expandai 0.0.4 → 0.0.6

package/src/Auth/SetupGrantAuthorization.ts

@@ -1,116 +0,0 @@
-import { Effect, Redacted, Schema } from 'effect'
-import { ConfigManager } from '../Config.js'
-import {
-	ManualAuthorization,
-	ManualAuthorizationCredentialSaveFailed,
-	ManualAuthorizationDenied,
-	ManualAuthorizationRefused,
-} from './ManualAuthorization.js'
-
-interface SetupGrantAuthorizationInput {
-	readonly setupToken: Redacted.Redacted<string>
-	readonly harness: 'agent-harnesses'
-	readonly scope: 'project' | 'global'
-}
-
-export class SetupGrantAuthorizationError extends Schema.TaggedError<SetupGrantAuthorizationError>()(
-	'SetupGrantAuthorizationError',
-	{
-		code: Schema.Literal(
-			'invalid_or_expired',
-			'stored_credential_conflict',
-			'request_failed',
-			'denied',
-			'credential_save_failed',
-			'refused',
-			'config_unreadable',
-		),
-		recoverable: Schema.Boolean,
-	},
-) {
-	get message() {
-		switch (this.code) {
-			// Checked before redemption, so the token is untouched and the user can
-			// retry with the same one after clearing the stored credential.
-			case 'stored_credential_conflict':
-				return 'An Expand API key is already stored on this machine, and completing this setup would replace it with no way to recover it. Nothing was changed and your setup prompt is still valid. Run `expandai logout` to clear the stored key, then run this setup command again.'
-			case 'request_failed':
-				return 'Could not reach Expand to redeem the setup token. Nothing was sent, so the same token is still good — check the network and try again.'
-			case 'denied':
-				return 'This setup authorization was denied. Copy a fresh setup prompt from the Expand dashboard.'
-			// Checked before redemption, so like stored_credential_conflict the token is
-			// untouched and the same prompt works once the file is dealt with.
-			case 'config_unreadable':
-				return 'The Expand config file on this machine could not be read, so setup cannot tell whether completing it would overwrite an existing API key. Nothing was redeemed and your setup prompt is still valid. Run `expandai whoami` to see which file it is, fix or delete it, then run this setup command again.'
-			// Server-side misconfiguration: a fresh prompt is refused identically.
-			case 'refused':
-				return 'Expand refused to redeem this setup token for a reason a fresh prompt cannot fix — most likely an OAuth client, resource, or scope misconfiguration on the server. Do not request another prompt; report this.'
-			// The token redeemed — it is spent — but the credentials could not be
-			// written locally. A fresh prompt hits the same wall until the local
-			// storage problem is fixed, so say that instead of blaming the token.
-			case 'credential_save_failed':
-				return 'The setup token was redeemed, but the credentials could not be saved on this machine. Fix credential storage — run `expandai whoami` to see the path it uses, and check its permissions — then copy a fresh setup prompt from the Expand dashboard.'
-			default:
-				return 'The setup token is invalid, expired, or already used. Copy a fresh setup prompt from the Expand dashboard.'
-		}
-	}
-}
-
-function setupGrantError(code: typeof SetupGrantAuthorizationError.fields.code.Type): SetupGrantAuthorizationError {
-	return new SetupGrantAuthorizationError({
-		code,
-		recoverable: code !== 'denied' && code !== 'credential_save_failed' && code !== 'refused',
-	})
-}
-
-/**
- * Dashboard-minted setup: the "token" in the prompt is a pre-approved RFC 8628
- * device code, already bound to the minting user and pinned to their
- * organization server-side. Redeeming is a single poll of the OAuth token
- * endpoint — better-auth owns generation, expiry and the single-use burn, so
- * there is no redemption protocol of ours left to get wrong.
