@openclaw/msteams 2026.7.1 → 2026.7.2-beta.2

package/dist/{resolve-allowlist-Dnw4aNOu.js → resolve-allowlist-DXd097EP.cjs}

@@ -1,20 +1,66 @@
-import { t as getMSTeamsRuntime } from "./runtime-BS5AZrKK.js";
-import { fetchWithSsrFGuard as fetchWithSsrFGuard$1 } from "./runtime-api.js";
-import { createRequire } from "node:module";
-import { mapAllowlistResolutionInputs } from "openclaw/plugin-sdk/allow-from";
-import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
-import { isRecord as isRecord$1, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
-import { createProviderHttpError, readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
-import { Buffer } from "node:buffer";
-import { lookup } from "node:dns/promises";
-import { buildHostnameAllowlistPolicyFromSuffixAllowlist, isHttpsUrlAllowedByHostnameSuffixAllowlist, isPrivateIpAddress, normalizeHostnameSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
-import * as fs from "node:fs";
-import { readFileSync } from "node:fs";
-import path, { basename, dirname } from "node:path";
-import { isFutureDateTimestampMs, resolveExpiresAtMsFromDurationSeconds } from "openclaw/plugin-sdk/number-runtime";
-import { privateFileStoreSync } from "openclaw/plugin-sdk/security-runtime";
-import { hasConfiguredSecretInput, normalizeResolvedSecretInputString, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
+const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
+const require_runtime = require("./runtime-gZTAuFux.cjs");
+require("./runtime-api.cjs");
+let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
+let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
+let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
+let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
+let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
+let node_buffer = require("node:buffer");
+let node_dns_promises = require("node:dns/promises");
+let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy");
+let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
+let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
+let node_fs = require("node:fs");
+node_fs = require_rolldown_runtime.__toESM(node_fs, 1);
+let node_module = require("node:module");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let openclaw_plugin_sdk_security_runtime = require("openclaw/plugin-sdk/security-runtime");
+let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
+//#region extensions/msteams/src/request-timeout.ts
+const MSTEAMS_REQUEST_TIMEOUT_MS = 3e4;
+const MSTEAMS_SHAREPOINT_UPLOAD_BASE_TIMEOUT_MS = 5 * 6e4;
+const MSTEAMS_SHAREPOINT_UPLOAD_MIN_BYTES_PER_SECOND = 256 * 1024;
+const MSTEAMS_INBOUND_PREPROCESS_TIMEOUT_MS = 1e4;
+function createMSTeamsInboundDeadline() {
+	return (0, openclaw_plugin_sdk_provider_http.createProviderOperationDeadline)({
+		label: "MS Teams inbound preprocessing",
+		timeoutMs: MSTEAMS_INBOUND_PREPROCESS_TIMEOUT_MS
+	});
+}
+function resolveMSTeamsRequestTimeoutMs(deadline) {
+	return deadline ? (0, openclaw_plugin_sdk_provider_http.resolveProviderOperationTimeoutMs)({
+		deadline,
+		defaultTimeoutMs: MSTEAMS_REQUEST_TIMEOUT_MS
+	}) : MSTEAMS_REQUEST_TIMEOUT_MS;
+}
+/** Bound non-abortable SDK and credential work to the same operation deadline as fetches. */
+async function withMSTeamsRequestDeadline(params) {
+	const timeoutMs = resolveMSTeamsRequestTimeoutMs(params.deadline);
+	return await (0, openclaw_plugin_sdk_text_utility_runtime.withTimeout)(params.work(), timeoutMs, params.label);
+}
+function resolveMSTeamsSharePointUploadTimeoutMs(sizeInBytes) {
+	const transferBudgetMs = Math.ceil((Number.isFinite(sizeInBytes) && sizeInBytes > 0 ? Math.ceil(sizeInBytes) : 0) / MSTEAMS_SHAREPOINT_UPLOAD_MIN_BYTES_PER_SECOND * 1e3);
+	return (0, openclaw_plugin_sdk_number_runtime.resolveTimerTimeoutMs)(MSTEAMS_SHAREPOINT_UPLOAD_BASE_TIMEOUT_MS + transferBudgetMs, MSTEAMS_SHAREPOINT_UPLOAD_BASE_TIMEOUT_MS, 1);
+}
+function createMSTeamsRequestTimeoutError(label, timeoutMs) {
+	const error = /* @__PURE__ */ new Error(`${label} timed out after ${timeoutMs}ms`);
+	error.name = "TimeoutError";
+	return error;
+}
+async function withMSTeamsAbortableRequestTimeout(params) {
+	const controller = new AbortController();
+	const timeoutMs = (0, openclaw_plugin_sdk_number_runtime.resolveTimerTimeoutMs)(params.timeoutMs, MSTEAMS_REQUEST_TIMEOUT_MS, 1);
+	const work = Promise.resolve().then(() => params.work(controller.signal));
+	try {
+		return await (0, openclaw_plugin_sdk_text_utility_runtime.withTimeout)(work, timeoutMs, { createError: () => createMSTeamsRequestTimeoutError(params.label, timeoutMs) });
+	} catch (error) {
+		controller.abort(error);
+		throw error;
+	}
+}
+//#endregion
 //#region extensions/msteams/src/response-with-release.ts
 const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
 	101,
@@ -147,7 +193,7 @@ const GRAPH_SHARED_LINK_HOST_SUFFIXES = [
 function isGraphSharedLinkUrl(url) {
 	let host;
 	try {
-		host = normalizeLowercaseStringOrEmpty(new URL(url).hostname);
+		host = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(new URL(url).hostname);
 	} catch {
 		return false;
 	}
@@ -160,7 +206,7 @@ function isGraphSharedLinkUrl(url) {
 * https://learn.microsoft.com/en-us/graph/api/shares-get#encoding-sharing-urls
 */
 function encodeGraphShareId(url) {
-	return `u!${Buffer.from(url, "utf8").toString("base64url")}`;
+	return `u!${node_buffer.Buffer.from(url, "utf8").toString("base64url")}`;
 }
 /**
 * When `url` is a SharePoint/OneDrive shared link, return the matching
@@ -172,14 +218,6 @@ function tryBuildGraphSharesUrlForSharedLink(url) {
 	if (!isGraphSharedLinkUrl(url)) return;
 	return `${GRAPH_ROOT}/shares/${encodeGraphShareId(url)}/driveItem/content`;
 }
-function readNestedString(value, keys) {
-	let current = value;
-	for (const key of keys) {
-		if (!isRecord$1(current)) return;
-		current = current[key];
-	}
-	return normalizeOptionalString(current);
-}
 function resolveRequestUrl(input) {
 	if (typeof input === "string") return input;
 	if (input instanceof URL) return input.toString();
@@ -191,14 +229,16 @@ function resolveRequestUrl(input) {
 	}
 }
 function normalizeContentType(value) {
-	if (typeof value !== "string") return;
-	const trimmed = value.trim();
-	return trimmed ? trimmed : void 0;
+	const trimmed = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(value);
+	if (!trimmed) return;
+	const parameterIndex = trimmed.indexOf(";");
+	if (parameterIndex === -1) return trimmed.toLowerCase();
+	return `${trimmed.slice(0, parameterIndex).trim().toLowerCase()}${trimmed.slice(parameterIndex)}`;
 }
 function inferPlaceholder(params) {
-	const mime = normalizeLowercaseStringOrEmpty(params.contentType ?? "");
-	const name = normalizeLowercaseStringOrEmpty(params.fileName ?? "");
-	const fileType = normalizeLowercaseStringOrEmpty(params.fileType ?? "");
+	const mime = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.contentType ?? "");
+	const name = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.fileName ?? "");
+	const fileType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.fileType ?? "");
 	return mime.startsWith("image/") || IMAGE_EXT_RE.test(name) || IMAGE_EXT_RE.test(`x.${fileType}`) ? "<media:image>" : "<media:document>";
 }
 function isLikelyImageAttachment(att) {
@@ -206,7 +246,7 @@ function isLikelyImageAttachment(att) {
 	const name = typeof att.name === "string" ? att.name : "";
 	if (contentType.startsWith("image/")) return true;
 	if (IMAGE_EXT_RE.test(name)) return true;
-	if (contentType === "application/vnd.microsoft.teams.file.download.info" && isRecord$1(att.content)) {
+	if (contentType === "application/vnd.microsoft.teams.file.download.info" && (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(att.content)) {
 		const fileType = typeof att.content.fileType === "string" ? att.content.fileType : "";
 		if (fileType && IMAGE_EXT_RE.test(`x.${fileType}`)) return true;
 		const fileName = typeof att.content.fileName === "string" ? att.content.fileName : "";
@@ -219,7 +259,7 @@ function isLikelyImageAttachment(att) {
 * Used when downloading all files, not just images.
