@zivis/cli 0.1.0-alpha.39 → 0.1.0-alpha.4

package/dist/internal/target-auth/config.d.ts

@@ -1,3 +1,15 @@
+/**
+ * Target-auth config storage (local-only, v1).
+ *
+ * Per-target IdP config (domain, client_id, mode, callback port) lives under
+ * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
+ * credentials — safe to commit a sanitized version to your repo if you want
+ * teammates to share it.
+ *
+ * v2: ZIVIS will serve target-auth config from the API so any team member's
+ * CLI can discover it. For now, configure once locally with `zivis target
+ * configure` and check in the file if you want it shared.
+ */
 import type { TargetAuthConfig } from "./types.js";
 export declare function loadTargetConfig(targetId: string): Promise<TargetAuthConfig | null>;
 export declare function saveTargetConfig(targetId: string, cfg: TargetAuthConfig): Promise<string>;

package/dist/internal/target-auth/config.js

@@ -1,3 +1,15 @@
+/**
+ * Target-auth config storage (local-only, v1).
+ *
+ * Per-target IdP config (domain, client_id, mode, callback port) lives under
+ * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
+ * credentials — safe to commit a sanitized version to your repo if you want
+ * teammates to share it.
+ *
+ * v2: ZIVIS will serve target-auth config from the API so any team member's
+ * CLI can discover it. For now, configure once locally with `zivis target
+ * configure` and check in the file if you want it shared.
+ */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
@@ -43,3 +55,4 @@ export async function listTargetConfigs() {
 export function getConfigPath(targetId) {
     return configPath(targetId);
 }
+//# sourceMappingURL=config.js.map

package/dist/internal/target-auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/internal/target-auth/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9B,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,GAAqB;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAA8C,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC"}

package/dist/internal/target-auth/index.d.ts

@@ -1,5 +1,23 @@
+/**
+ * Target-auth orchestrator: load config, run the right IdP flow, manage tokens.
+ *
+ * Public API:
+ *   getValidTargetToken(targetId, persona) — returns access_token; refreshes if near expiry
+ *   loginTarget(targetId, persona)         — runs the appropriate IdP flow
+ *   logoutTarget(targetId, persona)        — clears stored tokens
+ *
+ * Designed so RT-runner-side ephemeral cred plumbing only sees a flat
+ * { accessToken, refreshToken?, expiresAt, idpType } bundle — no IdP
+ * specifics leak past this boundary.
+ */
 import type { EphemeralTargetCreds, TargetTokens } from "./types.js";
 export declare function loginTarget(targetId: string, persona: string): Promise<TargetTokens>;
+/**
+ * J.4 path: log in against an Application by id. Auth config comes from
+ * the platform (no local config file required). Tokens are stored under
+ * the existing keychain namespace using applicationId as the key — same
+ * keychain layout, no migration needed for already-stored tokens.
+ */
 export declare function loginApplication(applicationId: string, persona: string, sessionName?: string): Promise<TargetTokens>;
 export declare function logoutTarget(targetId: string, persona: string): Promise<void>;
 export declare function getValidTargetToken(targetId: string, persona: string): Promise<TargetTokens | null>;

package/dist/internal/target-auth/index.js

@@ -1,3 +1,15 @@
+/**
+ * Target-auth orchestrator: load config, run the right IdP flow, manage tokens.
+ *
+ * Public API:
+ *   getValidTargetToken(targetId, persona) — returns access_token; refreshes if near expiry
+ *   loginTarget(targetId, persona)         — runs the appropriate IdP flow
+ *   logoutTarget(targetId, persona)        — clears stored tokens
+ *
+ * Designed so RT-runner-side ephemeral cred plumbing only sees a flat
+ * { accessToken, refreshToken?, expiresAt, idpType } bundle — no IdP
+ * specifics leak past this boundary.
+ */
 import { loadTargetConfig } from "./config.js";
 import { loadTokens, storeTokens, deleteTokens } from "./keychain.js";
 import { loginWorkos, refreshWorkos } from "./workos.js";
@@ -9,6 +21,12 @@ export async function loginTarget(targetId, persona) {
     await storeTokens(targetId, persona, tokens);
     return tokens;
 }
+/**
+ * J.4 path: log in against an Application by id. Auth config comes from
+ * the platform (no local config file required). Tokens are stored under
+ * the existing keychain namespace using applicationId as the key — same
+ * keychain layout, no migration needed for already-stored tokens.
+ */
 export async function loginApplication(applicationId, persona, sessionName) {
     const resp = await fetchAuthConfig(applicationId, sessionName);
     const cfg = adaptToWorkosConfig(resp);
@@ -80,3 +98,4 @@ async function runRefresh(cfg, refreshToken) {
             throw new Error(`Unsupported IdP type: ${cfg.type}`);
     }
 }
+//# sourceMappingURL=index.js.map

