@openclaw/msteams 2026.9.6 → 2026.9.7

package/dist/.setup/{resolve-allowlist-CHzaaWiC.cjs → resolve-allowlist-Pl_NQFYH.cjs}

@@ -1,7 +1,7 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("../runtime-api.cjs");
+const require_bot_framework_service_url = require("./bot-framework-service-url-BUhTe8F3.cjs");
 const require_delegated_state = require("./delegated-state-u-ywZyZT.cjs");
-require("./secret-input-C65t6kjM.cjs");
 let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
@@ -17,8 +17,8 @@ let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text
 let openclaw_plugin_sdk_secret_file = require("openclaw/plugin-sdk/secret-file");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let node_module = require("node:module");
-let openclaw_plugin_sdk_html_entity_runtime = require("openclaw/plugin-sdk/html-entity-runtime");
 let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
+let openclaw_plugin_sdk_html_entity_runtime = require("openclaw/plugin-sdk/html-entity-runtime");
 //#region extensions/msteams/src/request-timeout.ts
 const MSTEAMS_REQUEST_TIMEOUT_MS = 3e4;
 const MSTEAMS_SHAREPOINT_UPLOAD_BASE_TIMEOUT_MS = 3e5;
@@ -131,11 +131,6 @@ const GRAPH_SHARED_LINK_HOST_SUFFIXES = [
 	"onedrive.live.com",
 	"onedrive.com"
 ];
-/**
-* Returns true when the URL points at a SharePoint or OneDrive host whose
-* shared-link content must be fetched through the Graph shares API rather
-* than directly.
-*/
 function isGraphSharedLinkUrl(url) {
 	let parsed;
 	try {
@@ -155,12 +150,6 @@ function isGraphSharedLinkUrl(url) {
 function encodeGraphShareId(url) {
 	return `u!${node_buffer.Buffer.from(url, "utf8").toString("base64url")}`;
 }
-/**
-* When `url` is a SharePoint/OneDrive shared link, return the matching
-* `GET /shares/{shareId}/driveItem/content` URL that actually yields the file
-* bytes. Returns `undefined` for non-shared-link URLs so callers can fall
-* through to the existing fetch path.
-*/
 function tryBuildGraphSharesUrlForSharedLink(url) {
 	if (!isGraphSharedLinkUrl(url)) return;
 	return `${GRAPH_ROOT}/shares/${encodeGraphShareId(url)}/driveItem/content`;
@@ -201,25 +190,17 @@ function isLikelyImageAttachment(att) {
 	}
 	return false;
 }
-/**
-* Returns true if the attachment can be downloaded (any file type).
-* Used when downloading all files, not just images.
-*/
 function isDownloadableAttachment(att) {
 	if ((normalizeContentType(att.contentType) ?? "") === "application/vnd.microsoft.teams.file.download.info" && (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(att.content) && typeof att.content.downloadUrl === "string") return true;
-	if (typeof att.contentUrl === "string" && att.contentUrl.trim()) return true;
-	return false;
+	return typeof att.contentUrl === "string" && Boolean(att.contentUrl.trim());
 }
 function isAdvertisedFileAttachment(attachment) {
 	const contentType = normalizeContentType(attachment.contentType) ?? "";
 	if (contentType.startsWith("text/html") || contentType.startsWith("application/vnd.microsoft.card.") || contentType.startsWith("application/vnd.microsoft.teams.card.")) return false;
 	return Boolean(isDownloadableAttachment(attachment) || isLikelyImageAttachment(attachment) || attachment.name?.trim() || contentType);
 }
-function isHtmlAttachment(att) {
-	return (normalizeContentType(att.contentType) ?? "").startsWith("text/html");
-}
 function extractHtmlFromAttachment(att) {
-	if (!isHtmlAttachment(att)) return;
+	if (!normalizeContentType(att.contentType)?.startsWith("text/html")) return;
 	if (typeof att.content === "string") return att.content;
 	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(att.content)) return;
