agent-messenger 2.28.0 → 2.29.0

package/src/platforms/teams/commands/message.ts

@@ -6,12 +6,13 @@ import { formatOutput } from '@/shared/utils/output'
 import { TeamsClient } from '../client'
 import { TeamsCredentialManager } from '../credential-manager'
 import type { TeamsMessage } from '../types'
+import { TeamsAuthCapabilityError } from '../types'
 
 export async function sendAction(
   teamId: string,
   channelId: string,
   content: string,
-  options: { pretty?: boolean },
+  options: { pretty?: boolean; thread?: string },
 ): Promise<void> {
   try {
     const credManager = new TeamsCredentialManager()
@@ -28,13 +29,15 @@ export async function sendAction(
       accountType: cred.accountType,
       region: cred.region,
     })
-    const message = await client.sendMessage(teamId, channelId, content)
+    const message = await client.sendMessage(teamId, channelId, content, options.thread)
 
     const output = {
       id: message.id,
       content: message.content,
       author: message.author.displayName,
       timestamp: message.timestamp,
+      root_message_id: message.root_message_id,
+      parent_message_id: message.parent_message_id,
     }
 
     console.log(formatOutput(output, options.pretty))
@@ -71,14 +74,122 @@ export async function listAction(
       content: msg.content,
       author: msg.author.displayName,
       timestamp: msg.timestamp,
+      root_message_id: msg.root_message_id,
+      is_thread_reply: msg.is_thread_reply,
+    }))
+
+    console.log(formatOutput(output, options.pretty))
+  } catch (error) {
+    handleError(error as Error)
+  }
+}
+
+export async function repliesAction(
+  teamId: string,
+  channelId: string,
+  messageId: string,
+  options: { limit?: number; pretty?: boolean },
+): Promise<void> {
+  try {
+    const credManager = new TeamsCredentialManager()
+    const cred = await credManager.getTokenWithExpiry()
+
+    if (!cred) {
+      console.log(formatOutput({ error: 'Not authenticated. Run "auth extract" first.' }, options.pretty))
+      process.exit(1)
+    }
+
+    const client = await new TeamsClient().login({
+      token: cred.token,
+      tokenExpiresAt: cred.tokenExpiresAt,
+      accountType: cred.accountType,
+      region: cred.region,
+    })
+    const limit = options.limit || 50
+    const replies = await client.getThreadReplies(teamId, channelId, messageId, limit)
+
+    const output = replies.map((msg: TeamsMessage) => ({
+      id: msg.id,
+      content: msg.content,
+      author: msg.author.displayName,
+      timestamp: msg.timestamp,
+      root_message_id: msg.root_message_id,
+    }))
+
+    console.log(formatOutput(output, options.pretty))
+  } catch (error) {
+    handleError(error as Error)
+  }
+}
+
+export async function searchAction(
+  query: string,
+  options: { limit?: number; from?: number; pretty?: boolean },
+): Promise<void> {
+  try {
+    if (!isPositiveInteger(options.limit)) {
+      console.error(formatOutput({ error: '--limit must be a positive integer.' }, options.pretty))
+      process.exit(1)
+    }
+    if (!isNonNegativeInteger(options.from)) {
+      console.error(formatOutput({ error: '--from must be a non-negative integer.' }, options.pretty))
+      process.exit(1)
+    }
+
+    const credManager = new TeamsCredentialManager()
+    const cred = await credManager.getTokenWithExpiry()
+
+    if (!cred) {
+      console.error(formatOutput({ error: new TeamsAuthCapabilityError().message }, options.pretty))
+      process.exit(1)
+    }
+
+    const client = await new TeamsClient().login({
+      token: cred.token,
+      tokenExpiresAt: cred.tokenExpiresAt,
+      accountType: cred.accountType,
+      region: cred.region,
+    })
+    const results = await client.searchMessages(query, { limit: options.limit, from: options.from })
+
+    const output = results.map((result) => ({
+      id: result.id,
+      content: result.content,
+      author: result.author.displayName,
+      author_id: result.author.id,
+      channel_id: result.channel_id,
+      thread_id: result.thread_id,
+      team_name: result.team_name,
+      channel_name: result.channel_name,
+      timestamp: result.timestamp,
+      permalink: result.permalink,
     }))
 
