@openclaw/msteams 2026.9.4 → 2026.9.5

package/dist/{resolve-allowlist-DmUTQxEz.cjs → .setup/resolve-allowlist-CHzaaWiC.cjs}

@@ -1,10 +1,11 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
-require("./runtime-api.cjs");
-const require_delegated_state = require("./delegated-state-DiEz9JIa.cjs");
+require("../runtime-api.cjs");
+const require_delegated_state = require("./delegated-state-u-ywZyZT.cjs");
 require("./secret-input-C65t6kjM.cjs");
 let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
+let node_async_hooks = require("node:async_hooks");
 let openclaw_plugin_sdk_fetch_runtime = require("openclaw/plugin-sdk/fetch-runtime");
 let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
@@ -14,6 +15,7 @@ let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy")
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
 let openclaw_plugin_sdk_secret_file = require("openclaw/plugin-sdk/secret-file");
+let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let node_module = require("node:module");
 let openclaw_plugin_sdk_html_entity_runtime = require("openclaw/plugin-sdk/html-entity-runtime");
 let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
@@ -222,66 +224,6 @@ function extractHtmlFromAttachment(att) {
 	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(att.content)) return;
 	return typeof att.content.text === "string" ? att.content.text : typeof att.content.body === "string" ? att.content.body : typeof att.content.content === "string" ? att.content.content : void 0;
 }
-function canonicalizeInlineBase64Payload(value) {
-	let cleaned = "";
-	let padding = 0;
-	let sawPadding = false;
-	for (let index = 0; index < value.length; index += 1) {
-		const code = value.charCodeAt(index);
-		if (code <= 32) continue;
-		if (code === 61) {
-			padding += 1;
-			if (padding > 2) return;
-			sawPadding = true;
-			cleaned += "=";
-			continue;
-		}
-		if (sawPadding || !(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return;
-		cleaned += value[index];
-	}
-	return cleaned && cleaned.length % 4 === 0 ? cleaned : void 0;
-}
-function decodeDataImageWithLimits(src, opts) {
-	const match = /^data:(image\/[a-z0-9.+-]+)?(;base64)?,(.*)$/i.exec(src);
-	if (!match) return {
-		candidate: null,
-		estimatedBytes: 0
-	};
-	const contentType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(match[1] ?? "");
-	if (!Boolean(match[2])) return {
-		candidate: null,
-		estimatedBytes: 0
-	};
-	const canonicalPayload = canonicalizeInlineBase64Payload(match[3] ?? "");
-	if (!canonicalPayload) return {
-		candidate: null,
-		estimatedBytes: 0
-	};
-	const estimatedBytes = node_buffer.Buffer.byteLength(canonicalPayload, "base64");
-	if (estimatedBytes <= 0) return {
-		candidate: null,
-		estimatedBytes: 0
-	};
-	if (typeof opts.maxInlineBytes === "number" && estimatedBytes > opts.maxInlineBytes) return {
-		candidate: null,
-		estimatedBytes
-	};
-	try {
-		return {
-			candidate: {
-				kind: "data",
-				data: node_buffer.Buffer.from(canonicalPayload, "base64"),
-				contentType
-			},
-			estimatedBytes
-		};
-	} catch {
-		return {
-			candidate: null,
-			estimatedBytes: 0
-		};
-	}
-}
 function fileHintFromUrl(src) {
 	try {
 		return new URL(src).pathname.split("/").pop() || void 0;
@@ -289,14 +231,13 @@ function fileHintFromUrl(src) {
 		return;
 	}
 }
-function extractInlineImageCandidates(attachments, limits) {
+function extractInlineImageReferences(attachments) {
