@openclaw/msteams 2026.8.1-beta.2 → 2026.8.1

package/dist/{src-Bz9wY0Mr.cjs → src-BGhvpEOP.cjs}

@@ -1,25 +1,31 @@
 const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-C6YcNC9a.cjs");
-const require_channel = require("./channel-DfCbi0d_.cjs");
-const require_setup_surface = require("./setup-surface-DAhGL2h8.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CWbvAW4v.cjs");
+const require_channel = require("./channel-ChmCvkuA.cjs");
+const require_thread_session = require("./thread-session-Br3R0ovy.cjs");
+const require_channel_setup = require("./channel.setup-CKb8aKCV.cjs");
 const require_polls = require("./polls-DvuJvaDG.cjs");
 const require_sso_token_store = require("./sso-token-store-ChhO1f4i.cjs");
-const require_messenger = require("./messenger-BqA8G3pY.cjs");
+const require_approval_card = require("./approval-card-B6ZIMO83.cjs");
+const require_messenger = require("./messenger-Ctb9_CO7.cjs");
+const require_reaction_types = require("./reaction-types-DtWOWuDN.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
+let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
+let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runtime");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
-let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
-let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
 let node_crypto = require("node:crypto");
 node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+let openclaw_plugin_sdk_collection_runtime = require("openclaw/plugin-sdk/collection-runtime");
+let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
+let openclaw_plugin_sdk_approval_gateway_runtime = require("openclaw/plugin-sdk/approval-gateway-runtime");
 let openclaw_plugin_sdk_channel_ingress_runtime = require("openclaw/plugin-sdk/channel-ingress-runtime");
 let openclaw_plugin_sdk_context_visibility_runtime = require("openclaw/plugin-sdk/context-visibility-runtime");
 let openclaw_plugin_sdk_reply_history = require("openclaw/plugin-sdk/reply-history");
@@ -28,12 +34,11 @@ let openclaw_plugin_sdk_extension_shared = require("openclaw/plugin-sdk/extensio
 let openclaw_plugin_sdk_plugin_runtime = require("openclaw/plugin-sdk/plugin-runtime");
 let openclaw_plugin_sdk_dedupe_runtime = require("openclaw/plugin-sdk/dedupe-runtime");
 let openclaw_plugin_sdk_plugin_state_runtime = require("openclaw/plugin-sdk/plugin-state-runtime");
-let openclaw_plugin_sdk_collection_runtime = require("openclaw/plugin-sdk/collection-runtime");
 let openclaw_plugin_sdk_gateway_runtime = require("openclaw/plugin-sdk/gateway-runtime");
 let openclaw_plugin_sdk_channel_pairing = require("openclaw/plugin-sdk/channel-pairing");
-let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_runtime_group_policy = require("openclaw/plugin-sdk/runtime-group-policy");
 let openclaw_plugin_sdk_dangerous_name_runtime = require("openclaw/plugin-sdk/dangerous-name-runtime");
+let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
 let openclaw_plugin_sdk_webhook_ingress = require("openclaw/plugin-sdk/webhook-ingress");
 //#region extensions/msteams/src/feedback-reflection-store.ts
 const LEARNINGS_NAMESPACE = "feedback-learnings";
@@ -89,11 +94,11 @@ async function runFeedbackReflection(params) {
 			thumbedDownResponse: params.thumbedDownResponse,
 			userComment: params.userComment,
 			cooldownMs,
-			onRecordError: (err) => log.debug?.("reflection session record failed", { error: require_setup_surface.formatUnknownError(err) }),
-			onDispatchError: (err) => log.debug?.("reflection reply error", { error: require_setup_surface.formatUnknownError(err) })
+			onRecordError: (err) => log.debug?.("reflection session record failed", { error: require_channel_setup.formatUnknownError(err) }),
+			onDispatchError: (err) => log.debug?.("reflection reply error", { error: require_channel_setup.formatUnknownError(err) })
 		});
 	} catch (err) {
-		log.error("reflection dispatch failed", { error: require_setup_surface.formatUnknownError(err) });
+		log.error("reflection dispatch failed", { error: require_channel_setup.formatUnknownError(err) });
 		return;
 	}
 	if (reflection.status === "cooldown") {
@@ -116,7 +121,7 @@ async function runFeedbackReflection(params) {
 			learning: reflection.learning
 		});
 	} catch (err) {
-		log.debug?.("failed to store reflection learning", { error: require_setup_surface.formatUnknownError(err) });
+		log.debug?.("failed to store reflection learning", { error: require_channel_setup.formatUnknownError(err) });
