agent-messenger 2.27.2 → 2.29.0

package/src/platforms/teams/realm-discovery.ts

@@ -0,0 +1,42 @@
+import { GET_CREDENTIAL_TYPE_URL } from './app-config'
+import type { TeamsAccountType } from './types'
+
+// GetCredentialType (the endpoint Microsoft's own login page calls) reports
+// EstsProperties.DomainType, which distinguishes a personal account from a
+// work account before any device code is issued.
+const DOMAIN_TYPE_CONSUMER = 2
+
+interface CredentialTypeResponse {
+  IfExistsResult?: number
+  EstsProperties?: {
+    DomainType?: number
+    IsConsumerDomain?: boolean
+  }
+}
+
+// Returns the account type for an email, or undefined when it can't be
+// determined (network error, throttling, unknown domain) so the caller can
+// fall back to its default flow rather than block sign-in.
+export async function probeAccountType(email: string): Promise<TeamsAccountType | undefined> {
+  let body: CredentialTypeResponse
+  try {
+    const res = await fetch(GET_CREDENTIAL_TYPE_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ Username: email }),
+    })
+    if (!res.ok) return undefined
+    body = (await res.json()) as CredentialTypeResponse
+  } catch {
+    return undefined
+  }
+
+  const ests = body.EstsProperties
+  if (ests?.DomainType === DOMAIN_TYPE_CONSUMER || ests?.IsConsumerDomain === true) {
+    return 'personal'
+  }
+  if (typeof ests?.DomainType === 'number') {
+    return 'work'
+  }
+  return undefined
+}

package/src/platforms/teams/token-extractor.ts

@@ -49,6 +49,12 @@ const TEAMS_HOST_PATTERNS = [
   '.microsoft.com',
 ]
 
+// The trouter real-time WebSocket needs an OAuth Bearer token (a JWE) for its
+// user.authenticate step. Teams stores it in the `authtoken` cookie, prefixed
+// with "Bearer=" and URL-encoded.
+const AUTHTOKEN_COOKIE_NAME = 'authtoken'
+const AUTHTOKEN_HOST_PATTERNS = ['teams.live.com', 'teams.microsoft.com']
+
 const TEAMS_KEYCHAIN_VARIANTS: KeychainVariant[] = [
   { service: 'Microsoft Teams Safe Storage', account: 'Microsoft Teams' },
   {
@@ -252,6 +258,69 @@ export class TeamsTokenExtractor {
     return this.extractFromCookiesDB()
   }
 
+  async extractIdToken(accountType?: TeamsAccountType): Promise<string | null> {
+    await this.decryptor.loadCachedKey()
+
+    const desktopPaths = this.getDesktopCookiesPaths().filter(
+      (p) => accountType === undefined || !p.accountTypeKnown || p.accountType === accountType,
+    )
+    const candidatePaths = [...desktopPaths, ...this.getBrowserCookiesPaths()]
+
+    for (const { path: dbPath } of candidatePaths) {
+      if (!dbPath || !existsSync(dbPath)) continue
+
+      const bearer = await this.extractAuthTokenFromSQLite(dbPath)
+      if (bearer) return bearer
+    }
+
+    return null
+  }
+
+  private async extractAuthTokenFromSQLite(dbPath: string): Promise<string | null> {
+    try {
+      let localStatePath: string | undefined
+      if (this.platform === 'win32') {
+        localStatePath = findLocalStatePath(dbPath) ?? undefined
+      }
+
+      for (const hostPattern of AUTHTOKEN_HOST_PATTERNS) {
+        const sql = `
+          SELECT value, encrypted_value
+          FROM cookies
+          WHERE name = '${AUTHTOKEN_COOKIE_NAME}'
+          AND host_key LIKE '%${hostPattern}%'
+          LIMIT 1
+        `
+
+        type CookieRow = { value?: string; encrypted_value?: Uint8Array | Buffer } | null
+        const row = await this.cookieReader.queryFirst<CookieRow>(dbPath, sql)
+        if (!row) continue
+
+        let value = row.value ?? ''
+        if ((!value || value.length < 20) && row.encrypted_value && row.encrypted_value.length > 0) {
+          const decrypted = this.decryptor.decryptCookieRaw(Buffer.from(row.encrypted_value), localStatePath)
+          if (!decrypted) continue
