@openclaw/msteams 2026.7.1 → 2026.7.2-beta.1

package/dist/{src-DZFs5XtZ.js → src-CUMz2B6f.cjs}

@@ -1,35 +1,45 @@
-import { n as getOptionalMSTeamsRuntime, t as getMSTeamsRuntime } from "./runtime-BS5AZrKK.js";
-import { DEFAULT_ACCOUNT_ID, DEFAULT_WEBHOOK_MAX_BODY_BYTES, buildMediaPayload, createChannelMessageReplyPipeline, createChannelPairingController, dispatchReplyFromConfigWithSettledDispatcher as dispatchReplyFromConfigWithSettledDispatcher$1, isDangerousNameMatchingEnabled, keepHttpServerTaskAlive, logTypingFailure, mergeAllowlist, resolveChannelMediaMaxBytes, resolveDefaultGroupPolicy, summarizeMapping } from "./runtime-api.js";
-import { $ as isDownloadableAttachment, C as resolveMSTeamsCredentials, F as loadMSTeamsSdkWithAuth, G as ATTACHMENT_TAG_RE, J as applyAuthorizationHeaderForUrl, K as GRAPH_ROOT, L as ensureUserAgentHeader, N as createMSTeamsExpressAdapter, P as createMSTeamsTokenProvider, Q as inferPlaceholder, U as resolveMSTeamsSdkCloudOptions, V as tryNormalizeBotFrameworkServiceUrl, X as extractHtmlFromAttachment, Y as encodeGraphShareId, Z as extractInlineImageCandidates, at as resolveAttachmentFetchPolicy, c as resolveMSTeamsUserAllowlist, ct as safeFetchWithPolicy, et as isLikelyImageAttachment, it as readNestedString, lt as safeHostForUrl, nt as isUrlAllowed, ot as resolveMediaSsrfPolicy, p as fetchGraphJson, q as IMG_SRC_RE, rt as normalizeContentType, s as resolveMSTeamsChannelAllowlist, st as resolveRequestUrl, tt as isRecord$1, ut as tryBuildGraphSharesUrlForSharedLink } from "./resolve-allowlist-Dnw4aNOu.js";
-import { a as normalizeMSTeamsConversationId, c as translateMSTeamsDmConversationIdForGraph, f as resolveMSTeamsAllowlistMatch, i as extractMSTeamsQuoteInfo, l as wasMSTeamsBotMentioned, m as resolveMSTeamsRouteConfig, n as resolveMSTeamsRouteSessionKey, o as parseMSTeamsActivityTimestamp, p as resolveMSTeamsReplyPolicy, r as extractMSTeamsConversationMessageId, s as stripMSTeamsMentionTags } from "./channel-Cf5LJ4aO.js";
-import { a as formatUnknownError, i as formatMSTeamsSendErrorHint, r as classifyMSTeamsSendError } from "./setup-surface-qW-ECHL-.js";
-import { l as createMSTeamsPollStoreState, u as extractMSTeamsPollVote, v as createMSTeamsConversationStoreState } from "./polls-B_hs4aKm.js";
-import { i as createMSTeamsSsoTokenStoreFs } from "./sso-token-store-DrVbnCUF.js";
-import { _ as buildFileInfoCard, c as renderReplyPayloadsToMessages, d as withRevokedProxyFallback, f as resolveGraphChatId, g as removePendingUploadFs, h as getPendingUploadFs, l as sendMSTeamsMessages, m as removePendingUpload, p as getPendingUpload, s as buildConversationReference, u as sendMSTeamsActivityWithReference, v as parseFileConsentInvoke, y as uploadToConsentUrl } from "./probe-BnyZRZsD.js";
-import { formatAllowlistMatchMeta } from "openclaw/plugin-sdk/allow-from";
-import { buildChannelProgressDraftLine, buildChannelProgressDraftLineForEntry, createChannelProgressDraftGate, formatChannelProgressDraftText, isChannelProgressDraftWorkToolName, mergeChannelProgressDraftLine, normalizeChannelProgressDraftLineIdentity, resolveChannelPreviewStreamMode, resolveChannelProgressDraftMaxLines, resolveChannelStreamingBlockEnabled, resolveChannelStreamingPreviewToolProgress, resolveChannelStreamingSuppressDefaultToolProgressMessages } from "openclaw/plugin-sdk/channel-outbound";
-import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { parseMediaContentLength, saveResponseMedia } from "openclaw/plugin-sdk/media-runtime";
-import { buildChannelInboundEventContext, dispatchReplyFromConfigWithSettledDispatcher, formatInboundMediaUnavailableText, hasFinalInboundReplyDispatch, logInboundDrop, resolveInboundMentionDecision, resolveInboundReplyDispatchCounts, resolveInboundSessionEnvelopeContext } from "openclaw/plugin-sdk/channel-inbound";
-import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
-import { readProviderJsonArrayFieldResponse, readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
-import path from "node:path";
-import { asDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
-import { appendRegularFile } from "openclaw/plugin-sdk/security-runtime";
-import { resolveThreadSessionKeys } from "openclaw/plugin-sdk/routing";
-import crypto from "node:crypto";
-import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { channelIngressRoutes, resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
-import { filterSupplementalContextItems, resolveChannelContextVisibilityMode } from "openclaw/plugin-sdk/context-visibility-runtime";
-import { DEFAULT_GROUP_HISTORY_LIMIT, createChannelHistoryWindow } from "openclaw/plugin-sdk/reply-history";
-import { createPersistentDedupeCache } from "openclaw/plugin-sdk/dedupe-runtime";
+const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
+const require_runtime = require("./runtime-gZTAuFux.cjs");
+require("./runtime-api.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CyQ57MfH.cjs");
+const require_channel = require("./channel-BSyPdpGN.cjs");
+const require_setup_surface = require("./setup-surface-BDTPN3dX.cjs");
+const require_polls = require("./polls-BhoI4VaN.cjs");
+const require_sso_token_store = require("./sso-token-store-CktCz88k.cjs");
+const require_messenger = require("./messenger-DtS9gqkV.cjs");
+let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
+let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
+let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
+let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runtime");
+let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
+let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
+let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
+let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
+let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let openclaw_plugin_sdk_security_runtime = require("openclaw/plugin-sdk/security-runtime");
+let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
+let node_crypto = require("node:crypto");
+node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+let openclaw_plugin_sdk_channel_ingress_runtime = require("openclaw/plugin-sdk/channel-ingress-runtime");
+let openclaw_plugin_sdk_context_visibility_runtime = require("openclaw/plugin-sdk/context-visibility-runtime");
+let openclaw_plugin_sdk_reply_history = require("openclaw/plugin-sdk/reply-history");
+let openclaw_plugin_sdk_dedupe_runtime = require("openclaw/plugin-sdk/dedupe-runtime");
+let openclaw_plugin_sdk_collection_runtime = require("openclaw/plugin-sdk/collection-runtime");
+let openclaw_plugin_sdk_channel_pairing = require("openclaw/plugin-sdk/channel-pairing");
+let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
+let openclaw_plugin_sdk_runtime_group_policy = require("openclaw/plugin-sdk/runtime-group-policy");
+let openclaw_plugin_sdk_dangerous_name_runtime = require("openclaw/plugin-sdk/dangerous-name-runtime");
+let openclaw_plugin_sdk_reply_payload = require("openclaw/plugin-sdk/reply-payload");
+let openclaw_plugin_sdk_webhook_ingress = require("openclaw/plugin-sdk/webhook-ingress");
 //#region extensions/msteams/src/feedback-reflection-prompt.ts
 /** Max chars of the thumbed-down response to include in the reflection prompt. */
 const MAX_RESPONSE_CHARS = 500;
 function buildReflectionPrompt(params) {
 	const parts = ["A user indicated your previous response wasn't helpful."];
 	if (params.thumbedDownResponse) {
-		const truncated = params.thumbedDownResponse.length > MAX_RESPONSE_CHARS ? `${truncateUtf16Safe(params.thumbedDownResponse, MAX_RESPONSE_CHARS)}...` : params.thumbedDownResponse;
+		const truncated = params.thumbedDownResponse.length > MAX_RESPONSE_CHARS ? `${(0, openclaw_plugin_sdk_text_utility_runtime.truncateUtf16Safe)(params.thumbedDownResponse, MAX_RESPONSE_CHARS)}...` : params.thumbedDownResponse;
 		parts.push(`\nYour response was:\n> ${truncated}`);
 	}
 	if (params.userComment) parts.push(`\nUser's comment: "${params.userComment}"`);
@@ -39,7 +49,7 @@ function buildReflectionPrompt(params) {
 function parseBooleanLike(value) {
 	if (typeof value === "boolean") return value;
 	if (typeof value === "string") {
-		const normalized = normalizeOptionalLowercaseString(value);
+		const normalized = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(value);
 		if (normalized === "true" || normalized === "yes") return true;
 		if (normalized === "false" || normalized === "no") return false;
 	}
@@ -79,10 +89,10 @@ const MAX_COOLDOWN_ENTRIES = 500;
 const LEARNINGS_NAMESPACE = "feedback-learnings";
 const MAX_LEARNING_ENTRIES = 1e4;
 function learningStoreKey(storePath, sessionKey) {
-	return crypto.createHash("sha256").update(`${storePath}\0${sessionKey}`, "utf8").digest("hex");
+	return node_crypto.default.createHash("sha256").update(`${storePath}\0${sessionKey}`, "utf8").digest("hex");
 }
 function openLearningStore() {
-	return getMSTeamsRuntime().state.openKeyedStore({
+	return require_runtime.getMSTeamsRuntime().state.openKeyedStore({
 		namespace: LEARNINGS_NAMESPACE,
 		maxEntries: MAX_LEARNING_ENTRIES
 	});
@@ -134,7 +144,7 @@ function buildFeedbackEvent(params) {
 	};
 }
 function buildReflectionContext(params) {
-	const core = getMSTeamsRuntime();
+	const core = require_runtime.getMSTeamsRuntime();
 	const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(params.cfg);
 	const body = core.channel.reply.formatAgentEnvelope({
 		channel: "Teams",
@@ -163,7 +173,7 @@ function buildReflectionContext(params) {
 	}) };
 }
 function createReflectionCaptureDispatcher(params) {
-	const core = getMSTeamsRuntime();
+	const core = require_runtime.getMSTeamsRuntime();
 	let response = "";
 	const { dispatcher, replyOptions } = core.channel.reply.createReplyDispatcherWithTyping({
 		deliver: async (payload) => {
@@ -176,7 +186,7 @@ function createReflectionCaptureDispatcher(params) {
 		},
 		humanDelay: core.channel.reply.resolveHumanDelayConfig(params.cfg, params.agentId),
 		onError: (err) => {
-			params.log.debug?.("reflection reply error", { error: formatUnknownError(err) });
+			params.log.debug?.("reflection reply error", { error: require_setup_surface.formatUnknownError(err) });
 		}
 	});
 	return {
@@ -186,11 +196,11 @@ function createReflectionCaptureDispatcher(params) {
 	};
 }
 async function sendReflectionFollowUp(params) {
-	const baseRef = buildConversationReference(params.conversationRef);
-	await sendMSTeamsActivityWithReference(params.app, baseRef, {
+	const baseRef = require_messenger.buildConversationReference(params.conversationRef);
+	await require_messenger.sendMSTeamsActivityWithReference(params.app, baseRef, {
 		type: "message",
 		text: params.userMessage
-	}, { serviceUrlBoundary: resolveMSTeamsSdkCloudOptions(params.cfg.channels?.msteams) });
+	}, { serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(params.cfg.channels?.msteams) });
 }
 /**
 * Run a background reflection after negative feedback.
@@ -207,7 +217,7 @@ async function runFeedbackReflection(params) {
 		thumbedDownResponse: params.thumbedDownResponse,
 		userComment: params.userComment
 	});
-	const storePath = getMSTeamsRuntime().channel.session.resolveStorePath(cfg.session?.store, { agentId: params.agentId });
+	const storePath = require_runtime.getMSTeamsRuntime().channel.session.resolveStorePath(cfg.session?.store, { agentId: params.agentId });
 	const { ctxPayload } = buildReflectionContext({
 		cfg,
 		conversationId: params.conversationId,
@@ -220,7 +230,7 @@ async function runFeedbackReflection(params) {
 		log
 	});
 	try {
-		await dispatchReplyFromConfigWithSettledDispatcher$1({
+		await (0, openclaw_plugin_sdk_channel_inbound.dispatchReplyFromConfigWithSettledDispatcher)({
 			ctxPayload,
 			cfg,
 			dispatcher: capture.dispatcher,
@@ -228,7 +238,7 @@ async function runFeedbackReflection(params) {
 			replyOptions: capture.replyOptions
 		});
 	} catch (err) {
-		log.error("reflection dispatch failed", { error: formatUnknownError(err) });
+		log.error("reflection dispatch failed", { error: require_setup_surface.formatUnknownError(err) });
 		return;
 	}
 	const reflectionResponse = capture.readResponse().trim();
@@ -254,9 +264,9 @@ async function runFeedbackReflection(params) {
 			learning: parsedReflection.learning
 		});
 	} catch (err) {
-		log.debug?.("failed to store reflection learning", { error: formatUnknownError(err) });
+		log.debug?.("failed to store reflection learning", { error: require_setup_surface.formatUnknownError(err) });
 	}
-	const conversationType = normalizeOptionalLowercaseString(params.conversationRef.conversation?.conversationType);
+	const conversationType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(params.conversationRef.conversation?.conversationType);
 	if (!(conversationType === "personal" && parsedReflection.followUp && Boolean(parsedReflection.userMessage))) {
 		if (parsedReflection.followUp && conversationType !== "personal") log.debug?.("skipping reflection follow-up outside direct message", {
 			sessionKey,
@@ -273,22 +283,22 @@ async function runFeedbackReflection(params) {
 		});
 		log.info("sent reflection follow-up", { sessionKey });
 	} catch (err) {
-		log.debug?.("failed to send reflection follow-up", { error: formatUnknownError(err) });
+		log.debug?.("failed to send reflection follow-up", { error: require_setup_surface.formatUnknownError(err) });
 	}
 }
 //#endregion
 //#region extensions/msteams/src/adaptive-card-submit.ts
 function extractAdaptiveCardSubmittedData(value) {
-	if (!isRecord(value)) return value;
-	const action = isRecord(value.action) ? value.action : void 0;
-	if (action && normalizeOptionalLowercaseString(action.type) === "action.submit" && "data" in action) return action.data;
+	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value)) return value;
+	const action = (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value.action) ? value.action : void 0;
+	if (action && (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(action.type) === "action.submit" && "data" in action) return action.data;
 	return value;
 }
 function readMSTeamsImBackValue(value) {
-	if (!isRecord(value)) return null;
-	const msteams = isRecord(value.msteams) ? value.msteams : void 0;
-	if (!msteams || normalizeOptionalLowercaseString(msteams.type) !== "imback") return null;
-	return normalizeOptionalString(msteams.value) ?? null;
+	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value)) return null;
+	const msteams = (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(value.msteams) ? value.msteams : void 0;
+	if (!msteams || (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(msteams.type) !== "imback") return null;
+	return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(msteams.value) ?? null;
 }
 function serializeMSTeamsAdaptiveCardActionValue(value) {
 	const submittedValue = extractAdaptiveCardSubmittedData(value);
@@ -321,28 +331,28 @@ const msteamsIngressIdentity = {
 	resolveEntryId: ({ entryIndex, fieldKey }) => `msteams-entry-${entryIndex + 1}:${fieldKey === "sender-name" ? "name" : "id"}`
 };
 function normalizeIngressValue(value) {
-	return normalizeOptionalLowercaseString(value) ?? null;
+	return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(value) ?? null;
 }
 async function resolveMSTeamsSenderAccess(params) {
 	const activity = params.activity;
 	const msteamsCfg = params.cfg.channels?.msteams;
-	const conversationId = normalizeMSTeamsConversationId(activity.conversation?.id ?? "unknown");
-	const convType = normalizeOptionalLowercaseString(activity.conversation?.conversationType);
+	const conversationId = require_channel.normalizeMSTeamsConversationId(activity.conversation?.id ?? "unknown");
+	const convType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(activity.conversation?.conversationType);
 	const isDirectMessage = convType === "personal" || !convType && !activity.conversation?.isGroup;
 	const senderId = activity.from?.aadObjectId ?? activity.from?.id ?? "unknown";
 	const senderName = activity.from?.name ?? activity.from?.id ?? senderId;
-	const pairing = createChannelPairingController({
-		core: getMSTeamsRuntime(),
+	const pairing = (0, openclaw_plugin_sdk_channel_pairing.createChannelPairingController)({
+		core: require_runtime.getMSTeamsRuntime(),
 		channel: "msteams",
-		accountId: DEFAULT_ACCOUNT_ID
+		accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID
 	});
 	const dmPolicy = msteamsCfg?.dmPolicy ?? "pairing";
 	const configuredDmAllowFrom = msteamsCfg?.allowFrom ?? [];
 	const groupAllowFrom = msteamsCfg?.groupAllowFrom;
-	const defaultGroupPolicy = resolveDefaultGroupPolicy(params.cfg);
+	const defaultGroupPolicy = (0, openclaw_plugin_sdk_runtime_group_policy.resolveDefaultGroupPolicy)(params.cfg);
 	const groupPolicy = !isDirectMessage && msteamsCfg ? msteamsCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist" : "disabled";
-	const allowNameMatching = isDangerousNameMatchingEnabled(msteamsCfg);
-	const channelGate = resolveMSTeamsRouteConfig({
+	const allowNameMatching = (0, openclaw_plugin_sdk_dangerous_name_runtime.isDangerousNameMatchingEnabled)(msteamsCfg);
+	const channelGate = require_channel.resolveMSTeamsRouteConfig({
 		cfg: msteamsCfg,
 		teamId: activity.channelData?.team?.id,
 		teamName: activity.channelData?.team?.name,
@@ -351,7 +361,7 @@ async function resolveMSTeamsSenderAccess(params) {
 		allowNameMatching
 	});
 	return {
-		...await resolveStableChannelMessageIngress({
+		...await (0, openclaw_plugin_sdk_channel_ingress_runtime.resolveStableChannelMessageIngress)({
 			channelId: "msteams",
 			accountId: pairing.accountId,
 			identity: msteamsIngressIdentity,
@@ -366,7 +376,7 @@ async function resolveMSTeamsSenderAccess(params) {
 				id: conversationId,
 				parentId: activity.channelData?.team?.id
 			},
-			route: channelIngressRoutes(!isDirectMessage && channelGate.allowlistConfigured && {
+			route: (0, openclaw_plugin_sdk_channel_ingress_runtime.channelIngressRoutes)(!isDirectMessage && channelGate.allowlistConfigured && {
 				id: "msteams:team-channel",
 				kind: "nestedAllowlist",
 				allowed: channelGate.allowed,
@@ -426,8 +436,8 @@ function normalizeServiceUrl(serviceUrl) {
 	return serviceUrl.replace(/\/+$/, "");
 }
 function buildBotFrameworkAttachmentHeaders(params) {
-	const headers = ensureUserAgentHeader();
-	applyAuthorizationHeaderForUrl({
+	const headers = require_resolve_allowlist.ensureUserAgentHeader();
+	require_resolve_allowlist.applyAuthorizationHeaderForUrl({
 		headers,
 		url: params.url,
 		authAllowHosts: params.policy.authAllowHosts,
@@ -439,7 +449,7 @@ async function fetchBotFrameworkAttachmentInfo(params) {
 	const url = `${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}`;
 	let response;
 	try {
-		response = await safeFetchWithPolicy({
+		response = await require_resolve_allowlist.safeFetchWithPolicy({
 			url,
 			policy: params.policy,
 			fetchFn: params.fetchFn,
@@ -449,7 +459,8 @@ async function fetchBotFrameworkAttachmentInfo(params) {
 				url,
 				accessToken: params.accessToken,
 				policy: params.policy
-			}) }
+			}) },
+			timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
 		});
 	} catch (err) {
 		params.logger?.warn?.("msteams botFramework attachmentInfo fetch failed", { error: err instanceof Error ? err.message : String(err) });
@@ -461,7 +472,7 @@ async function fetchBotFrameworkAttachmentInfo(params) {
 		return;
 	}
 	try {
-		return await readProviderJsonResponse(response, "msteams botFramework attachmentInfo");
+		return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, "msteams botFramework attachmentInfo");
 	} catch (err) {
 		params.logger?.warn?.("msteams botFramework attachmentInfo parse failed", { error: err instanceof Error ? err.message : String(err) });
 		return;
@@ -471,7 +482,7 @@ async function saveBotFrameworkAttachmentView(params) {
 	const url = `${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}/views/${encodeURIComponent(params.viewId)}`;
 	let response;
 	try {
-		response = await safeFetchWithPolicy({
+		response = await require_resolve_allowlist.safeFetchWithPolicy({
 			url,
 			policy: params.policy,
 			fetchFn: params.fetchFn,
@@ -481,7 +492,8 @@ async function saveBotFrameworkAttachmentView(params) {
 				url,
 				accessToken: params.accessToken,
 				policy: params.policy
-			}) }
+			}) },
+			timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
 		});
 	} catch (err) {
 		params.logger?.warn?.("msteams botFramework attachmentView fetch failed", { error: err instanceof Error ? err.message : String(err) });
@@ -494,7 +506,7 @@ async function saveBotFrameworkAttachmentView(params) {
 	}
 	let contentLength;
 	try {
-		contentLength = parseMediaContentLength(response.headers.get("content-length"));
+		contentLength = (0, openclaw_plugin_sdk_media_runtime.parseMediaContentLength)(response.headers.get("content-length"));
 	} catch (err) {
 		await response.body?.cancel();
 		params.logger?.warn?.("msteams botFramework attachmentView invalid content-length", { error: err instanceof Error ? err.message : String(err) });
@@ -505,7 +517,7 @@ async function saveBotFrameworkAttachmentView(params) {
 		return;
 	}
 	try {
-		return await getMSTeamsRuntime().channel.media.saveResponseMedia(response, {
+		return await require_runtime.getMSTeamsRuntime().channel.media.saveResponseMedia(response, {
 			sourceUrl: url,
 			filePathHint: params.fileNameHint,
 			maxBytes: params.maxBytes,
@@ -516,6 +528,8 @@ async function saveBotFrameworkAttachmentView(params) {
 	} catch (err) {
 		params.logger?.warn?.("msteams botFramework attachmentView save failed", { error: err instanceof Error ? err.message : String(err) });
 		return;
+	} finally {
+		await response.body?.cancel().catch(() => void 0);
 	}
 }
 /**
@@ -526,14 +540,19 @@ async function saveBotFrameworkAttachmentView(params) {
 */
 async function downloadMSTeamsBotFrameworkAttachment(params) {
 	if (!params.serviceUrl || !params.attachmentId || !params.tokenProvider) return;
-	const policy = resolveAttachmentFetchPolicy({
+	const tokenProvider = params.tokenProvider;
+	const policy = require_resolve_allowlist.resolveAttachmentFetchPolicy({
 		allowHosts: params.allowHosts,
 		authAllowHosts: params.authAllowHosts
 	});
-	if (!isUrlAllowed(`${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}`, policy.allowHosts)) return;
+	if (!require_resolve_allowlist.isUrlAllowed(`${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}`, policy.allowHosts)) return;
 	let accessToken;
 	try {
-		accessToken = await params.tokenProvider.getAccessToken(BOT_FRAMEWORK_SCOPE);
+		accessToken = await require_resolve_allowlist.withMSTeamsRequestDeadline({
+			deadline: params.deadline,
+			label: "MS Teams Bot Framework token",
+			work: () => tokenProvider.getAccessToken(BOT_FRAMEWORK_SCOPE)
+		});
 	} catch (err) {
 		params.logger?.warn?.("msteams botFramework token acquisition failed", { error: err instanceof Error ? err.message : String(err) });
 		return;
@@ -547,7 +566,8 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 		fetchFn: params.fetchFn,
 		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 		resolveFn: params.resolveFn,
-		logger: params.logger
+		logger: params.logger,
+		deadline: params.deadline
 	});
 	if (!info) return;
 	const views = Array.isArray(info.views) ? info.views : [];
@@ -570,13 +590,14 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 		fetchFn: params.fetchFn,
 		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 		resolveFn: params.resolveFn,
-		logger: params.logger
+		logger: params.logger,
+		deadline: params.deadline
 	});
 	if (!saved) return;
 	return {
 		path: saved.path,
 		contentType: saved.contentType,
-		placeholder: inferPlaceholder({
+		placeholder: require_resolve_allowlist.inferPlaceholder({
 			contentType: saved.contentType,
 			fileName: fileNameHint
 		})
@@ -614,6 +635,7 @@ async function downloadMSTeamsBotFrameworkAttachments(params) {
 			fetchFn: params.fetchFn,
 			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 			resolveFn: params.resolveFn,
+			deadline: params.deadline,
 			fileNameHint: params.fileNameHint,
 			contentTypeHint: params.contentTypeHint,
 			preserveFilenames: params.preserveFilenames,
@@ -639,13 +661,18 @@ async function downloadMSTeamsBotFrameworkAttachments(params) {
 * sequence while keeping redirect and DNS pinning inside `safeFetchWithPolicy`.