 	const out = [];
 	const seenReferences = /* @__PURE__ */ new Set();
 	const representedAttachmentIds = new Set(attachments.flatMap((attachment) => {
 		const id = attachment.id?.trim();
 		return id && !extractHtmlFromAttachment(attachment) ? [id] : [];
 	}));
-	let totalEstimatedInlineBytes = 0;
 	for (const att of attachments) {
 		const html = extractHtmlFromAttachment(att);
 		if (!html) continue;
@@ -305,17 +246,11 @@ function extractInlineImageCandidates(attachments, limits) {
 		while (match) {
 			const src = match[1]?.trim();
 			if (src) {
-				if (src.startsWith("data:")) {
-					const { candidate: decoded, estimatedBytes } = decodeDataImageWithLimits(src, { maxInlineBytes: limits?.maxInlineBytes });
-					if (decoded) {
-						const nextTotal = totalEstimatedInlineBytes + estimatedBytes;
-						if (typeof limits?.maxInlineTotalBytes === "number" && nextTotal > limits.maxInlineTotalBytes) out.push({ kind: "unavailable" });
-						else {
-							totalEstimatedInlineBytes = nextTotal;
-							out.push(decoded);
-						}
-					} else out.push({ kind: "unavailable" });
-				} else if (!seenReferences.has(src)) {
+				if (src.startsWith("data:")) out.push({
+					kind: "data",
+					src
+				});
+				else if (!seenReferences.has(src)) {
 					seenReferences.add(src);
 					if (src.startsWith("cid:")) {
 						const sourceId = src.slice(4) || void 0;
@@ -590,6 +525,54 @@ function normalizeBotFrameworkServiceUrl(serviceUrl) {
 	throw new Error(`Blocked Microsoft Teams serviceUrl host: ${describeBotFrameworkServiceUrlHost(serviceUrl)}`);
 }
 //#endregion
+//#region extensions/msteams/src/send-handoff.ts
+const connectorHandoff = new node_async_hooks.AsyncLocalStorage();
+function notDispatched(error) {
+	return error instanceof openclaw_plugin_sdk_error_runtime.PlatformMessageNotDispatchedError ? error : new openclaw_plugin_sdk_error_runtime.PlatformMessageNotDispatchedError(error instanceof Error ? error.message : "Teams delivery authority closed", {
+		cause: error,
+		retryable: false
+	});
+}
+function assertMSTeamsSendHandoff(handoff) {
+	try {
+		handoff?.assertDirectAdapterHandoff?.();
+	} catch (error) {
+		throw notDispatched(error);
+	}
+}
+function withMSTeamsConnectorHandoff(handoff, send) {
+	const current = handoff.assertDirectAdapterHandoff || handoff.onPlatformSendDispatch ? handoff : connectorHandoff.getStore() ?? handoff;
+	return connectorHandoff.run(current, () => send(current));
+}
+/** Called only by a Connector transport, after its asynchronous token preparation. */
+async function prepareMSTeamsConnectorRequest() {
+	const handoff = connectorHandoff.getStore();
+	if (!handoff) return;
+	const assertCurrent = handoff.assertDirectAdapterHandoff ? () => assertMSTeamsSendHandoff(handoff) : void 0;
+	assertCurrent?.();
+	try {
+		await handoff.onPlatformSendDispatch?.();
+	} catch (error) {
+		throw notDispatched(error);
+	}
+	return assertCurrent;
+}
+const msteamsConnectorHandoffInterceptor = { request: async ({ config }) => {
+	const assertCurrent = await prepareMSTeamsConnectorRequest();
+	if (!assertCurrent) return config;
+	const transforms = config.transformRequest;
+	config.transformRequest = [...Array.isArray(transforms) ? transforms : transforms ? [transforms] : [], (data) => {
+		assertCurrent();
+		return data;
+	}];
+	const beforeRedirect = config.beforeRedirect;
+	config.beforeRedirect = (...args) => {
+		beforeRedirect?.(...args);
+		assertCurrent();
+	};
