@openclaw/msteams 2026.8.1-beta.3 → 2026.8.2

package/dist/{src-C127-DcQ.cjs → src-RSjkJRjI.cjs}

@@ -1,16 +1,20 @@
-const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-CIfWUwuc.cjs");
-const require_channel = require("./channel-KpWENcgK.cjs");
-const require_channel_setup = require("./channel.setup-mOFtsfYz.cjs");
-const require_polls = require("./polls-DvuJvaDG.cjs");
-const require_sso_token_store = require("./sso-token-store-ChhO1f4i.cjs");
-const require_messenger = require("./messenger-IISPSOvj.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-BrdWKHE-.cjs");
+const require_channel = require("./channel-DLn4b6Qi.cjs");
+const require_thread_session = require("./thread-session-DxOri69r.cjs");
+const require_channel_setup = require("./channel.setup-BRbhaigB.cjs");
+const require_polls = require("./polls-P86qBpeV.cjs");
+const require_sso_token_store = require("./sso-token-store-CNbRhz-A.cjs");
+const require_approval_card = require("./approval-card-BEblaIto.cjs");
+const require_messenger = require("./messenger-flkiAkkB.cjs");
+const require_reaction_types = require("./reaction-types-CL79V_5D.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
+let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runtime");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
@@ -18,8 +22,10 @@ let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
 let node_crypto = require("node:crypto");
 node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+let openclaw_plugin_sdk_collection_runtime = require("openclaw/plugin-sdk/collection-runtime");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
+let openclaw_plugin_sdk_approval_gateway_runtime = require("openclaw/plugin-sdk/approval-gateway-runtime");
 let openclaw_plugin_sdk_channel_ingress_runtime = require("openclaw/plugin-sdk/channel-ingress-runtime");
 let openclaw_plugin_sdk_context_visibility_runtime = require("openclaw/plugin-sdk/context-visibility-runtime");
 let openclaw_plugin_sdk_reply_history = require("openclaw/plugin-sdk/reply-history");
@@ -28,12 +34,11 @@ let openclaw_plugin_sdk_extension_shared = require("openclaw/plugin-sdk/extensio
 let openclaw_plugin_sdk_plugin_runtime = require("openclaw/plugin-sdk/plugin-runtime");
 let openclaw_plugin_sdk_dedupe_runtime = require("openclaw/plugin-sdk/dedupe-runtime");
 let openclaw_plugin_sdk_plugin_state_runtime = require("openclaw/plugin-sdk/plugin-state-runtime");
-let openclaw_plugin_sdk_collection_runtime = require("openclaw/plugin-sdk/collection-runtime");
 let openclaw_plugin_sdk_gateway_runtime = require("openclaw/plugin-sdk/gateway-runtime");
 let openclaw_plugin_sdk_channel_pairing = require("openclaw/plugin-sdk/channel-pairing");
-let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_runtime_group_policy = require("openclaw/plugin-sdk/runtime-group-policy");
 let openclaw_plugin_sdk_dangerous_name_runtime = require("openclaw/plugin-sdk/dangerous-name-runtime");
+let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
 let openclaw_plugin_sdk_webhook_ingress = require("openclaw/plugin-sdk/webhook-ingress");
 //#region extensions/msteams/src/feedback-reflection-store.ts
 const LEARNINGS_NAMESPACE = "feedback-learnings";
@@ -166,19 +171,114 @@ function serializeMSTeamsAdaptiveCardActionValue(value) {
 	}
 }
 //#endregion
+//#region extensions/msteams/src/approval-card-submit.ts
+function isMSTeamsApprovalSubmit(value) {
+	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value)) return false;
+	if (value.openclawAction === "approval") return true;
+	const data = ((0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value.action) ? value.action : void 0)?.data;
+	return (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(data) && data.openclawAction === "approval";
