@zivis/cli 0.1.0-alpha.28 → 0.1.0-alpha.3

package/dist/commands/auth/bind.d.ts

@@ -1,30 +0,0 @@
-/**
- * zivis auth bind
- *
- * The recommended setup command for developers using ZIVIS with an IDE or
- * agentic workflow.
- *
- * How it works:
- *   1. Opens a browser → WorkOS login scoped to the project's org
- *   2. ZIVIS backend verifies org membership and mints a Local Project
- *      Binding Token (a WorkOS API key scoped to this user + org)
- *   3. The token is stored in the OS keychain under `apikey.<session>`
- *   4. IDE configs (.cursor/mcp.json, .vscode/mcp.json) are written with
- *      --workspace pointing to this repo
- *   5. OAuth tokens from the login ceremony are discarded — the API key
- *      is the only long-lived credential
- *
- * The result: the MCP server uses a stable, org-scoped token that never
- * refreshes and never drifts to a different org.
- *
- * Security model:
- *   - WorkOS login = identity + membership proof (ephemeral)
- *   - Local Project Binding Token = execution credential (permanent until revoked)
- *   - Keys are visible in `zivis auth status` and Settings → API Tokens for audit
- *   - `zivis auth logout` clears the key locally; revoke in the UI to invalidate
- *     it server-side
- */
-export interface BindCmdOpts {
-    yes?: boolean;
-}
-export declare function bindCommand(opts: BindCmdOpts): Promise<void>;

package/dist/commands/auth/bind.js

@@ -1,174 +0,0 @@
-/**
- * zivis auth bind
- *
- * The recommended setup command for developers using ZIVIS with an IDE or
- * agentic workflow.
- *
- * How it works:
- *   1. Opens a browser → WorkOS login scoped to the project's org
- *   2. ZIVIS backend verifies org membership and mints a Local Project
- *      Binding Token (a WorkOS API key scoped to this user + org)
- *   3. The token is stored in the OS keychain under `apikey.<session>`
- *   4. IDE configs (.cursor/mcp.json, .vscode/mcp.json) are written with
- *      --workspace pointing to this repo
- *   5. OAuth tokens from the login ceremony are discarded — the API key
- *      is the only long-lived credential
- *
- * The result: the MCP server uses a stable, org-scoped token that never
- * refreshes and never drifts to a different org.
- *
- * Security model:
- *   - WorkOS login = identity + membership proof (ephemeral)
- *   - Local Project Binding Token = execution credential (permanent until revoked)
- *   - Keys are visible in `zivis auth status` and Settings → API Tokens for audit
- *   - `zivis auth logout` clears the key locally; revoke in the UI to invalidate
- *     it server-side
- */
-import * as os from "node:os";
-import * as crypto from "node:crypto";
-import * as child_process from "node:child_process";
-import { login } from "@zivis/mcp/auth";
-import { keychainStore, keychainClearSession } from "@zivis/mcp/auth";
-import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
-import { extractEmail } from "../../internal/orgs.js";
-import { ensureProjectBinding } from "../../internal/project-binding.js";
-import { setupCursorWorkspace, setupVsCodeClaude, setupVsCodeCopilot, setupClaudeCodeCli, } from "../../internal/ide-setup.js";
-/** Get the git remote URL of the current repo for the key name, or fallback. */
-function getRepoFingerprint() {
-    try {
-        const remote = child_process
-            .execSync("git remote get-url origin 2>/dev/null", { encoding: "utf8" })
-            .trim();
-        if (remote) {
-            return crypto.createHash("sha256").update(remote).digest("hex").slice(0, 12);
-        }
-    }
-    catch {
-        // no git or no remote
-    }
-    return crypto.createHash("sha256").update(process.cwd()).digest("hex").slice(0, 12);
-}
-export async function bindCommand(opts) {
-    const config = resolveConfigFromBinding(process.cwd());
-    const cwd = process.cwd();
-    const detected = detectProjectBinding(cwd);
-    // We need a project binding to know which org to bind to.
