@openclaw/msteams 2026.7.1-beta.1 → 2026.7.1-beta.4

package/node_modules/@azure/msal-common/src/response/ResponseHandler.ts

@@ -8,11 +8,7 @@ import {
     buildTenantProfile,
     updateAccountTenantProfileData,
 } from "../account/AccountInfo.js";
-import {
-    checkMaxAge,
-    extractTokenClaims,
-    isKmsi,
-} from "../account/AuthToken.js";
+import { extractTokenClaims, isKmsi } from "../account/AuthToken.js";
 import {
     TokenClaims,
     getTenantIdFromIdTokenClaims,
@@ -117,7 +113,8 @@ export class ResponseHandler {
                 ? serverResponse.error_codes[0]
                 : undefined;
             const serverError = new ServerError(
-                serverResponse.error,
+                serverResponse.error || "",
+                serverResponse.correlation_id || "",
                 errString,
                 serverResponse.suberror,
                 serverErrorNo,
@@ -164,12 +161,12 @@ export class ResponseHandler {
                 )
             ) {
                 throw new InteractionRequiredAuthError(
-                    serverResponse.error,
+                    serverResponse.error || "",
+                    serverResponse.correlation_id || "",
                     serverResponse.error_description,
                     serverResponse.suberror,
                     serverResponse.timestamp || "",
                     serverResponse.trace_id || "",
-                    serverResponse.correlation_id || "",
                     serverResponse.claims || "",
                     serverErrorNo
                 );
@@ -194,35 +191,26 @@ export class ResponseHandler {
         userAssertionHash?: string,
         handlingRefreshTokenResponse?: boolean,
         forceCacheRefreshTokenResponse?: boolean,
-        serverRequestId?: string
+        serverRequestId?: string,
+        additionalCacheKeyComponents?: Record<string, string>
     ): Promise<AuthenticationResult> {
         // create an idToken object (not entity)
         let idTokenClaims: TokenClaims | undefined;
         if (serverTokenResponse.id_token) {
             idTokenClaims = extractTokenClaims(
                 serverTokenResponse.id_token || "",
-                this.cryptoObj.base64Decode
+                this.cryptoObj.base64Decode,
+                request.correlationId
             );
 
             // token nonce check (TODO: Add a warning if no nonce is given?)
             if (authCodePayload && authCodePayload.nonce) {
                 if (idTokenClaims.nonce !== authCodePayload.nonce) {
                     throw createClientAuthError(
-                        ClientAuthErrorCodes.nonceMismatch
-                    );
-                }
-            }
-
-            // token max_age check
-            if (request.maxAge || request.maxAge === 0) {
-                const authTime = idTokenClaims.auth_time;
-                if (!authTime) {
-                    throw createClientAuthError(
-                        ClientAuthErrorCodes.authTimeNotFound
+                        ClientAuthErrorCodes.nonceMismatch,
+                        request.correlationId
                     );
                 }
-
-                checkMaxAge(authTime, request.maxAge);
             }
         }
 
@@ -241,7 +229,8 @@ export class ResponseHandler {
         if (!!authCodePayload && !!authCodePayload.state) {
             requestStateObj = ProtocolUtils.parseRequestState(
                 this.cryptoObj.base64Decode,
-                authCodePayload.state
+                authCodePayload.state,
+                request.correlationId
             );
         }
 
@@ -256,7 +245,8 @@ export class ResponseHandler {
             request,
             idTokenClaims,
             userAssertionHash,
-            authCodePayload
+            authCodePayload,
+            additionalCacheKeyComponents
         );
         let cacheContext;
         try {
@@ -363,12 +353,14 @@ export class ResponseHandler {
         request: BaseAuthRequest,
         idTokenClaims?: TokenClaims,
         userAssertionHash?: string,
-        authCodePayload?: AuthorizationCodePayload
+        authCodePayload?: AuthorizationCodePayload,
+        additionalCacheKeyComponents?: Record<string, string>
     ): CacheRecord {
         const env = authority.getPreferredCache();
         if (!env) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.invalidCacheEnvironment
+                ClientAuthErrorCodes.invalidCacheEnvironment,
+                request.correlationId
             );
         }
 
