expandai 0.0.4 → 0.0.5

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "expandai",
 	"type": "module",
-	"version": "0.0.4",
+	"version": "0.0.5",
 	"private": false,
 	"description": "Unified CLI and MCP server for ExpandAI",
 	"author": "ExpandAI",
@@ -14,10 +14,12 @@
 		"access": "public"
 	},
 	"files": [
-		"build/dts",
+		"build/assets",
+		"build/dts/index.d.ts",
+		"build/dts/Mcp/RequestHeaders.d.ts",
+		"build/dts/Mcp/Server.d.ts",
 		"build/esm",
 		"build/skills",
-		"src",
 		"!**/*.tsbuildinfo"
 	],
 	"bin": {
@@ -29,14 +31,14 @@
 			"types": "./build/dts/index.d.ts",
 			"import": "./build/esm/index.js"
 		},
-		"./*": {
-			"types": "./src/*.ts",
-			"import": "./build/esm/*.js"
+		"./Mcp/Server": {
+			"types": "./build/dts/Mcp/Server.d.ts",
+			"import": "./build/esm/index.js"
 		}
 	},
 	"scripts": {
 		"dev": "tsx --watch src/main.ts",
-		"build": "tsc -b tsconfig.build.json && rm -rf build/skills && cp -R skills build/skills && cp src/Install/Opencode/expandai-webfetch.js build/esm/Install/Opencode/expandai-webfetch.js && chmod +x build/esm/main.js",
+		"build": "rm -rf build/dts build/esm build/skills build/assets && tsc -b tsconfig.build.json --force && bun build --target=node --minify --external=msgpackr-extract --outfile=build/esm/main.js src/main.ts && bun build --target=node --minify --external=msgpackr-extract --outfile=build/esm/index.js src/index.ts && cp -R skills build/skills && mkdir -p build/assets/opencode && cp assets/opencode/expandai-webfetch.js build/assets/opencode/expandai-webfetch.js && chmod +x build/esm/main.js",
 		"build:bin": "bun ./scripts/build.ts --single",
 		"build:bin:all": "bun ./scripts/build.ts",
 		"check": "tsc -b tsconfig.json",
@@ -49,7 +51,15 @@
 		"test:integration": "bun run build && vitest run integration",
 		"coverage": "vitest --coverage"
 	},
-	"dependencies": {
+	"peerDependencies": {
+		"effect": "^3.21.2"
+	},
+	"peerDependenciesMeta": {
+		"effect": {
+			"optional": true
+		}
+	},
+	"devDependencies": {
 		"@effect/ai": "0.35.0",
 		"@effect/cli": "0.75.1",
 		"@effect/platform": "0.96.1",
@@ -57,9 +67,7 @@
 		"@expandai/sdk": "0.18.0",
 		"effect": "3.21.2",
 		"open": "^11.0.0",
-		"smol-toml": "^1.6.1"
-	},
-	"devDependencies": {
+		"smol-toml": "^1.6.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.150",
 		"@biomejs/biome": "^2.4.14",
 		"@effect/vitest": "0.29.0",