-    // The binding provides workosOrgId + session name.
-    if (!detected?.binding.workosOrgId) {
-        console.error("");
-        console.error("[zivis] ERROR: No project binding found.");
-        console.error("[zivis] Run zivis auth login first to establish a project binding,");
-        console.error("[zivis] or ensure .zivis/project.json exists with a workosOrgId.");
-        console.error("");
-        console.error("  To create a binding:");
-        console.error("    zivis auth login");
-        process.exit(1);
-    }
-    const { workosOrgId, session: bindingSession, orgName } = detected.binding;
-    const session = bindingSession;
-    console.log("");
-    console.log(`Binding this repo to ${orgName ?? workosOrgId} (session: "${session}")`);
-    console.log("This will mint a Local Project Binding Token for MCP and IDE use.");
-    console.log("");
-    // Step 1: OAuth PKCE login — identity ceremony only.
-    // We scope it to the org from the project binding so there's no ambiguity.
-    let tokens;
-    try {
-        tokens = await login(config, `__bind_temp_${session}`, workosOrgId, {
-            orgName,
-            sessionLabel: session,
-            skipConfirm: opts.yes === true,
-        });
-    }
-    catch (err) {
-        console.error("[zivis] Authentication failed:", err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-    const email = extractEmail(tokens.id_token);
-    console.log(`✓ Authenticated as ${email}`);
-    // Step 2: Call POST /api/auth/bind with the fresh access token.
-    // The backend verifies membership and mints the WorkOS API key.
-    const repoFingerprint = getRepoFingerprint();
-    const hostname = os.hostname();
-    let bindResult;
-    try {
-        const response = await fetch(`${config.apiBaseUrl}/api/auth/bind`, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${tokens.access_token}`,
-                "Content-Type": "application/json",
-                "User-Agent": "@zivis/cli",
-            },
-            body: JSON.stringify({ repoFingerprint, hostname }),
-        });
-        if (!response.ok) {
-            const body = (await response.json().catch(() => ({})));
-            console.error(`[zivis] Backend bind failed (HTTP ${response.status}): ${body.message ?? body.error ?? "unknown error"}`);
-            process.exit(1);
-        }
-        bindResult = (await response.json());
-    }
-    catch (err) {
-        console.error("[zivis] Network error calling /api/auth/bind:", err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-    finally {
-        // Step 3: Discard the OAuth tokens — they were only needed for the bind ceremony.
-        // The Local Project Binding Token is the only credential we keep.
-        await keychainClearSession(`__bind_temp_${session}`).catch(() => { });
-    }
-    // Step 4: Store the Local Project Binding Token in the OS keychain.
-    // Stored under apikey.<session> so the MCP server finds it in the
-    // preferred credential slot (ahead of OAuth tokens in the precedence chain).
-    const apiKeyAccount = `apikey.${session}`;
-    try {
-        await keychainStore(apiKeyAccount, bindResult.key);
-    }
-    catch (err) {
-        console.error("[zivis] Failed to store token in OS keychain:", err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-    const maskedKey = `${bindResult.key.slice(0, 10)}...${bindResult.key.slice(-4)}`;
-    console.log(`✓ Local Project Binding Token stored (${maskedKey})`);
-    console.log(`  Org: ${bindResult.orgName} (${bindResult.workosOrgId})`);
-    console.log(`  Key name: ${bindResult.keyName}`);
-    // Step 5: Write IDE configs with --workspace so the MCP process is isolated.
-    try {
-        await setupCursorWorkspace();
-    }
-    catch (err) {
-        console.log(`  WARNING: Failed to update .cursor/mcp.json: ${err instanceof Error ? err.message : err}`);
-    }
-    try {
-        await setupVsCodeClaude();
-        await setupVsCodeCopilot();
-    }
-    catch (err) {
-        console.log(`  WARNING: Failed to update .vscode/mcp.json: ${err instanceof Error ? err.message : err}`);
-    }
-    try {
-        await setupClaudeCodeCli();
-    }
-    catch (err) {
-        console.log(`  WARNING: Failed to update Claude Code CLI config: ${err instanceof Error ? err.message : err}`);
-    }
-    // Step 6: Ensure the project binding file is up to date.