+          value = ChromiumCookieDecryptor.stripIntegrityHash(decrypted).toString('utf8')
+        }
+
+        const bearer = this.normalizeAuthToken(value)
+        if (bearer) return bearer
+      }
+
+      return null
+    } catch (error) {
+      this.debug(`    authtoken query error: ${(error as Error).message}`)
+      return null
+    }
+  }
+
+  private normalizeAuthToken(rawValue: string): string | null {
+    if (!rawValue) return null
+    const decoded = decodeURIComponent(rawValue)
+    const token = decoded.replace(/^Bearer=/i, '').trim()
+    return token.length > 20 ? token : null
+  }
+
   async clearKeyCache(): Promise<void> {
     await this.decryptor.clearKeyCache()
   }

package/src/platforms/teams/token-provider.test.ts

@@ -0,0 +1,227 @@
+import { afterAll, afterEach, describe, expect, it, mock } from 'bun:test'
+import { rmSync } from 'node:fs'
+import { join } from 'node:path'
+
+import { TeamsCredentialManager } from './credential-manager'
+import { TeamsTokenProvider } from './token-provider'
+import { TeamsAuthCapabilityError } from './types'
+
+const TENANT_ID = '11111111-1111-1111-1111-111111111111'
+const USER_ID = '22222222-2222-2222-2222-222222222222'
+const CLIENT_ID = '1fec8e78-bce4-4aaf-ab1b-5451cc387264'
+const SUBSTRATE_AUD = 'https://substrate.office.com'
+const GRAPH_AUD = 'https://graph.microsoft.com'
+const originalFetch = globalThis.fetch
+const testDirs: string[] = []
+
+interface FetchCall {
+  url: string
+  init: RequestInit
+  body: URLSearchParams
+}
+
+interface TokenResponseConfig {
+  aud: string
+  refreshToken: string
+  expiresIn?: number
+  marker?: string
+}
+
+function setup(): TeamsCredentialManager {
+  const dir = join(import.meta.dir, `.test-teams-provider-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+  testDirs.push(dir)
+  return new TeamsCredentialManager(dir)
+}
+
+async function seedDeviceAccount(manager: TeamsCredentialManager, refreshToken = 'old-refresh'): Promise<void> {
+  await manager.setDeviceCodeAccount({
+    accountType: 'work',
+    token: 'skype-token',
+    tokenExpiresAt: '2100-01-01T00:00:00Z',
+    aadRefreshToken: refreshToken,
+    aadClientId: CLIENT_ID,
+    teams: {},
+    currentTeam: null,
+  })
+}
+
+async function seedPersonalDeviceAccount(
+  manager: TeamsCredentialManager,
+  refreshToken = 'personal-refresh',
+): Promise<void> {
+  await manager.setDeviceCodeAccount({
+    accountType: 'personal',
+    token: 'personal-skype-token',
+    tokenExpiresAt: '2100-01-01T00:00:00Z',
+    aadRefreshToken: refreshToken,
+    aadClientId: CLIENT_ID,
+    teams: {},
+    currentTeam: null,
+  })
+}
+
+function createJwt(aud: string, marker = 'token'): string {
+  const header = Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url')
+  const payload = Buffer.from(
+    JSON.stringify({ aud, tid: TENANT_ID, oid: USER_ID, exp: Math.floor(Date.now() / 1000) + 3600, jti: marker }),
+  ).toString('base64url')
+  return `${header}.${payload}.signature`
+}
+
+function bodyParams(body: BodyInit | null | undefined): URLSearchParams {
+  if (body instanceof URLSearchParams) return body
+  if (typeof body === 'string') return new URLSearchParams(body)
+  return new URLSearchParams()
+}
+
+function headerValue(init: RequestInit, name: string): string | undefined {
+  const headers = init.headers
+  if (headers instanceof Headers) return headers.get(name) ?? undefined
+  if (Array.isArray(headers)) {
+    const pair = headers.find(([key]) => key.toLowerCase() === name.toLowerCase())
+    return pair?.[1]
+  }
+  return headers?.[name]
+}
+
+function mockTokenResponses(responses: TokenResponseConfig[]): { calls: FetchCall[] } {
+  const calls: FetchCall[] = []
+  const queue = [...responses]
+  globalThis.fetch = mock((input: string | URL | Request, init?: RequestInit) => {
