@zivis/cli 0.1.0-alpha.1

package/dist/internal/project-binding.js

@@ -0,0 +1,96 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as readline from "node:readline/promises";
+import { decodeJwtPayload } from "@zivis-ai/mcp-security/auth/jwt";
+import { detectProjectBinding } from "@zivis-ai/mcp-security/project-binding";
+import { fetchUserOrgs } from "./orgs.js";
+export async function ensureProjectBinding(opts) {
+    const { config, session, accessToken, cwd, autoBind, skipBind } = opts;
+    const claims = decodeJwtPayload(accessToken);
+    const jwtOrgId = claims?.org_id;
+    if (!jwtOrgId) {
+        console.log("");
+        console.log("  Note: JWT has no org_id — skipping project binding.");
+        return;
+    }
+    const detected = detectProjectBinding(cwd);
+    if (detected?.binding.workosOrgId === jwtOrgId) {
+        console.log(`✓ Project binding verified: ${detected.filePath}`);
+        return;
+    }
+    if (detected?.binding.workosOrgId && detected.binding.workosOrgId !== jwtOrgId) {
+        console.error("");
+        console.error("[zivis] ERROR: Project binding org mismatches JWT org.");
+        console.error(`[zivis]   Binding file: ${detected.filePath}`);
+        console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+        console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
+        console.error("[zivis] This should not happen — investigate before proceeding.");
+        process.exit(1);
+    }
+    let orgInfo;
+    try {
+        const orgs = await fetchUserOrgs(config, accessToken);
+        orgInfo = orgs.find((o) => o.workosOrgId === jwtOrgId);
+    }
+    catch (err) {
+        console.log(`  WARNING: Could not fetch org info: ${err instanceof Error ? err.message : err}`);
+    }
+    const orgName = orgInfo?.name || detected?.binding.orgName;
+    const zivisOrgId = orgInfo?.id || detected?.binding.orgId;
+    const orgLabel = orgName ? `${orgName} (${jwtOrgId})` : jwtOrgId;
+    if (detected && !detected.binding.workosOrgId) {
+        const upgraded = {
+            ...detected.binding,
+            workosOrgId: jwtOrgId,
+        };
+        if (orgName)
+            upgraded.orgName = orgName;
+        if (zivisOrgId)
+            upgraded.orgId = zivisOrgId;
+        fs.writeFileSync(detected.filePath, JSON.stringify(upgraded, null, 2) + "\n");
+        console.log(`✓ Upgraded project binding with org: ${orgLabel}`);
+        console.log(`  File: ${detected.filePath}`);
+        return;
+    }
+    const bindingPath = path.join(cwd, ".zivis", "project.json");
+    const interactive = process.stderr.isTTY && process.stdin.isTTY;
+    let shouldBind = autoBind;
+    if (!shouldBind && !skipBind && interactive) {
+        console.log("");
+        console.log("This directory has no .zivis/project.json binding.");
+        console.log(`Binding locks future MCP calls to org: ${orgLabel}`);
+        const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+        try {
+            const answer = (await rl.question("Create binding now? [Y/n] ")).trim().toLowerCase();
+            shouldBind = answer !== "n" && answer !== "no";
+        }
+        finally {
+            rl.close();
+        }
+    }
+    if (!shouldBind) {
+        if (!skipBind) {
+            console.log("");
+            console.log("  WARNING: No project binding. MCP calls will not verify the org for this directory.");
+            console.log("  To bind later: zivis auth init");
+        }
+        return;
+    }
+    const binding = {
+        session,
+        workosOrgId: jwtOrgId,
+    };
+    if (orgName)
+        binding.orgName = orgName;
+    if (zivisOrgId)
+        binding.orgId = zivisOrgId;
+    const zivisDir = path.join(cwd, ".zivis");
+    if (!fs.existsSync(zivisDir)) {
+        fs.mkdirSync(zivisDir, { recursive: true });
+    }
+    fs.writeFileSync(bindingPath, JSON.stringify(binding, null, 2) + "\n");
+    console.log(`✓ Project bound to ${orgLabel}`);
+    console.log(`  File: ${bindingPath}`);
+    console.log("  Commit this file so future sessions in this repo are org-locked.");
+}
+//# sourceMappingURL=project-binding.js.map