+}
+async function maybeHandleMSTeamsApprovalCardSubmit(params) {
+	const { context, deps } = params;
+	if (!isMSTeamsApprovalSubmit(context.activity.value)) return false;
+	const ignored = (reason) => deps.log.info("msteams approval ignored", { reason });
+	const token = require_approval_card.readMSTeamsApprovalActionToken(context.activity.value);
+	if (!token) {
+		ignored("missing card token");
+		return true;
+	}
+	const binding = require_approval_card.getMSTeamsApprovalCardBinding(token);
+	if (!binding) {
+		ignored("unknown or expired card token");
+		return true;
+	}
+	if (binding.accountId !== openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID) {
+		ignored("card token account mismatch");
+		return true;
+	}
+	if (require_resolve_allowlist.normalizeMSTeamsConversationId(context.activity.conversation?.id ?? "") !== require_resolve_allowlist.normalizeMSTeamsConversationId(binding.conversationId)) {
+		ignored("card token conversation mismatch");
+		return true;
+	}
+	if (context.activity.replyToId && context.activity.replyToId !== binding.activityId) {
+		ignored("card token activity mismatch");
+		return true;
+	}
+	if (!binding.allowedDecisions.includes(binding.decision)) {
+		ignored("card token decision is no longer allowed");
+		return true;
+	}
+	const senderId = context.activity.from?.aadObjectId;
+	if (!(require_thread_session.msTeamsApprovalAuth.authorizeActorAction?.({
+		cfg: deps.cfg,
+		accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+		senderId,
+		action: "approve",
+		approvalKind: binding.approvalKind
+	}))?.authorized) {
+		ignored(`unauthorized actor ${senderId || "unknown"}`);
+		return true;
+	}
+	const claim = require_approval_card.claimMSTeamsApprovalCardBinding(token);
+	if (claim.kind !== "claimed") {
+		ignored(claim.kind === "in-flight" ? "card token resolve already in flight" : "card token already consumed");
+		return true;
+	}
+	const consumed = claim.binding;
+	let result;
+	try {
+		result = await (0, openclaw_plugin_sdk_approval_gateway_runtime.resolveApprovalOverGateway)({
+			cfg: deps.cfg,
+			approvalId: consumed.approvalId,
+			approvalKind: consumed.approvalKind,
+			decision: consumed.decision,
+			channel: "msteams",
+			accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+			senderId
+		});
+		await context.updateActivity({
+			type: "message",
+			id: consumed.activityId,
+			attachments: [{
+				contentType: "application/vnd.microsoft.card.adaptive",
+				content: require_approval_card.buildMSTeamsCanonicalApprovalTerminalCard(result)
+			}]
+		});
+	} catch (error) {
+		if ((0, openclaw_plugin_sdk_error_runtime.isApprovalNotFoundError)(error)) {
+			require_approval_card.completeMSTeamsApprovalCardBinding(token);
+			ignored(`approval expired or no longer exists id=${consumed.approvalId}`);
+			return true;
+		}
+		require_approval_card.releaseMSTeamsApprovalCardBinding(token);
+		throw error;
+	}
+	require_approval_card.completeMSTeamsApprovalCardBinding(token);
+	deps.log.info("msteams approval resolved", {
+		approvalId: consumed.approvalId,
+		approvalKind: consumed.approvalKind,
+		applied: result.applied,
+		status: result.approval.status,
+		senderId
+	});
+	return true;
+}
+//#endregion
 //#region extensions/msteams/src/monitor-handler/access.ts
 const msteamsIngressIdentity = {
 	key: "sender-id",
+	authentication: "asserted",
 	normalize: normalizeIngressValue,
 	aliases: [{
 		key: "sender-name",
 		kind: "plugin:msteams-sender-name",
 		normalizeEntry: normalizeSenderNameIngressValue,
 		normalizeSubject: normalizeSenderNameIngressValue,
-		dangerous: true
+		authentication: "mutable"
 	}, {
 		key: "conversation-id",
 		kind: "plugin:msteams-conversation-id",
