@zivis/cli 0.1.0-alpha.4 → 0.1.0-alpha.40

package/dist/internal/ide-setup.js

@@ -1,16 +1,290 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-const SERVER_NAME = "zivis";
-function buildServerConfig(session, extra) {
-    const config = {
+function getServerName(pkg) {
+    return pkg === "builder" ? "zivis-builder" : "zivis";
+}
+function appendBlock(filePath, blockKey, content) {
+    const begin = `<!-- BEGIN ZIVIS:${blockKey} -->`;
+    const end = `<!-- END ZIVIS:${blockKey} -->`;
+    let existing = fs.existsSync(filePath)
+        ? fs.readFileSync(filePath, "utf-8")
+        : "";
+    const blockRegex = new RegExp(`${escapeRegex(begin)}[\\s\\S]*?${escapeRegex(end)}`, "g");
+    const newBlock = `${begin}\n${content}\n${end}`;
+    if (blockRegex.test(existing)) {
+        existing = existing.replace(blockRegex, newBlock);
+    }
+    else {
+        if (existing && !existing.endsWith("\n"))
+            existing += "\n";
+        existing += `\n${newBlock}\n`;
+    }
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(filePath, existing);
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function cursorRuleContent() {
+    return `---
+description: ZIVIS security guidance — quietly suggest security checks at the right moments
+globs:
+  - "**/*.{ts,tsx,js,jsx,py,go,rb,java}"
+  - "**/package.json"
+  - "**/requirements.txt"
+  - "**/pyproject.toml"
+  - "**/go.mod"
+  - "**/Dockerfile"
+alwaysApply: false
+---
+
+<!-- BEGIN ZIVIS:guidance -->
+
+# ZIVIS Security Guidance
+
+ZIVIS is a security platform connected to this project as an MCP server.
+Use it sparingly and only when relevant — never nag.
+
+## When to suggest ZIVIS
+
+**On first security question in this project (per session):**
+If the user asks anything about security, safety, vulnerabilities, or "is this
+secure", call \`zivis_get_started\` first (no arguments). Present the
+\`recommended_next_steps\` as a numbered list. Do NOT invent your own security
+checklist — let ZIVIS produce one based on actual project state.
+
+**When dependencies change** (\`package.json\`, \`requirements.txt\`, \`go.mod\`,
+\`pyproject.toml\` is being edited and a new package is added):
+Mention once per session: "Want me to check this dependency with ZIVIS?
+It scans for prompt-injection risks and known vulnerabilities."
+If yes, call \`zivis_check_repo_trust\` with the package's source repo.
+This tool requires NO auth — works for any public GitHub repo.
+
+**When AI/LLM SDKs are imported** (\`openai\`, \`anthropic\`, \`langchain\`,
+\`@anthropic-ai/sdk\`, \`llamaindex\`, \`cohere\`, \`together\`, etc.):
+Mention once per session: "You're integrating an AI SDK. Want to set up a
+red-team target with ZIVIS? It tests for prompt injection, jailbreaks, and
+PII leakage." If yes, call \`zivis_setup_red_team_target\` with
+target_type=ai_chat.
+
+**When user mentions:** "audit", "compliance", "SOC 2", "pen test",
+"customer security questionnaire", "going to production", "launch":
+Call \`zivis_get_started\` with their phrase as the \`concern\` parameter.
+
+**When user has unread findings:**
+At the start of a session you may call \`zivis_get_findings\` (status=open) once.
+If any critical findings exist, surface them before the user starts new work.
+
+## When NOT to suggest ZIVIS
+
+- Never for non-security questions (refactors, performance, styling, tests, business logic).
+- Never call \`zivis_get_started\` more than once per session unless re-asked.
+- Never run scans that cost credits without explicit user confirmation.
+- Do not lecture about security best practices — let ZIVIS findings speak.
+
+## Vocabulary
+
+The user is a developer, not a security engineer. Avoid these words unless
+the user uses them first: "actor", "attack vector", "threat model", "STRIDE",
+"kill chain", "TTPs". Prefer plain alternatives: "tester", "how an attacker
+might break in", "security plan", "categories of attacks".
+
+## Available slash commands
+
+- \`/zivis-getting-started\` — entry-point tour for new users
+- \`/zivis-secure-my-app\` — register and test an app
+- \`/zivis-audit-dependencies\` — check open source libraries (no auth needed)
+- \`/zivis-prep-for-launch\` — pre-launch security checklist
+- \`/zivis-weekly-check\` — weekly security status update
+
+## Top tools (for quick reference)
+
+- \`zivis_get_started\` — entry point when user is unsure
+- \`zivis_check_repo_trust\` — scan a GitHub repo for risks (no auth needed)
