@openclaw/msteams 2026.8.1-beta.2 → 2026.8.1

package/dist/{setup-surface-DAhGL2h8.cjs → channel.setup-CKb8aKCV.cjs}

@@ -1,9 +1,13 @@
-const require_resolve_allowlist = require("./resolve-allowlist-C6YcNC9a.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CWbvAW4v.cjs");
+require("./secret-input-C65t6kjM.cjs");
+const require_config_schema = require("./config-schema-MyN2lamA.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
-let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
+let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
+let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_channel_config_helpers = require("openclaw/plugin-sdk/channel-config-helpers");
+let openclaw_plugin_sdk_secret_file_runtime = require("openclaw/plugin-sdk/secret-file-runtime");
 let openclaw_plugin_sdk_channel_setup = require("openclaw/plugin-sdk/channel-setup");
 let openclaw_plugin_sdk_setup = require("openclaw/plugin-sdk/setup");
 let openclaw_plugin_sdk_setup_tools = require("openclaw/plugin-sdk/setup-tools");
@@ -20,13 +24,23 @@ const msteamsMeta = {
 	aliases: ["teams"],
 	order: 60
 };
+function resolveMSTeamsAccount(cfg) {
+	const config = cfg.channels?.msteams;
+	const credentials = require_resolve_allowlist.resolveMSTeamsCredentials(config);
+	const certificatePath = credentials?.type === "federated" && !credentials.useManagedIdentity ? credentials.certificatePath : void 0;
+	const certificate = certificatePath ? (0, openclaw_plugin_sdk_secret_file_runtime.tryReadSecretFileSync)(certificatePath, "Microsoft Teams certificate", void 0, { configPath: config?.certificatePath?.trim() ? "channels.msteams.certificatePath" : "env.MSTEAMS_CERTIFICATE_PATH" }) : void 0;
+	const unavailable = certificate?.status === "configured_unavailable";
+	return {
+		accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+		enabled: config?.enabled !== false,
+		configured: Boolean(credentials),
+		tokenStatus: !credentials ? "missing" : unavailable ? "configured_unavailable" : "available",
+		...unavailable ? { credentialDiagnostics: [certificate.diagnostic] } : {}
+	};
+}
 const msteamsConfigAdapter = (0, openclaw_plugin_sdk_channel_config_helpers.createTopLevelChannelConfigAdapter)({
 	sectionKey: "msteams",
-	resolveAccount: (cfg) => ({
-		accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
-		enabled: cfg.channels?.msteams?.enabled !== false,
-		configured: Boolean(require_resolve_allowlist.resolveMSTeamsCredentials(cfg.channels?.msteams))
-	}),
+	resolveAccount: resolveMSTeamsAccount,
 	resolveAccessorAccount: ({ cfg }) => ({
 		allowFrom: cfg.channels?.msteams?.allowFrom,
 		defaultTo: cfg.channels?.msteams?.defaultTo
@@ -220,12 +234,8 @@ function parseNonNegativeRetryAfterSeconds(raw) {
 	});
 }
 /**
-* Classify outbound send errors for safe retries and actionable logs.
-*
-* Important: We only mark errors as retryable when we have an explicit HTTP
-* status code that indicates the message was not accepted (e.g. 429, 5xx).
-* For transport-level errors where delivery is ambiguous, we prefer to avoid
-* retries to reduce the chance of duplicate posts.
+* Owns retry safety and delivery ambiguity for Teams send failures.
+* Only Teams rate-limit rejection proves this unkeyed POST safe to replay.
