@michaelschnyder/teams-cli 0.1.0

package/dist/commands/skills.js

@@ -0,0 +1,70 @@
+import { SKILL_PLATFORMS, detectSkillPlatforms, findProjectRoot, installSkills, loadBundledSkills, lookupSkillPlatform, reinstallSkills, skillDestination, skillManifestFile, } from "../skills.js";
+function resolveSkillPlatforms(input) {
+    if (input?.toLowerCase() === "all")
+        return [...SKILL_PLATFORMS];
+    if (input) {
+        const platform = lookupSkillPlatform(input);
+        if (!platform) {
+            throw new Error(`Unknown skill platform ${input}. Supported: ${SKILL_PLATFORMS.map(({ name }) => name).join(", ")}, all`);
+        }
+        return [platform];
+    }
+    const detected = detectSkillPlatforms(findProjectRoot());
+    if (!detected.length) {
+        throw new Error(`No agent environment detected. Specify one of: ${SKILL_PLATFORMS.map(({ name }) => name).join(", ")}, all`);
+    }
+    return detected;
+}
+export function registerSkillsCommand(program, storageRoot) {
+    const skills = program.command("skills").description("List and install built-in agent skills");
+    skills.command("list").description("List packaged teams-cli skills").action(async () => {
+        for (const skill of await loadBundledSkills()) {
+            process.stdout.write(`${skill.name}\t${skill.description}\n`);
+        }
+    });
+    skills.command("path")
+        .description("Show skill installation paths for a platform or detected environments")
+        .argument("[platform]", "Platform name or all")
+        .option("--project", "Use project-local scope instead of personal scope")
+        .action((platformName, options) => {
+        const projectRoot = findProjectRoot();
+        for (const platform of resolveSkillPlatforms(platformName)) {
+            process.stdout.write(`${platform.name}\t${skillDestination(platform, Boolean(options.project), projectRoot)}\n`);
+        }
+    });
+    skills.command("install")
+        .description("Install packaged skills for a platform or detected environments")
+        .argument("[platform]", "Platform name or all")
+        .option("--project", "Install into project-local scope")
+        .option("--name <name>", "Install only one named skill")
+        .option("--dir <path>", "Install into a custom parent directory")
+        .option("--force", "Overwrite existing managed skill files")
+        .action(async (platformName, options) => {
+        const projectRoot = findProjectRoot();
+        const destinations = options.dir
+            ? [options.dir]
+            : resolveSkillPlatforms(platformName).map((platform) => skillDestination(platform, Boolean(options.project), projectRoot));
+        const result = await installSkills({
+            destinations,
+            ...(options.name ? { names: [options.name] } : {}),
+            force: Boolean(options.force),
+            manifestFile: skillManifestFile(storageRoot),
+        });
+        if (!result.filesWritten) {
+            throw new Error("No skill files were written. Use --force to replace existing files");
+        }
+        for (const destination of result.destinations)
+            process.stdout.write(`${destination}\n`);
+        process.stdout.write(`Installed ${result.filesWritten} skill file${result.filesWritten === 1 ? "" : "s"}.\n`);
+    });
+    skills.command("reinstall")
+        .description("Refresh all recorded CLI-managed skill installations")
+        .action(async () => {
+        const result = await reinstallSkills(skillManifestFile(storageRoot));
+        if (!result.installations) {
+            process.stdout.write("No recorded skill installations.\n");
+            return;
+        }
+        process.stdout.write(`Reinstalled ${result.filesWritten} skill file${result.filesWritten === 1 ? "" : "s"} across ${result.installations} destination${result.installations === 1 ? "" : "s"}.\n`);
+    });
+}

package/dist/commands/version.js

@@ -0,0 +1,16 @@
+import { upgradeCli } from "../upgrade.js";
+import { CLI_VERSION } from "../version.js";
+export function registerVersionCommand(program) {
+    program.command("version")
+        .description("Show the installed version or upgrade the global npm installation")
+        .option("--upgrade", "Install the latest npm version and refresh managed skills")
+        .action(async (options) => {
+        if (!options.upgrade) {
+            process.stdout.write(`${CLI_VERSION}\n`);
+            return;
+        }
+        process.stderr.write("Upgrading teams-cli through npm…\n");
+        await upgradeCli();
+        process.stdout.write("teams-cli and recorded skill installations are up to date.\n");
+    });
+}

