Files
vercel__chat/packages/adapter-teams
github-actions[bot] e3c136b6dc chore(release): version packages (#710)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @chat-adapter/discord@4.35.0

### Minor Changes

- 26c0522: Add an opt-in channel allowlist for treating non-bot Discord
messages as directed to the bot without requiring a mention. Configure
via `respondToChannelIds` or the `DISCORD_RESPOND_TO_CHANNEL_IDS` env
var (comma-separated).

### Patch Changes

- b605cf6: Preserve Discord's angle-bracket syntax for suppressing link
previews when rendering markdown.
- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/slack@4.35.0

### Minor Changes

- bb7cd12: Expose sender email addresses on normalized incoming Slack
message authors. `message.author.email` is populated from the same
cached `users.info` lookup used for display names and requires the
`users:read.email` scope; without it the field stays undefined.
- 907450d: Enterprise Grid fixes:

- `handleOAuthCallback` now handles org-wide installs
(`is_enterprise_install`): Slack returns `team: null` for these, and the
installation is now keyed by the enterprise ID — the same key webhook
token resolution looks up — instead of failing. The result includes
`enterpriseId` and `isEnterpriseInstall`, and `SlackInstallation`
records both.
- Socket mode now resolves per-installation tokens for events, slash
commands, and interactive payloads in multi-workspace deployments
(matching the HTTP webhook path), and no longer drops `enterprise_id` /
`is_enterprise_install` / `is_ext_shared_channel` from event payloads.
- The user profile cache and display-name mention reverse index are now
scoped by installation in multi-workspace deployments, so profiles
fetched with one workspace's token no longer bleed into another and
mentions can no longer resolve to a same-named user from a different
workspace. Existing cache entries repopulate on first lookup
(single-workspace keys are unchanged). `withBotToken` accepts an
optional `{ installationId }` so proactive/cron posts outside webhook
handling scope these caches too.
- API calls made while handling an event from an org-wide install now
pass the event's `team_id` explicitly, as Slack requires for
workspace-scoped methods (`conversations.list`, `usergroups.*`, …) on
org tokens. When an event carries a `context_team_id` (shared channels
hosted on an "away" workspace), channel-addressed calls echo it back as
`client_context_team_id`.
- Retried event deliveries (`x-slack-retry-num`, socket `retry_num`) are
dropped when the original delivery was already dispatched, using an
`event_id` marker in the state adapter (24-hour TTL). Events whose first
delivery never arrived are still recovered via the retry.
- Bare `@W…` mentions in outgoing messages are now recognized as raw
Enterprise Grid user IDs (previously only `@U…` was), so they render as
real mentions instead of being treated as display names.
- Event token resolution now prefers the envelope's `authorizations[0]`
— Slack's documented location for the event's installation identity —
over the top-level `team_id`/`enterprise_id`, which can name a different
workspace for Slack Connect shared-channel events. Top-level fields
remain as a fallback.

### Patch Changes

- 80def3a: Add optional `isSystem` field to the normalized message
`Author` type to distinguish platform-generated messages from humans and
bots. The Slack adapter now sets `isSystem: true` for messages authored
by Slack's reserved `USLACK` user (e.g. "@user archived the channel"
notifications in DMs), so consumers no longer need to hard-code
Slack-specific user IDs.
- 92530dd: Return a replyable Slack thread ID from `channel.post()` by
using the posted top-level message's timestamp as the thread root.
- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/teams@4.35.0

### Minor Changes

- 5eb8b84: Add support for adding and removing reactions from Microsoft
Teams messages.
- 46681f5: Expose Microsoft Graph email addresses on normalized incoming
Teams message authors. Resolved user profiles are cached in the state
adapter (1 hour, failed lookups 5 minutes) so the lookup doesn't add a
Graph call per message.
- 160140e: Add native Microsoft Teams targeted message support via
`thread.postEphemeral()` and `channel.postEphemeral()`.
- e06b4b6: Add a `token` config option to `TeamsAdapterConfig` for
supplying a custom token factory, forwarded to the Teams SDK's
`AppOptions.token`. This lets bots authenticate on runtimes that can't
reach Azure IMDS (so `federated` managed identity isn't reachable) but
can still mint access tokens through an external mechanism, without
needing a static client secret.

