expandai 0.0.0 → 0.0.2

package/src/ApiClient.ts

@@ -0,0 +1,257 @@
+import { HttpClient, HttpClientRequest, HttpClientResponse } from '@effect/platform'
+import { NodeHttpClient } from '@effect/platform-node'
+import { fetchObjectModeJson, fetchSnapshotSearch } from '@expandai/sdk/FetchJson'
+import * as Generated from '@expandai/sdk/Generated'
+import { decodeError, unexpectedStatus } from '@expandai/sdk/HttpClientHelpers'
+import { Data, DateTime, Duration, Effect, flow, Match, Option, Redacted, Schema } from 'effect'
+import { BrowserOAuthService } from './BrowserOAuth.js'
+import { ConfigManager, OAuthConfig, OAuthTokenExpired } from './Config.js'
+import { CurrentRequestHeaders } from './Mcp/RequestHeaders.js'
+
+/**
+ * Single user-facing error for any failure crossing the API boundary. The
+ * generated client raises a half-dozen status-specific tagged classes plus
+ * transport/decode errors; we collapse them here so the rest of the app sees
+ * one tag with a ready-made `.message` and never has to know about
+ * `Generated.ts` types.
+ */
+export class ApiRequestFailed extends Schema.TaggedError<ApiRequestFailed>()('ApiRequestFailed', {
+	detail: Schema.String,
+}) {
+	get message() {
+		return this.detail
+	}
+}
+
+// Derived rather than hand-written so codegen drift surfaces as a type error.
+type ClientError =
+	| Effect.Effect.Error<ReturnType<Generated.Client['fetchFetch']>>
+	| Effect.Effect.Error<ReturnType<Generated.Client['fetchFetchJson']>>
+	| Effect.Effect.Error<ReturnType<Generated.Client['fetchFetchSearch']>>
+	| Effect.Effect.Error<ReturnType<Generated.Client['fetchBatched']>>
+	| Effect.Effect.Error<ReturnType<Generated.Client['fetchGetBatched']>>
+type Issue = typeof Generated.Issue.Type
+type OAuthAuthMethod = typeof OAuthConfig.Type
+
+const OAUTH_REFRESH_SKEW = Duration.minutes(1)
+
+class OAuthAuthMethodChanged extends Data.TaggedError('OAuthAuthMethodChanged')<Record<string, never>> {}
+
+function getField(value: unknown, key: string): unknown {
+	return typeof value === 'object' && value !== null && key in value ? value[key as keyof typeof value] : undefined
+}
+
+function getStringField(value: unknown, key: string): string | undefined {
+	const field = getField(value, key)
+	return typeof field === 'string' ? field : undefined
+}
+
+function getIssueList(value: unknown): Issue[] {
+	const issues = getField(value, 'issues')
+	return Array.isArray(issues) ? (issues as Issue[]) : []
+}
+
+function getUnsupportedFields(value: unknown): string[] {
+	const unsupportedFields = getField(value, 'unsupportedFields')
+	return Array.isArray(unsupportedFields) ? unsupportedFields.filter((field) => typeof field === 'string') : []
+}
+
+const formatIssue = Effect.fn('ApiClient.formatIssue')(function* ({ path, message }: Issue) {
+	const prefix = path.map((segment) => (typeof segment === 'object' ? segment.key : String(segment))).join('.')
+	return prefix ? `${prefix}: ${message}` : message
+})
+
+const formatApiFailure = Effect.fn('ApiClient.formatApiFailure')(function* (error: ClientError) {
+	switch (getStringField(error, '_tag')) {
+		case 'HttpApiDecodeError': {
+			const issues = getIssueList(error)
+			return yield* issues.length === 0
+				? Effect.succeed(getStringField(error, 'message') ?? 'Invalid request')
+				: Effect.forEach(issues, formatIssue).pipe(Effect.map((parts) => parts.join('; ')))
+		}
+		case 'AuthFailed':
+			return `Authentication failed (${getStringField(error, 'reason') ?? 'unknown'}). Run \`expandai login\` to re-authenticate.`
+		case 'AccessBlocked':
+			return 'Access blocked. Check your billing status or contact support.'