@@ -408,8 +400,11 @@ export class ResponseHandler {
         if (serverTokenResponse.access_token) {
             // If scopes not returned in server response, use request scopes
             const responseScopes = serverTokenResponse.scope
-                ? ScopeSet.fromString(serverTokenResponse.scope)
-                : new ScopeSet(request.scopes || []);
+                ? ScopeSet.fromString(
+                      serverTokenResponse.scope,
+                      request.correlationId
+                  )
+                : new ScopeSet(request.scopes || [], request.correlationId);
 
             /*
              * Use timestamp calculated before request
@@ -446,10 +441,12 @@ export class ResponseHandler {
                 tokenExpirationSeconds,
                 extendedTokenExpirationSeconds,
                 this.cryptoObj.base64Decode,
+                request.correlationId,
                 refreshOnSeconds,
                 serverTokenResponse.token_type,
                 userAssertionHash,
-                serverTokenResponse.key_id
+                serverTokenResponse.key_id,
+                additionalCacheKeyComponents
             );
             // Set resource (to be used for MCP scenarios)
             const resource = request.resource || null;
@@ -553,7 +550,8 @@ export class ResponseHandler {
 
                 if (!keyId) {
                     throw createClientAuthError(
-                        ClientAuthErrorCodes.keyIdMissing
+                        ClientAuthErrorCodes.keyIdMissing,
+                        request.correlationId
                     );
                 }
 
@@ -566,7 +564,8 @@ export class ResponseHandler {
                 accessToken = cacheRecord.accessToken.secret;
             }
             responseScopes = ScopeSet.fromString(
-                cacheRecord.accessToken.target
+                cacheRecord.accessToken.target,
+                request.correlationId
             ).asArray();
             // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
             expiresOn = TimeUtils.toDateFromSeconds(
@@ -593,8 +592,20 @@ export class ResponseHandler {
 
         // for hybrid + native bridge enablement, send back the native account Id
         if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
+            // Set on deprecated top-level for downgrade compat
             cacheRecord.account.nativeAccountId =
                 serverTokenResponse?.spa_accountid;
+            // Set on the matching tenant profile (source of truth)
+            const targetTenantId = tid || cacheRecord.account.realm;
+            if (cacheRecord.account.tenantProfiles) {
+                const matchingProfile = cacheRecord.account.tenantProfiles.find(
+                    (tp) => tp.tenantId === targetTenantId
+                );
+                if (matchingProfile) {
+                    matchingProfile.nativeAccountId =
+                        serverTokenResponse.spa_accountid;
+                }
+            }
         }
 
         const accountInfo: AccountInfo | null = cacheRecord.account
@@ -632,6 +643,7 @@ export class ResponseHandler {
     }
 }
 
+/** @internal */
 export function buildAccountToCache(
     cacheStorage: CacheManager,
     authority: Authority,
@@ -691,6 +703,7 @@ export function buildAccountToCache(
                 nativeAccountId: nativeAccountId,
             },
             authority,
+            correlationId,
             base64Decode
         );
 
@@ -706,6 +719,7 @@ export function buildAccountToCache(
             homeAccountId,
             baseAccount.localAccountId,
             tenantId,
+            nativeAccountId,
             idTokenClaims
         );
         tenantProfiles.push(newTenantProfile);

package/node_modules/@azure/msal-common/src/telemetry/performance/IPerformanceClient.ts

@@ -31,6 +31,7 @@ export interface IPerformanceClient {
         fields: { [key: string]: {} | undefined },
         correlationId: string
     ): void;
+    addGlobalFields(fields: { [key: string]: {} | undefined }): void;
     incrementFields(
         fields: { [key: string]: number | undefined },
         correlationId: string

package/node_modules/@azure/msal-common/src/telemetry/performance/PerformanceClient.ts

@@ -279,6 +279,14 @@ export abstract class PerformanceClient implements IPerformanceClient {
     protected logger: Logger;
     protected callbacks: Map<string, PerformanceCallbackFunction>;
 
