PR #482 left a stale examples/quoted-replies entry (directory was
renamed to examples/quoting), and the lockfile predated PR #536's
examples/targeted-messages workspace. npm ci enforces lockfile
against workspace globs and was failing in CI; npm install tolerated
the drift. Regenerated from scratch so both new example workspaces
are present and the stale one is gone.

## Summary

Brings `main` into `release` for the 2.0.11 release, with quoted-replies
(PR #482) excluded.

Single squashed commit containing the diff between `release` (2.0.10)
and `main`, minus the quoted-replies feature.

## What's in this release

- All commits merged to main since 2.0.10 (the previous release),
notably:
- **Reactions GA** (PR #575) — `[Experimental]` removed;
`ReactionClient.remove()` → `delete()`
  - User-agent fix (PR #573)
  - Prompt Preview Support (PR #536)
  - Various dependency bumps and bug fixes

## What's NOT in this release

**Quoted-replies feature (PR #482) is excluded:**
- `prependQuote()`, `addQuote()` builder methods — absent
- `context.quote()` and quote-aware `reply()` behavior — reverted to
legacy `replyToId` + blockquote
- `examples/quoting` — removed
- QR-related tests — removed

**Kept intentionally:**
- `QuotedReplyEntity` type stays in the `Entity` union so inbound
activities carrying `quotedReply` entities still parse
- `addTargetedMessageInfo` runtime strip-QR logic (filters `e.type ===
'quotedReply'`) — preserves prompt-preview cleanup

## Version

`version.json`: `2.0.10` → `2.0.11`

## Test plan

- [x] `npm run lint` — 33/33 packages
- [x] `npm run build` — 35/35 packages
- [x] `npm run test` — 730/730 tests across 61 suites
- [x] `npm pack --workspaces` — all tarballs produced; verified
`quoted-reply-entity.d.ts` ships in `@microsoft/teams.api`; no
`prependQuote`/`addQuote` symbols in bundled `dist/`
- [ ] ADO Public publish pipeline (post-merge)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## CI note

skip-test-verification — the `release` branch is out of sync with `main`
for three template/example pairs (templates: `ai`; examples: `echo`,
`graph`). This PR brings them along as part of the bulk main→release
merge but doesn't try to re-pair them, since that's an orthogonal fix
and would muddy this PR's "single squashed release diff" intent.

## Summary

Brings `origin/main` into `release` for the **2.0.12** release. **No
carve-outs this time** — Quoted Replies is included.

`version.json`: `2.0.12-preview.{height}` → `2.0.12`.

Aligns with teams.py 2.0.12 (PR #442 already on PyPI / pending publish).

## What's in this release (delta from 2.0.11)

**Features**
- Quoted Replies + new quotes features — previously held back via the
2.0.11 carve-out (#576)
- SuggestedActionSubmitActivity for `suggestedAction/submit` invoke
(#591)
- Default targeted replies for targeted inbound messages (#592)
- Filter colliding keys before `Object.assign` in `ActivityContext`
(#596)
- Prompt Preview support (#536)
- A2A sample (#584)
- AI/MCPClient (#572)
- Allow passing custom HTTP client via `AppOptions`-equivalent
- Reactions API marked GA (#575), Rename `ReactionClient.remove()` →
`delete()` (#567)

**Security & fixes**
- Security hardening: tighten cross-origin policies (#595)
- Lock JsonWebToken trust-boundary contract (#586)
- `fix(deps)`: npm audit fix — clears all high-severity advisories
(#599)
- `fix(apps)`: log inbound activities at info, warn on missing
Authorization (#568)
- `fix`: App user-agent merging (#573)
- `fix`: Add null checks in `local-memory.ts` to prevent role crash
(#438)
- `fix`: `@microsoft/teams.client` import error in webpack 5 (#566)
- Switch to named imports without subpaths (#561)

**Deprecations / package changes**
- Deprecate `DevtoolsPlugin` in favor of Microsoft 365 Agents Playground
(#593)
- Remove in-repo Teams CLI package (#580) — moved to
`teams-sdk/packages/cli`
- Deprecate AI Libraries (#588)
- Correct imports + return types in misc. packages (#589)

**Dependency bumps**
- turbo 2.8.11 → 2.9.14 (#587)
- qs 6.15.0 → 6.15.2 (#594)
- hono 4.12.14 → 4.12.16 (#562)
- npm audit fix bundle (#599): axios 1.13.5 → 1.16.1, fast-uri 3.1.0 →
3.1.2, ws 8.19.0 → 8.21.0, @azure/msal-node hoisted 5.2.2, uuid 11.1.0 →
11.1.1, @azure/identity 4.13.0 → 4.13.1, express-rate-limit, ip-address,
brace-expansion, etc.

## Quoted Replies inclusion notes

- Teams client rendering is in-sync with the wire format as of
2026-05-06.
- APX QR rollout completed: Public 2026-04-10, GCCH/DoD/Gallatin
2026-04-14.
- No SDK-side carve-outs needed; this matches the teams.py 2.0.12 (PR
#442) decision.

## Branch structure note

`prep-release/2.0.12` is reset to `origin/main` + a one-line
`version.json` bump. Diff against `release` (this PR) shows the full
delta from 2.0.11. We deliberately did not use a 2-parent merge commit —
the auto-merge tried to interleave non-overlapping hunks from main's QR
additions with release's QR carve-outs in `activity.ts`, producing a
semantically broken file. Reset-to-main + version bump is the clean way
to express "release should equal main."

## Test plan

- [x] `npm install` clean (post-audit-fix lockfile)
- [x] `npm run build` — 33/33 targets clean
- [x] `npm test` — 14/14 task targets, 279+ tests pass
- [x] E2E echo bot smoke test against `cg-test-bot-py` via canary ABS —
done on `cg/audit-deps-ts` (now merged); covers axios + msal-node code
paths
- [ ] Pipeline Build + Test stages green on `release` after merge
- [ ] Publish pipeline run with **Public** → ESRP → npm
`@microsoft/teams.*@2.0.12`
- [ ] Smoke install: `npm view @microsoft/teams[email protected]` after
publish