@openclaw/msteams 2026.9.7 → 2026.10.1-beta.1

package/dist/.setup/{resolve-allowlist-Pl_NQFYH.cjs → resolve-allowlist-Ct9yxQUw.cjs}

@@ -1,7 +1,7 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("../runtime-api.cjs");
 const require_bot_framework_service_url = require("./bot-framework-service-url-BUhTe8F3.cjs");
-const require_delegated_state = require("./delegated-state-u-ywZyZT.cjs");
+const require_token_config = require("./token-config-DOt3XwVa.cjs");
 let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
@@ -17,7 +17,6 @@ let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text
 let openclaw_plugin_sdk_secret_file = require("openclaw/plugin-sdk/secret-file");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let node_module = require("node:module");
-let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
 let openclaw_plugin_sdk_html_entity_runtime = require("openclaw/plugin-sdk/html-entity-runtime");
 //#region extensions/msteams/src/request-timeout.ts
 const MSTEAMS_REQUEST_TIMEOUT_MS = 3e4;
@@ -154,16 +153,6 @@ function tryBuildGraphSharesUrlForSharedLink(url) {
 	if (!isGraphSharedLinkUrl(url)) return;
 	return `${GRAPH_ROOT}/shares/${encodeGraphShareId(url)}/driveItem/content`;
 }
-function resolveRequestUrl(input) {
-	if (typeof input === "string") return input;
-	if (input instanceof URL) return input.toString();
-	if (typeof input === "object" && input && "url" in input && typeof input.url === "string") return input.url;
-	try {
-		return JSON.stringify(input);
-	} catch {
-		return "";
-	}
-}
 function normalizeContentType(value) {
 	const trimmed = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(value);
 	if (!trimmed) return;
@@ -280,15 +269,8 @@ function resolveAttachmentFetchPolicy(params) {
 	};
 }
 function applyAuthorizationHeaderForUrl(params) {
-	if (!params.bearerToken) {
-		params.headers.delete("Authorization");
-		return;
-	}
-	if ((0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(params.url, params.authAllowHosts)) {
-		params.headers.set("Authorization", `Bearer ${params.bearerToken}`);
-		return;
-	}
-	params.headers.delete("Authorization");
+	if (params.bearerToken && (0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(params.url, params.authAllowHosts)) params.headers.set("Authorization", `Bearer ${params.bearerToken}`);
+	else params.headers.delete("Authorization");
 }
 async function resolveAndValidateIP(hostname, resolveFn) {
 	const resolve = resolveFn ?? node_dns_promises.lookup;
@@ -299,7 +281,6 @@ async function resolveAndValidateIP(hostname, resolveFn) {
 		throw new Error(`DNS resolution failed for "${hostname}"`);
 	}
 	if ((0, openclaw_plugin_sdk_ssrf_policy.isPrivateIpAddress)(resolved.address)) throw new Error(`Hostname "${hostname}" resolves to private/reserved IP (${resolved.address})`);
-	return resolved.address;
 }
 const MAX_SAFE_REDIRECTS = 5;
 function isRedirectStatus(status) {
@@ -316,7 +297,7 @@ function isRedirectStatus(status) {
 async function safeFetchWithPolicy(params) {
 	const { allowHosts, authAllowHosts } = params.policy;
 	const resolveFn = params.resolveFn ?? node_dns_promises.lookup;
-	const hasDispatcher = Boolean(params.requestInit && typeof params.requestInit === "object" && "dispatcher" in params.requestInit);
+	const hasDispatcher = params.requestInit && "dispatcher" in params.requestInit;
 	const currentHeaders = new Headers(params.requestInit?.headers);
 	const currentUrl = params.url;
 	if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(currentUrl, allowHosts)) throw new Error(`Initial download URL blocked: ${currentUrl}`);
@@ -590,25 +571,11 @@ const loadSdkModules = (0, openclaw_plugin_sdk_lazy_runtime.createLazyRuntimeMod
 	ExpressAdapter: apps.ExpressAdapter,
 	cloudFromName: api.cloudFromName
 })));
-/**
-* Lazily construct an ExpressAdapter that the Teams SDK App can register its
-* routes on. The dynamic import keeps the SDK bundle off the hot startup path
-* when msteams is disabled; the structural return type matches what
-* `loadMSTeamsSdkWithAuth` accepts as its `httpServerAdapter` option.