+- \`zivis_setup_red_team_target\` — register an app for testing
+- \`zivis_run_test_scenario\` — run a security test against a target
+- \`zivis_get_findings\` — list current security issues
+- \`zivis_triage_finding\` — resolve / dismiss / accept-risk a finding
+- \`zivis_security_review\` — pre-PR composite security intelligence
+
+<!-- END ZIVIS:guidance -->`;
+}
+function claudeBlockContent() {
+    return `## ZIVIS Security (MCP)
+
+ZIVIS is connected to this project. Use its tools sparingly — only for security-related topics.
+
+**When to use ZIVIS:**
+- User asks "is this secure" / "check for vulnerabilities" / "audit my deps" → call \`zivis_get_started\` first
+- User adds a new npm/pip/go package → offer to call \`zivis_check_repo_trust\` (no auth needed)
+- User adds openai/anthropic/langchain import → offer to call \`zivis_setup_red_team_target\` (target_type=ai_chat)
+- User mentions "launch", "audit", "compliance", "pen test" → call \`zivis_get_started\` with concern=<their phrase>
+
+**When NOT to use:** refactors, performance, styling, tests, business logic, anything non-security.
+
+**Vocabulary:** Don't use "threat model", "STRIDE", "attack vector", "kill chain" unless user does.
+
+**Slash commands:** /zivis-getting-started  /zivis-secure-my-app  /zivis-audit-dependencies  /zivis-prep-for-launch`;
+}
+function ruleFileContent() {
+    return `# ZIVIS Security Guidance
+
+ZIVIS is connected to this project via MCP. Use it only for security-related requests.
+
+## When to suggest ZIVIS
+
+- User asks about security, vulnerabilities, or safety → call zivis_get_started (no args)
+- New dependency added → offer zivis_check_repo_trust (no auth, works for any public repo)
+- AI SDK import added (openai, anthropic, langchain, etc.) → offer zivis_setup_red_team_target with target_type=ai_chat
+- User mentions "audit", "launch", "pen test", "SOC 2" → call zivis_get_started with concern=<their phrase>
+
+## When NOT to use
+
+Non-security work: refactors, performance, styling, tests, business logic.
+Never run paid scans without user confirmation.
+Never call zivis_get_started more than once per session unless re-asked.
+
+## Vocabulary rule
+
+Avoid security jargon unless the user uses it first.
+Say "how someone might break in" not "attack vector".
+Say "security plan" not "threat model".
+
+## Slash commands
+
+/zivis-getting-started — start here if user is new
+/zivis-secure-my-app — set up an app for testing
+/zivis-audit-dependencies — check libraries (free, no login)
+/zivis-prep-for-launch — pre-launch checklist
+/zivis-weekly-check — weekly status update`;
+}
+function copilotBlockContent() {
+    return `## ZIVIS Security Integration
+
+This project has ZIVIS security tools available via MCP.
+
+Use ZIVIS only for security-related user requests. Never proactively run scans or access security data for non-security work.
+
+**Trigger conditions:**
+1. User asks about security/vulnerabilities/safety → call zivis_get_started
+2. New external dependency added → offer zivis_check_repo_trust (no auth required)
+3. AI SDK import added (openai, anthropic, langchain) → offer zivis_setup_red_team_target with target_type=ai_chat
+4. User mentions audit/launch/pen test/compliance → call zivis_get_started with concern parameter
+
+**Key tools:** zivis_get_started, zivis_check_repo_trust, zivis_setup_red_team_target, zivis_get_findings, zivis_triage_finding
+
+**Language:** Avoid security jargon (threat model, STRIDE, attack vector) unless user uses it first.`;
+}
+function writeCursorGuidance(cwd) {
+    const rulesDir = path.join(cwd, ".cursor", "rules");
+    if (!fs.existsSync(rulesDir))
+        fs.mkdirSync(rulesDir, { recursive: true });
+    const rulesPath = path.join(rulesDir, "zivis.mdc");
+    fs.writeFileSync(rulesPath, cursorRuleContent());
+    return rulesPath;
+}
+function writeClaudeBlockGuidance(cwd) {
+    const written = [];
+    const claudePath = path.join(cwd, "CLAUDE.md");
+    appendBlock(claudePath, "zivis-security", claudeBlockContent());
+    written.push(claudePath);
+    const agentsPath = path.join(cwd, "AGENTS.md");
+    if (fs.existsSync(agentsPath)) {
+        appendBlock(agentsPath, "zivis-security", claudeBlockContent());
+        written.push(agentsPath);
+    }
+    return written;
+}
+function writeCopilotGuidance(cwd) {
+    const ghDir = path.join(cwd, ".github");
+    if (!fs.existsSync(ghDir))
+        fs.mkdirSync(ghDir, { recursive: true });
