expandai 0.0.1 → 0.0.3

package/build/dts/Auth/ManualAuthorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ManualAuthorization.d.ts","sourceRoot":"","sources":["../../../src/Auth/ManualAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAY,MAAM,EAAkB,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC3E,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAA;AAC3F,OAAO,EAAE,aAAa,EAAe,MAAM,cAAc,CAAA;AAIzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,GAC9B,MAAM,mBAAmB,CAAA;;;;;;;;;;;;;;;;;;;;AAO1B,qBAAa,wBAAyB,SAAQ,6BAK5C;CAAG;;;;;;;;;;;;;;;;AAEL,2EAA2E;AAC3E,qBAAa,2BAA4B,SAAQ,gCAM/C;CAAG;;;;AAEL;;;;;GAKG;AACH,qBAAa,WAAY,SAAQ,gBAAoD;CAAG;;;;;;AAExF,qBAAa,oBAAqB,SAAQ,yBAExC;CAAG;AAEL,eAAO,MAAM,0BAA0B,iEAAkD,CAAA;AACzF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;;;;;;AAE/E,qBAAa,yBAA0B,SAAQ,8BAK9C;IACA,IAAI,OAAO,WAEV;CACD;;;;;;;;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,+BAO/C;IACA,IAAI,OAAO,WAGV;CACD;;;;;;AAED,qBAAa,uCAAwC,SAAQ,4CAK5D;IACA,IAAI,OAAO,WAEV;CACD;;;;;;;;AAcD,qBAAa,mBAAoB,SAAQ,wBA8LxC;CAAG"}

package/build/dts/Auth/PendingInit.d.ts

@@ -0,0 +1,35 @@
+import { FileSystem, Path } from '@effect/platform';
+import { NodeContext } from '@effect/platform-node';
+import { Effect, Option } from 'effect';
+import { PendingInitCorrupt, type PendingInitKey, PendingInitRecord, PendingInitStorageError } from './Domain.js';
+/** Canonical, collision-free serialization of all pending authorization key fields. */
+export declare function serializePendingInitKey(key: PendingInitKey): string;
+declare const PendingInitStore_base: Effect.Service.Class<PendingInitStore, "@expandai/cli/Auth/PendingInitStore", {
+    readonly dependencies: readonly [import("effect/Layer").Layer<NodeContext.NodeContext, never, never>];
+    readonly effect: Effect.Effect<{
+        readonly pendingPath: string;
+        readonly get: (key: {
+            readonly apiOrigin: string;
+            readonly clientId: "expandai-cli-browser";
+            readonly harness: "agent-harnesses";
+            readonly scope: "global" | "project";
+            readonly canonicalScopeRoot: string;
+        }) => Effect.Effect<Option.Option<PendingInitRecord>, PendingInitCorrupt | PendingInitStorageError, never>;
+        readonly peek: (key: {
+            readonly apiOrigin: string;
+            readonly clientId: "expandai-cli-browser";
+            readonly harness: "agent-harnesses";
+            readonly scope: "global" | "project";
+            readonly canonicalScopeRoot: string;
+        }) => Effect.Effect<Option.Option<PendingInitRecord>, PendingInitCorrupt | PendingInitStorageError, never>;
+        readonly putIfAbsent: (record: PendingInitRecord) => Effect.Effect<PendingInitRecord, PendingInitCorrupt | PendingInitStorageError, never>;
+        readonly replaceIfMatch: (previous: PendingInitRecord, next: PendingInitRecord) => Effect.Effect<boolean, PendingInitCorrupt | PendingInitStorageError, never>;
+        readonly removeIfMatch: (record: PendingInitRecord) => Effect.Effect<boolean, PendingInitCorrupt | PendingInitStorageError, never>;
+        readonly pruneExpired: () => Effect.Effect<number, PendingInitStorageError, never>;
+        readonly canonicalScopeRoot: (scope: "global" | "project", cwd?: any) => Effect.Effect<string, PendingInitStorageError, never>;
+    }, import("effect/ConfigError").ConfigError, FileSystem.FileSystem | Path.Path>;
+}>;
+export declare class PendingInitStore extends PendingInitStore_base {
+}
+export {};
+//# sourceMappingURL=PendingInit.d.ts.map

package/build/dts/Auth/PendingInit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PendingInit.d.ts","sourceRoot":"","sources":["../../../src/Auth/PendingInit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,IAAI,EAA0B,MAAM,kBAAkB,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAY,MAAM,EAAU,MAAM,EAAU,MAAM,QAAQ,CAAA;AAEjE,OAAO,EAEN,kBAAkB,EAClB,KAAK,cAAc,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,MAAM,aAAa,CAAA;AA0BpB,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAQnE;;;;;;;;;;;;;;;;;;;;;;;;;;AAOD,qBAAa,gBAAiB,SAAQ,qBA4RpC;CAAG"}

package/build/dts/Auth/Pkce.d.ts

@@ -0,0 +1,10 @@
+import { Redacted } from 'effect';
+/** PKCE code verifier. Redacted so it cannot reach a log or a JSON result. */
+export declare function createCodeVerifier(): Redacted.Redacted<string>;
+export declare function codeChallengeFor(verifier: Redacted.Redacted<string>): string;
+/**
+ * Opaque high-entropy value for non-PKCE uses such as the OAuth `state`
+ * parameter. Same entropy and encoding, different purpose.
+ */
+export declare function createHighEntropySecret(): string;
+//# sourceMappingURL=Pkce.d.ts.map

package/build/dts/Auth/Pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pkce.d.ts","sourceRoot":"","sources":["../../../src/Auth/Pkce.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AASjC,8EAA8E;AAC9E,wBAAgB,kBAAkB,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE9D;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAE5E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD"}

