githits 0.2.3 → 0.3.1

package/dist/shared/{chunk-a9js75mw.js → chunk-0s7mxdt3.js}

@@ -1,7 +1,94 @@
 import {
+  __require,
   version
-} from "./chunk-js72s35a.js";
+} from "./chunk-m1xx8hzw.js";
 
+// src/services/app-config-paths.ts
+var APP_DIR = "githits";
+function getAppConfigDir(fs) {
+  const home = fs.getHomeDir();
+  switch (process.platform) {
+    case "win32":
+      return fs.joinPath(process.env.APPDATA ?? fs.joinPath(home, "AppData", "Roaming"), APP_DIR);
+    case "darwin":
+      return fs.joinPath(home, "Library", "Application Support", APP_DIR);
+    default:
+      return fs.joinPath(process.env.XDG_CONFIG_HOME ?? fs.joinPath(home, ".config"), APP_DIR);
+  }
+}
+function getAuthConfigPath(fs) {
+  return fs.joinPath(getAppConfigDir(fs), "config.toml");
+}
+function getAuthFileStorageDir(fs) {
+  return fs.joinPath(getAppConfigDir(fs), "auth");
+}
+function getLegacyAuthStorageDir(fs) {
+  return fs.joinPath(fs.getHomeDir(), ".githits");
+}
+// src/services/auth-config.ts
+import { parse as parseToml } from "smol-toml";
+import { z } from "zod";
+var AUTH_STORAGE_MODES = ["keychain", "file"];
+var AUTH_STORAGE_MODE_VALUES = new Set(AUTH_STORAGE_MODES);
+var CONFIG_SCHEMA = z.object({
+  auth: z.object({
+    storage: z.string().optional()
+  }).optional()
+}).passthrough();
+
+class AuthConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthConfigError";
+  }
+}
+function parseAuthStorageMode(value) {
+  const normalized = value.trim().toLowerCase();
+  if (AUTH_STORAGE_MODE_VALUES.has(normalized)) {
+    return normalized;
+  }
+  throw new AuthConfigError(`Invalid auth storage mode "${value}". Use "keychain" or "file". File mode stores OAuth credentials unencrypted on disk.`);
+}
+async function loadAuthConfig(fs) {
+  const configPath = getAuthConfigPath(fs);
+  const envMode = process.env.GITHITS_AUTH_STORAGE;
+  if (envMode !== undefined && envMode.trim() !== "") {
+    try {
+      return { storage: parseAuthStorageMode(envMode), configPath };
+    } catch (error) {
+      if (error instanceof AuthConfigError) {
+        throw new AuthConfigError(`Invalid GITHITS_AUTH_STORAGE: ${error.message}`);
+      }
+      throw error;
+    }
+  }
+  if (!await fs.exists(configPath)) {
+    return { storage: "keychain", configPath };
+  }
+  let rawConfig;
+  try {
+    rawConfig = parseToml(await fs.readFile(configPath));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new AuthConfigError(`Cannot parse GitHits config at ${configPath}: ${message}`);
+  }
+  const parsed = CONFIG_SCHEMA.safeParse(rawConfig);
+  if (!parsed.success) {
+    throw new AuthConfigError(`Invalid GitHits config at ${configPath}: ${z.prettifyError(parsed.error)}`);
+  }
+  const configuredMode = parsed.data.auth?.storage;
+  if (configuredMode === undefined || configuredMode.trim() === "") {
+    return { storage: "keychain", configPath };
+  }
+  try {
+    return { storage: parseAuthStorageMode(configuredMode), configPath };
+  } catch (error) {
+    if (error instanceof AuthConfigError) {
+      throw new AuthConfigError(`Invalid GitHits config at ${configPath}: ${error.message}`);
+    }
+    throw error;
+  }
+}
 // src/services/auth-service.ts
 import { createServer } from "node:http";
 
@@ -164,7 +251,7 @@ class AuthServiceImpl {
       const error = await response.text();
       throw new Error(`Token refresh failed: ${error}`);
     }
-    return parseTokenResponse(await response.json());
+    return parseRefreshTokenResponse(await response.json());
   }
 }
 function parseTokenResponse(data) {
@@ -178,6 +265,17 @@ function parseTokenResponse(data) {
     expiresIn: d.expires_in || 3600
   };
 }
+function parseRefreshTokenResponse(data) {
+  const d = data;
+  if (!d.access_token) {
+    throw new Error("Token response missing required fields");
+  }
+  return {
+    accessToken: d.access_token,
+    refreshToken: typeof d.refresh_token === "string" ? d.refresh_token : undefined,
+    expiresIn: d.expires_in || 3600
+  };
+}
 function successHtml(title = "Authentication successful") {
   return `<!DOCTYPE html>
 <html><head><title>GitHits CLI</title>
@@ -310,11 +408,9 @@ function escapeHtml(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 // src/services/auth-storage.ts
-var CONFIG_DIR = ".githits";
 var AUTH_FILE = "auth.json";
 var CLIENT_FILE = "client.json";
 var DIR_MODE = 448;
-var FILE_MODE = 384;
 
 class AuthStorageImpl {
   fs;
@@ -323,7 +419,7 @@ class AuthStorageImpl {
   clientPath;
   constructor(fs, configDir) {
     this.fs = fs;
-    this.configDir = configDir ?? fs.joinPath(fs.getHomeDir(), CONFIG_DIR);
+    this.configDir = configDir ?? getAuthFileStorageDir(fs);
     this.authPath = fs.joinPath(this.configDir, AUTH_FILE);
     this.clientPath = fs.joinPath(this.configDir, CLIENT_FILE);
   }
@@ -343,7 +439,14 @@ class AuthStorageImpl {
     };
     stored.tokens[normalizeBaseUrl(baseUrl)] = data;
     await this.fs.ensureDir(this.configDir, DIR_MODE);
-    await this.fs.writeFile(this.authPath, JSON.stringify(stored, null, 2), FILE_MODE);
+    await this.fs.atomicWriteFile(this.authPath, JSON.stringify(stored, null, 2));
+  }
+  async saveTokensIfUnchanged(baseUrl, expected, data) {
+    const current = await this.loadTokens(baseUrl);
+    if (!sameTokenData(current, expected))
+      return false;
+    await this.saveTokens(baseUrl, data);
+    return true;
   }
   async clearTokens(baseUrl) {
     const stored = await this.loadAuthFile();
@@ -353,9 +456,16 @@ class AuthStorageImpl {
     if (Object.keys(stored.tokens).length === 0) {
       await this.fs.deleteFile(this.authPath);
     } else {
-      await this.fs.writeFile(this.authPath, JSON.stringify(stored, null, 2), FILE_MODE);
+      await this.fs.atomicWriteFile(this.authPath, JSON.stringify(stored, null, 2));
     }
   }
+  async clearTokensIfUnchanged(baseUrl, expected) {
+    const current = await this.loadTokens(baseUrl);
+    if (!sameTokenData(current, expected))
+      return false;
+    await this.clearTokens(baseUrl);
+    return true;
+  }
   async loadClient(baseUrl) {
     const stored = await this.loadClientFile();
     if (!stored)
@@ -370,7 +480,7 @@ class AuthStorageImpl {
     if (Object.keys(stored.clients).length === 0) {
       await this.fs.deleteFile(this.clientPath);
     } else {
-      await this.fs.writeFile(this.clientPath, JSON.stringify(stored, null, 2), FILE_MODE);
+      await this.fs.atomicWriteFile(this.clientPath, JSON.stringify(stored, null, 2));
     }
   }
   async saveClient(baseUrl, data) {
@@ -380,7 +490,14 @@ class AuthStorageImpl {
     };
     stored.clients[normalizeBaseUrl(baseUrl)] = data;
     await this.fs.ensureDir(this.configDir, DIR_MODE);
-    await this.fs.writeFile(this.clientPath, JSON.stringify(stored, null, 2), FILE_MODE);
+    await this.fs.atomicWriteFile(this.clientPath, JSON.stringify(stored, null, 2));
+  }
+  async saveAuthSession(baseUrl, client, tokens) {
+    await this.saveClient(baseUrl, client);
+    await this.saveTokens(baseUrl, tokens);
+  }
+  async clearAuthSession(baseUrl) {
+    await clearAuthSessionBestEffort(() => this.clearTokens(baseUrl), () => this.clearClient(baseUrl));
   }
   async loadAuthFile() {
     if (!await this.fs.exists(this.authPath))
@@ -412,6 +529,26 @@ class AuthStorageImpl {
 function normalizeBaseUrl(url) {
   return url.replace(/\/+$/, "");
 }
+function sameTokenData(a, b) {
+  if (a === null || b === null)
+    return a === b;
+  return a.accessToken === b.accessToken && a.refreshToken === b.refreshToken && a.expiresAt === b.expiresAt && a.createdAt === b.createdAt;
+}
+async function clearAuthSessionBestEffort(clearTokens, clearClient) {
+  let firstError;
+  try {
+    await clearTokens();
+  } catch (error) {
+    firstError = error;
+  }
+  try {
+    await clearClient();
+  } catch (error) {
+    firstError ??= error;
+  }
+  if (firstError)
+    throw firstError;
+}
 // src/services/browser-service.ts
 import open from "open";
 
@@ -531,54 +668,34 @@ class ChunkingKeyringService {
     }
   }
 }
-// src/services/code-navigation-capability.ts
-function getCodeNavigationCapability(token) {
-  if (!token)
-    return "unknown";
-  const payload = parseJwtPayload(token);
-  if (!payload)
-    return "unknown";
-  const featureFlags = extractFeatureFlags(payload);
-  if (!featureFlags)
-    return "unknown";
-  return featureFlags.includes("code_navigation") ? "enabled" : "disabled";
-}
-function extractFeatureFlags(payload) {
-  if (isStringArray(payload.feature_flags)) {
-    return payload.feature_flags;
-  }
-  if (payload.claims && isStringArray(payload.claims.feature_flags)) {
-    return payload.claims.feature_flags;
+// src/services/client-update-required-error.ts
+var CLIENT_UPDATE_REQUIRED_REASON = "Backend protocol changed";
+
+class ClientUpdateRequiredError extends Error {
+  reason;
+  currentVersion;
+  constructor(message = `Update required: ${CLIENT_UPDATE_REQUIRED_REASON}`, reason = CLIENT_UPDATE_REQUIRED_REASON, currentVersion = version) {
+    super(message);
+    this.reason = reason;
+    this.currentVersion = currentVersion;
+    this.name = "ClientUpdateRequiredError";
   }
-  return null;
-}
-function isStringArray(value) {
-  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
-function parseJwtPayload(token) {
-  const parts = token.split(".");
-  if (parts.length < 2)
-    return null;
-  try {
-    const decoded = Buffer.from(toBase64(parts[1] ?? ""), "base64").toString("utf8");
-    const parsed = JSON.parse(decoded);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
+function isClientUpdateRequiredGraphQLError(input) {
+  if (input.code === "CLIENT_UPDATE_REQUIRED") {
+    return true;
+  }
+  const message = input.message;
+  if (!isGraphQLSchemaMismatchMessage(message)) {
+    return false;
   }
+  return !input.code || input.code === "GRAPHQL_VALIDATION_FAILED" || input.code === "BAD_USER_INPUT";
 }
-function toBase64(base64Url) {
-  const normalized = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-  const padding = normalized.length % 4;
-  if (padding === 0)
-    return normalized;
-  return normalized.padEnd(normalized.length + (4 - padding), "=");
+function isGraphQLSchemaMismatchMessage(message) {
+  return /Cannot query field|Field .* does not exist|Unknown argument|Unknown type|Unknown field/i.test(message);
 }
 // src/services/code-navigation-service.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 
 // src/shared/debug-log.ts
 function debugLog(area, payload) {
@@ -903,17 +1020,6 @@ async function withTelemetrySpan(name, operation, attributes) {
     throw error;
   }
 }
-function withTelemetrySpanSync(name, operation, attributes) {
-  const handle = telemetryCollector.startSpan(name, attributes);
-  try {
-    const result = operation();
-    telemetryCollector.endSpan(handle);
-    return result;
-  } catch (error) {
-    telemetryCollector.endSpan(handle, { error: true });
-    throw error;
-  }
-}
 function startTelemetrySpan(name, attributes) {
   return telemetryCollector.startSpan(name, attributes);
 }
@@ -1420,80 +1526,80 @@ function asRecord(value) {
   }
   return;
 }
-var availableVersionSchema = z.object({
-  version: z.string().nullable().optional(),
-  ref: z.string()
+var availableVersionSchema = z2.object({
+  version: z2.string().nullable().optional(),
+  ref: z2.string()
 });
-var unifiedSearchSourceSchema = z.enum(["AUTO", "DOCS", "CODE", "SYMBOL"]);
-var unifiedSearchResultTypeSchema = z.enum([
+var unifiedSearchSourceSchema = z2.enum(["AUTO", "DOCS", "CODE", "SYMBOL"]);
+var unifiedSearchResultTypeSchema = z2.enum([
   "DOCUMENTATION_PAGE",
   "REPOSITORY_SYMBOL",
   "REPOSITORY_CODE",
   "REPOSITORY_DOC"
 ]);
-var unifiedSearchLocatorSchema = z.object({
-  registry: z.string().nullable().optional(),
-  packageName: z.string().nullable().optional(),
-  version: z.string().nullable().optional(),
-  pageId: z.string().nullable().optional(),
-  sourceKind: z.string().nullable().optional(),
-  sourceUrl: z.string().nullable().optional(),
-  repoUrl: z.string().nullable().optional(),
-  gitRef: z.string().nullable().optional(),
-  requestedRef: z.string().nullable().optional(),
-  filePath: z.string().nullable().optional(),
-  startLine: z.number().int().nullable().optional(),
-  endLine: z.number().int().nullable().optional(),
-  fileContentHash: z.string().nullable().optional(),
-  symbolRef: z.string().nullable().optional(),
-  qualifiedPath: z.string().nullable().optional(),
-  kind: z.string().nullable().optional(),
-  category: z.string().nullable().optional(),
-  language: z.string().nullable().optional()
+var unifiedSearchLocatorSchema = z2.object({
+  registry: z2.string().nullable().optional(),
+  packageName: z2.string().nullable().optional(),
+  version: z2.string().nullable().optional(),
+  pageId: z2.string().nullable().optional(),
+  sourceKind: z2.string().nullable().optional(),
+  sourceUrl: z2.string().nullable().optional(),
+  repoUrl: z2.string().nullable().optional(),
+  gitRef: z2.string().nullable().optional(),
+  requestedRef: z2.string().nullable().optional(),
+  filePath: z2.string().nullable().optional(),
+  startLine: z2.number().int().nullable().optional(),
+  endLine: z2.number().int().nullable().optional(),
+  fileContentHash: z2.string().nullable().optional(),
+  symbolRef: z2.string().nullable().optional(),
+  qualifiedPath: z2.string().nullable().optional(),
+  kind: z2.string().nullable().optional(),
+  category: z2.string().nullable().optional(),
+  language: z2.string().nullable().optional()
 });
-var unifiedSearchHitSchema = z.object({
-  id: z.string(),
+var unifiedSearchHitSchema = z2.object({
+  id: z2.string(),
   resultType: unifiedSearchResultTypeSchema,
-  targetLabel: z.string(),
-  title: z.string().nullable().optional(),
-  summary: z.string().nullable().optional(),
-  score: z.number().nullable().optional(),
-  highlights: z.object({
-    title: z.array(z.tuple([z.number().int(), z.number().int()])).nullable().optional(),
-    summary: z.array(z.tuple([z.number().int(), z.number().int()])).nullable().optional()
+  targetLabel: z2.string(),
+  title: z2.string().nullable().optional(),
+  summary: z2.string().nullable().optional(),
+  score: z2.number().nullable().optional(),