-    await ensureProjectBinding({
-        config,
-        session,
-        accessToken: tokens.access_token,
-        organizationId: workosOrgId,
-        cwd,
-        autoBind: true,
-        skipBind: false,
-        force: false,
-    });
-    console.log("");
-    console.log("✓ Bind complete. Reload your IDE to activate the MCP server.");
-    console.log("");
-    console.log("  To verify:      zivis auth status");
-    console.log("  To revoke:      zivis auth logout  (or Settings → API Tokens in the UI)");
-    console.log("");
-    process.exit(0);
-}
-//# sourceMappingURL=bind.js.map

package/dist/commands/auth/bind.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bind.js","sourceRoot":"","sources":["../../../src/commands/auth/bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE5F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AAMrC,gFAAgF;AAChF,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa;aACzB,QAAQ,CAAC,uCAAuC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;aACvE,IAAI,EAAE,CAAC;QACV,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAiB;IACjD,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE3C,0DAA0D;IAC1D,mDAAmD;IACnD,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAClF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC3E,MAAM,OAAO,GAAG,cAAc,CAAC;IAE/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,IAAI,WAAW,eAAe,OAAO,IAAI,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,qDAAqD;IACrD,2EAA2E;IAC3E,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,eAAe,OAAO,EAAE,EAAE,WAAW,EAAE;YAClE,OAAO;YACP,YAAY,EAAE,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI;SAC/B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;IAE3C,gEAAgE;IAChE,gEAAgE;IAChE,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAE/B,IAAI,UAUH,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,gBAAgB,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE;gBAC9C,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,YAAY;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA2B,CAAC;YACjF,OAAO,CAAC,KAAK,CACX,qCAAqC,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,eAAe,EAAE,CAC1G,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,kFAAkF;QAClF,kEAAkE;QAClE,MAAM,oBAAoB,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,oEAAoE;IACpE,kEAAkE;IAClE,6EAA6E;IAC7E,MAAM,aAAa,GAAG,UAAU,OAAO,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,yCAAyC,SAAS,GAAG,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,UAAU,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,eAAe,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjD,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,oBAAoB,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,iBAAiB,EAAE,CAAC;QAC1B,MAAM,kBAAkB,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,kBAAkB,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,yDAAyD;IACzD,MAAM,oBAAoB,CAAC;QACzB,MAAM;QACN,OAAO;QACP,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,cAAc,EAAE,WAAW;QAC3B,GAAG;QACH,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/commands/auth/init.d.ts

@@ -1,4 +0,0 @@
-export interface InitCmdOpts {
-    session?: string;
-}
-export declare function initCommand(opts: InitCmdOpts): Promise<void>;

package/dist/commands/auth/init.js

@@ -1,242 +0,0 @@
-import * as readline from "node:readline/promises";
-import { login, getStorageName, saveSessionEntry } from "@zivis/mcp/auth";
-import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
-import { fetchUserOrgs, extractEmail } from "../../internal/orgs.js";
-import { ensureProjectBinding } from "../../internal/project-binding.js";
-import { decodeJwtPayload } from "@zivis/mcp/auth/jwt";
-import { detectIdesInRepo, writeGuidance } from "../../internal/ide-setup.js";
-async function prompt(question) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
-    try {
-        return (await rl.question(question)).trim();
-    }
-    finally {
-        rl.close();
-    }
-}
-/**
- * After project binding succeeds, offer to write IDE guidance files.
- * This is the prime moment to ask — the user is already in setup mode.
