githits 0.1.11 → 0.2.1

package/dist/shared/chunk-ykr7x8jp.js

@@ -0,0 +1,4436 @@
+import {
+  version
+} from "./chunk-szjytcvw.js";
+
+// src/services/auth-service.ts
+import { createServer } from "node:http";
+
+// src/auth/pkce.ts
+import { createHash, randomBytes } from "node:crypto";
+function generateCodeVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+function generateCodeChallenge(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+function generateState() {
+  return randomBytes(32).toString("hex");
+}
+
+// src/services/auth-service.ts
+class AuthServiceImpl {
+  async discoverEndpoints(mcpBaseUrl) {
+    const url = `${mcpBaseUrl}/.well-known/oauth-authorization-server`;
+    const response = await fetch(url);
+    if (!response.ok) {
+      throw new Error(`Failed to discover OAuth endpoints: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    const authorizationEndpoint = data.authorization_endpoint;
+    const tokenEndpoint = data.token_endpoint;
+    const registrationEndpoint = data.registration_endpoint;
+    if (!authorizationEndpoint || !tokenEndpoint || !registrationEndpoint) {
+      throw new Error("OAuth metadata missing required endpoints");
+    }
+    return {
+      authorizationEndpoint,
+      tokenEndpoint,
+      registrationEndpoint
+    };
+  }
+  async registerClient(params) {
+    const response = await fetch(params.registrationEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        client_name: "GitHits CLI",
+        redirect_uris: [params.redirectUri],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "client_secret_post"
+      })
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Client registration failed: ${error}`);
+    }
+    const data = await response.json();
+    if (!data.client_id || !data.client_secret) {
+      throw new Error("Client registration response missing required fields");
+    }
+    return {
+      clientId: data.client_id,
+      clientSecret: data.client_secret
+    };
+  }
+  generatePkceParams() {
+    const verifier = generateCodeVerifier();
+    return {
+      verifier,
+      challenge: generateCodeChallenge(verifier),
+      state: generateState()
+    };
+  }
+  buildAuthUrl(params) {
+    const url = new URL(params.authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", params.clientId);
+    url.searchParams.set("redirect_uri", params.redirectUri);
+    url.searchParams.set("state", params.state);
+    url.searchParams.set("code_challenge", params.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    return url.toString();
+  }
+  startCallbackServer(port, expectedState) {
+    return new Promise((resolve, reject) => {
+      let callbackHandled = false;
+      let resolved = false;
+      let closeTimer;
+      const server = createServer((req, res) => {
+        const url = new URL(req.url ?? "", `http://127.0.0.1:${port}`);
+        if (url.pathname === "/favicon.ico") {
+          res.writeHead(204);
+          res.end();
+          return;
+        }
+        if (url.pathname !== "/callback") {
+          if (callbackHandled) {
+            sendHtmlResponse(res, 200, successHtml("Authentication already completed."));
+            return;
+          }
+          sendHtmlResponse(res, 404, errorHtml("Invalid callback path.", "Run `githits login` to start authentication."));
+          return;
+        }
+        const code = url.searchParams.get("code");
+        const state = url.searchParams.get("state");
+        const error = url.searchParams.get("error");
+        const errorDescription = url.searchParams.get("error_description");
+        const evaluation = evaluateCallback({
+          code,
+          state,
+          error,
+          errorDescription,
+          expectedState
+        });
+        callbackHandled = true;
+        sendHtmlResponse(res, evaluation.statusCode, evaluation.html);
+        if (!resolved) {
+          resolved = true;
+          resolve(evaluation.result);
+        }
+        if (closeTimer)
+          clearTimeout(closeTimer);
+        closeTimer = setTimeout(() => closeServer(server), 1500);
+      });
+      server.listen(port, "127.0.0.1");
+      server.on("error", (err) => {
+        reject(new Error(`Failed to start callback server: ${err.message}`));
+      });
+    });
+  }
+  async exchangeCodeForTokens(params) {
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: params.clientId,
+      client_secret: params.clientSecret,
+      code: params.code,
+      code_verifier: params.codeVerifier,
+      redirect_uri: params.redirectUri
+    });
+    const response = await fetch(params.tokenEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token exchange failed: ${error}`);
+    }
+    return parseTokenResponse(await response.json());
+  }
+  async refreshAccessToken(params) {
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: params.clientId,
+      client_secret: params.clientSecret,
+      refresh_token: params.refreshToken
+    });
+    const response = await fetch(params.tokenEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token refresh failed: ${error}`);
+    }
+    return parseTokenResponse(await response.json());
+  }
+}
+function parseTokenResponse(data) {
+  const d = data;
+  if (!d.access_token || !d.refresh_token) {
+    throw new Error("Token response missing required fields");
+  }
+  return {
+    accessToken: d.access_token,
+    refreshToken: d.refresh_token,
+    expiresIn: d.expires_in || 3600
+  };
+}
+function successHtml(title = "Authentication successful") {
+  return `<!DOCTYPE html>
+<html><head><title>GitHits CLI</title>
+<style>
+  body {
+    font-family: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    height: 100vh;
+    margin: 0;
+    background: radial-gradient(circle at center center, #4d3648, #3a2835, #261a22, #0d1117);
+  }
+  .card {
+    text-align: center;
+    background: rgba(13, 17, 23, 0.75);
+    padding: 3rem;
+    border-radius: 16px;
+    border: 1px solid rgba(244, 11, 166, 0.35);
+    box-shadow: 0 8px 32px rgba(0, 0, 0, 0.35);
+    max-width: 720px;
+  }
+  h1 {
+    color: #f40ba6;
+    margin-bottom: 0.75rem;
+    font-size: 3rem;
+    font-weight: 700;
+  }
+  p {
+    color: #f385a5;
+    font-size: 1.1rem;
+    margin: 0;
+  }
+</style>
+</head>
+<body>
+  <div class="card">
+    <h1>${escapeHtml(title)}</h1>
+    <p>You can close this window and return to the terminal.</p>
+  </div>
+</body></html>`;
+}
+function evaluateCallback(input) {
+  if (input.error) {
+    const message = input.errorDescription ? `${input.error}: ${input.errorDescription}` : input.error;
+    return {
+      statusCode: 200,
+      html: errorHtml(message, "Run `githits login` to try again."),
+      result: { type: "oauth_error", message }
+    };
+  }
+  if (input.code && input.state) {
+    if (input.state !== input.expectedState) {
+      return {
+        statusCode: 400,
+        html: errorHtml("Authentication failed security validation (state mismatch)", "Run `githits login` to try again."),
+        result: {
+          type: "state_mismatch",
+          message: "Security validation failed (state mismatch)"
+        }
+      };
+    }
+    return {
+      statusCode: 200,
+      html: successHtml(),
+      result: { type: "success", code: input.code, state: input.state }
+    };
+  }
+  return {
+    statusCode: 400,
+    html: errorHtml("Authentication callback was missing required parameters", "Run `githits login` to try again."),
+    result: {
+      type: "invalid_callback",
+      message: "Authentication callback missing required parameters"
+    }
+  };
+}
+function errorHtml(error, nextStep) {
+  const nextStepHtml = nextStep ? `<p>${escapeHtml(nextStep)}</p>` : "";
+  return `<!DOCTYPE html>
+<html><head><title>GitHits CLI</title>
+<style>
+  body {
+    font-family: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    height: 100vh;
+    margin: 0;
+    background: radial-gradient(circle at center center, #4d3648, #3a2835, #261a22, #0d1117);
+  }
+  .card {
+    text-align: center;
+    background: rgba(13, 17, 23, 0.75);
+    padding: 3rem;
+    border-radius: 16px;
+    border: 1px solid rgba(239, 68, 68, 0.35);
+    box-shadow: 0 8px 32px rgba(0, 0, 0, 0.35);
+    max-width: 720px;
+  }
+  h1 {
+    color: #ef4444;
+    margin-bottom: 0.75rem;
+    font-size: 3rem;
+    font-weight: 700;
+  }
+  p {
+    color: #f385a5;
+    font-size: 1.1rem;
+    margin: 0;
+  }
+</style>
+</head>
+<body>
+  <div class="card">
+    <h1>Authentication failed</h1>
+    <p>${escapeHtml(error)}</p>
+    ${nextStepHtml}
+  </div>
+</body></html>`;
+}
+function sendHtmlResponse(res, statusCode, html) {
+  res.writeHead(statusCode, { "Content-Type": "text/html; charset=utf-8" });
+  res.end(html);
+}
+function closeServer(server) {
+  server.close();
+}
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+// src/services/auth-storage.ts
+var CONFIG_DIR = ".githits";
+var AUTH_FILE = "auth.json";
+var CLIENT_FILE = "client.json";
+var DIR_MODE = 448;
+var FILE_MODE = 384;
+
+class AuthStorageImpl {
+  fs;
+  configDir;
+  authPath;
+  clientPath;
+  constructor(fs, configDir) {
+    this.fs = fs;
+    this.configDir = configDir ?? fs.joinPath(fs.getHomeDir(), CONFIG_DIR);
+    this.authPath = fs.joinPath(this.configDir, AUTH_FILE);
+    this.clientPath = fs.joinPath(this.configDir, CLIENT_FILE);
+  }
+  getStorageLocation() {
+    return this.configDir;
+  }
+  async loadTokens(baseUrl) {
+    const stored = await this.loadAuthFile();
+    if (!stored)
+      return null;
+    return stored.tokens[normalizeBaseUrl(baseUrl)] ?? null;
+  }
+  async saveTokens(baseUrl, data) {
+    const stored = await this.loadAuthFile() ?? {
+      version: 1,
+      tokens: {}
+    };
+    stored.tokens[normalizeBaseUrl(baseUrl)] = data;
+    await this.fs.ensureDir(this.configDir, DIR_MODE);
+    await this.fs.writeFile(this.authPath, JSON.stringify(stored, null, 2), FILE_MODE);
+  }
+  async clearTokens(baseUrl) {
+    const stored = await this.loadAuthFile();
+    if (!stored)
+      return;
+    delete stored.tokens[normalizeBaseUrl(baseUrl)];
+    if (Object.keys(stored.tokens).length === 0) {
+      await this.fs.deleteFile(this.authPath);
+    } else {
+      await this.fs.writeFile(this.authPath, JSON.stringify(stored, null, 2), FILE_MODE);
+    }
+  }
+  async loadClient(baseUrl) {
+    const stored = await this.loadClientFile();
+    if (!stored)
+      return null;
+    return stored.clients[normalizeBaseUrl(baseUrl)] ?? null;
+  }
+  async clearClient(baseUrl) {
+    const stored = await this.loadClientFile();
+    if (!stored)
+      return;
+    delete stored.clients[normalizeBaseUrl(baseUrl)];
+    if (Object.keys(stored.clients).length === 0) {
+      await this.fs.deleteFile(this.clientPath);
+    } else {
+      await this.fs.writeFile(this.clientPath, JSON.stringify(stored, null, 2), FILE_MODE);
+    }
+  }
+  async saveClient(baseUrl, data) {
+    const stored = await this.loadClientFile() ?? {
+      version: 1,
+      clients: {}
+    };
+    stored.clients[normalizeBaseUrl(baseUrl)] = data;
+    await this.fs.ensureDir(this.configDir, DIR_MODE);
+    await this.fs.writeFile(this.clientPath, JSON.stringify(stored, null, 2), FILE_MODE);
+  }
+  async loadAuthFile() {
+    if (!await this.fs.exists(this.authPath))
+      return null;
+    try {
+      const content = await this.fs.readFile(this.authPath);
+      const data = JSON.parse(content);
+      if (data.version !== 1 || !data.tokens)
+        return null;
+      return data;
+    } catch {
+      return null;
+    }
+  }
+  async loadClientFile() {
+    if (!await this.fs.exists(this.clientPath))
+      return null;
+    try {
+      const content = await this.fs.readFile(this.clientPath);
+      const data = JSON.parse(content);
+      if (data.version !== 1 || !data.clients)
+        return null;
+      return data;
+    } catch {
+      return null;
+    }
+  }
+}
+function normalizeBaseUrl(url) {
+  return url.replace(/\/+$/, "");
+}
+// src/services/browser-service.ts
+import open from "open";
+
+class BrowserServiceImpl {
+  async open(url) {
+    await open(url);
+  }
+}
+// src/services/chunking-keyring-service.ts
+var WINDOWS_MAX_ENTRY_SIZE = 1200;
+var CHUNKED_PREFIX = "CHUNKED:";
+var MAX_CHUNK_COUNT = 100;
+function chunkKey(account, writeId, index) {
+  return `${account}:chunk:${writeId}:${index}`;
+}
+function parseChunkedSentinel(value) {
+  if (!value.startsWith(CHUNKED_PREFIX))
+    return null;
+  const rest = value.slice(CHUNKED_PREFIX.length);
+  const colonIndex = rest.indexOf(":");
+  if (colonIndex === -1)
+    return null;
+  const writeId = rest.slice(0, colonIndex);
+  if (writeId.length === 0)
+    return null;
+  const countStr = rest.slice(colonIndex + 1);
+  const count = Number(countStr);
+  if (!Number.isInteger(count) || count <= 0)
+    return null;
+  return { writeId, count };
+}
+function splitIntoChunks(value, maxSize) {
+  if (value.length === 0)
+    return [""];
+  const chunks = [];
+  for (let offset = 0;offset < value.length; offset += maxSize) {
+    chunks.push(value.slice(offset, offset + maxSize));
+  }
+  return chunks;
+}
+function generateWriteId() {
+  let id;
+  do {
+    id = Math.random().toString(36).slice(2, 8);
+  } while (id.length < 6);
+  return id;
+}
+
+class ChunkingKeyringService {
+  inner;
+  maxEntrySize;
+  constructor(inner, maxEntrySize = WINDOWS_MAX_ENTRY_SIZE) {
+    this.inner = inner;
+    this.maxEntrySize = maxEntrySize;
+  }
+  getPassword(service, account) {
+    const value = this.inner.getPassword(service, account);
+    if (value === null)
+      return null;
+    if (!value.startsWith(CHUNKED_PREFIX))
+      return value;
+    const sentinel = parseChunkedSentinel(value);
+    if (sentinel === null)
+      return null;
+    const chunks = [];
+    for (let i = 0;i < sentinel.count; i++) {
+      const chunk = this.inner.getPassword(service, chunkKey(account, sentinel.writeId, i));
+      if (chunk === null) {
+        console.error(`Warning: Incomplete chunked keychain entry for "${account}" (missing chunk ${i} of ${sentinel.count}). Treating as missing.`);
+        return null;
+      }
+      chunks.push(chunk);
+    }
+    return chunks.join("");
+  }
+  setPassword(service, account, password) {
+    const oldValue = this.readOldSentinel(service, account);
+    if (password.length <= this.maxEntrySize) {
+      this.inner.setPassword(service, account, password);
+    } else {
+      const chunks = splitIntoChunks(password, this.maxEntrySize);
+      if (chunks.length > MAX_CHUNK_COUNT) {
+        throw new Error(`Value requires ${chunks.length} chunks, exceeding maximum of ${MAX_CHUNK_COUNT}. ` + `This likely indicates a bug — credential data should not be this large.`);
+      }
+      const writeId = generateWriteId();
+      for (const [i, chunk] of chunks.entries()) {
+        this.inner.setPassword(service, chunkKey(account, writeId, i), chunk);
+      }
+      this.inner.setPassword(service, account, `${CHUNKED_PREFIX}${writeId}:${chunks.length}`);
+    }
+    if (oldValue !== null) {
+      this.deleteChunkEntries(service, account, oldValue);
+    }
+  }
+  deletePassword(service, account) {
+    const oldValue = this.readOldSentinel(service, account);
+    if (oldValue !== null) {
+      this.deleteChunkEntries(service, account, oldValue);
+    }
+    return this.inner.deletePassword(service, account);
+  }
+  readOldSentinel(service, account) {
+    try {
+      const value = this.inner.getPassword(service, account);
+      if (value === null)
+        return null;
+      return parseChunkedSentinel(value);
+    } catch {
+      return null;
+    }
+  }
+  deleteChunkEntries(service, account, sentinel) {
+    for (let i = 0;i < sentinel.count; i++) {
+      try {
+        this.inner.deletePassword(service, chunkKey(account, sentinel.writeId, i));
+      } catch {}
+    }
+  }
+}
+// src/services/code-navigation-capability.ts
+function getCodeNavigationCapability(token) {
+  if (!token)
+    return "unknown";
+  const payload = parseJwtPayload(token);
+  if (!payload)
+    return "unknown";
+  const featureFlags = extractFeatureFlags(payload);
+  if (!featureFlags)
+    return "unknown";
+  return featureFlags.includes("code_navigation") ? "enabled" : "disabled";
+}
+function extractFeatureFlags(payload) {
+  if (isStringArray(payload.feature_flags)) {
+    return payload.feature_flags;
+  }
+  if (payload.claims && isStringArray(payload.claims.feature_flags)) {
+    return payload.claims.feature_flags;
+  }
+  return null;
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function parseJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length < 2)
+    return null;
+  try {
+    const decoded = Buffer.from(toBase64(parts[1] ?? ""), "base64").toString("utf8");
+    const parsed = JSON.parse(decoded);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function toBase64(base64Url) {
+  const normalized = base64Url.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = normalized.length % 4;
+  if (padding === 0)
+    return normalized;
+  return normalized.padEnd(normalized.length + (4 - padding), "=");
+}
+// src/services/code-navigation-service.ts
+import { z } from "zod";
+
+// src/shared/debug-log.ts
+function debugLog(area, payload) {
+  if (!isAreaEnabled(area))
+    return;
