@openclaw/msteams 2026.7.2-beta.1 → 2026.7.2-beta.3

package/dist/api.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./channel-BSyPdpGN.cjs");
-const require_setup_surface = require("./setup-surface-BDTPN3dX.cjs");
+const require_channel = require("./channel-oNBYNcJT.cjs");
+const require_setup_surface = require("./setup-surface-BcRVoUY8.cjs");
 exports.createMSTeamsSetupWizardBase = require_setup_surface.createMSTeamsSetupWizardBase;
 exports.msteamsPlugin = require_channel.msteamsPlugin;
 exports.msteamsSetupAdapter = require_setup_surface.msteamsSetupAdapter;

package/dist/{channel-BSyPdpGN.cjs → channel-oNBYNcJT.cjs}

@@ -1,7 +1,7 @@
 require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-CyQ57MfH.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
 const require_config_schema = require("./config-schema-BSNLJUta.cjs");
-const require_setup_surface = require("./setup-surface-BDTPN3dX.cjs");
+const require_setup_surface = require("./setup-surface-BcRVoUY8.cjs");
 let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let openclaw_plugin_sdk_channel_config_helpers = require("openclaw/plugin-sdk/channel-config-helpers");
@@ -55,28 +55,19 @@ const msTeamsApprovalAuth = (0, openclaw_plugin_sdk_approval_auth_runtime.create
 }).approvalAuth;
 //#endregion
 //#region extensions/msteams/src/doctor.ts
-function isMSTeamsMutableAllowEntry(raw) {
-	const text = raw.trim();
-	if (!text || text === "*") return false;
-	const withoutPrefix = text.replace(/^(msteams|user):/i, "").trim();
-	return /\s/.test(withoutPrefix) || withoutPrefix.includes("@");
-}
+const isMSTeamsMutableAllowEntry = (0, openclaw_plugin_sdk_channel_policy.buildMutableAllowEntryDetector)({
+	prefixes: ["msteams:", "user:"],
+	stableIdPattern: /^[^\s@]+$/
+});
 const collectMSTeamsMutableAllowlistWarnings = (0, openclaw_plugin_sdk_channel_policy.createDangerousNameMatchingMutableAllowlistWarningCollector)({
 	channel: "msteams",
 	detector: isMSTeamsMutableAllowEntry,
-	collectLists: (scope) => [{
-		pathLabel: `${scope.prefix}.allowFrom`,
-		list: scope.account.allowFrom
-	}, {
-		pathLabel: `${scope.prefix}.groupAllowFrom`,
-		list: scope.account.groupAllowFrom
-	}]
+	collectLists: (scope) => (0, openclaw_plugin_sdk_channel_policy.collectStandardAllowlistLists)(scope)
 });
 //#endregion
 //#region extensions/msteams/src/policy.ts
-const encodeScopeSegment = (value) => `${value.length}:${value}`;
-const teamScopeKey = (teamKey) => `team:${encodeScopeSegment(teamKey)}`;
-const channelScopeKey = (teamKey, channelKey) => `${teamScopeKey(teamKey)}/channel:${encodeScopeSegment(channelKey)}`;
+const teamScopeKey = (teamKey) => (0, openclaw_plugin_sdk_channel_policy.scopeKey)(["team", teamKey]);
