@zivis/cli 0.1.0-alpha.33 → 0.1.0-alpha.35

package/dist/internal/extractor/index.js

@@ -1,14 +1,3 @@
-/**
- * Extractor orchestrator.
- *
- * Walks the customer's repo, dispatches matched files to per-language
- * adapters, merges their findings into a single ExtractionResult.
- *
- * Adapters register their own file extensions + manifest filenames; the
- * walker only reads files those filters claim. So adding a Go or Python
- * adapter doesn't change anything here — register the adapter and the
- * orchestrator picks up its files.
- */
 import * as path from "node:path";
 import { walk } from "./walker.js";
 import { typescriptAdapter } from "./adapters/typescript/index.js";
@@ -25,7 +14,6 @@ export async function runExtractor(opts) {
     const adapters = opts.languages
         ? ADAPTERS.filter((a) => opts.languages.includes(a.language))
         : ADAPTERS;
-    // Aggregate the file filters from each adapter so we walk the tree once.
     const extensions = new Set();
     const manifests = new Set();
     for (const a of adapters) {
@@ -104,4 +92,3 @@ function dedupeExternalServices(items) {
     }
     return [...out.values()];
 }
-//# sourceMappingURL=index.js.map

package/dist/internal/extractor/types.d.ts

@@ -1,29 +1,3 @@
-/**
- * Extractor output schema.
- *
- * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
- * for privacy-audit metadata. The shape is the contract between the CLI
- * and the eventual `--apply` endpoint that maps into ThreatModelComponent
- * / OrgComponent records (RECON.3-gated).
- *
- * Privacy invariant — what's IN the JSON:
- *   component names ("auth-service")
- *   file paths ("src/auth/login.ts")
- *   line numbers (42)
- *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
- *   detected protocols / methods (POST /login)
- *   dependency versions (from package.json / go.mod / pyproject.toml)
- *
- * What's NOT:
- *   function bodies, file contents, code snippets
- *   variable names from inside functions
- *   comments
- *   raw AST nodes
- *
- * `zivis tm extract --privacy-audit` prints this whole object to stdout
- * before any network call, so the customer can see exactly what would
- * be sent.
- */
 export type Language = "typescript" | "javascript" | "go" | "python";
 export interface EvidenceLocation {
     file: string;
@@ -44,21 +18,16 @@ export interface ConfigEvidence extends EvidenceLocation {
 export type Evidence = HttpRouteEvidence | ImportEvidence | ConfigEvidence;
 export type ComponentKind = "process" | "data_store" | "external_service" | "frontend";
 export interface ExtractedComponent {
-    /** Stable name derived from path / module — never a value from inside a function. */
     name: string;
     kind: ComponentKind;
     language: Language;
-    /** Detected web framework, if any (express | fastify | nextjs | trpc | hono | gin | echo | …). */
     framework?: string;
     sourceFiles: string[];
     evidence: Evidence[];
 }
 export interface ExtractedExternalService {
-    /** Vendor / SDK name — "Anthropic", "OpenAI", "WorkOS". */
     name: string;
-    /** What kind of integration: ai_sdk, payments, auth, observability, etc. */
     kind: string;
-    /** npm/PyPI/Go module identifier ("@anthropic-ai/sdk"). */
     package: string;
     version?: string;
     callSites: EvidenceLocation[];
@@ -84,30 +53,16 @@ export interface ExtractionResult {
     components: ExtractedComponent[];
     externalServices: ExtractedExternalService[];
     dataStores: ExtractedDataStore[];
-    /**
-     * Per-language manifests detected in the scope. Surfaces dependency-only
-     * findings (e.g., "this repo uses @anthropic-ai/sdk@^0.30") even when
-     * we can't yet match call sites.
-     */
     manifests: ManifestSummary[];
 }
 export interface ManifestSummary {
     language: Language;
     file: string;
-    /** Direct dependency names → version (verbatim from manifest). */
     dependencies: Record<string, string>;
 }
-/**
- * Adapter contract — one per language. Each adapter is fed the list of
- * source files matched for it (already filtered by .gitignore + .zivisignore)
- * plus any manifest files (package.json, go.mod, pyproject.toml). Returns
- * structured findings the framework merges into the final ExtractionResult.
- */
 export interface LanguageAdapter {
     language: Language;
-    /** File extensions this adapter handles. */
     extensions: string[];
-    /** Manifest filenames this adapter cares about. */
     manifests: string[];
     extract(input: AdapterInput): Promise<AdapterOutput>;
 }