package/dist/internal/target-auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/internal/target-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAQvE,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,OAAe,EACf,WAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,OAAe;IAClE,MAAM,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,IAAI,MAAM,CAAY;QACzC,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,OAAe;IAOf,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;QACzD,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QACpD,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QACrE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa;KACnC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,iCAAiC,QAAQ,iDAAiD,CAChI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAqB,EAAE,OAAe;IAC5D,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC;YACE,MAAM,IAAI,KAAK,CAAC,yBAA0B,GAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAqB,EACrB,YAAoB;IAEpB,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC1C;YACE,MAAM,IAAI,KAAK,CAAC,yBAA0B,GAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}

package/dist/internal/target-auth/keychain.d.ts

@@ -1,3 +1,21 @@
+/**
+ * Target-auth keychain.
+ *
+ * Distinct namespace from the user's ZIVIS-platform tokens (handled by
+ * `zivis-mcp-security`'s keychain module). A user can be logged into
+ * ZIVIS itself AND to N customer-target IdPs simultaneously, each with
+ * multiple personas (admin, user_a, …) for permutation testing.
+ *
+ * Storage layout
+ *   service: zivis.target.<targetId>.<persona>
+ *   account: zivis-target
+ *   value:   JSON-serialised TargetTokens
+ *
+ * macOS-only for v1 (matches the engagement helper). Linux/Windows fall
+ * back to an encrypted file on disk; the underlying impl lives in
+ * `@zivis/mcp/auth/keychain.ts` for the platform login — we
+ * deliberately don't share that module to keep the namespaces isolated.
+ */
 import type { TargetTokens } from "./types.js";
 export declare function storeTokens(targetId: string, persona: string, tokens: TargetTokens): Promise<void>;
 export declare function loadTokens(targetId: string, persona: string): Promise<TargetTokens | null>;

package/dist/internal/target-auth/keychain.js

@@ -1,3 +1,21 @@
+/**
+ * Target-auth keychain.
+ *
+ * Distinct namespace from the user's ZIVIS-platform tokens (handled by
+ * `zivis-mcp-security`'s keychain module). A user can be logged into
+ * ZIVIS itself AND to N customer-target IdPs simultaneously, each with
+ * multiple personas (admin, user_a, …) for permutation testing.
+ *
+ * Storage layout
+ *   service: zivis.target.<targetId>.<persona>
+ *   account: zivis-target
+ *   value:   JSON-serialised TargetTokens
+ *
+ * macOS-only for v1 (matches the engagement helper). Linux/Windows fall
+ * back to an encrypted file on disk; the underlying impl lives in
+ * `@zivis/mcp/auth/keychain.ts` for the platform login — we
+ * deliberately don't share that module to keep the namespaces isolated.
+ */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs/promises";
@@ -15,6 +33,7 @@ function fallbackPath(targetId, persona) {
     return path.join(dir, `${targetId}.${persona}.enc`);
 }
 function fallbackKey() {
+    // Same scheme as the platform-side keychain fallback: derive from username.
     return new Uint8Array(crypto.scryptSync(os.userInfo().username || "zivis", "zivis-target-salt", 32));
 }
 async function macStore(targetId, persona, value) {
@@ -23,7 +42,7 @@ async function macStore(targetId, persona, value) {
             "delete-generic-password", "-a", ACCOUNT, "-s", svc(targetId, persona),
         ]);
     }
-    catch { }
+    catch { /* not present */ }
     await execFileAsync("security", [
         "add-generic-password", "-a", ACCOUNT, "-s", svc(targetId, persona), "-w", value,
     ]);
@@ -45,7 +64,7 @@ async function macDelete(targetId, persona) {
             "delete-generic-password", "-a", ACCOUNT, "-s", svc(targetId, persona),
         ]);
     }
-    catch { }
+    catch { /* not present */ }
 }
 async function fileStore(targetId, persona, value) {
     const p = fallbackPath(targetId, persona);
@@ -86,7 +105,7 @@ async function fileDelete(targetId, persona) {
     try {
         await fs.unlink(fallbackPath(targetId, persona));
     }
-    catch { }
+    catch { /* not present */ }
 }
 async function tryMac() {
     if (process.platform !== "darwin")
@@ -128,3 +147,4 @@ export function getStorageName() {
         ? "macOS Keychain"
         : "encrypted file (~/.config/zivis/target-tokens)";
 }
+//# sourceMappingURL=keychain.js.map

