@colbymchenry/codegraph-darwin-x64 1.0.1 → 1.1.1

package/lib/dist/project-config.d.ts

@@ -0,0 +1,36 @@
+import { Language } from './types';
+/** Filename of the project-scoped config, resolved relative to the project root. */
+export declare const PROJECT_CONFIG_FILENAME = "codegraph.json";
+export interface ProjectConfig {
+    /** Map of custom file extension (`.foo`) to a supported language id. */
+    extensions?: Record<string, string>;
+    /**
+     * Gitignore-style patterns naming gitignored directories whose embedded git
+     * repositories should be indexed anyway — the explicit opt-in to override
+     * `.gitignore` for nested-repo discovery (#622, #699). Absent/empty (the
+     * default) means `.gitignore` is fully respected: gitignored embedded repos
+     * are never discovered or indexed (#970, #976).
+     */
+    includeIgnored?: string[];
+}
+/**
+ * Load the validated extension overrides for a project, mtime-cached.
+ *
+ * Returns a map of `.ext` → supported language id. The result merges on top of
+ * the built-in extension map at the point of use (see `detectLanguage` /
+ * `isSourceFile`), with these user mappings taking precedence. Returns an empty
+ * map when there is no `codegraph.json` (the zero-config default).
+ */
+export declare function loadExtensionOverrides(rootDir: string): Record<string, Language>;
+/**
+ * Load the validated `includeIgnored` patterns for a project, mtime-cached.
+ *
+ * These name gitignored directories whose embedded git repositories should be
+ * indexed despite `.gitignore` (#622, #699). An empty result — the zero-config
+ * default — means `.gitignore` is fully respected: gitignored embedded repos
+ * are never discovered or indexed (#970, #976).
+ */
+export declare function loadIncludeIgnoredPatterns(rootDir: string): string[];
+/** Test/maintenance hook: forget cached config (e.g. after rewriting it in a test). */
+export declare function clearProjectConfigCache(): void;
+//# sourceMappingURL=project-config.d.ts.map

package/lib/dist/project-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config.d.ts","sourceRoot":"","sources":["../src/project-config.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAInC,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AA2JD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAEhF;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpE;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}