+		authentication: "asserted",
 		normalizeEntry: normalizeAllowlistConversationId,
 		normalizeSubject: normalizeAllowlistConversationId
 	}],
@@ -221,8 +321,9 @@ async function resolveMSTeamsSenderAccess(params) {
 	const isDirectMessage = convType === "personal" || !convType && !activity.conversation?.isGroup;
 	const senderId = activity.from?.aadObjectId ?? activity.from?.id ?? "unknown";
 	const senderName = activity.from?.name ?? activity.from?.id ?? senderId;
+	const core = require_runtime.getMSTeamsRuntime();
 	const pairing = (0, openclaw_plugin_sdk_channel_pairing.createChannelPairingController)({
-		core: require_runtime.getMSTeamsRuntime(),
+		core,
 		channel: "msteams",
 		accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID
 	});
@@ -243,7 +344,23 @@ async function resolveMSTeamsSenderAccess(params) {
 	const resolved = await (0, openclaw_plugin_sdk_channel_ingress_runtime.resolveStableChannelMessageIngress)({
 		channelId: "msteams",
 		accountId: pairing.accountId,
-		identity: msteamsIngressIdentity,
+		identity: {
+			...msteamsIngressIdentity,
+			resolveParticipant: () => {
+				const tenantId = activity.channelData?.tenant?.id ?? activity.conversation?.tenantId;
+				const aadId = activity.from?.aadObjectId;
+				if (tenantId && aadId) return {
+					domain: `entra:${tenantId.toLowerCase()}`,
+					idKind: "object-id",
+					id: aadId.toLowerCase()
+				};
+				return msteamsCfg?.appId && activity.from?.id ? {
+					domain: `bot:${msteamsCfg.appId.toLowerCase()}`,
+					idKind: "channel-account-id",
+					id: activity.from.id
+				} : void 0;
+			}
+		},
 		cfg: params.cfg,
 		readStoreAllowFrom: pairing.readAllowFromStore,
 		subject: {
@@ -561,7 +678,8 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 		allowHosts: params.allowHosts,
 		authAllowHosts: params.authAllowHosts
 	});
-	if (!require_resolve_allowlist.isUrlAllowed(`${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}`, policy.allowHosts)) return;
+	const baseUrl = `${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}`;
+	if (!require_resolve_allowlist.isUrlAllowed(baseUrl, policy.allowHosts)) return;
 	let accessToken;
 	try {
 		accessToken = await require_resolve_allowlist.withMSTeamsRequestDeadline({
@@ -723,9 +841,11 @@ function summarizeMSTeamsHtmlAttachments(attachments) {
 		while (match) {
 			imgTags += 1;
 			const src = match[1]?.trim();
-			if (src) if (src.startsWith("data:")) dataImages += 1;
-			else if (src.startsWith("cid:")) cidImages += 1;
-			else srcHosts.add(require_resolve_allowlist.safeHostForUrl(src));
+			if (src) {
+				if (src.startsWith("data:")) dataImages += 1;
+				else if (src.startsWith("cid:")) cidImages += 1;
+				else srcHosts.add(require_resolve_allowlist.safeHostForUrl(src));
+			}
 			match = require_resolve_allowlist.IMG_SRC_RE.exec(html);
 		}
 		require_resolve_allowlist.ATTACHMENT_TAG_RE.lastIndex = 0;
@@ -885,10 +1005,11 @@ function scopeCandidatesForUrl(url) {
 	}
 }
 async function resolveInlineDataImageMime(inline) {
-	const mime = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(await require_runtime.getMSTeamsRuntime().media.detectMime({
+	const detectedMime = await require_runtime.getMSTeamsRuntime().media.detectMime({
 		buffer: inline.data,
 		headerMime: inline.contentType
-	}) ?? inline.contentType);
+	});
+	const mime = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(detectedMime ?? inline.contentType);
 	return mime?.startsWith("image/") ? mime : void 0;
 }
 async function fetchWithAuthFallback(params) {
@@ -1479,26 +1600,28 @@ async function resolveMSTeamsInboundMedia(params) {
 		});
 		const shouldFetchGraphMessage = hasHtmlFileAttachment || hasChannelOrGroupHtml;
