@openclaw/msteams 2026.5.27 → 2026.5.28-beta.2

package/dist/{src-ui0zJEZI.js → src-Cc3f8Zi2.js}

@@ -1,11 +1,11 @@
 import { A as summarizeMapping, D as resolveDefaultGroupPolicy, E as resolveChannelMediaMaxBytes, M as getMSTeamsRuntime, N as getOptionalMSTeamsRuntime, _ as isDangerousNameMatchingEnabled, a as buildMediaPayload, b as logTypingFailure, c as createChannelMessageReplyPipeline, f as dispatchReplyFromConfigWithSettledDispatcher$1, l as createChannelPairingController, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, t as DEFAULT_ACCOUNT_ID, v as keepHttpServerTaskAlive, x as mergeAllowlist } from "./runtime-api-BlvMnDKz.js";
-import { $ as safeHostForUrl, B as extractHtmlFromAttachment, C as loadMSTeamsSdkWithAuth, D as formatMSTeamsSendErrorHint, E as classifyMSTeamsSendError, F as GRAPH_ROOT, G as isRecord$1, H as inferPlaceholder, I as IMG_SRC_RE, J as readNestedString, K as isUrlAllowed, L as applyAuthorizationHeaderForUrl, N as tryNormalizeBotFrameworkServiceUrl, O as formatUnknownError, P as ATTACHMENT_TAG_RE, Q as safeFetchWithPolicy, R as encodeGraphShareId, S as createMSTeamsTokenProvider, T as ensureUserAgentHeader, U as isDownloadableAttachment, V as extractInlineImageCandidates, W as isLikelyImageAttachment, X as resolveMediaSsrfPolicy, Y as resolveAttachmentFetchPolicy, Z as resolveRequestUrl, _ as resolveMSTeamsStorePath, a as fetchGraphJson, b as createBotFrameworkJwtValidator, et as tryBuildGraphSharesUrlForSharedLink, h as resolveMSTeamsCredentials, q as normalizeContentType, w as buildUserAgent, x as createMSTeamsAdapter, z as estimateBase64DecodedBytes } from "./graph-users-uPAE6-KQ.js";
-import { d as resolveMSTeamsUserAllowlist, u as resolveMSTeamsChannelAllowlist } from "./setup-surface-evwYex71.js";
-import { a as resolveMSTeamsReplyPolicy, i as resolveMSTeamsAllowlistMatch, o as resolveMSTeamsRouteConfig } from "./channel-c7nnGfMx.js";
-import { C as readJsonFile, S as createMSTeamsConversationStoreFs, T as writeJsonFile, _ as buildFileInfoCard, b as createMSTeamsPollStoreFs, c as renderReplyPayloadsToMessages, d as withRevokedProxyFallback, f as resolveGraphChatId, g as removePendingUploadFs, h as getPendingUploadFs, l as sendMSTeamsMessages, m as removePendingUpload, p as getPendingUpload, s as buildConversationReference, u as AI_GENERATED_ENTITY, v as parseFileConsentInvoke, w as withFileLock, x as extractMSTeamsPollVote, y as uploadToConsentUrl } from "./probe-istgFnuw.js";
+import { $ as safeFetchWithPolicy, B as estimateBase64DecodedBytes, E as loadMSTeamsSdkWithAuth, F as ATTACHMENT_TAG_RE, G as isLikelyImageAttachment, H as extractInlineImageCandidates, I as GRAPH_ROOT, J as normalizeContentType, K as isRecord$1, L as IMG_SRC_RE, M as tryNormalizeBotFrameworkServiceUrl, N as resolveMSTeamsSdkCloudOptions, O as ensureUserAgentHeader, Q as resolveRequestUrl, R as applyAuthorizationHeaderForUrl, T as createMSTeamsTokenProvider, U as inferPlaceholder, V as extractHtmlFromAttachment, W as isDownloadableAttachment, X as resolveAttachmentFetchPolicy, Y as readNestedString, Z as resolveMediaSsrfPolicy, et as safeHostForUrl, l as fetchGraphJson, n as formatMSTeamsSendErrorHint, q as isUrlAllowed, r as formatUnknownError, t as classifyMSTeamsSendError, tt as tryBuildGraphSharesUrlForSharedLink, w as createMSTeamsExpressAdapter, x as resolveMSTeamsStorePath, y as resolveMSTeamsCredentials, z as encodeGraphShareId } from "./errors-B4snzfP5.js";
+import { d as resolveMSTeamsUserAllowlist, u as resolveMSTeamsChannelAllowlist } from "./setup-surface-C-uCiIKh.js";
+import { a as resolveMSTeamsReplyPolicy, i as resolveMSTeamsAllowlistMatch, o as resolveMSTeamsRouteConfig } from "./channel-C_AMaSpi.js";
+import { C as readJsonFile, S as createMSTeamsConversationStoreFs, T as writeJsonFile, _ as buildFileInfoCard, b as createMSTeamsPollStoreFs, c as renderReplyPayloadsToMessages, d as withRevokedProxyFallback, f as resolveGraphChatId, g as removePendingUploadFs, h as getPendingUploadFs, l as sendMSTeamsMessages, m as removePendingUpload, p as getPendingUpload, s as buildConversationReference, u as sendMSTeamsActivityWithReference, v as parseFileConsentInvoke, w as withFileLock, x as extractMSTeamsPollVote, y as uploadToConsentUrl } from "./probe-DRwI-ZqW.js";
 import { formatAllowlistMatchMeta } from "openclaw/plugin-sdk/allow-from";
-import { buildChannelProgressDraftLine, buildChannelProgressDraftLineForEntry, createChannelProgressDraftGate, createDraftStreamLoop, createLiveMessageState, createPreviewMessageReceipt, defineFinalizableLivePreviewAdapter, deliverWithFinalizableLivePreviewAdapter, formatChannelProgressDraftText, isChannelProgressDraftWorkToolName, markLiveMessageFinalized, mergeChannelProgressDraftLine, normalizeChannelProgressDraftLineIdentity, resolveChannelPreviewStreamMode, resolveChannelProgressDraftMaxLines, resolveChannelStreamingBlockEnabled, resolveChannelStreamingPreviewToolProgress } from "openclaw/plugin-sdk/channel-outbound";
-import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, readStringValue, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { buildChannelProgressDraftLine, buildChannelProgressDraftLineForEntry, createChannelProgressDraftGate, formatChannelProgressDraftText, isChannelProgressDraftWorkToolName, mergeChannelProgressDraftLine, normalizeChannelProgressDraftLineIdentity, resolveChannelPreviewStreamMode, resolveChannelProgressDraftMaxLines, resolveChannelStreamingBlockEnabled, resolveChannelStreamingPreviewToolProgress, resolveChannelStreamingSuppressDefaultToolProgressMessages } from "openclaw/plugin-sdk/channel-outbound";
+import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { saveResponseMedia } from "openclaw/plugin-sdk/media-runtime";
 import { buildChannelInboundEventContext, dispatchReplyFromConfigWithSettledDispatcher, hasFinalInboundReplyDispatch, logInboundDrop, resolveInboundMentionDecision, resolveInboundReplyDispatchCounts, resolveInboundSessionEnvelopeContext } from "openclaw/plugin-sdk/channel-inbound";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
@@ -195,16 +195,11 @@ function createReflectionCaptureDispatcher(params) {
 	};
 }
 async function sendReflectionFollowUp(params) {
-	const proactiveRef = {
-		...buildConversationReference(params.conversationRef),
-		activityId: void 0
-	};
-	await params.adapter.continueConversation(params.appId, proactiveRef, async (ctx) => {
-		await ctx.sendActivity({
-			type: "message",
-			text: params.userMessage
-		});
-	});
+	const baseRef = buildConversationReference(params.conversationRef);
+	await sendMSTeamsActivityWithReference(params.app, baseRef, {
+		type: "message",
+		text: params.userMessage
+	}, { serviceUrlBoundary: resolveMSTeamsSdkCloudOptions(params.cfg.channels?.msteams) });
 }
 /**
 * Run a background reflection after negative feedback.
@@ -280,8 +275,8 @@ async function runFeedbackReflection(params) {
 	}
 	try {
 		await sendReflectionFollowUp({
-			adapter: params.adapter,
-			appId: params.appId,
+			cfg,
+			app: params.app,
 			conversationRef: params.conversationRef,
 			userMessage: parsedReflection.userMessage
 		});
@@ -367,114 +362,6 @@ function wasMSTeamsBotMentioned(activity) {
 	return (activity.entities ?? []).some((e) => e.type === "mention" && e.mentioned?.id === botId);
 }
 //#endregion
-//#region extensions/msteams/src/file-consent-invoke.ts
-/**
-* Handle fileConsent/invoke activities for large file uploads.
