expandai 0.0.1 → 0.0.3

package/README.md

@@ -15,6 +15,8 @@ npm install -g expandai
 The binary is published as `expandai`. One-off use without install:
 
 ```bash
+npx -y expandai fetch https://example.com
+# or
 bunx expandai fetch https://example.com
 ```
 
@@ -43,11 +45,29 @@ environment.
 ## Quick start
 
 ```bash
-expandai login                                            # interactive auth
+expandai init                                             # authorize and configure detected agents
 expandai fetch https://docs.example.com/api               # full markdown
 expandai fetch https://docs.example.com/api --search auth # semantic snippets
 ```
 
+Human terminal use may omit the harness and scope; init detects supported
+harnesses, asks for scope, completes loopback browser authorization when
+needed, and configures every detected harness. Pass `--harness` to ensure the
+agent running the command is included even when it has no config directory yet.
+
+Agents and non-interactive VMs use the explicit machine form:
+
+```bash
+expandai init --harness <current-harness> --scope project --json
+```
+
+If authorization is required, the JSON result contains a browser URL and a
+`userCode`. Put both in front of the user: they open the page, type the code in,
+and approve — nothing comes back to paste. After they approve, run the **same
+command again**; the CLI polls the approval up itself (RFC 8628). Machine mode
+writes exactly one JSON result to stdout or one structured error to stderr, so
+agents never need to answer an interactive CLI prompt.
+
 ## Supported harnesses
 
 | Harness     | MCP server | Webfetch hook | Skill |
@@ -57,7 +77,9 @@ expandai fetch https://docs.example.com/api --search auth # semantic snippets
 | Cursor      |      ✓     |       —       |   ✓   |
 | Codex       |      ✓     |       —       |   ✓   |
 
-**Pick one — each integration works standalone.** In rough preference order:
+`expandai init` is the recommended path because it configures the current
+harness plus every other supported harness detected on the machine. The
+component commands below remain expert tools for migrations and targeted repair:
 
 1. **Hook** (Claude Code, OpenCode). `expandai hook install <host> <scope>`
    — best invisible upgrade: every native web fetch the agent issues comes
@@ -86,7 +108,9 @@ or `project`.
   when the harness is launched from inside that directory (or a
   subdirectory). Pick this when you want different projects to opt in
   independently, or when the integration should live in version control
-  alongside the project.
+  alongside the project. The installed Claude profile uses the stable
+  `expandai` command when it is on `PATH` and `npx -y expandai` otherwise;
+  restart the harness if it has not inherited the global npm `PATH` yet.
 
 The exact files each scope touches differ per harness and per integration —
 see the path comment next to each `install` line in the sections below.
@@ -94,7 +118,7 @@ see the path comment next to each `install` line in the sections below.
 ## Authentication
 
 ```bash
-expandai login    # OAuth (browser device flow) or API key
+expandai login    # OAuth (loopback browser flow) or API key
 expandai whoami   # show current auth state
 expandai logout   # clear credentials and optionally remove installed integrations
 ```
@@ -150,6 +174,11 @@ machine. `project` writes to per-directory equivalents
 (`<cwd>/.claude/settings.json`, `<cwd>/.opencode/plugins/`) — the
 substitution only fires when the harness is launched from that directory.
 
+Claude Code hook entries use the portable `expandai` command when it resolves on
+`PATH`, and `npx -y expandai` otherwise. Install the package globally before
+sharing a project-scoped profile, and restart Claude Code if the current session
+has not inherited the updated `PATH`.
+
 ### Why both, not just one
 
 - The **runtime hook** makes the agent's native fetch path return ExpandAI
@@ -176,7 +205,8 @@ substitution only fires when the harness is launched from that directory.
 - **OpenCode** — `expandai hook install opencode <scope>` copies an
   `expandai-webfetch.js` plugin into `.opencode/plugins/`. The plugin hooks
   `tool.execute.after` on `webfetch`, shells out to `expandai hook opencode`
-  with the URL, and overwrites `output.output` with the returned markdown.
+  with the URL (retrying through `npx -y expandai` when the binary is not
+  installed), and overwrites `output.output` with the returned markdown.
   (`tool.execute.before` can only mutate args, not replace results, which is
   why we run in `after`.)
 
@@ -230,6 +260,13 @@ user-level MCP config — the server is discoverable in every session.
 discoverable when the harness is launched from that directory, and the
 config file is well-suited for checking into version control.
 