+const channelScopeKey = (teamKey, channelKey) => (0, openclaw_plugin_sdk_channel_policy.scopeKey)(["team", teamKey], ["channel", channelKey]);
 function buildMSTeamsToolPolicyTree(teams) {
 	const scopes = {};
 	for (const [teamKey, team] of Object.entries(teams ?? {})) {
@@ -288,10 +279,12 @@ function buildMSTeamsPresentationCard(params) {
 		if (block.type === "buttons") for (const button of block.buttons) {
 			const action = (0, openclaw_plugin_sdk_interactive_runtime.resolveMessagePresentationButtonAction)(button);
 			if (action?.type === "url" || action?.type === "web-app") {
+				const url = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(action.url);
+				if (!url) continue;
 				actions.push({
 					type: "Action.OpenUrl",
 					title: button.label,
-					url: action.url
+					url
 				});
 				continue;
 			}
@@ -678,7 +671,7 @@ const collectMSTeamsSecurityWarnings = (0, openclaw_plugin_sdk_channel_policy.cr
 	resolveGroupPolicy: ({ cfg }) => cfg.channels?.msteams?.groupPolicy,
 	collect: ({ groupPolicy }) => groupPolicy === "open" ? ["- MS Teams groups: groupPolicy=\"open\" allows any member to trigger (mention-gated). Set channels.msteams.groupPolicy=\"allowlist\" + channels.msteams.groupAllowFrom to restrict senders."] : []
 });
-const loadMSTeamsChannelRuntime = (0, openclaw_plugin_sdk_lazy_runtime.createLazyRuntimeNamedExport)(() => Promise.resolve().then(() => require("./channel.runtime-DQTOzzet.cjs")), "msTeamsChannelRuntime");
+const loadMSTeamsChannelRuntime = (0, openclaw_plugin_sdk_lazy_runtime.createLazyRuntimeNamedExport)(() => Promise.resolve().then(() => require("./channel.runtime-Sn3hY2Lu.cjs")), "msTeamsChannelRuntime");
 const resolveMSTeamsChannelConfig = (cfg) => ({
 	allowFrom: cfg.channels?.msteams?.allowFrom,
 	defaultTo: cfg.channels?.msteams?.defaultTo
@@ -974,6 +967,7 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 		setup: require_setup_surface.msteamsSetupAdapter,
 		messaging: {
 			targetPrefixes: ["msteams", "teams"],
+			directTargetStyle: "user-prefixed",
 			normalizeTarget: require_resolve_allowlist.normalizeMSTeamsMessagingTarget,
 			resolveOutboundSessionRoute: (params) => resolveMSTeamsOutboundSessionRoute(params),
 			targetResolver: {
@@ -1571,7 +1565,7 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 			})
 		}),
 		gateway: { startAccount: async (ctx) => {
-			const { monitorMSTeamsProvider } = await Promise.resolve().then(() => require("./src-CUMz2B6f.cjs"));
+			const { monitorMSTeamsProvider } = await Promise.resolve().then(() => require("./src-BQM9QUTF.cjs"));
 			const port = ctx.cfg.channels?.msteams?.webhook?.port ?? 3978;
 			ctx.setStatus({
 				accountId: ctx.accountId,