package/dist/internal/target-auth/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/internal/target-auth/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAGtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,OAAO,GAAG,cAAc,CAAC;AAE/B,SAAS,GAAG,CAAC,QAAgB,EAAE,OAAe;IAC5C,OAAO,GAAG,cAAc,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAe;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,OAAO,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW;IAClB,4EAA4E;IAC5E,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,IAAI,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,OAAe,EAAE,KAAa;IACtE,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,MAAM,aAAa,CAAC,UAAU,EAAE;QAC9B,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK;KACjF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,OAAe;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;YACjD,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI;SAC3E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,OAAe;IACxD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,OAAe,EAAE,KAAa;IACvE,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxF,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACf,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,OAAe;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,OAAe;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,OAAe,EACf,MAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,MAAM,EAAE;QAAE,OAAO,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAgB,EAChB,OAAe;IAEf,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC;QAC1B,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;QAClC,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,OAAe;IAClE,IAAI,MAAM,MAAM,EAAE;QAAE,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,gDAAgD,CAAC;AACvD,CAAC"}

package/dist/internal/target-auth/types.d.ts

@@ -1,25 +1,51 @@
+/**
+ * Target-auth: PKCE auth flows against the *customer's* identity provider.
+ *
+ * The user authenticates locally against the target system's IdP. Tokens
+ * stay in the user's OS keychain. When a scenario run is triggered, the
+ * CLI ships a short-lived access token (and optionally a refresh token)
+ * to the ZIVIS platform, which uses it for the duration of the run only.
+ * ZIVIS never persists target-system credentials.
+ */
 export type IdpType = "workos" | "auth0" | "apikey" | "none";
+/** WorkOS path layout — three observed flavors. */
 export type WorkosMode = "user_management" | "authkit" | "workos";
 export interface WorkosConfig {
     type: "workos";
+    /** WorkOS client_id (AuthKit application). */
     clientId: string;
+    /**
+     * Auth host. e.g. `api.workos.com` (user_management/legacy) or
+     * `<custom>.authkit.app` (custom AuthKit domain).
+     */
     domain: string;
+    /** Path layout flavor. Defaults to `user_management`. */
     mode?: WorkosMode;
+    /** localhost callback port for the PKCE redirect. Defaults to 5174. */
     callbackPort?: number;
+    /** Extra OAuth scopes beyond `openid profile email offline_access`. */
     extraScopes?: string[];
 }
 export type TargetAuthConfig = WorkosConfig;
 export interface TargetTokens {
+    /** OAuth access token. */
     access_token: string;
+    /** OAuth refresh token, if the IdP issued one. */
     refresh_token?: string;
+    /** Unix-ms expiry, derived from JWT exp claim or `expires_in`. */
     expires_at: number;
+    /** Optional id_token for client-side claim inspection. */
     id_token?: string;
+    /** When this token bundle was obtained (unix-ms). */
     obtained_at: number;
 }
+/** Bundle shipped to ZIVIS on `scenario run` — RT consumes ephemerally. */
 export interface EphemeralTargetCreds {
     idpType: IdpType;
     accessToken: string;
     refreshToken?: string;
+    /** Unix-ms expiry of the access token. */
     expiresAt: number;
+    /** Echo of the persona, useful for audit logs. */
     persona?: string;
 }

package/dist/internal/target-auth/types.js

@@ -1 +1,11 @@
+/**
+ * Target-auth: PKCE auth flows against the *customer's* identity provider.
+ *
+ * The user authenticates locally against the target system's IdP. Tokens
+ * stay in the user's OS keychain. When a scenario run is triggered, the
+ * CLI ships a short-lived access token (and optionally a refresh token)
+ * to the ZIVIS platform, which uses it for the duration of the run only.
+ * ZIVIS never persists target-system credentials.
+ */
 export {};
+//# sourceMappingURL=types.js.map

package/dist/internal/target-auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/internal/target-auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/internal/target-auth/workos.d.ts

