@openclaw/msteams 2026.7.2-beta.5 → 2026.8.1-beta.2

package/dist/{resolve-allowlist-Dr_1sOJh.cjs → resolve-allowlist-C6YcNC9a.cjs}

@@ -1,20 +1,78 @@
-const require_delegated_state = require("./delegated-state-DOSCHaAB.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("./runtime-api.cjs");
+const require_delegated_state = require("./delegated-state-DiEz9JIa.cjs");
 let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
+let openclaw_plugin_sdk_html_entity_runtime = require("openclaw/plugin-sdk/html-entity-runtime");
+let openclaw_plugin_sdk_fetch_runtime = require("openclaw/plugin-sdk/fetch-runtime");
 let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
 let node_buffer = require("node:buffer");
 let node_dns_promises = require("node:dns/promises");
 let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
-let node_fs = require("node:fs");
-node_fs = require_delegated_state.__toESM(node_fs, 1);
+let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
+let openclaw_plugin_sdk_secret_file = require("openclaw/plugin-sdk/secret-file");
 let node_module = require("node:module");
 let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
+//#region extensions/msteams/src/inbound.ts
+/**
+* Strip HTML tags, preserving text content.
+*/
+function htmlToPlainText(html) {
+	return (0, openclaw_plugin_sdk_html_entity_runtime.decodeHtmlEntities)(html.replace(/<[^>]*>/g, " ")).replaceAll("\xA0", " ").replace(/\s+/g, " ").trim();
+}
+/**
+* Extract quote info from MS Teams HTML reply attachments.
+* Teams wraps quoted content in a blockquote with itemtype="http://schema.skype.com/Reply".
+*/
+function extractMSTeamsQuoteInfo(attachments) {
+	for (const att of attachments) {
+		let content = "";
+		if (typeof att.content === "string") content = att.content;
+		else if (typeof att.content === "object" && att.content !== null) {
+			const record = att.content;
+			content = typeof record.text === "string" ? record.text : typeof record.body === "string" ? record.body : "";
+		}
+		if (!content) continue;
+		if (!content.includes("http://schema.skype.com/Reply")) continue;
+		const senderMatch = /<strong[^>]*itemprop=["']mri["'][^>]*>(.*?)<\/strong>/i.exec(content);
+		const sender = senderMatch?.[1] ? htmlToPlainText(senderMatch[1]) : void 0;
+		const bodyMatch = /<p[^>]*itemprop=["']copy["'][^>]*>(.*?)<\/p>/is.exec(content) ?? /<p[^>]*itemprop=["']preview["'][^>]*>(.*?)<\/p>/is.exec(content);
+		const body = bodyMatch?.[1] ? htmlToPlainText(bodyMatch[1]) : void 0;
+		const id = /<blockquote[^>]*\bitemid=["']([^"']+)["'][^>]*>/is.exec(content)?.[1]?.trim() || void 0;
+		if (body) return {
+			sender: sender ?? "unknown",
+			body,
+			...id ? { id } : {}
+		};
+	}
+}
+function normalizeMSTeamsConversationId(raw) {
+	return raw.split(";")[0] ?? raw;
+}
+function extractMSTeamsConversationMessageId(raw) {
+	if (!raw) return;
+	return (/(?:^|;)messageid=([^;]+)/i.exec(raw)?.[1]?.trim() ?? "") || void 0;
+}
+function parseMSTeamsActivityTimestamp(value) {
+	if (!value) return;
+	if (value instanceof Date) return value;
+	if (typeof value !== "string") return;
+	const date = new Date(value);
+	return Number.isNaN(date.getTime()) ? void 0 : date;
+}
+function stripMSTeamsMentionTags(text) {
+	return text.replace(/<at[^>]*>.*?<\/at>/gi, "").trim();
+}
+function wasMSTeamsBotMentioned(activity) {