+    const requestInit = init ?? {}
+    calls.push({ url: String(input), init: requestInit, body: bodyParams(requestInit.body) })
+    const next = queue.shift()
+    if (!next) {
+      return Promise.resolve(new Response(JSON.stringify({ error: 'no_mock_response' }), { status: 500 }))
+    }
+    return Promise.resolve(
+      new Response(
+        JSON.stringify({
+          access_token: createJwt(next.aud, next.marker),
+          refresh_token: next.refreshToken,
+          expires_in: next.expiresIn ?? 3600,
+        }),
+        { status: 200, headers: { 'Content-Type': 'application/json' } },
+      ),
+    )
+  }) as typeof fetch
+  return { calls }
+}
+
+afterEach(() => {
+  globalThis.fetch = originalFetch
+})
+
+afterAll(() => {
+  for (const dir of testDirs) rmSync(dir, { recursive: true, force: true })
+})
+
+describe('TeamsTokenProvider', () => {
+  it('refresh-exchanges substrate tokens with Origin and persists rotated refresh tokens', async () => {
+    const manager = setup()
+    await seedDeviceAccount(manager)
+    const { calls } = mockTokenResponses([{ aud: SUBSTRATE_AUD, refreshToken: 'rotated-refresh' }])
+
+    const provider = new TeamsTokenProvider(manager)
+    const token = await provider.getSubstrateToken()
+
+    expect(token).toContain('.signature')
+    expect(calls[0].url).toContain('/organizations/oauth2/v2.0/token')
+    expect(calls[0].body.get('grant_type')).toBe('refresh_token')
+    expect(calls[0].body.get('client_id')).toBe(CLIENT_ID)
+    expect(calls[0].body.get('refresh_token')).toBe('old-refresh')
+    expect(calls[0].body.get('scope')).toBe('https://substrate.office.com/.default offline_access')
+    expect(headerValue(calls[0].init, 'Origin')).toBe('https://teams.microsoft.com')
+
+    const config = await manager.loadConfig()
+    expect(config?.accounts.work?.aad_refresh_token).toBe('rotated-refresh')
+  })
+
+  it('throws when the acquired token audience does not match the requested audience', async () => {
+    const manager = setup()
+    await seedDeviceAccount(manager)
+    mockTokenResponses([{ aud: GRAPH_AUD, refreshToken: 'rotated-refresh' }])
+
+    const provider = new TeamsTokenProvider(manager)
+    await expect(provider.getSubstrateToken()).rejects.toThrow(/audience/i)
+  })
+
+  it('throws TeamsAuthCapabilityError for cookie-only credentials', async () => {
+    const manager = setup()
+    await manager.setToken('skype-token', 'work', '2100-01-01T00:00:00Z')
+
+    const provider = new TeamsTokenProvider(manager)
+    await expect(provider.getSubstrateToken()).rejects.toThrow(TeamsAuthCapabilityError)
+    await expect(provider.getSubstrateToken()).rejects.toThrow(/auth login/)
+  })
+
+  it('uses the in-memory cache until the five-minute refresh buffer', async () => {
+    const manager = setup()
+    await seedDeviceAccount(manager)
+    const { calls } = mockTokenResponses([{ aud: SUBSTRATE_AUD, refreshToken: 'rotated-refresh', marker: 'cached' }])
+
+    const provider = new TeamsTokenProvider(manager)
+    const first = await provider.getSubstrateToken()
+    const second = await provider.getSubstrateToken()
+
+    expect(second).toBe(first)
+    expect(calls).toHaveLength(1)
+  })
+
+  it('refreshes cached tokens inside the five-minute buffer', async () => {
+    const manager = setup()
+    await seedDeviceAccount(manager)
+    const { calls } = mockTokenResponses([
+      { aud: SUBSTRATE_AUD, refreshToken: 'near-expiry-refresh', expiresIn: 299, marker: 'near-expiry' },
+      { aud: SUBSTRATE_AUD, refreshToken: 'fresh-refresh', expiresIn: 3600, marker: 'fresh' },
+    ])
+
+    const provider = new TeamsTokenProvider(manager)
+    const first = await provider.getSubstrateToken()
+    const second = await provider.getSubstrateToken()
+
+    expect(second).not.toBe(first)