- */
-export class SetupGrantAuthorization extends Effect.Service<SetupGrantAuthorization>()(
-	'@expandai/cli/Auth/SetupGrantAuthorization',
-	{
-		dependencies: [ConfigManager.Default, ManualAuthorization.Default],
-		effect: Effect.gen(function* () {
-			const configManager = yield* ConfigManager
-			const manualAuthorization = yield* ManualAuthorization
-			const authorize = Effect.fn('SetupGrantAuthorization.authorize')(function* (input: SetupGrantAuthorizationInput) {
-				// The *file*, specifically. `loadConfig` collapses env and file into one
-				// value, so it cannot tell an ambient `EXPAND_API_KEY` — which must
-				// never block setup — from a key written by `expandai login`, which
-				// saving new credentials would overwrite with no way to recover it.
-				//
-				// Refused before redemption: nothing has been spent, so the same prompt
-				// still works once the user clears the stored key.
-				// `readConfigFile` never fails — it reports an unreadable file through
-				// `parseFailed` and hands back an empty config — so `Effect.either` here was
-				// always Right and the ApiKey check silently passed on a corrupt file. That
-				// matters: redemption is single-use, so proceeding would spend the token and
-				// *then* fail to save. Refuse first, while the prompt is still good.
-				const storedFile = yield* configManager.readConfigFile()
-				if (storedFile.parseFailed) return yield* setupGrantError('config_unreadable')
-				if (storedFile.config.authMethod?._tag === 'ApiKey') {
-					return yield* setupGrantError('stored_credential_conflict')
-				}
-				yield* Effect.annotateCurrentSpan({ harness: input.harness, scope: input.scope })
-				yield* manualAuthorization.redeemPreApproved(input.setupToken).pipe(
-					Effect.mapError((error) => {
-						if (error instanceof ManualAuthorizationDenied) return setupGrantError('denied')
-						if (error instanceof ManualAuthorizationCredentialSaveFailed) {
-							return setupGrantError('credential_save_failed')
-						}
-						if (error instanceof ManualAuthorizationRefused) return setupGrantError('refused')
-						if (error._tag === 'ManualAuthorizationApiError' && error.kind === 'request_failed') {
-							return setupGrantError('request_failed')
-						}
-						return setupGrantError('invalid_or_expired')
-					}),
-				)
-			})
-			return { authorize } as const
-		}),
-	},
-) {}

package/src/Authentication.ts

@@ -1,202 +0,0 @@
-import { Command, Prompt } from '@effect/cli'
-import { Console, DateTime, Duration, Effect, Either, Match, Schema, String } from 'effect'
-import open from 'open'
-import { BrowserOAuthService } from './BrowserOAuth.js'
-import { ApiKey, ApiKeyConfig, type AuthMethod, ConfigManager, isAuthMethodLocallyUsable } from './Config.js'
-
-// Re-exported: these moved to Config.ts, where the credential types live, so
-// that credential precedence can consult usability without a cycle.
-export { type AuthMethodState, authMethodState, isAuthMethodLocallyUsable } from './Config.js'
-
-import { Uninstall } from './Install/Uninstall.js'
-
-/** Render a user-facing description of the current auth state. Pure given DateTime.now. */
-export const formatAuthStatus = Effect.fn('Authentication.formatAuthStatus')(function* (authMethod: AuthMethod) {
-	return yield* Match.value(authMethod).pipe(
-		Match.tag('ApiKey', () => Effect.succeed('Authenticated via API key.')),
-		Match.tag('OAuth', ({ expiresAt }) =>
-			Effect.gen(function* () {
-				const now = yield* DateTime.now
-				const expired = DateTime.lessThan(expiresAt, now)
-				const detail = expired
-					? `expired ${Duration.format(DateTime.distanceDuration(expiresAt, now))} ago — run \`expandai login\``
-					: `expires in ${Duration.format(DateTime.distanceDuration(now, expiresAt))}`
-				return `Authenticated via OAuth (${detail}).`
-			}),
-		),
-		Match.exhaustive,
-	)
-})
-
-export class Authentication extends Effect.Service<Authentication>()('@expandai/cli/Authentication', {
-	dependencies: [ConfigManager.Default, BrowserOAuthService.Default, Uninstall.Default],
-	effect: Effect.gen(function* () {
-		const configManager = yield* ConfigManager
-		const browserOAuth = yield* BrowserOAuthService
-		const uninstall = yield* Uninstall
-
-		const hasLocallyUsableCredentials = Effect.fn('Authentication.hasLocallyUsableCredentials')(function* () {
-			yield* configManager.ensureSecureStorage()
-			const loaded = yield* Effect.either(configManager.loadConfig())
-			if (Either.isLeft(loaded)) {
-				if (loaded.left._tag === 'NotAuthenticated') return false
-				return yield* Effect.fail(loaded.left)
-			}
-			const now = yield* DateTime.now
-			return isAuthMethodLocallyUsable(loaded.right.authMethod, now)
-		})
-
-		const apiKeyLogin = Effect.fn('Authentication.apiKeyLogin')(function* () {
-			const apiKey = yield* Prompt.password({ message: 'Enter your API Key' })
-			yield* configManager.updateConfig({
-				authMethod: ApiKeyConfig.make({ apiKey: yield* Schema.validate(ApiKey)(apiKey) }),
-			})
-			yield* Console.log('API key saved successfully!')