package/lib/dist/project-config.js

@@ -0,0 +1,235 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROJECT_CONFIG_FILENAME = void 0;
+exports.loadExtensionOverrides = loadExtensionOverrides;
+exports.loadIncludeIgnoredPatterns = loadIncludeIgnoredPatterns;
+exports.clearProjectConfigCache = clearProjectConfigCache;
+/**
+ * Project-scoped configuration: a committed `codegraph.json` at the project
+ * root that a team shares through version control.
+ *
+ * Today it carries one thing — `extensions`, an opt-in map from a custom file
+ * extension to one of CodeGraph's supported languages. The built-in
+ * extension → language table (`EXTENSION_MAP` in `extraction/grammars.ts`) is
+ * otherwise hardcoded, so a codebase that uses a non-standard extension for a
+ * supported language (e.g. `.dota_lua` for Lua) sees those files silently
+ * skipped. This lets the project map them once, in a version-controlled file:
+ *
+ *   {
+ *     "extensions": {
+ *       ".dota_lua": "lua",
+ *       ".tpl": "php"
+ *     }
+ *   }
+ *
+ * User mappings merge on TOP of the built-ins and win on conflict, so a project
+ * can also re-point a built-in extension (e.g. force `.h` → `cpp`). Absent or
+ * malformed config is the zero-config default — no overrides, no error. Invalid
+ * individual entries are warned-and-skipped (never fatal): an unparseable
+ * project file must not break indexing.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const grammars_1 = require("./extraction/grammars");
+const errors_1 = require("./errors");
+/** Filename of the project-scoped config, resolved relative to the project root. */
+exports.PROJECT_CONFIG_FILENAME = 'codegraph.json';
+/**
+ * Cache keyed by project root. The loader is called once per indexing/scan/sync
+ * operation (and per watch event), so the mtime guard keeps repeat calls to one
+ * `stat` while a single `codegraph.json` is in force. Keying by root keeps two
+ * projects in the same process (the daemon / multi-project MCP server) isolated.
+ */
+const cache = new Map();
+/** Shared frozen empties so the no-config path allocates nothing. */
+const EMPTY_EXTENSIONS = Object.freeze({});
+const EMPTY_CONFIG = Object.freeze({
+    extensions: EMPTY_EXTENSIONS,
+    includeIgnored: Object.freeze([]),
+});
+/**
+ * Normalize a user-provided extension key to the `.ext` lowercase form used by
+ * the built-in map. Returns null for keys that can never match a real file
+ * extension (so the caller warns and skips):
+ *   - empty / just "."
+ *   - multi-part (".d.ts") — language detection keys off the FINAL extension
+ *     only (`lastIndexOf('.')`), so a multi-dot key would never be consulted.
+ *   - anything containing a path separator.
+ */
+function normalizeExtKey(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    let ext = raw.trim().toLowerCase();
+    if (!ext)
+        return null;
+    if (!ext.startsWith('.'))
+        ext = '.' + ext;
+    const body = ext.slice(1);
+    if (!body)
+        return null;
+    if (body.includes('.') || body.includes('/') || body.includes('\\'))
+        return null;
+    return ext;
+}
+/**
+ * Read + JSON-parse a `codegraph.json` once and return its validated view.
+ * Every failure mode degrades to the zero-config default — a missing file, bad
+ * JSON, or a typo'd value never throws.
+ */
+function parseConfig(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, 'utf-8');
+    }
+    catch {
+        return EMPTY_CONFIG;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        (0, errors_1.logWarn)(`Ignoring ${exports.PROJECT_CONFIG_FILENAME}: not valid JSON`, {
+            file,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return EMPTY_CONFIG;
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return EMPTY_CONFIG;
+    const extensions = extractExtensions(parsed, file);
+    const includeIgnored = extractIncludeIgnored(parsed, file);
+    if (extensions === EMPTY_EXTENSIONS && includeIgnored.length === 0)
+        return EMPTY_CONFIG;
+    return { extensions, includeIgnored };
+}
+/**
+ * Validate the `extensions` map. Every failure mode degrades to "no overrides
+ * from this entry" — a bad value or a typo'd language never throws.
+ */
+function extractExtensions(parsed, file) {
+    const exts = parsed.extensions;
+    if (!exts || typeof exts !== 'object' || Array.isArray(exts))
+        return EMPTY_EXTENSIONS;
+    const out = {};
+    for (const [rawKey, rawVal] of Object.entries(exts)) {
+        const key = normalizeExtKey(rawKey);
+        if (!key) {
+            (0, errors_1.logWarn)(`Ignoring extension mapping in ${exports.PROJECT_CONFIG_FILENAME}: "${rawKey}" is not a valid file extension`, { file });
+            continue;
+        }
+        if (typeof rawVal !== 'string' || !(0, grammars_1.isLanguageSupported)(rawVal)) {
+            (0, errors_1.logWarn)(`Ignoring extension "${rawKey}" in ${exports.PROJECT_CONFIG_FILENAME}: "${String(rawVal)}" is not a supported language`, { file });
+            continue;
+        }
+        out[key] = rawVal;
+    }
+    return Object.keys(out).length > 0 ? out : EMPTY_EXTENSIONS;
+}
+/**
+ * Validate the `includeIgnored` patterns: an array of non-empty gitignore-style
+ * strings. A non-array value or a non-string/blank entry warns-and-skips; never
+ * throws. Patterns are kept verbatim (trimmed) so they match exactly as a
+ * `.gitignore` line would.
+ */
+function extractIncludeIgnored(parsed, file) {
+    const raw = parsed.includeIgnored;
+    if (raw === undefined)
+        return [];
+    if (!Array.isArray(raw)) {
+        (0, errors_1.logWarn)(`Ignoring "includeIgnored" in ${exports.PROJECT_CONFIG_FILENAME}: must be an array of gitignore-style patterns`, { file });
+        return [];
+    }
+    const out = [];
+    for (const entry of raw) {
+        if (typeof entry !== 'string' || !entry.trim()) {
+            (0, errors_1.logWarn)(`Ignoring an "includeIgnored" entry in ${exports.PROJECT_CONFIG_FILENAME}: every pattern must be a non-empty string`, { file });
+            continue;
+        }
+        out.push(entry.trim());
+    }
+    return out;
+}
+/**
+ * Load the parsed `codegraph.json` for a project, mtime-cached. A missing or
+ * malformed file yields the zero-config default. One `stat` (and at most one
+ * read/parse) while a single config file is in force, shared across every field.
+ */
+function loadParsedConfig(rootDir) {
+    const file = path.join(rootDir, exports.PROJECT_CONFIG_FILENAME);
+    let mtimeMs;
+    try {
+        mtimeMs = fs.statSync(file).mtimeMs;
+    }
+    catch {
+        // No config file — drop any stale cache entry and return the default.
+        cache.delete(rootDir);
+        return EMPTY_CONFIG;
+    }
+    const entry = cache.get(rootDir);
+    if (entry && entry.mtimeMs === mtimeMs)
+        return entry.config;
+    const config = parseConfig(file);
+    cache.set(rootDir, { mtimeMs, config });
+    return config;
+}
+/**
+ * Load the validated extension overrides for a project, mtime-cached.
+ *
+ * Returns a map of `.ext` → supported language id. The result merges on top of
+ * the built-in extension map at the point of use (see `detectLanguage` /
+ * `isSourceFile`), with these user mappings taking precedence. Returns an empty
+ * map when there is no `codegraph.json` (the zero-config default).
+ */
+function loadExtensionOverrides(rootDir) {
+    return loadParsedConfig(rootDir).extensions;
+}
+/**
+ * Load the validated `includeIgnored` patterns for a project, mtime-cached.
+ *
+ * These name gitignored directories whose embedded git repositories should be
+ * indexed despite `.gitignore` (#622, #699). An empty result — the zero-config
+ * default — means `.gitignore` is fully respected: gitignored embedded repos
+ * are never discovered or indexed (#970, #976).
+ */
+function loadIncludeIgnoredPatterns(rootDir) {
+    return loadParsedConfig(rootDir).includeIgnored;
+}
+/** Test/maintenance hook: forget cached config (e.g. after rewriting it in a test). */
+function clearProjectConfigCache() {
+    cache.clear();
+}
+//# sourceMappingURL=project-config.js.map