 	return typeof att.content.text === "string" ? att.content.text : typeof att.content.body === "string" ? att.content.body : typeof att.content.content === "string" ? att.content.content : void 0;
@@ -242,8 +223,7 @@ function extractInlineImageReferences(attachments) {
 		const html = extractHtmlFromAttachment(att);
 		if (!html) continue;
 		IMG_SRC_RE.lastIndex = 0;
-		let match = IMG_SRC_RE.exec(html);
-		while (match) {
+		for (const match of html.matchAll(IMG_SRC_RE)) {
 			const src = match[1]?.trim();
 			if (src) {
 				if (src.startsWith("data:")) out.push({
@@ -258,7 +238,6 @@ function extractInlineImageReferences(attachments) {
 							kind: "unavailable",
 							sourceId
 						});
-						match = IMG_SRC_RE.exec(html);
 						continue;
 					}
 					out.push({
@@ -269,7 +248,6 @@ function extractInlineImageReferences(attachments) {
 					});
 				}
 			}
-			match = IMG_SRC_RE.exec(html);
 		}
 	}
 	return out;
@@ -281,12 +259,6 @@ function safeHostForUrl(url) {
 		return "invalid-url";
 	}
 }
-function resolveAllowedHosts(input) {
-	return (0, openclaw_plugin_sdk_ssrf_policy.normalizeHostnameSuffixAllowlist)(input, DEFAULT_MEDIA_HOST_ALLOWLIST);
-}
-function resolveAuthAllowedHosts(input) {
-	return (0, openclaw_plugin_sdk_ssrf_policy.normalizeHostnameSuffixAllowlist)(input, DEFAULT_MEDIA_AUTH_HOST_ALLOWLIST);
-}
 function isMockFetchFn(fetchFn) {
 	const candidate = fetchFn;
 	return Boolean(candidate.mock || Object.hasOwn(candidate, "_isMockFunction"));
@@ -299,44 +271,25 @@ function resolveGuardedFetchImpl(params) {
 function resolveRetainedAuthorizationRedirectHostnameAllowlist(input) {
 	if (!input) return;
 	if (input.includes("*")) return ["*"];
-	return resolveMediaSsrfPolicy(input)?.hostnameAllowlist;
+	return (0, openclaw_plugin_sdk_ssrf_policy.buildHostnameAllowlistPolicyFromSuffixAllowlist)(input)?.hostnameAllowlist;
 }
 function resolveAttachmentFetchPolicy(params) {
 	return {
-		allowHosts: resolveAllowedHosts(params?.allowHosts),
-		authAllowHosts: resolveAuthAllowedHosts(params?.authAllowHosts)
+		allowHosts: (0, openclaw_plugin_sdk_ssrf_policy.normalizeHostnameSuffixAllowlist)(params?.allowHosts, DEFAULT_MEDIA_HOST_ALLOWLIST),
+		authAllowHosts: (0, openclaw_plugin_sdk_ssrf_policy.normalizeHostnameSuffixAllowlist)(params?.authAllowHosts, DEFAULT_MEDIA_AUTH_HOST_ALLOWLIST)
 	};
 }
-function isUrlAllowed(url, allowlist) {
-	return (0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(url, allowlist);
-}
 function applyAuthorizationHeaderForUrl(params) {
 	if (!params.bearerToken) {
 		params.headers.delete("Authorization");
 		return;
 	}
-	if (isUrlAllowed(params.url, params.authAllowHosts)) {
+	if ((0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(params.url, params.authAllowHosts)) {
 		params.headers.set("Authorization", `Bearer ${params.bearerToken}`);
 		return;
 	}
 	params.headers.delete("Authorization");
 }
-function resolveMediaSsrfPolicy(allowHosts) {
-	return (0, openclaw_plugin_sdk_ssrf_policy.buildHostnameAllowlistPolicyFromSuffixAllowlist)(allowHosts);
-}
-/**
-* Returns true if the given IPv4 or IPv6 address is in a private, loopback,
-* or link-local range that must never be reached from media downloads.
-*
-* Delegates to the SDK's `isPrivateIpAddress` which handles IPv4-mapped IPv6,
-* expanded notation, NAT64, 6to4, Teredo, octal IPv4, and fails closed on
-* parse errors.
-*/
-const isPrivateOrReservedIP = openclaw_plugin_sdk_ssrf_policy.isPrivateIpAddress;
-/**
-* Resolve a hostname via DNS and reject private/reserved IPs.
-* Throws if the resolved IP is private or resolution fails.