+  const line = {
+    ts: new Date().toISOString(),
+    area,
+    ...payload
+  };
+  let text;
+  try {
+    text = JSON.stringify(line);
+  } catch {
+    text = JSON.stringify({
+      ts: line.ts,
+      area,
+      error: "debug-log payload not serialisable"
+    });
+  }
+  process.stderr.write(`${text}
+`);
+}
+function isDebugAreaEnabled(area) {
+  return isAreaEnabled(area);
+}
+function isAreaEnabled(area) {
+  const raw = process.env.GITHITS_DEBUG;
+  if (!raw || raw === "")
+    return false;
+  const scopes = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  if (scopes.includes(area))
+    return true;
+  if (isExplicitOnlyArea(area))
+    return false;
+  return scopes.includes("*");
+}
+function isExplicitOnlyArea(area) {
+  return area === "code-nav-wire";
+}
+
+// src/shared/request-headers.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+var MAX_HEADER_BYTES = 256;
+var SESSION_ENV_VARS = [
+  "TERM_SESSION_ID",
+  "ITERM_SESSION_ID",
+  "WEZTERM_PANE",
+  "KITTY_PID",
+  "ALACRITTY_SOCKET",
+  "WT_SESSION",
+  "VSCODE_PID",
+  "SUPERSET_PANE_ID",
+  "SUPERSET_WORKSPACE_ID",
+  "STARSHIP_SESSION_KEY",
+  "SSH_CONNECTION"
+];
+var cachedSessionId;
+function resolveRawSessionId(env = process.env, ppid = process.ppid) {
+  for (const key of SESSION_ENV_VARS) {
+    const value = env[key];
+    if (value && value.trim().length > 0) {
+      return value.trim();
+    }
+  }
+  if (typeof ppid === "number" && !Number.isNaN(ppid) && ppid > 0) {
+    return String(ppid);
+  }
+  return randomUUID();
+}
+function getSessionId(env, ppid) {
+  if (cachedSessionId !== undefined && env === undefined && ppid === undefined) {
+    return cachedSessionId;
+  }
+  const raw = resolveRawSessionId(env, ppid);
+  const hashed = hashValue(raw);
+  if (env === undefined && ppid === undefined) {
+    cachedSessionId = hashed;
+  }
+  return hashed;
+}
+function hashValue(input) {
+  return createHash2("sha256").update(input).digest("hex").slice(0, 16);
+}
+var AGENT_PROBES = [
+  { envVar: "OPENCODE", name: "opencode" },
+  { envVar: "CLAUDECODE", name: "claude-code" },
+  { envVar: "CURSOR_TRACE_ID", name: "cursor" },
+  { envVar: "WINDSURF_CONFIG_DIR", name: "windsurf" },
+  { envVar: "ZED_TERM", name: "zed" },
+  { envVar: "VSCODE_PID", name: "vscode" }
+];
+function parseAgentString(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length === 0)
+    return;
+  const slashIndex = trimmed.indexOf("/");
+  if (slashIndex === -1)
+    return { name: trimmed };
+  const name = trimmed.slice(0, slashIndex);
+  const ver = trimmed.slice(slashIndex + 1);
+  if (name.length === 0)
+    return;
+  return { name, version: ver || undefined };
+}
+function formatAgentInfo(info) {
+  return info.version ? `${info.name}/${info.version}` : info.name;
+}
+function resolveAgentInfo(env = process.env) {
+  const explicit = env.GITHITS_AGENT;
+  if (explicit && explicit.trim().length > 0) {
+    return parseAgentString(explicit);
+  }
+  for (const probe of AGENT_PROBES) {
+    const value = env[probe.envVar];
+    if (value && value.trim().length > 0) {
+      return { name: probe.name };
+    }
+  }
+  return;
+}
+var currentAgentInfo;
+var agentInfoInitialized = false;
+var agentInfoExplicitlySet = false;
+var mcpClientVersionProvider;
+function setMcpClientVersionProvider(provider) {
+  mcpClientVersionProvider = provider;
+}
+function getAgentInfo(env) {
+  if (agentInfoExplicitlySet) {
+    return currentAgentInfo;
+  }
+  if (mcpClientVersionProvider) {
+    try {
+      const fromProvider = mcpClientVersionProvider();
+      if (fromProvider && fromProvider.name.trim().length > 0) {
+        return fromProvider;
+      }
+    } catch {}
+  }
+  if (!agentInfoInitialized || env !== undefined) {
+    currentAgentInfo = resolveAgentInfo(env);
+    if (env === undefined) {
+      agentInfoInitialized = true;
+    }
+  }
+  return currentAgentInfo;
+}
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function sanitizeHeaderValue(value) {
+  if (value === undefined || value === null || typeof value !== "string") {
+    return;
+  }
+  const cleaned = value.replace(CONTROL_CHARS, "").trim();
+  if (cleaned.length === 0)
+    return;
+  if (Buffer.byteLength(cleaned, "utf8") > MAX_HEADER_BYTES)
+    return;
+  return cleaned;
+}
+var BASE_CLIENT_NAME = "githits-cli";
+var clientName = BASE_CLIENT_NAME;
+function setClientMode(mode) {
+  clientName = `${BASE_CLIENT_NAME}/${mode}`;
+}
+function buildClientHeaders(env, ppid) {
+  try {
+    const headers = {};
+    const name = sanitizeHeaderValue(clientName);
+    if (name) {
+      headers["x-githits-client-name"] = name;
+    }
+    const clientVersion = sanitizeHeaderValue(version);
+    if (clientVersion) {
+      headers["x-githits-client-version"] = clientVersion;
+    }
+    const agentInfo = getAgentInfo(env);
+    if (agentInfo) {
+      const agentValue = sanitizeHeaderValue(formatAgentInfo(agentInfo));
+      if (agentValue) {
+        headers["x-githits-agent"] = agentValue;
+      }
+    }
+    const sessionId = sanitizeHeaderValue(getSessionId(env, ppid));
+    if (sessionId) {
+      headers["x-githits-session-id"] = sessionId;
+    }
+    return headers;
+  } catch {
+    return {};
+  }
+}
+
+// src/shared/pkgseer-graphql.ts
+class PkgseerTransportError extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "PkgseerTransportError";
+  }
+}
+function baseUrl(endpointUrl) {
+  return endpointUrl.replace(/\/+$/, "");
+}
+async function postPkgseerGraphql(request) {
+  const fetchFn = request.fetchFn ?? globalThis.fetch;
+  const userAgent = request.userAgent ?? `githits-cli/${version}`;
+  let response;
+  try {
+    response = await fetchFn(`${baseUrl(request.endpointUrl)}/api/graphql`, {
+      method: "POST",
+      headers: {
+        ...buildClientHeaders(),
+        Authorization: `Bearer ${request.token}`,
+        "Content-Type": "application/json",
+        "User-Agent": userAgent
+      },
+      body: JSON.stringify({
+        query: request.query,
+        variables: request.variables
+      })
+    });
+  } catch (cause) {
+    debugLog("pkg-graphql", {
+      event: "transport-error",
+      errorName: cause instanceof Error ? cause.name : typeof cause,
+      hasCause: true
+    });
+    throw new PkgseerTransportError("Network request failed before a response was received. Caller should re-wrap with a domain-specific message.", { cause });
+  }
+  const responseBody = await response.text().catch(() => "");
+  const parsedBody = parseJsonOrNull(responseBody);
+  return {
+    status: response.status,
+    responseBody,
+    parsedBody
+  };
+}
+function parseJsonOrNull(body) {
+  if (!body)
+    return null;
+  try {
+    return JSON.parse(body);
+  } catch {
+    return null;
+  }
+}
+
+// src/shared/telemetry.ts
+import { writeSync } from "node:fs";
+var ENABLED_VALUES = new Set(["1", "true", "yes", "on"]);
+function isTelemetryEnabled(env = process.env) {
+  const raw = env.GITHITS_TELEMETRY?.trim().toLowerCase();
+  if (!raw)
+    return false;
+  return ENABLED_VALUES.has(raw);
+}
+
+class TelemetryCollector {
+  enabled;
+  now;
+  write;
+  sessionStartMs;
+  spans = [];
+  activeSpans = new Map;
+  nextId = 1;
+  flushed = false;
+  constructor(options = {}) {
+    this.enabled = isTelemetryEnabled(options.env);
+    this.now = options.now ?? (() => globalThis.performance.now());
+    this.write = options.write ?? ((text) => writeSync(process.stderr.fd, text));
+    this.sessionStartMs = this.now();
+  }
+  isEnabled() {
+    return this.enabled;
+  }
+  startSpan(name, attributes) {
+    if (!this.enabled)
+      return;
+    const span = {
+      id: this.nextId++,
+      name,
+      startMs: this.now(),
+      attributes: sanitiseAttributes(attributes)
+    };
+    this.spans.push(span);
+    this.activeSpans.set(span.id, span);
+    return { id: span.id };
+  }
+  endSpan(handle, attributes) {
+    if (!this.enabled || !handle)
+      return;
+    const span = this.activeSpans.get(handle.id);
+    if (!span || span.endMs !== undefined)
+      return;
+    span.endMs = this.now();
+    span.attributes = mergeAttributes(span.attributes, attributes);
+    this.activeSpans.delete(handle.id);
+  }
+  flush(exitCode = 0) {
+    if (!this.enabled || this.flushed)
+      return;
+    const nowMs = this.now();
+    for (const span of this.activeSpans.values()) {
+      if (span.endMs !== undefined)
+        continue;
+      span.endMs = nowMs;
+      span.endedAtExit = true;
+    }
+    this.activeSpans.clear();
+    this.write(formatTelemetryReport(this.spans, this.sessionStartMs, nowMs, exitCode));
+    this.flushed = true;
+  }
+}
+async function withTelemetrySpan(name, operation, attributes) {
+  const handle = telemetryCollector.startSpan(name, attributes);
+  try {
+    const result = await operation();
+    telemetryCollector.endSpan(handle);
+    return result;
+  } catch (error) {
+    telemetryCollector.endSpan(handle, { error: true });
+    throw error;
+  }
+}
+function withTelemetrySpanSync(name, operation, attributes) {
+  const handle = telemetryCollector.startSpan(name, attributes);
+  try {
+    const result = operation();
+    telemetryCollector.endSpan(handle);
+    return result;
+  } catch (error) {
+    telemetryCollector.endSpan(handle, { error: true });
+    throw error;
+  }
+}
+function startTelemetrySpan(name, attributes) {
+  return telemetryCollector.startSpan(name, attributes);
+}
+function endTelemetrySpan(handle, attributes) {
+  telemetryCollector.endSpan(handle, attributes);
+}
+function flushTelemetry(exitCode = 0) {
+  telemetryCollector.flush(exitCode);
+}
+var telemetryCollector = new TelemetryCollector;
+function sanitiseAttributes(attributes) {
+  if (!attributes)
+    return;
+  const entries = Object.entries(attributes).filter(([, value]) => value !== undefined);
+  if (entries.length === 0)
+    return;
+  return Object.fromEntries(entries);
+}
+function mergeAttributes(initial, extra) {
+  if (!initial && !extra)
+    return;
+  return sanitiseAttributes({
+    ...initial ?? {},
+    ...extra ?? {}
+  });
+}
+function formatTelemetryReport(spans, sessionStartMs, sessionEndMs, exitCode) {
+  const lines = [
+    "[githits telemetry]",
+    `exit: ${exitCode}`,
+    `total: ${formatMs(sessionEndMs - sessionStartMs)}`
+  ];
+  const orderedSpans = [...spans].sort((left, right) => {
+    if (left.startMs !== right.startMs) {
+      return left.startMs - right.startMs;
+    }
+    return left.id - right.id;
+  });
+  for (const span of orderedSpans) {
+    const endMs = span.endMs ?? sessionEndMs;
+    const details = [`start +${formatMs(span.startMs - sessionStartMs)}`];
+    if (span.endedAtExit) {
+      details.push("ended-at-exit");
+    }
+    const attrs = formatAttributes(span.attributes);
+    if (attrs) {
+      details.push(attrs);
+    }
+    lines.push(`- ${span.name}: ${formatMs(endMs - span.startMs)} (${details.join(", ")})`);
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function formatAttributes(attributes) {
+  if (!attributes)
+    return "";
+  return Object.entries(attributes).map(([key, value]) => `${key}=${String(value)}`).join(" ");
+}
+function formatMs(value) {
+  return `${value.toFixed(1)}ms`;
+}
+
+// src/services/githits-service.ts
+class AuthenticationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthenticationError";
+  }
+}
+function parseDetail(body) {
+  if (!body)
+    return;
+  try {
+    const parsed = JSON.parse(body);
+    if (typeof parsed.detail === "string")
+      return parsed.detail;
+  } catch {
+    return body;
+  }
+  return;
+}
+
+class GitHitsServiceImpl {
+  apiUrl;
+  token;
+  constructor(apiUrl, token) {
+    this.apiUrl = apiUrl;
+    this.token = token;
+  }
+  async search(params) {
+    return withTelemetrySpan("githits.search.request", async () => {
+      const response = await fetch(`${this.apiUrl}/search`, {
+        method: "POST",
+        headers: this.headers(),
+        body: JSON.stringify({
+          query: params.query,
+          language: params.language,
+          license_mode: params.licenseMode ?? "strict",
+          include_explanation: params.includeExplanation ?? false
+        })
+      });
+      if (!response.ok) {
+        throw await this.createError(response);
+      }
+      return response.text();
+    });
+  }
+  async getLanguages() {
+    return withTelemetrySpan("githits.languages.request", async () => {
+      const response = await fetch(`${this.apiUrl}/languages`, {
+        headers: this.headers()
+      });
+      if (!response.ok) {
+        throw await this.createError(response);
+      }
+      return response.json();
+    });
+  }
+  async submitFeedback(params) {
+    return withTelemetrySpan("githits.feedback.request", async () => {
+      const response = await fetch(`${this.apiUrl}/feedbacks`, {
+        method: "POST",
+        headers: this.headers(),
+        body: JSON.stringify({
+          solution_id: params.solutionId,
+          accepted: params.accepted,
+          feedback_text: params.feedbackText ?? null
+        })
+      });
+      if (!response.ok) {
+        throw await this.createError(response);
+      }
+      return { success: true, message: "Feedback submitted successfully" };
+    });
+  }
+  headers() {
+    return {
+      ...buildClientHeaders(),
+      Authorization: `Bearer ${this.token}`,
+      "Content-Type": "application/json",
+      "User-Agent": `githits-cli/${version}`
+    };
+  }
+  async createError(response) {
+    const status = response.status;
+    const body = await response.text().catch(() => "");
+    switch (status) {
+      case 401:
+        return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+      case 403:
+        return new Error("Access denied.");
+      case 404:
+        return new Error(parseDetail(body) || "Resource not found.");
+      default: {
+        if (status >= 500) {
+          const detail = body ? `: ${body}` : "";
+          return new Error(`Server error (${status})${detail}`);
+        }
+        return new Error(body || `Request failed with status ${status}`);
+      }
+    }
+  }
+}
+
+// src/services/execute-with-token-refresh.ts
+async function executeWithTokenRefresh(options) {
+  const token = await options.getToken();
+  if (!token) {
+    throw new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+  }
+  try {
+    return await options.executeWithToken(token);
+  } catch (error) {
+    if (!options.shouldRefresh(error)) {
+      throw error;
+    }
+    const refreshedToken = await options.forceRefresh();
+    if (!refreshedToken) {
+      throw error;
+    }
+    return options.executeWithToken(refreshedToken);
+  }
+}
+
+// src/services/code-navigation-service.ts
+class CodeNavigationAccessError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeNavigationAccessError";
+  }
+}
+
+class CodeNavigationGraphQLError extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "CodeNavigationGraphQLError";
+  }
+}
+
+class CodeNavigationIndexingError extends Error {
+  indexingRef;
+  availableVersions;
+  constructor(message, indexingRef, availableVersions) {
+    super(message);
+    this.indexingRef = indexingRef;
+    this.availableVersions = availableVersions;
+    this.name = "CodeNavigationIndexingError";
+  }
+}
+
+class CodeNavigationUnresolvableError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeNavigationUnresolvableError";
+  }
+}
+
+class MalformedCodeNavigationResponseError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MalformedCodeNavigationResponseError";
+  }
+}
+
+class CodeNavigationTargetNotFoundError extends Error {
+  availableVersions;
+  constructor(message, availableVersions) {
+    super(message);
+    this.availableVersions = availableVersions;
+    this.name = "CodeNavigationTargetNotFoundError";
+  }
+}
+
+class CodeNavigationFileNotFoundError extends Error {
+  filePath;
+  constructor(message, filePath) {
+    super(message);
+    this.filePath = filePath;
+    this.name = "CodeNavigationFileNotFoundError";
+  }
+}
+
+class CodeNavigationVersionNotFoundError extends Error {
+  packageName;
+  requestedVersion;
+  latestIndexed;
+  availableVersions;
+  constructor(message, packageName, requestedVersion, latestIndexed, availableVersions) {
+    super(message);
+    this.packageName = packageName;
+    this.requestedVersion = requestedVersion;
+    this.latestIndexed = latestIndexed;
+    this.availableVersions = availableVersions;
+    this.name = "CodeNavigationVersionNotFoundError";
+  }
+}
+
+class CodeNavigationValidationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeNavigationValidationError";
+  }
+}
+
+class CodeNavigationFeatureFlagRequiredError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeNavigationFeatureFlagRequiredError";
+  }
+}
+
+class CodeNavigationNetworkError extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "CodeNavigationNetworkError";
+  }
+}
+
+class CodeNavigationBackendError extends Error {
+  status;
+  graphqlCode;
+  retryable;
+  constructor(message, status, graphqlCode, retryable) {
+    super(message);
+    this.status = status;
+    this.graphqlCode = graphqlCode;
+    this.retryable = retryable;
+    this.name = "CodeNavigationBackendError";
+  }
+}
+var UNIFIED_SEARCH_QUERY = `
+query UnifiedSearch(
+  $targets: [SearchPackageInput!]!