 */
 function classifyMSTeamsSendError(err) {
 	const statusCode = extractStatusCode(err);
@@ -249,15 +259,15 @@ function classifyMSTeamsSendError(err) {
 		};
 	}
 	if (statusCode === 429) return {
-		kind: "throttled",
+		kind: "replay-safe",
 		statusCode,
 		retryAfterMs: retryAfterMs ?? void 0,
 		errorCode
 	};
 	if (statusCode === 408 || statusCode != null && statusCode >= 500) return {
-		kind: "transient",
+		kind: "ambiguous",
+		source: "http",
 		statusCode,
-		retryAfterMs: retryAfterMs ?? void 0,
 		errorCode
 	};
 	if (statusCode != null && statusCode >= 400) return {
@@ -265,17 +275,14 @@ function classifyMSTeamsSendError(err) {
 		statusCode,
 		errorCode
 	};
-	if (statusCode == null) {
-		const networkCode = (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(err) && typeof err.code === "string" ? err.code : null;
-		if (networkCode === "ECONNREFUSED" || networkCode === "ENOTFOUND" || networkCode === "EHOSTUNREACH" || networkCode === "ETIMEDOUT" || networkCode === "ECONNRESET") return {
-			kind: "network",
-			errorCode: networkCode
-		};
-	}
+	if (statusCode == null && (0, openclaw_plugin_sdk_retry_runtime.isTransientNetworkError)(err)) return {
+		kind: "ambiguous",
+		source: "transport",
+		errorCode
+	};
 	return {
 		kind: "unknown",
 		statusCode: statusCode ?? void 0,
-		retryAfterMs: retryAfterMs ?? void 0,
 		errorCode
 	};
 }
@@ -294,9 +301,15 @@ function isRevokedProxyError(err) {
 function formatMSTeamsSendErrorHint(classification) {
 	if (classification.kind === "auth") return "check msteams appId/appPassword/tenantId (or env vars MSTEAMS_APP_ID/MSTEAMS_APP_PASSWORD/MSTEAMS_TENANT_ID)";
 	if (classification.errorCode === "ContentStreamNotAllowed") return "Teams expired the content stream; stop streaming earlier and fall back to normal message delivery";
-	if (classification.kind === "throttled") return "Teams throttled the bot; backing off may help";
-	if (classification.kind === "transient") return "transient Teams/Bot Framework error; retry may succeed";
-	if (classification.kind === "network") return "transport-level failure sending reply to Teams Bot Connector (smba.trafficmanager.net) — check egress firewall rules allow outbound HTTPS to smba.trafficmanager.net";
+	if (classification.kind === "replay-safe") return "Teams throttled the bot; backing off may help";
+	if (classification.kind === "ambiguous") {
+		if (classification.source === "transport") return "transport-level failure sending to Teams Bot Connector (smba.trafficmanager.net); the outcome is unknown, so check egress and conversation history before taking further action";
+		return "Teams/Bot Framework delivery outcome is unknown; inspect the conversation history before taking further action";
+	}
+}
+function formatMSTeamsDeliveryFailureGuidance(classification) {
+	if (classification.kind === "replay-safe") return "The request was rate-limited before delivery; retrying later may succeed.";
+	if (classification.kind === "ambiguous") return "Delivery may already have succeeded; do not send the same content again without checking the conversation.";
 }
 //#endregion
 //#region extensions/msteams/src/setup-surface.ts
@@ -466,7 +479,7 @@ const msteamsSetupWizard = {
 				};
 				let oauthModule;
 				try {
-					oauthModule = await Promise.resolve().then(() => require("./oauth-DktsbN22.cjs"));
+					oauthModule = await Promise.resolve().then(() => require("./oauth-BV7HWGe0.cjs"));
 				} catch (err) {
 					await noteDelegatedAuthFailure(err);
 					return {
@@ -520,6 +533,40 @@ const msteamsSetupWizard = {
 	disable: (cfg) => (0, openclaw_plugin_sdk_setup.setSetupChannelEnabled)(cfg, channel, false)
 };
 //#endregion
+//#region extensions/msteams/src/channel.setup.ts