package/dist/internal/extractor/types.js

@@ -1,28 +1 @@
-/**
- * Extractor output schema.
- *
- * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
- * for privacy-audit metadata. The shape is the contract between the CLI
- * and the eventual `--apply` endpoint that maps into ThreatModelComponent
- * / OrgComponent records (RECON.3-gated).
- *
- * Privacy invariant — what's IN the JSON:
- *   component names ("auth-service")
- *   file paths ("src/auth/login.ts")
- *   line numbers (42)
- *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
- *   detected protocols / methods (POST /login)
- *   dependency versions (from package.json / go.mod / pyproject.toml)
- *
- * What's NOT:
- *   function bodies, file contents, code snippets
- *   variable names from inside functions
- *   comments
- *   raw AST nodes
- *
- * `zivis tm extract --privacy-audit` prints this whole object to stdout
- * before any network call, so the customer can see exactly what would
- * be sent.
- */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/internal/extractor/walker.d.ts

@@ -1,24 +1,7 @@
-/**
- * Filesystem walker — yields source files relative to the scan root,
- * filtered by .gitignore + .zivisignore + per-extractor extension filters.
- *
- * Uses the `ignore` npm package (the same engine git ships with) so the
- * matching semantics mirror what developers expect from .gitignore.
- *
- * Hard limits:
- *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
- *    if not in .gitignore. These exist by convention and contain
- *    third-party code that pollutes the inventory.
- *  - Caps total files at 50_000 to refuse to scan a generated monorepo
- *    by accident (extractor would take forever; user should narrow scope).
- */
 export interface WalkOptions {
     rootDir: string;
-    /** Extensions to include (with the leading dot, e.g. [".ts", ".tsx"]). */
     extensions: string[];
-    /** Manifest basenames to capture regardless of extension (e.g. ["package.json"]). */
     manifests: string[];
-    /** Extra ignore patterns from --ignore CLI flags. */
     extraIgnores?: string[];
 }
 export interface WalkResult {
@@ -28,5 +11,4 @@ export interface WalkResult {
     filesSkipped: number;
 }
 export declare function walk(opts: WalkOptions): Promise<WalkResult>;
-/** Convert an absolute path to a posix-style repo-relative path. */
 export declare function repoRelative(rootDir: string, absPath: string): string;

package/dist/internal/extractor/walker.js

@@ -1,17 +1,3 @@
-/**
- * Filesystem walker — yields source files relative to the scan root,
- * filtered by .gitignore + .zivisignore + per-extractor extension filters.
- *
- * Uses the `ignore` npm package (the same engine git ships with) so the
- * matching semantics mirror what developers expect from .gitignore.
- *
- * Hard limits:
- *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
- *    if not in .gitignore. These exist by convention and contain
- *    third-party code that pollutes the inventory.
- *  - Caps total files at 50_000 to refuse to scan a generated monorepo
- *    by accident (extractor would take forever; user should narrow scope).
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import ignore from "ignore";
@@ -64,7 +50,6 @@ export async function walk(opts) {
                     filesSkipped++;
                     continue;
                 }
-                // ignore() expects gitignore-style paths with trailing /
                 if (ig.ignores(childRel + "/")) {
                     filesSkipped++;
                     continue;
@@ -99,12 +84,9 @@ async function loadIgnoreFile(ig, filePath) {
         ig.add(content);
     }
     catch {
-        // No ignore file — fine.
     }
 }
-/** Convert an absolute path to a posix-style repo-relative path. */
 export function repoRelative(rootDir, absPath) {
     const rel = path.relative(rootDir, absPath);
     return rel.split(path.sep).join("/");
 }
-//# sourceMappingURL=walker.js.map