package/dist/channel-plugin-api.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./channel-BSyPdpGN.cjs");
+const require_channel = require("./channel-oNBYNcJT.cjs");
 exports.msteamsPlugin = require_channel.msteamsPlugin;

package/dist/{channel.runtime-DQTOzzet.cjs → channel.runtime-Sn3hY2Lu.cjs}

@@ -1,10 +1,10 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-CyQ57MfH.cjs");
-const require_channel = require("./channel-BSyPdpGN.cjs");
-const require_setup_surface = require("./setup-surface-BDTPN3dX.cjs");
-const require_polls = require("./polls-BhoI4VaN.cjs");
-const require_messenger = require("./messenger-DtS9gqkV.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
+const require_channel = require("./channel-oNBYNcJT.cjs");
+const require_setup_surface = require("./setup-surface-BcRVoUY8.cjs");
+const require_polls = require("./polls-CWExq2xZ.cjs");
+const require_messenger = require("./messenger-Do4oje4J.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_reply_payload = require("openclaw/plugin-sdk/reply-payload");
@@ -1291,10 +1291,16 @@ async function probeMSTeams(cfg) {
 	try {
 		const { app } = await require_resolve_allowlist.loadMSTeamsSdkWithAuth(creds, require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(cfg));
 		const tokenProvider = require_resolve_allowlist.createMSTeamsTokenProvider(app);
-		if (!await tokenProvider.getAccessToken("https://api.botframework.com")) throw new Error("Failed to acquire bot token");
+		if (!await require_resolve_allowlist.withMSTeamsRequestDeadline({
+			label: "MS Teams Bot Framework probe token",
+			work: () => tokenProvider.getAccessToken("https://api.botframework.com")
+		})) throw new Error("Failed to acquire bot token");
 		let graph;
 		try {
-			const accessToken = require_resolve_allowlist.readAccessToken(await tokenProvider.getAccessToken("https://graph.microsoft.com"));
+			const accessToken = require_resolve_allowlist.readAccessToken(await require_resolve_allowlist.withMSTeamsRequestDeadline({
+				label: "MS Teams Graph probe token",
+				work: () => tokenProvider.getAccessToken("https://graph.microsoft.com")
+			}));
 			const payload = accessToken ? decodeJwtPayload(accessToken) : null;
 			graph = {
 				ok: true,

package/dist/delegated-state-DOSCHaAB.cjs

@@ -0,0 +1,98 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+const require_runtime = require("./runtime-gZTAuFux.cjs");
+//#region extensions/msteams/src/delegated-state.ts
+const MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME = "msteams-delegated.json";
+const MSTEAMS_DELEGATED_TOKEN_NAMESPACE = "delegated-token";
+const MSTEAMS_DELEGATED_TOKEN_KEY = "current";
+function openDelegatedTokenStore(env) {
+	return require_runtime.getMSTeamsRuntime().state.openSyncKeyedStore({
+		namespace: MSTEAMS_DELEGATED_TOKEN_NAMESPACE,
+		maxEntries: 1,
+		overflowPolicy: "reject-new",
+		...env ? { env } : {}
+	});
+}
+function normalizeMSTeamsDelegatedTokens(value) {
+	if (!value || typeof value !== "object") return null;
+	const token = value;
+	if (typeof token.accessToken !== "string" || !token.accessToken || typeof token.refreshToken !== "string" || !token.refreshToken || typeof token.expiresAt !== "number" || !Number.isFinite(token.expiresAt) || !Array.isArray(token.scopes) || !token.scopes.every((scope) => typeof scope === "string" && scope.length > 0)) return null;
+	return {
+		accessToken: token.accessToken,
+		refreshToken: token.refreshToken,
+		expiresAt: token.expiresAt,
+		scopes: [...token.scopes],
+		...typeof token.userPrincipalName === "string" ? { userPrincipalName: token.userPrincipalName } : {}
+	};
+}
+function loadMSTeamsDelegatedTokens(env) {
+	return normalizeMSTeamsDelegatedTokens(openDelegatedTokenStore(env).lookup("current")) ?? void 0;
+}
+function saveMSTeamsDelegatedTokens(tokens, env) {
+	const normalized = normalizeMSTeamsDelegatedTokens(tokens);
+	if (!normalized) throw new Error("Invalid Microsoft Teams delegated token payload");
+	openDelegatedTokenStore(env).register(MSTEAMS_DELEGATED_TOKEN_KEY, normalized);
+}
+//#endregion
+Object.defineProperty(exports, "MSTEAMS_DELEGATED_TOKEN_KEY", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DELEGATED_TOKEN_KEY;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_DELEGATED_TOKEN_NAMESPACE", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DELEGATED_TOKEN_NAMESPACE;
+	}
+});
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});
+Object.defineProperty(exports, "loadMSTeamsDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return loadMSTeamsDelegatedTokens;
+	}
+});
+Object.defineProperty(exports, "normalizeMSTeamsDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return normalizeMSTeamsDelegatedTokens;
+	}
+});
+Object.defineProperty(exports, "saveMSTeamsDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return saveMSTeamsDelegatedTokens;
+	}
+});