package/build/dts/Auth/SetupGrantAuthorization.d.ts

@@ -0,0 +1,34 @@
+import { Effect, Redacted, Schema } from 'effect';
+import { ConfigManager } from '../Config.js';
+import { ManualAuthorization } from './ManualAuthorization.js';
+interface SetupGrantAuthorizationInput {
+    readonly setupToken: Redacted.Redacted<string>;
+    readonly harness: 'agent-harnesses';
+    readonly scope: 'project' | 'global';
+}
+declare const SetupGrantAuthorizationError_base: Schema.TaggedErrorClass<SetupGrantAuthorizationError, "SetupGrantAuthorizationError", {
+    readonly _tag: Schema.tag<"SetupGrantAuthorizationError">;
+} & {
+    code: Schema.Literal<["invalid_or_expired", "stored_credential_conflict", "request_failed", "denied", "credential_save_failed", "refused", "config_unreadable"]>;
+    recoverable: typeof Schema.Boolean;
+}>;
+export declare class SetupGrantAuthorizationError extends SetupGrantAuthorizationError_base {
+    get message(): "An Expand API key is already stored on this machine, and completing this setup would replace it with no way to recover it. Nothing was changed and your setup prompt is still valid. Run `expandai logout` to clear the stored key, then run this setup command again." | "Could not reach Expand to redeem the setup token. Nothing was sent, so the same token is still good — check the network and try again." | "Expand refused to redeem this setup token for a reason a fresh prompt cannot fix — most likely an OAuth client, resource, or scope misconfiguration on the server. Do not request another prompt; report this." | "The Expand config file on this machine could not be read, so setup cannot tell whether completing it would overwrite an existing API key. Nothing was redeemed and your setup prompt is still valid. Run `expandai whoami` to see which file it is, fix or delete it, then run this setup command again." | "The setup token is invalid, expired, or already used. Copy a fresh setup prompt from the Expand dashboard." | "The setup token was redeemed, but the credentials could not be saved on this machine. Fix credential storage — run `expandai whoami` to see the path it uses, and check its permissions — then copy a fresh setup prompt from the Expand dashboard." | "This setup authorization was denied. Copy a fresh setup prompt from the Expand dashboard.";
+}
+declare const SetupGrantAuthorization_base: Effect.Service.Class<SetupGrantAuthorization, "@expandai/cli/Auth/SetupGrantAuthorization", {
+    readonly dependencies: readonly [import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<ManualAuthorization, import("effect/ConfigError").ConfigError, never>];
+    readonly effect: Effect.Effect<{
+        readonly authorize: (input: SetupGrantAuthorizationInput) => Effect.Effect<undefined, SetupGrantAuthorizationError, never>;
+    }, never, ConfigManager | ManualAuthorization>;
+}>;
+/**
+ * Dashboard-minted setup: the "token" in the prompt is a pre-approved RFC 8628
+ * device code, already bound to the minting user and pinned to their
+ * organization server-side. Redeeming is a single poll of the OAuth token
+ * endpoint — better-auth owns generation, expiry and the single-use burn, so
+ * there is no redemption protocol of ours left to get wrong.
+ */
+export declare class SetupGrantAuthorization extends SetupGrantAuthorization_base {
+}
+export {};
+//# sourceMappingURL=SetupGrantAuthorization.d.ts.map

package/build/dts/Auth/SetupGrantAuthorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetupGrantAuthorization.d.ts","sourceRoot":"","sources":["../../../src/Auth/SetupGrantAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EACN,mBAAmB,EAInB,MAAM,0BAA0B,CAAA;AAEjC,UAAU,4BAA4B;IACrC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAA;CACpC;;;;;;;AAED,qBAAa,4BAA6B,SAAQ,iCAcjD;IACA,IAAI,OAAO,61CAyBV;CACD;;;;;;;AASD;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,4BA2C5C;CAAG"}

package/build/dts/Authentication.d.ts

@@ -1,23 +1,24 @@
 import { Command } from '@effect/cli';
 import { Effect } from 'effect';
 import { BrowserOAuthService } from './BrowserOAuth.js';
-import { ApiKeyConfig, ConfigManager, OAuthConfig } from './Config.js';
+import { type AuthMethod, ConfigManager } from './Config.js';
+export { type AuthMethodState, authMethodState, isAuthMethodLocallyUsable } from './Config.js';
 import { Uninstall } from './Install/Uninstall.js';
-type AuthMethod = typeof ApiKeyConfig.Type | typeof OAuthConfig.Type;
 /** Render a user-facing description of the current auth state. Pure given DateTime.now. */
 export declare const formatAuthStatus: (authMethod: AuthMethod) => Effect.Effect<string, never, never>;
 declare const Authentication_base: Effect.Service.Class<Authentication, "@expandai/cli/Authentication", {
-    readonly dependencies: readonly [import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<BrowserOAuthService, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<Uninstall, import("effect/ConfigError").ConfigError | import("@effect/platform/Error").BadArgument, never>];
+    readonly dependencies: readonly [import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<BrowserOAuthService, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<Uninstall, import("@effect/platform/Error").BadArgument | import("effect/ConfigError").ConfigError, never>];
     readonly effect: Effect.Effect<{
+        readonly hasLocallyUsableCredentials: () => Effect.Effect<boolean, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly loginWithBrowser: () => Effect.Effect<void, unknown, never>;
         readonly login: () => Effect.Effect<void, unknown, import("@effect/platform/Terminal").Terminal>;
-        readonly whoami: () => Effect.Effect<void, import("./Config.js").ConfigParseError | import("./Config.js").NotAuthenticated | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly logout: () => Effect.Effect<void, import("effect/ParseResult").ParseError | import("./Config.js").ConfigNotWritable | import("@effect/platform/Error").PlatformError | import("./Install/Domain.js").McpParseError | import("./Install/Domain.js").McpWriteError | import("@effect/platform/Terminal").QuitException, import("@effect/platform/Terminal").Terminal>;
-    }, never, ConfigManager | BrowserOAuthService | Uninstall>;
+        readonly whoami: () => Effect.Effect<void, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly logout: () => Effect.Effect<void, import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").CredentialStoreInsecure | import("./Install/Domain.js").McpParseError | import("./Install/Domain.js").McpWriteError | import("effect/ParseResult").ParseError | import("@effect/platform/Terminal").QuitException | import("@effect/platform/Error").PlatformError, import("@effect/platform/Terminal").Terminal>;
+    }, never, BrowserOAuthService | ConfigManager | Uninstall>;
 }>;
 export declare class Authentication extends Authentication_base {
 }
 export declare const LoginCommand: Command.Command<"login", Authentication | import("@effect/platform/Terminal").Terminal, unknown, {}>;
-export declare const WhoamiCommand: Command.Command<"whoami", Authentication, import("./Config.js").ConfigParseError | import("./Config.js").NotAuthenticated | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, {}>;
-export declare const LogoutCommand: Command.Command<"logout", Authentication | import("@effect/platform/Terminal").Terminal, import("effect/ParseResult").ParseError | import("./Config.js").ConfigNotWritable | import("@effect/platform/Error").PlatformError | import("./Install/Domain.js").McpParseError | import("./Install/Domain.js").McpWriteError | import("@effect/platform/Terminal").QuitException, {}>;
-export {};
+export declare const WhoamiCommand: Command.Command<"whoami", Authentication, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, {}>;
+export declare const LogoutCommand: Command.Command<"logout", Authentication | import("@effect/platform/Terminal").Terminal, import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").CredentialStoreInsecure | import("./Install/Domain.js").McpParseError | import("./Install/Domain.js").McpWriteError | import("effect/ParseResult").ParseError | import("@effect/platform/Terminal").QuitException | import("@effect/platform/Error").PlatformError, {}>;
 //# sourceMappingURL=Authentication.d.ts.map