 		const isBotFrameworkPersonalChat = isBotFrameworkPersonalChatId(conversationId);
-		if (hasHtmlFileAttachment && isBotFrameworkPersonalChat) if (!serviceUrl) log.debug?.("bot framework attachment skipped (missing serviceUrl)", {
-			conversationType,
-			conversationId
-		});
-		else {
-			const bfMedia = await downloadMSTeamsBotFrameworkAttachments({
-				serviceUrl,
-				attachmentIds,
-				tokenProvider,
-				maxBytes,
-				allowHosts,
-				authAllowHosts: params.authAllowHosts,
-				preserveFilenames,
-				deadline: params.deadline
-			});
-			if (bfMedia.media.length > 0) mediaList = mergeMSTeamsMediaFacts(mediaList, bfMedia.media, { positionallyAligned: false });
-			if (!hasMaterializedMedia(bfMedia.media)) log.debug?.("bot framework attachments fetch empty", {
+		if (hasHtmlFileAttachment && isBotFrameworkPersonalChat) {
+			if (!serviceUrl) log.debug?.("bot framework attachment skipped (missing serviceUrl)", {
 				conversationType,
-				attachmentCount: bfMedia.attachmentCount ?? attachmentIds.length
+				conversationId
 			});
+			else {
+				const bfMedia = await downloadMSTeamsBotFrameworkAttachments({
+					serviceUrl,
+					attachmentIds,
+					tokenProvider,
+					maxBytes,
+					allowHosts,
+					authAllowHosts: params.authAllowHosts,
+					preserveFilenames,
+					deadline: params.deadline
+				});
+				if (bfMedia.media.length > 0) mediaList = mergeMSTeamsMediaFacts(mediaList, bfMedia.media, { positionallyAligned: false });
+				if (!hasMaterializedMedia(bfMedia.media)) log.debug?.("bot framework attachments fetch empty", {
+					conversationType,
+					attachmentCount: bfMedia.attachmentCount ?? attachmentIds.length
+				});
+			}
 		}
 		if (shouldFetchGraphMessage && !hasMaterializedMedia(mediaList) && !isBotFrameworkPersonalChat) {
 			const graphTeamAadGroupId = conversationType.trim().toLowerCase() === "channel" && !teamAadGroupId ? await params.resolveTeamAadGroupId?.() : teamAadGroupId;
@@ -2043,7 +2166,7 @@ function createMSTeamsReplyDispatcher(params) {
 	* chains described in #59731 (60s+ total runs are common). Give tool
 	* chains up to 10 minutes before auto-stopping the keepalive.
 	*/
-	const TYPING_KEEPALIVE_MAX_DURATION_MS = 10 * 6e4;
+	const TYPING_KEEPALIVE_MAX_DURATION_MS = 6e5;
 	const streamActiveRef = { current: () => false };
 	const streamCanceledRef = { current: () => false };
 	const rawSendTypingIndicator = async () => {
@@ -2089,7 +2212,7 @@ function createMSTeamsReplyDispatcher(params) {
 		cfg: params.cfg,
 		channel: "msteams"
 	});
-	const mediaMaxBytes = (0, openclaw_plugin_sdk_media_runtime.resolveChannelMediaMaxBytes)({
+	const mediaMaxBytes = (0, openclaw_plugin_sdk_account_helpers.resolveChannelMediaMaxBytes)({
 		cfg: params.cfg,
 		resolveChannelLimitMb: ({ cfg }) => cfg.channels?.msteams?.mediaMaxMb
 	});
@@ -2437,7 +2560,7 @@ function createMSTeamsReplyDispatcher(params) {
 //#region extensions/msteams/src/sent-message-cache.ts
 const sentMessages = (0, openclaw_plugin_sdk_dedupe_runtime.createPersistentDedupeCache)({
 	globalKey: Symbol.for("openclaw.msteamsSentMessages"),
-	ttlMs: 1440 * 60 * 1e3,
+	ttlMs: 864e5,
 	maxSize: 2e4,
 	persistent: {
 		namespace: "msteams.sent-messages",
@@ -2816,7 +2939,7 @@ async function resolveTeamGroupId(params) {
 }
 //#endregion
 //#region extensions/msteams/src/thread-parent-context.ts
-const PARENT_CACHE_TTL_MS = 300 * 1e3;
+const PARENT_CACHE_TTL_MS = 3e5;
 const PARENT_CACHE_MAX = 100;
 const parentCache = /* @__PURE__ */ new Map();
 const INJECTED_MAX = 200;
@@ -2842,7 +2965,7 @@ function resolveParentCacheExpiresAt(nowRaw) {
 * Uses the injected `fetchParent` (defaults to `fetchChannelMessage`) so
 * tests can swap in a stub without mocking the Graph transport.