package/dist/internal/project-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-binding.js","sourceRoot":"","sources":["../../src/internal/project-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAuB;IAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEvE,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE3C,IAAI,QAAQ,EAAE,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,EAAE,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,OAAO,CAAC,KAAK,CAAC,2BAA2B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CACX,2BAA2B,QAAQ,CAAC,OAAO,CAAC,WAAW,GACrD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAChE,EAAE,CACH,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACtD,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,EAAE,EAAE,IAAI,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEjE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAmB;YAC/B,GAAG,QAAQ,CAAC,OAAO;YACnB,WAAW,EAAE,QAAQ;SACtB,CAAC;QACF,IAAI,OAAO;YAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QACxC,IAAI,UAAU;YAAE,QAAQ,CAAC,KAAK,GAAG,UAAU,CAAC;QAC5C,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAChE,IAAI,UAAU,GAAG,QAAQ,CAAC;IAE1B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtF,UAAU,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAmB;QAC9B,OAAO;QACP,WAAW,EAAE,QAAQ;KACtB,CAAC;IACF,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IACvC,IAAI,UAAU;QAAE,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC;IAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,WAAW,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACpF,CAAC"}

package/dist/internal/target-auth/api-config.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Fetches an Application's auth config from the ZIVIS platform.
+ *
+ * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
+ * file the user previously had to write by hand. The Application's IdP
+ * discovery (clientId, domain, mode, scopes) lives on the Application
+ * record on the platform; the CLI calls this endpoint to learn how to
+ * PKCE-auth, then runs the flow locally and stores tokens in the user's
+ * keychain. Tokens never leave the user's machine unless the user
+ * explicitly ships them with a scenario-run trigger.
+ */
+import type { TargetAuthConfig, WorkosMode } from "./types.js";
+interface AuthConfigResponse {
+    applicationId: string;
+    name: string;
+    type: string;
+    authType: string;
+    useEphemeralCreds: boolean;
+    oauth: {
+        provider: "workos";
+        clientId: string;
+        domain: string;
+        mode: WorkosMode;
+        scopes: string[];
+    } | null;
+    hint?: string;
+    error?: string;
+}
+export declare function fetchAuthConfig(applicationId: string, sessionName?: string): Promise<AuthConfigResponse>;
+/**
+ * Adapt the platform's auth-config response into the local TargetAuthConfig
+ * shape that the existing PKCE flow consumes. Throws when the application
+ * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
+ * caller should give a useful error and direct the user elsewhere.
+ */
+export declare function adaptToWorkosConfig(resp: AuthConfigResponse): TargetAuthConfig;
+export {};

package/dist/internal/target-auth/api-config.js

@@ -0,0 +1,40 @@
+/**
+ * Fetches an Application's auth config from the ZIVIS platform.
+ *
+ * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
+ * file the user previously had to write by hand. The Application's IdP
+ * discovery (clientId, domain, mode, scopes) lives on the Application
+ * record on the platform; the CLI calls this endpoint to learn how to
+ * PKCE-auth, then runs the flow locally and stores tokens in the user's
+ * keychain. Tokens never leave the user's machine unless the user
+ * explicitly ships them with a scenario-run trigger.
+ */
+import { ApiClient } from "@zivis-ai/mcp-security/api-client";
+import { DEFAULT_CONFIG } from "@zivis-ai/mcp-security/types";
+export async function fetchAuthConfig(applicationId, sessionName) {
+    const config = sessionName
+        ? { ...DEFAULT_CONFIG, session: sessionName }
+        : DEFAULT_CONFIG;
+    const client = new ApiClient(config);
+    return client.request("GET", `/api/applications/${encodeURIComponent(applicationId)}/auth-config`);
+}
+/**
+ * Adapt the platform's auth-config response into the local TargetAuthConfig
+ * shape that the existing PKCE flow consumes. Throws when the application
+ * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
+ * caller should give a useful error and direct the user elsewhere.
+ */
+export function adaptToWorkosConfig(resp) {
+    if (!resp.oauth) {
+        throw new Error(resp.hint || resp.error ||
+            `Application ${resp.applicationId} (${resp.authType}) is not configured for PKCE auth`);
+    }
+    return {
+        type: "workos",
+        clientId: resp.oauth.clientId,
+        domain: resp.oauth.domain,
+        mode: resp.oauth.mode,
+        extraScopes: resp.oauth.scopes,
+    };
+}
+//# sourceMappingURL=api-config.js.map

