@openclaw/msteams 2026.5.27 → 2026.5.28-beta.2

package/dist/{graph-users-uPAE6-KQ.js → errors-B4snzfP5.js}

@@ -1,7 +1,7 @@
 import { M as getMSTeamsRuntime, h as fetchWithSsrFGuard$1 } from "./runtime-api-BlvMnDKz.js";
-import { n as refreshMSTeamsDelegatedTokens } from "./oauth.token-BNbWziwM.js";
+import { c as createMSTeamsHttpError, n as refreshMSTeamsDelegatedTokens } from "./oauth.token-5ygi8ycy.js";
 import { createRequire } from "node:module";
-import { isRecord, isRecord as isRecord$1, normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { isRecord, isRecord as isRecord$1, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 import { Buffer } from "node:buffer";
@@ -37,6 +37,7 @@ const DEFAULT_MEDIA_HOST_ALLOWLIST = [
 	"ams.skype.com",
 	"media.ams.skype.com",
 	"trafficmanager.net",
+	"botframework.azure.cn",
 	"blob.core.windows.net",
 	"azureedge.net",
 	"microsoft.com"
@@ -45,6 +46,7 @@ const DEFAULT_MEDIA_AUTH_HOST_ALLOWLIST = [
 	"api.botframework.com",
 	"botframework.com",
 	"smba.trafficmanager.net",
+	"botframework.azure.cn",
 	"graph.microsoft.com",
 	"graph.microsoft.us",
 	"graph.microsoft.de",
@@ -291,6 +293,20 @@ function resolveAllowedHosts(input) {
 function resolveAuthAllowedHosts(input) {
 	return normalizeHostnameSuffixAllowlist(input, DEFAULT_MEDIA_AUTH_HOST_ALLOWLIST);
 }
+function isMockFetchFn(fetchFn) {
+	const candidate = fetchFn;
+	return Boolean(candidate.mock || Object.prototype.hasOwnProperty.call(candidate, "_isMockFunction"));
+}
+function resolveGuardedFetchImpl(params) {
+	if (!params.fetchFn) return;
+	if (params.fetchFnSupportsDispatcher === true || params.fetchFn === fetch || params.fetchFn === globalThis.fetch || isMockFetchFn(params.fetchFn)) return params.fetchFn;
+	throw new Error("MSTeams attachment fetchFn must set fetchFnSupportsDispatcher to use guarded DNS pinning");
+}
+function resolveRetainedAuthorizationRedirectHostnameAllowlist(input) {
+	if (!input) return;
+	if (input.includes("*")) return ["*"];
+	return resolveMediaSsrfPolicy(input)?.hostnameAllowlist;
+}
 function resolveAttachmentFetchPolicy(params) {
 	return {
 		allowHosts: resolveAllowedHosts(params?.allowHosts),
@@ -340,6 +356,50 @@ async function resolveAndValidateIP(hostname, resolveFn) {
 }
 /** Maximum number of redirects to follow in safeFetch. */
 const MAX_SAFE_REDIRECTS = 5;
+const NULL_BODY_STATUSES$1 = new Set([
+	101,
+	204,
+	205,
+	304
+]);
+function responseWithRelease(response, release) {
+	let released = false;
+	const releaseOnce = async () => {
+		if (released) return;
+		released = true;
+		await release();
+	};
+	if (!response.body || NULL_BODY_STATUSES$1.has(response.status)) {
+		releaseOnce();
+		return response;
+	}
+	const reader = response.body.getReader();
+	const body = new ReadableStream({
+		async pull(controller) {
+			try {
+				const next = await reader.read();
+				if (next.done) {
+					controller.close();
+					await releaseOnce();
+					return;
+				}
+				controller.enqueue(next.value);
+			} catch (err) {
+				await releaseOnce();
+				throw err;
+			}
+		},
+		async cancel(reason) {
+			reader.cancel(reason).catch(() => {});
+			await releaseOnce();
+		}
+	});
+	return new Response(body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	});
+}
 /**
 * Fetch a URL with redirect: "manual", validating each redirect target
 * against the hostname allowlist and optional DNS-resolved IP (anti-SSRF).
@@ -349,12 +409,32 @@ const MAX_SAFE_REDIRECTS = 5;
 * - DNS rebinding attacks when a lookup function is provided
 */
 async function safeFetch(params) {
-	const fetchFn = params.fetchFn ?? fetch;
 	const resolveFn = params.resolveFn ?? lookup;
 	const hasDispatcher = Boolean(params.requestInit && typeof params.requestInit === "object" && "dispatcher" in params.requestInit);
 	const currentHeaders = new Headers(params.requestInit?.headers);
 	let currentUrl = params.url;
 	if (!isUrlAllowed(currentUrl, params.allowHosts)) throw new Error(`Initial download URL blocked: ${currentUrl}`);
+	if (currentHeaders.has("authorization") && params.authorizationAllowHosts && !isUrlAllowed(currentUrl, params.authorizationAllowHosts)) currentHeaders.delete("authorization");
+	if (!hasDispatcher) {
+		const guarded = await fetchWithSsrFGuard({
+			url: currentUrl,
+			fetchImpl: resolveGuardedFetchImpl({
+				fetchFn: params.fetchFn,
+				fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher
+			}),
+			init: {
+				...params.requestInit,
+				headers: currentHeaders
+			},
+			maxRedirects: MAX_SAFE_REDIRECTS,
+			requireHttps: true,
+			policy: resolveMediaSsrfPolicy(params.allowHosts),
+			lookupFn: resolveFn,
+			retainAuthorizationRedirectHostnameAllowlist: resolveRetainedAuthorizationRedirectHostnameAllowlist(params.authorizationAllowHosts),
+			auditContext: "msteams.attachment"
+		});
+		return responseWithRelease(guarded.response, guarded.release);
+	}
 	if (resolveFn) try {
 		const initialHost = new URL(currentUrl).hostname;
 		await resolveAndValidateIP(initialHost, resolveFn);
@@ -362,7 +442,7 @@ async function safeFetch(params) {
 		throw new Error(`Initial download URL blocked: ${currentUrl}`);
 	}
 	for (let i = 0; i <= MAX_SAFE_REDIRECTS; i++) {
-		const res = await fetchFn(currentUrl, {
+		const res = await (params.fetchFn ?? fetch)(currentUrl, {
 			...params.requestInit,
 			headers: currentHeaders,
 			redirect: "manual"
@@ -399,19 +479,73 @@ async function safeFetchWithPolicy(params) {
 		allowHosts: params.policy.allowHosts,
 		authorizationAllowHosts: params.policy.authAllowHosts,
 		fetchFn: params.fetchFn,
+		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 		requestInit: params.requestInit,
 		resolveFn: params.resolveFn
 	});
 }
+const PUBLIC_MSTEAMS_SERVICE_HOST = "smba.trafficmanager.net";
+const CHINA_BOT_FRAMEWORK_SERVICE_HOST = "botframework.azure.cn";
+function normalizeOptionalServiceUrl(value) {
+	const trimmed = value?.trim();
+	if (!trimmed) return null;
+	try {
+		const parsed = new URL(trimmed);
+		parsed.hash = "";
+		parsed.search = "";
+		parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+		return {
+			value: parsed.toString().replace(/\/+$/, ""),
+			host: parsed.hostname.toLowerCase()
+		};
+	} catch {
+		return null;
+	}
+}
+function resolveMSTeamsSdkCloudOptions(cfg) {
+	const cloud = cfg?.cloud ?? "Public";
+	const serviceUrl = cfg?.serviceUrl?.trim();
+	if (cloud !== "Public" && cloud !== "China" && !serviceUrl) throw new Error(`channels.msteams.cloud=${cloud} requires channels.msteams.serviceUrl so SDK proactive operations use the matching Teams Bot Connector endpoint.`);
+	return {
+		cloud,
+		...serviceUrl ? { serviceUrl } : {}
+	};
+}
+function isChinaBotFrameworkServiceHost(host) {
+	return host === CHINA_BOT_FRAMEWORK_SERVICE_HOST || host.endsWith(`.${CHINA_BOT_FRAMEWORK_SERVICE_HOST}`);
+}
+function isChinaBotFrameworkServiceUrl(value) {
+	const parsed = normalizeOptionalServiceUrl(value);
+	return Boolean(parsed && isChinaBotFrameworkServiceHost(parsed.host));
