@michaelschnyder/teams-cli 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+## 0.1.0
+
+- Added browser-backed Microsoft Teams authentication with identity-isolated profiles and token refresh.
+- Added people, chat, channel, and message reads with structured JSON output.
+- Added policy-authorized plain-text message sending and subject-path workspace policies.
+- Added packaged agent skills with multi-environment installation and managed refresh.
+- Added deferred npm update notifications and `version --upgrade`.
+- Added cross-platform CI, package validation, CodeQL, Dependabot, and npm publication automation.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael Schnyder
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,249 @@
+# teams-cli
+
+A safety-conscious command-line client for persistent Microsoft Teams sessions. It supports multiple tenants and users, named profiles, structured output, agent skills, and optional subject-path policies that can prevent messages from being sent to unintended chats or channels.
+
+> [!WARNING]
+> This project relies on undocumented Microsoft Teams behavior and a Microsoft first-party client identity. It is unsupported, may be blocked by tenant policy, and may stop working without notice. Obtain organizational approval before using it, and never run live write tests against a production tenant.
+
+## Requirements
+
+- Node.js 22.20 or newer. Node.js 24 LTS is recommended.
+- Microsoft Edge or Google Chrome.
+- A Microsoft 365 account with Teams access.
+
+### Install Node.js on Windows
+
+Open PowerShell and install the current Node.js LTS release with Windows Package Manager:
+
+```powershell
+winget install --id OpenJS.NodeJS.LTS --exact --source winget
+```
+
+Open a new terminal, then verify both tools:
+
+```powershell
+node --version
+npm --version
+```
+
+If `winget` is unavailable, install Microsoft App Installer or use the signed installer from the [Node.js download page](https://nodejs.org/en/download).
+
+### Install Node.js on macOS
+
+With [Homebrew](https://brew.sh/):
+
+```bash
+brew install node@24
+echo 'export PATH="$(brew --prefix node@24)/bin:$PATH"' >> ~/.zshrc
+source ~/.zshrc
+node --version
+npm --version
+```
+
+Alternatively, use the signed macOS package from the [Node.js download page](https://nodejs.org/en/download).
+
+### Install Node.js on Linux
+
+Distribution repositories may contain a Node.js version older than this CLI requires. A version manager keeps the runtime separate from system packages. The following follows the [Node.js download guidance](https://nodejs.org/en/download) using `nvm`; inspect downloaded installation scripts before running them:
+
+```bash
+curl -o nvm-install.sh https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.7/install.sh
+less nvm-install.sh
+bash nvm-install.sh
+. "$HOME/.nvm/nvm.sh"
+nvm install 24
+node --version
+npm --version
+```
+
+Node.js also publishes signed standalone Linux archives on its download page.
+
+## Install teams-cli
+
+Install the command globally:
+
+```bash
+npm install --global @michaelschnyder/teams-cli
+teams-cli --version
+teams-cli --help
+```
+
+To try it without a permanent installation:
+
+```bash
+npx @michaelschnyder/teams-cli --help
+```
+
+If a global install reports a permissions error, use a Node version manager instead of running npm with `sudo`. If installation succeeds but `teams-cli` is not found, run `npm prefix --global` and ensure that npm's global executable directory is on `PATH`.
+
+## Quick start
+
+Interactive login opens a dedicated Edge profile by default:
+
+```bash
+teams-cli --profile work --tenant YOUR_TENANT_ID auth login
+teams-cli --profile work auth whoami
+```
+
+The successful login records the verified tenant, user, and browser in the named profile. Subsequent commands reuse identity-isolated tokens and refresh them from the saved browser state when necessary.
+
+Discover Teams data:
+
+```bash
+teams-cli --profile work person search "Alice" --json
+teams-cli --profile work chat list --json
+teams-cli --profile work channel list --json
+teams-cli --profile work message list --chat CHAT_ID --json
+```
+
+Send a plain-text message after checking the selected identity and target:
+
+```bash
+teams-cli --profile work auth whoami
+teams-cli --profile work policy check send --chat CHAT_ID
+teams-cli --profile work message send --chat CHAT_ID --body "Hello"
+```
+
+Use `--channel CHANNEL_ID` instead of `--chat CHAT_ID` for channel messages. A message body can also be piped on stdin.