package/build/dts/ApiClient.d.ts

@@ -1,165 +0,0 @@
-import { HttpClient } from '@effect/platform';
-import * as Generated from '@expandai/sdk/Generated';
-import { Effect, Redacted, Schema } from 'effect';
-import { BrowserOAuthService } from './BrowserOAuth.js';
-import { ConfigManager, OAuthTokenExpired } from './Config.js';
-declare const DeviceAuthorizationCreated_base: Schema.Class<DeviceAuthorizationCreated, {
-    deviceCode: Schema.Redacted<typeof Schema.NonEmptyString>;
-    userCode: typeof Schema.NonEmptyString;
-    verificationUri: typeof Schema.URL;
-    expiresIn: Schema.filter<typeof Schema.Int>;
-    interval: Schema.filter<typeof Schema.Int>;
-}, Schema.Struct.Encoded<{
-    deviceCode: Schema.Redacted<typeof Schema.NonEmptyString>;
-    userCode: typeof Schema.NonEmptyString;
-    verificationUri: typeof Schema.URL;
-    expiresIn: Schema.filter<typeof Schema.Int>;
-    interval: Schema.filter<typeof Schema.Int>;
-}>, never, {
-    readonly deviceCode: Redacted.Redacted<string>;
-} & {
-    readonly expiresIn: number;
-} & {
-    readonly interval: number;
-} & {
-    readonly userCode: string;
-} & {
-    readonly verificationUri: URL;
-}, {}, {}>;
-export declare class DeviceAuthorizationCreated extends DeviceAuthorizationCreated_base {
-}
-declare const ManualAuthorizationTokenResponse: Schema.Struct<{
-    access_token: Schema.Redacted<typeof Schema.NonEmptyString>;
-    refresh_token: Schema.Redacted<typeof Schema.NonEmptyString>;
-    token_type: typeof Schema.NonEmptyString;
-    expires_in: Schema.filter<typeof Schema.Number>;
-    scope: Schema.optional<typeof Schema.String>;
-}>;
-export type ManualAuthorizationTokenResponse = typeof ManualAuthorizationTokenResponse.Type;
-/**
- * RFC 8628 §3.5 poll outcomes. These are results, not errors: an agent-driven
- * CLI returns immediately on every one of them, and only a transport failure
- * is exceptional.
- */
-export type DevicePollOutcome = {
-    readonly _tag: 'Tokens';
-    readonly token: ManualAuthorizationTokenResponse;
-} | {
-    readonly _tag: 'Pending';
-} | {
-    readonly _tag: 'SlowDown';
-} | {
-    readonly _tag: 'Denied';
-} | {
-    readonly _tag: 'Expired';
-} | {
-    readonly _tag: 'Invalid';
-}
-/**
- * The server refused for a reason a fresh code cannot fix — a misconfigured
- * client, resource, or scope. Distinct from `Invalid` because the recovery is
- * opposite: `Invalid` means start over, this means stop and report. Carries
- * the server's own `error` so the message names the actual cause instead of
- * guessing.
- */
- | {
-    readonly _tag: 'Refused';
-    readonly error: string;
-    readonly description?: string;
-};
-declare const ManualAuthorizationApiError_base: Schema.TaggedErrorClass<ManualAuthorizationApiError, "ManualAuthorizationApiError", {
-    readonly _tag: Schema.tag<"ManualAuthorizationApiError">;
-} & {
-    operation: Schema.Literal<["create", "poll"]>;
-    kind: Schema.Literal<["request_failed", "rejected", "invalid_response"]>;
-    status: Schema.optional<typeof Schema.Number>;
-    recoverable: typeof Schema.Boolean;
-}>;
-export declare class ManualAuthorizationApiError extends ManualAuthorizationApiError_base {
-    get message(): string;
-}
-declare const ApiRequestFailed_base: Schema.TaggedErrorClass<ApiRequestFailed, "ApiRequestFailed", {
-    readonly _tag: Schema.tag<"ApiRequestFailed">;
-} & {
-    detail: typeof Schema.String;
-}>;
-/**
- * Single user-facing error for any failure crossing the API boundary. The
- * generated client raises a half-dozen status-specific tagged classes plus
- * transport/decode errors; we collapse them here so the rest of the app sees
- * one tag with a ready-made `.message` and never has to know about
- * `Generated.ts` types.
- */
-export declare class ApiRequestFailed extends ApiRequestFailed_base {
-    get message(): string;
-}
-declare const OAuthAuthMethodChanged_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "OAuthAuthMethodChanged";
-} & Readonly<A>;
-declare class OAuthAuthMethodChanged extends OAuthAuthMethodChanged_base<Record<string, never>> {
-}
-declare const ManualAuthorizationApiClient_base: Effect.Service.Class<ManualAuthorizationApiClient, "@expandai/cli/ManualAuthorizationApiClient", {
-    readonly dependencies: readonly [import("effect/Layer").Layer<HttpClient.HttpClient, never, never>, import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>];
-    readonly effect: Effect.Effect<{
-        readonly create: (input: {
-            readonly harness: 'agent-harnesses';
-            readonly scope: 'project' | 'global';
-            readonly platform: string;
-            readonly machineLabel: string;
-            readonly cliVersion: string;
-        }) => Effect.Effect<DeviceAuthorizationCreated, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | ManualAuthorizationApiError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly poll: (deviceCode: Redacted.Redacted<string>) => Effect.Effect<{
-            _tag: "Tokens";
-            token: {
-                readonly access_token: Redacted.Redacted<string>;
-                readonly refresh_token: Redacted.Redacted<string>;
-                readonly token_type: string;
-                readonly expires_in: number;
-                readonly scope?: string | undefined;
-            };
-        } | {
-            token?: undefined;
-            _tag: "Pending";
-        } | {
-            token?: undefined;
-            _tag: "SlowDown";
-        } | {
-            token?: undefined;
-            _tag: "Denied";
-        } | {
-            token?: undefined;
-            _tag: "Expired";
-        } | {
-            token?: undefined;
-            _tag: "Refused";
-            error: string;
-            description?: string | undefined;
-        } | {
-            token?: undefined;
-            _tag: "Invalid";
-        }, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | ManualAuthorizationApiError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-    }, never, ConfigManager | HttpClient.HttpClient>;
-}>;
-/** Public, unauthenticated HTTP boundary for device-flow CLI authorization. */
-export declare class ManualAuthorizationApiClient extends ManualAuthorizationApiClient_base {
-}
-declare const ApiClient_base: Effect.Service.Class<ApiClient, "@expandai/cli/ApiClient", {
-    readonly dependencies: readonly [import("effect/Layer").Layer<HttpClient.HttpClient, never, never>, import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<BrowserOAuthService, import("effect/ConfigError").ConfigError, never>];
-    readonly scoped: Effect.Effect<{
-        readonly fetchFetch: (...args: Parameters<Generated.Client['fetchFetch']>) => Effect.Effect<string, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly fetchFetchResult: (...args: Parameters<Generated.Client['fetchFetchJson']>) => Effect.Effect<import("@expandai/sdk/FetchJson").FetchObjectModeResultWithJson, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly fetchFetchJson: (...args: Parameters<Generated.Client['fetchFetchJson']>) => Effect.Effect<import("@expandai/sdk/FetchJson").FetchObjectModeResultWithJson, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly fetchFetchSearch: (...args: Parameters<Generated.Client['fetchFetchSearch']>) => Effect.Effect<import("@expandai/sdk/FetchJson").FetchSnapshotSearchResultWithJson, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly fetchBatched: (...args: Parameters<Generated.Client['fetchBatched']>) => Effect.Effect<Generated.BatchedRun, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly fetchGetBatched: (...args: Parameters<Generated.Client['fetchGetBatched']>) => Effect.Effect<Generated.BatchedStatus, ApiRequestFailed | import("./BrowserOAuth.js").BrowserOAuthRequestFailed | import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | OAuthAuthMethodChanged | OAuthTokenExpired | import("effect/ParseResult").ParseError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-    }, never, BrowserOAuthService | ConfigManager | HttpClient.HttpClient>;
-}>;
-/**
- * Resolves outgoing API auth per call. When the current request scope carries
- * an `Authorization` header (via `CurrentRequestHeaders`), that value is
- * forwarded; otherwise auth comes from `~/.config/expandai/config.json`.
- */
-export declare class ApiClient extends ApiClient_base {
-}
-export {};
-//# sourceMappingURL=ApiClient.d.ts.map