package/dist/internal/github-linkage-prompt.d.ts

@@ -0,0 +1,7 @@
+import type { ZivisConfig } from "@zivis/mcp/types";
+export interface BuildLinkagePromptOpts {
+    config: ZivisConfig;
+    applicationId?: string;
+    style?: "short" | "full";
+}
+export declare function buildLinkagePrompt(opts: BuildLinkagePromptOpts): Promise<string | null>;

package/dist/internal/github-linkage-prompt.js

@@ -0,0 +1,95 @@
+import { resolveAuth } from "@zivis/mcp/auth";
+export async function buildLinkagePrompt(opts) {
+    const creds = await resolveAuth(opts.config);
+    if (creds.method === "none")
+        return null;
+    const appStatus = await fetchGitHubAppStatus(opts.config, creds);
+    if (!appStatus)
+        return null;
+    if (!appStatus.installed) {
+        if (!appStatus.installUrl)
+            return null;
+        return formatInstallPrompt(appStatus.installUrl, opts.style ?? "full");
+    }
+    if (opts.applicationId) {
+        const repoStatus = await fetchAppRepoStatus(opts.config, creds, opts.applicationId);
+        if (repoStatus && !repoStatus.linked) {
+            return formatLinkRepoPrompt(opts.config, opts.applicationId, opts.style ?? "full");
+        }
+    }
+    return null;
+}
+async function fetchGitHubAppStatus(config, creds) {
+    try {
+        const res = await fetch(`${config.apiBaseUrl}/api/github-app/status`, {
+            headers: authHeaders(creds),
+        });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+async function fetchAppRepoStatus(config, creds, applicationId) {
+    try {
+        const res = await fetch(`${config.apiBaseUrl}/api/applications/${encodeURIComponent(applicationId)}/repos/status`, { headers: authHeaders(creds) });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+function authHeaders(creds) {
+    const base = {
+        "Content-Type": "application/json",
+        "User-Agent": "@zivis/cli",
+    };
+    if (creds.method === "oauth" && creds.accessToken) {
+        base.Authorization = `Bearer ${creds.accessToken}`;
+    }
+    else if (creds.method === "apikey" && creds.apiKey) {
+        base["X-API-Key"] = creds.apiKey;
+    }
+    return base;
+}
+function formatInstallPrompt(installUrl, style) {
+    if (style === "short") {
+        return `Next: install the ZIVIS GitHub App — ${installUrl}`;
+    }
+    return [
+        "",
+        "Next: install the ZIVIS GitHub App",
+        `  ${installUrl}`,
+        "  Enables continuous monitoring + automatic threat-model updates on push.",
+    ].join("\n");
+}
+function formatLinkRepoPrompt(config, applicationId, style) {
+    const appBase = process.env.ZIVIS_APP_URL || guessAppUrlFromApi(config.apiBaseUrl);
+    const url = `${appBase}/applications/${applicationId}`;
+    if (style === "short") {
+        return `Next: link a GitHub repo to this application — ${url}`;
+    }
+    return [
+        "",
+        "Next: link a GitHub repo to this application",
+        `  ${url}`,
+        "  The GitHub App is installed but this app has no linked repo yet.",
+    ].join("\n");
+}
+function guessAppUrlFromApi(apiBaseUrl) {
+    try {
+        const u = new URL(apiBaseUrl);
+        if (u.host.startsWith("api.")) {
+            u.host = "app." + u.host.slice(4);
+            return `${u.protocol}//${u.host}`;
+        }
+        return apiBaseUrl;
+    }
+    catch {
+        return "https://app.zivis.ai";
+    }
+}