     console.log(formatOutput(output, options.pretty))
   } catch (error) {
+    if (error instanceof TeamsAuthCapabilityError) {
+      console.error(formatOutput({ error: error.message }, options.pretty))
+      process.exit(1)
+    }
     handleError(error as Error)
   }
 }
 
+function isPositiveInteger(value: number | undefined): boolean {
+  return value === undefined || (Number.isInteger(value) && value >= 1)
+}
+
+function isNonNegativeInteger(value: number | undefined): boolean {
+  return value === undefined || (Number.isInteger(value) && value >= 0)
+}
+
+// parseInt truncates "1.5"/"1abc" to 1, sneaking malformed input past the integer
+// checks in searchAction, so reject anything that isn't a pure decimal integer up front
+export function strictParseInt(value: string | undefined): number {
+  if (value === undefined) return Number.NaN
+  return /^-?\d+$/.test(value.trim()) ? Number.parseInt(value, 10) : Number.NaN
+}
+
 export async function getAction(
   teamId: string,
   channelId: string,
@@ -158,10 +269,11 @@ export const messageCommand = new Command('message')
   .description('Message commands')
   .addCommand(
     new Command('send')
-      .description('Send message to channel')
+      .description('Send message to channel (--thread <message-id> replies to a thread)')
       .argument('<team-id>', 'Team ID')
       .argument('<channel-id>', 'Channel ID')
       .argument('<content>', 'Message content')
+      .option('--thread <message-id>', 'Reply to a thread root message')
       .option('--pretty', 'Pretty print JSON output')
       .action(sendAction),
   )
@@ -179,6 +291,36 @@ export const messageCommand = new Command('message')
         })
       }),
   )
+  .addCommand(
+    new Command('replies')
+      .description('List replies for a message thread')
+      .argument('<team-id>', 'Team ID')
+      .argument('<channel-id>', 'Channel ID')
+      .argument('<message-id>', 'Message ID')
+      .option('--limit <n>', 'Number of replies to retrieve', '50')
+      .option('--pretty', 'Pretty print JSON output')
+      .action((teamId: string, channelId: string, messageId: string, options: any) => {
+        return repliesAction(teamId, channelId, messageId, {
+          limit: parseInt(options.limit, 10),
+          pretty: options.pretty,
+        })
+      }),
+  )
+  .addCommand(
+    new Command('search')
+      .description('Search Teams messages (requires auth login)')
+      .argument('<query>', 'Search query')
+      .option('--limit <n>', 'Number of results', '20')
+      .option('--from <n>', 'Offset for pagination', '0')
+      .option('--pretty', 'Pretty print JSON output')
+      .action((query: string, options: any) => {
+        return searchAction(query, {
+          limit: strictParseInt(options.limit),
+          from: strictParseInt(options.from),
+          pretty: options.pretty,
+        })
+      }),
+  )
   .addCommand(
     new Command('get')
       .description('Get a single message by ID')

package/src/platforms/teams/credential-manager.test.ts

@@ -204,4 +204,24 @@ describe('TeamsCredentialManager', () => {
     expect(config?.accounts?.work?.current_team).toBe('team-1')
     expect(config?.accounts?.work?.teams['team-1']).toEqual({ team_id: 'team-1', team_name: 'Team One' })
   })
+
+  it('setDeviceCodeAccount switches current_account to the just-authenticated account', async () => {
+    const manager = setup()
+    await manager.setToken('work-token', 'work', '2025-12-31T23:59:59Z')
+
+    await manager.setDeviceCodeAccount({
+      accountType: 'personal',
+      token: 'personal-token',
+      tokenExpiresAt: '2025-12-31T23:59:59Z',
+      aadRefreshToken: 'refresh',
+      aadClientId: 'client',
+      teams: {},
+      currentTeam: null,
+    })
+
+    const config = await manager.loadConfig()
+    expect(config?.current_account).toBe('personal')
+    expect(config?.accounts?.personal?.auth_method).toBe('device-code')
+    expect(config?.accounts?.work?.token).toBe('work-token')
+  })
 })