package/dist/config.js

@@ -0,0 +1,106 @@
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+import { stringify } from "yaml";
+import { parseStrictYaml, rejectUnknownKeys, requireObject } from "./yaml.js";
+function optionalString(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || value.length === 0)
+        throw new Error(`${field} must be a non-empty string`);
+    return value;
+}
+function parseBrowser(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (value !== "edge" && value !== "chrome")
+        throw new Error(`${field} must be edge or chrome`);
+    return value;
+}
+export function parseProfilesConfig(value) {
+    const root = requireObject(value, "Profiles configuration");
+    rejectUnknownKeys(root, ["version", "profiles"], "Profiles configuration");
+    if (root.version !== 1)
+        throw new Error("Profiles configuration version must be 1");
+    const rawProfiles = requireObject(root.profiles, "profiles");
+    const profiles = {};
+    for (const [name, raw] of Object.entries(rawProfiles)) {
+        if (!name.length)
+            throw new Error("Profile names must not be empty");
+        const profile = requireObject(raw, `Profile ${name}`);
+        rejectUnknownKeys(profile, ["tenantId", "userId", "username", "browser"], `Profile ${name}`);
+        const tenantId = optionalString(profile.tenantId, `Profile ${name}.tenantId`);
+        const userId = optionalString(profile.userId, `Profile ${name}.userId`);
+        const username = optionalString(profile.username, `Profile ${name}.username`);
+        const browser = parseBrowser(profile.browser, `Profile ${name}.browser`);
+        profiles[name] = {
+            ...(tenantId ? { tenantId } : {}),
+            ...(userId ? { userId } : {}),
+            ...(username ? { username } : {}),
+            ...(browser ? { browser } : {}),
+        };
+    }
+    return { version: 1, profiles };
+}
+export async function loadProfiles(paths) {
+    let raw;
+    try {
+        raw = await readFile(paths.configFile, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { version: 1, profiles: {} };
+        throw error;
+    }
+    return parseProfilesConfig(parseStrictYaml(raw, paths.configFile));
+}
+export async function saveProfiles(paths, config) {
+    await mkdir(dirname(paths.configFile), { recursive: true, mode: 0o700 });
+    await chmod(dirname(paths.configFile), 0o700);
+    const temporary = `${paths.configFile}.${randomUUID()}.tmp`;
+    await writeFile(temporary, stringify(config), { mode: 0o600 });
+    await rename(temporary, paths.configFile);
+    await chmod(paths.configFile, 0o600);
+}
+export async function resolveRuntimeContext(paths, overrides, environment = process.env) {
+    const config = await loadProfiles(paths);
+    const profileName = overrides.profile ?? environment.TEAMS_CLI_PROFILE ?? "default";
+    const profile = config.profiles[profileName] ?? {};
+    const browserValue = overrides.browser ?? environment.TEAMS_CLI_BROWSER ?? profile.browser ?? "edge";
+    const browser = parseBrowser(browserValue, "Browser") ?? "edge";
+    const tenantId = overrides.tenant ?? environment.TEAMS_CLI_TENANT ?? profile.tenantId;
+    const userId = overrides.user ?? environment.TEAMS_CLI_USER ?? profile.userId;
+    return {
+        profileName,
+        ...(tenantId ? { tenantId } : {}),
+        ...(userId ? { userId } : {}),
+        ...(profile.username ? { username: profile.username } : {}),
+        browser,
+    };
+}
+export function requireRuntimeIdentity(context) {
+    if (!context.tenantId || !context.userId) {
+        throw new Error("Select a tenant and user with --tenant and --user, or configure a profile");
+    }
+    return { tenantId: context.tenantId, userId: context.userId };
+}
+export async function saveProfile(paths, name, profile) {
+    if (!name.length)
+        throw new Error("Profile name must not be empty");
+    const config = await loadProfiles(paths);
+    config.profiles[name] = profile;
+    await saveProfiles(paths, config);
+}
+export async function removeProfile(paths, name) {
+    const config = await loadProfiles(paths);
+    if (!(name in config.profiles))
+        return false;
+    delete config.profiles[name];
+    if (Object.keys(config.profiles).length === 0) {
+        await rm(paths.configFile, { force: true });
+    }
+    else {
+        await saveProfiles(paths, config);
+    }
+    return true;
+}