+    /**
+     * Fields stamped onto every event emitted by this client (e.g. previousLibraryVersion).
+     * Unlike addFields, these are not scoped to a single correlationId and persist for the
+     * lifetime of the client. Set imperatively after construction via addGlobalFields.
+     * @protected
+     */
+    protected globalFields: { [key: string]: {} | undefined };
+
     /**
      * Multiple events with the same correlation id.
      * @protected
@@ -320,6 +328,7 @@ export abstract class PerformanceClient implements IPerformanceClient {
         this.authority = authority;
         this.libraryName = libraryName;
         this.libraryVersion = libraryVersion;
+        this.globalFields = {};
         this.applicationTelemetry = applicationTelemetry;
         this.clientId = clientId;
         this.logger = logger;
@@ -507,6 +516,12 @@ export abstract class PerformanceClient implements IPerformanceClient {
             incompleteSubsCount,
             context,
             logs: formattedLogs,
+            /*
+             * Global fields are spread last so they are always present on the
+             * emitted event and never overridden, even when registered after
+             * the measurement started.
+             */
+            ...this.globalFields,
         };
         if (account) {
             finalEvent.accountType = getAccountType(account);
@@ -568,6 +583,19 @@ export abstract class PerformanceClient implements IPerformanceClient {
         }
     }
 
+    /**
+     * Saves fields to be emitted on every event measured by this client.
+     * Unlike addFields, these are not scoped to a single correlationId and persist for the
+     * lifetime of the client (e.g. previousLibraryVersion for upgrade/downgrade telemetry).
+     * @param fields
+     */
+    addGlobalFields(fields: { [key: string]: {} | undefined }): void {
+        this.globalFields = {
+            ...this.globalFields,
+            ...fields,
+        };
+    }
+
     /**
      * Increment counters to be emitted when the measurements are flushed
      * @param fields {string[]}

package/node_modules/@azure/msal-common/src/telemetry/performance/PerformanceEvent.ts

@@ -474,11 +474,22 @@ export type PerformanceEvent = {
     migratedRTCount?: number;
 
     /**
-     * Cache telemetry — expired, invalid, and removed counts
-     */
-    expiredCacheRemovedCount?: number;
-    expiredAcntRemovedCount?: number;
-    invalidCacheCount?: number;
+     * Per-type migration outcome counters
+     */
+    ttlExpiredAcntCount?: number;
+    ttlExpiredITCount?: number;
+    ttlExpiredATCount?: number;
+    ttlExpiredRTCount?: number;
+    decryptFailedAcntCount?: number;
+    decryptFailedITCount?: number;
+    decryptFailedATCount?: number;
+    decryptFailedRTCount?: number;
+    invalidAcntCount?: number;
+    invalidITCount?: number;
+    invalidATCount?: number;
+    invalidRTCount?: number;
+    expiredATCount?: number;
+    expiredRTCount?: number;
 
     /**
      * Encrypted cache telemetry
@@ -542,7 +553,20 @@ export const IntFields: ReadonlySet<string> = new Set([
     "currAccessCount",
     "currIdCount",
     "currRefreshCount",
-    "expiredCacheRemovedCount",
+    "ttlExpiredAcntCount",
+    "ttlExpiredITCount",
+    "ttlExpiredATCount",
+    "ttlExpiredRTCount",
+    "decryptFailedAcntCount",
+    "decryptFailedITCount",
+    "decryptFailedATCount",
+    "decryptFailedRTCount",
+    "invalidAcntCount",
+    "invalidITCount",
+    "invalidATCount",
+    "invalidRTCount",
+    "expiredATCount",
+    "expiredRTCount",
     "upgradedCacheCount",
     "cacheMatchedAccounts",
     "networkRtt",

package/node_modules/@azure/msal-common/src/telemetry/performance/StubPerformanceClient.ts

@@ -77,6 +77,10 @@ export class StubPerformanceClient implements IPerformanceClient {
         return;
     }
 
+    addGlobalFields(): void {
+        return;
+    }
+
     incrementFields(): void {
         return;
     }

package/node_modules/@azure/msal-common/src/telemetry/server/ServerTelemetryManager.ts

@@ -167,40 +167,44 @@ export class ServerTelemetryManager {
      * @param error
      */
     cacheFailedRequest(error: unknown): void {
-        const lastRequests = this.getLastRequests();
-        if (
-            lastRequests.errors.length >=
-            Constants.SERVER_TELEM_MAX_CACHED_ERRORS
-        ) {
-            // Remove a cached error to make room, first in first out
-            lastRequests.failedRequests.shift(); // apiId
-            lastRequests.failedRequests.shift(); // correlationId
-            lastRequests.errors.shift();
-        }
-
-        lastRequests.failedRequests.push(this.apiId, this.correlationId);
+        try {
+            const lastRequests = this.getLastRequests();
+            if (
+                lastRequests.errors.length >=
+                Constants.SERVER_TELEM_MAX_CACHED_ERRORS
+            ) {
+                // Remove a cached error to make room, first in first out
+                lastRequests.failedRequests.shift(); // apiId
+                lastRequests.failedRequests.shift(); // correlationId
+                lastRequests.errors.shift();
+            }
 