+
+## Command overview
+
+```text
+teams-cli [--profile NAME] [--tenant ID] [--user ID] [--browser edge|chrome]
+
+version    show the installed version or upgrade it
+skills     list, locate, install, and refresh packaged agent skills
+auth       login, refresh, whoami, tokens, logout
+profile    list, show, save, remove
+policy     init, list, show, check, activate
+person     search, get, image
+chat       list, get
+channel    list, get
+message    list, get, send
+```
+
+Run `teams-cli <command> --help` for complete arguments and options.
+
+### Structured output
+
+Person, chat, channel, and message commands that return data support `--json`. JSON payloads stay on stdout. Progress, warnings, update notices, and sanitized debug output stay on stderr, so scripts can safely pipe stdout.
+
+## Profiles and local state
+
+Profiles provide defaults; global flags override them for one command. When no profile is selected, the profile named `default` is used.
+
+```bash
+teams-cli profile list
+teams-cli profile show work
+teams-cli --tenant TENANT_ID --user USER_ID --browser chrome profile save work
+teams-cli profile remove work
+```
+
+Configuration, authentication, browser state, policies, update state, and managed skill-installation records live under `~/.teams-cli/`. Secret-bearing files and directories are created with owner-only permissions on supported operating systems.
+
+See [profiles and precedence](docs/use/profiles.md) and [authentication and token handling](docs/use/authentication.md).
+
+## Policies
+
+Policies are optional. Inactive policies audit and warn without enforcing; active policies enforce the intersection of all matching subject-path rules. A malformed policy store puts authenticated operations into fail-safe mode. Active policies cannot be deactivated through this CLI.
+
+```bash
+teams-cli --profile work policy init project-agent
+teams-cli policy show project-agent
+teams-cli policy check send --chat CHAT_ID
+teams-cli policy activate project-agent
+```
+
+Review and edit the generated allowlists before activation. See [workspace policies](docs/use/policies.md) and the [security model](https://github.com/michaelschnyder/teams-cli/blob/main/docs/build/security-model.md).
+
+### Token export
+
+The existing authentication commands can print raw bearer tokens or decoded JWT claims:
+
+```bash
+teams-cli --profile work auth tokens
+teams-cli --profile work auth token access
+teams-cli --profile work auth tokens --decode
+```
+
+Applicable active policies can deny raw token export. Treat exported tokens like passwords: another HTTP client can use them outside the CLI's cooperative policy checks. Never paste them into prompts, logs, issues, or source files.
+
+## Agent skills
+
+The npm package includes skills that teach compatible coding agents how to use this CLI safely. Auto-detection supports Codex, Claude Code, Cursor, GitHub Copilot, OpenCode, Windsurf, Gemini CLI, Pi, and generic `.agents/skills` environments.
+
+```bash
+teams-cli skills list
+teams-cli skills path
+teams-cli skills install
+```
+
+When several environments are detected, the skills are installed into all of them. Specify a target when detection is unavailable:
+
+```bash
+teams-cli skills install codex
+teams-cli skills install github-copilot --project
+teams-cli skills install agents --name teams-cli
+teams-cli skills install all
+teams-cli skills install --dir /custom/skills
+```
+
+Initial installation does not replace an existing `SKILL.md`; use `--force` when replacement is intentional. Successful destinations are recorded. Installed copies are managed by the CLI and are refreshed by `teams-cli skills reinstall` and after a successful CLI upgrade, replacing local edits in those copies.
+
+## Updates and upgrades
+
+At startup, the CLI may launch a detached npm registry check. It runs at most once per hour, does not delay the command, and stores only timestamps and version numbers. If a newer version is found, a notice is printed to stderr on the next invocation.
+
+Disable checks with either environment variable:
+
+```bash
+export NO_UPDATE_NOTIFIER=1
+# or
+export TEAMS_CLI_DISABLE_UPDATE_CHECK=1
+```
+
+Checks are automatically disabled in CI. Upgrade the global npm installation and refresh recorded skills with:
+
+```bash
+teams-cli version --upgrade
+```
+
+This command updates the global npm package. It does not modify a project-local or one-off `npx` installation.
+
+## Troubleshooting
+
+- `teams-cli: command not found`: check `npm prefix --global` and your `PATH`.
+- Browser launch fails: install Edge or Chrome and select it with `--browser edge|chrome`.
+- Login succeeds but Teams access fails: confirm that the account has a Teams-enabled Microsoft 365 license.
+- Stored identity is rejected: run `auth login` again for the selected tenant, user, and profile.
+- An agent environment is not detected: pass its name explicitly to `skills install`.
