@quadient/skillshare 1.6.2 → 1.8.0

package/dist/install-files.js

@@ -0,0 +1,111 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { mkdir, readdir, rename, rm, rmdir, stat } from 'node:fs/promises';
+import { basename, dirname, join, relative, resolve, sep } from 'node:path';
+export function resolveInsideRoot(root, relativePath) {
+    const resolvedRoot = resolve(root);
+    const destination = resolve(resolvedRoot, relativePath);
+    if (destination === resolvedRoot || !destination.startsWith(resolvedRoot + sep)) {
+        throw new Error(`Refusing to write '${relativePath}' outside ${resolvedRoot}.`);
+    }
+    return destination;
+}
+export async function hashFile(path) {
+    const hash = createHash('sha256');
+    for await (const chunk of createReadStream(path)) {
+        hash.update(chunk);
+    }
+    return hash.digest('hex');
+}
+/**
+ * Compares a target directory with the manifest recorded at install time.
+ * A record without a manifest predates change tracking and cannot be verified.
+ */
+export async function inspectInstallTarget(targetRoot, record) {
+    if (!await isNonEmptyDirectory(targetRoot)) {
+        return { state: 'missing' };
+    }
+    if (!record) {
+        return { state: 'untracked' };
+    }
+    if (!record.files) {
+        return { state: 'legacy' };
+    }
+    const modified = [];
+    for (const [relativePath, expectedHash] of Object.entries(record.files)) {
+        const path = resolveInsideRoot(targetRoot, relativePath);
+        try {
+            if (await hashFile(path) !== expectedHash)
+                modified.push(relativePath);
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT')
+                throw error;
+            modified.push(relativePath);
+        }
+    }
+    return modified.length > 0 ? { state: 'modified', paths: modified } : { state: 'clean' };
+}
+/**
+ * Downloads every file into a sibling staging directory first, so a failed transfer
+ * leaves the existing install untouched. Files from the previous manifest that the
+ * new version no longer contains are removed afterwards.
+ */
+export async function installFilesAtomically(input) {
+    const targetRoot = resolve(input.targetRoot);
+    const stagingRoot = join(dirname(targetRoot), `.${basename(targetRoot)}.skillshare-${randomBytes(4).toString('hex')}`);
+    const manifest = {};
+    await mkdir(stagingRoot, { recursive: true });
+    try {
+        for (const file of input.files) {
+            const stagedPath = resolveInsideRoot(stagingRoot, file.relativePath);
+            resolveInsideRoot(targetRoot, file.relativePath);
+            await mkdir(dirname(stagedPath), { recursive: true });
+            manifest[normalizeRelativePath(file.relativePath)] = await input.download(file.relativePath, stagedPath);
+        }
+        await mkdir(targetRoot, { recursive: true });
+        for (const relativePath of Object.keys(manifest)) {
+            const destination = resolveInsideRoot(targetRoot, relativePath);
+            await mkdir(dirname(destination), { recursive: true });
+            await rename(resolveInsideRoot(stagingRoot, relativePath), destination);
+        }
+        for (const relativePath of Object.keys(input.previousManifest ?? {})) {
+            if (relativePath in manifest)
+                continue;
+            const stalePath = resolveInsideRoot(targetRoot, relativePath);
+            await rm(stalePath, { force: true });
+            await removeEmptyParents(dirname(stalePath), targetRoot);
+        }
+    }
+    finally {
+        await rm(stagingRoot, { recursive: true, force: true });
+    }
+    return manifest;
+}
+function normalizeRelativePath(path) {
+    return relative('.', join('.', path)).replaceAll('\\', '/');
+}
+async function isNonEmptyDirectory(path) {
+    try {
+        if (!(await stat(path)).isDirectory())
+            return true;
+        return (await readdir(path)).length > 0;
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+async function removeEmptyParents(directory, root) {
+    let current = resolve(directory);
+    while (current !== root && current.startsWith(root + sep)) {
+        try {
+            await rmdir(current);
+        }
+        catch {
+            return;
+        }
+        current = dirname(current);
+    }
+}

package/dist/teams-auth.js

@@ -0,0 +1,304 @@
+import { mkdir } from 'node:fs/promises';
+import { setTimeout as delay } from 'node:timers/promises';