+}
+function validateMSTeamsProactiveServiceUrlBoundary(params) {
+	const configured = normalizeOptionalServiceUrl(params.configuredServiceUrl);
+	if (params.cloud !== "Public" && params.cloud !== "China" && !configured) throw new Error(`msteams proactive send blocked for ${params.conversationId}: channels.msteams.cloud=${params.cloud} requires channels.msteams.serviceUrl so SDK proactive operations use the matching Teams Bot Connector endpoint.`);
+	if (params.cloud === "China" && configured && !isChinaBotFrameworkServiceHost(configured.host)) throw new Error(`msteams proactive send blocked for ${params.conversationId}: configured Teams serviceUrl (${configured.value}) is not a Microsoft Teams China Bot Framework channel endpoint.`);
+	if (params.cloud !== "China" && configured && isChinaBotFrameworkServiceHost(configured.host)) throw new Error(`msteams proactive send blocked for ${params.conversationId}: configured Teams serviceUrl (${configured.value}) requires channels.msteams.cloud=China.`);
+	if (configured) {
+		const stored = normalizeOptionalServiceUrl(params.storedServiceUrl);
+		if (!stored) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation reference is missing a valid serviceUrl. Ask the bot to receive a new Teams message in this conversation, then retry.`);
+		if (stored.host !== configured.host) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation serviceUrl (${stored.value}) does not match configured Teams SDK serviceUrl host (${configured.host}). Set channels.msteams.cloud/channels.msteams.serviceUrl for the Teams cloud that owns this conversation, or refresh the stored conversation by receiving a new message.`);
+		return;
+	}
+	const stored = normalizeOptionalServiceUrl(params.storedServiceUrl);
+	if (!stored) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation reference is missing a valid serviceUrl. Ask the bot to receive a new Teams message in this conversation, then retry.`);
+	if (params.cloud === "China") {
+		if (!isChinaBotFrameworkServiceHost(stored.host)) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation serviceUrl (${stored.value}) is not a Microsoft Teams China Bot Framework channel endpoint. Use a conversation reference received from the China/21Vianet Teams cloud.`);
+		return;
+	}
+	if (isChinaBotFrameworkServiceUrl(stored.value)) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation serviceUrl (${stored.value}) requires channels.msteams.cloud=China.`);
+	if (stored.host !== PUBLIC_MSTEAMS_SERVICE_HOST) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation serviceUrl (${stored.value}) is not a Microsoft Teams public-cloud Bot Connector endpoint. Set channels.msteams.cloud and channels.msteams.serviceUrl for the supported Teams cloud that owns this conversation.`);
+}
 const BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST = normalizeHostnameSuffixAllowlist([
 	"smba.trafficmanager.net",
 	"smba.infra.gcc.teams.microsoft.com",
 	"smba.infra.gov.teams.microsoft.us",
-	"smba.infra.dod.teams.microsoft.us"
+	"smba.infra.dod.teams.microsoft.us",
+	"botframework.azure.cn"
 ]);
-const serviceUrlSsrfPolicy = buildHostnameAllowlistPolicyFromSuffixAllowlist(BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST);
-if (!serviceUrlSsrfPolicy) throw new Error("Microsoft Teams Bot Framework serviceUrl allowlist is empty");
-const BOT_FRAMEWORK_SERVICE_URL_SSRF_POLICY = serviceUrlSsrfPolicy;
+if (!buildHostnameAllowlistPolicyFromSuffixAllowlist(BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST)) throw new Error("Microsoft Teams Bot Framework serviceUrl allowlist is empty");
 function describeBotFrameworkServiceUrlHost(serviceUrl) {
 	try {
 		return new URL(serviceUrl.trim()).hostname || "invalid-url";
@@ -434,163 +568,6 @@ function normalizeBotFrameworkServiceUrl(serviceUrl) {
 	throw new Error(`Blocked Microsoft Teams serviceUrl host: ${describeBotFrameworkServiceUrlHost(serviceUrl)}`);
 }
 //#endregion
-//#region extensions/msteams/src/errors.ts
-function formatUnknownError(err) {
-	if (err instanceof Error) return err.message;
-	if (typeof err === "string") return err;
-	if (err === null) return "null";
-	if (err === void 0) return "undefined";
-	if (typeof err === "number" || typeof err === "boolean" || typeof err === "bigint") return String(err);
-	if (typeof err === "symbol") return err.description ?? err.toString();
-	if (typeof err === "function") return err.name ? `[function ${err.name}]` : "[function]";
-	try {
-		return JSON.stringify(err) ?? "unknown error";
-	} catch {
-		return "unknown error";
-	}
-}
-function extractStatusCode(err) {
-	if (!isRecord(err)) return null;
-	const direct = err.statusCode ?? err.status;
-	if (typeof direct === "number" && Number.isFinite(direct)) return direct;
-	if (typeof direct === "string") {
-		const parsed = Number.parseInt(direct, 10);
-		if (Number.isFinite(parsed)) return parsed;
-	}
-	const response = err.response;
-	if (isRecord(response)) {
-		const status = response.status;
-		if (typeof status === "number" && Number.isFinite(status)) return status;
-		if (typeof status === "string") {
-			const parsed = Number.parseInt(status, 10);
-			if (Number.isFinite(parsed)) return parsed;
-		}
-	}
-	return null;
-}
-function extractErrorCode(err) {
-	if (!isRecord(err)) return null;
-	const direct = err.code;
-	if (typeof direct === "string" && direct.trim()) return direct;
-	const response = err.response;
-	if (!isRecord(response)) return null;
-	const body = response.body;
-	if (isRecord(body)) {
-		const error = body.error;
-		if (isRecord(error) && typeof error.code === "string" && error.code.trim()) return error.code;
-	}
-	return null;
-}
-function extractRetryAfterMs(err) {
-	if (!isRecord(err)) return null;
-	const direct = err.retryAfterMs ?? err.retry_after_ms;
-	if (typeof direct === "number" && Number.isFinite(direct) && direct >= 0) return direct;
-	const retryAfter = err.retryAfter ?? err.retry_after;
-	if (typeof retryAfter === "number" && Number.isFinite(retryAfter)) return retryAfter >= 0 ? retryAfter * 1e3 : null;
-	if (typeof retryAfter === "string") {
-		const parsed = Number.parseFloat(retryAfter);
-		if (Number.isFinite(parsed) && parsed >= 0) return parsed * 1e3;
-	}
-	const response = err.response;
-	if (!isRecord(response)) return null;
-	const headers = response.headers;
-	if (!headers) return null;
-	if (isRecord(headers)) {
-		const raw = headers["retry-after"] ?? headers["Retry-After"];
-		if (typeof raw === "string") {
-			const parsed = Number.parseFloat(raw);
-			if (Number.isFinite(parsed) && parsed >= 0) return parsed * 1e3;
-		}
-	}
-	if (typeof headers === "object" && headers !== null && "get" in headers && typeof headers.get === "function") {
-		const raw = headers.get("retry-after");
-		if (raw) {
-			const parsed = Number.parseFloat(raw);
-			if (Number.isFinite(parsed) && parsed >= 0) return parsed * 1e3;
-		}
-	}
-	return null;
-}
-/**
-* Classify outbound send errors for safe retries and actionable logs.
