feat(teams): migrate inbound + auth to microsoft-teams-apps SDK (#93 PR 1/4)

docs/UPSTREAM_SYNC.md

@@ -610,6 +610,8 @@ stay explicit instead of being rediscovered in code review.
 | Chat resolver | 3-level: explicit → ContextVar → global | Process-global singleton | See [DECISIONS.md](DECISIONS.md#why-3-level-chat-resolver) |
 | PostableObject history | Cached in message history with real message ID | Not cached (skips history) | Upstream gap — posted messages should appear in thread/channel history |
 | Teams `msteams` transport key | Stripped from action values | Not stripped | Upstream gap — SDK-injected metadata should not leak to handlers |
+| Teams inbound activity routing (issue #93 PR 1) | `BridgeHttpAdapter.dispatch` feeds webhooks through the SDK `HttpServer` (JWT validation), but the adapter **overrides `app.server.on_request`** with `_dispatch_activity` instead of letting the SDK's default router run. Our callback dumps the lenient `CoreActivity` to a camelCase dict and routes by `type` to the existing handler logic. | Upstream `adapter-teams@4.30.0` registers `app.on("message" / "card.action" / …)` and lets `@microsoft/teams.apps` route via its typed dispatcher; handlers receive `ctx.activity` as a strongly-typed `IMessageActivity` etc. | The Python SDK's default `on_request` (`App._process_activity_event` → `ActivityProcessor.process_activity`) runs `ActivityTypeAdapter.validate_python` (strict per-activity validation — `recipient`/`id` required) **and** a live `api.users.token.get` network call inside `_build_context` before any handler fires. Minimal serverless webhook payloads (and the adapter's dict-based handler logic) can't survive strict validation, and the token fetch would make an unwanted outbound call per inbound activity. We keep the SDK as the **auth + transport** layer (JWT genuinely validated by its `TokenValidator`) but route the already-authenticated activity ourselves through the lenient `CoreActivity`, preserving the exact pre-migration handler behavior. The SDK `on_message`/`on_card_action`/… decorators are still registered for parity/forward-compat. Regression coverage: `tests/test_teams_extended.py::TestActivityTypes`, `tests/test_teams_coverage.py::TestSdkInboundAuth`, `tests/test_teams_bridge.py`. |
+| Teams dialog/modal inbound (issue #93 PR 1) | `on_dialog_open` / `on_dialog_submit` are registered on the SDK App but only cache user context (no `process_modal_submit`, no task-module response) | Upstream `adapter-teams@4.30.0` `handleDialogOpen`/`handleDialogSubmit` drive `chat.processModalSubmit` + `modalToAdaptiveCard` | The pre-migration Python Teams adapter never implemented modal/dialog inbound processing, so PR 1 (inbound + auth plumbing) preserves that behavior rather than introducing new modal handling. Wiring dialogs to `chat.process_modal_submit` is tracked as a later wave of the #93 migration. |
 | Fallback streaming with whitespace-only streams (non-Teams adapters) | Placeholder cleared to `" "` on final edit | Placeholder left visible (`"..."` stuck) | Upstream 4.26 guards against empty edits but leaves the placeholder stranded on the message. We issue one final `edit_message(" ")` so the placeholder disappears when no real content was produced. Teams no longer routes through `_fallback_stream` after vercel/chat#416 (DMs use native streaming, group chats accumulate-and-post), so this divergence applies only to Slack / Discord / GitHub / Telegram / Google Chat / Linear / WhatsApp. |
 | Google Chat `<url\|text>` round-trip | `to_ast()` / `extract_plain_text()` parse the custom-label syntax back to a link node / bare label | `toAst()` / `extractPlainText()` leave `<url\|text>` as raw text (or parse the whole string as an autolink with a malformed URL) | Upstream 4.26 emits `<url\|text>` in `from_ast` but never taught the reverse direction to parse it. A message posted with `[label](url)` then read back through `fetch_messages` comes back as unstructured text (or worse, a link node with the full `url\|text` as its URL) in upstream. We close the round-trip via an AST placeholder substitution: each `<url\|text>` is extracted to a private-use sentinel, Markdown is parsed on the rest, and link nodes are injected where the sentinels landed. This avoids the Markdown parser's incomplete handling of balanced-parens link destinations, so URLs like `https://en.wikipedia.org/wiki/Foo_(bar)` round-trip intact. |
 | `from_json(data, adapter=X)` → `_adapter_name` | Updated to `X.name` so `to_json()` reflects the bound adapter | Kept at `json.adapterName`, so re-serialization can emit a name that no longer matches the actual adapter | Upstream TS has the same gap but only exposes it via the `fromJSON(json, adapter?)` overload. In Python we lean on this API more (explicit `chat=` / explicit `adapter=` is preferred over the singleton). We sync the name on rebind so runtime and serialize agree. |

pyproject.toml

@@ -52,7 +52,14 @@ redis = ["redis>=5.0"]
 postgres = ["asyncpg>=0.29"]
 crypto = ["cryptography>=42.0"]
 discord = ["pynacl>=1.5", "aiohttp>=3.9"]
-teams = ["aiohttp>=3.9"]
+teams = [
+    "aiohttp>=3.9",
+    # Official Microsoft Teams Apps Python SDK (issue #93 migration; mirrors upstream
+    # adapter-teams@4.30.0's @microsoft/teams.* deps). Graph stays hand-rolled (no [graph] extra).
+    "microsoft-teams-apps>=2.0.13",
+    "microsoft-teams-api>=2.0.13",
+    "microsoft-teams-cards>=2.0.13",
+]
 telegram = ["aiohttp>=3.9"]
 whatsapp = ["aiohttp>=3.9"]
 messenger = ["aiohttp>=3.9"]
@@ -68,6 +75,9 @@ all = [
     "pynacl>=1.5",
     "aiohttp>=3.9",
     "google-auth>=2.0",
+    "microsoft-teams-apps>=2.0.13",
+    "microsoft-teams-api>=2.0.13",
+    "microsoft-teams-cards>=2.0.13",
 ]
 
 [build-system]
@@ -123,6 +133,11 @@ dev = [
     "pyjwt[crypto]>=2.8",
     "ruff>=0.4.0",
     "pyrefly==0.61.1",
+    # Teams adapter SDK (issue #93) — in dev so CI (`uv sync --group dev`) installs it
+    # and the Teams test suite runs; matches how the other optional adapter deps are wired.
+    "microsoft-teams-apps>=2.0.13",
+    "microsoft-teams-api>=2.0.13",
+    "microsoft-teams-cards>=2.0.13",
 ]
 
 # ---------------------------------------------------------------------------
@@ -166,6 +181,9 @@ replace-imports-with-any = [
     # GitHub App auth
     "jwt",
     "jwt.*",
+    # Teams — official MS Teams Apps SDK (optional teams extra)
+    "microsoft_teams",
+    "microsoft_teams.*",
 ]
 
 [tool.pyrefly.errors]