-*/
-async function handleMSTeamsFileConsentInvoke(context, log) {
-	const expiredUploadMessage = "The file upload request has expired. Please try sending the file again.";
-	const activity = context.activity;
-	if (activity.type !== "invoke" || activity.name !== "fileConsent/invoke") return false;
-	const consentResponse = parseFileConsentInvoke(activity);
-	if (!consentResponse) {
-		log.debug?.("invalid file consent invoke", { value: activity.value });
-		return false;
-	}
-	const uploadId = typeof consentResponse.context?.uploadId === "string" ? consentResponse.context.uploadId : void 0;
-	const inMemoryFile = getPendingUpload(uploadId);
-	const fsFile = inMemoryFile ? void 0 : await getPendingUploadFs(uploadId);
-	const pendingFile = inMemoryFile ?? fsFile;
-	if (pendingFile) {
-		const pendingConversationId = normalizeMSTeamsConversationId(pendingFile.conversationId);
-		const invokeConversationId = normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
-		if (!invokeConversationId || pendingConversationId !== invokeConversationId) {
-			log.info("file consent conversation mismatch", {
-				uploadId,
-				expectedConversationId: pendingConversationId,
-				receivedConversationId: invokeConversationId || void 0
-			});
-			if (consentResponse.action === "accept") await context.sendActivity(expiredUploadMessage);
-			return true;
-		}
-	}
-	if (consentResponse.action === "accept" && consentResponse.uploadInfo) if (pendingFile) {
-		log.debug?.("user accepted file consent, uploading", {
-			uploadId,
-			filename: pendingFile.filename,
-			size: pendingFile.buffer.length
-		});
-		try {
-			await uploadToConsentUrl({
-				url: consentResponse.uploadInfo.uploadUrl,
-				buffer: pendingFile.buffer,
-				contentType: pendingFile.contentType
-			});
-			const fileInfoCard = buildFileInfoCard({
-				filename: consentResponse.uploadInfo.name,
-				contentUrl: consentResponse.uploadInfo.contentUrl,
-				uniqueId: consentResponse.uploadInfo.uniqueId,
-				fileType: consentResponse.uploadInfo.fileType
-			});
-			if (!pendingFile.consentCardActivityId) await context.sendActivity({
-				type: "message",
-				attachments: [fileInfoCard]
-			});
-			if (pendingFile.consentCardActivityId) try {
-				await context.updateActivity({
-					id: pendingFile.consentCardActivityId,
-					type: "message",
-					attachments: [fileInfoCard]
-				});
-			} catch {
-				await context.sendActivity({
-					type: "message",
-					attachments: [fileInfoCard]
-				});
-			}
-			log.info("file upload complete", {
-				uploadId,
-				filename: consentResponse.uploadInfo.name,
-				uniqueId: consentResponse.uploadInfo.uniqueId
-			});
-		} catch (err) {
-			log.error("file upload failed", {
-				uploadId,
-				error: formatUnknownError(err)
-			});
-			await context.sendActivity("File upload failed. Please try again.");
-		} finally {
-			removePendingUpload(uploadId);
-			await removePendingUploadFs(uploadId);
-		}
-	} else {
-		log.debug?.("pending file not found for consent", { uploadId });
-		await context.sendActivity(expiredUploadMessage);
-	}
-	else {
-		log.debug?.("user declined file consent", { uploadId });
-		removePendingUpload(uploadId);
-		await removePendingUploadFs(uploadId);
-	}
-	return true;
-}
-async function respondToMSTeamsFileConsentInvoke(context, log) {
-	await context.sendActivity({
-		type: "invokeResponse",
-		value: { status: 200 }
-	});
-	try {
-		await withRevokedProxyFallback({
-			run: async () => await handleMSTeamsFileConsentInvoke(context, log),
-			onRevoked: async () => true,
-			onRevokedLog: () => {
-				log.debug?.("turn context revoked during file consent invoke; skipping delayed response");
-			}
-		});
-	} catch (err) {
-		log.debug?.("file consent handler error", { error: formatUnknownError(err) });
-	}
-}
-//#endregion
 //#region extensions/msteams/src/monitor-handler/access.ts
 const msteamsIngressIdentity = {
 	key: "sender-id",
@@ -594,6 +481,16 @@ function isBotFrameworkPersonalChatId(conversationId) {
 function normalizeServiceUrl(serviceUrl) {
 	return serviceUrl.replace(/\/+$/, "");
 }
+function buildBotFrameworkAttachmentHeaders(params) {
+	const headers = ensureUserAgentHeader();
+	applyAuthorizationHeaderForUrl({
+		headers,
+		url: params.url,
+		authAllowHosts: params.policy.authAllowHosts,
+		bearerToken: params.accessToken
+	});
+	return headers;
+}
 async function fetchBotFrameworkAttachmentInfo(params) {
 	const url = `${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}`;
 	let response;
@@ -602,14 +499,20 @@ async function fetchBotFrameworkAttachmentInfo(params) {
 			url,
 			policy: params.policy,
 			fetchFn: params.fetchFn,
+			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 			resolveFn: params.resolveFn,
-			requestInit: { headers: ensureUserAgentHeader({ Authorization: `Bearer ${params.accessToken}` }) }
+			requestInit: { headers: buildBotFrameworkAttachmentHeaders({
+				url,
+				accessToken: params.accessToken,
+				policy: params.policy
+			}) }
 		});
 	} catch (err) {
 		params.logger?.warn?.("msteams botFramework attachmentInfo fetch failed", { error: err instanceof Error ? err.message : String(err) });
 		return;
 	}
 	if (!response.ok) {
+		await response.body?.cancel();
 		params.logger?.warn?.("msteams botFramework attachmentInfo non-ok", { status: response.status });
 		return;
 	}
@@ -628,19 +531,28 @@ async function saveBotFrameworkAttachmentView(params) {
 			url,
 			policy: params.policy,
 			fetchFn: params.fetchFn,
+			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 			resolveFn: params.resolveFn,
-			requestInit: { headers: ensureUserAgentHeader({ Authorization: `Bearer ${params.accessToken}` }) }
+			requestInit: { headers: buildBotFrameworkAttachmentHeaders({
+				url,
+				accessToken: params.accessToken,
+				policy: params.policy
+			}) }
 		});
 	} catch (err) {
 		params.logger?.warn?.("msteams botFramework attachmentView fetch failed", { error: err instanceof Error ? err.message : String(err) });
 		return;
 	}
 	if (!response.ok) {
+		await response.body?.cancel();
 		params.logger?.warn?.("msteams botFramework attachmentView non-ok", { status: response.status });
 		return;
 	}
 	const contentLength = response.headers.get("content-length");
-	if (contentLength && Number(contentLength) > params.maxBytes) return;
+	if (contentLength && Number(contentLength) > params.maxBytes) {
+		await response.body?.cancel();
+		return;
+	}
 	try {
 		return await getMSTeamsRuntime().channel.media.saveResponseMedia(response, {
 			sourceUrl: url,
@@ -682,6 +594,7 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 		accessToken,
 		policy,
 		fetchFn: params.fetchFn,
+		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 		resolveFn: params.resolveFn,
 		logger: params.logger
 	});
@@ -704,6 +617,7 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 		preserveFilenames: params.preserveFilenames,
 		policy,
 		fetchFn: params.fetchFn,
+		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 		resolveFn: params.resolveFn,
 		logger: params.logger
 	});
@@ -747,6 +661,7 @@ async function downloadMSTeamsBotFrameworkAttachments(params) {
 			allowHosts: params.allowHosts,
 			authAllowHosts: params.authAllowHosts,
 			fetchFn: params.fetchFn,
+			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 			resolveFn: params.resolveFn,
 			fileNameHint: params.fileNameHint,
 			contentTypeHint: params.contentTypeHint,
@@ -768,17 +683,9 @@ async function downloadMSTeamsBotFrameworkAttachments(params) {
 //#endregion
 //#region extensions/msteams/src/attachments/remote-media.ts
 /**
-* Direct fetch path used when the caller's `fetchImpl` has already validated
-* the URL against a hostname allowlist (for example `safeFetchWithPolicy`).
-*
-* Bypasses the strict SSRF dispatcher on `readRemoteMediaBuffer` because:
-*   1. The pinned undici dispatcher used by `readRemoteMediaBuffer` is incompatible
-*      with Node 24+'s built-in undici v7 (fails with "invalid onRequestStart
-*      method"), which silently breaks SharePoint/OneDrive downloads. See
-*      issue #63396.
-*   2. SSRF protection is already enforced by the caller's `fetchImpl`
-*      (`safeFetch` validates every redirect hop against the hostname
-*      allowlist before following).
+* Direct save path used when the caller supplies the already-guarded fetch
+* implementation. This lets Teams-specific auth fallback own the request
+* sequence while keeping redirect and DNS pinning inside `safeFetchWithPolicy`.
 */
 async function saveRemoteMediaDirect(params) {
 	return await saveResponseMedia(await params.fetchImpl(params.url, { redirect: "follow" }), {
@@ -878,6 +785,7 @@ async function fetchWithAuthFallback(params) {
 		url: params.url,
 		policy: params.policy,
 		fetchFn: params.fetchFn,
+		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 		requestInit: params.requestInit,
 		resolveFn: params.resolveFn
 	});
@@ -885,6 +793,7 @@ async function fetchWithAuthFallback(params) {
 	if (!params.tokenProvider) return firstAttempt;
 	if (firstAttempt.status !== 401 && firstAttempt.status !== 403) return firstAttempt;
 	if (!isUrlAllowed(params.url, params.policy.authAllowHosts)) return firstAttempt;
+	await firstAttempt.body?.cancel();
 	const scopes = scopeCandidatesForUrl(params.url);
 	const fetchFn = params.fetchFn ?? fetch;
 	for (const scope of scopes) try {
@@ -895,6 +804,7 @@ async function fetchWithAuthFallback(params) {
 			url: params.url,
 			policy: params.policy,
 			fetchFn,
+			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 			requestInit: {
 				...params.requestInit,
 				headers: authHeaders
@@ -903,7 +813,11 @@ async function fetchWithAuthFallback(params) {
 		});
 		if (authAttempt.ok) return authAttempt;
 		if (isRedirectStatus(authAttempt.status)) return authAttempt;
-		if (authAttempt.status !== 401 && authAttempt.status !== 403) continue;
+		if (authAttempt.status !== 401 && authAttempt.status !== 403) {
+			await authAttempt.body?.cancel();
+			continue;
+		}
+		await authAttempt.body?.cancel();
 	} catch {}
 	return firstAttempt;
 }
@@ -971,6 +885,7 @@ async function downloadMSTeamsAttachments(params) {
 					url: resolveRequestUrl(input),
 					tokenProvider: params.tokenProvider,
 					fetchFn: params.fetchFn,
+					fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 					requestInit: init,
 					resolveFn: params.resolveFn,
 					policy
@@ -978,10 +893,8 @@ async function downloadMSTeamsAttachments(params) {
 			});
 			out.push(media);
 		} catch (err) {
-			params.logger?.warn?.("msteams attachment download failed", {
-				error: err instanceof Error ? err.message : String(err),
-				host: safeHostForLog(candidate.url)
-			});
+			const msg = err instanceof Error ? err.message : String(err);
+			params.logger?.warn?.(`msteams attachment download failed host=${safeHostForLog(candidate.url)} error=${msg}`);
 		}
 	}
 	return out;
@@ -1241,6 +1154,7 @@ async function downloadMSTeamsGraphMedia(params) {
 									url: requestUrl,
 									policy,
 									fetchFn,
+									fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 									requestInit: {
 										...init,
 										headers
@@ -1297,6 +1211,7 @@ async function downloadMSTeamsGraphMedia(params) {
 			allowHosts: policy.allowHosts,
 			authAllowHosts: policy.authAllowHosts,
 			fetchFn: params.fetchFn,
+			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 			resolveFn: params.resolveFn,
 			preserveFilenames: params.preserveFilenames,
 			logger: params.logger
@@ -1568,240 +1483,54 @@ function markParentContextInjected(sessionKey, parentId) {
 	touchLru(injectedParents, sessionKey, parentId, INJECTED_MAX);
 }
 //#endregion
-//#region extensions/msteams/src/streaming-message.ts
+//#region extensions/msteams/src/reply-stream-controller.ts
+function isStreamCancelledError(err) {
+	return err instanceof Error && err.name === "StreamCancelledError";
+}
 /**
-* Teams streaming message using the streaminfo entity protocol.
-*
-* Follows the official Teams SDK pattern:
-* 1. First chunk → POST a typing activity with streaminfo entity (streamType: "streaming")
-* 2. Subsequent chunks → POST typing activities with streaminfo + incrementing streamSequence
-* 3. Finalize → POST a message activity with streaminfo (streamType: "final")
+* Bridges openclaw's reply pipeline callbacks to the SDK's `ctx.stream`.
+* Streaming is enabled for personal (DM) conversations only; group/channel
+* messages fall through to block delivery.
 *
-* Uses the shared draft-stream-loop for throttling (avoids rate limits).
-*/
-/** Default throttle interval between stream updates (ms).
-* Teams docs recommend buffering tokens for 1.5-2s; limit is 1 req/s. */
-const DEFAULT_THROTTLE_MS = 1500;
-/** Minimum chars before sending the first streaming message. */
-const MIN_INITIAL_CHARS = 20;
-/** Teams message text limit. */
-const TEAMS_MAX_CHARS = 4e3;
-/**
-* Stop streaming before Teams expires the content stream server-side.
-* The exact service limit is opaque, so stay comfortably under it.
+* Streaming modes (resolved from `cfg.channels.msteams.streaming.preview`):
+* - "partial" (default): per-token streaming via `stream.emit(text)`. Each
+*   chunk goes onto the live preview card in Teams.
+* - "progress": no per-token streaming; the preview card carries an
+*   informative status that updates as tools run (e.g. "Looking up the
+*   schema..." → "Generating SQL..."). When tool-progress streaming is also
+*   enabled, raw tool names appear as bullets above the label.
+* - "block": disable native streaming entirely; the reply lands as a regular
+*   block message. We bypass the controller in that case.
 */
-const MAX_STREAM_AGE_MS = 45e3;
-function extractId(response) {
-	if (response && typeof response === "object" && "id" in response) return readStringValue(response.id);
-}
-function buildStreamInfoEntity(streamId, streamType, streamSequence) {
-	const entity = {
-		type: "streaminfo",
-		streamType
-	};
-	if (streamId) entity.streamId = streamId;
-	if (streamSequence != null) entity.streamSequence = streamSequence;
-	return entity;
-}
-var TeamsHttpStream = class {
-	constructor(options) {
-		this.accumulatedText = "";
-		this.streamId = void 0;
-		this.sequenceNumber = 0;
-		this.stopped = false;
-		this.finalized = false;
-		this.streamFailed = false;
-		this.lastStreamedText = "";
-		this.finalMessageId = void 0;
-		this.streamStartedAt = void 0;
-		this.sendActivity = options.sendActivity;
-		this.feedbackLoopEnabled = options.feedbackLoopEnabled ?? false;
-		this.onError = options.onError;
-		this.loop = createDraftStreamLoop({
-			throttleMs: options.throttleMs ?? DEFAULT_THROTTLE_MS,
-			isStopped: () => this.stopped,
-			sendOrEditStreamMessage: (text) => this.pushStreamChunk(text)
-		});
-	}
-	/**
-	* Send an informative status update (blue progress bar in Teams).