### Patch Changes

- 3895ab3: Fall back to Microsoft Graph's user principal name when a
Teams user has no mail address.
- 93a58af: Show explicitly configured progress as a native Teams DM
status while preserving native streaming.
- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/telegram@4.35.0

### Minor Changes

- 54eea71: Add an optional Telegram user allowlist via `allowedUserIds`
or the comma-separated `TELEGRAM_ALLOWED_USER_IDS` environment variable.

### Patch Changes

- 0701679: Cache the compiled bot-mention regex in `isBotMentioned`
instead of recompiling it per message, and make the protected `sleep`
helper accept an optional `AbortSignal` so `stopPolling()` interrupts
the polling backoff delay immediately.
- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## chat@4.35.0

### Minor Changes

- 4cb7e5d: Add a `chat/workflow` subpath with `requestApproval()`:
durable human-in-the-loop approvals built on Workflow SDK. It posts an
approval card with Approve/Deny buttons, suspends the workflow until a
user decides (or an optional timeout elapses), validates approvers,
finalizes the card with the outcome, and returns `{ approved, timedOut,
user }`. Also exports the `buildApprovalCard` and `buildResolvedCard`
builders. Requires the new optional `workflow` peer dependency.
- 46681f5: Expose Microsoft Graph email addresses on normalized incoming
Teams message authors. Resolved user profiles are cached in the state
adapter (1 hour, failed lookups 5 minutes) so the lookup doesn't add a
Graph call per message.

### Patch Changes

- 80def3a: Add optional `isSystem` field to the normalized message
`Author` type to distinguish platform-generated messages from humans and
bots. The Slack adapter now sets `isSystem: true` for messages authored
by Slack's reserved `USLACK` user (e.g. "@user archived the channel"
notifications in DMs), so consumers no longer need to hard-code
Slack-specific user IDs.
- 93a58af: Show explicitly configured progress as a native Teams DM
status while preserving native streaming.
- 25f3099: `toAiMessages` no longer drops messages that have no text. A
message with an empty text body is now kept when it has links or
attachments the converter can include: images and text files (`text/*`,
JSON, XML, YAML, etc.) with a working `fetchData()`. Messages whose only
attachments are unsupported (video, audio, other file types, or
attachments without `fetchData()`) are still skipped, and
`onUnsupportedAttachment` now fires for video/audio attachments on these
previously filtered messages.

Note: multipart `content` no longer always starts with a text part. When
a kept message had no text, its `content` array contains only attachment
parts.
## @chat-adapter/gchat@4.35.0

### Patch Changes

- 270b1c2: fix(gchat): accept `endpointUrl` as a direct-webhook verifier
and verify each token type correctly

When a Google Chat app's connection setting **Authentication audience**
is set
to **HTTP endpoint URL** — Google's recommended option for HTTP-hosted
apps
not behind Cloud Run IAM, and the only mode available for Workspace
Add-on
Chat apps — incoming tokens are Google OIDC ID tokens whose `aud` is the
endpoint URL rather than the GCP project number. Previously the adapter
only
verified against `googleChatProjectNumber`, so URL-audience tokens
always
failed with 401 Unauthorized. The adapter now accepts `endpointUrl` as a
direct-webhook verifier (including in the constructor's fail-closed
check),
validating the OIDC token's audience plus the Google Chat issuer email
claims
  (`chat@system.gserviceaccount.com`, or the
`service-{projectNumber}@gcp-sa-gsuiteaddons.iam.gserviceaccount.com`
service
identity for Workspace Add-on Chat apps) with `email_verified: true` — a
public endpoint URL audience alone is not sufficient to forge a request.