+	return config;
+} };
+//#endregion
 //#region extensions/msteams/src/qa/private-runtime.ts
 const PRIVATE_QA_BUILD_ENV = "OPENCLAW_BUILD_PRIVATE_QA";
 const PRIVATE_QA_NONCE_HEADER = "x-openclaw-msteams-qa-nonce";
@@ -619,6 +602,7 @@ var PrivateQaHttpClient = class PrivateQaHttpClient {
 		const token = typeof this.options.token === "function" ? await this.options.token() : this.options.token;
 		if (token) headers.set("authorization", `Bearer ${token}`);
 		const method = String(config.method ?? "GET").toUpperCase();
+		const assertCurrent = await prepareMSTeamsConnectorRequest();
 		const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 			url: targetUrl.toString(),
 			init: {
@@ -628,7 +612,8 @@ var PrivateQaHttpClient = class PrivateQaHttpClient {
 			},
 			policy: (0, openclaw_plugin_sdk_ssrf_runtime.ssrfPolicyFromHttpBaseUrlAllowedOrigin)(targetUrl.toString()),
 			maxRedirects: 0,
-			auditContext: "msteams-private-qa-connector"
+			auditContext: "msteams-private-qa-connector",
+			beforeRequest: assertCurrent
 		});
 		try {
 			const text = await response.text();
@@ -784,7 +769,8 @@ async function createMSTeamsApp(creds, options) {
 	const appOptions = {
 		client: privateQaRuntime?.client ?? options?.httpClient ?? {
 			headers: { "User-Agent": buildOpenClawUserAgentFragment() },
-			timeout: 3e4
+			timeout: 3e4,
+			interceptors: [msteamsConnectorHandoffInterceptor]
 		},
 		...privateQaRuntime ? {
 			clientSecret: "",
@@ -1057,10 +1043,10 @@ function loadDelegatedTokens() {
 	return require_delegated_state.loadMSTeamsDelegatedTokens();
 }
 function saveDelegatedTokens(tokens) {
-	require_delegated_state.saveMSTeamsDelegatedTokens(tokens);
+	return require_delegated_state.saveMSTeamsDelegatedTokens(tokens);
 }
 async function resolveDelegatedAccessToken(params) {
-	const tokens = loadDelegatedTokens();
+	const tokens = await loadDelegatedTokens();
 	if (!tokens) return;
 	if ((0, openclaw_plugin_sdk_number_runtime.isFutureDateTimestampMs)(tokens.expiresAt)) return tokens.accessToken;
 	try {
@@ -1071,7 +1057,7 @@ async function resolveDelegatedAccessToken(params) {
 			refreshToken: tokens.refreshToken,
 			scopes: tokens.scopes
 		});
-		saveDelegatedTokens(refreshed);
+		await saveDelegatedTokens(refreshed);
 		return refreshed.accessToken;
 	} catch {
 		return;
@@ -1080,6 +1066,19 @@ async function resolveDelegatedAccessToken(params) {
 //#endregion
 //#region extensions/msteams/src/graph.ts
 const GRAPH_BETA = "https://graph.microsoft.com/beta";
+const graphRequestCurrentness = new node_async_hooks.AsyncLocalStorage();
+function runWithMSTeamsGraphRequestCurrentness(assertCurrent, work) {
+	assertCurrent?.();
+	return graphRequestCurrentness.run(assertCurrent, work);
+}
+function captureGraphRequestCurrentness(assertReadAuthority) {
+	const assertCurrent = graphRequestCurrentness.getStore();
+	if (!assertCurrent) return assertReadAuthority;
+	return () => {
+		assertReadAuthority?.();
+		assertCurrent();
+	};
+}
 function normalizeQuery(value) {
 	return value?.trim() ?? "";
 }
@@ -1087,6 +1086,9 @@ function escapeOData(value) {
 	return value.replace(/'/g, "''");
 }
 async function requestGraph(params) {
+	const assertReadAuthority = (0, openclaw_plugin_sdk_fetch_runtime.captureChannelReadAuthority)();
+	const assertRequestCurrent = captureGraphRequestCurrentness(assertReadAuthority);
+	assertRequestCurrent?.();
 	const hasBody = params.body !== void 0;