+  highlights: z2.object({
+    title: z2.array(z2.tuple([z2.number().int(), z2.number().int()])).nullable().optional(),
+    summary: z2.array(z2.tuple([z2.number().int(), z2.number().int()])).nullable().optional()
   }).nullable().optional(),
   locator: unifiedSearchLocatorSchema
 });
-var unifiedSearchPageInfoSchema = z.object({
-  offset: z.number().int(),
-  limit: z.number().int(),
-  returned: z.number().int(),
-  hasMore: z.boolean()
+var unifiedSearchPageInfoSchema = z2.object({
+  offset: z2.number().int(),
+  limit: z2.number().int(),
+  returned: z2.number().int(),
+  hasMore: z2.boolean()
 });
-var unifiedSearchSourceStatusSchema = z.object({
+var unifiedSearchSourceStatusSchema = z2.object({
   source: unifiedSearchSourceSchema,
-  targetLabel: z.string(),
-  indexingStatus: z.string().nullable().optional(),
-  codeIndexState: z.string().nullable().optional(),
-  resultCount: z.number().int().nullable().optional(),
-  appliedFilters: z.array(z.string()),
-  ignoredFilters: z.array(z.string()),
-  incompatibleFilters: z.array(z.string()),
-  appliedQueryFeatures: z.array(z.string()),
-  ignoredQueryFeatures: z.array(z.string()),
-  incompatibleQueryFeatures: z.array(z.string()),
-  note: z.string().nullable().optional()
+  targetLabel: z2.string(),
+  indexingStatus: z2.string().nullable().optional(),
+  codeIndexState: z2.string().nullable().optional(),
+  resultCount: z2.number().int().nullable().optional(),
+  appliedFilters: z2.array(z2.string()),
+  ignoredFilters: z2.array(z2.string()),
+  incompatibleFilters: z2.array(z2.string()),
+  appliedQueryFeatures: z2.array(z2.string()),
+  ignoredQueryFeatures: z2.array(z2.string()),
+  incompatibleQueryFeatures: z2.array(z2.string()),
+  note: z2.string().nullable().optional()
 });
-var unifiedSearchResultSchema = z.object({
-  query: z.string(),
-  queryWarnings: z.array(z.string()),
-  sources: z.array(unifiedSearchSourceSchema),
-  results: z.array(unifiedSearchHitSchema),
+var unifiedSearchResultSchema = z2.object({
+  query: z2.string(),
+  queryWarnings: z2.array(z2.string()),
+  sources: z2.array(unifiedSearchSourceSchema),
+  results: z2.array(unifiedSearchHitSchema),
   page: unifiedSearchPageInfoSchema,
-  partialResults: z.boolean(),
-  sourceStatus: z.array(unifiedSearchSourceStatusSchema)
+  partialResults: z2.boolean(),
+  sourceStatus: z2.array(unifiedSearchSourceStatusSchema)
 });
-var unifiedSearchSessionStatusSchema = z.enum([
+var unifiedSearchSessionStatusSchema = z2.enum([
   "PENDING",
   "INDEXING",
   "SEARCHING",
@@ -1501,60 +1607,60 @@ var unifiedSearchSessionStatusSchema = z.enum([
   "TIMEOUT",
   "FAILED"
 ]);
-var unifiedSearchProgressSchema = z.object({
-  searchRef: z.string(),
+var unifiedSearchProgressSchema = z2.object({
+  searchRef: z2.string(),
   status: unifiedSearchSessionStatusSchema,
-  targetsTotal: z.number().int(),
-  targetsReady: z.number().int(),
-  elapsedMs: z.number().int(),
-  query: z.string(),
-  queryWarnings: z.array(z.string()),
-  sources: z.array(unifiedSearchSourceSchema),
-  expiresAt: z.string().nullable().optional(),
+  targetsTotal: z2.number().int(),
+  targetsReady: z2.number().int(),
+  elapsedMs: z2.number().int(),
+  query: z2.string(),
+  queryWarnings: z2.array(z2.string()),
+  sources: z2.array(unifiedSearchSourceSchema),
+  expiresAt: z2.string().nullable().optional(),
   results: unifiedSearchResultSchema.nullable().optional()
 });
-var asyncUnifiedSearchResultSchema = z.object({
-  completed: z.boolean(),
-  searchRef: z.string().nullable().optional(),
+var asyncUnifiedSearchResultSchema = z2.object({
+  completed: z2.boolean(),
+  searchRef: z2.string().nullable().optional(),
   result: unifiedSearchResultSchema.nullable().optional(),
   progress: unifiedSearchProgressSchema.nullable().optional()
 });
-var graphQLErrorSchema = z.object({
-  message: z.string(),
-  extensions: z.record(z.string(), z.unknown()).optional()
+var graphQLErrorSchema = z2.object({
+  message: z2.string(),
+  extensions: z2.record(z2.string(), z2.unknown()).optional()
 });
-var navigationResolutionSchema = z.object({
-  requestedVersion: z.string().nullable().optional(),
-  requestedRef: z.string().nullable().optional(),
-  resolvedRef: z.string().nullable().optional(),
-  commitSha: z.string().nullable().optional()
+var navigationResolutionSchema = z2.object({
+  requestedVersion: z2.string().nullable().optional(),
+  requestedRef: z2.string().nullable().optional(),
+  resolvedRef: z2.string().nullable().optional(),
+  commitSha: z2.string().nullable().optional()
 }).nullable().optional();
-var navigationDiagnosticsSchema = z.object({
-  hint: z.string().nullable().optional()
+var navigationDiagnosticsSchema = z2.object({
+  hint: z2.string().nullable().optional()
 }).nullable().optional();
-var repoFileEntrySchema = z.object({
-  path: z.string(),
-  name: z.string().nullable().optional(),
-  language: z.string().nullable().optional(),
-  fileType: z.string().nullable().optional(),
-  byteSize: z.number().int().nullable().optional()
+var repoFileEntrySchema = z2.object({
+  path: z2.string(),
+  name: z2.string().nullable().optional(),
+  language: z2.string().nullable().optional(),
+  fileType: z2.string().nullable().optional(),
+  byteSize: z2.number().int().nullable().optional()
 });
-var listRepoFilesResponseSchema = z.object({
-  files: z.array(repoFileEntrySchema),
-  total: z.number().int(),
-  hasMore: z.boolean(),
-  indexedVersion: z.string().nullable().optional(),
+var listRepoFilesResponseSchema = z2.object({
+  files: z2.array(repoFileEntrySchema),
+  total: z2.number().int(),
+  hasMore: z2.boolean(),
+  indexedVersion: z2.string().nullable().optional(),
   resolution: navigationResolutionSchema,
   diagnostics: navigationDiagnosticsSchema,
-  codeIndexState: z.string(),
-  indexingRef: z.string().nullable().optional(),
-  availableVersions: z.array(availableVersionSchema).nullable().optional()
+  codeIndexState: z2.string(),
+  indexingRef: z2.string().nullable().optional(),
+  availableVersions: z2.array(availableVersionSchema).nullable().optional()
 });
-var listRepoFilesGraphQLResponseSchema = z.object({
-  data: z.object({
+var listRepoFilesGraphQLResponseSchema = z2.object({
+  data: z2.object({
     listRepoFiles: listRepoFilesResponseSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z.array(graphQLErrorSchema).optional()
+  errors: z2.array(graphQLErrorSchema).optional()
 });
 var LIST_REPO_FILES_QUERY = `
 query ListRepoFiles(
@@ -1604,24 +1710,24 @@ query ListRepoFiles(
     }
   }
 }`;
-var codeContextResponseSchema = z.object({
-  content: z.string().nullable().optional(),
-  filePath: z.string().nullable().optional(),
-  language: z.string().nullable().optional(),
-  totalLines: z.number().int().nullable().optional(),
-  startLine: z.number().int().nullable().optional(),
-  endLine: z.number().int().nullable().optional(),
-  repoUrl: z.string().nullable().optional(),
-  gitRef: z.string().nullable().optional(),
-  isBinary: z.boolean().nullable().optional(),
-  codeIndexState: z.string(),
-  indexingRef: z.string().nullable().optional()
+var codeContextResponseSchema = z2.object({
+  content: z2.string().nullable().optional(),
+  filePath: z2.string().nullable().optional(),
+  language: z2.string().nullable().optional(),
+  totalLines: z2.number().int().nullable().optional(),
+  startLine: z2.number().int().nullable().optional(),
+  endLine: z2.number().int().nullable().optional(),
+  repoUrl: z2.string().nullable().optional(),
+  gitRef: z2.string().nullable().optional(),
+  isBinary: z2.boolean().nullable().optional(),
+  codeIndexState: z2.string(),
+  indexingRef: z2.string().nullable().optional()
 });
-var fetchCodeContextGraphQLResponseSchema = z.object({
-  data: z.object({
+var fetchCodeContextGraphQLResponseSchema = z2.object({
+  data: z2.object({
     fetchCodeContext: codeContextResponseSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z.array(graphQLErrorSchema).optional()
+  errors: z2.array(graphQLErrorSchema).optional()
 });
 var FETCH_CODE_CONTEXT_QUERY = `
 query FetchCodeContext(
@@ -1659,63 +1765,63 @@ query FetchCodeContext(
     indexingRef
   }
 }`;
-var grepRepoMatchSchema = z.object({
-  filePath: z.string(),
-  line: z.number().int(),
-  matchStartByte: z.number().int(),
-  matchEndByte: z.number().int(),
-  lineContent: z.string(),
-  contextBefore: z.array(z.string()).nullable().optional(),
-  contextAfter: z.array(z.string()).nullable().optional(),
-  fileContentHash: z.string().nullable().optional(),
-  fileIntent: z.string().nullable().optional(),
-  symbolRowId: z.string().nullable().optional(),
-  symbol: z.object({
-    symbolRef: z.string().optional(),
-    name: z.string().optional(),
-    qualifiedPath: z.string().nullable().optional(),
-    kind: z.string().nullable().optional(),
-    category: z.string().nullable().optional(),
-    arity: z.number().int().nullable().optional(),
-    isPublic: z.boolean().nullable().optional(),
-    filePath: z.string().nullable().optional(),
-    startLine: z.number().int().nullable().optional(),
-    endLine: z.number().int().nullable().optional(),
-    code: z.string().nullable().optional(),
-    callerCount: z.number().int().nullable().optional(),
-    contentHash: z.string().nullable().optional(),
-    parentSymbolRef: z.string().nullable().optional(),
-    parentPath: z.string().nullable().optional()
+var grepRepoMatchSchema = z2.object({
+  filePath: z2.string(),
+  line: z2.number().int(),
+  matchStartByte: z2.number().int(),
+  matchEndByte: z2.number().int(),
+  lineContent: z2.string(),
+  contextBefore: z2.array(z2.string()).nullable().optional(),
+  contextAfter: z2.array(z2.string()).nullable().optional(),
+  fileContentHash: z2.string().nullable().optional(),
+  fileIntent: z2.string().nullable().optional(),
+  symbolRowId: z2.string().nullable().optional(),
+  symbol: z2.object({
+    symbolRef: z2.string().optional(),
+    name: z2.string().optional(),
+    qualifiedPath: z2.string().nullable().optional(),
+    kind: z2.string().nullable().optional(),
+    category: z2.string().nullable().optional(),
+    arity: z2.number().int().nullable().optional(),
+    isPublic: z2.boolean().nullable().optional(),
+    filePath: z2.string().nullable().optional(),
+    startLine: z2.number().int().nullable().optional(),
+    endLine: z2.number().int().nullable().optional(),
+    code: z2.string().nullable().optional(),
+    callerCount: z2.number().int().nullable().optional(),
+    contentHash: z2.string().nullable().optional(),
+    parentSymbolRef: z2.string().nullable().optional(),
+    parentPath: z2.string().nullable().optional()
   }).nullable().optional()
 });
-var grepRepoResponseSchema = z.object({
-  matches: z.array(grepRepoMatchSchema),
-  nextCursor: z.string().nullable().optional(),
-  hasMore: z.boolean(),
-  truncatedReason: z.enum([
+var grepRepoResponseSchema = z2.object({
+  matches: z2.array(grepRepoMatchSchema),
+  nextCursor: z2.string().nullable().optional(),
+  hasMore: z2.boolean(),
+  truncatedReason: z2.enum([
     "NONE",
     "MAX_MATCHES",
     "MAX_MATCHES_PER_FILE",
     "DEADLINE"
   ]),
-  routeTaken: z.enum(["SINGLE_FILE", "CONTENT_INDEX"]).nullable().optional(),
-  filesScanned: z.number().int(),
-  filesInScope: z.number().int(),
-  binaryFilesSkipped: z.number().int(),
-  filesTooLargeSkipped: z.number().int(),
-  totalMatches: z.number().int(),
-  uniqueFilesMatched: z.number().int(),
-  indexedVersion: z.string().nullable().optional(),
+  routeTaken: z2.enum(["SINGLE_FILE", "CONTENT_INDEX"]).nullable().optional(),
+  filesScanned: z2.number().int(),
+  filesInScope: z2.number().int(),
+  binaryFilesSkipped: z2.number().int(),
+  filesTooLargeSkipped: z2.number().int(),
+  totalMatches: z2.number().int(),
+  uniqueFilesMatched: z2.number().int(),
+  indexedVersion: z2.string().nullable().optional(),
   resolution: navigationResolutionSchema,
-  codeIndexState: z.string(),
-  indexingRef: z.string().nullable().optional(),
-  availableVersions: z.array(availableVersionSchema).nullable().optional()
+  codeIndexState: z2.string(),
+  indexingRef: z2.string().nullable().optional(),
+  availableVersions: z2.array(availableVersionSchema).nullable().optional()
 });
-var grepRepoGraphQLResponseSchema = z.object({
-  data: z.object({
+var grepRepoGraphQLResponseSchema = z2.object({
+  data: z2.object({
     grepRepo: grepRepoResponseSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z.array(graphQLErrorSchema).optional()
+  errors: z2.array(graphQLErrorSchema).optional()
 });
 var GREP_REPO_SYMBOL_SELECTIONS = {
   symbol_ref: "symbolRef",
@@ -1824,17 +1930,17 @@ query GrepRepo(
   }
 }`;
 }
-var unifiedSearchGraphQLResponseSchema = z.object({
-  data: z.object({
+var unifiedSearchGraphQLResponseSchema = z2.object({
+  data: z2.object({
     search: asyncUnifiedSearchResultSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z.array(graphQLErrorSchema).optional()
+  errors: z2.array(graphQLErrorSchema).optional()
 });
-var unifiedSearchStatusGraphQLResponseSchema = z.object({
-  data: z.object({
+var unifiedSearchStatusGraphQLResponseSchema = z2.object({
+  data: z2.object({
     discoverySearchProgress: unifiedSearchProgressSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z.array(graphQLErrorSchema).optional()
+  errors: z2.array(graphQLErrorSchema).optional()
 });
 
 class CodeNavigationServiceImpl {
@@ -1987,6 +2093,9 @@ class CodeNavigationServiceImpl {
     const code = typeof extensions?.code === "string" ? extensions.code : undefined;
     const retryable = typeof extensions?.retryable === "boolean" ? extensions.retryable : undefined;
     const indexingRef = getGraphQLIndexingRef(errors);
+    if (isClientUpdateRequiredGraphQLError({ message, code })) {
+      return new ClientUpdateRequiredError;
+    }
     switch (code) {
       case "PACKAGE_INDEXING":
         return new CodeNavigationIndexingError(this.createIndexingMessage(indexingRef), indexingRef, parseAvailableVersions(extensions));
@@ -2481,19 +2590,11 @@ function getCodeNavigationUrl() {
   if (explicitUrl) {
     return explicitUrl;
   }
-  const usingDefaultEnvironment = getMcpUrl() === DEFAULT_MCP_URL && getApiUrl() === DEFAULT_API_URL;