 */
 function isDownloadableAttachment(att) {
-	if ((normalizeContentType(att.contentType) ?? "") === "application/vnd.microsoft.teams.file.download.info" && isRecord$1(att.content) && typeof att.content.downloadUrl === "string") return true;
+	if ((normalizeContentType(att.contentType) ?? "") === "application/vnd.microsoft.teams.file.download.info" && (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(att.content) && typeof att.content.downloadUrl === "string") return true;
 	if (typeof att.contentUrl === "string" && att.contentUrl.trim()) return true;
 	return false;
 }
@@ -229,7 +269,7 @@ function isHtmlAttachment(att) {
 function extractHtmlFromAttachment(att) {
 	if (!isHtmlAttachment(att)) return;
 	if (typeof att.content === "string") return att.content;
-	if (!isRecord$1(att.content)) return;
+	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(att.content)) return;
 	return typeof att.content.text === "string" ? att.content.text : typeof att.content.body === "string" ? att.content.body : typeof att.content.content === "string" ? att.content.content : void 0;
 }
 function canonicalizeInlineBase64Payload(value) {
@@ -257,7 +297,7 @@ function decodeDataImageWithLimits(src, opts) {
 		candidate: null,
 		estimatedBytes: 0
 	};
-	const contentType = normalizeLowercaseStringOrEmpty(match[1] ?? "");
+	const contentType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(match[1] ?? "");
 	if (!Boolean(match[2])) return {
 		candidate: null,
 		estimatedBytes: 0
@@ -280,7 +320,7 @@ function decodeDataImageWithLimits(src, opts) {
 		return {
 			candidate: {
 				kind: "data",
-				data: Buffer.from(canonicalPayload, "base64"),
+				data: node_buffer.Buffer.from(canonicalPayload, "base64"),
 				contentType,
 				placeholder: "<media:image>"
 			},
@@ -331,16 +371,16 @@ function extractInlineImageCandidates(attachments, limits) {
 }
 function safeHostForUrl(url) {
 	try {
-		return normalizeLowercaseStringOrEmpty(new URL(url).hostname);
+		return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(new URL(url).hostname);
 	} catch {
 		return "invalid-url";
 	}
 }
 function resolveAllowedHosts(input) {
-	return normalizeHostnameSuffixAllowlist(input, DEFAULT_MEDIA_HOST_ALLOWLIST);
+	return (0, openclaw_plugin_sdk_ssrf_policy.normalizeHostnameSuffixAllowlist)(input, DEFAULT_MEDIA_HOST_ALLOWLIST);
 }
 function resolveAuthAllowedHosts(input) {
-	return normalizeHostnameSuffixAllowlist(input, DEFAULT_MEDIA_AUTH_HOST_ALLOWLIST);
+	return (0, openclaw_plugin_sdk_ssrf_policy.normalizeHostnameSuffixAllowlist)(input, DEFAULT_MEDIA_AUTH_HOST_ALLOWLIST);
 }
 function isMockFetchFn(fetchFn) {
 	const candidate = fetchFn;
@@ -363,7 +403,7 @@ function resolveAttachmentFetchPolicy(params) {
 	};
 }
 function isUrlAllowed(url, allowlist) {
-	return isHttpsUrlAllowedByHostnameSuffixAllowlist(url, allowlist);
+	return (0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(url, allowlist);
 }
 function applyAuthorizationHeaderForUrl(params) {
 	if (!params.bearerToken) {
@@ -377,7 +417,7 @@ function applyAuthorizationHeaderForUrl(params) {
 	params.headers.delete("Authorization");
 }
 function resolveMediaSsrfPolicy(allowHosts) {
-	return buildHostnameAllowlistPolicyFromSuffixAllowlist(allowHosts);
+	return (0, openclaw_plugin_sdk_ssrf_policy.buildHostnameAllowlistPolicyFromSuffixAllowlist)(allowHosts);
 }
 /**
 * Returns true if the given IPv4 or IPv6 address is in a private, loopback,
@@ -387,13 +427,13 @@ function resolveMediaSsrfPolicy(allowHosts) {
 * expanded notation, NAT64, 6to4, Teredo, octal IPv4, and fails closed on
 * parse errors.
 */
-const isPrivateOrReservedIP = isPrivateIpAddress;
+const isPrivateOrReservedIP = openclaw_plugin_sdk_ssrf_policy.isPrivateIpAddress;
 /**
 * Resolve a hostname via DNS and reject private/reserved IPs.
 * Throws if the resolved IP is private or resolution fails.