 	}
 	const conversationType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(params.conversationRef.conversation?.conversationType);
 	if (!(conversationType === "personal" && reflection.followUp && Boolean(reflection.userMessage))) {
@@ -133,7 +138,7 @@ async function runFeedbackReflection(params) {
 		}, { serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(cfg.channels?.msteams) });
 		log.info("sent reflection follow-up", { sessionKey });
 	} catch (err) {
-		log.debug?.("failed to send reflection follow-up", { error: require_setup_surface.formatUnknownError(err) });
+		log.debug?.("failed to send reflection follow-up", { error: require_channel_setup.formatUnknownError(err) });
 	}
 }
 //#endregion
@@ -166,19 +171,114 @@ function serializeMSTeamsAdaptiveCardActionValue(value) {
 	}
 }
 //#endregion
+//#region extensions/msteams/src/approval-card-submit.ts
+function isMSTeamsApprovalSubmit(value) {
+	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value)) return false;
+	if (value.openclawAction === "approval") return true;
+	const data = ((0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value.action) ? value.action : void 0)?.data;
+	return (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(data) && data.openclawAction === "approval";
+}
+async function maybeHandleMSTeamsApprovalCardSubmit(params) {
+	const { context, deps } = params;
+	if (!isMSTeamsApprovalSubmit(context.activity.value)) return false;
+	const ignored = (reason) => deps.log.info("msteams approval ignored", { reason });
+	const token = require_approval_card.readMSTeamsApprovalActionToken(context.activity.value);
+	if (!token) {
+		ignored("missing card token");
+		return true;
+	}
+	const binding = require_approval_card.getMSTeamsApprovalCardBinding(token);
+	if (!binding) {
+		ignored("unknown or expired card token");
+		return true;
+	}
+	if (binding.accountId !== openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID) {
+		ignored("card token account mismatch");
+		return true;
+	}
+	if (require_resolve_allowlist.normalizeMSTeamsConversationId(context.activity.conversation?.id ?? "") !== require_resolve_allowlist.normalizeMSTeamsConversationId(binding.conversationId)) {
+		ignored("card token conversation mismatch");
+		return true;
+	}
+	if (context.activity.replyToId && context.activity.replyToId !== binding.activityId) {
+		ignored("card token activity mismatch");
+		return true;
+	}
+	if (!binding.allowedDecisions.includes(binding.decision)) {
+		ignored("card token decision is no longer allowed");
+		return true;
+	}
+	const senderId = context.activity.from?.aadObjectId;
+	if (!(require_thread_session.msTeamsApprovalAuth.authorizeActorAction?.({
+		cfg: deps.cfg,
+		accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+		senderId,
+		action: "approve",
+		approvalKind: binding.approvalKind
+	}))?.authorized) {
+		ignored(`unauthorized actor ${senderId || "unknown"}`);
+		return true;
+	}
+	const claim = require_approval_card.claimMSTeamsApprovalCardBinding(token);
+	if (claim.kind !== "claimed") {
+		ignored(claim.kind === "in-flight" ? "card token resolve already in flight" : "card token already consumed");
+		return true;
+	}
+	const consumed = claim.binding;
+	let result;
+	try {
+		result = await (0, openclaw_plugin_sdk_approval_gateway_runtime.resolveApprovalOverGateway)({
+			cfg: deps.cfg,
+			approvalId: consumed.approvalId,
+			approvalKind: consumed.approvalKind,
+			decision: consumed.decision,
+			channel: "msteams",
+			accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+			senderId
+		});
+		await context.updateActivity({
+			type: "message",
+			id: consumed.activityId,
+			attachments: [{
+				contentType: "application/vnd.microsoft.card.adaptive",
+				content: require_approval_card.buildMSTeamsCanonicalApprovalTerminalCard(result)
+			}]
+		});
+	} catch (error) {
+		if ((0, openclaw_plugin_sdk_error_runtime.isApprovalNotFoundError)(error)) {
+			require_approval_card.completeMSTeamsApprovalCardBinding(token);
+			ignored(`approval expired or no longer exists id=${consumed.approvalId}`);
+			return true;
+		}
+		require_approval_card.releaseMSTeamsApprovalCardBinding(token);
+		throw error;
+	}
+	require_approval_card.completeMSTeamsApprovalCardBinding(token);
+	deps.log.info("msteams approval resolved", {
+		approvalId: consumed.approvalId,
+		approvalKind: consumed.approvalKind,
+		applied: result.applied,
+		status: result.approval.status,
+		senderId