package/build/dts/ApiClient.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ApiClient.d.ts","sourceRoot":"","sources":["../../src/ApiClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAyC,MAAM,kBAAkB,CAAA;AAGpF,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AAEpD,OAAO,EAA4B,MAAM,EAAuB,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEhG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAe,iBAAiB,EAAE,MAAM,aAAa,CAAA;;;;;;;;;;;;;;;;;;;;;;;;AAG3E,qBAAa,0BAA2B,SAAQ,+BAc9C;CAAG;AAEL,QAAA,MAAM,gCAAgC;;;;;;EAMpC,CAAA;AAEF,MAAM,MAAM,gCAAgC,GAAG,OAAO,gCAAgC,CAAC,IAAI,CAAA;AAE3F;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B;;;;;;GAMG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;;;;;;;;;AAItF,qBAAa,2BAA4B,SAAQ,gCAQhD;IACA,IAAI,OAAO,WAIV;CACD;;;;;;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,qBAEpC;IACD,IAAI,OAAO,WAEV;CACD;;;;AAcD,cAAM,sBAAuB,SAAQ,4BAA2C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAAG;;;;;8BAgFnF,iBAAiB;4BACnB,SAAS,GAAG,QAAQ;+BACjB,MAAM;mCACF,MAAM;iCACR,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA1B/B,+EAA+E;AAC/E,qBAAa,4BAA6B,SAAQ,iCA8HjD;CAAG;;;;uCAmJqB,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;6CAEpC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;2CAEhD,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;6CAE5C,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;yCAEpD,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;4CAEzC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;;;AA3J7E;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,cA0J7B;CAAG"}

