@quadient/skillshare 1.6.1 → 1.7.0

package/README.md

@@ -19,8 +19,40 @@ bun run index.ts install 12 0.1.0 --target ./installed
 bun run index.ts install --skill-version-id 42 --target ./installed
 ```
 
+## Teams MCP
+
+Starting with 1.7.0, `skillshare teams login` opens a dedicated local browser profile,
+connects your own Teams account to Skillshare and verifies the connection. Sign in with
+the same Microsoft account as Skillshare. The server refreshes captured tokens in the
+background. `teams watch` renews an expired Microsoft grant through local browser SSO.
+Keep that process running for automatic recovery beyond the SPA refresh token lifetime;
+another interactive CLI login is needed only when SSO cannot complete, for example MFA.
+
+```sh
+skillshare login
+skillshare teams login
+skillshare teams status
+skillshare teams test
+skillshare teams watch
+skillshare teams access fullAccess
+skillshare teams upload ./report.pdf
+skillshare teams download '<file-webUrl-or-download-link>' --output ./report.pdf
+skillshare teams access readOnly
+skillshare teams logout
+```
+
+Use `teams login local` for localhost or `--server <https-origin>` for another host.
+`login` accepts `--server` too. Browser options: `--browser chrome|msedge|chromium`,
+`--headless`, and `--browser-profile <dedicated-profile-directory>`.
+Chrome is the default on macOS/Linux, Edge on Windows; bundled Chromium needs
+`npx playwright install chromium` first. See [Teams MCP](../docs/teams-mcp.md) for
+permissions, Microsoft session lifetime and file-tool differences in the hosted server.
+
 ## Behavior
 
+- Starting with 1.6.2, `login`, `git configure` and API commands without a stored session default to `https://skillshare.quadientcloudpreprod.eu`. `login local` and `git configure local` still select `http://localhost:5050`.
+- Existing sessions keep their saved server. After preprod cutover, run `skillshare login` again to replace a UAT session with a preprod session; stored tokens are not reused across hosts.
+- Uploaded/installed records retain their registry URL. Legacy records without a URL still belong to UAT and are not silently reassigned to preprod.
 - Upload and publish commands show progress while scanning and reading local files, then keep a timed upload status visible until the registry call finishes.
 - `update` reads the centralized install registry and refreshes recorded installs to the latest published registry versions.
 - `update` can be narrowed to one skill or one target directory, and `--dry-run` prints planned changes without downloading or overwriting files.
@@ -36,7 +68,7 @@ flowchart TD
   B -- Yes --> D{Which command?}
 
   D -->|login local| E[login LOCAL_URL]
-  D -->|login| F[login PROD_URL]
+  D -->|login| F[login DEFAULT_URL]
   D -->|logout| G[logoutSession]
   D -->|whoami list show upload install update| H[createClient using active baseUrl]
 
@@ -148,7 +180,7 @@ export SKILLSHARE_TOKEN="<personal-access-token>"
 npx @quadient/skillshare whoami
 ```
 
-Register the production or local SkillShare host as a generic OAuth provider in Git Credential
+Register the default preprod or local SkillShare host as a generic OAuth provider in Git Credential
 Manager 2.0.931 or newer:
 
 ```bash
@@ -179,7 +211,7 @@ npx @quadient/skillshare pages show release-notes
 ```
 
 The page is then available at
-`https://skillshare.inspireclouduat.net/p/release-notes/` after SSO sign-in.
+`https://skillshare.quadientcloudpreprod.eu/p/release-notes/` after SSO sign-in.
 
 ## Package Distribution
 

package/dist/index.js

@@ -1,3 +1,4 @@
+import { assertCredentialDestination, runTeamsCommand } from './teams.js';
 import { preparePageFiles } from './pages.js';
 import { runPageDev } from './pages-dev.js';
 import { createServer } from 'node:http';
@@ -8,7 +9,9 @@ import { mkdir, open, readFile, readdir, rm, stat, writeFile } from 'node:fs/pro
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { cancel, confirm, intro, isCancel, multiselect, outro, progress, select, spinner, text } from '@clack/prompts';
-const PROD_URL = 'https://skillshare.inspireclouduat.net';
+const DEFAULT_URL = 'https://skillshare.quadientcloudpreprod.eu';
+// Records without a registry URL were created against UAT before the preprod migration.