+Profiles created by `expandai init` invoke the `expandai` command directly when
+it is on `PATH`, and fall back to `npx -y expandai` when it is not — so
+`npx expandai init` produces a working profile without a global install.
+Re-running init after a global install rewrites the entry to the direct command.
+For the fastest startup, install the package globally and make sure its bin
+directory is on `PATH` before starting or restarting the harness.
+
 `expandai mcp uninstall <host> <scope>` removes the entry without touching
 other servers in the same config file.
 

package/build/dts/ApiClient.d.ts

@@ -1,8 +1,83 @@
 import { HttpClient } from '@effect/platform';
 import * as Generated from '@expandai/sdk/Generated';
-import { Effect, Schema } from 'effect';
+import { Effect, Redacted, Schema } from 'effect';
 import { BrowserOAuthService } from './BrowserOAuth.js';
 import { ConfigManager, OAuthTokenExpired } from './Config.js';
+declare const DeviceAuthorizationCreated_base: Schema.Class<DeviceAuthorizationCreated, {
+    deviceCode: Schema.Redacted<typeof Schema.NonEmptyString>;
+    userCode: typeof Schema.NonEmptyString;
+    verificationUri: typeof Schema.URL;
+    expiresIn: Schema.filter<typeof Schema.Int>;
+    interval: Schema.filter<typeof Schema.Int>;
+}, Schema.Struct.Encoded<{
+    deviceCode: Schema.Redacted<typeof Schema.NonEmptyString>;
+    userCode: typeof Schema.NonEmptyString;
+    verificationUri: typeof Schema.URL;
+    expiresIn: Schema.filter<typeof Schema.Int>;
+    interval: Schema.filter<typeof Schema.Int>;
+}>, never, {
+    readonly deviceCode: Redacted.Redacted<string>;
+} & {
+    readonly expiresIn: number;
+} & {
+    readonly interval: number;
+} & {
+    readonly userCode: string;
+} & {
+    readonly verificationUri: URL;
+}, {}, {}>;
+export declare class DeviceAuthorizationCreated extends DeviceAuthorizationCreated_base {
+}
+declare const ManualAuthorizationTokenResponse: Schema.Struct<{
+    access_token: Schema.Redacted<typeof Schema.NonEmptyString>;
+    refresh_token: Schema.Redacted<typeof Schema.NonEmptyString>;
+    token_type: typeof Schema.NonEmptyString;
+    expires_in: Schema.filter<typeof Schema.Number>;
+    scope: Schema.optional<typeof Schema.String>;
+}>;
+export type ManualAuthorizationTokenResponse = typeof ManualAuthorizationTokenResponse.Type;
+/**
+ * RFC 8628 §3.5 poll outcomes. These are results, not errors: an agent-driven
+ * CLI returns immediately on every one of them, and only a transport failure
+ * is exceptional.
+ */
+export type DevicePollOutcome = {
+    readonly _tag: 'Tokens';
+    readonly token: ManualAuthorizationTokenResponse;
+} | {
+    readonly _tag: 'Pending';
+} | {
+    readonly _tag: 'SlowDown';
+} | {
+    readonly _tag: 'Denied';
+} | {
+    readonly _tag: 'Expired';
+} | {
+    readonly _tag: 'Invalid';
+}
+/**
+ * The server refused for a reason a fresh code cannot fix — a misconfigured
+ * client, resource, or scope. Distinct from `Invalid` because the recovery is
+ * opposite: `Invalid` means start over, this means stop and report. Carries
+ * the server's own `error` so the message names the actual cause instead of
+ * guessing.
+ */
+ | {
+    readonly _tag: 'Refused';
+    readonly error: string;
+    readonly description?: string;
+};
+declare const ManualAuthorizationApiError_base: Schema.TaggedErrorClass<ManualAuthorizationApiError, "ManualAuthorizationApiError", {
+    readonly _tag: Schema.tag<"ManualAuthorizationApiError">;
+} & {
+    operation: Schema.Literal<["create", "poll"]>;
+    kind: Schema.Literal<["request_failed", "rejected", "invalid_response"]>;
+    status: Schema.optional<typeof Schema.Number>;
+    recoverable: typeof Schema.Boolean;
+}>;
+export declare class ManualAuthorizationApiError extends ManualAuthorizationApiError_base {
+    get message(): string;
+}
 declare const ApiRequestFailed_base: Schema.TaggedErrorClass<ApiRequestFailed, "ApiRequestFailed", {
     readonly _tag: Schema.tag<"ApiRequestFailed">;
 } & {
@@ -23,193 +98,61 @@ declare const OAuthAuthMethodChanged_base: new <A extends Record<string, any> =
 } & Readonly<A>;
 declare class OAuthAuthMethodChanged extends OAuthAuthMethodChanged_base<Record<string, never>> {
 }
+declare const ManualAuthorizationApiClient_base: Effect.Service.Class<ManualAuthorizationApiClient, "@expandai/cli/ManualAuthorizationApiClient", {
+    readonly dependencies: readonly [import("effect/Layer").Layer<HttpClient.HttpClient, never, never>, import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>];
+    readonly effect: Effect.Effect<{
+        readonly create: (input: {
+            readonly harness: 'agent-harnesses';
+            readonly scope: 'project' | 'global';
+            readonly platform: string;