package/src/platforms/teams/credential-manager.ts

@@ -1,9 +1,16 @@
 import { existsSync } from 'node:fs'
-import { mkdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 
 import { getConfigDir } from '../../shared/utils/config-dir'
-import type { TeamsAccount, TeamsAccountType, TeamsConfig, TeamsConfigLegacy, TeamsRegion } from './types'
+import type {
+  TeamsAccount,
+  TeamsAccountType,
+  TeamsAuthMethod,
+  TeamsConfig,
+  TeamsConfigLegacy,
+  TeamsRegion,
+} from './types'
 
 export class TeamsCredentialManager {
   static accountOverride?: TeamsAccountType
@@ -32,7 +39,9 @@ export class TeamsCredentialManager {
 
   async saveConfig(config: TeamsConfig): Promise<void> {
     await mkdir(this.configDir, { recursive: true })
-    await writeFile(this.credentialsPath, JSON.stringify(config, null, 2), { mode: 0o600 })
+    const tmpPath = `${this.credentialsPath}.tmp`
+    await writeFile(tmpPath, JSON.stringify(config, null, 2), { mode: 0o600 })
+    await rename(tmpPath, this.credentialsPath)
   }
 
   private migrateIfNeeded(raw: TeamsConfig | TeamsConfigLegacy): TeamsConfig {
@@ -116,6 +125,62 @@ export class TeamsCredentialManager {
     await this.saveConfig(config)
   }
 
+  async setDeviceCodeAccount(params: {
+    accountType: TeamsAccountType
+    token: string
+    tokenExpiresAt: string
+    aadRefreshToken?: string
+    aadClientId?: string
+    aadTenantId?: string
+    region?: TeamsRegion
+    userName?: string
+    teams: Record<string, { team_id: string; team_name: string }>
+    currentTeam: string | null
+    authMethod?: TeamsAuthMethod
+    makeCurrent?: boolean
+  }): Promise<void> {
+    let config = await this.loadConfig()
+    if (!config) {
+      config = { current_account: params.accountType, accounts: {} }
+    }
+    const existing = config.accounts[params.accountType]
+    config.accounts[params.accountType] = {
+      token: params.token,
+      token_expires_at: params.tokenExpiresAt,
+      region: params.region ?? existing?.region,
+      account_type: params.accountType,
+      user_name: params.userName ?? existing?.user_name,
+      current_team: params.currentTeam,
+      teams: params.teams,
+      auth_method: params.authMethod ?? 'device-code',
+      aad_refresh_token: params.aadRefreshToken,
+      aad_client_id: params.aadClientId,
+      aad_tenant_id: params.aadTenantId ?? existing?.aad_tenant_id,
+    }
+    if (params.makeCurrent ?? true) {
+      config.current_account = params.accountType
+    }
+    await this.saveConfig(config)
+  }
+
+  async getAadRefresh(accountType: TeamsAccountType): Promise<{ refreshToken: string; clientId?: string } | null> {
+    const config = await this.loadConfig()
+    const account = config?.accounts[accountType]
+    if (!account?.aad_refresh_token) return null
+    return { refreshToken: account.aad_refresh_token, clientId: account.aad_client_id }
+  }
+
+  async updateAadRefreshToken(accountType: TeamsAccountType, refreshToken: string, clientId?: string): Promise<void> {
+    const config = await this.loadConfig()
+    const account = config?.accounts[accountType]
+    if (!config || !account) return
+    account.aad_refresh_token = refreshToken
+    if (clientId !== undefined) {
+      account.aad_client_id = clientId
+    }
+    await this.saveConfig(config)
+  }
+
   async getCurrentTeam(): Promise<{ team_id: string; team_name: string } | null> {
     const config = await this.loadConfig()
     if (!config) return null