+    expect(calls).toHaveLength(2)
+    const config = await manager.loadConfig()
+    expect(config?.accounts.work?.aad_refresh_token).toBe('fresh-refresh')
+  })
+
+  it('does not reuse bearer tokens across bound accounts', async () => {
+    const manager = setup()
+    await seedDeviceAccount(manager, 'work-refresh')
+    await seedPersonalDeviceAccount(manager, 'personal-refresh')
+    const { calls } = mockTokenResponses([
+      { aud: SUBSTRATE_AUD, refreshToken: 'work-rotated-refresh', marker: 'work-token' },
+      { aud: SUBSTRATE_AUD, refreshToken: 'personal-rotated-refresh', marker: 'personal-token' },
+    ])
+
+    const provider = new TeamsTokenProvider(manager)
+    const workToken = await provider.bindAccount('work').getSubstrateToken()
+    const personalToken = await provider.bindAccount('personal').getSubstrateToken()
+
+    expect(personalToken).not.toBe(workToken)
+    expect(calls).toHaveLength(2)
+    expect(calls[0].body.get('refresh_token')).toBe('work-refresh')
+    expect(calls[1].body.get('refresh_token')).toBe('personal-refresh')
+  })
+
+  it('restores tenant/user identity on a cached bearer hit after switching accounts back', async () => {
+    const manager = setup()
+    await seedDeviceAccount(manager, 'work-refresh')
+    await seedPersonalDeviceAccount(manager, 'personal-refresh')
+    mockTokenResponses([
+      { aud: SUBSTRATE_AUD, refreshToken: 'work-rotated', marker: 'work-token' },
+      { aud: SUBSTRATE_AUD, refreshToken: 'personal-rotated', marker: 'personal-token' },
+    ])
+
+    const provider = new TeamsTokenProvider(manager)
+    // work mints + caches (identity set), personal switch resets identity,
+    // then work again is served from cache and must re-restore identity
+    await provider.bindAccount('work').getSubstrateToken()
+    await provider.bindAccount('personal').getSubstrateToken()
+    await provider.bindAccount('work').getSubstrateToken()
+
+    expect(await provider.getTenantId()).toBe(TENANT_ID)
+    expect(await provider.getUserId()).toBe(USER_ID)
+  })
+})

package/src/platforms/teams/token-provider.ts

@@ -0,0 +1,284 @@
+import {
+  AAD_AUDIENCE_GRAPH,
+  AAD_AUDIENCE_SUBSTRATE,
+  AAD_SCOPE_GRAPH,
+  AAD_SCOPE_SUBSTRATE,
+  consumerTokenUrl,
+  getTeamsAppClientId,
+  organizationsTokenUrl,
+  TEAMS_WEB_ORIGIN,
+} from './app-config'
+import { TeamsCredentialManager } from './credential-manager'
+import type { TeamsAccount, TeamsAccountType } from './types'
+import { TeamsAuthCapabilityError, TeamsError } from './types'
+
+export type TokenAudience = 'skype' | 'substrate' | 'graph'
+
+type BearerAudience = Exclude<TokenAudience, 'skype'>
+
+interface CachedToken {
+  accessToken: string
+  expiresAt: number
+  aud: string
+  tenantId?: string
+  userId?: string
+}
+
+type CacheKey = TokenAudience | `${TeamsAccountType}:${BearerAudience}`
+
+interface CurrentAccountContext {
+  accountType: TeamsAccountType
+  account: TeamsAccount
+}
+
+interface BearerAudienceConfig {
+  scope: string
+  aud: string
+}
+
+interface JwtClaims {
+  aud?: string
+  tid?: string
+  oid?: string
+  exp?: number
+  [key: string]: unknown
+}
+
+const REFRESH_BUFFER_MS = 5 * 60 * 1000
+const DEFAULT_ACCESS_TOKEN_TTL_SEC = 3600
+
+const BEARER_AUDIENCES: Record<BearerAudience, BearerAudienceConfig> = {
+  substrate: { scope: AAD_SCOPE_SUBSTRATE, aud: AAD_AUDIENCE_SUBSTRATE },
+  graph: { scope: AAD_SCOPE_GRAPH, aud: AAD_AUDIENCE_GRAPH },
+}
+
+export class TeamsTokenProvider {
+  private cache: Map<CacheKey, CachedToken> = new Map()
+  private tenantId?: string
+  private userId?: string
+  private boundAccountType?: TeamsAccountType
+  private lastAccountType?: TeamsAccountType
+
+  constructor(private credManager: TeamsCredentialManager = new TeamsCredentialManager()) {}
+