 */
-async function fetchParentMessageCached(token, groupId, channelId, parentId, fetchParent = require_messenger.fetchChannelMessage) {
+async function fetchParentMessageCached(token, groupId, channelId, parentId, fetchParent = require_reaction_types.fetchChannelMessage) {
 	const key = buildParentCacheKey(groupId, channelId, parentId);
 	const now = (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(Date.now());
 	const cached = parentCache.get(key);
@@ -2872,11 +2995,11 @@ function summarizeParentMessage(message) {
 	const sender = message.from?.user?.displayName ?? message.from?.application?.displayName ?? "unknown";
 	const contentType = message.body?.contentType ?? "text";
 	const raw = message.body?.content ?? "";
-	const text = contentType === "html" ? require_messenger.stripHtmlFromTeamsMessage(raw) : raw.replace(/\s+/g, " ").trim();
+	const text = contentType === "html" ? require_reaction_types.stripHtmlFromTeamsMessage(raw) : raw.replace(/\s+/g, " ").trim();
 	if (!text) return;
 	return {
 		sender,
-		text: text.length > PARENT_TEXT_MAX_CHARS ? `${(0, openclaw_plugin_sdk_text_utility_runtime.truncateUtf16Safe)(text, PARENT_TEXT_MAX_CHARS - 1)}…` : text
+		text: text.length > PARENT_TEXT_MAX_CHARS ? `${(0, openclaw_plugin_sdk_text_utility_runtime.truncateUtf16Safe)(text, 399)}…` : text
 	};
 }
 /**
@@ -2916,7 +3039,7 @@ function prepareMSTeamsThreadRouting(params) {
 			id: params.isDirectMessage ? params.senderId : params.conversationId
 		}
 	});
-	route.sessionKey = require_channel.resolveMSTeamsRouteSessionKey({
+	route.sessionKey = require_thread_session.resolveMSTeamsRouteSessionKey({
 		baseSessionKey: route.sessionKey,
 		isChannel: params.isChannel,
 		conversationMessageId: params.conversationMessageId,
@@ -2967,7 +3090,7 @@ async function resolveMSTeamsThreadContext(params) {
 		quoteBodyFull = await require_resolve_allowlist.withMSTeamsRequestDeadline({
 			deadline,
 			label: "MS Teams quote lookup",
-			work: () => require_messenger.fetchChatMessageText(graphToken, params.conversationId, quoteMessageId, deadline)
+			work: () => require_reaction_types.fetchChatMessageText(graphToken, params.conversationId, quoteMessageId, deadline)
 		});
 	} catch (err) {
 		params.log.debug?.("failed to fetch full quoted message text", { error: require_channel_setup.formatUnknownError(err) });
@@ -2983,7 +3106,7 @@ async function resolveMSTeamsThreadContext(params) {
 		const [parentResult, repliesResult] = await require_resolve_allowlist.withMSTeamsRequestDeadline({
 			deadline,
 			label: "MS Teams thread history",
-			work: () => Promise.allSettled([fetchParentMessageCached(graphToken, teamAadGroupId, params.conversationId, threadParentId, (token, groupId, requestedChannelId, messageId) => require_messenger.fetchChannelMessage(token, groupId, requestedChannelId, messageId, deadline)), require_messenger.fetchThreadReplies(graphToken, teamAadGroupId, params.conversationId, threadParentId, 50, deadline)])
+			work: () => Promise.allSettled([fetchParentMessageCached(graphToken, teamAadGroupId, params.conversationId, threadParentId, (token, groupId, requestedChannelId, messageId) => require_reaction_types.fetchChannelMessage(token, groupId, requestedChannelId, messageId, deadline)), require_reaction_types.fetchThreadReplies(graphToken, teamAadGroupId, params.conversationId, threadParentId, 50, deadline)])
 		});
 		const parentMsg = parentResult.status === "fulfilled" ? parentResult.value : void 0;
 		const replies = repliesResult.status === "fulfilled" ? repliesResult.value : [];
@@ -3023,7 +3146,7 @@ async function resolveMSTeamsThreadContext(params) {