+    const instructionsPath = path.join(ghDir, "copilot-instructions.md");
+    appendBlock(instructionsPath, "zivis-security", copilotBlockContent());
+    return instructionsPath;
+}
+function writeClineGuidance(cwd) {
+    const rulesPath = path.join(cwd, ".clinerules");
+    fs.writeFileSync(rulesPath, ruleFileContent());
+    return rulesPath;
+}
+function writeWindsurfGuidance(cwd) {
+    const rulesPath = path.join(cwd, ".windsurfrules");
+    fs.writeFileSync(rulesPath, ruleFileContent());
+    return rulesPath;
+}
+export function writeGuidance(opts) {
+    const { cwd, client } = opts;
+    const written = [];
+    switch (client) {
+        case "cursor": {
+            written.push(writeCursorGuidance(cwd));
+            const extraPaths = writeClaudeBlockGuidance(cwd).filter((p) => fs.existsSync(p));
+            written.push(...extraPaths);
+            break;
+        }
+        case "claude-code-cli":
+        case "vscode-claude": {
+            written.push(...writeClaudeBlockGuidance(cwd));
+            break;
+        }
+        case "vscode-copilot": {
+            written.push(writeCopilotGuidance(cwd));
+            break;
+        }
+        case "cline": {
+            written.push(writeClineGuidance(cwd));
+            break;
+        }
+        case "windsurf": {
+            written.push(writeWindsurfGuidance(cwd));
+            break;
+        }
+    }
+    return written.filter(Boolean);
+}
+export function detectIdesInRepo(cwd) {
+    const found = [];
+    if (fs.existsSync(path.join(cwd, ".cursor"))) {
+        found.push("cursor");
+    }
+    if (fs.existsSync(path.join(cwd, "CLAUDE.md"))) {
+        found.push("claude-code-cli");
+    }
+    if (fs.existsSync(path.join(cwd, ".vscode"))) {
+        found.push("vscode-copilot");
+    }
+    if (fs.existsSync(path.join(cwd, ".clinerules"))) {
+        found.push("cline");
+    }
+    if (fs.existsSync(path.join(cwd, ".windsurfrules"))) {
+        found.push("windsurf");
+    }
+    return found;
+}
+function buildServerConfig(pkg, workspacePath, extra) {
+    if (pkg === "builder") {
+        const args = ["-y", "@zivis/mcp-builder@alpha", "serve"];
+        if (workspacePath) {
+            args.push("--workspace", workspacePath);
+        }
+        return {
+            ...extra,
+            command: "npx",
+            args,
+        };
+    }
+    const args = ["mcp", "serve"];
+    if (workspacePath) {
+        args.push("--workspace", workspacePath);
+    }
+    return {
         ...extra,
         command: "zivis",
-        args: ["mcp", "serve"],
+        args,
     };
-    if (session) {
-        config.env = { ZIVIS_SESSION: session };
-    }
-    return config;
 }
 async function updateMcpConfig(configPath, serverName, serverConfig, rootKey) {
     const configDir = path.dirname(configPath);
@@ -33,41 +307,47 @@ async function updateMcpConfig(configPath, serverName, serverConfig, rootKey) {
     servers[serverName] = serverConfig;
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
 }
-export async function setupCursor(session) {
+export async function setupCursor(pkg = "appsec") {
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".cursor", "mcp.json");
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
-    console.log(`✓ Cursor MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg), "mcpServers");
+    console.log(`✓ Cursor global MCP config updated: ${configPath}`);
     console.log("  Restart Cursor for changes to take effect");
 }
-export async function setupVsCodeCopilot(session) {
-    const localConfigPath = path.join(process.cwd(), ".vscode", "mcp.json");
+export async function setupCursorWorkspace(pkg = "appsec") {
+    const workspacePath = process.cwd();
+    const configPath = path.join(workspacePath, ".cursor", "mcp.json");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
+    console.log(`✓ Cursor workspace MCP config updated: ${configPath}`);
+    console.log(`  Workspace: ${workspacePath}`);
+    console.log("  Reload Cursor for changes to take effect");
+}
+export async function setupVsCodeCopilot(pkg = "appsec") {
+    const workspacePath = process.cwd();
+    const localConfigPath = path.join(workspacePath, ".vscode", "mcp.json");
     const globalConfigPath = path.join(process.env.HOME || "", ".vscode", "mcp.json");
     let configPath = localConfigPath;
     const exists = fs.existsSync(localConfigPath);
     if (!exists && fs.existsSync(globalConfigPath)) {
         configPath = globalConfigPath;