package/src/platforms/teams/device-code.test.ts

@@ -0,0 +1,311 @@
+import { afterEach, describe, expect, it, mock } from 'bun:test'
+
+import { getTeamsAppClientId } from './app-config'
+import {
+  decodeJwtTid,
+  exchangeDeviceCode,
+  exchangeForSkypeScope,
+  isConsumerTenant,
+  mintConsumerSkypeToken,
+  mintSkypeToken,
+  pollDeviceToken,
+  requestDeviceCode,
+  resolveWorkTenantId,
+} from './device-code'
+
+const CLIENT_ID = '5e3ce6c0-2b1f-4285-8d4b-75ee78787346'
+const REAL_TENANT_ID = 'c0ffee00-1111-2222-3333-444455556666'
+const originalFetch = globalThis.fetch
+
+function fakeJwt(claims: Record<string, unknown>): string {
+  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url')
+  return `header.${payload}.signature`
+}
+
+interface FakeResponse {
+  status?: number
+  json: unknown
+}
+
+function mockFetch(responder: (url: string, init: RequestInit) => FakeResponse): {
+  calls: Array<{ url: string; body: URLSearchParams; init: RequestInit }>
+} {
+  const calls: Array<{ url: string; body: URLSearchParams; init: RequestInit }> = []
+  globalThis.fetch = mock((input: string | URL | Request, init?: RequestInit) => {
+    const url = String(input)
+    const raw = (init?.body as string) ?? ''
+    calls.push({ url, body: new URLSearchParams(raw), init: init ?? {} })
+    const { status = 200, json } = responder(url, init ?? {})
+    return Promise.resolve({
+      ok: status >= 200 && status < 300,
+      status,
+      json: () => Promise.resolve(json),
+    } as Response)
+  }) as typeof fetch
+  return { calls }
+}
+
+afterEach(() => {
+  globalThis.fetch = originalFetch
+})
+
+describe('getTeamsAppClientId', () => {
+  it('keeps the consumer client for personal login and uses Teams desktop client for work login', () => {
+    expect(getTeamsAppClientId('personal').clientId).toBe('5e3ce6c0-2b1f-4285-8d4b-75ee78787346')
+    expect(getTeamsAppClientId('work').clientId).toBe('1fec8e78-bce4-4aaf-ab1b-5451cc387264')
+  })
+})
+
+describe('requestDeviceCode', () => {
+  it('posts to consumer devicecode endpoint with teams scope and composes verificationUriComplete', async () => {
+    const { calls } = mockFetch(() => ({
+      json: {
+        device_code: 'DC',
+        user_code: 'ABCD-1234',
+        verification_uri: 'https://microsoft.com/devicelogin',
+        expires_in: 900,
+        interval: 5,
+      },
+    }))
+
+    const info = await requestDeviceCode(CLIENT_ID)
+
+    expect(calls[0].url).toContain('/9188040d-6c67-4c5b-b112-36a304b66dad/oauth2/v2.0/devicecode')
+    expect(calls[0].body.get('client_id')).toBe(CLIENT_ID)
+    expect(calls[0].body.get('scope')).toContain('api.fl.teams.microsoft.com')
+    expect(calls[0].body.get('scope')).toContain('offline_access')
+    expect(info.verificationUriComplete).toBe('https://microsoft.com/devicelogin?otc=ABCD-1234')
+    expect(info.interval).toBe(5)
+  })
+
+  it('posts work-account device code requests to organizations authority with Teams scope', async () => {
+    const { calls } = mockFetch(() => ({
+      json: {
+        device_code: 'DC',
+        user_code: 'ABCD-1234',
+        verification_uri: 'https://microsoft.com/devicelogin',
+        expires_in: 900,
+        interval: 5,