package/dist/directory-contract-api.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_resolve_allowlist = require("./resolve-allowlist-CyQ57MfH.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
 let openclaw_plugin_sdk_directory_runtime = require("openclaw/plugin-sdk/directory-runtime");
 const msteamsDirectoryContractPlugin = {
 	id: "msteams",

package/dist/doctor-contract-api.cjs

@@ -1,14 +1,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
-const require_polls = require("./polls-BhoI4VaN.cjs");
-const require_sso_token_store = require("./sso-token-store-CktCz88k.cjs");
+const require_delegated_state = require("./delegated-state-DOSCHaAB.cjs");
+const require_polls = require("./polls-CWExq2xZ.cjs");
+const require_sso_token_store = require("./sso-token-store-OSg229re.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
-let node_path = require("node:path");
-node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
-node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+node_crypto = require_delegated_state.__toESM(node_crypto, 1);
 let node_fs_promises = require("node:fs/promises");
-node_fs_promises = require_rolldown_runtime.__toESM(node_fs_promises, 1);
+node_fs_promises = require_delegated_state.__toESM(node_fs_promises, 1);
+let node_path = require("node:path");
+node_path = require_delegated_state.__toESM(node_path, 1);
 let openclaw_plugin_sdk_runtime_doctor = require("openclaw/plugin-sdk/runtime-doctor");
 let openclaw_plugin_sdk_session_store_runtime = require("openclaw/plugin-sdk/session-store-runtime");
 //#region extensions/msteams/doctor-contract-api.ts
@@ -314,6 +314,85 @@ const stateMigrations = [
 			};
 		}
 	},
+	{
+		id: "msteams-delegated-token-json-to-plugin-state",
+		label: "Microsoft Teams delegated OAuth token",
+		async detectLegacyState(params) {
+			const filePath = resolveStateFilePath(params.stateDir, require_delegated_state.MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME);
+			try {
+				return (await node_fs_promises.default.stat(filePath)).isFile() ? { preview: [`- ${MSTEAMS_PLUGIN_ID} delegated OAuth token -> plugin state (${require_delegated_state.MSTEAMS_DELEGATED_TOKEN_NAMESPACE})`] } : null;
+			} catch {
+				return null;
+			}
+		},
+		async migrateLegacyState(params) {
+			const changes = [];
+			const warnings = [];
+			const filePath = resolveStateFilePath(params.stateDir, require_delegated_state.MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME);
+			let token;
+			try {
+				token = require_delegated_state.normalizeMSTeamsDelegatedTokens(JSON.parse(await node_fs_promises.default.readFile(filePath, "utf8")));
+			} catch (error) {
+				if (error.code === "ENOENT") return {
+					changes,
+					warnings
+				};
+				warnings.push(`Failed reading ${MSTEAMS_PLUGIN_ID} delegated OAuth token legacy source; left it in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			if (!token) {
+				warnings.push(`Invalid ${MSTEAMS_PLUGIN_ID} delegated OAuth token legacy source; left it in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			const store = params.context.openPluginStateKeyedStore({
+				namespace: require_delegated_state.MSTEAMS_DELEGATED_TOKEN_NAMESPACE,
+				maxEntries: 1,
+				overflowPolicy: "reject-new"
+			});
+			const existing = await store.lookup(require_delegated_state.MSTEAMS_DELEGATED_TOKEN_KEY);
+			if (existing && JSON.stringify(existing) !== JSON.stringify(token)) {
+				warnings.push(`Kept existing ${MSTEAMS_PLUGIN_ID} delegated OAuth token in plugin state; left differing legacy source in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			if (!existing) try {
+				await store.registerIfAbsent(require_delegated_state.MSTEAMS_DELEGATED_TOKEN_KEY, token);
+			} catch (error) {
+				warnings.push(`Failed importing ${MSTEAMS_PLUGIN_ID} delegated OAuth token: ${String(error)}; left legacy source in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			const persisted = require_delegated_state.normalizeMSTeamsDelegatedTokens(await store.lookup(require_delegated_state.MSTEAMS_DELEGATED_TOKEN_KEY));
+			if (!persisted || JSON.stringify(persisted) !== JSON.stringify(token)) {
+				warnings.push(`Failed verifying ${MSTEAMS_PLUGIN_ID} delegated OAuth token in plugin state; left legacy source in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			changes.push(`Migrated ${MSTEAMS_PLUGIN_ID} delegated OAuth token -> plugin state`);
+			await (0, openclaw_plugin_sdk_runtime_doctor.archiveLegacyStateSource)({
+				filePath,
+				label: `${MSTEAMS_PLUGIN_ID} delegated OAuth token`,
+				changes,
+				warnings
+			});
+			return {
+				changes,
+				warnings
+			};
+		}
+	},
 	{
 		id: "msteams-feedback-learnings-json-to-plugin-state",
 		label: "Microsoft Teams feedback learnings",