- */
-async function offerGuidanceInstall(cwd) {
-    const detectedIdes = detectIdesInRepo(cwd);
-    if (detectedIdes.length === 0)
-        return;
-    const ideLabels = {
-        cursor: "Cursor",
-        "claude-code-cli": "Claude Code (CLAUDE.md)",
-        "vscode-copilot": "VS Code (Copilot)",
-        "vscode-claude": "VS Code (Claude)",
-        cline: "Cline",
-        windsurf: "Windsurf",
-    };
-    const ideNames = detectedIdes.map((ide) => ideLabels[ide] ?? ide).join(", ");
-    console.log(`\nDetected IDE configs in this repo: ${ideNames}`);
-    const ans = await prompt("Add ZIVIS guidance so your AI assistant suggests security checks at the right moments?\n" +
-        "(Adds a rule/instruction file. You can edit or remove it anytime.) [Y/n] ");
-    if (ans.toLowerCase() === "n" || ans.toLowerCase() === "no") {
-        console.log("  Skipped. Run 'zivis mcp install --client <ide> --with-guidance' anytime to add later.");
-        return;
-    }
-    const written = [];
-    for (const ide of detectedIdes) {
-        try {
-            const files = writeGuidance({ cwd, client: ide });
-            written.push(...files);
-        }
-        catch (err) {
-            console.warn(`  Warning: Could not write guidance for ${ide}: ${err instanceof Error ? err.message : err}`);
-        }
-    }
-    if (written.length > 0) {
-        console.log(`✓ Wrote guidance files:`);
-        for (const f of written)
-            console.log(`  ${f}`);
-    }
-}
-export async function initCommand(opts) {
-    // Prefer URL config from the existing project binding (if any) so that
-    // re-running `zivis auth init` in a staging repo hits staging automatically.
-    const config = resolveConfigFromBinding(process.cwd());
-    const session = opts.session || "default";
-    const envLabel = config.apiBaseUrl.includes("staging") ? "staging" : "production";
-    console.log(`Environment: ${envLabel} (${config.apiBaseUrl})`);
-    console.log("");
-    // Step 1: Open browser — no org pre-selection. User picks the org in their browser.
-    console.log("Opening browser for authentication...");
-    console.log("Log into the org you want to bind this project to.\n");
-    let tokens;
-    try {
-        tokens = await login(config, session, undefined, { skipConfirm: true });
-    }
-    catch (err) {
-        console.error("Login failed:", err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-    const email = extractEmail(tokens.id_token);
-    // Step 2: Determine which org the JWT is scoped to
-    const claims = decodeJwtPayload(tokens.access_token);
-    const jwtOrgId = claims?.org_id;
-    if (jwtOrgId) {
-        // Look up org name before confirming
-        let orgName;
-        try {
-            const orgs = await fetchUserOrgs(config, tokens.access_token);
-            orgName = orgs.find((o) => o.workosOrgId === jwtOrgId)?.name;
-            if (!orgName && orgs.length > 0) {
-                console.log(`\n  ⚠  WorkOS org ${jwtOrgId} is not registered in ZIVIS.`);
-                console.log(`     Your ZIVIS orgs: ${orgs.map((o) => `${o.name} (${o.workosOrgId})`).join(", ")}`);
-                console.log(`     Try logging into ${config.apiBaseUrl} in your browser first, then re-run init.\n`);
-            }
-        }
-        catch (e) {
-            console.error(`  (note: org name lookup failed — ${e instanceof Error ? e.message : e})`);
-        }
-        const orgLabel = orgName ?? `unknown org (${jwtOrgId})`;
-        console.log(`\nAuthenticated as: ${email}`);
-        console.log(`Org:              ${orgLabel}`);
-        console.log(`Environment:      ${envLabel} (${config.apiBaseUrl})\n`);
-        const confirm = await prompt(`Bind this project to "${orgLabel}"? [Y/n] `);
