@zivis/cli 0.1.0-alpha.4 → 0.1.0-alpha.41

package/dist/internal/packs/semver.js

@@ -0,0 +1,57 @@
+const SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/;
+export function parseVersion(version) {
+    const m = SEMVER_RE.exec(version.trim());
+    if (!m) {
+        throw new Error(`Not a valid semver-like version: "${version}"`);
+    }
+    const [, major, minor, patch, prerelease] = m;
+    return {
+        major: Number(major),
+        minor: Number(minor),
+        patch: Number(patch),
+        prerelease: prerelease
+            ? prerelease.split(".").map((part) => (/^\d+$/.test(part) ? Number(part) : part))
+            : [],
+    };
+}
+function compareIdentifier(a, b) {
+    if (typeof a === "number" && typeof b === "number")
+        return a - b;
+    const as = String(a);
+    const bs = String(b);
+    if (typeof a === "number")
+        return -1;
+    if (typeof b === "number")
+        return 1;
+    return as < bs ? -1 : as > bs ? 1 : 0;
+}
+export function compareVersions(a, b) {
+    const pa = parseVersion(a);
+    const pb = parseVersion(b);
+    if (pa.major !== pb.major)
+        return pa.major - pb.major;
+    if (pa.minor !== pb.minor)
+        return pa.minor - pb.minor;
+    if (pa.patch !== pb.patch)
+        return pa.patch - pb.patch;
+    if (pa.prerelease.length === 0 && pb.prerelease.length === 0)
+        return 0;
+    if (pa.prerelease.length === 0)
+        return 1;
+    if (pb.prerelease.length === 0)
+        return -1;
+    const len = Math.max(pa.prerelease.length, pb.prerelease.length);
+    for (let i = 0; i < len; i++) {
+        if (i >= pa.prerelease.length)
+            return -1;
+        if (i >= pb.prerelease.length)
+            return 1;
+        const cmp = compareIdentifier(pa.prerelease[i], pb.prerelease[i]);
+        if (cmp !== 0)
+            return cmp;
+    }
+    return 0;
+}
+export function satisfiesMinVersion(cliVersion, minCliVersion) {
+    return compareVersions(cliVersion, minCliVersion) >= 0;
+}

package/dist/internal/packs/signing.d.ts

@@ -0,0 +1,5 @@
+import type { PackManifestV1, PackSignature } from "./types.js";
+export declare const DEV_PACK_SIGNING_KEY_ID = "zivis-pack-dev-2026-08";
+export declare function manifestSigningPayload(manifest: Omit<PackManifestV1, "signature">): string;
+export declare function verifyManifestSignature(manifest: PackManifestV1): boolean;
+export declare function signManifestDev(manifest: Omit<PackManifestV1, "signature">, privateKeySpkiB64: string): PackSignature;

package/dist/internal/packs/signing.js

@@ -0,0 +1,49 @@
+import * as crypto from "node:crypto";
+import { canonicalize } from "./jcs.js";
+export const DEV_PACK_SIGNING_KEY_ID = "zivis-pack-dev-2026-08";
+const DEV_PACK_PUBLIC_KEY_SPKI_B64 = "MCowBQYDK2VwAyEA1xfF9X57KKlqMA8vbHg7DEuU6K5aTURJaFINYk6wRvA=";
+const KNOWN_PUBLIC_KEYS = {
+    [DEV_PACK_SIGNING_KEY_ID]: DEV_PACK_PUBLIC_KEY_SPKI_B64,
+};
+function loadPublicKey(keyId) {
+    const spkiB64 = KNOWN_PUBLIC_KEYS[keyId];
+    if (!spkiB64)
+        return null;
+    return crypto.createPublicKey({
+        key: Buffer.from(spkiB64, "base64"),
+        format: "der",
+        type: "spki",
+    });
+}
+export function manifestSigningPayload(manifest) {
+    return canonicalize(manifest);
+}
+export function verifyManifestSignature(manifest) {
+    const { signature, ...unsigned } = manifest;
+    if (!signature || signature.algorithm !== "ed25519")
+        return false;
+    const publicKey = loadPublicKey(signature.key_id);
+    if (!publicKey)
+        return false;
+    try {
+        const payload = manifestSigningPayload(unsigned);
+        return crypto.verify(null, new Uint8Array(Buffer.from(payload, "utf8")), publicKey, new Uint8Array(Buffer.from(signature.signature, "base64")));
+    }
+    catch {
+        return false;
+    }
+}
+export function signManifestDev(manifest, privateKeySpkiB64) {
+    const privateKey = crypto.createPrivateKey({
+        key: Buffer.from(privateKeySpkiB64, "base64"),
+        format: "der",
+        type: "pkcs8",
+    });
+    const payload = manifestSigningPayload(manifest);
+    const sig = crypto.sign(null, new Uint8Array(Buffer.from(payload, "utf8")), privateKey);
+    return {
+        algorithm: "ed25519",
+        key_id: DEV_PACK_SIGNING_KEY_ID,
+        signature: sig.toString("base64"),
+    };
+}