+const LEGACY_UAT_URL = 'https://skillshare.inspireclouduat.net';
 const LOCAL_URL = 'http://localhost:5050';
 const APP_DIR = getAppDir();
 const SESSION_PATH = join(APP_DIR, 'session.json');
@@ -86,11 +89,23 @@ Commands:
   pages dev [directory] [--slug <slug>] [--port <port>]
     [--build <command> --watch-dir <sources>] [--celld <executable>]
     [--user-id <id>] [--user-name <name>] [--user-email <email>]
+  teams login [local] [--browser chrome|msedge|chromium] [--headless]
+  teams watch [local] [--browser chrome|msedge|chromium]
+  teams logout
+  teams status
+  teams test
+  teams access readOnly|fullAccess
+  teams upload <file>
+  teams download <url> --output <new-file>
   git configure [local]
   git unconfigure [local]
 
 Options:
   --token <token>    Bearer token for API requests (overrides SKILLSHARE_TOKEN)
+  --server <url>     Skillshare origin for login and Teams commands
+
+Default server: ${DEFAULT_URL}
+A stored session keeps its server; run "skillshare login" to switch to the default.
 `;
 async function main() {
     const args = process.argv.slice(2);
@@ -110,16 +125,26 @@ async function main() {
     }
     switch (command) {
         case 'login': {
-            await login(options.positionals[0] === 'local' ? LOCAL_URL : PROD_URL);
+            const baseUrl = options.flags.server ?? (options.positionals[0] === 'local' ? LOCAL_URL : DEFAULT_URL);
+            assertCredentialDestination(baseUrl);
+            await login(baseUrl);
             return;
         }
         case 'logout': {
             await logoutSession();
             return;
         }
+        case 'teams': {
+            const baseUrl = options.flags.server ?? (options.positionals[1] === 'local' ? LOCAL_URL : await resolveActiveBaseUrl());
+            assertCredentialDestination(baseUrl);
+            if (!options.token && !await loadSession(baseUrl))
+                await login(baseUrl);
+            await runTeamsCommand(await createClient(baseUrl, options.token), options.positionals, options.flags, APP_DIR);
+            return;
+        }
         case 'git': {
             const action = options.positionals[0];
-            const baseUrl = options.positionals[1] === 'local' ? LOCAL_URL : PROD_URL;
+            const baseUrl = options.positionals[1] === 'local' ? LOCAL_URL : DEFAULT_URL;
             if (action === 'configure') {
                 await configureGitCredentialManager(baseUrl);
                 return;
@@ -1410,7 +1435,7 @@ function formatVersion(version) {
     return version.join('.');
 }
 async function parseOptions(args) {
-    const booleanFlags = new Set(['dry-run']);
+    const booleanFlags = new Set(['dry-run', 'headless']);
     const flags = {};
     const positionals = [];
     for (let index = 0; index < args.length; index += 1) {
@@ -1421,6 +1446,10 @@ async function parseOptions(args) {
         if (current.startsWith('--')) {
             const key = current.slice(2);
             const value = args[index + 1];
+            if (key === 'headless' && value !== 'true' && value !== 'false') {
+                flags[key] = 'true';
+                continue;
+            }
             if (!value || value.startsWith('--')) {
                 if (booleanFlags.has(key)) {
                     flags[key] = 'true';
@@ -1455,7 +1484,7 @@ async function resolveActiveBaseUrl() {
     if (session?.baseUrl) {
         return normalizeBaseUrl(session.baseUrl);
     }
-    return PROD_URL;
+    return DEFAULT_URL;
 }
 async function createClient(baseUrl, explicitToken) {
     const resolvedBaseUrl = normalizeBaseUrl(baseUrl);
@@ -1533,6 +1562,10 @@ async function createClient(baseUrl, explicitToken) {
             });
             return parseJson(response);
         },
+        async request(path, init) {
+            // Streaming uploads cannot be replayed on an expired Skillshare access token.