-        if (error instanceof Error && !!error && error.toString()) {
-            if (error instanceof AuthError) {
-                if (error.subError) {
-                    lastRequests.errors.push(error.subError);
-                } else if (error.errorCode) {
-                    lastRequests.errors.push(error.errorCode);
+            lastRequests.failedRequests.push(this.apiId, this.correlationId);
+
+            if (error instanceof Error && !!error && error.toString()) {
+                if (error instanceof AuthError) {
+                    if (error.subError) {
+                        lastRequests.errors.push(error.subError);
+                    } else if (error.errorCode) {
+                        lastRequests.errors.push(error.errorCode);
+                    } else {
+                        lastRequests.errors.push(error.toString());
+                    }
                 } else {
                     lastRequests.errors.push(error.toString());
                 }
             } else {
-                lastRequests.errors.push(error.toString());
+                lastRequests.errors.push(Constants.SERVER_TELEM_UNKNOWN_ERROR);
             }
-        } else {
-            lastRequests.errors.push(Constants.SERVER_TELEM_UNKNOWN_ERROR);
-        }
 
-        this.cacheManager.setServerTelemetry(
-            this.telemetryCacheKey,
-            lastRequests,
-            this.correlationId
-        );
+            this.cacheManager.setServerTelemetry(
+                this.telemetryCacheKey,
+                lastRequests,
+                this.correlationId
+            );
+        } catch {
+            // Ignore telemetry cache failures to avoid masking the original auth error path.
+        }
 
         return;
     }
@@ -369,3 +373,45 @@ export class ServerTelemetryManager {
         return makeExtraSkuString(params);
     }
 }
+
+/** @internal */
+export class StubServerTelemetryManager extends ServerTelemetryManager {
+    constructor() {
+        super(
+            { clientId: "", apiId: 0, correlationId: "", forceRefresh: false },
+            {} as unknown as CacheManager
+        );
+    }
+
+    generateCurrentRequestHeaderValue(): string {
+        return "";
+    }
+
+    generateLastRequestHeaderValue(): string {
+        return "";
+    }
+
+    cacheFailedRequest(): void {}
+
+    incrementCacheHits(): number {
+        return 0;
+    }
+
+    clearTelemetryCache(): void {}
+
+    getRegionDiscoveryFields(): string {
+        return "";
+    }
+
+    updateRegionDiscoveryMetadata(): void {}
+
+    setCacheOutcome(): void {}
+
+    setNativeBrokerErrorCode(): void {}
+
+    getNativeBrokerErrorCode(): string | undefined {
+        return undefined;
+    }
+
+    clearNativeBrokerErrorCode(): void {}
+}

package/node_modules/@azure/msal-common/src/url/UrlString.ts

@@ -17,16 +17,19 @@ import * as Constants from "../utils/Constants.js";
 export class UrlString {
     // internal url string field
     private _urlString: string;
+    private correlationId: string;
     public get urlString(): string {
         return this._urlString;
     }
 
-    constructor(url: string) {
+    constructor(url: string, correlationId: string) {
         this._urlString = url;
+        this.correlationId = correlationId;
         if (!this._urlString) {
             // Throws error if url is empty
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.urlEmptyError
+                ClientConfigurationErrorCodes.urlEmptyError,
+                correlationId
             );
         }
 
@@ -69,14 +72,16 @@ export class UrlString {
             components = this.getUrlComponents();
         } catch (e) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.urlParseError
+                ClientConfigurationErrorCodes.urlParseError,
+                this.correlationId
             );
         }
 
         // Throw error if URI or path segments are not parseable.
         if (!components.HostNameAndPort || !components.PathSegments) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.urlParseError
+                ClientConfigurationErrorCodes.urlParseError,
+                this.correlationId
             );
         }
 
@@ -86,7 +91,8 @@ export class UrlString {
             components.Protocol.toLowerCase() !== "https:"
         ) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.authorityUriInsecure
+                ClientConfigurationErrorCodes.authorityUriInsecure,
+                this.correlationId
             );
         }
     }
@@ -130,7 +136,10 @@ export class UrlString {
         ) {
             pathArray[0] = tenantId;
         }
-        return UrlString.constructAuthorityUriFromObject(urlObject);
+        return UrlString.constructAuthorityUriFromObject(
+            urlObject,
+            this.correlationId
+        );
     }
 