-*/
 async function resolveAndValidateIP(hostname, resolveFn) {
 	const resolve = resolveFn ?? node_dns_promises.lookup;
 	let resolved;
@@ -345,10 +298,9 @@ async function resolveAndValidateIP(hostname, resolveFn) {
 	} catch {
 		throw new Error(`DNS resolution failed for "${hostname}"`);
 	}
-	if (isPrivateOrReservedIP(resolved.address)) throw new Error(`Hostname "${hostname}" resolves to private/reserved IP (${resolved.address})`);
+	if ((0, openclaw_plugin_sdk_ssrf_policy.isPrivateIpAddress)(resolved.address)) throw new Error(`Hostname "${hostname}" resolves to private/reserved IP (${resolved.address})`);
 	return resolved.address;
 }
-/** Maximum number of redirects to follow in safeFetch. */
 const MAX_SAFE_REDIRECTS = 5;
 function isRedirectStatus(status) {
 	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
@@ -361,13 +313,14 @@ function isRedirectStatus(status) {
 * - Auto-following redirects to non-allowlisted hosts
 * - DNS rebinding attacks when a lookup function is provided
 */
-async function safeFetch(params) {
+async function safeFetchWithPolicy(params) {
+	const { allowHosts, authAllowHosts } = params.policy;
 	const resolveFn = params.resolveFn ?? node_dns_promises.lookup;
 	const hasDispatcher = Boolean(params.requestInit && typeof params.requestInit === "object" && "dispatcher" in params.requestInit);
 	const currentHeaders = new Headers(params.requestInit?.headers);
 	const currentUrl = params.url;
-	if (!isUrlAllowed(currentUrl, params.allowHosts)) throw new Error(`Initial download URL blocked: ${currentUrl}`);
-	if (currentHeaders.has("authorization") && params.authorizationAllowHosts && !isUrlAllowed(currentUrl, params.authorizationAllowHosts)) currentHeaders.delete("authorization");
+	if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(currentUrl, allowHosts)) throw new Error(`Initial download URL blocked: ${currentUrl}`);
+	if (currentHeaders.has("authorization") && !(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(currentUrl, authAllowHosts)) currentHeaders.delete("authorization");
 	if (!hasDispatcher) {
 		const lookupFn = async (hostname) => {
 			const resolved = await resolveFn(hostname);
@@ -388,9 +341,9 @@ async function safeFetch(params) {
 			},
 			maxRedirects: MAX_SAFE_REDIRECTS,
 			requireHttps: true,
-			policy: resolveMediaSsrfPolicy(params.allowHosts),
+			policy: (0, openclaw_plugin_sdk_ssrf_policy.buildHostnameAllowlistPolicyFromSuffixAllowlist)(allowHosts),
 			lookupFn,
-			retainAuthorizationRedirectHostnameAllowlist: resolveRetainedAuthorizationRedirectHostnameAllowlist(params.authorizationAllowHosts),
+			retainAuthorizationRedirectHostnameAllowlist: resolveRetainedAuthorizationRedirectHostnameAllowlist(authAllowHosts),
 			auditContext: "msteams.attachment",
 			timeoutMs: params.timeoutMs ?? 3e4
 		});
@@ -416,22 +369,10 @@ async function safeFetch(params) {
 	} catch {
 		throw new Error(`Invalid redirect URL: ${location}`);
 	}
-	if (!isUrlAllowed(redirectUrl, params.allowHosts)) throw new Error(`Media redirect target blocked by allowlist: ${redirectUrl}`);
-	if (currentHeaders.has("authorization") && params.authorizationAllowHosts && !isUrlAllowed(redirectUrl, params.authorizationAllowHosts)) currentHeaders.delete("authorization");
+	if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(redirectUrl, allowHosts)) throw new Error(`Media redirect target blocked by allowlist: ${redirectUrl}`);
+	if (currentHeaders.has("authorization") && !(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(redirectUrl, authAllowHosts)) currentHeaders.delete("authorization");
 	return res;
 }
-async function safeFetchWithPolicy(params) {
-	return await safeFetch({
-		url: params.url,
-		allowHosts: params.policy.allowHosts,
-		authorizationAllowHosts: params.policy.authAllowHosts,
-		fetchFn: params.fetchFn,
-		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
-		requestInit: params.requestInit,
-		resolveFn: params.resolveFn,
-		timeoutMs: params.timeoutMs
-	});
-}
 //#endregion
 //#region extensions/msteams/src/cloud.ts
 const DEFAULT_MSTEAMS_CLOUD = "Public";
@@ -465,66 +406,25 @@ function resolveMSTeamsSdkCloudOptions(cfg) {
 function isChinaBotFrameworkServiceHost(host) {
 	return host === CHINA_BOT_FRAMEWORK_SERVICE_HOST || host.endsWith(`.${CHINA_BOT_FRAMEWORK_SERVICE_HOST}`);
 }
-function isChinaBotFrameworkServiceUrl(value) {
-	const parsed = normalizeOptionalServiceUrl(value);
-	return Boolean(parsed && isChinaBotFrameworkServiceHost(parsed.host));
-}
 function validateMSTeamsProactiveServiceUrlBoundary(params) {
 	const configured = normalizeOptionalServiceUrl(params.configuredServiceUrl);