-		})
-
-		const browserLogin = Effect.fnUntraced(function* <R>(
-			showAuthorizeUrl: (authorizeUrl: URL) => Effect.Effect<void, unknown, R>,
-		) {
-			yield* Console.log(
-				String.stripMargin(`
-					|
-					|Starting browser authorization...`),
-			)
-			yield* browserOAuth.login(showAuthorizeUrl)
-			yield* Console.log(
-				String.stripMargin(`
-					|
-					|Successfully authenticated!`),
-			)
-		})
-
-		const printAuthorizeUrl = Effect.fnUntraced(function* (authorizeUrl: URL) {
-			yield* Console.log(
-				String.stripMargin(`
-					|
-					|Open this URL in a browser:
-					|  ${authorizeUrl.toString()}
-					|
-					|Waiting for browser authorization...`),
-			)
-		})
-
-		// `init` already asks for harness and scope. Keep browser login on the
-		// existing loopback OAuth path without introducing a third Prompt choice.
-		const loginWithBrowser = Effect.fn('Authentication.loginWithBrowser')(function* () {
-			yield* browserLogin(printAuthorizeUrl)
-		})
-
-		const oauthLogin = Effect.fn('Authentication.oauthLogin')(function* () {
-			yield* browserLogin((authorizeUrl) =>
-				Effect.gen(function* () {
-					yield* Console.log(
-						String.stripMargin(`
-							|
-							|Open this URL in a browser:
-							|  ${authorizeUrl.toString()}
-							|`),
-					)
-
-					const shouldOpen = yield* Prompt.confirm({ message: 'Open browser now?', initial: true })
-					if (shouldOpen) {
-						yield* Effect.tryPromise(() => open(authorizeUrl.toString())).pipe(
-							Effect.catchAll(() => Console.log('Could not open browser automatically — use the URL above.')),
-						)
-					}
-
-					yield* Console.log(
-						String.stripMargin(`
-							|
-							|Waiting for browser authorization...`),
-					)
-				}),
-			)
-		})
-
-		const login = Effect.fn('Authentication.login')(function* () {
-			yield* configManager.ensureSecureStorage()
-			const existing = yield* Effect.either(configManager.loadConfig())
-
-			if (Either.isRight(existing)) {
-				const status = yield* formatAuthStatus(existing.right.authMethod)
-				const proceed = yield* Prompt.confirm({
-					message: String.stripMargin(`
-						|${status}
-						|Do you want to re-authenticate?`),
-				})
-				if (!proceed) {
-					return
-				}
-			}
-
-			const method = yield* Prompt.select({
-				message: 'How would you like to authenticate?',
-				choices: [
-					{ title: 'Browser Login', value: 'oauth' as const, description: 'Authenticate via browser' },
-					{ title: 'API Key', value: 'api-key' as const, description: 'Paste your API key' },
-				],
-			})
-
-			yield* Match.value(method).pipe(
-				Match.when('api-key', () => apiKeyLogin()),
-				Match.when('oauth', () => oauthLogin()),
-				Match.exhaustive,
-			)
-		})
-
-		const whoami = Effect.fn('Authentication.whoami')(function* () {
-			const { authMethod } = yield* configManager.loadConfig()
-			const text = yield* formatAuthStatus(authMethod)
-			yield* Console.log(text)
-		})
-
-		const logout = Effect.fn('Authentication.logout')(function* () {
-			yield* configManager.clearConfig()
-
-			if (!process.stdout.isTTY || !process.stdin.isTTY) {
-				yield* Effect.logInfo(
-					String.stripMargin(`
-						|Skipping install cleanup — \`expandai logout\` is not interactive in this context.