 */
 async function resolveAndValidateIP(hostname, resolveFn) {
-	const resolve = resolveFn ?? lookup;
+	const resolve = resolveFn ?? node_dns_promises.lookup;
 	let resolved;
 	try {
 		resolved = await resolve(hostname);
@@ -414,14 +454,14 @@ const MAX_SAFE_REDIRECTS = 5;
 * - DNS rebinding attacks when a lookup function is provided
 */
 async function safeFetch(params) {
-	const resolveFn = params.resolveFn ?? lookup;
+	const resolveFn = params.resolveFn ?? node_dns_promises.lookup;
 	const hasDispatcher = Boolean(params.requestInit && typeof params.requestInit === "object" && "dispatcher" in params.requestInit);
 	const currentHeaders = new Headers(params.requestInit?.headers);
 	let currentUrl = params.url;
 	if (!isUrlAllowed(currentUrl, params.allowHosts)) throw new Error(`Initial download URL blocked: ${currentUrl}`);
 	if (currentHeaders.has("authorization") && params.authorizationAllowHosts && !isUrlAllowed(currentUrl, params.authorizationAllowHosts)) currentHeaders.delete("authorization");
 	if (!hasDispatcher) {
-		const guarded = await fetchWithSsrFGuard({
+		const guarded = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 			url: currentUrl,
 			fetchImpl: resolveGuardedFetchImpl({
 				fetchFn: params.fetchFn,
@@ -436,7 +476,8 @@ async function safeFetch(params) {
 			policy: resolveMediaSsrfPolicy(params.allowHosts),
 			lookupFn: resolveFn,
 			retainAuthorizationRedirectHostnameAllowlist: resolveRetainedAuthorizationRedirectHostnameAllowlist(params.authorizationAllowHosts),
-			auditContext: "msteams.attachment"
+			auditContext: "msteams.attachment",
+			timeoutMs: params.timeoutMs ?? 3e4
 		});
 		return responseWithRelease(guarded.response, guarded.release);
 	}
@@ -486,7 +527,8 @@ async function safeFetchWithPolicy(params) {
 		fetchFn: params.fetchFn,
 		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 		requestInit: params.requestInit,
-		resolveFn: params.resolveFn
+		resolveFn: params.resolveFn,
+		timeoutMs: params.timeoutMs
 	});
 }
 //#endregion
@@ -549,11 +591,11 @@ function validateMSTeamsProactiveServiceUrlBoundary(params) {
 //#endregion
 //#region extensions/msteams/src/http-error.ts
 async function createMSTeamsHttpError(response, label, options) {
-	return await createProviderHttpError(response, label, options);
+	return await (0, openclaw_plugin_sdk_provider_http.createProviderHttpError)(response, label, options);
 }
 //#endregion
 //#region extensions/msteams/src/bot-framework-service-url.ts
-const BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST = normalizeHostnameSuffixAllowlist([
+const BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST = (0, openclaw_plugin_sdk_ssrf_policy.normalizeHostnameSuffixAllowlist)([
 	"smba.trafficmanager.net",
 	"smba.infra.gcc.teams.microsoft.com",
 	"smba.infra.gov.teams.microsoft.us",
@@ -570,7 +612,7 @@ function describeBotFrameworkServiceUrlHost(serviceUrl) {
 function isAllowedBotFrameworkServiceUrl(serviceUrl) {
 	if (typeof serviceUrl !== "string") return false;
 	const trimmed = serviceUrl.trim();
-	return Boolean(trimmed && isHttpsUrlAllowedByHostnameSuffixAllowlist(trimmed, BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST));
+	return Boolean(trimmed && (0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(trimmed, BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST));
 }
 function tryNormalizeBotFrameworkServiceUrl(serviceUrl) {
 	if (!isAllowedBotFrameworkServiceUrl(serviceUrl)) return;
@@ -586,18 +628,28 @@ function normalizeBotFrameworkServiceUrl(serviceUrl) {
 let cachedUserAgent;
 function resolveTeamsSdkVersion() {
 	try {
-		return createRequire(import.meta.url)("@microsoft/teams.apps/package.json").version ?? "unknown";
+		return (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href)("@microsoft/teams.apps/package.json").version ?? "unknown";
 	} catch {
 		return "unknown";
 	}
 }
 function resolveOpenClawVersion() {
 	try {
-		return getMSTeamsRuntime().version;
+		return require_runtime.getMSTeamsRuntime().version;
 	} catch {
 		return "unknown";
 	}
 }
+/**
+* Build a combined User-Agent string that preserves the Teams SDK identity
+* and appends the OpenClaw version.
+*
+* Format: "teams.ts[apps]/<sdk-version> OpenClaw/<openclaw-version>"
+* Example: "teams.ts[apps]/2.0.5 OpenClaw/2026.3.22"
+*
+* This lets the Teams backend track SDK usage while also identifying the
+* host application.
+*/
 function buildUserAgent() {
 	if (cachedUserAgent) return cachedUserAgent;
 	cachedUserAgent = `teams.ts[apps]/${resolveTeamsSdkVersion()} OpenClaw/${resolveOpenClawVersion()}`;
@@ -622,8 +674,8 @@ function ensureUserAgentHeader(headers) {
 //#endregion
 //#region extensions/msteams/src/sdk.ts
 const AZURE_IDENTITY_MODULE = "@azure/identity";
-const loadAzureIdentity = createLazyRuntimeModule(() => import(AZURE_IDENTITY_MODULE));
-const loadSdkModules = createLazyRuntimeModule(() => Promise.all([import("@microsoft/teams.apps"), import("@microsoft/teams.api")]).then(([apps, api]) => ({
+const loadAzureIdentity = (0, openclaw_plugin_sdk_lazy_runtime.createLazyRuntimeModule)(() => import(AZURE_IDENTITY_MODULE));
+const loadSdkModules = (0, openclaw_plugin_sdk_lazy_runtime.createLazyRuntimeModule)(() => Promise.all([import("@microsoft/teams.apps"), import("@microsoft/teams.api")]).then(([apps, api]) => ({
 	App: apps.App,
 	ExpressAdapter: apps.ExpressAdapter,
 	cloudFromName: api.cloudFromName
@@ -652,7 +704,10 @@ async function createMSTeamsApp(creds, options) {
 	const cloud = options?.cloud ?? "Public";
 	const serviceUrl = options?.serviceUrl ? normalizeBotFrameworkServiceUrl(options.serviceUrl) : void 0;
 	const appOptions = {
-		client: options?.httpClient ?? { headers: { "User-Agent": buildOpenClawUserAgentFragment() } },
+		client: options?.httpClient ?? {
+			headers: { "User-Agent": buildOpenClawUserAgentFragment() },
+			timeout: 3e4
+		},
 		...options?.httpServerAdapter ? { httpServerAdapter: options.httpServerAdapter } : {},
 		...options?.messagingEndpoint ? { messagingEndpoint: options.messagingEndpoint } : {},
 		cloud: cloudFromName(cloud),
@@ -677,7 +732,7 @@ function createFederatedApp(creds, App, appOptions) {
 	if (!creds.certificatePath) throw new Error("Federated credentials require either a certificate path or managed identity.");
 	let privateKey;
 	try {
-		privateKey = fs.readFileSync(creds.certificatePath, "utf-8");
+		privateKey = node_fs.readFileSync(creds.certificatePath, "utf-8");
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
 		throw new Error(`Failed to read certificate file at '${creds.certificatePath}': ${msg}`, { cause: err });
@@ -765,7 +820,7 @@ function createMSTeamsTokenBody(params) {
 	return body;
 }
 function resolveMSTeamsTokenExpiresAt(value) {
-	return resolveExpiresAtMsFromDurationSeconds(value, { bufferMs: EXPIRY_BUFFER_MS });
+	return (0, openclaw_plugin_sdk_number_runtime.resolveExpiresAtMsFromDurationSeconds)(value, { bufferMs: EXPIRY_BUFFER_MS });
 }
 function parseMSTeamsTokenResponse(data, failureLabel) {
 	const expiresAt = resolveMSTeamsTokenExpiresAt(data.expires_in);