 */
 async function saveRemoteMediaDirect(params) {
-	return await saveResponseMedia(await params.fetchImpl(params.url, { redirect: "follow" }), {
-		sourceUrl: params.url,
-		filePathHint: params.filePathHint,
-		maxBytes: params.maxBytes,
-		fallbackContentType: params.contentTypeHint,
-		originalFilename: params.originalFilename
-	});
+	const response = await params.fetchImpl(params.url, { redirect: "follow" });
+	try {
+		return await (0, openclaw_plugin_sdk_media_runtime.saveResponseMedia)(response, {
+			sourceUrl: params.url,
+			filePathHint: params.filePathHint,
+			maxBytes: params.maxBytes,
+			fallbackContentType: params.contentTypeHint,
+			originalFilename: params.originalFilename
+		});
+	} finally {
+		await response.body?.cancel().catch(() => void 0);
+	}
 }
 async function downloadAndStoreMSTeamsRemoteMedia(params) {
 	const originalFilename = params.preserveFilenames ? params.filePathHint : void 0;
@@ -658,7 +685,7 @@ async function downloadAndStoreMSTeamsRemoteMedia(params) {
 		contentTypeHint: params.contentTypeHint,
 		originalFilename
 	});
-	else saved = await getMSTeamsRuntime().channel.media.saveRemoteMedia({
+	else saved = await require_runtime.getMSTeamsRuntime().channel.media.saveRemoteMedia({
 		url: params.url,
 		fetchImpl: params.fetchImpl,
 		filePathHint: params.filePathHint,
@@ -670,7 +697,7 @@ async function downloadAndStoreMSTeamsRemoteMedia(params) {
 	return {
 		path: saved.path,
 		contentType: saved.contentType,
-		placeholder: params.placeholder ?? inferPlaceholder({
+		placeholder: params.placeholder ?? require_resolve_allowlist.inferPlaceholder({
 			contentType: saved.contentType,
 			fileName: params.filePathHint
 		})
@@ -679,35 +706,35 @@ async function downloadAndStoreMSTeamsRemoteMedia(params) {
 //#endregion
 //#region extensions/msteams/src/attachments/download.ts
 function resolveDownloadCandidate(att) {
-	const contentType = normalizeContentType(att.contentType);
-	const name = normalizeOptionalString(att.name) ?? "";
+	const contentType = require_resolve_allowlist.normalizeContentType(att.contentType);
+	const name = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(att.name) ?? "";
 	if (contentType === "application/vnd.microsoft.teams.file.download.info") {
-		if (!isRecord$1(att.content)) return null;
-		const downloadUrl = normalizeOptionalString(att.content.downloadUrl) ?? "";
+		if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(att.content)) return null;
+		const downloadUrl = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(att.content.downloadUrl) ?? "";
 		if (!downloadUrl) return null;
-		const fileType = normalizeOptionalString(att.content.fileType) ?? "";
-		const uniqueId = normalizeOptionalString(att.content.uniqueId) ?? "";
-		const fileName = normalizeOptionalString(att.content.fileName) ?? "";
+		const fileType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(att.content.fileType) ?? "";
+		const uniqueId = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(att.content.uniqueId) ?? "";
+		const fileName = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(att.content.fileName) ?? "";
 		const fileHint = name || fileName || (uniqueId && fileType ? `${uniqueId}.${fileType}` : "");
 		return {
 			url: downloadUrl,
 			fileHint: fileHint || void 0,
 			contentTypeHint: void 0,
-			placeholder: inferPlaceholder({
+			placeholder: require_resolve_allowlist.inferPlaceholder({
 				contentType,
 				fileName: fileHint,
 				fileType
 			})
 		};
 	}
-	const contentUrl = normalizeOptionalString(att.contentUrl) ?? "";
+	const contentUrl = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(att.contentUrl) ?? "";
 	if (!contentUrl) return null;
-	const sharesUrl = tryBuildGraphSharesUrlForSharedLink(contentUrl);
+	const sharesUrl = require_resolve_allowlist.tryBuildGraphSharesUrlForSharedLink(contentUrl);
 	return {
 		url: sharesUrl ?? contentUrl,
 		fileHint: name || void 0,
 		contentTypeHint: sharesUrl ? void 0 : contentType,
-		placeholder: inferPlaceholder({
+		placeholder: require_resolve_allowlist.inferPlaceholder({
 			contentType,
 			fileName: name
 		})
@@ -715,7 +742,7 @@ function resolveDownloadCandidate(att) {
 }
 function scopeCandidatesForUrl(url) {
 	try {
-		const host = normalizeLowercaseStringOrEmpty(new URL(url).hostname);
+		const host = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(new URL(url).hostname);
 		return host.endsWith("graph.microsoft.com") || host.endsWith("sharepoint.com") || host.endsWith("1drv.ms") || host.includes("sharepoint") ? ["https://graph.microsoft.com", "https://api.botframework.com"] : ["https://api.botframework.com", "https://graph.microsoft.com"];
 	} catch {
 		return ["https://api.botframework.com", "https://graph.microsoft.com"];
@@ -725,33 +752,39 @@ function isRedirectStatus(status) {
 	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
 }
 async function resolveInlineDataImageMime(inline) {
-	const mime = normalizeOptionalLowercaseString(await getMSTeamsRuntime().media.detectMime({
+	const mime = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(await require_runtime.getMSTeamsRuntime().media.detectMime({
 		buffer: inline.data,
 		headerMime: inline.contentType
 	}) ?? inline.contentType);
 	return mime?.startsWith("image/") ? mime : void 0;
 }
 async function fetchWithAuthFallback(params) {
-	const firstAttempt = await safeFetchWithPolicy({
+	const firstAttempt = await require_resolve_allowlist.safeFetchWithPolicy({
 		url: params.url,
 		policy: params.policy,
 		fetchFn: params.fetchFn,
 		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 		requestInit: params.requestInit,
-		resolveFn: params.resolveFn
+		resolveFn: params.resolveFn,
+		timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
 	});
 	if (firstAttempt.ok) return firstAttempt;
 	if (!params.tokenProvider) return firstAttempt;
+	const tokenProvider = params.tokenProvider;
 	if (firstAttempt.status !== 401 && firstAttempt.status !== 403) return firstAttempt;
-	if (!isUrlAllowed(params.url, params.policy.authAllowHosts)) return firstAttempt;
+	if (!require_resolve_allowlist.isUrlAllowed(params.url, params.policy.authAllowHosts)) return firstAttempt;
 	await firstAttempt.body?.cancel();
 	const scopes = scopeCandidatesForUrl(params.url);
 	const fetchFn = params.fetchFn ?? fetch;
 	for (const scope of scopes) try {
-		const token = await params.tokenProvider.getAccessToken(scope);
+		const token = await require_resolve_allowlist.withMSTeamsRequestDeadline({
+			deadline: params.deadline,
+			label: "MS Teams attachment token",
+			work: () => tokenProvider.getAccessToken(scope)
+		});
 		const authHeaders = new Headers(params.requestInit?.headers);
 		authHeaders.set("Authorization", `Bearer ${token}`);
-		const authAttempt = await safeFetchWithPolicy({
+		const authAttempt = await require_resolve_allowlist.safeFetchWithPolicy({
 			url: params.url,
 			policy: params.policy,
 			fetchFn,
@@ -760,7 +793,8 @@ async function fetchWithAuthFallback(params) {
 				...params.requestInit,
 				headers: authHeaders
 			},
-			resolveFn: params.resolveFn
+			resolveFn: params.resolveFn,
+			timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
 		});
 		if (authAttempt.ok) return authAttempt;
 		if (isRedirectStatus(authAttempt.status)) return authAttempt;
@@ -779,20 +813,20 @@ async function fetchWithAuthFallback(params) {
 async function downloadMSTeamsAttachments(params) {
 	const list = Array.isArray(params.attachments) ? params.attachments : [];
 	if (list.length === 0) return [];
-	const policy = resolveAttachmentFetchPolicy({
+	const policy = require_resolve_allowlist.resolveAttachmentFetchPolicy({
 		allowHosts: params.allowHosts,
 		authAllowHosts: params.authAllowHosts
 	});
 	const allowHosts = policy.allowHosts;
-	const ssrfPolicy = resolveMediaSsrfPolicy(allowHosts);
-	const candidates = list.filter(isDownloadableAttachment).map(resolveDownloadCandidate).filter(Boolean);
-	const inlineCandidates = extractInlineImageCandidates(list, {
+	const ssrfPolicy = require_resolve_allowlist.resolveMediaSsrfPolicy(allowHosts);
+	const candidates = list.filter(require_resolve_allowlist.isDownloadableAttachment).map(resolveDownloadCandidate).filter(Boolean);
+	const inlineCandidates = require_resolve_allowlist.extractInlineImageCandidates(list, {
 		maxInlineBytes: params.maxBytes,
 		maxInlineTotalBytes: params.maxBytes
 	});
 	const seenUrls = /* @__PURE__ */ new Set();
 	for (const inline of inlineCandidates) if (inline.kind === "url") {
-		if (!isUrlAllowed(inline.url, allowHosts)) continue;
+		if (!require_resolve_allowlist.isUrlAllowed(inline.url, allowHosts)) continue;
 		if (seenUrls.has(inline.url)) continue;
 		seenUrls.add(inline.url);
 		candidates.push({
@@ -810,18 +844,18 @@ async function downloadMSTeamsAttachments(params) {
 		try {
 			const contentType = await resolveInlineDataImageMime(inline);
 			if (!contentType) continue;
-			const saved = await getMSTeamsRuntime().channel.media.saveMediaBuffer(inline.data, contentType, "inbound", params.maxBytes);
+			const saved = await require_runtime.getMSTeamsRuntime().channel.media.saveMediaBuffer(inline.data, contentType, "inbound", params.maxBytes);
 			out.push({
 				path: saved.path,
 				contentType: saved.contentType,
-				placeholder: inferPlaceholder({ contentType: saved.contentType ?? contentType })
+				placeholder: require_resolve_allowlist.inferPlaceholder({ contentType: saved.contentType ?? contentType })
 			});
 		} catch (err) {
 			params.logger?.warn?.("msteams inline attachment decode failed", { error: err instanceof Error ? err.message : String(err) });
 		}
 	}
 	for (const candidate of candidates) {
-		if (!isUrlAllowed(candidate.url, allowHosts)) continue;
+		if (!require_resolve_allowlist.isUrlAllowed(candidate.url, allowHosts)) continue;
 		try {
 			const media = await downloadAndStoreMSTeamsRemoteMedia({
 				url: candidate.url,
@@ -833,13 +867,14 @@ async function downloadMSTeamsAttachments(params) {
 				ssrfPolicy,
 				useDirectFetch: true,
 				fetchImpl: (input, init) => fetchWithAuthFallback({
-					url: resolveRequestUrl(input),
+					url: require_resolve_allowlist.resolveRequestUrl(input),
 					tokenProvider: params.tokenProvider,
 					fetchFn: params.fetchFn,
 					fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 					requestInit: init,
 					resolveFn: params.resolveFn,
-					policy
+					policy,
+					deadline: params.deadline
 				})
 			});
 			out.push(media);
@@ -859,44 +894,31 @@ function safeHostForLog(url) {
 }
 //#endregion
 //#region extensions/msteams/src/attachments/graph.ts
-function buildMSTeamsGraphMessageUrls(params) {
-	const conversationType = normalizeLowercaseStringOrEmpty(params.conversationType ?? "");
-	const messageIdCandidates = /* @__PURE__ */ new Set();
-	const pushCandidate = (value) => {
-		const trimmed = normalizeOptionalString(value) ?? "";
-		if (trimmed) messageIdCandidates.add(trimmed);
-	};
-	pushCandidate(params.messageId);
-	pushCandidate(params.conversationMessageId);
-	pushCandidate(readNestedString(params.channelData, ["messageId"]));
-	pushCandidate(readNestedString(params.channelData, ["teamsMessageId"]));
-	const replyToId = normalizeOptionalString(params.replyToId) ?? "";
+function buildMSTeamsGraphMessageUrl(params) {
+	const conversationType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.conversationType ?? "");
+	const messageId = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params.messageId);
+	if (!messageId) return;
 	if (conversationType === "channel") {
-		const teamId = readNestedString(params.channelData, ["team", "id"]) ?? readNestedString(params.channelData, ["teamId"]);
-		const channelId = readNestedString(params.channelData, ["channel", "id"]) ?? readNestedString(params.channelData, ["channelId"]) ?? readNestedString(params.channelData, ["teamsChannelId"]);
-		if (!teamId || !channelId) return [];
-		const urls = [];
-		if (replyToId) for (const candidate of messageIdCandidates) {
-			if (candidate === replyToId) continue;
-			urls.push(`${GRAPH_ROOT}/teams/${encodeURIComponent(teamId)}/channels/${encodeURIComponent(channelId)}/messages/${encodeURIComponent(replyToId)}/replies/${encodeURIComponent(candidate)}`);
-		}
-		if (messageIdCandidates.size === 0 && replyToId) messageIdCandidates.add(replyToId);
-		for (const candidate of messageIdCandidates) urls.push(`${GRAPH_ROOT}/teams/${encodeURIComponent(teamId)}/channels/${encodeURIComponent(channelId)}/messages/${encodeURIComponent(candidate)}`);
-		return uniqueStrings(urls);
+		const teamAadGroupId = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params.teamAadGroupId);
+		const channelId = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params.channelId);
+		if (!teamAadGroupId || !channelId) return;
+		const messageRoot = `${require_resolve_allowlist.GRAPH_ROOT}/teams/${encodeURIComponent(teamAadGroupId)}/channels/${encodeURIComponent(channelId)}/messages`;
+		const threadRootMessageId = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params.threadRootMessageId);
+		return threadRootMessageId && threadRootMessageId !== messageId ? `${messageRoot}/${encodeURIComponent(threadRootMessageId)}/replies/${encodeURIComponent(messageId)}` : `${messageRoot}/${encodeURIComponent(messageId)}`;
 	}
-	const chatId = params.conversationId?.trim() || readNestedString(params.channelData, ["chatId"]);
-	if (!chatId) return [];
-	if (messageIdCandidates.size === 0 && replyToId) messageIdCandidates.add(replyToId);
-	return uniqueStrings(Array.from(messageIdCandidates).map((candidate) => `${GRAPH_ROOT}/chats/${encodeURIComponent(chatId)}/messages/${encodeURIComponent(candidate)}`));
+	const chatId = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params.conversationId);
+	if (!chatId) return;
+	return `${require_resolve_allowlist.GRAPH_ROOT}/chats/${encodeURIComponent(chatId)}/messages/${encodeURIComponent(messageId)}`;
 }
 async function fetchGraphCollection(params) {
 	const fetchFn = params.fetchFn ?? fetch;
-	const { response, release } = await fetchWithSsrFGuard({
+	const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 		url: params.url,
 		fetchImpl: fetchFn,
-		init: { headers: ensureUserAgentHeader({ Authorization: `Bearer ${params.accessToken}` }) },
+		init: { headers: require_resolve_allowlist.ensureUserAgentHeader({ Authorization: `Bearer ${params.accessToken}` }) },
 		policy: params.ssrfPolicy,
-		auditContext: "msteams.graph.collection"
+		auditContext: "msteams.graph.collection",
+		timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
 	});
 	try {
 		const status = response.status;
@@ -907,7 +929,7 @@ async function fetchGraphCollection(params) {
 		try {
 			return {
 				status,
-				items: await readProviderJsonArrayFieldResponse(response, "MS Teams Graph collection", "value")
+				items: await (0, openclaw_plugin_sdk_provider_http.readProviderJsonArrayFieldResponse)(response, "MS Teams Graph collection", "value")
 			};
 		} catch {
 			return {
@@ -925,7 +947,7 @@ function normalizeGraphAttachment(att) {
 		content = JSON.parse(content);
 	} catch {}
 	return {
-		contentType: normalizeContentType(att.contentType) ?? void 0,
+		contentType: require_resolve_allowlist.normalizeContentType(att.contentType) ?? void 0,
 		contentUrl: att.contentUrl ?? void 0,
 		name: att.name ?? void 0,
 		thumbnailUrl: att.thumbnailUrl ?? void 0,
@@ -937,12 +959,22 @@ function normalizeGraphAttachment(att) {
 * Renamed from downloadGraphHostedImages to support all file types.