-	* Call this immediately when a message is received, before LLM starts generating.
-	* Establishes the stream so subsequent chunks continue from this stream ID.
-	*/
-	async sendInformativeUpdate(text) {
-		if (this.stopped || this.finalized) return;
-		this.sequenceNumber++;
-		const activity = {
-			type: "typing",
-			text,
-			entities: [buildStreamInfoEntity(this.streamId, "informative", this.sequenceNumber)]
-		};
-		try {
-			const response = await this.sendActivity(activity);
-			if (!this.streamId) this.streamId = extractId(response);
-		} catch (err) {
-			this.onError?.(err);
-		}
-	}
-	/**
-	* Ingest partial text from the LLM token stream.
-	* Called by onPartialReply — accumulates text and throttles updates.
-	*/
-	update(text) {
-		if (this.stopped || this.finalized) return;
-		this.accumulatedText = text;
-		if (!this.streamId && this.accumulatedText.length < MIN_INITIAL_CHARS) return;
-		if (this.accumulatedText.length > TEAMS_MAX_CHARS) {
-			this.streamFailed = true;
-			this.finalize();
-			return;
-		}
-		if (this.streamStartedAt && Date.now() - this.streamStartedAt >= MAX_STREAM_AGE_MS) {
-			this.streamFailed = true;
-			this.finalize();
-			return;
-		}
-		this.loop.update(this.accumulatedText);
-	}
-	/**
-	* Replace an informative progress update with final answer text.
-	* Returns false when the stream could not safely carry the final text, so
-	* callers can deliver the answer through the normal Teams message path.
-	*/
-	async replaceInformativeWithFinal(text) {
-		if (this.stopped || this.finalized) return false;
-		this.update(text);
-		await this.loop.flush();
-		await this.finalize();
-		return !this.streamFailed && this.hasContent;
-	}
-	/**
-	* Finalize the stream — send the final message activity.
-	*/
-	async finalize() {
-		if (this.finalized) return this.finalMessageId;
-		this.finalized = true;
-		this.stopped = true;
-		this.loop.stop();
-		await this.loop.waitForInFlight();
-		if (!this.accumulatedText.trim()) return this.finalMessageId;
-		if (this.streamFailed) {
-			if (this.streamId) try {
-				const response = await this.sendActivity({
-					type: "message",
-					text: this.lastStreamedText || "",
-					channelData: { feedbackLoopEnabled: this.feedbackLoopEnabled },
-					entities: [AI_GENERATED_ENTITY, buildStreamInfoEntity(this.streamId, "final")]
-				});
-				this.finalMessageId = extractId(response);
-			} catch {}
-			return this.finalMessageId;
-		}
-		try {
-			const entities = [AI_GENERATED_ENTITY];
-			if (this.streamId) entities.push(buildStreamInfoEntity(this.streamId, "final"));
-			const finalActivity = {
-				type: "message",
-				text: this.accumulatedText,
-				channelData: { feedbackLoopEnabled: this.feedbackLoopEnabled },
-				entities
-			};
-			const response = await this.sendActivity(finalActivity);
-			this.finalMessageId = extractId(response);
-		} catch (err) {
-			this.streamFailed = true;
-			this.onError?.(err);
-		}
-		return this.finalMessageId;
-	}
-	/** Whether streaming successfully delivered content (at least one chunk sent, not failed). */
-	get hasContent() {
-		return this.accumulatedText.length > 0 && !this.streamFailed;
-	}
-	/** Whether streaming failed and fallback delivery is needed. */
-	get isFailed() {
-		return this.streamFailed;
-	}
-	/** Number of characters successfully streamed before failure. */
-	get streamedLength() {
-		return this.lastStreamedText.length;
-	}
-	/** Whether the stream has been finalized. */
-	get isFinalized() {
-		return this.finalized;
-	}
-	/** Platform id returned by the final message activity, when available. */
-	get messageId() {
-		return this.finalMessageId;
-	}
-	/** Stream id returned by the first streaminfo activity, when available. */
-	get previewStreamId() {
-		return this.streamId;
-	}
-	/** Whether streaming fell back (not used in this implementation). */
-	get isFallback() {
-		return false;
-	}
-	/**
-	* Send a single streaming chunk as a typing activity with streaminfo.
-	* Per the Teams REST API spec:
-	* - First chunk: no streamId, streamSequence=1 → returns 201 with { id: streamId }
-	* - Subsequent chunks: include streamId, increment streamSequence → returns 202
-	*/
-	async pushStreamChunk(text) {
-		if (this.stopped && !this.finalized) return false;
-		this.sequenceNumber++;
-		const activity = {
-			type: "typing",
-			text,
-			entities: [buildStreamInfoEntity(this.streamId, "streaming", this.sequenceNumber)]
-		};
-		try {
-			const response = await this.sendActivity(activity);
-			if (!this.streamStartedAt) this.streamStartedAt = Date.now();
-			if (!this.streamId) this.streamId = extractId(response);
-			this.lastStreamedText = text;
-			return true;
-		} catch (err) {
-			const axiosData = err?.response;
-			const statusCode = axiosData?.status ?? err?.statusCode;
-			const responseBody = axiosData?.data ? JSON.stringify(axiosData.data).slice(0, 300) : "";
-			const msg = formatUnknownError(err);
-			this.onError?.(/* @__PURE__ */ new Error(`stream POST failed (HTTP ${statusCode ?? "?"}): ${msg}${responseBody ? ` body=${responseBody}` : ""}`));
-			this.streamFailed = true;
-			return false;
-		}
-	}
-};
-//#endregion
-//#region extensions/msteams/src/reply-stream-controller.ts
 function createTeamsReplyStreamController(params) {
 	const isPersonal = normalizeOptionalLowercaseString(params.conversationType) === "personal";
 	const streamMode = resolveChannelPreviewStreamMode(params.msteamsConfig, "partial");
 	const shouldUseNativeStream = isPersonal && (streamMode === "partial" || streamMode === "progress");
-	const shouldSuppressDefaultToolProgressMessages = shouldUseNativeStream && streamMode === "progress";
-	const shouldStreamPreviewToolProgress = shouldSuppressDefaultToolProgressMessages && resolveChannelStreamingPreviewToolProgress(params.msteamsConfig);
-	const stream = shouldUseNativeStream ? new TeamsHttpStream({
-		sendActivity: (activity) => params.context.sendActivity(activity),
-		feedbackLoopEnabled: params.feedbackLoopEnabled,
-		onError: (err) => {
-			params.log.debug?.(`stream error: ${formatUnknownError(err)}`);
-		}
-	}) : void 0;
-	let streamReceivedTokens = false;
-	let informativeUpdateSent = false;
-	let progressLines = [];
+	const shouldStreamPreviewToolProgress = streamMode === "progress" && resolveChannelStreamingPreviewToolProgress(params.msteamsConfig);
+	const stream = shouldUseNativeStream ? params.context.stream : void 0;
+	let tokensEmitted = false;
+	let streamFinalizationPending = false;
+	let canceledLocally = false;
+	let streamFailed = false;
 	let lastInformativeText = "";
-	let pendingFinalize;
-	let liveState = createLiveMessageState({ canFinalizeInPlace: Boolean(stream) });
-	const markStreamFinalized = () => {
-		if (!stream || stream.isFailed) return;
-		const messageId = stream.messageId ?? stream.previewStreamId;
-		if (!messageId) return;
-		liveState = markLiveMessageFinalized(liveState, createPreviewMessageReceipt({ id: messageId }));
+	let progressLines = [];
+	let pendingFinalPayload;
+	let emittedTextLength = 0;
+	const wasCanceled = () => canceledLocally || Boolean(stream?.canceled);
+	const fallbackPayloadForSuppressedFinal = (payload) => {
+		return Boolean(payload.mediaUrl || payload.mediaUrls?.length) ? {
+			...payload,
+			mediaUrl: void 0,
+			mediaUrls: void 0
+		} : payload;
 	};
-	const renderInformativeUpdate = async () => {
-		if (!stream) return;
+	/**
+	* Render the current informative status line into the streaming card. Pulls
+	* the rotating "Thinking..." label from msteams config (or the plugin-sdk
+	* default) and prepends collected tool-progress lines when configured.
+	*/
+	const renderInformativeUpdate = () => {
+		if (!stream || wasCanceled()) return;
 		const informativeText = formatChannelProgressDraftText({
 			entry: params.msteamsConfig,
 			lines: shouldStreamPreviewToolProgress ? progressLines : [],
@@ -1810,151 +1539,142 @@ function createTeamsReplyStreamController(params) {
 		});
 		if (!informativeText || informativeText === lastInformativeText) return;
 		lastInformativeText = informativeText;
-		informativeUpdateSent = true;
-		await stream.sendInformativeUpdate(informativeText);
-	};
-	const progressDraftGate = createChannelProgressDraftGate({ onStart: renderInformativeUpdate });
-	const noteProgressWork = async (options) => {
-		if (!stream || streamMode !== "progress") return;
-		if (options?.toolName !== void 0 && !isChannelProgressDraftWorkToolName(options.toolName)) return;
-		const hadStarted = progressDraftGate.hasStarted;
-		await progressDraftGate.noteWork();
-		if (hadStarted && progressDraftGate.hasStarted) await renderInformativeUpdate();
-	};
-	const pushProgressLine = async (line, options) => {
-		if (!stream || streamMode !== "progress") return;
-		if (options?.toolName !== void 0 && !isChannelProgressDraftWorkToolName(options.toolName)) return;
-		if (shouldStreamPreviewToolProgress) {
-			const normalized = normalizeChannelProgressDraftLineIdentity(line);
-			if (normalized) progressLines = mergeChannelProgressDraftLine(progressLines, typeof line === "object" && line !== void 0 ? line : normalized, { maxLines: resolveChannelProgressDraftMaxLines(params.msteamsConfig) });
+		try {
+			stream.update(informativeText);
+		} catch (err) {
+			if (isStreamCancelledError(err)) {
+				canceledLocally = true;
+				return;
+			}
+			params.log?.debug?.(`stream informative update failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
-		await noteProgressWork();
-	};
-	const fallbackAfterStreamFailure = (payload, hasMedia) => {
-		if (!payload.text) return payload;
-		const streamedLength = stream?.streamedLength ?? 0;
-		if (streamedLength <= 0) return payload;
-		const remainingText = payload.text.slice(streamedLength);
-		if (!remainingText) return hasMedia ? {
-			...payload,
-			text: void 0
-		} : void 0;
-		return {
-			...payload,
-			text: remainingText
-		};
-	};
-	const finalizeProgressPayload = async (payload, hasMedia) => {
-		if (!stream || !payload.text) return payload;
-		return (await deliverWithFinalizableLivePreviewAdapter({
-			kind: "final",
-			payload,
-			liveState,
-			adapter: defineFinalizableLivePreviewAdapter({
-				draft: {
-					flush: async () => {},
-					clear: async () => {},
-					id: () => stream.previewStreamId
-				},
-				buildFinalEdit: (candidate) => candidate.text ? { text: candidate.text } : void 0,
-				editFinal: async (_previewId, edit) => {
-					const finalized = await stream.replaceInformativeWithFinal(edit.text);
-					informativeUpdateSent = false;
-					if (!finalized || stream.isFailed) throw new Error("Teams progress stream finalization failed");
-				},
-				resolveFinalizedId: (previewId) => stream.messageId ?? stream.previewStreamId ?? previewId,
-				createPreviewReceipt: (id) => createPreviewMessageReceipt({ id }),
-				onPreviewFinalized: (_id, _receipt, state) => {
-					liveState = state;
-				},
-				logPreviewEditFailure: (err) => {
-					params.log.debug?.(`stream finalization failed: ${formatUnknownError(err)}`);
-				}
-			}),
-			deliverNormally: async () => false
-		})).kind === "preview-finalized" ? hasMedia ? {
-			...payload,
-			text: void 0
-		} : void 0 : payload;
 	};
+	const progressDraftGate = createChannelProgressDraftGate({ onStart: renderInformativeUpdate });
 	return {
 		async onReplyStart() {},
-		async noteProgressWork(options) {
-			await noteProgressWork(options);
-		},
 		onPartialReply(payload) {
-			if (!stream || !payload.text) return;
-			if (streamMode === "progress") return;
-			streamReceivedTokens = true;
-			stream.update(payload.text);
-		},
-		async pushProgressLine(line, options) {
-			await pushProgressLine(line, options);
+			if (!stream || !payload.text || wasCanceled() || streamMode !== "partial" || streamFinalizationPending) return;
+			const fullText = payload.text;
+			if (fullText.length <= emittedTextLength) return;
+			const delta = fullText.slice(emittedTextLength);
+			try {
+				stream.emit(delta);
+				emittedTextLength = fullText.length;
+				tokensEmitted = true;
+			} catch (err) {
+				if (isStreamCancelledError(err)) {
+					canceledLocally = true;
+					return;
+				}
+				streamFailed = true;
+				params.log?.warn?.(`msteams stream emit failed, falling back to block delivery: ${err instanceof Error ? err.message : String(err)}`);
+			}
 		},
-		shouldSuppressDefaultToolProgressMessages() {
-			return shouldSuppressDefaultToolProgressMessages;
+		/**
+		* Note that the agent is working — bumps the progress-draft gate so the
+		* informative status starts (or refreshes) on the next render. Called
+		* from the reply-dispatcher's typing callbacks.
