@vscode/chat-lib 0.0.1

package/src/_internal/extension/xtab/node/xtabUtils.ts

@@ -0,0 +1,62 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import { IResponsePart } from '../../../platform/chat/common/chatMLFetcher';
+import { AsyncIterableObject } from '../../../util/vs/base/common/async';
+
+
+export function toLines(stream: AsyncIterableObject<IResponsePart>) {
+	return new AsyncIterableObject<string>(async (emitter) => {
+		let buffer = '';
+
+		for await (const chunk of stream) {
+			buffer += chunk.delta.text;
+
+			const parts = buffer.split(/\r?\n/);
+			buffer = parts.pop() ?? '';
+
+			emitter.emitMany(parts);
+		}
+
+		if (buffer) {
+			emitter.emitOne(buffer);
+		}
+	});
+}
+
+/**
+ * Remove backticks on the first and last lines.
+ */
+export function linesWithBackticksRemoved(linesStream: AsyncIterableObject<string>) {
+	return new AsyncIterableObject<string>(async (emitter) => {
+		let lineN = -1;
+
+		let bufferedBacktickLine: string | undefined;
+
+		for await (const line of linesStream) {
+			++lineN;
+
+			if (bufferedBacktickLine) {
+				emitter.emitOne(bufferedBacktickLine);
+				bufferedBacktickLine = undefined;
+			}
+
+			if (line.match(/^```[a-z]*$/)) {
+				if (lineN === 0) {
+					continue;
+				} else {
+					// maybe middle of stream or last line
+					// we set it to buffer; if it's midle of stream, it will be emitted
+					// if last line, it will be omitted
+					bufferedBacktickLine = line;
+				}
+			} else {
+				emitter.emitOne(line);
+			}
+		}
+
+		// ignore bufferedLine
+	});
+}

package/src/_internal/platform/authentication/common/authentication.ts

@@ -0,0 +1,309 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+import type { AuthenticationGetSessionOptions, AuthenticationSession } from 'vscode';
+import { createServiceIdentifier } from '../../../util/common/services';
+import { Emitter, Event } from '../../../util/vs/base/common/event';
+import { Disposable } from '../../../util/vs/base/common/lifecycle';
+import { derived } from '../../../util/vs/base/common/observableInternal';
+import { AuthPermissionMode, ConfigKey, IConfigurationService } from '../../configuration/common/configurationService';
+import { ILogService } from '../../log/common/logService';
+import { CopilotToken } from './copilotToken';
+import { ICopilotTokenManager } from './copilotTokenManager';
+import { ICopilotTokenStore } from './copilotTokenStore';
+
+// Minimum set of scopes needed for Copilot to work
+export const GITHUB_SCOPE_USER_EMAIL = ['user:email'];
+
+// Old list of scopes still used for backwards compatibility
+export const GITHUB_SCOPE_READ_USER = ['read:user'];
+
+// The same scopes that GitHub Pull Request, GitHub Repositories, and others use
+export const GITHUB_SCOPE_ALIGNED = ['read:user', 'user:email', 'repo', 'workflow'];
+
+export class MinimalModeError extends Error {
+	constructor() {
+		super('The authentication service is in minimal mode.');
+		this.name = 'MinimalModeError';
+	}
+}
+
+export const IAuthenticationService = createServiceIdentifier<IAuthenticationService>('IAuthenticationService');
+export interface IAuthenticationService {
+
+	readonly _serviceBrand: undefined;
+
+	/**
+	 * Whether the authentication service is in minimal mode. If true, the authentication service will not attempt to
+	 * fetch the permissive token. This means that:
+	 * * {@link getPermissiveGitHubSession} interactive flows will always throw an error
+	 * * {@link getPermissiveGitHubSession} silent flows and {@link permissiveGitHubSession} will always return undefined
+	 */
+	readonly isMinimalMode: boolean;
+
+	/**
+	 * Event emitter that will fire an event every time the authentication status changes. This is used for example to detect when the user
+	 * logs out of GitHub or when they log in with a more permissive token.
+	 *
+	 * @note For best practice of handling of the user's authentication state, you should react to this event.
+	 */
+	readonly onDidAuthenticationChange: Event<void>;
+
+	/**
+	 * @deprecated Use {@link onDidAuthenticationChange} instead. This event fires when the access token changes and not the copilot token.