  Project-number-audience tokens are now verified per Google's reference
  implementation: they are JWTs self-signed by
`chat@system.gserviceaccount.com`, so the adapter checks them against
that
  service account's X.509 certificates with issuer
`chat@system.gserviceaccount.com` (previously it used `verifyIdToken`,
which
only accepts Google OIDC issuers and certs and therefore rejected every
real
project-number token). When both verifiers are configured, either token
type
  is accepted.

  The adapter still infers an endpoint URL from incoming requests for
button-click action routing only — that inferred value is never used as
a
JWT verification audience, and inference now only happens after a
request
has passed verification (or verification was explicitly disabled),
because
  `request.url` derives from the attacker-controllable `Host` header in
  serverless runtimes.

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/github@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/linear@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/messenger@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/shared@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
## @chat-adapter/twilio@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/web@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/whatsapp@4.35.0

### Patch Changes

- 09b72e9: fix whatsapp card media duplication

- Prevent card titles and body content from appearing twice when sending
cards with files on WhatsApp.
- Avoid adding the full card fallback text as an image caption when an
interactive message follows.
- Keep interactive WhatsApp messages responsible for rendering card
titles, bodies, and actions.

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/x@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
  - @chat-adapter/shared@4.35.0
## @chat-adapter/state-ioredis@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
## @chat-adapter/state-memory@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
## @chat-adapter/state-pg@4.35.0

### Patch Changes

- d88789c: Fix `setIfNotExists()` so it can claim a cache key whose
existing row has expired. Previously the query used `ON CONFLICT DO
NOTHING`, so an expired row in `chat_state_cache` still blocked
acquisition until opportunistic cleanup deleted it — diverging from the
memory and Redis adapters, which treat expired entries as absent. Keys
stored without a TTL remain permanent and are never overwritten.
- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
## @chat-adapter/state-redis@4.35.0

### Patch Changes

- Updated dependencies [80def3a]
- Updated dependencies [4cb7e5d]
- Updated dependencies [46681f5]
- Updated dependencies [93a58af]
- Updated dependencies [25f3099]
  - chat@4.35.0
## @chat-adapter/tests@4.35.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-07-24 22:21:13 +01:00
..
2026-02-20 13:25:09 -08:00

Microsoft Teams adapter for Chat SDK

@chat-adapter/teams

npm package: @chat-adapter/teams

Agent Stack MIT License

Microsoft Teams adapter for Chat SDK.

Documentation: chat-sdk.dev/adapters/official/teams · Guides: vercel.com/kb/chat-sdk

Installation

pnpm add @chat-adapter/teams

Scaffold with the CLI

To scaffold a new Microsoft Teams bot with this adapter preselected:

npx create-chat-sdk@latest my-bot --adapter teams memory

Visit the adapters directory to see other available official and vendor-official adapters.

Usage

The adapter auto-detects TEAMS_APP_ID, TEAMS_APP_PASSWORD, and TEAMS_APP_TENANT_ID from environment variables:

import { Chat } from "chat";
import { createTeamsAdapter } from "@chat-adapter/teams";

const bot = new Chat({
  userName: "mybot",
  adapters: {
    teams: createTeamsAdapter({
      appType: "SingleTenant",
    }),
  },
});

bot.onNewMention(async (thread, message) => {
  await thread.post("Hello from Teams!");
});

Bot setup

The Teams CLI handles AAD app registration, client secret generation, bot registration, and Teams channel setup in one command.

npm install -g @microsoft/teams.cli

1. Create the app

teams login
teams status          # verify auth + sideloading permissions
teams app create --name "My Bot" --endpoint "https://your-domain.com/api/webhooks/teams" --env .env

Tip

For local development, use a tunnel (e.g. devtunnel, ngrok) to expose your local server.