@@ -1,3 +1,18 @@
+/**
+ * WorkOS PKCE login + refresh against a *target* IdP.
+ *
+ * Adapted from `zivis-rt/specs/engagements/meshmesh-cred-threat-model/scripts/authkit-helper.mjs`,
+ * which is itself adapted from `@zivis/mcp/src/auth/oauth.ts`. Three
+ * known WorkOS flavors are supported:
+ *   - user_management — api.workos.com/user_management/{authorize,authenticate}
+ *   - authkit         — <custom>.authkit.app/oauth2/{authorize,token}
+ *   - workos          — legacy auth.workos.com/{authorize,oauth/token}
+ *
+ * Why a copy and not a shared module: the platform-side login uses a fixed
+ * client_id and our own AuthKit. Target login uses the *customer's* IdP
+ * config, parameterized per target. Same primitives, different config
+ * surface — keeping them separate avoids accidental cross-tenant token mixing.
+ */
 import type { TargetTokens, WorkosConfig } from "./types.js";
 export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
 declare function refreshTokens(cfg: WorkosConfig, refreshToken: string): Promise<TargetTokens>;

package/dist/internal/target-auth/workos.js

@@ -1,3 +1,18 @@
+/**
+ * WorkOS PKCE login + refresh against a *target* IdP.
+ *
+ * Adapted from `zivis-rt/specs/engagements/meshmesh-cred-threat-model/scripts/authkit-helper.mjs`,
+ * which is itself adapted from `@zivis/mcp/src/auth/oauth.ts`. Three
+ * known WorkOS flavors are supported:
+ *   - user_management — api.workos.com/user_management/{authorize,authenticate}
+ *   - authkit         — <custom>.authkit.app/oauth2/{authorize,token}
+ *   - workos          — legacy auth.workos.com/{authorize,oauth/token}
+ *
+ * Why a copy and not a shared module: the platform-side login uses a fixed
+ * client_id and our own AuthKit. Target login uses the *customer's* IdP
+ * config, parameterized per target. Same primitives, different config
+ * surface — keeping them separate avoids accidental cross-tenant token mixing.
+ */
 import * as crypto from "node:crypto";
 import * as http from "node:http";
 import { execFile } from "node:child_process";
@@ -170,6 +185,7 @@ export async function loginWorkos(cfg, persona) {
         await open(authUrl);
     }
     catch {
+        // open() can fail in headless envs — print the URL and let the user click.
         await execFileAsync("printf", [authUrl]).catch(() => { });
         process.stderr.write(`[zivis] open ${authUrl}\n`);
     }
@@ -177,3 +193,4 @@ export async function loginWorkos(cfg, persona) {
     return exchangeCode(cfg, code, verifier);
 }
 export { refreshTokens as refreshWorkos };
+//# sourceMappingURL=workos.js.map