+  bindAccount(accountType: TeamsAccountType): this {
+    this.boundAccountType = accountType
+    return this
+  }
+
+  async getSkypeToken(): Promise<string> {
+    const cached = this.getCached('skype')
+    if (cached) return cached.accessToken
+
+    const cred = await this.credManager.getTokenWithExpiry()
+    if (!cred?.token) {
+      throw new TeamsError(
+        'No Teams credentials found. Run `agent-teams auth login` or `agent-teams auth extract`.',
+        'no_credentials',
+      )
+    }
+
+    const expiresAt = cred.tokenExpiresAt ? new Date(cred.tokenExpiresAt).getTime() : Number.POSITIVE_INFINITY
+    if (expiresAt <= Date.now()) {
+      throw new TeamsError('Token has expired. Run "auth login" or "auth extract" to refresh.', 'token_expired')
+    }
+
+    this.cache.set('skype', { accessToken: cred.token, expiresAt, aud: 'skype' })
+    return cred.token
+  }
+
+  async getSubstrateToken(): Promise<string> {
+    return this.getBearerToken('substrate')
+  }
+
+  async getGraphToken(): Promise<string> {
+    return this.getBearerToken('graph')
+  }
+
+  async getTenantId(): Promise<string> {
+    await this.ensureIdentity()
+    if (!this.tenantId) {
+      throw new TeamsError(
+        'Microsoft token did not include a tenant id needed for Teams search.',
+        'aad_identity_missing',
+      )
+    }
+    return this.tenantId
+  }
+
+  async getUserId(): Promise<string> {
+    await this.ensureIdentity()
+    if (!this.userId) {
+      throw new TeamsError('Microsoft token did not include a user id needed for Teams search.', 'aad_identity_missing')
+    }
+    return this.userId
+  }
+
+  private getCached(key: CacheKey): CachedToken | undefined {
+    const cached = this.cache.get(key)
+    if (!cached) return undefined
+    return cached.expiresAt - Date.now() > REFRESH_BUFFER_MS ? cached : undefined
+  }
+
+  private async getBearerToken(audience: BearerAudience): Promise<string> {
+    const current = await this.getCurrentAccount()
+    this.resetIdentityIfAccountChanged(current.accountType)
+    const cacheKey: CacheKey = `${current.accountType}:${audience}`
+    const cached = this.getCached(cacheKey)
+    if (cached) {
+      // a cache hit after an account switch reset our identity, so restore the
+      // tenant/user claims captured when this token was minted
+      this.tenantId = cached.tenantId ?? this.tenantId
+      this.userId = cached.userId ?? this.userId
+      return cached.accessToken
+    }
+
+    if (!current.account.aad_refresh_token) {
+      throw new TeamsAuthCapabilityError()
+    }
+
+    const clientId = current.account.aad_client_id ?? getTeamsAppClientId(current.accountType).clientId
+    const config = BEARER_AUDIENCES[audience]
+    const token = await this.refreshBearerToken({
+      accountType: current.accountType,
+      clientId,
+      refreshToken: current.account.aad_refresh_token,
+      audience,
+      config,
+    })
+
+    this.cache.set(cacheKey, token)
+    return token.accessToken
+  }
+
+  private async refreshBearerToken(params: {
+    accountType: TeamsAccountType
+    clientId: string
+    refreshToken: string
+    audience: BearerAudience
+    config: BearerAudienceConfig
+  }): Promise<CachedToken> {
+    const response = await fetch(tokenUrlForAccount(params.accountType), {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        Origin: TEAMS_WEB_ORIGIN,
+      },
+      body: new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: params.clientId,
+        refresh_token: params.refreshToken,
+        scope: params.config.scope,
+      }),
+    })
+
+    const body = (await response.json().catch(() => ({}))) as Record<string, unknown>
+    if (!response.ok) {
+      throw new TeamsError(
+        `Microsoft token refresh failed: ${describeAadError(body, response.status)}`,