package/build/dts/Authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Authentication.d.ts","sourceRoot":"","sources":["../../src/Authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAU,MAAM,aAAa,CAAA;AAC7C,OAAO,EAA+B,MAAM,EAAiC,MAAM,QAAQ,CAAA;AAE3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAU,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAElD,KAAK,UAAU,GAAG,OAAO,YAAY,CAAC,IAAI,GAAG,OAAO,WAAW,CAAC,IAAI,CAAA;AAEpE,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,iEAe3B,CAAA;;;;;;;;;AAEF,qBAAa,cAAe,SAAQ,mBAyHlC;CAAG;AAEL,eAAO,MAAM,YAAY,sGAGxB,CAAA;AAED,eAAO,MAAM,aAAa,4NAGzB,CAAA;AAED,eAAO,MAAM,aAAa,kXAGzB,CAAA"}
+{"version":3,"file":"Authentication.d.ts","sourceRoot":"","sources":["../../src/Authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAU,MAAM,aAAa,CAAA;AAC7C,OAAO,EAA+B,MAAM,EAAiC,MAAM,QAAQ,CAAA;AAE3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAwB,KAAK,UAAU,EAAE,aAAa,EAA6B,MAAM,aAAa,CAAA;AAI7G,OAAO,EAAE,KAAK,eAAe,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAE9F,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAElD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,iEAe3B,CAAA;;;;;;;;;;;AAEF,qBAAa,cAAe,SAAQ,mBA4JlC;CAAG;AAEL,eAAO,MAAM,YAAY,sGAGxB,CAAA;AAED,eAAO,MAAM,aAAa,4QAGzB,CAAA;AAED,eAAO,MAAM,aAAa,6cAGzB,CAAA"}

package/build/dts/BrowserOAuth.d.ts

@@ -14,15 +14,15 @@ declare const TokenResponse_base: Schema.Class<TokenResponse, {
     token_type: typeof Schema.String;
     scope: Schema.optional<typeof Schema.String>;
 }>, never, {
+    readonly refresh_token?: string | undefined;
+} & {
+    readonly scope?: string | undefined;
+} & {
     readonly access_token: string;
 } & {
     readonly expires_in: Duration.Duration;
 } & {
     readonly token_type: string;
-} & {
-    readonly refresh_token?: string | undefined;
-} & {
-    readonly scope?: string | undefined;
 }, {}, {}>;
 export declare class TokenResponse extends TokenResponse_base {
 }
@@ -87,11 +87,11 @@ export declare const buildAuthorizeUrl: (args_0: AuthorizeUrlInput) => Effect.Ef
 declare const BrowserOAuthService_base: Effect.Service.Class<BrowserOAuthService, "@expandai/cli/BrowserOAuthService", {
     readonly dependencies: readonly [import("effect/Layer").Layer<HttpClient.HttpClient, never, never>, import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>];
     readonly effect: Effect.Effect<{
-        readonly exchangeCode: (args_0: ExchangeCodeInput) => Effect.Effect<TokenResponse, import("./Config.js").ConfigParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError | BrowserOAuthRequestFailed, never>;
-        readonly refreshToken: (refreshToken: string) => Effect.Effect<TokenResponse, import("./Config.js").ConfigParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError | BrowserOAuthRequestFailed, never>;
-        readonly saveToken: (tokenResponse: TokenResponse) => Effect.Effect<void, import("effect/ParseResult").ParseError | import("./Config.js").ConfigNotWritable, never>;
+        readonly exchangeCode: (args_0: ExchangeCodeInput) => Effect.Effect<TokenResponse, BrowserOAuthRequestFailed | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly refreshToken: (refreshToken: string, clientId?: string | undefined) => Effect.Effect<TokenResponse, BrowserOAuthRequestFailed | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        readonly saveToken: (tokenResponse: TokenResponse) => Effect.Effect<void, import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("effect/ParseResult").ParseError | import("@effect/platform/Error").PlatformError, never>;
         readonly login: <R>(openAuthorizeUrl: (authorizeUrl: URL) => Effect.Effect<void, unknown, R>) => Effect.Effect<undefined, unknown, R>;
-    }, never, HttpClient.HttpClient | ConfigManager>;
+    }, never, ConfigManager | HttpClient.HttpClient>;
 }>;
 export declare class BrowserOAuthService extends BrowserOAuthService_base {
 }

