@colbymchenry/codegraph-darwin-x64 1.0.0 → 1.1.0

package/lib/dist/project-config.d.ts

@@ -0,0 +1,19 @@
+import { Language } from './types';
+/** Filename of the project-scoped config, resolved relative to the project root. */
+export declare const PROJECT_CONFIG_FILENAME = "codegraph.json";
+export interface ProjectConfig {
+    /** Map of custom file extension (`.foo`) to a supported language id. */
+    extensions?: Record<string, string>;
+}
+/**
+ * Load the validated extension overrides for a project, mtime-cached.
+ *
+ * Returns a map of `.ext` → supported language id. The result merges on top of
+ * the built-in extension map at the point of use (see `detectLanguage` /
+ * `isSourceFile`), with these user mappings taking precedence. Returns an empty
+ * map when there is no `codegraph.json` (the zero-config default).
+ */
+export declare function loadExtensionOverrides(rootDir: string): Record<string, Language>;
+/** Test/maintenance hook: forget cached config (e.g. after rewriting it in a test). */
+export declare function clearProjectConfigCache(): void;
+//# sourceMappingURL=project-config.d.ts.map

package/lib/dist/project-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config.d.ts","sourceRoot":"","sources":["../src/project-config.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAInC,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAoFD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAoBhF;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C"}