+const origins = new Set(['https://teams.microsoft.com', 'https://teams.cloud.microsoft']);
+const uuid = /^[a-f\d]{8}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{12}$/i;
+export function decodeTeamsJwt(value) {
+    try {
+        const part = value.split('.')[1];
+        if (!part)
+            return null;
+        return JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Select only credentials belonging to the Skillshare account. No full browser state leaves this machine. */
+export function extractTeamsSession(state, expectedObjectId, now = Date.now(), allowExpired = false) {
+    if (!uuid.test(expectedObjectId))
+        throw new Error('Skillshare must be signed in with a Microsoft account before connecting Teams.');
+    const stores = state.origins.filter(origin => origins.has(origin.origin));
+    const entries = stores.flatMap(origin => origin.localStorage.flatMap(item => {
+        try {
+            const entry = JSON.parse(item.value);
+            return entry && typeof entry === 'object' && !Array.isArray(entry)
+                ? [{ key: item.name, entry: entry, origin: origin.origin }] : [];
+        }
+        catch {
+            return [];
+        }
+    }));
+    const tokens = {};
+    let profile = null;
+    let clientId = '';
+    let accountId = '';
+    let spacesOrigin = '';
+    let substrateScope = 'https://substrate.office.com/.default offline_access';
+    for (const { entry, origin } of entries) {
+        if (entry.credentialType !== 'AccessToken' || typeof entry.secret !== 'string')
+            continue;
+        const claims = decodeTeamsJwt(entry.secret);
+        if (claims?.oid?.toLowerCase() !== expectedObjectId.toLowerCase() || !claims.tid || typeof claims.exp !== 'number' || !allowExpired && claims.exp * 1000 <= now + 30_000)
+            continue;
+        const target = typeof entry.target === 'string' ? entry.target : '';
+        const resource = target.includes('SubstrateSearch') ? 'substrate' :
+            target.includes('api.spaces.skype.com') ? 'spaces' : target.includes('chatsvcagg.teams.microsoft.com') ? 'csa' :
+                target.includes('graph.microsoft.com') || claims.aud === '00000003-0000-0000-c000-000000000000' ? 'graph' : undefined;
+        if (!resource)
+            continue;
+        if (profile?.tid && profile.tid !== claims.tid)
+            continue;
+        if (!tokens[resource] || new Date(tokens[resource].expiresAt).getTime() < claims.exp * 1000) {
+            if (resource === 'substrate')
+                substrateScope = target.includes('outlook.office.com/search')
+                    ? 'https://outlook.office.com/search/.default offline_access' : 'https://substrate.office.com/.default offline_access';
+            if (resource === 'spaces') {
+                spacesOrigin = origin;
+                if (typeof entry.clientId === 'string')
+                    clientId = entry.clientId;
+                if (typeof entry.homeAccountId === 'string')
+                    accountId = entry.homeAccountId;
+            }
+            tokens[resource] = { value: entry.secret, expiresAt: new Date(claims.exp * 1000).toISOString() };
+            profile ??= claims;
+        }
+    }
+    if (!profile?.tid || !allowExpired && !tokens.substrate || !tokens.spaces || !uuid.test(clientId))
+        return null;
+    const accountStores = new Set(entries.filter(({ entry }) => entry.homeAccountId === accountId).map(({ origin }) => origin));
+    const configs = entries.filter(({ key, origin }) => key.includes('DISCOVER-REGION-GTM') && accountStores.has(origin));
+    const discovery = configs.find(({ entry }) => typeof entry.item?.chatServiceAfd === 'string');
+    const item = discovery?.entry.item;
+    if (!item || typeof item.chatServiceAfd !== 'string' || typeof item.middleTier !== 'string')
+        return null;
+    let origin;
+    try {
+        origin = new URL(item.chatServiceAfd).origin;
+    }
+    catch {
+        return null;
+    }
+    if (!origins.has(origin) || !/^\/api\/chatsvc\/[a-z]+$/.test(new URL(item.chatServiceAfd).pathname))
+        return null;
+    const csa = typeof item.chatSvcAggAfd === 'string' ? item.chatSvcAggAfd : item.chatServiceAfd.replace('/chatsvc/', '/csa/');
+    if (!validServiceUrl(item.middleTier, origin, 'mt') || !validServiceUrl(csa, origin, 'csa'))
+        return null;
+    const skype = state.cookies.filter(cookie => {