+            readonly machineLabel: string;
+            readonly cliVersion: string;
+        }) => Effect.Effect<DeviceAuthorizationCreated, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | ManualAuthorizationApiError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly poll: (deviceCode: Redacted.Redacted<string>) => Effect.Effect<{
+            _tag: "Tokens";
+            token: {
+                readonly access_token: Redacted.Redacted<string>;
+                readonly refresh_token: Redacted.Redacted<string>;
+                readonly token_type: string;
+                readonly expires_in: number;
+                readonly scope?: string | undefined;
+            };
+        } | {
+            token?: undefined;
+            _tag: "Pending";
+        } | {
+            token?: undefined;
+            _tag: "SlowDown";
+        } | {
+            token?: undefined;
+            _tag: "Denied";
+        } | {
+            token?: undefined;
+            _tag: "Expired";
+        } | {
+            token?: undefined;
+            _tag: "Refused";
+            error: string;
+            description?: string | undefined;
+        } | {
+            token?: undefined;
+            _tag: "Invalid";
+        }, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | ManualAuthorizationApiError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+    }, never, ConfigManager | HttpClient.HttpClient>;
+}>;
+/** Public, unauthenticated HTTP boundary for device-flow CLI authorization. */
+export declare class ManualAuthorizationApiClient extends ManualAuthorizationApiClient_base {
+}
 declare const ApiClient_base: Effect.Service.Class<ApiClient, "@expandai/cli/ApiClient", {
     readonly dependencies: readonly [import("effect/Layer").Layer<HttpClient.HttpClient, never, never>, import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<BrowserOAuthService, import("effect/ConfigError").ConfigError, never>];
     readonly scoped: Effect.Effect<{
-        readonly fetchFetch: (options: {
-            readonly params: {
-                readonly include?: string | null | undefined;
-            };
-            readonly payload: {
-                readonly url: string;
-                readonly include?: {
-                    readonly html?: boolean | {
-                        readonly [x: string]: unknown;
-                    } | null | undefined;
-                    readonly markdown?: boolean | {
-                        readonly [x: string]: unknown;
-                    } | null | undefined;
-                    readonly screenshot?: boolean | {
-                        readonly fullPage?: boolean | null | undefined;
-                    } | null | undefined;
-                    readonly summary?: boolean | {
-                        readonly prompt?: string | null | undefined;
-                    } | null | undefined;
-                    readonly links?: boolean | {
-                        readonly skipEmptyText?: boolean | null | undefined;
-                        readonly includeNavigation?: boolean | null | undefined;
-                    } | null | undefined;
-                    readonly meta?: boolean | null | undefined;
-                    readonly response?: boolean | null | undefined;
-                    readonly json?: boolean | null | undefined;
-                    readonly appendix?: boolean | null | undefined;
-                } | null | undefined;
-                readonly search?: {
-                    readonly query: string;
-                    readonly maxResults?: number | null | undefined;
-                    readonly minScore?: number | null | undefined;
-                } | null | undefined;
-                readonly browserConfig?: {
-                    readonly scrollFullPage?: boolean | null | undefined;
-                } | null | undefined;
-            };
-        }) => Effect.Effect<string, import("effect/ParseResult").ParseError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").NotAuthenticated | OAuthTokenExpired | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | ApiRequestFailed | OAuthAuthMethodChanged, never>;
-        readonly fetchFetchResult: (options: {
-            readonly params: {
-                readonly include?: string | null | undefined;
-            };
-            readonly payload: {
-                readonly url: string;
-                readonly include?: {
-                    readonly html?: boolean | {
-                        readonly [x: string]: unknown;
-                    } | null | undefined;
-                    readonly markdown?: boolean | {
-                        readonly [x: string]: unknown;
-                    } | null | undefined;
-                    readonly screenshot?: boolean | {