-*/
+/** Keep the SDK off disabled-channel startup paths. */
 async function createMSTeamsExpressAdapter(serverOrApp) {
 	const { ExpressAdapter } = await loadSdkModules();
 	return new ExpressAdapter(serverOrApp);
 }
-/**
-* Create a Teams SDK App instance from credentials. The App manages token
-* acquisition, JWT validation, and the HTTP server lifecycle.
-*
-* Auth modes:
-* - Secret: clientId + clientSecret → MSAL client credential flow (SDK built-in)
-* - Managed identity: clientId + managedIdentityClientId → SDK built-in MI support
-* - Certificate: clientId + custom token provider via @azure/identity
-*/
 async function createMSTeamsApp(creds, options) {
 	const { App, cloudFromName } = await loadSdkModules();
 	const privateQaRuntime = resolveMSTeamsPrivateQaRuntime();
@@ -660,12 +627,8 @@ async function createFederatedApp(creds, App, appOptions) {
 }
 function createCertificateApp(creds, privateKey, App, appOptions) {
 	let credentialPromise = null;
-	const getCredential = async () => {
-		if (!credentialPromise) credentialPromise = loadAzureIdentity().then((az) => new az.ClientCertificateCredential(creds.tenantId, creds.appId, { certificate: privateKey }));
-		return credentialPromise;
-	};
 	const tokenProvider = async (scope) => {
-		const token = await (await getCredential()).getToken(scope);
+		const token = await (await (credentialPromise ??= loadAzureIdentity().then((az) => new az.ClientCertificateCredential(creds.tenantId, creds.appId, { certificate: privateKey })))).getToken(scope);
 		if (!token?.token) throw new Error("Failed to acquire token via certificate credential.");
 		return token.token;
 	};
@@ -799,62 +762,8 @@ async function refreshMSTeamsDelegatedTokens(params) {
 }
 //#endregion
 //#region extensions/msteams/src/token.ts
-function resolveAuthType(cfg) {
-	const fromCfg = cfg?.authType;
-	if (fromCfg === "secret" || fromCfg === "federated") return fromCfg;
-	if (process.env.MSTEAMS_AUTH_TYPE === "federated") return "federated";
-	return "secret";
-}
-function resolveFederatedPath(configValue, envValue) {
-	if ((0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(configValue)) return configValue;
-	if ((0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(envValue)) return envValue;
-}
-function hasConfiguredMSTeamsCredentials(cfg) {
-	const authType = resolveAuthType(cfg);
-	const hasAppId = Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_ID));
-	const hasTenantId = Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_TENANT_ID));
-	if (authType === "federated") {
-		const hasCert = Boolean(resolveFederatedPath(cfg?.certificatePath, process.env.MSTEAMS_CERTIFICATE_PATH));
-		const hasManagedIdentity = cfg?.useManagedIdentity ?? process.env.MSTEAMS_USE_MANAGED_IDENTITY === "true";
-		return hasAppId && hasTenantId && (hasCert || hasManagedIdentity);
-	}
-	return Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) && (0, openclaw_plugin_sdk_secret_input.hasConfiguredSecretInput)(cfg?.appPassword) && (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId));
-}
-function resolveMSTeamsCredentials(cfg) {
-	const authType = resolveAuthType(cfg);
-	const appId = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_ID);
-	const tenantId = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_TENANT_ID);
-	if (!appId || !tenantId) return;
-	if (authType === "federated") {
-		const certificatePath = resolveFederatedPath(cfg?.certificatePath, process.env.MSTEAMS_CERTIFICATE_PATH);
-		const certificateThumbprint = cfg?.certificateThumbprint || process.env.MSTEAMS_CERTIFICATE_THUMBPRINT || void 0;
-		const useManagedIdentity = cfg?.useManagedIdentity ?? process.env.MSTEAMS_USE_MANAGED_IDENTITY === "true";