-  return usingDefaultEnvironment ? DEFAULT_CODE_NAV_URL : undefined;
+  return DEFAULT_CODE_NAV_URL;
 }
 function getEnvApiToken() {
   return process.env.GITHITS_API_TOKEN;
 }
-function isCodeNavigationCliOverrideEnabled() {
-  const raw = process.env.GITHITS_CODE_NAVIGATION;
-  if (!raw)
-    return false;
-  const normalized = raw.toLowerCase();
-  return normalized !== "0" && normalized !== "false" && normalized !== "";
-}
 // src/services/exec-service.ts
 import { spawn } from "node:child_process";
 
@@ -2523,6 +2624,7 @@ class ExecServiceImpl {
   }
 }
 // src/services/filesystem-service.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
 import {
   mkdir,
   readdir,
@@ -2586,7 +2688,7 @@ class FileSystemServiceImpl {
     }
   }
   async atomicWriteFile(path, contents) {
-    const tmpPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    const tmpPath = `${path}.${process.pid}.${randomUUID2()}.tmp`;
     let mode = 384;
     try {
       const existing = await stat(path);
@@ -2649,10 +2751,24 @@ class KeychainAuthStorage {
     const key = `${TOKEN_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
     this.keyring.setPassword(SERVICE_NAME, key, JSON.stringify(data));
   }
+  async saveTokensIfUnchanged(baseUrl2, expected, data) {
+    const current = await this.loadTokens(baseUrl2);
+    if (!sameTokenData(current, expected))
+      return false;
+    await this.saveTokens(baseUrl2, data);
+    return true;
+  }
   async clearTokens(baseUrl2) {
     const key = `${TOKEN_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
     this.keyring.deletePassword(SERVICE_NAME, key);
   }
+  async clearTokensIfUnchanged(baseUrl2, expected) {
+    const current = await this.loadTokens(baseUrl2);
+    if (!sameTokenData(current, expected))
+      return false;
+    await this.clearTokens(baseUrl2);
+    return true;
+  }
   async loadClient(baseUrl2) {
     const key = `${CLIENT_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
     const json = this.keyring.getPassword(SERVICE_NAME, key);
@@ -2669,6 +2785,13 @@ class KeychainAuthStorage {
     const key = `${CLIENT_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
     this.keyring.deletePassword(SERVICE_NAME, key);
   }
+  async saveAuthSession(baseUrl2, client, tokens) {
+    await this.saveClient(baseUrl2, client);
+    await this.saveTokens(baseUrl2, tokens);
+  }
+  async clearAuthSession(baseUrl2) {
+    await clearAuthSessionBestEffort(() => this.clearTokens(baseUrl2), () => this.clearClient(baseUrl2));
+  }
   getStorageLocation() {
     switch (process.platform) {
       case "darwin":
@@ -2718,179 +2841,644 @@ class KeyringServiceImpl {
     }
   }
 }
-// src/services/migrating-auth-storage.ts
-class MigratingAuthStorage {
-  primary;
-  legacy;
-  onPrimaryUnavailable;
-  primaryAvailable = true;
-  warnedOnPrimaryFailure = false;
-  constructor(primary, legacy, onPrimaryUnavailable = () => {}) {
-    this.primary = primary;
-    this.legacy = legacy;
-    this.onPrimaryUnavailable = onPrimaryUnavailable;
+// src/services/locked-auth-storage.ts
+import { execFile } from "node:child_process";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2 } from "node:path";
+import { promisify } from "node:util";
+var LOCK_DIR = "auth.lock";
+var LOCK_TIMEOUT_MS = 1e4;
+var LOCK_RETRY_MS = 25;
+var ORPHANED_LOCK_MS = 5000;
+var OWNER_FILE = "owner.json";
+var execFileAsync = promisify(execFile);
+
+class AuthStorageLockTimeoutError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthStorageLockTimeoutError";
   }
-  async loadTokens(baseUrl2) {
-    if (this.primaryAvailable) {
-      try {
-        const tokens = await this.primary.loadTokens(baseUrl2);
-        if (tokens)
-          return tokens;
-      } catch (error) {
-        if (!this.handlePrimaryFailure(error))
-          throw error;
-      }
-    }
-    const legacyTokens = await this.legacy.loadTokens(baseUrl2);
-    if (!legacyTokens)
-      return null;
-    if (!this.primaryAvailable)
-      return legacyTokens;
+}
+
+class LockedAuthStorage {
+  storage;
+  lockPath;
+  lockTimeoutMs;
+  isOwnerAlive;
+  currentOwner = null;
+  constructor(storage, fileSystemService, options = {}) {
+    this.storage = storage;
+    this.lockTimeoutMs = options.lockTimeoutMs ?? LOCK_TIMEOUT_MS;
+    this.isOwnerAlive = options.isOwnerAlive ?? isOriginalProcessAlive;
+    this.lockPath = fileSystemService.joinPath(getAppConfigDir(fileSystemService), LOCK_DIR);
+  }
+  loadTokens(baseUrl2) {
+    return this.storage.loadTokens(baseUrl2);
+  }
+  saveTokens(baseUrl2, data) {
+    return this.withLock(() => this.storage.saveTokens(baseUrl2, data));
+  }
+  saveTokensIfUnchanged(baseUrl2, expected, data) {
+    return this.withLock(() => this.storage.saveTokensIfUnchanged(baseUrl2, expected, data));
+  }
+  clearTokens(baseUrl2) {
+    return this.withLock(() => this.storage.clearTokens(baseUrl2));
+  }
+  clearTokensIfUnchanged(baseUrl2, expected) {
+    return this.withLock(() => this.storage.clearTokensIfUnchanged(baseUrl2, expected));
+  }
+  loadClient(baseUrl2) {
+    return this.storage.loadClient(baseUrl2);
+  }
+  saveClient(baseUrl2, data) {
+    return this.withLock(() => this.storage.saveClient(baseUrl2, data));
+  }
+  clearClient(baseUrl2) {
+    return this.withLock(() => this.storage.clearClient(baseUrl2));
+  }
+  saveAuthSession(baseUrl2, client, tokens) {
+    return this.withLock(() => this.storage.saveAuthSession(baseUrl2, client, tokens));
+  }
+  clearAuthSession(baseUrl2) {
+    return this.withLock(() => this.storage.clearAuthSession(baseUrl2));
+  }
+  getStorageLocation() {
+    return this.storage.getStorageLocation();
+  }
+  async withLock(fn) {
+    await this.acquireLock();
     try {
-      await this.primary.saveTokens(baseUrl2, legacyTokens);
-    } catch (error) {
-      if (!this.handlePrimaryFailure(error))
-        throw error;
-      return legacyTokens;
+      return await fn();
+    } finally {
+      await this.releaseLock();
     }
-    try {
-      await this.legacy.clearTokens(baseUrl2);
-    } catch {}
-    return legacyTokens;
   }
-  async saveTokens(baseUrl2, data) {
-    if (this.primaryAvailable) {
+  async acquireLock() {
+    const startedAt = Date.now();
+    await mkdir2(dirname2(this.lockPath), { recursive: true, mode: 448 });
+    while (true) {
       try {
-        await this.primary.saveTokens(baseUrl2, data);
+        await mkdir2(this.lockPath, { recursive: false, mode: 448 });
+        try {
+          await this.writeOwner();
+        } catch (error) {
+          await rm(this.lockPath, { recursive: true, force: true }).catch(() => {
+            return;
+          });
+          throw error;
+        }
         return;
       } catch (error) {
-        if (!this.handlePrimaryFailure(error))
+        if (error.code !== "EEXIST")
           throw error;
-      }
-    }
-    await this.legacy.saveTokens(baseUrl2, data);
-  }
-  async clearTokens(baseUrl2) {
-    let primaryError;
-    if (this.primaryAvailable) {
-      try {
-        await this.primary.clearTokens(baseUrl2);
-      } catch (error) {
-        if (!this.handlePrimaryFailure(error)) {
-          primaryError = error;
+        await this.reclaimStaleLock();
+        if (Date.now() - startedAt >= this.lockTimeoutMs) {
+          throw new AuthStorageLockTimeoutError(`Timed out waiting for GitHits auth storage lock at ${this.lockPath}. If no githits process is running, remove this directory and retry.`);
         }
+        await sleep(LOCK_RETRY_MS);
       }
     }
-    try {
-      await this.legacy.clearTokens(baseUrl2);
-    } catch {}
-    if (primaryError)
-      throw primaryError;
   }
-  async loadClient(baseUrl2) {
-    if (this.primaryAvailable) {
-      try {
-        const client = await this.primary.loadClient(baseUrl2);
-        if (client)
-          return client;
-      } catch (error) {
-        if (!this.handlePrimaryFailure(error))
-          throw error;
-      }
-    }
-    const legacyClient = await this.legacy.loadClient(baseUrl2);
-    if (!legacyClient)
-      return null;
-    if (!this.primaryAvailable)
-      return legacyClient;
-    try {
-      await this.primary.saveClient(baseUrl2, legacyClient);
-    } catch (error) {
-      if (!this.handlePrimaryFailure(error))
-        throw error;
-      return legacyClient;
-    }
-    try {
-      await this.legacy.clearClient(baseUrl2);
-    } catch {}
-    return legacyClient;
+  async writeOwner() {
+    const owner = {
+      id: randomUUID3(),
+      pid: process.pid,
+      createdAt: new Date().toISOString(),
+      processStartedAt: await getProcessStartedAt(process.pid)
+    };
+    this.currentOwner = owner;
+    await writeFile2(this.ownerPath(), JSON.stringify(owner), { mode: 384 });
   }
-  async saveClient(baseUrl2, data) {
-    if (this.primaryAvailable) {
-      try {
-        await this.primary.saveClient(baseUrl2, data);
-        return;
-      } catch (error) {
-        if (!this.handlePrimaryFailure(error))
-          throw error;
-      }
+  async reclaimStaleLock() {
+    const owner = await this.readOwner();
+    if (!owner) {
+      await this.reclaimOldOwnerlessLock();
+      return;
     }
-    await this.legacy.saveClient(baseUrl2, data);
+    const ownerDead = !await this.isOwnerAlive(owner.pid, owner.processStartedAt);
+    if (!ownerDead)
+      return;
+    const currentOwner = await this.readOwner();
+    if (!currentOwner || currentOwner.id !== owner.id)
+      return;
+    await rm(this.lockPath, { recursive: true, force: true }).catch(() => {
+      return;
+    });
   }
-  async clearClient(baseUrl2) {
-    let primaryError;
-    if (this.primaryAvailable) {
-      try {
-        await this.primary.clearClient(baseUrl2);
-      } catch (error) {
-        if (!this.handlePrimaryFailure(error)) {
-          primaryError = error;
-        }
+  async reclaimOldOwnerlessLock() {
+    const createdAtMs = await lockCreatedAtMs(this.lockPath);
+    if (Date.now() - createdAtMs < ORPHANED_LOCK_MS)
+      return;
+    await rm(this.lockPath, { recursive: true, force: true }).catch(() => {
+      return;
+    });
+  }
+  async readOwner() {
+    try {
+      const raw = await readFile2(this.ownerPath(), "utf8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.id !== "string" || typeof parsed.pid !== "number" || typeof parsed.createdAt !== "string" || !(typeof parsed.processStartedAt === "string" || parsed.processStartedAt === null)) {
+        return null;
       }
+      return {
+        id: parsed.id,
+        pid: parsed.pid,
+        createdAt: parsed.createdAt,
+        processStartedAt: parsed.processStartedAt
+      };
+    } catch {
+      return null;
     }
-    try {
-      await this.legacy.clearClient(baseUrl2);
-    } catch {}
-    if (primaryError)
-      throw primaryError;
   }
-  getStorageLocation() {
-    return this.primaryAvailable ? this.primary.getStorageLocation() : this.legacy.getStorageLocation();
+  async releaseLock() {
+    const owner = this.currentOwner;
+    this.currentOwner = null;
+    if (!owner)
+      return;
+    const currentOwner = await this.readOwner();
+    if (!currentOwner || currentOwner.id !== owner.id)
+      return;
+    await rm(this.lockPath, { recursive: true, force: true }).catch(() => {
+      return;
+    });
   }
-  handlePrimaryFailure(error) {
-    if (!(error instanceof KeychainUnavailableError)) {
-      return false;
-    }
-    this.primaryAvailable = false;
-    if (!this.warnedOnPrimaryFailure) {
-      this.warnedOnPrimaryFailure = true;
-      this.onPrimaryUnavailable(error);
-    }
-    return true;
+  ownerPath() {
+    return `${this.lockPath}/${OWNER_FILE}`;
   }
 }
-// src/services/package-intelligence-service.ts
-import { z as z2 } from "zod";
-
-// src/services/promote-version-not-found.ts
-function promoteGenericVersionNotFound(error, params) {
-  if (!(error instanceof PackageIntelligenceBackendError))
-    return error;
-  if (error.graphqlCode !== undefined)
-    return error;
-  const requestedVersion = pickRequestedVersion(params);
-  if (!requestedVersion)
-    return error;
-  if (!/no matching version/i.test(error.message))
-    return error;
-  const qualifiedName = synthesizeQualifiedName(params);
-  return new PackageIntelligenceVersionNotFoundError(error.message, qualifiedName, requestedVersion, undefined);
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function pickRequestedVersion(params) {
-  if (params.version)
-    return params.version;
-  if (params.fromVersion)
-    return params.fromVersion;
-  if (params.toVersion)
-    return params.toVersion;
-  return;
-}
-function synthesizeQualifiedName(params) {
-  if (!params.registry || !params.packageName)
-    return;
-  return `${params.registry.toLowerCase()}:${params.packageName}`;
+async function isOriginalProcessAlive(pid, processStartedAt) {
+  if (!isProcessAlive(pid))
+    return false;
+  if (!processStartedAt)
+    return true;
+  return await getProcessStartedAt(pid) === processStartedAt;
 }
-
+function isProcessAlive(pid) {
+  if (pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = error.code;
+    return code === "EPERM";
+  }
+}
+async function getProcessStartedAt(pid) {
+  try {
+    if (process.platform === "win32") {
+      const { stdout: stdout2 } = await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-Command",
+        `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().ToString('o')`
+      ]);
+      return stdout2.trim() || null;
+    }
+    const { stdout } = await execFileAsync("ps", [
+      "-p",
+      String(pid),
+      "-o",
+      "lstart="
+    ]);
+    const parsed = Date.parse(stdout.trim());
+    return Number.isNaN(parsed) ? null : new Date(parsed).toISOString();
+  } catch {
+    return null;
+  }
+}
+async function lockCreatedAtMs(path) {
+  try {
+    const { stat: stat2 } = await import("node:fs/promises");
+    return (await stat2(path)).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+// src/services/mode-aware-file-auth-storage.ts
+class AuthStoragePolicyError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthStoragePolicyError";
+  }
+}
+function createFileAuthStorageGuidance(configPath) {
+  return `OAuth credentials were not saved to plaintext file storage.