 */
 async function downloadGraphHostedContent(params) {
-	const hosted = await fetchGraphCollection({
-		url: `${params.messageUrl}/hostedContents`,
-		accessToken: params.accessToken,
-		fetchFn: params.fetchFn,
-		ssrfPolicy: params.ssrfPolicy
-	});
+	let hosted;
+	try {
+		hosted = await fetchGraphCollection({
+			url: `${params.messageUrl}/hostedContents`,
+			accessToken: params.accessToken,
+			fetchFn: params.fetchFn,
+			ssrfPolicy: params.ssrfPolicy,
+			deadline: params.deadline
+		});
+	} catch (err) {
+		params.logger?.warn?.("msteams graph hostedContents fetch failed", { error: err instanceof Error ? err.message : String(err) });
+		return {
+			media: [],
+			count: 0
+		};
+	}
 	if (hosted.items.length === 0) return {
 		media: [],
 		status: hosted.status,
@@ -953,16 +985,17 @@ async function downloadGraphHostedContent(params) {
 		if (!item.id) continue;
 		try {
 			const valueUrl = `${params.messageUrl}/hostedContents/${encodeURIComponent(item.id)}/$value`;
-			const { response: valRes, release } = await fetchWithSsrFGuard({
+			const { response: valRes, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 				url: valueUrl,
 				fetchImpl: params.fetchFn ?? fetch,
-				init: { headers: ensureUserAgentHeader({ Authorization: `Bearer ${params.accessToken}` }) },
+				init: { headers: require_resolve_allowlist.ensureUserAgentHeader({ Authorization: `Bearer ${params.accessToken}` }) },
 				policy: params.ssrfPolicy,
-				auditContext: "msteams.graph.hostedContent.value"
+				auditContext: "msteams.graph.hostedContent.value",
+				timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
 			});
 			try {
 				if (!valRes.ok) continue;
-				const saved = await getMSTeamsRuntime().channel.media.saveResponseMedia(valRes, {
+				const saved = await require_runtime.getMSTeamsRuntime().channel.media.saveResponseMedia(valRes, {
 					sourceUrl: valueUrl,
 					maxBytes: params.maxBytes,
 					fallbackContentType: item.contentType ?? void 0,
@@ -971,7 +1004,7 @@ async function downloadGraphHostedContent(params) {
 				out.push({
 					path: saved.path,
 					contentType: saved.contentType,
-					placeholder: inferPlaceholder({ contentType: saved.contentType })
+					placeholder: require_resolve_allowlist.inferPlaceholder({ contentType: saved.contentType })
 				});
 			} finally {
 				await release();
@@ -989,18 +1022,22 @@ async function downloadGraphHostedContent(params) {
 }
 async function downloadMSTeamsGraphMedia(params) {
 	if (!params.messageUrl || !params.tokenProvider) return { media: [] };
-	const policy = resolveAttachmentFetchPolicy({
+	const tokenProvider = params.tokenProvider;
+	const policy = require_resolve_allowlist.resolveAttachmentFetchPolicy({
 		allowHosts: params.allowHosts,
 		authAllowHosts: params.authAllowHosts
 	});
-	const ssrfPolicy = resolveMediaSsrfPolicy(policy.allowHosts);
+	const ssrfPolicy = require_resolve_allowlist.resolveMediaSsrfPolicy(policy.allowHosts);
 	const messageUrl = params.messageUrl;
-	const debugLog = params.log ?? params.logger ?? void 0;
 	let accessToken;
 	try {
-		accessToken = await params.tokenProvider.getAccessToken("https://graph.microsoft.com");
+		accessToken = await require_resolve_allowlist.withMSTeamsRequestDeadline({
+			deadline: params.deadline,
+			label: "MS Teams Graph media token",
+			work: () => tokenProvider.getAccessToken("https://graph.microsoft.com")
+		});
 	} catch (err) {
-		debugLog?.debug?.("graph media token acquisition failed", {
+		params.logger?.debug?.("graph media token acquisition failed", {
 			messageUrl,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -1015,23 +1052,25 @@ async function downloadMSTeamsGraphMedia(params) {
 	const sharePointMedia = [];
 	const downloadedReferenceUrls = /* @__PURE__ */ new Set();
 	let messageAttachments = [];
+	let referenceAttachments = [];
 	let messageStatus;
 	try {
-		const { response: msgRes, release } = await fetchWithSsrFGuard({
+		const { response: msgRes, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 			url: messageUrl,
 			fetchImpl: fetchFn,
-			init: { headers: ensureUserAgentHeader({ Authorization: `Bearer ${accessToken}` }) },
+			init: { headers: require_resolve_allowlist.ensureUserAgentHeader({ Authorization: `Bearer ${accessToken}` }) },
 			policy: ssrfPolicy,
-			auditContext: "msteams.graph.message"
+			auditContext: "msteams.graph.message",
+			timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
 		});
 		try {
 			messageStatus = msgRes.status;
 			if (msgRes.ok) {
 				let msgData;
 				try {
-					msgData = await readProviderJsonResponse(msgRes, "MS Teams Graph message");
+					msgData = await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(msgRes, "MS Teams Graph message");
 				} catch (err) {
-					debugLog?.debug?.("graph media message parse failed", {
+					params.logger?.debug?.("graph media message parse failed", {
 						messageUrl,
 						error: err instanceof Error ? err.message : String(err)
 					});
@@ -1042,60 +1081,8 @@ async function downloadMSTeamsGraphMedia(params) {
 					msgData = {};
 				}
 				messageAttachments = Array.isArray(msgData.attachments) ? msgData.attachments : [];
-				const spAttachments = messageAttachments.filter((a) => a.contentType === "reference" && a.contentUrl && a.name);
-				for (const att of spAttachments) {
-					const name = att.name ?? "file";
-					const shareUrl = att.contentUrl ?? "";
-					if (!shareUrl) continue;
-					try {
-						const sharesUrl = `${GRAPH_ROOT}/shares/${encodeGraphShareId(shareUrl)}/driveItem/content`;
-						if (!isUrlAllowed(sharesUrl, policy.allowHosts)) {
-							debugLog?.debug?.("graph media sharepoint url not in allowHosts", {
-								messageUrl,
-								sharesUrl
-							});
-							continue;
-						}
-						const media = await downloadAndStoreMSTeamsRemoteMedia({
-							url: sharesUrl,
-							filePathHint: name,
-							maxBytes: params.maxBytes,
-							contentTypeHint: "application/octet-stream",
-							preserveFilenames: params.preserveFilenames,
-							ssrfPolicy,
-							useDirectFetch: true,
-							fetchImpl: async (input, init) => {
-								const requestUrl = resolveRequestUrl(input);
-								const headers = ensureUserAgentHeader(init?.headers);
-								applyAuthorizationHeaderForUrl({
-									headers,
-									url: requestUrl,
-									authAllowHosts: policy.authAllowHosts,
-									bearerToken: accessToken
-								});
-								return await safeFetchWithPolicy({
-									url: requestUrl,
-									policy,
-									fetchFn,
-									fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
-									requestInit: {
-										...init,
-										headers
-									},
-									resolveFn: params.resolveFn
-								});
-							}
-						});
-						sharePointMedia.push(media);
-						downloadedReferenceUrls.add(shareUrl);
-					} catch (err) {
-						params.logger?.warn?.("msteams SharePoint reference download failed", {
-							error: err instanceof Error ? err.message : String(err),
-							name
-						});
-					}
-				}
-			} else debugLog?.debug?.("graph media message fetch not ok", {
+				referenceAttachments = messageAttachments.filter((a) => a.contentType === "reference" && a.contentUrl && a.name);
+			} else params.logger?.debug?.("graph media message fetch not ok", {
 				messageUrl,
 				status: messageStatus
 			});
@@ -1103,12 +1090,65 @@ async function downloadMSTeamsGraphMedia(params) {
 			await release();
 		}
 	} catch (err) {
-		debugLog?.debug?.("graph media message fetch failed", {
+		params.logger?.debug?.("graph media message fetch failed", {
 			messageUrl,
 			error: err instanceof Error ? err.message : String(err)
 		});
 		params.logger?.warn?.("msteams graph message fetch failed", { error: err instanceof Error ? err.message : String(err) });
 	}
+	for (const att of referenceAttachments) {
+		const name = att.name ?? "file";
+		const shareUrl = att.contentUrl ?? "";
+		if (!shareUrl) continue;
+		try {
+			const sharesUrl = `${require_resolve_allowlist.GRAPH_ROOT}/shares/${require_resolve_allowlist.encodeGraphShareId(shareUrl)}/driveItem/content`;
+			if (!require_resolve_allowlist.isUrlAllowed(sharesUrl, policy.allowHosts)) {
+				params.logger?.debug?.("graph media sharepoint url not in allowHosts", {
+					messageUrl,
+					sharesUrl
+				});
+				continue;
+			}
+			const media = await downloadAndStoreMSTeamsRemoteMedia({
+				url: sharesUrl,
+				filePathHint: name,
+				maxBytes: params.maxBytes,
+				contentTypeHint: "application/octet-stream",
+				preserveFilenames: params.preserveFilenames,
+				ssrfPolicy,
+				useDirectFetch: true,
+				fetchImpl: async (input, init) => {
+					const requestUrl = require_resolve_allowlist.resolveRequestUrl(input);
+					const headers = require_resolve_allowlist.ensureUserAgentHeader(init?.headers);
+					require_resolve_allowlist.applyAuthorizationHeaderForUrl({
+						headers,
+						url: requestUrl,
+						authAllowHosts: policy.authAllowHosts,
+						bearerToken: accessToken
+					});
+					return await require_resolve_allowlist.safeFetchWithPolicy({
+						url: requestUrl,
+						policy,
+						fetchFn,
+						fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
+						requestInit: {
+							...init,
+							headers
+						},
+						resolveFn: params.resolveFn,
+						timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
+					});
+				}
+			});
+			sharePointMedia.push(media);
+			downloadedReferenceUrls.add(shareUrl);
+		} catch (err) {
+			params.logger?.warn?.("msteams SharePoint reference download failed", {
+				error: err instanceof Error ? err.message : String(err),
+				name
+			});
+		}
+	}
 	const hosted = await downloadGraphHostedContent({
 		accessToken,
 		messageUrl,
@@ -1116,11 +1156,12 @@ async function downloadMSTeamsGraphMedia(params) {
 		fetchFn: params.fetchFn,
 		preserveFilenames: params.preserveFilenames,
 		ssrfPolicy,
-		logger: params.logger
+		logger: params.logger,
+		deadline: params.deadline
 	});
 	const normalizedAttachments = messageAttachments.map(normalizeGraphAttachment);
 	const filteredAttachments = sharePointMedia.length > 0 ? normalizedAttachments.filter((att) => {
-		if (normalizeOptionalLowercaseString(att.contentType) !== "reference") return true;
+		if ((0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(att.contentType) !== "reference") return true;
 		const url = typeof att.contentUrl === "string" ? att.contentUrl : "";
 		if (!url) return true;
 		return !downloadedReferenceUrls.has(url);
@@ -1136,6 +1177,7 @@ async function downloadMSTeamsGraphMedia(params) {
 			fetchFn: params.fetchFn,
 			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 			resolveFn: params.resolveFn,
+			deadline: params.deadline,
 			preserveFilenames: params.preserveFilenames,
 			logger: params.logger
 		});
@@ -1170,14 +1212,14 @@ function extractMSTeamsHtmlAttachmentIds(attachments) {
 	if (list.length === 0) return [];
 	const ids = /* @__PURE__ */ new Set();
 	for (const att of list) {
-		const html = extractHtmlFromAttachment(att);
+		const html = require_resolve_allowlist.extractHtmlFromAttachment(att);
 		if (!html) continue;
-		ATTACHMENT_TAG_RE.lastIndex = 0;
-		let match = ATTACHMENT_TAG_RE.exec(html);
+		require_resolve_allowlist.ATTACHMENT_TAG_RE.lastIndex = 0;
+		let match = require_resolve_allowlist.ATTACHMENT_TAG_RE.exec(html);
 		while (match) {
 			const id = match[1]?.trim();
 			if (id) ids.add(id);
-			match = ATTACHMENT_TAG_RE.exec(html);
+			match = require_resolve_allowlist.ATTACHMENT_TAG_RE.exec(html);
 		}
 	}
 	return Array.from(ids);
@@ -1193,26 +1235,26 @@ function summarizeMSTeamsHtmlAttachments(attachments) {
 	let attachmentTags = 0;
 	const attachmentIds = /* @__PURE__ */ new Set();
 	for (const att of list) {
-		const html = extractHtmlFromAttachment(att);
+		const html = require_resolve_allowlist.extractHtmlFromAttachment(att);
 		if (!html) continue;
 		htmlAttachments += 1;
-		IMG_SRC_RE.lastIndex = 0;
-		let match = IMG_SRC_RE.exec(html);
+		require_resolve_allowlist.IMG_SRC_RE.lastIndex = 0;
+		let match = require_resolve_allowlist.IMG_SRC_RE.exec(html);
 		while (match) {
 			imgTags += 1;
 			const src = match[1]?.trim();
 			if (src) if (src.startsWith("data:")) dataImages += 1;
 			else if (src.startsWith("cid:")) cidImages += 1;
-			else srcHosts.add(safeHostForUrl(src));
-			match = IMG_SRC_RE.exec(html);
+			else srcHosts.add(require_resolve_allowlist.safeHostForUrl(src));
+			match = require_resolve_allowlist.IMG_SRC_RE.exec(html);
 		}
-		ATTACHMENT_TAG_RE.lastIndex = 0;
-		let attachmentMatch = ATTACHMENT_TAG_RE.exec(html);
+		require_resolve_allowlist.ATTACHMENT_TAG_RE.lastIndex = 0;
+		let attachmentMatch = require_resolve_allowlist.ATTACHMENT_TAG_RE.exec(html);
 		while (attachmentMatch) {
 			attachmentTags += 1;
 			const id = attachmentMatch[1]?.trim();
 			if (id) attachmentIds.add(id);
-			attachmentMatch = ATTACHMENT_TAG_RE.exec(html);
+			attachmentMatch = require_resolve_allowlist.ATTACHMENT_TAG_RE.exec(html);
 		}
 	}
 	if (htmlAttachments === 0) return;
@@ -1227,18 +1269,18 @@ function summarizeMSTeamsHtmlAttachments(attachments) {
 	};
 }
 function isAdvertisedFileAttachment(attachment) {
-	const contentType = normalizeContentType(attachment.contentType) ?? "";
+	const contentType = require_resolve_allowlist.normalizeContentType(attachment.contentType) ?? "";
 	if (contentType.startsWith("text/html") || contentType.startsWith("application/vnd.microsoft.card.") || contentType.startsWith("application/vnd.microsoft.teams.card.")) return false;
-	return Boolean(isDownloadableAttachment(attachment) || isLikelyImageAttachment(attachment) || attachment.name?.trim() || contentType);
+	return Boolean(require_resolve_allowlist.isDownloadableAttachment(attachment) || require_resolve_allowlist.isLikelyImageAttachment(attachment) || attachment.name?.trim() || contentType);
 }
 function countDistinctInlineImages(attachments) {
 	const seenReferences = /* @__PURE__ */ new Set();
 	let count = 0;
 	for (const attachment of attachments) {
-		const html = extractHtmlFromAttachment(attachment);
+		const html = require_resolve_allowlist.extractHtmlFromAttachment(attachment);
 		if (!html) continue;
-		IMG_SRC_RE.lastIndex = 0;
-		let match = IMG_SRC_RE.exec(html);
+		require_resolve_allowlist.IMG_SRC_RE.lastIndex = 0;
+		let match = require_resolve_allowlist.IMG_SRC_RE.exec(html);
 		while (match) {
 			const src = match[1]?.trim();
 			if (src?.startsWith("data:")) count += 1;
@@ -1246,7 +1288,7 @@ function countDistinctInlineImages(attachments) {
 				seenReferences.add(src);
 				count += 1;
 			}
-			match = IMG_SRC_RE.exec(html);
+			match = require_resolve_allowlist.IMG_SRC_RE.exec(html);
 		}
 	}
 	return count;
@@ -1254,14 +1296,14 @@ function countDistinctInlineImages(attachments) {
 function countDistinctInlineCandidates(attachments, limits) {
 	const seenUrls = /* @__PURE__ */ new Set();
 	let dataCount = 0;
-	for (const candidate of extractInlineImageCandidates(attachments, limits)) if (candidate.kind === "data") dataCount += 1;
+	for (const candidate of require_resolve_allowlist.extractInlineImageCandidates(attachments, limits)) if (candidate.kind === "data") dataCount += 1;
 	else seenUrls.add(candidate.url);
 	return dataCount + seenUrls.size;
 }
 function countUnrepresentedHtmlAttachmentIds(attachments) {
 	const representedIds = /* @__PURE__ */ new Set();
 	for (const attachment of attachments) {
-		if ((normalizeContentType(attachment.contentType) ?? "").startsWith("text/html")) continue;
+		if ((require_resolve_allowlist.normalizeContentType(attachment.contentType) ?? "").startsWith("text/html")) continue;
 		const id = attachment.id?.trim();
 		if (id) representedIds.add(id);
 	}
@@ -1282,7 +1324,7 @@ function resolveMSTeamsInboundAttachmentPresentation(attachments, limits) {
 		placeholder: "",
 		expectedMediaCount: 0
 	};
-	const totalImages = fileAttachments.filter(isLikelyImageAttachment).length + inlinePlaceholderCount;
+	const totalImages = fileAttachments.filter(require_resolve_allowlist.isLikelyImageAttachment).length + inlinePlaceholderCount;
 	if (totalImages > 0) return {
 		placeholder: `<media:image>${totalImages > 1 ? ` (${totalImages} images)` : ""}`,
 		expectedMediaCount
@@ -1295,100 +1337,7 @@ function resolveMSTeamsInboundAttachmentPresentation(attachments, limits) {
 //#endregion
 //#region extensions/msteams/src/attachments/payload.ts
 function buildMSTeamsMediaPayload(mediaList) {
-	return buildMediaPayload(mediaList, { preserveMediaTypeCardinality: true });
-}
-//#endregion
-//#region extensions/msteams/src/graph-thread.ts
-const teamGroupIdCache = /* @__PURE__ */ new Map();
-const CACHE_TTL_MS = 600 * 1e3;
-function resolveTeamGroupIdCacheExpiresAt(nowRaw = Date.now()) {
-	const now = asDateTimestampMs(nowRaw);
-	return now === void 0 ? void 0 : resolveExpiresAtMsFromDurationMs(CACHE_TTL_MS, { nowMs: now });
-}
-/**
-* Strip HTML tags from Teams message content, preserving @mention display names.
