@zivis/cli 0.1.0-alpha.33 → 0.1.0-alpha.35

package/dist/commands/check/index.js

@@ -0,0 +1,463 @@
+import * as crypto from "node:crypto";
+import * as readline from "node:readline";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { resolveAuth } from "@zivis/mcp/auth";
+import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { runMatcher } from "@zivis/mcp/matcher";
+import { runExtractor } from "../../internal/extractor/index.js";
+import { buildRepoGraphArtifact } from "../../internal/extractor/graph-builder.js";
+import { loginCommand } from "../auth/login.js";
+import { buildLinkagePrompt } from "../../internal/github-linkage-prompt.js";
+const execAsync = promisify(exec);
+const LLM_PACKAGE_NAMES = new Set([
+    "openai",
+    "@anthropic-ai/sdk",
+    "anthropic",
+    "@anthropic-ai/bedrock-sdk",
+    "@anthropic-ai/vertex-sdk",
+    "@google/generative-ai",
+    "@google-cloud/aiplatform",
+    "@google-cloud/vertexai",
+    "@aws-sdk/client-bedrock-runtime",
+    "@azure/openai",
+    "langchain",
+    "@langchain/core",
+    "@langchain/openai",
+    "@langchain/anthropic",
+    "llamaindex",
+    "ai",
+    "ollama",
+    "cohere-ai",
+    "@cohere-ai/sdk",
+    "replicate",
+    "mistralai",
+    "@mistralai/mistralai",
+    "groq-sdk",
+    "@groq/groq-sdk",
+]);
+export function registerCheckCommands(program) {
+    program
+        .command("check")
+        .description("inspect this repo's architecture and post findings to your ZIVIS threat model")
+        .option("--cwd <path>", "repo root to inspect (default: cwd)")
+        .option("--format <fmt>", "output format: human or json", "human")
+        .option("--no-network", "skip server-side promotion; build the graph + run matcher locally only")
+        .action(async (opts) => {
+        const result = await runCheck(opts);
+        process.exit(result.exitCode);
+    });
+}
+async function runCheck(opts) {
+    const rootDir = opts.cwd ?? process.cwd();
+    const format = opts.format === "json" ? "json" : "human";
+    const network = opts.network !== false;
+    const config = { ...DEFAULT_CONFIG, ...resolveConfigFromBinding(rootDir) };
+    const authStatus = await resolveAuth(config);
+    if (authStatus.method === "none") {
+        const handled = await handleUnauthenticated({ format, config });
+        if (handled !== "continue") {
+            return { exitCode: handled };
+        }
+        const recheck = await resolveAuth(config);
+        if (recheck.method === "none") {
+            printIfHuman(format, "\nAuth did not complete. Run `zivis auth login` and try again.");
+            return { exitCode: 1 };
+        }
+    }
+    const creds = await resolveAuth(config);
+    const startedAt = Date.now();
+    const extractorOutput = await runExtractor({
+        rootDir,
+        extractorVersion: "check",
+    });
+    const gitMeta = await readGitMetadata(rootDir);
+    const binding = detectProjectBinding(rootDir);
+    const applicationId = binding?.binding.applicationId;
+    const repoId = deriveRepoId(gitMeta.remoteUrl, rootDir);
+    const artifact = buildRepoGraphArtifact(extractorOutput, {
+        applicationId,
+        repoId,
+        commitSha: gitMeta.commitSha,
+        branch: gitMeta.branch,
+        analysisMode: "local",
+    });
+    const artifactPath = await writeArtifactToCache(artifact);
+    let matcherFindings = [];
+    try {
+        const matcherResult = await runMatcher({ artifactPath, cwd: rootDir });
+        matcherFindings = matcherResult.findings;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`\n[zivis check] matcher failed (continuing without pattern matches): ${msg}\n`);
+    }
+    const durationMs = Date.now() - startedAt;
+    const summary = summarizeArtifact(artifact, matcherFindings);
+    let promotion;
+    let promotionError;
+    if (network) {
+        try {
+            promotion = await postCheckArtifact({
+                config,
+                creds,
+                artifact,
+                findings: matcherFindings,
+                repoName: deriveRepoNameFromGit(gitMeta.remoteUrl, rootDir),
+            });
+        }
+        catch (err) {
+            promotionError = err instanceof Error ? err.message : String(err);
+        }
+    }
+    let linkagePrompt = null;
+    if (network) {
+        try {