package/build/dts/BrowserOAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BrowserOAuth.d.ts","sourceRoot":"","sources":["../../src/BrowserOAuth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAyC,MAAM,kBAAkB,CAAA;AAEpF,OAAO,EAAY,QAAQ,EAAE,MAAM,EAAyB,MAAM,EAAE,MAAM,QAAQ,CAAA;AAClF,OAAO,EAAE,aAAa,EAAe,MAAM,aAAa,CAAA;;;;;;;;;;;;;;;;;;;;;;;;AAexD,qBAAa,aAAc,SAAQ,kBAMjC;CAAG;;;;;;;;AAEL,qBAAa,yBAA0B,SAAQ,8BAO9C;IACA,IAAI,OAAO,WAEV;CACD;;;;;;;AAED,qBAAa,yBAA0B,SAAQ,8BAM9C;IACA,IAAI,OAAO,WAEV;CACD;;;;AAED,qBAAa,uBAAwB,SAAQ,4BAG5C;IACA,IAAI,OAAO,WAEV;CACD;;;;AAED,qBAAa,yBAA0B,SAAQ,8BAG9C;IACA,IAAI,OAAO,WAEV;CACD;;;;;;AAED,qBAAa,0BAA2B,SAAQ,+BAK/C;IACA,IAAI,OAAO,WAEV;CACD;;;;AAED,qBAAa,oBAAqB,SAAQ,yBAAsE;IAC/G,IAAI,OAAO,WAEV;CACD;AAID,UAAU,iBAAiB;IAC1B,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC9B;AAED,UAAU,iBAAiB;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC7B;AAgBD,eAAO,MAAM,mBAAmB,+DAE9B,CAAA;AAEF,eAAO,MAAM,iBAAiB,iEAe5B,CAAA;;;;;;;yBA6LgE,CAAC,mCAC/B,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;;;AAhF3E,qBAAa,mBAAoB,SAAQ,wBAkHvC;CAAG"}
+{"version":3,"file":"BrowserOAuth.d.ts","sourceRoot":"","sources":["../../src/BrowserOAuth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAyC,MAAM,kBAAkB,CAAA;AAEpF,OAAO,EAAY,QAAQ,EAAE,MAAM,EAAyB,MAAM,EAAE,MAAM,QAAQ,CAAA;AAElF,OAAO,EAAE,aAAa,EAAe,MAAM,aAAa,CAAA;;;;;;;;;;;;;;;;;;;;;;;;AAexD,qBAAa,aAAc,SAAQ,kBAMjC;CAAG;;;;;;;;AAEL,qBAAa,yBAA0B,SAAQ,8BAO9C;IACA,IAAI,OAAO,WAEV;CACD;;;;;;;AAED,qBAAa,yBAA0B,SAAQ,8BAM9C;IACA,IAAI,OAAO,WAEV;CACD;;;;AAED,qBAAa,uBAAwB,SAAQ,4BAG5C;IACA,IAAI,OAAO,WAEV;CACD;;;;AAED,qBAAa,yBAA0B,SAAQ,8BAG9C;IACA,IAAI,OAAO,WAEV;CACD;;;;;;AAED,qBAAa,0BAA2B,SAAQ,+BAK/C;IACA,IAAI,OAAO,WAEV;CACD;;;;AAED,qBAAa,oBAAqB,SAAQ,yBAAsE;IAC/G,IAAI,OAAO,WAEV;CACD;AAID,UAAU,iBAAiB;IAC1B,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC9B;AAED,UAAU,iBAAiB;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC7B;AAQD,eAAO,MAAM,mBAAmB,+DAE9B,CAAA;AAEF,eAAO,MAAM,iBAAiB,iEAe5B,CAAA;;;;;;;yBAkMgE,CAAC,mCAC/B,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;;;AArF3E,qBAAa,mBAAoB,SAAQ,wBAwHvC;CAAG"}

package/build/dts/CommandPath.d.ts

@@ -0,0 +1,2 @@
+export declare function commandFromArgv(argv: readonly string[]): string;
+//# sourceMappingURL=CommandPath.d.ts.map

package/build/dts/CommandPath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandPath.d.ts","sourceRoot":"","sources":["../../src/CommandPath.ts"],"names":[],"mappings":"AAwBA,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAK/D"}

package/build/dts/Commands/Fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Fetch.d.ts","sourceRoot":"","sources":["../../../src/Commands/Fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,OAAO,EAAW,MAAM,aAAa,CAAA;AAE7D,OAAO,EAAW,MAAM,EAAS,MAAM,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAA;;;;;;AAIvE,qBAAa,mBAAoB,SAAQ,wBAEvC;IACD,IAAI,OAAO,WAEV;CACD;;;;;;;AAED,qBAAa,mBAAoB,SAAQ,wBAGvC;IACD,IAAI,OAAO,WAEV;CACD;AAaD,eAAO,MAAM,WAAW,6DAatB,CAAA;AAmCF,UAAU,kBAAkB;IAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAkErF,CAAA"}
+{"version":3,"file":"Fetch.d.ts","sourceRoot":"","sources":["../../../src/Commands/Fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,OAAO,EAAW,MAAM,aAAa,CAAA;AAE7D,OAAO,EAAW,MAAM,EAAS,MAAM,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAA;;;;;;AAMvE,qBAAa,mBAAoB,SAAQ,wBAEvC;IACD,IAAI,OAAO,WAEV;CACD;;;;;;;AAED,qBAAa,mBAAoB,SAAQ,wBAGvC;IACD,IAAI,OAAO,WAEV;CACD;AAaD,eAAO,MAAM,WAAW,6DAatB,CAAA;AAmCF,UAAU,kBAAkB;IAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CA+FrF,CAAA"}

package/build/dts/Commands/Hook.d.ts

@@ -2,14 +2,14 @@ import { Command } from '@effect/cli';
 import { ClaudeHook } from '../Hook/Claude.js';
 import { OpencodeHook } from '../Hook/Opencode.js';
 import { HookInstaller } from '../Install/Hook.js';
-export declare const HumanHookCommand: Command.Command<"hook", HookInstaller | ClaudeHook | OpencodeHook, import("effect/ParseResult").ParseError | import("@effect/platform/Error").PlatformError | import("../Install/Domain.js").McpParseError | import("../Install/Domain.js").McpWriteError | import("../Hook/Errors.js").HookProtocolFailed, {
-    readonly subcommand: import("effect/Option").Option<{} | {
+export declare const HumanHookCommand: Command.Command<"hook", ClaudeHook | HookInstaller | OpencodeHook, import("../Hook/Errors.js").HookProtocolFailed | import("../Install/Domain.js").McpParseError | import("../Install/Domain.js").McpWriteError | import("effect/ParseResult").ParseError | import("@effect/platform/Error").PlatformError, {
+    readonly subcommand: import("effect/Option").Option<{
         readonly host: "claude-code" | "opencode";
-        readonly scope: "project" | "global";
+        readonly scope: "global" | "project";
     } | {
         readonly host: "claude-code" | "opencode";
-        readonly scope: "project" | "global";
-    }>;
+        readonly scope: "global" | "project";
+    } | {}>;
 }>;
 export declare const AgentHookCommand: Command.Command<"hook", ClaudeHook | OpencodeHook, import("../Hook/Errors.js").HookProtocolFailed, {
     readonly subcommand: import("effect/Option").Option<{}>;