-        if (confirm.toLowerCase() === "n" || confirm.toLowerCase() === "no") {
-            console.log("");
-            const retry = await prompt("Retry login in a private/incognito window? [Y/n] ");
-            if (retry.toLowerCase() !== "n" && retry.toLowerCase() !== "no") {
-                console.log("\nOpening a private/incognito window — log into the correct org...\n");
-                let retryTokens;
-                try {
-                    retryTokens = await login(config, session, undefined, { skipConfirm: true, incognito: true });
-                }
-                catch (err) {
-                    console.error("Login failed:", err instanceof Error ? err.message : err);
-                    process.exit(1);
-                }
-                // Recurse by re-entering the confirmation flow with the new tokens
-                tokens = retryTokens;
-                const retryClaims = decodeJwtPayload(retryTokens.access_token);
-                const retryOrgId = retryClaims?.org_id;
-                if (!retryOrgId) {
-                    console.error("JWT returned no org scope. Try `zivis auth logout` then `zivis auth init` again.");
-                    process.exit(1);
-                }
-                let retryOrgName;
-                try {
-                    const retryOrgs = await fetchUserOrgs(config, retryTokens.access_token);
-                    retryOrgName = retryOrgs.find((o) => o.workosOrgId === retryOrgId)?.name;
-                }
-                catch (e) {
-                    console.error(`  (note: org name lookup failed — ${e instanceof Error ? e.message : e})`);
-                }
-                const retryLabel = retryOrgName ?? retryOrgId;
-                const retryEmail = extractEmail(retryTokens.id_token);
-                console.log(`\nAuthenticated as: ${retryEmail}`);
-                console.log(`Org:              ${retryLabel}\n`);
-                const retryConfirm = await prompt(`Bind this project to "${retryLabel}"? [Y/n] `);
-                if (retryConfirm.toLowerCase() === "n" || retryConfirm.toLowerCase() === "no") {
-                    console.log("Aborted.");
-                    process.exit(0);
-                }
-                const storageName2 = getStorageName();
-                await saveSessionEntry(session, retryEmail);
-                console.log(`\n✓ Logged in as ${retryEmail} → ${retryLabel}`);
-                console.log(`✓ Credentials stored in ${storageName2}`);
-                await ensureProjectBinding({
-                    config, session, accessToken: retryTokens.access_token,
-                    organizationId: retryOrgId, cwd: process.cwd(), autoBind: true, skipBind: false, force: true,
-                });
-                await offerGuidanceInstall(process.cwd());
-                process.exit(0);
-            }
-            console.log("\nAborted. Switch orgs in your browser then run `zivis auth logout && zivis auth init`.");
-            process.exit(0);
-        }
-        const storageName = getStorageName();
-        await saveSessionEntry(session, email);
-        console.log(`\n✓ Logged in as ${email} → ${orgLabel}`);
-        console.log(`✓ Credentials stored in ${storageName}`);
-        await ensureProjectBinding({
-            config,
-            session,
-            accessToken: tokens.access_token,
-            organizationId: jwtOrgId,
-            cwd: process.cwd(),
-            autoBind: true,
-            skipBind: false,
-            force: true,
-        });
-        await offerGuidanceInstall(process.cwd());
-    }
-    else {
-        // No org in JWT — user is authenticated but not scoped to an org yet.
-        // Fetch orgs and let them pick, then do a scoped login.