 			kind: "thread",
 			isSenderAllowed: isThreadSenderAllowed
 		});
-		threadContext = require_messenger.formatThreadContext(threadMessages, activity.id) || void 0;
+		threadContext = require_reaction_types.formatThreadContext(threadMessages, activity.id) || void 0;
 	} catch (err) {
 		params.log.debug?.("failed to fetch thread history", { error: require_channel_setup.formatUnknownError(err) });
 	}
@@ -3316,7 +3439,8 @@ function createMSTeamsReactionHandler(deps) {
 			log.debug?.("reaction activity missing from.id; skipping");
 			return;
 		}
-		const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
+		const rawConversationId = activity.conversation?.id ?? "";
+		const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(rawConversationId);
 		const conversationType = activity.conversation?.conversationType ?? "personal";
 		const isGroupChat = conversationType === "groupChat" || activity.conversation?.isGroup === true;
 		const isChannel = conversationType === "channel";
@@ -3349,7 +3473,7 @@ function createMSTeamsReactionHandler(deps) {
 		const targetMessageId = activity.replyToId ?? "unknown";
 		for (const reaction of reactions) {
 			const reactionType = reaction.type ?? "unknown";
-			const emoji = require_messenger.resolveMSTeamsReactionEmoji(reactionType);
+			const emoji = require_reaction_types.resolveMSTeamsReactionEmoji(reactionType);
 			const label = direction === "added" ? `Teams reaction ${emoji} added by ${senderName} on message ${targetMessageId}` : `Teams reaction ${emoji} removed by ${senderName} from message ${targetMessageId}`;
 			log.info(`reaction ${direction}`, {
 				sender: senderId,
@@ -3491,6 +3615,10 @@ function registerMSTeamsHandlers(handler, deps) {
 	if (originalRun) handler.run = async (context, turnAdoptionLifecycle) => {
 		const ctx = context;
 		if (ctx.activity?.type === "invoke" && ctx.activity?.name === "adaptiveCard/action") {
+			if (await maybeHandleMSTeamsApprovalCardSubmit({
+				context: ctx,
+				deps
+			})) return;
 			const text = serializeMSTeamsAdaptiveCardActionValue(ctx.activity?.value);
 			if (text) return await handleTeamsMessage({
 				...ctx,
@@ -3511,7 +3639,15 @@ function registerMSTeamsHandlers(handler, deps) {
 			await next();
 		};
 		try {
-			const result = await handleTeamsMessage(context, turnAdoptionLifecycle);
+			const ctx = context;
+			if (await maybeHandleMSTeamsApprovalCardSubmit({
+				context: ctx,
+				deps
+			})) {
+				await runNext();
+				return;
+			}
+			const result = await handleTeamsMessage(ctx, turnAdoptionLifecycle);
 			await runNext();
 			return result;
 		} catch (err) {
@@ -3721,60 +3857,61 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 			return true;
 		}
 	}
-	if (consentResponse.action === "accept" && consentResponse.uploadInfo) if (pendingFile) {
-		log.debug?.("user accepted file consent, uploading", {
-			uploadId,
-			filename: pendingFile.filename,
-			size: pendingFile.buffer.length
-		});
-		try {
-			await require_messenger.uploadToConsentUrl({
-				url: consentResponse.uploadInfo.uploadUrl,
-				buffer: pendingFile.buffer,
-				contentType: pendingFile.contentType
-			});
-			const fileInfoCard = require_messenger.buildFileInfoCard({
-				filename: consentResponse.uploadInfo.name,
-				contentUrl: consentResponse.uploadInfo.contentUrl,
-				uniqueId: consentResponse.uploadInfo.uniqueId,
-				fileType: consentResponse.uploadInfo.fileType
-			});
-			if (!pendingFile.consentCardActivityId) await context.sendActivity({
-				type: "message",
-				attachments: [fileInfoCard]
+	if (consentResponse.action === "accept" && consentResponse.uploadInfo) {