-* Teams wraps mentions in <at>Name</at> tags.
-*/
-function stripHtmlFromTeamsMessage(html) {
-	let text = html.replace(/<at[^>]*>(.*?)<\/at>/gi, "@$1");
-	text = text.replace(/<[^>]*>/g, " ");
-	text = text.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&#39;/g, "'").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&");
-	return text.replace(/\s+/g, " ").trim();
-}
-/**
-* Resolve the Azure AD group GUID for a Teams conversation team ID.
-* Results are cached with a TTL to avoid repeated Graph API calls.
-*/
-async function resolveTeamGroupId(token, conversationTeamId) {
-	const cached = teamGroupIdCache.get(conversationTeamId);
-	if (cached) {
-		const now = asDateTimestampMs(Date.now());
-		const expiresAt = asDateTimestampMs(cached.expiresAt);
-		if (now !== void 0 && expiresAt !== void 0 && expiresAt > now) return cached.groupId;
-		teamGroupIdCache.delete(conversationTeamId);
-	}
-	try {
-		const groupId = (await fetchGraphJson({
-			token,
-			path: `/teams/${encodeURIComponent(conversationTeamId)}?$select=id`
-		})).id ?? conversationTeamId;
-		const expiresAt = resolveTeamGroupIdCacheExpiresAt();
-		if (expiresAt !== void 0) teamGroupIdCache.set(conversationTeamId, {
-			groupId,
-			expiresAt
-		});
-		return groupId;
-	} catch {
-		return conversationTeamId;
-	}
-}
-/**
-* Fetch a single channel message (the parent/root of a thread).
-* Returns undefined on error so callers can degrade gracefully.
-*/
-async function fetchChannelMessage(token, groupId, channelId, messageId) {
-	const path = `/teams/${encodeURIComponent(groupId)}/channels/${encodeURIComponent(channelId)}/messages/${encodeURIComponent(messageId)}?$select=id,from,body,createdDateTime`;
-	try {
-		return await fetchGraphJson({
-			token,
-			path
-		});
-	} catch {
-		return;
-	}
-}
-/**
-* Fetch thread replies for a channel message, ordered chronologically.
-*
-* **Limitation:** The Graph API replies endpoint (`/messages/{id}/replies`) does not
-* support `$orderby`, so results are always returned in ascending (oldest-first) order.
-* Combined with the `$top` cap of 50, this means only the **oldest 50 replies** are
-* returned for long threads — newer replies are silently omitted. There is currently no
-* Graph API workaround for this; pagination via `@odata.nextLink` can retrieve more
-* replies but still in ascending order only.
-*/
-async function fetchThreadReplies(token, groupId, channelId, messageId, limit = 50) {
-	return (await fetchGraphJson({
-		token,
-		path: `/teams/${encodeURIComponent(groupId)}/channels/${encodeURIComponent(channelId)}/messages/${encodeURIComponent(messageId)}/replies?$top=${Math.min(Math.max(limit, 1), 50)}&$select=id,from,body,createdDateTime`
-	})).value ?? [];
-}
-/**
-* Format thread messages into a context string for the agent.
-* Skips the current message (by id) and blank messages.
-*/
-function formatThreadContext(messages, currentMessageId) {
-	const lines = [];
-	for (const msg of messages) {
-		if (msg.id && msg.id === currentMessageId) continue;
-		const sender = msg.from?.user?.displayName ?? msg.from?.application?.displayName ?? "unknown";
-		const contentType = msg.body?.contentType ?? "text";
-		const rawContent = msg.body?.content ?? "";
-		const content = contentType === "html" ? stripHtmlFromTeamsMessage(rawContent) : rawContent.trim();
-		if (!content) continue;
-		lines.push(`${sender}: ${content}`);
-	}
-	return lines.join("\n");
+	return (0, openclaw_plugin_sdk_reply_payload.buildMediaPayload)(mediaList, { preserveMediaTypeCardinality: true });
 }
 //#endregion
 //#region extensions/msteams/src/thread-parent-context.ts
@@ -1409,8 +1358,8 @@ function buildParentCacheKey(groupId, channelId, parentId) {
 	return `${groupId}\u0000${channelId}\u0000${parentId}`;
 }
 function resolveParentCacheExpiresAt(nowRaw) {
-	const nowMs = asDateTimestampMs(nowRaw);
-	return nowMs === void 0 ? void 0 : resolveExpiresAtMsFromDurationMs(PARENT_CACHE_TTL_MS, { nowMs });
+	const nowMs = (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(nowRaw);
+	return nowMs === void 0 ? void 0 : (0, openclaw_plugin_sdk_number_runtime.resolveExpiresAtMsFromDurationMs)(PARENT_CACHE_TTL_MS, { nowMs });
 }
 /**
 * Fetch a channel parent message with an LRU+TTL cache.
@@ -1418,11 +1367,11 @@ function resolveParentCacheExpiresAt(nowRaw) {
 * Uses the injected `fetchParent` (defaults to `fetchChannelMessage`) so
 * tests can swap in a stub without mocking the Graph transport.
 */
-async function fetchParentMessageCached(token, groupId, channelId, parentId, fetchParent = fetchChannelMessage) {
+async function fetchParentMessageCached(token, groupId, channelId, parentId, fetchParent = require_messenger.fetchChannelMessage) {
 	const key = buildParentCacheKey(groupId, channelId, parentId);
-	const now = asDateTimestampMs(Date.now());
+	const now = (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(Date.now());
 	const cached = parentCache.get(key);
-	const cachedExpiresAt = cached ? asDateTimestampMs(cached.expiresAt) : void 0;
+	const cachedExpiresAt = cached ? (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(cached.expiresAt) : void 0;
 	if (cached && now !== void 0 && cachedExpiresAt !== void 0 && cachedExpiresAt > now) {
 		parentCache.delete(key);
 		parentCache.set(key, cached);
@@ -1448,11 +1397,11 @@ function summarizeParentMessage(message) {
 	const sender = message.from?.user?.displayName ?? message.from?.application?.displayName ?? "unknown";
 	const contentType = message.body?.contentType ?? "text";
 	const raw = message.body?.content ?? "";
-	const text = contentType === "html" ? stripHtmlFromTeamsMessage(raw) : raw.replace(/\s+/g, " ").trim();
+	const text = contentType === "html" ? require_messenger.stripHtmlFromTeamsMessage(raw) : raw.replace(/\s+/g, " ").trim();
 	if (!text) return;
 	return {
 		sender,
-		text: text.length > PARENT_TEXT_MAX_CHARS ? `${truncateUtf16Safe(text, PARENT_TEXT_MAX_CHARS - 1)}…` : text
+		text: text.length > PARENT_TEXT_MAX_CHARS ? `${(0, openclaw_plugin_sdk_text_utility_runtime.truncateUtf16Safe)(text, PARENT_TEXT_MAX_CHARS - 1)}…` : text
 	};
 }
 /**
@@ -1501,10 +1450,10 @@ function isStreamCancelledError(err) {
 *   block message. We bypass the controller in that case.
 */
 function createTeamsReplyStreamController(params) {
-	const isPersonal = normalizeOptionalLowercaseString(params.conversationType) === "personal";
-	const streamMode = resolveChannelPreviewStreamMode(params.msteamsConfig, "partial");
+	const isPersonal = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(params.conversationType) === "personal";
+	const streamMode = (0, openclaw_plugin_sdk_channel_outbound.resolveChannelPreviewStreamMode)(params.msteamsConfig, "partial");
 	const shouldUseNativeStream = isPersonal && (streamMode === "partial" || streamMode === "progress");
-	const shouldStreamPreviewToolProgress = streamMode === "progress" && resolveChannelStreamingPreviewToolProgress(params.msteamsConfig);
+	const shouldStreamPreviewToolProgress = streamMode === "progress" && (0, openclaw_plugin_sdk_channel_outbound.resolveChannelStreamingPreviewToolProgress)(params.msteamsConfig);
 	const stream = shouldUseNativeStream ? params.context.stream : void 0;
 	let tokensEmitted = false;
 	let streamFinalizationPending = false;
@@ -1513,7 +1462,7 @@ function createTeamsReplyStreamController(params) {
 	let lastInformativeText = "";
 	let progressLines = [];
 	let pendingFinalPayload;
-	let emittedTextLength = 0;
+	let emittedText = "";
 	const wasCanceled = () => canceledLocally || Boolean(stream?.canceled);
 	const fallbackPayloadForSuppressedFinal = (payload) => {
 		return Boolean(payload.mediaUrl || payload.mediaUrls?.length) ? {
@@ -1528,8 +1477,8 @@ function createTeamsReplyStreamController(params) {
 	* default) and prepends collected tool-progress lines when configured.
 	*/
 	const renderInformativeUpdate = () => {
-		if (!stream || wasCanceled()) return;
-		const informativeText = formatChannelProgressDraftText({
+		if (!stream || wasCanceled() || streamFinalizationPending) return;
+		const informativeText = (0, openclaw_plugin_sdk_channel_outbound.formatChannelProgressDraftText)({
 			entry: params.msteamsConfig,
 			lines: shouldStreamPreviewToolProgress ? progressLines : [],
 			seed: params.progressSeed,
@@ -1547,17 +1496,26 @@ function createTeamsReplyStreamController(params) {
 			params.log?.debug?.(`stream informative update failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 	};
-	const progressDraftGate = createChannelProgressDraftGate({ onStart: renderInformativeUpdate });
+	const progressDraftGate = (0, openclaw_plugin_sdk_channel_outbound.createChannelProgressDraftGate)({ onStart: renderInformativeUpdate });
 	return {
 		async onReplyStart() {},
 		onPartialReply(payload) {
 			if (!stream || !payload.text || wasCanceled() || streamMode !== "partial" || streamFinalizationPending) return;
 			const fullText = payload.text;
-			if (fullText.length <= emittedTextLength) return;
-			const delta = fullText.slice(emittedTextLength);
+			let prefixLength = 0;
+			while (prefixLength < emittedText.length && prefixLength < fullText.length && emittedText[prefixLength] === fullText[prefixLength]) prefixLength += 1;
+			const previousRemainder = emittedText.slice(prefixLength);
+			const delta = fullText.slice(prefixLength);
+			if (!delta) return;
+			if (previousRemainder.trim()) {
+				stream.clearText();
+				streamFailed = true;
+				streamFinalizationPending = true;
+				return;
+			}
 			try {
 				stream.emit(delta);
-				emittedTextLength = fullText.length;
+				emittedText = fullText;
 				tokensEmitted = true;
 			} catch (err) {
 				if (isStreamCancelledError(err)) {
@@ -1575,7 +1533,7 @@ function createTeamsReplyStreamController(params) {
 		*/
 		async noteProgressWork(options) {
 			if (!stream || streamMode !== "progress") return;
-			if (options?.toolName !== void 0 && !isChannelProgressDraftWorkToolName(options.toolName)) return;
+			if (options?.toolName !== void 0 && !(0, openclaw_plugin_sdk_channel_outbound.isChannelProgressDraftWorkToolName)(options.toolName)) return;
 			const hadStarted = progressDraftGate.hasStarted;
 			const progressActive = await progressDraftGate.noteWork();
 			if ((hadStarted || progressActive) && progressDraftGate.hasStarted) renderInformativeUpdate();
@@ -1587,10 +1545,10 @@ function createTeamsReplyStreamController(params) {
 		*/
 		async pushProgressLine(line, options) {
 			if (!stream || streamMode !== "progress") return;
-			if (options?.toolName !== void 0 && !isChannelProgressDraftWorkToolName(options.toolName)) return;
+			if (options?.toolName !== void 0 && !(0, openclaw_plugin_sdk_channel_outbound.isChannelProgressDraftWorkToolName)(options.toolName)) return;
 			if (shouldStreamPreviewToolProgress) {
-				const normalized = normalizeChannelProgressDraftLineIdentity(line);
-				if (normalized) progressLines = mergeChannelProgressDraftLine(progressLines, typeof line === "object" && line !== void 0 ? line : normalized, { maxLines: resolveChannelProgressDraftMaxLines(params.msteamsConfig) });
+				const normalized = (0, openclaw_plugin_sdk_channel_outbound.normalizeChannelProgressDraftLineIdentity)(line);
+				if (normalized) progressLines = (0, openclaw_plugin_sdk_channel_outbound.mergeChannelProgressDraftLine)(progressLines, typeof line === "object" && line !== void 0 ? line : normalized, { maxLines: (0, openclaw_plugin_sdk_channel_outbound.resolveChannelProgressDraftMaxLines)(params.msteamsConfig) });
 			}
 			const hadStarted = progressDraftGate.hasStarted;
 			const progressActive = await progressDraftGate.noteWork();
@@ -1627,6 +1585,7 @@ function createTeamsReplyStreamController(params) {
 			return payload;
 		},
 		async finalize() {
+			progressDraftGate.cancel();
 			if (!stream || !streamFinalizationPending || wasCanceled()) return;
 			const finalEntities = [{
 				type: "https://schema.org/Message",
@@ -1678,9 +1637,9 @@ function createTeamsReplyStreamController(params) {
 //#endregion
 //#region extensions/msteams/src/reply-dispatcher.ts
 function createMSTeamsReplyDispatcher(params) {
-	const core = getMSTeamsRuntime();
+	const core = require_runtime.getMSTeamsRuntime();
 	const msteamsCfg = params.cfg.channels?.msteams;
-	const conversationType = normalizeOptionalLowercaseString(params.conversationRef.conversation?.conversationType);
+	const conversationType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(params.conversationRef.conversation?.conversationType);
 	const isTypingSupported = conversationType === "personal" || conversationType === "groupchat";
 	/**
 	* Keepalive cadence for the typing indicator while the bot is running
@@ -1701,13 +1660,13 @@ function createMSTeamsReplyDispatcher(params) {
 	const streamActiveRef = { current: () => false };
 	const streamCanceledRef = { current: () => false };
 	const rawSendTypingIndicator = async () => {
-		await withRevokedProxyFallback({
+		await require_messenger.withRevokedProxyFallback({
 			run: async () => {
 				await params.context.sendActivity({ type: "typing" });
 			},
 			onRevoked: async () => {
-				const baseRef = buildConversationReference(params.conversationRef);
-				await sendMSTeamsActivityWithReference(params.app, baseRef, { type: "typing" }, { serviceUrlBoundary: resolveMSTeamsSdkCloudOptions(msteamsCfg) });
+				const baseRef = require_messenger.buildConversationReference(params.conversationRef);
+				await require_messenger.sendMSTeamsActivityWithReference(params.app, baseRef, { type: "typing" }, { serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg) });
 			},
 			onRevokedLog: () => {
 				params.log.debug?.("turn context revoked, sending typing via proactive messaging");
@@ -1719,7 +1678,7 @@ function createMSTeamsReplyDispatcher(params) {
 		if (streamCanceledRef.current()) return;
 		await rawSendTypingIndicator();
 	} : async () => {};
-	const { onModelSelected, typingCallbacks, ...replyPipeline } = createChannelMessageReplyPipeline({
+	const { onModelSelected, typingCallbacks, ...replyPipeline } = (0, openclaw_plugin_sdk_channel_outbound.createChannelMessageReplyPipeline)({
 		cfg: params.cfg,
 		agentId: params.agentId,
 		channel: "msteams",
@@ -1729,7 +1688,7 @@ function createMSTeamsReplyDispatcher(params) {
 			keepaliveIntervalMs: TYPING_KEEPALIVE_INTERVAL_MS,
 			maxDurationMs: TYPING_KEEPALIVE_MAX_DURATION_MS,
 			onStartError: (err) => {
-				logTypingFailure({
+				(0, openclaw_plugin_sdk_channel_outbound.logTypingFailure)({
 					log: (message) => params.log.debug?.(message),
 					channel: "msteams",
 					action: "start",
@@ -1743,7 +1702,7 @@ function createMSTeamsReplyDispatcher(params) {
 		cfg: params.cfg,
 		channel: "msteams"
 	});
-	const mediaMaxBytes = resolveChannelMediaMaxBytes({
+	const mediaMaxBytes = (0, openclaw_plugin_sdk_media_runtime.resolveChannelMediaMaxBytes)({
 		cfg: params.cfg,
 		resolveChannelLimitMb: ({ cfg }) => cfg.channels?.msteams?.mediaMaxMb
 	});
@@ -1758,13 +1717,13 @@ function createMSTeamsReplyDispatcher(params) {
 	});
 	streamActiveRef.current = () => streamController.isStreamActive();
 	streamCanceledRef.current = () => streamController.wasCanceled();
-	const teamsStreamMode = resolveChannelPreviewStreamMode(msteamsCfg, "partial");
-	const blockStreamingResolved = teamsStreamMode === "block" ? true : resolveChannelStreamingBlockEnabled(msteamsCfg);
+	const teamsStreamMode = (0, openclaw_plugin_sdk_channel_outbound.resolveChannelPreviewStreamMode)(msteamsCfg, "partial");
+	const blockStreamingResolved = teamsStreamMode === "block" ? true : (0, openclaw_plugin_sdk_channel_outbound.resolveChannelStreamingBlockEnabled)(msteamsCfg);
 	const blockStreamingEnabled = blockStreamingResolved ?? false;
 	const typingIndicatorEnabled = typeof msteamsCfg?.typingIndicator === "boolean" ? msteamsCfg.typingIndicator : true;
 	const pendingMessages = [];
 	const sendMessages = async (messages) => {
-		return sendMSTeamsMessages({
+		return require_messenger.sendMSTeamsMessages({
 			replyStyle: params.replyStyle,
 			app: params.app,
 			appId: params.appId,
@@ -1782,12 +1741,12 @@ function createMSTeamsReplyDispatcher(params) {
 			sharePointSiteId: params.sharePointSiteId,
 			mediaMaxBytes,
 			feedbackLoopEnabled,
-			serviceUrlBoundary: resolveMSTeamsSdkCloudOptions(msteamsCfg)
+			serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg)
 		});
 	};
 	const queueDeliveryFailureSystemEvent = (failure) => {
-		const classification = classifyMSTeamsSendError(failure.error);
-		const errorText = formatUnknownError(failure.error);
+		const classification = require_setup_surface.classifyMSTeamsSendError(failure.error);
+		const errorText = require_setup_surface.formatUnknownError(failure.error);
 		const failedAll = failure.failed >= failure.total;
 		const sentences = [
 			`Microsoft Teams delivery failed: ${failedAll ? "the previous reply was not delivered" : `${failure.failed} of ${failure.total} message blocks were not delivered`}.`,
@@ -1802,7 +1761,7 @@ function createMSTeamsReplyDispatcher(params) {
 		});
 	};
 	const queueReplyPayload = (payload) => {
-		const messages = renderReplyPayloadsToMessages([payload], {
+		const messages = require_messenger.renderReplyPayloadsToMessages([payload], {
 			textChunkLimit: params.textLimit,
 			chunkText: true,
 			mediaMode: "split",
@@ -1859,9 +1818,9 @@ function createMSTeamsReplyDispatcher(params) {
 			if (blockStreamingEnabled) await flushPendingMessages();
 		},
 		onError: (err, info) => {
-			const errMsg = formatUnknownError(err);
-			const classification = classifyMSTeamsSendError(err);