+	 */
+	readonly onDidAccessTokenChange: Event<void>;
+
+	/**
+	 * Checks if there is currently any session available in the cache. Does not make any network requests and does not
+	 * call out to the underlying authentication provider.
+	 *
+	 * @note See {@link getAnyGitHubToken} for more information and for an async version by calling {@link getAnyGitHubSession} with `{ silent: true }`.
+	 * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
+	 * @note This token will have at least the `user:email` scope to be able to access the minimum Copilot API.
+	 */
+	readonly anyGitHubSession: AuthenticationSession | undefined;
+
+	/**
+	 * Returns a currently valid GitHub session, also known as session or auth session. Skips the cache and calls
+	 * the underlying authentication provider using the options passed in.
+	 *
+	 * @note You should typically use the synchronous version {@link anyGitHubToken} if you are fetching a session silently.
+	 * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
+	 * @note This token will have at least the `user:email` scope to be able to access the minimum Copilot API.
+	 * @returns an auth session or undefined if none is found.
+	 */
+	getAnyGitHubSession(options?: AuthenticationGetSessionOptions): Promise<AuthenticationSession | undefined>;
+
+	/**
+	 * Checks if there is currently a permissive session available in the cache. Does not make any network requests and does not
+	 * call out to the underlying authentication provider.
+	 *
+	 * @note See {@link getPermissiveGitHubToken} for more information and for an async version by calling {@link getPermissiveGitHubSession} with `{ silent: true }`.
+	 * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
+	 * @returns undefined if no auth session is available or Minimal Mode is enabled. Otherwise, returns an auth session with the `repo` scope.
+	 */
+	readonly permissiveGitHubSession: AuthenticationSession | undefined;
+	/**
+	 * Returns a currently valid permissive GitHub session, also known as session or auth session. Skips the cache and calls
+	 * the underlying authentication provider using the options passed in.
+	 *
+	 * @note We have the {@link IAuthenticationChatUpgradeService} to upgrade the session to a permissive one. Use this for confirmation in Chat/Edits instead of showing the modal.
+	 * @note You should typically use the synchronous version {@link getPermissiveGitHubToken} if you are fetching a session silently.
+	 * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
+	 * @note This token will have at least the `repo` scope to be able to access the extended features of the Copilot API.
+	 * @returns an auth session or undefined if none is found.
+	 * @throws MinimalModeError {@link MinimalModeError} if the authentication service is in minimal mode.
+	 */
+	getPermissiveGitHubSession(options: AuthenticationGetSessionOptions): Promise<AuthenticationSession | undefined>;
+
+	/**
+	 * Checks if there is currently a Copilot token available in the cache. Does not make any network requests.
+	 * See {@link getCopilotToken} for more information and for an async version.
+	 *
+	 * @note we omit token here because it is possibly expired. If you need it, use {@link getCopilotToken} instead as it includes a refresh mechanism.
+	 * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
+	 */
+	readonly copilotToken: Omit<CopilotToken, 'token'> | undefined;
+
+
+	/**
+	 * Return the token needed to authenticate with the speculative decoding endpoint.
+	 * This token is public as it is set via a request to the ChatMLFetcher and reset either via expiration or a 403 response from the SD endpoint.
+	 * @note There is no guarantee this is a valid token and it can still reject due to 403 with the SD endpoint
+	 */
+	speculativeDecodingEndpointToken: string | undefined;
+
+	/**
+	 * Return a currently valid Copilot token, retrieving a fresh one if
+	 * necessary.
+	 *
+	 * @param force will force a refresh of the token, even if not expired
+	 * @returns a Copilot token or throws an error if none is found.
+	 * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
+	 */
+	getCopilotToken(force?: boolean): Promise<CopilotToken>;
+
+	/**
+	 * Drop the current Copilot token as we received an HTTP error while trying
+	 * to use it that indicates it's no longer valid.
+	 */
+	resetCopilotToken(httpError?: number): void;
+
+	/**
+	 * Fired when the authentication state changes for ado.
