perf(msteams): narrow secret and ssrf runtime seams

extensions/msteams/src/attachments/shared.ts

@@ -5,8 +5,8 @@ import {
   isHttpsUrlAllowedByHostnameSuffixAllowlist,
   isPrivateIpAddress,
   normalizeHostnameSuffixAllowlist,
-} from "../../runtime-api.js";
-import type { SsrFPolicy } from "../../runtime-api.js";
+  type SsrFPolicy,
+} from "openclaw/plugin-sdk/ssrf-policy";
 import type { MSTeamsAttachmentLike } from "./types.js";
 
 type InlineImageCandidate =

extensions/msteams/src/secret-input.ts

@@ -2,6 +2,6 @@ import {
   hasConfiguredSecretInput,
   normalizeResolvedSecretInputString,
   normalizeSecretInputString,
-} from "../runtime-api.js";
+} from "openclaw/plugin-sdk/secret-input";
 
 export { hasConfiguredSecretInput, normalizeResolvedSecretInputString, normalizeSecretInputString };

package.json

@@ -151,6 +151,10 @@
       "types": "./dist/plugin-sdk/runtime-group-policy.d.ts",
       "default": "./dist/plugin-sdk/runtime-group-policy.js"
     },
+    "./plugin-sdk/ssrf-policy": {
+      "types": "./dist/plugin-sdk/ssrf-policy.d.ts",
+      "default": "./dist/plugin-sdk/ssrf-policy.js"
+    },
     "./plugin-sdk/ssrf-runtime": {
       "types": "./dist/plugin-sdk/ssrf-runtime.d.ts",
       "default": "./dist/plugin-sdk/ssrf-runtime.js"

scripts/lib/plugin-sdk-entrypoints.json

@@ -27,6 +27,7 @@
   "infra-runtime",
   "runtime-config-snapshot",
   "runtime-group-policy",
+  "ssrf-policy",
   "ssrf-runtime",
   "media-runtime",
   "media-understanding-runtime",

src/plugin-sdk/ssrf-policy.ts

@@ -6,6 +6,8 @@ import {
   type SsrFPolicy,
 } from "../infra/net/ssrf.js";
 
+export { isPrivateIpAddress };
+
 export function ssrfPolicyFromAllowPrivateNetwork(
   allowPrivateNetwork: boolean | null | undefined,
 ): SsrFPolicy | undefined {