package/build/dts/Auth/Domain.d.ts

@@ -1,95 +0,0 @@
-import { Schema } from 'effect';
-/**
- * The OAuth client for browser-approved CLI setup. Distinct from the
- * `expandai-cli` client that `expandai login` uses: that one keeps loopback
- * redirect URIs and must keep showing a consent screen, because Better Auth
- * matches loopback URIs without comparing the port.
- */
-export declare const CLI_AUTHORIZATION_CLIENT_ID = "expandai-cli-browser";
-export declare const PendingInitKey: Schema.Struct<{
-    apiOrigin: typeof Schema.String;
-    clientId: Schema.Literal<["expandai-cli-browser"]>;
-    harness: Schema.Literal<["agent-harnesses"]>;
-    scope: Schema.Literal<["project", "global"]>;
-    canonicalScopeRoot: typeof Schema.String;
-}>;
-export type PendingInitKey = typeof PendingInitKey.Type;
-declare const PendingInitRecord_base: Schema.Class<PendingInitRecord, {
-    key: Schema.Struct<{
-        apiOrigin: typeof Schema.String;
-        clientId: Schema.Literal<["expandai-cli-browser"]>;
-        harness: Schema.Literal<["agent-harnesses"]>;
-        scope: Schema.Literal<["project", "global"]>;
-        canonicalScopeRoot: typeof Schema.String;
-    }>;
-    deviceCode: Schema.Redacted<typeof Schema.String>;
-    userCode: typeof Schema.String;
-    verificationUri: typeof Schema.String;
-    intervalSeconds: typeof Schema.Number;
-    nextPollAt: typeof Schema.DateTimeUtc;
-    approvalExpiresAt: typeof Schema.DateTimeUtc;
-}, Schema.Struct.Encoded<{
-    key: Schema.Struct<{
-        apiOrigin: typeof Schema.String;
-        clientId: Schema.Literal<["expandai-cli-browser"]>;
-        harness: Schema.Literal<["agent-harnesses"]>;
-        scope: Schema.Literal<["project", "global"]>;
-        canonicalScopeRoot: typeof Schema.String;
-    }>;
-    deviceCode: Schema.Redacted<typeof Schema.String>;
-    userCode: typeof Schema.String;
-    verificationUri: typeof Schema.String;
-    intervalSeconds: typeof Schema.Number;
-    nextPollAt: typeof Schema.DateTimeUtc;
-    approvalExpiresAt: typeof Schema.DateTimeUtc;
-}>, never, {
-    readonly approvalExpiresAt: import("effect/DateTime").Utc;
-} & {
-    readonly deviceCode: import("effect/Redacted").Redacted<string>;
-} & {
-    readonly intervalSeconds: number;
-} & {
-    readonly key: {
-        readonly apiOrigin: string;
-        readonly clientId: "expandai-cli-browser";
-        readonly harness: "agent-harnesses";
-        readonly scope: "global" | "project";
-        readonly canonicalScopeRoot: string;
-    };
-} & {
-    readonly nextPollAt: import("effect/DateTime").Utc;
-} & {
-    readonly userCode: string;
-} & {
-    readonly verificationUri: string;
-}, {}, {}>;
-/**
- * One pending RFC 8628 device authorization. The `deviceCode` is the whole
- * credential — better-auth binds it to our client id server-side and it never
- * leaves this machine — so the record keeps the same 0600/no-symlink storage
- * discipline the PKCE verifier had.
- */
-export declare class PendingInitRecord extends PendingInitRecord_base {
-}
-declare const PendingInitCorrupt_base: Schema.TaggedErrorClass<PendingInitCorrupt, "PendingInitCorrupt", {
-    readonly _tag: Schema.tag<"PendingInitCorrupt">;
-} & {
-    path: typeof Schema.String;
-    error: typeof Schema.Defect;
-}>;
-export declare class PendingInitCorrupt extends PendingInitCorrupt_base {
-    readonly recoverable = true;
-    get message(): string;
-}
-declare const PendingInitStorageError_base: Schema.TaggedErrorClass<PendingInitStorageError, "PendingInitStorageError", {
-    readonly _tag: Schema.tag<"PendingInitStorageError">;
-} & {
-    path: typeof Schema.String;
-    error: typeof Schema.Defect;
-}>;
-export declare class PendingInitStorageError extends PendingInitStorageError_base {
-    readonly recoverable = true;
-    get message(): string;
-}
-export {};
-//# sourceMappingURL=Domain.d.ts.map

package/build/dts/Auth/Domain.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"Domain.d.ts","sourceRoot":"","sources":["../../../src/Auth/Domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,yBAAyB,CAAA;AAEjE,eAAO,MAAM,cAAc;;;;;;EAMzB,CAAA;AAEF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEvD;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,sBAcrC;CAAG;;;;;;;AAEL,qBAAa,kBAAmB,SAAQ,uBAGtC;IACD,QAAQ,CAAC,WAAW,QAAO;IAE3B,IAAI,OAAO,WAEV;CACD;;;;;;;AAED,qBAAa,uBAAwB,SAAQ,4BAG3C;IACD,QAAQ,CAAC,WAAW,QAAO;IAE3B,IAAI,OAAO,WAEV;CACD"}

