#9949 fix(microsoft): validate Microsoft integrations, return dropped fields and expose missing params

Summary

• Outlook:
  • Read, search and the Outlook trigger now return bccRecipients, replyTo, internetMessageId, conversationId, categories, flag, isDraft and webLink. The trigger $select now requests them.
  • Send and Draft gain replyTo and importance. Reply and Forward gain Cc/Bcc; Reply All gains Bcc.
  • Send in reply mode now sends { message } only. It sent comment and message.body together, which Graph rejects with 400.
  • Trigger attachment fetches use the bounded $value download with a shared byte budget. They previously inlined base64 for every attachment.
• Teams:
  • Get Message, Add Reaction and Remove Reaction now show their chat and channel inputs on the canvas. Before, they always threw.
  • Scalar outputs (messageId, chatId, url, sender, …) are now emitted at the top level as well as under metadata. The top-level copies were always undefined.
  • Messages return the bot/app sender, replyToId, subject, importance, webUrl, mentions, reactions and edit times.
  • Read Chat and Read Channel get top/pageToken paging, and Read Channel gets includeReplies.
  • Reply and update gain contentType (default stays text).
  • The chat trigger returns the same message fields, and its attachment reads are byte-capped.
• OneDrive / Word:
  • Items return createdBy, lastModifiedBy, parentReference, folder.childCount and eTag.
  • List and search gain orderBy. Share links gain expirationDateTime.
  • Upload conflictBehavior is now reachable.
  • Word Graph JSON reads are capped.
• SharePoint:
  • Upload rejects dot-segment traversal in folderPath/fileName.
  • Read List gains filter, top and selectFields, and List Sites gains searchQuery.
  • Items and pages return the documented audit and publishing fields.
  • Page content is no longer logged.
• Excel:
  • Read gains valuesOnly (default unchanged).
  • Quoted sheet names work on sheet-only reads.
• Planner / Intune:
  • Read Task returns the documented task fields and full assignee detail.
  • Intune devices return 22 more v1.0 fields, including deviceActionResults.
  • Policies return odataType.
• Entra ID:
  • New List User Memberships operation (microsoft_ad_list_user_memberships, direct or transitive).
  • Users return more profile fields. Get User gains an opt-in includeManager.
  • Member lists return userPrincipalName.
• Power BI: reports return format, isOwnedByMe, appId and originalReportId.
• Dataverse:
  • List Records gains pageSize and same-origin nextLink paging.
  • Update Record gains returnRecord.
  • Search sends top/skip as numbers and surfaces search errors.
• Azure DevOps:
  • Work items return description, iteration, tags, priority, created/changed metadata, relations and the full field map.
  • WIQL link queries hydrate their items.
  • Builds and pipelines return continuation tokens. Builds gain the documented filters.
  • Timelines return issues.
  • The block exposes the tool params it was dropping.
• Azure Data Explorer:
  • Batch queries return every result table (additionalResults).
  • A byte budget truncates results that would previously have failed the tool response cap.
• All: path IDs go through safeUrlPathSegment. Valid Graph ids (ABC!123, base64 ids with =, 19:…@thread.v2, host,guid,guid) encode as before.
• Backwards compatibility:
  • No param, subBlock id, operation value, tool id or output was removed, renamed or retyped, and no defaults changed.
  • New params are optional and unset by default; new outputs are optional.
  • New inputs that apply to an existing operation use dedicated subBlock ids (for example AzDO queryTop, pipelinesTop, commentsTop, updateIterationPath and SharePoint itemSelectFields), so a stale value from another operation never starts flowing into a saved workflow.
  • Deliberate behaviour changes:
    • Outlook reply mode sends { message } only; the old comment + message.body body always returned 400.
    • SharePoint empty Read List returns items: [] instead of lists: [].
    • SharePoint nextPageUrl from a different collection is rejected.
    • SharePoint upload rejects traversal and ./.. file names.
    • Dataverse search errors now fail instead of returning empty results.
    • ADX truncates (truncated: true) instead of failing at the 10 MB tool response cap.
    • Teams Get Message and reactions now run from the canvas, and Teams scalar outputs resolve.
    • Teams trigger attachments share a 100 MB per-notification byte budget. An attachment over the budget is skipped with a warning instead of buffering unbounded.

Type of Change

• Bug fix
• New feature (additive params and outputs, Entra List User Memberships)

Testing

• New regression tests, each red on the pre-fix code:
  • Outlook reply body shape
  • SharePoint upload traversal
  • AzDO WIQL link-query hydration
  • ADX byte-cap truncation and multi-table batch
• vitest over every Microsoft tool, block, internal operation and webhook test file, plus blocks/blocks.test.ts: 428 passed
• These checks pass: check-block-registry.ts origin/staging, check:tool-metadata, check:docs, check:integration-catalog, check:explicit-any, check:utils, check:test-patterns, check:unused-exports, and biome on the changed files. Type-check and the full check:audits run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)