package/build/dts/Commands/Init.d.ts

@@ -0,0 +1,55 @@
+import { Command } from '@effect/cli';
+import { Terminal } from '@effect/platform';
+import { Effect, Option } from 'effect';
+import { Authentication } from '../Authentication.js';
+import { type InitHarnesses } from '../Init/Domain.js';
+import { HarnessDetector } from '../Init/HarnessDetector.js';
+import { InitService } from '../Init/Service.js';
+export declare const SUPPORTED_HARNESS_LIST = "claude-code, cursor, opencode, codex";
+/**
+ * Says that the *harness itself* is unsupported, rather than that the flag was
+ * malformed. An agent told only "invalid arguments" alongside a list of four
+ * valid names will pick one of them and misreport the user's environment.
+ */
+export declare const UNSUPPORTED_HARNESS_MESSAGE = "Expand does not support that agent harness. Supported harnesses are claude-code, cursor, opencode, codex. Do not substitute a different harness: tell the user their agent is not supported yet.";
+export interface InitCommandOptions {
+    readonly detect: boolean;
+    readonly harness: Option.Option<string>;
+    readonly harnesses: Option.Option<string>;
+    readonly json: boolean;
+    readonly scope: Option.Option<string>;
+    readonly setupToken: Option.Option<string>;
+}
+/**
+ * Decodes `--harnesses claude-code,cursor`. Returns `undefined` for any
+ * unknown or empty entry: silently dropping one would configure less than the
+ * user asked for, which is the failure mode this flag exists to prevent.
+ */
+export declare function parseHarnessSelection(value: string): InitHarnesses | undefined;
+export interface OnboardingExecutionModeInput {
+    readonly argv: readonly string[];
+    readonly environment: Readonly<Record<string, string | undefined>>;
+    readonly stdinIsTty: boolean;
+    readonly stdoutIsTty: boolean;
+}
+export interface InitExecutionModeInput extends OnboardingExecutionModeInput {
+}
+/** Selects a safe onboarding surface before either CLI tree parses the command. */
+export declare function resolveOnboardingExecutionMode(input: OnboardingExecutionModeInput, command: 'init' | 'status'): 'human' | 'machine' | undefined;
+/** Selects the safe init surface before either CLI tree parses the command. */
+export declare function resolveInitExecutionMode(input: InitExecutionModeInput): 'human' | 'machine' | undefined;
+/** Returns a safe JSON error before Effect CLI can render ordinary parser help. */
+export declare function preflightAgentInitArgv(argv: readonly string[]): string | undefined;
+declare const InitTerminalInteraction_base: Effect.Service.Class<InitTerminalInteraction, "@expandai/cli/Commands/InitTerminalInteraction", {
+    readonly effect: Effect.Effect<{
+        readonly chooseScope: () => Effect.Effect<"global" | "project", Terminal.QuitException, never>;
+        readonly chooseHarnesses: (detected: readonly ("claude-code" | "codex" | "cursor" | "opencode")[]) => Effect.Effect<("claude-code" | "codex" | "cursor" | "opencode")[], Terminal.QuitException, never>;
+    }, never, Terminal.Terminal>;
+}>;
+export declare class InitTerminalInteraction extends InitTerminalInteraction_base {
+}
+export declare const runHumanInit: (options: InitCommandOptions) => Effect.Effect<void, Terminal.QuitException, Authentication | HarnessDetector | InitService | InitTerminalInteraction>;
+export declare const HumanInitCommand: Command.Command<"init", Authentication | HarnessDetector | InitService | InitTerminalInteraction, Terminal.QuitException, InitCommandOptions>;
+export declare const AgentInitCommand: Command.Command<"init", HarnessDetector | InitService, never, InitCommandOptions>;
+export {};
+//# sourceMappingURL=Init.d.ts.map

package/build/dts/Commands/Init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Init.d.ts","sourceRoot":"","sources":["../../../src/Commands/Init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAmB,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAkB,MAAM,EAAU,MAAM,EAAU,MAAM,QAAQ,CAAA;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAKN,KAAK,aAAa,EAKlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAA;AAkClE,eAAO,MAAM,sBAAsB,yCAAyC,CAAA;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,qMAA0L,CAAA;AAiClO,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAS9E;AAED,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAClE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,sBAAuB,SAAQ,4BAA4B;CAAG;AAM/E,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC7C,KAAK,EAAE,4BAA4B,EACnC,OAAO,EAAE,MAAM,GAAG,QAAQ,GACxB,OAAO,GAAG,SAAS,GAAG,SAAS,CAUjC;AAED,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAEvG;AAyCD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAsBlF;;;;;;;AA0HD,qBAAa,uBAAwB,SAAQ,4BA+B5C;CAAG;AA0BJ,eAAO,MAAM,YAAY,wJAsFvB,CAAA;AAIF,eAAO,MAAM,gBAAgB,+IAG5B,CAAA;AAED,eAAO,MAAM,gBAAgB,mFAG5B,CAAA"}

package/build/dts/Commands/Mcp.d.ts

@@ -1,11 +1,11 @@
 import { Command } from '@effect/cli';
 import { Mcp } from '../Install/Mcp.js';
-export declare const InstallSubCommand: Command.Command<"install", Mcp, import("@effect/platform/Error").PlatformError | import("../Install/Domain.js").McpParseError | import("../Install/Domain.js").McpWriteError, {
-    readonly host: "claude-code" | "cursor" | "opencode" | "codex";
-    readonly scope: "project" | "global";
+export declare const InstallSubCommand: Command.Command<"install", Mcp, import("../Install/Domain.js").McpParseError | import("../Install/Domain.js").McpWriteError | import("@effect/platform/Error").PlatformError, {
+    readonly host: "claude-code" | "codex" | "cursor" | "opencode";
+    readonly scope: "global" | "project";
 }>;
-export declare const UninstallSubCommand: Command.Command<"uninstall", Mcp, import("@effect/platform/Error").PlatformError | import("../Install/Domain.js").McpParseError | import("../Install/Domain.js").McpWriteError, {
-    readonly host: "claude-code" | "cursor" | "opencode" | "codex";
-    readonly scope: "project" | "global";
+export declare const UninstallSubCommand: Command.Command<"uninstall", Mcp, import("../Install/Domain.js").McpParseError | import("../Install/Domain.js").McpWriteError | import("@effect/platform/Error").PlatformError, {
+    readonly host: "claude-code" | "codex" | "cursor" | "opencode";
+    readonly scope: "global" | "project";
 }>;
 //# sourceMappingURL=Mcp.d.ts.map

package/build/dts/Commands/Search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Search.d.ts","sourceRoot":"","sources":["../../../src/Commands/Search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAW,MAAM,aAAa,CAAA;AACpD,OAAO,EAAiC,MAAM,EAAE,MAAM,QAAQ,CAAA;;;;;;;AAK9D,qBAAa,2BAA4B,SAAQ,gCAMhD;IACA,IAAI,OAAO,WAEV;CACD;AAkCD,UAAU,mBAAmB;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAiCxF,CAAA"}
+{"version":3,"file":"Search.d.ts","sourceRoot":"","sources":["../../../src/Commands/Search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAW,MAAM,aAAa,CAAA;AAEpD,OAAO,EAAiC,MAAM,EAAE,MAAM,QAAQ,CAAA;;;;;;;AAM9D,qBAAa,2BAA4B,SAAQ,gCAMhD;IACA,IAAI,OAAO,WAEV;CACD;AAkCD,UAAU,mBAAmB;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAoCxF,CAAA"}