     }
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session, { type: "stdio" }), "servers");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath, { type: "stdio" }), "servers");
     console.log(`✓ VS Code (GitHub Copilot) MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    console.log(`  Workspace: ${workspacePath}`);
     console.log("  Restart VS Code for changes to take effect");
 }
-export async function setupVsCodeClaude(session) {
-    const configPath = path.join(process.cwd(), ".vscode", "mcp.json");
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
+export async function setupVsCodeClaude(pkg = "appsec") {
+    const workspacePath = process.cwd();
+    const configPath = path.join(workspacePath, ".vscode", "mcp.json");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
     console.log(`✓ VS Code (Claude Code) MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    console.log(`  Workspace: ${workspacePath}`);
     console.log("  Restart VS Code for changes to take effect");
 }
-export async function setupClaudeCodeCli(session) {
+export async function setupClaudeCodeCli(pkg = "appsec") {
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".claude.json");
-    const projectPath = process.cwd();
+    const workspacePath = process.cwd();
     if (!fs.existsSync(configPath)) {
         console.log("  Skipping Claude Code CLI (no ~/.claude.json found)");
         return;
@@ -75,48 +355,43 @@ export async function setupClaudeCodeCli(session) {
     try {
         const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
         config.projects ??= {};
-        config.projects[projectPath] ??= {};
-        config.projects[projectPath].mcpServers ??= {};
-        config.projects[projectPath].mcpServers[SERVER_NAME] = {
-            type: "stdio",
-            command: "zivis",
-            args: ["mcp", "serve"],
-            env: session ? { ZIVIS_SESSION: session } : {},
-        };
+        config.projects[workspacePath] ??= {};
+        config.projects[workspacePath].mcpServers ??= {};
+        config.projects[workspacePath].mcpServers[getServerName(pkg)] = buildServerConfig(pkg, workspacePath, { type: "stdio" });
         fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
         console.log("✓ Claude Code CLI MCP config updated: ~/.claude.json");
-        if (session)
-            console.log(`  Session: ${session}`);
+        console.log(`  Workspace: ${workspacePath}`);
         console.log("  Restart Claude Code for changes to take effect");
     }
     catch (err) {
         console.log(`  WARNING: Failed to update ~/.claude.json: ${err instanceof Error ? err.message : err}`);
     }
 }
-export async function setupCline(session) {
+export async function setupCline(pkg = "appsec") {
+    const workspacePath = process.cwd();
     const homeDir = process.env.HOME || "";
     const configPath = process.platform === "darwin"
         ? path.join(homeDir, "Library", "Application Support", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json")
         : path.join(homeDir, ".config", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json");
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
     console.log(`✓ Cline MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    console.log(`  Workspace: ${workspacePath}`);
     console.log("  Restart VS Code for changes to take effect");
 }
-export async function setupWindsurf(session) {
+export async function setupWindsurf(pkg = "appsec") {
+    const workspacePath = process.cwd();
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".codeium", "windsurf", "mcp_config.json");
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
     console.log(`✓ Windsurf MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    console.log(`  Workspace: ${workspacePath}`);
     console.log("  Restart Windsurf for changes to take effect");
 }
-export function printClaudeCodeManual(session) {
+export function printClaudeCodeManual(pkg = "appsec") {
+    const workspacePath = process.cwd();
     const serverConfig = {
         mcpServers: {
-            [SERVER_NAME]: buildServerConfig(session),
+            [getServerName(pkg)]: buildServerConfig(pkg, workspacePath),
         },
     };
     console.log("");
@@ -128,4 +403,3 @@ export function printClaudeCodeManual(session) {
     console.log("");
     console.log("Then restart Claude Code for changes to take effect");
 }
-//# sourceMappingURL=ide-setup.js.map