+        const claims = decodeTeamsJwt(cookie.value);
+        return cookie.name === 'skypetoken_asm' && claims?.skypeid?.replace(/^8:/, '').toLowerCase() === `orgid:${expectedObjectId.toLowerCase()}` &&
+            claims.tid === profile.tid && typeof claims.exp === 'number' &&
+            (/^\.?([a-z0-9-]+\.)?(asm\.skype\.com|asyncgw\.teams\.microsoft\.com)$/.test(cookie.domain) ||
+                /^\.?(teams\.microsoft\.com|teams\.cloud\.microsoft)$/.test(cookie.domain)) && (allowExpired || Math.min(claims.exp * 1000, cookie.expires * 1000) > now + 30_000);
+    })
+        .sort((a, b) => b.expires - a.expires)[0];
+    if (!skype && !allowExpired)
+        return null;
+    if (skype)
+        tokens.skype = { value: skype.value, expiresAt: new Date(decodeTeamsJwt(skype.value).exp * 1000).toISOString() };
+    const refresh = entries.find(({ entry, origin }) => origin === spacesOrigin && entry.credentialType === 'RefreshToken' && entry.homeAccountId === accountId &&
+        entry.clientId === clientId && typeof entry.secret === 'string')?.entry.secret;
+    if (typeof refresh !== 'string')
+        return null;
+    return {
+        tenantId: profile.tid, objectId: expectedObjectId.toLowerCase(), displayName: profile.name ?? expectedObjectId,
+        email: profile.upn ?? profile.preferred_username ?? '', clientId, substrateScope, refreshToken: typeof refresh === 'string' ? refresh : undefined,
+        teamsOrigin: origin, chatServiceUrl: item.chatServiceAfd, middleTierUrl: item.middleTier, csaServiceUrl: csa, tokens,
+    };
+}
+function validServiceUrl(value, origin, service) {
+    try {
+        const url = new URL(value);
+        return url.origin === origin && !url.username && !url.password && !url.search && !url.hash &&
+            (service === 'mt' ? /^\/api\/mt\/(part\/)?[a-z]+(-\d+)?$/ : /^\/api\/csa\/[a-z]+$/).test(url.pathname);
+    }
+    catch {
+        return false;
+    }
+}
+export async function captureTeamsLogin(options) {
+    options.signal?.throwIfAborted();
+    const { chromium } = await import('playwright');
+    const channel = options.browser ?? (process.platform === 'win32' ? 'msedge' : 'chrome');
+    if (!['chrome', 'msedge', 'chromium'].includes(channel))
+        throw new Error('--browser must be chrome, msedge or chromium.');
+    await mkdir(options.profileDirectory, { recursive: true, mode: 0o700 });
+    const controller = new AbortController();
+    const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+    const timeout = setTimeout(() => controller.abort(new Error('Teams login timed out. Finish sign-in with the same account as Skillshare, then run skillshare teams login again.')), options.timeoutMs ?? 10 * 60_000);
+    let context;
+    try {
+        context = await chromium.launchPersistentContext(options.profileDirectory, {
+            channel: channel === 'chromium' ? undefined : channel,
+            headless: options.headless ?? false,
+            viewport: null,
+            timeout: Math.min(options.timeoutMs ?? 60_000, 60_000),
+        });
+    }
+    catch {
+        clearTimeout(timeout);
+        signal.throwIfAborted();
+        throw new Error(`Could not launch ${channel}. Install that browser or use --browser chromium after running npx playwright install chromium. Close another Teams login using this profile and retry.`);
+    }
+    const close = () => { void context.close().catch(() => { }); };
+    const interrupt = () => controller.abort(new Error('Teams login cancelled.'));
+    process.once('SIGINT', interrupt);
+    process.once('SIGTERM', interrupt);
+    signal.addEventListener('abort', close, { once: true });
+    try {
+        signal.throwIfAborted();
+        const page = context.pages()[0] ?? await abortable(context.newPage(), signal);
+        options.onProgress?.('Sign in to Teams with the same Microsoft account as Skillshare. Existing login cookies are preserved.');
+        await abortable(page.goto('https://teams.microsoft.com/v2/', { waitUntil: 'domcontentloaded', timeout: 60_000 }), signal);
+        let lastProgress = Date.now();
+        let lastRefresh = 0;
+        let resetCache = false;
+        while (true) {
+            signal.throwIfAborted();
+            // Read the current Teams tab only. storageState visits every cached origin and can hang
+            // on Teams service-worker navigation; browser cookies remain local in this snapshot.