+            return sendAuthorized(path, { ...init, redirect: 'error' }, typeof init.body === 'string' || !init.body);
+        },
         async rawGet(path) {
             const response = await sendAuthorized(path);
             if (!response.ok) {
@@ -1823,7 +1856,7 @@ async function readUploadedSkillRecords() {
         const normalizedSkillId = Number.isInteger(skillId) && skillId > 0 ? skillId : undefined;
         return [{
                 directory: typeof entry.directory === 'string' ? resolve(entry.directory) : '',
-                baseUrl: typeof entry.baseUrl === 'string' ? normalizeBaseUrl(entry.baseUrl) : PROD_URL,
+                baseUrl: typeof entry.baseUrl === 'string' ? normalizeBaseUrl(entry.baseUrl) : LEGACY_UAT_URL,
                 updatedAt: typeof entry.updatedAt === 'string' ? entry.updatedAt : '',
                 skillId: normalizedSkillId,
                 skillName: typeof entry.skillName === 'string' ? entry.skillName : '',
@@ -1844,7 +1877,7 @@ async function readInstalledSkillRecords() {
         }
         return [{
                 targetRoot: typeof entry.targetRoot === 'string' ? resolve(entry.targetRoot) : '',
-                baseUrl: typeof entry.baseUrl === 'string' ? normalizeBaseUrl(entry.baseUrl) : PROD_URL,
+                baseUrl: typeof entry.baseUrl === 'string' ? normalizeBaseUrl(entry.baseUrl) : LEGACY_UAT_URL,
                 updatedAt: typeof entry.updatedAt === 'string' ? entry.updatedAt : '',
                 skillId,
                 skillName: typeof entry.skillName === 'string' ? entry.skillName : '',

package/dist/teams-auth.js

@@ -0,0 +1,304 @@
+import { mkdir } from 'node:fs/promises';
+import { setTimeout as delay } from 'node:timers/promises';
+const origins = new Set(['https://teams.microsoft.com', 'https://teams.cloud.microsoft']);
+const uuid = /^[a-f\d]{8}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{12}$/i;
+export function decodeTeamsJwt(value) {
+    try {
+        const part = value.split('.')[1];
+        if (!part)
+            return null;
+        return JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Select only credentials belonging to the Skillshare account. No full browser state leaves this machine. */
+export function extractTeamsSession(state, expectedObjectId, now = Date.now(), allowExpired = false) {
+    if (!uuid.test(expectedObjectId))
+        throw new Error('Skillshare must be signed in with a Microsoft account before connecting Teams.');
+    const stores = state.origins.filter(origin => origins.has(origin.origin));
+    const entries = stores.flatMap(origin => origin.localStorage.flatMap(item => {
+        try {
+            const entry = JSON.parse(item.value);
+            return entry && typeof entry === 'object' && !Array.isArray(entry)
+                ? [{ key: item.name, entry: entry, origin: origin.origin }] : [];
+        }
+        catch {
+            return [];
+        }
+    }));
+    const tokens = {};
+    let profile = null;
+    let clientId = '';
+    let accountId = '';
+    let spacesOrigin = '';
+    let substrateScope = 'https://substrate.office.com/.default offline_access';
+    for (const { entry, origin } of entries) {
+        if (entry.credentialType !== 'AccessToken' || typeof entry.secret !== 'string')
+            continue;
+        const claims = decodeTeamsJwt(entry.secret);
+        if (claims?.oid?.toLowerCase() !== expectedObjectId.toLowerCase() || !claims.tid || typeof claims.exp !== 'number' || !allowExpired && claims.exp * 1000 <= now + 30_000)
+            continue;
+        const target = typeof entry.target === 'string' ? entry.target : '';
+        const resource = target.includes('SubstrateSearch') ? 'substrate' :
+            target.includes('api.spaces.skype.com') ? 'spaces' : target.includes('chatsvcagg.teams.microsoft.com') ? 'csa' :
+                target.includes('graph.microsoft.com') || claims.aud === '00000003-0000-0000-c000-000000000000' ? 'graph' : undefined;
+        if (!resource)
+            continue;
+        if (profile?.tid && profile.tid !== claims.tid)
+            continue;