-                        readonly fullPage?: boolean | null | undefined;
-                    } | null | undefined;
-                    readonly summary?: boolean | {
-                        readonly prompt?: string | null | undefined;
-                    } | null | undefined;
-                    readonly links?: boolean | {
-                        readonly skipEmptyText?: boolean | null | undefined;
-                        readonly includeNavigation?: boolean | null | undefined;
-                    } | null | undefined;
-                    readonly meta?: boolean | null | undefined;
-                    readonly response?: boolean | null | undefined;
-                    readonly json?: boolean | null | undefined;
-                    readonly appendix?: boolean | null | undefined;
-                } | null | undefined;
-                readonly search?: {
-                    readonly query: string;
-                    readonly maxResults?: number | null | undefined;
-                    readonly minScore?: number | null | undefined;
-                } | null | undefined;
-                readonly browserConfig?: {
-                    readonly scrollFullPage?: boolean | null | undefined;
-                } | null | undefined;
-            };
-        }) => Effect.Effect<import("@expandai/sdk/FetchJson").FetchObjectModeResultWithJson, import("effect/ParseResult").ParseError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").NotAuthenticated | OAuthTokenExpired | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | ApiRequestFailed | OAuthAuthMethodChanged, never>;
-        readonly fetchFetchJson: (options: {
-            readonly params: {
-                readonly include?: string | null | undefined;
-            };
-            readonly payload: {
-                readonly url: string;
-                readonly include?: {
-                    readonly html?: boolean | {
-                        readonly [x: string]: unknown;
-                    } | null | undefined;
-                    readonly markdown?: boolean | {
-                        readonly [x: string]: unknown;
-                    } | null | undefined;
-                    readonly screenshot?: boolean | {
-                        readonly fullPage?: boolean | null | undefined;
-                    } | null | undefined;
-                    readonly summary?: boolean | {
-                        readonly prompt?: string | null | undefined;
-                    } | null | undefined;
-                    readonly links?: boolean | {
-                        readonly skipEmptyText?: boolean | null | undefined;
-                        readonly includeNavigation?: boolean | null | undefined;
-                    } | null | undefined;
-                    readonly meta?: boolean | null | undefined;
-                    readonly response?: boolean | null | undefined;
-                    readonly json?: boolean | null | undefined;
-                    readonly appendix?: boolean | null | undefined;
-                } | null | undefined;
-                readonly search?: {
-                    readonly query: string;
-                    readonly maxResults?: number | null | undefined;
-                    readonly minScore?: number | null | undefined;
-                } | null | undefined;
-                readonly browserConfig?: {
-                    readonly scrollFullPage?: boolean | null | undefined;
-                } | null | undefined;
-            };
-        }) => Effect.Effect<import("@expandai/sdk/FetchJson").FetchObjectModeResultWithJson, import("effect/ParseResult").ParseError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").NotAuthenticated | OAuthTokenExpired | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | ApiRequestFailed | OAuthAuthMethodChanged, never>;
-        readonly fetchFetchSearch: (options: {
-            readonly search: {
-                readonly query: string;
-                readonly maxResults?: number | null | undefined;
-                readonly minScore?: number | null | undefined;
-            };
-            readonly snapshotId: string;
-            readonly include?: {
-                readonly html?: boolean | {
-                    readonly [x: string]: unknown;
-                } | null | undefined;
-                readonly markdown?: boolean | {
-                    readonly [x: string]: unknown;
-                } | null | undefined;
-                readonly screenshot?: boolean | {
-                    readonly fullPage?: boolean | null | undefined;
-                } | null | undefined;
-                readonly summary?: boolean | {
-                    readonly prompt?: string | null | undefined;
-                } | null | undefined;
-                readonly links?: boolean | {