+            let local;
+            try {
+                local = await abortable(page.evaluate(() => ({ origin: location.origin,
+                    localStorage: Object.entries(localStorage).map(([name, value]) => ({ name, value })) })), signal);
+            }
+            catch (error) {
+                signal.throwIfAborted();
+                if (error instanceof Error && /Execution context was destroyed|Cannot find context|Frame was detached/.test(error.message)) {
+                    await delay(250, undefined, { signal });
+                    continue;
+                }
+                throw error;
+            }
+            const state = { origins: [local], cookies: await abortable(context.cookies(), signal) };
+            const session = extractTeamsSession(state, options.objectId);
+            if (session && !options.recover)
+                return session;
+            if (origins.has(new URL(page.url()).origin) && Date.now() - lastRefresh > 30_000) {
+                const cached = session ?? extractTeamsSession(state, options.objectId, Date.now(), true);
+                if (cached?.refreshToken) {
+                    lastRefresh = Date.now();
+                    try {
+                        return await abortable(refreshCapturedSession(cached, fetch, options.recover ?? false, signal), signal);
+                    }
+                    catch {
+                        signal.throwIfAborted();
+                        if (options.recover && !resetCache) {
+                            resetCache = true;
+                            // Expired grants can coexist with valid access tokens. Remove only this account's MSAL
+                            // credentials so Teams starts a new authorization flow, preserving SSO cookies and account hints.
+                            options.onProgress?.('The cached grant expired. Renewing Teams sign-in using browser SSO cookies.');
+                            await abortable(resetTeamsGrant(page, options.objectId, cached.clientId), signal);
+                            await abortable(page.reload({ waitUntil: 'domcontentloaded', timeout: 60_000 }), signal);
+                            lastRefresh = 0;
+                        }
+                    }
+                }
+            }
+            if (Date.now() - lastProgress > 30_000) {
+                options.onProgress?.('Waiting for Teams sign-in and API tokens. Finish sign-in in the browser; open Teams search if needed.');
+                lastProgress = Date.now();
+            }
+            await delay(1500, undefined, { signal });
+        }
+    }
+    catch (error) {
+        signal.throwIfAborted();
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+        process.removeListener('SIGINT', interrupt);
+        process.removeListener('SIGTERM', interrupt);
+        signal.removeEventListener('abort', close);
+        await Promise.race([context.close().catch(() => { }), delay(3000, undefined, { ref: false })]);
+    }
+}
+function abortable(operation, signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener('abort', abort, { once: true });
+        if (signal.aborted)
+            abort();
+        operation.then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+    });
+}
+/** The Teams web SPA may not request a search token until search is opened. Reuse its MSAL grant instead. */
+export async function refreshCapturedSession(session, request = fetch, force = false, signal) {
+    if (!session.refreshToken)
+        throw new Error('A Teams refresh token is required to renew this session.');
+    const scopes = {
+        substrate: session.substrateScope ?? 'https://substrate.office.com/.default offline_access',
+        spaces: 'https://api.spaces.skype.com/.default offline_access',
+        csa: 'https://chatsvcagg.teams.microsoft.com/.default offline_access',
+        graph: 'https://graph.microsoft.com/.default offline_access',
+    };
+    for (const resource of ['substrate', 'spaces', 'csa', ...(session.tokens.graph ? ['graph'] : [])]) {
+        if (!force && session.tokens[resource] && new Date(session.tokens[resource].expiresAt).getTime() > Date.now() + 120_000)
+            continue;
+        const response = await request(`https://login.microsoftonline.com/${session.tenantId}/oauth2/v2.0/token`, {
+            method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', Origin: session.teamsOrigin },
+            body: new URLSearchParams({ client_id: session.clientId, grant_type: 'refresh_token', refresh_token: session.refreshToken, scope: scopes[resource] }),
