@zivis/cli 0.1.0-alpha.1

package/dist/commands/app/index.d.ts

@@ -0,0 +1,10 @@
+import type { Command } from "commander";
+/**
+ * Phase J.4 command group. The customer-facing primitive is "Application" —
+ * the thing they built and want tested. This group replaces the older
+ * `zivis target` set: same keychain layout, but auth config is pulled from
+ * the platform instead of read from a local file. Teammates discover an
+ * Application's IdP by querying the API; their tokens still stay in their
+ * own keychain.
+ */
+export declare function registerAppCommands(program: Command): void;

package/dist/commands/app/index.js

@@ -0,0 +1,245 @@
+import { ApiClient } from "@zivis-ai/mcp-security/api-client";
+import { DEFAULT_CONFIG } from "@zivis-ai/mcp-security/types";
+import { loginApplication, logoutTarget, tokenInfo, getValidTargetToken, } from "../../internal/target-auth/index.js";
+import { getStorageName } from "../../internal/target-auth/keychain.js";
+import { decodeJwtPayload } from "../../internal/target-auth/workos.js";
+import { fetchAuthConfig } from "../../internal/target-auth/api-config.js";
+const DEFAULT_PERSONA = "default";
+/**
+ * Phase J.4 command group. The customer-facing primitive is "Application" —
+ * the thing they built and want tested. This group replaces the older
+ * `zivis target` set: same keychain layout, but auth config is pulled from
+ * the platform instead of read from a local file. Teammates discover an
+ * Application's IdP by querying the API; their tokens still stay in their
+ * own keychain.
+ */
+export function registerAppCommands(program) {
+    const app = program
+        .command("app")
+        .description("manage authentication against your customer-facing applications");
+    app
+        .command("list")
+        .description("list applications in the active org")
+        .option("-s, --session <name>", "named session")
+        .option("--json", "emit raw JSON")
+        .action(async (opts) => {
+        const client = buildClient(opts);
+        const apps = await client.request("GET", "/api/rt/applications");
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(apps, null, 2) + "\n");
+            return;
+        }
+        if (!apps.length) {
+            console.log("No applications in this org.");
+            return;
+        }
+        for (const a of apps) {
+            const type = a.type ? ` (${a.type})` : "";
+            const cred = a.useEphemeralCreds ? " ephemeral" : "";
+            console.log(`${a.id}  ${a.name}${type}${cred}`);
+            if (a.baseUrl)
+                console.log(`  ${a.baseUrl}`);
+        }
+    });
+    app
+        .command("show <appId>")
+        .description("print an application's auth config (debugging)")
+        .option("-s, --session <name>", "named session")
+        .action(async (appId, opts) => {
+        const cfg = await fetchAuthConfig(appId, opts.session);
+        process.stdout.write(JSON.stringify(cfg, null, 2) + "\n");
+    });
+    app
+        .command("create")
+        .description("create a customer-facing Application configured for ephemeral PKCE auth")
+        .requiredOption("--name <name>", "application display name")
+        .requiredOption("--base-url <url>", "primary base URL (e.g., https://api.acme.io)")
+        .option("--type <type>", "agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url", "agent")
+        .option("--description <text>", "optional description")
+        .option("--client-id <id>", "OAuth client_id (PKCE public client)")
+        .option("--oidc-issuer <url>", "OIDC issuer (for discovery)")
+        .option("--auth-url <url>", "explicit OAuth authorize endpoint")
+        .option("--token-url <url>", "explicit OAuth token endpoint")
+        .option("--scopes <list>", "comma-separated scopes (default: openid,offline_access)")
+        .option("--no-ephemeral", "do NOT opt into ephemeral creds (legacy KV-backed flow)")
+        .option("-s, --session <name>", "named session")
+        .option("--json", "emit raw JSON")
+        .action(async (opts) => {
+        const useEphemeral = opts.ephemeral !== false;
+        const body = {
+            name: opts.name,
+            baseUrl: opts.baseUrl,
+            type: opts.type,
+            useEphemeralCreds: useEphemeral,
+            // PKCE-only public-client mode is the whole reason for ephemeral creds —
+            // require oauth_pkce as the auth type. Non-PKCE flows (static_token,
+            // client_credentials, bearer_refresh) need their own subcommands.
+            authType: "oauth_pkce",
+        };
+        if (opts.description)
+            body.description = opts.description;
+        if (opts.clientId)
+            body.clientId = opts.clientId;
+        if (opts.oidcIssuer)
+            body.oidcIssuer = opts.oidcIssuer;
+        if (opts.authUrl)
+            body.authorizationUrl = opts.authUrl;
+        if (opts.tokenUrl)
+            body.tokenUrl = opts.tokenUrl;
+        if (opts.scopes) {
+            body.scopes = String(opts.scopes).split(",").map((s) => s.trim()).filter(Boolean);
+        }
+        if (!useEphemeral) {
+            console.error("[zivis] --no-ephemeral selected but `app create` only handles PKCE public-client mode in v1.\n" +
+                "[zivis] Use the web UI to create static-token / client-credentials applications.");