-                    readonly sameDomainOnly?: boolean | null | undefined;
-                    readonly includePatterns?: readonly string[] | null | undefined;
-                    readonly excludePatterns?: readonly string[] | null | undefined;
-                } | null | undefined;
-                readonly meta?: boolean | null | undefined;
-                readonly response?: {
-                    readonly includeHeaders?: boolean | null | undefined;
-                } | null | undefined;
-                readonly json?: boolean | null | undefined;
-                readonly appendix?: boolean | null | undefined;
-            } | null | undefined;
-        }) => Effect.Effect<import("@expandai/sdk/FetchJson").FetchSnapshotSearchResultWithJson, import("effect/ParseResult").ParseError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").NotAuthenticated | OAuthTokenExpired | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | ApiRequestFailed | OAuthAuthMethodChanged, never>;
-        readonly fetchBatched: (options: {
-            readonly urls: readonly [string, ...string[]];
-            readonly include?: {
-                readonly html?: boolean | {
-                    readonly [x: string]: unknown;
-                } | null | undefined;
-                readonly markdown?: boolean | {
-                    readonly [x: string]: unknown;
-                } | null | undefined;
-                readonly screenshot?: boolean | {
-                    readonly fullPage?: boolean | null | undefined;
-                } | null | undefined;
-                readonly summary?: boolean | {
-                    readonly prompt?: string | null | undefined;
-                } | null | undefined;
-                readonly links?: boolean | {
-                    readonly sameDomainOnly?: boolean | null | undefined;
-                    readonly includePatterns?: readonly string[] | null | undefined;
-                    readonly excludePatterns?: readonly string[] | null | undefined;
-                } | null | undefined;
-                readonly meta?: boolean | null | undefined;
-                readonly response?: {
-                    readonly includeHeaders?: boolean | null | undefined;
-                } | null | undefined;
-                readonly json?: boolean | null | undefined;
-                readonly appendix?: boolean | null | undefined;
-            } | null | undefined;
-            readonly browserConfig?: {
-                readonly scrollFullPage?: boolean | null | undefined;
-            } | null | undefined;
-        }) => Effect.Effect<Generated.BatchedRun, import("effect/ParseResult").ParseError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").NotAuthenticated | OAuthTokenExpired | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | ApiRequestFailed | OAuthAuthMethodChanged, never>;
-        readonly fetchGetBatched: (id: string, options: {
-            readonly include?: string | null | undefined;
-            readonly limit?: string | null | undefined;
-            readonly offset?: string | null | undefined;
-        }) => Effect.Effect<Generated.BatchedStatus, import("effect/ParseResult").ParseError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").NotAuthenticated | OAuthTokenExpired | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | ApiRequestFailed | OAuthAuthMethodChanged, never>;
-    }, never, HttpClient.HttpClient | ConfigManager | BrowserOAuthService>;
+        readonly fetchFetch: (...args: Parameters<Generated.Client['fetchFetch']>) => Effect.Effect<string, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly fetchFetchResult: (...args: Parameters<Generated.Client['fetchFetchJson']>) => Effect.Effect<import("@expandai/sdk/FetchJson").FetchObjectModeResultWithJson, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly fetchFetchJson: (...args: Parameters<Generated.Client['fetchFetchJson']>) => Effect.Effect<import("@expandai/sdk/FetchJson").FetchObjectModeResultWithJson, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly fetchFetchSearch: (...args: Parameters<Generated.Client['fetchFetchSearch']>) => Effect.Effect<import("@expandai/sdk/FetchJson").FetchSnapshotSearchResultWithJson, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly fetchBatched: (...args: Parameters<Generated.Client['fetchBatched']>) => Effect.Effect<Generated.BatchedRun, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly fetchGetBatched: (...args: Parameters<Generated.Client['fetchGetBatched']>) => Effect.Effect<Generated.BatchedStatus, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+    }, never, BrowserOAuthService | ConfigManager | HttpClient.HttpClient>;
 }>;
 /**
  * Resolves outgoing API auth per call. When the current request scope carries