package/dist/internal/ide-setup.d.ts

@@ -1,34 +1,11 @@
 export type GuidanceClient = "cursor" | "claude-code-cli" | "vscode-copilot" | "vscode-claude" | "cline" | "windsurf";
 export interface GuidanceOptions {
-    /** Workspace root to write guidance files into */
     cwd: string;
-    /** Which IDE client to write guidance for */
     client: GuidanceClient;
 }
-/**
- * Write IDE guidance files for the given client.
- *
- * The guidance files teach the host AI (Cursor, Claude Code, etc.)
- * when to suggest ZIVIS tools — no security knowledge required from the user.
- *
- * All writes are idempotent: re-running replaces only the ZIVIS-managed
- * block, never user content.
- *
- * Returns the list of file paths written.
- */
 export declare function writeGuidance(opts: GuidanceOptions): string[];
-/**
- * Detect which IDE configs are present in the given workspace.
- * Returns client identifiers whose config files/dirs were found.
- */
 export declare function detectIdesInRepo(cwd: string): GuidanceClient[];
 export declare function setupCursor(): Promise<void>;
-/**
- * Write a workspace-level .cursor/mcp.json with `--workspace <cwd>` so Cursor
- * starts an isolated MCP process bound to this specific repo.
- * One process = one org = zero cross-tenant risk, regardless of what other
- * repos are open in Cursor.
- */
 export declare function setupCursorWorkspace(): Promise<void>;
 export declare function setupVsCodeCopilot(): Promise<void>;
 export declare function setupVsCodeClaude(): Promise<void>;

package/dist/internal/ide-setup.js

@@ -1,12 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 const SERVER_NAME = "zivis";
-// ── Idempotent block append ──
-/**
- * Append (or replace) a ZIVIS-managed block inside a text file.
- * The block is wrapped in <!-- BEGIN ZIVIS:key --> / <!-- END ZIVIS:key -->
- * markers so future calls replace only this section without touching user content.
- */
 function appendBlock(filePath, blockKey, content) {
     const begin = `<!-- BEGIN ZIVIS:${blockKey} -->`;
     const end = `<!-- END ZIVIS:${blockKey} -->`;
@@ -31,8 +25,6 @@ function appendBlock(filePath, blockKey, content) {
 function escapeRegex(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-// ── Content templates ──
-/** Full Cursor .mdc rule — uses globs so it only attaches when relevant files are open */
 function cursorRuleContent() {
     return `---
 description: ZIVIS security guidance — quietly suggest security checks at the right moments
@@ -117,7 +109,6 @@ might break in", "security plan", "categories of attacks".
 
 <!-- END ZIVIS:guidance -->`;
 }
-/** Short block for CLAUDE.md / AGENTS.md — must be concise (read every turn) */
 function claudeBlockContent() {
     return `## ZIVIS Security (MCP)
 
@@ -135,7 +126,6 @@ ZIVIS is connected to this project. Use its tools sparingly — only for securit
 
 **Slash commands:** /zivis-getting-started  /zivis-secure-my-app  /zivis-audit-dependencies  /zivis-prep-for-launch`;
 }
-/** .clinerules / .windsurfrules content */
 function ruleFileContent() {
     return `# ZIVIS Security Guidance
 
@@ -168,7 +158,6 @@ Say "security plan" not "threat model".
 /zivis-prep-for-launch — pre-launch checklist
 /zivis-weekly-check — weekly status update`;
 }
-/** GitHub Copilot instructions block */
 function copilotBlockContent() {
     return `## ZIVIS Security Integration
 
@@ -186,7 +175,6 @@ Use ZIVIS only for security-related user requests. Never proactively run scans o
 