package/lib/dist/project-config.js

@@ -0,0 +1,180 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROJECT_CONFIG_FILENAME = void 0;
+exports.loadExtensionOverrides = loadExtensionOverrides;
+exports.clearProjectConfigCache = clearProjectConfigCache;
+/**
+ * Project-scoped configuration: a committed `codegraph.json` at the project
+ * root that a team shares through version control.
+ *
+ * Today it carries one thing — `extensions`, an opt-in map from a custom file
+ * extension to one of CodeGraph's supported languages. The built-in
+ * extension → language table (`EXTENSION_MAP` in `extraction/grammars.ts`) is
+ * otherwise hardcoded, so a codebase that uses a non-standard extension for a
+ * supported language (e.g. `.dota_lua` for Lua) sees those files silently
+ * skipped. This lets the project map them once, in a version-controlled file:
+ *
+ *   {
+ *     "extensions": {
+ *       ".dota_lua": "lua",
+ *       ".tpl": "php"
+ *     }
+ *   }
+ *
+ * User mappings merge on TOP of the built-ins and win on conflict, so a project
+ * can also re-point a built-in extension (e.g. force `.h` → `cpp`). Absent or
+ * malformed config is the zero-config default — no overrides, no error. Invalid
+ * individual entries are warned-and-skipped (never fatal): an unparseable
+ * project file must not break indexing.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const grammars_1 = require("./extraction/grammars");
+const errors_1 = require("./errors");
+/** Filename of the project-scoped config, resolved relative to the project root. */
+exports.PROJECT_CONFIG_FILENAME = 'codegraph.json';
+/**
+ * Cache keyed by project root. The loader is called once per indexing/scan/sync
+ * operation (and per watch event), so the mtime guard keeps repeat calls to one
+ * `stat` while a single `codegraph.json` is in force. Keying by root keeps two
+ * projects in the same process (the daemon / multi-project MCP server) isolated.
+ */
+const overridesCache = new Map();
+const cacheMeta = new Map();
+/** Shared frozen empty map so the no-config path allocates nothing. */
+const EMPTY = Object.freeze({});
+/**
+ * Normalize a user-provided extension key to the `.ext` lowercase form used by
+ * the built-in map. Returns null for keys that can never match a real file
+ * extension (so the caller warns and skips):
+ *   - empty / just "."
+ *   - multi-part (".d.ts") — language detection keys off the FINAL extension
+ *     only (`lastIndexOf('.')`), so a multi-dot key would never be consulted.
+ *   - anything containing a path separator.
+ */
+function normalizeExtKey(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    let ext = raw.trim().toLowerCase();
+    if (!ext)
+        return null;
+    if (!ext.startsWith('.'))
+        ext = '.' + ext;
+    const body = ext.slice(1);
+    if (!body)
+        return null;
+    if (body.includes('.') || body.includes('/') || body.includes('\\'))
+        return null;
+    return ext;
+}
+/**
+ * Parse and validate the `extensions` map out of a `codegraph.json` file.
+ * Every failure mode degrades to "no overrides from this entry" — a bad file or
+ * a typo'd language never throws.
+ */
+function parseExtensionOverrides(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, 'utf-8');
+    }
+    catch {
+        return EMPTY;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        (0, errors_1.logWarn)(`Ignoring ${exports.PROJECT_CONFIG_FILENAME}: not valid JSON`, {
+            file,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return EMPTY;
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return EMPTY;
+    const exts = parsed.extensions;
+    if (!exts || typeof exts !== 'object' || Array.isArray(exts))
+        return EMPTY;
+    const out = {};
+    for (const [rawKey, rawVal] of Object.entries(exts)) {
+        const key = normalizeExtKey(rawKey);
+        if (!key) {
+            (0, errors_1.logWarn)(`Ignoring extension mapping in ${exports.PROJECT_CONFIG_FILENAME}: "${rawKey}" is not a valid file extension`, { file });
+            continue;
+        }
+        if (typeof rawVal !== 'string' || !(0, grammars_1.isLanguageSupported)(rawVal)) {
+            (0, errors_1.logWarn)(`Ignoring extension "${rawKey}" in ${exports.PROJECT_CONFIG_FILENAME}: "${String(rawVal)}" is not a supported language`, { file });
+            continue;
+        }
+        out[key] = rawVal;
+    }
+    return Object.keys(out).length > 0 ? out : EMPTY;
+}
+/**
+ * Load the validated extension overrides for a project, mtime-cached.
+ *
+ * Returns a map of `.ext` → supported language id. The result merges on top of
+ * the built-in extension map at the point of use (see `detectLanguage` /
+ * `isSourceFile`), with these user mappings taking precedence. Returns an empty
+ * map when there is no `codegraph.json` (the zero-config default).
+ */
+function loadExtensionOverrides(rootDir) {
+    const file = path.join(rootDir, exports.PROJECT_CONFIG_FILENAME);
+    let mtimeMs;
+    try {
+        mtimeMs = fs.statSync(file).mtimeMs;
+    }
+    catch {
+        // No config file — drop any stale cache entry and return the default.
+        cacheMeta.delete(rootDir);
+        overridesCache.delete(rootDir);
+        return EMPTY;
+    }
+    const meta = cacheMeta.get(rootDir);
+    if (meta && meta.mtimeMs === mtimeMs)
+        return meta.overrides;
+    const overrides = parseExtensionOverrides(file);
+    cacheMeta.set(rootDir, { mtimeMs, overrides });
+    overridesCache.set(rootDir, overrides);
+    return overrides;
+}
+/** Test/maintenance hook: forget cached config (e.g. after rewriting it in a test). */
+function clearProjectConfigCache() {
+    cacheMeta.clear();
+    overridesCache.clear();
+}
+//# sourceMappingURL=project-config.js.map

package/lib/dist/project-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config.js","sourceRoot":"","sources":["../src/project-config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgIA,wDAoBC;AAGD,0DAGC;AA1JD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,oDAA4D;AAC5D,qCAAmC;AAEnC,oFAAoF;AACvE,QAAA,uBAAuB,GAAG,gBAAgB,CAAC;AAYxD;;;;;GAKG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoC,CAAC;AACnE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;AAEhD,uEAAuE;AACvE,MAAM,KAAK,GAA6B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE1D;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAA,gBAAO,EAAC,YAAY,+BAAuB,kBAAkB,EAAE;YAC7D,IAAI;YACJ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,IAAI,GAAI,MAAwB,CAAC,UAAU,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3E,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAA,gBAAO,EAAC,iCAAiC,+BAAuB,MAAM,MAAM,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACzH,SAAS;QACX,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAA,8BAAmB,EAAC,MAAkB,CAAC,EAAE,CAAC;YAC3E,IAAA,gBAAO,EAAC,uBAAuB,MAAM,QAAQ,+BAAuB,MAAM,MAAM,CAAC,MAAM,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnI,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAkB,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CAAC,OAAe;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,+BAAuB,CAAC,CAAC;IAEzD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC;IAE5D,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAChD,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uFAAuF;AACvF,SAAgB,uBAAuB;IACrC,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/lib/dist/reasoning/config.d.ts