package/dist/internal/packs/types.d.ts

@@ -0,0 +1,70 @@
+export type PackType = "appsec" | "threatmodel";
+export interface PackContentEntry {
+    path: string;
+    sha256: string;
+}
+export interface PackScopeEntry extends PackContentEntry {
+    id: string;
+    label: string;
+    description: string;
+}
+export interface PackSignature {
+    algorithm: "ed25519";
+    key_id: string;
+    signature: string;
+}
+export interface PackManifestV1 {
+    schema_version: "1.0.0";
+    pack_id: string;
+    pack_type: PackType;
+    version: string;
+    min_cli_version: string;
+    description?: string;
+    built_at: string;
+    base: PackContentEntry;
+    scopes?: PackScopeEntry[];
+    signature: PackSignature;
+}
+export interface PackVersionSummary {
+    version: string;
+    min_cli_version: string;
+    manifest_sha256: string;
+    published_at: string;
+}
+export interface PackVersionListing {
+    pack_type: PackType;
+    versions: PackVersionSummary[];
+}
+export type PackSource = "network" | "cache-verified" | "cache-offline";
+export interface ResolvedScope {
+    id: string;
+    label: string;
+    description: string;
+    content: string;
+}
+export interface ResolvedPack {
+    packId: string;
+    packType: PackType;
+    version: string;
+    minCliVersion: string;
+    source: PackSource;
+    basePath: string;
+    baseContent: string;
+    scopes: PackScopeEntry[];
+    cacheDir: string;
+}
+export declare class PackIntegrityError extends Error {
+    constructor(message: string);
+}
+export declare class PackUnavailableError extends Error {
+    constructor(message: string);
+}
+export declare class UnknownScopeError extends Error {
+    readonly availableScopes: PackScopeEntry[];
+    constructor(scopeId: string, availableScopes: PackScopeEntry[]);
+}
+export interface PackRegistryClient {
+    listVersions(packType: PackType): Promise<PackVersionListing>;
+    getManifest(packType: PackType, version: string): Promise<PackManifestV1>;
+    getContent(packType: PackType, version: string, relativePath: string): Promise<string>;
+}

package/dist/internal/packs/types.js

@@ -0,0 +1,20 @@
+export class PackIntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PackIntegrityError";
+    }
+}
+export class PackUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PackUnavailableError";
+    }
+}
+export class UnknownScopeError extends Error {
+    availableScopes;
+    constructor(scopeId, availableScopes) {
+        super(`Unknown scope "${scopeId}". Available scopes: ${availableScopes.map((s) => s.id).join(", ") || "(none)"}`);
+        this.name = "UnknownScopeError";
+        this.availableScopes = availableScopes;
+    }
+}

package/dist/internal/project-binding.d.ts

@@ -7,5 +7,6 @@ export interface EnsureBindingOpts {
     cwd: string;
     autoBind: boolean;
     skipBind: boolean;
+    force?: boolean;
 }
 export declare function ensureProjectBinding(opts: EnsureBindingOpts): Promise<void>;