 **Language:** Avoid security jargon (threat model, STRIDE, attack vector) unless user uses it first.`;
 }
-// ── Per-IDE writers ──
 function writeCursorGuidance(cwd) {
     const rulesDir = path.join(cwd, ".cursor", "rules");
     if (!fs.existsSync(rulesDir))
@@ -225,24 +213,12 @@ function writeWindsurfGuidance(cwd) {
     fs.writeFileSync(rulesPath, ruleFileContent());
     return rulesPath;
 }
-/**
- * Write IDE guidance files for the given client.
- *
- * The guidance files teach the host AI (Cursor, Claude Code, etc.)
- * when to suggest ZIVIS tools — no security knowledge required from the user.
- *
- * All writes are idempotent: re-running replaces only the ZIVIS-managed
- * block, never user content.
- *
- * Returns the list of file paths written.
- */
 export function writeGuidance(opts) {
     const { cwd, client } = opts;
     const written = [];
     switch (client) {
         case "cursor": {
             written.push(writeCursorGuidance(cwd));
-            // Also write CLAUDE.md/AGENTS.md block if those files exist
             const extraPaths = writeClaudeBlockGuidance(cwd).filter((p) => fs.existsSync(p));
             written.push(...extraPaths);
             break;
@@ -267,46 +243,25 @@ export function writeGuidance(opts) {
     }
     return written.filter(Boolean);
 }
-/**
- * Detect which IDE configs are present in the given workspace.
- * Returns client identifiers whose config files/dirs were found.
- */
 export function detectIdesInRepo(cwd) {
     const found = [];
-    // Cursor
     if (fs.existsSync(path.join(cwd, ".cursor"))) {
         found.push("cursor");
     }
-    // Claude Code (CLAUDE.md)
     if (fs.existsSync(path.join(cwd, "CLAUDE.md"))) {
         found.push("claude-code-cli");
     }
-    // VS Code (check for .vscode directory)
     if (fs.existsSync(path.join(cwd, ".vscode"))) {
-        // Assume Copilot by default for VS Code
         found.push("vscode-copilot");
     }
-    // Cline (.clinerules)
     if (fs.existsSync(path.join(cwd, ".clinerules"))) {
         found.push("cline");
     }
-    // Windsurf (.windsurfrules)
     if (fs.existsSync(path.join(cwd, ".windsurfrules"))) {
         found.push("windsurf");
     }
     return found;
 }
-/**
- * Build the MCP server config for an IDE config file.
- *
- * When workspacePath is provided, we pass it as `--workspace <path>` so the
- * MCP server process resolves its session from `.zivis/project.json` at that
- * path — not from an env var that can drift or be accidentally reused across
- * tenants. This gives us one-process-per-org isolation at the IDE level.
- *
- * ZIVIS_SESSION is intentionally NOT used here. The workspace path is the
- * canonical, immutable tenant binding for an MCP process.
- */
 function buildServerConfig(workspacePath, extra) {
     const args = ["mcp", "serve"];
     if (workspacePath) {
@@ -342,17 +297,10 @@ async function updateMcpConfig(configPath, serverName, serverConfig, rootKey) {
 export async function setupCursor() {
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".cursor", "mcp.json");
-    // Global config has no workspace path — serves repos without .zivis/project.json
     await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(), "mcpServers");
     console.log(`✓ Cursor global MCP config updated: ${configPath}`);
     console.log("  Restart Cursor for changes to take effect");
 }
-/**
- * Write a workspace-level .cursor/mcp.json with `--workspace <cwd>` so Cursor
- * starts an isolated MCP process bound to this specific repo.
- * One process = one org = zero cross-tenant risk, regardless of what other
- * repos are open in Cursor.
- */
 export async function setupCursorWorkspace() {
     const workspacePath = process.cwd();
     const configPath = path.join(workspacePath, ".cursor", "mcp.json");
@@ -446,4 +394,3 @@ export function printClaudeCodeManual() {
     console.log("");
     console.log("Then restart Claude Code for changes to take effect");
 }
-//# sourceMappingURL=ide-setup.js.map