-*
-* Important: We only mark errors as retryable when we have an explicit HTTP
-* status code that indicates the message was not accepted (e.g. 429, 5xx).
-* For transport-level errors where delivery is ambiguous, we prefer to avoid
-* retries to reduce the chance of duplicate posts.
-*/
-function classifyMSTeamsSendError(err) {
-	const statusCode = extractStatusCode(err);
-	const retryAfterMs = extractRetryAfterMs(err);
-	const errorCode = extractErrorCode(err) ?? void 0;
-	if (statusCode === 401) return {
-		kind: "auth",
-		statusCode,
-		errorCode
-	};
-	if (statusCode === 403) {
-		if (errorCode === "ContentStreamNotAllowed") return {
-			kind: "permanent",
-			statusCode,
-			errorCode
-		};
-		return {
-			kind: "auth",
-			statusCode,
-			errorCode
-		};
-	}
-	if (statusCode === 429) return {
-		kind: "throttled",
-		statusCode,
-		retryAfterMs: retryAfterMs ?? void 0,
-		errorCode
-	};
-	if (statusCode === 408 || statusCode != null && statusCode >= 500) return {
-		kind: "transient",
-		statusCode,
-		retryAfterMs: retryAfterMs ?? void 0,
-		errorCode
-	};
-	if (statusCode != null && statusCode >= 400) return {
-		kind: "permanent",
-		statusCode,
-		errorCode
-	};
-	if (statusCode == null) {
-		const networkCode = isRecord(err) && typeof err.code === "string" ? err.code : null;
-		if (networkCode === "ECONNREFUSED" || networkCode === "ENOTFOUND" || networkCode === "EHOSTUNREACH" || networkCode === "ETIMEDOUT" || networkCode === "ECONNRESET") return {
-			kind: "network",
-			errorCode: networkCode
-		};
-	}
-	return {
-		kind: "unknown",
-		statusCode: statusCode ?? void 0,
-		retryAfterMs: retryAfterMs ?? void 0,
-		errorCode
-	};
-}
-/**
-* Detect whether an error is caused by a revoked Proxy.
-*
-* The Bot Framework SDK wraps TurnContext in a Proxy that is revoked once the
-* turn handler returns.  Any later access (e.g. from a debounced callback)
-* throws a TypeError whose message contains the distinctive "proxy that has
-* been revoked" string.
-*/
-function isRevokedProxyError(err) {
-	if (!(err instanceof TypeError)) return false;
-	return /proxy that has been revoked/i.test(err.message);
-}
-function formatMSTeamsSendErrorHint(classification) {
-	if (classification.kind === "auth") return "check msteams appId/appPassword/tenantId (or env vars MSTEAMS_APP_ID/MSTEAMS_APP_PASSWORD/MSTEAMS_TENANT_ID)";
-	if (classification.errorCode === "ContentStreamNotAllowed") return "Teams expired the content stream; stop streaming earlier and fall back to normal message delivery";
-	if (classification.kind === "throttled") return "Teams throttled the bot; backing off may help";
-	if (classification.kind === "transient") return "transient Teams/Bot Framework error; retry may succeed";
-	if (classification.kind === "network") return "transport-level failure sending reply to Teams Bot Connector (smba.trafficmanager.net) — check egress firewall rules allow outbound HTTPS to smba.trafficmanager.net";
-}
-//#endregion
 //#region extensions/msteams/src/user-agent.ts
 let cachedUserAgent;
 function resolveTeamsSdkVersion() {
@@ -612,6 +589,17 @@ function buildUserAgent() {
 	cachedUserAgent = `teams.ts[apps]/${resolveTeamsSdkVersion()} OpenClaw/${resolveOpenClawVersion()}`;
 	return cachedUserAgent;
 }
+/**
+* User-Agent fragment for the Teams SDK App's client. The SDK's Client.clone
+* merges this with its own `teams.ts[apps]/<sdk-version>` identifier, so we
+* only contribute the OpenClaw piece — passing the full `buildUserAgent()`
+* would double-print the SDK token.
+*
+* Format: "OpenClaw/<openclaw-version>"
+*/
+function buildOpenClawUserAgentFragment() {
+	return `OpenClaw/${resolveOpenClawVersion()}`;
+}
 function ensureUserAgentHeader(headers) {
 	const nextHeaders = new Headers(headers);
 	if (!nextHeaders.has("User-Agent")) nextHeaders.set("User-Agent", buildUserAgent());
@@ -625,48 +613,61 @@ async function loadAzureIdentity() {
 	azureIdentityModulePromise ??= import(AZURE_IDENTITY_MODULE);
 	return azureIdentityModulePromise;
 }
-let msTeamsSdkPromise = null;
-async function loadMSTeamsSdk() {
-	msTeamsSdkPromise ??= Promise.all([import("@microsoft/teams.apps"), import("@microsoft/teams.api")]).then(([appsModule, apiModule]) => ({
-		App: appsModule.App,
-		Client: apiModule.Client
+let sdkAppPromise = null;
+async function loadSdkModules() {
+	sdkAppPromise ??= Promise.all([import("@microsoft/teams.apps"), import("@microsoft/teams.api")]).then(([apps, api]) => ({
+		App: apps.App,
+		ExpressAdapter: apps.ExpressAdapter,
+		cloudFromName: api.cloudFromName
 	}));
-	return msTeamsSdkPromise;
+	return sdkAppPromise;
 }
 /**
-* Create a no-op HTTP server adapter that satisfies the Teams SDK's
-* IHttpServerAdapter interface without spinning up an Express server.
-*
-* OpenClaw manages its own Express server for the Teams webhook endpoint, so
-* the SDK's built-in HTTP server is unnecessary.  Passing this adapter via the
-* `httpServerAdapter` option prevents the SDK from creating the default
-* HttpPlugin (which uses the deprecated `plugins` array and registers an
-* Express middleware with the pattern `/api*` — invalid in Express 5).
-*
-* See: https://github.com/openclaw/openclaw/issues/55161
-* See: https://github.com/openclaw/openclaw/issues/60732
+* Lazily construct an ExpressAdapter that the Teams SDK App can register its
+* routes on. The dynamic import keeps the SDK bundle off the hot startup path
+* when msteams is disabled; the structural return type matches what
+* `loadMSTeamsSdkWithAuth` accepts as its `httpServerAdapter` option.