package/dist/constants.js

@@ -0,0 +1,8 @@
+export const TEAMS_CLIENT_ID = "5e3ce6c0-2b1f-4285-8d4b-75ee78787346";
+export const SKYPE_RESOURCE = "https://api.spaces.skype.com";
+export const CHAT_SVC_AGG_RESOURCE = "https://chatsvcagg.teams.microsoft.com";
+export const OUTLOOK_SEARCH_RESOURCE = "https://outlook.office.com/search";
+export const TEAMS_REDIRECT_URI = "https://teams.microsoft.com/go";
+export const TEAMS_AUTHZ_URL = "https://teams.microsoft.com/api/authsvc/v1.0/authz";
+export const TEAMS_WEB_ORIGIN = "https://teams.microsoft.com";
+export const OUTLOOK_SEARCH_URL = "https://substrate.office.com/search/api/v1/suggestions";

package/dist/data.js

@@ -0,0 +1,56 @@
+import { refreshTokens, } from "./auth.js";
+import { debugDecision, setRequestAttempt, showStatus } from "./diagnostics.js";
+import { secondsUntil } from "./jwt.js";
+import { loadSession, requireCurrentSession, } from "./storage.js";
+import { TeamsApiError } from "./teams-client.js";
+const REFRESH_SKEW_SECONDS = 60;
+function tokenForTarget(session, target) {
+    return target === "access"
+        ? session.accessToken
+        : target === "skype"
+            ? session.skypeToken
+            : target === "chat"
+                ? session.chatToken
+                : session.searchToken;
+}
+function label(target) {
+    return target === "skype" ? "Skype" : target === "chat" ? "Chat" : target === "search" ? "Search" : "access";
+}
+async function refreshTarget(paths, identity, browser, target) {
+    let session = requireCurrentSession(await loadSession(paths, identity));
+    if (target === "skype" &&
+        secondsUntil(session.accessToken.expiresAt) <= REFRESH_SKEW_SECONDS) {
+        showStatus("Refreshing access token…");
+        debugDecision("refresh token=access reason=Skype-prerequisite");
+        session = (await refreshTokens(paths, identity, "access", browser)).after;
+    }
+    showStatus(`Refreshing ${label(target)} token…`);
+    debugDecision(`refresh token=${target}`);
+    return (await refreshTokens(paths, identity, target, browser)).after;
+}
+async function prepareSession(paths, identity, browser, targets, force) {
+    let session = requireCurrentSession(await loadSession(paths, identity));
+    for (const target of targets) {
+        if (force || secondsUntil(tokenForTarget(session, target).expiresAt) <= REFRESH_SKEW_SECONDS) {
+            session = await refreshTarget(paths, identity, browser, target);
+        }
+    }
+    return session;
+}
+export async function withDataSession(paths, identity, browser, targets, operation) {
+    const required = typeof targets === "string" ? [targets] : [...targets];
+    const session = await prepareSession(paths, identity, browser, required, false);
+    setRequestAttempt(1);
+    try {
+        return await operation(session);
+    }
+    catch (error) {
+        if (!(error instanceof TeamsApiError) || (error.status !== 401 && error.status !== 403)) {
+            throw error;
+        }
+        debugDecision(`retry authenticationStatus=${error.status} attempt=2`);
+        const refreshed = await prepareSession(paths, identity, browser, required, true);
+        setRequestAttempt(2);
+        return operation(refreshed);
+    }
+}