+	 */
+	readonly onDidAdoAuthenticationChange: Event<void>;
+
+	/**
+	 * Returns a valid Azure DevOps session for the user
+	 */
+	getAdoAccessTokenBase64(options?: AuthenticationGetSessionOptions): Promise<string | undefined>;
+}
+
+export abstract class BaseAuthenticationService extends Disposable implements IAuthenticationService {
+	declare readonly _serviceBrand: undefined;
+
+	protected readonly _onDidAuthenticationChange = this._register(new Emitter<void>());
+	readonly onDidAuthenticationChange: Event<void> = this._onDidAuthenticationChange.event;
+
+	protected readonly _onDidAccessTokenChange = this._register(new Emitter<void>());
+	readonly onDidAccessTokenChange: Event<void> = this._onDidAccessTokenChange.event;
+
+	protected readonly _onDidAdoAuthenticationChange = this._register(new Emitter<void>());
+	readonly onDidAdoAuthenticationChange: Event<void> = this._onDidAdoAuthenticationChange.event;
+
+	constructor(
+		@ILogService protected readonly _logService: ILogService,
+		@ICopilotTokenStore protected readonly _tokenStore: ICopilotTokenStore,
+		@ICopilotTokenManager private readonly _tokenManager: ICopilotTokenManager,
+		@IConfigurationService protected readonly _configurationService: IConfigurationService,
+	) {
+		super();
+		this._register(_tokenManager.onDidCopilotTokenRefresh(() => {
+			this._logService.debug('Handling CopilotToken refresh.');
+			void this._handleAuthChangeEvent();
+		}));
+	}
+
+	//#region isMinimalMode
+
+	protected _isMinimalMode = derived(r => this._configurationService.getConfigObservable(ConfigKey.Shared.AuthPermissions).read(r) === AuthPermissionMode.Minimal);
+	get isMinimalMode(): boolean {
+		return this._isMinimalMode.get();
+	}
+
+	//#endregion
+
+	//#region Any GitHub Token
+
+	protected _anyGitHubSession: AuthenticationSession | undefined;
+	get anyGitHubSession(): AuthenticationSession | undefined {
+		return this._anyGitHubSession;
+	}
+	abstract getAnyGitHubSession(options?: AuthenticationGetSessionOptions): Promise<AuthenticationSession | undefined>;
+
+	//#endregion
+
+	//#region Permissive GitHub Token
+
+	protected _permissiveGitHubSession: AuthenticationSession | undefined;
+	get permissiveGitHubSession(): AuthenticationSession | undefined {
+		return this._permissiveGitHubSession;
+	}
+	abstract getPermissiveGitHubSession(options: AuthenticationGetSessionOptions): Promise<AuthenticationSession | undefined>;
+
+	//#endregion
+
+	//#region Ado
+
+	protected _anyAdoSession: AuthenticationSession | undefined;
+	get anyAdoSession(): AuthenticationSession | undefined {
+		return this._anyAdoSession;
+	}
+	protected abstract getAnyAdoSession(options?: AuthenticationGetSessionOptions): Promise<AuthenticationSession | undefined>;
+
+	//#endregion
+
+	//#region Copilot Token
+
+	private _copilotTokenError: Error | undefined;
+	get copilotToken(): CopilotToken | undefined {
+		return this._tokenStore.copilotToken;
+	}
+	async getCopilotToken(force?: boolean): Promise<CopilotToken> {
+		try {
+			await this.getAnyGitHubSession({ silent: true });
+			// TODO: could this take in an auth session?
+			const token = await this._tokenManager.getCopilotToken(force);
+			this._tokenStore.copilotToken = token;
+			this._copilotTokenError = undefined;
+			return token;
+		} catch (afterError) {
+			this._tokenStore.copilotToken = undefined;
+			const beforeError = this._copilotTokenError;
+			this._copilotTokenError = afterError;
+			// This handles the case where the user still can't get a Copilot Token,
+			// but the error has change. I.e. They go from being not signed in (no copilot token can be minted)
+			// to an account that doesn't have a valid subscription (no copilot token can be minted).
+			// NOTE: if either error is undefined, this event should be fired elsewhere already.