+const msteamsSetupPlugin = {
+	id: "msteams",
+	meta: {
+		...msteamsMeta,
+		aliases: [...msteamsMeta.aliases]
+	},
+	capabilities: {
+		chatTypes: [
+			"direct",
+			"channel",
+			"group",
+			"thread"
+		],
+		polls: true,
+		threads: true,
+		media: true,
+		reactions: true
+	},
+	reload: { configPrefixes: ["channels.msteams"] },
+	configSchema: require_config_schema.MSTeamsChannelConfigSchema,
+	config: {
+		...msteamsConfigAdapter,
+		isConfigured: (account) => account.configured,
+		describeAccount: (account) => (0, openclaw_plugin_sdk_account_helpers.describeAccountSnapshot)({
+			account,
+			configured: account.configured,
+			extra: { tokenStatus: account.tokenStatus }
+		})
+	},
+	setupWizard: msteamsSetupWizard,
+	setupContract: msteamsSetupContract
+};
+//#endregion
 Object.defineProperty(exports, "classifyMSTeamsSendError", {
 	enumerable: true,
 	get: function() {
@@ -532,6 +579,12 @@ Object.defineProperty(exports, "createMSTeamsSetupWizardBase", {
 		return createMSTeamsSetupWizardBase;
 	}
 });
+Object.defineProperty(exports, "formatMSTeamsDeliveryFailureGuidance", {
+	enumerable: true,
+	get: function() {
+		return formatMSTeamsDeliveryFailureGuidance;
+	}
+});
 Object.defineProperty(exports, "formatMSTeamsSendErrorHint", {
 	enumerable: true,
 	get: function() {
@@ -556,22 +609,16 @@ Object.defineProperty(exports, "msteamsConfigAdapter", {
 		return msteamsConfigAdapter;
 	}
 });
-Object.defineProperty(exports, "msteamsMeta", {
-	enumerable: true,
-	get: function() {
-		return msteamsMeta;
-	}
-});
 Object.defineProperty(exports, "msteamsSetupAdapter", {
 	enumerable: true,
 	get: function() {
 		return msteamsSetupAdapter;
 	}
 });
-Object.defineProperty(exports, "msteamsSetupContract", {
+Object.defineProperty(exports, "msteamsSetupPlugin", {
 	enumerable: true,
 	get: function() {
-		return msteamsSetupContract;
+		return msteamsSetupPlugin;
 	}
 });
 Object.defineProperty(exports, "msteamsSetupWizard", {
@@ -586,3 +633,9 @@ Object.defineProperty(exports, "openDelegatedOAuthUrl", {
 		return openDelegatedOAuthUrl;
 	}
 });
+Object.defineProperty(exports, "resolveMSTeamsAccount", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsAccount;
+	}
+});

package/dist/{config-schema-C4CszdDi.cjs → config-schema-MyN2lamA.cjs}

@@ -80,18 +80,19 @@ function isAzureChinaBotFrameworkServiceUrl(value) {
 		return false;
 	}
 }
+const { accountShape, rootPolicyShape } = (0, openclaw_plugin_sdk_channel_config_schema.buildChannelAccountSchemaParts)({
+	omit: [
+		"name",
+		"mentionPatterns",
+		"replyToMode"
+	],
+	allowFrom: zod.z.array(zod.z.string()).optional(),
+	groupAllowFrom: zod.z.array(zod.z.string()).optional(),
+	streaming: openclaw_plugin_sdk_channel_config_schema.ChannelPreviewStreamingConfigSchema.optional()
+});
 const MSTeamsConfigSchema = zod.z.object({
-	...(0, openclaw_plugin_sdk_channel_config_schema.buildCommonChannelAccountShape)({
-		useDefaults: true,
-		omit: [
-			"name",
-			"mentionPatterns",
-			"replyToMode"
-		],
-		allowFrom: zod.z.array(zod.z.string()).optional(),
-		groupAllowFrom: zod.z.array(zod.z.string()).optional(),
-		streaming: openclaw_plugin_sdk_channel_config_schema.ChannelPreviewStreamingConfigSchema.optional()
-	}),
+	...accountShape,
+	...rootPolicyShape,
 	dangerouslyAllowNameMatching: openclaw_plugin_sdk_channel_config_schema.ChannelDangerouslyAllowNameMatchingSchema,
 	appId: zod.z.string().optional(),
 	appPassword: (0, openclaw_plugin_sdk_secret_input.registerSensitiveConfigSchema)(SecretInputSchema.optional()),

package/dist/configured-state.cjs

@@ -0,0 +1,20 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("./secret-input-C65t6kjM.cjs");
+let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