 	if (params.cloud !== "Public" && params.cloud !== "China" && !configured) throw new Error(`msteams proactive send blocked for ${params.conversationId}: channels.msteams.cloud=${params.cloud} requires channels.msteams.serviceUrl so SDK proactive operations use the matching Teams Bot Connector endpoint.`);
 	if (params.cloud === "China" && configured && !isChinaBotFrameworkServiceHost(configured.host)) throw new Error(`msteams proactive send blocked for ${params.conversationId}: configured Teams serviceUrl (${configured.value}) is not a Microsoft Teams China Bot Framework channel endpoint.`);
 	if (params.cloud !== "China" && configured && isChinaBotFrameworkServiceHost(configured.host)) throw new Error(`msteams proactive send blocked for ${params.conversationId}: configured Teams serviceUrl (${configured.value}) requires channels.msteams.cloud=China.`);
+	const stored = normalizeOptionalServiceUrl(params.storedServiceUrl);
+	if (!stored) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation reference is missing a valid serviceUrl. Ask the bot to receive a new Teams message in this conversation, then retry.`);
 	if (configured) {
-		const stored = normalizeOptionalServiceUrl(params.storedServiceUrl);
-		if (!stored) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation reference is missing a valid serviceUrl. Ask the bot to receive a new Teams message in this conversation, then retry.`);
 		if (stored.host !== configured.host) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation serviceUrl (${stored.value}) does not match configured Teams SDK serviceUrl host (${configured.host}). Set channels.msteams.cloud/channels.msteams.serviceUrl for the Teams cloud that owns this conversation, or refresh the stored conversation by receiving a new message.`);
 		return;
 	}
-	const stored = normalizeOptionalServiceUrl(params.storedServiceUrl);
-	if (!stored) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation reference is missing a valid serviceUrl. Ask the bot to receive a new Teams message in this conversation, then retry.`);
 	if (params.cloud === "China") {
 		if (!isChinaBotFrameworkServiceHost(stored.host)) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation serviceUrl (${stored.value}) is not a Microsoft Teams China Bot Framework channel endpoint. Use a conversation reference received from the China/21Vianet Teams cloud.`);
 		return;
 	}
-	if (isChinaBotFrameworkServiceUrl(stored.value)) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation serviceUrl (${stored.value}) requires channels.msteams.cloud=China.`);
+	if (isChinaBotFrameworkServiceHost(stored.host)) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation serviceUrl (${stored.value}) requires channels.msteams.cloud=China.`);
 	if (stored.host !== PUBLIC_MSTEAMS_SERVICE_HOST) throw new Error(`msteams proactive send blocked for ${params.conversationId}: stored conversation serviceUrl (${stored.value}) is not a Microsoft Teams public-cloud Bot Connector endpoint. Set channels.msteams.cloud and channels.msteams.serviceUrl for the supported Teams cloud that owns this conversation.`);
 }
 //#endregion
-//#region extensions/msteams/src/http-error.ts
-async function createMSTeamsHttpError(response, label, options) {
-	return await (0, openclaw_plugin_sdk_provider_http.createProviderHttpError)(response, label, options);
-}
-//#endregion
-//#region extensions/msteams/src/bot-framework-service-url.ts
-const BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST = (0, openclaw_plugin_sdk_ssrf_policy.normalizeHostnameSuffixAllowlist)([
-	"smba.trafficmanager.net",
-	"smba.infra.gcc.teams.microsoft.com",
-	"smba.infra.gov.teams.microsoft.us",
-	"smba.infra.dod.teams.microsoft.us",
-	"botframework.azure.cn"
-]);
-function describeBotFrameworkServiceUrlHost(serviceUrl) {
-	try {
-		return new URL(serviceUrl.trim()).hostname || "invalid-url";
-	} catch {
-		return "invalid-url";
-	}
-}
-function isAllowedBotFrameworkServiceUrl(serviceUrl) {
-	if (typeof serviceUrl !== "string") return false;
-	const trimmed = serviceUrl.trim();
-	return Boolean(trimmed && (0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(trimmed, BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST));
-}
-function tryNormalizeBotFrameworkServiceUrl(serviceUrl) {
-	if (!isAllowedBotFrameworkServiceUrl(serviceUrl)) return;
-	return serviceUrl.trim().replace(/\/+$/, "");
-}
-function normalizeBotFrameworkServiceUrl(serviceUrl) {
-	const normalized = tryNormalizeBotFrameworkServiceUrl(serviceUrl);
-	if (normalized) return normalized;