@@ -0,0 +1,45 @@
+/** Managed tier ("CodeGraph AI") — the metered gateway used when logged in. */
+export declare const MANAGED_DEFAULT_URL = "https://ai.getcodegraph.com/v1";
+/** The gateway's public model id (it translates this to the upstream provider id). */
+export declare const MANAGED_DEFAULT_MODEL = "openai/gpt-oss-120b";
+export interface OffloadConfig {
+    /** Managed tier: route through CodeGraph AI (metered) with the logged-in org token. */
+    managed?: boolean;
+    /** OpenAI-compatible base URL ending in `/v1` (e.g. https://api.cerebras.ai/v1). */
+    url?: string;
+    /** Model id to request (default `gpt-oss-120b` BYO, `openai/gpt-oss-120b` managed). */
+    model?: string;
+    /** Name of the env var holding the provider API key (never persisted). BYO only. */
+    keyEnv?: string;
+    /** reasoning_effort: low | medium | high (default `low`). */
+    effort?: string;
+    /** Output style: plain | report (default `plain`). */
+    style?: string;
+}
+export interface ResolvedOffload {
+    /** True when the offload is usable (endpoint present; for managed, a token too). */
+    enabled: boolean;
+    /** Managed tier (CodeGraph AI, metered) vs BYO endpoint. */
+    managed: boolean;
+    url?: string;
+    model: string;
+    /** Resolved API key / org token (from env, the configured `keyEnv`, or login), if any. */
+    apiKey?: string;
+    /** Where the key/token came from (for `status` display) — never the secret itself. */
+    keySource?: string;
+    effort: string;
+    style: string;
+    timeoutMs: number;
+    maxTokens: number;
+    strip: boolean;
+    debug: boolean;
+    /** Where the endpoint came from — drives `codegraph offload status`. */
+    origin: 'env' | 'config' | 'none';
+}
+/** The persisted offload block (empty object if none). */
+export declare function readOffloadConfig(): OffloadConfig;
+/** Persist (or, with `null`, clear) the offload block, leaving other config keys intact. */
+export declare function writeOffloadConfig(offload: OffloadConfig | null): void;
+/** Merge the persisted config with `CODEGRAPH_OFFLOAD_*` env overrides (env wins). */
+export declare function resolveOffload(env?: NodeJS.ProcessEnv): ResolvedOffload;
+//# sourceMappingURL=config.d.ts.map

package/lib/dist/reasoning/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/reasoning/config.ts"],"names":[],"mappings":"AAqBA,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,mCAAmC,CAAC;AACpE,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACnC;AAsBD,0DAA0D;AAC1D,wBAAgB,iBAAiB,IAAI,aAAa,CAIjD;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAKtE;AAOD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAwDpF"}

