@openclaw/msteams 2026.7.2-beta.2 → 2026.7.2-beta.3

package/dist/api.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./channel-BKc8zroK.cjs");
-const require_setup_surface = require("./setup-surface-D4f6x5cx.cjs");
+const require_channel = require("./channel-oNBYNcJT.cjs");
+const require_setup_surface = require("./setup-surface-BcRVoUY8.cjs");
 exports.createMSTeamsSetupWizardBase = require_setup_surface.createMSTeamsSetupWizardBase;
 exports.msteamsPlugin = require_channel.msteamsPlugin;
 exports.msteamsSetupAdapter = require_setup_surface.msteamsSetupAdapter;

package/dist/{channel-BKc8zroK.cjs → channel-oNBYNcJT.cjs}

@@ -1,7 +1,7 @@
 require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-DXd097EP.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
 const require_config_schema = require("./config-schema-BSNLJUta.cjs");
-const require_setup_surface = require("./setup-surface-D4f6x5cx.cjs");
+const require_setup_surface = require("./setup-surface-BcRVoUY8.cjs");
 let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let openclaw_plugin_sdk_channel_config_helpers = require("openclaw/plugin-sdk/channel-config-helpers");
@@ -671,7 +671,7 @@ const collectMSTeamsSecurityWarnings = (0, openclaw_plugin_sdk_channel_policy.cr
 	resolveGroupPolicy: ({ cfg }) => cfg.channels?.msteams?.groupPolicy,
 	collect: ({ groupPolicy }) => groupPolicy === "open" ? ["- MS Teams groups: groupPolicy=\"open\" allows any member to trigger (mention-gated). Set channels.msteams.groupPolicy=\"allowlist\" + channels.msteams.groupAllowFrom to restrict senders."] : []
 });
-const loadMSTeamsChannelRuntime = (0, openclaw_plugin_sdk_lazy_runtime.createLazyRuntimeNamedExport)(() => Promise.resolve().then(() => require("./channel.runtime-hd1Zsoo2.cjs")), "msTeamsChannelRuntime");
+const loadMSTeamsChannelRuntime = (0, openclaw_plugin_sdk_lazy_runtime.createLazyRuntimeNamedExport)(() => Promise.resolve().then(() => require("./channel.runtime-Sn3hY2Lu.cjs")), "msTeamsChannelRuntime");
 const resolveMSTeamsChannelConfig = (cfg) => ({
 	allowFrom: cfg.channels?.msteams?.allowFrom,
 	defaultTo: cfg.channels?.msteams?.defaultTo
@@ -1565,7 +1565,7 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 			})
 		}),
 		gateway: { startAccount: async (ctx) => {
-			const { monitorMSTeamsProvider } = await Promise.resolve().then(() => require("./src-20YasZEp.cjs"));
+			const { monitorMSTeamsProvider } = await Promise.resolve().then(() => require("./src-BQM9QUTF.cjs"));
 			const port = ctx.cfg.channels?.msteams?.webhook?.port ?? 3978;
 			ctx.setStatus({
 				accountId: ctx.accountId,

package/dist/channel-plugin-api.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./channel-BKc8zroK.cjs");
+const require_channel = require("./channel-oNBYNcJT.cjs");
 exports.msteamsPlugin = require_channel.msteamsPlugin;

