chore(msteams): drop unused jsonwebtoken/jwks-rsa deps

The SDK migration removed all `import "jsonwebtoken"` / `import "jwks-rsa"`
from source code (the SDK does JWT validation internally now), but the
package.json entries and the matching `package-manifest.contract.test.ts`
expectation were left orphaned. Drop both:

- `extensions/msteams/package.json`: remove `jsonwebtoken` (^9), `jwks-rsa`
  (^4) from `dependencies` and `@types/jsonwebtoken` from `devDependencies`.
- `src/plugins/contracts/package-manifest.contract.test.ts`: remove the
  two entries from msteams's `pluginLocalRuntimeDeps` expectation.
- `monitor.lifecycle.test.ts`: extend the `./sdk.js` mock with the
  `createMSTeamsExpressAdapter` export added in the typed-helper cleanup,
  so the lifecycle suite still mounts after the deps drop.

Lockfile regenerates accordingly. All msteams tests (865) pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

extensions/msteams/package.json

@@ -12,13 +12,10 @@
     "@microsoft/teams.api": "2.0.10",
     "@microsoft/teams.apps": "2.0.10",
     "express": "5.2.1",
-    "jsonwebtoken": "9.0.3",
-    "jwks-rsa": "4.0.1",
     "typebox": "1.1.37"
   },
   "devDependencies": {
     "@openclaw/plugin-sdk": "workspace:*",
-    "@types/jsonwebtoken": "^9.0.10",
     "openclaw": "workspace:*"
   },
   "peerDependencies": {

extensions/msteams/src/monitor.lifecycle.test.ts

@@ -126,6 +126,11 @@ vi.mock("./sdk.js", () => ({
   createMSTeamsTokenProvider: () => ({
     getAccessToken: vi.fn().mockResolvedValue("mock-token"),
   }),
+  createMSTeamsExpressAdapter: vi.fn().mockResolvedValue({
+    registerRoute: vi.fn(),
+    start: vi.fn().mockResolvedValue(undefined),
+    stop: vi.fn().mockResolvedValue(undefined),
+  }),
 }));
 
 vi.mock("./runtime.js", () => ({

pnpm-lock.yaml

@@ -1050,12 +1050,6 @@ importers:
       express:
         specifier: 5.2.1
         version: 5.2.1
-      jsonwebtoken:
-        specifier: 9.0.3
-        version: 9.0.3
-      jwks-rsa:
-        specifier: 4.0.1
-        version: 4.0.1
       typebox:
         specifier: 1.1.37
         version: 1.1.37
@@ -1063,9 +1057,6 @@ importers:
       '@openclaw/plugin-sdk':
         specifier: workspace:*
         version: link:../../packages/plugin-sdk
-      '@types/jsonwebtoken':
-        specifier: ^9.0.10
-        version: 9.0.10
       openclaw:
         specifier: workspace:*
         version: link:../..
@@ -5945,10 +5936,6 @@ packages:
     resolution: {integrity: sha512-BqTyEDV+lS8F2trk3A+qJnxV5Q9EqKCBJOPti3W97r7qTympCZjb7h2X6f2kc+0K3rsSTY1/6YG2eaXKoj497w==}
     engines: {node: '>=14'}
 
-  jwks-rsa@4.0.1:
-    resolution: {integrity: sha512-poXwUA8S4cP9P5N8tZS3xnUDJH8WmwSGfKK9gIaRPdjLHyJtd9iX/cngX9CUIe0Caof5JhK2EbN7N5lnnaf9NA==}
-    engines: {node: ^20.19.0 || ^22.12.0 || >= 23.0.0}
-
   jws@4.0.1:
     resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==}
 
@@ -6132,9 +6119,6 @@ packages:
   lru-memoizer@2.3.0:
     resolution: {integrity: sha512-GXn7gyHAMhO13WSKrIiNfztwxodVsP8IoZ3XfrJV4yH2x0/OeTO/FIaAHTY5YekdGgW94njfuKmyyt1E0mR6Ug==}
 
-  lru-memoizer@3.0.0:
-    resolution: {integrity: sha512-m83w/cYXLdUIboKSPxzPAGfYnk+vqeDYXuoSrQRw1q+yVEd8IXhvMufN8Q5TIPe7e2jyX4SRNrDJI2Skw1yznQ==}
-
   lru_map@0.4.1:
     resolution: {integrity: sha512-I+lBvqMMFfqaV8CJCISjI3wbjmwVu/VyOoU7+qtu9d7ioW5klMgsTTiUOUp+DJvfTTzKXoPbyC6YfgkNcyPSOg==}
 
@@ -12996,16 +12980,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  jwks-rsa@4.0.1:
-    dependencies:
-      '@types/jsonwebtoken': 9.0.10
-      debug: 4.4.3
-      jose: 6.2.3
-      limiter: 1.1.5
-      lru-memoizer: 3.0.0
-    transitivePeerDependencies:
-      - supports-color
-
   jws@4.0.1:
     dependencies:
       jwa: 2.0.1
@@ -13152,11 +13126,6 @@ snapshots:
       lodash.clonedeep: 4.5.0
       lru-cache: 6.0.0
 
-  lru-memoizer@3.0.0:
-    dependencies:
-      lodash.clonedeep: 4.5.0
-      lru-cache: 11.3.6
-
   lru_map@0.4.1: {}
 
   magic-string@0.30.21:

src/plugins/contracts/package-manifest.contract.test.ts

@@ -49,13 +49,7 @@ const packageManifestContractTests: PackageManifestContractParams[] = [
   },
   {
     pluginId: "msteams",
-    pluginLocalRuntimeDeps: [
-      "@azure/identity",
-      "@microsoft/teams.api",
-      "@microsoft/teams.apps",
-      "jsonwebtoken",
-      "jwks-rsa",
-    ],
+    pluginLocalRuntimeDeps: ["@azure/identity", "@microsoft/teams.api", "@microsoft/teams.apps"],
     minHostVersionBaseline: "2026.3.22",
   },
   { pluginId: "nextcloud-talk", minHostVersionBaseline: "2026.3.22" },