+            linkagePrompt = await buildLinkagePrompt({
+                config,
+                applicationId: promotion?.applicationId ?? applicationId,
+            });
+        }
+        catch {
+        }
+    }
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(buildJsonOutput(artifact, summary, durationMs, promotion, promotionError, network, linkagePrompt), null, 2) + "\n");
+    }
+    else {
+        renderHumanOutput(artifact, summary, durationMs, promotion, promotionError, network, linkagePrompt);
+    }
+    return { exitCode: 0 };
+}
+async function handleUnauthenticated(args) {
+    const isInteractive = process.stdout.isTTY && process.stdin.isTTY && process.env.CI !== "true";
+    if (!isInteractive) {
+        printNonTtyAuthInstructions(args.format);
+        return 1;
+    }
+    if (args.format === "json") {
+        process.stdout.write(JSON.stringify({
+            schema_version: "1",
+            error: "not_authenticated",
+            message: "zivis check requires authentication; run `zivis auth login` interactively.",
+        }, null, 2) + "\n");
+        return 1;
+    }
+    const choice = await promptAuthChoice();
+    if (choice === "quit") {
+        process.stdout.write("\nCancelled — run `zivis check` again when ready.\n");
+        return 1;
+    }
+    process.stdout.write(`\nOpening your browser to ${choice === "create" ? "sign up" : "sign in"}...\n`);
+    try {
+        await loginCommand({});
+    }
+    catch (err) {
+        process.stdout.write(`\nAuthentication failed: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    process.stdout.write("\nRunning zivis check ...\n\n");
+    return "continue";
+}
+function printNonTtyAuthInstructions(format) {
+    if (format === "json") {
+        process.stdout.write(JSON.stringify({
+            schema_version: "1",
+            error: "not_authenticated",
+            message: "zivis check requires authentication; set ZIVIS_API_KEY for CI or run interactively.",
+            help: {
+                sign_up: "https://app.zivis.ai/sign-up?source=cli",
+                sign_in: "https://app.zivis.ai/sign-in?source=cli",
+                api_keys: "https://app.zivis.ai/settings/api-keys",
+            },
+        }, null, 2) + "\n");
+        return;
+    }
+    process.stdout.write(`\nZIVIS requires an account to inspect repos.\n\n` +
+        `  → Sign up:                  https://app.zivis.ai/sign-up?source=cli\n` +
+        `  → Sign in:                  https://app.zivis.ai/sign-in?source=cli\n` +
+        `  → For CI / headless use:    set ZIVIS_API_KEY (issue a service key from\n` +
+        `                              https://app.zivis.ai/settings/api-keys)\n\n`);
+}
+async function promptAuthChoice() {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        process.stdout.write(`\nZIVIS requires an account to inspect repos.\n\n` +
+            `  1) Create account   (recommended — first time using ZIVIS)\n` +
+            `  2) Sign in          (already have an account)\n` +
+            `  q) Quit\n\n`);
+        for (;;) {
+            const raw = await new Promise((resolve) => rl.question("> ", resolve));
+            const choice = raw.trim().toLowerCase();
+            if (choice === "" || choice === "1")
+                return "create";
+            if (choice === "2")
+                return "signin";
+            if (choice === "q" || choice === "quit")
+                return "quit";
+            process.stdout.write("Please choose 1, 2, or q.\n");
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+async function postCheckArtifact(args) {
+    const { config, creds, artifact, findings, repoName } = args;
+    const url = `${config.apiBaseUrl}/api/cli/check`;
+    const headers = {
+        "Content-Type": "application/json",
+        "User-Agent": "@zivis/cli",
+    };
+    if (creds.method === "oauth" && creds.accessToken) {
+        headers.Authorization = `Bearer ${creds.accessToken}`;
+    }
+    else if (creds.method === "apikey" && creds.apiKey) {
+        headers["X-API-Key"] = creds.apiKey;
+    }
+    const body = {
+        artifact,
+        matches: findings.map((f) => ({
+            pattern_id: f.pattern_id,
+            lane: f.lane,
+            confidence: f.confidence,
+            evidence_spans: (f.evidence ?? []).map((e) => ({
+                file: e.file,