+//#region extensions/msteams/configured-state.ts
+/** Mirror Teams auth-mode requirements without loading the Azure SDK or full channel. */
+function hasConfiguredMSTeamsChannelState(params) {
+	const config = params.cfg.channels?.msteams;
+	if (config?.enabled === false) return false;
+	const env = params.env ?? process.env;
+	const appId = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(config && Object.hasOwn(config, "appId") ? config.appId : env.MSTEAMS_APP_ID);
+	const tenantId = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(config && Object.hasOwn(config, "tenantId") ? config.tenantId : env.MSTEAMS_TENANT_ID);
+	if (!appId || !tenantId) return false;
+	if ((config?.authType ?? env.MSTEAMS_AUTH_TYPE ?? "secret") === "federated") {
+		const certificatePath = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(config && Object.hasOwn(config, "certificatePath") ? config.certificatePath : env.MSTEAMS_CERTIFICATE_PATH);
+		return Boolean(certificatePath || (config?.useManagedIdentity ?? env.MSTEAMS_USE_MANAGED_IDENTITY === "true"));
+	}
+	return config && Object.hasOwn(config, "appPassword") ? (0, openclaw_plugin_sdk_secret_input.hasConfiguredSecretInput)(config.appPassword) : Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(env.MSTEAMS_APP_PASSWORD));
+}
+//#endregion
+exports.hasConfiguredMSTeamsChannelState = hasConfiguredMSTeamsChannelState;

package/dist/directory-contract-api.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_resolve_allowlist = require("./resolve-allowlist-C6YcNC9a.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CWbvAW4v.cjs");
 let openclaw_plugin_sdk_directory_runtime = require("openclaw/plugin-sdk/directory-runtime");
 const msteamsDirectoryContractPlugin = {
 	id: "msteams",

package/dist/doctor-contract-api.cjs

@@ -11,7 +11,7 @@ node_fs_promises = require_rolldown_runtime.__toESM(node_fs_promises, 1);
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let openclaw_plugin_sdk_runtime_doctor_migrations = require("openclaw/plugin-sdk/runtime-doctor-migrations");
-//#region extensions/msteams/doctor-contract-api.ts
+//#region extensions/msteams/config-doctor-api.ts
 const streamingAliasMigration = (0, openclaw_plugin_sdk_runtime_doctor_migrations.defineChannelAliasMigration)({
 	channelId: "msteams",
 	streaming: { defaultMode: "partial" }
@@ -20,6 +20,8 @@ const legacyConfigRules = streamingAliasMigration.legacyConfigRules;
 function normalizeCompatibilityConfig({ cfg }) {
 	return streamingAliasMigration.normalizeChannelConfig({ cfg });
 }
+//#endregion
+//#region extensions/msteams/doctor-contract-api.ts
 const LEARNINGS_NAMESPACE = "feedback-learnings";
 const MAX_LEARNING_ENTRIES = 1e4;
 const MSTEAMS_PLUGIN_ID = "Microsoft Teams";
@@ -165,6 +167,33 @@ function mergeLearnings(legacy, existing) {
 	}
 	return merged.slice(-10);
 }
+async function completeLegacyKeyedImport(params) {
+	const { filePath, label, imported, warnings } = params;
+	const changes = [];
+	let missing = 0;
+	for (const { store, requiredKeys } of params.stores) {
+		const retainedKeys = new Set((await store.entries()).map((entry) => entry.key));
+		missing += [...requiredKeys].filter((key) => !retainedKeys.has(key)).length;
+	}
+	if (missing > 0) {
+		warnings.push(`Incomplete ${label} migration: plugin state failed to retain every required entry (${missing} missing); left legacy source in place`);
+		return {
+			changes,
+			warnings
+		};
+	}
+	changes.push(`Migrated ${imported} ${label} ${imported === 1 ? "entry" : "entries"} -> plugin state`);
+	await (0, openclaw_plugin_sdk_runtime_doctor_migrations.archiveLegacyStateSource)({
+		filePath,
+		label: params.archiveLabel ?? label,
+		changes,