+			if (beforeError && afterError && beforeError.message !== afterError.message) {
+				this._onDidAuthenticationChange.fire();
+			}
+			throw afterError;
+		}
+	}
+
+	resetCopilotToken(httpError?: number): void {
+		this._tokenStore.copilotToken = undefined;
+		this._tokenManager.resetCopilotToken(httpError);
+	}
+
+	//#endregion
+
+	// #region Speculative decoding endpoint token
+	public speculativeDecodingEndpointToken: string | undefined;
+	// #endregion
+
+	//#region ADO Token
+	abstract getAdoAccessTokenBase64(options?: AuthenticationGetSessionOptions): Promise<string | undefined>
+	//#endregion
+
+	protected async _handleAuthChangeEvent(): Promise<void> {
+		const anyGitHubSessionBefore = this._anyGitHubSession;
+		const permissiveGitHubSessionBefore = this._permissiveGitHubSession;
+		const anyAdoSessionBefore = this._anyAdoSession;
+		const copilotTokenBefore = this._tokenStore.copilotToken;
+		const copilotTokenErrorBefore = this._copilotTokenError;
+
+		// Update caches
+		const resolved = await Promise.allSettled([
+			this.getAnyGitHubSession({ silent: true }),
+			this.getPermissiveGitHubSession({ silent: true }),
+			this.getAnyAdoSession({ silent: true }),
+		]);
+		for (const res of resolved) {
+			if (res.status === 'rejected') {
+				this._logService.error(`Error getting a session: ${res.reason}`);
+			}
+		}
+
+		if (
+			anyGitHubSessionBefore?.accessToken !== this._anyGitHubSession?.accessToken ||
+			permissiveGitHubSessionBefore?.accessToken !== this._permissiveGitHubSession?.accessToken
+		) {
+			this._onDidAccessTokenChange.fire();
+			this._logService.debug('Auth state changed, minting a new CopilotToken...');
+			// The auth state has changed, so mint a new Copilot token
+			try {
+				await this.getCopilotToken(true);
+			} catch (e) {
+				// Ignore errors
+			}
+			this._logService.debug('Minted a new CopilotToken.');
+			return;
+		}
+
+		if (anyAdoSessionBefore?.accessToken !== this._anyAdoSession?.accessToken) {
+			this._logService.debug(`Ado auth state changed, firing event. Had token before: ${!!anyAdoSessionBefore?.accessToken}. Has token now: ${!!this._anyAdoSession?.accessToken}.`);
+			this._onDidAdoAuthenticationChange.fire();
+		}
+
+		// Auth state hasn't changed, but the Copilot token might have
+		try {
+			await this.getCopilotToken();
+		} catch (e) {
+			// Ignore errors
+		}
+
+		if (copilotTokenBefore?.token !== this._tokenStore.copilotToken?.token ||
+			// React to errors changing too (i.e. I go from zero session to a session that doesn't have Copilot access)
+			copilotTokenErrorBefore?.message !== this._copilotTokenError?.message
+		) {
+			this._logService.debug('CopilotToken state changed, firing event.');
+			this._onDidAuthenticationChange.fire();
+		}
+		this._logService.debug('Finished handling auth change event.');
+	}
+}

package/src/_internal/platform/authentication/common/copilotToken.ts

@@ -0,0 +1,300 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import { CopilotUserQuotaInfo } from '../../chat/common/chatQuotaService';
+
+/**
+ * A function used to determine if the org list contains an internal organization
+ * @param orgList The list of organizations the user is a member of
+ * Whether or not it contains an internal org
+ */
+export function containsInternalOrg(orgList: string[]): boolean {
+	return containsGitHubOrg(orgList) || containsMicrosoftOrg(orgList);
+}
+
+/**
+ * A function used to determine if the org list contains a GitHub organization
+ * @param orgList The list of organizations the user is a member of
+ * Whether or not it contains a GitHub org
+ */
+function containsGitHubOrg(orgList: string[]): boolean {
+	const GITHUB_ORGANIZATIONS = ['4535c7beffc844b46bb1ed4aa04d759a'];
+	// Check if the user is part of an allowed organization.
+	for (const org of orgList) {
+		if (GITHUB_ORGANIZATIONS.includes(org)) {
+			return true;
+		}
+	}
+	return false;
+}
+
+/**
+ * A function used to determine if the org list contains a Microsoft organization
+ * @param orgList The list of organizations the user is a member of
+ * Whether or not it contains a Microsoft org
+ */
+function containsMicrosoftOrg(orgList: string[]): boolean {
+	const MICROSOFT_ORGANIZATIONS = ['a5db0bcaae94032fe715fb34a5e4bce2', '7184f66dfcee98cb5f08a1cb936d5225',
+		'1cb18ac6eedd49b43d74a1c5beb0b955', 'ea9395b9a9248c05ee6847cbd24355ed'];
+	// Check if the user is part of a Microsoft organization.