@@ -778,10 +833,8 @@ function parseMSTeamsTokenResponse(data, failureLabel) {
 	};
 }
 async function fetchMSTeamsTokens(params) {
-	const currentFetch = globalThis.fetch;
-	const { response, release } = await fetchWithSsrFGuard({
+	const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 		url: params.tokenUrl,
-		fetchImpl: async (input, guardedInit) => await currentFetch(input, guardedInit),
 		init: {
 			method: "POST",
 			headers: {
@@ -795,7 +848,7 @@ async function fetchMSTeamsTokens(params) {
 	});
 	try {
 		if (!response.ok) throw await createMSTeamsHttpError(response, `MSTeams ${params.failureLabel} failed`);
-		return parseMSTeamsTokenResponse(await readProviderJsonResponse(response, `MSTeams ${params.failureLabel} failed`), params.failureLabel);
+		return parseMSTeamsTokenResponse(await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `MSTeams ${params.failureLabel} failed`), params.failureLabel);
 	} finally {
 		await release();
 	}
@@ -859,10 +912,10 @@ async function refreshMSTeamsDelegatedTokens(params) {
 //#region extensions/msteams/src/storage.ts
 function resolveMSTeamsStorePath(params) {
 	if (params.storePath) return params.storePath;
-	if (params.stateDir) return path.join(params.stateDir, params.filename);
+	if (params.stateDir) return node_path.default.join(params.stateDir, params.filename);
 	const env = params.env ?? process.env;
-	const stateDir = params.homedir ? getMSTeamsRuntime().state.resolveStateDir(env, params.homedir) : getMSTeamsRuntime().state.resolveStateDir(env);
-	return path.join(stateDir, params.filename);
+	const stateDir = params.homedir ? require_runtime.getMSTeamsRuntime().state.resolveStateDir(env, params.homedir) : require_runtime.getMSTeamsRuntime().state.resolveStateDir(env);
+	return node_path.default.join(stateDir, params.filename);
 }
 //#endregion
 //#region extensions/msteams/src/token.ts
@@ -874,19 +927,19 @@ function resolveAuthType(cfg) {
 }
 function hasConfiguredMSTeamsCredentials(cfg) {
 	const authType = resolveAuthType(cfg);
-	const hasAppId = Boolean(normalizeSecretInputString(cfg?.appId) || normalizeSecretInputString(process.env.MSTEAMS_APP_ID));
-	const hasTenantId = Boolean(normalizeSecretInputString(cfg?.tenantId) || normalizeSecretInputString(process.env.MSTEAMS_TENANT_ID));
+	const hasAppId = Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_ID));
+	const hasTenantId = Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_TENANT_ID));
 	if (authType === "federated") {
 		const hasCert = Boolean(cfg?.certificatePath || process.env.MSTEAMS_CERTIFICATE_PATH);
 		const hasManagedIdentity = cfg?.useManagedIdentity ?? process.env.MSTEAMS_USE_MANAGED_IDENTITY === "true";
 		return hasAppId && hasTenantId && (hasCert || hasManagedIdentity);
 	}
-	return Boolean(normalizeSecretInputString(cfg?.appId) && hasConfiguredSecretInput(cfg?.appPassword) && normalizeSecretInputString(cfg?.tenantId));
+	return Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) && (0, openclaw_plugin_sdk_secret_input.hasConfiguredSecretInput)(cfg?.appPassword) && (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId));
 }
 function resolveMSTeamsCredentials(cfg) {
 	const authType = resolveAuthType(cfg);
-	const appId = normalizeSecretInputString(cfg?.appId) || normalizeSecretInputString(process.env.MSTEAMS_APP_ID);
-	const tenantId = normalizeSecretInputString(cfg?.tenantId) || normalizeSecretInputString(process.env.MSTEAMS_TENANT_ID);
+	const appId = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_ID);
+	const tenantId = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_TENANT_ID);
 	if (!appId || !tenantId) return;
 	if (authType === "federated") {
 		const certificatePath = cfg?.certificatePath || process.env.MSTEAMS_CERTIFICATE_PATH || void 0;
@@ -904,10 +957,10 @@ function resolveMSTeamsCredentials(cfg) {
 			managedIdentityClientId
 		};
 	}
-	const appPassword = normalizeResolvedSecretInputString({
+	const appPassword = (0, openclaw_plugin_sdk_secret_input.normalizeResolvedSecretInputString)({
 		value: cfg?.appPassword,
 		path: "channels.msteams.appPassword"
-	}) || normalizeSecretInputString(process.env.MSTEAMS_APP_PASSWORD);
+	}) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_PASSWORD);
 	if (!appPassword) return;
 	return {
 		type: "secret",
@@ -922,7 +975,7 @@ function resolveDelegatedTokenPath() {
 }
 function loadDelegatedTokens() {
 	try {
-		const content = readFileSync(resolveDelegatedTokenPath(), "utf8");
+		const content = (0, node_fs.readFileSync)(resolveDelegatedTokenPath(), "utf8");
 		return JSON.parse(content);
 	} catch {
 		return;
@@ -930,12 +983,12 @@ function loadDelegatedTokens() {
 }
 function saveDelegatedTokens(tokens) {
 	const tokenPath = resolveDelegatedTokenPath();
-	privateFileStoreSync(dirname(tokenPath)).writeJson(basename(tokenPath), tokens);
+	(0, openclaw_plugin_sdk_security_runtime.privateFileStoreSync)((0, node_path.dirname)(tokenPath)).writeJson((0, node_path.basename)(tokenPath), tokens);
 }
 async function resolveDelegatedAccessToken(params) {
 	const tokens = loadDelegatedTokens();
 	if (!tokens) return;
-	if (isFutureDateTimestampMs(tokens.expiresAt)) return tokens.accessToken;
+	if ((0, openclaw_plugin_sdk_number_runtime.isFutureDateTimestampMs)(tokens.expiresAt)) return tokens.accessToken;
 	try {
 		const refreshed = await refreshMSTeamsDelegatedTokens({
 			tenantId: params.tenantId,
@@ -961,11 +1014,8 @@ function escapeOData(value) {
 }
 async function requestGraph(params) {
 	const hasBody = params.body !== void 0;
-	const url = `${params.root ?? "https://graph.microsoft.com/v1.0"}${params.path}`;
-	const currentFetch = globalThis.fetch;
-	const { response, release } = await fetchWithSsrFGuard$1({
-		url,
-		fetchImpl: async (input, guardedInit) => await currentFetch(input, guardedInit),
+	const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
+		url: `${params.root ?? "https://graph.microsoft.com/v1.0"}${params.path}`,
 		init: {
 			method: params.method,
 			headers: {
@@ -976,7 +1026,8 @@ async function requestGraph(params) {
 			},
 			body: hasBody ? JSON.stringify(params.body) : void 0
 		},
-		auditContext: "msteams.graph"
+		auditContext: "msteams.graph",
+		timeoutMs: resolveMSTeamsRequestTimeoutMs(params.deadline)
 	});
 	let releaseInFinally = true;
 	try {
@@ -989,7 +1040,7 @@ async function requestGraph(params) {
 }
 async function readOptionalGraphJson(res, label) {
 	if (res.status === 204 || res.headers?.get?.("content-length") === "0") return;
-	return await readProviderJsonResponse(res, label);
+	return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, label);
 }
 async function fetchGraphJson(params) {
 	return await readOptionalGraphJson(await requestGraph({
@@ -997,7 +1048,8 @@ async function fetchGraphJson(params) {
 		path: params.path,
 		method: params.method,
 		body: params.body,
-		headers: params.headers
+		headers: params.headers,
+		deadline: params.deadline
 	}), `Graph ${params.path} failed`);
 }
 /**
@@ -1005,18 +1057,19 @@ async function fetchGraphJson(params) {
 * pagination URLs) without prepending GRAPH_ROOT.