+        if (!tokens[resource] || new Date(tokens[resource].expiresAt).getTime() < claims.exp * 1000) {
+            if (resource === 'substrate')
+                substrateScope = target.includes('outlook.office.com/search')
+                    ? 'https://outlook.office.com/search/.default offline_access' : 'https://substrate.office.com/.default offline_access';
+            if (resource === 'spaces') {
+                spacesOrigin = origin;
+                if (typeof entry.clientId === 'string')
+                    clientId = entry.clientId;
+                if (typeof entry.homeAccountId === 'string')
+                    accountId = entry.homeAccountId;
+            }
+            tokens[resource] = { value: entry.secret, expiresAt: new Date(claims.exp * 1000).toISOString() };
+            profile ??= claims;
+        }
+    }
+    if (!profile?.tid || !allowExpired && !tokens.substrate || !tokens.spaces || !uuid.test(clientId))
+        return null;
+    const accountStores = new Set(entries.filter(({ entry }) => entry.homeAccountId === accountId).map(({ origin }) => origin));
+    const configs = entries.filter(({ key, origin }) => key.includes('DISCOVER-REGION-GTM') && accountStores.has(origin));
+    const discovery = configs.find(({ entry }) => typeof entry.item?.chatServiceAfd === 'string');
+    const item = discovery?.entry.item;
+    if (!item || typeof item.chatServiceAfd !== 'string' || typeof item.middleTier !== 'string')
+        return null;
+    let origin;
+    try {
+        origin = new URL(item.chatServiceAfd).origin;
+    }
+    catch {
+        return null;
+    }
+    if (!origins.has(origin) || !/^\/api\/chatsvc\/[a-z]+$/.test(new URL(item.chatServiceAfd).pathname))
+        return null;
+    const csa = typeof item.chatSvcAggAfd === 'string' ? item.chatSvcAggAfd : item.chatServiceAfd.replace('/chatsvc/', '/csa/');
+    if (!validServiceUrl(item.middleTier, origin, 'mt') || !validServiceUrl(csa, origin, 'csa'))
+        return null;
+    const skype = state.cookies.filter(cookie => {
+        const claims = decodeTeamsJwt(cookie.value);
+        return cookie.name === 'skypetoken_asm' && claims?.skypeid?.replace(/^8:/, '').toLowerCase() === `orgid:${expectedObjectId.toLowerCase()}` &&
+            claims.tid === profile.tid && typeof claims.exp === 'number' &&
+            (/^\.?([a-z0-9-]+\.)?(asm\.skype\.com|asyncgw\.teams\.microsoft\.com)$/.test(cookie.domain) ||
+                /^\.?(teams\.microsoft\.com|teams\.cloud\.microsoft)$/.test(cookie.domain)) && (allowExpired || Math.min(claims.exp * 1000, cookie.expires * 1000) > now + 30_000);
+    })
+        .sort((a, b) => b.expires - a.expires)[0];
+    if (!skype && !allowExpired)
+        return null;
+    if (skype)
+        tokens.skype = { value: skype.value, expiresAt: new Date(decodeTeamsJwt(skype.value).exp * 1000).toISOString() };
+    const refresh = entries.find(({ entry, origin }) => origin === spacesOrigin && entry.credentialType === 'RefreshToken' && entry.homeAccountId === accountId &&
+        entry.clientId === clientId && typeof entry.secret === 'string')?.entry.secret;
+    if (typeof refresh !== 'string')
+        return null;
+    return {
+        tenantId: profile.tid, objectId: expectedObjectId.toLowerCase(), displayName: profile.name ?? expectedObjectId,
+        email: profile.upn ?? profile.preferred_username ?? '', clientId, substrateScope, refreshToken: typeof refresh === 'string' ? refresh : undefined,
+        teamsOrigin: origin, chatServiceUrl: item.chatServiceAfd, middleTierUrl: item.middleTier, csaServiceUrl: csa, tokens,
+    };
+}
+function validServiceUrl(value, origin, service) {
+    try {
+        const url = new URL(value);
+        return url.origin === origin && !url.username && !url.password && !url.search && !url.hash &&
+            (service === 'mt' ? /^\/api\/mt\/(part\/)?[a-z]+(-\d+)?$/ : /^\/api\/csa\/[a-z]+$/).test(url.pathname);
+    }
+    catch {
+        return false;
+    }
+}
+export async function captureTeamsLogin(options) {
+    options.signal?.throwIfAborted();
+    const { chromium } = await import('playwright');