+	for (const org of orgList) {
+		if (MICROSOFT_ORGANIZATIONS.includes(org)) {
+			return true;
+		}
+	}
+	return false;
+}
+
+export class CopilotToken {
+	private readonly tokenMap: Map<string, string>;
+	constructor(private readonly _info: ExtendedTokenInfo) {
+		this.tokenMap = this.parseToken(_info.token);
+	}
+
+	private parseToken(token: string): Map<string, string> {
+		const result = new Map<string, string>();
+		const firstPart = token?.split(':')[0];
+		const fields = firstPart?.split(';');
+		for (const field of fields) {
+			const [key, value] = field.split('=');
+			result.set(key, value);
+		}
+		return result;
+	}
+
+	get token(): string {
+		return this._info.token;
+	}
+
+	get sku(): string | undefined {
+		return this._info.sku;
+	}
+
+	/**
+	 * Evaluates `has_cfi_access?` which is defined as `!has_cfb_access? && !has_cfe_access?`
+	 * (cfb = copilot for business, cfe = copilot for enterprise).
+	 * So it's also true for copilot free users.
+	 */
+	get isIndividual(): boolean {
+		return this._info.individual ?? false;
+	}
+
+	get organizationList(): string[] {
+		return this._info.organization_list || [];
+	}
+
+	get enterpriseList(): number[] {
+		return this._info.enterprise_list || [];
+	}
+
+	get endpoints(): { api: string; telemetry: string; proxy: string; 'origin-tracker'?: string } | undefined {
+		return this._info.endpoints;
+	}
+
+	get isInternal() {
+		return containsInternalOrg(this.organizationList);
+	}
+
+	get isMicrosoftInternal(): boolean {
+		return containsMicrosoftOrg(this.organizationList);
+	}
+
+	get isGitHubInternal(): boolean {
+		return containsGitHubOrg(this.organizationList);
+	}
+
+	get isFreeUser(): boolean {
+		return this.sku === 'free_limited_copilot';
+	}
+
+	get isChatQuotaExceeded(): boolean {
+		return this.isFreeUser && (this._info.limited_user_quotas?.chat ?? 1) <= 0;
+	}
+
+	get isCompletionsQuotaExceeded(): boolean {
+		return this.isFreeUser && (this._info.limited_user_quotas?.completions ?? 1) <= 0;
+	}
+
+	get codeQuoteEnabled(): boolean {
+		return this._info.code_quote_enabled ?? false;
+	}
+
+	get isVscodeTeamMember(): boolean {
+		return this._info.isVscodeTeamMember;
+	}
+
+	get copilotPlan(): 'free' | 'individual' | 'individual_pro' | 'business' | 'enterprise' {
+		if (this.isFreeUser) {
+			return 'free';
+		}
+		const plan = this._info.copilot_plan;
+		switch (plan) {
+			case 'individual':
+			case 'individual_pro':
+			case 'business':
+			case 'enterprise':
+				return plan;
+			default:
+				// Default to 'individual' for unexpected values
+				return 'individual';
+		}
+	}
+
+	get quotaInfo() {
+		return { quota_snapshots: this._info.quota_snapshots, quota_reset_date: this._info.quota_reset_date };
+	}
+
+	get username(): string {
+		return this._info.username;
+	}
+
+	private _isTelemetryEnabled: boolean | undefined;
+	isTelemetryEnabled(): boolean {
+		if (this._isTelemetryEnabled === undefined) {
+			this._isTelemetryEnabled = this._info.telemetry === 'enabled';
+		}
+		return this._isTelemetryEnabled;
+	}
+
+	private _isPublicSuggestionsEnabled: boolean | undefined;
+	isPublicSuggestionsEnabled(): boolean {
+		if (this._isPublicSuggestionsEnabled === undefined) {
+			this._isPublicSuggestionsEnabled = this._info.public_suggestions === 'enabled';
+		}
+		return this._isPublicSuggestionsEnabled;
+	}
+
+	isChatEnabled(): boolean {
+		return this._info.chat_enabled ?? false;
+	}
+
+	isCopilotIgnoreEnabled(): boolean {
+		return this._info.copilotignore_enabled ?? false;
+	}
+
+	get isCopilotCodeReviewEnabled(): boolean {
+		return (this.getTokenValue('ccr') === '1');
+	}
+
+	isEditorPreviewFeaturesEnabled(): boolean {
+		// Editor preview features are disabled if the flag is present and set to 0
+		return this.getTokenValue('editor_preview_features') !== '0';
+	}
+
+	isMcpEnabled(): boolean {
+		// MCP is disabled if the flag is present and set to 0
+		return this.getTokenValue('mcp') !== '0';
+	}
+
+	getTokenValue(key: string): string | undefined {
+		return this.tokenMap.get(key);
+	}
+
+	isExpandedClientSideIndexingEnabled(): boolean {
+		return this._info.blackbird_clientside_indexing === true;
+	}
+}
+
+/**
+ * Details of the user's telemetry consent status we get from the server during token retrieval.