+		warnings
+	});
+	return {
+		changes,
+		warnings
+	};
+}
 const stateMigrations = [
 	{
 		id: "msteams-conversations-json-to-plugin-state",
@@ -175,35 +204,36 @@ const stateMigrations = [
 			return { preview: [`- ${MSTEAMS_PLUGIN_ID} conversations: ${Object.keys(state.conversations).length} entries -> plugin state (${require_polls.MSTEAMS_CONVERSATIONS_NAMESPACE})`] };
 		},
 		async migrateLegacyState(params) {
-			const changes = [];
-			const warnings = [];
 			const filePath = resolveStateFilePath(params.stateDir, require_polls.MSTEAMS_CONVERSATIONS_LEGACY_FILENAME);
 			const state = await readLegacyJsonFile(filePath, parseLegacyConversationStore);
 			if (!state) return {
-				changes,
-				warnings
+				changes: [],
+				warnings: []
 			};
 			const store = params.context.openPluginStateKeyedStore({
 				namespace: require_polls.MSTEAMS_CONVERSATIONS_NAMESPACE,
 				maxEntries: require_polls.MSTEAMS_SQLITE_MAX_CONVERSATION_ROWS
 			});
+			const requiredKeys = new Set((await store.entries()).map((entry) => entry.key));
 			let imported = 0;
 			for (const [rawConversationId, reference] of require_polls.selectRetainedMSTeamsConversations(state.conversations)) {
 				const conversationId = require_polls.normalizeStoredConversationId(rawConversationId);
 				if (!conversationId) continue;
-				if (await store.registerIfAbsent(require_polls.buildMSTeamsConversationStateKey(conversationId), require_polls.prepareMSTeamsConversationReferenceForStorage(conversationId, reference))) imported++;
+				const key = require_polls.buildMSTeamsConversationStateKey(conversationId);
+				requiredKeys.add(key);
+				const storedReference = require_polls.prepareMSTeamsConversationReferenceForStorage(conversationId, reference);
+				if (await store.registerIfAbsent(key, storedReference)) imported++;
 			}
-			changes.push(`Migrated ${imported} ${MSTEAMS_PLUGIN_ID} conversation ${imported === 1 ? "entry" : "entries"} -> plugin state`);
-			await (0, openclaw_plugin_sdk_runtime_doctor_migrations.archiveLegacyStateSource)({
+			return completeLegacyKeyedImport({
 				filePath,
 				label: `${MSTEAMS_PLUGIN_ID} conversation`,
-				changes,
-				warnings
+				imported,
+				warnings: [],
+				stores: [{
+					store,
+					requiredKeys
+				}]
 			});
-			return {
-				changes,
-				warnings
-			};
 		}
 	},
 	{
@@ -215,13 +245,11 @@ const stateMigrations = [
 			return { preview: [`- ${MSTEAMS_PLUGIN_ID} polls: ${Object.keys(state.polls).length} entries -> plugin state (${require_polls.MSTEAMS_POLLS_NAMESPACE})`] };
 		},
 		async migrateLegacyState(params) {
-			const changes = [];
-			const warnings = [];
 			const filePath = resolveStateFilePath(params.stateDir, require_polls.MSTEAMS_POLLS_LEGACY_FILENAME);
 			const state = await readLegacyJsonFile(filePath, parseLegacyPollStore);
 			if (!state) return {
-				changes,
-				warnings
+				changes: [],
+				warnings: []
 			};
 			const pollStore = params.context.openPluginStateKeyedStore({
 				namespace: require_polls.MSTEAMS_POLLS_NAMESPACE,
@@ -231,10 +259,14 @@ const stateMigrations = [
 				namespace: require_polls.MSTEAMS_POLL_VOTE_BUCKETS_NAMESPACE,
 				maxEntries: require_polls.MSTEAMS_MAX_POLL_VOTE_BUCKET_ROWS
 			});
+			const requiredPollKeys = new Set((await pollStore.entries()).map((entry) => entry.key));
+			const requiredVoteKeys = new Set((await voteBucketStore.entries()).map((entry) => entry.key));
 			let imported = 0;
 			for (const [pollId, poll] of require_polls.selectRetainedMSTeamsPolls(state.polls)) {
 				const { metadata, votes } = require_polls.splitMSTeamsPoll(poll);
-				const didImportPoll = await pollStore.registerIfAbsent(require_polls.buildMSTeamsPollStateKey(pollId), metadata);