package/build/dts/Auth/ManualAuthorization.d.ts

@@ -1,107 +0,0 @@
-import { DateTime, Effect, Schema } from 'effect';
-import { ManualAuthorizationApiClient, ManualAuthorizationApiError } from '../ApiClient.js';
-import { ConfigManager } from '../Config.js';
-import { PendingInitStore } from './PendingInit.js';
-export { ALREADY_AUTHENTICATED_MESSAGE, AUTHORIZATION_CONSUMED_MESSAGE, AUTHORIZATION_REQUIRED_MESSAGE, } from '../Init/Domain.js';
-declare const ManualAuthorizationInput_base: Schema.Class<ManualAuthorizationInput, {
-    harness: Schema.Literal<["agent-harnesses"]>;
-    scope: Schema.Literal<["project", "global"]>;
-    cwd: Schema.optional<typeof Schema.String>;
-    platform: Schema.optional<typeof Schema.String>;
-}, Schema.Struct.Encoded<{
-    harness: Schema.Literal<["agent-harnesses"]>;
-    scope: Schema.Literal<["project", "global"]>;
-    cwd: Schema.optional<typeof Schema.String>;
-    platform: Schema.optional<typeof Schema.String>;
-}>, never, {
-    readonly cwd?: string | undefined;
-} & {
-    readonly platform?: string | undefined;
-} & {
-    readonly harness: "agent-harnesses";
-} & {
-    readonly scope: "global" | "project";
-}, {}, {}>;
-export declare class ManualAuthorizationInput extends ManualAuthorizationInput_base {
-}
-declare const ManualAuthorizationRequired_base: Schema.Class<ManualAuthorizationRequired, {
-    verificationUri: typeof Schema.String;
-    userCode: typeof Schema.NonEmptyString;
-    approvalExpiresAt: typeof Schema.DateTimeUtc;
-}, Schema.Struct.Encoded<{
-    verificationUri: typeof Schema.String;
-    userCode: typeof Schema.NonEmptyString;
-    approvalExpiresAt: typeof Schema.DateTimeUtc;
-}>, never, {
-    readonly approvalExpiresAt: DateTime.Utc;
-} & {
-    readonly userCode: string;
-} & {
-    readonly verificationUri: string;
-}, {}, {}>;
-/** What the agent relays: where to approve, and the code to type there. */
-export declare class ManualAuthorizationRequired extends ManualAuthorizationRequired_base {
-}
-declare const TokensSaved_base: Schema.TaggedClass<TokensSaved, "TokensSaved", {
-    readonly _tag: Schema.tag<"TokensSaved">;
-}>;
-/**
- * One `advance` call moves the flow as far as it can without blocking, then
- * returns. RFC 8628's polling loop is inverted: the agent re-invokes the CLI,
- * and each invocation polls the token endpoint at most once — or not at all,
- * when the persisted interval says the server would answer `slow_down`.
- */
-export declare class TokensSaved extends TokensSaved_base {
-}
-declare const AuthorizationPending_base: Schema.TaggedClass<AuthorizationPending, "AuthorizationPending", {
-    readonly _tag: Schema.tag<"AuthorizationPending">;
-} & {
-    pending: typeof ManualAuthorizationRequired;
-}>;
-export declare class AuthorizationPending extends AuthorizationPending_base {
-}
-export declare const ManualAuthorizationOutcome: Schema.Union<[typeof TokensSaved, typeof AuthorizationPending]>;
-export type ManualAuthorizationOutcome = typeof ManualAuthorizationOutcome.Type;
-declare const ManualAuthorizationDenied_base: Schema.TaggedErrorClass<ManualAuthorizationDenied, "ManualAuthorizationDenied", {
-    readonly _tag: Schema.tag<"ManualAuthorizationDenied">;
-} & {
-    recoverable: Schema.Literal<[true]>;
-}>;
-export declare class ManualAuthorizationDenied extends ManualAuthorizationDenied_base {
-    get message(): string;
-}
-declare const ManualAuthorizationRefused_base: Schema.TaggedErrorClass<ManualAuthorizationRefused, "ManualAuthorizationRefused", {
-    readonly _tag: Schema.tag<"ManualAuthorizationRefused">;
-} & {
-    error: typeof Schema.String;
-    description: Schema.optional<typeof Schema.String>;
-    recoverable: Schema.Literal<[false]>;
-}>;
-/**
- * The server refused redemption for a reason a fresh code cannot fix. Kept
- * separate from every other failure because the correct response is the
- * opposite of the usual one: do not start over, stop and report. Re-minting
- * here is what produced an endless approve loop — each new code is approved by
- * the user and then refused identically, with nothing surfaced.
- */
-export declare class ManualAuthorizationRefused extends ManualAuthorizationRefused_base {
-    get message(): string;
-}
-declare const ManualAuthorizationCredentialSaveFailed_base: Schema.TaggedErrorClass<ManualAuthorizationCredentialSaveFailed, "ManualAuthorizationCredentialSaveFailed", {
-    readonly _tag: Schema.tag<"ManualAuthorizationCredentialSaveFailed">;
-} & {
-    recoverable: Schema.Literal<[false]>;
-}>;
-export declare class ManualAuthorizationCredentialSaveFailed extends ManualAuthorizationCredentialSaveFailed_base {
-    get message(): string;
-}
-declare const ManualAuthorization_base: Effect.Service.Class<ManualAuthorization, "@expandai/cli/Auth/ManualAuthorization", {
-    readonly dependencies: readonly [import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<PendingInitStore, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<ManualAuthorizationApiClient, import("effect/ConfigError").ConfigError, never>];
-    readonly effect: Effect.Effect<{
-        readonly advance: (input: ManualAuthorizationInput) => Effect.Effect<AuthorizationPending | TokensSaved, import("../Config.js").ConfigParseError | import("../Config.js").CredentialStoreInsecure | ManualAuthorizationApiError | ManualAuthorizationCredentialSaveFailed | ManualAuthorizationDenied | ManualAuthorizationRefused | import("./Domain.js").PendingInitCorrupt | import("./Domain.js").PendingInitStorageError | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly redeemPreApproved: (deviceCode: import("effect/Redacted").Redacted<string>) => Effect.Effect<undefined, import("../Config.js").ConfigParseError | import("../Config.js").CredentialStoreInsecure | ManualAuthorizationApiError | ManualAuthorizationCredentialSaveFailed | ManualAuthorizationDenied | ManualAuthorizationRefused | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-    }, never, ConfigManager | ManualAuthorizationApiClient | PendingInitStore>;
-}>;
-export declare class ManualAuthorization extends ManualAuthorization_base {
-}
-//# sourceMappingURL=ManualAuthorization.d.ts.map