+            signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000), redirect: 'error',
+        });
+        if (!response.ok) {
+            if (resource === 'graph') {
+                delete session.tokens.graph;
+                continue;
+            }
+            throw new Error('Teams needs interactive sign-in to renew this session.');
+        }
+        const data = await response.json();
+        const claims = decodeTeamsJwt(data.access_token);
+        if (claims?.oid?.toLowerCase() !== session.objectId.toLowerCase() || claims.tid !== session.tenantId || !claims.exp)
+            throw new Error('The renewed Teams token belongs to a different account.');
+        session.tokens[resource] = { value: data.access_token, expiresAt: new Date(claims.exp * 1000).toISOString() };
+        session.refreshToken = data.refresh_token ?? session.refreshToken;
+    }
+    if (!session.tokens.skype || new Date(session.tokens.skype.expiresAt).getTime() <= Date.now() + 120_000) {
+        const response = await request('https://authsvc.teams.microsoft.com/v1.0/authz', {
+            method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${session.tokens.spaces.value}` },
+            body: '{}', signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000), redirect: 'error',
+        });
+        if (!response.ok)
+            throw new Error('Teams could not renew the Skype token.');
+        const data = await response.json();
+        if (!data.tokens?.skypeToken)
+            throw new Error('Teams returned no Skype token.');
+        const claims = decodeTeamsJwt(data.tokens.skypeToken);
+        if (claims?.skypeid?.replace(/^8:/, '').toLowerCase() !== `orgid:${session.objectId.toLowerCase()}` || claims.tid !== session.tenantId || !claims.exp)
+            throw new Error('The renewed Skype token belongs to a different account.');
+        session.tokens.skype = { value: data.tokens.skypeToken, expiresAt: new Date(claims.exp * 1000).toISOString() };
+    }
+    return session;
+}
+async function resetTeamsGrant(page, objectId, clientId) {
+    if (!origins.has(new URL(page.url()).origin))
+        return;
+    await page.evaluate(({ objectId, clientId }) => {
+        const entries = Object.entries(localStorage).flatMap(([key, value]) => {
+            try {
+                const entry = JSON.parse(value);
+                return entry && typeof entry === 'object' && entry.clientId === clientId ? [{ key, entry }] : [];
+            }
+            catch {
+                return [];
+            }
+        });
+        const access = entries.filter(({ entry }) => {
+            if (entry.credentialType !== 'AccessToken' || typeof entry.secret !== 'string')
+                return false;
+            try {
+                const claims = JSON.parse(atob(entry.secret.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')));
+                return claims.oid?.toLowerCase() === objectId.toLowerCase();
+            }
+            catch {
+                return false;
+            }
+        });
+        const accounts = new Set(access.map(({ entry }) => entry.homeAccountId));
+        for (const { key, entry } of entries) {
+            if (access.some(item => item.key === key) || entry.credentialType === 'RefreshToken' && accounts.has(entry.homeAccountId))
+                localStorage.removeItem(key);
+        }
+    }, { objectId, clientId });
+}

package/dist/teams-watch.js

@@ -0,0 +1,45 @@
+import { setTimeout as delay } from 'node:timers/promises';
+/** The server renews access tokens; a local browser supplies a new SSO grant when that grant expires. */
+export async function watchTeamsConnection(options) {
+    const now = options.now ?? Date.now;
+    const wait = options.wait ?? (async (ms, signal) => { await delay(ms, undefined, { signal }); });
+    let retryAt = 0;
+    let warned = false;
+    while (!options.signal.aborted) {
+        try {
+            const status = await options.readStatus();
+            if (!status.connectionId) {
+                options.onProgress?.('Teams is disconnected. Watch stopped; run skillshare teams login before starting it again.');
+                return;
+            }
+            if (status.requiresReconnect && now() >= retryAt) {
+                options.onProgress?.('Microsoft needs a new Teams session. Renewing it through local browser SSO.');
+                // Conditional import prevents a disconnect or another login during capture from being overwritten.