+		case 'BatchedIncludeUnsupported':
+			return `Unsupported batched include fields: ${getUnsupportedFields(error).join(', ')}.`
+		case 'FetchSnapshotSearchNotFound':
+			return 'Fetch snapshot not found.'
+		case 'PayloadTooLarge':
+			return 'Request payload is too large.'
+		case 'TooManyRequests':
+			return 'Rate limit exceeded — try again in a moment.'
+		case 'InternalError':
+			return 'The expand.ai API returned an internal error. Try again or contact support.'
+		case 'ServiceUnavailable':
+			return 'The expand.ai API is temporarily unavailable. Try again shortly.'
+		default:
+			return error instanceof Error ? error.message : (getStringField(error, 'message') ?? 'Expand API request failed.')
+	}
+})
+
+const liftApiError = <A, R>(self: Effect.Effect<A, ClientError, R>) =>
+	self.pipe(
+		Effect.catchAll((error) =>
+			formatApiFailure(error).pipe(Effect.flatMap((detail) => Effect.fail(new ApiRequestFailed({ detail })))),
+		),
+	)
+
+/**
+ * Resolves outgoing API auth per call. When the current request scope carries
+ * an `Authorization` header (via `CurrentRequestHeaders`), that value is
+ * forwarded; otherwise auth comes from `~/.config/expandai/config.json`.
+ */
+export class ApiClient extends Effect.Service<ApiClient>()('@expandai/cli/ApiClient', {
+	dependencies: [NodeHttpClient.layer, ConfigManager.Default, BrowserOAuthService.Default],
+	scoped: Effect.gen(function* () {
+		const configManager = yield* ConfigManager
+		const browserOAuth = yield* BrowserOAuthService
+		const baseClient = yield* HttpClient.HttpClient
+		const refreshLock = yield* Effect.makeSemaphore(1)
+
+		const freshOAuthAccessToken = Effect.fn('ApiClient.freshOAuthAccessToken')(function* ({
+			accessToken,
+			expiresAt,
+			refreshToken,
+		}: OAuthAuthMethod) {
+			const now = yield* DateTime.now
+			const refreshThreshold = refreshToken === undefined ? now : DateTime.addDuration(now, OAUTH_REFRESH_SKEW)
+			if (DateTime.lessThan(refreshThreshold, expiresAt)) {
+				return Option.some(Redacted.value(accessToken))
+			}
+			return Option.none<string>()
+		})
+
+		const refreshOAuthToken = Effect.fn('ApiClient.refreshOAuthToken')(function* ({
+			refreshToken,
+			expiresAt,
+		}: OAuthAuthMethod) {
+			if (refreshToken === undefined) {
+				return yield* new OAuthTokenExpired({ expiredAt: expiresAt })
+			}
+
+			const now = yield* DateTime.now
+			const token = yield* browserOAuth.refreshToken(Redacted.value(refreshToken))
+			if (token === undefined) {
+				return yield* new OAuthTokenExpired({ expiredAt: expiresAt })
+			}
+			const refreshedExpiresAt = DateTime.addDuration(now, token.expires_in)
+			const nextRefreshToken = token.refresh_token === undefined ? refreshToken : Redacted.make(token.refresh_token)
+			yield* configManager.updateConfig({
+				authMethod: OAuthConfig.make({
+					accessToken: Redacted.make(token.access_token),
+					refreshToken: nextRefreshToken,
+					expiresAt: refreshedExpiresAt,
+				}),
+			})
+
+			return token.access_token
+		})
+
+		const oauthBearerToken = Effect.fn('ApiClient.oauthBearerToken')(function* (authMethod: OAuthAuthMethod) {
+			const alreadyFresh = yield* freshOAuthAccessToken(authMethod)
+			if (Option.isSome(alreadyFresh)) {
+				return alreadyFresh.value
+			}
+
+			return yield* refreshLock.withPermits(1)(
+				Effect.gen(function* () {
+					const { authMethod: persistedAuthMethod } = yield* configManager.loadConfig()
+					if (persistedAuthMethod._tag !== 'OAuth') {
+						return yield* new OAuthAuthMethodChanged({})
+					}
+
+					const persistedFresh = yield* freshOAuthAccessToken(persistedAuthMethod)
+					if (Option.isSome(persistedFresh)) {
+						return persistedFresh.value
+					}
+
+					return yield* refreshOAuthToken(persistedAuthMethod)
+				}),
+			)
+		})
+
+		// Resolved per call, not at construction. Effect Layers are globally
+		// memoized, so capturing CurrentRequestHeaders here once would freeze
+		// auth resolution to whatever was on the first request. Reading per
+		// call also keeps the OAuth `expiresAt` check live against `DateTime.now`.
