@openclaw/msteams 2026.8.1-beta.3 → 2026.8.1

package/dist/{src-C127-DcQ.cjs → src-BGhvpEOP.cjs}

@@ -1,16 +1,20 @@
 const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-CIfWUwuc.cjs");
-const require_channel = require("./channel-KpWENcgK.cjs");
-const require_channel_setup = require("./channel.setup-mOFtsfYz.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CWbvAW4v.cjs");
+const require_channel = require("./channel-ChmCvkuA.cjs");
+const require_thread_session = require("./thread-session-Br3R0ovy.cjs");
+const require_channel_setup = require("./channel.setup-CKb8aKCV.cjs");
 const require_polls = require("./polls-DvuJvaDG.cjs");
 const require_sso_token_store = require("./sso-token-store-ChhO1f4i.cjs");
-const require_messenger = require("./messenger-IISPSOvj.cjs");
+const require_approval_card = require("./approval-card-B6ZIMO83.cjs");
+const require_messenger = require("./messenger-Ctb9_CO7.cjs");
+const require_reaction_types = require("./reaction-types-DtWOWuDN.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
+let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runtime");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
@@ -18,8 +22,10 @@ let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
 let node_crypto = require("node:crypto");
 node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+let openclaw_plugin_sdk_collection_runtime = require("openclaw/plugin-sdk/collection-runtime");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
+let openclaw_plugin_sdk_approval_gateway_runtime = require("openclaw/plugin-sdk/approval-gateway-runtime");
 let openclaw_plugin_sdk_channel_ingress_runtime = require("openclaw/plugin-sdk/channel-ingress-runtime");
 let openclaw_plugin_sdk_context_visibility_runtime = require("openclaw/plugin-sdk/context-visibility-runtime");
 let openclaw_plugin_sdk_reply_history = require("openclaw/plugin-sdk/reply-history");
@@ -28,12 +34,11 @@ let openclaw_plugin_sdk_extension_shared = require("openclaw/plugin-sdk/extensio
 let openclaw_plugin_sdk_plugin_runtime = require("openclaw/plugin-sdk/plugin-runtime");
 let openclaw_plugin_sdk_dedupe_runtime = require("openclaw/plugin-sdk/dedupe-runtime");
 let openclaw_plugin_sdk_plugin_state_runtime = require("openclaw/plugin-sdk/plugin-state-runtime");
-let openclaw_plugin_sdk_collection_runtime = require("openclaw/plugin-sdk/collection-runtime");
 let openclaw_plugin_sdk_gateway_runtime = require("openclaw/plugin-sdk/gateway-runtime");
 let openclaw_plugin_sdk_channel_pairing = require("openclaw/plugin-sdk/channel-pairing");
-let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_runtime_group_policy = require("openclaw/plugin-sdk/runtime-group-policy");
 let openclaw_plugin_sdk_dangerous_name_runtime = require("openclaw/plugin-sdk/dangerous-name-runtime");
+let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
 let openclaw_plugin_sdk_webhook_ingress = require("openclaw/plugin-sdk/webhook-ingress");
 //#region extensions/msteams/src/feedback-reflection-store.ts
 const LEARNINGS_NAMESPACE = "feedback-learnings";
@@ -166,19 +171,114 @@ function serializeMSTeamsAdaptiveCardActionValue(value) {
 	}
 }
 //#endregion
+//#region extensions/msteams/src/approval-card-submit.ts
+function isMSTeamsApprovalSubmit(value) {
+	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value)) return false;
+	if (value.openclawAction === "approval") return true;
+	const data = ((0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value.action) ? value.action : void 0)?.data;
+	return (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(data) && data.openclawAction === "approval";
+}
+async function maybeHandleMSTeamsApprovalCardSubmit(params) {
+	const { context, deps } = params;
+	if (!isMSTeamsApprovalSubmit(context.activity.value)) return false;