package/dist/diagnostics.js

@@ -0,0 +1,60 @@
+let options = { progress: false, debug: false };
+let activeStatus = null;
+let requestAttempt = 1;
+export function configureDiagnostics(next) {
+    options = next;
+    activeStatus = null;
+    requestAttempt = 1;
+}
+export function setRequestAttempt(attempt) {
+    requestAttempt = attempt;
+}
+export function showStatus(message) {
+    if (!options.progress)
+        return;
+    activeStatus = message;
+    process.stderr.write(`\r\x1b[2K${message}`);
+}
+export function clearStatus() {
+    if (!options.progress || activeStatus === null)
+        return;
+    process.stderr.write("\r\x1b[2K");
+    activeStatus = null;
+}
+function sanitizedUrl(input) {
+    const url = new URL(input instanceof Request ? input.url : input.toString());
+    const parts = url.pathname.split("/").map((part, index, all) => all[index - 1] === "conversations" || all[index - 1] === "messages" || all[index - 1] === "users"
+        ? "<redacted>"
+        : part);
+    return `${url.origin}${parts.join("/")}`;
+}
+function debugLine(message) {
+    if (!options.debug)
+        return;
+    if (activeStatus !== null)
+        process.stderr.write("\r\x1b[2K");
+    process.stderr.write(`[debug] ${message}\n`);
+    if (activeStatus !== null)
+        process.stderr.write(activeStatus);
+}
+export function debugDecision(message) {
+    debugLine(message);
+}
+export async function observedFetch(implementation, input, init) {
+    const method = init?.method ?? (input instanceof Request ? input.method : "GET");
+    const url = sanitizedUrl(input);
+    const started = performance.now();
+    debugLine(`request method=${method} url=${url} attempt=${requestAttempt}`);
+    try {
+        const response = await implementation(input, init);
+        debugLine(`response method=${method} url=${url} status=${response.status} durationMs=${Math.round(performance.now() - started)} attempt=${requestAttempt}`);
+        return response;
+    }
+    catch (error) {
+        const category = error instanceof DOMException && error.name === "AbortError"
+            ? "aborted"
+            : error instanceof TypeError ? "network" : "unknown";
+        debugLine(`error method=${method} url=${url} category=${category} durationMs=${Math.round(performance.now() - started)} attempt=${requestAttempt}`);
+        throw error;
+    }
+}

package/dist/jwt.js

@@ -0,0 +1,42 @@
+export function decodeJwtClaims(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        throw new Error("The returned value is not a JWT");
+    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!claims || typeof claims !== "object" || Array.isArray(claims)) {
+        throw new Error("The JWT payload is not a claims object");
+    }
+    return claims;
+}
+export function readJwtMetadata(token) {
+    const claims = decodeJwtClaims(token);
+    return {
+        ...(claims.aud ? { audience: claims.aud } : {}),
+        ...(claims.tid ? { tenantId: claims.tid } : {}),
+        ...(claims.oid ? { userId: claims.oid } : {}),
+        ...(claims.name ? { name: claims.name } : {}),
+        ...(claims.preferred_username || claims.upn
+            ? { username: claims.preferred_username ?? claims.upn }
+            : {}),
+        ...(claims.exp ? { expiresAt: new Date(claims.exp * 1000).toISOString() } : {}),
+    };
+}
+export function secondsUntil(expiresAt, now = new Date()) {
+    const milliseconds = new Date(expiresAt).getTime() - now.getTime();
+    if (!Number.isFinite(milliseconds))
+        throw new Error("Invalid token expiry date");
+    return Math.max(0, Math.ceil(milliseconds / 1000));
+}
+export function formatDuration(totalSeconds) {
+    const seconds = Math.max(0, Math.floor(totalSeconds));
+    const days = Math.floor(seconds / 86_400);
+    const hours = Math.floor((seconds % 86_400) / 3_600);
+    const minutes = Math.floor((seconds % 3_600) / 60);
+    const remainder = seconds % 60;
+    return [
+        ...(days ? [`${days}d`] : []),
+        ...(hours ? [`${hours}h`] : []),
+        ...(minutes ? [`${minutes}m`] : []),
+        ...(!days && !hours ? [`${remainder}s`] : []),
+    ].join(" ");
+}