 */
-function createNoOpHttpServerAdapter() {
-	return { registerRoute() {} };
+async function createMSTeamsExpressAdapter(serverOrApp) {
+	const { ExpressAdapter } = await loadSdkModules();
+	return new ExpressAdapter(serverOrApp);
 }
 /**
 * Create a Teams SDK App instance from credentials. The App manages token
 * acquisition, JWT validation, and the HTTP server lifecycle.
 *
-* This replaces the previous CloudAdapter + MsalTokenProvider + authorizeJWT
-* from @microsoft/agents-hosting.
+* Auth modes:
+* - Secret: clientId + clientSecret → MSAL client credential flow (SDK built-in)
+* - Managed identity: clientId + managedIdentityClientId → SDK built-in MI support
+* - Certificate: clientId + custom token provider via @azure/identity
 */
-async function createMSTeamsApp(creds, sdk) {
-	if (creds.type === "federated") return createFederatedApp(creds, sdk);
-	return new sdk.App({
+async function createMSTeamsApp(creds, options) {
+	const { App, cloudFromName } = await loadSdkModules();
+	const cloud = options?.cloud ?? "Public";
+	const serviceUrl = options?.serviceUrl ? normalizeBotFrameworkServiceUrl(options.serviceUrl) : void 0;
+	const appOptions = {
+		client: options?.httpClient ?? { headers: { "User-Agent": buildOpenClawUserAgentFragment() } },
+		...options?.httpServerAdapter ? { httpServerAdapter: options.httpServerAdapter } : {},
+		...options?.messagingEndpoint ? { messagingEndpoint: options.messagingEndpoint } : {},
+		cloud: cloudFromName(cloud),
+		...serviceUrl ? { serviceUrl } : {},
+		...options?.oauthDefaultConnectionName ? { oauth: { defaultConnectionName: options.oauthDefaultConnectionName } } : {}
+	};
+	if (creds.type === "federated") return createFederatedApp(creds, App, appOptions);
+	return new App({
 		clientId: creds.appId,
 		clientSecret: creds.appPassword,
 		tenantId: creds.tenantId,
-		httpServerAdapter: createNoOpHttpServerAdapter()
+		...appOptions
 	});
 }
-function createFederatedApp(creds, sdk) {
-	if (creds.useManagedIdentity) return createManagedIdentityApp(creds, sdk);
+function createFederatedApp(creds, App, appOptions) {
+	if (creds.useManagedIdentity) return new App({
+		clientId: creds.appId,
+		tenantId: creds.tenantId,
+		managedIdentityClientId: creds.managedIdentityClientId ?? "system",
+		...appOptions
+	});
 	if (!creds.certificatePath) throw new Error("Federated credentials require either a certificate path or managed identity.");
 	let privateKey;
 	try {
@@ -675,9 +676,9 @@ function createFederatedApp(creds, sdk) {
 		const msg = err instanceof Error ? err.message : String(err);
 		throw new Error(`Failed to read certificate file at '${creds.certificatePath}': ${msg}`, { cause: err });
 	}
-	return createCertificateApp(creds, privateKey, sdk);
+	return createCertificateApp(creds, privateKey, App, appOptions);
 }
-function createCertificateApp(creds, privateKey, sdk) {
+function createCertificateApp(creds, privateKey, App, appOptions) {
 	let credentialPromise = null;
 	const getCredential = async () => {
 		if (!credentialPromise) credentialPromise = loadAzureIdentity().then((az) => new az.ClientCertificateCredential(creds.tenantId, creds.appId, { certificate: privateKey }));
@@ -688,438 +689,32 @@ function createCertificateApp(creds, privateKey, sdk) {
 		if (!token?.token) throw new Error("Failed to acquire token via certificate credential.");
 		return token.token;
 	};
-	return new sdk.App({
+	return new App({
 		clientId: creds.appId,
 		tenantId: creds.tenantId,
 		token: tokenProvider,
-		httpServerAdapter: createNoOpHttpServerAdapter()
-	});
-}
-function createManagedIdentityApp(creds, sdk) {
-	let credentialPromise = null;
-	const getCredential = async () => {
-		if (!credentialPromise) credentialPromise = loadAzureIdentity().then((az) => creds.managedIdentityClientId ? new az.ManagedIdentityCredential(creds.managedIdentityClientId) : new az.ManagedIdentityCredential());
-		return credentialPromise;
-	};
-	const tokenProvider = async (scope) => {
-		const token = await (await getCredential()).getToken(scope);
-		if (!token?.token) throw new Error("Failed to acquire token via managed identity.");
-		return token.token;
-	};
-	return new sdk.App({
-		clientId: creds.appId,
-		tenantId: creds.tenantId,
-		token: tokenProvider,
-		httpServerAdapter: createNoOpHttpServerAdapter()
+		...appOptions
 	});
 }
 /**
-* Build a token provider that uses the Teams SDK App for token acquisition.
+* Build a token provider that uses the Teams SDK App's public tokenManager
+* for token acquisition.
 */
 function createMSTeamsTokenProvider(app) {
-	return { async getAccessToken(scope) {
-		if (scope.includes("graph.microsoft.com")) {
-			const token = await app.getAppGraphToken();
-			return token ? String(token) : "";
-		}
-		const token = await app.getBotToken();
-		return token ? String(token) : "";
-	} };
-}
-function createBotTokenGetter(app) {
-	return async () => {
-		const token = await app.getBotToken();
-		return token ? String(token) : void 0;
-	};
-}
-function createApiClient(sdk, serviceUrl, getToken) {
-	const normalizedServiceUrl = normalizeBotFrameworkServiceUrl(serviceUrl);
-	return new sdk.Client(normalizedServiceUrl, {
-		token: async () => await getToken() || void 0,
-		headers: { "User-Agent": buildUserAgent() }
-	});
-}
-function normalizeOutboundActivity(textOrActivity) {
-	return typeof textOrActivity === "string" ? {
-		type: "message",
-		text: textOrActivity
-	} : textOrActivity;
-}
-function createSendContext(params) {
-	const normalizedServiceUrl = tryNormalizeBotFrameworkServiceUrl(params.serviceUrl);
-	const apiClient = normalizedServiceUrl && params.conversationId ? createApiClient(params.sdk, normalizedServiceUrl, params.getToken) : void 0;
-	return {
-		async sendActivity(textOrActivity) {
-			const msg = normalizeOutboundActivity(textOrActivity);
-			if (params.treatInvokeResponseAsNoop && msg.type === "invokeResponse") return { id: "invokeResponse" };
-			if (params.serviceUrl && !normalizedServiceUrl) normalizeBotFrameworkServiceUrl(params.serviceUrl);
-			if (!apiClient || !params.conversationId) return { id: "unknown" };
-			const existingChannelData = msg.channelData && typeof msg.channelData === "object" ? msg.channelData : void 0;
-			const channelData = params.tenantId ? {
-				...existingChannelData,
-				tenant: { id: params.tenantId }
-			} : existingChannelData;
-			return await apiClient.conversations.activities(params.conversationId).create({
-				type: "message",
-				...msg,
-				...channelData ? { channelData } : {},
-				from: params.bot?.id ? {
-					id: params.bot.id,
-					name: params.bot.name ?? "",
-					role: "bot"
-				} : void 0,
-				conversation: {
-					id: params.conversationId,
-					conversationType: params.conversationType ?? "personal",
-					...params.tenantId ? { tenantId: params.tenantId } : {}
-				},
-				...params.recipientId || params.recipientAadObjectId ? { recipient: {