+		// `Effect.serviceOption` reads the tag from the outer fiber context
+		// without leaking it into our R, so the API's per-request
+		// `Context.make(CurrentRequestHeaders, headers)` flows through and the
+		// stdio MCP path simply gets `Option.none` → empty headers.
+		const buildAuthedClientOnce = () =>
+			Effect.gen(function* () {
+				const forwardedHeaders = yield* Effect.serviceOption(CurrentRequestHeaders).pipe(
+					Effect.map(Option.getOrElse(() => ({}) as Record<string, string>)),
+				)
+				// header keys are lowercase per WHATWG Headers spec.
+				const forwardedAuth = Option.fromNullable(forwardedHeaders['authorization'])
+
+				if (Option.isSome(forwardedAuth)) {
+					// Forwarded path: caller owns the token's lifecycle (their session,
+					// their bearer). We don't re-check expiry — if it's stale the API
+					// will return 401. `OAuthTokenExpired` is for the *persisted*
+					// OAuth in the loadConfig branch only.
+					const apiUrl = yield* configManager.getApiUrl()
+					const mapRequest = flow(
+						HttpClientRequest.prependUrl(apiUrl.toString()),
+						HttpClientRequest.setHeader('authorization', forwardedAuth.value),
+					)
+					return baseClient.pipe(HttpClient.mapRequest(mapRequest))
+				}
+
+				const { authMethod, apiUrl } = yield* configManager.loadConfig()
+				const applyAuth = yield* Match.value(authMethod).pipe(
+					Match.tag('ApiKey', ({ apiKey }) =>
+						Effect.succeed(HttpClientRequest.setHeader('x-expand-api-key', Redacted.value(apiKey))),
+					),
+					Match.tag('OAuth', (authMethod) =>
+						oauthBearerToken(authMethod).pipe(Effect.map((accessToken) => HttpClientRequest.bearerToken(accessToken))),
+					),
+					Match.exhaustive,
+				)
+				const mapRequest = flow(HttpClientRequest.prependUrl(apiUrl.toString()), applyAuth)
+				return baseClient.pipe(HttpClient.mapRequest(mapRequest))
+			})
+		const buildAuthedClient = () =>
+			buildAuthedClientOnce().pipe(Effect.catchTag('OAuthAuthMethodChanged', () => buildAuthedClientOnce()))
+		const buildAuthed = () => buildAuthedClient().pipe(Effect.map(Generated.make))
+		const fetchMarkdown = (client: HttpClient.HttpClient, options: Parameters<Generated.Client['fetchFetch']>[0]) =>
+			HttpClientRequest.make('POST')('/v1/fetch').pipe(
+				HttpClientRequest.setUrlParams(options.params.include !== undefined ? { include: options.params.include } : {}),
+				(req) => Effect.orDie(HttpClientRequest.bodyJson(req, options.payload)),
+				Effect.flatMap((request) =>
+					Effect.flatMap(
+						client.execute(request),
+						HttpClientResponse.matchStatus({
+							'200': (response) => response.text,
+							'400': (response) => decodeError(response, Generated.FetchFetch400),
+							'401': (response) => decodeError(response, Generated.AuthFailed),
+							'403': (response) => decodeError(response, Generated.FetchFetch403),
+							'413': (response) => decodeError(response, Generated.PayloadTooLarge),
+							'429': (response) => decodeError(response, Generated.TooManyRequests),
+							'500': (response) => decodeError(response, Generated.InternalError),
+							'503': (response) => decodeError(response, Generated.ServiceUnavailable),
+							orElse: (response) => unexpectedStatus(request, response),