-						|Run \`expandai uninstall\` to remove hooks, skills, and MCP entries.`),
-				)
-				yield* Console.log('Logged out.')
-				return
-			}
-
-			const cleanup = yield* Prompt.multiSelect({
-				message: 'Remove installed expandai integrations?',
-				choices: [
-					{ title: 'Global hooks', value: { target: 'hook' as const, scope: 'global' as const } },
-					{ title: 'Project hooks', value: { target: 'hook' as const, scope: 'project' as const } },
-					{ title: 'Global skills', value: { target: 'skill' as const, scope: 'global' as const } },
-					{ title: 'Project skills', value: { target: 'skill' as const, scope: 'project' as const } },
-					{ title: 'Global MCP entries', value: { target: 'mcp' as const, scope: 'global' as const } },
-					{ title: 'Project MCP entries', value: { target: 'mcp' as const, scope: 'project' as const } },
-				],
-			})
-			if (cleanup.length > 0) {
-				yield* Effect.forEach(cleanup, (item) => uninstall.uninstall(item), { discard: true })
-			}
-
-			yield* Console.log('Logged out.')
-		})
-
-		return { hasLocallyUsableCredentials, loginWithBrowser, login, whoami, logout } as const
-	}),
-}) {}
-
-export const LoginCommand = Command.make('login').pipe(
-	Command.withDescription('Authenticate with ExpandAI'),
-	Command.withHandler(() => Effect.flatMap(Authentication, (auth) => auth.login())),
-)
-
-export const WhoamiCommand = Command.make('whoami').pipe(
-	Command.withDescription('Show current authentication status'),
-	Command.withHandler(() => Effect.flatMap(Authentication, (auth) => auth.whoami())),
-)
-
-export const LogoutCommand = Command.make('logout').pipe(
-	Command.withDescription('Clear stored credentials and optionally remove installed integrations'),
-	Command.withHandler(() => Effect.flatMap(Authentication, (auth) => auth.logout())),
-)

package/src/BrowserOAuth.ts

@@ -1,359 +0,0 @@
-import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http'
-import { HttpClient, HttpClientRequest, HttpClientResponse } from '@effect/platform'
-import { NodeHttpClient } from '@effect/platform-node'
-import { DateTime, Duration, Effect, Inspectable, Redacted, Schema } from 'effect'
-import { codeChallengeFor, createHighEntropySecret } from './Auth/Pkce.js'
-import { ConfigManager, OAuthConfig } from './Config.js'
-
-const CLIENT_ID = 'expandai-cli'
-const OAUTH_AUTHORIZE_ENDPOINT = '/api/auth/oauth2/authorize'
-const OAUTH_TOKEN_ENDPOINT = '/api/auth/oauth2/token'
-const OAUTH_SCOPE = 'openid profile email offline_access'
-const LOOPBACK_HOST = '127.0.0.1'
-const OAUTH_LOGIN_TIMEOUT = Duration.minutes(5)
-
-const DurationFromSeconds = Schema.transform(Schema.Number, Schema.DurationFromSelf, {
-	strict: true,
-	decode: Duration.seconds,
-	encode: Duration.toSeconds,
-})
-
-export class TokenResponse extends Schema.Class<TokenResponse>('BrowserOAuthTokenResponse')({
-	access_token: Schema.String,
-	refresh_token: Schema.optional(Schema.String),
-	expires_in: DurationFromSeconds,
-	token_type: Schema.String,
-	scope: Schema.optional(Schema.String),
-}) {}
-
-export class BrowserOAuthRequestFailed extends Schema.TaggedError<BrowserOAuthRequestFailed>()(
-	'BrowserOAuthRequestFailed',
-	{
-		endpoint: Schema.String,
-		error: Schema.Defect,
-		status: Schema.optional(Schema.Number),
-	},
-) {
-	get message() {
-		return `OAuth request to ${this.endpoint} failed${this.status ? ` (${this.status})` : ''}: ${Inspectable.format(this.error)}`
-	}
-}
-
-export class BrowserOAuthCallbackError extends Schema.TaggedError<BrowserOAuthCallbackError>()(
-	'BrowserOAuthCallbackError',
-	{
-		error: Schema.String,
-		errorDescription: Schema.optional(Schema.String),
-	},
-) {
-	get message() {
-		return this.errorDescription ? `${this.error}: ${this.errorDescription}` : this.error
-	}
-}
-
-export class BrowserOAuthMissingCode extends Schema.TaggedError<BrowserOAuthMissingCode>()(
-	'BrowserOAuthMissingCode',
-	{},
-) {
-	get message() {
-		return 'OAuth callback did not include an authorization code.'