-					...params.recipientId ? { id: params.recipientId } : {},
-					...params.recipientAadObjectId ? { aadObjectId: params.recipientAadObjectId } : {}
-				} } : {},
-				...params.replyToActivityId && !msg.replyToId ? { replyToId: params.replyToActivityId } : {}
-			});
-		},
-		async updateActivity(activityUpdate) {
-			const nextActivity = activityUpdate;
-			const activityId = nextActivity.id;
-			if (!activityId) throw new Error("updateActivity requires an activity id");
-			if (!params.serviceUrl || !params.conversationId) return { id: "unknown" };
-			return await updateActivityViaRest({
-				serviceUrl: normalizeBotFrameworkServiceUrl(params.serviceUrl),
-				conversationId: params.conversationId,
-				activityId,
-				activity: nextActivity,
-				token: await params.getToken()
-			});
-		},
-		async deleteActivity(activityId) {
-			if (!activityId) throw new Error("deleteActivity requires an activity id");
-			if (!params.serviceUrl || !params.conversationId) return;
-			await deleteActivityViaRest({
-				serviceUrl: normalizeBotFrameworkServiceUrl(params.serviceUrl),
-				conversationId: params.conversationId,
-				activityId,
-				token: await params.getToken()
-			});
-		}
+	const tokenToString = (token) => {
+		if (token == null) return "";
+		return token.toString();
 	};
-}
-function createProcessContext(params) {
-	const serviceUrl = params.activity?.serviceUrl;
-	const conversationId = (params.activity?.conversation)?.id;
-	const conversationType = (params.activity?.conversation)?.conversationType;
-	const replyToActivityId = params.activity?.id;
-	const bot = params.activity?.recipient && typeof params.activity.recipient === "object" ? {
-		id: params.activity.recipient.id,
-		name: params.activity.recipient.name
-	} : void 0;
-	const sendContext = createSendContext({
-		sdk: params.sdk,
-		serviceUrl,
-		conversationId,
-		conversationType,
-		bot,
-		replyToActivityId,
-		getToken: params.getToken,
-		treatInvokeResponseAsNoop: true
-	});
-	return {
-		activity: params.activity,
-		...sendContext,
-		async sendActivities(activities) {
-			const results = [];
-			for (const activity of activities) results.push(await sendContext.sendActivity(activity));
-			return results;
-		}
-	};
-}
-/**
-* Update an existing activity via the Bot Framework REST API.
-* PUT /v3/conversations/{conversationId}/activities/{activityId}
-*/
-async function updateActivityViaRest(params) {
-	const { serviceUrl, conversationId, activityId, activity, token } = params;
-	const url = `${normalizeBotFrameworkServiceUrl(serviceUrl)}/v3/conversations/${encodeURIComponent(conversationId)}/activities/${encodeURIComponent(activityId)}`;
-	const headers = {
-		"Content-Type": "application/json",
-		"User-Agent": buildUserAgent()
-	};
-	if (token) headers.Authorization = `Bearer ${token}`;
-	const currentFetch = globalThis.fetch;
-	const { response, release } = await fetchWithSsrFGuard({
-		url,
-		fetchImpl: async (input, guardedInit) => await currentFetch(input, guardedInit),
-		init: {
-			method: "PUT",
-			headers,
-			body: JSON.stringify({
-				type: "message",
-				...activity,
-				id: activityId
-			})
-		},
-		auditContext: "msteams-update-activity",
-		policy: BOT_FRAMEWORK_SERVICE_URL_SSRF_POLICY
-	});
-	try {
-		if (!response.ok) {
-			const body = await response.text().catch(() => "");
-			throw Object.assign(/* @__PURE__ */ new Error(`updateActivity failed: HTTP ${response.status} ${body}`), { statusCode: response.status });
-		}
-		return await response.json().catch(() => ({ id: activityId }));
-	} finally {
-		await release();
-	}
-}
-/**
-* Delete an existing activity via the Bot Framework REST API.
-* DELETE /v3/conversations/{conversationId}/activities/{activityId}
-*/
-async function deleteActivityViaRest(params) {
-	const { serviceUrl, conversationId, activityId, token } = params;
-	const url = `${normalizeBotFrameworkServiceUrl(serviceUrl)}/v3/conversations/${encodeURIComponent(conversationId)}/activities/${encodeURIComponent(activityId)}`;
-	const headers = { "User-Agent": buildUserAgent() };
-	if (token) headers.Authorization = `Bearer ${token}`;
-	const currentFetch = globalThis.fetch;
-	const { response, release } = await fetchWithSsrFGuard({
-		url,
-		fetchImpl: async (input, guardedInit) => await currentFetch(input, guardedInit),
-		init: {
-			method: "DELETE",
-			headers
-		},
-		auditContext: "msteams-delete-activity",
-		policy: BOT_FRAMEWORK_SERVICE_URL_SSRF_POLICY
-	});
-	try {
-		if (!response.ok) {
-			const body = await response.text().catch(() => "");
-			throw Object.assign(/* @__PURE__ */ new Error(`deleteActivity failed: HTTP ${response.status} ${body}`), { statusCode: response.status });
-		}
-	} finally {
-		await release();
-	}
-}
-/**
-* Build a CloudAdapter-compatible adapter using the Teams SDK REST client.
-*
-* This replaces the previous CloudAdapter from @microsoft/agents-hosting.
-* For incoming requests: the App's HTTP server handles JWT validation.
-* For proactive sends: uses the Bot Framework REST API via
-* @microsoft/teams.api Client.
-*/
-function createMSTeamsAdapter(app, sdk) {
-	return {
-		async continueConversation(_appId, reference, logic) {
-			const rawServiceUrl = reference.serviceUrl;
-			if (!rawServiceUrl) throw new Error("Missing serviceUrl in conversation reference");
-			const serviceUrl = normalizeBotFrameworkServiceUrl(rawServiceUrl);
-			const conversationId = reference.conversation?.id;
-			if (!conversationId) throw new Error("Missing conversation.id in conversation reference");
-			const tenantId = reference.tenantId ?? reference.conversation?.tenantId;
-			const recipientAadObjectId = reference.aadObjectId ?? reference.user?.aadObjectId;
-			const recipientId = reference.user?.id;
-			await logic(createSendContext({
-				sdk,
-				serviceUrl,
-				conversationId,
-				conversationType: reference.conversation?.conversationType,
-				bot: reference.agent ?? void 0,
-				getToken: createBotTokenGetter(app),
-				tenantId,
-				recipientId,
-				recipientAadObjectId
-			}));
-		},
-		async process(req, res, logic) {
-			const request = req;
-			const response = res;
-			const activity = request.body;
-			const isInvoke = activity?.type === "invoke";
-			try {
-				const context = createProcessContext({
-					sdk,
-					activity,
-					getToken: createBotTokenGetter(app)
-				});
-				if (isInvoke) response.status(200).send();
-				await logic(context);
-				if (!isInvoke) response.status(200).send();
-			} catch (err) {
-				if (!isInvoke) response.status(500).send({ error: formatUnknownError(err) });
-			}
-		},
-		async updateActivity(_context, _activity) {},
-		async deleteActivity(_context, _reference) {}
-	};
-}
-async function loadMSTeamsSdkWithAuth(creds) {
-	const sdk = await loadMSTeamsSdk();
-	return {
-		sdk,
-		app: await createMSTeamsApp(creds, sdk)
-	};
-}
-/**
-* Bot Framework issuer → JWKS mapping.