package/dist/internal/target-auth/api-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-config.js","sourceRoot":"","sources":["../../../src/internal/target-auth/api-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAoB9D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,WAAoB;IAEpB,MAAM,MAAM,GAAG,WAAW;QACxB,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE;QAC7C,CAAC,CAAC,cAAc,CAAC;IACnB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,OAAO,CACnB,KAAK,EACL,qBAAqB,kBAAkB,CAAC,aAAa,CAAC,cAAc,CACrE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC1D,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;YACrB,eAAe,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,QAAQ,mCAAmC,CACzF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;QAC7B,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;QACzB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QACrB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;KAC/B,CAAC;AACJ,CAAC"}

package/dist/internal/target-auth/config.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Target-auth config storage (local-only, v1).
+ *
+ * Per-target IdP config (domain, client_id, mode, callback port) lives under
+ * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
+ * credentials — safe to commit a sanitized version to your repo if you want
+ * teammates to share it.
+ *
+ * v2: ZIVIS will serve target-auth config from the API so any team member's
+ * CLI can discover it. For now, configure once locally with `zivis target
+ * configure` and check in the file if you want it shared.
+ */
+import type { TargetAuthConfig } from "./types.js";
+export declare function loadTargetConfig(targetId: string): Promise<TargetAuthConfig | null>;
+export declare function saveTargetConfig(targetId: string, cfg: TargetAuthConfig): Promise<string>;
+export declare function listTargetConfigs(): Promise<Array<{
+    targetId: string;
+    type: string;
+}>>;
+export declare function getConfigPath(targetId: string): string;

package/dist/internal/target-auth/config.js

@@ -0,0 +1,58 @@
+/**
+ * Target-auth config storage (local-only, v1).
+ *
+ * Per-target IdP config (domain, client_id, mode, callback port) lives under
+ * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
+ * credentials — safe to commit a sanitized version to your repo if you want
+ * teammates to share it.
+ *
+ * v2: ZIVIS will serve target-auth config from the API so any team member's
+ * CLI can discover it. For now, configure once locally with `zivis target
+ * configure` and check in the file if you want it shared.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+function configDir() {
+    return path.join(os.homedir(), ".config", "zivis", "target-configs");
+}
+function configPath(targetId) {
+    return path.join(configDir(), `${targetId}.json`);
+}
+export async function loadTargetConfig(targetId) {
+    try {
+        const raw = await fs.readFile(configPath(targetId), "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function saveTargetConfig(targetId, cfg) {
+    await fs.mkdir(configDir(), { recursive: true, mode: 0o700 });
+    const p = configPath(targetId);
+    await fs.writeFile(p, JSON.stringify(cfg, null, 2) + "\n", { mode: 0o600 });
+    return p;
+}
+export async function listTargetConfigs() {
+    try {
+        const entries = await fs.readdir(configDir());
+        const out = [];
+        for (const name of entries) {
+            if (!name.endsWith(".json"))
+                continue;
+            const targetId = name.slice(0, -".json".length);
+            const cfg = await loadTargetConfig(targetId);
+            if (cfg)
+                out.push({ targetId, type: cfg.type });
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+export function getConfigPath(targetId) {
+    return configPath(targetId);
+}
+//# sourceMappingURL=config.js.map

package/dist/internal/target-auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/internal/target-auth/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9B,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,GAAqB;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAA8C,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC"}