+	const ignored = (reason) => deps.log.info("msteams approval ignored", { reason });
+	const token = require_approval_card.readMSTeamsApprovalActionToken(context.activity.value);
+	if (!token) {
+		ignored("missing card token");
+		return true;
+	}
+	const binding = require_approval_card.getMSTeamsApprovalCardBinding(token);
+	if (!binding) {
+		ignored("unknown or expired card token");
+		return true;
+	}
+	if (binding.accountId !== openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID) {
+		ignored("card token account mismatch");
+		return true;
+	}
+	if (require_resolve_allowlist.normalizeMSTeamsConversationId(context.activity.conversation?.id ?? "") !== require_resolve_allowlist.normalizeMSTeamsConversationId(binding.conversationId)) {
+		ignored("card token conversation mismatch");
+		return true;
+	}
+	if (context.activity.replyToId && context.activity.replyToId !== binding.activityId) {
+		ignored("card token activity mismatch");
+		return true;
+	}
+	if (!binding.allowedDecisions.includes(binding.decision)) {
+		ignored("card token decision is no longer allowed");
+		return true;
+	}
+	const senderId = context.activity.from?.aadObjectId;
+	if (!(require_thread_session.msTeamsApprovalAuth.authorizeActorAction?.({
+		cfg: deps.cfg,
+		accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+		senderId,
+		action: "approve",
+		approvalKind: binding.approvalKind
+	}))?.authorized) {
+		ignored(`unauthorized actor ${senderId || "unknown"}`);
+		return true;
+	}
+	const claim = require_approval_card.claimMSTeamsApprovalCardBinding(token);
+	if (claim.kind !== "claimed") {
+		ignored(claim.kind === "in-flight" ? "card token resolve already in flight" : "card token already consumed");
+		return true;
+	}
+	const consumed = claim.binding;
+	let result;
+	try {
+		result = await (0, openclaw_plugin_sdk_approval_gateway_runtime.resolveApprovalOverGateway)({
+			cfg: deps.cfg,
+			approvalId: consumed.approvalId,
+			approvalKind: consumed.approvalKind,
+			decision: consumed.decision,
+			channel: "msteams",
+			accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+			senderId
+		});
+		await context.updateActivity({
+			type: "message",
+			id: consumed.activityId,
+			attachments: [{
+				contentType: "application/vnd.microsoft.card.adaptive",
+				content: require_approval_card.buildMSTeamsCanonicalApprovalTerminalCard(result)
+			}]
+		});
+	} catch (error) {
+		if ((0, openclaw_plugin_sdk_error_runtime.isApprovalNotFoundError)(error)) {
+			require_approval_card.completeMSTeamsApprovalCardBinding(token);
+			ignored(`approval expired or no longer exists id=${consumed.approvalId}`);
+			return true;
+		}
+		require_approval_card.releaseMSTeamsApprovalCardBinding(token);
+		throw error;
+	}
+	require_approval_card.completeMSTeamsApprovalCardBinding(token);
+	deps.log.info("msteams approval resolved", {
+		approvalId: consumed.approvalId,
+		approvalKind: consumed.approvalKind,
+		applied: result.applied,
+		status: result.approval.status,
+		senderId
+	});
+	return true;
+}
+//#endregion
 //#region extensions/msteams/src/monitor-handler/access.ts
 const msteamsIngressIdentity = {
 	key: "sender-id",
+	authentication: "asserted",
 	normalize: normalizeIngressValue,
 	aliases: [{
 		key: "sender-name",
 		kind: "plugin:msteams-sender-name",
 		normalizeEntry: normalizeSenderNameIngressValue,
 		normalizeSubject: normalizeSenderNameIngressValue,
-		dangerous: true
+		authentication: "mutable"
 	}, {
 		key: "conversation-id",
 		kind: "plugin:msteams-conversation-id",
+		authentication: "asserted",
 		normalizeEntry: normalizeAllowlistConversationId,
 		normalizeSubject: normalizeAllowlistConversationId
 	}],
@@ -243,7 +343,23 @@ async function resolveMSTeamsSenderAccess(params) {
 	const resolved = await (0, openclaw_plugin_sdk_channel_ingress_runtime.resolveStableChannelMessageIngress)({