+      },
+    }))
+
+    await requestDeviceCode(CLIENT_ID, 'work')
+
+    expect(calls[0].url).toContain('/organizations/oauth2/v2.0/devicecode')
+    expect(calls[0].body.get('client_id')).toBe(CLIENT_ID)
+    expect(calls[0].body.get('scope')).toBe('https://api.spaces.skype.com/.default openid profile offline_access')
+  })
+
+  it('throws on non-200', async () => {
+    mockFetch(() => ({ status: 400, json: { error: 'invalid_client', error_description: 'bad client' } }))
+    await expect(requestDeviceCode(CLIENT_ID)).rejects.toThrow(/bad client/)
+  })
+})
+
+describe('exchangeDeviceCode', () => {
+  it('maps authorization_pending to pending', async () => {
+    mockFetch(() => ({ status: 400, json: { error: 'authorization_pending' } }))
+    expect(await exchangeDeviceCode('DC', CLIENT_ID)).toEqual({ status: 'pending' })
+  })
+
+  it('maps slow_down, expired_token, authorization_declined', async () => {
+    mockFetch(() => ({ status: 400, json: { error: 'slow_down' } }))
+    expect((await exchangeDeviceCode('DC', CLIENT_ID)).status).toBe('slow_down')
+    mockFetch(() => ({ status: 400, json: { error: 'expired_token' } }))
+    expect((await exchangeDeviceCode('DC', CLIENT_ID)).status).toBe('expired')
+    mockFetch(() => ({ status: 400, json: { error: 'authorization_declined' } }))
+    expect((await exchangeDeviceCode('DC', CLIENT_ID)).status).toBe('declined')
+  })
+
+  it('returns success with tokens', async () => {
+    mockFetch(() => ({ json: { access_token: 'AT', refresh_token: 'RT' } }))
+    const result = await exchangeDeviceCode('DC', CLIENT_ID)
+    expect(result).toEqual({ status: 'success', token: { accessToken: 'AT', refreshToken: 'RT' } })
+  })
+})
+
+describe('pollDeviceToken', () => {
+  it('polls until success', async () => {
+    let n = 0
+    mockFetch(() =>
+      n++ < 2
+        ? { status: 400, json: { error: 'authorization_pending' } }
+        : { json: { access_token: 'AT', refresh_token: 'RT' } },
+    )
+    const token = await pollDeviceToken('DC', 0, 10, CLIENT_ID)
+    expect(token.accessToken).toBe('AT')
+  })
+
+  it('throws when device code expires', async () => {
+    mockFetch(() => ({ status: 400, json: { error: 'expired_token' } }))
+    await expect(pollDeviceToken('DC', 0, 10, CLIENT_ID)).rejects.toThrow(/expired/)
+  })
+})
+
+describe('exchangeForSkypeScope', () => {
+  it('refresh-exchanges to the spaces.skype scope and keeps a refresh token', async () => {
+    const { calls } = mockFetch(() => ({ json: { access_token: 'SKYPE_AT', refresh_token: 'RT2' } }))
+    const token = await exchangeForSkypeScope('RT1', CLIENT_ID)
+    expect(calls[0].body.get('grant_type')).toBe('refresh_token')
+    expect(calls[0].body.get('scope')).toContain('api.fl.spaces.skype.com')
+    expect(calls[0].body.get('scope')).toContain('offline_access')
+    expect(token).toEqual({ accessToken: 'SKYPE_AT', refreshToken: 'RT2' })
+  })
+
+  it('falls back to the input refresh token when none is rotated', async () => {
+    mockFetch(() => ({ json: { access_token: 'SKYPE_AT' } }))
+    const token = await exchangeForSkypeScope('RT1', CLIENT_ID)
+    expect(token.refreshToken).toBe('RT1')
+  })
+