+                line_span: e.end_line ? [e.start_line, e.end_line] : undefined,
+            })),
+            capsule: {
+                safe_summary: f.safe_summary,
+                threats: Array.isArray(f.threats) ? f.threats : undefined,
+            },
+        })),
+        repoName,
+    };
+    const response = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`HTTP ${response.status} from /api/cli/check: ${text.slice(0, 400)}`);
+    }
+    return (await response.json());
+}
+function summarizeArtifact(artifact, findings) {
+    const services = artifact.nodes.filter((n) => n.type === "service").length;
+    const endpoints = artifact.nodes.filter((n) => n.type === "endpoint").length;
+    const deps = artifact.nodes.filter((n) => n.type === "external_dependency");
+    const llmIntegrations = new Set();
+    for (const dep of deps) {
+        if (dep.type !== "external_dependency")
+            continue;
+        const pkg = dep.attributes.package;
+        if (!pkg)
+            continue;
+        if (LLM_PACKAGE_NAMES.has(pkg)) {
+            llmIntegrations.add(friendlyLlmName(pkg));
+        }
+    }
+    const trustedMatches = findings.filter((f) => f.lane === "trusted").length;
+    const inferredMatches = findings.filter((f) => f.lane === "inferred").length;
+    const topPatterns = findings
+        .slice()
+        .sort((a, b) => b.confidence - a.confidence)
+        .slice(0, 3)
+        .map((f) => f.pattern_id);
+    return {
+        serviceCount: services,
+        endpointCount: endpoints,
+        externalDependencyCount: deps.length,
+        llmIntegrations: Array.from(llmIntegrations).sort(),
+        languages: artifact.scope.languages ?? [],
+        filesScanned: artifact.scope.files_scanned ?? 0,
+        trustedMatches,
+        inferredMatches,
+        topPatterns,
+    };
+}
+function friendlyLlmName(pkg) {
+    if (pkg === "openai" || pkg === "@azure/openai")
+        return "openai";
+    if (pkg.startsWith("@anthropic-ai") || pkg === "anthropic")
+        return "anthropic";
+    if (pkg.startsWith("@google") || pkg.includes("vertexai") || pkg.includes("generative-ai")) {
+        return "google";
+    }
+    if (pkg.includes("bedrock"))
+        return "aws-bedrock";
+    if (pkg.startsWith("@langchain") || pkg === "langchain")
+        return "langchain";
+    if (pkg === "llamaindex")
+        return "llamaindex";
+    if (pkg === "ollama")
+        return "ollama";
+    if (pkg.includes("cohere"))
+        return "cohere";
+    if (pkg.includes("mistral"))
+        return "mistral";
+    if (pkg.includes("groq"))
+        return "groq";
+    if (pkg === "ai")
+        return "vercel-ai";
+    return pkg;
+}
+function renderHumanOutput(_artifact, summary, durationMs, promotion, promotionError, network, linkagePrompt) {
+    const seconds = (durationMs / 1000).toFixed(1);
+    let out = `\nZIVIS read your repo (${seconds}s):\n\n`;
+    out += `  Architecture (current snapshot)\n`;
+    out += `    ${summary.serviceCount} service${plural(summary.serviceCount)} · ${summary.endpointCount} endpoint${plural(summary.endpointCount)}\n`;
+    if (summary.llmIntegrations.length > 0) {
+        out += `    ${summary.llmIntegrations.length} LLM integration${plural(summary.llmIntegrations.length)} (${summary.llmIntegrations.join(", ")})\n`;
+    }
+    if (summary.languages.length > 0) {
+        out += `    Languages: ${summary.languages.join(", ")}\n`;
+    }
+    const totalMatches = summary.trustedMatches + summary.inferredMatches;
+    if (totalMatches > 0) {
+        out += `\n  Patterns matched\n`;
+        out += `    ${summary.trustedMatches} trusted · ${summary.inferredMatches} inferred (need IDE review)\n`;
+        for (const p of summary.topPatterns) {
+            out += `      • ${p}\n`;
+        }
+    }
+    if (promotion) {
+        out += `\n  ${promotion.isNewApplication ? "Created" : "Updated"} threat model — "${promotion.applicationName}"\n`;
+        out += `    Components:   +${promotion.componentsAdded}`;
+        if (promotion.componentsUnchanged > 0)
+            out += ` (${promotion.componentsUnchanged} already present)`;
+        out += `\n`;
+        out += `    Data flows:   +${promotion.dataFlowsAdded}`;
+        if (promotion.dataFlowsUnchanged > 0)
+            out += ` (${promotion.dataFlowsUnchanged} already present)`;