+  $query: String!
+  $sources: [DiscoverySearchSource!]
+  $filters: DiscoverySearchFiltersInput
+  $allowPartialResults: Boolean
+  $limit: Int
+  $offset: Int
+  $waitTimeoutMs: Int
+) {
+  search(
+    targets: $targets
+    query: $query
+    sources: $sources
+    filters: $filters
+    allowPartialResults: $allowPartialResults
+    limit: $limit
+    offset: $offset
+    waitTimeoutMs: $waitTimeoutMs
+  ) {
+    completed
+    searchRef
+    result {
+      query
+      queryWarnings
+      sources
+      results {
+        id
+        resultType
+        targetLabel
+        title
+        summary
+        score
+        highlights {
+          title
+          summary
+        }
+        locator {
+          registry
+          packageName
+          version
+          pageId
+          sourceKind
+          sourceUrl
+          repoUrl
+          gitRef
+          requestedRef
+          filePath
+          startLine
+          endLine
+          fileContentHash
+          symbolRef
+          qualifiedPath
+          kind
+          category
+          language
+        }
+      }
+      page {
+        offset
+        limit
+        returned
+        hasMore
+      }
+      partialResults
+      sourceStatus {
+        source
+        targetLabel
+        indexingStatus
+        codeIndexState
+        resultCount
+        appliedFilters
+        ignoredFilters
+        incompatibleFilters
+        appliedQueryFeatures
+        ignoredQueryFeatures
+        incompatibleQueryFeatures
+        note
+      }
+    }
+    progress {
+      searchRef
+      status
+      targetsTotal
+      targetsReady
+      elapsedMs
+      query
+      queryWarnings
+      sources
+      expiresAt
+    }
+  }
+}`;
+var UNIFIED_SEARCH_STATUS_QUERY = `
+query UnifiedSearchStatus($searchRef: String!, $includeResults: Boolean!) {
+  discoverySearchProgress(searchRef: $searchRef, includeResults: $includeResults) {
+    searchRef
+    status
+    targetsTotal
+    targetsReady
+    elapsedMs
+    query
+    queryWarnings
+    sources
+    expiresAt
+    results {
+      query
+      queryWarnings
+      sources
+      results {
+        id
+        resultType
+        targetLabel
+        title
+        summary
+        score
+        highlights {
+          title
+          summary
+        }
+        locator {
+          registry
+          packageName
+          version
+          pageId
+          sourceKind
+          sourceUrl
+          repoUrl
+          gitRef
+          requestedRef
+          filePath
+          startLine
+          endLine
+          fileContentHash
+          symbolRef
+          qualifiedPath
+          kind
+          category
+          language
+        }
+      }
+      page {
+        offset
+        limit
+        returned
+        hasMore
+      }
+      partialResults
+      sourceStatus {
+        source
+        targetLabel
+        indexingStatus
+        codeIndexState
+        resultCount
+        appliedFilters
+        ignoredFilters
+        incompatibleFilters
+        appliedQueryFeatures
+        ignoredQueryFeatures
+        incompatibleQueryFeatures
+        note
+      }
+    }
+  }
+}`;
+function debugUnifiedSearchRequest(variables) {
+  if (!isDebugAreaEnabled("code-nav"))
+    return;
+  const serialised = serialiseForDebug(variables);
+  const filters = asRecord(serialised.filters);
+  debugLog("code-nav", {
+    event: "request",
+    operation: "search",
+    targetCount: Array.isArray(serialised.targets) ? serialised.targets.length : 0,
+    sources: Array.isArray(serialised.sources) ? serialised.sources : [],
+    hasFilters: filters !== undefined,
+    filterKeys: filters ? Object.keys(filters).sort() : [],
+    fileIntent: filters && typeof filters.fileIntent === "string" ? filters.fileIntent : "omitted",
+    allowPartialResults: serialised.allowPartialResults === true,
+    presentVariableKeys: Object.keys(serialised).sort(),
+    hasLimit: typeof serialised.limit === "number",
+    hasOffset: typeof serialised.offset === "number",
+    waitTimeoutMs: typeof serialised.waitTimeoutMs === "number" ? serialised.waitTimeoutMs : undefined
+  });
+}
+function debugGraphqlWireRequest(operation, graphqlQuery, variables) {
+  if (!isDebugAreaEnabled("code-nav-wire"))
+    return;
+  debugLog("code-nav-wire", {
+    event: "wire-request",
+    operation,
+    graphqlQuery,
+    variables: serialiseForDebug(variables)
+  });
+}
+function serialiseForDebug(value) {
+  try {
+    const text = JSON.stringify(value);
+    if (!text)
+      return {};
+    const parsed = JSON.parse(text);
+    return asRecord(parsed) ?? {};
+  } catch {
+    return {};
+  }
+}
+function asRecord(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return value;
+  }
+  return;
+}
+var availableVersionSchema = z.object({
+  version: z.string().nullable().optional(),
+  ref: z.string()
+});
+var unifiedSearchSourceSchema = z.enum(["AUTO", "DOCS", "CODE", "SYMBOL"]);
+var unifiedSearchResultTypeSchema = z.enum([
+  "DOCUMENTATION_PAGE",
+  "REPOSITORY_SYMBOL",
+  "REPOSITORY_CODE",
+  "REPOSITORY_DOC"
+]);
+var unifiedSearchLocatorSchema = z.object({
+  registry: z.string().nullable().optional(),
+  packageName: z.string().nullable().optional(),
+  version: z.string().nullable().optional(),
+  pageId: z.string().nullable().optional(),
+  sourceKind: z.string().nullable().optional(),
+  sourceUrl: z.string().nullable().optional(),
+  repoUrl: z.string().nullable().optional(),
+  gitRef: z.string().nullable().optional(),
+  requestedRef: z.string().nullable().optional(),
+  filePath: z.string().nullable().optional(),
+  startLine: z.number().int().nullable().optional(),
+  endLine: z.number().int().nullable().optional(),
+  fileContentHash: z.string().nullable().optional(),
+  symbolRef: z.string().nullable().optional(),
+  qualifiedPath: z.string().nullable().optional(),
+  kind: z.string().nullable().optional(),
+  category: z.string().nullable().optional(),
+  language: z.string().nullable().optional()
+});
+var unifiedSearchHitSchema = z.object({
+  id: z.string(),
+  resultType: unifiedSearchResultTypeSchema,
+  targetLabel: z.string(),
+  title: z.string().nullable().optional(),
+  summary: z.string().nullable().optional(),
+  score: z.number().nullable().optional(),
+  highlights: z.object({
+    title: z.array(z.tuple([z.number().int(), z.number().int()])).nullable().optional(),
+    summary: z.array(z.tuple([z.number().int(), z.number().int()])).nullable().optional()
+  }).nullable().optional(),
+  locator: unifiedSearchLocatorSchema
+});
+var unifiedSearchPageInfoSchema = z.object({
+  offset: z.number().int(),
+  limit: z.number().int(),
+  returned: z.number().int(),
+  hasMore: z.boolean()
+});
+var unifiedSearchSourceStatusSchema = z.object({
+  source: unifiedSearchSourceSchema,
+  targetLabel: z.string(),
+  indexingStatus: z.string().nullable().optional(),
+  codeIndexState: z.string().nullable().optional(),
+  resultCount: z.number().int().nullable().optional(),
+  appliedFilters: z.array(z.string()),
+  ignoredFilters: z.array(z.string()),
+  incompatibleFilters: z.array(z.string()),
+  appliedQueryFeatures: z.array(z.string()),
+  ignoredQueryFeatures: z.array(z.string()),
+  incompatibleQueryFeatures: z.array(z.string()),
+  note: z.string().nullable().optional()
+});
+var unifiedSearchResultSchema = z.object({
+  query: z.string(),
+  queryWarnings: z.array(z.string()),
+  sources: z.array(unifiedSearchSourceSchema),
+  results: z.array(unifiedSearchHitSchema),
+  page: unifiedSearchPageInfoSchema,
+  partialResults: z.boolean(),
+  sourceStatus: z.array(unifiedSearchSourceStatusSchema)
+});
+var unifiedSearchSessionStatusSchema = z.enum([
+  "PENDING",
+  "INDEXING",
+  "SEARCHING",
+  "COMPLETED",
+  "TIMEOUT",
+  "FAILED"
+]);
+var unifiedSearchProgressSchema = z.object({
+  searchRef: z.string(),
+  status: unifiedSearchSessionStatusSchema,
+  targetsTotal: z.number().int(),
+  targetsReady: z.number().int(),
+  elapsedMs: z.number().int(),
+  query: z.string(),
+  queryWarnings: z.array(z.string()),
+  sources: z.array(unifiedSearchSourceSchema),
+  expiresAt: z.string().nullable().optional(),
+  results: unifiedSearchResultSchema.nullable().optional()
+});
+var asyncUnifiedSearchResultSchema = z.object({
+  completed: z.boolean(),
+  searchRef: z.string().nullable().optional(),
+  result: unifiedSearchResultSchema.nullable().optional(),
+  progress: unifiedSearchProgressSchema.nullable().optional()
+});
+var graphQLErrorSchema = z.object({
+  message: z.string(),
+  extensions: z.record(z.string(), z.unknown()).optional()
+});
+var navigationResolutionSchema = z.object({
+  requestedVersion: z.string().nullable().optional(),
+  requestedRef: z.string().nullable().optional(),
+  resolvedRef: z.string().nullable().optional(),
+  commitSha: z.string().nullable().optional()
+}).nullable().optional();
+var navigationDiagnosticsSchema = z.object({
+  hint: z.string().nullable().optional()
+}).nullable().optional();
+var repoFileEntrySchema = z.object({
+  path: z.string(),
+  name: z.string().nullable().optional(),
+  language: z.string().nullable().optional(),
+  fileType: z.string().nullable().optional(),
+  byteSize: z.number().int().nullable().optional()
+});
+var listRepoFilesResponseSchema = z.object({
+  files: z.array(repoFileEntrySchema),
+  total: z.number().int(),
+  hasMore: z.boolean(),
+  indexedVersion: z.string().nullable().optional(),
+  resolution: navigationResolutionSchema,
+  diagnostics: navigationDiagnosticsSchema,
+  codeIndexState: z.string(),
+  indexingRef: z.string().nullable().optional(),
+  availableVersions: z.array(availableVersionSchema).nullable().optional()
+});
+var listRepoFilesGraphQLResponseSchema = z.object({
+  data: z.object({
+    listRepoFiles: listRepoFilesResponseSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z.array(graphQLErrorSchema).optional()
+});
+var LIST_REPO_FILES_QUERY = `
+query ListRepoFiles(
+  $registry: Registry
+  $packageName: String
+  $repoUrl: String
+  $gitRef: String
+  $version: String
+  $pathPrefix: String
+  $limit: Int
+  $waitTimeoutMs: Int
+) {
+  listRepoFiles(
+    registry: $registry
+    packageName: $packageName
+    repoUrl: $repoUrl
+    gitRef: $gitRef
+    version: $version
+    pathPrefix: $pathPrefix
+    limit: $limit
+    waitTimeoutMs: $waitTimeoutMs
+  ) {
+    files {
+      path
+      name
+      language
+      fileType
+      byteSize
+    }
+    total
+    hasMore
+    indexedVersion
+    resolution {
+      requestedVersion
+      requestedRef
+      resolvedRef
+      commitSha
+    }
+    diagnostics {
+      hint
+    }
+    codeIndexState
+    indexingRef
+    availableVersions {
+      version
+      ref
+    }
+  }
+}`;
+var codeContextResponseSchema = z.object({
+  content: z.string().nullable().optional(),
+  filePath: z.string().nullable().optional(),
+  language: z.string().nullable().optional(),
+  totalLines: z.number().int().nullable().optional(),
+  startLine: z.number().int().nullable().optional(),
+  endLine: z.number().int().nullable().optional(),
+  repoUrl: z.string().nullable().optional(),
+  gitRef: z.string().nullable().optional(),
+  isBinary: z.boolean().nullable().optional(),
+  codeIndexState: z.string(),
+  indexingRef: z.string().nullable().optional()
+});
+var fetchCodeContextGraphQLResponseSchema = z.object({
+  data: z.object({
+    fetchCodeContext: codeContextResponseSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z.array(graphQLErrorSchema).optional()
+});
+var FETCH_CODE_CONTEXT_QUERY = `
+query FetchCodeContext(
+  $registry: Registry
+  $packageName: String
+  $repoUrl: String
+  $gitRef: String
+  $version: String
+  $filePath: String!
+  $startLine: Int
+  $endLine: Int
+  $waitTimeoutMs: Int
+) {
+  fetchCodeContext(
+    registry: $registry
+    packageName: $packageName
+    repoUrl: $repoUrl
+    gitRef: $gitRef
+    version: $version
+    filePath: $filePath
+    startLine: $startLine
+    endLine: $endLine
+    waitTimeoutMs: $waitTimeoutMs
+  ) {
+    content
+    filePath
+    language
+    totalLines
+    startLine
+    endLine
+    repoUrl
+    gitRef
+    isBinary
+    codeIndexState
+    indexingRef
+  }
+}`;
+var grepRepoMatchSchema = z.object({
+  filePath: z.string(),
+  line: z.number().int(),
+  matchStartByte: z.number().int(),
+  matchEndByte: z.number().int(),
+  lineContent: z.string(),
+  contextBefore: z.array(z.string()).nullable().optional(),
+  contextAfter: z.array(z.string()).nullable().optional(),
+  fileContentHash: z.string().nullable().optional(),
+  fileIntent: z.string().nullable().optional(),
+  symbolRowId: z.string().nullable().optional(),
+  symbol: z.object({
+    symbolRef: z.string().optional(),
+    name: z.string().optional(),
+    qualifiedPath: z.string().nullable().optional(),
+    kind: z.string().nullable().optional(),
+    category: z.string().nullable().optional(),
+    arity: z.number().int().nullable().optional(),
+    isPublic: z.boolean().nullable().optional(),
+    filePath: z.string().nullable().optional(),
+    startLine: z.number().int().nullable().optional(),
+    endLine: z.number().int().nullable().optional(),
+    code: z.string().nullable().optional(),
+    callerCount: z.number().int().nullable().optional(),
+    contentHash: z.string().nullable().optional(),
+    parentSymbolRef: z.string().nullable().optional(),
+    parentPath: z.string().nullable().optional()
+  }).nullable().optional()
+});
+var grepRepoResponseSchema = z.object({
+  matches: z.array(grepRepoMatchSchema),
+  nextCursor: z.string().nullable().optional(),
+  hasMore: z.boolean(),
+  truncatedReason: z.enum([
+    "NONE",
+    "MAX_MATCHES",
+    "MAX_MATCHES_PER_FILE",
+    "DEADLINE"
+  ]),
+  routeTaken: z.enum(["SINGLE_FILE", "CONTENT_INDEX"]).nullable().optional(),
+  filesScanned: z.number().int(),
+  filesInScope: z.number().int(),
+  binaryFilesSkipped: z.number().int(),
+  filesTooLargeSkipped: z.number().int(),
+  totalMatches: z.number().int(),
+  uniqueFilesMatched: z.number().int(),
+  indexedVersion: z.string().nullable().optional(),
+  resolution: navigationResolutionSchema,
+  codeIndexState: z.string(),
+  indexingRef: z.string().nullable().optional(),
+  availableVersions: z.array(availableVersionSchema).nullable().optional()
+});
+var grepRepoGraphQLResponseSchema = z.object({
+  data: z.object({
+    grepRepo: grepRepoResponseSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z.array(graphQLErrorSchema).optional()
+});
+var GREP_REPO_SYMBOL_SELECTIONS = {
+  symbol_ref: "symbolRef",
+  name: "name",
+  qualified_path: "qualifiedPath",
+  kind: "kind",
+  category: "category",
+  arity: "arity",
+  is_public: "isPublic",
+  file_path: "filePath",
+  start_line: "startLine",
+  end_line: "endLine",
+  code: "code",
+  caller_count: "callerCount",
+  content_hash: "contentHash",
+  parent_symbol_ref: "parentSymbolRef",
+  parent_path: "parentPath"
+};
+function buildGrepRepoQuery(symbolFields) {
+  const symbolSelection = (symbolFields ?? []).map((field) => GREP_REPO_SYMBOL_SELECTIONS[field]).filter((field) => Boolean(field)).filter((field, index, fields) => fields.indexOf(field) === index).join(`
+        `);
+  const symbolBlock = symbolSelection.length > 0 ? `
+      symbol {
+        ${symbolSelection}
+      }` : "";
+  return `
+query GrepRepo(
+  $registry: Registry
+  $packageName: String
+  $repoUrl: String
+  $gitRef: String
+  $version: String
+  $waitTimeoutMs: Int
+  $pattern: String!