package/dist/oauth.js

@@ -0,0 +1,146 @@
+import { randomUUID } from "node:crypto";
+import { chromium } from "playwright-core";
+import { SKYPE_RESOURCE, TEAMS_CLIENT_ID, TEAMS_REDIRECT_URI, } from "./constants.js";
+export function browserChannel(browser) {
+    return browser === "edge" ? "msedge" : "chrome";
+}
+export class OAuthRedirectError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "OAuthRedirectError";
+    }
+}
+export function createResourceTokenUrl(resource, tenant = "organizations", prompt = "select_account") {
+    const url = new URL(`https://login.microsoftonline.com/${tenant}/oauth2/authorize`);
+    url.searchParams.set("client_id", TEAMS_CLIENT_ID);
+    url.searchParams.set("response_type", "token");
+    url.searchParams.set("redirect_uri", TEAMS_REDIRECT_URI);
+    url.searchParams.set("resource", resource);
+    url.searchParams.set("state", `${randomUUID()}|${resource}`);
+    url.searchParams.set("client-request-id", randomUUID());
+    url.searchParams.set("nonce", randomUUID());
+    url.searchParams.set("prompt", prompt);
+    return url.toString();
+}
+export function createInitialTokenUrl(tenant = "organizations") {
+    return createResourceTokenUrl(SKYPE_RESOURCE, tenant);
+}
+export function tokenFromRedirect(urlString) {
+    const url = new URL(urlString);
+    if (url.origin !== "https://teams.microsoft.com" || url.pathname !== "/go") {
+        return undefined;
+    }
+    const params = new URLSearchParams(url.hash.slice(1));
+    const error = params.get("error");
+    if (error) {
+        throw new OAuthRedirectError(error, params.get("error_description") ?? error);
+    }
+    return params.get("access_token") ?? undefined;
+}
+async function waitForToken(page, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            clearTimeout(timer);
+            page.off("framenavigated", onNavigation);
+            page.off("close", onClose);
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error(`Login timed out after ${Math.round(timeoutMs / 1000)} seconds`));
+        }, timeoutMs);
+        const inspect = (url) => {
+            try {
+                const token = tokenFromRedirect(url);
+                if (token) {
+                    cleanup();
+                    resolve(token);
+                }
+            }
+            catch (error) {
+                cleanup();
+                reject(error);
+            }
+        };
+        const onNavigation = (frame) => {
+            if (frame === page.mainFrame())
+                inspect(frame.url());
+        };
+        const onClose = () => {
+            cleanup();
+            reject(new Error("Edge was closed before login completed"));
+        };
+        page.on("framenavigated", onNavigation);
+        page.on("close", onClose);
+    });
+}
+export async function completePasswordLogin(page, username, password, timeoutMs) {
+    const usernameInput = page.locator('input[name="loginfmt"], input[type="email"]').first();
+    await usernameInput.waitFor({ state: "visible", timeout: timeoutMs });
+    await usernameInput.fill(username);
+    await page.locator('#idSIButton9, input[type="submit"], button[type="submit"]').first().click();
+    const passwordInput = page.locator('input[name="passwd"], input[type="password"]').first();
+    await passwordInput.waitFor({ state: "visible", timeout: timeoutMs });
+    await passwordInput.fill(password);
+    await page.locator('#idSIButton9, input[type="submit"], button[type="submit"]').first().click();
+    const staySignedIn = page.locator('input[type="submit"][value="Yes"], button:has-text("Yes")').first();
+    try {
+        await staySignedIn.waitFor({ state: "visible", timeout: 5_000 });
+        await staySignedIn.click();
+    }
+    catch {
+        // The tenant may skip the stay-signed-in prompt.
+    }
+}
+export async function acquireInitialToken(options) {
+    const acquired = await acquireResourceTokens([SKYPE_RESOURCE], options);
+    const token = acquired.tokens.get(SKYPE_RESOURCE);
+    if (!token) {
+        await acquired.close();
+        throw new Error("Microsoft login returned no Skype resource token");
+    }
+    return { close: acquired.close, token };
+}
+export async function acquireResourceTokens(resources, options) {
+    if (resources.length === 0)
+        throw new Error("At least one OAuth resource is required");
+    let context;
+    try {
+        context = await chromium.launchPersistentContext(options.profileDirectory, {
+            channel: browserChannel(options.browser),
+            headless: options.headless ?? !options.interactive,
+            viewport: null,
+            args: ["--no-first-run"],
+        });
+    }
+    catch (error) {
+        const label = options.browser === "edge" ? "Microsoft Edge" : "Google Chrome";
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not launch ${label}. Confirm it is installed and available: ${message}`);
+    }
+    const close = () => context.close();
+    const page = context.pages()[0] ?? (await context.newPage());
+    try {
+        const tokens = new Map();
+        for (const [index, resource] of resources.entries()) {
+            const tokenPromise = waitForToken(page, options.timeoutMs ?? 5 * 60_000);
+            try {
+                await page.goto(createResourceTokenUrl(resource, options.tenant, options.interactive && index === 0 ? "select_account" : "none"), { waitUntil: "domcontentloaded" });
+                if (index === 0 && options.username && options.password) {
+                    await completePasswordLogin(page, options.username, options.password, options.timeoutMs ?? 5 * 60_000);
+                }
+                tokens.set(resource, await tokenPromise);
+            }
+            catch (error) {
+                await tokenPromise.catch(() => undefined);
+                throw error;
+            }
+        }
+        return { close, tokens };
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+}