-	}
-}
-
-export class BrowserOAuthStateMismatch extends Schema.TaggedError<BrowserOAuthStateMismatch>()(
-	'BrowserOAuthStateMismatch',
-	{},
-) {
-	get message() {
-		return 'OAuth callback state did not match the login request.'
-	}
-}
-
-export class BrowserOAuthLoopbackFailed extends Schema.TaggedError<BrowserOAuthLoopbackFailed>()(
-	'BrowserOAuthLoopbackFailed',
-	{
-		error: Schema.Defect,
-	},
-) {
-	get message() {
-		return `Could not start OAuth loopback server: ${Inspectable.format(this.error)}`
-	}
-}
-
-export class BrowserOAuthTimedOut extends Schema.TaggedError<BrowserOAuthTimedOut>()('BrowserOAuthTimedOut', {}) {
-	get message() {
-		return 'OAuth browser login timed out before the local callback completed.'
-	}
-}
-
-type CallbackFailure = BrowserOAuthCallbackError | BrowserOAuthMissingCode | BrowserOAuthStateMismatch
-
-interface AuthorizeUrlInput {
-	readonly apiUrl: URL
-	readonly redirectUri: URL
-	readonly state: string
-	readonly codeChallenge: string
-}
-
-interface ExchangeCodeInput {
-	readonly code: string
-	readonly redirectUri: URL
-	readonly codeVerifier: string
-}
-
-interface LoopbackServer {
-	readonly redirectUri: URL
-	readonly waitForCode: Effect.Effect<string, CallbackFailure>
-	readonly close: Effect.Effect<void>
-}
-
-export const createCodeChallenge = Effect.fn('BrowserOAuth.createCodeChallenge')(function* (codeVerifier: string) {
-	return codeChallengeFor(Redacted.make(codeVerifier))
-})
-
-export const buildAuthorizeUrl = Effect.fn('BrowserOAuth.buildAuthorizeUrl')(function* ({
-	apiUrl,
-	redirectUri,
-	state,
-	codeChallenge,
-}: AuthorizeUrlInput) {
-	const authorizeUrl = new URL(OAUTH_AUTHORIZE_ENDPOINT, apiUrl)
-	authorizeUrl.searchParams.set('response_type', 'code')
-	authorizeUrl.searchParams.set('client_id', CLIENT_ID)
-	authorizeUrl.searchParams.set('redirect_uri', redirectUri.toString())
-	authorizeUrl.searchParams.set('scope', OAUTH_SCOPE)
-	authorizeUrl.searchParams.set('code_challenge', codeChallenge)
-	authorizeUrl.searchParams.set('code_challenge_method', 'S256')
-	authorizeUrl.searchParams.set('state', state)
-	return authorizeUrl
-})
-
-function respond(response: ServerResponse, status: number, body: string): void {
-	response.writeHead(status, { 'content-type': 'text/html; charset=utf-8' })
-	response.end(body)
-}
-
-function validateCallback(request: IncomingMessage, expectedState: string): string {
-	const callbackUrl = new URL(request.url ?? '/', `http://${LOOPBACK_HOST}`)
-	const error = callbackUrl.searchParams.get('error')
-	if (error !== null) {
-		throw new BrowserOAuthCallbackError({
-			error,
-			errorDescription: callbackUrl.searchParams.get('error_description') ?? undefined,
-		})
-	}
-
-	if (callbackUrl.searchParams.get('state') !== expectedState) {
-		throw new BrowserOAuthStateMismatch()
-	}
-
-	const code = callbackUrl.searchParams.get('code')
-	if (code === null || code.length === 0) {
-		throw new BrowserOAuthMissingCode()
-	}
-
-	return code
-}
-
-function toCallbackFailure(error: unknown): CallbackFailure {
-	if (
-		error instanceof BrowserOAuthCallbackError ||
-		error instanceof BrowserOAuthMissingCode ||
-		error instanceof BrowserOAuthStateMismatch
-	) {
-		return error
-	}