+		*/
+		async noteProgressWork(options) {
+			if (!stream || streamMode !== "progress") return;
+			if (options?.toolName !== void 0 && !isChannelProgressDraftWorkToolName(options.toolName)) return;
+			const hadStarted = progressDraftGate.hasStarted;
+			await progressDraftGate.noteWork();
+			if (hadStarted && progressDraftGate.hasStarted) renderInformativeUpdate();
 		},
-		shouldStreamPreviewToolProgress() {
-			return shouldStreamPreviewToolProgress;
+		/**
+		* Append a tool-progress line (e.g. a tool name being invoked) into the
+		* preview card's informative status. Only takes effect in "progress" mode
+		* with `streaming.previewToolProgress` enabled in config.
+		*/
+		async pushProgressLine(line, options) {
+			if (!stream || streamMode !== "progress") return;
+			if (options?.toolName !== void 0 && !isChannelProgressDraftWorkToolName(options.toolName)) return;
+			if (shouldStreamPreviewToolProgress) {
+				const normalized = normalizeChannelProgressDraftLineIdentity(line);
+				if (normalized) progressLines = mergeChannelProgressDraftLine(progressLines, typeof line === "object" && line !== void 0 ? line : normalized, { maxLines: resolveChannelProgressDraftMaxLines(params.msteamsConfig) });
+			}
+			const hadStarted = progressDraftGate.hasStarted;
+			await progressDraftGate.noteWork();
+			if (hadStarted && progressDraftGate.hasStarted) renderInformativeUpdate();
 		},
-		async preparePayload(payload) {
-			const hasMedia = Boolean(payload.mediaUrl || payload.mediaUrls?.length);
-			if (stream && streamMode === "progress" && informativeUpdateSent && !stream.isFinalized) {
-				if (!payload.text) return payload;
-				return await finalizeProgressPayload(payload, hasMedia);
+		preparePayload(payload) {
+			if (!stream) return payload;
+			if (wasCanceled()) return;
+			if (tokensEmitted && !streamFailed) {
+				const hasMedia = Boolean(payload.mediaUrl || payload.mediaUrls?.length);
+				pendingFinalPayload = fallbackPayloadForSuppressedFinal(payload);
+				streamFinalizationPending = true;
+				tokensEmitted = false;
+				return hasMedia ? {
+					...payload,
+					text: void 0
+				} : void 0;
 			}
-			if (!stream || !streamReceivedTokens) return payload;
-			if (stream.isFailed) {
-				streamReceivedTokens = false;
-				return fallbackAfterStreamFailure(payload, hasMedia);
+			if (streamMode === "progress" && payload.text) try {
+				stream.emit(payload.text);
+				pendingFinalPayload = fallbackPayloadForSuppressedFinal(payload);
+				streamFinalizationPending = true;
+				return Boolean(payload.mediaUrl || payload.mediaUrls?.length) ? {
+					...payload,
+					text: void 0
+				} : void 0;
+			} catch (err) {
+				if (isStreamCancelledError(err)) {
+					canceledLocally = true;
+					return;
+				}
+				params.log?.debug?.(`progress-mode finalize failed: ${err instanceof Error ? err.message : String(err)}`);
 			}
-			if (!stream.hasContent || stream.isFinalized) return payload;
-			streamReceivedTokens = false;
-			pendingFinalize = stream.finalize().then(() => {
-				markStreamFinalized();
-			});
-			if (!hasMedia) return;
-			return {
-				...payload,
-				text: void 0
-			};
+			return payload;
 		},
 		async finalize() {
-			progressDraftGate.cancel();
-			await pendingFinalize;
-			if (!pendingFinalize) {
-				await stream?.finalize();
-				markStreamFinalized();
+			if (!stream || !streamFinalizationPending || wasCanceled()) return;
+			const finalEntities = [{
+				type: "https://schema.org/Message",
+				"@type": "Message",
+				"@context": "https://schema.org",
+				"@id": "",
+				additionalType: ["AIGeneratedContent"]
+			}];
+			const finalChannelData = params.feedbackLoopEnabled ? { feedbackLoopEnabled: true } : {};
+			try {
+				stream.emit({
+					type: "message",
+					entities: finalEntities,
+					channelData: finalChannelData
+				});
+				const result = await stream.close();
+				streamFinalizationPending = false;
+				if (!result) {
+					const fallback = pendingFinalPayload;
+					pendingFinalPayload = void 0;
+					return fallback;
+				}
+				pendingFinalPayload = void 0;
+				return;
+			} catch (err) {
+				if (isStreamCancelledError(err)) {
+					canceledLocally = true;
+					pendingFinalPayload = void 0;
+					streamFinalizationPending = false;
+					return;
+				}
+				streamFailed = true;
+				streamFinalizationPending = false;
+				params.log?.warn?.(`msteams stream finalize failed: ${err instanceof Error ? err.message : String(err)}`);
+				const fallback = pendingFinalPayload;
+				pendingFinalPayload = void 0;
+				return fallback;
 			}
 		},
 		hasStream() {
 			return Boolean(stream);
 		},
-		liveState() {
-			return liveState;
-		},
-		/**
-		* Whether the Teams streaming card is currently receiving LLM tokens.
-		* Used to gate side-channel keepalive activity so we don't overlay plain
-		* "typing" indicators on top of a live streaming card.
-		*
-		* Returns true only while the stream is actively chunking text into the
-		* streaming card. The informative update (blue progress bar) is short
-		* lived so we intentionally do not count it as "active"; this way the
-		* typing keepalive can still fire during the informative window and
-		* during tool chains between text segments.
-		*
-		* Returns false when:
-		* - No stream exists (non-personal conversation).
-		* - Stream has not yet received any text tokens.
-		* - Stream has been finalized (e.g. after the first text segment, while
-		*   tools run before the next segment).
-		*/
 		isStreamActive() {
-			if (!stream) return false;
-			if (stream.isFinalized || stream.isFailed) return false;
-			return streamReceivedTokens;
-		}
+			return Boolean(stream) && tokensEmitted && !wasCanceled() && !streamFailed;
+		},
+		wasCanceled
 	};
 }
 //#endregion
@@ -1981,6 +1701,7 @@ function createMSTeamsReplyDispatcher(params) {
 	*/
 	const TYPING_KEEPALIVE_MAX_DURATION_MS = 10 * 6e4;
 	const streamActiveRef = { current: () => false };
+	const streamCanceledRef = { current: () => false };
 	const rawSendTypingIndicator = async () => {
 		await withRevokedProxyFallback({
 			run: async () => {
@@ -1988,12 +1709,7 @@ function createMSTeamsReplyDispatcher(params) {
 			},
 			onRevoked: async () => {
 				const baseRef = buildConversationReference(params.conversationRef);
-				await params.adapter.continueConversation(params.appId, {
-					...baseRef,
-					activityId: void 0
-				}, async (ctx) => {
-					await ctx.sendActivity({ type: "typing" });
-				});
+				await sendMSTeamsActivityWithReference(params.app, baseRef, { type: "typing" }, { serviceUrlBoundary: resolveMSTeamsSdkCloudOptions(msteamsCfg) });
 			},
 			onRevokedLog: () => {
 				params.log.debug?.("turn context revoked, sending typing via proactive messaging");
@@ -2002,6 +1718,7 @@ function createMSTeamsReplyDispatcher(params) {
 	};
 	const sendTypingIndicator = isTypingSupported ? async () => {
 		if (streamActiveRef.current()) return;
+		if (streamCanceledRef.current()) return;
 		await rawSendTypingIndicator();
 	} : async () => {};
 	const { onModelSelected, typingCallbacks, ...replyPipeline } = createChannelMessageReplyPipeline({
@@ -2042,14 +1759,16 @@ function createMSTeamsReplyDispatcher(params) {
 		progressSeed: `${params.accountId ?? "default"}:${params.conversationRef.conversation?.id ?? ""}`
 	});
 	streamActiveRef.current = () => streamController.isStreamActive();
-	const resolvedBlockStreamingEnabled = resolveChannelPreviewStreamMode(msteamsCfg, "partial") === "block" ? true : resolveChannelStreamingBlockEnabled(msteamsCfg);
-	const blockStreamingEnabled = resolvedBlockStreamingEnabled ?? false;
+	streamCanceledRef.current = () => streamController.wasCanceled();
+	const teamsStreamMode = resolveChannelPreviewStreamMode(msteamsCfg, "partial");
+	const blockStreamingResolved = teamsStreamMode === "block" ? true : resolveChannelStreamingBlockEnabled(msteamsCfg);
+	const blockStreamingEnabled = blockStreamingResolved ?? false;
 	const typingIndicatorEnabled = typeof msteamsCfg?.typingIndicator === "boolean" ? msteamsCfg.typingIndicator : true;
 	const pendingMessages = [];
 	const sendMessages = async (messages) => {
 		return sendMSTeamsMessages({
 			replyStyle: params.replyStyle,
-			adapter: params.adapter,
+			app: params.app,
 			appId: params.appId,
 			conversationRef: params.conversationRef,
 			context: params.context,
@@ -2064,7 +1783,8 @@ function createMSTeamsReplyDispatcher(params) {
 			tokenProvider: params.tokenProvider,
 			sharePointSiteId: params.sharePointSiteId,
 			mediaMaxBytes,
-			feedbackLoopEnabled
+			feedbackLoopEnabled,
+			serviceUrlBoundary: resolveMSTeamsSdkCloudOptions(msteamsCfg)
 		});
 	};
 	const queueDeliveryFailureSystemEvent = (failure) => {
@@ -2083,6 +1803,16 @@ function createMSTeamsReplyDispatcher(params) {
 			contextKey: `msteams:delivery-failure:${params.conversationRef.conversation?.id ?? "unknown"}`
 		});
 	};
+	const queueReplyPayload = (payload) => {
+		const messages = renderReplyPayloadsToMessages([payload], {
+			textChunkLimit: params.textLimit,
+			chunkText: true,
+			mediaMode: "split",
+			tableMode,
+			chunkMode
+		});
+		pendingMessages.push(...messages);
+	};
 	const flushPendingMessages = async () => {
 		if (pendingMessages.length === 0) return;
 		const toSend = pendingMessages.splice(0);
@@ -2125,16 +1855,9 @@ function createMSTeamsReplyDispatcher(params) {
 		},
 		typingCallbacks,
 		deliver: async (payload) => {
-			const preparedPayload = await streamController.preparePayload(payload);
+			const preparedPayload = streamController.preparePayload(payload);
 			if (!preparedPayload) return;
-			const messages = renderReplyPayloadsToMessages([preparedPayload], {
-				textChunkLimit: params.textLimit,
-				chunkText: true,
-				mediaMode: "split",
-				tableMode,
-				chunkMode
-			});
-			pendingMessages.push(...messages);
+			queueReplyPayload(preparedPayload);
 			if (blockStreamingEnabled) await flushPendingMessages();
 		},
 		onError: (err, info) => {
@@ -2161,110 +1884,114 @@ function createMSTeamsReplyDispatcher(params) {
 				classification,
 				hint
 			});
-		}).then(() => {
-			return streamController.finalize().catch((err) => {
+		}).then(async () => {
+			const fallbackPayload = await streamController.finalize().catch((err) => {