package/dist/{messenger-DtS9gqkV.cjs → messenger-Do4oje4J.cjs}

@@ -1,9 +1,9 @@
-const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
+const require_delegated_state = require("./delegated-state-DOSCHaAB.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-CyQ57MfH.cjs");
-const require_setup_surface = require("./setup-surface-BDTPN3dX.cjs");
-const require_polls = require("./polls-BhoI4VaN.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
+const require_setup_surface = require("./setup-surface-BcRVoUY8.cjs");
+const require_polls = require("./polls-CWExq2xZ.cjs");
 let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_reply_payload = require("openclaw/plugin-sdk/reply-payload");
@@ -11,11 +11,11 @@ let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-ht
 let node_dns_promises = require("node:dns/promises");
 let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
-let node_path = require("node:path");
-node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let openclaw_plugin_sdk_html_entity_runtime = require("openclaw/plugin-sdk/html-entity-runtime");
 let node_crypto = require("node:crypto");
-node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+node_crypto = require_delegated_state.__toESM(node_crypto, 1);
+let node_path = require("node:path");
+node_path = require_delegated_state.__toESM(node_path, 1);
 let openclaw_plugin_sdk_reply_chunking = require("openclaw/plugin-sdk/reply-chunking");
 let openclaw_plugin_sdk_web_media = require("openclaw/plugin-sdk/web-media");
 let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runtime");
@@ -256,6 +256,7 @@ async function uploadToConsentUrl(params) {
 		},
 		body: new Uint8Array(params.buffer)
 	}, params.timeoutMs ?? require_resolve_allowlist.resolveMSTeamsSharePointUploadTimeoutMs(params.buffer.length), fetchFn);
+	await res.body?.cancel().catch(() => void 0);
 	if (!res.ok) throw new Error(`File upload to consent URL failed: ${res.status} ${res.statusText}`);
 }
 //#endregion
@@ -270,7 +271,7 @@ const RAW_CHUNK_BYTES = 36 * 1024;
 const PENDING_UPLOAD_META_MAX_ENTRIES = 200;
 const PENDING_UPLOAD_META_NAMESPACE = "pending-uploads";
 const PENDING_UPLOAD_CHUNKS_NAMESPACE = "pending-upload-chunks";
-const PENDING_UPLOAD_LOCK_FILENAME = "msteams-pending-uploads.sqlite.lock";
+const PENDING_UPLOAD_MUTATION_KEY = "pending-uploads";
 function createMetaStore(options) {
 	return require_runtime.getMSTeamsRuntime().state.openKeyedStore({
 		namespace: PENDING_UPLOAD_META_NAMESPACE,
@@ -339,7 +340,7 @@ async function registerUploadRows(record, metaStore, chunkStore, ttlMs, overwrit
 	}));
 }
 async function withPendingUploadLock(options, run) {
-	return await require_polls.withMSTeamsSqliteMutationLock(options, PENDING_UPLOAD_LOCK_FILENAME, run);
+	return await require_polls.withMSTeamsSqliteMutationLock(options, PENDING_UPLOAD_MUTATION_KEY, run);
 }
 async function readUploadRows(id, metaStore, chunkStore) {
 	const meta = await metaStore.lookup(buildMetaKey(id));
@@ -632,6 +633,15 @@ function requireMSTeamsSharePointSiteId(siteId) {
 	if (!normalized) throw new Error("channels.msteams.sharePointSiteId is required to send files to group chats or channels");
 	return normalized;
 }
+const SHAREPOINT_REQUEST_TIMEOUT_LABEL = "MS Teams SharePoint request";