+    const channel = options.browser ?? (process.platform === 'win32' ? 'msedge' : 'chrome');
+    if (!['chrome', 'msedge', 'chromium'].includes(channel))
+        throw new Error('--browser must be chrome, msedge or chromium.');
+    await mkdir(options.profileDirectory, { recursive: true, mode: 0o700 });
+    const controller = new AbortController();
+    const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+    const timeout = setTimeout(() => controller.abort(new Error('Teams login timed out. Finish sign-in with the same account as Skillshare, then run skillshare teams login again.')), options.timeoutMs ?? 10 * 60_000);
+    let context;
+    try {
+        context = await chromium.launchPersistentContext(options.profileDirectory, {
+            channel: channel === 'chromium' ? undefined : channel,
+            headless: options.headless ?? false,
+            viewport: null,
+            timeout: Math.min(options.timeoutMs ?? 60_000, 60_000),
+        });
+    }
+    catch {
+        clearTimeout(timeout);
+        signal.throwIfAborted();
+        throw new Error(`Could not launch ${channel}. Install that browser or use --browser chromium after running npx playwright install chromium. Close another Teams login using this profile and retry.`);
+    }
+    const close = () => { void context.close().catch(() => { }); };
+    const interrupt = () => controller.abort(new Error('Teams login cancelled.'));
+    process.once('SIGINT', interrupt);
+    process.once('SIGTERM', interrupt);
+    signal.addEventListener('abort', close, { once: true });
+    try {
+        signal.throwIfAborted();
+        const page = context.pages()[0] ?? await abortable(context.newPage(), signal);
+        options.onProgress?.('Sign in to Teams with the same Microsoft account as Skillshare. Existing login cookies are preserved.');
+        await abortable(page.goto('https://teams.microsoft.com/v2/', { waitUntil: 'domcontentloaded', timeout: 60_000 }), signal);
+        let lastProgress = Date.now();
+        let lastRefresh = 0;
+        let resetCache = false;
+        while (true) {
+            signal.throwIfAborted();
+            // Read the current Teams tab only. storageState visits every cached origin and can hang
+            // on Teams service-worker navigation; browser cookies remain local in this snapshot.
+            let local;
+            try {
+                local = await abortable(page.evaluate(() => ({ origin: location.origin,
+                    localStorage: Object.entries(localStorage).map(([name, value]) => ({ name, value })) })), signal);
+            }
+            catch (error) {
+                signal.throwIfAborted();
+                if (error instanceof Error && /Execution context was destroyed|Cannot find context|Frame was detached/.test(error.message)) {
+                    await delay(250, undefined, { signal });
+                    continue;
+                }
+                throw error;
+            }
+            const state = { origins: [local], cookies: await abortable(context.cookies(), signal) };
+            const session = extractTeamsSession(state, options.objectId);
+            if (session && !options.recover)
+                return session;
+            if (origins.has(new URL(page.url()).origin) && Date.now() - lastRefresh > 30_000) {
+                const cached = session ?? extractTeamsSession(state, options.objectId, Date.now(), true);
+                if (cached?.refreshToken) {
+                    lastRefresh = Date.now();
+                    try {
+                        return await abortable(refreshCapturedSession(cached, fetch, options.recover ?? false, signal), signal);
+                    }
+                    catch {
+                        signal.throwIfAborted();
+                        if (options.recover && !resetCache) {
+                            resetCache = true;
+                            // Expired grants can coexist with valid access tokens. Remove only this account's MSAL
+                            // credentials so Teams starts a new authorization flow, preserving SSO cookies and account hints.