-		const managedIdentityClientId = cfg?.managedIdentityClientId || process.env.MSTEAMS_MANAGED_IDENTITY_CLIENT_ID || void 0;
-		if (!certificatePath && !useManagedIdentity) return;
-		return {
-			type: "federated",
-			appId,
-			tenantId,
-			certificatePath,
-			certificateThumbprint,
-			useManagedIdentity: useManagedIdentity || void 0,
-			managedIdentityClientId
-		};
-	}
-	const appPassword = (0, openclaw_plugin_sdk_secret_input.normalizeResolvedSecretInputString)({
-		value: cfg?.appPassword,
-		path: "channels.msteams.appPassword"
-	}) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_PASSWORD);
-	if (!appPassword) return;
-	return {
-		type: "secret",
-		appId,
-		appPassword,
-		tenantId
-	};
-}
 async function resolveDelegatedAccessToken(params) {
-	const tokens = await require_delegated_state.loadMSTeamsDelegatedTokens();
+	const tokens = await require_token_config.loadMSTeamsDelegatedTokens();
 	if (!tokens) return;
 	if ((0, openclaw_plugin_sdk_number_runtime.isFutureDateTimestampMs)(tokens.expiresAt)) return tokens.accessToken;
 	try {
@@ -865,7 +774,7 @@ async function resolveDelegatedAccessToken(params) {
 			refreshToken: tokens.refreshToken,
 			scopes: tokens.scopes
 		});
-		await require_delegated_state.saveMSTeamsDelegatedTokens(refreshed);
+		await require_token_config.saveMSTeamsDelegatedTokens(refreshed);
 		return refreshed.accessToken;
 	} catch {
 		return;
@@ -1019,7 +928,7 @@ async function resolveGraphToken(cfg, options) {
 	const assertRequestCurrent = captureGraphRequestCurrentness((0, openclaw_plugin_sdk_fetch_runtime.captureChannelReadAuthority)());
 	assertRequestCurrent?.();
 	const msteamsCfg = cfg?.channels?.msteams;
-	const creds = resolveMSTeamsCredentials(msteamsCfg);
+	const creds = require_token_config.resolveMSTeamsCredentials(msteamsCfg);
 	if (!creds) throw new Error("MS Teams credentials missing");
 	if (msteamsCfg?.cloud === "China") throw new Error("Microsoft Teams Graph operations are not supported for channels.msteams.cloud=China until Graph requests are routed through the Azure China Graph endpoint.");
 	if (options?.preferDelegated && msteamsCfg?.delegatedAuth?.enabled && creds.type === "secret") {
@@ -1164,9 +1073,6 @@ function wasMSTeamsBotMentioned(activity) {
 //#endregion
 //#region extensions/msteams/src/resolve-allowlist.ts
 const MSTEAMS_GROUP_CONVERSATION_ID = /^19:.+@thread\.(?:tacv2|skype|v2)$/i;
-function normalizeExactMatch(value) {
-	return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(value ?? "");
-}
 function uniqueItemsById(items) {
 	const byId = /* @__PURE__ */ new Map();
 	for (const item of items) {
@@ -1176,16 +1082,16 @@ function uniqueItemsById(items) {
 	return [...byId.values()];
 }
 function findExactNames(items, query) {
-	const normalized = normalizeExactMatch(query);
-	return uniqueItemsById(items.filter((item) => normalizeExactMatch(item.displayName) === normalized));
+	const normalized = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(query);
+	return uniqueItemsById(items.filter((item) => (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(item.displayName) === normalized));
 }
 function findExactUsers(items, query) {
-	const normalized = normalizeExactMatch(query);
+	const normalized = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(query);
 	return uniqueItemsById(items.filter((item) => [
 		item.displayName,
 		item.mail,
 		item.userPrincipalName
-	].some((value) => normalizeExactMatch(value) === normalized)));
+	].some((value) => (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(value) === normalized)));
 }