+				const pollKey = require_polls.buildMSTeamsPollStateKey(pollId);
+				requiredPollKeys.add(pollKey);
+				const didImportPoll = await pollStore.registerIfAbsent(pollKey, metadata);
 				const buckets = /* @__PURE__ */ new Map();
 				for (const [voterId, selections] of Object.entries(votes)) {
 					const bucket = require_polls.selectMSTeamsPollVoteBucket(pollId, voterId);
@@ -245,6 +277,7 @@ const stateMigrations = [
 				let importedVoteBucket = false;
 				for (const [bucket, bucketVotes] of buckets) {
 					const key = require_polls.buildMSTeamsPollVoteBucketKey(pollId, bucket);
+					requiredVoteKeys.add(key);
 					const existing = await voteBucketStore.lookup(key);
 					await voteBucketStore.register(key, {
 						pollId,
@@ -259,17 +292,19 @@ const stateMigrations = [
 				}
 				if (didImportPoll || importedVoteBucket) imported++;
 			}
-			changes.push(`Migrated ${imported} ${MSTEAMS_PLUGIN_ID} poll ${imported === 1 ? "entry" : "entries"} -> plugin state`);
-			await (0, openclaw_plugin_sdk_runtime_doctor_migrations.archiveLegacyStateSource)({
+			return completeLegacyKeyedImport({
 				filePath,
 				label: `${MSTEAMS_PLUGIN_ID} poll`,
-				changes,
-				warnings
+				imported,
+				warnings: [],
+				stores: [{
+					store: pollStore,
+					requiredKeys: requiredPollKeys
+				}, {
+					store: voteBucketStore,
+					requiredKeys: requiredVoteKeys
+				}]
 			});
-			return {
-				changes,
-				warnings
-			};
 		}
 	},
 	{
@@ -281,18 +316,18 @@ const stateMigrations = [
 			return { preview: [`- ${MSTEAMS_PLUGIN_ID} SSO tokens: ${Object.keys(state.tokens).length} entries -> plugin state (${require_sso_token_store.MSTEAMS_SSO_TOKENS_NAMESPACE})`] };
 		},
 		async migrateLegacyState(params) {
-			const changes = [];
 			const warnings = [];
 			const filePath = resolveStateFilePath(params.stateDir, require_sso_token_store.MSTEAMS_SSO_TOKENS_LEGACY_FILENAME);
 			const state = await readLegacyJsonFile(filePath, (value) => require_sso_token_store.isMSTeamsSsoStoreData(value) ? value : null);
 			if (!state) return {
-				changes,
+				changes: [],
 				warnings
 			};
 			const store = params.context.openPluginStateKeyedStore({
 				namespace: require_sso_token_store.MSTEAMS_SSO_TOKENS_NAMESPACE,
 				maxEntries: require_sso_token_store.MSTEAMS_MAX_SSO_TOKENS
 			});
+			const requiredKeys = new Set((await store.entries()).map((entry) => entry.key));
 			let imported = 0;
 			let skipped = 0;
 			for (const token of Object.values(state.tokens)) {
@@ -301,20 +336,22 @@ const stateMigrations = [
 					skipped++;
 					continue;
 				}
-				if (await store.registerIfAbsent(require_sso_token_store.makeMSTeamsSsoTokenStoreKey(normalized.connectionName, normalized.userId), normalized)) imported++;
+				const key = require_sso_token_store.makeMSTeamsSsoTokenStoreKey(normalized.connectionName, normalized.userId);
+				requiredKeys.add(key);
+				if (await store.registerIfAbsent(key, normalized)) imported++;
 			}
-			changes.push(`Migrated ${imported} ${MSTEAMS_PLUGIN_ID} SSO token ${imported === 1 ? "entry" : "entries"} -> plugin state`);
 			if (skipped > 0) warnings.push(`Skipped ${skipped} malformed ${MSTEAMS_PLUGIN_ID} SSO token ${skipped === 1 ? "entry" : "entries"} during migration`);
-			await (0, openclaw_plugin_sdk_runtime_doctor_migrations.archiveLegacyStateSource)({
+			return completeLegacyKeyedImport({
 				filePath,
-				label: `${MSTEAMS_PLUGIN_ID} SSO-token`,
-				changes,
-				warnings
+				label: `${MSTEAMS_PLUGIN_ID} SSO token`,
+				archiveLabel: `${MSTEAMS_PLUGIN_ID} SSO-token`,
+				imported,
+				warnings,
+				stores: [{
+					store,
+					requiredKeys
+				}]
 			});
-			return {
-				changes,
-				warnings
-			};
 		}
 	},
 	{