+  $patternType: GrepPatternType
+  $caseSensitive: Boolean
+  $pathSelectors: [GrepPathSelectorInput!]
+  $extensions: [String!]
+  $excludeDocFiles: Boolean
+  $excludeTestFiles: Boolean
+  $allowUnscoped: Boolean
+  $contextLinesBefore: Int
+  $contextLinesAfter: Int
+  $maxMatches: Int
+  $maxMatchesPerFile: Int
+  $cursor: String
+  $symbolFields: [String!]
+) {
+  grepRepo(
+    registry: $registry
+    packageName: $packageName
+    repoUrl: $repoUrl
+    gitRef: $gitRef
+    version: $version
+    waitTimeoutMs: $waitTimeoutMs
+    pattern: $pattern
+    patternType: $patternType
+    caseSensitive: $caseSensitive
+    pathSelectors: $pathSelectors
+    extensions: $extensions
+    excludeDocFiles: $excludeDocFiles
+    excludeTestFiles: $excludeTestFiles
+    allowUnscoped: $allowUnscoped
+    contextLinesBefore: $contextLinesBefore
+    contextLinesAfter: $contextLinesAfter
+    maxMatches: $maxMatches
+    maxMatchesPerFile: $maxMatchesPerFile
+    cursor: $cursor
+    symbolFields: $symbolFields
+  ) {
+    matches {
+      filePath
+      line
+      matchStartByte
+      matchEndByte
+      lineContent
+      contextBefore
+      contextAfter
+      fileContentHash
+      fileIntent
+      symbolRowId${symbolBlock}
+    }
+    nextCursor
+    totalMatches
+    hasMore
+    truncatedReason
+    routeTaken
+    filesScanned
+    filesInScope
+    binaryFilesSkipped
+    filesTooLargeSkipped
+    uniqueFilesMatched
+    indexedVersion
+    resolution {
+      requestedVersion
+      requestedRef
+      resolvedRef
+      commitSha
+    }
+    codeIndexState
+    indexingRef
+    availableVersions {
+      version
+      ref
+    }
+  }
+}`;
+}
+var unifiedSearchGraphQLResponseSchema = z.object({
+  data: z.object({
+    search: asyncUnifiedSearchResultSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z.array(graphQLErrorSchema).optional()
+});
+var unifiedSearchStatusGraphQLResponseSchema = z.object({
+  data: z.object({
+    discoverySearchProgress: unifiedSearchProgressSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z.array(graphQLErrorSchema).optional()
+});
+
+class CodeNavigationServiceImpl {
+  codeNavigationUrl;
+  tokenProvider;
+  fetchFn;
+  constructor(codeNavigationUrl, tokenProvider, fetchFn = globalThis.fetch) {
+    this.codeNavigationUrl = codeNavigationUrl;
+    this.tokenProvider = tokenProvider;
+    this.fetchFn = fetchFn;
+  }
+  async search(params) {
+    return executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executeUnifiedSearch(token, params)
+    });
+  }
+  async searchStatus(searchRef) {
+    return executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executeUnifiedSearchStatus(token, searchRef)
+    });
+  }
+  async executeUnifiedSearch(token, params) {
+    if (params.targets.length === 0) {
+      throw new CodeNavigationValidationError("At least one search target is required.");
+    }
+    let response;
+    const variables = {
+      targets: params.targets.map((target) => ({
+        registry: target.registry,
+        name: target.packageName,
+        version: target.version,
+        repoUrl: target.repoUrl,
+        gitRef: target.gitRef
+      })),
+      query: params.query,
+      sources: params.sources,
+      filters: params.filters,
+      allowPartialResults: params.allowPartialResults ?? false,
+      limit: params.limit,
+      offset: params.offset,
+      waitTimeoutMs: params.waitTimeoutMs
+    };
+    debugUnifiedSearchRequest(variables);
+    debugGraphqlWireRequest("search", UNIFIED_SEARCH_QUERY, variables);
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.codeNavigationUrl,
+        token,
+        query: UNIFIED_SEARCH_QUERY,
+        variables,
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new CodeNavigationNetworkError("Could not reach the code navigation service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = unifiedSearchGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw this.createGraphQLError(parsed.data.errors);
+    }
+    const data = parsed.data.data?.search;
+    if (!data) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    return this.normaliseUnifiedSearchOutcome(data);
+  }
+  async executeUnifiedSearchStatus(token, searchRef) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.codeNavigationUrl,
+        token,
+        query: UNIFIED_SEARCH_STATUS_QUERY,
+        variables: {
+          searchRef,
+          includeResults: true
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new CodeNavigationNetworkError("Could not reach the code navigation service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = unifiedSearchStatusGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw this.createGraphQLError(parsed.data.errors);
+    }
+    const data = parsed.data.data?.discoverySearchProgress;
+    if (!data) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    const progress = this.normaliseUnifiedSearchProgress(data);
+    const result = data.results ? this.normaliseUnifiedSearchResult(data.results) : undefined;
+    if (result && progress.status === "COMPLETED") {
+      return {
+        state: "completed",
+        completed: true,
+        searchRef: progress.searchRef,
+        result,
+        progress
+      };
+    }
+    return {
+      state: "incomplete",
+      completed: false,
+      searchRef: progress.searchRef,
+      result,
+      progress
+    };
+  }
+  createHttpError(response) {
+    const status = response.status;
+    const detail = parseDetail2(response.responseBody);
+    if (status === 401) {
+      return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+    }
+    if (status === 403) {
+      return new CodeNavigationAccessError(detail ?? "Code navigation access denied.");
+    }
+    if (status >= 500) {
+      return new CodeNavigationBackendError(detail ? `Server error (${status}): ${detail}` : `Server error (${status})`, status);
+    }
+    return new CodeNavigationBackendError(detail ?? `Request failed with status ${status}`, status);
+  }
+  createGraphQLError(errors) {
+    const message = errors.map((error) => error.message).join(", ");
+    const extensions = getPrimaryExtensions(errors);
+    const code = typeof extensions?.code === "string" ? extensions.code : undefined;
+    const retryable = typeof extensions?.retryable === "boolean" ? extensions.retryable : undefined;
+    const indexingRef = getGraphQLIndexingRef(errors);
+    switch (code) {
+      case "PACKAGE_INDEXING":
+        return new CodeNavigationIndexingError(this.createIndexingMessage(indexingRef), indexingRef, parseAvailableVersions(extensions));
+      case "GREP_PATTERN_TOO_SHORT":
+      case "GREP_PATTERN_TOO_LONG":
+      case "GREP_PATTERN_INVALID":
+      case "GREP_INVALID_REGEX":
+      case "GREP_UNSUPPORTED_PATTERN":
+      case "GREP_PATTERN_TOO_UNSELECTIVE":
+      case "GREP_SCOPE_REQUIRED":
+      case "GREP_SELECTOR_INVALID":
+      case "GREP_CURSOR_INVALID":
+      case "GREP_CONTEXT_TOO_LARGE":
+      case "GREP_CONTEXT_NEGATIVE":
+      case "GREP_MAX_MATCHES_TOO_LARGE":
+      case "GREP_MAX_MATCHES_INVALID":
+        return new CodeNavigationValidationError(message);
+      case "VERSION_NOT_FOUND":
+        return new CodeNavigationVersionNotFoundError(message, typeof extensions?.package === "string" ? extensions.package : undefined, typeof extensions?.requested_version === "string" ? extensions.requested_version : undefined, typeof extensions?.latest_indexed === "string" ? extensions.latest_indexed : undefined, parseAvailableVersions(extensions));
+      case "NOT_FOUND":
+      case "PACKAGE_NOT_FOUND":
+      case "NO_REPOSITORY_URL":
+        return new CodeNavigationTargetNotFoundError(message);
+      case "FILE_NOT_FOUND":
+        return new CodeNavigationFileNotFoundError(message, typeof extensions?.file_path === "string" ? extensions.file_path : typeof extensions?.filePath === "string" ? extensions.filePath : undefined);
+      case "UNSUPPORTED_REGISTRY":
+      case "VALIDATION_ERROR":
+        return new CodeNavigationValidationError(message);
+      case "FEATURE_FLAG_REQUIRED":
+        return new CodeNavigationFeatureFlagRequiredError(message);
+      case "UNAUTHORIZED":
+        return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+      case "FORBIDDEN":
+        return new CodeNavigationAccessError("Code navigation access denied. This feature may not be enabled for your account.");
+      case "UPSTREAM_ERROR":
+      case "TIMEOUT":
+      case "RATE_LIMITED":
+      case "GREP_FILE_TOO_LARGE":
+      case "GREP_TIMEOUT":
+      case "GREP_SERVICE_UNAVAILABLE":
+      case "GREP_FAILED":
+      case "GREP_INDEX_NOT_AVAILABLE":
+      case "INTERNAL_ERROR":
+      case "UNKNOWN_ERROR":
+        return new CodeNavigationBackendError(message, undefined, code, retryable);
+      default:
+        break;
+    }
+    if (code === undefined) {
+      if (isAuthMessage(message)) {
+        return new CodeNavigationAccessError("Code navigation access denied. This feature may not be enabled for your account.");
+      }
+      if (isUnresolvableMessage(message)) {
+        return new CodeNavigationUnresolvableError(message);
+      }
+      if (isTargetNotFoundMessage(message)) {
+        return new CodeNavigationTargetNotFoundError(message);
+      }
+    }
+    return new CodeNavigationBackendError(message, undefined, code, retryable);
+  }
+  createIndexingMessage(indexingRef) {
+    const base = "Target is still indexing. Indexing usually completes within 30 seconds. Retry this request, or pass a longer wait timeout (CLI: `--wait 60000`, MCP: `wait_timeout_ms: 60000`) to block until ready.";
+    if (indexingRef) {
+      return `${base} Indexing reference: ${indexingRef}.`;
+    }
+    return base;
+  }
+  normaliseUnifiedSearchOutcome(data) {
+    const progress = data.progress ? this.normaliseUnifiedSearchProgress(data.progress) : undefined;
+    if (data.completed) {
+      if (!data.result) {
+        throw new MalformedCodeNavigationResponseError("Completed unified search response missing result payload.");
+      }
+      return {
+        state: "completed",
+        completed: true,
+        searchRef: data.searchRef ?? undefined,
+        result: this.normaliseUnifiedSearchResult(data.result),
+        progress
+      };
+    }
+    const searchRef = data.searchRef ?? progress?.searchRef;
+    if (!searchRef) {
+      throw new MalformedCodeNavigationResponseError("Incomplete unified search response missing search reference.");
+    }
+    const result = data.result ? this.normaliseUnifiedSearchResult(data.result) : undefined;
+    return {
+      state: "incomplete",
+      completed: false,
+      searchRef,
+      result,
+      progress
+    };
+  }
+  normaliseUnifiedSearchResult(result) {
+    return {
+      query: result.query,
+      queryWarnings: result.queryWarnings,
+      sources: result.sources,
+      results: result.results.map((entry) => ({
+        id: entry.id,
+        resultType: entry.resultType,
+        targetLabel: entry.targetLabel,
+        title: entry.title ?? undefined,
+        summary: entry.summary ?? undefined,
+        score: entry.score ?? undefined,
+        highlights: entry.highlights ? {
+          title: entry.highlights.title ?? undefined,
+          summary: entry.highlights.summary ?? undefined
+        } : undefined,
+        locator: {
+          registry: entry.locator.registry ?? undefined,
+          packageName: entry.locator.packageName ?? undefined,
+          version: entry.locator.version ?? undefined,
+          pageId: entry.locator.pageId ?? undefined,
+          sourceKind: entry.locator.sourceKind ?? undefined,
+          sourceUrl: entry.locator.sourceUrl ?? undefined,
+          repoUrl: entry.locator.repoUrl ?? undefined,
+          gitRef: entry.locator.gitRef ?? undefined,
+          requestedRef: entry.locator.requestedRef ?? undefined,
+          filePath: entry.locator.filePath ?? undefined,
+          startLine: entry.locator.startLine ?? undefined,
+          endLine: entry.locator.endLine ?? undefined,
+          fileContentHash: entry.locator.fileContentHash ?? undefined,
+          symbolRef: entry.locator.symbolRef ?? undefined,
+          qualifiedPath: entry.locator.qualifiedPath ?? undefined,
+          kind: entry.locator.kind ?? undefined,
+          category: entry.locator.category ?? undefined,
+          language: entry.locator.language ?? undefined
+        }
+      })),
+      page: {
+        offset: result.page.offset,
+        limit: result.page.limit,
+        returned: result.page.returned,
+        hasMore: result.page.hasMore
+      },
+      partialResults: result.partialResults,
+      sourceStatus: result.sourceStatus.map((entry) => ({
+        source: entry.source,
+        targetLabel: entry.targetLabel,
+        indexingStatus: entry.indexingStatus ?? undefined,
+        codeIndexState: entry.codeIndexState ?? undefined,
+        resultCount: entry.resultCount ?? undefined,
+        appliedFilters: entry.appliedFilters,
+        ignoredFilters: entry.ignoredFilters,
+        incompatibleFilters: entry.incompatibleFilters,
+        appliedQueryFeatures: entry.appliedQueryFeatures,
+        ignoredQueryFeatures: entry.ignoredQueryFeatures,
+        incompatibleQueryFeatures: entry.incompatibleQueryFeatures,
+        note: entry.note ?? undefined
+      }))
+    };
+  }
+  normaliseUnifiedSearchProgress(progress) {
+    return {
+      searchRef: progress.searchRef,
+      status: progress.status,
+      targetsTotal: progress.targetsTotal,
+      targetsReady: progress.targetsReady,
+      elapsedMs: progress.elapsedMs,
+      query: progress.query,
+      queryWarnings: progress.queryWarnings,
+      sources: progress.sources,
+      expiresAt: progress.expiresAt ?? undefined
+    };
+  }
+  throwIfIndexing(data) {
+    if (data.codeIndexState === "INDEXING") {
+      throw new CodeNavigationIndexingError(this.createIndexingMessage(data.indexingRef ?? undefined), data.indexingRef ?? undefined, data.availableVersions?.map((entry) => ({
+        version: entry.version ?? undefined,
+        ref: entry.ref
+      })));
+    }
+  }
+  async listFiles(params) {
+    return executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executeListFiles(token, params)
+    });
+  }
+  async executeListFiles(token, params) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.codeNavigationUrl,
+        token,
+        query: LIST_REPO_FILES_QUERY,
+        variables: {
+          registry: params.target.registry,
+          packageName: params.target.packageName,
+          repoUrl: params.target.repoUrl,
+          gitRef: params.target.gitRef,
+          version: params.target.version,
+          pathPrefix: params.pathPrefix,
+          limit: params.limit,
+          waitTimeoutMs: params.waitTimeoutMs
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new CodeNavigationNetworkError("Could not reach the code navigation service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = listRepoFilesGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw this.createGraphQLError(parsed.data.errors);
+    }
+    const data = parsed.data.data?.listRepoFiles;
+    if (!data) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    this.throwIfIndexing(data);
+    return {
+      files: data.files.map((entry) => ({
+        path: entry.path,
+        name: entry.name ?? undefined,
+        language: entry.language ?? undefined,
+        fileType: entry.fileType ?? undefined,
+        byteSize: entry.byteSize ?? undefined
+      })),
+      total: data.total,
+      hasMore: data.hasMore,
+      indexedVersion: data.indexedVersion ?? undefined,
+      resolution: data.resolution ? {
+        requestedVersion: data.resolution.requestedVersion ?? undefined,
+        requestedRef: data.resolution.requestedRef ?? undefined,
+        resolvedRef: data.resolution.resolvedRef ?? undefined,
+        commitSha: data.resolution.commitSha ?? undefined
+      } : undefined,
+      hint: data.diagnostics?.hint ?? undefined
+    };
+  }
+  async readFile(params) {
+    return executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executeReadFile(token, params)
+    });
+  }
+  async executeReadFile(token, params) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.codeNavigationUrl,
+        token,
+        query: FETCH_CODE_CONTEXT_QUERY,
+        variables: {
+          registry: params.target.registry,
+          packageName: params.target.packageName,
+          repoUrl: params.target.repoUrl,
+          gitRef: params.target.gitRef,
+          version: params.target.version,
+          filePath: params.filePath,
+          startLine: params.startLine,
+          endLine: params.endLine,
+          waitTimeoutMs: params.waitTimeoutMs
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new CodeNavigationNetworkError("Could not reach the code navigation service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = fetchCodeContextGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw this.createGraphQLError(parsed.data.errors);
+    }
+    const data = parsed.data.data?.fetchCodeContext;
+    if (!data) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    this.throwIfIndexing({
+      codeIndexState: data.codeIndexState,
+      indexingRef: data.indexingRef
+    });
+    return {
+      filePath: data.filePath ?? undefined,
+      language: data.language ?? undefined,
+      totalLines: data.totalLines ?? undefined,
+      startLine: data.startLine ?? undefined,
+      endLine: data.endLine ?? undefined,
+      content: data.content ?? undefined,
+      isBinary: data.isBinary ?? undefined
+    };
+  }
+  async grepRepo(params) {
+    return executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executeGrepRepo(token, params)
+    });
+  }
+  async executeGrepRepo(token, params) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.codeNavigationUrl,
+        token,
+        query: buildGrepRepoQuery(params.symbolFields),
+        variables: {