+const SHAREPOINT_UPLOAD_TIMEOUT_LABEL = "MS Teams SharePoint upload";
+const GRAPH_TOKEN_TIMEOUT_LABEL = "MS Teams Graph token acquisition";
+async function getGraphAccessToken(tokenProvider) {
+	return await require_resolve_allowlist.withMSTeamsRequestDeadline({
+		label: GRAPH_TOKEN_TIMEOUT_LABEL,
+		work: async () => await tokenProvider.getAccessToken(GRAPH_SCOPE)
+	});
+}
 /**
 * Upload a file to a SharePoint site.
 * This is used for group chats and channels where /me/drive doesn't work for bots.
@@ -640,19 +650,26 @@ function requireMSTeamsSharePointSiteId(siteId) {
 */
 async function uploadToSharePoint(params) {
 	const fetchFn = params.fetchFn ?? fetch;
-	const token = await params.tokenProvider.getAccessToken(GRAPH_SCOPE);
 	const uploadPath = `/OpenClawShared/${encodeURIComponent(params.filename)}`;
-	const res = await fetchFn(`${GRAPH_ROOT}/sites/${params.siteId}/drive/root:${uploadPath}:/content`, {
-		method: "PUT",
-		headers: {
-			"User-Agent": require_resolve_allowlist.buildUserAgent(),
-			Authorization: `Bearer ${token}`,
-			"Content-Type": params.contentType ?? "application/octet-stream"
-		},
-		body: new Uint8Array(params.buffer)
+	const data = await require_resolve_allowlist.withMSTeamsAbortableRequestTimeout({
+		label: SHAREPOINT_UPLOAD_TIMEOUT_LABEL,
+		timeoutMs: require_resolve_allowlist.resolveMSTeamsSharePointUploadTimeoutMs(params.buffer.length),
+		work: async (signal) => {
+			const token = await getGraphAccessToken(params.tokenProvider);
+			const res = await fetchFn(`${GRAPH_ROOT}/sites/${params.siteId}/drive/root:${uploadPath}:/content`, {
+				method: "PUT",
+				headers: {
+					"User-Agent": require_resolve_allowlist.buildUserAgent(),
+					Authorization: `Bearer ${token}`,
+					"Content-Type": params.contentType ?? "application/octet-stream"
+				},
+				body: new Uint8Array(params.buffer),
+				signal
+			});
+			if (!res.ok) throw await require_resolve_allowlist.createMSTeamsHttpError(res, "SharePoint upload failed");
+			return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, "msteams.graph-upload.uploadSharePointFile");
+		}
 	});
-	if (!res.ok) throw await require_resolve_allowlist.createMSTeamsHttpError(res, "SharePoint upload failed");
-	const data = await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, "msteams.graph-upload.uploadSharePointFile");
 	if (!data.id || !data.webUrl || !data.name) throw new Error("SharePoint upload response missing required fields");
 	return {
 		id: data.id,
@@ -669,13 +686,21 @@ async function uploadToSharePoint(params) {
 */
 async function getDriveItemProperties(params) {
 	const fetchFn = params.fetchFn ?? fetch;
-	const token = await params.tokenProvider.getAccessToken(GRAPH_SCOPE);
-	const res = await fetchFn(`${GRAPH_ROOT}/sites/${params.siteId}/drive/items/${params.itemId}?$select=eTag,webDavUrl,name`, { headers: {
-		"User-Agent": require_resolve_allowlist.buildUserAgent(),
-		Authorization: `Bearer ${token}`
-	} });
-	if (!res.ok) throw await require_resolve_allowlist.createMSTeamsHttpError(res, "Get driveItem properties failed");
-	const data = await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, "msteams.graph-upload.getDriveItemProperties");