package/lib/dist/project-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config.js","sourceRoot":"","sources":["../src/project-config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+MA,wDAEC;AAUD,gEAEC;AAGD,0DAEC;AAlOD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,oDAA4D;AAC5D,qCAAmC;AAEnC,oFAAoF;AACvE,QAAA,uBAAuB,GAAG,gBAAgB,CAAC;AA0BxD;;;;;GAKG;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C,qEAAqE;AACrE,MAAM,gBAAgB,GAA6B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACrE,MAAM,YAAY,GAAiB,MAAM,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,gBAAgB;IAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAwB;CACzD,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAA,gBAAO,EAAC,YAAY,+BAAuB,kBAAkB,EAAE;YAC7D,IAAI;YACJ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAE/D,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,UAAU,KAAK,gBAAgB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACxF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAAc,EAAE,IAAY;IACrD,MAAM,IAAI,GAAI,MAAwB,CAAC,UAAU,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEtF,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAA,gBAAO,EAAC,iCAAiC,+BAAuB,MAAM,MAAM,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACzH,SAAS;QACX,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAA,8BAAmB,EAAC,MAAkB,CAAC,EAAE,CAAC;YAC3E,IAAA,gBAAO,EAAC,uBAAuB,MAAM,QAAQ,+BAAuB,MAAM,MAAM,CAAC,MAAM,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnI,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAkB,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,MAAc,EAAE,IAAY;IACzD,MAAM,GAAG,GAAI,MAAwB,CAAC,cAAc,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAA,gBAAO,EAAC,gCAAgC,+BAAuB,gDAAgD,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3H,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAA,gBAAO,EAAC,yCAAyC,+BAAuB,4CAA4C,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAChI,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,+BAAuB,CAAC,CAAC;IAEzD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAE5D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CAAC,OAAe;IACpD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,0BAA0B,CAAC,OAAe;IACxD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC;AAClD,CAAC;AAED,uFAAuF;AACvF,SAAgB,uBAAuB;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/lib/dist/reasoning/config.d.ts