+
+Options:
+  1. Unlock or fix your system keychain.
+  2. Use GITHITS_API_TOKEN for CI/automation.
+  3. If you accept storing OAuth credentials unencrypted on disk, set:
+
+     [auth]
+     storage = "file"
+
+     in ${configPath}, or run with GITHITS_AUTH_STORAGE=file.
+
+Warning: file storage is plaintext. Use it only on machines where local file access is trusted.`;
+}
+
+class ModeAwareFileAuthStorage {
+  storage;
+  mode;
+  configPath;
+  constructor(storage, mode, configPath = "your GitHits config.toml") {
+    this.storage = storage;
+    this.mode = mode;
+    this.configPath = configPath;
+  }
+  loadTokens(baseUrl2) {
+    return this.storage.loadTokens(baseUrl2);
+  }
+  async saveTokens(baseUrl2, data) {
+    this.assertFileMode();
+    await this.storage.saveTokens(baseUrl2, data);
+  }
+  async saveTokensIfUnchanged(baseUrl2, expected, data) {
+    this.assertFileMode();
+    return this.storage.saveTokensIfUnchanged(baseUrl2, expected, data);
+  }
+  clearTokens(baseUrl2) {
+    return this.storage.clearTokens(baseUrl2);
+  }
+  clearTokensIfUnchanged(baseUrl2, expected) {
+    return this.storage.clearTokensIfUnchanged(baseUrl2, expected);
+  }
+  loadClient(baseUrl2) {
+    return this.storage.loadClient(baseUrl2);
+  }
+  async saveClient(baseUrl2, data) {
+    this.assertFileMode();
+    await this.storage.saveClient(baseUrl2, data);
+  }
+  clearClient(baseUrl2) {
+    return this.storage.clearClient(baseUrl2);
+  }
+  async saveAuthSession(baseUrl2, client, tokens) {
+    this.assertFileMode();
+    await this.storage.saveAuthSession(baseUrl2, client, tokens);
+  }
+  clearAuthSession(baseUrl2) {
+    return this.storage.clearAuthSession(baseUrl2);
+  }
+  getStorageLocation() {
+    return this.storage.getStorageLocation();
+  }
+  assertFileMode() {
+    if (this.mode === "file")
+      return;
+    throw new AuthStoragePolicyError(createFileAuthStorageGuidance(this.configPath));
+  }
+}
+
+// src/services/migrating-auth-storage.ts
+class MigratingAuthStorage {
+  primary;
+  file;
+  legacy;
+  mode;
+  configPath;
+  onWarning;
+  warnedFileModeKeychainExport = false;
+  warnedAmbiguousPlaintext = false;
+  constructor(primary, file, legacy, mode, configPath = "your GitHits config.toml", onWarning = () => {}) {
+    this.primary = primary;
+    this.file = file;
+    this.legacy = legacy;
+    this.mode = mode;
+    this.configPath = configPath;
+    this.onWarning = onWarning;
+  }
+  async loadTokens(baseUrl2) {
+    if (this.mode === "file") {
+      return this.loadTokensFileMode(baseUrl2);
+    }
+    return this.loadTokensKeychainMode(baseUrl2);
+  }
+  async saveTokens(baseUrl2, data) {
+    if (this.mode === "file") {
+      await this.file.saveTokens(baseUrl2, data);
+      return;
+    }
+    try {
+      await this.primary.saveTokens(baseUrl2, data);
+    } catch (error) {
+      throw this.toPolicyError(error);
+    }
+  }
+  async saveTokensIfUnchanged(baseUrl2, expected, data) {
+    const current = await this.loadTokens(baseUrl2);
+    if (!this.sameTokenData(current, expected))
+      return false;
+    await this.saveTokens(baseUrl2, data);
+    return true;
+  }
+  async clearTokens(baseUrl2) {
+    const primaryError = await this.clearBestEffort(() => this.primary.clearTokens(baseUrl2));
+    await this.clearBestEffort(() => this.file.clearTokens(baseUrl2));
+    await this.clearBestEffort(() => this.legacy.clearTokens(baseUrl2));
+    if (primaryError && !(primaryError instanceof KeychainUnavailableError)) {
+      throw primaryError;
+    }
+  }
+  async clearTokensIfUnchanged(baseUrl2, expected) {
+    const current = await this.loadTokens(baseUrl2);
+    if (!this.sameTokenData(current, expected))
+      return false;
+    await this.clearTokens(baseUrl2);
+    return true;
+  }
+  async loadClient(baseUrl2) {
+    if (this.mode === "file") {
+      return this.loadClientFileMode(baseUrl2);
+    }
+    return this.loadClientKeychainMode(baseUrl2);
+  }
+  async saveClient(baseUrl2, data) {
+    if (this.mode === "file") {
+      await this.file.saveClient(baseUrl2, data);
+      return;
+    }
+    try {
+      await this.primary.saveClient(baseUrl2, data);
+    } catch (error) {
+      throw this.toPolicyError(error);
+    }
+  }
+  async clearClient(baseUrl2) {
+    const primaryError = await this.clearBestEffort(() => this.primary.clearClient(baseUrl2));
+    await this.clearBestEffort(() => this.file.clearClient(baseUrl2));
+    await this.clearBestEffort(() => this.legacy.clearClient(baseUrl2));
+    if (primaryError && !(primaryError instanceof KeychainUnavailableError)) {
+      throw primaryError;
+    }
+  }
+  async saveAuthSession(baseUrl2, client, tokens) {
+    if (this.mode === "file") {
+      await this.file.saveAuthSession(baseUrl2, client, tokens);
+      return;
+    }
+    try {
+      await this.primary.saveAuthSession(baseUrl2, client, tokens);
+    } catch (error) {
+      throw this.toPolicyError(error);
+    }
+  }
+  async clearAuthSession(baseUrl2) {
+    const primaryError = await this.clearBestEffort(() => this.primary.clearAuthSession(baseUrl2));
+    await this.clearBestEffort(() => this.file.clearAuthSession(baseUrl2));
+    await this.clearBestEffort(() => this.legacy.clearAuthSession(baseUrl2));
+    if (primaryError && !(primaryError instanceof KeychainUnavailableError)) {
+      throw primaryError;
+    }
+  }
+  getStorageLocation() {
+    return this.mode === "file" ? this.file.getStorageLocation() : this.primary.getStorageLocation();
+  }
+  async loadTokensKeychainMode(baseUrl2) {
+    try {
+      const primaryTokens = await this.primary.loadTokens(baseUrl2);
+      if (primaryTokens)
+        return primaryTokens;
+    } catch (error) {
+      if (!(error instanceof KeychainUnavailableError))
+        throw error;
+    }
+    const candidate = await this.selectPlaintextTokenCandidate(baseUrl2);
+    if (!candidate)
+      return null;
+    try {
+      await this.primary.saveTokens(baseUrl2, candidate.data);
+    } catch (error) {
+      if (error instanceof KeychainUnavailableError)
+        return candidate.data;
+      throw error;
+    }
+    await this.clearMigratedPlaintext(baseUrl2, "tokens", candidate.source, candidate.ambiguous);
+    return candidate.data;
+  }
+  async loadTokensFileMode(baseUrl2) {
+    const candidate = await this.selectPlaintextTokenCandidate(baseUrl2);
+    if (candidate) {
+      if (candidate.source === "legacy") {
+        await this.file.saveTokens(baseUrl2, candidate.data);
+        await this.clearBestEffort(() => this.legacy.clearTokens(baseUrl2));
+      }
+      return candidate.data;
+    }
+    let primaryTokens = null;
+    try {
+      primaryTokens = await this.primary.loadTokens(baseUrl2);
+    } catch (error) {
+      if (!(error instanceof KeychainUnavailableError))
+        throw error;
+    }
+    if (!primaryTokens)
+      return null;
+    this.warnKeychainExport();
+    await this.file.saveTokens(baseUrl2, primaryTokens);
+    return primaryTokens;
+  }
+  async loadClientKeychainMode(baseUrl2) {
+    try {
+      const primaryClient = await this.primary.loadClient(baseUrl2);
+      if (primaryClient)
+        return primaryClient;
+    } catch (error) {
+      if (!(error instanceof KeychainUnavailableError))
+        throw error;
+    }
+    const candidate = await this.selectPlaintextClientCandidate(baseUrl2);
+    if (!candidate)
+      return null;
+    try {
+      await this.primary.saveClient(baseUrl2, candidate.data);
+    } catch (error) {
+      if (error instanceof KeychainUnavailableError)
+        return candidate.data;
+      throw error;
+    }
+    await this.clearMigratedPlaintext(baseUrl2, "client", candidate.source, candidate.ambiguous);
+    return candidate.data;
+  }
+  async loadClientFileMode(baseUrl2) {
+    const candidate = await this.selectPlaintextClientCandidate(baseUrl2);
+    if (candidate) {
+      if (candidate.source === "legacy") {
+        await this.file.saveClient(baseUrl2, candidate.data);
+        await this.clearBestEffort(() => this.legacy.clearClient(baseUrl2));
+      }
+      return candidate.data;
+    }
+    let primaryClient = null;
+    try {
+      primaryClient = await this.primary.loadClient(baseUrl2);
+    } catch (error) {
+      if (!(error instanceof KeychainUnavailableError))
+        throw error;
+    }
+    if (!primaryClient)
+      return null;
+    this.warnKeychainExport();
+    await this.file.saveClient(baseUrl2, primaryClient);
+    return primaryClient;
+  }
+  async selectPlaintextTokenCandidate(baseUrl2) {
+    const candidates = [];
+    const fileTokens = await this.file.loadTokens(baseUrl2);
+    if (fileTokens) {
+      candidates.push({
+        data: fileTokens,
+        source: "file",
+        timestamp: fileTokens.createdAt,
+        ambiguous: false
+      });
+    }
+    const legacyTokens = await this.legacy.loadTokens(baseUrl2);
+    if (legacyTokens) {
+      candidates.push({
+        data: legacyTokens,
+        source: "legacy",
+        timestamp: legacyTokens.createdAt,
+        ambiguous: false
+      });
+    }
+    return this.selectNewestCandidate(candidates);
+  }
+  async selectPlaintextClientCandidate(baseUrl2) {
+    const candidates = [];
+    const fileClient = await this.file.loadClient(baseUrl2);
+    if (fileClient) {
+      candidates.push({
+        data: fileClient,
+        source: "file",
+        timestamp: fileClient.registeredAt,
+        ambiguous: false
+      });
+    }
+    const legacyClient = await this.legacy.loadClient(baseUrl2);
+    if (legacyClient) {
+      candidates.push({
+        data: legacyClient,
+        source: "legacy",
+        timestamp: legacyClient.registeredAt,
+        ambiguous: false
+      });
+    }
+    return this.selectNewestCandidate(candidates);
+  }
+  selectNewestCandidate(candidates) {
+    if (candidates.length === 0)
+      return null;
+    if (candidates.length === 1)
+      return candidates[0] ?? null;
+    const parsed = candidates.map((candidate) => ({
+      candidate,
+      timestampMs: Date.parse(candidate.timestamp)
+    }));
+    if (parsed.some((entry) => Number.isNaN(entry.timestampMs))) {
+      this.warnAmbiguousPlaintext();
+      const selected = candidates.find((candidate) => candidate.source === "file") ?? candidates[0] ?? null;
+      if (selected)
+        selected.ambiguous = true;
+      return selected;
+    }
+    const sorted = [...parsed].sort((a, b) => b.timestampMs - a.timestampMs);
+    const first = sorted[0];
+    const second = sorted[1];
+    if (!first)
+      return candidates[0] ?? null;
+    if (second && first.timestampMs === second.timestampMs) {
+      this.warnAmbiguousPlaintext();
+      const selected = candidates.find((candidate) => candidate.source === "file") ?? first.candidate;
+      selected.ambiguous = true;
+      return selected;
+    }
+    return first.candidate;
+  }
+  async clearMigratedPlaintext(baseUrl2, kind, source, ambiguous = false) {
+    if (!ambiguous) {
+      await this.clearPlaintextSource(this.file, baseUrl2, kind);
+      await this.clearPlaintextSource(this.legacy, baseUrl2, kind);
+      return;
+    }
+    if (source === "file") {
+      await this.clearPlaintextSource(this.file, baseUrl2, kind);
+      return;
+    }
+    if (source === "legacy") {
+      await this.clearPlaintextSource(this.legacy, baseUrl2, kind);
+    }
+  }
+  async clearPlaintextSource(storage, baseUrl2, kind) {
+    await this.clearBestEffort(() => kind === "tokens" ? storage.clearTokens(baseUrl2) : storage.clearClient(baseUrl2));
+  }
+  async clearBestEffort(fn) {
+    try {
+      await fn();
+      return;
+    } catch (error) {
+      return error;
+    }
+  }
+  toPolicyError(error) {
+    if (!(error instanceof KeychainUnavailableError))
+      return error;
+    return new AuthStoragePolicyError(`System keychain is unavailable. ${createFileAuthStorageGuidance(this.configPath)}`);
+  }
+  warnKeychainExport() {
+    if (this.warnedFileModeKeychainExport)
+      return;
+    this.warnedFileModeKeychainExport = true;
+    this.onWarning("Warning: auth.storage=file is exporting existing keychain credentials to plaintext file storage.");
+  }
+  warnAmbiguousPlaintext() {
+    if (this.warnedAmbiguousPlaintext)
+      return;
+    this.warnedAmbiguousPlaintext = true;
+    this.onWarning("Warning: multiple plaintext auth entries exist with ambiguous timestamps; using the new config auth path and leaving the other entry intact.");
+  }
+  sameTokenData(a, b) {
+    if (a === null || b === null)
+      return a === b;
+    return a.accessToken === b.accessToken && a.refreshToken === b.refreshToken && a.expiresAt === b.expiresAt && a.createdAt === b.createdAt;
+  }
+}
+// src/services/package-intelligence-service.ts
+import { z as z3 } from "zod";
+
+// src/services/promote-version-not-found.ts
+function promoteGenericVersionNotFound(error, params) {
+  if (!(error instanceof PackageIntelligenceBackendError))
+    return error;
+  if (error.graphqlCode !== undefined)
+    return error;
+  const requestedVersion = pickRequestedVersion(params);
+  if (!requestedVersion)
+    return error;
+  if (!/no matching version/i.test(error.message))
+    return error;
+  const qualifiedName = synthesizeQualifiedName(params);
+  return new PackageIntelligenceVersionNotFoundError(error.message, qualifiedName, requestedVersion, undefined);
+}
+function pickRequestedVersion(params) {
+  if (params.version)
+    return params.version;
+  if (params.fromVersion)
+    return params.fromVersion;
+  if (params.toVersion)
+    return params.toVersion;
+  return;
+}
+function synthesizeQualifiedName(params) {
+  if (!params.registry || !params.packageName)