package/lib/dist/reasoning/config.js

@@ -0,0 +1,171 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MANAGED_DEFAULT_MODEL = exports.MANAGED_DEFAULT_URL = void 0;
+exports.readOffloadConfig = readOffloadConfig;
+exports.writeOffloadConfig = writeOffloadConfig;
+exports.resolveOffload = resolveOffload;
+/**
+ * Reasoning-offload configuration: the persistent, machine-level settings the
+ * `codegraph offload` CLI writes, merged with `CODEGRAPH_OFFLOAD_*` env overrides.
+ *
+ * Stored in `~/.codegraph/config.json` under the `offload` key — the same global
+ * home CodeGraph already uses for the daemon registry — because the reasoning
+ * endpoint is a per-machine choice (the model you bring), not per-project state.
+ * Every codegraph MCP server on the machine picks it up, so a user configures it
+ * once. Env vars override the file (CI / ephemeral / advanced use).
+ *
+ * For a BYO endpoint, the API key is NEVER written to disk: the CLI stores the
+ * NAME of an env var (`keyEnv`) and reads the key from it at call time. The
+ * MANAGED tier ("CodeGraph AI") instead authenticates with a revocable, org-scoped
+ * token from `codegraph offload login`, stored separately in `credentials.json`
+ * (see ./credentials) — so `config.json` itself never carries a secret either way.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const credentials_1 = require("./credentials");
+/** Managed tier ("CodeGraph AI") — the metered gateway used when logged in. */
+exports.MANAGED_DEFAULT_URL = 'https://ai.getcodegraph.com/v1';
+/** The gateway's public model id (it translates this to the upstream provider id). */
+exports.MANAGED_DEFAULT_MODEL = 'openai/gpt-oss-120b';
+function configDir() {
+    return path.join(os.homedir(), '.codegraph');
+}
+function configPath() {
+    return path.join(configDir(), 'config.json');
+}
+function readUserConfig() {
+    try {
+        return JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function writeUserConfig(cfg) {
+    fs.mkdirSync(configDir(), { recursive: true });
+    fs.writeFileSync(configPath(), JSON.stringify(cfg, null, 2) + '\n');
+}
+/** The persisted offload block (empty object if none). */
+function readOffloadConfig() {
+    const cfg = readUserConfig();
+    const o = cfg.offload;
+    return o && typeof o === 'object' ? o : {};
+}
+/** Persist (or, with `null`, clear) the offload block, leaving other config keys intact. */
+function writeOffloadConfig(offload) {
+    const cfg = readUserConfig();
+    if (offload === null)
+        delete cfg.offload;
+    else
+        cfg.offload = offload;
+    writeUserConfig(cfg);
+}
+const trimmed = (v) => {
+    const t = v?.trim();
+    return t ? t : undefined;
+};
+/** Merge the persisted config with `CODEGRAPH_OFFLOAD_*` env overrides (env wins). */
+function resolveOffload(env = process.env) {
+    // Hard kill-switch: disable the offload for this process/session without touching
+    // the persisted config or the stored login — e.g. one A/B arm, or a user who wants
+    // codegraph_explore to return raw source for a session. Env-only by design.
+    if (env.CODEGRAPH_OFFLOAD_DISABLE === '1') {
+        return {
+            enabled: false, managed: false, url: undefined, model: exports.MANAGED_DEFAULT_MODEL,
+            apiKey: undefined, keySource: undefined, effort: 'low', style: 'plain',
+            timeoutMs: 20000, maxTokens: 12000, strip: false,
+            debug: env.CODEGRAPH_OFFLOAD_DEBUG === '1', origin: 'none',
+        };
+    }
+    const c = readOffloadConfig();
+    const managed = !!c.managed;
+    const envUrl = trimmed(env.CODEGRAPH_OFFLOAD_URL);
+    const envKey = trimmed(env.CODEGRAPH_OFFLOAD_KEY);
+    let url;
+    let apiKey;
+    let keySource;
+    let model;
+    if (managed) {
+        // Managed tier: default to the CodeGraph AI gateway + its public model id; the
+        // bearer is the org token from `codegraph offload login` (or an env override).
+        url = envUrl ?? trimmed(c.url) ?? exports.MANAGED_DEFAULT_URL;
+        model = trimmed(env.CODEGRAPH_OFFLOAD_MODEL) ?? trimmed(c.model) ?? exports.MANAGED_DEFAULT_MODEL;
+        if (envKey) {
+            apiKey = envKey;
+            keySource = 'CODEGRAPH_OFFLOAD_KEY';
+        }
+        else {
+            const t = (0, credentials_1.readOffloadToken)();
+            if (t) {
+                apiKey = t;
+                keySource = 'codegraph login';
+            }
+        }
+    }
+    else {
+        // BYO: endpoint + (optional) provider key resolved from env or the named env var.
+        url = envUrl ?? trimmed(c.url);
+        model = trimmed(env.CODEGRAPH_OFFLOAD_MODEL) ?? trimmed(c.model) ?? 'gpt-oss-120b';
+        if (envKey) {
+            apiKey = envKey;
+            keySource = 'CODEGRAPH_OFFLOAD_KEY';
+        }
+        else if (c.keyEnv && trimmed(env[c.keyEnv])) {
+            apiKey = trimmed(env[c.keyEnv]);
+            keySource = c.keyEnv;
+        }
+    }
+    const origin = envUrl ? 'env' : (managed || trimmed(c.url)) ? 'config' : 'none';
+    return {
+        // Managed needs both an endpoint AND a token (no token → effectively logged out);
+        // BYO needs only an endpoint (some endpoints require no auth).
+        enabled: managed ? (!!url && !!apiKey) : !!url,
+        managed,
+        url,
+        model,
+        apiKey,
+        keySource,
+        effort: trimmed(env.CODEGRAPH_OFFLOAD_EFFORT) ?? trimmed(c.effort) ?? 'low',
+        style: trimmed(env.CODEGRAPH_OFFLOAD_STYLE) ?? trimmed(c.style) ?? 'plain',
+        timeoutMs: Number(env.CODEGRAPH_OFFLOAD_TIMEOUT_MS) || 20000,
+        maxTokens: Number(env.CODEGRAPH_OFFLOAD_MAXTOKENS) || 12000,
+        strip: env.CODEGRAPH_OFFLOAD_STRIP === '1',
+        debug: env.CODEGRAPH_OFFLOAD_DEBUG === '1',
+        origin,
+    };
+}
+//# sourceMappingURL=config.js.map