 				params.log.debug?.("stream finalize failed", { error: formatUnknownError(err) });
 			});
+			if (fallbackPayload) {
+				queueReplyPayload(fallbackPayload);
+				await flushPendingMessages();
+			}
 		}).finally(() => {
 			baseMarkDispatchIdle();
 		});
 	};
+	const previewToolProgressEnabled = resolveChannelStreamingPreviewToolProgress(msteamsCfg);
+	const suppressDefaultToolProgressMessages = resolveChannelStreamingSuppressDefaultToolProgressMessages(msteamsCfg);
+	const shouldSuppressDefaultToolProgressMessages = teamsStreamMode === "progress" && suppressDefaultToolProgressMessages && previewToolProgressEnabled;
+	const progressCallbacks = streamController.hasStream() ? {
+		onReasoningStream: async (payload) => {
+			const text = typeof payload?.text === "string" ? payload.text : void 0;
+			if (!text) return;
+			if (payload?.isReasoningSnapshot !== true) {
+				await streamController.pushProgressLine(text);
+				return;
+			}
+			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+				event: "item",
+				itemId: "reasoning",
+				itemKind: "analysis",
+				title: "Reasoning",
+				progressText: text
+			}));
+		},
+		onToolStart: async (payload) => {
+			const name = typeof payload?.name === "string" ? payload.name : void 0;
+			const detailMode = typeof payload?.detailMode === "string" ? payload.detailMode : void 0;
+			await streamController.pushProgressLine(buildChannelProgressDraftLineForEntry(msteamsCfg, {
+				event: "tool",
+				...name ? { name } : {},
+				...typeof payload?.phase === "string" ? { phase: payload.phase } : {},
+				...payload?.args && typeof payload.args === "object" ? { args: payload.args } : {}
+			}, detailMode === "explain" || detailMode === "raw" ? { detailMode } : void 0), name ? { toolName: name } : void 0);
+		},
+		onItemEvent: async (payload) => {
+			await streamController.pushProgressLine(buildChannelProgressDraftLineForEntry(msteamsCfg, {
+				event: "item",
+				...typeof payload?.kind === "string" ? { itemKind: payload.kind } : {},
+				...typeof payload?.title === "string" ? { title: payload.title } : {},
+				...typeof payload?.name === "string" ? { name: payload.name } : {},
+				...typeof payload?.phase === "string" ? { phase: payload.phase } : {},
+				...typeof payload?.status === "string" ? { status: payload.status } : {},
+				...typeof payload?.summary === "string" ? { summary: payload.summary } : {},
+				...typeof payload?.progressText === "string" ? { progressText: payload.progressText } : {},
+				...typeof payload?.meta === "string" ? { meta: payload.meta } : {}
+			}));
+		},
+		onPlanUpdate: async (payload) => {
+			if (payload?.phase !== "update") return;
+			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+				event: "plan",
+				phase: payload.phase,
+				...typeof payload?.title === "string" ? { title: payload.title } : {},
+				...typeof payload?.explanation === "string" ? { explanation: payload.explanation } : {},
+				...Array.isArray(payload?.steps) && payload.steps.every((s) => typeof s === "string") ? { steps: payload.steps } : {}
+			}));
+		},
+		onApprovalEvent: async (payload) => {
+			if (payload?.phase !== "requested") return;
+			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+				event: "approval",
+				phase: payload.phase,
+				...typeof payload?.title === "string" ? { title: payload.title } : {},
+				...typeof payload?.command === "string" ? { command: payload.command } : {},
+				...typeof payload?.reason === "string" ? { reason: payload.reason } : {},
+				...typeof payload?.message === "string" ? { message: payload.message } : {}
+			}));
+		},
+		onCommandOutput: async (payload) => {
+			if (payload?.phase !== "end") return;
+			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+				event: "command-output",
+				phase: payload.phase,
+				...typeof payload?.title === "string" ? { title: payload.title } : {},
+				...typeof payload?.name === "string" ? { name: payload.name } : {},
+				...typeof payload?.status === "string" ? { status: payload.status } : {},
+				...typeof payload?.exitCode === "number" ? { exitCode: payload.exitCode } : {}
+			}));
+		},
+		onPatchSummary: async (payload) => {
+			if (payload?.phase !== "end") return;
+			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+				event: "patch",
+				phase: payload.phase,
+				...typeof payload?.title === "string" ? { title: payload.title } : {},
+				...typeof payload?.name === "string" ? { name: payload.name } : {},
+				...Array.isArray(payload?.added) && payload.added.every((s) => typeof s === "string") ? { added: payload.added } : {},
+				...Array.isArray(payload?.modified) && payload.modified.every((s) => typeof s === "string") ? { modified: payload.modified } : {},
+				...Array.isArray(payload?.deleted) && payload.deleted.every((s) => typeof s === "string") ? { deleted: payload.deleted } : {},
+				...typeof payload?.summary === "string" ? { summary: payload.summary } : {}
+			}));
+		}
+	} : {};
 	return {
 		dispatcher,
 		replyOptions: {
 			...replyOptions,
-			...streamController.hasStream() ? {
-				onPartialReply: (payload) => streamController.onPartialReply(payload),
-				onToolStart: async (payload) => {
-					await streamController.noteProgressWork({ toolName: payload.name });
-				},
-				onItemEvent: async () => {
-					await streamController.noteProgressWork();
-				},
-				onPlanUpdate: async (payload) => {
-					if (payload.phase === "update") await streamController.noteProgressWork();
-				},
-				onApprovalEvent: async (payload) => {
-					if (payload.phase === "requested") await streamController.noteProgressWork();
-				},
-				onCommandOutput: async (payload) => {
-					if (payload.phase === "end") await streamController.noteProgressWork();
-				},
-				onPatchSummary: async (payload) => {
-					if (payload.phase === "end") await streamController.noteProgressWork();
-				}
-			} : {},
-			...streamController.shouldSuppressDefaultToolProgressMessages() ? { suppressDefaultToolProgressMessages: true } : {},
-			...streamController.shouldStreamPreviewToolProgress() ? {
-				onToolStart: async (payload) => {
-					await streamController.pushProgressLine(buildChannelProgressDraftLineForEntry(msteamsCfg, {
-						event: "tool",
-						name: payload.name,
-						phase: payload.phase,
-						args: payload.args
-					}, payload.detailMode ? { detailMode: payload.detailMode } : void 0), { toolName: payload.name });
-				},
-				onItemEvent: async (payload) => {
-					await streamController.pushProgressLine(buildChannelProgressDraftLineForEntry(msteamsCfg, {
-						event: "item",
-						itemId: payload.itemId,
-						itemKind: payload.kind,
-						title: payload.title,
-						name: payload.name,
-						phase: payload.phase,
-						status: payload.status,
-						summary: payload.summary,
-						progressText: payload.progressText,
-						meta: payload.meta
-					}));
-				},
-				onPlanUpdate: async (payload) => {
-					if (payload.phase !== "update") return;
-					await streamController.pushProgressLine(buildChannelProgressDraftLine({
-						event: "plan",
-						phase: payload.phase,
-						title: payload.title,
-						explanation: payload.explanation,
-						steps: payload.steps
-					}));
-				},
-				onApprovalEvent: async (payload) => {
-					if (payload.phase !== "requested") return;
-					await streamController.pushProgressLine(buildChannelProgressDraftLine({
-						event: "approval",
-						phase: payload.phase,
-						title: payload.title,
-						command: payload.command,
-						reason: payload.reason,
-						message: payload.message
-					}));
-				},
-				onCommandOutput: async (payload) => {
-					if (payload.phase !== "end") return;
-					await streamController.pushProgressLine(buildChannelProgressDraftLine({
-						event: "command-output",
-						phase: payload.phase,
-						title: payload.title,
-						name: payload.name,
-						status: payload.status,
-						exitCode: payload.exitCode
-					}));
-				},
-				onPatchSummary: async (payload) => {
-					if (payload.phase !== "end") return;
-					await streamController.pushProgressLine(buildChannelProgressDraftLine({
-						event: "patch",
-						phase: payload.phase,
-						title: payload.title,
-						name: payload.name,
-						added: payload.added,
-						modified: payload.modified,
-						deleted: payload.deleted,
-						summary: payload.summary
-					}));
-				}
-			} : {},
-			disableBlockStreaming: typeof resolvedBlockStreamingEnabled === "boolean" ? !resolvedBlockStreamingEnabled : void 0,
+			...streamController.hasStream() ? { onPartialReply: (payload) => streamController.onPartialReply(payload) } : {},
+			...progressCallbacks,
+			...shouldSuppressDefaultToolProgressMessages ? { suppressDefaultToolProgressMessages: true } : {},
+			disableBlockStreaming: blockStreamingResolved == null ? void 0 : !blockStreamingResolved,
 			onModelSelected
 		},
 		markDispatchIdle
@@ -2545,7 +2272,7 @@ function buildStoredConversationReference(params) {
 	};
 }
 function createMSTeamsMessageHandler(deps) {
-	const { cfg, runtime, appId, adapter, tokenProvider, textLimit, mediaMaxBytes, conversationStore, pollStore, log } = deps;
+	const { cfg, runtime, appId, app, tokenProvider, textLimit, mediaMaxBytes, conversationStore, pollStore, log } = deps;
 	const core = getMSTeamsRuntime();
 	const logVerboseMessage = (message) => {
 		if (core.logging.shouldLogVerbose()) log.debug?.(message);
@@ -3012,7 +2739,7 @@ function createMSTeamsMessageHandler(deps) {
 			accountId: route.accountId,
 			runtime,
 			log,
-			adapter,
+			app,
 			appId,
 			conversationRef,
 			context,
@@ -3243,191 +2970,6 @@ function createMSTeamsReactionHandler(deps) {
 	};
 }
 //#endregion
-//#region extensions/msteams/src/sso.ts
-/** Scope used to obtain a Bot Framework service token. */
-const BOT_FRAMEWORK_TOKEN_SCOPE = "https://api.botframework.com/.default";
-/** Bot Framework User Token service base URL. */
-const BOT_FRAMEWORK_USER_TOKEN_BASE_URL = "https://token.botframework.com";
-/**
-* Extract and validate the `signin/tokenExchange` activity value. Teams
-* delivers `{ id, connectionName, token }`; any field may be missing on
-* malformed invocations, so callers should check the parsed result.