+		if (pendingFile) {
+			log.debug?.("user accepted file consent, uploading", {
+				uploadId,
+				filename: pendingFile.filename,
+				size: pendingFile.buffer.length
 			});
-			if (pendingFile.consentCardActivityId) try {
-				await context.updateActivity({
-					id: pendingFile.consentCardActivityId,
-					type: "message",
-					attachments: [fileInfoCard]
+			try {
+				await require_messenger.uploadToConsentUrl({
+					url: consentResponse.uploadInfo.uploadUrl,
+					buffer: pendingFile.buffer,
+					contentType: pendingFile.contentType
+				});
+				const fileInfoCard = require_messenger.buildFileInfoCard({
+					filename: consentResponse.uploadInfo.name,
+					contentUrl: consentResponse.uploadInfo.contentUrl,
+					uniqueId: consentResponse.uploadInfo.uniqueId,
+					fileType: consentResponse.uploadInfo.fileType
 				});
-			} catch {
-				await context.sendActivity({
+				if (!pendingFile.consentCardActivityId) await context.sendActivity({
 					type: "message",
 					attachments: [fileInfoCard]
 				});
+				if (pendingFile.consentCardActivityId) try {
+					await context.updateActivity({
+						id: pendingFile.consentCardActivityId,
+						type: "message",
+						attachments: [fileInfoCard]
+					});
+				} catch {
+					await context.sendActivity({
+						type: "message",
+						attachments: [fileInfoCard]
+					});
+				}
+				log.info("file upload complete", {
+					uploadId,
+					filename: consentResponse.uploadInfo.name,
+					uniqueId: consentResponse.uploadInfo.uniqueId
+				});
+			} catch (err) {
+				log.error("file upload failed", {
+					uploadId,
+					error: require_channel_setup.formatUnknownError(err)
+				});
+				await context.sendActivity("File upload failed. Please try again.");
+			} finally {
+				require_messenger.removePendingUpload(uploadId);
+				await require_messenger.removePendingUploadFs(uploadId);
 			}
-			log.info("file upload complete", {
-				uploadId,
-				filename: consentResponse.uploadInfo.name,
-				uniqueId: consentResponse.uploadInfo.uniqueId
-			});
-		} catch (err) {
-			log.error("file upload failed", {
-				uploadId,
-				error: require_channel_setup.formatUnknownError(err)
-			});
-			await context.sendActivity("File upload failed. Please try again.");
-		} finally {
-			require_messenger.removePendingUpload(uploadId);
-			await require_messenger.removePendingUploadFs(uploadId);
+		} else {
+			log.debug?.("pending file not found for consent", { uploadId });
+			await context.sendActivity(expiredUploadMessage);
 		}
 	} else {
-		log.debug?.("pending file not found for consent", { uploadId });
-		await context.sendActivity(expiredUploadMessage);
-	}
-	else {
 		log.debug?.("user declined file consent", { uploadId });
 		require_messenger.removePendingUpload(uploadId);
 		await require_messenger.removePendingUploadFs(uploadId);
@@ -4069,7 +4206,8 @@ async function monitorMSTeamsProvider(opts) {
 		const unresolved = [];
 		for (const entry of resolved) if (entry.resolved && entry.id) additions.push(entry.id);
 		else unresolved.push(entry.input);
-		(0, openclaw_plugin_sdk_allow_from.summarizeMapping)(label, resolved.filter((entry) => entry.resolved && entry.id).map((entry) => `${entry.input}→${entry.id}`), unresolved, runtime);
+		const mapping = resolved.filter((entry) => entry.resolved && entry.id).map((entry) => `${entry.input}→${entry.id}`);
+		(0, openclaw_plugin_sdk_allow_from.summarizeMapping)(label, mapping, unresolved, runtime);
 		return {
 			additions,
 			unresolved
@@ -4127,10 +4265,10 @@ async function monitorMSTeamsProvider(opts) {
 	};
 	const port = msteamsCfg.webhook?.port ?? 3978;
