@zivis/cli 0.1.0-alpha.1

package/dist/internal/target-auth/types.js

@@ -0,0 +1,11 @@
+/**
+ * Target-auth: PKCE auth flows against the *customer's* identity provider.
+ *
+ * The user authenticates locally against the target system's IdP. Tokens
+ * stay in the user's OS keychain. When a scenario run is triggered, the
+ * CLI ships a short-lived access token (and optionally a refresh token)
+ * to the ZIVIS platform, which uses it for the duration of the run only.
+ * ZIVIS never persists target-system credentials.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/internal/target-auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/internal/target-auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/internal/target-auth/workos.d.ts

@@ -0,0 +1,20 @@
+/**
+ * WorkOS PKCE login + refresh against a *target* IdP.
+ *
+ * Adapted from `zivis-rt/specs/engagements/meshmesh-cred-threat-model/scripts/authkit-helper.mjs`,
+ * which is itself adapted from `@zivis-ai/mcp-security/src/auth/oauth.ts`. Three
+ * known WorkOS flavors are supported:
+ *   - user_management — api.workos.com/user_management/{authorize,authenticate}
+ *   - authkit         — <custom>.authkit.app/oauth2/{authorize,token}
+ *   - workos          — legacy auth.workos.com/{authorize,oauth/token}
+ *
+ * Why a copy and not a shared module: the platform-side login uses a fixed
+ * client_id and our own AuthKit. Target login uses the *customer's* IdP
+ * config, parameterized per target. Same primitives, different config
+ * surface — keeping them separate avoids accidental cross-tenant token mixing.
+ */
+import type { TargetTokens, WorkosConfig } from "./types.js";
+export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
+declare function refreshTokens(cfg: WorkosConfig, refreshToken: string): Promise<TargetTokens>;
+export declare function loginWorkos(cfg: WorkosConfig, persona: string): Promise<TargetTokens>;
+export { refreshTokens as refreshWorkos };