 	const url = `${params.root ?? "https://graph.microsoft.com/v1.0"}${params.path}`;
 	const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
@@ -1102,10 +1104,12 @@ async function requestGraph(params) {
 			body: hasBody ? JSON.stringify(params.body) : void 0
 		},
 		auditContext: "msteams.graph",
-		timeoutMs: resolveMSTeamsRequestTimeoutMs(params.deadline)
+		timeoutMs: resolveMSTeamsRequestTimeoutMs(params.deadline),
+		beforeRequest: assertRequestCurrent
 	});
 	let releaseInFinally = true;
 	try {
+		assertReadAuthority?.();
 		if (!response.ok) throw await createMSTeamsHttpError(response, `${params.errorPrefix ?? "Graph"} ${params.path} failed`);
 		releaseInFinally = false;
 		return (0, openclaw_plugin_sdk_fetch_runtime.responseWithRelease)(response, release);
@@ -1129,18 +1133,26 @@ async function mutateGraphJson(params) {
 	}), `${errorPrefix} ${params.path} failed`);
 }
 async function fetchGraphJson(params) {
-	return await readOptionalGraphJson(await requestGraph({
-		token: params.token,
-		path: params.path,
-		headers: params.headers,
-		deadline: params.deadline
-	}), `Graph ${params.path} failed`);
+	const assertReadAuthority = (0, openclaw_plugin_sdk_fetch_runtime.captureChannelReadAuthority)();
+	try {
+		return await readOptionalGraphJson(await requestGraph({
+			token: params.token,
+			path: params.path,
+			headers: params.headers,
+			deadline: params.deadline
+		}), `Graph ${params.path} failed`);
+	} finally {
+		assertReadAuthority?.();
+	}
 }
 /**
 * Fetch JSON from an absolute Graph API URL (for example @odata.nextLink
 * pagination URLs) without prepending GRAPH_ROOT.
 */
 async function fetchGraphAbsoluteUrl(params) {
+	const assertReadAuthority = (0, openclaw_plugin_sdk_fetch_runtime.captureChannelReadAuthority)();
+	const assertRequestCurrent = captureGraphRequestCurrentness(assertReadAuthority);
+	assertRequestCurrent?.();
 	const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 		url: params.url,
 		init: { headers: {
@@ -1149,13 +1161,19 @@ async function fetchGraphAbsoluteUrl(params) {
 			...params.headers
 		} },
 		auditContext: "msteams.graph.absolute",
-		timeoutMs: MSTEAMS_REQUEST_TIMEOUT_MS
+		timeoutMs: MSTEAMS_REQUEST_TIMEOUT_MS,
+		beforeRequest: assertRequestCurrent
 	});
 	try {
+		assertReadAuthority?.();
 		if (!response.ok) throw await createMSTeamsHttpError(response, `Graph ${params.url} failed`);
 		return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `Graph ${params.url} failed`);
 	} finally {
-		await release();
+		try {
+			await release();
+		} finally {
+			assertReadAuthority?.();
+		}
 	}
 }
 /**
@@ -1190,6 +1208,8 @@ async function fetchAllGraphPages(params) {
 	};
 }
 async function resolveGraphToken(cfg, options) {
+	const assertRequestCurrent = captureGraphRequestCurrentness((0, openclaw_plugin_sdk_fetch_runtime.captureChannelReadAuthority)());
+	assertRequestCurrent?.();
 	const msteamsCfg = cfg?.channels?.msteams;
 	const creds = resolveMSTeamsCredentials(msteamsCfg);
 	if (!creds) throw new Error("MS Teams credentials missing");
@@ -1200,14 +1220,18 @@ async function resolveGraphToken(cfg, options) {
 			clientId: creds.appId,
 			clientSecret: creds.appPassword
 		});
+		assertRequestCurrent?.();
 		if (delegated) return delegated;
 	}
 	const { app } = await loadMSTeamsSdkWithAuth(creds, resolveMSTeamsSdkCloudOptions(msteamsCfg));
+	assertRequestCurrent?.();
 	const tokenProvider = createMSTeamsTokenProvider(app);