package/build/dts/Commands/Skill.d.ts

@@ -2,11 +2,11 @@ import { Command } from '@effect/cli';
 import { Skill } from '../Install/Skill.js';
 export declare const SkillCommand: Command.Command<"skill", Skill, import("@effect/platform/Error").PlatformError, {
     readonly subcommand: import("effect/Option").Option<{
-        readonly host: "claude-code" | "cursor" | "opencode" | "codex";
-        readonly scope: "project" | "global";
+        readonly host: "claude-code" | "codex" | "cursor" | "opencode";
+        readonly scope: "global" | "project";
     } | {
-        readonly host: "claude-code" | "cursor" | "opencode" | "codex";
-        readonly scope: "project" | "global";
+        readonly host: "claude-code" | "codex" | "cursor" | "opencode";
+        readonly scope: "global" | "project";
     }>;
 }>;
 //# sourceMappingURL=Skill.d.ts.map

package/build/dts/Commands/Status.d.ts

@@ -0,0 +1,27 @@
+import { Command } from '@effect/cli';
+import { Terminal } from '@effect/platform';
+import { Effect, Option } from 'effect';
+import { StatusService } from '../Init/Status.js';
+import { type OnboardingExecutionModeInput } from './Init.js';
+export interface StatusCommandOptions {
+    readonly harness: Option.Option<string>;
+    readonly json: boolean;
+    readonly scope: Option.Option<string>;
+}
+/** Selects the status surface using the same machine-safety precedence as init. */
+export declare function resolveStatusExecutionMode(input: OnboardingExecutionModeInput): 'human' | 'machine' | undefined;
+/** Returns safe JSON before Effect CLI can render parser help or acquire services. */
+export declare function preflightAgentStatusArgv(argv: readonly string[]): string | undefined;
+declare const StatusTerminalInteraction_base: Effect.Service.Class<StatusTerminalInteraction, "@expandai/cli/Commands/StatusTerminalInteraction", {
+    readonly effect: Effect.Effect<{
+        readonly chooseHarness: () => Effect.Effect<"claude-code" | "codex" | "cursor" | "opencode", Terminal.QuitException, never>;
+        readonly chooseScope: () => Effect.Effect<"global" | "project", Terminal.QuitException, never>;
+    }, never, Terminal.Terminal>;
+}>;
+export declare class StatusTerminalInteraction extends StatusTerminalInteraction_base {
+}
+export declare const runHumanStatus: (options: StatusCommandOptions) => Effect.Effect<void, Terminal.QuitException, StatusService | StatusTerminalInteraction>;
+export declare const HumanStatusCommand: Command.Command<"status", StatusService | StatusTerminalInteraction, Terminal.QuitException, StatusCommandOptions>;
+export declare const AgentStatusCommand: Command.Command<"status", StatusService, never, StatusCommandOptions>;
+export {};
+//# sourceMappingURL=Status.d.ts.map

package/build/dts/Commands/Status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Status.d.ts","sourceRoot":"","sources":["../../../src/Commands/Status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAmB,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAW,MAAM,EAA4B,MAAM,EAAU,MAAM,QAAQ,CAAA;AAElF,OAAO,EAA+B,aAAa,EAAsB,MAAM,mBAAmB,CAAA;AAClG,OAAO,EAAE,KAAK,4BAA4B,EAAkC,MAAM,WAAW,CAAA;AA4B7F,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;CACrC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAE/G;AAsBD,sFAAsF;AACtF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAapF;;;;;;;AAuFD,qBAAa,yBAA0B,SAAQ,8BA6B9C;CAAG;AAEJ,eAAO,MAAM,cAAc,2HAmBzB,CAAA;AAIF,eAAO,MAAM,kBAAkB,oHAG9B,CAAA;AAED,eAAO,MAAM,kBAAkB,uEAG9B,CAAA"}

package/build/dts/Commands/Telemetry.d.ts

@@ -0,0 +1,7 @@
+import { Command } from '@effect/cli';
+import { ConfigManager } from '../Config.js';
+import { Telemetry } from '../Telemetry.js';
+export declare const TelemetryCommand: Command.Command<"telemetry", ConfigManager | Telemetry, import("../Config.js").ConfigCleanupError | import("../Config.js").ConfigNotWritable | import("../Config.js").ConfigParseError | import("../Config.js").CredentialStoreInsecure | import("effect/ParseResult").ParseError | import("@effect/platform/Error").PlatformError, {
+    readonly subcommand: import("effect/Option").Option<{}>;
+}>;
+//# sourceMappingURL=Telemetry.d.ts.map

package/build/dts/Commands/Telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Telemetry.d.ts","sourceRoot":"","sources":["../../../src/Commands/Telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAmC3C,eAAO,MAAM,gBAAgB;;EAG5B,CAAA"}

package/build/dts/Commands/Uninstall.d.ts

@@ -1,9 +1,9 @@
 import { Command } from '@effect/cli';
 import { Option } from 'effect';
 import { Uninstall } from '../Install/Uninstall.js';
-export declare const UninstallCommand: Command.Command<"uninstall", Uninstall, import("effect/ParseResult").ParseError | import("@effect/platform/Error").PlatformError | import("../Install/Domain.js").McpParseError | import("../Install/Domain.js").McpWriteError, {
-    readonly target: Option.Option<"mcp" | "all" | "hook" | "skill">;
-    readonly host: Option.Option<"claude-code" | "cursor" | "opencode" | "codex">;
-    readonly scope: Option.Option<"project" | "global">;
+export declare const UninstallCommand: Command.Command<"uninstall", Uninstall, import("../Install/Domain.js").McpParseError | import("../Install/Domain.js").McpWriteError | import("effect/ParseResult").ParseError | import("@effect/platform/Error").PlatformError, {
+    readonly target: Option.Option<"all" | "hook" | "mcp" | "skill">;
+    readonly host: Option.Option<"claude-code" | "codex" | "cursor" | "opencode">;
+    readonly scope: Option.Option<"global" | "project">;
 }>;
 //# sourceMappingURL=Uninstall.d.ts.map