+            process.exit(1);
+        }
+        const client = buildClient(opts);
+        try {
+            const created = await client.request("POST", "/api/rt/applications", body);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(created, null, 2) + "\n");
+                return;
+            }
+            console.log(`✓ Created application ${created.id}`);
+            console.log(`  ${created.name}${created.type ? ` (${created.type})` : ""}`);
+            console.log("");
+            console.log(`Next: zivis app auth ${created.id}`);
+        }
+        catch (err) {
+            console.error("Create failed:", err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+    });
+    app
+        .command("update <appId>")
+        .description("update an application's metadata (name, type, ephemeral-creds toggle, etc.)")
+        .option("--name <name>", "rename the application")
+        .option("--description <text>", "update the description")
+        .option("--type <type>", "agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url")
+        .option("--use-ephemeral", "opt into ephemeral-creds mode (Phase J)")
+        .option("--no-ephemeral-disable", "opt OUT of ephemeral-creds mode (legacy KV-backed)")
+        .option("--base-url <url>", "update base URL")
+        .option("--client-id <id>", "update OAuth client_id")
+        .option("--oidc-issuer <url>", "update OIDC issuer")
+        .option("-s, --session <name>", "named session")
+        .option("--json", "emit raw JSON")
+        .action(async (appId, opts) => {
+        const body = {};
+        if (opts.name)
+            body.name = opts.name;
+        if (opts.description !== undefined)
+            body.description = opts.description;
+        if (opts.type)
+            body.type = opts.type;
+        if (opts.useEphemeral)
+            body.useEphemeralCreds = true;
+        if (opts.ephemeralDisable === false)
+            body.useEphemeralCreds = false;
+        if (opts.baseUrl)
+            body.baseUrl = opts.baseUrl;
+        if (opts.clientId)
+            body.clientId = opts.clientId;
+        if (opts.oidcIssuer)
+            body.oidcIssuer = opts.oidcIssuer;
+        if (Object.keys(body).length === 0) {
+            console.error("No fields to update. Pass at least one of --name/--type/--use-ephemeral/etc.");
+            process.exit(1);
+        }
+        const client = buildClient(opts);
+        try {
+            const result = await client.request("PATCH", `/api/rt/applications/${encodeURIComponent(appId)}`, body);
+            const application = result.application ?? result;
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(application, null, 2) + "\n");
+                return;
+            }
+            console.log(`✓ Updated ${application.id ?? appId}`);
+            for (const k of Object.keys(body)) {
+                console.log(`  ${k}: ${JSON.stringify(body[k])}`);
+            }
+        }
+        catch (err) {
+            console.error("Update failed:", err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+    });
+    app
+        .command("auth <appId>")
+        .description("PKCE login against the application's IdP; tokens stay in your OS keychain")
+        .option("-p, --persona <name>", "persona for permutation testing", DEFAULT_PERSONA)
+        .option("-s, --session <name>", "named session")
+        .action(async (appId, opts) => {
+        try {
+            const tokens = await loginApplication(appId, opts.persona, opts.session);
+            const claims = decodeJwtPayload(tokens.access_token) || {};
+            console.log(`✓ Logged in as persona "${opts.persona}"`);
+            console.log(`  storage: ${getStorageName()}`);
+            if (claims.sub)
+                console.log(`  sub:     ${claims.sub}`);
+            if (claims.email)
+                console.log(`  email:   ${claims.email}`);
+            if (claims.org_id)
+                console.log(`  org:     ${claims.org_id}`);
+            console.log(`  expires: ${new Date(tokens.expires_at).toISOString()}`);
+        }
+        catch (err) {
+            console.error("Login failed:", err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+    });
+    app
+        .command("token <appId>")
+        .description("print a valid access_token (auto-refreshes); for piping into curl/scripts")
+        .option("-p, --persona <name>", "persona", DEFAULT_PERSONA)
+        .action(async (appId, opts) => {
+        try {
+            const tokens = await getValidTargetToken(appId, opts.persona);
+            if (!tokens) {
+                console.error(`No token for application ${appId} (persona: ${opts.persona}). Run: zivis app auth ${appId} -p ${opts.persona}`);
+                process.exit(2);
+            }
+            process.stdout.write(tokens.access_token);
+        }
+        catch (err) {
+            console.error("Token fetch failed:", err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+    });
+    app
+        .command("whoami <appId>")
+        .description("decode the stored token and print expiry + key claims")
+        .option("-p, --persona <name>", "persona", DEFAULT_PERSONA)
+        .option("--json", "emit raw JSON")
+        .action(async (appId, opts) => {