 	const textLimit = core.channel.text.resolveTextChunkLimit(cfg, "msteams");
-	const mediaMaxBytes = (0, openclaw_plugin_sdk_media_runtime.resolveChannelMediaMaxBytes)({
+	const mediaMaxBytes = (0, openclaw_plugin_sdk_account_helpers.resolveChannelMediaMaxBytes)({
 		cfg,
 		resolveChannelLimitMb: ({ cfg: channelCfg }) => channelCfg.channels?.msteams?.mediaMaxMb
-	}) ?? 8 * 1024 * 1024;
+	}) ?? 8388608;
 	const conversationStore = opts.conversationStore ?? require_polls.createMSTeamsConversationStoreState();
 	const pollStore = opts.pollStore ?? require_polls.createMSTeamsPollStoreState();
 	log.info(`starting provider (port ${port})`);

package/dist/{sso-token-store-ChhO1f4i.cjs → sso-token-store-CNbRhz-A.cjs}

@@ -1,5 +1,5 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
-const require_polls = require("./polls-DvuJvaDG.cjs");
+const require_polls = require("./polls-P86qBpeV.cjs");
 let node_crypto = require("node:crypto");
 //#region extensions/msteams/src/sso-token-store.ts
 /**

package/dist/thread-session-DxOri69r.cjs

@@ -0,0 +1,63 @@
+const require_resolve_allowlist = require("./resolve-allowlist-BrdWKHE-.cjs");
+let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
+let openclaw_plugin_sdk_approval_auth_runtime = require("openclaw/plugin-sdk/approval-auth-runtime");
+let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
+//#region extensions/msteams/src/approval-auth.ts
+const MSTEAMS_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function normalizeMSTeamsApproverId(value) {
+	const normalized = require_resolve_allowlist.normalizeMSTeamsMessagingTarget(String(value));
+	const id = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(normalized?.startsWith("user:") ? normalized.slice(5) : normalized);
+	return id && MSTEAMS_ID_RE.test(id) ? id : void 0;
+}
+function resolveMSTeamsChannelConfig(cfg) {
+	return cfg.channels?.msteams;
+}
+const msTeamsApproval = (0, openclaw_plugin_sdk_approval_auth_runtime.createChannelApprovalAuth)({
+	channelLabel: "Microsoft Teams",
+	resolveInputs: ({ cfg }) => {
+		const channel = resolveMSTeamsChannelConfig(cfg);
+		return {
+			allowFrom: channel?.allowFrom,
+			defaultTo: channel?.defaultTo
+		};
+	},
+	normalizeApprover: normalizeMSTeamsApproverId,
+	normalizeSenderId: (value) => {
+		const trimmed = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(value);
+		if (!trimmed) return;
+		return MSTEAMS_ID_RE.test(trimmed) ? trimmed : void 0;
+	}
+});
+const getMSTeamsApprovalApprovers = msTeamsApproval.resolveApprovers;
+const msTeamsApprovalAuth = msTeamsApproval.approvalAuth;
+//#endregion
+//#region extensions/msteams/src/monitor-handler/thread-session.ts
+const TRAILING_THREAD_SUFFIX = /(?::thread:[^:]+)+$/;
+function resolveMSTeamsRouteSessionKey(params) {
+	const channelThreadId = params.isChannel ? params.conversationMessageId ?? params.replyToId ?? void 0 : void 0;
+	const cleanBase = params.baseSessionKey.replace(TRAILING_THREAD_SUFFIX, "");
+	return (0, openclaw_plugin_sdk_routing.resolveThreadSessionKeys)({
+		baseSessionKey: cleanBase,
+		threadId: channelThreadId,
+		parentSessionKey: channelThreadId ? cleanBase : void 0
+	}).sessionKey;
+}
+//#endregion
+Object.defineProperty(exports, "getMSTeamsApprovalApprovers", {
+	enumerable: true,
+	get: function() {
+		return getMSTeamsApprovalApprovers;
+	}
+});
+Object.defineProperty(exports, "msTeamsApprovalAuth", {
+	enumerable: true,
+	get: function() {
+		return msTeamsApprovalAuth;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsRouteSessionKey", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsRouteSessionKey;
+	}
+});