Credentials (CLIENT_ID, CLIENT_SECRET, TENANT_ID) are written to .env. Rename them to match the adapter:

TEAMS_APP_ID=<CLIENT_ID>
TEAMS_APP_PASSWORD=<CLIENT_SECRET>
TEAMS_APP_TENANT_ID=<TENANT_ID>

2. Install in Teams

Get a direct install link:

teams app get <appId> --install-link

Or download the app package for sideloading:

teams app package download <appId> -o my-bot.zip

Then in Teams: Apps > Manage your apps > Upload an app > Upload a custom app.

3. Verify

teams app doctor <appId>

Checks bot registration, AAD app health, manifest consistency, and endpoint reachability.

Configuration

All options are auto-detected from environment variables when not provided. Internally, the adapter maps these options to the Teams SDK (@microsoft/teams.apps).

Option Required Description
appId No* Azure Bot App ID. Auto-detected from TEAMS_APP_ID
appPassword No** Azure Bot App Password. Auto-detected from TEAMS_APP_PASSWORD
federated No** Federated (workload identity) authentication config
appType No "MultiTenant" or "SingleTenant" (default: "MultiTenant")
appTenantId For SingleTenant Azure AD Tenant ID. Auto-detected from TEAMS_APP_TENANT_ID
userName No Bot display name (default: "bot")
apiUrl No Override the Teams API base URL (e.g. for GCC-High or sovereign-cloud deployments). Auto-detected from TEAMS_API_URL
logger No Logger instance (defaults to ConsoleLogger("info"))

*appId is required — either via config or TEAMS_APP_ID env var.

**Exactly one authentication method is required: appPassword or federated. When neither is provided, TEAMS_APP_PASSWORD is auto-detected from environment.

Authentication methods

The adapter supports two authentication methods. When no explicit auth is provided, TEAMS_APP_PASSWORD is auto-detected from environment variables.

Client secret (default)

The simplest option — provide appPassword directly or set TEAMS_APP_PASSWORD:

createTeamsAdapter({
  appPassword: "your_app_password_here",
});

Federated (workload identity)

For environments with managed identities (e.g. Azure Kubernetes Service, GitHub Actions). Maps to managedIdentityClientId in the Teams SDK:

createTeamsAdapter({
  federated: {
    clientId: "your_managed_identity_client_id_here",
  },
});

Environment variables

TEAMS_APP_ID=...
TEAMS_APP_PASSWORD=...
TEAMS_APP_TENANT_ID=...  # Required for SingleTenant apps
TEAMS_API_URL=...        # Optional, for GCC-High or sovereign-cloud deployments

Features

Messaging

Feature Supported
Post message Yes
Edit message Yes
Delete message Yes
File uploads Yes
Streaming Native (DMs) / Buffered fallback (group chats)

Rich content

Feature Supported
Card format Adaptive Cards
Buttons Yes
Link buttons Yes
Select menus No
Tables GFM
Fields Yes
Images in cards Yes
Modals Yes

Conversations

Feature Supported
Slash commands No
Mentions Yes
Add reactions Yes
Remove reactions Yes
Receive reactions Yes
Typing indicator Yes
DMs Yes
Ephemeral messages Yes (native targeted messages, public preview)
User lookup (getUser) Yes (requires User.Read.All)

Message history

Feature Supported
Fetch messages Yes (requires Graph permissions)
Fetch single message No
Fetch thread info Yes
Fetch channel messages Yes (requires Graph permissions)
List threads Yes (requires Graph permissions)
Fetch channel info Yes (requires Graph permissions)
Post channel message Yes

User lookup (getUser)

The adapter supports looking up user profiles via the Microsoft Graph API. To enable it:

  1. Grant the User.Read.All application permission in your Azure AD app registration
  2. Grant admin consent for the permission
const user = await bot.getUser(message.author);
console.log(user?.email);    // "alice@contoso.com"
console.log(user?.fullName); // "Alice Smith"

Incoming message authors also include email when Graph resolves the sender. The adapter uses the activity's Azure AD object ID first and falls back to its cached ID, so missing permissions or lookup failures leave message.author.email undefined without preventing message delivery. This applies to live incoming messages only — authors on edited-message events and messages returned by fetchMessages are not hydrated with an email. Resolved profiles are cached in the state adapter for 1 hour (failed lookups for 5 minutes), so busy conversations don't trigger a Graph call per message.