+        out += `\n`;
+        out += `    Actors:       +${promotion.actorsAttached}\n`;
+        out += `    Observations: +${promotion.findingsCreated}\n`;
+        out += `    Scenarios:    +${promotion.scenariosGenerated}\n`;
+        out += `\n  View it:    ${promotion.webAppUrl}\n`;
+    }
+    else if (network && promotionError) {
+        out += `\n  Could not post to your threat model: ${promotionError}\n`;
+        out += `  (graph + matches still produced locally; rerun once the API is reachable)\n`;
+    }
+    else if (!network) {
+        out += `\n  (--no-network: nothing posted to your threat model)\n`;
+    }
+    out += `\nContinue:\n`;
+    out += `  → In your IDE:                         zivis mcp install --for claude-code\n`;
+    out += `  → Human-reviewed Mini-Threat-Model:    zivis teardown   ($500)\n`;
+    out += `  → Full Deal-Readiness Threat Model:    zivis sales      ($7.5K–$15K)\n`;
+    if (linkagePrompt) {
+        out += linkagePrompt + "\n";
+    }
+    out += "\n";
+    process.stdout.write(out);
+}
+function plural(n) {
+    return n === 1 ? "" : "s";
+}
+function buildJsonOutput(artifact, summary, durationMs, promotion, promotionError, network, linkagePrompt) {
+    let promotionField;
+    if (promotion)
+        promotionField = { status: "ok", ...promotion };
+    else if (!network)
+        promotionField = { status: "skipped", reason: "no-network" };
+    else if (promotionError)
+        promotionField = { status: "error", error: promotionError };
+    return {
+        schema_version: "1",
+        repo_id: artifact.provenance.repo_id ?? "unknown",
+        ran_at: artifact.extracted_at,
+        duration_ms: durationMs,
+        architecture: {
+            services: summary.serviceCount,
+            endpoints: summary.endpointCount,
+            external_dependencies: summary.externalDependencyCount,
+            llm_integrations: summary.llmIntegrations,
+            languages: summary.languages,
+        },
+        matches: {
+            trusted: summary.trustedMatches,
+            inferred: summary.inferredMatches,
+            top_patterns: summary.topPatterns,
+        },
+        promotion: promotionField,
+        conversion_links: {
+            mcp_install: "zivis mcp install --for <ide>",
+            teardown: "zivis teardown",
+            sales: "zivis sales",
+        },
+        linkage_prompt: linkagePrompt,
+    };
+}
+function printIfHuman(format, msg) {
+    if (format === "human")
+        process.stdout.write(msg + "\n");
+}
+async function readGitMetadata(rootDir) {
+    return {
+        remoteUrl: await tryGit(rootDir, "remote get-url origin"),
+        commitSha: await tryGit(rootDir, "rev-parse HEAD"),
+        branch: await tryGit(rootDir, "rev-parse --abbrev-ref HEAD"),
+    };
+}
+async function tryGit(cwd, args) {
+    try {
+        const { stdout } = await execAsync(`git ${args}`, { cwd });
+        const value = stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function deriveRepoId(remoteUrl, rootDir) {
+    if (remoteUrl) {
+        return "remote-" + sha256Short(remoteUrl);
+    }
+    return "path-" + sha256Short(rootDir);
+}
+function sha256Short(value) {
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+function deriveRepoNameFromGit(remoteUrl, rootDir) {
+    if (remoteUrl) {
+        const m = /[/:]([^/:]+?)\/([^/]+?)(?:\.git)?$/.exec(remoteUrl);
+        if (m)
+            return m[2];
+    }
+    const base = path.basename(rootDir);
+    return base && base !== "." ? base : undefined;
+}
+function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+async function writeArtifactToCache(artifact) {
+    const repoId = artifact.provenance.repo_id ?? "unknown";
+    const commitSha = artifact.provenance.commit_sha;
+    const runId = formatRunId(commitSha, artifact.extracted_at);
+    const outPath = path.join(userCacheRoot(), "repos", repoId, "inspect", "runs", `${runId}.json`);
+    await fs.mkdir(path.dirname(outPath), { recursive: true });
+    await fs.writeFile(outPath, JSON.stringify(artifact, null, 2) + "\n");
+    return outPath;
+}
+function formatRunId(commitSha, extractedAt) {
+    const compactTs = extractedAt.replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+    if (!commitSha)
+        return `nogit-${compactTs}`;
+    return `${commitSha.slice(0, 7)}-${compactTs}`;
+}