-	throw new Error(`Blocked Microsoft Teams serviceUrl host: ${describeBotFrameworkServiceUrlHost(serviceUrl)}`);
-}
-//#endregion
 //#region extensions/msteams/src/send-handoff.ts
 const connectorHandoff = new node_async_hooks.AsyncLocalStorage();
 function notDispatched(error) {
@@ -577,30 +477,13 @@ const msteamsConnectorHandoffInterceptor = { request: async ({ config }) => {
 const PRIVATE_QA_BUILD_ENV = "OPENCLAW_BUILD_PRIVATE_QA";
 const PRIVATE_QA_NONCE_HEADER = "x-openclaw-msteams-qa-nonce";
 const PRIVATE_QA_RUNTIME_SYMBOL = Symbol.for("openclaw.msteams.privateQaRuntime");
-var PrivateQaHttpClient = class PrivateQaHttpClient {
-	constructor(connectorUrl, nonce, options = {}) {
-		this.connectorUrl = connectorUrl;
-		this.nonce = nonce;
-		this.options = options;
-	}
-	clone(options = {}) {
-		return new PrivateQaHttpClient(this.connectorUrl, this.nonce, {
-			...this.options,
-			...options,
-			headers: {
-				...this.options.headers,
-				...options.headers
-			}
-		});
-	}
-	async request(config) {
+function createPrivateQaClientOptions(connectorUrl, nonce) {
+	const request = async (config) => {
 		const sourceUrl = new URL(config.url ?? "", "https://smba.trafficmanager.net");
-		const targetUrl = new URL(`${sourceUrl.pathname}${sourceUrl.search}`, this.connectorUrl);
-		const headers = new Headers(this.options.headers);
+		const targetUrl = new URL(`${sourceUrl.pathname}${sourceUrl.search}`, connectorUrl);
+		const headers = new Headers();
 		for (const [key, value] of Object.entries(config.headers ?? {})) if (value != null) headers.set(key, String(value));
-		headers.set(PRIVATE_QA_NONCE_HEADER, this.nonce);
-		const token = typeof this.options.token === "function" ? await this.options.token() : this.options.token;
-		if (token) headers.set("authorization", `Bearer ${token}`);
+		headers.set(PRIVATE_QA_NONCE_HEADER, nonce);
 		const method = String(config.method ?? "GET").toUpperCase();
 		const assertCurrent = await prepareMSTeamsConnectorRequest();
 		const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
@@ -629,46 +512,12 @@ var PrivateQaHttpClient = class PrivateQaHttpClient {
 		} finally {
 			await release();
 		}
-	}
-	get(url, config = {}) {
-		return this.request({
-			...config,
-			method: "GET",
-			url
-		});
-	}
-	post(url, data, config = {}) {
-		return this.request({
-			...config,
-			data,
-			method: "POST",
-			url
-		});
-	}
-	put(url, data, config = {}) {
-		return this.request({
-			...config,
-			data,
-			method: "PUT",
-			url
-		});
-	}
-	patch(url, data, config = {}) {
-		return this.request({
-			...config,
-			data,
-			method: "PATCH",
-			url
-		});
-	}
-	delete(url, config = {}) {
-		return this.request({
-			...config,
-			method: "DELETE",
-			url
-		});
-	}
-};
+	};
+	return { interceptors: [{ request: ({ config }) => {
+		config.adapter = request;
+		return config;
+	} }] };
+}
 function resolveMSTeamsPrivateQaRuntime(env = process.env, bootstrap = globalThis[PRIVATE_QA_RUNTIME_SYMBOL]) {
 	if (!bootstrap) return;
 	if (env[PRIVATE_QA_BUILD_ENV] !== "1") throw new Error("Microsoft Teams private QA runtime requires OPENCLAW_BUILD_PRIVATE_QA=1");
@@ -679,8 +528,7 @@ function resolveMSTeamsPrivateQaRuntime(env = process.env, bootstrap = globalThi
 	const parsedConnectorUrl = new URL(connectorUrl);
 	if (parsedConnectorUrl.protocol !== "http:" || parsedConnectorUrl.hostname !== "127.0.0.1" && parsedConnectorUrl.hostname !== "localhost") throw new Error("Microsoft Teams private QA connector must use loopback HTTP");
 	return {
-		client: new PrivateQaHttpClient(parsedConnectorUrl.toString(), nonce),
-		listenHost: "127.0.0.1",
+		client: createPrivateQaClientOptions(parsedConnectorUrl.toString(), nonce),
 		skipAuth: true,
 		token: async () => botToken
 	};
@@ -765,7 +613,7 @@ async function createMSTeamsApp(creds, options) {
 	const { App, cloudFromName } = await loadSdkModules();
 	const privateQaRuntime = resolveMSTeamsPrivateQaRuntime();
 	const cloud = options?.cloud ?? "Public";
-	const serviceUrl = options?.serviceUrl ? normalizeBotFrameworkServiceUrl(options.serviceUrl) : void 0;
+	const serviceUrl = options?.serviceUrl ? require_bot_framework_service_url.normalizeBotFrameworkServiceUrl(options.serviceUrl) : void 0;
 	const appOptions = {
 		client: privateQaRuntime?.client ?? options?.httpClient ?? {
 			headers: { "User-Agent": buildOpenClawUserAgentFragment() },
@@ -828,37 +676,19 @@ function createCertificateApp(creds, privateKey, App, appOptions) {
 		...appOptions
 	});
 }
-/**
-* Build a token provider that uses the Teams SDK App's public tokenManager
-* for token acquisition.