package/dist/internal/orgs.js

@@ -28,4 +28,3 @@ export function extractEmail(idToken) {
         return "unknown";
     }
 }
-//# sourceMappingURL=orgs.js.map

package/dist/internal/project-binding.d.ts

@@ -7,7 +7,6 @@ export interface EnsureBindingOpts {
     cwd: string;
     autoBind: boolean;
     skipBind: boolean;
-    /** Overwrite an existing conflicting binding without erroring (used by `zivis auth init`). */
     force?: boolean;
 }
 export declare function ensureProjectBinding(opts: EnsureBindingOpts): Promise<void>;

package/dist/internal/project-binding.js

@@ -28,8 +28,6 @@ export async function ensureProjectBinding(opts) {
             console.error("[zivis] This should not happen — investigate before proceeding.");
             process.exit(1);
         }
-        // force=true: init is intentionally replacing the binding.
-        // Clear detected so we don't accidentally inherit the OLD binding's name/id.
         const oldLabel = detected.binding.orgName ?? detected.binding.workosOrgId;
         console.log(`  Replacing existing binding (was: ${oldLabel})`);
         fs.unlinkSync(detected.filePath);
@@ -43,8 +41,6 @@ export async function ensureProjectBinding(opts) {
     catch (err) {
         console.log(`  WARNING: Could not fetch org info: ${err instanceof Error ? err.message : err}`);
     }
-    // Only fall back to detected?.binding.orgName when we are UPGRADING the same org
-    // (detected still set), not when force-replacing a different org (detected=null).
     const orgName = orgInfo?.name || detected?.binding.orgName;
     const zivisOrgId = orgInfo?.id || detected?.binding.orgId;
     const orgLabel = orgName ? `${orgName} (${jwtOrgId})` : jwtOrgId;
@@ -103,4 +99,3 @@ export async function ensureProjectBinding(opts) {
     console.log(`  File: ${bindingPath}`);
     console.log("  Commit this file so future sessions in this repo are org-locked.");
 }
-//# sourceMappingURL=project-binding.js.map

package/dist/internal/target-auth/api-config.d.ts

@@ -1,14 +1,3 @@
-/**
- * Fetches an Application's auth config from the ZIVIS platform.
- *
- * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
- * file the user previously had to write by hand. The Application's IdP
- * discovery (clientId, domain, mode, scopes) lives on the Application
- * record on the platform; the CLI calls this endpoint to learn how to
- * PKCE-auth, then runs the flow locally and stores tokens in the user's
- * keychain. Tokens never leave the user's machine unless the user
- * explicitly ships them with a scenario-run trigger.
- */
 import type { TargetAuthConfig, WorkosMode } from "./types.js";
 interface AuthConfigResponse {
     applicationId: string;
@@ -27,11 +16,5 @@ interface AuthConfigResponse {
     error?: string;
 }
 export declare function fetchAuthConfig(applicationId: string, sessionName?: string): Promise<AuthConfigResponse>;
-/**
- * Adapt the platform's auth-config response into the local TargetAuthConfig
- * shape that the existing PKCE flow consumes. Throws when the application
- * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
- * caller should give a useful error and direct the user elsewhere.
- */
 export declare function adaptToWorkosConfig(resp: AuthConfigResponse): TargetAuthConfig;
 export {};