package/build/dts/Config.d.ts

@@ -1,7 +1,28 @@
-import { FileSystem, Path } from '@effect/platform';
-import { DateTime, Effect, Schema } from 'effect';
+/**
+ * CLI configuration. Persisted at `$XDG_CONFIG_HOME/expandai/config.json`
+ * (default `~/.config/expandai/config.json`). `EXPAND_API_URL` overrides the
+ * file. `EXPAND_API_KEY` overrides an API key stored in the file, but not
+ * credentials established by `expandai login` or agent setup — signing in is a
+ * deliberate act, and an exported API key usually is not. `EXPAND_APP_URL`
+ * points guide links at the web app serving them.
+ */
+import { CommandExecutor, FileSystem, Path, Error as PlatformError } from '@effect/platform';
+import { NodeContext } from '@effect/platform-node';
+import { Config, DateTime, Effect, Option, Redacted, Schema } from 'effect';
 /** Production API endpoint used when neither `EXPAND_API_URL` nor the config file overrides it. */
 export declare const DEFAULT_API_URL = "https://api.expand.ai";
+/** Production web app used when `EXPAND_APP_URL` does not override it. */
+export declare const DEFAULT_APP_URL = "https://expand.ai";
+/**
+ * Lenient env readers. `Config.option` / `Config.withDefault` only absorb
+ * missing data — a present-but-malformed value (`CLAUDECODE=banana`,
+ * `EXPANDAI_HARNESS=bogus`) fails as InvalidData and would crash the CLI at
+ * layer construction. These read the raw string and degrade gracefully:
+ * flags follow the DO_NOT_TRACK convention (set unless an explicit off),
+ * literals decode to None instead of failing.
+ */
+export declare const envFlag: (name: string) => Config.Config<boolean>;
+export declare const envLiteral: <A extends string>(name: string, schema: Schema.Schema<A, A>) => Config.Config<Option.Option<A>>;
 export declare const ApiKey: Schema.Redacted<Schema.brand<typeof Schema.NonEmptyTrimmedString, "ApiKey">>;
 export declare const ApiKeyConfig: Schema.TaggedStruct<"ApiKey", {
     apiKey: Schema.Redacted<Schema.brand<typeof Schema.NonEmptyTrimmedString, "ApiKey">>;
@@ -10,6 +31,12 @@ export declare const OAuthConfig: Schema.TaggedStruct<"OAuth", {
     accessToken: Schema.Redacted<typeof Schema.String>;
     refreshToken: Schema.optional<Schema.Redacted<typeof Schema.String>>;
     expiresAt: typeof Schema.DateTimeUtc;
+    clientId: Schema.optional<typeof Schema.String>;
+}>;
+export declare const TelemetrySettings: Schema.Struct<{
+    enabled: Schema.optional<typeof Schema.Boolean>;
+    distinctId: Schema.optional<typeof Schema.String>;
+    noticeShown: Schema.optional<typeof Schema.Boolean>;
 }>;
 declare const ExpandCliConfig_base: Schema.Class<ExpandCliConfig, {
     apiUrl: Schema.optional<typeof Schema.URL>;
@@ -19,7 +46,13 @@ declare const ExpandCliConfig_base: Schema.Class<ExpandCliConfig, {
         accessToken: Schema.Redacted<typeof Schema.String>;
         refreshToken: Schema.optional<Schema.Redacted<typeof Schema.String>>;
         expiresAt: typeof Schema.DateTimeUtc;
+        clientId: Schema.optional<typeof Schema.String>;
     }>]>>;
+    telemetry: Schema.optional<Schema.Struct<{
+        enabled: Schema.optional<typeof Schema.Boolean>;
+        distinctId: Schema.optional<typeof Schema.String>;
+        noticeShown: Schema.optional<typeof Schema.Boolean>;
+    }>>;
 }, Schema.Struct.Encoded<{
     apiUrl: Schema.optional<typeof Schema.URL>;
     authMethod: Schema.optional<Schema.Union<[Schema.TaggedStruct<"ApiKey", {
@@ -28,23 +61,49 @@ declare const ExpandCliConfig_base: Schema.Class<ExpandCliConfig, {
         accessToken: Schema.Redacted<typeof Schema.String>;
         refreshToken: Schema.optional<Schema.Redacted<typeof Schema.String>>;
         expiresAt: typeof Schema.DateTimeUtc;
+        clientId: Schema.optional<typeof Schema.String>;
     }>]>>;
+    telemetry: Schema.optional<Schema.Struct<{
+        enabled: Schema.optional<typeof Schema.Boolean>;
+        distinctId: Schema.optional<typeof Schema.String>;
+        noticeShown: Schema.optional<typeof Schema.Boolean>;
+    }>>;
 }>, never, {
     readonly apiUrl?: URL | undefined;
 } & {
     readonly authMethod?: {
         readonly _tag: "ApiKey";
-        readonly apiKey: import("effect/Redacted").Redacted<string & import("effect/Brand").Brand<"ApiKey">>;
+        readonly apiKey: Redacted.Redacted<string & import("effect/Brand").Brand<"ApiKey">>;
     } | {
         readonly _tag: "OAuth";
-        readonly accessToken: import("effect/Redacted").Redacted<string>;
-        readonly refreshToken?: import("effect/Redacted").Redacted<string> | undefined;
+        readonly accessToken: Redacted.Redacted<string>;
+        readonly refreshToken?: Redacted.Redacted<string> | undefined;
         readonly expiresAt: DateTime.Utc;
+        readonly clientId?: string | undefined;
+    } | undefined;
+} & {
+    readonly telemetry?: {
+        readonly enabled?: boolean | undefined;
+        readonly distinctId?: string | undefined;
+        readonly noticeShown?: boolean | undefined;
     } | undefined;
 }, {}, {}>;
 export declare class ExpandCliConfig extends ExpandCliConfig_base {
     static readonly Json: Schema.transform<Schema.SchemaClass<unknown, string, never>, typeof ExpandCliConfig>;
 }
+export type AuthMethod = typeof ApiKeyConfig.Type | typeof OAuthConfig.Type;
+/**
+ * How a stored credential stands right now.
+ *
+ * `refresh_required` is deliberately distinct from `healthy`: an expired access
+ * token with a refresh token on disk is only a credential we *could* renew, and
+ * renewal can fail. Reporting it as healthy told agents a machine was authorized
+ * when the next call would fail.
+ */
+export type AuthMethodState = 'healthy' | 'refresh_required' | 'unusable';
+export declare function authMethodState(authMethod: AuthMethod, now: DateTime.Utc): AuthMethodState;
+/** Returns whether a local credential can be used now or renewed on first API use. */