-* During Microsoft's transition, inbound service tokens can be signed by either
-* the legacy Bot Framework issuer or the Entra issuer. Each gets its own JWKS
-* endpoint so we verify signatures with the correct key set.
-*/
-const BOT_FRAMEWORK_ISSUERS = [
-	{
-		issuer: "https://api.botframework.com",
-		jwksUri: "https://login.botframework.com/v1/.well-known/keys"
-	},
-	{
-		issuer: (tenantId) => `https://login.microsoftonline.com/${tenantId}/v2.0`,
-		jwksUri: "https://login.microsoftonline.com/common/discovery/v2.0/keys"
-	},
-	{
-		issuer: (tenantId) => `https://sts.windows.net/${tenantId}/`,
-		jwksUri: "https://login.microsoftonline.com/common/discovery/v2.0/keys"
-	}
-];
-const BOT_FRAMEWORK_GLOBAL_AUDIENCE = "https://api.botframework.com";
-function isJwtPayloadObject(value) {
-	return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function getAudienceClaims(payload) {
-	if (!isJwtPayloadObject(payload)) return [];
-	const audience = payload.aud;
-	if (typeof audience === "string") {
-		const trimmed = audience.trim();
-		return trimmed ? [trimmed] : [];
-	}
-	if (Array.isArray(audience)) return normalizeStringEntries(audience.filter((value) => typeof value === "string"));
-	return [];
-}
-function normalizeBotIdentityClaim(value) {
-	if (typeof value !== "string") return null;
-	return value.trim().toLowerCase() || null;
-}
-function hasExpectedBotIdentity(payload, expectedAppId) {
-	if (!isJwtPayloadObject(payload)) return false;
-	const expected = normalizeBotIdentityClaim(expectedAppId);
-	if (!expected) return false;
-	return normalizeBotIdentityClaim(payload.appid) === expected || normalizeBotIdentityClaim(payload.azp) === expected;
-}
-let botFrameworkJwtDepsPromise = null;
-function hasDefaultExport(value) {
-	return !!value && typeof value === "object" && "default" in value;
-}
-function isJsonwebtokenRuntime(value) {
-	return !!value && typeof value === "object" && typeof value.decode === "function" && typeof value.verify === "function";
-}
-function loadJsonwebtokenRuntime(jwtModule) {
-	const jwt = hasDefaultExport(jwtModule) ? jwtModule.default ?? jwtModule : jwtModule;
-	if (!isJsonwebtokenRuntime(jwt)) throw new Error("jsonwebtoken did not export decode/verify");
-	return jwt;
-}
-function isJwksClientRuntime(value) {
-	return typeof value === "function";
-}
-function loadJwksClientRuntime(jwksModule) {
-	const direct = jwksModule && typeof jwksModule === "object" ? jwksModule.JwksClient : void 0;
-	const fallback = hasDefaultExport(jwksModule) && jwksModule.default && typeof jwksModule.default === "object" ? jwksModule.default.JwksClient : void 0;
-	const JwksClient = direct ?? fallback;
-	if (!isJwksClientRuntime(JwksClient)) throw new Error("jwks-rsa did not export JwksClient");
-	return JwksClient;
-}
-async function loadBotFrameworkJwtDeps() {
-	botFrameworkJwtDepsPromise ??= Promise.all([import("jsonwebtoken"), import("jwks-rsa")]).then(([jwtModule, jwksModule]) => {
-		return {
-			jwt: loadJsonwebtokenRuntime(jwtModule),
-			JwksClient: loadJwksClientRuntime(jwksModule)
-		};
-	});
-	return botFrameworkJwtDepsPromise;
-}
-/**
-* Create a Bot Framework JWT validator using jsonwebtoken + jwks-rsa directly.
-*
-* The @microsoft/teams.apps JwtValidator hardcodes audience to [clientId, api://clientId],
-* which rejects valid Bot Framework tokens that carry aud: "https://api.botframework.com".
-* This implementation uses jsonwebtoken directly with the correct audience list, matching
-* the behavior of the legacy @microsoft/agents-hosting authorizeJWT middleware.
-*
-* Security invariants:
-* - signature verification via issuer-specific JWKS endpoints
-* - audience validation: appId, api://appId, and https://api.botframework.com
-* - issuer validation: strict allowlist (Bot Framework + tenant-scoped Entra)
-* - expiration validation with 5-minute clock tolerance
-*/
-async function createBotFrameworkJwtValidator(creds) {
-	const { jwt, JwksClient } = await loadBotFrameworkJwtDeps();
-	const allowedAudiences = [
-		creds.appId,
-		`api://${creds.appId}`,
-		BOT_FRAMEWORK_GLOBAL_AUDIENCE
-	];
-	const allowedIssuers = BOT_FRAMEWORK_ISSUERS.map((entry) => typeof entry.issuer === "function" ? entry.issuer(creds.tenantId) : entry.issuer);
-	const jwksClients = /* @__PURE__ */ new Map();
-	function getJwksClient(uri) {
-		let client = jwksClients.get(uri);
-		if (!client) {
-			client = new JwksClient({
-				jwksUri: uri,
-				cache: true,
-				cacheMaxAge: 6e5,
-				rateLimit: true
-			});
-			jwksClients.set(uri, client);
-		}
-		return client;
-	}
-	/** Decode the token header without verification to determine the kid. */
-	function decodeHeader(token) {
-		const decoded = jwt.decode(token, { complete: true });
-		return decoded && typeof decoded === "object" ? decoded.header : null;
-	}
-	/** Resolve the issuer entry for a token's issuer claim (pre-verification). */
-	function resolveIssuerEntry(issuerClaim) {
-		if (!issuerClaim) return;
-		return BOT_FRAMEWORK_ISSUERS.find((entry) => {
-			return (typeof entry.issuer === "function" ? entry.issuer(creds.tenantId) : entry.issuer) === issuerClaim;
-		});
-	}
-	return { async validate(authHeader, _serviceUrl) {
-		const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : authHeader;
-		if (!token) return false;
-		const header = decodeHeader(token);
-		const unverifiedPayload = jwt.decode(token);
-		if (!header?.kid || !isJwtPayloadObject(unverifiedPayload) || typeof unverifiedPayload.iss !== "string") return false;
-		const issuerEntry = resolveIssuerEntry(unverifiedPayload.iss);
-		if (!issuerEntry) return false;
-		const client = getJwksClient(issuerEntry.jwksUri);
-		try {
-			const publicKey = (await client.getSigningKey(header.kid)).getPublicKey();
-			const verifiedPayload = jwt.verify(token, publicKey, {
-				audience: allowedAudiences,
-				issuer: allowedIssuers,
-				algorithms: ["RS256"],
-				clockTolerance: 300
-			});
-			if (!isJwtPayloadObject(verifiedPayload)) return false;
-			if (getAudienceClaims(verifiedPayload).includes(BOT_FRAMEWORK_GLOBAL_AUDIENCE) && !hasExpectedBotIdentity(verifiedPayload, creds.appId)) return false;
-			return true;
-		} catch (err) {
-			if (isJwksNetworkError(err)) throw err;
-			return false;
+	return { async getAccessToken(scope) {
+		if (scope.includes("graph.microsoft.com") || scope.includes("graph.microsoft.us") || scope.includes("microsoftgraph.chinacloudapi.cn")) {
+			if (app.cloud?.graphScope?.includes("microsoftgraph.chinacloudapi.cn")) throw new Error("Microsoft Teams Graph operations are not supported for channels.msteams.cloud=China until Graph requests are routed through the Azure China Graph endpoint.");
+			return tokenToString(await app.tokenManager.getGraphToken());
 		}
+		return tokenToString(await app.tokenManager.getBotToken());
 	} };
 }
-/**
-* Return true when the error originated from a network-level failure fetching
-* the JWKS endpoint (DNS resolution, connection refused, TLS handshake, etc.)