+        const info = await tokenInfo(appId, opts.persona);
+        if (!info) {
+            console.error(`No tokens stored for application ${appId} (persona: ${opts.persona}).`);
+            process.exit(2);
+        }
+        const out = { applicationId: appId, persona: opts.persona, ...info };
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+            return;
+        }
+        console.log(`Application: ${appId}`);
+        console.log(`Persona:     ${opts.persona}`);
+        console.log(`Valid:       ${info.valid}`);
+        console.log(`Expires:     ${info.expiresAt}`);
+        console.log(`Remaining:   ${info.secondsRemaining}s`);
+        console.log(`Refresh:     ${info.hasRefresh ? "available" : "none"}`);
+    });
+    app
+        .command("logout <appId>")
+        .description("clear stored tokens for an application persona")
+        .option("-p, --persona <name>", "persona", DEFAULT_PERSONA)
+        .action(async (appId, opts) => {
+        await logoutTarget(appId, opts.persona);
+        console.log(`✓ Cleared tokens for application ${appId} (persona: ${opts.persona})`);
+    });
+}
+function buildClient(opts) {
+    const config = opts.session ? { ...DEFAULT_CONFIG, session: opts.session } : DEFAULT_CONFIG;
+    return new ApiClient(config);
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/app/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/app/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAE3E,MAAM,eAAe,GAAG,SAAS,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,iEAAiE,CAAC,CAAC;IAElF,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAE/B,KAAK,EAAE,sBAAsB,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yEAAyE,CAAC;SACtF,cAAc,CAAC,eAAe,EAAE,0BAA0B,CAAC;SAC3D,cAAc,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;SAClF,MAAM,CAAC,eAAe,EAAE,2DAA2D,EAAE,OAAO,CAAC;SAC7F,MAAM,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;SACtD,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;SAClE,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SAC/D,MAAM,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;SAC5D,MAAM,CAAC,iBAAiB,EAAE,yDAAyD,CAAC;SACpF,MAAM,CAAC,gBAAgB,EAAE,yDAAyD,CAAC;SACnF,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;QAC9C,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,iBAAiB,EAAE,YAAY;YAC/B,yEAAyE;YACzE,qEAAqE;YACrE,kEAAkE;YAClE,QAAQ,EAAE,YAAY;SACvB,CAAC;QACF,IAAI,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAC1D,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACvD,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC;QACvD,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CACX,gGAAgG;gBAC9F,kFAAkF,CACrF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAClC,MAAM,EACN,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,6EAA6E,CAAC;SAC1F,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC;SACjD,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;SACxD,MAAM,CAAC,eAAe,EAAE,2DAA2D,CAAC;SACpF,MAAM,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;SACpE,MAAM,CAAC,wBAAwB,EAAE,oDAAoD,CAAC;SACtF,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;SAC7C,MAAM,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;SACpD,MAAM,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;SACnD,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACxE,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,gBAAgB,KAAK,KAAK;YAAE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACpE,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9C,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEvD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CACjC,OAAO,EACP,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EACnD,IAAI,CACL,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;YACjD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,aAAc,WAAmB,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;YAC7D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAE,IAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,sBAAsB,EAAE,iCAAiC,EAAE,eAAe,CAAC;SAClF,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,cAAc,cAAc,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAK,MAA2B,CAAC,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAe,MAA2B,CAAC,GAAG,EAAE,CAAC,CAAC;YACpG,IAAK,MAA6B,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAe,MAA6B,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5G,IAAK,MAA8B,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAe,MAA8B,CAAC,MAAM,EAAE,CAAC,CAAC;YAChH,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,sBAAsB,EAAE,SAAS,EAAE,eAAe,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,4BAA4B,KAAK,cAAc,IAAI,CAAC,OAAO,0BAA0B,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAChH,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,sBAAsB,EAAE,SAAS,EAAE,eAAe,CAAC;SAC1D,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,oCAAoC,KAAK,cAAc,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;QACrE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,sBAAsB,EAAE,SAAS,EAAE,eAAe,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,oCAAoC,KAAK,cAAc,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,IAA0B;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC5F,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/dist/commands/auth/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerAuthCommands(program: Command): void;