+	const botId = activity.recipient?.id;
+	if (!botId) return false;
+	return (activity.entities ?? []).some((e) => e.type === "mention" && e.mentioned?.id === botId);
+}
+//#endregion
 //#region extensions/msteams/src/request-timeout.ts
 const MSTEAMS_REQUEST_TIMEOUT_MS = 3e4;
 const MSTEAMS_SHAREPOINT_UPLOAD_BASE_TIMEOUT_MS = 5 * 6e4;
@@ -58,52 +116,6 @@ async function withMSTeamsAbortableRequestTimeout(params) {
 	}
 }
 //#endregion
-//#region extensions/msteams/src/response-with-release.ts
-const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
-	101,
-	204,
-	205,
-	304
-]);
-function responseWithRelease(response, release) {
-	let released = false;
-	const releaseOnce = async () => {
-		if (released) return;
-		released = true;
-		await release();
-	};
-	if (!response.body || NULL_BODY_STATUSES.has(response.status)) {
-		releaseOnce();
-		return response;
-	}
-	const reader = response.body.getReader();
-	const body = new ReadableStream({
-		async pull(controller) {
-			try {
-				const next = await reader.read();
-				if (next.done) {
-					controller.close();
-					await releaseOnce();
-					return;
-				}
-				controller.enqueue(next.value);
-			} catch (error) {
-				await releaseOnce();
-				throw error;
-			}
-		},
-		async cancel(reason) {
-			reader.cancel(reason).catch(() => void 0);
-			await releaseOnce();
-		}
-	});
-	return new Response(body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers: response.headers
-	});
-}
-//#endregion
 //#region extensions/msteams/src/attachments/shared.ts
 const IMAGE_EXT_RE = /\.(avif|bmp|gif|heic|heif|jpe?g|png|tiff?|webp)$/i;
 const IMG_SRC_RE = /<img[^>]+src=["']([^"']+)["'][^>]*>/gi;
@@ -477,6 +489,9 @@ async function resolveAndValidateIP(hostname, resolveFn) {
 }
 /** Maximum number of redirects to follow in safeFetch. */
 const MAX_SAFE_REDIRECTS = 5;
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
 /**
 * Fetch a URL with redirect: "manual", validating each redirect target
 * against the hostname allowlist and optional DNS-resolved IP (anti-SSRF).
@@ -493,6 +508,13 @@ async function safeFetch(params) {
 	if (!isUrlAllowed(currentUrl, params.allowHosts)) throw new Error(`Initial download URL blocked: ${currentUrl}`);
 	if (currentHeaders.has("authorization") && params.authorizationAllowHosts && !isUrlAllowed(currentUrl, params.authorizationAllowHosts)) currentHeaders.delete("authorization");
 	if (!hasDispatcher) {
+		const lookupFn = async (hostname) => {
+			const resolved = await resolveFn(hostname);
+			return [{
+				...resolved,
+				family: resolved.address.includes(":") ? 6 : 4
+			}];
+		};
 		const guarded = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 			url: currentUrl,
 			fetchImpl: resolveGuardedFetchImpl({
@@ -506,12 +528,12 @@ async function safeFetch(params) {
 			maxRedirects: MAX_SAFE_REDIRECTS,
 			requireHttps: true,
 			policy: resolveMediaSsrfPolicy(params.allowHosts),
-			lookupFn: resolveFn,
+			lookupFn,
 			retainAuthorizationRedirectHostnameAllowlist: resolveRetainedAuthorizationRedirectHostnameAllowlist(params.authorizationAllowHosts),
 			auditContext: "msteams.attachment",
 			timeoutMs: params.timeoutMs ?? 3e4
 		});
-		return responseWithRelease(guarded.response, guarded.release);
+		return (0, openclaw_plugin_sdk_fetch_runtime.responseWithRelease)(guarded.response, guarded.release);