+  it('refresh-exchanges work accounts against organizations authority with Teams Skype scope', async () => {
+    const { calls } = mockFetch(() => ({ json: { access_token: 'WORK_SKYPE_AT', refresh_token: 'RT2' } }))
+
+    const token = await exchangeForSkypeScope('RT1', CLIENT_ID, 'work')
+
+    expect(calls[0].url).toContain('/organizations/oauth2/v2.0/token')
+    expect(calls[0].body.get('grant_type')).toBe('refresh_token')
+    expect(calls[0].body.get('scope')).toBe('https://api.spaces.skype.com/.default openid profile offline_access')
+    expect(token).toEqual({ accessToken: 'WORK_SKYPE_AT', refreshToken: 'RT2' })
+  })
+
+  it('targets the tenant-specific authority when a tenant id is provided', async () => {
+    const { calls } = mockFetch(() => ({ json: { access_token: 'TENANT_SKYPE_AT', refresh_token: 'RT2' } }))
+
+    await exchangeForSkypeScope('RT1', CLIENT_ID, 'work', REAL_TENANT_ID)
+
+    expect(calls[0].url).toContain(`/${REAL_TENANT_ID}/oauth2/v2.0/token`)
+    expect(calls[0].url).not.toContain('/organizations/')
+  })
+})
+
+describe('resolveWorkTenantId', () => {
+  it('uses the token tid directly when it is already a real tenant guid', async () => {
+    const { calls } = mockFetch(() => ({ json: [] }))
+
+    const tenantId = await resolveWorkTenantId(fakeJwt({ tid: REAL_TENANT_ID }))
+
+    expect(tenantId).toBe(REAL_TENANT_ID)
+    // given a concrete tenant, discovery must be skipped
+    expect(calls).toHaveLength(0)
+  })
+
+  it('discovers the tenant when the token tid is the organizations placeholder', async () => {
+    const { calls } = mockFetch(() => ({
+      json: [{ tenantId: REAL_TENANT_ID, tenantName: 'Contoso', isInvitationRedeemed: true }],
+    }))
+
+    const tenantId = await resolveWorkTenantId(fakeJwt({ tid: 'organizations' }))
+
+    expect(tenantId).toBe(REAL_TENANT_ID)
+    expect(calls[0].url).toContain('/api/mt/emea/beta/users/tenants')
+    expect((calls[0].init.headers as Record<string, string>).Authorization).toContain('Bearer ')
+  })
+
+  it('discovers the tenant when the token tid is the Microsoft Services placeholder', async () => {
+    const { calls } = mockFetch(() => ({
+      json: [{ tenantId: REAL_TENANT_ID, isInvitationRedeemed: true }],
+    }))
+
+    const tenantId = await resolveWorkTenantId(fakeJwt({ tid: 'f8cdef31-a31e-4b4a-93e4-5f571e91255a' }))
+
+    expect(tenantId).toBe(REAL_TENANT_ID)
+    expect(calls[0].url).toContain('/api/mt/emea/beta/users/tenants')
+  })
+
+  it('prefers the first redeemed tenant over an unredeemed one', async () => {
+    mockFetch(() => ({
+      json: [
+        { tenantId: 'guest-tenant', isInvitationRedeemed: false },
+        { tenantId: REAL_TENANT_ID, isInvitationRedeemed: true },
+      ],
+    }))
+
+    const tenantId = await resolveWorkTenantId(fakeJwt({ tid: 'organizations' }))
+
+    expect(tenantId).toBe(REAL_TENANT_ID)
+  })
+
+  it('throws an actionable error when only an unredeemed guest tenant exists', async () => {
+    mockFetch(() => ({ json: [{ tenantId: 'guest-tenant', isInvitationRedeemed: false }] }))
+
+    await expect(resolveWorkTenantId(fakeJwt({ tid: 'organizations' }))).rejects.toThrow(
+      /invitation has not been accepted/,
+    )
+  })
+