 function isStableMSTeamsUserId(raw) {
 	return /^[0-9a-fA-F-]{16,}$/.test(normalizeMSTeamsUserInput(raw));
@@ -1200,7 +1106,7 @@ function normalizeStaticMSTeamsAllowEntry(raw) {
 function projectStableMSTeamsUserAllowlist(entries) {
 	if (!entries) return;
 	const projected = entries.map((entry) => normalizeStaticMSTeamsAllowEntry(entry)).filter((entry) => Boolean(entry));
-	return [...new Map(projected.map((entry) => [normalizeExactMatch(entry), entry])).values()];
+	return [...new Map(projected.map((entry) => [(0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(entry), entry])).values()];
 }
 function projectStableMSTeamsGroupAllowlist(entries) {
 	if (!entries) return;
@@ -1210,7 +1116,7 @@ function projectStableMSTeamsGroupAllowlist(entries) {
 		const conversationId = normalizeMSTeamsConversationId(normalizeMSTeamsUserInput(entry));
 		return MSTEAMS_GROUP_CONVERSATION_ID.test(conversationId) ? conversationId : void 0;
 	}).filter((entry) => Boolean(entry));
-	return [...new Map(projected.map((entry) => [MSTEAMS_GROUP_CONVERSATION_ID.test(entry) ? `conversation:${entry}` : normalizeExactMatch(entry), entry])).values()];
+	return [...new Map(projected.map((entry) => [MSTEAMS_GROUP_CONVERSATION_ID.test(entry) ? `conversation:${entry}` : (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(entry), entry])).values()];
 }
 function stripProviderPrefix(raw) {
 	return raw.replace(/^(msteams|teams):/i, "");
@@ -1250,13 +1156,7 @@ function parseMSTeamsConversationId(raw) {
 */
 function looksLikeMSTeamsConversationId(raw) {
 	const trimmed = raw.trim();
-	if (!trimmed) return false;
-	if (/^conversation:/i.test(trimmed)) return true;
-	if (MSTEAMS_GROUP_CONVERSATION_ID.test(trimmed)) return true;
-	if (/^19:.+@unq\.gbl\.spaces$/i.test(trimmed)) return true;
-	if (/^a:1[A-Za-z0-9_-]+$/i.test(trimmed)) return true;
-	if (/^8:orgid:[A-Za-z0-9-]+$/i.test(trimmed)) return true;
-	return /@thread\b/i.test(trimmed);
+	return /^conversation:/i.test(trimmed) || MSTEAMS_GROUP_CONVERSATION_ID.test(trimmed) || /^19:.+@unq\.gbl\.spaces$/i.test(trimmed) || /^a:1[A-Za-z0-9_-]+$/i.test(trimmed) || /^8:orgid:[A-Za-z0-9-]+$/i.test(trimmed) || /@thread\b/i.test(trimmed);
 }
 /**
 * Detect conversation ids plus stable user ids that explicit-target delivery
@@ -1761,12 +1661,6 @@ Object.defineProperty(exports, "fetchGraphJson", {
 		return fetchGraphJson;
 	}
 });
-Object.defineProperty(exports, "hasConfiguredMSTeamsCredentials", {
-	enumerable: true,
-	get: function() {
-		return hasConfiguredMSTeamsCredentials;
-	}
-});
 Object.defineProperty(exports, "htmlToPlainText", {
 	enumerable: true,
 	get: function() {
@@ -1929,12 +1823,6 @@ Object.defineProperty(exports, "resolveMSTeamsChannelAllowlist", {
 		return resolveMSTeamsChannelAllowlist;
 	}
 });
-Object.defineProperty(exports, "resolveMSTeamsCredentials", {
-	enumerable: true,
-	get: function() {
-		return resolveMSTeamsCredentials;
-	}
-});
 Object.defineProperty(exports, "resolveMSTeamsMediaKind", {
 	enumerable: true,
 	get: function() {
@@ -1977,12 +1865,6 @@ Object.defineProperty(exports, "resolveMSTeamsUserAllowlist", {
 		return resolveMSTeamsUserAllowlist;
 	}
 });
-Object.defineProperty(exports, "resolveRequestUrl", {
-	enumerable: true,
-	get: function() {
-		return resolveRequestUrl;
-	}
-});
 Object.defineProperty(exports, "runWithMSTeamsGraphRequestCurrentness", {
 	enumerable: true,
 	get: function() {

package/dist/.setup/{send-VUM7Sryb.cjs → send-7VV1iCai.cjs}

@@ -1,10 +1,11 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("../runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-Pl_NQFYH.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Ct9yxQUw.cjs");