@@ -0,0 +1,45 @@
+/** Managed tier ("CodeGraph AI") — the metered gateway used when logged in. */
+export declare const MANAGED_DEFAULT_URL = "https://ai.getcodegraph.com/v1";
+/** The gateway's public model id (it translates this to the upstream provider id). */
+export declare const MANAGED_DEFAULT_MODEL = "openai/gpt-oss-120b";
+export interface OffloadConfig {
+    /** Managed tier: route through CodeGraph AI (metered) with the logged-in org token. */
+    managed?: boolean;
+    /** OpenAI-compatible base URL ending in `/v1` (e.g. https://api.cerebras.ai/v1). */
+    url?: string;
+    /** Model id to request (default `gpt-oss-120b` BYO, `openai/gpt-oss-120b` managed). */
+    model?: string;
+    /** Name of the env var holding the provider API key (never persisted). BYO only. */
+    keyEnv?: string;
+    /** reasoning_effort: low | medium | high (default `low`). */
+    effort?: string;
+    /** Output style: plain | report (default `plain`). */
+    style?: string;
+}
+export interface ResolvedOffload {
+    /** True when the offload is usable (endpoint present; for managed, a token too). */
+    enabled: boolean;
+    /** Managed tier (CodeGraph AI, metered) vs BYO endpoint. */
+    managed: boolean;
+    url?: string;
+    model: string;
+    /** Resolved API key / org token (from env, the configured `keyEnv`, or login), if any. */
+    apiKey?: string;
+    /** Where the key/token came from (for `status` display) — never the secret itself. */
+    keySource?: string;
+    effort: string;
+    style: string;
+    timeoutMs: number;
+    maxTokens: number;
+    strip: boolean;
+    debug: boolean;
+    /** Where the endpoint came from — drives `codegraph offload status`. */
+    origin: 'env' | 'config' | 'none';
+}
+/** The persisted offload block (empty object if none). */
+export declare function readOffloadConfig(): OffloadConfig;
+/** Persist (or, with `null`, clear) the offload block, leaving other config keys intact. */
+export declare function writeOffloadConfig(offload: OffloadConfig | null): void;
+/** Merge the persisted config with `CODEGRAPH_OFFLOAD_*` env overrides (env wins). */
+export declare function resolveOffload(env?: NodeJS.ProcessEnv): ResolvedOffload;
+//# sourceMappingURL=config.d.ts.map

package/lib/dist/reasoning/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/reasoning/config.ts"],"names":[],"mappings":"AAqBA,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,mCAAmC,CAAC;AACpE,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACnC;AAsBD,0DAA0D;AAC1D,wBAAgB,iBAAiB,IAAI,aAAa,CAIjD;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAKtE;AAOD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAwDpF"}