+          registry: params.target.registry,
+          packageName: params.target.packageName,
+          repoUrl: params.target.repoUrl,
+          gitRef: params.target.gitRef,
+          version: params.target.version,
+          waitTimeoutMs: params.waitTimeoutMs,
+          pattern: params.pattern,
+          patternType: params.patternType,
+          caseSensitive: params.caseSensitive,
+          pathSelectors: params.pathSelectors?.map((entry) => ({
+            kind: entry.kind,
+            value: entry.value
+          })),
+          extensions: params.extensions,
+          excludeDocFiles: params.excludeDocFiles,
+          excludeTestFiles: params.excludeTestFiles,
+          allowUnscoped: params.allowUnscoped,
+          contextLinesBefore: params.contextLinesBefore,
+          contextLinesAfter: params.contextLinesAfter,
+          maxMatches: params.maxMatches,
+          maxMatchesPerFile: params.maxMatchesPerFile,
+          cursor: params.cursor,
+          symbolFields: params.symbolFields
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new CodeNavigationNetworkError("Could not reach the code navigation service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = grepRepoGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw this.createGraphQLError(parsed.data.errors);
+    }
+    const data = parsed.data.data?.grepRepo;
+    if (!data) {
+      throw new MalformedCodeNavigationResponseError("Malformed response from code navigation service.");
+    }
+    this.throwIfIndexing(data);
+    return {
+      matches: data.matches.map((entry) => ({
+        filePath: entry.filePath,
+        line: entry.line,
+        matchStartByte: entry.matchStartByte,
+        matchEndByte: entry.matchEndByte,
+        lineContent: entry.lineContent,
+        contextBefore: entry.contextBefore ?? undefined,
+        contextAfter: entry.contextAfter ?? undefined,
+        fileContentHash: entry.fileContentHash ?? undefined,
+        fileIntent: entry.fileIntent ?? undefined,
+        symbolRowId: entry.symbolRowId ?? undefined,
+        symbol: entry.symbol ? {
+          symbolRef: entry.symbol.symbolRef,
+          name: entry.symbol.name,
+          qualifiedPath: entry.symbol.qualifiedPath ?? undefined,
+          kind: entry.symbol.kind ?? undefined,
+          category: entry.symbol.category ?? undefined,
+          arity: entry.symbol.arity ?? undefined,
+          isPublic: entry.symbol.isPublic ?? undefined,
+          filePath: entry.symbol.filePath ?? undefined,
+          startLine: entry.symbol.startLine ?? undefined,
+          endLine: entry.symbol.endLine ?? undefined,
+          code: entry.symbol.code ?? undefined,
+          callerCount: entry.symbol.callerCount ?? undefined,
+          contentHash: entry.symbol.contentHash ?? undefined,
+          parentSymbolRef: entry.symbol.parentSymbolRef ?? undefined,
+          parentPath: entry.symbol.parentPath ?? undefined
+        } : undefined
+      })),
+      nextCursor: data.nextCursor ?? undefined,
+      hasMore: data.hasMore,
+      truncatedReason: data.truncatedReason,
+      routeTaken: data.routeTaken ?? undefined,
+      filesScanned: data.filesScanned,
+      filesInScope: data.filesInScope,
+      binaryFilesSkipped: data.binaryFilesSkipped,
+      filesTooLargeSkipped: data.filesTooLargeSkipped,
+      totalMatches: data.totalMatches,
+      uniqueFilesMatched: data.uniqueFilesMatched,
+      indexedVersion: data.indexedVersion ?? undefined,
+      resolution: data.resolution ? {
+        requestedVersion: data.resolution.requestedVersion ?? undefined,
+        requestedRef: data.resolution.requestedRef ?? undefined,
+        resolvedRef: data.resolution.resolvedRef ?? undefined,
+        commitSha: data.resolution.commitSha ?? undefined
+      } : undefined
+    };
+  }
+}
+function parseDetail2(body) {
+  if (!body)
+    return;
+  try {
+    const parsed = JSON.parse(body);
+    if (typeof parsed.detail === "string")
+      return parsed.detail;
+    if (typeof parsed.error === "string")
+      return parsed.error;
+  } catch {
+    return body;
+  }
+  return;
+}
+function getPrimaryExtensions(errors) {
+  for (const error of errors) {
+    if (error.extensions && Object.keys(error.extensions).length > 0) {
+      return error.extensions;
+    }
+  }
+  return;
+}
+function getGraphQLIndexingRef(errors) {
+  for (const error of errors) {
+    const indexingRef = error.extensions?.indexing_ref ?? error.extensions?.indexingRef;
+    if (typeof indexingRef === "string")
+      return indexingRef;
+  }
+  return;
+}
+function parseAvailableVersions(extensions) {
+  const raw = extensions?.available_versions ?? extensions?.availableVersions;
+  if (!Array.isArray(raw))
+    return;
+  const parsed = [];
+  for (const item of raw) {
+    if (item && typeof item === "object" && "ref" in item) {
+      const entry = item;
+      if (typeof entry.ref === "string") {
+        parsed.push({
+          ref: entry.ref,
+          version: typeof entry.version === "string" ? entry.version : undefined
+        });
+      }
+    }
+  }
+  return parsed.length > 0 ? parsed : undefined;
+}
+function isAuthMessage(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("unauthorized") || lower.includes("forbidden") || lower.includes("permission") || lower.includes("authentication");
+}
+function isTargetNotFoundMessage(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("not found") || lower.includes("unknown package") || lower.includes("no such package") || lower.includes("does not exist");
+}
+function isUnresolvableMessage(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("could not resolve") || lower.includes("cannot resolve");
+}
+// src/services/config.ts
+var DEFAULT_MCP_URL = "https://mcp.githits.com";
+var DEFAULT_API_URL = "https://api.githits.com";
+var DEFAULT_CODE_NAV_URL = "https://pkgseer.dev";
+function getMcpUrl() {
+  return process.env.GITHITS_MCP_URL ?? DEFAULT_MCP_URL;
+}
+function getApiUrl() {
+  return process.env.GITHITS_API_URL ?? DEFAULT_API_URL;
+}
+function getCodeNavigationUrl() {
+  const explicitUrl = process.env.GITHITS_CODE_NAV_URL ?? process.env.PKGSEER_URL;
+  if (explicitUrl) {
+    return explicitUrl;
+  }
+  const usingDefaultEnvironment = getMcpUrl() === DEFAULT_MCP_URL && getApiUrl() === DEFAULT_API_URL;
+  return usingDefaultEnvironment ? DEFAULT_CODE_NAV_URL : undefined;
+}
+function getEnvApiToken() {
+  return process.env.GITHITS_API_TOKEN;
+}
+function isCodeNavigationCliOverrideEnabled() {
+  const raw = process.env.GITHITS_CODE_NAVIGATION;
+  if (!raw)
+    return false;
+  const normalized = raw.toLowerCase();
+  return normalized !== "0" && normalized !== "false" && normalized !== "";
+}
+// src/services/exec-service.ts
+import { spawn } from "node:child_process";
+
+class ExecServiceImpl {
+  async exec(command, args) {
+    return new Promise((resolve, reject) => {
+      const child = spawn(command, args, {
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env },
+        ...process.platform === "win32" && { shell: true }
+      });
+      const stdoutChunks = [];
+      const stderrChunks = [];
+      child.stdout.on("data", (chunk) => stdoutChunks.push(chunk));
+      child.stderr.on("data", (chunk) => stderrChunks.push(chunk));
+      child.on("error", (error) => {
+        reject(error);
+      });
+      child.on("close", (code) => {
+        resolve({
+          exitCode: code ?? 1,
+          stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
+          stderr: Buffer.concat(stderrChunks).toString("utf-8")
+        });
+      });
+    });
+  }
+}
+// src/services/filesystem-service.ts
+import {
+  mkdir,
+  readdir,
+  readFile,
+  rename,
+  stat,
+  unlink,
+  writeFile
+} from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+class FileSystemServiceImpl {
+  async readFile(path) {
+    return readFile(path, "utf-8");
+  }
+  async writeFile(path, contents, mode) {
+    await writeFile(path, contents, { mode });
+  }
+  async deleteFile(path) {
+    try {
+      await unlink(path);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }
+  async exists(path) {
+    try {
+      await stat(path);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async ensureDir(path, mode) {
+    await mkdir(path, { recursive: true, mode });
+  }
+  getHomeDir() {
+    return homedir();
+  }
+  joinPath(...segments) {
+    return join(...segments);
+  }
+  getCwd() {
+    return process.cwd();
+  }
+  getDirname(path) {
+    return dirname(path);
+  }
+  async readdir(path) {
+    return readdir(path);
+  }
+  async isDirectory(path) {
+    try {
+      const stats = await stat(path);
+      return stats.isDirectory();
+    } catch {
+      return false;
+    }
+  }
+  async atomicWriteFile(path, contents) {
+    const tmpPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    let mode = 384;
+    try {
+      const existing = await stat(path);
+      mode = existing.mode & 511;
+    } catch {}
+    try {
+      await writeFile(tmpPath, contents, { mode });
+      await rename(tmpPath, path);
+    } catch (error) {
+      try {
+        await unlink(tmpPath);
+      } catch {}
+      throw error;
+    }
+  }
+}
+// src/services/keychain-auth-storage.ts
+var SERVICE_NAME = "githits";
+var TOKEN_PREFIX = "v1:tokens:";
+var CLIENT_PREFIX = "v1:client:";
+function parseJsonOrNull2(json) {
+  if (json === null)
+    return null;
+  try {
+    const parsed = JSON.parse(json);
+    if (typeof parsed !== "object" || parsed === null)
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isValidTokenData(data) {
+  if (typeof data !== "object" || data === null)
+    return false;
+  const d = data;
+  return typeof d.accessToken === "string" && d.accessToken.length > 0 && typeof d.refreshToken === "string" && d.refreshToken.length > 0 && typeof d.createdAt === "string" && d.createdAt.length > 0 && (d.expiresAt === null || typeof d.expiresAt === "string" && d.expiresAt.length > 0);
+}
+function isValidClientRegistration(data) {
+  if (typeof data !== "object" || data === null)
+    return false;
+  const d = data;
+  return typeof d.clientId === "string" && d.clientId.length > 0 && typeof d.clientSecret === "string" && d.clientSecret.length > 0 && typeof d.redirectUri === "string" && d.redirectUri.length > 0 && typeof d.registeredAt === "string" && d.registeredAt.length > 0;
+}
+
+class KeychainAuthStorage {
+  keyring;
+  constructor(keyring) {
+    this.keyring = keyring;
+  }
+  async loadTokens(baseUrl2) {
+    const key = `${TOKEN_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
+    const json = this.keyring.getPassword(SERVICE_NAME, key);
+    const data = parseJsonOrNull2(json);
+    if (data !== null && !isValidTokenData(data))
+      return null;
+    return data;
+  }
+  async saveTokens(baseUrl2, data) {
+    const key = `${TOKEN_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
+    this.keyring.setPassword(SERVICE_NAME, key, JSON.stringify(data));
+  }
+  async clearTokens(baseUrl2) {
+    const key = `${TOKEN_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
+    this.keyring.deletePassword(SERVICE_NAME, key);
+  }
+  async loadClient(baseUrl2) {
+    const key = `${CLIENT_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
+    const json = this.keyring.getPassword(SERVICE_NAME, key);
+    const data = parseJsonOrNull2(json);
+    if (data !== null && !isValidClientRegistration(data))
+      return null;
+    return data;
+  }
+  async saveClient(baseUrl2, data) {
+    const key = `${CLIENT_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
+    this.keyring.setPassword(SERVICE_NAME, key, JSON.stringify(data));
+  }
+  async clearClient(baseUrl2) {
+    const key = `${CLIENT_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
+    this.keyring.deletePassword(SERVICE_NAME, key);
+  }
+  getStorageLocation() {
+    switch (process.platform) {
+      case "darwin":
+        return "macOS Keychain (githits)";
+      case "win32":
+        return "Windows Credential Manager (githits)";
+      default:
+        return "System keychain (githits)";
+    }
+  }
+}
+// src/services/keyring-service.ts
+import { Entry } from "@napi-rs/keyring";
+
+class KeychainUnavailableError extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.name = "KeychainUnavailableError";
+    this.cause = cause;
+  }
+}
+function wrapKeyringError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  throw new KeychainUnavailableError(`System keychain unavailable: ${message}`, error);
+}
+
+class KeyringServiceImpl {
+  getPassword(service, account) {
+    try {
+      return new Entry(service, account).getPassword();
+    } catch (error) {
+      wrapKeyringError(error);
+    }
+  }
+  setPassword(service, account, password) {
+    try {
+      new Entry(service, account).setPassword(password);
+    } catch (error) {
+      wrapKeyringError(error);
+    }
+  }
+  deletePassword(service, account) {
+    try {
+      return new Entry(service, account).deleteCredential();
+    } catch (error) {
+      wrapKeyringError(error);
+    }
+  }
+}
+// src/services/migrating-auth-storage.ts
+class MigratingAuthStorage {
+  primary;
+  legacy;
+  onPrimaryUnavailable;
+  primaryAvailable = true;
+  warnedOnPrimaryFailure = false;
+  constructor(primary, legacy, onPrimaryUnavailable = () => {}) {
+    this.primary = primary;
+    this.legacy = legacy;
+    this.onPrimaryUnavailable = onPrimaryUnavailable;
+  }
+  async loadTokens(baseUrl2) {
+    if (this.primaryAvailable) {
+      try {
+        const tokens = await this.primary.loadTokens(baseUrl2);
+        if (tokens)
+          return tokens;
+      } catch (error) {
+        if (!this.handlePrimaryFailure(error))
+          throw error;
+      }
+    }
+    const legacyTokens = await this.legacy.loadTokens(baseUrl2);
+    if (!legacyTokens)
+      return null;
+    if (!this.primaryAvailable)
+      return legacyTokens;
+    try {
+      await this.primary.saveTokens(baseUrl2, legacyTokens);
+    } catch (error) {
+      if (!this.handlePrimaryFailure(error))
+        throw error;
+      return legacyTokens;
+    }
+    try {
+      await this.legacy.clearTokens(baseUrl2);
+    } catch {}
+    return legacyTokens;
+  }
+  async saveTokens(baseUrl2, data) {
+    if (this.primaryAvailable) {
+      try {
+        await this.primary.saveTokens(baseUrl2, data);
+        return;
+      } catch (error) {
+        if (!this.handlePrimaryFailure(error))
+          throw error;
+      }
+    }
+    await this.legacy.saveTokens(baseUrl2, data);
+  }
+  async clearTokens(baseUrl2) {
+    let primaryError;
+    if (this.primaryAvailable) {
+      try {
+        await this.primary.clearTokens(baseUrl2);
+      } catch (error) {
+        if (!this.handlePrimaryFailure(error)) {
+          primaryError = error;
+        }
+      }
+    }
+    try {
+      await this.legacy.clearTokens(baseUrl2);
+    } catch {}
+    if (primaryError)
+      throw primaryError;
+  }
+  async loadClient(baseUrl2) {
+    if (this.primaryAvailable) {
+      try {
+        const client = await this.primary.loadClient(baseUrl2);
+        if (client)
+          return client;
+      } catch (error) {
+        if (!this.handlePrimaryFailure(error))
+          throw error;
+      }
+    }
+    const legacyClient = await this.legacy.loadClient(baseUrl2);
+    if (!legacyClient)
+      return null;
+    if (!this.primaryAvailable)
+      return legacyClient;
+    try {
+      await this.primary.saveClient(baseUrl2, legacyClient);
+    } catch (error) {
+      if (!this.handlePrimaryFailure(error))
+        throw error;
+      return legacyClient;
+    }
+    try {
+      await this.legacy.clearClient(baseUrl2);
+    } catch {}
+    return legacyClient;
+  }
+  async saveClient(baseUrl2, data) {
+    if (this.primaryAvailable) {
+      try {
+        await this.primary.saveClient(baseUrl2, data);
+        return;
+      } catch (error) {
+        if (!this.handlePrimaryFailure(error))
+          throw error;
+      }
+    }
+    await this.legacy.saveClient(baseUrl2, data);
+  }
+  async clearClient(baseUrl2) {
+    let primaryError;
+    if (this.primaryAvailable) {
+      try {
+        await this.primary.clearClient(baseUrl2);
+      } catch (error) {
+        if (!this.handlePrimaryFailure(error)) {
+          primaryError = error;
+        }
+      }
+    }
+    try {
+      await this.legacy.clearClient(baseUrl2);
+    } catch {}
+    if (primaryError)
+      throw primaryError;
+  }
+  getStorageLocation() {
+    return this.primaryAvailable ? this.primary.getStorageLocation() : this.legacy.getStorageLocation();
+  }
+  handlePrimaryFailure(error) {
+    if (!(error instanceof KeychainUnavailableError)) {
+      return false;
+    }
+    this.primaryAvailable = false;
+    if (!this.warnedOnPrimaryFailure) {
+      this.warnedOnPrimaryFailure = true;
+      this.onPrimaryUnavailable(error);
+    }
+    return true;
+  }
+}
+// src/services/package-intelligence-service.ts
+import { z as z2 } from "zod";
+
+// src/services/promote-version-not-found.ts
+function promoteGenericVersionNotFound(error, params) {
+  if (!(error instanceof PackageIntelligenceBackendError))
+    return error;
+  if (error.graphqlCode !== undefined)
+    return error;
+  const requestedVersion = pickRequestedVersion(params);
+  if (!requestedVersion)
+    return error;
+  if (!/no matching version/i.test(error.message))
+    return error;
+  const qualifiedName = synthesizeQualifiedName(params);
+  return new PackageIntelligenceVersionNotFoundError(error.message, qualifiedName, requestedVersion, undefined);
+}
+function pickRequestedVersion(params) {
+  if (params.version)
+    return params.version;
+  if (params.fromVersion)
+    return params.fromVersion;
+  if (params.toVersion)
+    return params.toVersion;
+  return;
+}
+function synthesizeQualifiedName(params) {
+  if (!params.registry || !params.packageName)
+    return;
+  return `${params.registry.toLowerCase()}:${params.packageName}`;
+}
+