+  it('throws when no tenant is associated with the account and points to the personal flow', async () => {
+    mockFetch(() => ({ json: [] }))
+
+    await expect(resolveWorkTenantId(fakeJwt({ tid: 'organizations' }))).rejects.toThrow(/--account-type personal/)
+  })
+})
+
+describe('decodeJwtTid', () => {
+  it('returns the tid claim from a JWT access token', () => {
+    expect(decodeJwtTid(fakeJwt({ tid: '9188040d-6c67-4c5b-b112-36a304b66dad' }))).toBe(
+      '9188040d-6c67-4c5b-b112-36a304b66dad',
+    )
+  })
+
+  it('returns undefined for a malformed token', () => {
+    expect(decodeJwtTid('not-a-jwt')).toBeUndefined()
+  })
+
+  it('returns undefined when the tid claim is absent', () => {
+    expect(decodeJwtTid(fakeJwt({ sub: 'user' }))).toBeUndefined()
+  })
+})
+
+describe('isConsumerTenant', () => {
+  it('recognizes the consumer tenant as personal', () => {
+    expect(isConsumerTenant('9188040d-6c67-4c5b-b112-36a304b66dad')).toBe(true)
+  })
+
+  it('does not treat the Microsoft Services placeholder as personal (work tokens carry it too)', () => {
+    expect(isConsumerTenant('f8cdef31-a31e-4b4a-93e4-5f571e91255a')).toBe(false)
+  })
+
+  it('does not treat the organizations placeholder or a real tenant as personal', () => {
+    expect(isConsumerTenant('organizations')).toBe(false)
+    expect(isConsumerTenant(REAL_TENANT_ID)).toBe(false)
+  })
+})
+
+describe('mintConsumerSkypeToken', () => {
+  it('parses shape A { skypeToken: { skypetoken } } and derives expiry from skypeTokenExpiresIn', async () => {
+    mockFetch(() => ({ json: { skypeToken: { skypetoken: 'SKYPE', skypeTokenExpiresIn: 3600 } } }))
+    const before = Date.now()
+    const minted = await mintConsumerSkypeToken('AT')
+    expect(minted.skypeToken).toBe('SKYPE')
+    const ttl = new Date(minted.skypeTokenExpiresAt).getTime() - before
+    expect(ttl).toBeGreaterThan(3000 * 1000)
+    expect(ttl).toBeLessThan(3700 * 1000)
+  })
+
+  it('parses shape B { tokens: { skypeToken } }', async () => {
+    mockFetch(() => ({ json: { tokens: { skypeToken: 'SKYPE_B' } } }))
+    const minted = await mintConsumerSkypeToken('AT')
+    expect(minted.skypeToken).toBe('SKYPE_B')
+  })
+
+  it('defaults TTL when expiry is absent', async () => {
+    mockFetch(() => ({ json: { skypeToken: { skypetoken: 'SKYPE' } } }))
+    const before = Date.now()
+    const minted = await mintConsumerSkypeToken('AT')
+    const ttl = new Date(minted.skypeTokenExpiresAt).getTime() - before
+    expect(ttl).toBeGreaterThan(21000 * 1000)
+  })
+
+  it('throws when no skype token present', async () => {
+    mockFetch(() => ({ status: 403, json: { errorCode: 'UserLicenseNotPresentForbidden', message: 'Teams disabled' } }))
+    await expect(mintConsumerSkypeToken('AT')).rejects.toThrow(/UserLicenseNotPresentForbidden/)
+  })
+
+  it('augments GuestUserNotRedeemed with an actionable hint', async () => {
+    mockFetch(() => ({ status: 400, json: { errorCode: 'GuestUserNotRedeemed' } }))
+    await expect(mintSkypeToken('AT', 'work')).rejects.toThrow(/GuestUserNotRedeemed/)
+    mockFetch(() => ({ status: 400, json: { errorCode: 'GuestUserNotRedeemed' } }))
+    await expect(mintSkypeToken('AT', 'work')).rejects.toThrow(/--account-type personal/)
+  })
+})