+                            options.onProgress?.('The cached grant expired. Renewing Teams sign-in using browser SSO cookies.');
+                            await abortable(resetTeamsGrant(page, options.objectId, cached.clientId), signal);
+                            await abortable(page.reload({ waitUntil: 'domcontentloaded', timeout: 60_000 }), signal);
+                            lastRefresh = 0;
+                        }
+                    }
+                }
+            }
+            if (Date.now() - lastProgress > 30_000) {
+                options.onProgress?.('Waiting for Teams sign-in and API tokens. Finish sign-in in the browser; open Teams search if needed.');
+                lastProgress = Date.now();
+            }
+            await delay(1500, undefined, { signal });
+        }
+    }
+    catch (error) {
+        signal.throwIfAborted();
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+        process.removeListener('SIGINT', interrupt);
+        process.removeListener('SIGTERM', interrupt);
+        signal.removeEventListener('abort', close);
+        await Promise.race([context.close().catch(() => { }), delay(3000, undefined, { ref: false })]);
+    }
+}
+function abortable(operation, signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener('abort', abort, { once: true });
+        if (signal.aborted)
+            abort();
+        operation.then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+    });
+}
+/** The Teams web SPA may not request a search token until search is opened. Reuse its MSAL grant instead. */
+export async function refreshCapturedSession(session, request = fetch, force = false, signal) {
+    if (!session.refreshToken)
+        throw new Error('A Teams refresh token is required to renew this session.');
+    const scopes = {
+        substrate: session.substrateScope ?? 'https://substrate.office.com/.default offline_access',
+        spaces: 'https://api.spaces.skype.com/.default offline_access',
+        csa: 'https://chatsvcagg.teams.microsoft.com/.default offline_access',
+        graph: 'https://graph.microsoft.com/.default offline_access',
+    };
+    for (const resource of ['substrate', 'spaces', 'csa', ...(session.tokens.graph ? ['graph'] : [])]) {
+        if (!force && session.tokens[resource] && new Date(session.tokens[resource].expiresAt).getTime() > Date.now() + 120_000)
+            continue;
+        const response = await request(`https://login.microsoftonline.com/${session.tenantId}/oauth2/v2.0/token`, {
+            method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', Origin: session.teamsOrigin },
+            body: new URLSearchParams({ client_id: session.clientId, grant_type: 'refresh_token', refresh_token: session.refreshToken, scope: scopes[resource] }),
+            signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000), redirect: 'error',
+        });
+        if (!response.ok) {
+            if (resource === 'graph') {
+                delete session.tokens.graph;
+                continue;
+            }
+            throw new Error('Teams needs interactive sign-in to renew this session.');
+        }
+        const data = await response.json();
+        const claims = decodeTeamsJwt(data.access_token);
+        if (claims?.oid?.toLowerCase() !== session.objectId.toLowerCase() || claims.tid !== session.tenantId || !claims.exp)
+            throw new Error('The renewed Teams token belongs to a different account.');
+        session.tokens[resource] = { value: data.access_token, expiresAt: new Date(claims.exp * 1000).toISOString() };
+        session.refreshToken = data.refresh_token ?? session.refreshToken;
+    }
+    if (!session.tokens.skype || new Date(session.tokens.skype.expiresAt).getTime() <= Date.now() + 120_000) {
+        const response = await request('https://authsvc.teams.microsoft.com/v1.0/authz', {
+            method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${session.tokens.spaces.value}` },
+            body: '{}', signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000), redirect: 'error',
+        });
+        if (!response.ok)
+            throw new Error('Teams could not renew the Skype token.');
+        const data = await response.json();
+        if (!data.tokens?.skypeToken)
+            throw new Error('Teams returned no Skype token.');
+        const claims = decodeTeamsJwt(data.tokens.skypeToken);
+        if (claims?.skypeid?.replace(/^8:/, '').toLowerCase() !== `orgid:${session.objectId.toLowerCase()}` || claims.tid !== session.tenantId || !claims.exp)
+            throw new Error('The renewed Skype token belongs to a different account.');
+        session.tokens.skype = { value: data.tokens.skypeToken, expiresAt: new Date(claims.exp * 1000).toISOString() };
+    }
+    return session;
+}
+async function resetTeamsGrant(page, objectId, clientId) {
+    if (!origins.has(new URL(page.url()).origin))
+        return;
+    await page.evaluate(({ objectId, clientId }) => {
+        const entries = Object.entries(localStorage).flatMap(([key, value]) => {
+            try {
+                const entry = JSON.parse(value);
+                return entry && typeof entry === 'object' && entry.clientId === clientId ? [{ key, entry }] : [];
+            }
+            catch {
+                return [];
+            }
+        });
+        const access = entries.filter(({ entry }) => {
+            if (entry.credentialType !== 'AccessToken' || typeof entry.secret !== 'string')
+                return false;
+            try {
+                const claims = JSON.parse(atob(entry.secret.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')));
+                return claims.oid?.toLowerCase() === objectId.toLowerCase();
+            }
+            catch {
+                return false;
+            }
+        });
+        const accounts = new Set(access.map(({ entry }) => entry.homeAccountId));
+        for (const { key, entry } of entries) {
+            if (access.some(item => item.key === key) || entry.credentialType === 'RefreshToken' && accounts.has(entry.homeAccountId))
+                localStorage.removeItem(key);
+        }
+    }, { objectId, clientId });
+}

package/dist/teams-watch.js

@@ -0,0 +1,45 @@
+import { setTimeout as delay } from 'node:timers/promises';
+/** The server renews access tokens; a local browser supplies a new SSO grant when that grant expires. */
+export async function watchTeamsConnection(options) {
+    const now = options.now ?? Date.now;
+    const wait = options.wait ?? (async (ms, signal) => { await delay(ms, undefined, { signal }); });
+    let retryAt = 0;
+    let warned = false;
+    while (!options.signal.aborted) {
+        try {
+            const status = await options.readStatus();
+            if (!status.connectionId) {
+                options.onProgress?.('Teams is disconnected. Watch stopped; run skillshare teams login before starting it again.');
+                return;
+            }
+            if (status.requiresReconnect && now() >= retryAt) {
+                options.onProgress?.('Microsoft needs a new Teams session. Renewing it through local browser SSO.');
+                // Conditional import prevents a disconnect or another login during capture from being overwritten.