+    return;
+  return `${params.registry.toLowerCase()}:${params.packageName}`;
+}
+
 // src/services/package-intelligence-service.ts
 class PackageIntelligenceAccessError extends Error {
   constructor(message) {
@@ -2975,63 +3563,63 @@ class PackageIntelligenceChangelogSourceNotFoundError extends Error {
     this.name = "PackageIntelligenceChangelogSourceNotFoundError";
   }
 }
-var githubRepositorySchema = z2.object({
-  stargazersCount: z2.number().int().nullable().optional(),
-  forksCount: z2.number().int().nullable().optional(),
-  openIssuesCount: z2.number().int().nullable().optional(),
-  archived: z2.boolean().nullable().optional(),
-  language: z2.string().nullable().optional(),
-  topics: z2.array(z2.string()).nullable().optional(),
-  pushedAt: z2.string().nullable().optional()
+var githubRepositorySchema = z3.object({
+  stargazersCount: z3.number().int().nullable().optional(),
+  forksCount: z3.number().int().nullable().optional(),
+  openIssuesCount: z3.number().int().nullable().optional(),
+  archived: z3.boolean().nullable().optional(),
+  language: z3.string().nullable().optional(),
+  topics: z3.array(z3.string()).nullable().optional(),
+  pushedAt: z3.string().nullable().optional()
 }).nullable().optional();
-var packageIdentitySchema = z2.object({
-  name: z2.string().nullable().optional(),
-  registry: z2.string().nullable().optional(),
-  description: z2.string().nullable().optional(),
-  latestVersion: z2.string().nullable().optional(),
-  latestVersionPublishedAt: z2.string().nullable().optional(),
-  homepage: z2.string().nullable().optional(),
-  repositoryUrl: z2.string().nullable().optional(),
-  license: z2.string().nullable().optional(),
-  downloadsLastMonth: z2.number().int().nullable().optional(),
-  downloadsTotal: z2.number().int().nullable().optional(),
+var packageIdentitySchema = z3.object({
+  name: z3.string().nullable().optional(),
+  registry: z3.string().nullable().optional(),
+  description: z3.string().nullable().optional(),
+  latestVersion: z3.string().nullable().optional(),
+  latestVersionPublishedAt: z3.string().nullable().optional(),
+  homepage: z3.string().nullable().optional(),
+  repositoryUrl: z3.string().nullable().optional(),
+  license: z3.string().nullable().optional(),
+  downloadsLastMonth: z3.number().int().nullable().optional(),
+  downloadsTotal: z3.number().int().nullable().optional(),
   githubRepository: githubRepositorySchema
 });
-var vulnerabilityOverviewSchema = z2.object({
-  osvId: z2.string().nullable().optional(),
-  summary: z2.string().nullable().optional(),
-  severityScore: z2.number().nullable().optional(),
-  publishedAt: z2.string().nullable().optional()
+var vulnerabilityOverviewSchema = z3.object({
+  osvId: z3.string().nullable().optional(),
+  summary: z3.string().nullable().optional(),
+  severityScore: z3.number().nullable().optional(),
+  publishedAt: z3.string().nullable().optional()
 });
-var packageSecurityOverviewSchema = z2.object({
-  vulnerabilityCount: z2.number().int().nullable().optional(),
-  hasCurrentVulnerabilities: z2.boolean().nullable().optional(),
-  recentVulnerabilities: z2.array(vulnerabilityOverviewSchema).nullable().optional()
+var packageSecurityOverviewSchema = z3.object({
+  vulnerabilityCount: z3.number().int().nullable().optional(),
+  hasCurrentVulnerabilities: z3.boolean().nullable().optional(),
+  recentVulnerabilities: z3.array(vulnerabilityOverviewSchema).nullable().optional()
 }).nullable().optional();
-var quickstartInfoSchema = z2.object({
-  installCommand: z2.string().nullable().optional(),
-  usageExample: z2.string().nullable().optional()
+var quickstartInfoSchema = z3.object({
+  installCommand: z3.string().nullable().optional(),
+  usageExample: z3.string().nullable().optional()
 }).nullable().optional();
-var changelogEntrySchema = z2.object({
-  version: z2.string().nullable().optional(),
-  publishedAt: z2.string().nullable().optional(),
-  body: z2.string().nullable().optional()
+var changelogEntrySchema = z3.object({
+  version: z3.string().nullable().optional(),
+  publishedAt: z3.string().nullable().optional(),
+  body: z3.string().nullable().optional()
 });
-var packageSummaryResponseSchema = z2.object({
+var packageSummaryResponseSchema = z3.object({
   package: packageIdentitySchema.nullable().optional(),
   security: packageSecurityOverviewSchema,
   quickstart: quickstartInfoSchema,
-  latestChangelogs: z2.array(changelogEntrySchema).nullable().optional()
+  latestChangelogs: z3.array(changelogEntrySchema).nullable().optional()
 });
-var graphQLErrorSchema2 = z2.object({
-  message: z2.string(),
-  extensions: z2.record(z2.string(), z2.unknown()).optional()
+var graphQLErrorSchema2 = z3.object({
+  message: z3.string(),
+  extensions: z3.record(z3.string(), z3.unknown()).optional()
 });
-var graphQLResponseSchema = z2.object({
-  data: z2.object({
+var graphQLResponseSchema = z3.object({
+  data: z3.object({
     packageSummary: packageSummaryResponseSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z2.array(graphQLErrorSchema2).optional()
+  errors: z3.array(graphQLErrorSchema2).optional()
 });
 var PACKAGE_SUMMARY_QUERY = `
 query PackageSummary($registry: Registry!, $name: String!) {
@@ -3078,39 +3666,55 @@ query PackageSummary($registry: Registry!, $name: String!) {
     }
   }
 }`;
-var packageVersionIdentitySchema = z2.object({
-  name: z2.string().nullable().optional(),
-  registry: z2.string().nullable().optional(),
-  version: z2.string().nullable().optional()
+var packageVersionIdentitySchema = z3.object({
+  name: z3.string().nullable().optional(),
+  registry: z3.string().nullable().optional(),
+  version: z3.string().nullable().optional()
 });
-var vulnerabilityDetailSchema = z2.object({
-  osvId: z2.string().nullable().optional(),
-  summary: z2.string().nullable().optional(),
-  severityScore: z2.number().nullable().optional(),
-  severityType: z2.string().nullable().optional(),
-  affectedVersionRanges: z2.array(z2.string()).nullable().optional(),
-  fixedInVersions: z2.array(z2.string()).nullable().optional(),
-  publishedAt: z2.string().nullable().optional(),
-  modifiedAt: z2.string().nullable().optional(),
-  withdrawnAt: z2.string().nullable().optional(),
-  aliases: z2.array(z2.string()).nullable().optional(),
-  isMalicious: z2.boolean().nullable().optional()
+var vulnerabilityDetailSchema = z3.object({
+  osvId: z3.string().nullable().optional(),
+  summary: z3.string().nullable().optional(),
+  severityScore: z3.number().nullable().optional(),
+  severityType: z3.string().nullable().optional(),
+  affectedVersionRanges: z3.array(z3.string()).nullable().optional(),
+  affectedVersionRangesCount: z3.number().int(),
+  affectedVersionRangesTruncated: z3.boolean(),
+  fixedInVersions: z3.array(z3.string()).nullable().optional(),
+  publishedAt: z3.string().nullable().optional(),
+  modifiedAt: z3.string().nullable().optional(),
+  withdrawnAt: z3.string().nullable().optional(),
+  aliases: z3.array(z3.string()).nullable().optional(),
+  isMalicious: z3.boolean().nullable().optional(),
+  affectsInspectedVersion: z3.boolean(),
+  matchedAffectedVersionRanges: z3.array(z3.string()),
+  duplicateIds: z3.array(z3.string())
+});
+var pageInfoSchema = z3.object({
+  hasNextPage: z3.boolean(),
+  endCursor: z3.string().nullable().optional(),
+  totalCount: z3.number().int()
+});
+var vulnerabilityAdvisoryPageSchema = z3.object({
+  entries: z3.array(vulnerabilityDetailSchema),
+  pageInfo: pageInfoSchema
 });
-var vulnerabilitySecurityDetailsSchema = z2.object({
-  vulnerabilityCount: z2.number().int().nullable().optional(),
-  currentVersionAffected: z2.boolean().nullable().optional(),
-  vulnerabilities: z2.array(vulnerabilityDetailSchema).nullable().optional(),
-  upgradePaths: z2.array(z2.string()).nullable().optional()
+var vulnerabilitySecurityDetailsSchema = z3.object({
+  affectedVulnerabilityCount: z3.number().int(),
+  nonAffectingVulnerabilityCount: z3.number().int(),
+  allVulnerabilityCount: z3.number().int(),
+  currentVersionAffected: z3.boolean().nullable().optional(),
+  advisories: vulnerabilityAdvisoryPageSchema,
+  upgradePaths: z3.array(z3.string()).nullable().optional()
 }).nullable().optional();
-var vulnerabilityReportResponseSchema = z2.object({
+var vulnerabilityReportResponseSchema = z3.object({
   package: packageVersionIdentitySchema.nullable().optional(),
   security: vulnerabilitySecurityDetailsSchema
 });
-var vulnerabilitiesGraphQLResponseSchema = z2.object({
-  data: z2.object({
+var vulnerabilitiesGraphQLResponseSchema = z3.object({
+  data: z3.object({
     packageVulnerabilities: vulnerabilityReportResponseSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z2.array(graphQLErrorSchema2).optional()
+  errors: z3.array(graphQLErrorSchema2).optional()
 });
 var PACKAGE_VULNERABILITIES_QUERY = `
 query PackageVulnerabilities(
@@ -3119,6 +3723,7 @@ query PackageVulnerabilities(
   $version: String
   $minSeverity: Float
   $includeWithdrawn: Boolean
+  $after: String
 ) {
   packageVulnerabilities(
     registry: $registry
@@ -3133,110 +3738,124 @@ query PackageVulnerabilities(
       version
     }
     security {
-      vulnerabilityCount
+      affectedVulnerabilityCount
+      nonAffectingVulnerabilityCount
+      allVulnerabilityCount
       currentVersionAffected
       upgradePaths
-      vulnerabilities {
-        osvId
-        summary
-        severityScore
-        severityType
-        affectedVersionRanges
-        fixedInVersions
-        publishedAt
-        modifiedAt
-        withdrawnAt
-        aliases
-        isMalicious
+      advisories(scope: AFFECTED, first: 100, after: $after) {
+        entries {
+          osvId
+          summary
+          severityScore
+          severityType
+          affectedVersionRanges
+          affectedVersionRangesCount
+          affectedVersionRangesTruncated
+          fixedInVersions
+          publishedAt
+          modifiedAt
+          withdrawnAt
+          aliases
+          isMalicious
+          affectsInspectedVersion
+          matchedAffectedVersionRanges
+          duplicateIds
+        }
+        pageInfo {
+          hasNextPage
+          endCursor
+          totalCount
+        }
       }
     }
   }
 }`;
-var directDependencySchema = z2.object({
-  name: z2.string().nullable().optional(),
-  versionConstraint: z2.string().nullable().optional(),
-  type: z2.string().nullable().optional()
+var directDependencySchema = z3.object({
+  name: z3.string().nullable().optional(),
+  versionConstraint: z3.string().nullable().optional(),
+  type: z3.string().nullable().optional()
 });
-var dependencyGraphNodeSchema = z2.object({
-  registry: z2.string(),
-  name: z2.string(),
-  version: z2.string().nullable().optional()
+var dependencyGraphNodeSchema = z3.object({
+  registry: z3.string(),
+  name: z3.string(),
+  version: z3.string().nullable().optional()
 });
-var dependencyGraphEdgeSchema = z2.object({
-  fromIndex: z2.number().int().nullable().optional(),
-  toIndex: z2.number().int(),
-  constraint: z2.string().nullable().optional(),
-  dependencyType: z2.string().nullable().optional()
+var dependencyGraphEdgeSchema = z3.object({
+  fromIndex: z3.number().int().nullable().optional(),
+  toIndex: z3.number().int(),
+  constraint: z3.string().nullable().optional(),
+  dependencyType: z3.string().nullable().optional()
 });
-var dependencyGraphSchema = z2.object({
-  formatVersion: z2.number().int(),
-  nodes: z2.array(dependencyGraphNodeSchema),
-  edges: z2.array(dependencyGraphEdgeSchema)
+var dependencyGraphSchema = z3.object({
+  formatVersion: z3.number().int(),
+  nodes: z3.array(dependencyGraphNodeSchema),
+  edges: z3.array(dependencyGraphEdgeSchema)
 });
-var dependencyConflictEdgeSchema = z2.object({
-  fromIndex: z2.number().int().nullable().optional(),
-  toIndex: z2.number().int(),
-  versionConstraint: z2.string(),
-  dependencyType: z2.string()
+var dependencyConflictEdgeSchema = z3.object({
+  fromIndex: z3.number().int().nullable().optional(),
+  toIndex: z3.number().int(),
+  versionConstraint: z3.string(),
+  dependencyType: z3.string()
 });
-var dependencyConflictSchema = z2.object({
-  packageName: z2.string(),
-  requiredVersions: z2.array(z2.string()),
-  conflictingEdges: z2.array(dependencyConflictEdgeSchema)
+var dependencyConflictSchema = z3.object({
+  packageName: z3.string(),
+  requiredVersions: z3.array(z3.string()),
+  conflictingEdges: z3.array(dependencyConflictEdgeSchema)
 });
-var circularDependencyCycleSchema = z2.object({
-  cycleStart: z2.string(),
-  circularPath: z2.array(z2.string()),
-  displayChain: z2.string()
+var circularDependencyCycleSchema = z3.object({
+  cycleStart: z3.string(),
+  circularPath: z3.array(z3.string()),
+  displayChain: z3.string()
 });
-var environmentMarkerSchema = z2.object({
-  type: z2.string().nullable().optional(),
-  value: z2.string().nullable().optional(),
-  raw: z2.string().nullable().optional()
+var environmentMarkerSchema = z3.object({
+  type: z3.string().nullable().optional(),
+  value: z3.string().nullable().optional(),
+  raw: z3.string().nullable().optional()
 });
-var transitiveDependencySchema = z2.object({
-  totalEdges: z2.number().int().nullable().optional(),
-  uniquePackagesCount: z2.number().int().nullable().optional(),
-  uniqueDependencies: z2.array(z2.string()).nullable().optional(),
-  dependencyConflicts: z2.array(dependencyConflictSchema).nullable().optional(),
-  circularDependencyCycles: z2.array(circularDependencyCycleSchema).nullable().optional(),
+var transitiveDependencySchema = z3.object({
+  totalEdges: z3.number().int().nullable().optional(),