package/lib/dist/reasoning/config.js

@@ -0,0 +1,171 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MANAGED_DEFAULT_MODEL = exports.MANAGED_DEFAULT_URL = void 0;
+exports.readOffloadConfig = readOffloadConfig;
+exports.writeOffloadConfig = writeOffloadConfig;
+exports.resolveOffload = resolveOffload;
+/**
+ * Reasoning-offload configuration: the persistent, machine-level settings the
+ * `codegraph offload` CLI writes, merged with `CODEGRAPH_OFFLOAD_*` env overrides.
+ *
+ * Stored in `~/.codegraph/config.json` under the `offload` key — the same global
+ * home CodeGraph already uses for the daemon registry — because the reasoning
+ * endpoint is a per-machine choice (the model you bring), not per-project state.
+ * Every codegraph MCP server on the machine picks it up, so a user configures it
+ * once. Env vars override the file (CI / ephemeral / advanced use).
+ *
+ * For a BYO endpoint, the API key is NEVER written to disk: the CLI stores the
+ * NAME of an env var (`keyEnv`) and reads the key from it at call time. The
+ * MANAGED tier ("CodeGraph AI") instead authenticates with a revocable, org-scoped
+ * token from `codegraph offload login`, stored separately in `credentials.json`
+ * (see ./credentials) — so `config.json` itself never carries a secret either way.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const credentials_1 = require("./credentials");
+/** Managed tier ("CodeGraph AI") — the metered gateway used when logged in. */
+exports.MANAGED_DEFAULT_URL = 'https://ai.getcodegraph.com/v1';
+/** The gateway's public model id (it translates this to the upstream provider id). */
+exports.MANAGED_DEFAULT_MODEL = 'openai/gpt-oss-120b';
+function configDir() {
+    return path.join(os.homedir(), '.codegraph');
+}
+function configPath() {
+    return path.join(configDir(), 'config.json');
+}
+function readUserConfig() {
+    try {
+        return JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function writeUserConfig(cfg) {
+    fs.mkdirSync(configDir(), { recursive: true });
+    fs.writeFileSync(configPath(), JSON.stringify(cfg, null, 2) + '\n');
+}
+/** The persisted offload block (empty object if none). */
+function readOffloadConfig() {
+    const cfg = readUserConfig();
+    const o = cfg.offload;
+    return o && typeof o === 'object' ? o : {};
+}
+/** Persist (or, with `null`, clear) the offload block, leaving other config keys intact. */
+function writeOffloadConfig(offload) {
+    const cfg = readUserConfig();
+    if (offload === null)
+        delete cfg.offload;
+    else
+        cfg.offload = offload;
+    writeUserConfig(cfg);
+}
+const trimmed = (v) => {
+    const t = v?.trim();
+    return t ? t : undefined;
+};
+/** Merge the persisted config with `CODEGRAPH_OFFLOAD_*` env overrides (env wins). */
+function resolveOffload(env = process.env) {
+    // Hard kill-switch: disable the offload for this process/session without touching
+    // the persisted config or the stored login — e.g. one A/B arm, or a user who wants
+    // codegraph_explore to return raw source for a session. Env-only by design.
+    if (env.CODEGRAPH_OFFLOAD_DISABLE === '1') {
+        return {
+            enabled: false, managed: false, url: undefined, model: exports.MANAGED_DEFAULT_MODEL,
+            apiKey: undefined, keySource: undefined, effort: 'low', style: 'plain',
+            timeoutMs: 20000, maxTokens: 12000, strip: false,
+            debug: env.CODEGRAPH_OFFLOAD_DEBUG === '1', origin: 'none',
+        };
+    }
+    const c = readOffloadConfig();
+    const managed = !!c.managed;
+    const envUrl = trimmed(env.CODEGRAPH_OFFLOAD_URL);
+    const envKey = trimmed(env.CODEGRAPH_OFFLOAD_KEY);
+    let url;
+    let apiKey;
+    let keySource;
+    let model;
+    if (managed) {
+        // Managed tier: default to the CodeGraph AI gateway + its public model id; the
+        // bearer is the org token from `codegraph offload login` (or an env override).
+        url = envUrl ?? trimmed(c.url) ?? exports.MANAGED_DEFAULT_URL;
+        model = trimmed(env.CODEGRAPH_OFFLOAD_MODEL) ?? trimmed(c.model) ?? exports.MANAGED_DEFAULT_MODEL;
+        if (envKey) {
+            apiKey = envKey;
+            keySource = 'CODEGRAPH_OFFLOAD_KEY';
+        }
+        else {
+            const t = (0, credentials_1.readOffloadToken)();
+            if (t) {
+                apiKey = t;
+                keySource = 'codegraph login';
+            }
+        }
+    }
+    else {
+        // BYO: endpoint + (optional) provider key resolved from env or the named env var.
+        url = envUrl ?? trimmed(c.url);
+        model = trimmed(env.CODEGRAPH_OFFLOAD_MODEL) ?? trimmed(c.model) ?? 'gpt-oss-120b';
+        if (envKey) {
+            apiKey = envKey;
+            keySource = 'CODEGRAPH_OFFLOAD_KEY';
+        }
+        else if (c.keyEnv && trimmed(env[c.keyEnv])) {
+            apiKey = trimmed(env[c.keyEnv]);
+            keySource = c.keyEnv;
+        }
+    }
+    const origin = envUrl ? 'env' : (managed || trimmed(c.url)) ? 'config' : 'none';
+    return {
+        // Managed needs both an endpoint AND a token (no token → effectively logged out);
+        // BYO needs only an endpoint (some endpoints require no auth).
+        enabled: managed ? (!!url && !!apiKey) : !!url,
+        managed,
+        url,
+        model,
+        apiKey,
+        keySource,
+        effort: trimmed(env.CODEGRAPH_OFFLOAD_EFFORT) ?? trimmed(c.effort) ?? 'low',
+        style: trimmed(env.CODEGRAPH_OFFLOAD_STYLE) ?? trimmed(c.style) ?? 'plain',
+        timeoutMs: Number(env.CODEGRAPH_OFFLOAD_TIMEOUT_MS) || 20000,
+        maxTokens: Number(env.CODEGRAPH_OFFLOAD_MAXTOKENS) || 12000,
+        strip: env.CODEGRAPH_OFFLOAD_STRIP === '1',
+        debug: env.CODEGRAPH_OFFLOAD_DEBUG === '1',
+        origin,
+    };
+}
+//# sourceMappingURL=config.js.map