 const require_bot_framework_service_url = require("./bot-framework-service-url-BUhTe8F3.cjs");
-const require_channel = require("./channel-ByzS7QJ0.cjs");
-const require_channel_setup = require("./channel.setup-DL8lcWT_.cjs");
-const require_conversation_store_state = require("./conversation-store-state-B7JuyZTm.cjs");
+const require_token_config = require("./token-config-DOt3XwVa.cjs");
+const require_channel = require("./channel-BFhXodl2.cjs");
+const require_channel_setup = require("./channel.setup-ss0TO-ap.cjs");
+const require_conversation_store_state = require("./conversation-store-state-f7V8CVNy.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
@@ -87,7 +88,7 @@ async function resolveMSTeamsSendContext(params) {
 	const account = require_channel_setup.resolveMSTeamsAccount(params.cfg);
 	if (account.tokenStatus === "configured_unavailable") throw new Error("msteams credential file is configured but unavailable");
 	if (!account.configured) throw new Error("msteams credentials not configured");
-	const creds = require_resolve_allowlist.resolveMSTeamsCredentials(msteamsCfg);
+	const creds = require_token_config.resolveMSTeamsCredentials(msteamsCfg);
 	if (!creds) throw new Error("msteams credentials not configured");
 	const store = require_conversation_store_state.createMSTeamsConversationStoreState();
 	const recipient = parseRecipient(params.to);
@@ -146,7 +147,6 @@ async function resolveMSTeamsSendContext(params) {
 		resolveChannelLimitMb: ({ cfg }) => cfg.channels?.msteams?.mediaMaxMb
 	});
 	return {
-		appId: creds.appId,
 		conversationId,
 		ref: safeRef,
 		app,
@@ -161,12 +161,6 @@ async function resolveMSTeamsSendContext(params) {
 }
 //#endregion
 //#region extensions/msteams/src/send.ts
-const FILE_CONSENT_THRESHOLD_BYTES = 4194304;
-/**
-* MSTeams-specific media size limit (100MB).
-* Higher than the default to support Teams file-consent and SharePoint uploads.
-*/
-const MSTEAMS_MAX_MEDIA_BYTES = 104857600;
 function createMSTeamsSendError(errorPrefix, error) {
 	if (error instanceof Error && (error instanceof openclaw_plugin_sdk_error_runtime.PlatformMessageNotDispatchedError || (0, openclaw_plugin_sdk_channel_inbound.isChannelPartialDeliveryError)(error))) return error;
 	const classification = require_channel_setup.classifyMSTeamsSendError(error);
@@ -214,17 +208,7 @@ function createMSTeamsSendResult(params) {
 		...params.pendingUploadId ? { pendingUploadId: params.pendingUploadId } : {}
 	};
 }
-/**
-* Send a message to a Teams conversation or user.
-*
-* Uses the stored ConversationReference from previous interactions.
-* The bot must have received at least one message from the conversation
-* before proactive messaging works.
-*
-* File handling by conversation type:
-* - Personal (1:1) chats: small images (<4MB) use base64, large files and non-images use FileConsentCard
-* - Group chats / channels: files require configured SharePoint storage
-*/
+/** Proactive delivery requires a conversation reference captured from an earlier inbound turn. */
 async function sendMessageMSTeams(params) {
 	require_resolve_allowlist.assertMSTeamsSendHandoff(params);
 	const { cfg, to, text, mediaUrl, filename, mediaAccess, mediaLocalRoots, mediaReadFile } = params;
@@ -245,14 +229,14 @@ async function sendMessageMSTeams(params) {
 		hasMedia: Boolean(mediaUrl)
 	});
 	if (mediaUrl) {
-		const mediaMaxBytes = ctx.mediaMaxBytes ?? MSTEAMS_MAX_MEDIA_BYTES;
+		const mediaMaxBytes = ctx.mediaMaxBytes ?? 104857600;
 		const media = await (0, openclaw_plugin_sdk_outbound_media.loadOutboundMediaFromUrl)(mediaUrl, {
 			maxBytes: mediaMaxBytes,