-        console.log("\nYour account isn't scoped to a specific org yet.");
-        console.log("Fetching your organizations...\n");
-        let orgs;
-        try {
-            orgs = await fetchUserOrgs(config, tokens.access_token);
-        }
-        catch (err) {
-            console.error("Failed to fetch organizations:", err instanceof Error ? err.message : err);
-            process.exit(1);
-        }
-        if (orgs.length === 0) {
-            console.error("No organizations found. Contact support.");
-            process.exit(1);
-        }
-        if (orgs.length === 1) {
-            console.log(`One org found: ${orgs[0].name}. Re-authenticating scoped to that org...`);
-        }
-        else {
-            console.log("Your organizations:");
-            orgs.forEach((org, i) => console.log(`  ${i + 1}. ${org.name}`));
-            const answer = await prompt(`\nSelect org to bind this project to [1-${orgs.length}]: `);
-            const idx = parseInt(answer, 10) - 1;
-            if (isNaN(idx) || idx < 0 || idx >= orgs.length) {
-                console.error("Invalid selection.");
-                process.exit(1);
-            }
-            const selected = orgs[idx];
-            if (!selected.workosOrgId) {
-                console.error(`Org "${selected.name}" has no WorkOS org ID.`);
-                process.exit(1);
-            }
-            console.log(`\nRe-opening browser scoped to ${selected.name}...`);
-            console.log("(Tip: if your browser logs into the wrong org, use option 2 to get a URL for a private/incognito window)\n");
-            try {
-                const scopedTokens = await login(config, session, selected.workosOrgId, {
-                    orgName: selected.name,
-                    skipConfirm: true,
-                });
-                const storageName2 = getStorageName();
-                await saveSessionEntry(session, email);
-                console.log(`\n✓ Logged in as ${email} → ${selected.name}`);
-                console.log(`✓ Credentials stored in ${storageName2}`);
-                await ensureProjectBinding({
-                    config,
-                    session,
-                    accessToken: scopedTokens.access_token,
-                    organizationId: selected.workosOrgId,
-                    cwd: process.cwd(),
-                    autoBind: true,
-                    skipBind: false,
-                    force: true,
-                });
-                await offerGuidanceInstall(process.cwd());
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                const m = msg.match(/received (org_\w+)/);
-                if (m) {
-                    console.error(`\n⚠  Browser authenticated to a different org than selected.`);
-                    console.error(`   Your browser has an active session for a different org.\n`);
-                    console.error(`   To fix: run \`zivis auth init\` again and paste the URL into a private/incognito window.`);
-                }
-                else {
-                    console.error("Login failed:", msg);
-                }
-                process.exit(1);
-            }
-        }
-    }
-    process.exit(0);
-}
-//# sourceMappingURL=init.js.map

package/dist/commands/auth/init.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/commands/auth/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAuB,MAAM,6BAA6B,CAAC;AAMnG,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAW;IAC7C,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEtC,MAAM,SAAS,GAAmC;QAChD,MAAM,EAAE,QAAQ;QAChB,iBAAiB,EAAE,yBAAyB;QAC5C,gBAAgB,EAAE,mBAAmB;QACrC,eAAe,EAAE,kBAAkB;QACnC,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,UAAU;KACrB,CAAC;IACF,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7E,OAAO,CAAC,GAAG,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,MAAM,CACtB,0FAA0F;QAC1F,2EAA2E,CAC5E,CAAC;IAEF,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,2CAA2C,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAiB;IACjD,uEAAuE;IACvE,6EAA6E;IAC7E,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;IAE1C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,KAAK,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,oFAAoF;IACpF,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IAEpE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,mDAAmD;IACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,EAAE,MAA4B,CAAC;IAEtD,IAAI,QAAQ,EAAE,CAAC;QACb,qCAAqC;QACrC,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC;YAC7D,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