 */
 async function fetchGraphAbsoluteUrl(params) {
-	const { response, release } = await fetchWithSsrFGuard$1({
+	const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 		url: params.url,
 		init: { headers: {
 			"User-Agent": buildUserAgent(),
 			Authorization: `Bearer ${params.token}`,
 			...params.headers
 		} },
-		auditContext: "msteams.graph.absolute"
+		auditContext: "msteams.graph.absolute",
+		timeoutMs: MSTEAMS_REQUEST_TIMEOUT_MS
 	});
 	try {
 		if (!response.ok) throw await createMSTeamsHttpError(response, `Graph ${params.url} failed`);
-		return await readProviderJsonResponse(response, `Graph ${params.url} failed`);
+		return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `Graph ${params.url} failed`);
 	} finally {
 		await release();
 	}
@@ -1076,13 +1129,14 @@ async function resolveGraphToken(cfg, options) {
 	return accessToken;
 }
 async function listTeamsByName(token, query) {
+	return (await listTeamsByNameWithPageInfo(token, query)).items;
+}
+async function listTeamsByNameWithPageInfo(token, query) {
 	const filter = `resourceProvisioningOptions/Any(x:x eq 'Team') and startsWith(displayName,'${escapeOData(query)}')`;
-	const { items } = await fetchAllGraphPages({
+	return await fetchAllGraphPages({
 		token,
-		path: `/groups?$filter=${encodeURIComponent(filter)}&$select=id,displayName`,
-		maxPages: 5
+		path: `/groups?$filter=${encodeURIComponent(filter)}&$select=id,displayName`
 	});
-	return items;
 }
 async function postGraphJson(params) {
 	return readOptionalGraphJson(await requestGraph({
@@ -1121,12 +1175,13 @@ async function patchGraphJson(params) {
 	}), `Graph PATCH ${params.path} failed`);
 }
 async function listChannelsForTeam(token, teamId) {
-	const { items } = await fetchAllGraphPages({
+	return (await listChannelsForTeamWithPageInfo(token, teamId)).items;
+}
+async function listChannelsForTeamWithPageInfo(token, teamId) {
+	return await fetchAllGraphPages({
 		token,
-		path: `/teams/${encodeURIComponent(teamId)}/channels?$select=id,displayName`,
-		maxPages: 10
+		path: `/teams/${encodeURIComponent(teamId)}/channels?$select=id,displayName`
 	});
-	return items;
 }
 //#endregion
 //#region extensions/msteams/src/graph-users.ts
@@ -1150,8 +1205,64 @@ async function searchGraphUsers(params) {
 		headers: { ConsistencyLevel: "eventual" }
 	})).value ?? [];
 }
+async function findGraphUsersByExactIdentity(params) {
+	const query = params.query.trim();
+	if (!query) return {
+		items: [],
+		truncated: false
+	};
+	const escaped = escapeOData(query);
+	const filter = `(displayName eq '${escaped}' or mail eq '${escaped}' or userPrincipalName eq '${escaped}')`;
+	const path = `/users?$filter=${encodeURIComponent(filter)}&\$select=id,displayName,mail,userPrincipalName`;
+	return await fetchAllGraphPages({
+		token: params.token,
+		path
+	});
+}
 //#endregion
 //#region extensions/msteams/src/resolve-allowlist.ts
+function normalizeExactMatch(value) {
+	return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(value ?? "");
+}
+function uniqueItemsById(items) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const id = item.id?.trim();
+		if (id && !byId.has(id)) byId.set(id, item);
+	}
+	return [...byId.values()];
+}
+function findExactTeams(items, query) {
+	const normalized = normalizeExactMatch(query);
+	return uniqueItemsById(items.filter((item) => normalizeExactMatch(item.displayName) === normalized));
+}
+function findExactChannels(items, query) {
+	const normalized = normalizeExactMatch(query);
+	return uniqueItemsById(items.filter((item) => normalizeExactMatch(item.displayName) === normalized));
+}
+function findExactUsers(items, query) {
+	const normalized = normalizeExactMatch(query);
+	return uniqueItemsById(items.filter((item) => [
+		item.displayName,
+		item.mail,
+		item.userPrincipalName
+	].some((value) => normalizeExactMatch(value) === normalized)));
+}
+function isStableMSTeamsUserId(raw) {
+	return /^[0-9a-fA-F-]{16,}$/.test(normalizeMSTeamsUserInput(raw));
+}
+function normalizeStaticMSTeamsAllowEntry(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return;
+	if (trimmed === "*" || /^accessGroup:/i.test(trimmed)) return trimmed;
+	const id = normalizeMSTeamsUserInput(trimmed);
+	return isStableMSTeamsUserId(id) ? id : void 0;
+}
+function projectStableMSTeamsUserAllowlist(entries) {
+	if (!entries) return;
+	const projected = entries.map((entry) => normalizeStaticMSTeamsAllowEntry(entry)).filter((entry) => Boolean(entry));
+	return [...new Map(projected.map((entry) => [normalizeExactMatch(entry), entry])).values()];
+}
 function stripProviderPrefix(raw) {
 	return raw.replace(/^(msteams|teams):/i, "");
 }
@@ -1178,37 +1289,39 @@ function parseMSTeamsConversationId(raw) {
 	return trimmed.slice(13).trim();
 }
 /**
-* Detect whether a raw target string looks like a Microsoft Teams conversation
-* or user id that cron announce delivery and other explicit-target paths can
-* forward verbatim to the channel adapter.
+* Detect whether a raw target string is a supported Microsoft Teams
+* conversation id.
 *
 * Accepts both prefixed and bare formats:
 * - `conversation:<id>` — explicit conversation prefix
-* - `user:<aad-guid>`   — user id (16+ hex chars, UUID-like)
 * - `19:abc@thread.tacv2` / `19:abc@thread.skype` — channel / legacy group
 * - `19:{userId}_{appId}@unq.gbl.spaces` — Graph 1:1 chat thread format
 * - `a:1xxx` — Bot Framework personal (1:1) chat id
 * - `8:orgid:xxx` — Bot Framework org-scoped personal chat id
-* - `29:xxx` — Bot Framework user id
-*
-* Display-name user targets such as `user:John Smith` intentionally return
-* false so that the Graph API directory lookup still runs for them.
 */
-function looksLikeMSTeamsTargetId(raw) {
+function looksLikeMSTeamsConversationId(raw) {
 	const trimmed = raw.trim();
 	if (!trimmed) return false;
 	if (/^conversation:/i.test(trimmed)) return true;
-	if (/^user:/i.test(trimmed)) {
-		const id = trimmed.slice(5).trim();
-		return /^[0-9a-fA-F-]{16,}$/.test(id);
-	}
 	if (/^19:.+@thread\.(tacv2|skype)$/i.test(trimmed)) return true;
 	if (/^19:.+@unq\.gbl\.spaces$/i.test(trimmed)) return true;
 	if (/^a:1[A-Za-z0-9_-]+$/i.test(trimmed)) return true;
 	if (/^8:orgid:[A-Za-z0-9-]+$/i.test(trimmed)) return true;
-	if (/^29:[A-Za-z0-9_-]+$/i.test(trimmed)) return true;
 	return /@thread\b/i.test(trimmed);
 }
+/**
+* Detect conversation ids plus stable user ids that explicit-target delivery
+* can forward verbatim to the channel adapter.