 	}
 	if (resolveFn) try {
 		const initialHost = new URL(currentUrl).hostname;
@@ -525,13 +547,7 @@ async function safeFetch(params) {
 			headers: currentHeaders,
 			redirect: "manual"
 		});
-		if (![
-			301,
-			302,
-			303,
-			307,
-			308
-		].includes(res.status)) return res;
+		if (!isRedirectStatus(res.status)) return res;
 		const location = res.headers.get("location");
 		if (!location) return res;
 		let redirectUrl;
@@ -656,6 +672,117 @@ function normalizeBotFrameworkServiceUrl(serviceUrl) {
 	throw new Error(`Blocked Microsoft Teams serviceUrl host: ${describeBotFrameworkServiceUrlHost(serviceUrl)}`);
 }
 //#endregion
+//#region extensions/msteams/src/qa/private-runtime.ts
+const PRIVATE_QA_BUILD_ENV = "OPENCLAW_BUILD_PRIVATE_QA";
+const PRIVATE_QA_NONCE_HEADER = "x-openclaw-msteams-qa-nonce";
+const PRIVATE_QA_RUNTIME_SYMBOL = Symbol.for("openclaw.msteams.privateQaRuntime");
+var PrivateQaHttpClient = class PrivateQaHttpClient {
+	constructor(connectorUrl, nonce, options = {}) {
+		this.connectorUrl = connectorUrl;
+		this.nonce = nonce;
+		this.options = options;
+	}
+	clone(options = {}) {
+		return new PrivateQaHttpClient(this.connectorUrl, this.nonce, {
+			...this.options,
+			...options,
+			headers: {
+				...this.options.headers,
+				...options.headers
+			}
+		});
+	}
+	async request(config) {
+		const sourceUrl = new URL(config.url ?? "", "https://smba.trafficmanager.net");
+		const targetUrl = new URL(`${sourceUrl.pathname}${sourceUrl.search}`, this.connectorUrl);
+		const headers = new Headers(this.options.headers);
+		for (const [key, value] of Object.entries(config.headers ?? {})) if (value != null) headers.set(key, String(value));
+		headers.set(PRIVATE_QA_NONCE_HEADER, this.nonce);
+		const token = typeof this.options.token === "function" ? await this.options.token() : this.options.token;
+		if (token) headers.set("authorization", `Bearer ${token}`);
+		const method = String(config.method ?? "GET").toUpperCase();
+		const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
+			url: targetUrl.toString(),
+			init: {
+				method,
+				headers,
+				body: method === "GET" || method === "HEAD" || config.data == null ? void 0 : typeof config.data === "string" ? config.data : JSON.stringify(config.data)
+			},
+			policy: (0, openclaw_plugin_sdk_ssrf_runtime.ssrfPolicyFromHttpBaseUrlAllowedOrigin)(targetUrl.toString()),
+			maxRedirects: 0,
+			auditContext: "msteams-private-qa-connector"
+		});
+		try {
+			const text = await response.text();
+			const data = text ? JSON.parse(text) : void 0;
+			if (!response.ok) throw new Error(`Microsoft Teams private QA connector returned HTTP ${response.status}`);
+			return {
+				data,
+				status: response.status,
+				statusText: response.statusText,
+				headers: Object.fromEntries(response.headers),
+				config
+			};
+		} finally {
+			await release();
+		}
+	}
+	get(url, config = {}) {
+		return this.request({
+			...config,
+			method: "GET",
+			url
+		});
+	}
+	post(url, data, config = {}) {
+		return this.request({
+			...config,
+			data,
+			method: "POST",
+			url
+		});
+	}
+	put(url, data, config = {}) {
+		return this.request({
+			...config,
+			data,
+			method: "PUT",
+			url
+		});
+	}
+	patch(url, data, config = {}) {