+						}),
+					),
+				),
+			)
+
+		return {
+			fetchFetch: (...args: Parameters<Generated.Client['fetchFetch']>) =>
+				buildAuthedClient().pipe(Effect.flatMap((client) => fetchMarkdown(client, ...args).pipe(liftApiError))),
+			fetchFetchResult: (...args: Parameters<Generated.Client['fetchFetchJson']>) =>
+				buildAuthedClient().pipe(Effect.flatMap((client) => fetchObjectModeJson(client, ...args).pipe(liftApiError))),
+			fetchFetchJson: (...args: Parameters<Generated.Client['fetchFetchJson']>) =>
+				buildAuthedClient().pipe(Effect.flatMap((client) => fetchObjectModeJson(client, ...args).pipe(liftApiError))),
+			fetchFetchSearch: (...args: Parameters<Generated.Client['fetchFetchSearch']>) =>
+				buildAuthedClient().pipe(Effect.flatMap((client) => fetchSnapshotSearch(client, ...args).pipe(liftApiError))),
+			fetchBatched: (...args: Parameters<Generated.Client['fetchBatched']>) =>
+				buildAuthed().pipe(Effect.flatMap((client) => client.fetchBatched(...args).pipe(liftApiError))),
+			fetchGetBatched: (...args: Parameters<Generated.Client['fetchGetBatched']>) =>
+				buildAuthed().pipe(Effect.flatMap((client) => client.fetchGetBatched(...args).pipe(liftApiError))),
+		} as const
+	}),
+}) {}

package/src/Authentication.ts

@@ -0,0 +1,164 @@
+import { Command, Prompt } from '@effect/cli'
+import { Console, DateTime, Duration, Effect, Either, Match, Schema, String } from 'effect'
+import open from 'open'
+import { BrowserOAuthService } from './BrowserOAuth.js'
+import { ApiKey, ApiKeyConfig, ConfigManager, OAuthConfig } from './Config.js'
+import { Uninstall } from './Install/Uninstall.js'
+
+type AuthMethod = typeof ApiKeyConfig.Type | typeof OAuthConfig.Type
+
+/** Render a user-facing description of the current auth state. Pure given DateTime.now. */
+export const formatAuthStatus = Effect.fn('Authentication.formatAuthStatus')(function* (authMethod: AuthMethod) {
+	return yield* Match.value(authMethod).pipe(
+		Match.tag('ApiKey', () => Effect.succeed('Authenticated via API key.')),
+		Match.tag('OAuth', ({ expiresAt }) =>
+			Effect.gen(function* () {
+				const now = yield* DateTime.now
+				const expired = DateTime.lessThan(expiresAt, now)
+				const detail = expired
+					? `expired ${Duration.format(DateTime.distanceDuration(expiresAt, now))} ago — run \`expandai login\``
+					: `expires in ${Duration.format(DateTime.distanceDuration(now, expiresAt))}`
+				return `Authenticated via OAuth (${detail}).`
+			}),
+		),
+		Match.exhaustive,
+	)
+})
+
+export class Authentication extends Effect.Service<Authentication>()('@expandai/cli/Authentication', {
+	dependencies: [ConfigManager.Default, BrowserOAuthService.Default, Uninstall.Default],
+	effect: Effect.gen(function* () {
+		const configManager = yield* ConfigManager
+		const browserOAuth = yield* BrowserOAuthService
+		const uninstall = yield* Uninstall
+
+		const apiKeyLogin = Effect.fn('Authentication.apiKeyLogin')(function* () {
+			const apiKey = yield* Prompt.password({ message: 'Enter your API Key' })
+			yield* configManager.updateConfig({
+				authMethod: ApiKeyConfig.make({ apiKey: yield* Schema.validate(ApiKey)(apiKey) }),
+			})
+			yield* Console.log('API key saved successfully!')