+export declare function isAuthMethodLocallyUsable(authMethod: AuthMethod, now: DateTime.Utc): boolean;
 declare const ConfigNotWritable_base: Schema.TaggedErrorClass<ConfigNotWritable, "ConfigNotWritable", {
     readonly _tag: Schema.tag<"ConfigNotWritable">;
 } & {
@@ -53,6 +112,17 @@ declare const ConfigNotWritable_base: Schema.TaggedErrorClass<ConfigNotWritable,
 export declare class ConfigNotWritable extends ConfigNotWritable_base {
     get message(): string;
 }
+declare const ConfigCleanupError_base: Schema.TaggedErrorClass<ConfigCleanupError, "ConfigCleanupError", {
+    readonly _tag: Schema.tag<"ConfigCleanupError">;
+} & {
+    path: typeof Schema.String;
+    temporaryPath: typeof Schema.String;
+    error: typeof Schema.Defect;
+    operationError: typeof Schema.Defect;
+}>;
+export declare class ConfigCleanupError extends ConfigCleanupError_base {
+    get message(): string;
+}
 declare const ConfigParseError_base: Schema.TaggedErrorClass<ConfigParseError, "ConfigParseError", {
     readonly _tag: Schema.tag<"ConfigParseError">;
 } & {
@@ -62,6 +132,16 @@ declare const ConfigParseError_base: Schema.TaggedErrorClass<ConfigParseError, "
 export declare class ConfigParseError extends ConfigParseError_base {
     get message(): string;
 }
+declare const CredentialStoreInsecure_base: Schema.TaggedErrorClass<CredentialStoreInsecure, "CredentialStoreInsecure", {
+    readonly _tag: Schema.tag<"CredentialStoreInsecure">;
+} & {
+    path: typeof Schema.String;
+    reason: typeof Schema.String;
+    error: typeof Schema.Defect;
+}>;
+export declare class CredentialStoreInsecure extends CredentialStoreInsecure_base {
+    get message(): string;
+}
 declare const NotAuthenticated_base: Schema.TaggedErrorClass<NotAuthenticated, "NotAuthenticated", {
     readonly _tag: Schema.tag<"NotAuthenticated">;
 }>;
@@ -77,27 +157,38 @@ export declare class OAuthTokenExpired extends OAuthTokenExpired_base {
     get message(): string;
 }
 declare const ConfigManager_base: Effect.Service.Class<ConfigManager, "@expandai/cli/Config/ConfigManager", {
-    readonly dependencies: readonly [import("effect/Layer").Layer<FileSystem.FileSystem, never, never>, import("effect/Layer").Layer<Path.Path, never, never>];
+    readonly dependencies: readonly [import("effect/Layer").Layer<NodeContext.NodeContext, never, never>];
     readonly effect: Effect.Effect<{
         readonly configPath: string;
+        readonly inspectSecureStorage: () => Effect.Effect<void, CredentialStoreInsecure, never>;
+        readonly ensureSecureStorage: () => Effect.Effect<void, CredentialStoreInsecure, never>;
         readonly loadConfig: () => Effect.Effect<{
             apiUrl: URL;
             authMethod: NonNullable<{
                 readonly _tag: "ApiKey";
-                readonly apiKey: import("effect/Redacted").Redacted<string & import("effect/Brand").Brand<"ApiKey">>;
+                readonly apiKey: Redacted.Redacted<string & import("effect/Brand").Brand<"ApiKey">>;
             } | {
                 readonly _tag: "OAuth";
-                readonly accessToken: import("effect/Redacted").Redacted<string>;
-                readonly refreshToken?: import("effect/Redacted").Redacted<string> | undefined;
+                readonly accessToken: Redacted.Redacted<string>;
+                readonly refreshToken?: Redacted.Redacted<string> | undefined;
                 readonly expiresAt: DateTime.Utc;
+                readonly clientId?: string | undefined;
             } | undefined>;
-        }, ConfigParseError | NotAuthenticated | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly saveConfig: (config: ExpandCliConfig) => Effect.Effect<void, import("effect/ParseResult").ParseError | ConfigNotWritable, never>;
-        readonly updateConfig: (patch: Partial<ExpandCliConfig>) => Effect.Effect<void, import("effect/ParseResult").ParseError | ConfigNotWritable, never>;
-        readonly clearConfig: () => Effect.Effect<void, import("effect/ParseResult").ParseError | ConfigNotWritable, never>;
-        readonly getApiUrl: () => Effect.Effect<URL, ConfigParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
+        }, ConfigParseError | CredentialStoreInsecure | NotAuthenticated | import("effect/ConfigError").ConfigError | PlatformError.PlatformError, never>;
+        readonly saveConfig: (config: ExpandCliConfig) => Effect.Effect<void, ConfigCleanupError | ConfigNotWritable | CredentialStoreInsecure | import("effect/ParseResult").ParseError, never>;
+        readonly updateConfig: (patch: Partial<ExpandCliConfig>) => Effect.Effect<void, ConfigCleanupError | ConfigNotWritable | ConfigParseError | CredentialStoreInsecure | import("effect/ParseResult").ParseError | PlatformError.PlatformError, never>;
+        readonly clearConfig: () => Effect.Effect<undefined, PlatformError.BadArgument | ConfigCleanupError | ConfigNotWritable | CredentialStoreInsecure | import("effect/ParseResult").ParseError | PlatformError.SystemError, never>;
+        readonly readConfigFile: () => Effect.Effect<{
+            config: ExpandCliConfig;
+            parseFailed: boolean;
+        } | {
+            config: ExpandCliConfig;
+            parseFailed: boolean;
+        }, never, never>;
+        readonly getApiUrl: () => Effect.Effect<URL, ConfigParseError | CredentialStoreInsecure | import("effect/ConfigError").ConfigError | PlatformError.PlatformError, never>;
+        readonly getAppUrl: () => Effect.Effect<string, import("effect/ConfigError").ConfigError, never>;
         readonly getPlaygroundHost: () => Effect.Effect<string, import("effect/ConfigError").ConfigError, never>;
-    }, import("effect/ConfigError").ConfigError, FileSystem.FileSystem | Path.Path>;
+    }, import("effect/ConfigError").ConfigError, CommandExecutor.CommandExecutor | FileSystem.FileSystem | Path.Path>;
 }>;
 export declare class ConfigManager extends ConfigManager_base {
 }