package/dist/internal/org-picker.d.ts

@@ -0,0 +1,11 @@
+import type { ZivisConfig } from "@zivis/mcp/types";
+import { type OrgInfo } from "./orgs.js";
+export interface PickOrgOpts {
+    currentOrgId?: string;
+    header?: string;
+    promptText?: string;
+}
+export interface PickedOrg extends OrgInfo {
+    workosOrgId: string;
+}
+export declare function pickOrg(config: ZivisConfig, identityAccessToken: string, opts?: PickOrgOpts): Promise<PickedOrg>;

package/dist/internal/org-picker.js

@@ -0,0 +1,34 @@
+import * as readline from "node:readline/promises";
+import { fetchUserOrgs } from "./orgs.js";
+export async function pickOrg(config, identityAccessToken, opts = {}) {
+    const all = await fetchUserOrgs(config, identityAccessToken);
+    const eligible = all.filter((o) => typeof o.workosOrgId === "string" && o.workosOrgId.length > 0);
+    if (eligible.length === 0) {
+        throw new Error("No active organizations available for this account. " +
+            "Ask an org admin to invite you, or contact support.");
+    }
+    if (eligible.length === 1) {
+        const only = eligible[0];
+        console.log(`One organization available: ${only.name}`);
+        return only;
+    }
+    console.log("");
+    console.log(opts.header ?? "Your organizations:");
+    eligible.forEach((o, i) => {
+        const marker = opts.currentOrgId && o.workosOrgId === opts.currentOrgId ? " (current)" : "";
+        console.log(`  ${i + 1}. ${o.name}${marker}`);
+    });
+    const promptText = opts.promptText ?? `\nSelect org [1-${eligible.length}]: `;
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = (await rl.question(promptText)).trim();
+        const idx = Number.parseInt(answer, 10) - 1;
+        if (Number.isNaN(idx) || idx < 0 || idx >= eligible.length) {
+            throw new Error("Invalid selection.");
+        }
+        return eligible[idx];
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/internal/orgs.js