+*/
+function looksLikeMSTeamsTargetId(raw) {
+	const trimmed = raw.trim();
+	if (looksLikeMSTeamsConversationId(trimmed)) return true;
+	if (/^user:/i.test(trimmed)) {
+		const id = trimmed.slice(5).trim();
+		return /^[0-9a-fA-F-]{16,}$/.test(id);
+	}
+	return /^29:[A-Za-z0-9_-]+$/i.test(trimmed);
+}
 function normalizeMSTeamsTeamKey(raw) {
 	return stripProviderPrefix(raw).replace(/^team:/i, "").trim() || void 0;
 }
@@ -1223,6 +1336,33 @@ function looksLikeMSTeamsThreadConversationId(raw) {
 	const normalized = normalizeMSTeamsConversationTargetId(raw);
 	return /^19:.+@thread\./i.test(normalized);
 }
+function isStableMSTeamsTeamKey(raw) {
+	return /^[0-9a-fA-F-]{16,}$/.test(raw.trim()) || looksLikeMSTeamsThreadConversationId(raw);
+}
+function projectStableMSTeamsChannels(channels) {
+	const projected = {};
+	for (const [channelKey, channelConfig] of Object.entries(channels ?? {})) {
+		if (channelKey === "*") {
+			projected[channelKey] = channelConfig;
+			continue;
+		}
+		if (looksLikeMSTeamsThreadConversationId(channelKey)) projected[normalizeMSTeamsConversationTargetId(channelKey)] = channelConfig;
+	}
+	return projected;
+}
+function projectStableMSTeamsTeamsConfig(teams) {
+	if (!teams) return;
+	const projected = {};
+	for (const [teamKey, teamConfig] of Object.entries(teams)) {
+		if (teamKey !== "*" && !isStableMSTeamsTeamKey(teamKey)) continue;
+		const stableKey = teamKey === "*" ? teamKey : normalizeMSTeamsConversationTargetId(teamKey);
+		projected[stableKey] = {
+			...teamConfig,
+			channels: projectStableMSTeamsChannels(teamConfig.channels)
+		};
+	}
+	return projected;
+}
 function parseMSTeamsTeamChannelInput(raw) {
 	const trimmed = stripProviderPrefix(raw).trim();
 	if (!trimmed) return {};
@@ -1248,7 +1388,7 @@ async function resolveMSTeamsChannelAllowlist(params) {
 		tokenPromise ??= resolveGraphToken(params.cfg);
 		return tokenPromise;
 	};
-	return await mapAllowlistResolutionInputs({
+	return await (0, openclaw_plugin_sdk_allow_from.mapAllowlistResolutionInputs)({
 		inputs: params.entries,
 		mapInput: async (input) => {
 			const { team, channel } = parseMSTeamsTeamChannelInput(input);
@@ -1282,16 +1422,32 @@ async function resolveMSTeamsChannelAllowlist(params) {
 				};
 			}
 			const token = await getToken();
-			const teams = /^[0-9a-fA-F-]{16,}$/.test(team) ? [{
+			let teamMatch;
+			if (/^[0-9a-fA-F-]{16,}$/.test(team)) teamMatch = {
 				id: team,
 				displayName: team
-			}] : await listTeamsByName(token, team);
-			if (teams.length === 0) return {
-				input,
-				resolved: false,
-				note: "team not found"
 			};
-			const teamMatch = teams[0];
+			else {
+				const result = await listTeamsByNameWithPageInfo(token, team);
+				if (result.truncated) return {
+					input,
+					resolved: false,
+					note: "team lookup incomplete"
+				};
+				const exactTeams = findExactTeams(result.items, team);
+				const [exactTeam] = exactTeams;
+				if (!exactTeam) return {
+					input,
+					resolved: false,
+					note: "team not found"
+				};
+				if (exactTeams.length > 1) return {
+					input,
+					resolved: false,
+					note: "team name is ambiguous"
+				};
+				teamMatch = exactTeam;
+			}
 			const graphTeamId = teamMatch.id?.trim();
 			const teamName = teamMatch.displayName?.trim() || team;
 			if (!graphTeamId) return {
@@ -1299,40 +1455,158 @@ async function resolveMSTeamsChannelAllowlist(params) {
 				resolved: false,
 				note: "team id missing"
 			};
-			let teamChannels = [];
+			if (!(params.teamIdMode !== "graph" || Boolean(channel))) return {
+				input,
+				resolved: true,
+				teamId: graphTeamId,
+				graphTeamId,
+				teamName
+			};
+			let teamChannels;
 			try {
-				teamChannels = await listChannelsForTeam(token, graphTeamId);
-			} catch {}
-			const teamId = teamChannels.find((ch) => normalizeOptionalLowercaseString(ch.displayName) === "general")?.id?.trim() || graphTeamId;
+				const result = await listChannelsForTeamWithPageInfo(token, graphTeamId);
+				if (result.truncated) return {
+					input,
+					resolved: false,
+					note: "channel lookup incomplete"
+				};
+				teamChannels = result.items;
+			} catch {
+				return {
+					input,
+					resolved: false,
+					note: "channel lookup failed"
+				};
+			}
+			const generalChannels = findExactChannels(teamChannels, "general");
+			if (params.teamIdMode !== "graph" && generalChannels.length !== 1) return {
+				input,
+				resolved: false,
+				graphTeamId,
+				teamName,
+				note: generalChannels.length > 1 ? "General channel is ambiguous" : "General channel not found"
+			};
+			const teamId = generalChannels[0]?.id?.trim() || graphTeamId;
 			if (!channel) return {
 				input,
 				resolved: true,
 				teamId,
-				teamName,
-				note: teams.length > 1 ? "multiple teams; chose first" : void 0
+				graphTeamId,
+				teamName
 			};
-			const normalizedChannel = normalizeOptionalLowercaseString(channel);
-			const channelMatch = teamChannels.find((item) => item.id === channel) ?? teamChannels.find((item) => normalizeOptionalLowercaseString(item.displayName) === normalizedChannel) ?? teamChannels.find((item) => normalizeLowercaseStringOrEmpty(item.displayName ?? "").includes(normalizedChannel ?? ""));
-			if (!channelMatch?.id) return {
+			const channelById = teamChannels.find((item) => item.id === channel);
+			const exactChannels = channelById ? [channelById] : findExactChannels(teamChannels, channel);
+			if (exactChannels.length === 0) return {
 				input,
 				resolved: false,
 				note: "channel not found"
 			};
+			if (exactChannels.length > 1) return {
+				input,
+				resolved: false,
+				note: "channel name is ambiguous"
+			};
+			const channelMatch = exactChannels[0];
+			if (!channelMatch?.id) return {
+				input,
+				resolved: false,
+				note: "channel id missing"
+			};
 			return {
 				input,
 				resolved: true,
 				teamId,
+				graphTeamId,
 				teamName,
 				channelId: channelMatch.id,
-				channelName: channelMatch.displayName ?? channel,
-				note: teamChannels.length > 1 ? "multiple channels; chose first" : void 0
+				channelName: channelMatch.displayName ?? channel
+			};
+		}
+	});
+}
+async function resolveMSTeamsTeamsConfig(params) {
+	const entries = [];
+	const unresolved = [];
+	for (const [teamKey, teamCfg] of Object.entries(params.teams)) {
+		if (teamKey === "*") {
+			for (const channelKey of Object.keys(teamCfg?.channels ?? {})) if (channelKey !== "*" && !looksLikeMSTeamsThreadConversationId(channelKey)) unresolved.push(`${teamKey}/${channelKey}`);
+			continue;
+		}
+		const channelKeys = Object.keys(teamCfg?.channels ?? {}).filter((key) => key !== "*");
+		if (channelKeys.length === 0) {
+			entries.push({
+				input: teamKey,
+				teamKey
+			});
+			continue;
+		}
+		for (const channelKey of channelKeys) entries.push({
+			input: `${teamKey}/${channelKey}`,
+			teamKey,
+			channelKey
+		});
+	}
+	if (entries.length === 0) return {
+		teams: projectStableMSTeamsTeamsConfig(params.teams) ?? {},
+		mapping: [],
+		unresolved
+	};
+	const resolved = await resolveMSTeamsChannelAllowlist({
+		cfg: params.cfg,
+		entries: entries.map((entry) => entry.input),
+		teamIdMode: params.teamIdMode
+	});
+	const mapping = [];
+	const teams = projectStableMSTeamsTeamsConfig(params.teams) ?? {};
+	resolved.forEach((entry, index) => {
+		const source = entries[index];
+		if (!source) return;