package/lib/dist/reasoning/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/reasoning/config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmFA,8CAIC;AAGD,gDAKC;AAQD,wCAwDC;AA/JD;;;;;;;;;;;;;;;GAeG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,+CAAiD;AAEjD,+EAA+E;AAClE,QAAA,mBAAmB,GAAG,gCAAgC,CAAC;AACpE,sFAAsF;AACzE,QAAA,qBAAqB,GAAG,qBAAqB,CAAC;AAsC3D,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAA4B,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,0DAA0D;AAC1D,SAAgB,iBAAiB;IAC/B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,4FAA4F;AAC5F,SAAgB,kBAAkB,CAAC,OAA6B;IAC9D,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;;QACpC,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,eAAe,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAqB,EAAsB,EAAE;IAC5D,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACpB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC,CAAC;AAEF,sFAAsF;AACtF,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,kFAAkF;IAClF,mFAAmF;IACnF,4EAA4E;IAC5E,IAAI,GAAG,CAAC,yBAAyB,KAAK,GAAG,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,6BAAqB;YAC5E,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;YACtE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;YAChD,KAAK,EAAE,GAAG,CAAC,uBAAuB,KAAK,GAAG,EAAE,MAAM,EAAE,MAAM;SAC3D,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAElD,IAAI,GAAuB,CAAC;IAC5B,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAA6B,CAAC;IAClC,IAAI,KAAa,CAAC;IAElB,IAAI,OAAO,EAAE,CAAC;QACZ,+EAA+E;QAC/E,+EAA+E;QAC/E,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,2BAAmB,CAAC;QACtD,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,6BAAqB,CAAC;QAC1F,IAAI,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,MAAM,CAAC;YAAC,SAAS,GAAG,uBAAuB,CAAC;QAAC,CAAC;aAChE,CAAC;YAAC,MAAM,CAAC,GAAG,IAAA,8BAAgB,GAAE,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,GAAG,CAAC,CAAC;gBAAC,SAAS,GAAG,iBAAiB,CAAC;YAAC,CAAC;QAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,kFAAkF;QAClF,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC;QACnF,IAAI,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,MAAM,CAAC;YAAC,SAAS,GAAG,uBAAuB,CAAC;QAAC,CAAC;aAChE,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC;IACzG,CAAC;IAED,MAAM,MAAM,GAA8B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAE3G,OAAO;QACL,kFAAkF;QAClF,+DAA+D;QAC/D,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAC9C,OAAO;QACP,GAAG;QACH,KAAK;QACL,MAAM;QACN,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK;QAC3E,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO;QAC1E,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,KAAK;QAC5D,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,KAAK;QAC3D,KAAK,EAAE,GAAG,CAAC,uBAAuB,KAAK,GAAG;QAC1C,KAAK,EAAE,GAAG,CAAC,uBAAuB,KAAK,GAAG;QAC1C,MAAM;KACP,CAAC;AACJ,CAAC"}