@@ -28,4 +28,3 @@ export function extractEmail(idToken) {
         return "unknown";
     }
 }
-//# sourceMappingURL=orgs.js.map

package/dist/internal/project-binding.d.ts

@@ -7,5 +7,6 @@ export interface EnsureBindingOpts {
     cwd: string;
     autoBind: boolean;
     skipBind: boolean;
+    force?: boolean;
 }
 export declare function ensureProjectBinding(opts: EnsureBindingOpts): Promise<void>;

package/dist/internal/project-binding.js

@@ -13,19 +13,25 @@ export async function ensureProjectBinding(opts) {
         console.log("  Note: JWT has no org_id — skipping project binding.");
         return;
     }
-    const detected = detectProjectBinding(cwd);
+    let detected = detectProjectBinding(cwd);
     if (detected?.binding.workosOrgId === jwtOrgId) {
         console.log(`✓ Project binding verified: ${detected.filePath}`);
         return;
     }
     if (detected?.binding.workosOrgId && detected.binding.workosOrgId !== jwtOrgId) {
-        console.error("");
-        console.error("[zivis] ERROR: Project binding org mismatches JWT org.");
-        console.error(`[zivis]   Binding file: ${detected.filePath}`);
-        console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
-        console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
-        console.error("[zivis] This should not happen — investigate before proceeding.");
-        process.exit(1);
+        if (!opts.force) {
+            console.error("");
+            console.error("[zivis] ERROR: Project binding org mismatches JWT org.");
+            console.error(`[zivis]   Binding file: ${detected.filePath}`);
+            console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+            console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
+            console.error("[zivis] This should not happen — investigate before proceeding.");
+            process.exit(1);
+        }
+        const oldLabel = detected.binding.orgName ?? detected.binding.workosOrgId;
+        console.log(`  Replacing existing binding (was: ${oldLabel})`);
+        fs.unlinkSync(detected.filePath);
+        detected = null;
     }
     let orgInfo;
     try {
@@ -93,4 +99,3 @@ export async function ensureProjectBinding(opts) {
     console.log(`  File: ${bindingPath}`);
     console.log("  Commit this file so future sessions in this repo are org-locked.");
 }
-//# sourceMappingURL=project-binding.js.map

package/dist/internal/target-auth/api-config.d.ts

@@ -1,14 +1,3 @@
-/**
- * Fetches an Application's auth config from the ZIVIS platform.
- *
- * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
- * file the user previously had to write by hand. The Application's IdP
- * discovery (clientId, domain, mode, scopes) lives on the Application
- * record on the platform; the CLI calls this endpoint to learn how to
- * PKCE-auth, then runs the flow locally and stores tokens in the user's
- * keychain. Tokens never leave the user's machine unless the user
- * explicitly ships them with a scenario-run trigger.
- */
 import type { TargetAuthConfig, WorkosMode } from "./types.js";
 interface AuthConfigResponse {
     applicationId: string;
@@ -27,11 +16,5 @@ interface AuthConfigResponse {
     error?: string;
 }
 export declare function fetchAuthConfig(applicationId: string, sessionName?: string): Promise<AuthConfigResponse>;
-/**
- * Adapt the platform's auth-config response into the local TargetAuthConfig
- * shape that the existing PKCE flow consumes. Throws when the application
- * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
- * caller should give a useful error and direct the user elsewhere.
- */
 export declare function adaptToWorkosConfig(resp: AuthConfigResponse): TargetAuthConfig;
 export {};