+  uniquePackagesCount: z3.number().int().nullable().optional(),
+  uniqueDependencies: z3.array(z3.string()).nullable().optional(),
+  dependencyConflicts: z3.array(dependencyConflictSchema).nullable().optional(),
+  circularDependencyCycles: z3.array(circularDependencyCycleSchema).nullable().optional(),
   dependencyGraph: dependencyGraphSchema.nullable().optional()
 }).nullable().optional();
-var dependencyBundleSchema = z2.object({
-  direct: z2.array(directDependencySchema).nullable().optional(),
+var dependencyBundleSchema = z3.object({
+  direct: z3.array(directDependencySchema).nullable().optional(),
   transitive: transitiveDependencySchema
 }).nullable().optional();
-var groupDependencySchema = z2.object({
-  name: z2.string(),
-  constraint: z2.string().nullable().optional()
+var groupDependencySchema = z3.object({
+  name: z3.string(),
+  constraint: z3.string().nullable().optional()
 });
-var dependencyGroupSchema = z2.object({
-  name: z2.string(),
-  lifecycle: z2.string(),
-  conditionType: z2.string(),
-  conditionValue: z2.string().nullable().optional(),
-  selectionMode: z2.string(),
-  exclusiveGroup: z2.string().nullable().optional(),
-  fallbackPriority: z2.number().int().nullable().optional(),
-  compatibleWith: z2.array(z2.string()).nullable().optional(),
-  defaultEnabled: z2.boolean().nullable().optional(),
-  dependencies: z2.array(groupDependencySchema)
+var dependencyGroupSchema = z3.object({
+  name: z3.string(),
+  lifecycle: z3.string(),
+  conditionType: z3.string(),
+  conditionValue: z3.string().nullable().optional(),
+  selectionMode: z3.string(),
+  exclusiveGroup: z3.string().nullable().optional(),
+  fallbackPriority: z3.number().int().nullable().optional(),
+  compatibleWith: z3.array(z3.string()).nullable().optional(),
+  defaultEnabled: z3.boolean().nullable().optional(),
+  dependencies: z3.array(groupDependencySchema)
 });
-var dependencyGroupsInfoSchema = z2.object({
-  primaryGroup: z2.string().nullable().optional(),
-  environmentMarkers: z2.array(environmentMarkerSchema).nullable().optional(),
-  groups: z2.array(dependencyGroupSchema)
+var dependencyGroupsInfoSchema = z3.object({
+  primaryGroup: z3.string().nullable().optional(),
+  environmentMarkers: z3.array(environmentMarkerSchema).nullable().optional(),
+  groups: z3.array(dependencyGroupSchema)
 }).nullable().optional();
-var dependencyReportResponseSchema = z2.object({
+var dependencyReportResponseSchema = z3.object({
   package: packageVersionIdentitySchema.nullable().optional(),
   dependencies: dependencyBundleSchema,
   dependencyGroups: dependencyGroupsInfoSchema
 });
-var dependenciesGraphQLResponseSchema = z2.object({
-  data: z2.object({
+var dependenciesGraphQLResponseSchema = z3.object({
+  data: z3.object({
     packageDependencies: dependencyReportResponseSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z2.array(graphQLErrorSchema2).optional()
+  errors: z3.array(graphQLErrorSchema2).optional()
 });
 var PACKAGE_DEPENDENCIES_QUERY = `
 query PackageDependencies(
@@ -3330,32 +3949,32 @@ query PackageDependencies(
     }
   }
 }`;
-var changelogPackageInfoSchema = z2.object({
-  name: z2.string().nullable().optional(),
-  registry: z2.string().nullable().optional(),
-  repoUrl: z2.string().nullable().optional(),
-  fromVersion: z2.string().nullable().optional(),
-  toVersion: z2.string().nullable().optional(),
-  limit: z2.number().int().nullable().optional()
+var changelogPackageInfoSchema = z3.object({
+  name: z3.string().nullable().optional(),
+  registry: z3.string().nullable().optional(),
+  repoUrl: z3.string().nullable().optional(),
+  fromVersion: z3.string().nullable().optional(),
+  toVersion: z3.string().nullable().optional(),
+  limit: z3.number().int().nullable().optional()
 }).nullable().optional();
-var changelogEntryDetailSchema = z2.object({
-  version: z2.string().nullable().optional(),
-  normalizedVersion: z2.string().nullable().optional(),
-  body: z2.string().nullable().optional(),
-  htmlUrl: z2.string().nullable().optional(),
-  publishedAt: z2.string().nullable().optional(),
-  metadata: z2.unknown().nullable().optional()
+var changelogEntryDetailSchema = z3.object({
+  version: z3.string().nullable().optional(),
+  normalizedVersion: z3.string().nullable().optional(),
+  body: z3.string().nullable().optional(),
+  htmlUrl: z3.string().nullable().optional(),
+  publishedAt: z3.string().nullable().optional(),
+  metadata: z3.unknown().nullable().optional()
 });
-var changelogReportResponseSchema = z2.object({
+var changelogReportResponseSchema = z3.object({
   package: changelogPackageInfoSchema,
-  source: z2.string().nullable().optional(),
-  entries: z2.array(changelogEntryDetailSchema).nullable().optional()
+  source: z3.string().nullable().optional(),
+  entries: z3.array(changelogEntryDetailSchema).nullable().optional()
 });
-var changelogGraphQLResponseSchema = z2.object({
-  data: z2.object({
+var changelogGraphQLResponseSchema = z3.object({
+  data: z3.object({
     packageChangelog: changelogReportResponseSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z2.array(graphQLErrorSchema2).optional()
+  errors: z3.array(graphQLErrorSchema2).optional()
 });
 var PACKAGE_CHANGELOG_QUERY = `
 query PackageChangelog(
@@ -3395,72 +4014,72 @@ query PackageChangelog(
     }
   }
 }`;
-var packageDocSourceKindSchema = z2.enum(["CRAWLED", "REPOSITORY"]);
-var packageDocPageSummarySchema = z2.object({
-  id: z2.string().nullable().optional(),
-  title: z2.string().nullable().optional(),
-  slug: z2.string().nullable().optional(),
-  order: z2.number().int().nullable().optional(),
-  linkName: z2.string().nullable().optional(),
-  lastUpdatedAt: z2.string().nullable().optional(),
+var packageDocSourceKindSchema = z3.enum(["CRAWLED", "REPOSITORY"]);
+var packageDocPageSummarySchema = z3.object({
+  id: z3.string().nullable().optional(),
+  title: z3.string().nullable().optional(),
+  slug: z3.string().nullable().optional(),
+  order: z3.number().int().nullable().optional(),
+  linkName: z3.string().nullable().optional(),
+  lastUpdatedAt: z3.string().nullable().optional(),
   sourceKind: packageDocSourceKindSchema.nullable().optional(),
-  sourceUrl: z2.string().nullable().optional(),
-  repoUrl: z2.string().nullable().optional(),
-  gitRef: z2.string().nullable().optional(),
-  requestedRef: z2.string().nullable().optional(),
-  filePath: z2.string().nullable().optional()
+  sourceUrl: z3.string().nullable().optional(),
+  repoUrl: z3.string().nullable().optional(),
+  gitRef: z3.string().nullable().optional(),
+  requestedRef: z3.string().nullable().optional(),
+  filePath: z3.string().nullable().optional()
 });
-var packageDocsPageInfoSchema = z2.object({
-  hasNextPage: z2.boolean(),
-  endCursor: z2.string().nullable().optional(),
-  totalCount: z2.number().int().nullable().optional()
+var packageDocsPageInfoSchema = z3.object({
+  hasNextPage: z3.boolean(),
+  endCursor: z3.string().nullable().optional(),
+  totalCount: z3.number().int().nullable().optional()
 }).nullable().optional();
-var packageDocsListResponseSchema = z2.object({
-  registry: z2.string().nullable().optional(),
-  packageName: z2.string().nullable().optional(),
-  version: z2.string().nullable().optional(),
-  stale: z2.boolean().nullable().optional(),
-  pages: z2.array(packageDocPageSummarySchema).nullable().optional(),
+var packageDocsListResponseSchema = z3.object({
+  registry: z3.string().nullable().optional(),
+  packageName: z3.string().nullable().optional(),
+  version: z3.string().nullable().optional(),
+  stale: z3.boolean().nullable().optional(),
+  pages: z3.array(packageDocPageSummarySchema).nullable().optional(),
   pageInfo: packageDocsPageInfoSchema
 });
-var packageDocSourceSchema = z2.object({
-  url: z2.string().nullable().optional(),
-  label: z2.string().nullable().optional()
+var packageDocSourceSchema = z3.object({
+  url: z3.string().nullable().optional(),
+  label: z3.string().nullable().optional()
 }).nullable().optional();
-var packageDocPageSchema = z2.object({
-  id: z2.string().nullable().optional(),
-  title: z2.string().nullable().optional(),
-  content: z2.string().nullable().optional(),
-  contentFormat: z2.string().nullable().optional(),
-  breadcrumbs: z2.array(z2.string()).nullable().optional(),
-  linkName: z2.string().nullable().optional(),
-  lastUpdatedAt: z2.string().nullable().optional(),
+var packageDocPageSchema = z3.object({
+  id: z3.string().nullable().optional(),
+  title: z3.string().nullable().optional(),
+  content: z3.string().nullable().optional(),
+  contentFormat: z3.string().nullable().optional(),
+  breadcrumbs: z3.array(z3.string()).nullable().optional(),
+  linkName: z3.string().nullable().optional(),
+  lastUpdatedAt: z3.string().nullable().optional(),
   sourceKind: packageDocSourceKindSchema.nullable().optional(),
   source: packageDocSourceSchema,
-  repoUrl: z2.string().nullable().optional(),
-  gitRef: z2.string().nullable().optional(),
-  requestedRef: z2.string().nullable().optional(),
-  filePath: z2.string().nullable().optional(),
-  baseUrl: z2.string().nullable().optional()
+  repoUrl: z3.string().nullable().optional(),
+  gitRef: z3.string().nullable().optional(),
+  requestedRef: z3.string().nullable().optional(),
+  filePath: z3.string().nullable().optional(),
+  baseUrl: z3.string().nullable().optional()
 }).nullable().optional();
-var packageDocResultResponseSchema = z2.object({
-  registry: z2.string().nullable().optional(),
-  packageName: z2.string().nullable().optional(),
-  version: z2.string().nullable().optional(),
+var packageDocResultResponseSchema = z3.object({
+  registry: z3.string().nullable().optional(),
+  packageName: z3.string().nullable().optional(),
+  version: z3.string().nullable().optional(),
   sourceKind: packageDocSourceKindSchema.nullable().optional(),
   page: packageDocPageSchema
 });
-var packageDocsListGraphQLResponseSchema = z2.object({
-  data: z2.object({
+var packageDocsListGraphQLResponseSchema = z3.object({
+  data: z3.object({
     listPackageDocs: packageDocsListResponseSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z2.array(graphQLErrorSchema2).optional()
+  errors: z3.array(graphQLErrorSchema2).optional()
 });
-var packageDocReadGraphQLResponseSchema = z2.object({
-  data: z2.object({
+var packageDocReadGraphQLResponseSchema = z3.object({
+  data: z3.object({
     getDocPage: packageDocResultResponseSchema.nullable().optional()
   }).nullable().optional(),
-  errors: z2.array(graphQLErrorSchema2).optional()
+  errors: z3.array(graphQLErrorSchema2).optional()
 });
 var LIST_PACKAGE_DOCS_QUERY = `
 query ListPackageDocs(
@@ -3602,6 +4221,9 @@ class PackageIntelligenceServiceImpl {
     const extensions = getPrimaryExtensions2(errors);
     const code = typeof extensions?.code === "string" ? extensions.code : undefined;
     const retryable = typeof extensions?.retryable === "boolean" ? extensions.retryable : undefined;
+    if (isClientUpdateRequiredGraphQLError({ message, code })) {
+      return new ClientUpdateRequiredError;
+    }
     switch (code) {
       case "NOT_FOUND":
       case "PACKAGE_NOT_FOUND":
@@ -3692,6 +4314,56 @@ class PackageIntelligenceServiceImpl {
     }));
   }
   async executePackageVulnerabilities(token, params) {
+    let after = null;
+    let firstPage;
+    const entries = [];
+    const seenCursors = new Set;
+    do {
+      const page = await this.fetchPackageVulnerabilitiesPage(token, params, after);
+      if (!firstPage)
+        firstPage = page;
+      const advisoryPage = page.security?.advisories;
+      if (!advisoryPage) {
+        after = null;
+        break;
+      }
+      entries.push(...advisoryPage.entries);
+      if (advisoryPage.pageInfo.hasNextPage) {
+        const nextCursor = advisoryPage.pageInfo.endCursor;
+        if (!nextCursor) {
+          throw new MalformedPackageIntelligenceResponseError("Vulnerability response pagination omitted next cursor.");
+        }
+        if (seenCursors.has(nextCursor)) {
+          throw new MalformedPackageIntelligenceResponseError("Vulnerability response pagination repeated a cursor.");
+        }
+        seenCursors.add(nextCursor);
+        after = nextCursor;
+      } else {
+        after = null;
+      }
+    } while (after !== null);
+    if (!firstPage) {
+      throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
+    }
+    if (firstPage.security) {
+      const expectedCount = firstPage.security.advisories.pageInfo.totalCount;
+      if (entries.length !== expectedCount) {
+        throw new MalformedPackageIntelligenceResponseError("Vulnerability response pagination returned an incomplete advisory set.");
+      }
+    }
+    const data = firstPage.security ? {
+      ...firstPage,
+      security: {
+        ...firstPage.security,
+        advisories: {
+          ...firstPage.security.advisories,
+          entries
+        }
+      }
+    } : firstPage;
+    return this.normaliseVulnerabilityReport(data);
+  }
+  async fetchPackageVulnerabilitiesPage(token, params, after) {
     let response;
     try {
       response = await postPkgseerGraphql({
@@ -3703,7 +4375,8 @@ class PackageIntelligenceServiceImpl {
           name: params.packageName,
           version: params.version,
           minSeverity: params.minSeverity,
-          includeWithdrawn: params.includeWithdrawn
+          includeWithdrawn: params.includeWithdrawn,
+          after
         },
         fetchFn: this.fetchFn
       });
@@ -3727,7 +4400,7 @@ class PackageIntelligenceServiceImpl {
     if (!data) {
       throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
     }
-    return this.normaliseVulnerabilityReport(data);
+    return data;
   }