package/dist/internal/target-auth/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Target-auth orchestrator: load config, run the right IdP flow, manage tokens.
+ *
+ * Public API:
+ *   getValidTargetToken(targetId, persona) — returns access_token; refreshes if near expiry
+ *   loginTarget(targetId, persona)         — runs the appropriate IdP flow
+ *   logoutTarget(targetId, persona)        — clears stored tokens
+ *
+ * Designed so RT-runner-side ephemeral cred plumbing only sees a flat
+ * { accessToken, refreshToken?, expiresAt, idpType } bundle — no IdP
+ * specifics leak past this boundary.
+ */
+import type { EphemeralTargetCreds, TargetTokens } from "./types.js";
+export declare function loginTarget(targetId: string, persona: string): Promise<TargetTokens>;
+/**
+ * J.4 path: log in against an Application by id. Auth config comes from
+ * the platform (no local config file required). Tokens are stored under
+ * the existing keychain namespace using applicationId as the key — same
+ * keychain layout, no migration needed for already-stored tokens.
+ */
+export declare function loginApplication(applicationId: string, persona: string, sessionName?: string): Promise<TargetTokens>;
+export declare function logoutTarget(targetId: string, persona: string): Promise<void>;
+export declare function getValidTargetToken(targetId: string, persona: string): Promise<TargetTokens | null>;
+export declare function getEphemeralCreds(targetId: string, persona: string): Promise<EphemeralTargetCreds | null>;
+export declare function tokenInfo(targetId: string, persona: string): Promise<{
+    valid: boolean;
+    expiresAt: string | null;
+    secondsRemaining: number;
+    hasRefresh: boolean;
+} | null>;

package/dist/internal/target-auth/index.js

@@ -0,0 +1,101 @@
+/**
+ * Target-auth orchestrator: load config, run the right IdP flow, manage tokens.
+ *
+ * Public API:
+ *   getValidTargetToken(targetId, persona) — returns access_token; refreshes if near expiry
+ *   loginTarget(targetId, persona)         — runs the appropriate IdP flow
+ *   logoutTarget(targetId, persona)        — clears stored tokens
+ *
+ * Designed so RT-runner-side ephemeral cred plumbing only sees a flat
+ * { accessToken, refreshToken?, expiresAt, idpType } bundle — no IdP
+ * specifics leak past this boundary.
+ */
+import { loadTargetConfig } from "./config.js";
+import { loadTokens, storeTokens, deleteTokens } from "./keychain.js";
+import { loginWorkos, refreshWorkos } from "./workos.js";
+import { fetchAuthConfig, adaptToWorkosConfig } from "./api-config.js";
+const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+export async function loginTarget(targetId, persona) {
+    const cfg = await mustLoadConfig(targetId);
+    const tokens = await runLogin(cfg, persona);
+    await storeTokens(targetId, persona, tokens);
+    return tokens;
+}
+/**
+ * J.4 path: log in against an Application by id. Auth config comes from
+ * the platform (no local config file required). Tokens are stored under
+ * the existing keychain namespace using applicationId as the key — same
+ * keychain layout, no migration needed for already-stored tokens.
+ */
+export async function loginApplication(applicationId, persona, sessionName) {
+    const resp = await fetchAuthConfig(applicationId, sessionName);
+    const cfg = adaptToWorkosConfig(resp);
+    const tokens = await runLogin(cfg, persona);
+    await storeTokens(applicationId, persona, tokens);
+    return tokens;
+}
+export async function logoutTarget(targetId, persona) {
+    await deleteTokens(targetId, persona);
+}
+export async function getValidTargetToken(targetId, persona) {
+    const tokens = await loadTokens(targetId, persona);
+    if (!tokens)
+        return null;
+    if (tokens.expires_at > Date.now() + REFRESH_BUFFER_MS) {
+        return tokens;
+    }
+    if (!tokens.refresh_token)
+        return null;
+    const cfg = await mustLoadConfig(targetId);
+    const fresh = await runRefresh(cfg, tokens.refresh_token);
+    await storeTokens(targetId, persona, fresh);
+    return fresh;
+}
+export async function getEphemeralCreds(targetId, persona) {
+    const tokens = await getValidTargetToken(targetId, persona);
+    if (!tokens)
+        return null;
+    const cfg = await loadTargetConfig(targetId);
+    return {
+        idpType: (cfg?.type ?? "none"),
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresAt: tokens.expires_at,
+        persona,
+    };
+}
+export async function tokenInfo(targetId, persona) {
+    const tokens = await loadTokens(targetId, persona);
+    if (!tokens)
+        return null;
+    return {
+        valid: tokens.expires_at > Date.now() + REFRESH_BUFFER_MS,
+        expiresAt: new Date(tokens.expires_at).toISOString(),
+        secondsRemaining: Math.round((tokens.expires_at - Date.now()) / 1000),
+        hasRefresh: !!tokens.refresh_token,
+    };
+}
+async function mustLoadConfig(targetId) {
+    const cfg = await loadTargetConfig(targetId);
+    if (!cfg) {
+        throw new Error(`No auth config for target ${targetId}. Run: zivis target configure ${targetId} --type workos --client-id <id> --domain <host>`);
+    }
+    return cfg;
+}
+async function runLogin(cfg, persona) {
+    switch (cfg.type) {
+        case "workos":
+            return loginWorkos(cfg, persona);
+        default:
+            throw new Error(`Unsupported IdP type: ${cfg.type}`);
+    }
+}
+async function runRefresh(cfg, refreshToken) {
+    switch (cfg.type) {
+        case "workos":
+            return refreshWorkos(cfg, refreshToken);
+        default:
+            throw new Error(`Unsupported IdP type: ${cfg.type}`);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/internal/target-auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/internal/target-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAQvE,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,OAAe,EACf,WAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,OAAe;IAClE,MAAM,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,IAAI,MAAM,CAAY;QACzC,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,OAAe;IAOf,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;QACzD,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QACpD,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QACrE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa;KACnC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,iCAAiC,QAAQ,iDAAiD,CAChI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAqB,EAAE,OAAe;IAC5D,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC;YACE,MAAM,IAAI,KAAK,CAAC,yBAA0B,GAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAqB,EACrB,YAAoB;IAEpB,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC1C;YACE,MAAM,IAAI,KAAK,CAAC,yBAA0B,GAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}