+                await options.reconnect(status.connectionId);
+                options.onProgress?.('Teams SSO session renewed and saved to Skillshare.');
+                retryAt = 0;
+                warned = false;
+            }
+            else if (status.configured) {
+                retryAt = 0;
+                warned = false;
+            }
+        }
+        catch {
+            if (options.signal.aborted)
+                return;
+            retryAt = now() + 5 * 60_000;
+            if (!warned)
+                options.onProgress?.('Automatic Teams renewal is waiting for browser sign-in or server access. If MFA is required, run skillshare teams login in another terminal. Retrying in five minutes.');
+            warned = true;
+        }
+        try {
+            await wait(options.intervalMs ?? 60_000, options.signal);
+        }
+        catch (error) {
+            if (options.signal.aborted)
+                return;
+            throw error;
+        }
+    }
+}

package/dist/teams.js

@@ -0,0 +1,142 @@
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { open, rm, stat } from 'node:fs/promises';
+import { basename, join, resolve } from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { captureTeamsLogin } from './teams-auth.js';
+import { watchTeamsConnection } from './teams-watch.js';
+const root = '/api/mcps/providers/teams';
+async function expectOk(response) {
+    if (response.ok)
+        return;
+    let error = {};
+    try {
+        error = await response.json();
+    }
+    catch { }
+    throw new Error(error.error ?? `Skillshare Teams API returned HTTP ${response.status}.`);
+}
+export async function runTeamsCommand(client, args, flags, appDirectory) {
+    // Browser credentials may be uploaded only over HTTPS, with HTTP reserved for loopback development.
+    assertCredentialDestination(client.baseUrl);
+    const action = args[0];
+    if (action === 'login' || action === 'watch') {
+        const user = await client.get('/api/auth/me');
+        const key = createHash('sha256').update(client.baseUrl + '\0' + user.id).digest('hex').slice(0, 24);
+        const profileDirectory = flags['browser-profile'] ? resolve(flags['browser-profile']) : join(appDirectory, 'teams', key, 'browser-profile');
+        const abort = new AbortController();
+        async function connect(connectionId) {
+            const session = await captureTeamsLogin({ profileDirectory, objectId: user.id, browser: flags.browser,
+                headless: action === 'watch' ? flags.headless !== 'false' : flags.headless === 'true', recover: action === 'watch',
+                signal: abort.signal, timeoutMs: action === 'watch' ? 90_000 : undefined, onProgress: console.log });
+            const headers = { 'Content-Type': 'application/json' };
+            if (connectionId)
+                headers['If-Match'] = `"${connectionId}"`;
+            const response = await client.request(`${root}/session`, { method: 'PUT', headers, body: JSON.stringify(session), signal: abort.signal });
+            await expectOk(response);
+            await client.post(`${root}/test`);
+        }
+        if (action === 'login') {
+            await connect();
+            console.log(`Teams connected. Skillshare refreshes tokens automatically. Use skillshare teams watch for renewed browser SSO after session expiry.`);
+            console.log(`MCP endpoint: ${client.baseUrl}/teams/mcp`);
+            return;
+        }
+        const stop = () => abort.abort();
+        process.once('SIGINT', stop);
+        process.once('SIGTERM', stop);
+        try {
+            console.log('Watching Teams session. Server refreshes access tokens; this process renews expired grants through local SSO. Press Ctrl+C to stop.');
+            await watchTeamsConnection({ readStatus: () => client.get(`${root}/settings`), reconnect: connect,
+                signal: abort.signal, onProgress: console.log });
+        }
+        finally {
+            process.removeListener('SIGINT', stop);
+            process.removeListener('SIGTERM', stop);
+        }
+        return;
+    }
+    if (action === 'status' || action === 'test') {
+        const result = action === 'test' ? await client.post(`${root}/test`) : await client.get(`${root}/settings`);
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (action === 'logout') {
+        const response = await client.request(`${root}/session`, { method: 'DELETE' });