-			const hint = formatMSTeamsSendErrorHint(classification);
+			const errMsg = require_setup_surface.formatUnknownError(err);
+			const classification = require_setup_surface.classifyMSTeamsSendError(err);
+			const hint = require_setup_surface.formatMSTeamsSendErrorHint(classification);
 			params.runtime.error?.(`msteams ${info.kind} reply failed: ${errMsg}${hint ? ` (${hint})` : ""}`);
 			params.log.error("reply failed", {
 				kind: info.kind,
@@ -1873,9 +1832,9 @@ function createMSTeamsReplyDispatcher(params) {
 	});
 	const markDispatchIdle = () => {
 		return flushPendingMessages().catch((err) => {
-			const errMsg = formatUnknownError(err);
-			const classification = classifyMSTeamsSendError(err);
-			const hint = formatMSTeamsSendErrorHint(classification);
+			const errMsg = require_setup_surface.formatUnknownError(err);
+			const classification = require_setup_surface.classifyMSTeamsSendError(err);
+			const hint = require_setup_surface.formatMSTeamsSendErrorHint(classification);
 			params.runtime.error?.(`msteams flush reply failed: ${errMsg}${hint ? ` (${hint})` : ""}`);
 			params.log.error("flush reply failed", {
 				error: errMsg,
@@ -1884,7 +1843,7 @@ function createMSTeamsReplyDispatcher(params) {
 			});
 		}).then(async () => {
 			const fallbackPayload = await streamController.finalize().catch((err) => {
-				params.log.debug?.("stream finalize failed", { error: formatUnknownError(err) });
+				params.log.debug?.("stream finalize failed", { error: require_setup_surface.formatUnknownError(err) });
 			});
 			if (fallbackPayload) {
 				queueReplyPayload(fallbackPayload);
@@ -1894,8 +1853,8 @@ function createMSTeamsReplyDispatcher(params) {
 			baseMarkDispatchIdle();
 		});
 	};
-	const previewToolProgressEnabled = resolveChannelStreamingPreviewToolProgress(msteamsCfg);
-	const suppressDefaultToolProgressMessages = resolveChannelStreamingSuppressDefaultToolProgressMessages(msteamsCfg);
+	const previewToolProgressEnabled = (0, openclaw_plugin_sdk_channel_outbound.resolveChannelStreamingPreviewToolProgress)(msteamsCfg);
+	const suppressDefaultToolProgressMessages = (0, openclaw_plugin_sdk_channel_outbound.resolveChannelStreamingSuppressDefaultToolProgressMessages)(msteamsCfg);
 	const shouldSuppressDefaultToolProgressMessages = teamsStreamMode === "progress" && suppressDefaultToolProgressMessages && previewToolProgressEnabled;
 	const progressCallbacks = streamController.hasStream() ? {
 		onReasoningStream: async (payload) => {
@@ -1905,7 +1864,7 @@ function createMSTeamsReplyDispatcher(params) {
 				await streamController.pushProgressLine(text);
 				return;
 			}
-			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLine)({
 				event: "item",
 				itemId: "reasoning",
 				itemKind: "analysis",
@@ -1916,7 +1875,7 @@ function createMSTeamsReplyDispatcher(params) {
 		onToolStart: async (payload) => {
 			const name = typeof payload?.name === "string" ? payload.name : void 0;
 			const detailMode = typeof payload?.detailMode === "string" ? payload.detailMode : void 0;
-			await streamController.pushProgressLine(buildChannelProgressDraftLineForEntry(msteamsCfg, {
+			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLineForEntry)(msteamsCfg, {
 				event: "tool",
 				...typeof payload?.itemId === "string" ? { itemId: payload.itemId } : {},
 				...typeof payload?.toolCallId === "string" ? { toolCallId: payload.toolCallId } : {},
@@ -1926,7 +1885,7 @@ function createMSTeamsReplyDispatcher(params) {
 			}, detailMode === "explain" || detailMode === "raw" ? { detailMode } : void 0), name ? { toolName: name } : void 0);
 		},
 		onItemEvent: async (payload) => {
-			await streamController.pushProgressLine(buildChannelProgressDraftLineForEntry(msteamsCfg, {
+			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLineForEntry)(msteamsCfg, {
 				event: "item",
 				...typeof payload?.itemId === "string" ? { itemId: payload.itemId } : {},
 				...typeof payload?.toolCallId === "string" ? { toolCallId: payload.toolCallId } : {},
@@ -1942,7 +1901,7 @@ function createMSTeamsReplyDispatcher(params) {
 		},
 		onPlanUpdate: async (payload) => {
 			if (payload?.phase !== "update") return;
-			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLine)({
 				event: "plan",
 				phase: payload.phase,
 				...typeof payload?.title === "string" ? { title: payload.title } : {},
@@ -1952,7 +1911,7 @@ function createMSTeamsReplyDispatcher(params) {
 		},
 		onApprovalEvent: async (payload) => {
 			if (payload?.phase !== "requested") return;
-			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLine)({
 				event: "approval",
 				phase: payload.phase,
 				...typeof payload?.title === "string" ? { title: payload.title } : {},
@@ -1963,7 +1922,7 @@ function createMSTeamsReplyDispatcher(params) {
 		},
 		onCommandOutput: async (payload) => {
 			if (payload?.phase !== "end") return;
-			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLine)({
 				event: "command-output",
 				...typeof payload?.itemId === "string" ? { itemId: payload.itemId } : {},
 				...typeof payload?.toolCallId === "string" ? { toolCallId: payload.toolCallId } : {},
@@ -1976,7 +1935,7 @@ function createMSTeamsReplyDispatcher(params) {
 		},
 		onPatchSummary: async (payload) => {
 			if (payload?.phase !== "end") return;
-			await streamController.pushProgressLine(buildChannelProgressDraftLine({
+			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLine)({
 				event: "patch",
 				...typeof payload?.itemId === "string" ? { itemId: payload.itemId } : {},
 				...typeof payload?.toolCallId === "string" ? { toolCallId: payload.toolCallId } : {},
@@ -2005,17 +1964,17 @@ function createMSTeamsReplyDispatcher(params) {
 }
 //#endregion
 //#region extensions/msteams/src/sent-message-cache.ts
-const sentMessages = createPersistentDedupeCache({
+const sentMessages = (0, openclaw_plugin_sdk_dedupe_runtime.createPersistentDedupeCache)({
 	globalKey: Symbol.for("openclaw.msteamsSentMessages"),
 	ttlMs: 1440 * 60 * 1e3,
 	maxSize: 2e4,
 	persistent: {
 		namespace: "msteams.sent-messages",
 		maxEntries: 1e3,
-		openStore: (options) => getOptionalMSTeamsRuntime()?.state.openKeyedStore(options),
+		openStore: (options) => require_runtime.getOptionalMSTeamsRuntime()?.state.openKeyedStore(options),
 		logError: (error) => {
 			try {
-				getOptionalMSTeamsRuntime()?.logging.getChildLogger({
+				require_runtime.getOptionalMSTeamsRuntime()?.logging.getChildLogger({
 					plugin: "msteams",
 					feature: "sent-message-state"
 				}).warn("Microsoft Teams persistent sent-message state failed", { error: String(error) });
@@ -2037,18 +1996,50 @@ async function wasMSTeamsMessageSentWithPersistence(params) {
 	return await sentMessages.lookup(makeKey(params.conversationId, params.messageId));
 }
 //#endregion
+//#region extensions/msteams/src/team-identity.ts
+const teamGroupIdCache = /* @__PURE__ */ new Map();
+const TEAM_GROUP_ID_CACHE_MAX_ENTRIES = 500;
+function cacheTeamGroupId(conversationTeamId, groupId) {
+	teamGroupIdCache.set(conversationTeamId, groupId);
+	(0, openclaw_plugin_sdk_collection_runtime.pruneMapToMaxSize)(teamGroupIdCache, TEAM_GROUP_ID_CACHE_MAX_ENTRIES);
+}
+/** Resolve the Graph team GUID without ever treating a Bot Framework team ID as equivalent. */
+async function resolveTeamGroupId(params) {
+	const activityGroupId = params.aadGroupId?.trim();
+	if (activityGroupId) {
+		cacheTeamGroupId(params.conversationTeamId, activityGroupId);
+		return activityGroupId;
+	}
+	const cached = teamGroupIdCache.get(params.conversationTeamId);
+	if (cached) return cached;
+	const getTeamDetails = params.getTeamDetails;
+	if (!getTeamDetails) return;
+	const groupId = (await require_resolve_allowlist.withMSTeamsRequestDeadline({
+		deadline: params.deadline,
+		label: "MS Teams team details",
+		work: () => getTeamDetails(params.conversationTeamId)
+	})).aadGroupId?.trim();
+	if (!groupId) return;
+	cacheTeamGroupId(params.conversationTeamId, groupId);
+	return groupId;
+}
+//#endregion
 //#region extensions/msteams/src/monitor-handler/inbound-media.ts
+function shouldAttemptMSTeamsGraphMediaFallback(params) {
+	const conversationType = params.conversationType.trim().toLowerCase();
+	return params.graphMediaFallback === true && (conversationType === "channel" || conversationType === "groupchat") && (params.htmlSummary?.htmlAttachments ?? 0) > 0;
+}
 function resolveMSTeamsInboundMediaBody(params) {
 	const unavailableCount = Math.max(0, params.expectedMediaCount - params.mediaCount);
 	if (unavailableCount === 0) return params.body;
-	return formatInboundMediaUnavailableText({
+	return (0, openclaw_plugin_sdk_channel_inbound.formatInboundMediaUnavailableText)({
 		body: params.mediaCount > 0 && params.body === params.mediaPlaceholder ? params.materializedMediaPlaceholder : params.body,
 		mediaPlaceholder: params.mediaCount === 0 ? params.mediaPlaceholder : void 0,
 		notice: `[msteams ${unavailableCount > 1 ? `${unavailableCount} attachments` : "attachment"} unavailable]`
 	});
 }
 async function resolveMSTeamsInboundMedia(params) {
-	const { attachments, htmlSummary, maxBytes, tokenProvider, allowHosts, conversationType, conversationId, conversationMessageId, serviceUrl, activity, log, preserveFilenames } = params;
+	const { attachments, htmlSummary, maxBytes, tokenProvider, allowHosts, conversationType, conversationId, conversationMessageId, teamAadGroupId, serviceUrl, activity, log, preserveFilenames } = params;
 	let mediaList = await downloadMSTeamsAttachments({
 		attachments,
 		maxBytes,
@@ -2056,12 +2047,20 @@ async function resolveMSTeamsInboundMedia(params) {
 		allowHosts,
 		authAllowHosts: params.authAllowHosts,
 		preserveFilenames,
+		deadline: params.deadline,
 		logger: log
 	});
 	if (mediaList.length === 0) {
 		const attachmentIds = extractMSTeamsHtmlAttachmentIds(attachments);
 		const hasHtmlFileAttachment = attachmentIds.length > 0;
-		if (hasHtmlFileAttachment && isBotFrameworkPersonalChatId(conversationId)) if (!serviceUrl) log.debug?.("bot framework attachment skipped (missing serviceUrl)", {
+		const hasChannelOrGroupHtml = shouldAttemptMSTeamsGraphMediaFallback({
+			conversationType,
+			htmlSummary,
+			graphMediaFallback: params.graphMediaFallback
+		});
+		const shouldFetchGraphMessage = hasHtmlFileAttachment || hasChannelOrGroupHtml;
+		const isBotFrameworkPersonalChat = isBotFrameworkPersonalChatId(conversationId);
+		if (hasHtmlFileAttachment && isBotFrameworkPersonalChat) if (!serviceUrl) log.debug?.("bot framework attachment skipped (missing serviceUrl)", {
 			conversationType,
 			conversationId
 		});
@@ -2073,7 +2072,8 @@ async function resolveMSTeamsInboundMedia(params) {
 				maxBytes,
 				allowHosts,
 				authAllowHosts: params.authAllowHosts,
-				preserveFilenames
+				preserveFilenames,
+				deadline: params.deadline
 			});
 			if (bfMedia.media.length > 0) mediaList = bfMedia.media;
 			else log.debug?.("bot framework attachments fetch empty", {
@@ -2081,50 +2081,41 @@ async function resolveMSTeamsInboundMedia(params) {
 				attachmentCount: bfMedia.attachmentCount ?? attachmentIds.length
 			});
 		}
-		if (hasHtmlFileAttachment && mediaList.length === 0 && !isBotFrameworkPersonalChatId(conversationId)) {
-			const messageUrls = buildMSTeamsGraphMessageUrls({
+		if (shouldFetchGraphMessage && mediaList.length === 0 && !isBotFrameworkPersonalChat) {
+			const graphTeamAadGroupId = conversationType.trim().toLowerCase() === "channel" && !teamAadGroupId ? await params.resolveTeamAadGroupId?.() : teamAadGroupId;
+			const messageUrl = buildMSTeamsGraphMessageUrl({
 				conversationType,
 				conversationId,
 				messageId: activity.id ?? void 0,
-				replyToId: activity.replyToId ?? void 0,
-				conversationMessageId,
-				channelData: activity.channelData
+				threadRootMessageId: conversationMessageId ?? activity.replyToId,
+				teamAadGroupId: graphTeamAadGroupId,
+				channelId: activity.channelData?.channel?.id
 			});
-			if (messageUrls.length === 0) log.debug?.("graph message url unavailable", {
+			if (!messageUrl) log.debug?.("graph message url unavailable", {
 				conversationType,
 				hasChannelData: Boolean(activity.channelData),
 				messageId: activity.id ?? void 0,
 				replyToId: activity.replyToId ?? void 0
 			});
 			else {
-				const attempts = [];
-				for (const messageUrl of messageUrls) {
-					const graphMedia = await downloadMSTeamsGraphMedia({
-						messageUrl,
-						tokenProvider,
-						maxBytes,
-						allowHosts,
-						authAllowHosts: params.authAllowHosts,
-						preserveFilenames,
-						log,
-						logger: log
-					});
-					attempts.push({
-						url: messageUrl,
-						hostedStatus: graphMedia.hostedStatus,
-						attachmentStatus: graphMedia.attachmentStatus,
-						hostedCount: graphMedia.hostedCount,
-						attachmentCount: graphMedia.attachmentCount,
-						tokenError: graphMedia.tokenError
-					});
-					if (graphMedia.media.length > 0) {
-						mediaList = graphMedia.media;
-						break;
-					}
-					if (graphMedia.tokenError) break;
-				}
+				const graphMedia = await downloadMSTeamsGraphMedia({
+					messageUrl,
+					tokenProvider,
+					maxBytes,
+					allowHosts,
+					authAllowHosts: params.authAllowHosts,
+					preserveFilenames,
+					deadline: params.deadline,
+					logger: log
+				});
+				if (graphMedia.media.length > 0) mediaList = graphMedia.media;
 				if (mediaList.length === 0) log.debug?.("graph media fetch empty", {
-					attempts,
+					messageUrl,
+					hostedStatus: graphMedia.hostedStatus,
+					attachmentStatus: graphMedia.attachmentStatus,
+					hostedCount: graphMedia.hostedCount,
+					attachmentCount: graphMedia.attachmentCount,
+					tokenError: graphMedia.tokenError,
 					attachmentIdCount: attachmentIds.length
 				});
 			}
@@ -2143,9 +2134,7 @@ async function resolveMSTeamsInboundMedia(params) {
 //#region extensions/msteams/src/monitor-handler/message-handler.ts
 function extractTextFromHtmlAttachments(attachments) {
 	for (const attachment of attachments) {
-		if (attachment.contentType !== "text/html") continue;
-		const content = attachment.content;
-		const raw = typeof content === "string" ? content : isRecord$1(content) && typeof content.text === "string" ? content.text : isRecord$1(content) && typeof content.body === "string" ? content.body : "";
+		const raw = require_resolve_allowlist.extractHtmlFromAttachment(attachment);
 		if (!raw) continue;
 		const text = raw.replace(/<at[^>]*>.*?<\/at>/gis, " ").replace(/<a\b[^>]*href=["']([^"']+)["'][^>]*>(.*?)<\/a>/gis, "$2 $1").replace(/<br\s*\/?>/gi, "\n").replace(/<\/p>/gi, "\n").replace(/<[^>]+>/g, " ").replace(/&nbsp;/gi, " ").replace(/&amp;/gi, "&").replace(/\s+/g, " ").trim();
 		if (text) return text;
@@ -2176,7 +2165,7 @@ function buildStoredConversationReference(params) {
 	const clientInfo = activity.entities?.find((e) => e.type === "clientInfo");
 	const tenantId = activity.channelData?.tenant?.id ?? conversation?.tenantId;
 	const aadObjectId = from?.aadObjectId;
-	const serviceUrl = tryNormalizeBotFrameworkServiceUrl(activity.serviceUrl);
+	const serviceUrl = require_resolve_allowlist.tryNormalizeBotFrameworkServiceUrl(activity.serviceUrl);
 	return {
 		activityId: activity.id,
 		user: from ? {
@@ -2185,10 +2174,6 @@ function buildStoredConversationReference(params) {
 			aadObjectId: from.aadObjectId
 		} : void 0,
 		agent,
-		bot: agent ? {
-			id: agent.id,
-			name: agent.name
-		} : void 0,
 		conversation: {
 			id: conversationId,
 			conversationType,
@@ -2206,16 +2191,16 @@ function buildStoredConversationReference(params) {
 }
 function createMSTeamsMessageHandler(deps) {
 	const { cfg, runtime, appId, app, tokenProvider, textLimit, mediaMaxBytes, conversationStore, pollStore, log } = deps;
-	const core = getMSTeamsRuntime();
+	const core = require_runtime.getMSTeamsRuntime();
 	const logVerboseMessage = (message) => {
 		if (core.logging.shouldLogVerbose()) log.debug?.(message);
 	};
 	const msteamsCfg = cfg.channels?.msteams;
-	const contextVisibilityMode = resolveChannelContextVisibilityMode({
+	const contextVisibilityMode = (0, openclaw_plugin_sdk_context_visibility_runtime.resolveChannelContextVisibilityMode)({
 		cfg,
 		channel: "msteams"
 	});
-	const historyLimit = Math.max(0, msteamsCfg?.historyLimit ?? cfg.messages?.groupChat?.historyLimit ?? DEFAULT_GROUP_HISTORY_LIMIT);
+	const historyLimit = Math.max(0, msteamsCfg?.historyLimit ?? cfg.messages?.groupChat?.historyLimit ?? openclaw_plugin_sdk_reply_history.DEFAULT_GROUP_HISTORY_LIMIT);
 	const conversationHistories = /* @__PURE__ */ new Map();
 	const inboundDebounceMs = core.channel.debounce.resolveInboundDebounceMs({
 		cfg,
@@ -2233,7 +2218,7 @@ function createMSTeamsMessageHandler(deps) {
 		});
 		const attachmentPlaceholder = attachmentPresentation.placeholder;
 		const rawBody = text || attachmentPlaceholder;
-		const quoteInfo = extractMSTeamsQuoteInfo(attachments);
+		const quoteInfo = require_channel.extractMSTeamsQuoteInfo(attachments);
 		let quoteSenderId;
 		let quoteSenderName;
 		const from = activity.from;
@@ -2241,8 +2226,8 @@ function createMSTeamsMessageHandler(deps) {
 		const attachmentTypes = attachments.map((att) => typeof att.contentType === "string" ? att.contentType : void 0).filter(Boolean).slice(0, 3);
 		const htmlSummary = summarizeMSTeamsHtmlAttachments(attachments);
 		log.info("received message", {
-			rawText: truncateUtf16Safe(rawText, 50),
-			text: truncateUtf16Safe(text, 50),
+			rawText: (0, openclaw_plugin_sdk_text_utility_runtime.truncateUtf16Safe)(rawText, 50),