+	});
+	return true;
+}
+//#endregion
 //#region extensions/msteams/src/monitor-handler/access.ts
 const msteamsIngressIdentity = {
 	key: "sender-id",
+	authentication: "asserted",
 	normalize: normalizeIngressValue,
 	aliases: [{
 		key: "sender-name",
 		kind: "plugin:msteams-sender-name",
 		normalizeEntry: normalizeSenderNameIngressValue,
 		normalizeSubject: normalizeSenderNameIngressValue,
-		dangerous: true
+		authentication: "mutable"
 	}, {
 		key: "conversation-id",
 		kind: "plugin:msteams-conversation-id",
+		authentication: "asserted",
 		normalizeEntry: normalizeAllowlistConversationId,
 		normalizeSubject: normalizeAllowlistConversationId
 	}],
@@ -243,7 +343,23 @@ async function resolveMSTeamsSenderAccess(params) {
 	const resolved = await (0, openclaw_plugin_sdk_channel_ingress_runtime.resolveStableChannelMessageIngress)({
 		channelId: "msteams",
 		accountId: pairing.accountId,
-		identity: msteamsIngressIdentity,
+		identity: {
+			...msteamsIngressIdentity,
+			resolveParticipant: () => {
+				const tenantId = activity.channelData?.tenant?.id ?? activity.conversation?.tenantId;
+				const aadId = activity.from?.aadObjectId;
+				if (tenantId && aadId) return {
+					domain: `entra:${tenantId.toLowerCase()}`,
+					idKind: "object-id",
+					id: aadId.toLowerCase()
+				};
+				return msteamsCfg?.appId && activity.from?.id ? {
+					domain: `bot:${msteamsCfg.appId.toLowerCase()}`,
+					idKind: "channel-account-id",
+					id: activity.from.id
+				} : void 0;
+			}
+		},
 		cfg: params.cfg,
 		readStoreAllowFrom: pairing.readAllowFromStore,
 		subject: {
@@ -331,7 +447,7 @@ async function admitMSTeamsMessage(params) {
 		});
 		if (senderAccess.decision === "pairing") {
 			params.conversationStore.upsert(params.conversationId, params.conversationRef).catch((err) => {
-				params.log.debug?.("failed to save conversation reference", { error: require_setup_surface.formatUnknownError(err) });
+				params.log.debug?.("failed to save conversation reference", { error: require_channel_setup.formatUnknownError(err) });
 			});
 			if (await pairing.upsertPairingRequest({
 				id: senderId,
@@ -417,7 +533,7 @@ async function admitMSTeamsMessage(params) {
 		return null;
 	}
 	params.conversationStore.upsert(params.conversationId, params.conversationRef).catch((err) => {
-		params.log.debug?.("failed to save conversation reference", { error: require_setup_surface.formatUnknownError(err) });
+		params.log.debug?.("failed to save conversation reference", { error: require_channel_setup.formatUnknownError(err) });
 	});
 	return {
 		...access,
@@ -1593,7 +1709,7 @@ async function prepareMSTeamsInboundContent(params) {
 			})
 		});
 	} catch (err) {
-		params.log.debug?.("failed to resolve inbound Teams media", { error: require_setup_surface.formatUnknownError(err) });
+		params.log.debug?.("failed to resolve inbound Teams media", { error: require_channel_setup.formatUnknownError(err) });
 	}
 	const inboundMedia = mergeMSTeamsMediaFacts(params.advertisedMedia, mediaList);
 	const nativeMediaForComparison = [...params.advertisedMedia, ...mediaList.slice(params.advertisedMedia.length).map((media) => ({
@@ -2089,7 +2205,7 @@ function createMSTeamsReplyDispatcher(params) {
 		cfg: params.cfg,
 		channel: "msteams"
 	});
-	const mediaMaxBytes = (0, openclaw_plugin_sdk_media_runtime.resolveChannelMediaMaxBytes)({
+	const mediaMaxBytes = (0, openclaw_plugin_sdk_account_helpers.resolveChannelMediaMaxBytes)({
 		cfg: params.cfg,
 		resolveChannelLimitMb: ({ cfg }) => cfg.channels?.msteams?.mediaMaxMb
 	});
@@ -2135,15 +2251,16 @@ function createMSTeamsReplyDispatcher(params) {
 		});
 	};
 	const queueDeliveryFailureSystemEvent = (failure) => {
-		const classification = require_setup_surface.classifyMSTeamsSendError(failure.error);
-		const errorText = require_setup_surface.formatUnknownError(failure.error);
+		const classification = require_channel_setup.classifyMSTeamsSendError(failure.error);
+		const errorText = require_channel_setup.formatUnknownError(failure.error);
 		const failedAll = failure.failed >= failure.total;
+		const ambiguous = classification.kind === "ambiguous";
 		const sentences = [
-			`Microsoft Teams delivery failed: ${failedAll ? "the previous reply was not delivered" : `${failure.failed} of ${failure.total} message blocks were not delivered`}.`,
-			`The user may not have received ${failedAll ? "that reply" : "the full reply"}.`,