+		return this.request({
+			...config,
+			data,
+			method: "PATCH",
+			url
+		});
+	}
+	delete(url, config = {}) {
+		return this.request({
+			...config,
+			method: "DELETE",
+			url
+		});
+	}
+};
+function resolveMSTeamsPrivateQaRuntime(env = process.env, bootstrap = globalThis[PRIVATE_QA_RUNTIME_SYMBOL]) {
+	if (!bootstrap) return;
+	if (env[PRIVATE_QA_BUILD_ENV] !== "1") throw new Error("Microsoft Teams private QA runtime requires OPENCLAW_BUILD_PRIVATE_QA=1");
+	const connectorUrl = bootstrap.connectorUrl?.trim();
+	const nonce = bootstrap.nonce?.trim();
+	const botToken = bootstrap.botToken?.trim();
+	if (!connectorUrl || !nonce || !botToken) throw new Error("Microsoft Teams private QA bootstrap requires connector URL, nonce, and bot token");
+	const parsedConnectorUrl = new URL(connectorUrl);
+	if (parsedConnectorUrl.protocol !== "http:" || parsedConnectorUrl.hostname !== "127.0.0.1" && parsedConnectorUrl.hostname !== "localhost") throw new Error("Microsoft Teams private QA connector must use loopback HTTP");
+	return {
+		client: new PrivateQaHttpClient(parsedConnectorUrl.toString(), nonce),
+		listenHost: "127.0.0.1",
+		skipAuth: true,
+		token: async () => botToken
+	};
+}
+//#endregion
 //#region extensions/msteams/src/user-agent.ts
 let cachedUserAgent;
 function resolveTeamsSdkVersion() {
@@ -733,20 +860,26 @@ async function createMSTeamsExpressAdapter(serverOrApp) {
 */
 async function createMSTeamsApp(creds, options) {
 	const { App, cloudFromName } = await loadSdkModules();
+	const privateQaRuntime = resolveMSTeamsPrivateQaRuntime();
 	const cloud = options?.cloud ?? "Public";
 	const serviceUrl = options?.serviceUrl ? normalizeBotFrameworkServiceUrl(options.serviceUrl) : void 0;
 	const appOptions = {
-		client: options?.httpClient ?? {
+		client: privateQaRuntime?.client ?? options?.httpClient ?? {
 			headers: { "User-Agent": buildOpenClawUserAgentFragment() },
 			timeout: 3e4
 		},
+		...privateQaRuntime ? {
+			clientSecret: "",
+			skipAuth: privateQaRuntime.skipAuth,
+			token: privateQaRuntime.token
+		} : {},
 		...options?.httpServerAdapter ? { httpServerAdapter: options.httpServerAdapter } : {},
 		...options?.messagingEndpoint ? { messagingEndpoint: options.messagingEndpoint } : {},
 		cloud: cloudFromName(cloud),
 		...serviceUrl ? { serviceUrl } : {},
 		...options?.oauthDefaultConnectionName ? { oauth: { defaultConnectionName: options.oauthDefaultConnectionName } } : {}
 	};
-	if (creds.type === "federated") return createFederatedApp(creds, App, appOptions);
+	if (creds.type === "federated") return await createFederatedApp(creds, App, appOptions);
 	return new App({
 		clientId: creds.appId,
 		clientSecret: creds.appPassword,
@@ -754,7 +887,7 @@ async function createMSTeamsApp(creds, options) {
 		...appOptions
 	});
 }
-function createFederatedApp(creds, App, appOptions) {
+async function createFederatedApp(creds, App, appOptions) {
 	if (creds.useManagedIdentity) return new App({
 		clientId: creds.appId,
 		tenantId: creds.tenantId,
@@ -764,9 +897,9 @@ function createFederatedApp(creds, App, appOptions) {
 	if (!creds.certificatePath) throw new Error("Federated credentials require either a certificate path or managed identity.");
 	let privateKey;
 	try {
-		privateKey = node_fs.readFileSync(creds.certificatePath, "utf-8");