package/dist/{channel.runtime-hd1Zsoo2.cjs → channel.runtime-Sn3hY2Lu.cjs}

@@ -1,10 +1,10 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-DXd097EP.cjs");
-const require_channel = require("./channel-BKc8zroK.cjs");
-const require_setup_surface = require("./setup-surface-D4f6x5cx.cjs");
-const require_polls = require("./polls-BhoI4VaN.cjs");
-const require_messenger = require("./messenger-BVcKl6dv.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
+const require_channel = require("./channel-oNBYNcJT.cjs");
+const require_setup_surface = require("./setup-surface-BcRVoUY8.cjs");
+const require_polls = require("./polls-CWExq2xZ.cjs");
+const require_messenger = require("./messenger-Do4oje4J.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_reply_payload = require("openclaw/plugin-sdk/reply-payload");
@@ -1291,10 +1291,16 @@ async function probeMSTeams(cfg) {
 	try {
 		const { app } = await require_resolve_allowlist.loadMSTeamsSdkWithAuth(creds, require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(cfg));
 		const tokenProvider = require_resolve_allowlist.createMSTeamsTokenProvider(app);
-		if (!await tokenProvider.getAccessToken("https://api.botframework.com")) throw new Error("Failed to acquire bot token");
+		if (!await require_resolve_allowlist.withMSTeamsRequestDeadline({
+			label: "MS Teams Bot Framework probe token",
+			work: () => tokenProvider.getAccessToken("https://api.botframework.com")
+		})) throw new Error("Failed to acquire bot token");
 		let graph;
 		try {
-			const accessToken = require_resolve_allowlist.readAccessToken(await tokenProvider.getAccessToken("https://graph.microsoft.com"));
+			const accessToken = require_resolve_allowlist.readAccessToken(await require_resolve_allowlist.withMSTeamsRequestDeadline({
+				label: "MS Teams Graph probe token",
+				work: () => tokenProvider.getAccessToken("https://graph.microsoft.com")
+			}));
 			const payload = accessToken ? decodeJwtPayload(accessToken) : null;
 			graph = {
 				ok: true,

package/dist/delegated-state-DOSCHaAB.cjs

@@ -0,0 +1,98 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+const require_runtime = require("./runtime-gZTAuFux.cjs");
+//#region extensions/msteams/src/delegated-state.ts
+const MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME = "msteams-delegated.json";
+const MSTEAMS_DELEGATED_TOKEN_NAMESPACE = "delegated-token";
+const MSTEAMS_DELEGATED_TOKEN_KEY = "current";
+function openDelegatedTokenStore(env) {
+	return require_runtime.getMSTeamsRuntime().state.openSyncKeyedStore({
+		namespace: MSTEAMS_DELEGATED_TOKEN_NAMESPACE,
+		maxEntries: 1,
+		overflowPolicy: "reject-new",
+		...env ? { env } : {}
+	});
+}
+function normalizeMSTeamsDelegatedTokens(value) {
+	if (!value || typeof value !== "object") return null;
+	const token = value;
+	if (typeof token.accessToken !== "string" || !token.accessToken || typeof token.refreshToken !== "string" || !token.refreshToken || typeof token.expiresAt !== "number" || !Number.isFinite(token.expiresAt) || !Array.isArray(token.scopes) || !token.scopes.every((scope) => typeof scope === "string" && scope.length > 0)) return null;
+	return {
+		accessToken: token.accessToken,
+		refreshToken: token.refreshToken,
+		expiresAt: token.expiresAt,
+		scopes: [...token.scopes],
+		...typeof token.userPrincipalName === "string" ? { userPrincipalName: token.userPrincipalName } : {}
+	};
+}
+function loadMSTeamsDelegatedTokens(env) {
+	return normalizeMSTeamsDelegatedTokens(openDelegatedTokenStore(env).lookup("current")) ?? void 0;
+}
+function saveMSTeamsDelegatedTokens(tokens, env) {
+	const normalized = normalizeMSTeamsDelegatedTokens(tokens);
+	if (!normalized) throw new Error("Invalid Microsoft Teams delegated token payload");
+	openDelegatedTokenStore(env).register(MSTEAMS_DELEGATED_TOKEN_KEY, normalized);
+}
+//#endregion
+Object.defineProperty(exports, "MSTEAMS_DELEGATED_TOKEN_KEY", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DELEGATED_TOKEN_KEY;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_DELEGATED_TOKEN_NAMESPACE", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DELEGATED_TOKEN_NAMESPACE;
+	}
+});
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});
+Object.defineProperty(exports, "loadMSTeamsDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return loadMSTeamsDelegatedTokens;
+	}
+});
+Object.defineProperty(exports, "normalizeMSTeamsDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return normalizeMSTeamsDelegatedTokens;
+	}
+});
+Object.defineProperty(exports, "saveMSTeamsDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return saveMSTeamsDelegatedTokens;
+	}
+});