package/build/dts/ApiClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiClient.d.ts","sourceRoot":"","sources":["../../src/ApiClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAyC,MAAM,kBAAkB,CAAA;AAGpF,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AAEpD,OAAO,EAA4B,MAAM,EAAiC,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAe,iBAAiB,EAAE,MAAM,aAAa,CAAA;;;;;;AAG3E;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,qBAEpC;IACD,IAAI,OAAO,WAEV;CACD;;;;AAcD,cAAM,sBAAuB,SAAQ,4BAA2C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DzG;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,cAwJ7B;CAAG"}
+{"version":3,"file":"ApiClient.d.ts","sourceRoot":"","sources":["../../src/ApiClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAyC,MAAM,kBAAkB,CAAA;AAGpF,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AAEpD,OAAO,EAA4B,MAAM,EAAuB,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEhG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAe,iBAAiB,EAAE,MAAM,aAAa,CAAA;;;;;;;;;;;;;;;;;;;;;;;;AAG3E,qBAAa,0BAA2B,SAAQ,+BAc9C;CAAG;AAEL,QAAA,MAAM,gCAAgC;;;;;;EAMpC,CAAA;AAEF,MAAM,MAAM,gCAAgC,GAAG,OAAO,gCAAgC,CAAC,IAAI,CAAA;AAE3F;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B;;;;;;GAMG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;;;;;;;;;AAItF,qBAAa,2BAA4B,SAAQ,gCAQhD;IACA,IAAI,OAAO,WAIV;CACD;;;;;;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,qBAEpC;IACD,IAAI,OAAO,WAEV;CACD;;;;AAcD,cAAM,sBAAuB,SAAQ,4BAA2C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAAG;;;;;8BAgFnF,iBAAiB;4BACnB,SAAS,GAAG,QAAQ;+BACjB,MAAM;mCACF,MAAM;iCACR,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA1B/B,+EAA+E;AAC/E,qBAAa,4BAA6B,SAAQ,iCA8HjD;CAAG;;;;uCAmJqB,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;6CAEpC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;2CAEhD,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;6CAE5C,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;yCAEpD,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;4CAEzC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;;;AA3J7E;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,cA0J7B;CAAG"}