package/dist/internal/target-auth/workos.js

@@ -0,0 +1,196 @@
+/**
+ * WorkOS PKCE login + refresh against a *target* IdP.
+ *
+ * Adapted from `zivis-rt/specs/engagements/meshmesh-cred-threat-model/scripts/authkit-helper.mjs`,
+ * which is itself adapted from `@zivis-ai/mcp-security/src/auth/oauth.ts`. Three
+ * known WorkOS flavors are supported:
+ *   - user_management — api.workos.com/user_management/{authorize,authenticate}
+ *   - authkit         — <custom>.authkit.app/oauth2/{authorize,token}
+ *   - workos          — legacy auth.workos.com/{authorize,oauth/token}
+ *
+ * Why a copy and not a shared module: the platform-side login uses a fixed
+ * client_id and our own AuthKit. Target login uses the *customer's* IdP
+ * config, parameterized per target. Same primitives, different config
+ * surface — keeping them separate avoids accidental cross-tenant token mixing.
+ */
+import * as crypto from "node:crypto";
+import * as http from "node:http";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import open from "open";
+const execFileAsync = promisify(execFile);
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+function pathsFor(mode) {
+    switch (mode) {
+        case "workos":
+            return { authPath: "/authorize", tokenPath: "/oauth/token" };
+        case "authkit":
+            return { authPath: "/oauth2/authorize", tokenPath: "/oauth2/token" };
+        case "user_management":
+        default:
+            return { authPath: "/user_management/authorize", tokenPath: "/user_management/authenticate" };
+    }
+}
+function pkce() {
+    const verifier = crypto.randomBytes(32).toString("base64url");
+    const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge };
+}
+function randomState() {
+    return crypto.randomBytes(16).toString("hex");
+}
+export function decodeJwtPayload(jwt) {
+    const parts = jwt.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function baseUrl(domain) {
+    return domain.startsWith("http") ? domain : `https://${domain}`;
+}
+function tokensFromResponse(d, prevRefresh) {
+    const claims = decodeJwtPayload(d.access_token) || {};
+    const expClaim = claims.exp;
+    const expAt = expClaim
+        ? expClaim * 1000
+        : d.expires_in
+            ? Date.now() + d.expires_in * 1000
+            : Date.now() + 10 * 60 * 1000;
+    return {
+        access_token: d.access_token,
+        refresh_token: d.refresh_token || prevRefresh,
+        expires_at: expAt,
+        id_token: d.id_token,
+        obtained_at: Date.now(),
+    };
+}
+function htmlPage(success, msg = "") {
+    const title = success ? "Authenticated" : "Auth failed";
+    const color = success ? "#00d4aa" : "#ff5252";
+    return `<!DOCTYPE html><html><head><title>${title}</title></head>
+<body style="font-family:system-ui;text-align:center;padding:50px;background:#0f0f1a;color:#fff;">
+<h1 style="color:${color};">${title}</h1><p>${msg}</p>
+<p>You can close this window.</p><script>setTimeout(()=>window.close(),1500);</script>
+</body></html>`;
+}
+function startCallbackServer(port, expectedState) {
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            const u = new URL(req.url || "/", `http://localhost:${port}`);
+            if (u.pathname !== "/callback") {
+                res.writeHead(404);
+                res.end("not found");
+                return;
+            }
+            const code = u.searchParams.get("code");
+            const state = u.searchParams.get("state");
+            const error = u.searchParams.get("error");
+            const errorDesc = u.searchParams.get("error_description");
+            res.writeHead(200, { "Content-Type": "text/html" });
+            if (error) {
+                res.end(htmlPage(false, errorDesc || error));
+                server.close();
+                return reject(new Error(errorDesc || error));
+            }
+            if (state !== expectedState) {
+                res.end(htmlPage(false, "state mismatch"));
+                server.close();
+                return reject(new Error("state mismatch"));
+            }
+            if (!code) {
+                res.end(htmlPage(false, "no code"));
+                server.close();
+                return reject(new Error("no code"));
+            }
+            res.end(htmlPage(true));
+            server.close();
+            resolve(code);
+        });
+        server.on("error", reject);
+        server.listen(port, "127.0.0.1");
+        setTimeout(() => {
+            server.close();
+            reject(new Error("login timed out"));
+        }, LOGIN_TIMEOUT_MS);
+    });
+}
+async function exchangeCode(cfg, code, verifier) {
+    const { tokenPath } = pathsFor(cfg.mode);
+    const port = cfg.callbackPort ?? 5174;
+    const body = {
+        grant_type: "authorization_code",
+        client_id: cfg.clientId,
+        code,
+        code_verifier: verifier,
+    };
+    if ((cfg.mode || "user_management") !== "user_management") {
+        body.redirect_uri = `http://localhost:${port}/callback`;
+    }
+    const res = await fetch(`${baseUrl(cfg.domain)}${tokenPath}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const txt = await res.text();
+        throw new Error(`token exchange failed: ${res.status} ${txt}`);
+    }
+    return tokensFromResponse(await res.json());
+}
+async function refreshTokens(cfg, refreshToken) {
+    const { tokenPath } = pathsFor(cfg.mode);
+    const res = await fetch(`${baseUrl(cfg.domain)}${tokenPath}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            grant_type: "refresh_token",
+            client_id: cfg.clientId,
+            refresh_token: refreshToken,
+        }),
+    });
+    if (!res.ok) {
+        const txt = await res.text();
+        throw new Error(`refresh failed: ${res.status} ${txt}`);
+    }
+    return tokensFromResponse(await res.json(), refreshToken);
+}
+export async function loginWorkos(cfg, persona) {
+    const { authPath } = pathsFor(cfg.mode);
+    const port = cfg.callbackPort ?? 5174;
+    const { verifier, challenge } = pkce();
+    const state = randomState();
+    const scope = ["openid", "profile", "email", "offline_access", ...(cfg.extraScopes || [])].join(" ");
+    const params = new URLSearchParams({
+        response_type: "code",
+        client_id: cfg.clientId,
+        redirect_uri: `http://localhost:${port}/callback`,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        state,
+        scope,
+    });
+    params.set("prompt", "login");
+    if ((cfg.mode || "user_management") === "user_management") {
+        params.set("provider", "authkit");
+    }
+    const authUrl = `${baseUrl(cfg.domain)}${authPath}?${params.toString()}`;
+    const codePromise = startCallbackServer(port, state);
+    process.stderr.write(`[zivis] target auth → opening browser for persona "${persona}"\n`);
+    try {
+        await open(authUrl);
+    }
+    catch {
+        // open() can fail in headless envs — print the URL and let the user click.
+        await execFileAsync("printf", [authUrl]).catch(() => { });
+        process.stderr.write(`[zivis] open ${authUrl}\n`);
+    }
+    const code = await codePromise;
+    return exchangeCode(cfg, code, verifier);
+}
+export { refreshTokens as refreshWorkos };
+//# sourceMappingURL=workos.js.map