-	return new BrowserOAuthCallbackError({ error: 'server_error', errorDescription: Inspectable.format(error) })
-}
-
-function closeServer(server: Server): Effect.Effect<void> {
-	return Effect.async<void>((resume) => {
-		server.close((error) => {
-			if (error) {
-				resume(Effect.void)
-				return
-			}
-			resume(Effect.void)
-		})
-	})
-}
-
-const startLoopbackServer = Effect.fn('BrowserOAuth.startLoopbackServer')(function* (expectedState: string) {
-	return yield* Effect.async<LoopbackServer, BrowserOAuthLoopbackFailed>((resume) => {
-		let settled = false
-		let resolveCode: (code: string) => void = () => undefined
-		let rejectCode: (error: CallbackFailure) => void = () => undefined
-		const codePromise = new Promise<string>((resolve, reject) => {
-			resolveCode = resolve
-			rejectCode = (error) => reject(error)
-		})
-
-		const server = createServer((request, response) => {
-			const requestUrl = new URL(request.url ?? '/', `http://${LOOPBACK_HOST}`)
-			if (requestUrl.pathname !== '/callback') {
-				respond(response, 404, 'Not found')
-				return
-			}
-
-			if (settled) {
-				respond(response, 409, 'OAuth callback already handled.')
-				return
-			}
-			settled = true
-
-			try {
-				const code = validateCallback(request, expectedState)
-				respond(response, 200, 'Authentication complete. You can close this tab.')
-				resolveCode(code)
-			} catch (error) {
-				respond(response, 400, 'Authentication failed. Return to the terminal and try again.')
-				rejectCode(toCallbackFailure(error))
-			}
-		})
-
-		server.once('error', (error) => {
-			resume(Effect.fail(new BrowserOAuthLoopbackFailed({ error })))
-		})
-
-		server.listen(0, LOOPBACK_HOST, () => {
-			const address = server.address()
-			if (address === null || typeof address === 'string') {
-				resume(Effect.fail(new BrowserOAuthLoopbackFailed({ error: 'loopback server did not report a port' })))
-				return
-			}
-
-			resume(
-				Effect.succeed({
-					redirectUri: new URL(`http://${LOOPBACK_HOST}:${address.port}/callback`),
-					waitForCode: Effect.tryPromise({
-						try: () => codePromise,
-						catch: toCallbackFailure,
-					}),
-					close: closeServer(server),
-				}),
-			)
-		})
-	})
-})
-
-export class BrowserOAuthService extends Effect.Service<BrowserOAuthService>()('@expandai/cli/BrowserOAuthService', {
-	dependencies: [NodeHttpClient.layer, ConfigManager.Default],
-	effect: Effect.gen(function* () {
-		const httpClient = yield* HttpClient.HttpClient
-		const configManager = yield* ConfigManager
-
-		const exchangeToken = Effect.fn('BrowserOAuthService.exchangeToken')(function* (
-			form: ReadonlyArray<readonly [string, string]>,
-		) {
-			yield* configManager.ensureSecureStorage()
-			const apiUrl = yield* configManager.getApiUrl()
-			const resource = apiUrl.toString()
-			const request = HttpClientRequest.post(new URL(OAUTH_TOKEN_ENDPOINT, apiUrl)).pipe(
-				HttpClientRequest.bodyUrlParams([...form, ['resource', resource]]),
-			)
-
-			return yield* httpClient.execute(request).pipe(
-				Effect.flatMap(
-					HttpClientResponse.matchStatus({
-						'200': (response) => HttpClientResponse.schemaBodyJson(TokenResponse)(response),
-						orElse: (response) =>
-							response.text.pipe(