+		})
+
+		const oauthLogin = Effect.fn('Authentication.oauthLogin')(function* () {
+			yield* Console.log(
+				String.stripMargin(`
+					|
+					|Starting browser authorization...`),
+			)
+			yield* browserOAuth.login((authorizeUrl) =>
+				Effect.gen(function* () {
+					yield* Console.log(
+						String.stripMargin(`
+							|
+							|Open this URL in a browser:
+							|  ${authorizeUrl.toString()}
+							|`),
+					)
+
+					const shouldOpen = yield* Prompt.confirm({ message: 'Open browser now?', initial: true })
+					if (shouldOpen) {
+						yield* Effect.tryPromise(() => open(authorizeUrl.toString())).pipe(
+							Effect.catchAll(() => Console.log('Could not open browser automatically — use the URL above.')),
+						)
+					}
+
+					yield* Console.log(
+						String.stripMargin(`
+							|
+							|Waiting for browser authorization...`),
+					)
+				}),
+			)
+			yield* Console.log(
+				String.stripMargin(`
+					|
+					|Successfully authenticated!`),
+			)
+		})
+
+		const login = Effect.fn('Authentication.login')(function* () {
+			const existing = yield* Effect.either(configManager.loadConfig())
+
+			if (Either.isRight(existing)) {
+				const status = yield* formatAuthStatus(existing.right.authMethod)
+				const proceed = yield* Prompt.confirm({
+					message: String.stripMargin(`
+						|${status}
+						|Do you want to re-authenticate?`),
+				})
+				if (!proceed) {
+					return
+				}
+			}
+
+			const method = yield* Prompt.select({
+				message: 'How would you like to authenticate?',
+				choices: [
+					{ title: 'Browser Login', value: 'oauth' as const, description: 'Authenticate via browser' },
+					{ title: 'API Key', value: 'api-key' as const, description: 'Paste your API key' },
+				],
+			})
+
+			yield* Match.value(method).pipe(
+				Match.when('api-key', () => apiKeyLogin()),
+				Match.when('oauth', () => oauthLogin()),
+				Match.exhaustive,
+			)
+		})
+
+		const whoami = Effect.fn('Authentication.whoami')(function* () {
+			const { authMethod } = yield* configManager.loadConfig()
+			const text = yield* formatAuthStatus(authMethod)
+			yield* Console.log(text)
+		})
+
+		const logout = Effect.fn('Authentication.logout')(function* () {
+			yield* configManager.clearConfig()
+
+			if (!process.stdout.isTTY || !process.stdin.isTTY) {
+				yield* Effect.logInfo(
+					String.stripMargin(`
+						|Skipping install cleanup — \`expandai logout\` is not interactive in this context.
+						|Run \`expandai uninstall\` to remove hooks, skills, and MCP entries.`),
+				)
+				yield* Console.log('Logged out.')
+				return
+			}
+
+			const cleanup = yield* Prompt.multiSelect({
+				message: 'Remove installed expandai integrations?',
+				choices: [
+					{ title: 'Global hooks', value: { target: 'hook' as const, scope: 'global' as const } },
+					{ title: 'Project hooks', value: { target: 'hook' as const, scope: 'project' as const } },
+					{ title: 'Global skills', value: { target: 'skill' as const, scope: 'global' as const } },
+					{ title: 'Project skills', value: { target: 'skill' as const, scope: 'project' as const } },
+					{ title: 'Global MCP entries', value: { target: 'mcp' as const, scope: 'global' as const } },
+					{ title: 'Project MCP entries', value: { target: 'mcp' as const, scope: 'project' as const } },
+				],
+			})
+			if (cleanup.length > 0) {
+				yield* Effect.forEach(cleanup, (item) => uninstall.uninstall(item), { discard: true })
+			}
+
+			yield* Console.log('Logged out.')
+		})
+
+		return { login, whoami, logout } as const
+	}),
+}) {}
+
+export const LoginCommand = Command.make('login').pipe(
+	Command.withDescription('Authenticate with ExpandAI'),
+	Command.withHandler(() => Effect.flatMap(Authentication, (auth) => auth.login())),
+)
+
+export const WhoamiCommand = Command.make('whoami').pipe(
+	Command.withDescription('Show current authentication status'),
+	Command.withHandler(() => Effect.flatMap(Authentication, (auth) => auth.whoami())),
+)
+
+export const LogoutCommand = Command.make('logout').pipe(
+	Command.withDescription('Clear stored credentials and optionally remove installed integrations'),
+	Command.withHandler(() => Effect.flatMap(Authentication, (auth) => auth.logout())),
+)