package/dist/internal/target-auth/keychain.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Target-auth keychain.
+ *
+ * Distinct namespace from the user's ZIVIS-platform tokens (handled by
+ * `zivis-mcp-security`'s keychain module). A user can be logged into
+ * ZIVIS itself AND to N customer-target IdPs simultaneously, each with
+ * multiple personas (admin, user_a, …) for permutation testing.
+ *
+ * Storage layout
+ *   service: zivis.target.<targetId>.<persona>
+ *   account: zivis-target
+ *   value:   JSON-serialised TargetTokens
+ *
+ * macOS-only for v1 (matches the engagement helper). Linux/Windows fall
+ * back to an encrypted file on disk; the underlying impl lives in
+ * `@zivis-ai/mcp-security/auth/keychain.ts` for the platform login — we
+ * deliberately don't share that module to keep the namespaces isolated.
+ */
+import type { TargetTokens } from "./types.js";
+export declare function storeTokens(targetId: string, persona: string, tokens: TargetTokens): Promise<void>;
+export declare function loadTokens(targetId: string, persona: string): Promise<TargetTokens | null>;
+export declare function deleteTokens(targetId: string, persona: string): Promise<void>;
+export declare function getStorageName(): string;

package/dist/internal/target-auth/keychain.js

@@ -0,0 +1,150 @@
+/**
+ * Target-auth keychain.
+ *
+ * Distinct namespace from the user's ZIVIS-platform tokens (handled by
+ * `zivis-mcp-security`'s keychain module). A user can be logged into
+ * ZIVIS itself AND to N customer-target IdPs simultaneously, each with
+ * multiple personas (admin, user_a, …) for permutation testing.
+ *
+ * Storage layout
+ *   service: zivis.target.<targetId>.<persona>
+ *   account: zivis-target
+ *   value:   JSON-serialised TargetTokens
+ *
+ * macOS-only for v1 (matches the engagement helper). Linux/Windows fall
+ * back to an encrypted file on disk; the underlying impl lives in
+ * `@zivis-ai/mcp-security/auth/keychain.ts` for the platform login — we
+ * deliberately don't share that module to keep the namespaces isolated.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import * as crypto from "node:crypto";
+const execFileAsync = promisify(execFile);
+const SERVICE_PREFIX = "zivis.target";
+const ACCOUNT = "zivis-target";
+function svc(targetId, persona) {
+    return `${SERVICE_PREFIX}.${targetId}.${persona}`;
+}
+function fallbackPath(targetId, persona) {
+    const dir = path.join(os.homedir(), ".config", "zivis", "target-tokens");
+    return path.join(dir, `${targetId}.${persona}.enc`);
+}
+function fallbackKey() {
+    // Same scheme as the platform-side keychain fallback: derive from username.
+    return new Uint8Array(crypto.scryptSync(os.userInfo().username || "zivis", "zivis-target-salt", 32));
+}
+async function macStore(targetId, persona, value) {
+    try {
+        await execFileAsync("security", [
+            "delete-generic-password", "-a", ACCOUNT, "-s", svc(targetId, persona),
+        ]);
+    }
+    catch { /* not present */ }
+    await execFileAsync("security", [
+        "add-generic-password", "-a", ACCOUNT, "-s", svc(targetId, persona), "-w", value,
+    ]);
+}
+async function macRead(targetId, persona) {
+    try {