-*/
-function parseSigninTokenExchangeValue(value) {
-	if (!value || typeof value !== "object") return null;
-	const obj = value;
-	return {
-		id: typeof obj.id === "string" ? obj.id : void 0,
-		connectionName: typeof obj.connectionName === "string" ? obj.connectionName : void 0,
-		token: typeof obj.token === "string" ? obj.token : void 0
-	};
-}
-/** Extract the `signin/verifyState` activity value `{ state }`. */
-function parseSigninVerifyStateValue(value) {
-	if (!value || typeof value !== "object") return null;
-	const obj = value;
-	return { state: typeof obj.state === "string" ? obj.state : void 0 };
-}
-async function callUserTokenService(params) {
-	const qs = new URLSearchParams(params.query).toString();
-	const url = `${params.baseUrl.replace(/\/+$/, "")}${params.path}?${qs}`;
-	const headers = {
-		Accept: "application/json",
-		Authorization: `Bearer ${params.bearerToken}`,
-		"User-Agent": buildUserAgent()
-	};
-	if (params.body !== void 0) headers["Content-Type"] = "application/json";
-	const response = await params.fetchImpl(url, {
-		method: params.method,
-		headers,
-		body: params.body === void 0 ? void 0 : JSON.stringify(params.body)
-	});
-	if (!response.ok) return {
-		error: await response.text().catch(() => "") || `HTTP ${response.status}`,
-		status: response.status
-	};
-	let parsed;
-	try {
-		parsed = await response.json();
-	} catch {
-		return {
-			error: "invalid JSON from User Token service",
-			status: response.status
-		};
-	}
-	if (!parsed || typeof parsed !== "object") return {
-		error: "empty response from User Token service",
-		status: response.status
-	};
-	const obj = parsed;
-	const token = typeof obj.token === "string" ? obj.token : void 0;
-	const connectionName = typeof obj.connectionName === "string" ? obj.connectionName : void 0;
-	const channelId = typeof obj.channelId === "string" ? obj.channelId : void 0;
-	const expiration = typeof obj.expiration === "string" ? obj.expiration : void 0;
-	if (!token || !connectionName) return {
-		error: "User Token service response missing token/connectionName",
-		status: 502
-	};
-	return {
-		channelId,
-		connectionName,
-		token,
-		expiration
-	};
-}
-/**
-* Exchange a Teams SSO token for a delegated user token via Bot
-* Framework's User Token service, then persist the result.
-*/
-async function handleSigninTokenExchangeInvoke(params) {
-	const { value, user, deps } = params;
-	if (!user.userId) return {
-		ok: false,
-		code: "missing_user",
-		message: "no user id on invoke activity"
-	};
-	const connectionName = value.connectionName?.trim() || deps.connectionName;
-	if (!connectionName) return {
-		ok: false,
-		code: "missing_connection",
-		message: "no OAuth connection name"
-	};
-	if (!value.token) return {
-		ok: false,
-		code: "missing_token",
-		message: "no exchangeable token on invoke"
-	};
-	const bearer = await deps.tokenProvider.getAccessToken(BOT_FRAMEWORK_TOKEN_SCOPE);
-	const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
-	const result = await callUserTokenService({
-		baseUrl: deps.userTokenBaseUrl ?? BOT_FRAMEWORK_USER_TOKEN_BASE_URL,
-		path: "/api/usertoken/exchange",
-		query: {
-			userId: user.userId,
-			connectionName,
-			channelId: user.channelId ?? "msteams"
-		},
-		method: "POST",
-		body: { token: value.token },
-		bearerToken: bearer,
-		fetchImpl
-	});
-	if ("error" in result) return {
-		ok: false,
-		code: result.status >= 500 ? "service_error" : "unexpected_response",
-		message: result.error,
-		status: result.status
-	};
-	await deps.tokenStore.save({
-		connectionName,
-		userId: user.userId,
-		token: result.token,
-		expiresAt: result.expiration,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	});
-	return {
-		ok: true,
-		token: result.token,
-		expiresAt: result.expiration
-	};
-}
-/**
-* Finish a magic-code sign-in: look up the user token for the state
-* code via Bot Framework's User Token service, then persist it.
-*/
-async function handleSigninVerifyStateInvoke(params) {
-	const { value, user, deps } = params;
-	if (!user.userId) return {
-		ok: false,
-		code: "missing_user",
-		message: "no user id on invoke activity"
-	};
-	if (!deps.connectionName) return {
-		ok: false,
-		code: "missing_connection",
-		message: "no OAuth connection name"
-	};
-	const state = value.state?.trim();
-	if (!state) return {
-		ok: false,
-		code: "missing_state",
-		message: "no state code on invoke"
-	};
-	const bearer = await deps.tokenProvider.getAccessToken(BOT_FRAMEWORK_TOKEN_SCOPE);
-	const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
-	const result = await callUserTokenService({
-		baseUrl: deps.userTokenBaseUrl ?? BOT_FRAMEWORK_USER_TOKEN_BASE_URL,
-		path: "/api/usertoken/GetToken",
-		query: {
-			userId: user.userId,
-			connectionName: deps.connectionName,
-			channelId: user.channelId ?? "msteams",
-			code: state
-		},
-		method: "GET",
-		bearerToken: bearer,
-		fetchImpl
-	});
-	if ("error" in result) return {
-		ok: false,
-		code: result.status >= 500 ? "service_error" : "unexpected_response",
-		message: result.error,
-		status: result.status
-	};
-	await deps.tokenStore.save({
-		connectionName: deps.connectionName,
-		userId: user.userId,
-		token: result.token,
-		expiresAt: result.expiration,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	});
-	return {
-		ok: true,
-		token: result.token,
-		expiresAt: result.expiration
-	};
-}
-//#endregion
 //#region extensions/msteams/src/welcome-card.ts
 /**
 * Builds an Adaptive Card for welcoming users when the bot is added to a conversation.
@@ -3546,11 +3088,118 @@ async function isSigninInvokeAuthorized(context, deps) {
 		includeInvokeName: true
 	});
 }
+async function isCardActionInvokeAuthorized(context, deps) {
+	return isInvokeAuthorized({
+		context,
+		deps,
+		deniedLogs: {
+			dm: "dropping card action invoke (dm sender not allowlisted)",
+			channel: "dropping card action invoke (not in team/channel allowlist)",
+			group: "dropping card action invoke (group sender not allowlisted)"
+		},
+		includeInvokeName: true
+	});
+}
+function registerMSTeamsHandlers(handler, deps) {
+	const handleTeamsMessage = createMSTeamsMessageHandler(deps);
+	const handleReaction = createMSTeamsReactionHandler(deps);
+	const originalRun = handler.run;
+	if (originalRun) handler.run = async (context) => {
+		const ctx = context;
+		if (ctx.activity?.type === "invoke" && ctx.activity?.name === "adaptiveCard/action") {
+			const text = serializeAdaptiveCardActionValue(ctx.activity?.value);
+			if (text) await handleTeamsMessage({
+				...ctx,
+				activity: {
+					...ctx.activity,
+					type: "message",
+					text
+				}
+			});
+			return;
+		}
+		return originalRun.call(handler, context);
+	};
+	handler.onMessage(async (context, next) => {
+		try {
+			await handleTeamsMessage(context);
+		} catch (err) {
+			deps.runtime.error(`msteams handler failed: ${formatUnknownError(err)}`);
+		}
+		await next();
+	});
+	handler.onMembersAdded(async (context, next) => {
+		const ctx = context;
+		const membersAdded = ctx.activity?.membersAdded ?? [];
+		const botId = ctx.activity?.recipient?.id;
+		const msteamsCfg = deps.cfg.channels?.msteams;
+		for (const member of membersAdded) if (member.id === botId) {
+			const isPersonal = (normalizeOptionalLowercaseString(ctx.activity?.conversation?.conversationType) ?? "personal") === "personal";
+			if (isPersonal && msteamsCfg?.welcomeCard !== false) {
+				const card = buildWelcomeCard({
+					botName: ctx.activity?.recipient?.name ?? void 0,
+					promptStarters: msteamsCfg?.promptStarters
+				});
+				try {
+					await ctx.sendActivity({
+						type: "message",
+						attachments: [{
+							contentType: "application/vnd.microsoft.card.adaptive",
+							content: card
+						}]
+					});
+					deps.log.info("sent welcome card");
+				} catch (err) {
+					deps.log.debug?.("failed to send welcome card", { error: formatUnknownError(err) });
+				}
+			} else if (!isPersonal && msteamsCfg?.groupWelcomeCard === true) {
+				const botName = ctx.activity?.recipient?.name ?? void 0;
+				try {
+					await ctx.sendActivity(buildGroupWelcomeText(botName));
+					deps.log.info("sent group welcome message");
+				} catch (err) {
+					deps.log.debug?.("failed to send group welcome", { error: formatUnknownError(err) });
+				}
+			} else deps.log.debug?.("skipping welcome (disabled by config or conversation type)");
+		} else deps.log.debug?.("member added", { member: member.id });
+		await next();
+	});
+	handler.onReactionsAdded(async (context, next) => {
+		try {
+			await handleReaction(context, "added");
+		} catch (err) {
+			deps.runtime.error(`msteams reaction handler failed: ${String(err)}`);
+		}
+		await next();
+	});
+	handler.onReactionsRemoved(async (context, next) => {
+		try {
+			await handleReaction(context, "removed");
+		} catch (err) {
+			deps.runtime.error(`msteams reaction handler failed: ${String(err)}`);
+		}
+		await next();
+	});
+	return handler;
+}
+//#endregion
+//#region extensions/msteams/src/feedback-invoke.ts
 /**
-* Parse and handle feedback invoke activities (thumbs up/down).
-* Returns true if the activity was a feedback invoke, false otherwise.
+* Run the message-submit (feedback) invoke handler.
+*
+* Teams delivers feedback (`actionName === "feedback"`) on AI-generated
+* messages as a `message/submitAction` invoke. The SDK wraps a void return
+* into the HTTP 200 InvokeResponse, so this function intentionally does
+* not ack itself — the legacy `ctx.sendActivity({ type: "invokeResponse",
+* … })` shape is gone (it became an outbound BF activity on the new SDK
+* instead of the HTTP response).
+*
+* Returns `true` if the invoke matched the feedback shape and was
+* consumed (whether or not it was authorized / written / reflected on),
+* `false` if the invoke didn't look like feedback at all and the caller
+* should fall through to other handlers.
 */
-async function handleFeedbackInvoke(context, deps) {
+async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 	const activity = context.activity;
 	const value = activity.value;
 	if (!value) return false;
@@ -3616,7 +3265,6 @@ async function handleFeedbackInvoke(context, deps) {
 			rejectSymlinkParents: true
 		}).catch(() => {});
 	} catch {}
-	const serviceUrl = tryNormalizeBotFrameworkServiceUrl(activity.serviceUrl);
 	const conversationRef = {
 		activityId: activity.id,
 		user: {
@@ -3638,12 +3286,12 @@ async function handleFeedbackInvoke(context, deps) {
 			tenantId: activity.conversation?.tenantId
 		},
 		channelId: activity.channelId ?? "msteams",
-		...serviceUrl ? { serviceUrl } : {},
+		serviceUrl: activity.serviceUrl,
 		locale: activity.locale
 	};
 	if (isNegative && msteamsCfg?.feedbackReflection !== false) runFeedbackReflection({
 		cfg: deps.cfg,
-		adapter: deps.adapter,
+		app: deps.app,
 		appId: deps.appId,
 		conversationRef,
 		sessionKey: route.sessionKey,
@@ -3657,161 +3305,114 @@ async function handleFeedbackInvoke(context, deps) {
 	});
 	return true;
 }
-function registerMSTeamsHandlers(handler, deps) {
-	const handleTeamsMessage = createMSTeamsMessageHandler(deps);
-	const handleReaction = createMSTeamsReactionHandler(deps);
-	const originalRun = handler.run;
-	if (originalRun) handler.run = async (context) => {
-		const ctx = context;
-		if (ctx.activity?.type === "invoke" && ctx.activity?.name === "fileConsent/invoke") {
-			await respondToMSTeamsFileConsentInvoke(ctx, deps.log);
-			return;
-		}
-		if (ctx.activity?.type === "invoke" && ctx.activity?.name === "message/submitAction") {
-			if (await handleFeedbackInvoke(ctx, deps)) return;
-		}
-		if (ctx.activity?.type === "invoke" && ctx.activity?.name === "adaptiveCard/action") {
-			const text = serializeAdaptiveCardActionValue(ctx.activity?.value);
-			if (text) {
-				await handleTeamsMessage({
-					...ctx,
-					activity: {
-						...ctx.activity,
-						type: "message",
-						text
-					}
-				});
-				return;
-			}
-			deps.log.debug?.("skipping adaptive card action invoke without value payload");
+//#endregion
+//#region extensions/msteams/src/file-consent-invoke.ts
+/**
+* Handle fileConsent/invoke activities for large file uploads.