+		privateKey = await (0, openclaw_plugin_sdk_secret_file.readSecretFile)(creds.certificatePath, "Microsoft Teams certificate");
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = (0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err);
 		throw new Error(`Failed to read certificate file at '${creds.certificatePath}': ${msg}`, { cause: err });
 	}
 	return createCertificateApp(creds, privateKey, App, appOptions);
@@ -854,6 +987,10 @@ function createMSTeamsTokenBody(params) {
 function resolveMSTeamsTokenExpiresAt(value) {
 	return (0, openclaw_plugin_sdk_number_runtime.resolveExpiresAtMsFromDurationSeconds)(value, { bufferMs: EXPIRY_BUFFER_MS });
 }
+function assertMSTeamsTokenResponseObject(data, failureLabel) {
+	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(data)) throw new Error(`MSTeams ${failureLabel} failed: invalid token response fields`);
+	return data;
+}
 function parseMSTeamsTokenResponse(data, failureLabel) {
 	const expiresAt = resolveMSTeamsTokenExpiresAt(data.expires_in);
 	if (typeof data.access_token !== "string" || !data.access_token || expiresAt === void 0 || data.refresh_token !== void 0 && typeof data.refresh_token !== "string" || data.scope !== void 0 && typeof data.scope !== "string") throw new Error(`MSTeams ${failureLabel} failed: invalid token response fields`);
@@ -880,7 +1017,7 @@ async function fetchMSTeamsTokens(params) {
 	});
 	try {
 		if (!response.ok) throw await createMSTeamsHttpError(response, `MSTeams ${params.failureLabel} failed`);
-		return parseMSTeamsTokenResponse(await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `MSTeams ${params.failureLabel} failed`), params.failureLabel);
+		return parseMSTeamsTokenResponse(assertMSTeamsTokenResponseObject(await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `MSTeams ${params.failureLabel} failed`), params.failureLabel), params.failureLabel);
 	} finally {
 		await release();
 	}
@@ -948,12 +1085,16 @@ function resolveAuthType(cfg) {
 	if (process.env.MSTEAMS_AUTH_TYPE === "federated") return "federated";
 	return "secret";
 }
+function resolveFederatedPath(configValue, envValue) {
+	if ((0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(configValue)) return configValue;
+	if ((0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(envValue)) return envValue;
+}
 function hasConfiguredMSTeamsCredentials(cfg) {
 	const authType = resolveAuthType(cfg);
 	const hasAppId = Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_ID));
 	const hasTenantId = Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_TENANT_ID));
 	if (authType === "federated") {
-		const hasCert = Boolean(cfg?.certificatePath || process.env.MSTEAMS_CERTIFICATE_PATH);
+		const hasCert = Boolean(resolveFederatedPath(cfg?.certificatePath, process.env.MSTEAMS_CERTIFICATE_PATH));
 		const hasManagedIdentity = cfg?.useManagedIdentity ?? process.env.MSTEAMS_USE_MANAGED_IDENTITY === "true";
 		return hasAppId && hasTenantId && (hasCert || hasManagedIdentity);
 	}
@@ -965,7 +1106,7 @@ function resolveMSTeamsCredentials(cfg) {
 	const tenantId = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_TENANT_ID);
 	if (!appId || !tenantId) return;
 	if (authType === "federated") {
-		const certificatePath = cfg?.certificatePath || process.env.MSTEAMS_CERTIFICATE_PATH || void 0;