 		channelId: "msteams",
 		accountId: pairing.accountId,
-		identity: msteamsIngressIdentity,
+		identity: {
+			...msteamsIngressIdentity,
+			resolveParticipant: () => {
+				const tenantId = activity.channelData?.tenant?.id ?? activity.conversation?.tenantId;
+				const aadId = activity.from?.aadObjectId;
+				if (tenantId && aadId) return {
+					domain: `entra:${tenantId.toLowerCase()}`,
+					idKind: "object-id",
+					id: aadId.toLowerCase()
+				};
+				return msteamsCfg?.appId && activity.from?.id ? {
+					domain: `bot:${msteamsCfg.appId.toLowerCase()}`,
+					idKind: "channel-account-id",
+					id: activity.from.id
+				} : void 0;
+			}
+		},
 		cfg: params.cfg,
 		readStoreAllowFrom: pairing.readAllowFromStore,
 		subject: {
@@ -2089,7 +2205,7 @@ function createMSTeamsReplyDispatcher(params) {
 		cfg: params.cfg,
 		channel: "msteams"
 	});
-	const mediaMaxBytes = (0, openclaw_plugin_sdk_media_runtime.resolveChannelMediaMaxBytes)({
+	const mediaMaxBytes = (0, openclaw_plugin_sdk_account_helpers.resolveChannelMediaMaxBytes)({
 		cfg: params.cfg,
 		resolveChannelLimitMb: ({ cfg }) => cfg.channels?.msteams?.mediaMaxMb
 	});
@@ -2842,7 +2958,7 @@ function resolveParentCacheExpiresAt(nowRaw) {
 * Uses the injected `fetchParent` (defaults to `fetchChannelMessage`) so
 * tests can swap in a stub without mocking the Graph transport.
 */
-async function fetchParentMessageCached(token, groupId, channelId, parentId, fetchParent = require_messenger.fetchChannelMessage) {
+async function fetchParentMessageCached(token, groupId, channelId, parentId, fetchParent = require_reaction_types.fetchChannelMessage) {
 	const key = buildParentCacheKey(groupId, channelId, parentId);
 	const now = (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(Date.now());
 	const cached = parentCache.get(key);
@@ -2872,7 +2988,7 @@ function summarizeParentMessage(message) {
 	const sender = message.from?.user?.displayName ?? message.from?.application?.displayName ?? "unknown";
 	const contentType = message.body?.contentType ?? "text";
 	const raw = message.body?.content ?? "";
-	const text = contentType === "html" ? require_messenger.stripHtmlFromTeamsMessage(raw) : raw.replace(/\s+/g, " ").trim();
+	const text = contentType === "html" ? require_reaction_types.stripHtmlFromTeamsMessage(raw) : raw.replace(/\s+/g, " ").trim();
 	if (!text) return;
 	return {
 		sender,
@@ -2916,7 +3032,7 @@ function prepareMSTeamsThreadRouting(params) {
 			id: params.isDirectMessage ? params.senderId : params.conversationId
 		}
 	});
-	route.sessionKey = require_channel.resolveMSTeamsRouteSessionKey({
+	route.sessionKey = require_thread_session.resolveMSTeamsRouteSessionKey({
 		baseSessionKey: route.sessionKey,
 		isChannel: params.isChannel,
 		conversationMessageId: params.conversationMessageId,
@@ -2967,7 +3083,7 @@ async function resolveMSTeamsThreadContext(params) {
 		quoteBodyFull = await require_resolve_allowlist.withMSTeamsRequestDeadline({
 			deadline,
 			label: "MS Teams quote lookup",
-			work: () => require_messenger.fetchChatMessageText(graphToken, params.conversationId, quoteMessageId, deadline)
+			work: () => require_reaction_types.fetchChatMessageText(graphToken, params.conversationId, quoteMessageId, deadline)
 		});
 	} catch (err) {
 		params.log.debug?.("failed to fetch full quoted message text", { error: require_channel_setup.formatUnknownError(err) });
@@ -2983,7 +3099,7 @@ async function resolveMSTeamsThreadContext(params) {
 		const [parentResult, repliesResult] = await require_resolve_allowlist.withMSTeamsRequestDeadline({
 			deadline,
 			label: "MS Teams thread history",