+- Use `--debug` for sanitized request method, endpoint, status, duration, and retry diagnostics. Headers, tokens, cookies, query values, and bodies are not logged.
+
+## Uninstall
+
+Remove the global command:
+
+```bash
+npm uninstall --global @michaelschnyder/teams-cli
+```
+
+Uninstalling the npm package intentionally leaves authentication and configuration data in `~/.teams-cli/`. Run `auth logout` for each stored identity before uninstalling. Remove `~/.teams-cli/` manually only when you intend to delete every remaining profile, token, browser session, policy, update record, and managed-skill record.
+
+Installed agent skill copies live outside `~/.teams-cli/` and are not deleted automatically.
+
+## Development
+
+```bash
+npm install
+npm run check
+npm test
+npm run build
+npm run package:check
+npm run package:smoke
+```
+
+See [CONTRIBUTING.md](https://github.com/michaelschnyder/teams-cli/blob/main/CONTRIBUTING.md), [architecture](https://github.com/michaelschnyder/teams-cli/blob/main/docs/build/architecture.md), [testing](https://github.com/michaelschnyder/teams-cli/blob/main/docs/build/testing.md), and the [release guide](docs/releasing.md).
+
+## License
+
+[MIT](LICENSE)

package/SECURITY.md

@@ -0,0 +1,21 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Do not open a public issue containing credentials, bearer tokens, tenant data, private Teams content, or an exploitable vulnerability. Report security concerns privately through GitHub's security-advisory feature for `michaelschnyder/teams-cli`. Include the affected version, impact, reproduction steps with synthetic data, and any suggested mitigation.
+
+## Security model
+
+This CLI stores bearer tokens and a dedicated browser profile locally so a Teams session can persist. Those assets are sensitive and are protected with owner-only filesystem permissions where the operating system supports them. Debug logging excludes authentication material and request or response bodies.
+
+Workspace policies are cooperative client-side controls intended to prevent accidental messages and token export. They do not constrain another process running as the same operating-system user, an exported token used by another HTTP client, or a user who can replace the policy files. Stronger enforcement requires operating-system isolation, read-only mounts, restricted network egress, least-privilege Microsoft accounts, or server-side Teams controls.
+
+The CLI uses undocumented Microsoft Teams behavior and a Microsoft first-party client identity. It must not be used to bypass MFA, conditional access, tenant policy, organizational approval, or Microsoft authorization.
+
+The hourly update check contacts only the npm registry, is disabled in CI, and can be disabled with `NO_UPDATE_NOTIFIER=1` or `TEAMS_CLI_DISABLE_UPDATE_CHECK=1`. No telemetry is collected.
+
+Packaged agent skills are instruction files, not executable plugins. Review skills before installing them. The supplied skills do not pre-authorize shell commands and explicitly preserve Teams identity, target, and policy checks.
+
+## Supported versions
+
+Security fixes are provided for the latest published npm version. Upgrade with `teams-cli version --upgrade` or `npm install --global @michaelschnyder/teams-cli@latest`.

package/dist/auth.js

@@ -0,0 +1,337 @@
+import { CHAT_SVC_AGG_RESOURCE, OUTLOOK_SEARCH_RESOURCE, SKYPE_RESOURCE, } from "./constants.js";
+import { readJwtMetadata, secondsUntil } from "./jwt.js";
+import { acquireResourceTokens, OAuthRedirectError, } from "./oauth.js";
+import { clearAuthentication, discardStagingBrowserProfile, loadSession, prepareBrowserProfile, prepareStagingBrowserProfile, promoteStagingBrowserProfile, requireCurrentSession, saveSession, } from "./storage.js";
+import { execFile } from "node:child_process";
+import { isAbsolute } from "node:path";
+import { promisify } from "node:util";
+import { exchangeInitialToken, TeamsAuthError, } from "./teams-auth.js";
+const ALL_RESOURCES = [SKYPE_RESOURCE, CHAT_SVC_AGG_RESOURCE, OUTLOOK_SEARCH_RESOURCE];
+const defaultDependencies = {
+    acquireTokens: acquireResourceTokens,
+    exchangeToken: exchangeInitialToken,
+    now: () => new Date(),
+};
+const execFileAsync = promisify(execFile);
+export async function passwordFromCommand(command) {
+    if (!isAbsolute(command))
+        throw new Error("--password-command must be an absolute executable path");
+    let stdout;
+    try {
+        ({ stdout } = await execFileAsync(command, [], {
+            encoding: "utf8",
+            timeout: 30_000,