 			mediaAccess,
 			mediaLocalRoots,
 			mediaReadFile
 		});
-		const isLargeFile = media.buffer.length >= FILE_CONSENT_THRESHOLD_BYTES;
+		const isLargeFile = media.buffer.length >= require_conversation_store_state.FILE_CONSENT_THRESHOLD_BYTES;
 		const isImage = media.contentType?.startsWith("image/") ?? false;
 		const fallbackFileName = await require_conversation_store_state.extractFilename(mediaUrl);
 		const fileName = filename?.trim() || media.fileName || fallbackFileName;
@@ -267,8 +251,7 @@ async function sendMessageMSTeams(params) {
 		if (require_conversation_store_state.requiresFileConsent({
 			conversationType,
 			contentType: media.contentType,
-			bufferSize: media.buffer.length,
-			thresholdBytes: FILE_CONSENT_THRESHOLD_BYTES
+			bufferSize: media.buffer.length
 		})) {
 			require_resolve_allowlist.assertMSTeamsSendHandoff(params);
 			const { activity, uploadId } = await require_conversation_store_state.prepareFileConsentActivityFs({
@@ -377,7 +360,7 @@ async function sendMessageMSTeams(params) {
 	return sendTextWithMedia(ctx, messageText, void 0, params);
 }
 async function sendTextWithMedia(ctx, text, mediaUrl, options) {
-	const { app, appId, conversationId, ref, log, tokenProvider, sharePointSiteId, mediaMaxBytes, replyStyle } = ctx;
+	const { app, conversationId, ref, log, tokenProvider, sharePointSiteId, mediaMaxBytes, replyStyle } = ctx;
 	const messages = text && mediaUrl ? [{ text }, { mediaUrl }] : [{
 		text: text || void 0,
 		mediaUrl
@@ -401,7 +384,6 @@ async function sendTextWithMedia(ctx, text, mediaUrl, options) {
 			},
 			replyStyle,
 			app,
-			appId,
 			conversationRef: ref,
 			messages,
 			retry: {},
@@ -528,14 +510,8 @@ async function sendAdaptiveCardMSTeams(params) {
 		await params.onDeliveryResult?.(result);
 	});
 }
-/**
-* Edit (update) a previously sent message in a Teams conversation.
-*
-* Uses the Bot Framework REST API for proactive edits outside of the
-* original turn context.
-*/
 async function editMessageMSTeams(params) {
-	return updateMSTeamsMessageActivity({
+	return mutateMSTeamsMessageActivity({
 		...params,
 		activity: {
 			...require_conversation_store_state.buildMSTeamsMessageActivity(require_conversation_store_state.formatMSTeamsMarkdown(params.text, (0, openclaw_plugin_sdk_markdown_table_runtime.resolveMarkdownTableMode)({
@@ -547,7 +523,7 @@ async function editMessageMSTeams(params) {
 	});
 }
 async function editAdaptiveCardMSTeams(params) {
-	return updateMSTeamsMessageActivity({
+	return mutateMSTeamsMessageActivity({
 		...params,
 		activity: {
 			...require_conversation_store_state.buildMSTeamsAdaptiveCardActivity(params.card),
@@ -555,51 +531,29 @@ async function editAdaptiveCardMSTeams(params) {
 		}
 	});
 }
-async function updateMSTeamsMessageActivity(params) {
-	const { cfg, to, activityId, activity } = params;
-	const { app, conversationId, ref, log, sdkCloudOptions } = await resolveMSTeamsSendContext({
-		cfg,
-		to
-	});
-	log.debug?.("editing proactive message", {
-		conversationId,
-		activityId
-	});
-	try {
-		const baseRef = require_conversation_store_state.buildConversationReference(ref);
-		await require_conversation_store_state.updateMSTeamsActivityWithReference(app, baseRef, activityId, activity, { serviceUrlBoundary: sdkCloudOptions });
-	} catch (err) {
-		throw createMSTeamsSendError("msteams edit", err);
-	}
-	log.info("edited proactive message", {
-		conversationId,
-		activityId
-	});
-	return { conversationId };
-}
-/**
-* Delete a previously sent message in a Teams conversation.
-*
-* Uses the Bot Framework REST API for proactive deletes outside of the
-* original turn context.