package/dist/internal/target-auth/api-config.js

@@ -1,14 +1,3 @@
-/**
- * Fetches an Application's auth config from the ZIVIS platform.
- *
- * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
- * file the user previously had to write by hand. The Application's IdP
- * discovery (clientId, domain, mode, scopes) lives on the Application
- * record on the platform; the CLI calls this endpoint to learn how to
- * PKCE-auth, then runs the flow locally and stores tokens in the user's
- * keychain. Tokens never leave the user's machine unless the user
- * explicitly ships them with a scenario-run trigger.
- */
 import { ApiClient } from "@zivis/mcp/api-client";
 import { DEFAULT_CONFIG } from "@zivis/mcp/types";
 export async function fetchAuthConfig(applicationId, sessionName) {
@@ -18,12 +7,6 @@ export async function fetchAuthConfig(applicationId, sessionName) {
     const client = new ApiClient(config);
     return client.request("GET", `/api/applications/${encodeURIComponent(applicationId)}/auth-config`);
 }
-/**
- * Adapt the platform's auth-config response into the local TargetAuthConfig
- * shape that the existing PKCE flow consumes. Throws when the application
- * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
- * caller should give a useful error and direct the user elsewhere.
- */
 export function adaptToWorkosConfig(resp) {
     if (!resp.oauth) {
         throw new Error(resp.hint || resp.error ||
@@ -37,4 +20,3 @@ export function adaptToWorkosConfig(resp) {
         extraScopes: resp.oauth.scopes,
     };
 }
-//# sourceMappingURL=api-config.js.map

package/dist/internal/target-auth/config.d.ts

@@ -1,15 +1,3 @@
-/**
- * Target-auth config storage (local-only, v1).
- *
- * Per-target IdP config (domain, client_id, mode, callback port) lives under
- * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
- * credentials — safe to commit a sanitized version to your repo if you want
- * teammates to share it.
- *
- * v2: ZIVIS will serve target-auth config from the API so any team member's
- * CLI can discover it. For now, configure once locally with `zivis target
- * configure` and check in the file if you want it shared.
- */
 import type { TargetAuthConfig } from "./types.js";
 export declare function loadTargetConfig(targetId: string): Promise<TargetAuthConfig | null>;
 export declare function saveTargetConfig(targetId: string, cfg: TargetAuthConfig): Promise<string>;

package/dist/internal/target-auth/config.js

@@ -1,15 +1,3 @@
-/**
- * Target-auth config storage (local-only, v1).
- *
- * Per-target IdP config (domain, client_id, mode, callback port) lives under
- * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
- * credentials — safe to commit a sanitized version to your repo if you want
- * teammates to share it.
- *
- * v2: ZIVIS will serve target-auth config from the API so any team member's
- * CLI can discover it. For now, configure once locally with `zivis target
- * configure` and check in the file if you want it shared.
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
@@ -55,4 +43,3 @@ export async function listTargetConfigs() {
 export function getConfigPath(targetId) {
     return configPath(targetId);
 }
-//# sourceMappingURL=config.js.map

package/dist/internal/target-auth/index.d.ts

@@ -1,23 +1,5 @@
-/**
- * Target-auth orchestrator: load config, run the right IdP flow, manage tokens.
- *
- * Public API:
- *   getValidTargetToken(targetId, persona) — returns access_token; refreshes if near expiry
- *   loginTarget(targetId, persona)         — runs the appropriate IdP flow
- *   logoutTarget(targetId, persona)        — clears stored tokens
- *
- * Designed so RT-runner-side ephemeral cred plumbing only sees a flat
- * { accessToken, refreshToken?, expiresAt, idpType } bundle — no IdP
- * specifics leak past this boundary.
- */
 import type { EphemeralTargetCreds, TargetTokens } from "./types.js";
 export declare function loginTarget(targetId: string, persona: string): Promise<TargetTokens>;
-/**
- * J.4 path: log in against an Application by id. Auth config comes from
- * the platform (no local config file required). Tokens are stored under
- * the existing keychain namespace using applicationId as the key — same
- * keychain layout, no migration needed for already-stored tokens.
- */
 export declare function loginApplication(applicationId: string, persona: string, sessionName?: string): Promise<TargetTokens>;
 export declare function logoutTarget(targetId: string, persona: string): Promise<void>;
 export declare function getValidTargetToken(targetId: string, persona: string): Promise<TargetTokens | null>;