+            maxBuffer: 16 * 1024,
+            windowsHide: true,
+        }));
+    }
+    catch (error) {
+        throw new Error("Password helper failed");
+    }
+    const password = stdout.replace(/\r?\n$/, "");
+    if (!password.length)
+        throw new Error("Password helper returned an empty password");
+    return password;
+}
+function tokenExpiry(metadata, expiresIn, now = new Date()) {
+    if (metadata.expiresAt)
+        return metadata.expiresAt;
+    if (expiresIn !== undefined)
+        return new Date(now.getTime() + expiresIn * 1000).toISOString();
+    throw new Error("Teams returned a token without an expiry");
+}
+function validateTokenIdentity(token, expectedTenant, expectedUser) {
+    const metadata = readJwtMetadata(token);
+    if (!metadata.tenantId)
+        throw new Error("Teams returned a token without a tenant ID");
+    if (metadata.tenantId !== expectedTenant) {
+        throw new Error(`Teams returned a token for unexpected tenant ${metadata.tenantId}`);
+    }
+    if (expectedUser && metadata.userId && metadata.userId !== expectedUser) {
+        throw new Error(`Teams returned a token for unexpected user ${metadata.userId}`);
+    }
+    return metadata;
+}
+function requireResource(tokens, resource) {
+    const token = tokens.get(resource);
+    if (!token)
+        throw new Error(`Microsoft login returned no token for ${resource}`);
+    return token;
+}
+function createStoredSession(tokens, exchanged, browser, expectedTenant, now) {
+    const accessToken = requireResource(tokens, SKYPE_RESOURCE);
+    const chatToken = requireResource(tokens, CHAT_SVC_AGG_RESOURCE);
+    const searchToken = requireResource(tokens, OUTLOOK_SEARCH_RESOURCE);
+    const access = readJwtMetadata(accessToken);
+    const skype = readJwtMetadata(exchanged.skypeToken);
+    const tenantId = access.tenantId ?? skype.tenantId;
+    if (!tenantId)
+        throw new Error("Teams returned tokens without a tenant ID");
+    const userId = access.userId;
+    if (!userId)
+        throw new Error("Teams returned an access token without a user ID");
+    if (expectedTenant && expectedTenant !== tenantId) {
+        throw new Error(`Teams returned a token for unexpected tenant ${tenantId}`);
+    }
+    for (const token of [exchanged.skypeToken, chatToken, searchToken]) {
+        validateTokenIdentity(token, tenantId, userId);
+    }
+    if (!exchanged.region)
+        throw new Error("Teams auth exchange returned no region");
+    if (!exchanged.endpoints.chatService) {
+        throw new Error("Teams auth exchange returned no regional chat service endpoint");
+    }
+    return {
+        version: 3,
+        browser,
+        tenantId,
+        userId,
+        ...(access.username ? { username: access.username } : {}),
+        savedAt: now.toISOString(),
+        region: exchanged.region,
+        accessToken: { value: accessToken, expiresAt: tokenExpiry(access, undefined, now) },
+        skypeToken: {
+            value: exchanged.skypeToken,
+            expiresAt: tokenExpiry(skype, exchanged.expiresIn, now),
+        },
+        chatToken: {
+            value: chatToken,
+            expiresAt: tokenExpiry(readJwtMetadata(chatToken), undefined, now),
+        },
+        searchToken: {
+            value: searchToken,
+            expiresAt: tokenExpiry(readJwtMetadata(searchToken), undefined, now),
+        },
+        endpoints: {
+            chatService: exchanged.endpoints.chatService,
+            ...(exchanged.endpoints.chatServiceAggregator
+                ? { chatServiceAggregator: exchanged.endpoints.chatServiceAggregator }
+                : {}),
+            ...(exchanged.endpoints.middleTier ? { middleTier: exchanged.endpoints.middleTier } : {}),
+        },
+    };
+}
+function interactiveRefreshError(error) {
+    if (error instanceof OAuthRedirectError) {
+        throw new Error(`Microsoft could not refresh the session without interaction (${error.code}). Run \`teams-cli auth login\`.`);
+    }
+    throw error;
+}
+async function acquireAndExchange(paths, options, dependencies, expectedIdentity = {}) {
+    const knownIdentity = !options.interactive && expectedIdentity.tenantId && expectedIdentity.userId
+        ? { tenantId: expectedIdentity.tenantId, userId: expectedIdentity.userId }
+        : null;
+    const staging = knownIdentity ? null : await prepareStagingBrowserProfile(paths, options.browser);
+    const profileDirectory = knownIdentity
+        ? await prepareBrowserProfile(paths, knownIdentity, options.browser)
+        : staging?.directory;
+    try {