     /**
@@ -147,7 +156,8 @@ export class UrlString {
         const match = this.urlString.match(regEx);
         if (!match) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.urlParseError
+                ClientConfigurationErrorCodes.urlParseError,
+                this.correlationId
             );
         }
 
@@ -175,23 +185,28 @@ export class UrlString {
         return urlComponents;
     }
 
-    static getDomainFromUrl(url: string): string {
+    static getDomainFromUrl(url: string, correlationId: string): string {
         const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
 
         const match = url.match(regEx);
 
         if (!match) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.urlParseError
+                ClientConfigurationErrorCodes.urlParseError,
+                correlationId
             );
         }
 
         return match[2];
     }
 
-    static getAbsoluteUrl(relativeUrl: string, baseUrl: string): string {
+    static getAbsoluteUrl(
+        relativeUrl: string,
+        baseUrl: string,
+        correlationId: string
+    ): string {
         if (relativeUrl[0] === Constants.FORWARD_SLASH) {
-            const url = new UrlString(baseUrl);
+            const url = new UrlString(baseUrl, correlationId);
             const baseComponents = url.getUrlComponents();
 
             return (
@@ -205,13 +220,17 @@ export class UrlString {
         return relativeUrl;
     }
 
-    static constructAuthorityUriFromObject(urlObject: IUri): UrlString {
+    static constructAuthorityUriFromObject(
+        urlObject: IUri,
+        correlationId: string
+    ): UrlString {
         return new UrlString(
             urlObject.Protocol +
                 "//" +
                 urlObject.HostNameAndPort +
                 "/" +
-                urlObject.PathSegments.join("/")
+                urlObject.PathSegments.join("/"),
+            correlationId
         );
     }
 }

package/node_modules/@azure/msal-common/src/utils/ClientAssertionUtils.ts

@@ -11,7 +11,8 @@ import {
 export async function getClientAssertion(
     clientAssertion: string | ClientAssertionCallback,
     clientId: string,
-    tokenEndpoint?: string
+    tokenEndpoint?: string,
+    fmiPath?: string
 ): Promise<string> {
     if (typeof clientAssertion === "string") {
         return clientAssertion;
@@ -19,6 +20,7 @@ export async function getClientAssertion(
         const config: ClientAssertionConfig = {
             clientId: clientId,
             tokenEndpoint: tokenEndpoint,
+            fmiPath: fmiPath,
         };
         return clientAssertion(config);
     }

package/node_modules/@azure/msal-common/src/utils/Constants.ts

@@ -33,9 +33,8 @@ export const AUTHORIZATION_PENDING = "authorization_pending";
 export const NOT_APPLICABLE = "N/A";
 export const NOT_AVAILABLE = "Not Available";
 export const FORWARD_SLASH = "/";
-export const IMDS_ENDPOINT =
-    "http://169.254.169.254/metadata/instance/compute/location";
-export const IMDS_VERSION = "2020-06-01";
+export const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute";
+export const IMDS_VERSION = "2021-02-01";
 export const IMDS_TIMEOUT = 2000;
 export const AZURE_REGION_AUTO_DISCOVER_FLAG = "TryAutoDetect";
 export const REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX = "login.microsoft.com";
@@ -122,6 +121,9 @@ export type AADAuthority = (typeof AADAuthority)[keyof typeof AADAuthority];
 export const ClaimsRequestKeys = {
     ACCESS_TOKEN: "access_token",
     XMS_CC: "xms_cc",
+    ID_TOKEN: "id_token",
+    SIGNIN_STATE: "signin_state",
+    LOGIN_HINT: "login_hint",
 } as const;
 export type ClaimsRequestKeys =
     (typeof ClaimsRequestKeys)[keyof typeof ClaimsRequestKeys];
@@ -180,6 +182,7 @@ export const GrantType = {
     REFRESH_TOKEN_GRANT: "refresh_token",
     DEVICE_CODE_GRANT: "device_code",
     JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    USER_FIC: "user_fic",
 } as const;
 export type GrantType = (typeof GrantType)[keyof typeof GrantType];