-	const accessToken = readAccessToken(await withMSTeamsRequestDeadline({
+	const graphTokenValue = await withMSTeamsRequestDeadline({
 		label: "MS Teams Graph token",
 		work: () => tokenProvider.getAccessToken("https://graph.microsoft.com")
-	}));
+	});
+	assertRequestCurrent?.();
+	const accessToken = readAccessToken(graphTokenValue);
 	if (!accessToken) throw new Error("MS Teams graph token unavailable");
 	return accessToken;
 }
@@ -1826,6 +1850,12 @@ Object.defineProperty(exports, "applyAuthorizationHeaderForUrl", {
 		return applyAuthorizationHeaderForUrl;
 	}
 });
+Object.defineProperty(exports, "assertMSTeamsSendHandoff", {
+	enumerable: true,
+	get: function() {
+		return assertMSTeamsSendHandoff;
+	}
+});
 Object.defineProperty(exports, "buildMSTeamsAuthEndpoint", {
 	enumerable: true,
 	get: function() {
@@ -1904,10 +1934,10 @@ Object.defineProperty(exports, "extractHtmlFromAttachment", {
 		return extractHtmlFromAttachment;
 	}
 });
-Object.defineProperty(exports, "extractInlineImageCandidates", {
+Object.defineProperty(exports, "extractInlineImageReferences", {
 	enumerable: true,
 	get: function() {
-		return extractInlineImageCandidates;
+		return extractInlineImageReferences;
 	}
 });
 Object.defineProperty(exports, "extractMSTeamsConversationMessageId", {
@@ -2198,6 +2228,12 @@ Object.defineProperty(exports, "resolveRequestUrl", {
 		return resolveRequestUrl;
 	}
 });
+Object.defineProperty(exports, "runWithMSTeamsGraphRequestCurrentness", {
+	enumerable: true,
+	get: function() {
+		return runWithMSTeamsGraphRequestCurrentness;
+	}
+});
 Object.defineProperty(exports, "safeFetchWithPolicy", {
 	enumerable: true,
 	get: function() {
@@ -2258,6 +2294,12 @@ Object.defineProperty(exports, "withMSTeamsAbortableRequestTimeout", {
 		return withMSTeamsAbortableRequestTimeout;
 	}
 });
+Object.defineProperty(exports, "withMSTeamsConnectorHandoff", {
+	enumerable: true,
+	get: function() {
+		return withMSTeamsConnectorHandoff;
+	}
+});
 Object.defineProperty(exports, "withMSTeamsRequestDeadline", {
 	enumerable: true,
 	get: function() {

package/dist/.setup/secret-contract-api-ChQdBeU1.cjs

@@ -0,0 +1,4 @@
+const require_secret_contract_api = require("./secret-contract-api-ipiUsANg.cjs");
+exports.channelSecrets = require_secret_contract_api.channelSecrets;
+exports.collectRuntimeConfigAssignments = require_secret_contract_api.collectRuntimeConfigAssignments;
+exports.secretTargetRegistryEntries = require_secret_contract_api.secretTargetRegistryEntries;

package/dist/.setup/secret-contract-api-ipiUsANg.cjs

@@ -0,0 +1,28 @@
+//#region extensions/msteams/src/secret-contract.ts
+const channelSecrets = (0, require("openclaw/plugin-sdk/channel-secret-basic-runtime").createSimpleChannelSecretContract)({
+	channelKey: "msteams",
+	label: "Microsoft Teams",
+	accountFields: [],
+	channelFields: ["appPassword"],
+	mode: "channel-only"
+});
+const { secretTargetRegistryEntries, collectRuntimeConfigAssignments } = channelSecrets;
+//#endregion
+Object.defineProperty(exports, "channelSecrets", {
+	enumerable: true,
+	get: function() {
+		return channelSecrets;
+	}
+});
+Object.defineProperty(exports, "collectRuntimeConfigAssignments", {
+	enumerable: true,
+	get: function() {
+		return collectRuntimeConfigAssignments;
+	}
+});
+Object.defineProperty(exports, "secretTargetRegistryEntries", {
+	enumerable: true,
+	get: function() {
+		return secretTargetRegistryEntries;
+	}
+});