+		const sourceTeam = params.teams[source.teamKey] ?? {};
+		const resolvedTeamId = params.teamIdMode === "graph" ? entry.graphTeamId : entry.teamId;
+		if (!entry.resolved || !resolvedTeamId) {
+			unresolved.push(entry.input);
+			return;
+		}
+		mapping.push(entry.channelId ? `${entry.input}→${resolvedTeamId}/${entry.channelId}` : `${entry.input}→${resolvedTeamId}`);
+		const existing = teams[resolvedTeamId] ?? {};
+		const { channels: _sourceChannels, ...sourceTeamPolicy } = sourceTeam;
+		const mergedChannels = {
+			...projectStableMSTeamsChannels(sourceTeam.channels),
+			...existing.channels
+		};
+		const mergedTeam = {
+			...sourceTeamPolicy,
+			...existing,
+			channels: mergedChannels
+		};
+		teams[resolvedTeamId] = mergedTeam;
+		if (source.channelKey && entry.channelId) {
+			const sourceChannel = sourceTeam.channels?.[source.channelKey];
+			if (sourceChannel) teams[resolvedTeamId] = {
+				...mergedTeam,
+				channels: {
+					...mergedChannels,
+					[entry.channelId]: {
+						...sourceChannel,
+						...mergedChannels?.[entry.channelId]
+					}
+				}
 			};
 		}
 	});
+	return {
+		teams,
+		mapping,
+		unresolved
+	};
 }
 async function resolveMSTeamsUserAllowlist(params) {
-	const token = await resolveGraphToken(params.cfg);
-	return await mapAllowlistResolutionInputs({
+	let tokenPromise;
+	const getToken = () => {
+		tokenPromise ??= resolveGraphToken(params.cfg);
+		return tokenPromise;
+	};
+	return await (0, openclaw_plugin_sdk_allow_from.mapAllowlistResolutionInputs)({
 		inputs: params.entries,
 		mapInput: async (input) => {
 			const query = normalizeQuery(normalizeMSTeamsUserInput(input));
@@ -1345,25 +1619,460 @@ async function resolveMSTeamsUserAllowlist(params) {
 				resolved: true,
 				id: query
 			};
-			const users = await searchGraphUsers({
-				token,
-				query,
-				top: 10
+			const result = await findGraphUsersByExactIdentity({
+				token: await getToken(),
+				query
 			});
-			const match = users[0];
-			if (!match?.id) return {
+			if (result.truncated) return {
 				input,
-				resolved: false
+				resolved: false,
+				note: "user lookup incomplete"
+			};
+			const users = findExactUsers(result.items, query);
+			const [match] = users;
+			if (!match) return {
+				input,
+				resolved: false,
+				note: "user not found"
+			};
+			if (users.length > 1) return {
+				input,
+				resolved: false,
+				note: "user identity is ambiguous"
 			};
 			return {
 				input,
 				resolved: true,
 				id: match.id,
-				name: match.displayName ?? void 0,
-				note: users.length > 1 ? "multiple matches; chose first" : void 0
+				name: match.displayName ?? void 0
 			};
 		}
 	});
 }
 //#endregion
-export { isDownloadableAttachment as $, MSTEAMS_OAUTH_REDIRECT_URI as A, normalizeBotFrameworkServiceUrl as B, resolveMSTeamsCredentials as C, MSTEAMS_DEFAULT_DELEGATED_SCOPES as D, exchangeMSTeamsCodeForTokens as E, loadMSTeamsSdkWithAuth as F, ATTACHMENT_TAG_RE as G, createMSTeamsHttpError as H, buildUserAgent as I, applyAuthorizationHeaderForUrl as J, GRAPH_ROOT as K, ensureUserAgentHeader as L, readAccessToken as M, createMSTeamsExpressAdapter as N, MSTEAMS_OAUTH_CALLBACK_PATH as O, createMSTeamsTokenProvider as P, inferPlaceholder as Q, describeBotFrameworkServiceUrlHost as R, loadDelegatedTokens as S, normalizeSecretInputString as T, resolveMSTeamsSdkCloudOptions as U, tryNormalizeBotFrameworkServiceUrl as V, validateMSTeamsProactiveServiceUrlBoundary as W, extractHtmlFromAttachment as X, encodeGraphShareId as Y, extractInlineImageCandidates as Z, patchGraphJson as _, parseMSTeamsTeamChannelInput as a, resolveAttachmentFetchPolicy as at, resolveGraphToken as b, resolveMSTeamsUserAllowlist as c, safeFetchWithPolicy as ct, escapeOData as d, isLikelyImageAttachment as et, fetchGraphAbsoluteUrl as f, normalizeQuery as g, listTeamsByName as h, parseMSTeamsConversationId as i, readNestedString as it, buildMSTeamsAuthEndpoint as j, MSTEAMS_OAUTH_CALLBACK_PORT as k, searchGraphUsers as l, safeHostForUrl as lt, listChannelsForTeam as m, normalizeMSTeamsMessagingTarget as n, isUrlAllowed as nt, parseMSTeamsTeamEntry as o, resolveMediaSsrfPolicy as ot, fetchGraphJson as p, IMG_SRC_RE as q, normalizeMSTeamsUserInput as r, normalizeContentType as rt, resolveMSTeamsChannelAllowlist as s, resolveRequestUrl as st, looksLikeMSTeamsTargetId as t, isRecord$1 as tt, deleteGraphRequest as u, tryBuildGraphSharesUrlForSharedLink as ut, postGraphBetaJson as v, saveDelegatedTokens as w, hasConfiguredMSTeamsCredentials as x, postGraphJson as y, isAllowedBotFrameworkServiceUrl as z };
+Object.defineProperty(exports, "ATTACHMENT_TAG_RE", {
+	enumerable: true,
+	get: function() {
+		return ATTACHMENT_TAG_RE;
+	}
+});
+Object.defineProperty(exports, "GRAPH_ROOT", {
+	enumerable: true,
+	get: function() {
+		return GRAPH_ROOT;
+	}
+});
+Object.defineProperty(exports, "IMG_SRC_RE", {
+	enumerable: true,
+	get: function() {
+		return IMG_SRC_RE;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_DEFAULT_DELEGATED_SCOPES", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DEFAULT_DELEGATED_SCOPES;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_OAUTH_CALLBACK_PATH", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_OAUTH_CALLBACK_PATH;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_OAUTH_CALLBACK_PORT", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_OAUTH_CALLBACK_PORT;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_OAUTH_REDIRECT_URI", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_OAUTH_REDIRECT_URI;
+	}
+});
+Object.defineProperty(exports, "applyAuthorizationHeaderForUrl", {
+	enumerable: true,
+	get: function() {
+		return applyAuthorizationHeaderForUrl;
+	}
+});
+Object.defineProperty(exports, "buildMSTeamsAuthEndpoint", {
+	enumerable: true,
+	get: function() {
+		return buildMSTeamsAuthEndpoint;
+	}
+});
+Object.defineProperty(exports, "buildUserAgent", {
+	enumerable: true,
+	get: function() {
+		return buildUserAgent;
+	}
+});
+Object.defineProperty(exports, "createMSTeamsExpressAdapter", {
+	enumerable: true,
+	get: function() {
+		return createMSTeamsExpressAdapter;
+	}
+});
+Object.defineProperty(exports, "createMSTeamsHttpError", {
+	enumerable: true,
+	get: function() {
+		return createMSTeamsHttpError;
+	}
+});
+Object.defineProperty(exports, "createMSTeamsInboundDeadline", {
+	enumerable: true,
+	get: function() {
+		return createMSTeamsInboundDeadline;
+	}
+});
+Object.defineProperty(exports, "createMSTeamsTokenProvider", {
+	enumerable: true,
+	get: function() {
+		return createMSTeamsTokenProvider;
+	}
+});
+Object.defineProperty(exports, "deleteGraphRequest", {
+	enumerable: true,
+	get: function() {
+		return deleteGraphRequest;
+	}
+});
+Object.defineProperty(exports, "describeBotFrameworkServiceUrlHost", {
+	enumerable: true,
+	get: function() {
+		return describeBotFrameworkServiceUrlHost;
+	}
+});
+Object.defineProperty(exports, "encodeGraphShareId", {
+	enumerable: true,
+	get: function() {
+		return encodeGraphShareId;
+	}
+});
+Object.defineProperty(exports, "ensureUserAgentHeader", {
+	enumerable: true,
+	get: function() {
+		return ensureUserAgentHeader;
+	}
+});
+Object.defineProperty(exports, "escapeOData", {
+	enumerable: true,
+	get: function() {
+		return escapeOData;
+	}
+});
+Object.defineProperty(exports, "exchangeMSTeamsCodeForTokens", {
+	enumerable: true,
+	get: function() {
+		return exchangeMSTeamsCodeForTokens;