+        const acquired = await dependencies.acquireTokens(ALL_RESOURCES, { ...options, profileDirectory });
+        let session;
+        try {
+            const exchanged = await dependencies.exchangeToken(requireResource(acquired.tokens, SKYPE_RESOURCE));
+            session = createStoredSession(acquired.tokens, exchanged, options.browser, expectedIdentity.tenantId, dependencies.now());
+            if (expectedIdentity.userId && expectedIdentity.userId !== session.userId) {
+                throw new Error(`Microsoft login returned unexpected user ${session.userId}`);
+            }
+        }
+        finally {
+            await acquired.close();
+        }
+        if (staging) {
+            await promoteStagingBrowserProfile(paths, staging.identifier, session, options.browser);
+        }
+        return session;
+    }
+    catch (error) {
+        if (staging)
+            await discardStagingBrowserProfile(paths, staging.identifier);
+        throw error;
+    }
+}
+export async function login(paths, options, dependencies = defaultDependencies) {
+    if (options.password && options.passwordCommand) {
+        throw new Error("Provide either a password or --password-command, not both");
+    }
+    if ((options.password || options.passwordCommand) && !options.username) {
+        throw new Error("Automated login requires a username");
+    }
+    if (options.headless && !options.password && !options.passwordCommand) {
+        throw new Error("--headless login requires automated credentials");
+    }
+    const password = options.password ?? (options.passwordCommand
+        ? await passwordFromCommand(options.passwordCommand)
+        : undefined);
+    const session = await acquireAndExchange(paths, {
+        browser: options.browser,
+        interactive: true,
+        ...(options.headless ? { headless: true } : {}),
+        ...(options.username ? { username: options.username } : {}),
+        ...(password ? { password } : {}),
+        ...(options.tenant ? { tenant: options.tenant } : {}),
+    }, dependencies, {
+        ...(options.tenant ? { tenantId: options.tenant } : {}),
+        ...(options.user ? { userId: options.user } : {}),
+    });
+    if (options.authorizeIdentity)
+        await options.authorizeIdentity(session);
+    await saveSession(paths, session);
+    return session;
+}
+async function refreshAll(paths, session, dependencies, browser) {
+    try {
+        return await acquireAndExchange(paths, { browser, interactive: false, tenant: session.tenantId }, dependencies, { tenantId: session.tenantId, userId: session.userId });
+    }
+    catch (error) {
+        interactiveRefreshError(error);
+    }
+}
+async function acquireOneResource(paths, session, resource, dependencies, browser) {
+    const profileDirectory = await prepareBrowserProfile(paths, session, browser);
+    try {
+        const acquired = await dependencies.acquireTokens([resource], {
+            browser,
+            interactive: false,
+            tenant: session.tenantId,
+            profileDirectory,
+        });
+        try {
+            const token = requireResource(acquired.tokens, resource);
+            const metadata = validateTokenIdentity(token, session.tenantId, session.userId);
+            return { value: token, expiresAt: tokenExpiry(metadata, undefined, dependencies.now()) };
+        }
+        finally {
+            await acquired.close();
+        }
+    }
+    catch (error) {
+        interactiveRefreshError(error);
+    }
+}
+async function refreshAccess(paths, session, dependencies, browser) {
+    return {
+        ...session,
+        savedAt: dependencies.now().toISOString(),
+        browser,
+        accessToken: await acquireOneResource(paths, session, SKYPE_RESOURCE, dependencies, browser),
+    };
+}
+async function refreshOAuthTarget(paths, session, target, dependencies, browser) {
+    const resource = target === "chat" ? CHAT_SVC_AGG_RESOURCE : OUTLOOK_SEARCH_RESOURCE;
+    const token = await acquireOneResource(paths, session, resource, dependencies, browser);
+    return {
+        ...session,
+        browser,
+        savedAt: dependencies.now().toISOString(),
+        ...(target === "chat" ? { chatToken: token } : { searchToken: token }),
+    };
+}
+async function refreshSkype(session, dependencies) {
+    if (secondsUntil(session.accessToken.expiresAt, dependencies.now()) === 0) {
+        throw new Error("Cannot refresh the Skype token because the access token has expired. Refresh `all` or `access` first.");
+    }