package/dist/internal/target-auth/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../../src/internal/target-auth/workos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAOvC,SAAS,QAAQ,CAAC,IAA0B;IAC1C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QAC/D,KAAK,SAAS;YACZ,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;QACvE,KAAK,iBAAiB,CAAC;QACvB;YACE,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,SAAS,EAAE,+BAA+B,EAAE,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAM,EAAE,WAAoB;IACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAI,MAA2B,CAAC,GAAG,CAAC;IAClD,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,QAAQ,GAAG,IAAI;QACjB,CAAC,CAAC,CAAC,CAAC,UAAU;YACd,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,GAAG,IAAI;YAClC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAChC,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,WAAW;QAC7C,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB,EAAE,GAAG,GAAG,EAAE;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,OAAO,qCAAqC,KAAK;;mBAEhC,KAAK,MAAM,KAAK,WAAW,GAAG;;eAElC,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,aAAqB;IAC9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAE1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;gBAC7C,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAC3C,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;gBACpC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjC,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAiB,EACjB,IAAY,EACZ,QAAgB;IAEhB,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IACtC,MAAM,IAAI,GAA2B;QACnC,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,GAAG,CAAC,QAAQ;QACvB,IAAI;QACJ,aAAa,EAAE,QAAQ;KACxB,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,KAAK,iBAAiB,EAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,oBAAoB,IAAI,WAAW,CAAC;IAC1D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAiB,EACjB,YAAoB;IAEpB,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,GAAG,CAAC,QAAQ;YACvB,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAiB,EACjB,OAAe;IAEf,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IACtC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAE5B,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,GAAG,CAAC,QAAQ;QACvB,YAAY,EAAE,oBAAoB,IAAI,WAAW;QACjD,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,KAAK;KACN,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,KAAK,iBAAiB,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzE,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAErD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,OAAO,KAAK,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;IAC/B,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,CAAC"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@zivis/cli",
+  "version": "0.1.0-alpha.1",
+  "description": "ZIVIS CLI — threat modeling, scans, and MCP server for IDE integration",
+  "type": "module",
+  "bin": {
+    "zivis": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "package.json"
+  ],
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "@iarna/toml": "^2.2.5",
+    "@vscode/tree-sitter-wasm": "^0.3.1",
+    "commander": "^12.1.0",
+    "ignore": "^7.0.5",
+    "open": "^10.1.0",
+    "web-tree-sitter": "^0.26.8",
+    "@zivis/mcp-security": "0.1.8"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build:workspace-deps": "pnpm --filter @zivis/mcp-security run build",
+    "build": "pnpm run build:workspace-deps && tsc && node scripts/ensure-symlink.cjs",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "lint": "pnpm run build:workspace-deps && tsc --noEmit",
+    "test": "vitest run"
+  }
+}