This is a comment left during a code review.
Path: extensions/msteams/src/errors.ts
Line: 196

Comment:
**Env var hints dropped from error message**

The updated message removes mention of the `MSTEAMS_APP_ID`, `MSTEAMS_APP_PASSWORD`, and `MSTEAMS_TENANT_ID` environment variables. For users who configure credentials via env vars (rather than the YAML config), this is a regression — they lose the hint pointing to those vars when auth fails.

Consider keeping the env var guidance alongside the new auth type info:

```suggestion
    return "check msteams appId/tenantId and auth config (appPassword, certificate, or federated credential) — or env vars MSTEAMS_APP_ID/MSTEAMS_APP_PASSWORD/MSTEAMS_TENANT_ID";
```

How can I resolve this? If you propose a fix, please make it concise.

This is a comment left during a code review.
Path: extensions/msteams/src/token.ts
Line: 10-13

Comment:
**`appPassword` required but meaningless for non-`clientSecret` auth**

`appPassword: string` is a required field in `MSTeamsCredentials`, yet for `certificate` and `federatedCredential` auth it's always set to the empty string `""`. Downstream consumers of this type may be confused by a field that is nominally required but silently unused. Making it optional better represents the actual contract:

```suggestion
export type MSTeamsCredentials = {
  appId: string;
  appPassword?: string;
  tenantId: string;
  authType: MSTeamsAuthType;
  certPemFile?: string;
  certKeyFile?: string;
  sendX5C?: boolean;
  ficClientId?: string;
  widAssertionFile?: string;
};
```

The `clientSecret` branch in `sdk.ts` already guards the field access with `creds.appPassword`, so making it optional there is safe. The `resolveMSTeamsCredentials` return for `clientSecret` already guarantees a non-empty value via the `if (!appPassword) return undefined` guard.

How can I resolve this? If you propose a fix, please make it concise.

This is a comment left during a code review.
Path: extensions/msteams/src/token.ts
Line: 8

Comment:
**Duplicated auth type union between `token.ts` and `types.msteams.ts`**

`MSTeamsAuthType` is exported from `token.ts` as a named type, but `MSTeamsConfig.authType` in `src/config/types.msteams.ts` repeats the same union inline (`"clientSecret" | "certificate" | "federatedCredential"`). If a new auth method is added later, both locations need to be updated independently, risking a drift.

I understand `types.msteams.ts` cannot directly import from `token.ts` without creating a circular dependency (since `token.ts` imports `MSTeamsConfig`). One option is to extract `MSTeamsAuthType` into its own lightweight file (or into the shared plugin-sdk types) so it can be imported by both sides without a cycle.

How can I resolve this? If you propose a fix, please make it concise.