The adapter caches each user's Azure AD object ID from incoming activities for later getUser calls. getUser returns null if the user hasn't been seen or the Graph call fails.

Targeted / ephemeral messages

Teams targeted messages are available in public preview. Use the standard Chat SDK postEphemeral API to send a message that is visible only to a specific Teams conversation member:

await thread.postEphemeral(message.author, "Only you can see this.", {
  fallbackToDM: false,
});

The adapter sends these natively with Teams targeted message metadata. usedFallback is false when the Teams API accepts the message.

Message history (fetchMessages)

Fetching message history requires TEAMS_APP_TENANT_ID and the right permissions depending on the conversation type:

Context Permission Type Admin consent?
Channel ChannelMessage.Read.Group RSC No
Group chat ChatMessage.Read.Chat RSC No
DM Chat.Read.All Azure AD Yes

RSC permissions are set via the Teams CLI (no admin consent needed):

teams app rsc add <appId> ChannelMessage.Read.Group --type Application
teams app rsc add <appId> ChatMessage.Read.Chat --type Application

For DM message history, RSC is not sufficient. Add the Chat.Read.All Azure AD permission using the Azure CLI:

az ad app permission add \
  --id <appId> \
  --api 00000003-0000-0000-c000-000000000000 \
  --api-permissions 6b7d71aa-70aa-4810-a8d9-5d9fb2830017=Role

az ad app permission admin-consent --id <appId>

Without any of these permissions, fetchMessages will throw a NotImplementedError.

Receiving all messages

By default, Teams bots only receive messages when directly @-mentioned. The RSC permissions above (ChannelMessage.Read.Group and ChatMessage.Read.Chat) also enable receiving all messages in channels and group chats as a side effect.

Troubleshooting

Run teams app doctor <appId> to diagnose common issues — it checks bot registration, AAD app health, manifest consistency, and endpoint reachability.

"Unauthorized" error

  • Verify TEAMS_APP_ID and your chosen auth credential are correct
  • For client secret auth, check that TEAMS_APP_PASSWORD is valid and not expired
  • For federated auth, verify the managed identity client ID is correct and that federated credentials are configured in Azure AD
  • For SingleTenant apps, ensure TEAMS_APP_TENANT_ID is set
  • Check that the messaging endpoint URL is correct in Azure

Bot not appearing in Teams

  • Verify the Teams channel is enabled in Azure Bot
  • Check that the app manifest is correctly configured
  • Ensure the app is installed in the workspace/team

Messages not received

  • Verify the messaging endpoint URL is correct
  • Check that your server is accessible from the internet
  • Review Azure Bot logs for errors

AI Coding Agents

If you use an AI coding agent such as OpenAI Codex, Claude Code, or Cursor, install the Chat SDK skill so it knows the SDK APIs, adapter patterns, and project conventions before writing code.

npx skills add vercel/chat

The skill references bundled documentation in node_modules/chat/docs, plus adapter guides and starter templates in the published package.

You can also install the Vercel Plugin for a broader agent toolkit — it includes the Chat SDK skill alongside specialist agents, agent slash commands, and more:

npx plugins add vercel/vercel-plugin

The plugin is optional; the skill alone is enough to build with Chat SDK.

For agent-readable documentation, see chat-sdk.dev/llms.txt (page index) or chat-sdk.dev/llms-full.txt (full text).

License

MIT