package/dist/directory-contract-api.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_resolve_allowlist = require("./resolve-allowlist-DXd097EP.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
 let openclaw_plugin_sdk_directory_runtime = require("openclaw/plugin-sdk/directory-runtime");
 const msteamsDirectoryContractPlugin = {
 	id: "msteams",

package/dist/doctor-contract-api.cjs

@@ -1,14 +1,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
-const require_polls = require("./polls-BhoI4VaN.cjs");
-const require_sso_token_store = require("./sso-token-store-CktCz88k.cjs");
+const require_delegated_state = require("./delegated-state-DOSCHaAB.cjs");
+const require_polls = require("./polls-CWExq2xZ.cjs");
+const require_sso_token_store = require("./sso-token-store-OSg229re.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
-let node_path = require("node:path");
-node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
-node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+node_crypto = require_delegated_state.__toESM(node_crypto, 1);
 let node_fs_promises = require("node:fs/promises");
-node_fs_promises = require_rolldown_runtime.__toESM(node_fs_promises, 1);
+node_fs_promises = require_delegated_state.__toESM(node_fs_promises, 1);
+let node_path = require("node:path");
+node_path = require_delegated_state.__toESM(node_path, 1);
 let openclaw_plugin_sdk_runtime_doctor = require("openclaw/plugin-sdk/runtime-doctor");
 let openclaw_plugin_sdk_session_store_runtime = require("openclaw/plugin-sdk/session-store-runtime");
 //#region extensions/msteams/doctor-contract-api.ts
@@ -314,6 +314,85 @@ const stateMigrations = [
 			};
 		}
 	},
+	{
+		id: "msteams-delegated-token-json-to-plugin-state",
+		label: "Microsoft Teams delegated OAuth token",
+		async detectLegacyState(params) {
+			const filePath = resolveStateFilePath(params.stateDir, require_delegated_state.MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME);
+			try {
+				return (await node_fs_promises.default.stat(filePath)).isFile() ? { preview: [`- ${MSTEAMS_PLUGIN_ID} delegated OAuth token -> plugin state (${require_delegated_state.MSTEAMS_DELEGATED_TOKEN_NAMESPACE})`] } : null;
+			} catch {
+				return null;
+			}
+		},
+		async migrateLegacyState(params) {
+			const changes = [];
+			const warnings = [];
+			const filePath = resolveStateFilePath(params.stateDir, require_delegated_state.MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME);
+			let token;
+			try {
+				token = require_delegated_state.normalizeMSTeamsDelegatedTokens(JSON.parse(await node_fs_promises.default.readFile(filePath, "utf8")));
+			} catch (error) {
+				if (error.code === "ENOENT") return {
+					changes,
+					warnings
+				};
+				warnings.push(`Failed reading ${MSTEAMS_PLUGIN_ID} delegated OAuth token legacy source; left it in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			if (!token) {
+				warnings.push(`Invalid ${MSTEAMS_PLUGIN_ID} delegated OAuth token legacy source; left it in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			const store = params.context.openPluginStateKeyedStore({
+				namespace: require_delegated_state.MSTEAMS_DELEGATED_TOKEN_NAMESPACE,
+				maxEntries: 1,
+				overflowPolicy: "reject-new"
+			});
+			const existing = await store.lookup(require_delegated_state.MSTEAMS_DELEGATED_TOKEN_KEY);
+			if (existing && JSON.stringify(existing) !== JSON.stringify(token)) {
+				warnings.push(`Kept existing ${MSTEAMS_PLUGIN_ID} delegated OAuth token in plugin state; left differing legacy source in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			if (!existing) try {
+				await store.registerIfAbsent(require_delegated_state.MSTEAMS_DELEGATED_TOKEN_KEY, token);
+			} catch (error) {
+				warnings.push(`Failed importing ${MSTEAMS_PLUGIN_ID} delegated OAuth token: ${String(error)}; left legacy source in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			const persisted = require_delegated_state.normalizeMSTeamsDelegatedTokens(await store.lookup(require_delegated_state.MSTEAMS_DELEGATED_TOKEN_KEY));
+			if (!persisted || JSON.stringify(persisted) !== JSON.stringify(token)) {
+				warnings.push(`Failed verifying ${MSTEAMS_PLUGIN_ID} delegated OAuth token in plugin state; left legacy source in place`);
+				return {
+					changes,
+					warnings
+				};
+			}
+			changes.push(`Migrated ${MSTEAMS_PLUGIN_ID} delegated OAuth token -> plugin state`);
+			await (0, openclaw_plugin_sdk_runtime_doctor.archiveLegacyStateSource)({
+				filePath,
+				label: `${MSTEAMS_PLUGIN_ID} delegated OAuth token`,
+				changes,
+				warnings
+			});
+			return {
+				changes,
+				warnings
+			};
+		}
+	},
 	{
 		id: "msteams-feedback-learnings-json-to-plugin-state",
 		label: "Microsoft Teams feedback learnings",