package/build/dts/Auth/Domain.d.ts

@@ -0,0 +1,95 @@
+import { Schema } from 'effect';
+/**
+ * The OAuth client for browser-approved CLI setup. Distinct from the
+ * `expandai-cli` client that `expandai login` uses: that one keeps loopback
+ * redirect URIs and must keep showing a consent screen, because Better Auth
+ * matches loopback URIs without comparing the port.
+ */
+export declare const CLI_AUTHORIZATION_CLIENT_ID = "expandai-cli-browser";
+export declare const PendingInitKey: Schema.Struct<{
+    apiOrigin: typeof Schema.String;
+    clientId: Schema.Literal<["expandai-cli-browser"]>;
+    harness: Schema.Literal<["agent-harnesses"]>;
+    scope: Schema.Literal<["project", "global"]>;
+    canonicalScopeRoot: typeof Schema.String;
+}>;
+export type PendingInitKey = typeof PendingInitKey.Type;
+declare const PendingInitRecord_base: Schema.Class<PendingInitRecord, {
+    key: Schema.Struct<{
+        apiOrigin: typeof Schema.String;
+        clientId: Schema.Literal<["expandai-cli-browser"]>;
+        harness: Schema.Literal<["agent-harnesses"]>;
+        scope: Schema.Literal<["project", "global"]>;
+        canonicalScopeRoot: typeof Schema.String;
+    }>;
+    deviceCode: Schema.Redacted<typeof Schema.String>;
+    userCode: typeof Schema.String;
+    verificationUri: typeof Schema.String;
+    intervalSeconds: typeof Schema.Number;
+    nextPollAt: typeof Schema.DateTimeUtc;
+    approvalExpiresAt: typeof Schema.DateTimeUtc;
+}, Schema.Struct.Encoded<{
+    key: Schema.Struct<{
+        apiOrigin: typeof Schema.String;
+        clientId: Schema.Literal<["expandai-cli-browser"]>;
+        harness: Schema.Literal<["agent-harnesses"]>;
+        scope: Schema.Literal<["project", "global"]>;
+        canonicalScopeRoot: typeof Schema.String;
+    }>;
+    deviceCode: Schema.Redacted<typeof Schema.String>;
+    userCode: typeof Schema.String;
+    verificationUri: typeof Schema.String;
+    intervalSeconds: typeof Schema.Number;
+    nextPollAt: typeof Schema.DateTimeUtc;
+    approvalExpiresAt: typeof Schema.DateTimeUtc;
+}>, never, {
+    readonly approvalExpiresAt: import("effect/DateTime").Utc;
+} & {
+    readonly deviceCode: import("effect/Redacted").Redacted<string>;
+} & {
+    readonly intervalSeconds: number;
+} & {
+    readonly key: {
+        readonly apiOrigin: string;
+        readonly clientId: "expandai-cli-browser";
+        readonly harness: "agent-harnesses";
+        readonly scope: "global" | "project";
+        readonly canonicalScopeRoot: string;
+    };
+} & {
+    readonly nextPollAt: import("effect/DateTime").Utc;
+} & {
+    readonly userCode: string;
+} & {
+    readonly verificationUri: string;
+}, {}, {}>;
+/**
+ * One pending RFC 8628 device authorization. The `deviceCode` is the whole
+ * credential — better-auth binds it to our client id server-side and it never
+ * leaves this machine — so the record keeps the same 0600/no-symlink storage
+ * discipline the PKCE verifier had.
+ */
+export declare class PendingInitRecord extends PendingInitRecord_base {
+}
+declare const PendingInitCorrupt_base: Schema.TaggedErrorClass<PendingInitCorrupt, "PendingInitCorrupt", {
+    readonly _tag: Schema.tag<"PendingInitCorrupt">;
+} & {
+    path: typeof Schema.String;
+    error: typeof Schema.Defect;
+}>;
+export declare class PendingInitCorrupt extends PendingInitCorrupt_base {
+    readonly recoverable = true;
+    get message(): string;
+}
+declare const PendingInitStorageError_base: Schema.TaggedErrorClass<PendingInitStorageError, "PendingInitStorageError", {
+    readonly _tag: Schema.tag<"PendingInitStorageError">;
+} & {
+    path: typeof Schema.String;
+    error: typeof Schema.Defect;
+}>;
+export declare class PendingInitStorageError extends PendingInitStorageError_base {
+    readonly recoverable = true;
+    get message(): string;
+}
+export {};
+//# sourceMappingURL=Domain.d.ts.map