+    const exchanged = await dependencies.exchangeToken(session.accessToken.value);
+    const metadata = validateTokenIdentity(exchanged.skypeToken, session.tenantId, session.userId);
+    if (!exchanged.region || !exchanged.endpoints.chatService) {
+        throw new Error("Teams auth exchange returned an incomplete regional endpoint map");
+    }
+    return {
+        ...session,
+        savedAt: dependencies.now().toISOString(),
+        region: exchanged.region,
+        skypeToken: {
+            value: exchanged.skypeToken,
+            expiresAt: tokenExpiry(metadata, exchanged.expiresIn, dependencies.now()),
+        },
+        endpoints: {
+            chatService: exchanged.endpoints.chatService,
+            ...(exchanged.endpoints.chatServiceAggregator
+                ? { chatServiceAggregator: exchanged.endpoints.chatServiceAggregator }
+                : {}),
+            ...(exchanged.endpoints.middleTier ? { middleTier: exchanged.endpoints.middleTier } : {}),
+        },
+    };
+}
+export async function refreshTokens(paths, identity, target = "all", browser, dependencies = defaultDependencies) {
+    const before = requireCurrentSession(await loadSession(paths, identity));
+    const selectedBrowser = browser ?? before.browser;
+    const session = target === "all"
+        ? await refreshAll(paths, before, dependencies, selectedBrowser)
+        : target === "access"
+            ? await refreshAccess(paths, before, dependencies, selectedBrowser)
+            : target === "skype"
+                ? await refreshSkype(before, dependencies)
+                : await refreshOAuthTarget(paths, before, target, dependencies, selectedBrowser);
+    await saveSession(paths, session);
+    return { target, before, after: session };
+}
+export async function validateSession(paths, identity, browser, dependencies = defaultDependencies) {
+    const stored = requireCurrentSession(await loadSession(paths, identity));
+    const selectedBrowser = browser ?? stored.browser;
+    let session;
+    if (secondsUntil(stored.accessToken.expiresAt, dependencies.now()) === 0) {
+        session = await refreshAll(paths, stored, dependencies, selectedBrowser);
+    }
+    else {
+        try {
+            session = await refreshSkype(stored, dependencies);
+        }
+        catch (error) {
+            if (!(error instanceof TeamsAuthError) || (error.status !== 401 && error.status !== 403)) {
+                throw error;
+            }
+            session = await refreshAll(paths, stored, dependencies, selectedBrowser);
+        }
+    }
+    await saveSession(paths, session);
+    return session;
+}
+function tokenForTarget(session, target) {
+    return target === "access"
+        ? session.accessToken
+        : target === "skype"
+            ? session.skypeToken
+            : target === "chat"
+                ? session.chatToken
+                : session.searchToken;
+}
+export async function ensureDataSession(paths, identity, target, browser, dependencies = defaultDependencies) {
+    const session = requireCurrentSession(await loadSession(paths, identity));
+    if (secondsUntil(tokenForTarget(session, target).expiresAt, dependencies.now()) > 60) {
+        return session;
+    }
+    if (target === "skype" && secondsUntil(session.accessToken.expiresAt, dependencies.now()) <= 60) {
+        await refreshTokens(paths, identity, "access", browser, dependencies);
+    }
+    return (await refreshTokens(paths, identity, target, browser, dependencies)).after;
+}
+function tokenResult(token, now) {
+    const metadata = readJwtMetadata(token.value);
+    return {
+        value: token.value,
+        audience: metadata.audience ?? null,
+        expiresAt: token.expiresAt,
+        expiresInSeconds: secondsUntil(token.expiresAt, now),
+    };
+}
+export function describeSession(session, now = new Date()) {
+    const identity = readJwtMetadata(session.accessToken.value);
+    return {
+        authenticated: true,
+        user: {
+            id: identity.userId ?? session.userId,
+            name: identity.name ?? null,
+            username: identity.username ?? null,
+            tenantId: session.tenantId,
+        },
+        tokens: {
+            accessToken: tokenResult(session.accessToken, now),
+            skypeToken: tokenResult(session.skypeToken, now),
+            chatToken: tokenResult(session.chatToken, now),
+            searchToken: tokenResult(session.searchToken, now),
+        },
+    };
+}
+export async function logout(paths, identity) {
+    await clearAuthentication(paths, identity);
+}