+		const certificatePath = resolveFederatedPath(cfg?.certificatePath, process.env.MSTEAMS_CERTIFICATE_PATH);
 		const certificateThumbprint = cfg?.certificateThumbprint || process.env.MSTEAMS_CERTIFICATE_THUMBPRINT || void 0;
 		const useManagedIdentity = cfg?.useManagedIdentity ?? process.env.MSTEAMS_USE_MANAGED_IDENTITY === "true";
 		const managedIdentityClientId = cfg?.managedIdentityClientId || process.env.MSTEAMS_MANAGED_IDENTITY_CLIENT_ID || void 0;
@@ -1046,21 +1187,30 @@ async function requestGraph(params) {
 	try {
 		if (!response.ok) throw await createMSTeamsHttpError(response, `${params.errorPrefix ?? "Graph"} ${params.path} failed`);
 		releaseInFinally = false;
-		return responseWithRelease(response, release);
+		return (0, openclaw_plugin_sdk_fetch_runtime.responseWithRelease)(response, release);
 	} finally {
 		if (releaseInFinally) await release();
 	}
 }
 async function readOptionalGraphJson(res, label) {
-	if (res.status === 204 || res.headers?.get?.("content-length") === "0") return;
+	if (res.status === 204 || res.headers.get("content-length") === "0") return;
 	return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, label);
 }
-async function fetchGraphJson(params) {
-	return await readOptionalGraphJson(await requestGraph({
+async function mutateGraphJson(params) {
+	const errorPrefix = `Graph${params.beta ? " beta" : ""} ${params.method}`;
+	return readOptionalGraphJson(await requestGraph({
 		token: params.token,
 		path: params.path,
 		method: params.method,
 		body: params.body,
+		root: params.beta ? GRAPH_BETA : void 0,
+		errorPrefix
+	}), `${errorPrefix} ${params.path} failed`);
+}
+async function fetchGraphJson(params) {
+	return await readOptionalGraphJson(await requestGraph({
+		token: params.token,
+		path: params.path,
 		headers: params.headers,
 		deadline: params.deadline
 	}), `Graph ${params.path} failed`);
@@ -1155,41 +1305,13 @@ async function listTeamsByNameWithPageInfo(token, query) {
 		path: `/groups?$filter=${encodeURIComponent(filter)}&$select=id,displayName`
 	});
 }
-async function postGraphJson(params) {
-	return readOptionalGraphJson(await requestGraph({
-		token: params.token,
-		path: params.path,
-		method: "POST",
-		body: params.body,
-		errorPrefix: "Graph POST"
-	}), `Graph POST ${params.path} failed`);
-}
-async function postGraphBetaJson(params) {
-	return readOptionalGraphJson(await requestGraph({
-		token: params.token,
-		path: params.path,
-		method: "POST",
-		root: GRAPH_BETA,
-		body: params.body,
-		errorPrefix: "Graph beta POST"
-	}), `Graph beta POST ${params.path} failed`);
-}
 async function deleteGraphRequest(params) {
-	await requestGraph({
+	await (await requestGraph({
 		token: params.token,
 		path: params.path,
 		method: "DELETE",
 		errorPrefix: "Graph DELETE"
-	});
-}
-async function patchGraphJson(params) {
-	return readOptionalGraphJson(await requestGraph({
-		token: params.token,
-		path: params.path,
-		method: "PATCH",
-		body: params.body,
-		errorPrefix: "Graph PATCH"
-	}), `Graph PATCH ${params.path} failed`);
+	})).body?.cancel().catch(() => void 0);
 }
 async function listChannelsForTeam(token, teamId) {
 	return (await listChannelsForTeamWithPageInfo(token, teamId)).items;
@@ -1238,6 +1360,7 @@ async function findGraphUsersByExactIdentity(params) {
 }
 //#endregion