package/dist/internal/target-auth/api-config.js

@@ -1,14 +1,3 @@
-/**
- * Fetches an Application's auth config from the ZIVIS platform.
- *
- * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
- * file the user previously had to write by hand. The Application's IdP
- * discovery (clientId, domain, mode, scopes) lives on the Application
- * record on the platform; the CLI calls this endpoint to learn how to
- * PKCE-auth, then runs the flow locally and stores tokens in the user's
- * keychain. Tokens never leave the user's machine unless the user
- * explicitly ships them with a scenario-run trigger.
- */
 import { ApiClient } from "@zivis/mcp/api-client";
 import { DEFAULT_CONFIG } from "@zivis/mcp/types";
 export async function fetchAuthConfig(applicationId, sessionName) {
@@ -18,12 +7,6 @@ export async function fetchAuthConfig(applicationId, sessionName) {
     const client = new ApiClient(config);
     return client.request("GET", `/api/applications/${encodeURIComponent(applicationId)}/auth-config`);
 }
-/**
- * Adapt the platform's auth-config response into the local TargetAuthConfig
- * shape that the existing PKCE flow consumes. Throws when the application
- * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
- * caller should give a useful error and direct the user elsewhere.
- */
 export function adaptToWorkosConfig(resp) {
     if (!resp.oauth) {
         throw new Error(resp.hint || resp.error ||
@@ -37,4 +20,3 @@ export function adaptToWorkosConfig(resp) {
         extraScopes: resp.oauth.scopes,
     };
 }
-//# sourceMappingURL=api-config.js.map

package/dist/internal/target-auth/config.d.ts

@@ -1,15 +1,3 @@
-/**
- * Target-auth config storage (local-only, v1).
- *
- * Per-target IdP config (domain, client_id, mode, callback port) lives under
- * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
- * credentials — safe to commit a sanitized version to your repo if you want
- * teammates to share it.
- *
- * v2: ZIVIS will serve target-auth config from the API so any team member's
- * CLI can discover it. For now, configure once locally with `zivis target
- * configure` and check in the file if you want it shared.
- */
 import type { TargetAuthConfig } from "./types.js";
 export declare function loadTargetConfig(targetId: string): Promise<TargetAuthConfig | null>;
 export declare function saveTargetConfig(targetId: string, cfg: TargetAuthConfig): Promise<string>;

package/dist/internal/target-auth/config.js

@@ -1,15 +1,3 @@
-/**
- * Target-auth config storage (local-only, v1).
- *
- * Per-target IdP config (domain, client_id, mode, callback port) lives under
- * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
- * credentials — safe to commit a sanitized version to your repo if you want
- * teammates to share it.
- *
- * v2: ZIVIS will serve target-auth config from the API so any team member's
- * CLI can discover it. For now, configure once locally with `zivis target
- * configure` and check in the file if you want it shared.
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
@@ -55,4 +43,3 @@ export async function listTargetConfigs() {
 export function getConfigPath(targetId) {
     return configPath(targetId);
 }
-//# sourceMappingURL=config.js.map

package/dist/internal/target-auth/index.d.ts

@@ -1,23 +1,5 @@
-/**
- * Target-auth orchestrator: load config, run the right IdP flow, manage tokens.
- *
- * Public API:
- *   getValidTargetToken(targetId, persona) — returns access_token; refreshes if near expiry
- *   loginTarget(targetId, persona)         — runs the appropriate IdP flow
- *   logoutTarget(targetId, persona)        — clears stored tokens
- *
- * Designed so RT-runner-side ephemeral cred plumbing only sees a flat
- * { accessToken, refreshToken?, expiresAt, idpType } bundle — no IdP
- * specifics leak past this boundary.
- */
 import type { EphemeralTargetCreds, TargetTokens } from "./types.js";
 export declare function loginTarget(targetId: string, persona: string): Promise<TargetTokens>;
-/**
- * J.4 path: log in against an Application by id. Auth config comes from
- * the platform (no local config file required). Tokens are stored under
- * the existing keychain namespace using applicationId as the key — same
- * keychain layout, no migration needed for already-stored tokens.
- */
 export declare function loginApplication(applicationId: string, persona: string, sessionName?: string): Promise<TargetTokens>;
 export declare function logoutTarget(targetId: string, persona: string): Promise<void>;
 export declare function getValidTargetToken(targetId: string, persona: string): Promise<TargetTokens | null>;