   normaliseVulnerabilityReport(data) {
     const name = data.package?.name ?? undefined;
@@ -3741,21 +4414,28 @@ class PackageIntelligenceServiceImpl {
       registry: data.package?.registry ?? undefined
     };
     const security = data.security ? {
-      vulnerabilityCount: data.security.vulnerabilityCount ?? undefined,
+      affectedVulnerabilityCount: data.security.affectedVulnerabilityCount,
+      nonAffectingVulnerabilityCount: data.security.nonAffectingVulnerabilityCount,
+      allVulnerabilityCount: data.security.allVulnerabilityCount,
       currentVersionAffected: data.security.currentVersionAffected ?? undefined,
-      vulnerabilities: data.security.vulnerabilities?.map((vuln) => ({
+      vulnerabilities: data.security.advisories.entries.map((vuln) => ({
         osvId: vuln.osvId ?? undefined,
         summary: vuln.summary ?? undefined,
         severityScore: vuln.severityScore ?? undefined,
         severityType: vuln.severityType ?? undefined,
         affectedVersionRanges: vuln.affectedVersionRanges ?? undefined,
+        affectedVersionRangesCount: vuln.affectedVersionRangesCount,
+        affectedVersionRangesTruncated: vuln.affectedVersionRangesTruncated,
         fixedInVersions: vuln.fixedInVersions ?? undefined,
         publishedAt: vuln.publishedAt ?? undefined,
         modifiedAt: vuln.modifiedAt ?? undefined,
         withdrawnAt: vuln.withdrawnAt ?? undefined,
         aliases: vuln.aliases ?? undefined,
-        isMalicious: vuln.isMalicious ?? undefined
-      })) ?? undefined,
+        isMalicious: vuln.isMalicious ?? undefined,
+        affectsInspectedVersion: vuln.affectsInspectedVersion,
+        matchedAffectedVersionRanges: vuln.matchedAffectedVersionRanges,
+        duplicateIds: vuln.duplicateIds
+      })),
       upgradePaths: data.security.upgradePaths ?? undefined
     } : undefined;
     return {
@@ -3946,12 +4626,12 @@ class PackageIntelligenceServiceImpl {
     return this.normaliseChangelogReport(data, params);
   }
   normaliseChangelogReport(data, params) {
-    const source = data.source ?? undefined;
-    if (!source) {
+    const source = data.source && data.source.trim() ? data.source : undefined;
+    const rawEntries = data.entries ?? [];
+    if (!source && rawEntries.length === 0) {
       const target = params.repoUrl ?? (params.registry && params.packageName ? `${params.registry.toLowerCase()}:${params.packageName}` : "package");
       throw new PackageIntelligenceChangelogSourceNotFoundError(`No changelog source available for ${target} (tried GitHub Releases, CHANGELOG.md, and HexDocs).`);
     }
-    const rawEntries = data.entries ?? [];
     const entries = rawEntries.map((entry) => ({
       version: entry.version ?? undefined,
       normalizedVersion: entry.normalizedVersion ?? undefined,
@@ -4292,37 +4972,428 @@ class TokenManager {
           refreshToken: tokens.refreshToken
         }));
       } catch {
+        const reloadedToken = await this.loadExternallyUpdatedToken(tokens);
+        if (reloadedToken)
+          return reloadedToken.accessToken;
         const isExpired = tokens.expiresAt ? new Date >= new Date(tokens.expiresAt) : false;
         if (isExpired) {
+          const currentStoredTokens = await this.loadExternallyUpdatedToken(tokens);
+          if (currentStoredTokens)
+            return currentStoredTokens.accessToken;
+          const cleared = await withTelemetrySpan("token-manager.clear-tokens-if-unchanged", () => this.authStorage.clearTokensIfUnchanged(this.mcpUrl, tokens));
+          if (!cleared) {
+            const currentToken = await this.authStorage.loadTokens(this.mcpUrl);
+            this.cachedToken = currentToken;
+            return currentToken?.accessToken;
+          }
           this.cachedToken = null;
-          await withTelemetrySpan("token-manager.clear-tokens", () => this.authStorage.clearTokens(this.mcpUrl));
         }
         return;
       }
       const newTokenData = {
         accessToken: response.accessToken,
-        refreshToken: response.refreshToken,
+        refreshToken: response.refreshToken ?? tokens.refreshToken,
         expiresAt: new Date(Date.now() + response.expiresIn * 1000).toISOString(),
         createdAt: new Date().toISOString()
       };
-      await withTelemetrySpan("token-manager.save-tokens", () => this.authStorage.saveTokens(this.mcpUrl, newTokenData));
+      const externallyUpdatedToken = await this.loadExternallyUpdatedToken(tokens, {
+        treatMissingAsExternalUpdate: true
+      });
+      if (externallyUpdatedToken === null)
+        return;
+      if (externallyUpdatedToken)
+        return externallyUpdatedToken.accessToken;
+      const saved = await withTelemetrySpan("token-manager.save-tokens", () => this.authStorage.saveTokensIfUnchanged(this.mcpUrl, tokens, newTokenData));
+      if (!saved) {
+        const currentToken = await this.authStorage.loadTokens(this.mcpUrl);
+        this.cachedToken = currentToken;
+        return currentToken?.accessToken;
+      }
       this.cachedToken = newTokenData;
       return response.accessToken;
     });
   }
+  async loadExternallyUpdatedToken(failedTokens, options = {}) {
+    const storedTokens = await withTelemetrySpan("token-manager.reload-tokens", () => this.authStorage.loadTokens(this.mcpUrl));
+    if (!storedTokens) {
+      if (options.treatMissingAsExternalUpdate)
+        this.cachedToken = null;
+      return options.treatMissingAsExternalUpdate ? null : undefined;
+    }
+    if (areSameTokenData(storedTokens, failedTokens))
+      return;
+    this.cachedToken = storedTokens;
+    return storedTokens;
+  }
 }
-// src/container.ts
-function createAuthStorage(fileSystemService) {
-  return withTelemetrySpanSync("container.create-auth-storage", () => {
-    const fileStorage = new AuthStorageImpl(fileSystemService);
-    const rawKeyring = new KeyringServiceImpl;
-    const keyring = process.platform === "win32" ? new ChunkingKeyringService(rawKeyring, WINDOWS_MAX_ENTRY_SIZE) : rawKeyring;
-    const keychainStorage = new KeychainAuthStorage(keyring);
-    return new MigratingAuthStorage(keychainStorage, fileStorage, (error) => {
-      if (!(error instanceof KeychainUnavailableError))
-        return;
-      console.error("Warning: System keychain unavailable. Falling back to file-based credential storage.");
+function areSameTokenData(a, b) {
+  return a.accessToken === b.accessToken && a.refreshToken === b.refreshToken && a.expiresAt === b.expiresAt && a.createdAt === b.createdAt;
+}
+// src/services/update-check-service.ts
+import semver from "semver";
+var NPM_DIST_TAGS_URL = "https://registry.npmjs.org/-/package/githits/dist-tags";
+var NPM_PACKAGE_VERSION_URL = "https://registry.npmjs.org/githits";
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+var FETCH_TIMEOUT_MS = 1000;
+var DIR_MODE2 = 448;
+var UPDATE_COMMAND = "npm i -g githits@latest";
+var MAX_DEPRECATION_REASON_LENGTH = 200;
+
+class NpmRegistryUpdateCheckService {
+  currentVersion;
+  fs;
+  fetcher;
+  env;
+  now;
+  checkIntervalMs;
+  fetchTimeoutMs;
+  configDir;
+  cachePath;
+  constructor(options) {
+    this.currentVersion = options.currentVersion;
+    this.fs = options.fileSystemService;
+    this.fetcher = options.fetcher ?? fetch;
+    this.env = options.env ?? process.env;
+    this.now = options.now ?? (() => new Date);
+    this.checkIntervalMs = options.checkIntervalMs ?? CHECK_INTERVAL_MS;
+    this.fetchTimeoutMs = options.fetchTimeoutMs ?? FETCH_TIMEOUT_MS;
+    this.configDir = this.fs.joinPath(resolveConfigHome(this.env, this.fs), "githits");
+    this.cachePath = this.fs.joinPath(this.configDir, "update-check.json");
+  }
+  async checkForUpdate(signal) {
+    const cache = await this.loadCache();
+    const latestDue = !cache || this.isCheckDue(cache);
+    const currentVersionStatusDue = this.isCurrentVersionStatusDue(cache?.currentVersionStatus);
+    const currentVersionStatus = await this.refreshCurrentVersionStatusIfDue(cache?.currentVersionStatus, signal);
+    const currentVersionStatusChanged = currentVersionStatusDue && !sameCurrentVersionStatus(currentVersionStatus, cache?.currentVersionStatus);
+    if (cache && !latestDue) {
+      if (currentVersionStatusChanged) {
+        await this.saveCache({
+          ...cache,
+          currentVersionStatus
+        });
+      }
+      return this.noticeFromLatest(cache.latestVersion);
+    }
+    const latestVersion = await this.fetchLatestVersion(signal);
+    if (!latestVersion) {
+      if (currentVersionStatusChanged) {
+        await this.saveCache({
+          ...cache,
+          currentVersionStatus
+        });
+      }
+      return this.noticeFromLatest(cache?.latestVersion);
+    }
+    await this.saveCache({
+      checkedAt: this.now().toISOString(),
+      latestVersion,
+      currentVersionStatus
     });
+    return this.noticeFromLatest(latestVersion);
+  }
+  async refreshRequiredUpdateStatus(signal) {
+    const cache = await this.loadCache();
+    const currentVersionStatusDue = this.isCurrentVersionStatusDue(cache?.currentVersionStatus);
+    const currentVersionStatus = await this.refreshCurrentVersionStatusIfDue(cache?.currentVersionStatus, signal);
+    if (currentVersionStatusDue && !sameCurrentVersionStatus(currentVersionStatus, cache?.currentVersionStatus)) {
+      await this.saveCache({
+        ...cache,
+        currentVersionStatus
+      });
+    }
+  }
+  async getRequiredUpdateNotice() {
+    const cache = await this.loadCache();
+    const status = cache?.currentVersionStatus;
+    if (!status || status.version !== this.currentVersion || !status.deprecatedReason) {
+      return;
+    }
+    return {
+      currentVersion: this.currentVersion,
+      ...cache.latestVersion ? { latestKnownVersion: cache.latestVersion } : {},
+      reason: status.deprecatedReason,
+      updateCommand: formatUpdateCommand(this.env)
+    };
+  }
+  noticeFromLatest(latestVersion) {
+    if (!latestVersion || !semver.valid(latestVersion) || !semver.valid(this.currentVersion) || !semver.gt(latestVersion, this.currentVersion)) {
+      return;
+    }
+    return {
+      currentVersion: this.currentVersion,
+      latestVersion,
+      updateCommand: UPDATE_COMMAND
+    };
+  }
+  isCheckDue(cache) {
+    if (!cache.checkedAt || !cache.latestVersion) {
+      return true;
+    }
+    const checkedAtMs = Date.parse(cache.checkedAt);
+    if (Number.isNaN(checkedAtMs)) {
+      return true;
+    }
+    return this.now().getTime() - checkedAtMs >= this.checkIntervalMs;
+  }
+  isCurrentVersionStatusDue(status) {
+    if (!status || status.version !== this.currentVersion) {
+      return true;
+    }
+    const checkedAtMs = Date.parse(status.checkedAt);
+    if (Number.isNaN(checkedAtMs)) {
+      return true;
+    }
+    return this.now().getTime() - checkedAtMs >= this.checkIntervalMs;
+  }
+  async refreshCurrentVersionStatusIfDue(cached, signal) {
+    const reusableCached = cached?.version === this.currentVersion ? cached : undefined;
+    if (!this.isCurrentVersionStatusDue(reusableCached)) {
+      return reusableCached;
+    }
+    const remote = await this.fetchCurrentVersionStatus(signal);
+    if (!remote) {
+      return reusableCached;
+    }
+    return remote;
+  }
+  async fetchLatestVersion(signal) {
+    try {
+      const timeoutSignal = AbortSignal.timeout(this.fetchTimeoutMs);
+      const response = await this.fetcher(NPM_DIST_TAGS_URL, {
+        signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal
+      });
+      if (!response.ok) {
+        return;
+      }
+      const body = await response.json();
+      if (!body || typeof body !== "object" || typeof body.latest !== "string") {
+        return;
+      }
+      const latest = body.latest;
+      return semver.valid(latest) ? latest : undefined;
+    } catch {
+      return;
+    }
+  }
+  async fetchCurrentVersionStatus(signal) {
+    try {
+      const timeoutSignal = AbortSignal.timeout(this.fetchTimeoutMs);
+      const response = await this.fetcher(`${NPM_PACKAGE_VERSION_URL}/${this.currentVersion}`, {
+        signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal
+      });
+      if (!response.ok) {
+        return;
+      }
+      const body = await response.json();
+      if (!body || typeof body !== "object") {
+        return;
+      }
+      const rawDeprecated = body.deprecated;
+      const deprecatedReason = typeof rawDeprecated === "string" ? sanitizeDeprecationReason(rawDeprecated) : undefined;
+      return {
+        version: this.currentVersion,
+        checkedAt: this.now().toISOString(),
+        ...deprecatedReason ? { deprecatedReason } : {}
+      };
+    } catch {
+      return;
+    }
+  }
+  async loadCache() {
+    try {
+      if (!await this.fs.exists(this.cachePath)) {
+        return;
+      }
+      const raw = await this.fs.readFile(this.cachePath);
+      const parsed = JSON.parse(raw);
+      const currentVersionStatus = parseCurrentVersionStatus(parsed.currentVersionStatus);
+      const hasLatest = typeof parsed.checkedAt === "string" && typeof parsed.latestVersion === "string";
+      if (!hasLatest && !currentVersionStatus) {
+        return;
+      }
+      return {
+        ...hasLatest ? {
+          checkedAt: parsed.checkedAt,
+          latestVersion: parsed.latestVersion
+        } : {},
+        currentVersionStatus
+      };
+    } catch {
+      return;
+    }
+  }
+  async saveCache(cache) {
+    try {
+      await this.fs.ensureDir(this.configDir, DIR_MODE2);
+      if (typeof this.fs.atomicWriteFile === "function") {
+        await this.fs.atomicWriteFile(this.cachePath, `${JSON.stringify(cache, null, 2)}
+`);
+        return;