-								Effect.flatMap((body) =>
-									Effect.fail(
-										new BrowserOAuthRequestFailed({
-											endpoint: OAUTH_TOKEN_ENDPOINT,
-											status: response.status,
-											error: body,
-										}),
-									),
-								),
-							),
-					}),
-				),
-				Effect.catchTags({
-					RequestError: (error) =>
-						Effect.fail(new BrowserOAuthRequestFailed({ endpoint: OAUTH_TOKEN_ENDPOINT, error })),
-					ResponseError: (error) =>
-						Effect.fail(new BrowserOAuthRequestFailed({ endpoint: OAUTH_TOKEN_ENDPOINT, error })),
-					ParseError: (error) => Effect.fail(new BrowserOAuthRequestFailed({ endpoint: OAUTH_TOKEN_ENDPOINT, error })),
-				}),
-			)
-		})
-
-		const exchangeCode = Effect.fn('BrowserOAuthService.exchangeCode')(function* ({
-			code,
-			redirectUri,
-			codeVerifier,
-		}: ExchangeCodeInput) {
-			return yield* exchangeToken([
-				['grant_type', 'authorization_code'],
-				['client_id', CLIENT_ID],
-				['code', code],
-				['redirect_uri', redirectUri.toString()],
-				['code_verifier', codeVerifier],
-			])
-		})
-
-		const refreshToken = Effect.fn('BrowserOAuthService.refreshToken')(function* (
-			refreshToken: string,
-			clientId: string = CLIENT_ID,
-		) {
-			return yield* exchangeToken([
-				['grant_type', 'refresh_token'],
-				['client_id', clientId],
-				['refresh_token', refreshToken],
-			])
-		})
-
-		const saveToken = Effect.fn('BrowserOAuthService.saveToken')(function* (tokenResponse: TokenResponse) {
-			const now = yield* DateTime.now
-			const expiresAt = DateTime.addDuration(now, tokenResponse.expires_in)
-
-			yield* configManager.updateConfig({
-				authMethod: OAuthConfig.make({
-					accessToken: Redacted.make(tokenResponse.access_token),
-					refreshToken:
-						tokenResponse.refresh_token === undefined ? undefined : Redacted.make(tokenResponse.refresh_token),
-					expiresAt,
-					clientId: CLIENT_ID,
-				}),
-			})
-		})
-
-		const login = Effect.fn('BrowserOAuthService.login')(function* <R>(
-			openAuthorizeUrl: (authorizeUrl: URL) => Effect.Effect<void, unknown, R>,
-		) {
-			yield* configManager.ensureSecureStorage()
-			const codeVerifier = createHighEntropySecret()
-			const state = createHighEntropySecret()
-			const codeChallenge = yield* createCodeChallenge(codeVerifier)
-			const loopback = yield* startLoopbackServer(state)
-			const apiUrl = yield* configManager.getApiUrl()
-			const authorizeUrl = yield* buildAuthorizeUrl({
-				apiUrl,
-				redirectUri: loopback.redirectUri,
-				state,
-				codeChallenge,
-			})
-
-			const code = yield* openAuthorizeUrl(authorizeUrl).pipe(
-				Effect.zipRight(loopback.waitForCode),
-				Effect.timeoutFail({
-					duration: OAUTH_LOGIN_TIMEOUT,
-					onTimeout: () => new BrowserOAuthTimedOut(),
-				}),
-				Effect.ensuring(loopback.close),
-			)
-			const token = yield* exchangeCode({ code, redirectUri: loopback.redirectUri, codeVerifier })
-			if (token === undefined) {
-				return yield* new BrowserOAuthRequestFailed({
-					endpoint: OAUTH_TOKEN_ENDPOINT,
-					error: 'OAuth token endpoint returned an empty response body',
-				})
-			}
-			yield* saveToken(token)
-		})
-
-		return { exchangeCode, refreshToken, saveToken, login } as const
-	}),
-}) {}