package/dist/{messenger-BVcKl6dv.cjs → messenger-Do4oje4J.cjs}

@@ -1,9 +1,9 @@
-const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
+const require_delegated_state = require("./delegated-state-DOSCHaAB.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-DXd097EP.cjs");
-const require_setup_surface = require("./setup-surface-D4f6x5cx.cjs");
-const require_polls = require("./polls-BhoI4VaN.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
+const require_setup_surface = require("./setup-surface-BcRVoUY8.cjs");
+const require_polls = require("./polls-CWExq2xZ.cjs");
 let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_reply_payload = require("openclaw/plugin-sdk/reply-payload");
@@ -11,11 +11,11 @@ let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-ht
 let node_dns_promises = require("node:dns/promises");
 let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
-let node_path = require("node:path");
-node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let openclaw_plugin_sdk_html_entity_runtime = require("openclaw/plugin-sdk/html-entity-runtime");
 let node_crypto = require("node:crypto");
-node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+node_crypto = require_delegated_state.__toESM(node_crypto, 1);
+let node_path = require("node:path");
+node_path = require_delegated_state.__toESM(node_path, 1);
 let openclaw_plugin_sdk_reply_chunking = require("openclaw/plugin-sdk/reply-chunking");
 let openclaw_plugin_sdk_web_media = require("openclaw/plugin-sdk/web-media");
 let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runtime");
@@ -256,6 +256,7 @@ async function uploadToConsentUrl(params) {
 		},
 		body: new Uint8Array(params.buffer)
 	}, params.timeoutMs ?? require_resolve_allowlist.resolveMSTeamsSharePointUploadTimeoutMs(params.buffer.length), fetchFn);
+	await res.body?.cancel().catch(() => void 0);
 	if (!res.ok) throw new Error(`File upload to consent URL failed: ${res.status} ${res.statusText}`);
 }
 //#endregion
@@ -270,7 +271,7 @@ const RAW_CHUNK_BYTES = 36 * 1024;
 const PENDING_UPLOAD_META_MAX_ENTRIES = 200;
 const PENDING_UPLOAD_META_NAMESPACE = "pending-uploads";
 const PENDING_UPLOAD_CHUNKS_NAMESPACE = "pending-upload-chunks";
-const PENDING_UPLOAD_LOCK_FILENAME = "msteams-pending-uploads.sqlite.lock";
+const PENDING_UPLOAD_MUTATION_KEY = "pending-uploads";
 function createMetaStore(options) {
 	return require_runtime.getMSTeamsRuntime().state.openKeyedStore({
 		namespace: PENDING_UPLOAD_META_NAMESPACE,
@@ -339,7 +340,7 @@ async function registerUploadRows(record, metaStore, chunkStore, ttlMs, overwrit
 	}));
 }
 async function withPendingUploadLock(options, run) {
-	return await require_polls.withMSTeamsSqliteMutationLock(options, PENDING_UPLOAD_LOCK_FILENAME, run);
+	return await require_polls.withMSTeamsSqliteMutationLock(options, PENDING_UPLOAD_MUTATION_KEY, run);
 }
 async function readUploadRows(id, metaStore, chunkStore) {
 	const meta = await metaStore.lookup(buildMetaKey(id));