package/dist/internal/target-auth/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../../src/internal/target-auth/workos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAOvC,SAAS,QAAQ,CAAC,IAA0B;IAC1C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QAC/D,KAAK,SAAS;YACZ,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;QACvE,KAAK,iBAAiB,CAAC;QACvB;YACE,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,SAAS,EAAE,+BAA+B,EAAE,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAM,EAAE,WAAoB;IACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAI,MAA2B,CAAC,GAAG,CAAC;IAClD,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,QAAQ,GAAG,IAAI;QACjB,CAAC,CAAC,CAAC,CAAC,UAAU;YACd,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,GAAG,IAAI;YAClC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAChC,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,WAAW;QAC7C,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB,EAAE,GAAG,GAAG,EAAE;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,OAAO,qCAAqC,KAAK;;mBAEhC,KAAK,MAAM,KAAK,WAAW,GAAG;;eAElC,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,aAAqB;IAC9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAE1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;gBAC7C,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAC3C,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;gBACpC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjC,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAiB,EACjB,IAAY,EACZ,QAAgB;IAEhB,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IACtC,MAAM,IAAI,GAA2B;QACnC,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,GAAG,CAAC,QAAQ;QACvB,IAAI;QACJ,aAAa,EAAE,QAAQ;KACxB,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,KAAK,iBAAiB,EAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,oBAAoB,IAAI,WAAW,CAAC;IAC1D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAiB,EACjB,YAAoB;IAEpB,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,GAAG,CAAC,QAAQ;YACvB,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAiB,EACjB,OAAe;IAEf,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IACtC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAE5B,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,GAAG,CAAC,QAAQ;QACvB,YAAY,EAAE,oBAAoB,IAAI,WAAW;QACjD,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,KAAK;KACN,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,KAAK,iBAAiB,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzE,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAErD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,OAAO,KAAK,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;IAC/B,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,CAAC"}

package/package.json

@@ -1,23 +1,14 @@
 {
   "name": "@zivis/cli",
-  "version": "0.1.0-alpha.39",
+  "version": "0.1.0-alpha.4",
   "description": "ZIVIS CLI — threat modeling, scans, and MCP server for IDE integration",
-  "license": "Apache-2.0",
-  "homepage": "https://zivis.ai",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/zivisai/zivis-platform.git",
-    "directory": "zivis-cli"
-  },
   "type": "module",
   "bin": {
     "zivis": "./dist/index.js"
   },
   "files": [
     "dist",
-    "package.json",
-    "README.md",
-    "LICENSE"
+    "package.json"
   ],
   "publishConfig": {
     "access": "restricted"
@@ -32,21 +23,16 @@
     "ignore": "^7.0.5",
     "open": "^10.1.0",
     "web-tree-sitter": "^0.26.8",
-    "@zivis/mcp": "0.1.0-alpha.26"
+    "@zivis/mcp": "0.1.0-alpha.2"
   },
   "devDependencies": {
-    "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
-    "ajv": "^8.17.1",
-    "ajv-formats": "^3.0.1",
-    "js-yaml": "^4.1.0",
-    "tsx": "^4.19.2",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
   },
   "scripts": {
     "build:workspace-deps": "pnpm --filter @zivis/mcp run build",
-    "build": "pnpm run build:workspace-deps && tsc -p tsconfig.build.json && node scripts/ensure-symlink.cjs",
+    "build": "pnpm run build:workspace-deps && tsc && node scripts/ensure-symlink.cjs",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "lint": "pnpm run build:workspace-deps && tsc --noEmit",

package/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2026 ZIVIS, Inc.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

package/README.md

@@ -1,31 +0,0 @@
-# @zivis/cli
-
-The ZIVIS command-line interface — interactive setup, threat-model and security operations, and the launcher for the ZIVIS MCP server used by IDE assistants (Cursor, Claude Code, VS Code Copilot, Cline, Windsurf).
-
-```bash
-# Install (per-project)
-pnpm add -D @zivis/cli
-
-# Or run on demand
-npx @zivis/cli init
-```
-
-## Common commands
-
-```bash
-zivis init           # interactive setup: log in, pick org, bind this repo
-zivis check          # local architecture inspection + delta from last run
-zivis mcp serve      # stdio MCP server (called by your IDE, not directly)
-zivis auth status    # show current auth state and active session
-zivis auth logout    # clear stored credentials
-```
-
-Credentials are stored in your OS keychain (macOS Keychain / Windows Credential Manager / libsecret on Linux). They are not written to any `.env` file.
-
-## What is ZIVIS?
-
-ZIVIS is an architecture-inspection security platform — it looks at the components in your app, how they connect, and what trust boundaries exist between them. See <https://zivis.ai>.
-
-## License
-
-Apache 2.0 — see [`LICENSE`](./LICENSE).

package/dist/commands/auth/bind.d.ts

@@ -1,4 +0,0 @@
-export interface BindCmdOpts {
-    yes?: boolean;
-}
-export declare function bindCommand(opts: BindCmdOpts): Promise<void>;