+			text: (0, openclaw_plugin_sdk_text_utility_runtime.truncateUtf16Safe)(text, 50),
 			attachments: attachments.length,
 			attachmentTypes,
 			from: from?.id,
@@ -2254,10 +2239,11 @@ function createMSTeamsMessageHandler(deps) {
 			return;
 		}
 		const rawConversationId = conversation?.id ?? "";
-		const conversationId = normalizeMSTeamsConversationId(rawConversationId);
-		const conversationMessageId = extractMSTeamsConversationMessageId(rawConversationId);
+		const conversationId = require_channel.normalizeMSTeamsConversationId(rawConversationId);
+		const conversationMessageId = require_channel.extractMSTeamsConversationMessageId(rawConversationId);
 		const conversationType = conversation?.conversationType ?? "personal";
 		const teamId = activity.channelData?.team?.id;
+		const graphChannelId = activity.channelData?.channel?.id?.trim() || conversationId;
 		const conversationRef = buildStoredConversationReference({
 			activity,
 			conversationId,
@@ -2288,7 +2274,7 @@ function createMSTeamsMessageHandler(deps) {
 				log.debug?.("dropping dm (dms disabled)");
 				return;
 			}
-			const allowMatch = resolveMSTeamsAllowlistMatch({
+			const allowMatch = require_channel.resolveMSTeamsAllowlistMatch({
 				allowFrom: effectiveDmAllowFrom,
 				senderId,
 				senderName,
@@ -2296,7 +2282,7 @@ function createMSTeamsMessageHandler(deps) {
 			});
 			if (senderAccess.decision === "pairing") {
 				conversationStore.upsert(conversationId, conversationRef).catch((err) => {
-					log.debug?.("failed to save conversation reference", { error: formatUnknownError(err) });
+					log.debug?.("failed to save conversation reference", { error: require_setup_surface.formatUnknownError(err) });
 				});
 				if (await pairing.upsertPairingRequest({
 					id: senderId,
@@ -2309,7 +2295,7 @@ function createMSTeamsMessageHandler(deps) {
 			log.debug?.("dropping dm (not allowlisted)", {
 				sender: senderId,
 				label: senderName,
-				allowlistMatch: formatAllowlistMatchMeta(allowMatch)
+				allowlistMatch: (0, openclaw_plugin_sdk_allow_from.formatAllowlistMatchMeta)(allowMatch)
 			});
 			log.info("dropping dm (not allowlisted)", {
 				sender: senderId,
@@ -2320,7 +2306,7 @@ function createMSTeamsMessageHandler(deps) {
 					dmPolicy,
 					groupPolicy
 				}),
-				allowlistMatch: formatAllowlistMatchMeta(allowMatch)
+				allowlistMatch: (0, openclaw_plugin_sdk_allow_from.formatAllowlistMatchMeta)(allowMatch)
 			});
 			return;
 		}
@@ -2353,7 +2339,7 @@ function createMSTeamsMessageHandler(deps) {
 				return;
 			}
 			if (!senderAccess.allowed && senderAccess.reasonCode === "group_policy_not_allowlisted") {
-				const allowMatch = resolveMSTeamsAllowlistMatch({
+				const allowMatch = require_channel.resolveMSTeamsAllowlistMatch({
 					allowFrom: effectiveGroupAllowFrom,
 					senderId,
 					senderName,
@@ -2362,18 +2348,18 @@ function createMSTeamsMessageHandler(deps) {
 				log.debug?.("dropping group message (not in groupAllowFrom)", {
 					sender: senderId,
 					label: senderName,
-					allowlistMatch: formatAllowlistMatchMeta(allowMatch)
+					allowlistMatch: (0, openclaw_plugin_sdk_allow_from.formatAllowlistMatchMeta)(allowMatch)
 				});
 				log.info("dropping group message (not in groupAllowFrom)", {
 					sender: senderId,
 					label: senderName,
-					allowlistMatch: formatAllowlistMatchMeta(allowMatch)
+					allowlistMatch: (0, openclaw_plugin_sdk_allow_from.formatAllowlistMatchMeta)(allowMatch)
 				});
 				return;
 			}
 		}
 		if (commandAccess.shouldBlockControlCommand) {
-			logInboundDrop({
+			(0, openclaw_plugin_sdk_channel_inbound.logInboundDrop)({
 				log: logVerboseMessage,
 				channel: "msteams",
 				reason: "control command (unauthorized)",
@@ -2382,9 +2368,9 @@ function createMSTeamsMessageHandler(deps) {
 			return;
 		}
 		conversationStore.upsert(conversationId, conversationRef).catch((err) => {
-			log.debug?.("failed to save conversation reference", { error: formatUnknownError(err) });
+			log.debug?.("failed to save conversation reference", { error: require_setup_surface.formatUnknownError(err) });
 		});
-		const pollVote = extractMSTeamsPollVote(activity);
+		const pollVote = require_polls.extractMSTeamsPollVote(activity);
 		if (pollVote) {
 			try {
 				if (!await pollStore.recordVote({
@@ -2400,12 +2386,17 @@ function createMSTeamsMessageHandler(deps) {
 			} catch (err) {
 				log.error("failed to record poll vote", {
 					pollId: pollVote.pollId,
-					error: formatUnknownError(err)
+					error: require_setup_surface.formatUnknownError(err)
 				});
 			}
 			return;
 		}
-		if (!rawBody) {
+		const mayRecoverGraphMedia = Boolean(htmlSummary?.attachmentIds.length) || shouldAttemptMSTeamsGraphMediaFallback({
+			conversationType,
+			htmlSummary: htmlSummary ?? void 0,
+			graphMediaFallback: msteamsCfg?.graphMediaFallback
+		});
+		if (!rawBody && !mayRecoverGraphMedia) {
 			log.debug?.("skipping empty message after stripping mentions");
 			return;
 		}
@@ -2420,13 +2411,13 @@ function createMSTeamsMessageHandler(deps) {
 				id: isDirectMessage ? senderId : conversationId
 			}
 		});
-		route.sessionKey = resolveMSTeamsRouteSessionKey({
+		route.sessionKey = require_channel.resolveMSTeamsRouteSessionKey({
 			baseSessionKey: route.sessionKey,
 			isChannel,
 			conversationMessageId,
 			replyToId: activity.replyToId
 		});
-		const preview = sliceUtf16Safe(rawBody.replace(/\s+/g, " "), 0, 160);
+		const preview = (0, openclaw_plugin_sdk_text_utility_runtime.sliceUtf16Safe)(rawBody.replace(/\s+/g, " "), 0, 160);
 		const inboundLabel = isDirectMessage ? `Teams DM from ${senderName}` : `Teams message in ${conversationType} from ${senderName}`;
 		const enqueuePrimaryMessageSystemEvent = () => core.system.enqueueSystemEvent(inboundLabel, {
 			sessionKey: route.sessionKey,
@@ -2434,14 +2425,14 @@ function createMSTeamsMessageHandler(deps) {
 		});
 		const channelId = conversationId;
 		const { teamConfig, channelConfig } = channelGate;
-		const { requireMention, replyStyle } = resolveMSTeamsReplyPolicy({
+		const { requireMention, replyStyle } = require_channel.resolveMSTeamsReplyPolicy({
 			isDirectMessage,
 			globalConfig: msteamsCfg,
 			teamConfig,
 			channelConfig
 		});
-		const timestamp = parseMSTeamsActivityTimestamp(activity.timestamp);
-		const mentionDecision = resolveInboundMentionDecision({
+		const timestamp = require_channel.parseMSTeamsActivityTimestamp(activity.timestamp);
+		const mentionDecision = (0, openclaw_plugin_sdk_channel_inbound.resolveInboundMentionDecision)({
 			facts: {
 				canDetectMention: true,
 				wasMentioned: params.wasMentioned,
@@ -2464,124 +2455,163 @@ function createMSTeamsMessageHandler(deps) {
 					requireMention,
 					mentioned
 				});
-				enqueuePrimaryMessageSystemEvent();
-				createChannelHistoryWindow({ historyMap: conversationHistories }).record({
-					historyKey: conversationId,
-					limit: historyLimit,
-					entry: {
-						sender: senderName,
-						body: rawBody,
-						timestamp: timestamp?.getTime(),
-						messageId: activity.id ?? void 0
-					}
-				});
+				if (rawBody) {
+					enqueuePrimaryMessageSystemEvent();
+					(0, openclaw_plugin_sdk_reply_history.createChannelHistoryWindow)({ historyMap: conversationHistories }).record({
+						historyKey: conversationId,
+						limit: historyLimit,
+						entry: {
+							sender: senderName,
+							body: rawBody,
+							timestamp: timestamp?.getTime(),
+							messageId: activity.id ?? void 0
+						}
+					});
+				}
 				return;
 			}
 		}
-		enqueuePrimaryMessageSystemEvent();
-		let graphConversationId = translateMSTeamsDmConversationIdForGraph({
-			isDirectMessage,
-			conversationId,
-			aadObjectId: from.aadObjectId,
-			appId
-		});
-		if (isDirectMessage && conversationId.startsWith("a:")) {
-			const cached = await conversationStore.get(conversationId);
-			if (cached?.graphChatId) graphConversationId = cached.graphChatId;
-			else try {
-				const resolved = await resolveGraphChatId({
-					botFrameworkConversationId: conversationId,
-					userAadObjectId: from.aadObjectId ?? void 0,
-					tokenProvider
+		const preprocessingDeadline = require_resolve_allowlist.createMSTeamsInboundDeadline();
+		let teamAadGroupId = activity.channelData?.team?.aadGroupId?.trim() || void 0;
+		const conversationTeamId = isChannel ? teamId : void 0;
+		let teamGroupIdPromise;
+		const resolveChannelTeamGroupId = async () => {
+			if (!conversationTeamId) return;
+			teamGroupIdPromise ??= resolveTeamGroupId({
+				conversationTeamId,
+				aadGroupId: teamAadGroupId,
+				getTeamDetails: context.getTeamDetails,
+				deadline: preprocessingDeadline
+			}).catch((err) => {
+				log.debug?.("failed to resolve Teams AAD group ID", {
+					teamId: conversationTeamId,
+					error: require_setup_surface.formatUnknownError(err)
 				});
-				if (resolved) {
-					graphConversationId = resolved;
-					conversationStore.upsert(conversationId, {
-						...conversationRef,
-						graphChatId: resolved
-					}).catch(() => {});
-				}
-			} catch {
-				log.debug?.("failed to resolve Graph chat ID for inbound media", { conversationId });
-			}
+			});
+			teamAadGroupId = await teamGroupIdPromise;
+			return teamAadGroupId;
+		};
+		let mediaList = [];
+		try {
+			mediaList = await require_resolve_allowlist.withMSTeamsRequestDeadline({
+				deadline: preprocessingDeadline,
+				label: "MS Teams inbound media",
+				work: () => resolveMSTeamsInboundMedia({
+					attachments,
+					htmlSummary: htmlSummary ?? void 0,
+					maxBytes: mediaMaxBytes,
+					tokenProvider,
+					allowHosts: msteamsCfg?.mediaAllowHosts,
+					authAllowHosts: msteamsCfg?.mediaAuthAllowHosts,
+					graphMediaFallback: msteamsCfg?.graphMediaFallback,
+					conversationType,
+					conversationId,
+					conversationMessageId: conversationMessageId ?? void 0,
+					teamAadGroupId,
+					resolveTeamAadGroupId: resolveChannelTeamGroupId,
+					serviceUrl: activity.serviceUrl,
+					activity: {
+						id: activity.id,
+						replyToId: activity.replyToId,
+						channelData: activity.channelData
+					},
+					log,
+					deadline: preprocessingDeadline,
+					preserveFilenames: cfg.media?.preserveFilenames
+				})
+			});
+		} catch (err) {
+			log.debug?.("failed to resolve inbound Teams media", { error: require_setup_surface.formatUnknownError(err) });
 		}
-		const mediaList = await resolveMSTeamsInboundMedia({
-			attachments,
-			htmlSummary: htmlSummary ?? void 0,
-			maxBytes: mediaMaxBytes,
-			tokenProvider,
-			allowHosts: msteamsCfg?.mediaAllowHosts,
-			authAllowHosts: msteamsCfg?.mediaAuthAllowHosts,
-			conversationType,
-			conversationId: graphConversationId,
-			conversationMessageId: conversationMessageId ?? void 0,
-			serviceUrl: activity.serviceUrl,
-			activity: {
-				id: activity.id,
-				replyToId: activity.replyToId,
-				channelData: activity.channelData
-			},
-			log,
-			preserveFilenames: cfg.media?.preserveFilenames
-		});
 		const mediaPayload = buildMSTeamsMediaPayload(mediaList);
 		const materializedMediaPlaceholder = resolveMSTeamsInboundAttachmentPresentation(mediaList.map((media) => ({
 			contentType: media.contentType,
 			name: media.path
 		}))).placeholder;
 		const agentBody = resolveMSTeamsInboundMediaBody({
-			body: rawBody,
+			body: rawBody || materializedMediaPlaceholder,
 			mediaPlaceholder: attachmentPlaceholder,
 			materializedMediaPlaceholder,
 			expectedMediaCount: attachmentPresentation.expectedMediaCount,
 			mediaCount: mediaList.length
 		});
+		if (!agentBody) {
+			log.debug?.("skipping empty message after Graph media recovery");
+			return;
+		}
+		enqueuePrimaryMessageSystemEvent();
+		teamAadGroupId = await resolveChannelTeamGroupId();
+		let quoteBodyFull;
+		const quoteMessageId = quoteInfo?.id;
+		if (quoteMessageId && isDirectMessage && conversationId.startsWith("19:")) try {
+			const graphToken = await require_resolve_allowlist.withMSTeamsRequestDeadline({
+				deadline: preprocessingDeadline,
+				label: "MS Teams quote token",
+				work: () => tokenProvider.getAccessToken("https://graph.microsoft.com")
+			});
+			quoteBodyFull = await require_resolve_allowlist.withMSTeamsRequestDeadline({
+				deadline: preprocessingDeadline,
+				label: "MS Teams quote lookup",
+				work: () => require_messenger.fetchChatMessageText(graphToken, conversationId, quoteMessageId, preprocessingDeadline)
+			});
+		} catch (err) {
+			log.debug?.("failed to fetch full quoted message text", { error: require_setup_surface.formatUnknownError(err) });
+		}
 		let threadContext;
-		if (activity.replyToId && isChannel && teamId) try {
-			const graphToken = await tokenProvider.getAccessToken("https://graph.microsoft.com");
-			const groupId = await resolveTeamGroupId(graphToken, teamId);
-			const [parentResult, repliesResult] = await Promise.allSettled([fetchParentMessageCached(graphToken, groupId, conversationId, activity.replyToId), fetchThreadReplies(graphToken, groupId, conversationId, activity.replyToId)]);
+		const threadParentId = activity.replyToId;
+		const channelGroupId = teamAadGroupId;
+		if (threadParentId && isChannel && channelGroupId) try {
+			const graphToken = await require_resolve_allowlist.withMSTeamsRequestDeadline({
+				deadline: preprocessingDeadline,
+				label: "MS Teams thread token",
+				work: () => tokenProvider.getAccessToken("https://graph.microsoft.com")
+			});
+			const [parentResult, repliesResult] = await require_resolve_allowlist.withMSTeamsRequestDeadline({
+				deadline: preprocessingDeadline,
+				label: "MS Teams thread history",
+				work: () => Promise.allSettled([fetchParentMessageCached(graphToken, channelGroupId, conversationId, threadParentId, (token, groupId, requestedChannelId, messageId) => require_messenger.fetchChannelMessage(token, groupId, requestedChannelId, messageId, preprocessingDeadline)), require_messenger.fetchThreadReplies(graphToken, channelGroupId, conversationId, threadParentId, 50, preprocessingDeadline)])
+			});
 			const parentMsg = parentResult.status === "fulfilled" ? parentResult.value : void 0;
 			const replies = repliesResult.status === "fulfilled" ? repliesResult.value : [];
-			if (parentResult.status === "rejected") log.debug?.("failed to fetch parent message", { error: formatUnknownError(parentResult.reason) });
-			if (repliesResult.status === "rejected") log.debug?.("failed to fetch thread replies", { error: formatUnknownError(repliesResult.reason) });
-			const isThreadSenderAllowed = (msg) => groupPolicy === "allowlist" ? resolveMSTeamsAllowlistMatch({
+			if (parentResult.status === "rejected") log.debug?.("failed to fetch parent message", { error: require_setup_surface.formatUnknownError(parentResult.reason) });
+			if (repliesResult.status === "rejected") log.debug?.("failed to fetch thread replies", { error: require_setup_surface.formatUnknownError(repliesResult.reason) });
+			const isThreadSenderAllowed = (msg) => groupPolicy === "allowlist" ? require_channel.resolveMSTeamsAllowlistMatch({
 				allowFrom: effectiveGroupAllowFrom,
 				senderId: msg.from?.user?.id ?? "",
 				senderName: msg.from?.user?.displayName,
 				allowNameMatching
 			}).allowed : true;
 			const parentSummary = summarizeParentMessage(parentMsg);
-			const visibleParentMessages = parentMsg ? filterSupplementalContextItems({
+			const visibleParentMessages = parentMsg ? (0, openclaw_plugin_sdk_context_visibility_runtime.filterSupplementalContextItems)({
 				items: [parentMsg],
 				mode: contextVisibilityMode,
 				kind: "thread",
 				isSenderAllowed: isThreadSenderAllowed
 			}).items : [];
-			if (parentSummary && visibleParentMessages.length > 0 && shouldInjectParentContext(route.sessionKey, activity.replyToId)) {
+			if (parentSummary && visibleParentMessages.length > 0 && shouldInjectParentContext(route.sessionKey, threadParentId)) {
 				core.system.enqueueSystemEvent(formatParentContextEvent(parentSummary), {
 					sessionKey: route.sessionKey,
-					contextKey: `msteams:thread-parent:${conversationId}:${activity.replyToId}`
+					contextKey: `msteams:thread-parent:${conversationId}:${threadParentId}`
 				});
-				markParentContextInjected(route.sessionKey, activity.replyToId);
+				markParentContextInjected(route.sessionKey, threadParentId);
 			}
 			const allMessages = parentMsg ? [parentMsg, ...replies] : replies;
 			quoteSenderId = parentMsg?.from?.user?.id ?? parentMsg?.from?.application?.id ?? void 0;
 			quoteSenderName = parentMsg?.from?.user?.displayName ?? parentMsg?.from?.application?.displayName ?? quoteInfo?.sender;
-			const { items: threadMessages } = filterSupplementalContextItems({
+			const { items: threadMessages } = (0, openclaw_plugin_sdk_context_visibility_runtime.filterSupplementalContextItems)({
 				items: allMessages,
 				mode: contextVisibilityMode,
 				kind: "thread",
 				isSenderAllowed: isThreadSenderAllowed
 			});
-			const formatted = formatThreadContext(threadMessages, activity.id);
+			const formatted = require_messenger.formatThreadContext(threadMessages, activity.id);
 			if (formatted) threadContext = formatted;
 		} catch (err) {
-			log.debug?.("failed to fetch thread history", { error: formatUnknownError(err) });
+			log.debug?.("failed to fetch thread history", { error: require_setup_surface.formatUnknownError(err) });
 		}
 		quoteSenderName ??= quoteInfo?.sender;
 		const envelopeFrom = isDirectMessage ? senderName : conversationType;
-		const { storePath, envelopeOptions, previousTimestamp } = resolveInboundSessionEnvelopeContext({