+			`Microsoft Teams delivery failed: ${ambiguous ? failedAll ? "the delivery outcome is unknown for the previous reply" : `the delivery outcome is unknown for ${failure.failed} of ${failure.total} message blocks` : failedAll ? "the previous reply was not delivered" : `${failure.failed} of ${failure.total} message blocks were not delivered`}.`,
+			ambiguous ? void 0 : `The user may not have received ${failedAll ? "that reply" : "the full reply"}.`,
 			`Error: ${errorText}.`,
 			classification.statusCode != null ? `Status: ${classification.statusCode}.` : void 0,
-			classification.kind === "transient" || classification.kind === "throttled" ? "Retrying later may succeed." : void 0
+			require_channel_setup.formatMSTeamsDeliveryFailureGuidance(classification)
 		].filter(Boolean);
 		core.system.enqueueSystemEvent(sentences.join(" "), {
 			sessionKey: params.sessionKey,
@@ -2236,7 +2353,7 @@ function createMSTeamsReplyDispatcher(params) {
 			if (sentIds.length > 0) try {
 				params.onSentMessageIds?.(sentIds);
 			} catch (error) {
-				params.log.warn?.("failed to record sent Teams message ids", { error: require_setup_surface.formatUnknownError(error) });
+				params.log.warn?.("failed to record sent Teams message ids", { error: require_channel_setup.formatUnknownError(error) });
 			}
 		}
 	};
@@ -2268,9 +2385,9 @@ function createMSTeamsReplyDispatcher(params) {
 			};
 		},
 		onError: (err, info) => {
-			const errMsg = require_setup_surface.formatUnknownError(err);
-			const classification = require_setup_surface.classifyMSTeamsSendError(err);
-			const hint = require_setup_surface.formatMSTeamsSendErrorHint(classification);
+			const errMsg = require_channel_setup.formatUnknownError(err);
+			const classification = require_channel_setup.classifyMSTeamsSendError(err);
+			const hint = require_channel_setup.formatMSTeamsSendErrorHint(classification);
 			params.runtime.error?.(`msteams ${info.kind} reply failed: ${errMsg}${hint ? ` (${hint})` : ""}`);
 			params.log.error("reply failed", {
 				kind: info.kind,
@@ -2314,7 +2431,7 @@ function createMSTeamsReplyDispatcher(params) {
 		if (nativeResult.messageId) try {
 			params.onSentMessageIds?.([nativeResult.messageId]);
 		} catch (error) {
-			params.log.warn?.("failed to record sent Teams message id", { error: require_setup_surface.formatUnknownError(error) });
+			params.log.warn?.("failed to record sent Teams message id", { error: require_channel_setup.formatUnknownError(error) });
 		}
 	};
 	const previewToolProgressEnabled = (0, openclaw_plugin_sdk_channel_outbound.resolveChannelStreamingPreviewToolProgress)(msteamsCfg, true, teamsStreamMode);
@@ -2643,7 +2760,7 @@ async function dispatchMSTeamsInboundTurn(params) {
 					},
 					ctxPayload,
 					record: { onRecordError: (err) => {
-						logVerboseMessage(`msteams: failed updating session meta: ${require_setup_surface.formatUnknownError(err)}`);
+						logVerboseMessage(`msteams: failed updating session meta: ${require_channel_setup.formatUnknownError(err)}`);
 					} },
 					history: {
 						isGroup: isRoomish,
@@ -2662,18 +2779,15 @@ async function dispatchMSTeamsInboundTurn(params) {
 		});
 		const dispatchResult = turnResult.dispatched ? turnResult.dispatchResult : void 0;
 		const counts = (0, openclaw_plugin_sdk_channel_inbound.resolveInboundReplyDispatchCounts)(dispatchResult);
-		log.info("dispatch complete", {
-			queuedFinal: dispatchResult?.queuedFinal ?? false,
-			counts
-		});
+		log.info("dispatch complete", { counts });
 		if ((0, openclaw_plugin_sdk_channel_inbound.hasFinalInboundReplyDispatch)(dispatchResult)) logVerboseMessage(`msteams: delivered ${counts.final} repl${counts.final === 1 ? "y" : "ies"} to ${teamsTo}`);
 		return {
 			kind: "completed",
 			finalResponses: counts.final
 		};
 	} catch (err) {
-		log.error("dispatch failed", { error: require_setup_surface.formatUnknownError(err) });
-		runtime.error(`msteams dispatch failed: ${require_setup_surface.formatUnknownError(err)}`);
+		log.error("dispatch failed", { error: require_channel_setup.formatUnknownError(err) });
+		runtime.error(`msteams dispatch failed: ${require_channel_setup.formatUnknownError(err)}`);
 		if (facts.turnAdoptionLifecycle) throw err;
 		try {
 			await context.sendActivity("⚠️ Something went wrong. Please try again.");
@@ -2844,7 +2958,7 @@ function resolveParentCacheExpiresAt(nowRaw) {
 * Uses the injected `fetchParent` (defaults to `fetchChannelMessage`) so
 * tests can swap in a stub without mocking the Graph transport.