-			work: () => Promise.allSettled([fetchParentMessageCached(graphToken, teamAadGroupId, params.conversationId, threadParentId, (token, groupId, requestedChannelId, messageId) => require_messenger.fetchChannelMessage(token, groupId, requestedChannelId, messageId, deadline)), require_messenger.fetchThreadReplies(graphToken, teamAadGroupId, params.conversationId, threadParentId, 50, deadline)])
+			work: () => Promise.allSettled([fetchParentMessageCached(graphToken, teamAadGroupId, params.conversationId, threadParentId, (token, groupId, requestedChannelId, messageId) => require_reaction_types.fetchChannelMessage(token, groupId, requestedChannelId, messageId, deadline)), require_reaction_types.fetchThreadReplies(graphToken, teamAadGroupId, params.conversationId, threadParentId, 50, deadline)])
 		});
 		const parentMsg = parentResult.status === "fulfilled" ? parentResult.value : void 0;
 		const replies = repliesResult.status === "fulfilled" ? repliesResult.value : [];
@@ -3023,7 +3139,7 @@ async function resolveMSTeamsThreadContext(params) {
 			kind: "thread",
 			isSenderAllowed: isThreadSenderAllowed
 		});
-		threadContext = require_messenger.formatThreadContext(threadMessages, activity.id) || void 0;
+		threadContext = require_reaction_types.formatThreadContext(threadMessages, activity.id) || void 0;
 	} catch (err) {
 		params.log.debug?.("failed to fetch thread history", { error: require_channel_setup.formatUnknownError(err) });
 	}
@@ -3349,7 +3465,7 @@ function createMSTeamsReactionHandler(deps) {
 		const targetMessageId = activity.replyToId ?? "unknown";
 		for (const reaction of reactions) {
 			const reactionType = reaction.type ?? "unknown";
-			const emoji = require_messenger.resolveMSTeamsReactionEmoji(reactionType);
+			const emoji = require_reaction_types.resolveMSTeamsReactionEmoji(reactionType);
 			const label = direction === "added" ? `Teams reaction ${emoji} added by ${senderName} on message ${targetMessageId}` : `Teams reaction ${emoji} removed by ${senderName} from message ${targetMessageId}`;
 			log.info(`reaction ${direction}`, {
 				sender: senderId,
@@ -3491,6 +3607,10 @@ function registerMSTeamsHandlers(handler, deps) {
 	if (originalRun) handler.run = async (context, turnAdoptionLifecycle) => {
 		const ctx = context;
 		if (ctx.activity?.type === "invoke" && ctx.activity?.name === "adaptiveCard/action") {
+			if (await maybeHandleMSTeamsApprovalCardSubmit({
+				context: ctx,
+				deps
+			})) return;
 			const text = serializeMSTeamsAdaptiveCardActionValue(ctx.activity?.value);
 			if (text) return await handleTeamsMessage({
 				...ctx,
@@ -3511,7 +3631,15 @@ function registerMSTeamsHandlers(handler, deps) {
 			await next();
 		};
 		try {
-			const result = await handleTeamsMessage(context, turnAdoptionLifecycle);
+			const ctx = context;
+			if (await maybeHandleMSTeamsApprovalCardSubmit({
+				context: ctx,
+				deps
+			})) {
+				await runNext();
+				return;
+			}
+			const result = await handleTeamsMessage(ctx, turnAdoptionLifecycle);
 			await runNext();
 			return result;
 		} catch (err) {
@@ -4127,7 +4255,7 @@ async function monitorMSTeamsProvider(opts) {
 	};
 	const port = msteamsCfg.webhook?.port ?? 3978;
 	const textLimit = core.channel.text.resolveTextChunkLimit(cfg, "msteams");
-	const mediaMaxBytes = (0, openclaw_plugin_sdk_media_runtime.resolveChannelMediaMaxBytes)({
+	const mediaMaxBytes = (0, openclaw_plugin_sdk_account_helpers.resolveChannelMediaMaxBytes)({
 		cfg,
 		resolveChannelLimitMb: ({ cfg: channelCfg }) => channelCfg.channels?.msteams?.mediaMaxMb
 	}) ?? 8 * 1024 * 1024;

package/dist/thread-session-Br3R0ovy.cjs

@@ -0,0 +1,63 @@
+const require_resolve_allowlist = require("./resolve-allowlist-CWbvAW4v.cjs");
+let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
+let openclaw_plugin_sdk_approval_auth_runtime = require("openclaw/plugin-sdk/approval-auth-runtime");
+let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
+//#region extensions/msteams/src/approval-auth.ts