+      }
+      await this.fs.writeFile(this.cachePath, `${JSON.stringify(cache, null, 2)}
+`, 384);
+    } catch {}
+  }
+}
+function resolveConfigHome(env, fs) {
+  const xdgConfigHome = env.XDG_CONFIG_HOME?.trim();
+  if (xdgConfigHome) {
+    return xdgConfigHome;
+  }
+  return fs.joinPath(fs.getHomeDir(), ".config");
+}
+function shouldRunUpdateCheck(input) {
+  if (input.stderrIsTTY !== true) {
+    return false;
+  }
+  const env = input.env ?? process.env;
+  if (env.CI || env.GITHITS_DISABLE_UPDATE_CHECK) {
+    return false;
+  }
+  if (isHelpOrVersionInvocation(input.args)) {
+    return false;
+  }
+  if (isLikelyEphemeralPackageRunner(env)) {
+    return false;
+  }
+  if (isMcpStdioInvocation(input.args, input.stdinIsTTY === true, input.stdoutIsTTY === true)) {
+    return false;
+  }
+  return true;
+}
+function shouldRunRequiredUpdateEnforcement(input) {
+  if (isHelpOrVersionInvocation(input.args)) {
+    return false;
+  }
+  const env = input.env ?? process.env;
+  if (isLikelyEphemeralPackageRunner(env)) {
+    return false;
+  }
+  return true;
+}
+function formatUpdateNotice(notice) {
+  return `Update available: githits ${notice.currentVersion} -> ${notice.latestVersion}
+Run: ${notice.updateCommand}`;
+}
+function formatRequiredUpdateNotice(notice) {
+  const lines = [
+    `Update required: ${notice.reason}`,
+    "",
+    `Installed githits ${notice.currentVersion} is no longer supported.`
+  ];
+  if (notice.latestKnownVersion) {
+    lines.push(`Latest known version: ${notice.latestKnownVersion}`);
+  }
+  lines.push("Update with:", `  ${notice.updateCommand}`);
+  return [...lines].join(`
+`);
+}
+function formatUpdateCommand(env = process.env) {
+  const userAgent = env.npm_config_user_agent ?? "";
+  const execPath = env.npm_execpath ?? "";
+  const signal = `${userAgent} ${execPath}`.toLowerCase();
+  if (signal.includes("pnpm")) {
+    return "pnpm add -g githits@latest";
+  }
+  if (signal.includes("yarn")) {
+    return "yarn global add githits@latest";
+  }
+  if (signal.includes("bun")) {
+    return "bun add -g githits@latest";
+  }
+  return UPDATE_COMMAND;
+}
+function parseCurrentVersionStatus(value) {
+  if (!value || typeof value !== "object") {
+    return;
+  }
+  const status = value;
+  if (typeof status.version !== "string") {
+    return;
+  }
+  if (typeof status.checkedAt !== "string") {
+    return;
+  }
+  const deprecatedReason = typeof status.deprecatedReason === "string" ? sanitizeDeprecationReason(status.deprecatedReason) : undefined;
+  return {
+    version: status.version,
+    checkedAt: status.checkedAt,
+    ...deprecatedReason ? { deprecatedReason } : {}
+  };
+}
+function sameCurrentVersionStatus(left, right) {
+  return left?.version === right?.version && left?.checkedAt === right?.checkedAt && left?.deprecatedReason === right?.deprecatedReason;
+}
+function sanitizeDeprecationReason(value) {
+  const sanitized = Array.from(value).map((character) => isControlCharacter(character) ? " " : character).join("").replace(/\s+/g, " ").trim().slice(0, MAX_DEPRECATION_REASON_LENGTH).trim();
+  return sanitized.length > 0 ? sanitized : undefined;
+}
+function isControlCharacter(value) {
+  const code = value.charCodeAt(0);
+  return code <= 31 || code >= 127 && code <= 159;
+}
+function isHelpOrVersionInvocation(args) {
+  return args.length === 0 || args[0] === "help" || args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-V");
+}
+function isLikelyEphemeralPackageRunner(env) {
+  const lifecycleEvent = env.npm_lifecycle_event;
+  if (lifecycleEvent === "npx" || lifecycleEvent === "bunx") {
+    return true;
+  }
+  const userAgent = env.npm_config_user_agent ?? "";
+  return env.npm_command === "exec" && (userAgent.startsWith("npm/") || userAgent.startsWith("bun/"));
+}
+function isMcpStdioInvocation(args, stdinIsTTY, stdoutIsTTY) {
+  const firstTokenIndex = args.findIndex((arg) => !arg.startsWith("-"));
+  if (firstTokenIndex === -1 || args[firstTokenIndex] !== "mcp") {
+    return false;
+  }
+  const remainingArgs = args.slice(firstTokenIndex + 1);
+  return remainingArgs.includes("start") || !stdinIsTTY || !stdoutIsTTY;
+}
+// src/container.ts
+async function createAuthStorage(fileSystemService) {
+  return withTelemetrySpan("container.create-auth-storage", async () => {
+    const authConfig = await loadAuthConfig(fileSystemService);
+    return createAuthStorageForMode(fileSystemService, authConfig.storage, authConfig.configPath);
+  });
+}
+function createAuthStorageForMode(fileSystemService, mode, configPath = "your GitHits config.toml") {
+  const fileStorage = new ModeAwareFileAuthStorage(new AuthStorageImpl(fileSystemService, getAuthFileStorageDir(fileSystemService)), mode, configPath);
+  const legacyStorage = new AuthStorageImpl(fileSystemService, getLegacyAuthStorageDir(fileSystemService));
+  const rawKeyring = new KeyringServiceImpl;
+  const keyring = process.platform === "win32" ? new ChunkingKeyringService(rawKeyring, WINDOWS_MAX_ENTRY_SIZE) : rawKeyring;
+  const keychainStorage = new KeychainAuthStorage(keyring);
+  return new LockedAuthStorage(new MigratingAuthStorage(keychainStorage, fileStorage, legacyStorage, mode, configPath, (message) => console.error(message)), fileSystemService);
+}
+async function createAuthCommandDependencies() {
+  return withTelemetrySpan("container.create-auth-command", async () => {
+    const fileSystemService = new FileSystemServiceImpl;
+    return {
+      authStorage: await createAuthStorage(fileSystemService),
+      authService: new AuthServiceImpl,
+      browserService: new BrowserServiceImpl,
+      fileSystemService,
+      mcpUrl: getMcpUrl(),
+      apiUrl: getApiUrl(),
+      envApiToken: getEnvApiToken()
+    };
+  });
+}
+async function createAuthStatusDependencies() {
+  return withTelemetrySpan("container.create-auth-status", async () => {
+    const fileSystemService = new FileSystemServiceImpl;
+    const envApiToken = getEnvApiToken();
+    return {
+      authStorage: envApiToken ? createAuthStorageForMode(fileSystemService, "keychain") : await createAuthStorage(fileSystemService),
+      authService: new AuthServiceImpl,
+      browserService: new BrowserServiceImpl,
+      fileSystemService,
+      mcpUrl: getMcpUrl(),
+      apiUrl: getApiUrl(),
+      envApiToken
+    };
   });
 }
 function createStaticTokenProvider(token) {
@@ -4338,18 +5409,17 @@ async function createContainer() {
     const mcpUrl = getMcpUrl();
     const apiUrl = getApiUrl();
     const codeNavigationUrl = getCodeNavigationUrl();
-    const codeNavigationCliOverrideEnabled = isCodeNavigationCliOverrideEnabled();
     const fileSystemService = new FileSystemServiceImpl;
-    const authStorage = createAuthStorage(fileSystemService);
     const authService = new AuthServiceImpl;
     const browserService = new BrowserServiceImpl;
     const envToken = getEnvApiToken();
     if (envToken) {
+      const authStorage2 = createAuthStorageForMode(fileSystemService, "keychain");
       const tokenProvider = createStaticTokenProvider(envToken);
-      const codeNavigationService2 = codeNavigationUrl ? new CodeNavigationServiceImpl(codeNavigationUrl, tokenProvider) : undefined;
-      const packageIntelligenceService2 = codeNavigationUrl ? new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenProvider) : undefined;
+      const codeNavigationService2 = new CodeNavigationServiceImpl(codeNavigationUrl, tokenProvider);
+      const packageIntelligenceService2 = new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenProvider);
       return {
-        authStorage,
+        authStorage: authStorage2,
         authService,
         browserService,
         fileSystemService,
@@ -4358,18 +5428,17 @@ async function createContainer() {
         apiToken: envToken,
         hasValidToken: true,
         envApiToken: envToken,
-        codeNavigationCapability: getCodeNavigationCapability(envToken),
-        codeNavigationCliOverrideEnabled,
         codeNavigationUrl,
         codeNavigationService: codeNavigationService2,
         packageIntelligenceService: packageIntelligenceService2,
         githitsService: new GitHitsServiceImpl(apiUrl, envToken)
       };
     }
+    const authStorage = await createAuthStorage(fileSystemService);
     const tokenManager = new TokenManager({ authService, authStorage, mcpUrl });
     const apiToken = await withTelemetrySpan("container.token.get", () => tokenManager.getToken());
-    const codeNavigationService = codeNavigationUrl ? new CodeNavigationServiceImpl(codeNavigationUrl, tokenManager) : undefined;
-    const packageIntelligenceService = codeNavigationUrl ? new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenManager) : undefined;
+    const codeNavigationService = new CodeNavigationServiceImpl(codeNavigationUrl, tokenManager);
+    const packageIntelligenceService = new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenManager);
     return {
       authStorage,
       authService,
@@ -4380,8 +5449,6 @@ async function createContainer() {
       apiToken,
       hasValidToken: apiToken !== undefined,
       envApiToken: undefined,
-      codeNavigationCapability: getCodeNavigationCapability(apiToken),
-      codeNavigationCliOverrideEnabled,
       codeNavigationUrl,
       codeNavigationService,
       packageIntelligenceService,
@@ -4389,48 +5456,5 @@ async function createContainer() {
     };
   });
 }
-async function resolveStartupCodeNavigationCapability() {
-  const state = await resolveStartupCodeNavigationRegistrationState();
-  return state.capability;
-}
-async function resolveStartupCodeNavigationRegistrationState() {
-  return withTelemetrySpan("startup.resolve-code-nav-registration-state", async () => {
-    const envToken = getEnvApiToken();
-    if (envToken) {
-      return {
-        capability: getCodeNavigationCapability(envToken),
-        expiredStoredAuth: false
-      };
-    }
-    const tokens = await loadStartupTokens(getMcpUrl());
-    if (tokens?.expiresAt && new Date(tokens.expiresAt) < new Date) {
-      return { capability: "unknown", expiredStoredAuth: true };
-    }
-    return {
-      capability: getCodeNavigationCapability(tokens?.accessToken),
-      expiredStoredAuth: false
-    };
-  });
-}
-async function loadStartupTokens(mcpUrl) {
-  return withTelemetrySpan("startup.load-tokens", async () => {
-    const fileSystemService = new FileSystemServiceImpl;
-    const fileStorage = new AuthStorageImpl(fileSystemService);
-    try {
-      const rawKeyring = new KeyringServiceImpl;
-      const keyring = process.platform === "win32" ? new ChunkingKeyringService(rawKeyring, WINDOWS_MAX_ENTRY_SIZE) : rawKeyring;
-      const keychainStorage = new KeychainAuthStorage(keyring);
-      const keychainTokens = await keychainStorage.loadTokens(mcpUrl);
-      if (keychainTokens) {
-        return keychainTokens;
-      }
-    } catch (error) {
-      if (!(error instanceof KeychainUnavailableError)) {
-        throw error;
-      }
-    }
-    return fileStorage.loadTokens(mcpUrl);
-  });
-}
 
-export { getCodeNavigationCapability, debugLog, setMcpClientVersionProvider, setClientMode, isTelemetryEnabled, withTelemetrySpan, startTelemetrySpan, endTelemetrySpan, flushTelemetry, AuthenticationError, CodeNavigationAccessError, CodeNavigationGraphQLError, CodeNavigationIndexingError, CodeNavigationUnresolvableError, MalformedCodeNavigationResponseError, CodeNavigationTargetNotFoundError, CodeNavigationFileNotFoundError, CodeNavigationVersionNotFoundError, CodeNavigationValidationError, CodeNavigationFeatureFlagRequiredError, CodeNavigationNetworkError, CodeNavigationBackendError, getCodeNavigationUrl, getEnvApiToken, isCodeNavigationCliOverrideEnabled, ExecServiceImpl, FileSystemServiceImpl, PackageIntelligenceAccessError, PackageIntelligenceFeatureFlagRequiredError, PackageIntelligenceNetworkError, PackageIntelligenceBackendError, PackageIntelligenceGraphQLError, PackageIntelligenceTargetNotFoundError, PackageIntelligenceValidationError, PackageIntelligenceVersionNotFoundError, MalformedPackageIntelligenceResponseError, PackageIntelligenceChangelogSourceNotFoundError, PromptServiceImpl, refreshExpiredToken, createContainer, resolveStartupCodeNavigationCapability, resolveStartupCodeNavigationRegistrationState };
+export { AuthConfigError, CLIENT_UPDATE_REQUIRED_REASON, ClientUpdateRequiredError, debugLog, setMcpClientVersionProvider, setClientMode, isTelemetryEnabled, withTelemetrySpan, startTelemetrySpan, endTelemetrySpan, flushTelemetry, AuthenticationError, CodeNavigationAccessError, CodeNavigationGraphQLError, CodeNavigationIndexingError, CodeNavigationUnresolvableError, MalformedCodeNavigationResponseError, CodeNavigationTargetNotFoundError, CodeNavigationFileNotFoundError, CodeNavigationVersionNotFoundError, CodeNavigationValidationError, CodeNavigationFeatureFlagRequiredError, CodeNavigationNetworkError, CodeNavigationBackendError, getCodeNavigationUrl, ExecServiceImpl, FileSystemServiceImpl, AuthStorageLockTimeoutError, AuthStoragePolicyError, PackageIntelligenceAccessError, PackageIntelligenceFeatureFlagRequiredError, PackageIntelligenceNetworkError, PackageIntelligenceBackendError, PackageIntelligenceGraphQLError, PackageIntelligenceTargetNotFoundError, PackageIntelligenceValidationError, PackageIntelligenceVersionNotFoundError, MalformedPackageIntelligenceResponseError, PackageIntelligenceChangelogSourceNotFoundError, PromptServiceImpl, refreshExpiredToken, NpmRegistryUpdateCheckService, shouldRunUpdateCheck, shouldRunRequiredUpdateEnforcement, formatUpdateNotice, formatRequiredUpdateNotice, createAuthCommandDependencies, createAuthStatusDependencies, createContainer };