 */
-async function fetchParentMessageCached(token, groupId, channelId, parentId, fetchParent = require_messenger.fetchChannelMessage) {
+async function fetchParentMessageCached(token, groupId, channelId, parentId, fetchParent = require_reaction_types.fetchChannelMessage) {
 	const key = buildParentCacheKey(groupId, channelId, parentId);
 	const now = (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(Date.now());
 	const cached = parentCache.get(key);
@@ -2874,7 +2988,7 @@ function summarizeParentMessage(message) {
 	const sender = message.from?.user?.displayName ?? message.from?.application?.displayName ?? "unknown";
 	const contentType = message.body?.contentType ?? "text";
 	const raw = message.body?.content ?? "";
-	const text = contentType === "html" ? require_messenger.stripHtmlFromTeamsMessage(raw) : raw.replace(/\s+/g, " ").trim();
+	const text = contentType === "html" ? require_reaction_types.stripHtmlFromTeamsMessage(raw) : raw.replace(/\s+/g, " ").trim();
 	if (!text) return;
 	return {
 		sender,
@@ -2918,7 +3032,7 @@ function prepareMSTeamsThreadRouting(params) {
 			id: params.isDirectMessage ? params.senderId : params.conversationId
 		}
 	});
-	route.sessionKey = require_channel.resolveMSTeamsRouteSessionKey({
+	route.sessionKey = require_thread_session.resolveMSTeamsRouteSessionKey({
 		baseSessionKey: route.sessionKey,
 		isChannel: params.isChannel,
 		conversationMessageId: params.conversationMessageId,
@@ -2938,7 +3052,7 @@ function prepareMSTeamsThreadRouting(params) {
 		}).catch((err) => {
 			params.log.debug?.("failed to resolve Teams AAD group ID", {
 				teamId: conversationTeamId,
-				error: require_setup_surface.formatUnknownError(err)
+				error: require_channel_setup.formatUnknownError(err)
 			});
 		});
 		teamAadGroupId = await teamGroupIdPromise;
@@ -2969,10 +3083,10 @@ async function resolveMSTeamsThreadContext(params) {
 		quoteBodyFull = await require_resolve_allowlist.withMSTeamsRequestDeadline({
 			deadline,
 			label: "MS Teams quote lookup",
-			work: () => require_messenger.fetchChatMessageText(graphToken, params.conversationId, quoteMessageId, deadline)
+			work: () => require_reaction_types.fetchChatMessageText(graphToken, params.conversationId, quoteMessageId, deadline)
 		});
 	} catch (err) {
-		params.log.debug?.("failed to fetch full quoted message text", { error: require_setup_surface.formatUnknownError(err) });
+		params.log.debug?.("failed to fetch full quoted message text", { error: require_channel_setup.formatUnknownError(err) });
 	}
 	let threadContext;
 	const threadParentId = activity.replyToId;
@@ -2985,12 +3099,12 @@ async function resolveMSTeamsThreadContext(params) {
 		const [parentResult, repliesResult] = await require_resolve_allowlist.withMSTeamsRequestDeadline({
 			deadline,
 			label: "MS Teams thread history",
-			work: () => Promise.allSettled([fetchParentMessageCached(graphToken, teamAadGroupId, params.conversationId, threadParentId, (token, groupId, requestedChannelId, messageId) => require_messenger.fetchChannelMessage(token, groupId, requestedChannelId, messageId, deadline)), require_messenger.fetchThreadReplies(graphToken, teamAadGroupId, params.conversationId, threadParentId, 50, deadline)])
+			work: () => Promise.allSettled([fetchParentMessageCached(graphToken, teamAadGroupId, params.conversationId, threadParentId, (token, groupId, requestedChannelId, messageId) => require_reaction_types.fetchChannelMessage(token, groupId, requestedChannelId, messageId, deadline)), require_reaction_types.fetchThreadReplies(graphToken, teamAadGroupId, params.conversationId, threadParentId, 50, deadline)])
 		});
 		const parentMsg = parentResult.status === "fulfilled" ? parentResult.value : void 0;
 		const replies = repliesResult.status === "fulfilled" ? repliesResult.value : [];
-		if (parentResult.status === "rejected") params.log.debug?.("failed to fetch parent message", { error: require_setup_surface.formatUnknownError(parentResult.reason) });
-		if (repliesResult.status === "rejected") params.log.debug?.("failed to fetch thread replies", { error: require_setup_surface.formatUnknownError(repliesResult.reason) });
+		if (parentResult.status === "rejected") params.log.debug?.("failed to fetch parent message", { error: require_channel_setup.formatUnknownError(parentResult.reason) });
+		if (repliesResult.status === "rejected") params.log.debug?.("failed to fetch thread replies", { error: require_channel_setup.formatUnknownError(repliesResult.reason) });
 		const isThreadSenderAllowed = (message) => (0, openclaw_plugin_sdk_channel_inbound.resolveInboundSupplementalSenderAllowed)({
 			isGroup: params.isChannel,
 			groupPolicy: params.groupPolicy,
@@ -3025,9 +3139,9 @@ async function resolveMSTeamsThreadContext(params) {
 			kind: "thread",
 			isSenderAllowed: isThreadSenderAllowed
 		});
-		threadContext = require_messenger.formatThreadContext(threadMessages, activity.id) || void 0;
+		threadContext = require_reaction_types.formatThreadContext(threadMessages, activity.id) || void 0;