package/dist/{oauth-yNoKtU_3.cjs → oauth-BUFvYhIw.cjs}

@@ -1,4 +1,4 @@
-const require_resolve_allowlist = require("./resolve-allowlist-DXd097EP.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
 let openclaw_plugin_sdk_provider_auth = require("openclaw/plugin-sdk/provider-auth");
 let openclaw_plugin_sdk_provider_auth_runtime = require("openclaw/plugin-sdk/provider-auth-runtime");
 let openclaw_plugin_sdk_runtime_env = require("openclaw/plugin-sdk/runtime-env");

package/dist/{polls-BhoI4VaN.cjs → polls-CWExq2xZ.cjs}

@@ -1,15 +1,13 @@
-const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
+const require_delegated_state = require("./delegated-state-DOSCHaAB.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_file_lock = require("openclaw/plugin-sdk/file-lock");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
-let node_path = require("node:path");
-node_path = require_rolldown_runtime.__toESM(node_path, 1);
-let openclaw_plugin_sdk_security_runtime = require("openclaw/plugin-sdk/security-runtime");
 let node_crypto = require("node:crypto");
-node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+node_crypto = require_delegated_state.__toESM(node_crypto, 1);
+let node_path = require("node:path");
+node_path = require_delegated_state.__toESM(node_path, 1);
 let openclaw_plugin_sdk_keyed_async_queue = require("openclaw/plugin-sdk/keyed-async-queue");
-let openclaw_plugin_sdk_json_store = require("openclaw/plugin-sdk/json-store");
 //#region extensions/msteams/src/conversation-store-helpers.ts
 function normalizeStoredConversationId(raw) {
 	return raw.split(";")[0] ?? raw;
@@ -52,30 +50,6 @@ function findPreferredDmConversationByUserId(entries, id) {
 	return candidates[0] ?? null;
 }
 //#endregion
-//#region extensions/msteams/src/store-fs.ts
-const STORE_LOCK_OPTIONS = {
-	retries: {
-		retries: 10,
-		factor: 2,
-		minTimeout: 100,
-		maxTimeout: 1e4,
-		randomize: true
-	},
-	stale: 3e4
-};
-async function writeJsonFile(filePath, value) {
-	await (0, openclaw_plugin_sdk_json_store.writeJsonFileAtomically)(filePath, value);
-}
-async function ensureJsonFile(filePath, fallback) {
-	if (!await (0, openclaw_plugin_sdk_security_runtime.pathExists)(filePath)) await writeJsonFile(filePath, fallback);
-}
-async function withFileLock(filePath, fallback, fn) {
-	await ensureJsonFile(filePath, fallback);
-	return await (0, openclaw_plugin_sdk_file_lock.withFileLock)(filePath, STORE_LOCK_OPTIONS, async () => {
-		return await fn();
-	});
-}
-//#endregion
 //#region extensions/msteams/src/sqlite-state.ts
 function resolveStateDirOverride(options) {
 	if (!options) return;
@@ -100,13 +74,23 @@ function resolveMSTeamsSqliteStateDir(options) {
 	return resolveStateDirOverride(options) ?? require_runtime.getMSTeamsRuntime().state.resolveStateDir(options?.env ?? process.env, options?.homedir);
 }
 const sqliteMutationLocks = new openclaw_plugin_sdk_keyed_async_queue.KeyedAsyncQueue();
+const MSTEAMS_MUTATION_LOCK_OPTIONS = {
+	retries: {
+		retries: 10,
+		factor: 2,
+		minTimeout: 100,
+		maxTimeout: 1e4,
+		randomize: true
+	},
+	stale: 3e4
+};
 async function withProcessMutationLock(lockPath, fn) {
 	return await sqliteMutationLocks.enqueue(lockPath, fn);
 }
-async function withMSTeamsSqliteMutationLock(options, lockFilename, fn) {
-	const lockPath = node_path.default.join(resolveMSTeamsSqliteStateDir(options), lockFilename);