package/build/dts/Auth/Domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Domain.d.ts","sourceRoot":"","sources":["../../../src/Auth/Domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,yBAAyB,CAAA;AAEjE,eAAO,MAAM,cAAc;;;;;;EAMzB,CAAA;AAEF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEvD;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,sBAcrC;CAAG;;;;;;;AAEL,qBAAa,kBAAmB,SAAQ,uBAGtC;IACD,QAAQ,CAAC,WAAW,QAAO;IAE3B,IAAI,OAAO,WAEV;CACD;;;;;;;AAED,qBAAa,uBAAwB,SAAQ,4BAG3C;IACD,QAAQ,CAAC,WAAW,QAAO;IAE3B,IAAI,OAAO,WAEV;CACD"}

package/build/dts/Auth/ManualAuthorization.d.ts

@@ -0,0 +1,107 @@
+import { DateTime, Effect, Schema } from 'effect';
+import { ManualAuthorizationApiClient, ManualAuthorizationApiError } from '../ApiClient.js';
+import { ConfigManager } from '../Config.js';
+import { PendingInitStore } from './PendingInit.js';
+export { ALREADY_AUTHENTICATED_MESSAGE, AUTHORIZATION_CONSUMED_MESSAGE, AUTHORIZATION_REQUIRED_MESSAGE, } from '../Init/Domain.js';
+declare const ManualAuthorizationInput_base: Schema.Class<ManualAuthorizationInput, {
+    harness: Schema.Literal<["agent-harnesses"]>;
+    scope: Schema.Literal<["project", "global"]>;
+    cwd: Schema.optional<typeof Schema.String>;
+    platform: Schema.optional<typeof Schema.String>;
+}, Schema.Struct.Encoded<{
+    harness: Schema.Literal<["agent-harnesses"]>;
+    scope: Schema.Literal<["project", "global"]>;
+    cwd: Schema.optional<typeof Schema.String>;
+    platform: Schema.optional<typeof Schema.String>;
+}>, never, {
+    readonly cwd?: string | undefined;
+} & {
+    readonly platform?: string | undefined;
+} & {
+    readonly harness: "agent-harnesses";
+} & {
+    readonly scope: "global" | "project";
+}, {}, {}>;
+export declare class ManualAuthorizationInput extends ManualAuthorizationInput_base {
+}
+declare const ManualAuthorizationRequired_base: Schema.Class<ManualAuthorizationRequired, {
+    verificationUri: typeof Schema.String;
+    userCode: typeof Schema.NonEmptyString;
+    approvalExpiresAt: typeof Schema.DateTimeUtc;
+}, Schema.Struct.Encoded<{
+    verificationUri: typeof Schema.String;
+    userCode: typeof Schema.NonEmptyString;
+    approvalExpiresAt: typeof Schema.DateTimeUtc;
+}>, never, {
+    readonly approvalExpiresAt: DateTime.Utc;
+} & {
+    readonly userCode: string;
+} & {
+    readonly verificationUri: string;
+}, {}, {}>;
+/** What the agent relays: where to approve, and the code to type there. */
+export declare class ManualAuthorizationRequired extends ManualAuthorizationRequired_base {
+}
+declare const TokensSaved_base: Schema.TaggedClass<TokensSaved, "TokensSaved", {
+    readonly _tag: Schema.tag<"TokensSaved">;
+}>;
+/**
+ * One `advance` call moves the flow as far as it can without blocking, then
+ * returns. RFC 8628's polling loop is inverted: the agent re-invokes the CLI,
+ * and each invocation polls the token endpoint at most once — or not at all,
+ * when the persisted interval says the server would answer `slow_down`.
+ */
+export declare class TokensSaved extends TokensSaved_base {
+}
+declare const AuthorizationPending_base: Schema.TaggedClass<AuthorizationPending, "AuthorizationPending", {
+    readonly _tag: Schema.tag<"AuthorizationPending">;
+} & {
+    pending: typeof ManualAuthorizationRequired;
+}>;
+export declare class AuthorizationPending extends AuthorizationPending_base {
+}
+export declare const ManualAuthorizationOutcome: Schema.Union<[typeof TokensSaved, typeof AuthorizationPending]>;
+export type ManualAuthorizationOutcome = typeof ManualAuthorizationOutcome.Type;
+declare const ManualAuthorizationDenied_base: Schema.TaggedErrorClass<ManualAuthorizationDenied, "ManualAuthorizationDenied", {
+    readonly _tag: Schema.tag<"ManualAuthorizationDenied">;
+} & {
+    recoverable: Schema.Literal<[true]>;
+}>;
+export declare class ManualAuthorizationDenied extends ManualAuthorizationDenied_base {
+    get message(): string;
+}
+declare const ManualAuthorizationRefused_base: Schema.TaggedErrorClass<ManualAuthorizationRefused, "ManualAuthorizationRefused", {
+    readonly _tag: Schema.tag<"ManualAuthorizationRefused">;
+} & {
+    error: typeof Schema.String;
+    description: Schema.optional<typeof Schema.String>;
+    recoverable: Schema.Literal<[false]>;
+}>;
+/**
+ * The server refused redemption for a reason a fresh code cannot fix. Kept
+ * separate from every other failure because the correct response is the
+ * opposite of the usual one: do not start over, stop and report. Re-minting
+ * here is what produced an endless approve loop — each new code is approved by
+ * the user and then refused identically, with nothing surfaced.
+ */
+export declare class ManualAuthorizationRefused extends ManualAuthorizationRefused_base {
+    get message(): string;
+}
+declare const ManualAuthorizationCredentialSaveFailed_base: Schema.TaggedErrorClass<ManualAuthorizationCredentialSaveFailed, "ManualAuthorizationCredentialSaveFailed", {
+    readonly _tag: Schema.tag<"ManualAuthorizationCredentialSaveFailed">;
+} & {
+    recoverable: Schema.Literal<[false]>;
+}>;
+export declare class ManualAuthorizationCredentialSaveFailed extends ManualAuthorizationCredentialSaveFailed_base {
+    get message(): string;
+}
+declare const ManualAuthorization_base: Effect.Service.Class<ManualAuthorization, "@expandai/cli/Auth/ManualAuthorization", {
+    readonly dependencies: readonly [import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<PendingInitStore, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<ManualAuthorizationApiClient, import("effect/ConfigError").ConfigError, never>];
+    readonly effect: Effect.Effect<{
+        readonly advance: (input: ManualAuthorizationInput) => Effect.Effect<AuthorizationPending | TokensSaved, import("../Config.js").ConfigParseError | import("../Config.js").CredentialStoreInsecure | ManualAuthorizationApiError | ManualAuthorizationCredentialSaveFailed | ManualAuthorizationDenied | ManualAuthorizationRefused | import("./Domain.js").PendingInitCorrupt | import("./Domain.js").PendingInitStorageError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly redeemPreApproved: (deviceCode: import("effect/Redacted").Redacted<string>) => Effect.Effect<undefined, import("../Config.js").ConfigParseError | import("../Config.js").CredentialStoreInsecure | ManualAuthorizationApiError | ManualAuthorizationCredentialSaveFailed | ManualAuthorizationDenied | ManualAuthorizationRefused | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+    }, never, ConfigManager | ManualAuthorizationApiClient | PendingInitStore>;
+}>;
+export declare class ManualAuthorization extends ManualAuthorization_base {
+}
+//# sourceMappingURL=ManualAuthorization.d.ts.map