-*/
 function createMSTeamsTokenProvider(app) {
-	const tokenToString = (token) => {
-		if (token == null) return "";
-		return token.toString();
-	};
 	return { async getAccessToken(scope) {
 		if (scope.includes("graph.microsoft.com") || scope.includes("graph.microsoft.us") || scope.includes("microsoftgraph.chinacloudapi.cn")) {
 			if (app.cloud?.graphScope?.includes("microsoftgraph.chinacloudapi.cn")) throw new Error("Microsoft Teams Graph operations are not supported for channels.msteams.cloud=China until Graph requests are routed through the Azure China Graph endpoint.");
-			return tokenToString(await app.tokenManager.getGraphToken());
+			return (await app.tokenProvider.getAppToken(app.cloud?.graphScope ?? "https://graph.microsoft.com/.default", app.credentials?.tenantId || "common"))?.toString() ?? "";
 		}
-		return tokenToString(await app.tokenManager.getBotToken());
+		return (await app.tokenProvider.getAppToken(app.cloud?.botScope ?? "https://api.botframework.com/.default"))?.toString() ?? "";
 	} };
 }
 async function loadMSTeamsSdkWithAuth(creds, options) {
 	return { app: await createMSTeamsApp(creds, options) };
 }
 //#endregion
-//#region extensions/msteams/src/token-response.ts
-function readAccessToken(value) {
-	if (typeof value === "string") return value;
-	if (value && typeof value === "object") {
-		const token = value.accessToken ?? value.token;
-		return typeof token === "string" ? token : null;
-	}
-	return null;
-}
-//#endregion
 //#region extensions/msteams/src/oauth.shared.ts
 const MSTEAMS_OAUTH_REDIRECT_URI = "http://localhost:8086/oauth2callback";
 const MSTEAMS_OAUTH_CALLBACK_PORT = 8086;
@@ -880,25 +710,9 @@ function buildMSTeamsTokenEndpoint(tenantId) {
 //#region extensions/msteams/src/oauth.token.ts
 /** Five-minute buffer subtracted from token expiry to avoid edge-case clock drift. */
 const EXPIRY_BUFFER_MS = 3e5;
-function createMSTeamsTokenBody(params) {
-	const body = new URLSearchParams({
-		client_id: params.clientId,
-		client_secret: params.clientSecret,
-		grant_type: params.grantType,
-		scope: [...params.scopes].join(" ")
-	});
-	for (const [key, value] of Object.entries(params.values ?? {})) body.set(key, value);
-	return body;
-}
-function resolveMSTeamsTokenExpiresAt(value) {
-	return (0, openclaw_plugin_sdk_number_runtime.resolveExpiresAtMsFromDurationSeconds)(value, { bufferMs: EXPIRY_BUFFER_MS });
-}
-function assertMSTeamsTokenResponseObject(data, failureLabel) {
-	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(data)) throw new Error(`MSTeams ${failureLabel} failed: invalid token response fields`);
-	return data;
-}
 function parseMSTeamsTokenResponse(data, failureLabel) {
-	const expiresAt = resolveMSTeamsTokenExpiresAt(data.expires_in);
+	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(data)) throw new Error(`MSTeams ${failureLabel} failed: invalid token response fields`);
+	const expiresAt = (0, openclaw_plugin_sdk_number_runtime.resolveExpiresAtMsFromDurationSeconds)(data.expires_in, { bufferMs: EXPIRY_BUFFER_MS });
 	if (typeof data.access_token !== "string" || !data.access_token || expiresAt === void 0 || data.refresh_token !== void 0 && typeof data.refresh_token !== "string" || data.scope !== void 0 && typeof data.scope !== "string") throw new Error(`MSTeams ${failureLabel} failed: invalid token response fields`);
 	return {
 		access_token: data.access_token,
@@ -922,20 +736,20 @@ async function fetchMSTeamsTokens(params) {
 		auditContext: params.auditContext
 	});
 	try {
-		if (!response.ok) throw await createMSTeamsHttpError(response, `MSTeams ${params.failureLabel} failed`);
-		return parseMSTeamsTokenResponse(assertMSTeamsTokenResponseObject(await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `MSTeams ${params.failureLabel} failed`), params.failureLabel), params.failureLabel);
+		if (!response.ok) throw await (0, openclaw_plugin_sdk_provider_http.createProviderHttpError)(response, `MSTeams ${params.failureLabel} failed`);
+		return parseMSTeamsTokenResponse(await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `MSTeams ${params.failureLabel} failed`), params.failureLabel);
 	} finally {
 		await release();
 	}
 }
 async function requestMSTeamsDelegatedTokens(params) {
 	const scopes = params.scopes ?? MSTEAMS_DEFAULT_DELEGATED_SCOPES;