package/dist/commands/auth/index.js

@@ -0,0 +1,41 @@
+import { loginCommand } from "./login.js";
+import { statusCommand } from "./status.js";
+import { logoutCommand } from "./logout.js";
+import { sessionsCommand } from "./sessions.js";
+export function registerAuthCommands(program) {
+    const auth = program.command("auth").description("authentication");
+    auth
+        .command("login")
+        .description("OAuth PKCE login (stores tokens in OS keychain)")
+        .option("-s, --session <name>", "named session for multi-tenant")
+        .option("-o, --org <workosOrgId>", "scope JWT to a specific WorkOS org")
+        .option("-y, --yes", "skip interactive confirmation")
+        .option("--bind", "auto-write .zivis/project.json binding")
+        .option("--no-bind", "skip project binding")
+        .action(async (opts) => {
+        await loginCommand(opts);
+    });
+    auth
+        .command("status")
+        .description("show current auth state and active session")
+        .option("-s, --session <name>", "session to inspect")
+        .action(async (opts) => {
+        await statusCommand(opts);
+    });
+    auth
+        .command("logout")
+        .description("clear stored credentials")
+        .option("-s, --session <name>", "session to clear")
+        .option("--all", "clear every stored session")
+        .action(async (opts) => {
+        await logoutCommand(opts);
+    });
+    auth
+        .command("sessions")
+        .description("list every named session with stored credentials")
+        .option("--remove <name>", "remove a specific session")
+        .action(async (opts) => {
+        await sessionsCommand(opts);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAEnE,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CAAC,sBAAsB,EAAE,gCAAgC,CAAC;SAChE,MAAM,CAAC,yBAAyB,EAAE,oCAAoC,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+BAA+B,CAAC;SACpD,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;SAClD,MAAM,CAAC,OAAO,EAAE,4BAA4B,CAAC;SAC7C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/auth/login.d.ts