-	return await withProcessMutationLock(lockPath, async () => {
-		return await withFileLock(lockPath, { version: 1 }, fn);
+async function withMSTeamsSqliteMutationLock(options, mutationKey, fn) {
+	const scopedMutationKey = node_path.default.join(resolveMSTeamsSqliteStateDir(options), mutationKey);
+	return await withProcessMutationLock(scopedMutationKey, async () => {
+		return await (0, openclaw_plugin_sdk_file_lock.withFileLock)(scopedMutationKey, MSTEAMS_MUTATION_LOCK_OPTIONS, fn);
 	});
 }
 //#endregion
@@ -116,7 +100,7 @@ const MSTEAMS_CONVERSATIONS_NAMESPACE = "conversations";
 const MSTEAMS_MAX_CONVERSATIONS = 1e3;
 const MSTEAMS_SQLITE_MAX_CONVERSATION_ROWS = 2e3;
 const MSTEAMS_CONVERSATION_TTL_MS = 365 * 24 * 60 * 60 * 1e3;
-const CONVERSATION_LOCK_FILENAME = "msteams-conversations.sqlite.lock";
+const CONVERSATION_MUTATION_KEY = "conversations";
 function createConversationStateStore(params) {
 	return require_runtime.getMSTeamsRuntime().state.openKeyedStore({
 		namespace: MSTEAMS_CONVERSATIONS_NAMESPACE,
@@ -217,14 +201,14 @@ function createMSTeamsConversationStoreState(params) {
 	};
 	const upsert = async (conversationId, reference) => {
 		const normalizedId = normalizeStoredConversationId(conversationId);
-		await withMSTeamsSqliteMutationLock(params, CONVERSATION_LOCK_FILENAME, async () => {
+		await withMSTeamsSqliteMutationLock(params, CONVERSATION_MUTATION_KEY, async () => {
 			const existing = await lookupStored(normalizedId);
 			await register(normalizedId, mergeStoredConversationReference(existing ?? void 0, reference, (/* @__PURE__ */ new Date()).toISOString()));
 		});
 	};
 	const remove = async (conversationId) => {
 		const normalizedId = normalizeStoredConversationId(conversationId);
-		return await withMSTeamsSqliteMutationLock(params, CONVERSATION_LOCK_FILENAME, async () => {
+		return await withMSTeamsSqliteMutationLock(params, CONVERSATION_MUTATION_KEY, async () => {
 			return await conversationStore.delete(buildMSTeamsConversationStateKey(normalizedId));
 		});
 	};
@@ -246,7 +230,7 @@ const MSTEAMS_SQLITE_MAX_POLL_ROWS = 2e3;
 const MSTEAMS_POLL_VOTE_BUCKET_COUNT = 32;
 const MSTEAMS_MAX_POLL_VOTE_BUCKET_ROWS = 1001 * MSTEAMS_POLL_VOTE_BUCKET_COUNT;
 const MSTEAMS_POLL_TTL_MS = 720 * 60 * 60 * 1e3;
-const POLL_LOCK_FILENAME = "msteams-polls.sqlite.lock";
+const POLL_MUTATION_KEY = "polls";
 function normalizeChoiceValue(value) {
 	if (typeof value === "string") {
 		const trimmed = value.trim();
@@ -496,7 +480,7 @@ function createMSTeamsPollStoreState(params) {
 		}
 	};
 	const createPoll = async (poll) => {
-		await withMSTeamsSqliteMutationLock(params, POLL_LOCK_FILENAME, async () => {
+		await withMSTeamsSqliteMutationLock(params, POLL_MUTATION_KEY, async () => {
 			const { metadata, votes } = splitMSTeamsPoll(poll);
 			await pollStore.register(buildMSTeamsPollStateKey(poll.id), toPluginJsonValue(metadata));
 			await deletePollVotes(poll.id);
@@ -511,7 +495,7 @@ function createMSTeamsPollStoreState(params) {
 		return await reconstructPoll(poll);
 	};
 	const recordVote = async (vote) => {
-		return await withMSTeamsSqliteMutationLock(params, POLL_LOCK_FILENAME, async () => {
+		return await withMSTeamsSqliteMutationLock(params, POLL_MUTATION_KEY, async () => {
 			const pollKey = buildMSTeamsPollStateKey(vote.pollId);
 			const poll = await pollStore.lookup(pollKey);
 			if (!poll) return null;