,8BAA8B,CAAC,CAAC;gBACzE,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnG,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,UAAU,6CAA6C,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,IAAI,gBAAgB,QAAQ,GAAG,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,KAAK,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,yBAAyB,QAAQ,WAAW,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;YAChF,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChE,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;gBACpF,IAAI,WAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChG,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,mEAAmE;gBACnE,MAAM,GAAG,WAAW,CAAC;gBACrB,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAC/D,MAAM,UAAU,GAAG,WAAW,EAAE,MAA4B,CAAC;gBAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;oBAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,IAAI,YAAgC,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;oBACxE,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,EAAE,IAAI,CAAC;gBAC3E,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC5F,CAAC;gBACD,MAAM,UAAU,GAAG,YAAY,IAAI,UAAU,CAAC;gBAC9C,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACtD,OAAO,CAAC,GAAG,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,qBAAqB,UAAU,IAAI,CAAC,CAAC;gBACjD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,yBAAyB,UAAU,WAAW,CAAC,CAAC;gBAClF,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;oBAC9E,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;gBACtC,MAAM,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,MAAM,UAAU,EAAE,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,2BAA2B,YAAY,EAAE,CAAC,CAAC;gBACvD,MAAM,oBAAoB,CAAC;oBACzB,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,YAAY;oBACtD,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;iBAC7F,CAAC,CAAC;gBACH,MAAM,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,QAAQ,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAC;QAEtD,MAAM,oBAAoB,CAAC;YACzB,MAAM;YACN,OAAO;YACP,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,cAAc,EAAE,QAAQ;YACxB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,MAAM,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,wDAAwD;QACxD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAEhD,IAAI,IAA+C,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,2CAA2C,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAEjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,2CAA2C,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YAE3B,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,QAAQ,QAAQ,CAAC,IAAI,yBAAyB,CAAC,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,kCAAkC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,4GAA4G,CAAC,CAAC;YAE1H,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE;oBACtE,OAAO,EAAE,QAAQ,CAAC,IAAI;oBACtB,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;gBACtC,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5D,OAAO,CAAC,GAAG,CAAC,2BAA2B,YAAY,EAAE,CAAC,CAAC;gBAEnD,MAAM,oBAAoB,CAAC;oBAC7B,MAAM;oBACN,OAAO;oBACP,WAAW,EAAE,YAAY,CAAC,YAAY;oBACtC,cAAc,EAAE,QAAQ,CAAC,WAAW;oBACpC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;oBAClB,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC;gBACH,MAAM,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBAC1C,IAAI,CAAC,EAAE,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;oBAC9E,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;oBAC9E,OAAO,CAAC,KAAK,CAAC,6FAA6F,CAAC,CAAC;gBAC/G,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;gBACtC,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/commands/auth/token.d.ts

@@ -1,17 +0,0 @@
-/**
- * zivis auth token
- *
- * Store a ZIVIS API access token in the OS keychain for a named session.
- * API tokens are the preferred auth method for the MCP server and CI pipelines
- * — they don't expire and don't require browser interaction.
- *
- * Usage:
- *   zivis auth token sk_<...>                   # default session
- *   zivis auth token sk_<...> --session zivis   # named session
- *
- * Tokens are generated in the ZIVIS platform: Settings → API Tokens
- */
-export interface TokenCmdOpts {
-    session?: string;
-}
-export declare function tokenCommand(apiKey: string, opts: TokenCmdOpts): Promise<void>;

package/dist/commands/auth/token.js

@@ -1,90 +0,0 @@
-/**
- * zivis auth token
- *
- * Store a ZIVIS API access token in the OS keychain for a named session.
- * API tokens are the preferred auth method for the MCP server and CI pipelines
- * — they don't expire and don't require browser interaction.