+                await options.reconnect(status.connectionId);
+                options.onProgress?.('Teams SSO session renewed and saved to Skillshare.');
+                retryAt = 0;
+                warned = false;
+            }
+            else if (status.configured) {
+                retryAt = 0;
+                warned = false;
+            }
+        }
+        catch {
+            if (options.signal.aborted)
+                return;
+            retryAt = now() + 5 * 60_000;
+            if (!warned)
+                options.onProgress?.('Automatic Teams renewal is waiting for browser sign-in or server access. If MFA is required, run skillshare teams login in another terminal. Retrying in five minutes.');
+            warned = true;
+        }
+        try {
+            await wait(options.intervalMs ?? 60_000, options.signal);
+        }
+        catch (error) {
+            if (options.signal.aborted)
+                return;
+            throw error;
+        }
+    }
+}

package/dist/teams.js

@@ -0,0 +1,142 @@
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { open, rm, stat } from 'node:fs/promises';
+import { basename, join, resolve } from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { captureTeamsLogin } from './teams-auth.js';
+import { watchTeamsConnection } from './teams-watch.js';
+const root = '/api/mcps/providers/teams';
+async function expectOk(response) {
+    if (response.ok)
+        return;
+    let error = {};
+    try {
+        error = await response.json();
+    }
+    catch { }
+    throw new Error(error.error ?? `Skillshare Teams API returned HTTP ${response.status}.`);
+}
+export async function runTeamsCommand(client, args, flags, appDirectory) {
+    // Browser credentials may be uploaded only over HTTPS, with HTTP reserved for loopback development.
+    assertCredentialDestination(client.baseUrl);
+    const action = args[0];
+    if (action === 'login' || action === 'watch') {
+        const user = await client.get('/api/auth/me');
+        const key = createHash('sha256').update(client.baseUrl + '\0' + user.id).digest('hex').slice(0, 24);
+        const profileDirectory = flags['browser-profile'] ? resolve(flags['browser-profile']) : join(appDirectory, 'teams', key, 'browser-profile');
+        const abort = new AbortController();
+        async function connect(connectionId) {
+            const session = await captureTeamsLogin({ profileDirectory, objectId: user.id, browser: flags.browser,
+                headless: action === 'watch' ? flags.headless !== 'false' : flags.headless === 'true', recover: action === 'watch',
+                signal: abort.signal, timeoutMs: action === 'watch' ? 90_000 : undefined, onProgress: console.log });
+            const headers = { 'Content-Type': 'application/json' };
+            if (connectionId)
+                headers['If-Match'] = `"${connectionId}"`;
+            const response = await client.request(`${root}/session`, { method: 'PUT', headers, body: JSON.stringify(session), signal: abort.signal });
+            await expectOk(response);
+            await client.post(`${root}/test`);
+        }
+        if (action === 'login') {
+            await connect();
+            console.log(`Teams connected. Skillshare refreshes tokens automatically. Use skillshare teams watch for renewed browser SSO after session expiry.`);
+            console.log(`MCP endpoint: ${client.baseUrl}/teams/mcp`);
+            return;
+        }
+        const stop = () => abort.abort();
+        process.once('SIGINT', stop);
+        process.once('SIGTERM', stop);
+        try {
+            console.log('Watching Teams session. Server refreshes access tokens; this process renews expired grants through local SSO. Press Ctrl+C to stop.');
+            await watchTeamsConnection({ readStatus: () => client.get(`${root}/settings`), reconnect: connect,
+                signal: abort.signal, onProgress: console.log });
+        }
+        finally {
+            process.removeListener('SIGINT', stop);
+            process.removeListener('SIGTERM', stop);
+        }
+        return;
+    }
+    if (action === 'status' || action === 'test') {
+        const result = action === 'test' ? await client.post(`${root}/test`) : await client.get(`${root}/settings`);
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (action === 'logout') {
+        const response = await client.request(`${root}/session`, { method: 'DELETE' });