+ *
+ * `unconfigured` is a transitional state for pre-GA that indicates the user is in the Technical Preview
+ * and needs to be asked about telemetry consent client-side. It can be removed post-GA as the server
+ * will never return it again.
+ *
+ * `enabled` indicates that they agreed to full telemetry.
+ *
+ * `disabled` indicates that they opted out of full telemetry so we can only send the core messages
+ * that users cannot opt-out of.
+ *
+ */
+export type UserTelemetryChoice = 'enabled' | 'disabled';
+/**
+ * A notification we get from the server during token retrieval. Needs to be presented to the user.
+ */
+type ServerSideNotification = {
+	message: string;
+	url: string;
+	title: string;
+};
+/**
+ * A notification that warns the user about upcoming problems.
+ */
+type WarningNotification = ServerSideNotification & {
+	notification_id: string;
+};
+/**
+ * A notification in case of an error.
+ */
+type ErrorNotification = ServerSideNotification;
+/**
+ * A server response containing a Copilot token and metadata associated with it.
+ */
+export interface TokenInfo {
+	// v2 format: fields:mac
+	//   fields are ';' separated key=value pairs, including tid (tracking_id), dom (domain), and exp (unix_time).
+	token: string;
+	expires_at: number; // unix time UTC in seconds
+	refresh_in: number; // seconds to refresh token
+	user_notification?: WarningNotification;
+	error_details?: ErrorNotification;
+	organization_list?: string[];
+	code_quote_enabled?: boolean;
+	public_suggestions?: string;
+	telemetry?: string;
+	copilotignore_enabled?: boolean;
+	endpoints?: { api: string; telemetry: string; proxy: string; 'origin-tracker'?: string };
+	chat_enabled?: boolean;
+	limited_user_quotas?: { chat: number; completions: number };
+	enterprise_list?: number[];
+	individual?: boolean;
+	sku?: string; // e.g. 'copilot_enterprise_seat'
+	message?: string; // error message
+}
+
+/**
+ * A server response containing the user info for the copilot user from the /copilot_internal/user endpoint
+ */
+
+export interface CopilotUserInfo extends CopilotUserQuotaInfo {
+	access_type_sku: string;
+	analytics_tracking_id: string;
+	assigned_date: string;
+	can_signup_for_limited: boolean;
+	chat_enabled: boolean;
+	copilot_plan: string;
+	organization_login_list: string[];
+	organization_list: Array<{
+		login: string;
+		name: string | null;
+	}>;
+}
+
+// The token info extended with additional metadata that is helpful to have
+export type ExtendedTokenInfo = TokenInfo & { username: string; isVscodeTeamMember: boolean; blackbird_clientside_indexing?: boolean } & Pick<CopilotUserInfo, 'copilot_plan' | 'quota_snapshots' | 'quota_reset_date'>;
+
+export type TokenEnvelope = Omit<TokenInfo, 'token' | 'organization_list'>;
+
+export type TokenErrorReason = 'NotAuthorized' | 'FailedToGetToken' | 'TokenInvalid' | 'GitHubLoginFailed' | 'HTTP401' | 'RateLimited';
+
+export enum TokenErrorNotificationId {
+	EnterPriseManagedUserAccount = 'enterprise_managed_user_account',
+	NotSignedUp = 'not_signed_up',
+	NoCopilotAccess = 'no_copilot_access',
+	SubscriptionEnded = 'subscription_ended',
+	ServerError = 'server_error',
+	FeatureFlagBlocked = 'feature_flag_blocked',
+	SpammyUser = 'spammy_user',
+	CodespacesDemoInactive = 'codespaces_demo_inactive', //TODO: Handle this if this is still applicable
+	SnippyNotConfigured = 'snippy_not_configured'
+}
+
+export type TokenError = {
+	reason: TokenErrorReason;
+	notification_id?: TokenErrorNotificationId;
+	message?: string; // TODO: not used yet, but will be for 466 errors
+};
+
+export type TokenInfoOrError = ({ kind: 'success' } & ExtendedTokenInfo) | ({ kind: 'failure' } & TokenError);