+	}
+});
+Object.defineProperty(exports, "extractHtmlFromAttachment", {
+	enumerable: true,
+	get: function() {
+		return extractHtmlFromAttachment;
+	}
+});
+Object.defineProperty(exports, "extractInlineImageCandidates", {
+	enumerable: true,
+	get: function() {
+		return extractInlineImageCandidates;
+	}
+});
+Object.defineProperty(exports, "fetchGraphAbsoluteUrl", {
+	enumerable: true,
+	get: function() {
+		return fetchGraphAbsoluteUrl;
+	}
+});
+Object.defineProperty(exports, "fetchGraphJson", {
+	enumerable: true,
+	get: function() {
+		return fetchGraphJson;
+	}
+});
+Object.defineProperty(exports, "hasConfiguredMSTeamsCredentials", {
+	enumerable: true,
+	get: function() {
+		return hasConfiguredMSTeamsCredentials;
+	}
+});
+Object.defineProperty(exports, "inferPlaceholder", {
+	enumerable: true,
+	get: function() {
+		return inferPlaceholder;
+	}
+});
+Object.defineProperty(exports, "isAllowedBotFrameworkServiceUrl", {
+	enumerable: true,
+	get: function() {
+		return isAllowedBotFrameworkServiceUrl;
+	}
+});
+Object.defineProperty(exports, "isDownloadableAttachment", {
+	enumerable: true,
+	get: function() {
+		return isDownloadableAttachment;
+	}
+});
+Object.defineProperty(exports, "isLikelyImageAttachment", {
+	enumerable: true,
+	get: function() {
+		return isLikelyImageAttachment;
+	}
+});
+Object.defineProperty(exports, "isUrlAllowed", {
+	enumerable: true,
+	get: function() {
+		return isUrlAllowed;
+	}
+});
+Object.defineProperty(exports, "listChannelsForTeam", {
+	enumerable: true,
+	get: function() {
+		return listChannelsForTeam;
+	}
+});
+Object.defineProperty(exports, "listChannelsForTeamWithPageInfo", {
+	enumerable: true,
+	get: function() {
+		return listChannelsForTeamWithPageInfo;
+	}
+});
+Object.defineProperty(exports, "listTeamsByName", {
+	enumerable: true,
+	get: function() {
+		return listTeamsByName;
+	}
+});
+Object.defineProperty(exports, "loadDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return loadDelegatedTokens;
+	}
+});
+Object.defineProperty(exports, "loadMSTeamsSdkWithAuth", {
+	enumerable: true,
+	get: function() {
+		return loadMSTeamsSdkWithAuth;
+	}
+});
+Object.defineProperty(exports, "looksLikeMSTeamsConversationId", {
+	enumerable: true,
+	get: function() {
+		return looksLikeMSTeamsConversationId;
+	}
+});
+Object.defineProperty(exports, "looksLikeMSTeamsTargetId", {
+	enumerable: true,
+	get: function() {
+		return looksLikeMSTeamsTargetId;
+	}
+});
+Object.defineProperty(exports, "normalizeBotFrameworkServiceUrl", {
+	enumerable: true,
+	get: function() {
+		return normalizeBotFrameworkServiceUrl;
+	}
+});
+Object.defineProperty(exports, "normalizeContentType", {
+	enumerable: true,
+	get: function() {
+		return normalizeContentType;
+	}
+});
+Object.defineProperty(exports, "normalizeMSTeamsMessagingTarget", {
+	enumerable: true,
+	get: function() {
+		return normalizeMSTeamsMessagingTarget;
+	}
+});
+Object.defineProperty(exports, "normalizeMSTeamsUserInput", {
+	enumerable: true,
+	get: function() {
+		return normalizeMSTeamsUserInput;
+	}
+});
+Object.defineProperty(exports, "normalizeQuery", {
+	enumerable: true,
+	get: function() {
+		return normalizeQuery;
+	}
+});
+Object.defineProperty(exports, "parseMSTeamsConversationId", {
+	enumerable: true,
+	get: function() {
+		return parseMSTeamsConversationId;
+	}
+});
+Object.defineProperty(exports, "parseMSTeamsTeamChannelInput", {
+	enumerable: true,
+	get: function() {
+		return parseMSTeamsTeamChannelInput;
+	}
+});
+Object.defineProperty(exports, "parseMSTeamsTeamEntry", {
+	enumerable: true,
+	get: function() {
+		return parseMSTeamsTeamEntry;
+	}
+});
+Object.defineProperty(exports, "patchGraphJson", {
+	enumerable: true,
+	get: function() {
+		return patchGraphJson;
+	}
+});
+Object.defineProperty(exports, "postGraphBetaJson", {
+	enumerable: true,
+	get: function() {
+		return postGraphBetaJson;
+	}
+});
+Object.defineProperty(exports, "postGraphJson", {
+	enumerable: true,
+	get: function() {
+		return postGraphJson;
+	}
+});
+Object.defineProperty(exports, "projectStableMSTeamsTeamsConfig", {
+	enumerable: true,
+	get: function() {
+		return projectStableMSTeamsTeamsConfig;
+	}
+});
+Object.defineProperty(exports, "projectStableMSTeamsUserAllowlist", {
+	enumerable: true,
+	get: function() {
+		return projectStableMSTeamsUserAllowlist;
+	}
+});
+Object.defineProperty(exports, "readAccessToken", {
+	enumerable: true,
+	get: function() {
+		return readAccessToken;
+	}
+});
+Object.defineProperty(exports, "resolveAttachmentFetchPolicy", {
+	enumerable: true,
+	get: function() {
+		return resolveAttachmentFetchPolicy;
+	}
+});
+Object.defineProperty(exports, "resolveGraphToken", {
+	enumerable: true,
+	get: function() {
+		return resolveGraphToken;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsChannelAllowlist", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsChannelAllowlist;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsCredentials", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsCredentials;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsRequestTimeoutMs", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsRequestTimeoutMs;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsSdkCloudOptions", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsSdkCloudOptions;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsSharePointUploadTimeoutMs", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsSharePointUploadTimeoutMs;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsTeamsConfig", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsTeamsConfig;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsUserAllowlist", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsUserAllowlist;
+	}
+});
+Object.defineProperty(exports, "resolveMediaSsrfPolicy", {
+	enumerable: true,
+	get: function() {
+		return resolveMediaSsrfPolicy;
+	}
+});
+Object.defineProperty(exports, "resolveRequestUrl", {
+	enumerable: true,
+	get: function() {
+		return resolveRequestUrl;
+	}
+});
+Object.defineProperty(exports, "safeFetchWithPolicy", {
+	enumerable: true,
+	get: function() {
+		return safeFetchWithPolicy;
+	}
+});
+Object.defineProperty(exports, "safeHostForUrl", {
+	enumerable: true,
+	get: function() {
+		return safeHostForUrl;
+	}
+});
+Object.defineProperty(exports, "saveDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return saveDelegatedTokens;
+	}
+});
+Object.defineProperty(exports, "searchGraphUsers", {
+	enumerable: true,
+	get: function() {
+		return searchGraphUsers;
+	}
+});
+Object.defineProperty(exports, "tryBuildGraphSharesUrlForSharedLink", {
+	enumerable: true,
+	get: function() {
+		return tryBuildGraphSharesUrlForSharedLink;
+	}
+});
+Object.defineProperty(exports, "tryNormalizeBotFrameworkServiceUrl", {
+	enumerable: true,
+	get: function() {
+		return tryNormalizeBotFrameworkServiceUrl;
+	}
+});
+Object.defineProperty(exports, "validateMSTeamsProactiveServiceUrlBoundary", {
+	enumerable: true,
+	get: function() {
+		return validateMSTeamsProactiveServiceUrlBoundary;
+	}
+});
+Object.defineProperty(exports, "withMSTeamsAbortableRequestTimeout", {
+	enumerable: true,
+	get: function() {
+		return withMSTeamsAbortableRequestTimeout;
+	}
+});
+Object.defineProperty(exports, "withMSTeamsRequestDeadline", {
+	enumerable: true,
+	get: function() {
+		return withMSTeamsRequestDeadline;
+	}
+});