package/lib/dist/reasoning/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/reasoning/config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmFA,8CAIC;AAGD,gDAKC;AAQD,wCAwDC;AA/JD;;;;;;;;;;;;;;;GAeG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,+CAAiD;AAEjD,+EAA+E;AAClE,QAAA,mBAAmB,GAAG,gCAAgC,CAAC;AACpE,sFAAsF;AACzE,QAAA,qBAAqB,GAAG,qBAAqB,CAAC;AAsC3D,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAA4B,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,0DAA0D;AAC1D,SAAgB,iBAAiB;IAC/B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,4FAA4F;AAC5F,SAAgB,kBAAkB,CAAC,OAA6B;IAC9D,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;;QACpC,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,eAAe,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAqB,EAAsB,EAAE;IAC5D,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACpB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC,CAAC;AAEF,sFAAsF;AACtF,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,kFAAkF;IAClF,mFAAmF;IACnF,4EAA4E;IAC5E,IAAI,GAAG,CAAC,yBAAyB,KAAK,GAAG,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,6BAAqB;YAC5E,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;YACtE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;YAChD,KAAK,EAAE,GAAG,CAAC,uBAAuB,KAAK,GAAG,EAAE,MAAM,EAAE,MAAM;SAC3D,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAElD,IAAI,GAAuB,CAAC;IAC5B,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAA6B,CAAC;IAClC,IAAI,KAAa,CAAC;IAElB,IAAI,OAAO,EAAE,CAAC;QACZ,+EAA+E;QAC/E,+EAA+E;QAC/E,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,2BAAmB,CAAC;QACtD,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,6BAAqB,CAAC;QAC1F,IAAI,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,MAAM,CAAC;YAAC,SAAS,GAAG,uBAAuB,CAAC;QAAC,CAAC;aAChE,CAAC;YAAC,MAAM,CAAC,GAAG,IAAA,8BAAgB,GAAE,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,GAAG,CAAC,CAAC;gBAAC,SAAS,GAAG,iBAAiB,CAAC;YAAC,CAAC;QAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,kFAAkF;QAClF,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC;QACnF,IAAI,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,MAAM,CAAC;YAAC,SAAS,GAAG,uBAAuB,CAAC;QAAC,CAAC;aAChE,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC;IACzG,CAAC;IAED,MAAM,MAAM,GAA8B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAE3G,OAAO;QACL,kFAAkF;QAClF,+DAA+D;QAC/D,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAC9C,OAAO;QACP,GAAG;QACH,KAAK;QACL,MAAM;QACN,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK;QAC3E,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO;QAC1E,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,KAAK;QAC5D,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,KAAK;QAC3D,KAAK,EAAE,GAAG,CAAC,uBAAuB,KAAK,GAAG;QAC1C,KAAK,EAAE,GAAG,CAAC,uBAAuB,KAAK,GAAG;QAC1C,MAAM;KACP,CAAC;AACJ,CAAC"}