+const MSTEAMS_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function normalizeMSTeamsApproverId(value) {
+	const normalized = require_resolve_allowlist.normalizeMSTeamsMessagingTarget(String(value));
+	const id = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(normalized?.startsWith("user:") ? normalized.slice(5) : normalized);
+	return id && MSTEAMS_ID_RE.test(id) ? id : void 0;
+}
+function resolveMSTeamsChannelConfig(cfg) {
+	return cfg.channels?.msteams;
+}
+const msTeamsApproval = (0, openclaw_plugin_sdk_approval_auth_runtime.createChannelApprovalAuth)({
+	channelLabel: "Microsoft Teams",
+	resolveInputs: ({ cfg }) => {
+		const channel = resolveMSTeamsChannelConfig(cfg);
+		return {
+			allowFrom: channel?.allowFrom,
+			defaultTo: channel?.defaultTo
+		};
+	},
+	normalizeApprover: normalizeMSTeamsApproverId,
+	normalizeSenderId: (value) => {
+		const trimmed = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(value);
+		if (!trimmed) return;
+		return MSTEAMS_ID_RE.test(trimmed) ? trimmed : void 0;
+	}
+});
+const getMSTeamsApprovalApprovers = msTeamsApproval.resolveApprovers;
+const msTeamsApprovalAuth = msTeamsApproval.approvalAuth;
+//#endregion
+//#region extensions/msteams/src/monitor-handler/thread-session.ts
+const TRAILING_THREAD_SUFFIX = /(?::thread:[^:]+)+$/;
+function resolveMSTeamsRouteSessionKey(params) {
+	const channelThreadId = params.isChannel ? params.conversationMessageId ?? params.replyToId ?? void 0 : void 0;
+	const cleanBase = params.baseSessionKey.replace(TRAILING_THREAD_SUFFIX, "");
+	return (0, openclaw_plugin_sdk_routing.resolveThreadSessionKeys)({
+		baseSessionKey: cleanBase,
+		threadId: channelThreadId,
+		parentSessionKey: channelThreadId ? cleanBase : void 0
+	}).sessionKey;
+}
+//#endregion
+Object.defineProperty(exports, "getMSTeamsApprovalApprovers", {
+	enumerable: true,
+	get: function() {
+		return getMSTeamsApprovalApprovers;
+	}
+});
+Object.defineProperty(exports, "msTeamsApprovalAuth", {
+	enumerable: true,
+	get: function() {
+		return msTeamsApprovalAuth;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsRouteSessionKey", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsRouteSessionKey;
+	}
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/msteams",
-  "version": "2026.8.1-beta.3",
+  "version": "2026.8.1",
   "description": "OpenClaw Microsoft Teams channel plugin for bot conversations.",
   "repository": {
     "type": "git",
@@ -8,21 +8,21 @@
   },
   "type": "module",
   "dependencies": {
-    "@azure/identity": "4.13.1",
-    "@microsoft/teams.api": "2.0.14",
-    "@microsoft/teams.apps": "2.0.14",
+    "@azure/identity": "4.13.2",
+    "@microsoft/teams.api": "2.0.15",
+    "@microsoft/teams.apps": "2.0.15",
     "express": "5.2.1",
-    "typebox": "1.3.6",
+    "typebox": "1.3.16",
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@microsoft/teams.common": "2.0.14",
+    "@microsoft/teams.common": "2.0.15",
     "@openclaw/plugin-sdk": "workspace:*",
-    "jose": "6.2.4",
+    "jose": "6.2.10",
     "openclaw": "workspace:*"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.8.1-beta.3"
+    "openclaw": ">=2026.8.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -43,7 +43,9 @@
             "MSTEAMS_APP_PASSWORD",
             "MSTEAMS_TENANT_ID"
           ]
-        }
+        },
+        "specifier": "./dist/configured-state.cjs",
+        "exportName": "hasConfiguredMSTeamsChannelState"
       },
       "label": "Microsoft Teams",
       "selectionLabel": "Microsoft Teams (Teams SDK)",
@@ -70,10 +72,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.8.1-beta.3"
+      "pluginApi": ">=2026.8.1"
     },
     "build": {
-      "openclawVersion": "2026.8.1-beta.3",
+      "openclawVersion": "2026.8.1",
       "runtimeFormat": "cjs"
     },
     "release": {