 //#region extensions/msteams/src/resolve-allowlist.ts
+const MSTEAMS_GROUP_CONVERSATION_ID = /^19:.+@thread\.(?:tacv2|skype|v2)$/i;
 function normalizeExactMatch(value) {
 	return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(value ?? "");
 }
@@ -1280,6 +1403,16 @@ function projectStableMSTeamsUserAllowlist(entries) {
 	const projected = entries.map((entry) => normalizeStaticMSTeamsAllowEntry(entry)).filter((entry) => Boolean(entry));
 	return [...new Map(projected.map((entry) => [normalizeExactMatch(entry), entry])).values()];
 }
+function projectStableMSTeamsGroupAllowlist(entries) {
+	if (!entries) return;
+	const projected = entries.map((entry) => {
+		const stableUserEntry = normalizeStaticMSTeamsAllowEntry(entry);
+		if (stableUserEntry) return stableUserEntry;
+		const conversationId = normalizeMSTeamsConversationId(normalizeMSTeamsUserInput(entry));
+		return MSTEAMS_GROUP_CONVERSATION_ID.test(conversationId) ? conversationId : void 0;
+	}).filter((entry) => Boolean(entry));
+	return [...new Map(projected.map((entry) => [MSTEAMS_GROUP_CONVERSATION_ID.test(entry) ? `conversation:${entry}` : normalizeExactMatch(entry), entry])).values()];
+}
 function stripProviderPrefix(raw) {
 	return raw.replace(/^(msteams|teams):/i, "");
 }
@@ -1311,7 +1444,7 @@ function parseMSTeamsConversationId(raw) {
 *
 * Accepts both prefixed and bare formats:
 * - `conversation:<id>` — explicit conversation prefix
-* - `19:abc@thread.tacv2` / `19:abc@thread.skype` — channel / legacy group
+* - `19:abc@thread.tacv2` / `19:abc@thread.skype` / `19:abc@thread.v2` — group or channel
 * - `19:{userId}_{appId}@unq.gbl.spaces` — Graph 1:1 chat thread format
 * - `a:1xxx` — Bot Framework personal (1:1) chat id
 * - `8:orgid:xxx` — Bot Framework org-scoped personal chat id
@@ -1320,7 +1453,7 @@ function looksLikeMSTeamsConversationId(raw) {
 	const trimmed = raw.trim();
 	if (!trimmed) return false;
 	if (/^conversation:/i.test(trimmed)) return true;
-	if (/^19:.+@thread\.(tacv2|skype)$/i.test(trimmed)) return true;
+	if (MSTEAMS_GROUP_CONVERSATION_ID.test(trimmed)) return true;
 	if (/^19:.+@unq\.gbl\.spaces$/i.test(trimmed)) return true;
 	if (/^a:1[A-Za-z0-9_-]+$/i.test(trimmed)) return true;
 	if (/^8:orgid:[A-Za-z0-9-]+$/i.test(trimmed)) return true;
@@ -1331,7 +1464,7 @@ function looksLikeMSTeamsConversationId(raw) {
 * can forward verbatim to the channel adapter.
 */
 function looksLikeMSTeamsTargetId(raw) {
-	const trimmed = raw.trim();
+	const trimmed = stripProviderPrefix(raw.trim()).trim();
 	if (looksLikeMSTeamsConversationId(trimmed)) return true;
 	if (/^user:/i.test(trimmed)) {
 		const id = trimmed.slice(5).trim();
@@ -1805,6 +1938,18 @@ Object.defineProperty(exports, "extractInlineImageCandidates", {
 		return extractInlineImageCandidates;
 	}
 });
+Object.defineProperty(exports, "extractMSTeamsConversationMessageId", {
+	enumerable: true,
+	get: function() {
+		return extractMSTeamsConversationMessageId;
+	}
+});
+Object.defineProperty(exports, "extractMSTeamsQuoteInfo", {
+	enumerable: true,
+	get: function() {
+		return extractMSTeamsQuoteInfo;
+	}
+});
 Object.defineProperty(exports, "fetchGraphAbsoluteUrl", {
 	enumerable: true,
 	get: function() {
@@ -1847,6 +1992,12 @@ Object.defineProperty(exports, "isLikelyImageAttachment", {
 		return isLikelyImageAttachment;
 	}
 });