+        if (response.status !== 404)
+            await expectOk(response);
+        console.log('Teams disconnected from Skillshare. Browser login cookies are preserved for your next login.');
+        return;
+    }
+    if (action === 'access') {
+        const mode = args[1];
+        if (mode !== 'readOnly' && mode !== 'fullAccess')
+            throw new Error('Use teams access readOnly or teams access fullAccess.');
+        const response = await client.request(`${root}/access-mode`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ accessMode: mode }) });
+        await expectOk(response);
+        console.log(`Teams access mode: ${mode}`);
+        return;
+    }
+    if (action === 'upload') {
+        if (!args[1])
+            throw new Error('Use teams upload <file>.');
+        const path = resolve(args[1]);
+        const info = await stat(path);
+        if (!info.isFile() || info.size === 0)
+            throw new Error('Expected a nonempty regular file.');
+        const stream = createReadStream(path);
+        try {
+            const response = await client.request(`${root}/upload?fileName=${encodeURIComponent(basename(path))}`, {
+                method: 'POST', headers: { 'Content-Type': 'application/octet-stream', 'Content-Length': String(info.size) },
+                body: Readable.toWeb(stream), duplex: 'half',
+            });
+            await expectOk(response);
+            console.log(JSON.stringify(await response.json(), null, 2));
+        }
+        finally {
+            stream.destroy();
+        }
+        return;
+    }
+    if (action === 'download') {
+        if (!args[1] || !flags.output)
+            throw new Error('Use teams download <shared-file-webUrl|Skillshare-download-link> --output <new-file>.');
+        let target = new URL(args[1]);
+        if (target.origin !== new URL(client.baseUrl).origin) {
+            const linkResponse = await client.request(`${root}/download-link`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ url: args[1] }) });
+            await expectOk(linkResponse);
+            const link = await linkResponse.json();
+            target = new URL(link.url);
+        }
+        if (target.origin !== new URL(client.baseUrl).origin || target.pathname !== `${root}/download` || !target.searchParams.has('ticket'))
+            throw new Error('Expected a Skillshare Teams download link or direct SharePoint file URL.');
+        const path = resolve(flags.output);
+        const handle = await open(path, 'wx', 0o600);
+        try {
+            const response = await client.request(target.pathname + target.search, { method: 'GET', redirect: 'error' });
+            await expectOk(response);
+            if (!response.body)
+                throw new Error('The download response is empty.');
+            await pipeline(Readable.fromWeb(response.body), handle.createWriteStream());
+        }
+        catch (error) {
+            await handle.close().catch(() => { });
+            await rm(path, { force: true });
+            throw error;
+        }
+        finally {
+            await handle.close().catch(() => { });
+        }
+        console.log(`Downloaded to ${path}`);
+        return;
+    }
+    throw new Error('teams requires login, watch, logout, status, test, access, upload or download.');
+}
+export function assertCredentialDestination(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash || (url.protocol !== 'https:' &&
+        !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))) {
+        throw new Error('Teams credentials require an HTTPS Skillshare server, or HTTP on localhost.');
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quadient/skillshare",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "description": "Skillshare CLI for installing and publishing Quadient skills",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "start": "node ./dist/index.js",
     "prepublishOnly": "npm run build",
-    "test": "tsx --test pages.test.ts pages-dev.test.ts"
+    "test": "tsx --test pages.test.ts pages-dev.test.ts teams-auth.test.ts teams-watch.test.ts teams-browser.test.ts"
   },
   "publishConfig": {
     "access": "public"
@@ -33,6 +33,7 @@
     "@clack/prompts": "^1.7.0",
     "chokidar": "4.0.3",
     "esbuild": "0.28.2",
-    "jsonc-parser": "3.3.1"
+    "jsonc-parser": "3.3.1",
+    "playwright": "^1.63.0"
   }
 }