package/build/dts/Auth/ManualAuthorization.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ManualAuthorization.d.ts","sourceRoot":"","sources":["../../../src/Auth/ManualAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAY,MAAM,EAAkB,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC3E,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAA;AAC3F,OAAO,EAAE,aAAa,EAAe,MAAM,cAAc,CAAA;AAIzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,GAC9B,MAAM,mBAAmB,CAAA;;;;;;;;;;;;;;;;;;;;AAO1B,qBAAa,wBAAyB,SAAQ,6BAK5C;CAAG;;;;;;;;;;;;;;;;AAEL,2EAA2E;AAC3E,qBAAa,2BAA4B,SAAQ,gCAM/C;CAAG;;;;AAEL;;;;;GAKG;AACH,qBAAa,WAAY,SAAQ,gBAAoD;CAAG;;;;;;AAExF,qBAAa,oBAAqB,SAAQ,yBAExC;CAAG;AAEL,eAAO,MAAM,0BAA0B,iEAAkD,CAAA;AACzF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;;;;;;AAE/E,qBAAa,yBAA0B,SAAQ,8BAK9C;IACA,IAAI,OAAO,WAEV;CACD;;;;;;;;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,+BAO/C;IACA,IAAI,OAAO,WAGV;CACD;;;;;;AAED,qBAAa,uCAAwC,SAAQ,4CAK5D;IACA,IAAI,OAAO,WAEV;CACD;;;;;;;;AAcD,qBAAa,mBAAoB,SAAQ,wBA8LxC;CAAG"}

package/build/dts/Auth/PendingInit.d.ts

@@ -1,35 +0,0 @@
-import { FileSystem, Path } from '@effect/platform';
-import { NodeContext } from '@effect/platform-node';
-import { Effect, Option } from 'effect';
-import { PendingInitCorrupt, type PendingInitKey, PendingInitRecord, PendingInitStorageError } from './Domain.js';
-/** Canonical, collision-free serialization of all pending authorization key fields. */
-export declare function serializePendingInitKey(key: PendingInitKey): string;
-declare const PendingInitStore_base: Effect.Service.Class<PendingInitStore, "@expandai/cli/Auth/PendingInitStore", {
-    readonly dependencies: readonly [import("effect/Layer").Layer<NodeContext.NodeContext, never, never>];
-    readonly effect: Effect.Effect<{
-        readonly pendingPath: string;
-        readonly get: (key: {
-            readonly apiOrigin: string;
-            readonly clientId: "expandai-cli-browser";
-            readonly harness: "agent-harnesses";
-            readonly scope: "global" | "project";
-            readonly canonicalScopeRoot: string;
-        }) => Effect.Effect<Option.Option<PendingInitRecord>, PendingInitCorrupt | PendingInitStorageError, never>;
-        readonly peek: (key: {
-            readonly apiOrigin: string;
-            readonly clientId: "expandai-cli-browser";
-            readonly harness: "agent-harnesses";
-            readonly scope: "global" | "project";
-            readonly canonicalScopeRoot: string;
-        }) => Effect.Effect<Option.Option<PendingInitRecord>, PendingInitCorrupt | PendingInitStorageError, never>;
-        readonly putIfAbsent: (record: PendingInitRecord) => Effect.Effect<PendingInitRecord, PendingInitCorrupt | PendingInitStorageError, never>;
-        readonly replaceIfMatch: (previous: PendingInitRecord, next: PendingInitRecord) => Effect.Effect<boolean, PendingInitCorrupt | PendingInitStorageError, never>;
-        readonly removeIfMatch: (record: PendingInitRecord) => Effect.Effect<boolean, PendingInitCorrupt | PendingInitStorageError, never>;
-        readonly pruneExpired: () => Effect.Effect<number, PendingInitStorageError, never>;
-        readonly canonicalScopeRoot: (scope: "global" | "project", cwd?: any) => Effect.Effect<string, PendingInitStorageError, never>;
-    }, import("effect/ConfigError").ConfigError, FileSystem.FileSystem | Path.Path>;
-}>;
-export declare class PendingInitStore extends PendingInitStore_base {
-}
-export {};
-//# sourceMappingURL=PendingInit.d.ts.map