+*/
+async function handleMSTeamsFileConsentInvoke(context, log) {
+	const expiredUploadMessage = "The file upload request has expired. Please try sending the file again.";
+	const activity = context.activity;
+	if (activity.type !== "invoke" || activity.name !== "fileConsent/invoke") return false;
+	const consentResponse = parseFileConsentInvoke(activity);
+	if (!consentResponse) {
+		log.debug?.("invalid file consent invoke", { value: activity.value });
+		return false;
+	}
+	const uploadId = typeof consentResponse.context?.uploadId === "string" ? consentResponse.context.uploadId : void 0;
+	const inMemoryFile = getPendingUpload(uploadId);
+	const fsFile = inMemoryFile ? void 0 : await getPendingUploadFs(uploadId);
+	const pendingFile = inMemoryFile ?? fsFile;
+	if (pendingFile) {
+		const pendingConversationId = normalizeMSTeamsConversationId(pendingFile.conversationId);
+		const invokeConversationId = normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
+		if (!invokeConversationId || pendingConversationId !== invokeConversationId) {
+			log.info("file consent conversation mismatch", {
+				uploadId,
+				expectedConversationId: pendingConversationId,
+				receivedConversationId: invokeConversationId || void 0
+			});
+			if (consentResponse.action === "accept") await context.sendActivity(expiredUploadMessage);
+			return true;
 		}
-		if (ctx.activity?.type === "invoke" && (ctx.activity?.name === "signin/tokenExchange" || ctx.activity?.name === "signin/verifyState")) {
-			await ctx.sendActivity({
-				type: "invokeResponse",
-				value: {
-					status: 200,
-					body: {}
-				}
+	}
+	if (consentResponse.action === "accept" && consentResponse.uploadInfo) if (pendingFile) {
+		log.debug?.("user accepted file consent, uploading", {
+			uploadId,
+			filename: pendingFile.filename,
+			size: pendingFile.buffer.length
+		});
+		try {
+			await uploadToConsentUrl({
+				url: consentResponse.uploadInfo.uploadUrl,
+				buffer: pendingFile.buffer,
+				contentType: pendingFile.contentType
 			});
-			if (!await isSigninInvokeAuthorized(ctx, deps)) return;
-			if (!deps.sso) {
-				deps.log.debug?.("signin invoke received but msteams.sso is not configured", { name: ctx.activity.name });
-				return;
-			}
-			const user = {
-				userId: ctx.activity.from?.aadObjectId ?? ctx.activity.from?.id ?? "",
-				channelId: ctx.activity.channelId ?? "msteams"
-			};
-			try {
-				if (ctx.activity.name === "signin/tokenExchange") {
-					const parsed = parseSigninTokenExchangeValue(ctx.activity.value);
-					if (!parsed) {
-						deps.log.debug?.("invalid signin/tokenExchange invoke value");
-						return;
-					}
-					const result = await handleSigninTokenExchangeInvoke({
-						value: parsed,
-						user,
-						deps: deps.sso
-					});
-					if (result.ok) deps.log.info("msteams sso token exchanged", {
-						userId: user.userId,
-						hasExpiry: Boolean(result.expiresAt)
-					});
-					else deps.log.error("msteams sso token exchange failed", {
-						code: result.code,
-						status: result.status,
-						message: result.message
-					});
-					return;
-				}
-				const parsed = parseSigninVerifyStateValue(ctx.activity.value);
-				if (!parsed) {
-					deps.log.debug?.("invalid signin/verifyState invoke value");
-					return;
-				}
-				const result = await handleSigninVerifyStateInvoke({
-					value: parsed,
-					user,
-					deps: deps.sso
-				});
-				if (result.ok) deps.log.info("msteams sso verifyState succeeded", {
-					userId: user.userId,
-					hasExpiry: Boolean(result.expiresAt)
+			const fileInfoCard = buildFileInfoCard({
+				filename: consentResponse.uploadInfo.name,
+				contentUrl: consentResponse.uploadInfo.contentUrl,
+				uniqueId: consentResponse.uploadInfo.uniqueId,
+				fileType: consentResponse.uploadInfo.fileType
+			});
+			if (!pendingFile.consentCardActivityId) await context.sendActivity({
+				type: "message",
+				attachments: [fileInfoCard]
+			});
+			if (pendingFile.consentCardActivityId) try {
+				await context.updateActivity({
+					id: pendingFile.consentCardActivityId,
+					type: "message",
+					attachments: [fileInfoCard]
 				});
-				else deps.log.error("msteams sso verifyState failed", {
-					code: result.code,
-					status: result.status,
-					message: result.message
+			} catch {
+				await context.sendActivity({
+					type: "message",
+					attachments: [fileInfoCard]
 				});
-			} catch (err) {
-				deps.log.error("msteams sso invoke handler error", { error: formatUnknownError(err) });
 			}
-			return;
-		}
-		return originalRun.call(handler, context);
-	};
-	handler.onMessage(async (context, next) => {
-		try {
-			await handleTeamsMessage(context);
-		} catch (err) {
-			deps.runtime.error(`msteams handler failed: ${formatUnknownError(err)}`);
-		}
-		await next();
-	});
-	handler.onMembersAdded(async (context, next) => {
-		const ctx = context;
-		const membersAdded = ctx.activity?.membersAdded ?? [];
-		const botId = ctx.activity?.recipient?.id;
-		const msteamsCfg = deps.cfg.channels?.msteams;
-		for (const member of membersAdded) if (member.id === botId) {
-			const isPersonal = (normalizeOptionalLowercaseString(ctx.activity?.conversation?.conversationType) ?? "personal") === "personal";
-			if (isPersonal && msteamsCfg?.welcomeCard !== false) {
-				const card = buildWelcomeCard({
-					botName: ctx.activity?.recipient?.name ?? void 0,
-					promptStarters: msteamsCfg?.promptStarters
-				});
-				try {
-					await ctx.sendActivity({
-						type: "message",
-						attachments: [{
-							contentType: "application/vnd.microsoft.card.adaptive",
-							content: card
-						}]
-					});
-					deps.log.info("sent welcome card");
-				} catch (err) {
-					deps.log.debug?.("failed to send welcome card", { error: formatUnknownError(err) });
-				}
-			} else if (!isPersonal && msteamsCfg?.groupWelcomeCard === true) {
-				const botName = ctx.activity?.recipient?.name ?? void 0;
-				try {
-					await ctx.sendActivity(buildGroupWelcomeText(botName));
-					deps.log.info("sent group welcome message");
-				} catch (err) {
-					deps.log.debug?.("failed to send group welcome", { error: formatUnknownError(err) });
-				}
-			} else deps.log.debug?.("skipping welcome (disabled by config or conversation type)");
-		} else deps.log.debug?.("member added", { member: member.id });
-		await next();
-	});
-	handler.onReactionsAdded(async (context, next) => {
-		try {
-			await handleReaction(context, "added");
-		} catch (err) {
-			deps.runtime.error(`msteams reaction handler failed: ${String(err)}`);
-		}
-		await next();
-	});
-	handler.onReactionsRemoved(async (context, next) => {
-		try {
-			await handleReaction(context, "removed");
+			log.info("file upload complete", {
+				uploadId,
+				filename: consentResponse.uploadInfo.name,
+				uniqueId: consentResponse.uploadInfo.uniqueId
+			});
 		} catch (err) {
-			deps.runtime.error(`msteams reaction handler failed: ${String(err)}`);
+			log.error("file upload failed", {
+				uploadId,
+				error: formatUnknownError(err)
+			});
+			await context.sendActivity("File upload failed. Please try again.");
+		} finally {
+			removePendingUpload(uploadId);
+			await removePendingUploadFs(uploadId);
 		}
-		await next();
-	});
-	return handler;
+	} else {
+		log.debug?.("pending file not found for consent", { uploadId });
+		await context.sendActivity(expiredUploadMessage);
+	}
+	else {
+		log.debug?.("user declined file consent", { uploadId });
+		removePendingUpload(uploadId);
+		await removePendingUploadFs(uploadId);
+	}
+	return true;
+}
+/**
+* Run the file-consent invoke handler after the SDK route has acknowledged the
+* invoke. This intentionally does not send its own invokeResponse; it only does
+* the delayed upload/update work.
+*/
+async function runMSTeamsFileConsentInvokeHandler(context, log) {
+	try {
+		await withRevokedProxyFallback({
+			run: async () => await handleMSTeamsFileConsentInvoke(context, log),
+			onRevoked: async () => true,
+			onRevokedLog: () => {
+				log.debug?.("turn context revoked during file consent invoke; skipping delayed response");
+			}
+		});
+	} catch (err) {
+		log.debug?.("file consent handler error", { error: formatUnknownError(err) });
+	}
 }
 //#endregion
 //#region extensions/msteams/src/sso-token-store.ts
@@ -3920,7 +3521,6 @@ function applyMSTeamsWebhookTimeouts(httpServer, opts) {
 }
 //#endregion
 //#region extensions/msteams/src/monitor.ts
-const MSTEAMS_WEBHOOK_MAX_BODY_BYTES = DEFAULT_WEBHOOK_MAX_BODY_BYTES;
 async function monitorMSTeamsProvider(opts) {
 	const core = getMSTeamsRuntime();
 	const log = core.logging.getChildLogger({ name: "msteams" });
@@ -4071,7 +3671,7 @@ async function monitorMSTeamsProvider(opts) {
 			}
 		}
 	} catch (err) {
-		runtime?.error(`msteams resolve failed; falling back to raw config entries — allowlist members resolved via Graph may be missing. ${formatUnknownError(err)}`);
+		runtime.error?.(`msteams resolve failed; falling back to raw config entries — allowlist members resolved via Graph may be missing. ${formatUnknownError(err)}`);
 	}
 	msteamsCfg = {
 		...msteamsCfg,
@@ -4095,9 +3695,42 @@ async function monitorMSTeamsProvider(opts) {
 	const pollStore = opts.pollStore ?? createMSTeamsPollStoreFs();
 	log.info(`starting provider (port ${port})`);
 	const express = await import("express");
-	const { sdk, app } = await loadMSTeamsSdkWithAuth(creds);
+	const expressApp = express.default();
+	expressApp.use((req, res, next) => {
+		const auth = req.headers.authorization;
+		if (!auth || !auth.startsWith("Bearer ")) {
+			res.status(401).json({ error: "Unauthorized" });
+			return;
+		}
+		next();
+	});
+	expressApp.use(express.json({ limit: DEFAULT_WEBHOOK_MAX_BODY_BYTES }));
+	expressApp.use((err, _req, res, next) => {
+		if (err && typeof err === "object" && "status" in err && err.status === 413) {
+			res.status(413).json({ error: "Payload too large" });
+			return;
+		}
+		next(err);
+	});
+	const configuredPath = msteamsCfg.webhook?.path ?? "/api/messages";
+	const { app } = await loadMSTeamsSdkWithAuth(creds, {
+		...resolveMSTeamsSdkCloudOptions(msteamsCfg),
+		httpServerAdapter: await createMSTeamsExpressAdapter(expressApp),
+		messagingEndpoint: configuredPath,
+		...msteamsCfg.sso?.enabled && msteamsCfg.sso.connectionName ? { oauthDefaultConnectionName: msteamsCfg.sso.connectionName } : {}
+	});
+	if (configuredPath !== "/api/messages") {
+		let warnedLegacyMessagesRoute = false;
+		expressApp.post("/api/messages", (req, res, next) => {
+			if (!warnedLegacyMessagesRoute) {
+				warnedLegacyMessagesRoute = true;
+				log.warn?.(`received request on /api/messages but webhook.path is ${configuredPath}; update your Azure Bot endpoint — this fallback will be removed in a future release`);
+			}
+			req.url = configuredPath;
+			expressApp(req, res, next);
+		});
+	}
 	const tokenProvider = createMSTeamsTokenProvider(app);
-	const adapter = createMSTeamsAdapter(app, sdk);
 	let ssoDeps;
 	if (msteamsCfg.sso?.enabled && msteamsCfg.sso.connectionName) {
 		ssoDeps = {
@@ -4108,11 +3741,11 @@ async function monitorMSTeamsProvider(opts) {
 		log.debug?.("msteams sso enabled", { connectionName: msteamsCfg.sso.connectionName });
 	}
 	const handler = buildActivityHandler();
-	registerMSTeamsHandlers(handler, {
+	const handlerDeps = {
 		cfg,
 		runtime,
 		appId,
-		adapter,
+		app,
 		tokenProvider,
 		textLimit,
 		mediaMaxBytes,
@@ -4120,52 +3753,182 @@ async function monitorMSTeamsProvider(opts) {
 		pollStore,
 		log,
 		sso: ssoDeps
-	});
-	const expressApp = express.default();
-	expressApp.use((req, res, next) => {
-		const auth = req.headers.authorization;
-		if (!auth || !auth.startsWith("Bearer ")) {
-			res.status(401).json({ error: "Unauthorized" });
-			return;
+	};
+	registerMSTeamsHandlers(handler, handlerDeps);
+	app.on("card.action", async (ctx) => {
+		const adaptedCtx = adaptSdkContext(ctx, app);
+		try {
+			const activity = adaptedCtx.activity;
+			const vote = extractMSTeamsPollVote(activity);
+			if (vote) {
+				const voterId = activity?.from?.aadObjectId ?? activity?.from?.id ?? "unknown";
+				try {
+					if (!await isCardActionInvokeAuthorized(adaptedCtx, handlerDeps)) return {
+						statusCode: 200,
+						type: "application/vnd.microsoft.activity.message",
+						value: "Not authorized."