-	const body = createMSTeamsTokenBody({
-		clientId: params.clientId,
-		clientSecret: params.clientSecret,
-		grantType: params.grantType,
-		scopes,
-		values: params.values
+	const body = new URLSearchParams({
+		client_id: params.clientId,
+		client_secret: params.clientSecret,
+		grant_type: params.grantType,
+		scope: scopes.join(" "),
+		...params.values
 	});
 	const data = await fetchMSTeamsTokens({
 		tokenUrl: buildMSTeamsTokenEndpoint(params.tenantId),
@@ -1039,14 +853,8 @@ function resolveMSTeamsCredentials(cfg) {
 		tenantId
 	};
 }
-function loadDelegatedTokens() {
-	return require_delegated_state.loadMSTeamsDelegatedTokens();
-}
-function saveDelegatedTokens(tokens) {
-	return require_delegated_state.saveMSTeamsDelegatedTokens(tokens);
-}
 async function resolveDelegatedAccessToken(params) {
-	const tokens = await loadDelegatedTokens();
+	const tokens = await require_delegated_state.loadMSTeamsDelegatedTokens();
 	if (!tokens) return;
 	if ((0, openclaw_plugin_sdk_number_runtime.isFutureDateTimestampMs)(tokens.expiresAt)) return tokens.accessToken;
 	try {
@@ -1057,7 +865,7 @@ async function resolveDelegatedAccessToken(params) {
 			refreshToken: tokens.refreshToken,
 			scopes: tokens.scopes
 		});
-		await saveDelegatedTokens(refreshed);
+		await require_delegated_state.saveMSTeamsDelegatedTokens(refreshed);
 		return refreshed.accessToken;
 	} catch {
 		return;
@@ -1110,7 +918,7 @@ async function requestGraph(params) {
 	let releaseInFinally = true;
 	try {
 		assertReadAuthority?.();
-		if (!response.ok) throw await createMSTeamsHttpError(response, `${params.errorPrefix ?? "Graph"} ${params.path} failed`);
+		if (!response.ok) throw await (0, openclaw_plugin_sdk_provider_http.createProviderHttpError)(response, `${params.errorPrefix ?? "Graph"} ${params.path} failed`);
 		releaseInFinally = false;
 		return (0, openclaw_plugin_sdk_fetch_runtime.responseWithRelease)(response, release);
 	} finally {
@@ -1166,7 +974,7 @@ async function fetchGraphAbsoluteUrl(params) {
 	});
 	try {
 		assertReadAuthority?.();
-		if (!response.ok) throw await createMSTeamsHttpError(response, `Graph ${params.url} failed`);
+		if (!response.ok) throw await (0, openclaw_plugin_sdk_provider_http.createProviderHttpError)(response, `Graph ${params.url} failed`);
 		return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `Graph ${params.url} failed`);
 	} finally {
 		try {
@@ -1226,12 +1034,11 @@ async function resolveGraphToken(cfg, options) {
 	const { app } = await loadMSTeamsSdkWithAuth(creds, resolveMSTeamsSdkCloudOptions(msteamsCfg));
 	assertRequestCurrent?.();
 	const tokenProvider = createMSTeamsTokenProvider(app);
-	const graphTokenValue = await withMSTeamsRequestDeadline({
+	const accessToken = await withMSTeamsRequestDeadline({
 		label: "MS Teams Graph token",
 		work: () => tokenProvider.getAccessToken("https://graph.microsoft.com")
 	});
 	assertRequestCurrent?.();
-	const accessToken = readAccessToken(graphTokenValue);
 	if (!accessToken) throw new Error("MS Teams graph token unavailable");
 	return accessToken;
 }
@@ -1368,11 +1175,7 @@ function uniqueItemsById(items) {
 	}
 	return [...byId.values()];
 }
-function findExactTeams(items, query) {
-	const normalized = normalizeExactMatch(query);
-	return uniqueItemsById(items.filter((item) => normalizeExactMatch(item.displayName) === normalized));
-}
-function findExactChannels(items, query) {
+function findExactNames(items, query) {
 	const normalized = normalizeExactMatch(query);
 	return uniqueItemsById(items.filter((item) => normalizeExactMatch(item.displayName) === normalized));
 }
@@ -1580,7 +1383,7 @@ async function resolveMSTeamsChannelAllowlist(params) {
 					resolved: false,
 					note: "team lookup incomplete"
 				};
-				const exactTeams = findExactTeams(result.items, team);
+				const exactTeams = findExactNames(result.items, team);
 				const [exactTeam] = exactTeams;
 				if (!exactTeam) return {
 					input,
@@ -1624,7 +1427,7 @@ async function resolveMSTeamsChannelAllowlist(params) {
 					note: "channel lookup failed"
 				};
 			}
-			const generalChannels = findExactChannels(teamChannels, "general");
+			const generalChannels = findExactNames(teamChannels, "general");