package/lib/dist/reasoning/credentials.d.ts

@@ -0,0 +1,5 @@
+/** The stored managed-offload org token, if the machine is logged in. */
+export declare function readOffloadToken(): string | undefined;
+/** Persist (or, with `null`, clear) the managed-offload org token at `0600`. */
+export declare function writeOffloadToken(token: string | null): void;
+//# sourceMappingURL=credentials.d.ts.map

package/lib/dist/reasoning/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/reasoning/credentials.ts"],"names":[],"mappings":"AA0BA,yEAAyE;AACzE,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAGrD;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAS5D"}

package/lib/dist/reasoning/credentials.js

@@ -0,0 +1,83 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readOffloadToken = readOffloadToken;
+exports.writeOffloadToken = writeOffloadToken;
+/**
+ * Managed-offload credentials: the CodeGraph org token that authenticates the
+ * managed reasoning tier against `codegraph-ai` (the metered gateway).
+ *
+ * Unlike a BYO provider key (which is never persisted — the config stores only the
+ * NAME of an env var), the org token IS a revocable, org-scoped auth token issued
+ * to this machine — like the token `gh auth` or `npm login` stores. So it lives in
+ * its own file, `~/.codegraph/credentials.json`, written `0600`, kept out of the
+ * shareable `config.json`.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+function credentialsPath() {
+    return path.join(os.homedir(), '.codegraph', 'credentials.json');
+}
+function read() {
+    try {
+        return JSON.parse(fs.readFileSync(credentialsPath(), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+/** The stored managed-offload org token, if the machine is logged in. */
+function readOffloadToken() {
+    const t = read().offloadToken;
+    return typeof t === 'string' && t.trim() ? t.trim() : undefined;
+}
+/** Persist (or, with `null`, clear) the managed-offload org token at `0600`. */
+function writeOffloadToken(token) {
+    const p = credentialsPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    const creds = read();
+    if (token === null)
+        delete creds.offloadToken;
+    else
+        creds.offloadToken = token;
+    // Write restrictively: create at 0600, and tighten an existing file too.
+    fs.writeFileSync(p, JSON.stringify(creds, null, 2) + '\n', { mode: 0o600 });
+    try {
+        fs.chmodSync(p, 0o600);
+    }
+    catch { /* best-effort on platforms without POSIX modes */ }
+}
+//# sourceMappingURL=credentials.js.map

package/lib/dist/reasoning/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/reasoning/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,4CAGC;AAGD,8CASC;AA1CD;;;;;;;;;GASG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAEzB,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,IAAI;IACX,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAgB,gBAAgB;IAC9B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,YAAY,CAAC;IAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,gFAAgF;AAChF,SAAgB,iBAAiB,CAAC,KAAoB;IACpD,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;IAC5B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;IACrB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;;QACzC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;IAChC,yEAAyE;IACzE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;AAC9F,CAAC"}

package/lib/dist/reasoning/login.d.ts

@@ -0,0 +1,21 @@
+/** Dashboard base for the device-login endpoints; override for testing via CODEGRAPH_LOGIN_URL. */
+export declare function loginBaseUrl(): string;
+/** The dashboard's response to a device-authorization start request. */
+export interface DeviceStart {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    /** Same URL with the code prefilled, for one-click open. */
+    verification_uri_complete?: string;
+    /** Seconds the CLI should wait between polls. */
+    interval?: number;
+    /** Seconds until the request expires. */
+    expires_in?: number;
+}
+/** Begin a device-authorization request. */
+export declare function startDeviceLogin(): Promise<DeviceStart>;
+/** Poll until the user approves in the browser; resolves with the org token. */
+export declare function pollForToken(deviceCode: string, intervalSec: number, expiresInSec: number): Promise<string>;
+/** Best-effort: open a URL in the default browser. Never throws — the URL is also printed. */
+export declare function openBrowser(url: string): Promise<void>;
+//# sourceMappingURL=login.d.ts.map

package/lib/dist/reasoning/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/reasoning/login.ts"],"names":[],"mappings":"AAeA,mGAAmG;AACnG,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4CAA4C;AAC5C,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC,CAY7D;AAED,gFAAgF;AAChF,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBjH;AAED,8FAA8F;AAC9F,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY5D"}