+        const { stdout } = await execFileAsync("security", [
+            "find-generic-password", "-a", ACCOUNT, "-s", svc(targetId, persona), "-w",
+        ]);
+        return stdout.trim();
+    }
+    catch {
+        return null;
+    }
+}
+async function macDelete(targetId, persona) {
+    try {
+        await execFileAsync("security", [
+            "delete-generic-password", "-a", ACCOUNT, "-s", svc(targetId, persona),
+        ]);
+    }
+    catch { /* not present */ }
+}
+async function fileStore(targetId, persona, value) {
+    const p = fallbackPath(targetId, persona);
+    await fs.mkdir(path.dirname(p), { recursive: true, mode: 0o700 });
+    const iv = new Uint8Array(crypto.randomBytes(16));
+    const cipher = crypto.createCipheriv("aes-256-gcm", fallbackKey(), iv);
+    const encUpdate = new Uint8Array(cipher.update(value, "utf8"));
+    const encFinal = new Uint8Array(cipher.final());
+    const tag = new Uint8Array(cipher.getAuthTag());
+    const out = new Uint8Array(iv.length + tag.length + encUpdate.length + encFinal.length);
+    out.set(iv, 0);
+    out.set(tag, iv.length);
+    out.set(encUpdate, iv.length + tag.length);
+    out.set(encFinal, iv.length + tag.length + encUpdate.length);
+    await fs.writeFile(p, out, { mode: 0o600 });
+}
+async function fileRead(targetId, persona) {
+    try {
+        const p = fallbackPath(targetId, persona);
+        const buf = new Uint8Array(await fs.readFile(p));
+        const iv = buf.subarray(0, 16);
+        const tag = buf.subarray(16, 32);
+        const enc = buf.subarray(32);
+        const decipher = crypto.createDecipheriv("aes-256-gcm", fallbackKey(), iv);
+        decipher.setAuthTag(tag);
+        const decUpdate = new Uint8Array(decipher.update(enc));
+        const decFinal = new Uint8Array(decipher.final());
+        const dec = new Uint8Array(decUpdate.length + decFinal.length);
+        dec.set(decUpdate, 0);
+        dec.set(decFinal, decUpdate.length);
+        return Buffer.from(dec).toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
+async function fileDelete(targetId, persona) {
+    try {
+        await fs.unlink(fallbackPath(targetId, persona));
+    }
+    catch { /* not present */ }
+}
+async function tryMac() {
+    if (process.platform !== "darwin")
+        return false;
+    try {
+        await execFileAsync("which", ["security"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function storeTokens(targetId, persona, tokens) {
+    const value = JSON.stringify(tokens);
+    if (await tryMac())
+        return macStore(targetId, persona, value);
+    return fileStore(targetId, persona, value);
+}
+export async function loadTokens(targetId, persona) {
+    const raw = (await tryMac())
+        ? await macRead(targetId, persona)
+        : await fileRead(targetId, persona);
+    if (!raw)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function deleteTokens(targetId, persona) {
+    if (await tryMac())
+        return macDelete(targetId, persona);
+    return fileDelete(targetId, persona);
+}
+export function getStorageName() {
+    return process.platform === "darwin"
+        ? "macOS Keychain"
+        : "encrypted file (~/.config/zivis/target-tokens)";
+}
+//# sourceMappingURL=keychain.js.map