+        'aad_refresh_failed',
+      )
+    }
+
+    const accessToken = stringField(body, 'access_token')
+    if (!accessToken) {
+      throw new TeamsError('Microsoft token refresh response did not include an access token.', 'aad_access_missing')
+    }
+
+    const claims = decodeJwt(accessToken)
+    if (claims.aud !== params.config.aud) {
+      throw new TeamsError(
+        `Microsoft token audience mismatch: expected ${params.config.aud}, got ${claims.aud ?? 'missing'}.`,
+        'aad_audience_mismatch',
+      )
+    }
+
+    this.tenantId = claims.tid ?? this.tenantId
+    this.userId = claims.oid ?? this.userId
+
+    const rotatedRefreshToken = stringField(body, 'refresh_token')
+    if (rotatedRefreshToken) {
+      await this.credManager.updateAadRefreshToken(params.accountType, rotatedRefreshToken, params.clientId)
+    }
+
+    const expiresIn = numberField(body, 'expires_in') ?? DEFAULT_ACCESS_TOKEN_TTL_SEC
+    return {
+      accessToken,
+      expiresAt: Date.now() + expiresIn * 1000,
+      aud: params.config.aud,
+      tenantId: claims.tid,
+      userId: claims.oid,
+    }
+  }
+
+  private async getCurrentAccount(): Promise<CurrentAccountContext> {
+    const config = await this.credManager.loadConfig()
+    if (!config) {
+      throw new TeamsError(
+        'No Teams credentials found. Run `agent-teams auth login` or `agent-teams auth extract`.',
+        'no_credentials',
+      )
+    }
+    const accountKey = this.boundAccountType ?? TeamsCredentialManager.accountOverride ?? config.current_account
+    if (accountKey !== 'work' && accountKey !== 'personal') {
+      throw new TeamsError(
+        'No active Teams account selected. Run `agent-teams auth switch-account`.',
+        'no_current_account',
+      )
+    }
+    const account = config.accounts[accountKey]
+    if (!account) {
+      throw new TeamsError(
+        'No active Teams account selected. Run `agent-teams auth switch-account`.',
+        'no_current_account',
+      )
+    }
+    return { accountType: accountKey, account }
+  }
+
+  private resetIdentityIfAccountChanged(accountType: TeamsAccountType): void {
+    if (this.lastAccountType === accountType) return
+    this.tenantId = undefined
+    this.userId = undefined
+    this.lastAccountType = accountType
+  }
+
+  private async ensureIdentity(): Promise<void> {
+    if (this.tenantId && this.userId) return
+    await this.getSubstrateToken()
+  }
+}
+
+function tokenUrlForAccount(accountType: TeamsAccountType): string {
+  return accountType === 'personal' ? consumerTokenUrl() : organizationsTokenUrl()
+}
+
+function decodeJwt(token: string): JwtClaims {
+  const payload = token.split('.')[1]
+  if (!payload) {
+    throw new TeamsError('Microsoft token response was not a JWT.', 'aad_token_invalid')
+  }
+  const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<string, unknown>
+  return {
+    ...decoded,
+    aud: typeof decoded.aud === 'string' ? decoded.aud : undefined,
+    tid: typeof decoded.tid === 'string' ? decoded.tid : undefined,
+    oid: typeof decoded.oid === 'string' ? decoded.oid : undefined,
+    exp: typeof decoded.exp === 'number' ? decoded.exp : undefined,
+  }
+}
+
+function stringField(record: Record<string, unknown>, key: string): string | undefined {
+  const value = record[key]
+  return typeof value === 'string' ? value : undefined
+}
+
+function numberField(record: Record<string, unknown>, key: string): number | undefined {
+  const value = record[key]
+  return typeof value === 'number' ? value : undefined
+}
+
+function describeAadError(body: Record<string, unknown>, status: number): string {
+  const desc = body.error_description ?? body.error
+  return typeof desc === 'string' ? desc.split('\n')[0] : `HTTP ${status}`
+}