+// src/services/package-intelligence-service.ts
+class PackageIntelligenceAccessError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PackageIntelligenceAccessError";
+  }
+}
+
+class PackageIntelligenceFeatureFlagRequiredError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PackageIntelligenceFeatureFlagRequiredError";
+  }
+}
+
+class PackageIntelligenceNetworkError extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "PackageIntelligenceNetworkError";
+  }
+}
+
+class PackageIntelligenceBackendError extends Error {
+  status;
+  graphqlCode;
+  retryable;
+  constructor(message, status, graphqlCode, retryable) {
+    super(message);
+    this.status = status;
+    this.graphqlCode = graphqlCode;
+    this.retryable = retryable;
+    this.name = "PackageIntelligenceBackendError";
+  }
+}
+
+class PackageIntelligenceGraphQLError extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "PackageIntelligenceGraphQLError";
+  }
+}
+
+class PackageIntelligenceTargetNotFoundError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PackageIntelligenceTargetNotFoundError";
+  }
+}
+
+class PackageIntelligenceValidationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PackageIntelligenceValidationError";
+  }
+}
+
+class PackageIntelligenceVersionNotFoundError extends Error {
+  packageName;
+  requestedVersion;
+  availableVersions;
+  constructor(message, packageName, requestedVersion, availableVersions) {
+    super(message);
+    this.packageName = packageName;
+    this.requestedVersion = requestedVersion;
+    this.availableVersions = availableVersions;
+    this.name = "PackageIntelligenceVersionNotFoundError";
+  }
+}
+
+class MalformedPackageIntelligenceResponseError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MalformedPackageIntelligenceResponseError";
+  }
+}
+
+class PackageIntelligenceChangelogSourceNotFoundError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PackageIntelligenceChangelogSourceNotFoundError";
+  }
+}
+var githubRepositorySchema = z2.object({
+  stargazersCount: z2.number().int().nullable().optional(),
+  forksCount: z2.number().int().nullable().optional(),
+  openIssuesCount: z2.number().int().nullable().optional(),
+  archived: z2.boolean().nullable().optional(),
+  language: z2.string().nullable().optional(),
+  topics: z2.array(z2.string()).nullable().optional(),
+  pushedAt: z2.string().nullable().optional()
+}).nullable().optional();
+var packageIdentitySchema = z2.object({
+  name: z2.string().nullable().optional(),
+  registry: z2.string().nullable().optional(),
+  description: z2.string().nullable().optional(),
+  latestVersion: z2.string().nullable().optional(),
+  latestVersionPublishedAt: z2.string().nullable().optional(),
+  homepage: z2.string().nullable().optional(),
+  repositoryUrl: z2.string().nullable().optional(),
+  license: z2.string().nullable().optional(),
+  downloadsLastMonth: z2.number().int().nullable().optional(),
+  downloadsTotal: z2.number().int().nullable().optional(),
+  githubRepository: githubRepositorySchema
+});
+var vulnerabilityOverviewSchema = z2.object({
+  osvId: z2.string().nullable().optional(),
+  summary: z2.string().nullable().optional(),
+  severityScore: z2.number().nullable().optional(),
+  publishedAt: z2.string().nullable().optional()
+});
+var packageSecurityOverviewSchema = z2.object({
+  vulnerabilityCount: z2.number().int().nullable().optional(),
+  hasCurrentVulnerabilities: z2.boolean().nullable().optional(),
+  recentVulnerabilities: z2.array(vulnerabilityOverviewSchema).nullable().optional()
+}).nullable().optional();
+var quickstartInfoSchema = z2.object({
+  installCommand: z2.string().nullable().optional(),
+  usageExample: z2.string().nullable().optional()
+}).nullable().optional();
+var changelogEntrySchema = z2.object({
+  version: z2.string().nullable().optional(),
+  publishedAt: z2.string().nullable().optional(),
+  body: z2.string().nullable().optional()
+});
+var packageSummaryResponseSchema = z2.object({
+  package: packageIdentitySchema.nullable().optional(),
+  security: packageSecurityOverviewSchema,
+  quickstart: quickstartInfoSchema,
+  latestChangelogs: z2.array(changelogEntrySchema).nullable().optional()
+});
+var graphQLErrorSchema2 = z2.object({
+  message: z2.string(),
+  extensions: z2.record(z2.string(), z2.unknown()).optional()
+});
+var graphQLResponseSchema = z2.object({
+  data: z2.object({
+    packageSummary: packageSummaryResponseSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z2.array(graphQLErrorSchema2).optional()
+});
+var PACKAGE_SUMMARY_QUERY = `
+query PackageSummary($registry: Registry!, $name: String!) {
+  packageSummary(registry: $registry, name: $name) {
+    package {
+      name
+      registry
+      description
+      latestVersion
+      latestVersionPublishedAt
+      homepage
+      repositoryUrl
+      license
+      downloadsLastMonth
+      downloadsTotal
+      githubRepository {
+        stargazersCount
+        forksCount
+        openIssuesCount
+        archived
+        language
+        topics
+        pushedAt
+      }
+    }
+    security {
+      vulnerabilityCount
+      hasCurrentVulnerabilities
+      recentVulnerabilities {
+        osvId
+        summary
+        severityScore
+        publishedAt
+      }
+    }
+    quickstart {
+      installCommand
+      usageExample
+    }
+    latestChangelogs(limit: 3) {
+      version
+      publishedAt
+      body
+    }
+  }
+}`;
+var packageVersionIdentitySchema = z2.object({
+  name: z2.string().nullable().optional(),
+  registry: z2.string().nullable().optional(),
+  version: z2.string().nullable().optional()
+});
+var vulnerabilityDetailSchema = z2.object({
+  osvId: z2.string().nullable().optional(),
+  summary: z2.string().nullable().optional(),
+  severityScore: z2.number().nullable().optional(),
+  severityType: z2.string().nullable().optional(),
+  affectedVersionRanges: z2.array(z2.string()).nullable().optional(),
+  fixedInVersions: z2.array(z2.string()).nullable().optional(),
+  publishedAt: z2.string().nullable().optional(),
+  modifiedAt: z2.string().nullable().optional(),
+  withdrawnAt: z2.string().nullable().optional(),
+  aliases: z2.array(z2.string()).nullable().optional(),
+  isMalicious: z2.boolean().nullable().optional()
+});
+var vulnerabilitySecurityDetailsSchema = z2.object({
+  vulnerabilityCount: z2.number().int().nullable().optional(),
+  currentVersionAffected: z2.boolean().nullable().optional(),
+  vulnerabilities: z2.array(vulnerabilityDetailSchema).nullable().optional(),
+  upgradePaths: z2.array(z2.string()).nullable().optional()
+}).nullable().optional();
+var vulnerabilityReportResponseSchema = z2.object({
+  package: packageVersionIdentitySchema.nullable().optional(),
+  security: vulnerabilitySecurityDetailsSchema
+});
+var vulnerabilitiesGraphQLResponseSchema = z2.object({
+  data: z2.object({
+    packageVulnerabilities: vulnerabilityReportResponseSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z2.array(graphQLErrorSchema2).optional()
+});
+var PACKAGE_VULNERABILITIES_QUERY = `
+query PackageVulnerabilities(
+  $registry: Registry!
+  $name: String!
+  $version: String
+  $minSeverity: Float
+  $includeWithdrawn: Boolean
+) {
+  packageVulnerabilities(
+    registry: $registry
+    name: $name
+    version: $version
+    minSeverity: $minSeverity
+    includeWithdrawn: $includeWithdrawn
+  ) {
+    package {
+      name
+      registry
+      version
+    }
+    security {
+      vulnerabilityCount
+      currentVersionAffected
+      upgradePaths
+      vulnerabilities {
+        osvId
+        summary
+        severityScore
+        severityType
+        affectedVersionRanges
+        fixedInVersions
+        publishedAt
+        modifiedAt
+        withdrawnAt
+        aliases
+        isMalicious
+      }
+    }
+  }
+}`;
+var directDependencySchema = z2.object({
+  name: z2.string().nullable().optional(),
+  versionConstraint: z2.string().nullable().optional(),
+  type: z2.string().nullable().optional()
+});
+var dependencyGraphNodeSchema = z2.object({
+  registry: z2.string(),
+  name: z2.string(),
+  version: z2.string().nullable().optional()
+});
+var dependencyGraphEdgeSchema = z2.object({
+  fromIndex: z2.number().int().nullable().optional(),
+  toIndex: z2.number().int(),
+  constraint: z2.string().nullable().optional(),
+  dependencyType: z2.string().nullable().optional()
+});
+var dependencyGraphSchema = z2.object({
+  formatVersion: z2.number().int(),
+  nodes: z2.array(dependencyGraphNodeSchema),
+  edges: z2.array(dependencyGraphEdgeSchema)
+});
+var dependencyConflictEdgeSchema = z2.object({
+  fromIndex: z2.number().int().nullable().optional(),
+  toIndex: z2.number().int(),
+  versionConstraint: z2.string(),
+  dependencyType: z2.string()
+});
+var dependencyConflictSchema = z2.object({
+  packageName: z2.string(),
+  requiredVersions: z2.array(z2.string()),
+  conflictingEdges: z2.array(dependencyConflictEdgeSchema)
+});
+var circularDependencyCycleSchema = z2.object({
+  cycleStart: z2.string(),
+  circularPath: z2.array(z2.string()),
+  displayChain: z2.string()
+});
+var environmentMarkerSchema = z2.object({
+  type: z2.string().nullable().optional(),
+  value: z2.string().nullable().optional(),
+  raw: z2.string().nullable().optional()
+});
+var transitiveDependencySchema = z2.object({
+  totalEdges: z2.number().int().nullable().optional(),
+  uniquePackagesCount: z2.number().int().nullable().optional(),
+  uniqueDependencies: z2.array(z2.string()).nullable().optional(),
+  dependencyConflicts: z2.array(dependencyConflictSchema).nullable().optional(),
+  circularDependencyCycles: z2.array(circularDependencyCycleSchema).nullable().optional(),
+  dependencyGraph: dependencyGraphSchema.nullable().optional()
+}).nullable().optional();
+var dependencyBundleSchema = z2.object({
+  direct: z2.array(directDependencySchema).nullable().optional(),
+  transitive: transitiveDependencySchema
+}).nullable().optional();
+var groupDependencySchema = z2.object({
+  name: z2.string(),
+  constraint: z2.string().nullable().optional()
+});
+var dependencyGroupSchema = z2.object({
+  name: z2.string(),
+  lifecycle: z2.string(),
+  conditionType: z2.string(),
+  conditionValue: z2.string().nullable().optional(),
+  selectionMode: z2.string(),
+  exclusiveGroup: z2.string().nullable().optional(),
+  fallbackPriority: z2.number().int().nullable().optional(),
+  compatibleWith: z2.array(z2.string()).nullable().optional(),
+  defaultEnabled: z2.boolean().nullable().optional(),
+  dependencies: z2.array(groupDependencySchema)
+});
+var dependencyGroupsInfoSchema = z2.object({
+  primaryGroup: z2.string().nullable().optional(),
+  environmentMarkers: z2.array(environmentMarkerSchema).nullable().optional(),
+  groups: z2.array(dependencyGroupSchema)
+}).nullable().optional();
+var dependencyReportResponseSchema = z2.object({
+  package: packageVersionIdentitySchema.nullable().optional(),
+  dependencies: dependencyBundleSchema,
+  dependencyGroups: dependencyGroupsInfoSchema
+});
+var dependenciesGraphQLResponseSchema = z2.object({
+  data: z2.object({
+    packageDependencies: dependencyReportResponseSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z2.array(graphQLErrorSchema2).optional()
+});
+var PACKAGE_DEPENDENCIES_QUERY = `
+query PackageDependencies(
+  $registry: Registry!
+  $name: String!
+  $version: String
+  $includeTransitive: Boolean
+  $maxDepth: Int
+  $lifecycle: [String!]
+) {
+  packageDependencies(
+    registry: $registry
+    name: $name
+    version: $version
+    includeTransitive: $includeTransitive
+    maxDepth: $maxDepth
+    lifecycle: $lifecycle
+  ) {
+    package {
+      name
+      registry
+      version
+    }
+    dependencies {
+      # Backend-side summary block intentionally not selected — our
+      # envelope computes runtime.count client-side from direct[].length
+      # so the invariant runtime.count === runtime.items.length always
+      # holds regardless of backend-side drift.
+      direct {
+        name
+        versionConstraint
+        type
+      }
+      transitive {
+        totalEdges
+        uniquePackagesCount
+        uniqueDependencies
+        dependencyConflicts {
+          packageName
+          requiredVersions
+          conflictingEdges {
+            fromIndex
+            toIndex
+            versionConstraint
+            dependencyType
+          }
+        }
+        circularDependencyCycles {
+          cycleStart
+          circularPath
+          displayChain
+        }
+        dependencyGraph {
+          formatVersion
+          nodes {
+            registry
+            name
+            version
+          }
+          edges {
+            fromIndex
+            toIndex
+            constraint
+            dependencyType
+          }
+        }
+      }
+    }
+    dependencyGroups {
+      primaryGroup
+      environmentMarkers {
+        type
+        value
+        raw
+      }
+      groups {
+        name
+        lifecycle
+        conditionType
+        conditionValue
+        selectionMode
+        exclusiveGroup
+        fallbackPriority
+        compatibleWith
+        defaultEnabled
+        dependencies {
+          name
+          constraint
+        }
+      }
+    }
+  }
+}`;
+var changelogPackageInfoSchema = z2.object({
+  name: z2.string().nullable().optional(),
+  registry: z2.string().nullable().optional(),
+  repoUrl: z2.string().nullable().optional(),
+  fromVersion: z2.string().nullable().optional(),
+  toVersion: z2.string().nullable().optional(),
+  limit: z2.number().int().nullable().optional()
+}).nullable().optional();
+var changelogEntryDetailSchema = z2.object({
+  version: z2.string().nullable().optional(),
+  normalizedVersion: z2.string().nullable().optional(),
+  body: z2.string().nullable().optional(),
+  htmlUrl: z2.string().nullable().optional(),
+  publishedAt: z2.string().nullable().optional(),
+  metadata: z2.unknown().nullable().optional()
+});
+var changelogReportResponseSchema = z2.object({
+  package: changelogPackageInfoSchema,
+  source: z2.string().nullable().optional(),
+  entries: z2.array(changelogEntryDetailSchema).nullable().optional()
+});
+var changelogGraphQLResponseSchema = z2.object({
+  data: z2.object({
+    packageChangelog: changelogReportResponseSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z2.array(graphQLErrorSchema2).optional()
+});
+var PACKAGE_CHANGELOG_QUERY = `
+query PackageChangelog(
+  $registry: Registry
+  $name: String
+  $repoUrl: String
+  $gitRef: String
+  $fromVersion: String
+  $toVersion: String
+  $limit: Int
+) {
+  packageChangelog(
+    registry: $registry
+    name: $name
+    repoUrl: $repoUrl
+    gitRef: $gitRef
+    fromVersion: $fromVersion
+    toVersion: $toVersion
+    limit: $limit
+  ) {
+    package {
+      name
+      registry
+      repoUrl
+      fromVersion
+      toVersion
+      limit
+    }
+    source
+    entries {
+      version
+      normalizedVersion
+      body
+      htmlUrl
+      publishedAt
+      metadata
+    }
+  }
+}`;
+var packageDocSourceKindSchema = z2.enum(["CRAWLED", "REPOSITORY"]);
+var packageDocPageSummarySchema = z2.object({
+  id: z2.string().nullable().optional(),
+  title: z2.string().nullable().optional(),
+  slug: z2.string().nullable().optional(),
+  order: z2.number().int().nullable().optional(),
+  linkName: z2.string().nullable().optional(),
+  lastUpdatedAt: z2.string().nullable().optional(),
+  sourceKind: packageDocSourceKindSchema.nullable().optional(),
+  sourceUrl: z2.string().nullable().optional(),
+  repoUrl: z2.string().nullable().optional(),
+  gitRef: z2.string().nullable().optional(),
+  requestedRef: z2.string().nullable().optional(),
+  filePath: z2.string().nullable().optional()
+});
+var packageDocsPageInfoSchema = z2.object({
+  hasNextPage: z2.boolean(),
+  endCursor: z2.string().nullable().optional(),
+  totalCount: z2.number().int().nullable().optional()
+}).nullable().optional();
+var packageDocsListResponseSchema = z2.object({
+  registry: z2.string().nullable().optional(),
+  packageName: z2.string().nullable().optional(),
+  version: z2.string().nullable().optional(),
+  stale: z2.boolean().nullable().optional(),
+  pages: z2.array(packageDocPageSummarySchema).nullable().optional(),
+  pageInfo: packageDocsPageInfoSchema
+});
+var packageDocSourceSchema = z2.object({
+  url: z2.string().nullable().optional(),
+  label: z2.string().nullable().optional()
+}).nullable().optional();
+var packageDocPageSchema = z2.object({
+  id: z2.string().nullable().optional(),
+  title: z2.string().nullable().optional(),
+  content: z2.string().nullable().optional(),
+  contentFormat: z2.string().nullable().optional(),
+  breadcrumbs: z2.array(z2.string()).nullable().optional(),
+  linkName: z2.string().nullable().optional(),
+  lastUpdatedAt: z2.string().nullable().optional(),
+  sourceKind: packageDocSourceKindSchema.nullable().optional(),
+  source: packageDocSourceSchema,
+  repoUrl: z2.string().nullable().optional(),
+  gitRef: z2.string().nullable().optional(),
+  requestedRef: z2.string().nullable().optional(),
+  filePath: z2.string().nullable().optional(),
+  baseUrl: z2.string().nullable().optional()
+}).nullable().optional();
+var packageDocResultResponseSchema = z2.object({
+  registry: z2.string().nullable().optional(),
+  packageName: z2.string().nullable().optional(),
+  version: z2.string().nullable().optional(),
+  sourceKind: packageDocSourceKindSchema.nullable().optional(),
+  page: packageDocPageSchema
+});
+var packageDocsListGraphQLResponseSchema = z2.object({
+  data: z2.object({
+    listPackageDocs: packageDocsListResponseSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z2.array(graphQLErrorSchema2).optional()
+});
+var packageDocReadGraphQLResponseSchema = z2.object({
+  data: z2.object({
+    getDocPage: packageDocResultResponseSchema.nullable().optional()
+  }).nullable().optional(),
+  errors: z2.array(graphQLErrorSchema2).optional()
+});
+var LIST_PACKAGE_DOCS_QUERY = `
+query ListPackageDocs(
+  $registry: Registry!