package/dist/commands/credits/index.js

@@ -48,4 +48,3 @@ export function registerCreditsCommands(program) {
         }
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/inspect/index.d.ts

@@ -1,17 +1,2 @@
-/**
- * `zivis inspect` — local repo graph extraction.
- *
- * Walks the repo with the existing extractor, converts the result into a
- * RepoGraphArtifactV1 (the canonical contract), and writes it to the
- * user-level cache. This is the user-facing entrypoint for Phase 1 of the
- * local repo graph + pattern library work.
- *
- * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md
- * Schema: schemas/repo-graph-artifact.schema.json
- *
- * The command is local-only and never makes network calls. Persistence to
- * the platform happens in a separate step (Phase 4 — `/inspect` upload),
- * gated on Application mapping resolution per plan §Repo->Application Mapping.
- */
 import type { Command } from "commander";
 export declare function registerInspectCommands(program: Command): void;

package/dist/commands/inspect/index.js

@@ -1,18 +1,3 @@
-/**
- * `zivis inspect` — local repo graph extraction.
- *
- * Walks the repo with the existing extractor, converts the result into a
- * RepoGraphArtifactV1 (the canonical contract), and writes it to the
- * user-level cache. This is the user-facing entrypoint for Phase 1 of the
- * local repo graph + pattern library work.
- *
- * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md
- * Schema: schemas/repo-graph-artifact.schema.json
- *
- * The command is local-only and never makes network calls. Persistence to
- * the platform happens in a separate step (Phase 4 — `/inspect` upload),
- * gated on Application mapping resolution per plan §Repo->Application Mapping.
- */
 import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
@@ -115,12 +100,6 @@ function deriveRepoId(remoteUrl, rootDir) {
 function sha256Short(value) {
     return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
 }
-/**
- * XDG-compliant user cache root. Layout follows the plan §2A:
- *   macOS:   ~/Library/Caches/zivis
- *   Linux:   $XDG_CACHE_HOME/zivis  (or ~/.cache/zivis)
- *   Windows: %LOCALAPPDATA%\zivis\Cache
- */
 function userCacheRoot() {
     const home = os.homedir();
     if (process.platform === "darwin") {
@@ -138,7 +117,6 @@ function defaultCacheOutPath(repoId, commitSha, extractedAt) {
     return path.join(userCacheRoot(), "repos", repoId, "inspect", "runs", `${runId}.json`);
 }
 function formatRunId(commitSha, extractedAt) {
-    // <short-commit>-<compact-iso>  e.g. abc1234-20260505T201600Z
     const compactTs = extractedAt.replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
     if (!commitSha)
         return `nogit-${compactTs}`;
@@ -156,4 +134,3 @@ function printSummary(artifact, suffix) {
         `  ${artifact.edges.length} edges  (${exposes} exposes, ${dependsOn} depends_on)\n` +
         (suffix ? `  ${suffix}\n` : ""));
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/mcp/index.js

@@ -12,10 +12,6 @@ const KNOWN_CLIENTS = [
     "vscode-copilot",
     "vscode-claude",
 ];
-/**
- * Map the CLI --client value to the GuidanceClient type used by writeGuidance().
- * "claude-code" (manual) has no guidance files — skip it.
- */
 function toGuidanceClient(client) {
     switch (client) {
         case "cursor": return "cursor";
@@ -97,23 +93,19 @@ export function registerMcpCommands(program) {
             console.error("Install failed:", err instanceof Error ? err.message : err);
             process.exit(1);
         }
-        // "claude-code" is manual — no guidance files to write
         if (client === "claude-code")
             return;
         const guidanceClient = toGuidanceClient(client);
         if (!guidanceClient)
             return;
-        // Determine whether to write guidance files
         let shouldWrite;
         if (opts.withGuidance) {
             shouldWrite = true;
         }
         else if (opts.guidance === false) {
-            // Commander sets opts.guidance = false when --no-guidance is passed
             shouldWrite = false;
         }
         else {
-            // Interactive default
             console.log("");
             shouldWrite = await promptYesNo("Write ZIVIS guidance files so your IDE knows when to suggest security checks?\n" +
                 "(Adds a rule/instruction file to the project. You can edit or remove it anytime.) [Y/n] ");
@@ -133,4 +125,3 @@ export function registerMcpCommands(program) {
         }
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/open/index.d.ts