package/lib/dist/reasoning/credentials.d.ts

@@ -0,0 +1,5 @@
+/** The stored managed-offload org token, if the machine is logged in. */
+export declare function readOffloadToken(): string | undefined;
+/** Persist (or, with `null`, clear) the managed-offload org token at `0600`. */
+export declare function writeOffloadToken(token: string | null): void;
+//# sourceMappingURL=credentials.d.ts.map

package/lib/dist/reasoning/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/reasoning/credentials.ts"],"names":[],"mappings":"AA0BA,yEAAyE;AACzE,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAGrD;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAS5D"}

package/lib/dist/reasoning/credentials.js

@@ -0,0 +1,83 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readOffloadToken = readOffloadToken;
+exports.writeOffloadToken = writeOffloadToken;
+/**
+ * Managed-offload credentials: the CodeGraph org token that authenticates the
+ * managed reasoning tier against `codegraph-ai` (the metered gateway).
+ *
+ * Unlike a BYO provider key (which is never persisted — the config stores only the
+ * NAME of an env var), the org token IS a revocable, org-scoped auth token issued
+ * to this machine — like the token `gh auth` or `npm login` stores. So it lives in
+ * its own file, `~/.codegraph/credentials.json`, written `0600`, kept out of the
+ * shareable `config.json`.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+function credentialsPath() {
+    return path.join(os.homedir(), '.codegraph', 'credentials.json');
+}
+function read() {
+    try {
+        return JSON.parse(fs.readFileSync(credentialsPath(), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+/** The stored managed-offload org token, if the machine is logged in. */
+function readOffloadToken() {
+    const t = read().offloadToken;
+    return typeof t === 'string' && t.trim() ? t.trim() : undefined;
+}
+/** Persist (or, with `null`, clear) the managed-offload org token at `0600`. */
+function writeOffloadToken(token) {
+    const p = credentialsPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    const creds = read();
+    if (token === null)
+        delete creds.offloadToken;
+    else
+        creds.offloadToken = token;
+    // Write restrictively: create at 0600, and tighten an existing file too.
+    fs.writeFileSync(p, JSON.stringify(creds, null, 2) + '\n', { mode: 0o600 });
+    try {
+        fs.chmodSync(p, 0o600);
+    }
+    catch { /* best-effort on platforms without POSIX modes */ }
+}
+//# sourceMappingURL=credentials.js.map

package/lib/dist/reasoning/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/reasoning/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,4CAGC;AAGD,8CASC;AA1CD;;;;;;;;;GASG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAEzB,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,IAAI;IACX,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAgB,gBAAgB;IAC9B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,YAAY,CAAC;IAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,gFAAgF;AAChF,SAAgB,iBAAiB,CAAC,KAAoB;IACpD,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;IAC5B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;IACrB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;;QACzC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;IAChC,yEAAyE;IACzE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;AAC9F,CAAC"}

package/lib/dist/reasoning/login.d.ts

@@ -0,0 +1,21 @@
+/** Dashboard base for the device-login endpoints; override for testing via CODEGRAPH_LOGIN_URL. */
+export declare function loginBaseUrl(): string;
+/** The dashboard's response to a device-authorization start request. */
+export interface DeviceStart {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    /** Same URL with the code prefilled, for one-click open. */
+    verification_uri_complete?: string;
+    /** Seconds the CLI should wait between polls. */
+    interval?: number;
+    /** Seconds until the request expires. */
+    expires_in?: number;
+}
+/** Begin a device-authorization request. */
+export declare function startDeviceLogin(): Promise<DeviceStart>;
+/** Poll until the user approves in the browser; resolves with the org token. */
+export declare function pollForToken(deviceCode: string, intervalSec: number, expiresInSec: number): Promise<string>;
+/** Best-effort: open a URL in the default browser. Never throws — the URL is also printed. */
+export declare function openBrowser(url: string): Promise<void>;
+//# sourceMappingURL=login.d.ts.map