+Object.defineProperty(exports, "isRedirectStatus", {
+	enumerable: true,
+	get: function() {
+		return isRedirectStatus;
+	}
+});
 Object.defineProperty(exports, "isUrlAllowed", {
 	enumerable: true,
 	get: function() {
@@ -1895,6 +2046,12 @@ Object.defineProperty(exports, "looksLikeMSTeamsTargetId", {
 		return looksLikeMSTeamsTargetId;
 	}
 });
+Object.defineProperty(exports, "mutateGraphJson", {
+	enumerable: true,
+	get: function() {
+		return mutateGraphJson;
+	}
+});
 Object.defineProperty(exports, "normalizeBotFrameworkServiceUrl", {
 	enumerable: true,
 	get: function() {
@@ -1907,6 +2064,12 @@ Object.defineProperty(exports, "normalizeContentType", {
 		return normalizeContentType;
 	}
 });
+Object.defineProperty(exports, "normalizeMSTeamsConversationId", {
+	enumerable: true,
+	get: function() {
+		return normalizeMSTeamsConversationId;
+	}
+});
 Object.defineProperty(exports, "normalizeMSTeamsMessagingTarget", {
 	enumerable: true,
 	get: function() {
@@ -1925,6 +2088,12 @@ Object.defineProperty(exports, "normalizeQuery", {
 		return normalizeQuery;
 	}
 });
+Object.defineProperty(exports, "parseMSTeamsActivityTimestamp", {
+	enumerable: true,
+	get: function() {
+		return parseMSTeamsActivityTimestamp;
+	}
+});
 Object.defineProperty(exports, "parseMSTeamsConversationId", {
 	enumerable: true,
 	get: function() {
@@ -1943,22 +2112,10 @@ Object.defineProperty(exports, "parseMSTeamsTeamEntry", {
 		return parseMSTeamsTeamEntry;
 	}
 });
-Object.defineProperty(exports, "patchGraphJson", {
-	enumerable: true,
-	get: function() {
-		return patchGraphJson;
-	}
-});
-Object.defineProperty(exports, "postGraphBetaJson", {
+Object.defineProperty(exports, "projectStableMSTeamsGroupAllowlist", {
 	enumerable: true,
 	get: function() {
-		return postGraphBetaJson;
-	}
-});
-Object.defineProperty(exports, "postGraphJson", {
-	enumerable: true,
-	get: function() {
-		return postGraphJson;
+		return projectStableMSTeamsGroupAllowlist;
 	}
 });
 Object.defineProperty(exports, "projectStableMSTeamsTeamsConfig", {
@@ -2009,6 +2166,12 @@ Object.defineProperty(exports, "resolveMSTeamsMediaKind", {
 		return resolveMSTeamsMediaKind;
 	}
 });
+Object.defineProperty(exports, "resolveMSTeamsPrivateQaRuntime", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsPrivateQaRuntime;
+	}
+});
 Object.defineProperty(exports, "resolveMSTeamsRequestTimeoutMs", {
 	enumerable: true,
 	get: function() {
@@ -2075,6 +2238,12 @@ Object.defineProperty(exports, "searchGraphUsers", {
 		return searchGraphUsers;
 	}
 });
+Object.defineProperty(exports, "stripMSTeamsMentionTags", {
+	enumerable: true,
+	get: function() {
+		return stripMSTeamsMentionTags;
+	}
+});
 Object.defineProperty(exports, "tryBuildGraphSharesUrlForSharedLink", {
 	enumerable: true,
 	get: function() {
@@ -2093,6 +2262,12 @@ Object.defineProperty(exports, "validateMSTeamsProactiveServiceUrlBoundary", {
 		return validateMSTeamsProactiveServiceUrlBoundary;
 	}
 });
+Object.defineProperty(exports, "wasMSTeamsBotMentioned", {
+	enumerable: true,
+	get: function() {
+		return wasMSTeamsBotMentioned;
+	}
+});
 Object.defineProperty(exports, "withMSTeamsAbortableRequestTimeout", {
 	enumerable: true,
 	get: function() {

package/dist/rolldown-runtime-D6vf50IK.cjs

@@ -0,0 +1,28 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});