+					};
+					const existingPoll = await pollStore.getPoll(vote.pollId);
+					if (!existingPoll) {
+						log.debug?.("poll vote ignored (poll not found)", { pollId: vote.pollId });
+						return {
+							statusCode: 200,
+							type: "application/vnd.microsoft.activity.message",
+							value: "Poll not found."
+						};
+					}
+					const pollConversationId = existingPoll.conversationId ? normalizeMSTeamsConversationId(existingPoll.conversationId) : void 0;
+					const activityConversationId = normalizeMSTeamsConversationId(activity?.conversation?.id ?? "");
+					if (pollConversationId && pollConversationId !== activityConversationId) {
+						log.info("poll vote ignored (conversation mismatch)", {
+							pollId: vote.pollId,
+							expectedConversationId: pollConversationId,
+							receivedConversationId: activityConversationId || void 0
+						});
+						return {
+							statusCode: 200,
+							type: "application/vnd.microsoft.activity.message",
+							value: "Poll not found."
+						};
+					}
+					if (await pollStore.recordVote({
+						pollId: vote.pollId,
+						voterId,
+						selections: vote.selections
+					})) {
+						log.info("recorded poll vote", {
+							pollId: vote.pollId,
+							voterId
+						});
+						return {
+							statusCode: 200,
+							type: "application/vnd.microsoft.activity.message",
+							value: "Vote recorded."
+						};
+					}
+					log.debug?.("poll vote ignored (poll not found)", { pollId: vote.pollId });
+					return {
+						statusCode: 200,
+						type: "application/vnd.microsoft.activity.message",
+						value: "Poll not found."
+					};
+				} catch (err) {
+					log.error("failed to record poll vote", {
+						pollId: vote.pollId,
+						error: formatUnknownError(err)
+					});
+					return {
+						statusCode: 500,
+						type: "application/vnd.microsoft.error",
+						value: {
+							code: "RECORD_VOTE_FAILED",
+							message: "Could not record vote.",
+							innerHttpError: {
+								statusCode: 500,
+								body: null
+							}
+						}
+					};
+				}
+			}
+			handler.run(adaptedCtx).catch((err) => {
+				log.error("msteams card.action dispatch failed", { error: formatUnknownError(err) });
+			});
+			return {
+				statusCode: 200,
+				type: "application/vnd.microsoft.activity.message",
+				value: "OK"
+			};
+		} catch (err) {
+			log.error("msteams card.action failed", { error: formatUnknownError(err) });
+			return {
+				statusCode: 500,
+				type: "application/vnd.microsoft.error",
+				value: {
+					code: "CARD_ACTION_FAILED",
+					message: "Card action failed.",
+					innerHttpError: {
+						statusCode: 500,
+						body: null
+					}
+				}
+			};
 		}
-		next();
 	});
-	const jwtValidator = await createBotFrameworkJwtValidator(creds);
-	expressApp.use((req, res, next) => {
-		const authHeader = req.headers.authorization;
-		jwtValidator.validate(authHeader).then((valid) => {
-			if (!valid) {
-				log.debug?.("JWT validation failed");
-				res.status(401).json({ error: "Unauthorized" });
+	app.on("file.consent.accept", (ctx) => {
+		runMSTeamsFileConsentInvokeHandler(adaptSdkContext(ctx, app), log);
+	});
+	app.on("file.consent.decline", (ctx) => {
+		runMSTeamsFileConsentInvokeHandler(adaptSdkContext(ctx, app), log);
+	});
+	const handleSdkSigninInvoke = async (ctx, delegateName) => {
+		const adaptedCtx = adaptSdkContext(ctx, app);
+		if (!await isSigninInvokeAuthorized(adaptedCtx, handlerDeps)) return {
+			status: 200,
+			body: {}
+		};
+		if (!ssoDeps) {
+			log.debug?.("signin invoke received but msteams.sso is not configured", { name: adaptedCtx.activity?.name });
+			return {
+				status: 200,
+				body: {}
+			};
+		}
+		const sdkSigninApp = app;
+		const delegate = sdkSigninApp[delegateName];
+		if (typeof delegate !== "function") throw new Error(`Teams SDK ${delegateName} handler is unavailable`);
+		return delegate.call(sdkSigninApp, ctx);
+	};
+	app.on("signin.token-exchange", (ctx) => handleSdkSigninInvoke(ctx, "onTokenExchange"));
+	app.on("signin.verify-state", (ctx) => handleSdkSigninInvoke(ctx, "onVerifyState"));
+	if (ssoDeps) app.event("signin", (ctx) => {
+		(async () => {
+			if (!await isSigninInvokeAuthorized(adaptSdkContext(ctx, app), handlerDeps)) return;
+			const activity = ctx.activity;
+			const userIds = Array.from(new Set([activity.from?.id, activity.from?.aadObjectId].filter((id) => Boolean(id))));
+			const connectionName = ctx.token.connectionName || ssoDeps.connectionName;
+			if (!connectionName || !ctx.token.token || userIds.length === 0) {
+				log.warn?.("msteams sso signin event missing token metadata", {
+					hasConnectionName: Boolean(connectionName),
+					hasToken: Boolean(ctx.token.token),
+					hasUser: userIds.length > 0
+				});
 				return;
 			}
-			next();
-		}).catch((err) => {
-			if (err instanceof Error && /ECONNREFUSED|ENOTFOUND|EHOSTUNREACH|ETIMEDOUT|ECONNRESET/i.test(err.code ?? err.message)) runtime?.error(`msteams: JWKS key fetch failed — check egress to login.botframework.com:443 (firewall or DNS may be blocking it). Bot will 401 all inbound requests until this is resolved. Error: ${formatUnknownError(err)}`);
-			else log.debug?.(`JWT validation error: ${formatUnknownError(err)}`);
-			res.status(401).json({ error: "Unauthorized" });
+			await Promise.all(userIds.map((userId) => ssoDeps.tokenStore.save({
+				connectionName,
+				userId,
+				token: ctx.token.token,
+				expiresAt: ctx.token.expiration,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			})));
+			log.info("msteams sso token persisted", {
+				connectionName,
+				userIdCount: userIds.length,
+				hasExpiry: Boolean(ctx.token.expiration)
+			});
+		})().catch((err) => {
+			log.error("msteams sso token persistence failed", { error: formatUnknownError(err) });
 		});
 	});
-	expressApp.use(express.json({ limit: MSTEAMS_WEBHOOK_MAX_BODY_BYTES }));
-	expressApp.use((err, _req, res, next) => {
-		if (err && typeof err === "object" && "status" in err && err.status === 413) {
-			res.status(413).json({ error: "Payload too large" });
-			return;
-		}
-		next(err);
+	app.on("message.submit", async (ctx) => {
+		if (!await runMSTeamsFeedbackInvokeHandler(adaptSdkContext(ctx, app), handlerDeps)) await ctx.next?.call(ctx);
 	});
-	const configuredPath = msteamsCfg.webhook?.path ?? "/api/messages";
-	const messageHandler = (req, res) => {
-		adapter.process(req, res, (context) => handler.run(context)).catch((err) => {
+	app.on("activity", async (ctx) => {
+		try {
+			const adaptedCtx = adaptSdkContext(ctx, app);
+			const activity = adaptedCtx.activity;
+			if (activity?.type === "invoke") {
+				if (activity?.name === "adaptiveCard/action") return;
+				if (activity?.name === "fileConsent/invoke") return;
+				if (activity?.name === "signin/tokenExchange" || activity?.name === "signin/verifyState") return;
+			}
+			await handler.run(adaptedCtx);
+		} catch (err) {
 			log.error("msteams webhook failed", { error: formatUnknownError(err) });
-		});
-	};
-	expressApp.post(configuredPath, messageHandler);
-	if (configuredPath !== "/api/messages") expressApp.post("/api/messages", messageHandler);
-	log.debug?.("listening on paths", {
-		primary: configuredPath,
-		fallback: "/api/messages"
+		}
 	});
+	await app.initialize();
 	const httpServer = expressApp.listen(port);
 	await new Promise((resolve, reject) => {
 		const onListening = () => {
@@ -4245,5 +4008,34 @@ function buildActivityHandler() {
 	};
 	return handler;
 }
+/**
+* Adapt a new @microsoft/teams.apps SDK context to the MSTeamsTurnContext interface
+* our handlers expect. The new SDK uses reply()/send() instead of sendActivity().
+*/
+function adaptSdkContext(ctx, app) {
+	const sdkCtx = ctx ?? {};
+	if (typeof sdkCtx.reply !== "function" && typeof sdkCtx.send !== "function") return ctx;
+	const conversationId = sdkCtx.activity?.conversation?.id ?? "";
+	const activityApi = sdkCtx.api ?? app.api;
+	const conversationType = (sdkCtx.activity?.conversation?.conversationType ?? "").toLowerCase();
+	const isThreadable = conversationType === "channel" || conversationType === "groupchat";
+	const sendActivity = (activity) => isThreadable ? sdkCtx.reply(activity) : sdkCtx.send(activity);
+	return Object.assign(Object.create(Object.getPrototypeOf(ctx)), ctx, {
+		sendActivity,
+		sendActivities: async (activities) => {
+			const results = [];
+			for (const a of activities) results.push(await sendActivity(a));
+			return results;
+		},
+		updateActivity: async (activity) => {
+			const activityId = activity.id ?? "";
+			return activityApi.conversations.activities(conversationId).update(activityId, activity);
+		},
+		deleteActivity: async (activityId) => {
+			return activityApi.conversations.activities(conversationId).delete(activityId);
+		},
+		stream: sdkCtx.stream
+	});
+}
 //#endregion
 export { monitorMSTeamsProvider };