- *
- * Usage:
- *   zivis auth token sk_<...>                   # default session
- *   zivis auth token sk_<...> --session zivis   # named session
- *
- * Tokens are generated in the ZIVIS platform: Settings → API Tokens
- */
-import { keychainStore, getStorageName } from "@zivis/mcp/auth";
-import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
-const API_KEY_PREFIX = "sk_";
-const API_KEY_REGEX = /^sk_[a-z0-9_]{10,}$/i;
-function getApiKeyAccount(session) {
-    return session ? `apikey.${session}` : "apikey";
-}
-function validateKeyFormat(key) {
-    return API_KEY_REGEX.test(key);
-}
-export async function tokenCommand(apiKey, opts) {
-    // Validate format
-    if (!validateKeyFormat(apiKey)) {
-        console.error(`Invalid API token format. Expected: ${API_KEY_PREFIX}<token value>`);
-        console.error(`Got: ${apiKey.substring(0, 20)}...`);
-        console.error(`\nGenerate a token at: Settings → API Tokens in the ZIVIS platform.`);
-        process.exit(1);
-    }
-    // Determine session from opts or project binding
-    const detected = detectProjectBinding(process.cwd());
-    const session = opts.session ?? detected?.binding.session;
-    const account = getApiKeyAccount(session);
-    const sessionLabel = session ? `session "${session}"` : "default session";
-    const storageName = getStorageName();
-    try {
-        await keychainStore(account, apiKey);
-    }
-    catch (err) {
-        console.error(`Failed to store token: ${err instanceof Error ? err.message : err}`);
-        process.exit(1);
-    }
-    const maskedKey = `${apiKey.substring(0, 12)}...${apiKey.slice(-4)}`;
-    console.log(`✓ API token stored for ${sessionLabel}`);
-    console.log(`  Key: ${maskedKey}`);
-    console.log(`  Storage: ${storageName} (account: ${account})`);
-    if (session) {
-        console.log(`\nThe MCP server will use this token automatically for projects bound to session "${session}".`);
-    }
-    else {
-        console.log(`\nThe MCP server will use this token for the default session.`);
-        console.log(`Tip: Use --session <name> to scope this token to a specific org.`);
-    }
-    if (detected) {
-        const orgLabel = detected.binding.orgName
-            ? ` (${detected.binding.orgName})`
-            : "";
-        console.log(`\nProject binding detected: this repo is bound to session "${detected.binding.session}"${orgLabel}.`);
-        if (!session) {
-            console.log(`  Tip: Run with --session ${detected.binding.session} to scope this token to that org.`);
-        }
-    }
-    // Optionally verify the key works against the API
-    const config = resolveConfigFromBinding(process.cwd());
-    const apiBaseUrl = config.apiBaseUrl;
-    try {
-        const response = await fetch(`${apiBaseUrl}/api/mcp/session`, {
-            headers: { "X-API-Key": apiKey, "User-Agent": "@zivis/cli" },
-        });
-        if (response.ok) {
-            const data = (await response.json());
-            const orgName = data.org?.name ?? "unknown org";
-            const email = data.user?.email ?? "unknown user";
-            console.log(`\n✓ Token verified — authenticated as ${email} in ${orgName}`);
-        }
-        else {
-            const body = await response.json().catch(() => ({}));
-            console.log(`\n  Warning: Could not verify token against API (HTTP ${response.status}): ${body.message ?? body.error ?? "unknown error"}`);
-            console.log(`  Token was stored but may be invalid or lack the 'mcp' scope.`);
-        }
-    }
-    catch {
-        // Network error — token is stored, just couldn't verify
-        console.log(`\n  Note: Could not reach the ZIVIS API to verify the token (stored anyway).`);
-    }
-    process.exit(0);
-}
-//# sourceMappingURL=token.js.map

package/dist/commands/auth/token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/commands/auth/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAG5F,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAM7C,SAAS,gBAAgB,CAAC,OAAgB;IACxC,OAAO,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,IAAkB;IAElB,kBAAkB;IAClB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CACX,uCAAuC,cAAc,eAAe,CACrE,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CACX,qEAAqE,CACtE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iDAAiD;IACjD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;IAE1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC1E,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACrE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,OAAO,CAAC,GAAG,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,cAAc,WAAW,cAAc,OAAO,GAAG,CAAC,CAAC;IAE/D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CACT,qFAAqF,OAAO,IAAI,CACjG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,+DAA+D,CAChE,CAAC;QACF,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO;YACvC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG;YAClC,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CACT,8DAA8D,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,GAAG,CACtG,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CACT,6BAA6B,QAAQ,CAAC,OAAO,CAAC,OAAO,mCAAmC,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,kBAAkB,EAAE;YAC5D,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE;SAC7D,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,cAAc,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,yCAAyC,KAAK,OAAO,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA2B,CAAC;YAC/E,OAAO,CAAC,GAAG,CACT,yDAAyD,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,eAAe,EAAE,CAC9H,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}