+  $packageName: String!
+  $version: String
+  $limit: Int
+  $after: String
+) {
+  listPackageDocs(
+    registry: $registry
+    packageName: $packageName
+    version: $version
+    limit: $limit
+    after: $after
+  ) {
+    registry
+    packageName
+    version
+    stale
+    pages {
+      id
+      title
+      slug
+      order
+      linkName
+      lastUpdatedAt
+      sourceKind
+      sourceUrl
+      repoUrl
+      gitRef
+      requestedRef
+      filePath
+    }
+    pageInfo {
+      hasNextPage
+      endCursor
+      totalCount
+    }
+  }
+}`;
+var READ_PACKAGE_DOC_QUERY = `
+query ReadPackageDoc($pageId: String!) {
+  getDocPage(pageId: $pageId) {
+    registry
+    packageName
+    version
+    sourceKind
+    page {
+      id
+      title
+      content
+      contentFormat
+      breadcrumbs
+      linkName
+      lastUpdatedAt
+      sourceKind
+      source {
+        url
+        label
+      }
+      repoUrl
+      gitRef
+      requestedRef
+      filePath
+      baseUrl
+    }
+  }
+}`;
+
+class PackageIntelligenceServiceImpl {
+  endpointUrl;
+  tokenProvider;
+  fetchFn;
+  constructor(endpointUrl, tokenProvider, fetchFn = globalThis.fetch) {
+    this.endpointUrl = endpointUrl;
+    this.tokenProvider = tokenProvider;
+    this.fetchFn = fetchFn;
+  }
+  async packageSummary(params) {
+    return withTelemetrySpan("pkg-intel.summary.request", () => executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executePackageSummary(token, params)
+    }));
+  }
+  async executePackageSummary(token, params) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.endpointUrl,
+        token,
+        query: PACKAGE_SUMMARY_QUERY,
+        variables: {
+          registry: params.registry,
+          name: params.packageName
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new PackageIntelligenceNetworkError("Could not reach the package intelligence service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = graphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedPackageIntelligenceResponseError("Malformed response from the package-intelligence service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw this.createGraphQLError(parsed.data.errors);
+    }
+    const data = parsed.data.data?.packageSummary;
+    if (!data) {
+      throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
+    }
+    return this.normalise(data);
+  }
+  createHttpError(response) {
+    const status = response.status;
+    const detail = parseDetail3(response.responseBody);
+    if (status === 401) {
+      return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+    }
+    if (status === 403) {
+      return new PackageIntelligenceAccessError(detail ?? "Access denied.");
+    }
+    if (status >= 500) {
+      return new PackageIntelligenceBackendError(detail ? `Server error (${status}): ${detail}` : `Server error (${status})`, status);
+    }
+    return new PackageIntelligenceBackendError(detail ?? `Request failed with status ${status}`, status);
+  }
+  createGraphQLError(errors) {
+    const message = errors.map((error) => error.message).join(", ");
+    const extensions = getPrimaryExtensions2(errors);
+    const code = typeof extensions?.code === "string" ? extensions.code : undefined;
+    const retryable = typeof extensions?.retryable === "boolean" ? extensions.retryable : undefined;
+    switch (code) {
+      case "NOT_FOUND":
+      case "PACKAGE_NOT_FOUND":
+        return new PackageIntelligenceTargetNotFoundError(message);
+      case "VERSION_NOT_FOUND":
+        return new PackageIntelligenceVersionNotFoundError(message, typeof extensions?.package === "string" ? extensions.package : undefined, typeof extensions?.requested_version === "string" ? extensions.requested_version : undefined, parseVersionList(extensions?.available_versions ?? extensions?.availableVersions));
+      case "UNSUPPORTED_REGISTRY":
+      case "VALIDATION_ERROR":
+        return new PackageIntelligenceValidationError(message);
+      case "FEATURE_FLAG_REQUIRED":
+        return new PackageIntelligenceFeatureFlagRequiredError(message);
+      case "UNAUTHORIZED":
+        return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+      case "FORBIDDEN":
+        return new PackageIntelligenceAccessError("Access denied. This feature may not be enabled for your account.");
+      case "UPSTREAM_ERROR":
+      case "TIMEOUT":
+      case "RATE_LIMITED":
+      case "INTERNAL_ERROR":
+      case "UNKNOWN_ERROR":
+        return new PackageIntelligenceBackendError(message, undefined, code, retryable);
+      default:
+        break;
+    }
+    return new PackageIntelligenceBackendError(message, undefined, code, retryable);
+  }
+  normalise(data) {
+    const name = data.package?.name ?? undefined;
+    const latestVersion = data.package?.latestVersion ?? undefined;
+    if (!name || !latestVersion) {
+      throw new MalformedPackageIntelligenceResponseError("Package summary response missing required name/latestVersion.");
+    }
+    const pkg = data.package;
+    const github = pkg?.githubRepository;
+    const identity = {
+      name,
+      latestVersion,
+      registry: pkg?.registry ?? undefined,
+      description: pkg?.description ?? undefined,
+      latestVersionPublishedAt: pkg?.latestVersionPublishedAt ?? undefined,
+      homepage: pkg?.homepage ?? undefined,
+      repositoryUrl: pkg?.repositoryUrl ?? undefined,
+      license: pkg?.license ?? undefined,
+      downloadsLastMonth: pkg?.downloadsLastMonth ?? undefined,
+      downloadsTotal: pkg?.downloadsTotal ?? undefined,
+      githubRepository: github ? {
+        stargazersCount: github.stargazersCount ?? undefined,
+        forksCount: github.forksCount ?? undefined,
+        openIssuesCount: github.openIssuesCount ?? undefined,
+        archived: github.archived ?? undefined,
+        language: github.language ?? undefined,
+        topics: github.topics ?? undefined,
+        pushedAt: github.pushedAt ?? undefined
+      } : undefined
+    };
+    const security = data.security ? {
+      vulnerabilityCount: data.security.vulnerabilityCount ?? undefined,
+      hasCurrentVulnerabilities: data.security.hasCurrentVulnerabilities ?? undefined,
+      recentVulnerabilities: data.security.recentVulnerabilities?.map((vuln) => ({
+        osvId: vuln.osvId ?? undefined,
+        summary: vuln.summary ?? undefined,
+        severityScore: vuln.severityScore ?? undefined,
+        publishedAt: vuln.publishedAt ?? undefined
+      })) ?? undefined
+    } : undefined;
+    const quickstart = data.quickstart ? {
+      installCommand: data.quickstart.installCommand ?? undefined,
+      usageExample: data.quickstart.usageExample ?? undefined
+    } : undefined;
+    const latestChangelogs = data.latestChangelogs?.map((entry) => ({
+      version: entry.version ?? undefined,
+      publishedAt: entry.publishedAt ?? undefined,
+      body: entry.body ?? undefined
+    })) ?? undefined;
+    return {
+      package: identity,
+      security,
+      quickstart,
+      latestChangelogs
+    };
+  }
+  async packageVulnerabilities(params) {
+    return withTelemetrySpan("pkg-intel.vulnerabilities.request", () => executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executePackageVulnerabilities(token, params)
+    }));
+  }
+  async executePackageVulnerabilities(token, params) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.endpointUrl,
+        token,
+        query: PACKAGE_VULNERABILITIES_QUERY,
+        variables: {
+          registry: params.registry,
+          name: params.packageName,
+          version: params.version,
+          minSeverity: params.minSeverity,
+          includeWithdrawn: params.includeWithdrawn
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new PackageIntelligenceNetworkError("Could not reach the package intelligence service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = vulnerabilitiesGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedPackageIntelligenceResponseError("Malformed response from the package-intelligence service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw promoteGenericVersionNotFound(this.createGraphQLError(parsed.data.errors), params);
+    }
+    const data = parsed.data.data?.packageVulnerabilities;
+    if (!data) {
+      throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
+    }
+    return this.normaliseVulnerabilityReport(data);
+  }
+  normaliseVulnerabilityReport(data) {
+    const name = data.package?.name ?? undefined;
+    const version2 = data.package?.version ?? undefined;
+    if (!name || !version2) {
+      throw new MalformedPackageIntelligenceResponseError("Vulnerability report response missing required name/version.");
+    }
+    const identity = {
+      name,
+      version: version2,
+      registry: data.package?.registry ?? undefined
+    };
+    const security = data.security ? {
+      vulnerabilityCount: data.security.vulnerabilityCount ?? undefined,
+      currentVersionAffected: data.security.currentVersionAffected ?? undefined,
+      vulnerabilities: data.security.vulnerabilities?.map((vuln) => ({
+        osvId: vuln.osvId ?? undefined,
+        summary: vuln.summary ?? undefined,
+        severityScore: vuln.severityScore ?? undefined,
+        severityType: vuln.severityType ?? undefined,
+        affectedVersionRanges: vuln.affectedVersionRanges ?? undefined,
+        fixedInVersions: vuln.fixedInVersions ?? undefined,
+        publishedAt: vuln.publishedAt ?? undefined,
+        modifiedAt: vuln.modifiedAt ?? undefined,
+        withdrawnAt: vuln.withdrawnAt ?? undefined,
+        aliases: vuln.aliases ?? undefined,
+        isMalicious: vuln.isMalicious ?? undefined
+      })) ?? undefined,
+      upgradePaths: data.security.upgradePaths ?? undefined
+    } : undefined;
+    return {
+      package: identity,
+      security
+    };
+  }
+  async packageDependencies(params) {
+    return withTelemetrySpan("pkg-intel.dependencies.request", () => executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executePackageDependencies(token, params)
+    }));
+  }
+  async executePackageDependencies(token, params) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.endpointUrl,
+        token,
+        query: PACKAGE_DEPENDENCIES_QUERY,
+        variables: {
+          registry: params.registry,
+          name: params.packageName,
+          version: params.version,
+          includeTransitive: params.includeTransitive,
+          maxDepth: params.maxDepth,
+          lifecycle: params.lifecycle && params.lifecycle.length > 0 ? params.lifecycle : undefined
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new PackageIntelligenceNetworkError("Could not reach the package intelligence service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = dependenciesGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedPackageIntelligenceResponseError("Malformed response from the package-intelligence service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw promoteGenericVersionNotFound(this.createGraphQLError(parsed.data.errors), params);
+    }
+    const data = parsed.data.data?.packageDependencies;
+    if (!data) {
+      throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
+    }
+    return this.normaliseDependencyReport(data);
+  }
+  normaliseDependencyReport(data) {
+    const name = data.package?.name ?? undefined;
+    const version2 = data.package?.version ?? undefined;
+    if (!name || !version2) {
+      throw new MalformedPackageIntelligenceResponseError("Package dependencies response missing required name/version.");
+    }
+    const identity = {
+      name,
+      version: version2,
+      registry: data.package?.registry ?? undefined
+    };
+    const bundle = data.dependencies;
+    const dependencies = bundle ? {
+      direct: bundle.direct?.map((entry) => {
+        if (!entry.name) {
+          throw new MalformedPackageIntelligenceResponseError("Dependency entry missing required name.");
+        }
+        return {
+          name: entry.name,
+          versionConstraint: entry.versionConstraint ?? undefined,
+          type: entry.type ?? undefined
+        };
+      }) ?? undefined,
+      transitive: bundle.transitive ? {
+        totalEdges: bundle.transitive.totalEdges ?? undefined,
+        uniquePackagesCount: bundle.transitive.uniquePackagesCount ?? undefined,
+        uniqueDependencies: bundle.transitive.uniqueDependencies ?? undefined,
+        dependencyConflicts: bundle.transitive.dependencyConflicts?.map((c) => ({
+          packageName: c.packageName,
+          requiredVersions: c.requiredVersions,
+          conflictingEdges: c.conflictingEdges.map((edge) => ({
+            fromIndex: edge.fromIndex ?? undefined,
+            toIndex: edge.toIndex,
+            versionConstraint: edge.versionConstraint,
+            dependencyType: edge.dependencyType
+          }))
+        })) ?? undefined,
+        circularDependencyCycles: bundle.transitive.circularDependencyCycles?.map((cycle) => ({
+          cycleStart: cycle.cycleStart,
+          circularPath: cycle.circularPath,
+          displayChain: cycle.displayChain
+        })) ?? undefined,
+        dependencyGraph: bundle.transitive.dependencyGraph ? {
+          formatVersion: bundle.transitive.dependencyGraph.formatVersion,
+          nodes: bundle.transitive.dependencyGraph.nodes.map((n) => ({
+            registry: n.registry,
+            name: n.name,
+            version: n.version ?? undefined
+          })),
+          edges: bundle.transitive.dependencyGraph.edges.map((e) => ({
+            fromIndex: e.fromIndex ?? undefined,
+            toIndex: e.toIndex,
+            constraint: e.constraint ?? undefined,
+            dependencyType: e.dependencyType ?? undefined
+          }))
+        } : undefined
+      } : undefined
+    } : undefined;
+    const dependencyGroups = data.dependencyGroups ? {
+      primaryGroup: data.dependencyGroups.primaryGroup ?? undefined,
+      environmentMarkers: data.dependencyGroups.environmentMarkers?.map((m) => ({
+        type: m.type ?? undefined,
+        value: m.value ?? undefined,
+        raw: m.raw ?? undefined
+      })) ?? undefined,
+      groups: data.dependencyGroups.groups.map((group) => ({
+        name: group.name,
+        lifecycle: group.lifecycle,
+        conditionType: group.conditionType,
+        conditionValue: group.conditionValue ?? undefined,
+        selectionMode: group.selectionMode,
+        exclusiveGroup: group.exclusiveGroup ?? undefined,
+        fallbackPriority: group.fallbackPriority ?? undefined,
+        compatibleWith: group.compatibleWith ?? undefined,
+        defaultEnabled: group.defaultEnabled ?? undefined,
+        dependencies: group.dependencies.map((entry) => ({
+          name: entry.name,
+          constraint: entry.constraint ?? undefined
+        }))
+      }))
+    } : undefined;
+    return {
+      package: identity,
+      dependencies,
+      dependencyGroups
+    };
+  }
+  async packageChangelog(params) {
+    return withTelemetrySpan("pkg-intel.changelog.request", () => executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executePackageChangelog(token, params)
+    }));
+  }
+  async executePackageChangelog(token, params) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.endpointUrl,
+        token,
+        query: PACKAGE_CHANGELOG_QUERY,
+        variables: {
+          registry: params.registry,
+          name: params.packageName,
+          repoUrl: params.repoUrl,
+          gitRef: params.gitRef,
+          fromVersion: params.fromVersion,
+          toVersion: params.toVersion,
+          limit: params.limit
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new PackageIntelligenceNetworkError("Could not reach the package intelligence service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = changelogGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedPackageIntelligenceResponseError("Malformed response from the package-intelligence service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw promoteGenericVersionNotFound(this.createGraphQLError(parsed.data.errors), params);
+    }
+    const data = parsed.data.data?.packageChangelog;
+    if (!data) {
+      throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
+    }
+    return this.normaliseChangelogReport(data, params);
+  }
+  normaliseChangelogReport(data, params) {
+    const source = data.source ?? undefined;
+    if (!source) {
+      const target = params.repoUrl ?? (params.registry && params.packageName ? `${params.registry.toLowerCase()}:${params.packageName}` : "package");
+      throw new PackageIntelligenceChangelogSourceNotFoundError(`No changelog source available for ${target} (tried GitHub Releases, CHANGELOG.md, and HexDocs).`);
+    }
+    const rawEntries = data.entries ?? [];
+    const entries = rawEntries.map((entry) => ({
+      version: entry.version ?? undefined,
+      normalizedVersion: entry.normalizedVersion ?? undefined,
+      body: entry.body ?? undefined,
+      htmlUrl: entry.htmlUrl ?? undefined,
+      publishedAt: entry.publishedAt ?? undefined,
+      metadata: entry.metadata ?? undefined
+    }));
+    const packageInfo = data.package ? {
+      name: data.package.name ?? undefined,
+      registry: data.package.registry ?? undefined,
+      repoUrl: data.package.repoUrl ?? undefined,