@@ -0,0 +1,8 @@
+export interface LoginCmdOpts {
+    session?: string;
+    org?: string;
+    yes?: boolean;
+    bind?: boolean;
+    noBind?: boolean;
+}
+export declare function loginCommand(opts: LoginCmdOpts): Promise<void>;

package/dist/commands/auth/login.js

@@ -0,0 +1,65 @@
+import { login } from "@zivis-ai/mcp-security/auth";
+import { getStorageName } from "@zivis-ai/mcp-security/auth";
+import { saveSessionEntry } from "@zivis-ai/mcp-security/auth";
+import { detectProjectBinding } from "@zivis-ai/mcp-security/project-binding";
+import { DEFAULT_CONFIG } from "@zivis-ai/mcp-security/types";
+import { extractEmail } from "../../internal/orgs.js";
+import { ensureProjectBinding } from "../../internal/project-binding.js";
+import { setupVsCodeClaude, setupVsCodeCopilot, setupClaudeCodeCli, } from "../../internal/ide-setup.js";
+export async function loginCommand(opts) {
+    const config = DEFAULT_CONFIG;
+    const detected = detectProjectBinding(process.cwd());
+    const session = opts.session || detected?.binding.session || config.session;
+    let organizationId = opts.org;
+    if (!organizationId && detected?.binding.workosOrgId) {
+        organizationId = detected.binding.workosOrgId;
+        console.log(`Using org from project binding: ${organizationId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+    }
+    if (detected?.binding.session && !opts.session) {
+        console.log(`Using session from project binding: ${session}`);
+    }
+    try {
+        const tokens = await login(config, session, organizationId, {
+            orgName: detected?.binding.orgName,
+            skipConfirm: opts.yes === true,
+        });
+        const storageName = getStorageName();
+        const email = extractEmail(tokens.id_token);
+        const sessionName = session || "default";
+        await saveSessionEntry(sessionName, email);
+        const sessionLabel = session ? ` (session: ${session})` : "";
+        console.log(`✓ Logged in as ${email}${sessionLabel}`);
+        console.log(`✓ Credentials stored in ${storageName}`);
+        if (organizationId) {
+            console.log(`✓ JWT scoped to organization: ${organizationId}`);
+        }
+        try {
+            await setupVsCodeClaude(session);
+            await setupVsCodeCopilot(session);
+        }
+        catch (err) {
+            console.log(`  WARNING: Failed to update .vscode/mcp.json: ${err instanceof Error ? err.message : err}`);
+        }
+        try {
+            await setupClaudeCodeCli(session);
+        }
+        catch (err) {
+            console.log(`  WARNING: Failed to update Claude Code CLI config: ${err instanceof Error ? err.message : err}`);
+        }
+        await ensureProjectBinding({
+            config,
+            session: sessionName,
+            accessToken: tokens.access_token,
+            organizationId,
+            cwd: process.cwd(),
+            autoBind: opts.bind === true,
+            skipBind: opts.noBind === true,
+        });
+        process.exit(0);
+    }
+    catch (err) {
+        console.error("Login failed:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=login.js.map

package/dist/commands/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AAUrC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;IAE5E,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;IAC9B,IAAI,CAAC,cAAc,IAAI,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QACrD,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,mCAAmC,cAAc,GAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAChE,EAAE,CACH,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE;YAC1D,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO;YAClC,WAAW,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI;SAC/B,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5C,MAAM,WAAW,GAAG,OAAO,IAAI,SAAS,CAAC;QACzC,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAE3C,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,YAAY,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAC;QACtD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CACT,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC5F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CACT,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,CAAC;YACzB,MAAM;YACN,OAAO,EAAE,WAAW;YACpB,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,cAAc;YACd,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,QAAQ,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;SAC/B,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/auth/logout.d.ts

@@ -0,0 +1,5 @@
+export interface LogoutCmdOpts {
+    session?: string;
+    all?: boolean;
+}
+export declare function logoutCommand(opts: LogoutCmdOpts): Promise<void>;

package/dist/commands/auth/logout.js

@@ -0,0 +1,14 @@
+import { keychainClearAll, keychainClearSession } from "@zivis-ai/mcp-security/auth";
+import { removeSessionEntry } from "@zivis-ai/mcp-security/auth";
+export async function logoutCommand(opts) {
+    if (opts.session) {
+        await keychainClearSession(opts.session);
+        await removeSessionEntry(opts.session);
+        console.log(`✓ Session "${opts.session}" credentials cleared`);
+        return;
+    }
+    await keychainClearAll();
+    console.log("✓ Default credentials cleared");
+    console.log("  Note: Named sessions are not affected. Use 'zivis auth sessions' to list them.");
+}
+//# sourceMappingURL=logout.js.map