 	} catch (err) {
-		params.log.debug?.("failed to fetch thread history", { error: require_setup_surface.formatUnknownError(err) });
+		params.log.debug?.("failed to fetch thread history", { error: require_channel_setup.formatUnknownError(err) });
 	}
 	quoteSenderName ??= params.quoteInfo?.sender;
 	return {
@@ -3106,7 +3220,7 @@ function createMSTeamsMessageHandler(deps) {
 			} catch (err) {
 				log.error("failed to record poll vote", {
 					pollId: pollVote.pollId,
-					error: require_setup_surface.formatUnknownError(err)
+					error: require_channel_setup.formatUnknownError(err)
 				});
 			}
 			return;
@@ -3283,7 +3397,7 @@ function createMSTeamsMessageHandler(deps) {
 			});
 		},
 		onError: (err) => {
-			runtime.error(`msteams debounce flush failed: ${require_setup_surface.formatUnknownError(err)}`);
+			runtime.error(`msteams debounce flush failed: ${require_channel_setup.formatUnknownError(err)}`);
 		}
 	});
 	return async function handleTeamsMessage(context, turnAdoptionLifecycle) {
@@ -3307,7 +3421,8 @@ function createMSTeamsReactionHandler(deps) {
 	const msteamsCfg = cfg.channels?.msteams;
 	return async function handleReaction(context, direction) {
 		const activity = context.activity;
-		const reactions = direction === "added" ? activity.reactionsAdded ?? [] : activity.reactionsRemoved ?? [];
+		const rawReactions = direction === "added" ? activity.reactionsAdded : activity.reactionsRemoved;
+		const reactions = Array.isArray(rawReactions) ? rawReactions : [];
 		if (reactions.length === 0) {
 			log.debug?.("reaction activity has no reactions; skipping");
 			return;
@@ -3350,7 +3465,7 @@ function createMSTeamsReactionHandler(deps) {
 		const targetMessageId = activity.replyToId ?? "unknown";
 		for (const reaction of reactions) {
 			const reactionType = reaction.type ?? "unknown";
-			const emoji = require_messenger.resolveMSTeamsReactionEmoji(reactionType);
+			const emoji = require_reaction_types.resolveMSTeamsReactionEmoji(reactionType);
 			const label = direction === "added" ? `Teams reaction ${emoji} added by ${senderName} on message ${targetMessageId}` : `Teams reaction ${emoji} removed by ${senderName} from message ${targetMessageId}`;
 			log.info(`reaction ${direction}`, {
 				sender: senderId,
@@ -3492,6 +3607,10 @@ function registerMSTeamsHandlers(handler, deps) {
 	if (originalRun) handler.run = async (context, turnAdoptionLifecycle) => {
 		const ctx = context;
 		if (ctx.activity?.type === "invoke" && ctx.activity?.name === "adaptiveCard/action") {
+			if (await maybeHandleMSTeamsApprovalCardSubmit({
+				context: ctx,
+				deps
+			})) return;
 			const text = serializeMSTeamsAdaptiveCardActionValue(ctx.activity?.value);
 			if (text) return await handleTeamsMessage({
 				...ctx,
@@ -3512,12 +3631,20 @@ function registerMSTeamsHandlers(handler, deps) {
 			await next();
 		};
 		try {
-			const result = await handleTeamsMessage(context, turnAdoptionLifecycle);
+			const ctx = context;
+			if (await maybeHandleMSTeamsApprovalCardSubmit({
+				context: ctx,
+				deps
+			})) {
+				await runNext();
+				return;
+			}
+			const result = await handleTeamsMessage(ctx, turnAdoptionLifecycle);
 			await runNext();
 			return result;
 		} catch (err) {
 			if (turnAdoptionLifecycle) throw err;
-			deps.runtime.error(`msteams handler failed: ${require_setup_surface.formatUnknownError(err)}`);
+			deps.runtime.error(`msteams handler failed: ${require_channel_setup.formatUnknownError(err)}`);
 		}
 		if (!nextRan) await runNext();
 	});
@@ -3543,7 +3670,7 @@ function registerMSTeamsHandlers(handler, deps) {
 					});
 					deps.log.info("sent welcome card");
 				} catch (err) {
-					deps.log.debug?.("failed to send welcome card", { error: require_setup_surface.formatUnknownError(err) });
+					deps.log.debug?.("failed to send welcome card", { error: require_channel_setup.formatUnknownError(err) });
 				}
 			} else if (!isPersonal && msteamsCfg?.groupWelcomeCard === true) {
 				const botName = ctx.activity?.recipient?.name ?? void 0;
@@ -3551,7 +3678,7 @@ function registerMSTeamsHandlers(handler, deps) {
 					await ctx.sendActivity(buildGroupWelcomeText(botName));
 					deps.log.info("sent group welcome message");
 				} catch (err) {
-					deps.log.debug?.("failed to send group welcome", { error: require_setup_surface.formatUnknownError(err) });
+					deps.log.debug?.("failed to send group welcome", { error: require_channel_setup.formatUnknownError(err) });
 				}
 			} else deps.log.debug?.("skipping welcome (disabled by config or conversation type)");
 		} else deps.log.debug?.("member added", { member: member.id });
@@ -3687,7 +3814,7 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 		userComment,
 		log: deps.log
 	}).catch((err) => {
-		deps.log.error("feedback reflection failed", { error: require_setup_surface.formatUnknownError(err) });
+		deps.log.error("feedback reflection failed", { error: require_channel_setup.formatUnknownError(err) });