+		const { storePath, envelopeOptions, previousTimestamp } = (0, openclaw_plugin_sdk_channel_inbound.resolveInboundSessionEnvelopeContext)({
 			cfg,
 			agentId: route.agentId,
 			sessionKey: route.sessionKey
@@ -2596,7 +2626,7 @@ function createMSTeamsMessageHandler(deps) {
 		});
 		const isRoomish = !isDirectMessage;
 		const historyKey = isRoomish ? conversationId : void 0;
-		if (isRoomish && historyKey) combinedBody = createChannelHistoryWindow({ historyMap: conversationHistories }).buildPendingContext({
+		if (isRoomish && historyKey) combinedBody = (0, openclaw_plugin_sdk_reply_history.createChannelHistoryWindow)({ historyMap: conversationHistories }).buildPendingContext({
 			historyKey,
 			limit: historyLimit,
 			currentMessage: combinedBody,
@@ -2608,26 +2638,26 @@ function createMSTeamsMessageHandler(deps) {
 				envelope: envelopeOptions
 			})
 		});
-		const inboundHistory = isRoomish && historyKey && historyLimit > 0 ? createChannelHistoryWindow({ historyMap: conversationHistories }).buildInboundHistory({
+		const inboundHistory = isRoomish && historyKey && historyLimit > 0 ? (0, openclaw_plugin_sdk_reply_history.createChannelHistoryWindow)({ historyMap: conversationHistories }).buildInboundHistory({
 			historyKey,
 			limit: historyLimit
 		}) : void 0;
 		const commandBody = text.trim();
-		const quoteSenderAllowed = quoteInfo && quoteInfo.sender ? !isChannel || groupPolicy !== "allowlist" ? true : resolveMSTeamsAllowlistMatch({
+		const quoteSenderAllowed = quoteInfo && quoteInfo.sender ? !isChannel || groupPolicy !== "allowlist" ? true : require_channel.resolveMSTeamsAllowlistMatch({
 			allowFrom: effectiveGroupAllowFrom,
 			senderId: quoteSenderId ?? "",
 			senderName: quoteSenderName,
 			allowNameMatching
 		}).allowed : true;
 		const bodyForAgent = threadContext ? `[Thread history]\n${threadContext}\n[/Thread history]\n\n${agentBody}` : agentBody;
-		const nativeChannelId = isChannel && teamId ? `${teamId}/${conversationId}` : void 0;
-		const ctxPayload = buildChannelInboundEventContext({
+		const nativeChannelId = isChannel && teamAadGroupId ? `${teamAadGroupId}/${graphChannelId}` : void 0;
+		const ctxPayload = (0, openclaw_plugin_sdk_channel_inbound.buildChannelInboundEventContext)({
 			channel: "msteams",
 			finalize: core.channel.reply.finalizeInboundContext,
 			contextVisibility: contextVisibilityMode,
 			supplemental: { quote: quoteInfo ? {
-				id: activity.replyToId ?? void 0,
-				body: quoteInfo.body,
+				id: quoteInfo.id ?? activity.replyToId ?? void 0,
+				body: quoteBodyFull ?? quoteInfo.body,
 				sender: quoteInfo.sender,
 				senderAllowed: quoteSenderAllowed,
 				isQuote: true
@@ -2725,7 +2755,7 @@ function createMSTeamsMessageHandler(deps) {
 						ctxPayload,
 						recordInboundSession: core.channel.session.recordInboundSession,
 						record: { onRecordError: (err) => {
-							logVerboseMessage(`msteams: failed updating session meta: ${formatUnknownError(err)}`);
+							logVerboseMessage(`msteams: failed updating session meta: ${require_setup_surface.formatUnknownError(err)}`);
 						} },
 						history: {
 							isGroup: isRoomish,
@@ -2737,7 +2767,7 @@ function createMSTeamsMessageHandler(deps) {
 							dispatcher,
 							onSettled: () => markDispatchIdle()
 						}),
-						runDispatch: () => dispatchReplyFromConfigWithSettledDispatcher({
+						runDispatch: () => (0, openclaw_plugin_sdk_channel_inbound.dispatchReplyFromConfigWithSettledDispatcher)({
 							cfg,
 							ctxPayload,
 							dispatcher,
@@ -2750,8 +2780,8 @@ function createMSTeamsMessageHandler(deps) {
 			});
 			const dispatchResult = turnResult.dispatched ? turnResult.dispatchResult : void 0;
 			const queuedFinal = dispatchResult?.queuedFinal ?? false;
-			const counts = resolveInboundReplyDispatchCounts(dispatchResult);
-			const hasFinalResponse = hasFinalInboundReplyDispatch(dispatchResult);
+			const counts = (0, openclaw_plugin_sdk_channel_inbound.resolveInboundReplyDispatchCounts)(dispatchResult);
+			const hasFinalResponse = (0, openclaw_plugin_sdk_channel_inbound.hasFinalInboundReplyDispatch)(dispatchResult);
 			log.info("dispatch complete", {
 				queuedFinal,
 				counts
@@ -2760,8 +2790,8 @@ function createMSTeamsMessageHandler(deps) {
 			const finalCount = counts.final;
 			logVerboseMessage(`msteams: delivered ${finalCount} reply${finalCount === 1 ? "" : "ies"} to ${teamsTo}`);
 		} catch (err) {
-			log.error("dispatch failed", { error: formatUnknownError(err) });
-			runtime.error(`msteams dispatch failed: ${formatUnknownError(err)}`);
+			log.error("dispatch failed", { error: require_setup_surface.formatUnknownError(err) });
+			runtime.error(`msteams dispatch failed: ${require_setup_surface.formatUnknownError(err)}`);
 			try {
 				await context.sendActivity("⚠️ Something went wrong. Please try again.");
 			} catch {}
@@ -2770,7 +2800,7 @@ function createMSTeamsMessageHandler(deps) {
 	const inboundDebouncer = core.channel.debounce.createInboundDebouncer({
 		debounceMs: inboundDebounceMs,
 		buildKey: (entry) => {
-			const conversationId = normalizeMSTeamsConversationId(entry.context.activity.conversation?.id ?? "");
+			const conversationId = require_channel.normalizeMSTeamsConversationId(entry.context.activity.conversation?.id ?? "");
 			const senderId = entry.context.activity.from?.aadObjectId ?? entry.context.activity.from?.id ?? "";
 			if (!senderId || !conversationId) return null;
 			return `msteams:${appId}:${conversationId}:${senderId}`;
@@ -2802,7 +2832,7 @@ function createMSTeamsMessageHandler(deps) {
 			});
 		},
 		onError: (err) => {
-			runtime.error(`msteams debounce flush failed: ${formatUnknownError(err)}`);
+			runtime.error(`msteams debounce flush failed: ${require_setup_surface.formatUnknownError(err)}`);
 		}
 	});
 	return async function handleTeamsMessage(context) {
@@ -2811,9 +2841,9 @@ function createMSTeamsMessageHandler(deps) {
 		const rawText = activity.text?.trim() ?? "";
 		const htmlText = extractTextFromHtmlAttachments(attachments);
 		const valueText = rawText || htmlText ? "" : serializeMSTeamsAdaptiveCardActionValue(activity.value);
-		const text = stripMSTeamsMentionTags(rawText || htmlText || valueText || "");
-		const wasMentioned = wasMSTeamsBotMentioned(activity);
-		const conversationId = normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
+		const text = require_channel.stripMSTeamsMentionTags(rawText || htmlText || valueText || "");
+		const wasMentioned = require_channel.wasMSTeamsBotMentioned(activity);
+		const conversationId = require_channel.normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
 		const replyToId = activity.replyToId ?? void 0;
 		const implicitMentionKinds = conversationId && replyToId && await wasMSTeamsMessageSentWithPersistence({
 			conversationId,
@@ -2831,29 +2861,13 @@ function createMSTeamsMessageHandler(deps) {
 }
 //#endregion
 //#region extensions/msteams/src/monitor-handler/reaction-handler.ts
-/** Teams reaction type names → Unicode emoji. */
-const TEAMS_REACTION_EMOJI = {
-	like: "👍",
-	heart: "❤️",
-	laugh: "😆",
-	surprised: "😮",
-	sad: "😢",
-	angry: "😡"
-};
-/**
-* Map a Teams reaction type string to a Unicode emoji.
-* Falls back to the raw type if not recognized.
-*/
-function mapReactionEmoji(reactionType) {
-	return TEAMS_REACTION_EMOJI[reactionType] ?? reactionType;
-}
 /**
 * Create a handler for MS Teams reaction activities (reactionsAdded / reactionsRemoved).
 * The returned function accepts a turn context and a direction string.
 */
 function createMSTeamsReactionHandler(deps) {
 	const { cfg, log } = deps;
-	const core = getMSTeamsRuntime();
+	const core = require_runtime.getMSTeamsRuntime();
 	const msteamsCfg = cfg.channels?.msteams;
 	return async function handleReaction(context, direction) {
 		const activity = context.activity;
@@ -2867,7 +2881,7 @@ function createMSTeamsReactionHandler(deps) {
 			log.debug?.("reaction activity missing from.id; skipping");
 			return;
 		}
-		const conversationId = normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
+		const conversationId = require_channel.normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
 		const conversationType = activity.conversation?.conversationType ?? "personal";
 		const isGroupChat = conversationType === "groupChat" || activity.conversation?.isGroup === true;
 		const isChannel = conversationType === "channel";
@@ -2900,7 +2914,7 @@ function createMSTeamsReactionHandler(deps) {
 		const targetMessageId = activity.replyToId ?? "unknown";
 		for (const reaction of reactions) {
 			const reactionType = reaction.type ?? "unknown";
-			const emoji = mapReactionEmoji(reactionType);
+			const emoji = require_messenger.resolveMSTeamsReactionEmoji(reactionType);
 			const label = direction === "added" ? `Teams reaction ${emoji} added by ${senderName} on message ${targetMessageId}` : `Teams reaction ${emoji} removed by ${senderName} from message ${targetMessageId}`;
 			log.info(`reaction ${direction}`, {
 				sender: senderId,
@@ -3059,7 +3073,7 @@ function registerMSTeamsHandlers(handler, deps) {
 		try {
 			await handleTeamsMessage(context);
 		} catch (err) {
-			deps.runtime.error(`msteams handler failed: ${formatUnknownError(err)}`);
+			deps.runtime.error(`msteams handler failed: ${require_setup_surface.formatUnknownError(err)}`);
 		}
 		await next();
 	});
@@ -3069,7 +3083,7 @@ function registerMSTeamsHandlers(handler, deps) {
 		const botId = ctx.activity?.recipient?.id;
 		const msteamsCfg = deps.cfg.channels?.msteams;
 		for (const member of membersAdded) if (member.id === botId) {
-			const isPersonal = (normalizeOptionalLowercaseString(ctx.activity?.conversation?.conversationType) ?? "personal") === "personal";
+			const isPersonal = ((0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(ctx.activity?.conversation?.conversationType) ?? "personal") === "personal";
 			if (isPersonal && msteamsCfg?.welcomeCard !== false) {
 				const card = buildWelcomeCard({
 					botName: ctx.activity?.recipient?.name ?? void 0,
@@ -3085,7 +3099,7 @@ function registerMSTeamsHandlers(handler, deps) {
 					});
 					deps.log.info("sent welcome card");
 				} catch (err) {
-					deps.log.debug?.("failed to send welcome card", { error: formatUnknownError(err) });
+					deps.log.debug?.("failed to send welcome card", { error: require_setup_surface.formatUnknownError(err) });
 				}
 			} else if (!isPersonal && msteamsCfg?.groupWelcomeCard === true) {
 				const botName = ctx.activity?.recipient?.name ?? void 0;
@@ -3093,7 +3107,7 @@ function registerMSTeamsHandlers(handler, deps) {
 					await ctx.sendActivity(buildGroupWelcomeText(botName));
 					deps.log.info("sent group welcome message");
 				} catch (err) {
-					deps.log.debug?.("failed to send group welcome", { error: formatUnknownError(err) });
+					deps.log.debug?.("failed to send group welcome", { error: require_setup_surface.formatUnknownError(err) });
 				}
 			} else deps.log.debug?.("skipping welcome (disabled by config or conversation type)");
 		} else deps.log.debug?.("member added", { member: member.id });
@@ -3155,14 +3169,14 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 		userComment = JSON.parse(value.actionValue.feedback).feedbackText || void 0;
 	} catch {}
 	const rawConversationId = activity.conversation?.id ?? "unknown";
-	const conversationId = normalizeMSTeamsConversationId(rawConversationId);
+	const conversationId = require_channel.normalizeMSTeamsConversationId(rawConversationId);
 	const senderId = activity.from?.aadObjectId ?? activity.from?.id ?? "unknown";
 	const messageId = value.replyToId ?? activity.replyToId ?? "unknown";
 	const isNegative = reaction === "dislike";
-	const convType = normalizeOptionalLowercaseString(activity.conversation?.conversationType);
+	const convType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(activity.conversation?.conversationType);
 	const isDirectMessage = convType === "personal" || !convType && !activity.conversation?.isGroup;
 	const isChannel = convType === "channel";
-	const core = getMSTeamsRuntime();
+	const core = require_runtime.getMSTeamsRuntime();
 	const route = core.channel.routing.resolveAgentRoute({
 		cfg: deps.cfg,
 		channel: "msteams",
@@ -3171,8 +3185,8 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 			id: isDirectMessage ? senderId : conversationId
 		}
 	});
-	const feedbackThreadId = isChannel ? extractMSTeamsConversationMessageId(rawConversationId) ?? activity.replyToId ?? void 0 : void 0;
-	if (feedbackThreadId) route.sessionKey = resolveThreadSessionKeys({
+	const feedbackThreadId = isChannel ? require_channel.extractMSTeamsConversationMessageId(rawConversationId) ?? activity.replyToId ?? void 0 : void 0;
+	if (feedbackThreadId) route.sessionKey = (0, openclaw_plugin_sdk_routing.resolveThreadSessionKeys)({
 		baseSessionKey: route.sessionKey,
 		threadId: feedbackThreadId,
 		parentSessionKey: route.sessionKey
@@ -3194,8 +3208,8 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 	try {
 		const storePath = core.channel.session.resolveStorePath(deps.cfg.session?.store, { agentId: route.agentId });
 		const safeKey = route.sessionKey.replace(/[^a-zA-Z0-9_-]/g, "_");
-		await appendRegularFile({
-			filePath: path.join(storePath, `${safeKey}.jsonl`),
+		await (0, openclaw_plugin_sdk_security_runtime.appendRegularFile)({
+			filePath: node_path.default.join(storePath, `${safeKey}.jsonl`),
 			content: `${JSON.stringify(feedbackEvent)}\n`,
 			rejectSymlinkParents: true
 		}).catch(() => {});
@@ -3211,10 +3225,6 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 			id: activity.recipient.id,
 			name: activity.recipient.name
 		} : void 0,
-		bot: activity.recipient ? {
-			id: activity.recipient.id,
-			name: activity.recipient.name
-		} : void 0,
 		conversation: {
 			id: conversationId,
 			conversationType: activity.conversation?.conversationType,
@@ -3236,7 +3246,7 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 		userComment,
 		log: deps.log
 	}).catch((err) => {
-		deps.log.error("feedback reflection failed", { error: formatUnknownError(err) });
+		deps.log.error("feedback reflection failed", { error: require_setup_surface.formatUnknownError(err) });
 	});
 	return true;
 }
@@ -3249,18 +3259,18 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 	const expiredUploadMessage = "The file upload request has expired. Please try sending the file again.";
 	const activity = context.activity;
 	if (activity.type !== "invoke" || activity.name !== "fileConsent/invoke") return false;
-	const consentResponse = parseFileConsentInvoke(activity);
+	const consentResponse = require_messenger.parseFileConsentInvoke(activity);
 	if (!consentResponse) {
 		log.debug?.("invalid file consent invoke", { value: activity.value });
 		return false;
 	}
 	const uploadId = typeof consentResponse.context?.uploadId === "string" ? consentResponse.context.uploadId : void 0;
-	const inMemoryFile = getPendingUpload(uploadId);
-	const fsFile = inMemoryFile ? void 0 : await getPendingUploadFs(uploadId);
+	const inMemoryFile = require_messenger.getPendingUpload(uploadId);
+	const fsFile = inMemoryFile ? void 0 : await require_messenger.getPendingUploadFs(uploadId);
 	const pendingFile = inMemoryFile ?? fsFile;
 	if (pendingFile) {
-		const pendingConversationId = normalizeMSTeamsConversationId(pendingFile.conversationId);
-		const invokeConversationId = normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
+		const pendingConversationId = require_channel.normalizeMSTeamsConversationId(pendingFile.conversationId);
+		const invokeConversationId = require_channel.normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
 		if (!invokeConversationId || pendingConversationId !== invokeConversationId) {
 			log.info("file consent conversation mismatch", {
 				uploadId,
@@ -3278,12 +3288,12 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 			size: pendingFile.buffer.length
 		});
 		try {
-			await uploadToConsentUrl({
+			await require_messenger.uploadToConsentUrl({
 				url: consentResponse.uploadInfo.uploadUrl,
 				buffer: pendingFile.buffer,
 				contentType: pendingFile.contentType
 			});
-			const fileInfoCard = buildFileInfoCard({
+			const fileInfoCard = require_messenger.buildFileInfoCard({
 				filename: consentResponse.uploadInfo.name,
 				contentUrl: consentResponse.uploadInfo.contentUrl,
 				uniqueId: consentResponse.uploadInfo.uniqueId,
@@ -3313,12 +3323,12 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 		} catch (err) {
 			log.error("file upload failed", {
 				uploadId,
-				error: formatUnknownError(err)
+				error: require_setup_surface.formatUnknownError(err)
 			});
 			await context.sendActivity("File upload failed. Please try again.");
 		} finally {
-			removePendingUpload(uploadId);
-			await removePendingUploadFs(uploadId);
+			require_messenger.removePendingUpload(uploadId);
+			await require_messenger.removePendingUploadFs(uploadId);
 		}
 	} else {
 		log.debug?.("pending file not found for consent", { uploadId });
@@ -3326,8 +3336,8 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 	}
 	else {
 		log.debug?.("user declined file consent", { uploadId });
-		removePendingUpload(uploadId);
-		await removePendingUploadFs(uploadId);
+		require_messenger.removePendingUpload(uploadId);
+		await require_messenger.removePendingUploadFs(uploadId);
 	}
 	return true;
 }
@@ -3338,7 +3348,7 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 */
 async function runMSTeamsFileConsentInvokeHandler(context, log) {
 	try {
-		await withRevokedProxyFallback({