+      fromVersion: data.package.fromVersion ?? undefined,
+      toVersion: data.package.toVersion ?? undefined,
+      limit: data.package.limit ?? undefined
+    } : undefined;
+    return {
+      package: packageInfo,
+      source,
+      entries
+    };
+  }
+  async listPackageDocs(params) {
+    return withTelemetrySpan("pkg-intel.docs.list", () => executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executeListPackageDocs(token, params)
+    }));
+  }
+  async executeListPackageDocs(token, params) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.endpointUrl,
+        token,
+        query: LIST_PACKAGE_DOCS_QUERY,
+        variables: {
+          registry: params.registry,
+          packageName: params.packageName,
+          version: params.version,
+          limit: params.limit,
+          after: params.after
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new PackageIntelligenceNetworkError("Could not reach the package intelligence service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = packageDocsListGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedPackageIntelligenceResponseError("Malformed response from the package-intelligence service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw promoteGenericVersionNotFound(this.createGraphQLError(parsed.data.errors), params);
+    }
+    const data = parsed.data.data?.listPackageDocs;
+    if (!data) {
+      throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
+    }
+    return this.normalisePackageDocsList(data);
+  }
+  normalisePackageDocsList(data) {
+    return {
+      registry: data.registry ?? undefined,
+      packageName: data.packageName ?? undefined,
+      version: data.version ?? undefined,
+      stale: data.stale ?? undefined,
+      pages: data.pages?.map((page) => ({
+        id: page.id ?? undefined,
+        title: page.title ?? undefined,
+        slug: page.slug ?? undefined,
+        order: page.order ?? undefined,
+        linkName: page.linkName ?? undefined,
+        lastUpdatedAt: page.lastUpdatedAt ?? undefined,
+        sourceKind: page.sourceKind ?? undefined,
+        sourceUrl: page.sourceUrl ?? undefined,
+        repoUrl: page.repoUrl ?? undefined,
+        gitRef: page.gitRef ?? undefined,
+        requestedRef: page.requestedRef ?? undefined,
+        filePath: page.filePath ?? undefined
+      })) ?? [],
+      pageInfo: data.pageInfo ? {
+        hasNextPage: data.pageInfo.hasNextPage,
+        endCursor: data.pageInfo.endCursor ?? undefined,
+        totalCount: data.pageInfo.totalCount ?? undefined
+      } : undefined
+    };
+  }
+  async readPackageDoc(params) {
+    return withTelemetrySpan("pkg-intel.docs.read", () => executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executeReadPackageDoc(token, params)
+    }));
+  }
+  async executeReadPackageDoc(token, params) {
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.endpointUrl,
+        token,
+        query: READ_PACKAGE_DOC_QUERY,
+        variables: {
+          pageId: params.pageId
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new PackageIntelligenceNetworkError("Could not reach the package intelligence service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = packageDocReadGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedPackageIntelligenceResponseError("Malformed response from the package-intelligence service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw this.createGraphQLError(parsed.data.errors);
+    }
+    const data = parsed.data.data?.getDocPage;
+    if (!data) {
+      throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
+    }
+    return this.normalisePackageDocResult(data);
+  }
+  normalisePackageDocResult(data) {
+    return {
+      registry: data.registry ?? undefined,
+      packageName: data.packageName ?? undefined,
+      version: data.version ?? undefined,
+      sourceKind: data.sourceKind ?? undefined,
+      page: data.page ? {
+        id: data.page.id ?? undefined,
+        title: data.page.title ?? undefined,
+        content: data.page.content ?? undefined,
+        contentFormat: data.page.contentFormat ?? undefined,
+        breadcrumbs: data.page.breadcrumbs ?? undefined,
+        linkName: data.page.linkName ?? undefined,
+        lastUpdatedAt: data.page.lastUpdatedAt ?? undefined,
+        sourceKind: data.page.sourceKind ?? undefined,
+        source: data.page.source ? {
+          url: data.page.source.url ?? undefined,
+          label: data.page.source.label ?? undefined
+        } : undefined,
+        repoUrl: data.page.repoUrl ?? undefined,
+        gitRef: data.page.gitRef ?? undefined,
+        requestedRef: data.page.requestedRef ?? undefined,
+        filePath: data.page.filePath ?? undefined,
+        baseUrl: data.page.baseUrl ?? undefined
+      } : undefined
+    };
+  }
+}
+function parseDetail3(body) {
+  if (!body)
+    return;
+  try {
+    const parsed = JSON.parse(body);
+    if (typeof parsed.detail === "string")
+      return parsed.detail;
+    if (typeof parsed.error === "string")
+      return parsed.error;
+  } catch {
+    return body;
+  }
+  return;
+}
+function getPrimaryExtensions2(errors) {
+  for (const error of errors) {
+    if (error.extensions && Object.keys(error.extensions).length > 0) {
+      return error.extensions;
+    }
+  }
+  return;
+}
+function parseVersionList(raw) {
+  if (!Array.isArray(raw))
+    return;
+  const versions = [];
+  for (const item of raw) {
+    if (typeof item === "string" && item.length > 0) {
+      versions.push(item);
+    }
+  }
+  return versions.length > 0 ? versions : undefined;
+}
+// src/services/prompt-service.ts
+import { checkbox, select } from "@inquirer/prompts";
+
+class PromptServiceImpl {
+  async checkbox(message, choices) {
+    return checkbox({ message, choices });
+  }
+  async confirm3(message) {
+    return select({
+      message,
+      choices: [
+        { value: "yes", name: "Yes" },
+        { value: "no", name: "No" },
+        {
+          value: "always",
+          name: "Yes to all",
+          description: "Skip confirmation for remaining agents"
+        }
+      ]
+    });
+  }
+}
+// src/services/refreshing-githits-service.ts
+class RefreshingGitHitsService {
+  apiUrl;
+  tokenProvider;
+  serviceFactory;
+  constructor(apiUrl, tokenProvider, serviceFactory = (url, token) => new GitHitsServiceImpl(url, token)) {
+    this.apiUrl = apiUrl;
+    this.tokenProvider = tokenProvider;
+    this.serviceFactory = serviceFactory;
+  }
+  async search(params) {
+    return this.withTokenRefresh((service) => service.search(params));
+  }
+  async getLanguages() {
+    return this.withTokenRefresh((service) => service.getLanguages());
+  }
+  async submitFeedback(params) {
+    return this.withTokenRefresh((service) => service.submitFeedback(params));
+  }
+  async withTokenRefresh(operation) {
+    return executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: async (token) => {
+        const service = this.serviceFactory(this.apiUrl, token);
+        return operation(service);
+      }
+    });
+  }
+}
+// src/services/token-manager.ts
+var PROACTIVE_REFRESH_RATIO = 0.9;
+function shouldRefreshToken(token, ratio, now) {
+  if (!token.expiresAt) {
+    return { expired: false, shouldRefresh: false };
+  }
+  const expiresAt = new Date(token.expiresAt).getTime();
+  const nowMs = now.getTime();
+  if (nowMs >= expiresAt) {
+    return { expired: true, shouldRefresh: true };
+  }
+  const createdAt = new Date(token.createdAt).getTime();
+  const lifetime = expiresAt - createdAt;
+  if (lifetime <= 0) {
+    return { expired: false, shouldRefresh: false };
+  }
+  const threshold = createdAt + lifetime * ratio;
+  return { expired: false, shouldRefresh: nowMs >= threshold };
+}
+async function refreshExpiredToken(authService, authStorage, mcpUrl) {
+  const manager = new TokenManager({ authService, authStorage, mcpUrl });
+  return manager.forceRefresh();
+}
+
+class TokenManager {
+  authService;
+  authStorage;
+  mcpUrl;
+  cachedToken = null;
+  refreshPromise = null;
+  constructor(deps) {
+    this.authService = deps.authService;
+    this.authStorage = deps.authStorage;
+    this.mcpUrl = deps.mcpUrl;
+  }
+  async getToken() {
+    return withTelemetrySpan("token-manager.get-token", async () => {
+      if (!this.cachedToken) {
+        this.cachedToken = await withTelemetrySpan("token-manager.load-tokens", () => this.authStorage.loadTokens(this.mcpUrl));
+        if (!this.cachedToken)
+          return;
+      }
+      const currentToken = this.cachedToken.accessToken;
+      const { expired, shouldRefresh } = shouldRefreshToken(this.cachedToken, PROACTIVE_REFRESH_RATIO, new Date);
+      if (!shouldRefresh) {
+        return currentToken;
+      }
+      const refreshedToken = await this.doRefresh();
+      if (refreshedToken) {
+        return refreshedToken;
+      }
+      if (!expired) {
+        return currentToken;
+      }
+      return;
+    });
+  }
+  async forceRefresh() {
+    return withTelemetrySpan("token-manager.force-refresh", () => this.doRefresh());
+  }
+  async doRefresh() {
+    if (this.refreshPromise) {
+      return this.refreshPromise;
+    }
+    this.refreshPromise = this.executeRefresh();
+    try {
+      return await this.refreshPromise;
+    } finally {
+      this.refreshPromise = null;
+    }
+  }
+  async executeRefresh() {
+    return withTelemetrySpan("token-manager.refresh", async () => {
+      const tokens = this.cachedToken ?? await withTelemetrySpan("token-manager.load-tokens", () => this.authStorage.loadTokens(this.mcpUrl));
+      if (!tokens)
+        return;
+      const client = await withTelemetrySpan("token-manager.load-client", () => this.authStorage.loadClient(this.mcpUrl));
+      if (!client)
+        return;
+      let response;
+      try {
+        const metadata = await withTelemetrySpan("token-manager.discover-endpoints", () => this.authService.discoverEndpoints(this.mcpUrl));
+        response = await withTelemetrySpan("token-manager.refresh-access-token", () => this.authService.refreshAccessToken({
+          tokenEndpoint: metadata.tokenEndpoint,
+          clientId: client.clientId,
+          clientSecret: client.clientSecret,
+          refreshToken: tokens.refreshToken
+        }));
+      } catch {
+        const isExpired = tokens.expiresAt ? new Date >= new Date(tokens.expiresAt) : false;
+        if (isExpired) {
+          this.cachedToken = null;
+          await withTelemetrySpan("token-manager.clear-tokens", () => this.authStorage.clearTokens(this.mcpUrl));
+        }
+        return;
+      }
+      const newTokenData = {
+        accessToken: response.accessToken,
+        refreshToken: response.refreshToken,
+        expiresAt: new Date(Date.now() + response.expiresIn * 1000).toISOString(),
+        createdAt: new Date().toISOString()
+      };
+      await withTelemetrySpan("token-manager.save-tokens", () => this.authStorage.saveTokens(this.mcpUrl, newTokenData));
+      this.cachedToken = newTokenData;
+      return response.accessToken;
+    });
+  }
+}
+// src/container.ts
+function createAuthStorage(fileSystemService) {
+  return withTelemetrySpanSync("container.create-auth-storage", () => {
+    const fileStorage = new AuthStorageImpl(fileSystemService);
+    const rawKeyring = new KeyringServiceImpl;
+    const keyring = process.platform === "win32" ? new ChunkingKeyringService(rawKeyring, WINDOWS_MAX_ENTRY_SIZE) : rawKeyring;
+    const keychainStorage = new KeychainAuthStorage(keyring);
+    return new MigratingAuthStorage(keychainStorage, fileStorage, (error) => {
+      if (!(error instanceof KeychainUnavailableError))
+        return;
+      console.error("Warning: System keychain unavailable. Falling back to file-based credential storage.");
+    });
+  });
+}
+function createStaticTokenProvider(token) {
+  return {
+    getToken: async () => token,
+    forceRefresh: async () => {
+      return;
+    }
+  };
+}
+async function createContainer() {
+  return withTelemetrySpan("container.create", async () => {
+    const mcpUrl = getMcpUrl();
+    const apiUrl = getApiUrl();
+    const codeNavigationUrl = getCodeNavigationUrl();
+    const codeNavigationCliOverrideEnabled = isCodeNavigationCliOverrideEnabled();
+    const fileSystemService = new FileSystemServiceImpl;
+    const authStorage = createAuthStorage(fileSystemService);
+    const authService = new AuthServiceImpl;
+    const browserService = new BrowserServiceImpl;
+    const envToken = getEnvApiToken();
+    if (envToken) {
+      const tokenProvider = createStaticTokenProvider(envToken);
+      const codeNavigationService2 = codeNavigationUrl ? new CodeNavigationServiceImpl(codeNavigationUrl, tokenProvider) : undefined;
+      const packageIntelligenceService2 = codeNavigationUrl ? new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenProvider) : undefined;
+      return {
+        authStorage,
+        authService,
+        browserService,
+        fileSystemService,
+        mcpUrl,
+        apiUrl,
+        apiToken: envToken,
+        hasValidToken: true,
+        envApiToken: envToken,
+        codeNavigationCapability: getCodeNavigationCapability(envToken),
+        codeNavigationCliOverrideEnabled,
+        codeNavigationUrl,
+        codeNavigationService: codeNavigationService2,
+        packageIntelligenceService: packageIntelligenceService2,
+        githitsService: new GitHitsServiceImpl(apiUrl, envToken)
+      };
+    }
+    const tokenManager = new TokenManager({ authService, authStorage, mcpUrl });
+    const apiToken = await withTelemetrySpan("container.token.get", () => tokenManager.getToken());
+    const codeNavigationService = codeNavigationUrl ? new CodeNavigationServiceImpl(codeNavigationUrl, tokenManager) : undefined;
+    const packageIntelligenceService = codeNavigationUrl ? new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenManager) : undefined;
+    return {
+      authStorage,
+      authService,
+      browserService,
+      fileSystemService,
+      mcpUrl,
+      apiUrl,
+      apiToken,
+      hasValidToken: apiToken !== undefined,
+      envApiToken: undefined,
+      codeNavigationCapability: getCodeNavigationCapability(apiToken),
+      codeNavigationCliOverrideEnabled,
+      codeNavigationUrl,
+      codeNavigationService,
+      packageIntelligenceService,
+      githitsService: new RefreshingGitHitsService(apiUrl, tokenManager)
+    };
+  });
+}
+async function resolveStartupCodeNavigationCapability() {
+  const state = await resolveStartupCodeNavigationRegistrationState();
+  return state.capability;
+}
+async function resolveStartupCodeNavigationRegistrationState() {
+  return withTelemetrySpan("startup.resolve-code-nav-registration-state", async () => {
+    const envToken = getEnvApiToken();
+    if (envToken) {
+      return {
+        capability: getCodeNavigationCapability(envToken),
+        expiredStoredAuth: false
+      };
+    }
+    const tokens = await loadStartupTokens(getMcpUrl());
+    if (tokens?.expiresAt && new Date(tokens.expiresAt) < new Date) {
+      return { capability: "unknown", expiredStoredAuth: true };
+    }
+    return {
+      capability: getCodeNavigationCapability(tokens?.accessToken),
+      expiredStoredAuth: false
+    };
+  });
+}
+async function loadStartupTokens(mcpUrl) {
+  return withTelemetrySpan("startup.load-tokens", async () => {
+    const fileSystemService = new FileSystemServiceImpl;
+    const fileStorage = new AuthStorageImpl(fileSystemService);
+    try {
+      const rawKeyring = new KeyringServiceImpl;
+      const keyring = process.platform === "win32" ? new ChunkingKeyringService(rawKeyring, WINDOWS_MAX_ENTRY_SIZE) : rawKeyring;
+      const keychainStorage = new KeychainAuthStorage(keyring);
+      const keychainTokens = await keychainStorage.loadTokens(mcpUrl);
+      if (keychainTokens) {
+        return keychainTokens;
+      }
+    } catch (error) {
+      if (!(error instanceof KeychainUnavailableError)) {
+        throw error;
+      }
+    }
+    return fileStorage.loadTokens(mcpUrl);
+  });
+}
+
+export { getCodeNavigationCapability, debugLog, setMcpClientVersionProvider, setClientMode, isTelemetryEnabled, withTelemetrySpan, startTelemetrySpan, endTelemetrySpan, flushTelemetry, AuthenticationError, CodeNavigationAccessError, CodeNavigationGraphQLError, CodeNavigationIndexingError, CodeNavigationUnresolvableError, MalformedCodeNavigationResponseError, CodeNavigationTargetNotFoundError, CodeNavigationFileNotFoundError, CodeNavigationVersionNotFoundError, CodeNavigationValidationError, CodeNavigationFeatureFlagRequiredError, CodeNavigationNetworkError, CodeNavigationBackendError, getCodeNavigationUrl, getEnvApiToken, isCodeNavigationCliOverrideEnabled, ExecServiceImpl, FileSystemServiceImpl, PackageIntelligenceAccessError, PackageIntelligenceFeatureFlagRequiredError, PackageIntelligenceNetworkError, PackageIntelligenceBackendError, PackageIntelligenceGraphQLError, PackageIntelligenceTargetNotFoundError, PackageIntelligenceValidationError, PackageIntelligenceVersionNotFoundError, MalformedPackageIntelligenceResponseError, PackageIntelligenceChangelogSourceNotFoundError, PromptServiceImpl, refreshExpiredToken, createContainer, resolveStartupCodeNavigationCapability, resolveStartupCodeNavigationRegistrationState };