package/dist/commands/auth/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/commands/auth/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAOjE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,OAAO,uBAAuB,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,EAAE,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;AAClG,CAAC"}

package/dist/commands/auth/sessions.d.ts

@@ -0,0 +1,4 @@
+export interface SessionsCmdOpts {
+    remove?: string;
+}
+export declare function sessionsCommand(opts: SessionsCmdOpts): Promise<void>;

package/dist/commands/auth/sessions.js

@@ -0,0 +1,30 @@
+import { listSessions, removeSessionEntry, keychainClearSession } from "@zivis-ai/mcp-security/auth";
+export async function sessionsCommand(opts) {
+    if (opts.remove) {
+        await keychainClearSession(opts.remove);
+        await removeSessionEntry(opts.remove);
+        console.log(`✓ Session "${opts.remove}" removed`);
+        return;
+    }
+    const sessions = await listSessions();
+    const activeSession = process.env.ZIVIS_SESSION;
+    if (sessions.length === 0) {
+        console.log("No sessions stored.");
+        console.log("");
+        console.log("To create a session:");
+        console.log("  zivis auth login                    # default session");
+        console.log("  zivis auth login --session <name>   # named session");
+        return;
+    }
+    console.log("Sessions:");
+    console.log("");
+    for (const s of sessions) {
+        const active = s.name === (activeSession || "default") ? "  (active)" : "";
+        const nameCol = s.name.padEnd(20);
+        console.log(`  ${nameCol} ${s.email}${active}`);
+    }
+    console.log("");
+    console.log("To use a session in a project, add to .mcp.json:");
+    console.log('  "env": { "ZIVIS_SESSION": "<session-name>" }');
+}
+//# sourceMappingURL=sessions.js.map

package/dist/commands/auth/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/commands/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAMrG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAqB;IACzD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAEhD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;AAChE,CAAC"}

package/dist/commands/auth/status.d.ts

@@ -0,0 +1,4 @@
+export interface StatusCmdOpts {
+    session?: string;
+}
+export declare function statusCommand(opts: StatusCmdOpts): Promise<void>;

package/dist/commands/auth/status.js

@@ -0,0 +1,53 @@
+import { resolveAuth, loadTokens, getStorageName, keychainRead } from "@zivis-ai/mcp-security/auth";
+import { detectProjectBinding } from "@zivis-ai/mcp-security/project-binding";
+import { DEFAULT_CONFIG } from "@zivis-ai/mcp-security/types";
+import { extractEmail } from "../../internal/orgs.js";
+export async function statusCommand(opts) {
+    const config = DEFAULT_CONFIG;
+    const detected = detectProjectBinding(process.cwd());
+    const session = opts.session || config.session || detected?.binding.session;
+    const resolveConfig = session ? { ...config, session } : config;
+    if (session) {
+        const source = opts.session
+            ? "flag"
+            : config.session
+                ? "ZIVIS_SESSION"
+                : "project binding";
+        console.log(`Session: ${session} (from ${source})`);
+    }
+    const creds = await resolveAuth(resolveConfig);
+    switch (creds.method) {
+        case "oauth": {
+            const tokens = await loadTokens(session);
+            const email = extractEmail(tokens?.id_token);
+            console.log(`Auth:   OAuth (${email})`);
+            if (tokens) {
+                const expiresIn = Math.round((tokens.expires_at - Date.now()) / 1000 / 60);
+                console.log(`Token:  ${expiresIn > 0 ? `expires in ${expiresIn} min` : "expired (will refresh)"}`);
+            }
+            break;
+        }
+        case "apikey": {
+            const masked = creds.apiKey?.startsWith("sk_")
+                ? `sk_...${creds.apiKey.slice(-4)}`
+                : "***";
+            const source = (await keychainRead("apikey")) ? getStorageName() : "environment variable";
+            console.log(`Auth:   API Key (${masked}) from ${source}`);
+            break;
+        }
+        case "none":
+            console.log("Auth:   Not authenticated");
+            console.log("");
+            if (session) {
+                console.log(`Session "${session}" has no credentials.`);
+                console.log(`Run: zivis auth login --session ${session}`);
+            }
+            else {
+                console.log("To authenticate:");
+                console.log("  zivis auth login");
+            }
+            break;
+    }
+    console.log(`API:    ${resolveConfig.apiBaseUrl}`);
+}
+//# sourceMappingURL=status.js.map