@@ -1,10 +1,2 @@
-/**
- * `zivis open` — Build and (by default) launch a vscode:// or cursor:// deep link
- * that opens a ZIVIS artifact in the ZIVIS Code IDE extension. Use `--ide cursor`
- * for Cursor. With --print, emit the URI to stdout for piping/sharing.
- *
- * Mirrors the URI shape emitted by the `zivis_open_in_ide` MCP tool and the
- * web app's buildIdeLink() helper. See docs/platform/integrations/IDE-DEEP-LINKS.md.
- */
 import type { Command } from "commander";
 export declare function registerOpenCommands(program: Command): void;

package/dist/commands/open/index.js

@@ -1,11 +1,3 @@
-/**
- * `zivis open` — Build and (by default) launch a vscode:// or cursor:// deep link
- * that opens a ZIVIS artifact in the ZIVIS Code IDE extension. Use `--ide cursor`
- * for Cursor. With --print, emit the URI to stdout for piping/sharing.
- *
- * Mirrors the URI shape emitted by the `zivis_open_in_ide` MCP tool and the
- * web app's buildIdeLink() helper. See docs/platform/integrations/IDE-DEEP-LINKS.md.
- */
 const KINDS = ["diagram", "document", "threat-model"];
 export function registerOpenCommands(program) {
     program
@@ -47,11 +39,8 @@ export function registerOpenCommands(program) {
             console.log(uri);
             return;
         }
-        // Lazy-import `open` so --print stays dependency-free in environments
-        // (e.g. headless CI) where launching a URL handler would fail or hang.
         const { default: open } = await import("open");
         await open(uri);
         console.log(uri);
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/scan/index.js

@@ -118,11 +118,6 @@ export function registerScanCommands(program) {
         }
     });
 }
-/**
- * Map customer-facing ApplicationType to the RT scan's targetType enum.
- * The two enums differ historically: ApplicationType is product-shape,
- * targetType is what the RT runner needs to know about the wire format.
- */
 function appTypeToTargetType(appType) {
     switch (appType) {
         case "agent":
@@ -137,4 +132,3 @@ function appTypeToTargetType(appType) {
             return undefined;
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/target/index.js

@@ -4,8 +4,6 @@ import { getStorageName } from "../../internal/target-auth/keychain.js";
 import { decodeJwtPayload } from "../../internal/target-auth/workos.js";
 const DEFAULT_PERSONA = "default";
 function warnDeprecated() {
-    // stderr so it doesn't pollute stdout (CLI scripts pipe `zivis target token`
-    // straight into curl). One line, no color codes — keeps grep-friendly.
     console.error("[zivis] WARNING: 'zivis target' is deprecated; use 'zivis app' instead.");
 }
 export function registerTargetCommands(program) {
@@ -143,4 +141,3 @@ export function registerTargetCommands(program) {
         console.log(`✓ Cleared tokens for target ${targetId} (persona: ${opts.persona})`);
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/tm/index.js

@@ -14,7 +14,6 @@ function collect(value, previous) {
     return previous.concat([value]);
 }
 function defaultOutPath(extractedAt) {
-    // .zivis/extracted/<iso-no-colons>.json — matches the doc's example.
     const ts = extractedAt.replace(/[:.]/g, "-");
     return `.zivis/extracted/${ts}.json`;
 }
@@ -80,9 +79,6 @@ export function registerTmCommands(program) {
             process.exit(1);
         });
         const parsed = JSON.parse(raw);
-        // Only fields the PATCH endpoint accepts. tm pull dumps the full
-        // record; tm push only sends the editable subset, so a round-trip
-        // edit cycle Just Works.
         const payload = {};
         for (const k of ["name", "description", "status", "campaignId"]) {
             if (parsed[k] !== undefined)
@@ -123,8 +119,6 @@ export function registerTmCommands(program) {
             extractorVersion: cliPkg.version,
         });
         if (opts.privacyAudit) {
-            // Prints the entire object that WOULD be sent to ZIVIS via --apply.
-            // Never makes a network call; the extractor itself is local-only.
             process.stdout.write(JSON.stringify(result, null, 2) + "\n");
             process.stderr.write(`\n[zivis] Privacy audit: ${result.scope.filesScanned} files scanned, ` +
                 `${result.components.length} component(s), ${result.externalServices.length} external service(s), ` +
@@ -263,4 +257,3 @@ export function registerTmCommands(program) {
         }
     });
 }
-//# sourceMappingURL=index.js.map