package/build/dts/Auth/PendingInit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PendingInit.d.ts","sourceRoot":"","sources":["../../../src/Auth/PendingInit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,IAAI,EAA0B,MAAM,kBAAkB,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAY,MAAM,EAAU,MAAM,EAAU,MAAM,QAAQ,CAAA;AAEjE,OAAO,EAEN,kBAAkB,EAClB,KAAK,cAAc,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,MAAM,aAAa,CAAA;AA0BpB,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAQnE;;;;;;;;;;;;;;;;;;;;;;;;;;AAOD,qBAAa,gBAAiB,SAAQ,qBA4RpC;CAAG"}

package/build/dts/Auth/Pkce.d.ts

@@ -1,10 +0,0 @@
-import { Redacted } from 'effect';
-/** PKCE code verifier. Redacted so it cannot reach a log or a JSON result. */
-export declare function createCodeVerifier(): Redacted.Redacted<string>;
-export declare function codeChallengeFor(verifier: Redacted.Redacted<string>): string;
-/**
- * Opaque high-entropy value for non-PKCE uses such as the OAuth `state`
- * parameter. Same entropy and encoding, different purpose.
- */
-export declare function createHighEntropySecret(): string;
-//# sourceMappingURL=Pkce.d.ts.map

package/build/dts/Auth/Pkce.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"Pkce.d.ts","sourceRoot":"","sources":["../../../src/Auth/Pkce.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AASjC,8EAA8E;AAC9E,wBAAgB,kBAAkB,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE9D;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAE5E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD"}

package/build/dts/Auth/SetupGrantAuthorization.d.ts

@@ -1,34 +0,0 @@
-import { Effect, Redacted, Schema } from 'effect';
-import { ConfigManager } from '../Config.js';
-import { ManualAuthorization } from './ManualAuthorization.js';
-interface SetupGrantAuthorizationInput {
-    readonly setupToken: Redacted.Redacted<string>;
-    readonly harness: 'agent-harnesses';
-    readonly scope: 'project' | 'global';
-}
-declare const SetupGrantAuthorizationError_base: Schema.TaggedErrorClass<SetupGrantAuthorizationError, "SetupGrantAuthorizationError", {
-    readonly _tag: Schema.tag<"SetupGrantAuthorizationError">;
-} & {
-    code: Schema.Literal<["invalid_or_expired", "stored_credential_conflict", "request_failed", "denied", "credential_save_failed", "refused", "config_unreadable"]>;
-    recoverable: typeof Schema.Boolean;
-}>;
-export declare class SetupGrantAuthorizationError extends SetupGrantAuthorizationError_base {
-    get message(): "An Expand API key is already stored on this machine, and completing this setup would replace it with no way to recover it. Nothing was changed and your setup prompt is still valid. Run `expandai logout` to clear the stored key, then run this setup command again." | "Could not reach Expand to redeem the setup token. Nothing was sent, so the same token is still good — check the network and try again." | "Expand refused to redeem this setup token for a reason a fresh prompt cannot fix — most likely an OAuth client, resource, or scope misconfiguration on the server. Do not request another prompt; report this." | "The Expand config file on this machine could not be read, so setup cannot tell whether completing it would overwrite an existing API key. Nothing was redeemed and your setup prompt is still valid. Run `expandai whoami` to see which file it is, fix or delete it, then run this setup command again." | "The setup token is invalid, expired, or already used. Copy a fresh setup prompt from the Expand dashboard." | "The setup token was redeemed, but the credentials could not be saved on this machine. Fix credential storage — run `expandai whoami` to see the path it uses, and check its permissions — then copy a fresh setup prompt from the Expand dashboard." | "This setup authorization was denied. Copy a fresh setup prompt from the Expand dashboard.";
-}
-declare const SetupGrantAuthorization_base: Effect.Service.Class<SetupGrantAuthorization, "@expandai/cli/Auth/SetupGrantAuthorization", {
-    readonly dependencies: readonly [import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<ManualAuthorization, import("effect/ConfigError").ConfigError, never>];
-    readonly effect: Effect.Effect<{
-        readonly authorize: (input: SetupGrantAuthorizationInput) => Effect.Effect<undefined, SetupGrantAuthorizationError, never>;
-    }, never, ConfigManager | ManualAuthorization>;
-}>;
-/**
- * Dashboard-minted setup: the "token" in the prompt is a pre-approved RFC 8628
- * device code, already bound to the minting user and pinned to their
- * organization server-side. Redeeming is a single poll of the OAuth token
- * endpoint — better-auth owns generation, expiry and the single-use burn, so
- * there is no redemption protocol of ours left to get wrong.
- */
-export declare class SetupGrantAuthorization extends SetupGrantAuthorization_base {
-}
-export {};
-//# sourceMappingURL=SetupGrantAuthorization.d.ts.map