 			if (params.teamIdMode !== "graph" && generalChannels.length !== 1) return {
 				input,
 				resolved: false,
@@ -1641,7 +1444,7 @@ async function resolveMSTeamsChannelAllowlist(params) {
 				teamName
 			};
 			const channelById = teamChannels.find((item) => item.id === channel);
-			const exactChannels = channelById ? [channelById] : findExactChannels(teamChannels, channel);
+			const exactChannels = channelById ? [channelById] : findExactNames(teamChannels, channel);
 			if (exactChannels.length === 0) return {
 				input,
 				resolved: false,
@@ -1874,12 +1677,6 @@ Object.defineProperty(exports, "createMSTeamsExpressAdapter", {
 		return createMSTeamsExpressAdapter;
 	}
 });
-Object.defineProperty(exports, "createMSTeamsHttpError", {
-	enumerable: true,
-	get: function() {
-		return createMSTeamsHttpError;
-	}
-});
 Object.defineProperty(exports, "createMSTeamsInboundDeadline", {
 	enumerable: true,
 	get: function() {
@@ -1898,12 +1695,6 @@ Object.defineProperty(exports, "deleteGraphRequest", {
 		return deleteGraphRequest;
 	}
 });
-Object.defineProperty(exports, "describeBotFrameworkServiceUrlHost", {
-	enumerable: true,
-	get: function() {
-		return describeBotFrameworkServiceUrlHost;
-	}
-});
 Object.defineProperty(exports, "encodeGraphShareId", {
 	enumerable: true,
 	get: function() {
@@ -1988,12 +1779,6 @@ Object.defineProperty(exports, "isAdvertisedFileAttachment", {
 		return isAdvertisedFileAttachment;
 	}
 });
-Object.defineProperty(exports, "isAllowedBotFrameworkServiceUrl", {
-	enumerable: true,
-	get: function() {
-		return isAllowedBotFrameworkServiceUrl;
-	}
-});
 Object.defineProperty(exports, "isDownloadableAttachment", {
 	enumerable: true,
 	get: function() {
@@ -2012,12 +1797,6 @@ Object.defineProperty(exports, "isRedirectStatus", {
 		return isRedirectStatus;
 	}
 });
-Object.defineProperty(exports, "isUrlAllowed", {
-	enumerable: true,
-	get: function() {
-		return isUrlAllowed;
-	}
-});
 Object.defineProperty(exports, "listChannelsForTeam", {
 	enumerable: true,
 	get: function() {
@@ -2036,12 +1815,6 @@ Object.defineProperty(exports, "listTeamsByName", {
 		return listTeamsByName;
 	}
 });
-Object.defineProperty(exports, "loadDelegatedTokens", {
-	enumerable: true,
-	get: function() {
-		return loadDelegatedTokens;
-	}
-});
 Object.defineProperty(exports, "loadMSTeamsSdkWithAuth", {
 	enumerable: true,
 	get: function() {
@@ -2066,12 +1839,6 @@ Object.defineProperty(exports, "mutateGraphJson", {
 		return mutateGraphJson;
 	}
 });
-Object.defineProperty(exports, "normalizeBotFrameworkServiceUrl", {
-	enumerable: true,
-	get: function() {
-		return normalizeBotFrameworkServiceUrl;
-	}
-});
 Object.defineProperty(exports, "normalizeContentType", {
 	enumerable: true,
 	get: function() {
@@ -2144,12 +1911,6 @@ Object.defineProperty(exports, "projectStableMSTeamsUserAllowlist", {
 		return projectStableMSTeamsUserAllowlist;
 	}
 });
-Object.defineProperty(exports, "readAccessToken", {
-	enumerable: true,
-	get: function() {
-		return readAccessToken;
-	}
-});
 Object.defineProperty(exports, "resolveAttachmentFetchPolicy", {
 	enumerable: true,
 	get: function() {
@@ -2216,12 +1977,6 @@ Object.defineProperty(exports, "resolveMSTeamsUserAllowlist", {
 		return resolveMSTeamsUserAllowlist;
 	}
 });
-Object.defineProperty(exports, "resolveMediaSsrfPolicy", {
-	enumerable: true,
-	get: function() {
-		return resolveMediaSsrfPolicy;
-	}
-});
 Object.defineProperty(exports, "resolveRequestUrl", {
 	enumerable: true,
 	get: function() {
@@ -2246,12 +2001,6 @@ Object.defineProperty(exports, "safeHostForUrl", {
 		return safeHostForUrl;
 	}
 });
-Object.defineProperty(exports, "saveDelegatedTokens", {
-	enumerable: true,
-	get: function() {
-		return saveDelegatedTokens;
-	}
-});
 Object.defineProperty(exports, "searchGraphUsers", {
 	enumerable: true,
 	get: function() {
@@ -2270,12 +2019,6 @@ Object.defineProperty(exports, "tryBuildGraphSharesUrlForSharedLink", {
 		return tryBuildGraphSharesUrlForSharedLink;
 	}
 });
-Object.defineProperty(exports, "tryNormalizeBotFrameworkServiceUrl", {
-	enumerable: true,
-	get: function() {
-		return tryNormalizeBotFrameworkServiceUrl;
-	}
-});
 Object.defineProperty(exports, "validateMSTeamsProactiveServiceUrlBoundary", {
 	enumerable: true,
 	get: function() {