package/dist/{resolve-allowlist-DXd097EP.cjs → resolve-allowlist-Dk-1CqBm.cjs}

@@ -1,4 +1,4 @@
-const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
+const require_delegated_state = require("./delegated-state-DOSCHaAB.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("./runtime-api.cjs");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
@@ -12,11 +12,8 @@ let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy")
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
 let node_fs = require("node:fs");
-node_fs = require_rolldown_runtime.__toESM(node_fs, 1);
+node_fs = require_delegated_state.__toESM(node_fs, 1);
 let node_module = require("node:module");
-let node_path = require("node:path");
-node_path = require_rolldown_runtime.__toESM(node_path, 1);
-let openclaw_plugin_sdk_security_runtime = require("openclaw/plugin-sdk/security-runtime");
 let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
 //#region extensions/msteams/src/request-timeout.ts
 const MSTEAMS_REQUEST_TIMEOUT_MS = 3e4;
@@ -909,15 +906,6 @@ async function refreshMSTeamsDelegatedTokens(params) {
 	});
 }
 //#endregion
-//#region extensions/msteams/src/storage.ts
-function resolveMSTeamsStorePath(params) {
-	if (params.storePath) return params.storePath;
-	if (params.stateDir) return node_path.default.join(params.stateDir, params.filename);
-	const env = params.env ?? process.env;
-	const stateDir = params.homedir ? require_runtime.getMSTeamsRuntime().state.resolveStateDir(env, params.homedir) : require_runtime.getMSTeamsRuntime().state.resolveStateDir(env);
-	return node_path.default.join(stateDir, params.filename);
-}
-//#endregion
 //#region extensions/msteams/src/token.ts
 function resolveAuthType(cfg) {
 	const fromCfg = cfg?.authType;
@@ -969,21 +957,11 @@ function resolveMSTeamsCredentials(cfg) {
 		tenantId
 	};
 }
-const DELEGATED_TOKEN_FILENAME = "msteams-delegated.json";
-function resolveDelegatedTokenPath() {
-	return resolveMSTeamsStorePath({ filename: DELEGATED_TOKEN_FILENAME });
-}
 function loadDelegatedTokens() {
-	try {
-		const content = (0, node_fs.readFileSync)(resolveDelegatedTokenPath(), "utf8");
-		return JSON.parse(content);
-	} catch {
-		return;
-	}
+	return require_delegated_state.loadMSTeamsDelegatedTokens();
 }
 function saveDelegatedTokens(tokens) {
-	const tokenPath = resolveDelegatedTokenPath();
-	(0, openclaw_plugin_sdk_security_runtime.privateFileStoreSync)((0, node_path.dirname)(tokenPath)).writeJson((0, node_path.basename)(tokenPath), tokens);
+	require_delegated_state.saveMSTeamsDelegatedTokens(tokens);
 }
 async function resolveDelegatedAccessToken(params) {
 	const tokens = loadDelegatedTokens();
@@ -1124,7 +1102,11 @@ async function resolveGraphToken(cfg, options) {
 		if (delegated) return delegated;
 	}
 	const { app } = await loadMSTeamsSdkWithAuth(creds, resolveMSTeamsSdkCloudOptions(msteamsCfg));
-	const accessToken = readAccessToken(await createMSTeamsTokenProvider(app).getAccessToken("https://graph.microsoft.com"));
+	const tokenProvider = createMSTeamsTokenProvider(app);
+	const accessToken = readAccessToken(await withMSTeamsRequestDeadline({
+		label: "MS Teams Graph token",
+		work: () => tokenProvider.getAccessToken("https://graph.microsoft.com")
+	}));
 	if (!accessToken) throw new Error("MS Teams graph token unavailable");
 	return accessToken;
 }