-* rather than from token verification logic.
-*/
-function isJwksNetworkError(err) {
-	if (!(err instanceof Error)) return false;
-	const code = err.code;
-	if (code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "EHOSTUNREACH" || code === "ETIMEDOUT" || code === "ECONNRESET") return true;
-	return /jwks|key fetch|getSigningKey/i.test(err.message) && /network|fetch|connect/i.test(err.message);
+async function loadMSTeamsSdkWithAuth(creds, options) {
+	return { app: await createMSTeamsApp(creds, options) };
 }
 //#endregion
 //#region extensions/msteams/src/token-response.ts
@@ -1261,10 +856,7 @@ async function requestGraph(params) {
 		auditContext: "msteams.graph"
 	});
 	try {
-		if (!response.ok) {
-			const text = await response.text().catch(() => "");
-			throw new Error(`${params.errorPrefix ?? "Graph"} ${params.path} failed (${response.status}): ${text || "unknown error"}`);
-		}
+		if (!response.ok) throw await createMSTeamsHttpError(response, `${params.errorPrefix ?? "Graph"} ${params.path} failed`);
 		const body = NULL_BODY_STATUSES.has(response.status) ? null : await response.arrayBuffer();
 		return new Response(body, {
 			status: response.status,
@@ -1303,10 +895,7 @@ async function fetchGraphAbsoluteUrl(params) {
 		auditContext: "msteams.graph.absolute"
 	});
 	try {
-		if (!response.ok) {
-			const text = await response.text().catch(() => "");
-			throw new Error(`Graph ${params.url} failed (${response.status}): ${text || "unknown error"}`);
-		}
+		if (!response.ok) throw await createMSTeamsHttpError(response, `Graph ${params.url} failed`);
 		return await readProviderJsonResponse(response, `Graph ${params.url} failed`);
 	} finally {
 		await release();
@@ -1352,6 +941,7 @@ async function resolveGraphToken(cfg, options) {
 	const msteamsCfg = cfg?.channels?.msteams;
 	const creds = resolveMSTeamsCredentials(msteamsCfg);
 	if (!creds) throw new Error("MS Teams credentials missing");
+	if (msteamsCfg?.cloud === "China") throw new Error("Microsoft Teams Graph operations are not supported for channels.msteams.cloud=China until Graph requests are routed through the Azure China Graph endpoint.");
 	if (options?.preferDelegated && msteamsCfg?.delegatedAuth?.enabled && creds.type === "secret") {
 		const delegated = await resolveDelegatedAccessToken({
 			tenantId: creds.tenantId,
@@ -1360,7 +950,7 @@ async function resolveGraphToken(cfg, options) {
 		});
 		if (delegated) return delegated;
 	}
-	const { app } = await loadMSTeamsSdkWithAuth(creds);
+	const { app } = await loadMSTeamsSdkWithAuth(creds, resolveMSTeamsSdkCloudOptions(msteamsCfg));
 	const accessToken = readAccessToken(await createMSTeamsTokenProvider(app).getAccessToken("https://graph.microsoft.com"));
 	if (!accessToken) throw new Error("MS Teams graph token unavailable");
 	return accessToken;
@@ -1441,4 +1031,168 @@ async function searchGraphUsers(params) {
 	})).value ?? [];
 }
 //#endregion
-export { safeHostForUrl as $, describeBotFrameworkServiceUrlHost as A, extractHtmlFromAttachment as B, loadMSTeamsSdkWithAuth as C, formatMSTeamsSendErrorHint as D, classifyMSTeamsSendError as E, GRAPH_ROOT as F, isRecord$1 as G, inferPlaceholder as H, IMG_SRC_RE as I, readNestedString as J, isUrlAllowed as K, applyAuthorizationHeaderForUrl as L, normalizeBotFrameworkServiceUrl as M, tryNormalizeBotFrameworkServiceUrl as N, formatUnknownError as O, ATTACHMENT_TAG_RE as P, safeFetchWithPolicy as Q, encodeGraphShareId as R, createMSTeamsTokenProvider as S, ensureUserAgentHeader as T, isDownloadableAttachment as U, extractInlineImageCandidates as V, isLikelyImageAttachment as W, resolveMediaSsrfPolicy as X, resolveAttachmentFetchPolicy as Y, resolveRequestUrl as Z, resolveMSTeamsStorePath as _, fetchGraphJson as a, createBotFrameworkJwtValidator as b, normalizeQuery as c, postGraphJson as d, tryBuildGraphSharesUrlForSharedLink as et, resolveGraphToken as f, saveDelegatedTokens as g, resolveMSTeamsCredentials as h, fetchGraphAbsoluteUrl as i, isAllowedBotFrameworkServiceUrl as j, isRevokedProxyError as k, patchGraphJson as l, loadDelegatedTokens as m, deleteGraphRequest as n, listChannelsForTeam as o, hasConfiguredMSTeamsCredentials as p, normalizeContentType as q, escapeOData as r, listTeamsByName as s, searchGraphUsers as t, postGraphBetaJson as u, normalizeSecretInputString as v, buildUserAgent as w, createMSTeamsAdapter as x, readAccessToken as y, estimateBase64DecodedBytes as z };
+//#region extensions/msteams/src/errors.ts
+function formatUnknownError(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	if (err === null) return "null";
+	if (err === void 0) return "undefined";
+	if (typeof err === "number" || typeof err === "boolean" || typeof err === "bigint") return String(err);
+	if (typeof err === "symbol") return err.description ?? err.toString();
+	if (typeof err === "function") return err.name ? `[function ${err.name}]` : "[function]";
+	try {
+		return JSON.stringify(err) ?? "unknown error";
+	} catch {
+		return "unknown error";
+	}
+}
+function extractStatusCode(err) {
+	if (!isRecord(err)) return null;
+	const parseStatusCode = (value) => {
+		if (typeof value === "number") return Number.isInteger(value) && value >= 100 && value <= 599 ? value : null;
+		if (typeof value === "string") {
+			const trimmed = value.trim();
+			if (!/^\d{3}$/.test(trimmed)) return null;
+			const parsed = Number(trimmed);
+			return parsed >= 100 && parsed <= 599 ? parsed : null;
+		}
+		return null;
+	};
+	const directStatus = parseStatusCode(err.statusCode ?? err.status);
+	if (directStatus !== null) return directStatus;
+	const response = err.response;
+	if (isRecord(response)) {
+		const responseStatus = parseStatusCode(response.status);
+		if (responseStatus !== null) return responseStatus;
+	}
+	return null;
+}
+function extractErrorCode(err) {
+	if (!isRecord(err)) return null;
+	const direct = err.code;
+	if (typeof direct === "string" && direct.trim()) return direct;
+	const response = err.response;
+	if (!isRecord(response)) return null;
+	const body = response.body;
+	if (isRecord(body)) {
+		const error = body.error;
+		if (isRecord(error) && typeof error.code === "string" && error.code.trim()) return error.code;
+	}
+	return null;
+}
+function extractRetryAfterMs(err) {
+	if (!isRecord(err)) return null;
+	const direct = err.retryAfterMs ?? err.retry_after_ms;
+	if (typeof direct === "number" && Number.isFinite(direct) && direct >= 0) return direct;
+	const retryAfter = err.retryAfter ?? err.retry_after;
+	if (typeof retryAfter === "number" && Number.isFinite(retryAfter)) return retryAfter >= 0 ? retryAfter * 1e3 : null;
+	if (typeof retryAfter === "string") {
+		const parsed = parseNonNegativeRetryAfterSeconds(retryAfter);
+		if (Number.isFinite(parsed) && parsed >= 0) return parsed * 1e3;
+	}
+	const response = err.response;
+	if (!isRecord(response)) return null;
+	const headers = response.headers;
+	if (!headers) return null;
+	if (isRecord(headers)) {
+		const raw = headers["retry-after"] ?? headers["Retry-After"];
+		if (typeof raw === "string") {
+			const parsed = parseNonNegativeRetryAfterSeconds(raw);
+			if (Number.isFinite(parsed) && parsed >= 0) return parsed * 1e3;
+		}
+	}
+	if (typeof headers === "object" && headers !== null && "get" in headers && typeof headers.get === "function") {
+		const raw = headers.get("retry-after");
+		if (raw) {
+			const parsed = parseNonNegativeRetryAfterSeconds(raw);
+			if (Number.isFinite(parsed) && parsed >= 0) return parsed * 1e3;
+		}
+	}
+	return null;
+}
+function parseNonNegativeRetryAfterSeconds(raw) {
+	const trimmed = raw.trim();
+	if (!/^\d+(?:\.\d+)?$/.test(trimmed)) return NaN;
+	return Number(trimmed);
+}
+/**
+* Classify outbound send errors for safe retries and actionable logs.