+        if (response.status !== 404)
+            await expectOk(response);
+        console.log('Teams disconnected from Skillshare. Browser login cookies are preserved for your next login.');
+        return;
+    }
+    if (action === 'access') {
+        const mode = args[1];
+        if (mode !== 'readOnly' && mode !== 'fullAccess')
+            throw new Error('Use teams access readOnly or teams access fullAccess.');
+        const response = await client.request(`${root}/access-mode`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ accessMode: mode }) });
+        await expectOk(response);
+        console.log(`Teams access mode: ${mode}`);
+        return;
+    }
+    if (action === 'upload') {
+        if (!args[1])
+            throw new Error('Use teams upload <file>.');
+        const path = resolve(args[1]);
+        const info = await stat(path);
+        if (!info.isFile() || info.size === 0)
+            throw new Error('Expected a nonempty regular file.');
+        const stream = createReadStream(path);
+        try {
+            const response = await client.request(`${root}/upload?fileName=${encodeURIComponent(basename(path))}`, {
+                method: 'POST', headers: { 'Content-Type': 'application/octet-stream', 'Content-Length': String(info.size) },
+                body: Readable.toWeb(stream), duplex: 'half',
+            });
+            await expectOk(response);
+            console.log(JSON.stringify(await response.json(), null, 2));
+        }
+        finally {
+            stream.destroy();
+        }
+        return;
+    }
+    if (action === 'download') {
+        if (!args[1] || !flags.output)
+            throw new Error('Use teams download <shared-file-webUrl|Skillshare-download-link> --output <new-file>.');
+        let target = new URL(args[1]);
+        if (target.origin !== new URL(client.baseUrl).origin) {
+            const linkResponse = await client.request(`${root}/download-link`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ url: args[1] }) });
+            await expectOk(linkResponse);
+            const link = await linkResponse.json();
+            target = new URL(link.url);
+        }
+        if (target.origin !== new URL(client.baseUrl).origin || target.pathname !== `${root}/download` || !target.searchParams.has('ticket'))
+            throw new Error('Expected a Skillshare Teams download link or direct SharePoint file URL.');
+        const path = resolve(flags.output);
+        const handle = await open(path, 'wx', 0o600);
+        try {
+            const response = await client.request(target.pathname + target.search, { method: 'GET', redirect: 'error' });
+            await expectOk(response);
+            if (!response.body)
+                throw new Error('The download response is empty.');
+            await pipeline(Readable.fromWeb(response.body), handle.createWriteStream());
+        }
+        catch (error) {
+            await handle.close().catch(() => { });
+            await rm(path, { force: true });
+            throw error;
+        }
+        finally {
+            await handle.close().catch(() => { });
+        }
+        console.log(`Downloaded to ${path}`);
+        return;
+    }
+    throw new Error('teams requires login, watch, logout, status, test, access, upload or download.');
+}
+export function assertCredentialDestination(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash || (url.protocol !== 'https:' &&
+        !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))) {
+        throw new Error('Teams credentials require an HTTPS Skillshare server, or HTTP on localhost.');
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quadient/skillshare",
-  "version": "1.6.2",
+  "version": "1.8.0",
   "description": "Skillshare CLI for installing and publishing Quadient skills",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "start": "node ./dist/index.js",
     "prepublishOnly": "npm run build",
-    "test": "tsx --test pages.test.ts pages-dev.test.ts"
+    "test": "tsx --test cli-args.test.ts install-files.test.ts pages.test.ts pages-dev.test.ts teams-auth.test.ts teams-watch.test.ts teams-browser.test.ts"
   },
   "publishConfig": {
     "access": "public"
@@ -33,6 +33,7 @@
     "@clack/prompts": "^1.7.0",
     "chokidar": "4.0.3",
     "esbuild": "0.28.2",
-    "jsonc-parser": "3.3.1"
+    "jsonc-parser": "3.3.1",
+    "playwright": "^1.63.0"
   }
 }