 	});
 	return true;
 }
@@ -3764,7 +3891,7 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 		} catch (err) {
 			log.error("file upload failed", {
 				uploadId,
-				error: require_setup_surface.formatUnknownError(err)
+				error: require_channel_setup.formatUnknownError(err)
 			});
 			await context.sendActivity("File upload failed. Please try again.");
 		} finally {
@@ -3797,7 +3924,7 @@ async function runMSTeamsFileConsentInvokeHandler(context, log) {
 			}
 		});
 	} catch (err) {
-		log.debug?.("file consent handler error", { error: require_setup_surface.formatUnknownError(err) });
+		log.debug?.("file consent handler error", { error: require_channel_setup.formatUnknownError(err) });
 	}
 }
 //#endregion
@@ -3902,7 +4029,7 @@ function createMSTeamsIngress(options) {
 					reason: error.reason,
 					message: error.message
 				};
-				return require_setup_surface.classifyMSTeamsSendError(error).kind === "auth" ? {
+				return require_channel_setup.classifyMSTeamsSendError(error).kind === "auth" ? {
 					reason: "authentication-failed",
 					message: (0, openclaw_plugin_sdk_error_runtime.formatErrorMessage)(error)
 				} : null;
@@ -3955,6 +4082,54 @@ function createMSTeamsIngress(options) {
 	};
 }
 //#endregion
+//#region extensions/msteams/src/replay-context.ts
+function createMSTeamsReplayContext(activity, app, serviceUrlBoundary) {
+	const rawConversationId = activity.conversation?.id ?? "";
+	const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(rawConversationId);
+	const conversationType = activity.conversation?.conversationType ?? "personal";
+	const normalizedConversationType = conversationType.toLowerCase();
+	const threadActivityId = normalizedConversationType === "channel" ? require_resolve_allowlist.extractMSTeamsConversationMessageId(rawConversationId) ?? activity.replyToId : void 0;
+	const quoteActivityId = normalizedConversationType === "channel" || normalizedConversationType === "groupchat" ? activity.id : void 0;
+	const tenantId = activity.channelData?.tenant?.id ?? activity.conversation?.tenantId;
+	const reference = {
+		activityId: activity.id,
+		user: activity.from,
+		agent: activity.recipient,
+		conversation: {
+			id: conversationId,
+			conversationType,
+			...tenantId ? { tenantId } : {}
+		},
+		channelId: activity.channelId,
+		serviceUrl: activity.serviceUrl,
+		locale: activity.locale,
+		...tenantId ? { tenantId } : {},
+		...activity.from?.aadObjectId ? { aadObjectId: activity.from.aadObjectId } : {}
+	};
+	const proactiveOptions = {
+		...quoteActivityId ? { quoteActivityId } : {},
+		...threadActivityId ? { threadActivityId } : {},
+		serviceUrlBoundary
+	};
+	const sendActivity = (outbound) => require_messenger.sendMSTeamsActivityWithReference(app, reference, outbound, proactiveOptions);
+	return {
+		activity,
+		sendActivity,
+		sendActivities: async (activities) => {
+			const results = [];
+			for (const outbound of activities) results.push(await sendActivity(outbound));
+			return results;
+		},
+		updateActivity: async (outbound) => {
+			return await require_messenger.updateMSTeamsActivityWithReference(app, reference, typeof outbound.id === "string" ? outbound.id : "", outbound, proactiveOptions);
+		},
+		deleteActivity: async (activityId) => {
+			await require_messenger.deleteMSTeamsActivityWithReference(app, reference, activityId, proactiveOptions);
+		},
+		getTeamDetails: (teamId) => app.api.teams.getById(teamId)
+	};
+}
+//#endregion
 //#region extensions/msteams/src/webhook-timeouts.ts
 const MSTEAMS_WEBHOOK_INACTIVITY_TIMEOUT_MS = 3e4;
 const MSTEAMS_WEBHOOK_REQUEST_TIMEOUT_MS = 3e4;
@@ -4059,7 +4234,7 @@ async function monitorMSTeamsProvider(opts) {
 			(0, openclaw_plugin_sdk_allow_from.summarizeMapping)("msteams channels", resolved.mapping, resolved.unresolved, runtime);
 		}
 	} catch (err) {
-		runtime.error?.(`msteams resolve failed; mutable allowlist entries are disabled. ${require_setup_surface.formatUnknownError(err)}`);
+		runtime.error?.(`msteams resolve failed; mutable allowlist entries are disabled. ${require_channel_setup.formatUnknownError(err)}`);
 	}
 	if (configuredGroupAllowFrom == null && groupAllowFrom) groupAllowFrom = (0, openclaw_plugin_sdk_allow_from.mergeAllowlist)({
 		existing: groupAllowFrom,
@@ -4080,7 +4255,7 @@ async function monitorMSTeamsProvider(opts) {
 	};
 	const port = msteamsCfg.webhook?.port ?? 3978;
 	const textLimit = core.channel.text.resolveTextChunkLimit(cfg, "msteams");
-	const mediaMaxBytes = (0, openclaw_plugin_sdk_media_runtime.resolveChannelMediaMaxBytes)({
+	const mediaMaxBytes = (0, openclaw_plugin_sdk_account_helpers.resolveChannelMediaMaxBytes)({
 		cfg,
 		resolveChannelLimitMb: ({ cfg: channelCfg }) => channelCfg.channels?.msteams?.mediaMaxMb
 	}) ?? 8 * 1024 * 1024;
@@ -4213,7 +4388,7 @@ async function monitorMSTeamsProvider(opts) {
 				} catch (err) {
 					log.error("failed to record poll vote", {
 						pollId: vote.pollId,
-						error: require_setup_surface.formatUnknownError(err)