+*
+* Important: We only mark errors as retryable when we have an explicit HTTP
+* status code that indicates the message was not accepted (e.g. 429, 5xx).
+* For transport-level errors where delivery is ambiguous, we prefer to avoid
+* retries to reduce the chance of duplicate posts.
+*/
+function classifyMSTeamsSendError(err) {
+	const statusCode = extractStatusCode(err);
+	const retryAfterMs = extractRetryAfterMs(err);
+	const errorCode = extractErrorCode(err) ?? void 0;
+	if (statusCode === 401) return {
+		kind: "auth",
+		statusCode,
+		errorCode
+	};
+	if (statusCode === 403) {
+		if (errorCode === "ContentStreamNotAllowed") return {
+			kind: "permanent",
+			statusCode,
+			errorCode
+		};
+		return {
+			kind: "auth",
+			statusCode,
+			errorCode
+		};
+	}
+	if (statusCode === 429) return {
+		kind: "throttled",
+		statusCode,
+		retryAfterMs: retryAfterMs ?? void 0,
+		errorCode
+	};
+	if (statusCode === 408 || statusCode != null && statusCode >= 500) return {
+		kind: "transient",
+		statusCode,
+		retryAfterMs: retryAfterMs ?? void 0,
+		errorCode
+	};
+	if (statusCode != null && statusCode >= 400) return {
+		kind: "permanent",
+		statusCode,
+		errorCode
+	};
+	if (statusCode == null) {
+		const networkCode = isRecord(err) && typeof err.code === "string" ? err.code : null;
+		if (networkCode === "ECONNREFUSED" || networkCode === "ENOTFOUND" || networkCode === "EHOSTUNREACH" || networkCode === "ETIMEDOUT" || networkCode === "ECONNRESET") return {
+			kind: "network",
+			errorCode: networkCode
+		};
+	}
+	return {
+		kind: "unknown",
+		statusCode: statusCode ?? void 0,
+		retryAfterMs: retryAfterMs ?? void 0,
+		errorCode
+	};
+}
+/**
+* Detect whether an error is caused by a revoked Proxy.
+*
+* The Bot Framework SDK wraps TurnContext in a Proxy that is revoked once the
+* turn handler returns.  Any later access (e.g. from a debounced callback)
+* throws a TypeError whose message contains the distinctive "proxy that has
+* been revoked" string.
+*/
+function isRevokedProxyError(err) {
+	if (!(err instanceof TypeError)) return false;
+	return /proxy that has been revoked/i.test(err.message);
+}
+function formatMSTeamsSendErrorHint(classification) {
+	if (classification.kind === "auth") return "check msteams appId/appPassword/tenantId (or env vars MSTEAMS_APP_ID/MSTEAMS_APP_PASSWORD/MSTEAMS_TENANT_ID)";
+	if (classification.errorCode === "ContentStreamNotAllowed") return "Teams expired the content stream; stop streaming earlier and fall back to normal message delivery";
+	if (classification.kind === "throttled") return "Teams throttled the bot; backing off may help";
+	if (classification.kind === "transient") return "transient Teams/Bot Framework error; retry may succeed";
+	if (classification.kind === "network") return "transport-level failure sending reply to Teams Bot Connector (smba.trafficmanager.net) — check egress firewall rules allow outbound HTTPS to smba.trafficmanager.net";
+}
+//#endregion
+export { safeFetchWithPolicy as $, isAllowedBotFrameworkServiceUrl as A, estimateBase64DecodedBytes as B, readAccessToken as C, buildUserAgent as D, loadMSTeamsSdkWithAuth as E, ATTACHMENT_TAG_RE as F, isLikelyImageAttachment as G, extractInlineImageCandidates as H, GRAPH_ROOT as I, normalizeContentType as J, isRecord$1 as K, IMG_SRC_RE as L, tryNormalizeBotFrameworkServiceUrl as M, resolveMSTeamsSdkCloudOptions as N, ensureUserAgentHeader as O, validateMSTeamsProactiveServiceUrlBoundary as P, resolveRequestUrl as Q, applyAuthorizationHeaderForUrl as R, normalizeSecretInputString as S, createMSTeamsTokenProvider as T, inferPlaceholder as U, extractHtmlFromAttachment as V, isDownloadableAttachment as W, resolveAttachmentFetchPolicy as X, readNestedString as Y, resolveMediaSsrfPolicy as Z, hasConfiguredMSTeamsCredentials as _, searchGraphUsers as a, saveDelegatedTokens as b, fetchGraphAbsoluteUrl as c, listTeamsByName as d, safeHostForUrl as et, normalizeQuery as f, resolveGraphToken as g, postGraphJson as h, isRevokedProxyError as i, normalizeBotFrameworkServiceUrl as j, describeBotFrameworkServiceUrlHost as k, fetchGraphJson as l, postGraphBetaJson as m, formatMSTeamsSendErrorHint as n, deleteGraphRequest as o, patchGraphJson as p, isUrlAllowed as q, formatUnknownError as r, escapeOData as s, classifyMSTeamsSendError as t, tryBuildGraphSharesUrlForSharedLink as tt, listChannelsForTeam as u, loadDelegatedTokens as v, createMSTeamsExpressAdapter as w, resolveMSTeamsStorePath as x, resolveMSTeamsCredentials as y, encodeGraphShareId as z };