+	const data = await require_resolve_allowlist.withMSTeamsAbortableRequestTimeout({
+		label: SHAREPOINT_REQUEST_TIMEOUT_LABEL,
+		work: async (signal) => {
+			const token = await getGraphAccessToken(params.tokenProvider);
+			const res = await fetchFn(`${GRAPH_ROOT}/sites/${params.siteId}/drive/items/${params.itemId}?$select=eTag,webDavUrl,name`, {
+				headers: {
+					"User-Agent": require_resolve_allowlist.buildUserAgent(),
+					Authorization: `Bearer ${token}`
+				},
+				signal
+			});
+			if (!res.ok) throw await require_resolve_allowlist.createMSTeamsHttpError(res, "Get driveItem properties failed");
+			return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, "msteams.graph-upload.getDriveItemProperties");
+		}
+	});
 	if (!data.eTag || !data.webDavUrl || !data.name) throw new Error("DriveItem response missing required properties (eTag, webDavUrl, or name)");
 	return {
 		eTag: data.eTag,
@@ -689,13 +714,21 @@ async function getDriveItemProperties(params) {
 */
 async function getChatMembers(params) {
 	const fetchFn = params.fetchFn ?? fetch;
-	const token = await params.tokenProvider.getAccessToken(GRAPH_SCOPE);
-	const res = await fetchFn(`${GRAPH_ROOT}/chats/${params.chatId}/members`, { headers: {
-		"User-Agent": require_resolve_allowlist.buildUserAgent(),
-		Authorization: `Bearer ${token}`
-	} });
-	if (!res.ok) throw await require_resolve_allowlist.createMSTeamsHttpError(res, "Get chat members failed");
-	return ((await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, "msteams.graph-upload.getChatMembers")).value ?? []).map((m) => ({ aadObjectId: m.userId ?? "" })).filter((m) => m.aadObjectId);
+	return await require_resolve_allowlist.withMSTeamsAbortableRequestTimeout({
+		label: SHAREPOINT_REQUEST_TIMEOUT_LABEL,
+		work: async (signal) => {
+			const token = await getGraphAccessToken(params.tokenProvider);
+			const res = await fetchFn(`${GRAPH_ROOT}/chats/${params.chatId}/members`, {
+				headers: {
+					"User-Agent": require_resolve_allowlist.buildUserAgent(),
+					Authorization: `Bearer ${token}`
+				},
+				signal
+			});
+			if (!res.ok) throw await require_resolve_allowlist.createMSTeamsHttpError(res, res.status === 403 ? "Get chat members failed; verify Graph chat-member permissions and tenant access policies" : "Get chat members failed");
+			return ((await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, "msteams.graph-upload.getChatMembers")).value ?? []).map((member) => ({ aadObjectId: member.userId ?? "" })).filter((member) => member.aadObjectId);
+		}
+	});
 }
 /**
 * Create a sharing link for a SharePoint drive item.
@@ -704,7 +737,6 @@ async function getChatMembers(params) {
 */
 async function createSharePointSharingLink(params) {
 	const fetchFn = params.fetchFn ?? fetch;
-	const token = await params.tokenProvider.getAccessToken(GRAPH_SCOPE);
 	const scope = params.scope ?? "organization";
 	const apiRoot = scope === "users" ? GRAPH_BETA : GRAPH_ROOT;
 	const body = {
@@ -712,17 +744,24 @@ async function createSharePointSharingLink(params) {
 		scope: scope === "users" ? "users" : "organization"
 	};
 	if (scope === "users" && params.recipientObjectIds?.length) body.recipients = params.recipientObjectIds.map((id) => ({ objectId: id }));