package/lib/dist/reasoning/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/reasoning/login.ts"],"names":[],"mappings":"AAeA,mGAAmG;AACnG,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4CAA4C;AAC5C,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC,CAY7D;AAED,gFAAgF;AAChF,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBjH;AAED,8FAA8F;AAC9F,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY5D"}

package/lib/dist/reasoning/login.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loginBaseUrl = loginBaseUrl;
+exports.startDeviceLogin = startDeviceLogin;
+exports.pollForToken = pollForToken;
+exports.openBrowser = openBrowser;
+/**
+ * Managed-login device flow for `codegraph login`.
+ *
+ * Opens the user's browser to the CodeGraph dashboard, where they authorize with
+ * their account; the CLI meanwhile polls for the minted, org-scoped token and
+ * stores it (see ./credentials + ./config) to turn on managed reasoning.
+ *
+ * This talks to the DASHBOARD (app.getcodegraph.com), not the metered gateway —
+ * it's a plain OAuth-style device handshake (RFC 8628 shape), nothing proprietary.
+ * The resulting token is what authenticates the managed reasoning calls (./reasoner).
+ */
+const child_process_1 = require("child_process");
+const DEFAULT_BASE = 'https://app.getcodegraph.com';
+/** Dashboard base for the device-login endpoints; override for testing via CODEGRAPH_LOGIN_URL. */
+function loginBaseUrl() {
+    const raw = process.env.CODEGRAPH_LOGIN_URL?.trim() || DEFAULT_BASE;
+    return raw.replace(/\/+$/, '');
+}
+/** Begin a device-authorization request. */
+async function startDeviceLogin() {
+    const base = loginBaseUrl();
+    const res = await fetch(`${base}/api/cli/device/start`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{}',
+    }).catch(() => null);
+    if (!res)
+        throw new Error(`couldn't reach ${base} — check your connection`);
+    if (!res.ok)
+        throw new Error(`couldn't start login (HTTP ${res.status})`);
+    const j = (await res.json().catch(() => null));
+    if (!j?.device_code || !j.user_code)
+        throw new Error('login start returned an unexpected response');
+    return j;
+}
+/** Poll until the user approves in the browser; resolves with the org token. */
+async function pollForToken(deviceCode, intervalSec, expiresInSec) {
+    const deadline = Date.now() + Math.max(30, expiresInSec || 600) * 1000;
+    let waitMs = Math.max(2, intervalSec || 5) * 1000;
+    const base = loginBaseUrl();
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, waitMs));
+        const res = await fetch(`${base}/api/cli/device/token`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ device_code: deviceCode }),
+        }).catch(() => null);
+        if (!res)
+            continue; // transient network blip — keep polling until the deadline
+        if (res.status === 200) {
+            const j = (await res.json().catch(() => null));
+            if (j?.token)
+                return j.token;
+        }
+        else if (res.status === 429) {
+            waitMs += 2000; // server asked us to slow down
+        }
+        else if (res.status === 404 || res.status === 410) {
+            throw new Error('the login request expired — run `codegraph login` again');
+        }
+        // 202 (authorization pending) → keep waiting
+    }
+    throw new Error('login timed out before you approved — run `codegraph login` again');
+}
+/** Best-effort: open a URL in the default browser. Never throws — the URL is also printed. */
+async function openBrowser(url) {
+    const [cmd, args] = process.platform === 'darwin' ? ['open', [url]]
+        : process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]]
+            : ['xdg-open', [url]];
+    try {
+        const child = (0, child_process_1.spawn)(cmd, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        /* the URL is printed for manual open */
+    }
+}
+//# sourceMappingURL=login.js.map