package/dist/internal/target-auth/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/internal/target-auth/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAGtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,OAAO,GAAG,cAAc,CAAC;AAE/B,SAAS,GAAG,CAAC,QAAgB,EAAE,OAAe;IAC5C,OAAO,GAAG,cAAc,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAe;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,OAAO,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW;IAClB,4EAA4E;IAC5E,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,IAAI,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,OAAe,EAAE,KAAa;IACtE,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,MAAM,aAAa,CAAC,UAAU,EAAE;QAC9B,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK;KACjF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,OAAe;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;YACjD,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI;SAC3E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,OAAe;IACxD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,OAAe,EAAE,KAAa;IACvE,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxF,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACf,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,OAAe;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,OAAe;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,OAAe,EACf,MAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,MAAM,EAAE;QAAE,OAAO,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAgB,EAChB,OAAe;IAEf,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC;QAC1B,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;QAClC,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,OAAe;IAClE,IAAI,MAAM,MAAM,EAAE;QAAE,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,gDAAgD,CAAC;AACvD,CAAC"}

package/dist/internal/target-auth/types.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Target-auth: PKCE auth flows against the *customer's* identity provider.
+ *
+ * The user authenticates locally against the target system's IdP. Tokens
+ * stay in the user's OS keychain. When a scenario run is triggered, the
+ * CLI ships a short-lived access token (and optionally a refresh token)
+ * to the ZIVIS platform, which uses it for the duration of the run only.
+ * ZIVIS never persists target-system credentials.
+ */
+export type IdpType = "workos" | "auth0" | "apikey" | "none";
+/** WorkOS path layout — three observed flavors. */
+export type WorkosMode = "user_management" | "authkit" | "workos";
+export interface WorkosConfig {
+    type: "workos";
+    /** WorkOS client_id (AuthKit application). */
+    clientId: string;
+    /**
+     * Auth host. e.g. `api.workos.com` (user_management/legacy) or
+     * `<custom>.authkit.app` (custom AuthKit domain).
+     */
+    domain: string;
+    /** Path layout flavor. Defaults to `user_management`. */
+    mode?: WorkosMode;
+    /** localhost callback port for the PKCE redirect. Defaults to 5174. */
+    callbackPort?: number;
+    /** Extra OAuth scopes beyond `openid profile email offline_access`. */
+    extraScopes?: string[];
+}
+export type TargetAuthConfig = WorkosConfig;
+export interface TargetTokens {
+    /** OAuth access token. */
+    access_token: string;
+    /** OAuth refresh token, if the IdP issued one. */
+    refresh_token?: string;
+    /** Unix-ms expiry, derived from JWT exp claim or `expires_in`. */
+    expires_at: number;
+    /** Optional id_token for client-side claim inspection. */
+    id_token?: string;
+    /** When this token bundle was obtained (unix-ms). */
+    obtained_at: number;
+}
+/** Bundle shipped to ZIVIS on `scenario run` — RT consumes ephemerally. */
+export interface EphemeralTargetCreds {
+    idpType: IdpType;
+    accessToken: string;
+    refreshToken?: string;
+    /** Unix-ms expiry of the access token. */
+    expiresAt: number;
+    /** Echo of the persona, useful for audit logs. */
+    persona?: string;
+}