-*/
 async function deleteMessageMSTeams(params) {
-	const { cfg, to, activityId } = params;
+	return mutateMSTeamsMessageActivity(params);
+}
+async function mutateMSTeamsMessageActivity(params) {
+	const { cfg, to, activityId, activity } = params;
 	const { app, conversationId, ref, log, sdkCloudOptions } = await resolveMSTeamsSendContext({
 		cfg,
 		to
 	});
-	log.debug?.("deleting proactive message", {
+	const operation = activity ? "edit" : "delete";
+	log.debug?.(`${activity ? "editing" : "deleting"} proactive message`, {
 		conversationId,
 		activityId
 	});
 	try {
 		const baseRef = require_conversation_store_state.buildConversationReference(ref);
-		await require_conversation_store_state.deleteMSTeamsActivityWithReference(app, baseRef, activityId, { serviceUrlBoundary: sdkCloudOptions });
+		const options = { serviceUrlBoundary: sdkCloudOptions };
+		if (activity) await require_conversation_store_state.updateMSTeamsActivityWithReference(app, baseRef, activityId, activity, options);
+		else await require_conversation_store_state.deleteMSTeamsActivityWithReference(app, baseRef, activityId, options);
 	} catch (err) {
-		throw createMSTeamsSendError("msteams delete", err);
+		throw createMSTeamsSendError(`msteams ${operation}`, err);
 	}
-	log.info("deleted proactive message", {
+	log.info(`${activity ? "edited" : "deleted"} proactive message`, {
 		conversationId,
 		activityId
 	});

package/dist/.setup/{setup-plugin-api-Dyf8kF-l.cjs → setup-plugin-api-B0OFG32J.cjs}

@@ -1,3 +1,3 @@
-const require_channel_setup = require("./channel.setup-DL8lcWT_.cjs");
+const require_channel_setup = require("./channel.setup-ss0TO-ap.cjs");
 require("../setup-plugin-api.cjs");
 exports.msteamsSetupPlugin = require_channel_setup.msteamsSetupPlugin;

package/dist/.setup/{thread-session--rw3BTal.cjs → thread-session-ClI-lSyG.cjs}

@@ -1,4 +1,4 @@
-const require_resolve_allowlist = require("./resolve-allowlist-Pl_NQFYH.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Ct9yxQUw.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_approval_auth_runtime = require("openclaw/plugin-sdk/approval-auth-runtime");
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");

package/dist/.setup/token-config-DOt3XwVa.cjs

@@ -0,0 +1,139 @@
+const require_runtime = require("./runtime-gZTAuFux.cjs");
+let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
+let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
+//#region extensions/msteams/src/delegated-state.ts
+const MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME = "msteams-delegated.json";
+const MSTEAMS_DELEGATED_TOKEN_NAMESPACE = "delegated-token";
+const MSTEAMS_DELEGATED_TOKEN_KEY = "current";
+function openDelegatedTokenStore(env) {
+	return require_runtime.getMSTeamsRuntime().state.openKeyedStore({
+		namespace: MSTEAMS_DELEGATED_TOKEN_NAMESPACE,
+		maxEntries: 1,
+		overflowPolicy: "reject-new",
+		...env ? { env } : {}
+	});
+}
+function normalizeMSTeamsDelegatedTokens(value) {
+	if (!value || typeof value !== "object") return null;
+	const token = value;
+	if (typeof token.accessToken !== "string" || !token.accessToken || typeof token.refreshToken !== "string" || !token.refreshToken || typeof token.expiresAt !== "number" || !Number.isFinite(token.expiresAt) || !Array.isArray(token.scopes) || !token.scopes.every((scope) => typeof scope === "string" && scope.length > 0)) return null;
+	return {
+		accessToken: token.accessToken,
+		refreshToken: token.refreshToken,
+		expiresAt: token.expiresAt,
+		scopes: [...token.scopes],
+		...typeof token.userPrincipalName === "string" ? { userPrincipalName: token.userPrincipalName } : {}
+	};
+}
+async function loadMSTeamsDelegatedTokens(env) {
+	return normalizeMSTeamsDelegatedTokens(await openDelegatedTokenStore(env).lookup("current")) ?? void 0;
+}
+async function saveMSTeamsDelegatedTokens(tokens, env) {
+	const normalized = normalizeMSTeamsDelegatedTokens(tokens);
+	if (!normalized) throw new Error("Invalid Microsoft Teams delegated token payload");
+	await openDelegatedTokenStore(env).register(MSTEAMS_DELEGATED_TOKEN_KEY, normalized);
+}
+//#endregion
+//#region extensions/msteams/src/token-config.ts
+function resolveAuthType(cfg) {
+	const fromCfg = cfg?.authType;
+	if (fromCfg === "secret" || fromCfg === "federated") return fromCfg;
+	if (process.env.MSTEAMS_AUTH_TYPE === "federated") return "federated";
+	return "secret";
+}
+function resolveFederatedPath(configValue, envValue) {