-	const res = await fetchFn(`${apiRoot}/sites/${params.siteId}/drive/items/${params.itemId}/createLink`, {
-		method: "POST",
-		headers: {
-			"User-Agent": require_resolve_allowlist.buildUserAgent(),
-			Authorization: `Bearer ${token}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(body)
+	const data = await require_resolve_allowlist.withMSTeamsAbortableRequestTimeout({
+		label: SHAREPOINT_REQUEST_TIMEOUT_LABEL,
+		work: async (signal) => {
+			const token = await getGraphAccessToken(params.tokenProvider);
+			const res = await fetchFn(`${apiRoot}/sites/${params.siteId}/drive/items/${params.itemId}/createLink`, {
+				method: "POST",
+				headers: {
+					"User-Agent": require_resolve_allowlist.buildUserAgent(),
+					Authorization: `Bearer ${token}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify(body),
+				signal
+			});
+			if (!res.ok) throw await require_resolve_allowlist.createMSTeamsHttpError(res, "Create SharePoint sharing link failed");
+			return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, "msteams.graph-upload.createSharePointSharingLink");
+		}
 	});
-	if (!res.ok) throw await require_resolve_allowlist.createMSTeamsHttpError(res, "Create SharePoint sharing link failed");
-	const data = await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(res, "msteams.graph-upload.createSharePointSharingLink");
 	if (!data.link?.webUrl) throw new Error("Create SharePoint sharing link response missing webUrl");
 	return { webUrl: data.link.webUrl };
 }
@@ -734,7 +773,7 @@ async function createSharePointSharingLink(params) {
 *
 * @param params.siteId - SharePoint site ID
 * @param params.chatId - Optional chat ID for per-user sharing (group chats)
-* @param params.usePerUserSharing - Whether to use per-user sharing (requires beta API + Chat.Read.All)
+* @param params.usePerUserSharing - Whether to use per-user sharing (requires beta API + chat-member read access)
 */
 async function uploadAndShareSharePoint(params) {
 	const uploaded = await uploadToSharePoint({
@@ -747,17 +786,16 @@ async function uploadAndShareSharePoint(params) {
 	});
 	let scope = "organization";
 	let recipientObjectIds;
-	if (params.usePerUserSharing && params.chatId) try {
+	if (params.usePerUserSharing && params.chatId) {
 		const members = await getChatMembers({
 			chatId: params.chatId,
 			tokenProvider: params.tokenProvider,
 			fetchFn: params.fetchFn
 		});
-		if (members.length > 0) {
-			scope = "users";
-			recipientObjectIds = members.map((m) => m.aadObjectId);
-		}
-	} catch {}
+		if (members.length === 0) throw new Error("MS Teams chat member lookup returned no recipients");
+		scope = "users";
+		recipientObjectIds = members.map((member) => member.aadObjectId);
+	}
 	const shareLink = await createSharePointSharingLink({
 		siteId: params.siteId,
 		itemId: uploaded.id,

package/dist/{oauth-C5E5powI.cjs → oauth-BUFvYhIw.cjs}

@@ -1,4 +1,4 @@
-const require_resolve_allowlist = require("./resolve-allowlist-CyQ57MfH.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
 let openclaw_plugin_sdk_provider_auth = require("openclaw/plugin-sdk/provider-auth");
 let openclaw_plugin_sdk_provider_auth_runtime = require("openclaw/plugin-sdk/provider-auth-runtime");
 let openclaw_plugin_sdk_runtime_env = require("openclaw/plugin-sdk/runtime-env");