+						error: require_channel_setup.formatUnknownError(err)
 					});
 					return {
 						statusCode: 500,
@@ -4236,7 +4411,7 @@ async function monitorMSTeamsProvider(opts) {
 				value: "OK"
 			};
 		} catch (err) {
-			log.error("msteams card.action failed", { error: require_setup_surface.formatUnknownError(err) });
+			log.error("msteams card.action failed", { error: require_channel_setup.formatUnknownError(err) });
 			return {
 				statusCode: 500,
 				type: "application/vnd.microsoft.error",
@@ -4304,7 +4479,7 @@ async function monitorMSTeamsProvider(opts) {
 				hasExpiry: Boolean(ctx.token.expiration)
 			});
 		})().catch((err) => {
-			log.error("msteams sso token persistence failed", { error: require_setup_surface.formatUnknownError(err) });
+			log.error("msteams sso token persistence failed", { error: require_channel_setup.formatUnknownError(err) });
 		});
 	});
 	app.on("message.submit", async (ctx) => {
@@ -4325,7 +4500,7 @@ async function monitorMSTeamsProvider(opts) {
 		try {
 			await handler.run(adaptedCtx);
 		} catch (err) {
-			log.error("msteams non-turn activity failed", { error: require_setup_surface.formatUnknownError(err) });
+			log.error("msteams non-turn activity failed", { error: require_channel_setup.formatUnknownError(err) });
 		}
 	});
 	await app.initialize();
@@ -4335,7 +4510,7 @@ async function monitorMSTeamsProvider(opts) {
 		const onListen = (err) => err ? reject(err) : resolve(server);
 		const server = privateQaRuntime ? expressApp.listen(port, privateQaRuntime.listenHost, onListen) : expressApp.listen(port, onListen);
 	}).catch(async (err) => {
-		log.error("msteams server error", { error: require_setup_surface.formatUnknownError(err) });
+		log.error("msteams server error", { error: require_channel_setup.formatUnknownError(err) });
 		await ingress.stop();
 		throw err;
 	});
@@ -4343,14 +4518,14 @@ async function monitorMSTeamsProvider(opts) {
 	publishMSTeamsReady(opts.statusSink);
 	applyMSTeamsWebhookTimeouts(httpServer);
 	httpServer.on("error", (err) => {
-		log.error("msteams server error", { error: require_setup_surface.formatUnknownError(err) });
-		publishMSTeamsRecovering(opts.statusSink, require_setup_surface.formatUnknownError(err));
+		log.error("msteams server error", { error: require_channel_setup.formatUnknownError(err) });
+		publishMSTeamsRecovering(opts.statusSink, require_channel_setup.formatUnknownError(err));
 	});
 	const shutdown = async () => {
 		log.info("shutting down msteams provider");
 		await new Promise((resolve) => {
 			httpServer.close((err) => {
-				if (err) log.debug?.("msteams server close error", { error: require_setup_surface.formatUnknownError(err) });
+				if (err) log.debug?.("msteams server close error", { error: require_channel_setup.formatUnknownError(err) });
 				resolve();
 			});
 		});
@@ -4411,47 +4586,6 @@ function buildActivityHandler() {
 	};
 	return handler;
 }
-function createMSTeamsReplayContext(activity, app, serviceUrlBoundary) {
-	const rawConversationId = activity.conversation?.id ?? "";
-	const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(rawConversationId);
-	const conversationType = activity.conversation?.conversationType ?? "personal";
-	const threadActivityId = conversationType.toLowerCase() === "channel" ? require_resolve_allowlist.extractMSTeamsConversationMessageId(rawConversationId) ?? activity.replyToId : void 0;
-	const tenantId = activity.channelData?.tenant?.id ?? activity.conversation?.tenantId;
-	const reference = {
-		activityId: activity.id,
-		user: activity.from,
-		agent: activity.recipient,
-		conversation: {
-			id: conversationId,
-			conversationType,
-			...tenantId ? { tenantId } : {}
-		},
-		channelId: activity.channelId,
-		serviceUrl: activity.serviceUrl,
-		locale: activity.locale,
-		...tenantId ? { tenantId } : {},
-		...activity.from?.aadObjectId ? { aadObjectId: activity.from.aadObjectId } : {}
-	};
-	const proactiveOptions = {
-		...threadActivityId ? { threadActivityId } : {},
-		serviceUrlBoundary
-	};
-	const sendActivity = (outbound) => require_messenger.sendMSTeamsActivityWithReference(app, reference, outbound, proactiveOptions);
-	return {
-		activity,
-		sendActivity,
-		sendActivities: async (activities) => {
-			const results = [];
-			for (const outbound of activities) results.push(await sendActivity(outbound));
-			return results;
-		},
-		updateActivity: async (outbound) => await require_messenger.updateMSTeamsActivityWithReference(app, reference, typeof outbound.id === "string" ? outbound.id : "", outbound, proactiveOptions),
-		deleteActivity: async (activityId) => {
-			await require_messenger.deleteMSTeamsActivityWithReference(app, reference, activityId, proactiveOptions);
-		},
-		getTeamDetails: (teamId) => app.api.teams.getById(teamId)
-	};
-}
 /**
 * Adapt a new @microsoft/teams.apps SDK context to the MSTeamsTurnContext interface
 * our handlers expect. The new SDK uses reply()/send() instead of sendActivity().