package/dist/commands/auth/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/commands/auth/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAMtD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;IAC5E,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAEhE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO;YACzB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,CAAC,OAAO;gBAChB,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,iBAAiB,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,UAAU,MAAM,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC;IAE/C,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC3E,OAAO,CAAC,GAAG,CACT,WAAW,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,SAAS,MAAM,CAAC,CAAC,CAAC,wBAAwB,EAAE,CACtF,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC;gBAC5C,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnC,CAAC,CAAC,KAAK,CAAC;YACV,MAAM,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;YAC1F,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,UAAU,MAAM,EAAE,CAAC,CAAC;YAC1D,MAAM;QACR,CAAC;QACD,KAAK,MAAM;YACT,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,uBAAuB,CAAC,CAAC;gBACxD,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YACpC,CAAC;YACD,MAAM;IACV,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC;AACrD,CAAC"}

package/dist/commands/credits/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerCreditsCommands(program: Command): void;

package/dist/commands/credits/index.js

@@ -0,0 +1,51 @@
+import { ApiClient } from "@zivis-ai/mcp-security/api-client";
+import { DEFAULT_CONFIG } from "@zivis-ai/mcp-security/types";
+function buildClient(opts) {
+    const config = opts.session ? { ...DEFAULT_CONFIG, session: opts.session } : DEFAULT_CONFIG;
+    return new ApiClient(config);
+}
+export function registerCreditsCommands(program) {
+    program
+        .command("credits")
+        .description("show credit balance and recent burn by action type")
+        .option("-s, --session <name>", "named session")
+        .option("--json", "emit raw JSON (combined balance + usage-summary)")
+        .action(async (opts) => {
+        const client = buildClient(opts);
+        const [balance, usage] = await Promise.all([
+            client.request("GET", "/api/credits/balance"),
+            client
+                .request("GET", "/api/credits/usage-summary")
+                .catch(() => ({})),
+        ]);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ balance, usage }, null, 2) + "\n");
+            return;
+        }
+        console.log("Credits");
+        if (typeof balance.balance === "number") {
+            console.log(`  Balance:  ${balance.balance}`);
+        }
+        if (typeof balance.totalGranted === "number") {
+            console.log(`  Granted:  ${balance.totalGranted}`);
+        }
+        if (typeof balance.totalSpent === "number") {
+            console.log(`  Spent:    ${balance.totalSpent}`);
+        }
+        if (typeof balance.reservedAmount === "number" && balance.reservedAmount > 0) {
+            console.log(`  Reserved: ${balance.reservedAmount} (in-flight scans)`);
+        }
+        const entries = Object.entries(usage).filter(([, v]) => v && typeof v === "object");
+        if (entries.length > 0) {
+            console.log("");
+            console.log("Recent usage by action:");
+            for (const [action, v] of entries) {
+                const row = v;
+                const spent = row.spent ?? 0;
+                const runs = row.runs ?? 0;
+                console.log(`  ${action.padEnd(18)} ${String(spent).padStart(8)}  (${runs} runs)`);
+            }
+        }
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/credits/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/credits/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAY9D,SAAS,WAAW,CAAC,IAA0B;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC5F,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,kDAAkD,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,MAAM,CAAC,OAAO,CAAgB,KAAK,EAAE,sBAAsB,CAAC;YAC5D,MAAM;iBACH,OAAO,CAAe,KAAK,EAAE,4BAA4B,CAAC;iBAC1D,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAmB,CAAA,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvB,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAC7E,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,cAAc,oBAAoB,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACvC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,CAAsC,CAAC;gBACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;gBAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/mcp/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerMcpCommands(program: Command): void;