+	return (0, openclaw_plugin_sdk_string_coerce_runtime.readNonBlankString)(configValue) ?? (0, openclaw_plugin_sdk_string_coerce_runtime.readNonBlankString)(envValue);
+}
+function hasConfiguredMSTeamsCredentials(cfg) {
+	const authType = resolveAuthType(cfg);
+	const hasAppId = Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_ID));
+	const hasTenantId = Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_TENANT_ID));
+	if (authType === "federated") {
+		const hasCert = Boolean(resolveFederatedPath(cfg?.certificatePath, process.env.MSTEAMS_CERTIFICATE_PATH));
+		const hasManagedIdentity = cfg?.useManagedIdentity ?? process.env.MSTEAMS_USE_MANAGED_IDENTITY === "true";
+		return hasAppId && hasTenantId && (hasCert || hasManagedIdentity);
+	}
+	return Boolean((0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) && (0, openclaw_plugin_sdk_secret_input.hasConfiguredSecretInput)(cfg?.appPassword) && (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId));
+}
+function resolveMSTeamsCredentials(cfg) {
+	const authType = resolveAuthType(cfg);
+	const appId = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.appId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_ID);
+	const tenantId = (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(cfg?.tenantId) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_TENANT_ID);
+	if (!appId || !tenantId) return;
+	if (authType === "federated") {
+		const certificatePath = resolveFederatedPath(cfg?.certificatePath, process.env.MSTEAMS_CERTIFICATE_PATH);
+		const certificateThumbprint = cfg?.certificateThumbprint || process.env.MSTEAMS_CERTIFICATE_THUMBPRINT || void 0;
+		const useManagedIdentity = cfg?.useManagedIdentity ?? process.env.MSTEAMS_USE_MANAGED_IDENTITY === "true";
+		const managedIdentityClientId = cfg?.managedIdentityClientId || process.env.MSTEAMS_MANAGED_IDENTITY_CLIENT_ID || void 0;
+		if (!certificatePath && !useManagedIdentity) return;
+		return {
+			type: "federated",
+			appId,
+			tenantId,
+			certificatePath,
+			certificateThumbprint,
+			useManagedIdentity: useManagedIdentity || void 0,
+			managedIdentityClientId
+		};
+	}
+	const appPassword = (0, openclaw_plugin_sdk_secret_input.normalizeResolvedSecretInputString)({
+		value: cfg?.appPassword,
+		path: "channels.msteams.appPassword"
+	}) || (0, openclaw_plugin_sdk_secret_input.normalizeSecretInputString)(process.env.MSTEAMS_APP_PASSWORD);
+	if (!appPassword) return;
+	return {
+		type: "secret",
+		appId,
+		appPassword,
+		tenantId
+	};
+}
+//#endregion
+Object.defineProperty(exports, "MSTEAMS_DELEGATED_TOKEN_KEY", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DELEGATED_TOKEN_KEY;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME;
+	}
+});
+Object.defineProperty(exports, "MSTEAMS_DELEGATED_TOKEN_NAMESPACE", {
+	enumerable: true,
+	get: function() {
+		return MSTEAMS_DELEGATED_TOKEN_NAMESPACE;
+	}
+});
+Object.defineProperty(exports, "hasConfiguredMSTeamsCredentials", {
+	enumerable: true,
+	get: function() {
+		return hasConfiguredMSTeamsCredentials;
+	}
+});
+Object.defineProperty(exports, "loadMSTeamsDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return loadMSTeamsDelegatedTokens;
+	}
+});
+Object.defineProperty(exports, "normalizeMSTeamsDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return normalizeMSTeamsDelegatedTokens;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsCredentials", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsCredentials;
+	}
+});
+Object.defineProperty(exports, "saveMSTeamsDelegatedTokens", {
+	enumerable: true,
+	get: function() {
+		return saveMSTeamsDelegatedTokens;
+	}
+});

package/dist/api.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./.setup/channel-ByzS7QJ0.cjs");
-const require_channel_setup = require("./.setup/channel.setup-DL8lcWT_.cjs");
+const require_channel = require("./.setup/channel-BFhXodl2.cjs");
+const require_channel_setup = require("./.setup/channel.setup-ss0TO-ap.cjs");
 exports.createMSTeamsSetupWizardBase = require_channel_setup.createMSTeamsSetupWizardBase;
 exports.msteamsPlugin = require_channel.msteamsPlugin;
 exports.msteamsSetupAdapter = require_channel_setup.msteamsSetupAdapter;

package/dist/channel-plugin-api.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./.setup/channel-ByzS7QJ0.cjs");
+const require_channel = require("./.setup/channel-BFhXodl2.cjs");
 exports.msteamsPlugin = require_channel.msteamsPlugin;