package/build/dts/Auth/SetupGrantAuthorization.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SetupGrantAuthorization.d.ts","sourceRoot":"","sources":["../../../src/Auth/SetupGrantAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EACN,mBAAmB,EAInB,MAAM,0BAA0B,CAAA;AAEjC,UAAU,4BAA4B;IACrC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAA;CACpC;;;;;;;AAED,qBAAa,4BAA6B,SAAQ,iCAcjD;IACA,IAAI,OAAO,61CAyBV;CACD;;;;;;;AASD;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,4BA2C5C;CAAG"}

package/build/dts/Authentication.d.ts

@@ -1,24 +0,0 @@
-import { Command } from '@effect/cli';
-import { Effect } from 'effect';
-import { BrowserOAuthService } from './BrowserOAuth.js';
-import { type AuthMethod, ConfigManager } from './Config.js';
-export { type AuthMethodState, authMethodState, isAuthMethodLocallyUsable } from './Config.js';
-import { Uninstall } from './Install/Uninstall.js';
-/** Render a user-facing description of the current auth state. Pure given DateTime.now. */
-export declare const formatAuthStatus: (authMethod: AuthMethod) => Effect.Effect<string, never, never>;
-declare const Authentication_base: Effect.Service.Class<Authentication, "@expandai/cli/Authentication", {
-    readonly dependencies: readonly [import("effect/Layer").Layer<ConfigManager, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<BrowserOAuthService, import("effect/ConfigError").ConfigError, never>, import("effect/Layer").Layer<Uninstall, import("@effect/platform/Error").BadArgument | import("effect/ConfigError").ConfigError, never>];
-    readonly effect: Effect.Effect<{
-        readonly hasLocallyUsableCredentials: () => Effect.Effect<boolean, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly loginWithBrowser: () => Effect.Effect<void, unknown, never>;
-        readonly login: () => Effect.Effect<void, unknown, import("@effect/platform/Terminal").Terminal>;
-        readonly whoami: () => Effect.Effect<void, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, never>;
-        readonly logout: () => Effect.Effect<void, import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").CredentialStoreInsecure | import("./Install/Domain.js").McpParseError | import("./Install/Domain.js").McpWriteError | import("effect/ParseResult").ParseError | import("@effect/platform/Terminal").QuitException | import("@effect/platform/Error").PlatformError, import("@effect/platform/Terminal").Terminal>;
-    }, never, BrowserOAuthService | ConfigManager | Uninstall>;
-}>;
-export declare class Authentication extends Authentication_base {
-}
-export declare const LoginCommand: Command.Command<"login", Authentication | import("@effect/platform/Terminal").Terminal, unknown, {}>;
-export declare const WhoamiCommand: Command.Command<"whoami", Authentication, import("./Config.js").ConfigParseError | import("./Config.js").CredentialStoreInsecure | import("./Config.js").NotAuthenticated | import("effect/ConfigError").ConfigError | import("@effect/platform/Error").PlatformError, {}>;
-export declare const LogoutCommand: Command.Command<"logout", Authentication | import("@effect/platform/Terminal").Terminal, import("./Config.js").ConfigCleanupError | import("./Config.js").ConfigNotWritable | import("./Config.js").CredentialStoreInsecure | import("./Install/Domain.js").McpParseError | import("./Install/Domain.js").McpWriteError | import("effect/ParseResult").ParseError | import("@effect/platform/Terminal").QuitException | import("@effect/platform/Error").PlatformError, {}>;
-//# sourceMappingURL=Authentication.d.ts.map

package/build/dts/Authentication.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"Authentication.d.ts","sourceRoot":"","sources":["../../src/Authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAU,MAAM,aAAa,CAAA;AAC7C,OAAO,EAA+B,MAAM,EAAiC,MAAM,QAAQ,CAAA;AAE3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAwB,KAAK,UAAU,EAAE,aAAa,EAA6B,MAAM,aAAa,CAAA;AAI7G,OAAO,EAAE,KAAK,eAAe,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAE9F,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAElD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,iEAe3B,CAAA;;;;;;;;;;;AAEF,qBAAa,cAAe,SAAQ,mBA4JlC;CAAG;AAEL,eAAO,MAAM,YAAY,sGAGxB,CAAA;AAED,eAAO,MAAM,aAAa,4QAGzB,CAAA;AAED,eAAO,MAAM,aAAa,6cAGzB,CAAA"}