+		await require_messenger.withRevokedProxyFallback({
 			run: async () => await handleMSTeamsFileConsentInvoke(context, log),
 			onRevoked: async () => true,
 			onRevokedLog: () => {
@@ -3346,7 +3356,7 @@ async function runMSTeamsFileConsentInvokeHandler(context, log) {
 			}
 		});
 	} catch (err) {
-		log.debug?.("file consent handler error", { error: formatUnknownError(err) });
+		log.debug?.("file consent handler error", { error: require_setup_surface.formatUnknownError(err) });
 	}
 }
 //#endregion
@@ -3365,7 +3375,7 @@ function applyMSTeamsWebhookTimeouts(httpServer, opts) {
 //#endregion
 //#region extensions/msteams/src/monitor.ts
 async function monitorMSTeamsProvider(opts) {
-	const core = getMSTeamsRuntime();
+	const core = require_runtime.getMSTeamsRuntime();
 	const log = core.logging.getChildLogger({ name: "msteams" });
 	let cfg = opts.cfg;
 	let msteamsCfg = cfg.channels?.msteams;
@@ -3376,7 +3386,7 @@ async function monitorMSTeamsProvider(opts) {
 			shutdown: async () => {}
 		};
 	}
-	const creds = resolveMSTeamsCredentials(msteamsCfg);
+	const creds = require_resolve_allowlist.resolveMSTeamsCredentials(msteamsCfg);
 	if (!creds) {
 		log.error("msteams credentials not configured");
 		return {
@@ -3392,26 +3402,22 @@ async function monitorMSTeamsProvider(opts) {
 			throw new Error(`exit ${code}`);
 		}
 	};
-	let allowFrom = msteamsCfg.allowFrom;
-	let groupAllowFrom = msteamsCfg.groupAllowFrom;
-	let teamsConfig = msteamsCfg.teams;
-	const allowNameMatching = isDangerousNameMatchingEnabled(msteamsCfg);
+	const configuredAllowFrom = msteamsCfg.allowFrom;
+	const configuredGroupAllowFrom = msteamsCfg.groupAllowFrom;
+	let allowFrom = require_resolve_allowlist.projectStableMSTeamsUserAllowlist(configuredAllowFrom);
+	let groupAllowFrom = require_resolve_allowlist.projectStableMSTeamsUserAllowlist(configuredGroupAllowFrom);
+	let teamsConfig = require_resolve_allowlist.projectStableMSTeamsTeamsConfig(msteamsCfg.teams);
+	const allowNameMatching = (0, openclaw_plugin_sdk_dangerous_name_runtime.isDangerousNameMatchingEnabled)(msteamsCfg);
 	const cleanAllowEntry = (entry) => entry.replace(/^(msteams|teams):/i, "").replace(/^user:/i, "").trim();
 	const isStableUserId = (entry) => /^[0-9a-fA-F-]{16,}$/.test(entry);
 	const cleanAllowEntries = (entries) => entries?.map((entry) => cleanAllowEntry(entry)).filter((entry) => entry && entry !== "*") ?? [];
-	const mergeStableUserIds = (entries) => {
-		const additions = cleanAllowEntries(entries).filter((entry) => isStableUserId(entry));
-		return additions.length > 0 ? mergeAllowlist({
-			existing: entries,
-			additions
-		}) : entries;
-	};
+	const isMutableUserEntry = (entry) => !isStableUserId(entry) && !/^accessGroup:/i.test(entry);
 	const resolveAllowlistUsers = async (label, entries) => {
 		if (entries.length === 0) return {
 			additions: [],
 			unresolved: []
 		};
-		const resolved = await resolveMSTeamsUserAllowlist({
+		const resolved = await require_resolve_allowlist.resolveMSTeamsUserAllowlist({
 			cfg,
 			entries
 		});
@@ -3419,102 +3425,44 @@ async function monitorMSTeamsProvider(opts) {
 		const unresolved = [];
 		for (const entry of resolved) if (entry.resolved && entry.id) additions.push(entry.id);
 		else unresolved.push(entry.input);
-		summarizeMapping(label, resolved.filter((entry) => entry.resolved && entry.id).map((entry) => `${entry.input}→${entry.id}`), unresolved, runtime);
+		(0, openclaw_plugin_sdk_allow_from.summarizeMapping)(label, resolved.filter((entry) => entry.resolved && entry.id).map((entry) => `${entry.input}→${entry.id}`), unresolved, runtime);
 		return {
 			additions,
 			unresolved
 		};
 	};
 	try {
-		allowFrom = mergeStableUserIds(allowFrom);
-		if (Array.isArray(groupAllowFrom) && groupAllowFrom.length > 0) groupAllowFrom = mergeStableUserIds(groupAllowFrom);
 		if (allowNameMatching) {
-			const allowEntries = cleanAllowEntries(allowFrom).filter((entry) => !isStableUserId(entry));
+			const allowEntries = cleanAllowEntries(configuredAllowFrom).filter(isMutableUserEntry);
 			if (allowEntries.length > 0) {
 				const { additions } = await resolveAllowlistUsers("msteams users", allowEntries);
-				allowFrom = mergeAllowlist({
+				allowFrom = (0, openclaw_plugin_sdk_allow_from.mergeAllowlist)({
 					existing: allowFrom,
 					additions
 				});
 			}
-			if (Array.isArray(groupAllowFrom) && groupAllowFrom.length > 0) {
-				const groupEntries = cleanAllowEntries(groupAllowFrom).filter((entry) => !isStableUserId(entry));
+			if (Array.isArray(configuredGroupAllowFrom) && configuredGroupAllowFrom.length > 0) {
+				const groupEntries = cleanAllowEntries(configuredGroupAllowFrom).filter(isMutableUserEntry);
 				if (groupEntries.length > 0) {
 					const { additions } = await resolveAllowlistUsers("msteams group users", groupEntries);
-					groupAllowFrom = mergeAllowlist({
+					groupAllowFrom = (0, openclaw_plugin_sdk_allow_from.mergeAllowlist)({
 						existing: groupAllowFrom,
 						additions
 					});
 				}
 			}
 		}
-		if (teamsConfig && Object.keys(teamsConfig).length > 0) {
-			const entries = [];
-			for (const [teamKey, teamCfg] of Object.entries(teamsConfig)) {
-				if (teamKey === "*") continue;
-				const channels = teamCfg?.channels ?? {};
-				const channelKeys = Object.keys(channels).filter((key) => key !== "*");
-				if (channelKeys.length === 0) {
-					entries.push({
-						input: teamKey,
-						teamKey
-					});
-					continue;
-				}
-				for (const channelKey of channelKeys) entries.push({
-					input: `${teamKey}/${channelKey}`,
-					teamKey,
-					channelKey
-				});
-			}
-			if (entries.length > 0) {
-				const resolved = await resolveMSTeamsChannelAllowlist({
-					cfg,
-					entries: entries.map((entry) => entry.input)
-				});
-				const mapping = [];
-				const unresolved = [];
-				const nextTeams = { ...teamsConfig };
-				resolved.forEach((entry, idx) => {
-					const source = entries[idx];
-					if (!source) return;
-					const sourceTeam = teamsConfig?.[source.teamKey] ?? {};
-					if (!entry.resolved || !entry.teamId) {
-						unresolved.push(entry.input);
-						return;
-					}
-					mapping.push(entry.channelId ? `${entry.input}→${entry.teamId}/${entry.channelId}` : `${entry.input}→${entry.teamId}`);
-					const existing = nextTeams[entry.teamId] ?? {};
-					const mergedChannels = {
-						...sourceTeam.channels,
-						...existing.channels
-					};
-					const mergedTeam = {
-						...sourceTeam,
-						...existing,
-						channels: mergedChannels
-					};
-					nextTeams[entry.teamId] = mergedTeam;
-					if (source.channelKey && entry.channelId) {
-						const sourceChannel = sourceTeam.channels?.[source.channelKey];
-						if (sourceChannel) nextTeams[entry.teamId] = {
-							...mergedTeam,
-							channels: {
-								...mergedChannels,
-								[entry.channelId]: {
-									...sourceChannel,
-									...mergedChannels?.[entry.channelId]
-								}
-							}
-						};
-					}
-				});
-				teamsConfig = nextTeams;
-				summarizeMapping("msteams channels", mapping, unresolved, runtime);
-			}
+		if (msteamsCfg.teams && Object.keys(msteamsCfg.teams).length > 0) {
+			const resolved = await require_resolve_allowlist.resolveMSTeamsTeamsConfig({
+				cfg,
+				teamIdMode: "bot-framework",
+				teams: msteamsCfg.teams
+			});
+			teamsConfig = resolved.teams;
+			(0, openclaw_plugin_sdk_allow_from.summarizeMapping)("msteams channels", resolved.mapping, resolved.unresolved, runtime);
 		}
 	} catch (err) {
-		runtime.error?.(`msteams resolve failed; falling back to raw config entries — allowlist members resolved via Graph may be missing. ${formatUnknownError(err)}`);
+		runtime.error?.(`msteams resolve failed; mutable allowlist entries are disabled. ${require_setup_surface.formatUnknownError(err)}`);
 	}
 	msteamsCfg = {
 		...msteamsCfg,
@@ -3534,8 +3482,8 @@ async function monitorMSTeamsProvider(opts) {
 	const MB = 1024 * 1024;
 	const agentDefaults = cfg.agents?.defaults;
 	const mediaMaxBytes = typeof agentDefaults?.mediaMaxMb === "number" && agentDefaults.mediaMaxMb > 0 ? Math.floor(agentDefaults.mediaMaxMb * MB) : 8 * MB;
-	const conversationStore = opts.conversationStore ?? createMSTeamsConversationStoreState();
-	const pollStore = opts.pollStore ?? createMSTeamsPollStoreState();
+	const conversationStore = opts.conversationStore ?? require_polls.createMSTeamsConversationStoreState();
+	const pollStore = opts.pollStore ?? require_polls.createMSTeamsPollStoreState();
 	log.info(`starting provider (port ${port})`);
 	const express = await import("express");
 	const expressApp = express.default();
@@ -3547,7 +3495,7 @@ async function monitorMSTeamsProvider(opts) {
 		}
 		next();
 	});
-	expressApp.use(express.json({ limit: DEFAULT_WEBHOOK_MAX_BODY_BYTES }));
+	expressApp.use(express.json({ limit: openclaw_plugin_sdk_webhook_ingress.DEFAULT_WEBHOOK_MAX_BODY_BYTES }));
 	expressApp.use((err, _req, res, next) => {
 		if (err && typeof err === "object" && "status" in err && err.status === 413) {
 			res.status(413).json({ error: "Payload too large" });
@@ -3556,11 +3504,12 @@ async function monitorMSTeamsProvider(opts) {
 		next(err);
 	});
 	const configuredPath = msteamsCfg.webhook?.path ?? "/api/messages";
-	const { app } = await loadMSTeamsSdkWithAuth(creds, {
-		...resolveMSTeamsSdkCloudOptions(msteamsCfg),
-		httpServerAdapter: await createMSTeamsExpressAdapter(expressApp),
+	const ssoConnectionName = msteamsCfg.sso?.enabled && msteamsCfg.sso.connectionName ? msteamsCfg.sso.connectionName : void 0;
+	const { app } = await require_resolve_allowlist.loadMSTeamsSdkWithAuth(creds, {
+		...require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg),
+		httpServerAdapter: await require_resolve_allowlist.createMSTeamsExpressAdapter(expressApp),
 		messagingEndpoint: configuredPath,
-		...msteamsCfg.sso?.enabled && msteamsCfg.sso.connectionName ? { oauthDefaultConnectionName: msteamsCfg.sso.connectionName } : {}
+		...ssoConnectionName ? { oauthDefaultConnectionName: ssoConnectionName } : {}
 	});
 	if (configuredPath !== "/api/messages") {
 		let warnedLegacyMessagesRoute = false;
@@ -3573,16 +3522,12 @@ async function monitorMSTeamsProvider(opts) {
 			expressApp(req, res, next);
 		});
 	}
-	const tokenProvider = createMSTeamsTokenProvider(app);
-	let ssoDeps;
-	if (msteamsCfg.sso?.enabled && msteamsCfg.sso.connectionName) {
-		ssoDeps = {
-			tokenProvider,
-			tokenStore: createMSTeamsSsoTokenStoreFs(),
-			connectionName: msteamsCfg.sso.connectionName
-		};
-		log.debug?.("msteams sso enabled", { connectionName: msteamsCfg.sso.connectionName });
-	}
+	const tokenProvider = require_resolve_allowlist.createMSTeamsTokenProvider(app);
+	const ssoDeps = ssoConnectionName ? {
+		tokenStore: require_sso_token_store.createMSTeamsSsoTokenStoreFs(),
+		connectionName: ssoConnectionName
+	} : void 0;
+	if (ssoDeps) log.debug?.("msteams sso enabled", { connectionName: ssoDeps.connectionName });
 	const handler = buildActivityHandler();
 	const handlerDeps = {
 		cfg,
@@ -3594,15 +3539,14 @@ async function monitorMSTeamsProvider(opts) {
 		mediaMaxBytes,
 		conversationStore,
 		pollStore,
-		log,
-		sso: ssoDeps
+		log
 	};
 	registerMSTeamsHandlers(handler, handlerDeps);
 	app.on("card.action", async (ctx) => {
 		const adaptedCtx = adaptSdkContext(ctx, app);
 		try {
 			const activity = adaptedCtx.activity;
-			const vote = extractMSTeamsPollVote(activity);
+			const vote = require_polls.extractMSTeamsPollVote(activity);
 			if (vote) {
 				const voterId = activity?.from?.aadObjectId ?? activity?.from?.id ?? "unknown";
 				try {
@@ -3620,8 +3564,8 @@ async function monitorMSTeamsProvider(opts) {
 							value: "Poll not found."
 						};
 					}
-					const pollConversationId = existingPoll.conversationId ? normalizeMSTeamsConversationId(existingPoll.conversationId) : void 0;
-					const activityConversationId = normalizeMSTeamsConversationId(activity?.conversation?.id ?? "");
+					const pollConversationId = existingPoll.conversationId ? require_channel.normalizeMSTeamsConversationId(existingPoll.conversationId) : void 0;
+					const activityConversationId = require_channel.normalizeMSTeamsConversationId(activity?.conversation?.id ?? "");
 					if (pollConversationId && pollConversationId !== activityConversationId) {
 						log.info("poll vote ignored (conversation mismatch)", {
 							pollId: vote.pollId,
@@ -3658,7 +3602,7 @@ async function monitorMSTeamsProvider(opts) {
 				} catch (err) {
 					log.error("failed to record poll vote", {
 						pollId: vote.pollId,
-						error: formatUnknownError(err)
+						error: require_setup_surface.formatUnknownError(err)
 					});
 					return {
 						statusCode: 500,
@@ -3675,7 +3619,7 @@ async function monitorMSTeamsProvider(opts) {
 				}
 			}
 			handler.run(adaptedCtx).catch((err) => {
-				log.error("msteams card.action dispatch failed", { error: formatUnknownError(err) });
+				log.error("msteams card.action dispatch failed", { error: require_setup_surface.formatUnknownError(err) });
 			});
 			return {
 				statusCode: 200,
@@ -3683,7 +3627,7 @@ async function monitorMSTeamsProvider(opts) {
 				value: "OK"
 			};
 		} catch (err) {
-			log.error("msteams card.action failed", { error: formatUnknownError(err) });
+			log.error("msteams card.action failed", { error: require_setup_surface.formatUnknownError(err) });
 			return {
 				statusCode: 500,
 				type: "application/vnd.microsoft.error",
@@ -3751,7 +3695,7 @@ async function monitorMSTeamsProvider(opts) {
 				hasExpiry: Boolean(ctx.token.expiration)
 			});
 		})().catch((err) => {
-			log.error("msteams sso token persistence failed", { error: formatUnknownError(err) });
+			log.error("msteams sso token persistence failed", { error: require_setup_surface.formatUnknownError(err) });
 		});
 	});
 	app.on("message.submit", async (ctx) => {
@@ -3768,39 +3712,31 @@ async function monitorMSTeamsProvider(opts) {
 			}
 			await handler.run(adaptedCtx);
 		} catch (err) {
-			log.error("msteams webhook failed", { error: formatUnknownError(err) });
+			log.error("msteams webhook failed", { error: require_setup_surface.formatUnknownError(err) });
 		}
 	});
 	await app.initialize();
-	const httpServer = expressApp.listen(port);
-	await new Promise((resolve, reject) => {
-		const onListening = () => {
-			httpServer.off("error", onError);
-			log.info(`msteams provider started on port ${port}`);
-			resolve();
-		};
-		const onError = (err) => {
-			httpServer.off("listening", onListening);
-			log.error("msteams server error", { error: formatUnknownError(err) });
-			reject(toLintErrorObject(err, "MSTeams server failed"));
-		};
-		httpServer.once("listening", onListening);
-		httpServer.once("error", onError);
+	const httpServer = await new Promise((resolve, reject) => {
+		const server = expressApp.listen(port, (err) => err ? reject(err) : resolve(server));
+	}).catch((err) => {
+		log.error("msteams server error", { error: require_setup_surface.formatUnknownError(err) });
+		throw err;
 	});
+	log.info(`msteams provider started on port ${port}`);
 	applyMSTeamsWebhookTimeouts(httpServer);
 	httpServer.on("error", (err) => {
-		log.error("msteams server error", { error: formatUnknownError(err) });
+		log.error("msteams server error", { error: require_setup_surface.formatUnknownError(err) });
 	});
 	const shutdown = async () => {
 		log.info("shutting down msteams provider");
 		return new Promise((resolve) => {
 			httpServer.close((err) => {
-				if (err) log.debug?.("msteams server close error", { error: formatUnknownError(err) });
+				if (err) log.debug?.("msteams server close error", { error: require_setup_surface.formatUnknownError(err) });
 				resolve();
 			});
 		});
 	};
-	await keepHttpServerTaskAlive({
+	await (0, openclaw_plugin_sdk_channel_outbound.keepHttpServerTaskAlive)({
 		server: httpServer,
 		abortSignal: opts.abortSignal,
 		onAbort: shutdown
@@ -3810,13 +3746,6 @@ async function monitorMSTeamsProvider(opts) {
 		shutdown
 	};
 }
-function toLintErrorObject(value, fallbackMessage) {
-	if (value instanceof Error) return value;
-	if (typeof value === "string") return new Error(value);
-	const error = new Error(fallbackMessage, { cause: value });
-	if (typeof value === "object" && value !== null || typeof value === "function") Object.assign(error, value);
-	return error;
-}
 /**
 * Build a minimal ActivityHandler-compatible object that supports
 * onMessage / onMembersAdded registration and a run() method.
@@ -3866,7 +3795,9 @@ function adaptSdkContext(ctx, app) {
 	const sdkCtx = ctx ?? {};
 	if (typeof sdkCtx.reply !== "function" && typeof sdkCtx.send !== "function") return ctx;
 	const conversationId = sdkCtx.activity?.conversation?.id ?? "";
-	const activityApi = sdkCtx.api ?? app.api;
+	const inboundApi = sdkCtx.api;
+	const activityApi = inboundApi ?? app.api;
+	const getTeamDetails = inboundApi ? (teamId) => inboundApi.teams.getById(teamId) : void 0;
 	const conversationType = (sdkCtx.activity?.conversation?.conversationType ?? "").toLowerCase();
 	const isThreadable = conversationType === "channel" || conversationType === "groupchat";
 	const sendActivity = (activity) => isThreadable ? sdkCtx.reply(activity) : sdkCtx.send(activity);
@@ -3884,8 +3815,9 @@ function adaptSdkContext(ctx, app) {
 		deleteActivity: async (activityId) => {
 			return activityApi.conversations.activities(conversationId).delete(activityId);
 		},
+		getTeamDetails,
 		stream: sdkCtx.stream
 	});
 }
 //#endregion
-export { monitorMSTeamsProvider };
+exports.monitorMSTeamsProvider = monitorMSTeamsProvider;