package/dist/runtime-api.cjs

@@ -11,7 +11,6 @@ let openclaw_plugin_sdk_dangerous_name_runtime = require("openclaw/plugin-sdk/da
 let openclaw_plugin_sdk_runtime_group_policy = require("openclaw/plugin-sdk/runtime-group-policy");
 let openclaw_plugin_sdk_file_lock = require("openclaw/plugin-sdk/file-lock");
 let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runtime");
-let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
 let openclaw_plugin_sdk_outbound_media = require("openclaw/plugin-sdk/outbound-media");
 let openclaw_plugin_sdk_reply_payload = require("openclaw/plugin-sdk/reply-payload");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
@@ -84,12 +83,6 @@ Object.defineProperty(exports, "detectMime", {
 		return openclaw_plugin_sdk_media_runtime.detectMime;
 	}
 });
-Object.defineProperty(exports, "dispatchReplyFromConfigWithSettledDispatcher", {
-	enumerable: true,
-	get: function() {
-		return openclaw_plugin_sdk_channel_inbound.dispatchReplyFromConfigWithSettledDispatcher;
-	}
-});
 Object.defineProperty(exports, "extensionForMime", {
 	enumerable: true,
 	get: function() {

package/dist/secret-contract-api.cjs

@@ -16,6 +16,12 @@ function collectRuntimeConfigAssignments(params) {
 		context: params.context,
 		active: msteams.enabled !== false,
 		inactiveReason: "Microsoft Teams channel is disabled.",
+		owner: {
+			ownerKind: "account",
+			ownerId: "msteams:default",
+			requiredForGateway: false,
+			disposition: "isolate"
+		},
 		apply: (value) => {
 			msteams.appPassword = value;
 		}

package/dist/setup-plugin-api.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_resolve_allowlist = require("./resolve-allowlist-DXd097EP.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
 const require_config_schema = require("./config-schema-BSNLJUta.cjs");
-const require_setup_surface = require("./setup-surface-D4f6x5cx.cjs");
+const require_setup_surface = require("./setup-surface-BcRVoUY8.cjs");
 let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let openclaw_plugin_sdk_channel_config_helpers = require("openclaw/plugin-sdk/channel-config-helpers");

package/dist/{setup-surface-D4f6x5cx.cjs → setup-surface-BcRVoUY8.cjs}

@@ -1,4 +1,4 @@
-const require_resolve_allowlist = require("./resolve-allowlist-DXd097EP.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Dk-1CqBm.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_setup = require("openclaw/plugin-sdk/setup");
@@ -455,7 +455,7 @@ const msteamsSetupWizard = {
 				};
 				let oauthModule;
 				try {
-					oauthModule = await Promise.resolve().then(() => require("./oauth-yNoKtU_3.cjs"));
+					oauthModule = await Promise.resolve().then(() => require("./oauth-BUFvYhIw.cjs"));
 				} catch (err) {
 					await noteDelegatedAuthFailure(err);
 					return {