package/dist/internal/project-binding.js

@@ -13,19 +13,25 @@ export async function ensureProjectBinding(opts) {
         console.log("  Note: JWT has no org_id — skipping project binding.");
         return;
     }
-    const detected = detectProjectBinding(cwd);
+    let detected = detectProjectBinding(cwd);
     if (detected?.binding.workosOrgId === jwtOrgId) {
         console.log(`✓ Project binding verified: ${detected.filePath}`);
         return;
     }
     if (detected?.binding.workosOrgId && detected.binding.workosOrgId !== jwtOrgId) {
-        console.error("");
-        console.error("[zivis] ERROR: Project binding org mismatches JWT org.");
-        console.error(`[zivis]   Binding file: ${detected.filePath}`);
-        console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
-        console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
-        console.error("[zivis] This should not happen — investigate before proceeding.");
-        process.exit(1);
+        if (!opts.force) {
+            console.error("");
+            console.error("[zivis] ERROR: Project binding org mismatches JWT org.");
+            console.error(`[zivis]   Binding file: ${detected.filePath}`);
+            console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+            console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
+            console.error("[zivis] This should not happen — investigate before proceeding.");
+            process.exit(1);
+        }
+        const oldLabel = detected.binding.orgName ?? detected.binding.workosOrgId;
+        console.log(`  Replacing existing binding (was: ${oldLabel})`);
+        fs.unlinkSync(detected.filePath);
+        detected = null;
     }
     let orgInfo;
     try {
@@ -93,4 +99,3 @@ export async function ensureProjectBinding(opts) {
     console.log(`  File: ${bindingPath}`);
     console.log("  Commit this file so future sessions in this repo are org-locked.");
 }
-//# sourceMappingURL=project-binding.js.map

package/dist/internal/run-workdir.d.ts

@@ -0,0 +1 @@
+export declare function writeRunWorkFile(cwd: string, runId: string, filename: string, data: unknown): string;

package/dist/internal/run-workdir.js

@@ -0,0 +1,11 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { ensureZivisGitignore } from "./zivis-local-state.js";
+export function writeRunWorkFile(cwd, runId, filename, data) {
+    ensureZivisGitignore(cwd);
+    const dir = path.join(cwd, ".zivis", "work", runId);
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = path.join(dir, filename);
+    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+    return filePath;
+}

package/dist/internal/security-context.d.ts

@@ -0,0 +1,62 @@
+export interface SecurityContextFinding {
+    id: string;
+    title: string;
+    severity: string;
+    status: string;
+    owaspId: string | null;
+    sourceSubtype: string;
+    resourceId: string | null;
+    firstDetectedAt: string;
+    dispositionAt?: string | null;
+    dispositionRef?: string | null;
+}
+export interface SecurityContext {
+    application: {
+        id: string;
+        name: string;
+    };
+    repo: {
+        repoFullName: string;
+        defaultBranch: string | null;
+        latestKnownCommitSha: string | null;
+        revisionSyncedAt: string | null;
+    } | null;
+    lastTestedGitSha: string | null;
+    lastThreatModeledGitSha: string | null;
+    openFindings: {
+        total: number;
+        truncated: boolean;
+        items: SecurityContextFinding[];
+    };
+    findingsAwaitingRetest: {
+        total: number;
+        truncated: boolean;
+        items: SecurityContextFinding[];
+    };
+    inconclusiveAreas: unknown[];
+    weakOrUncoveredAreas: unknown[];
+    latestThreatModel: {
+        version: number;
+        gitCommitSha: string | null;
+        updatedAt: string;
+        methodology: string | null;
+    } | null;
+    trustRoomUrl: string | null;
+    generatedAt: string;
+    gaps: {
+        field: string;
+        reason: string;
+    }[];
+}
+export interface SecurityContextApi {
+    get<T>(path: string): Promise<T>;
+}
+export type SecurityContextOutcome = {
+    available: true;
+    context: SecurityContext;
+} | {
+    available: false;
+    reason: string;
+};
+export declare function fetchSecurityContext(client: SecurityContextApi, applicationId: string): Promise<SecurityContextOutcome>;
+export declare function renderSecurityContext(outcome: SecurityContextOutcome, format?: "human" | "json"): string;

package/dist/internal/security-context.js

@@ -0,0 +1,50 @@
+export async function fetchSecurityContext(client, applicationId) {
+    try {
+        const context = await client.get(`/api/rt/applications/${encodeURIComponent(applicationId)}/security-context`);
+        return { available: true, context };
+    }
+    catch (err) {
+        return { available: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+function summarizeFinding(f) {
+    return `  - [${f.severity}] ${f.title} (${f.id})${f.owaspId ? ` — ${f.owaspId}` : ""}`;
+}
+export function renderSecurityContext(outcome, format = "human") {
+    if (format === "json") {
+        return JSON.stringify(outcome, null, 2);
+    }
+    if (!outcome.available) {
+        return `[zivis] No connected security context available (${outcome.reason}). Continuing with local-only context.`;
+    }
+    const c = outcome.context;
+    const lines = [];
+    lines.push(`ZIVIS connected security context — ${c.application.name}`);
+    if (c.repo) {
+        lines.push(`Last known repo commit: ${c.repo.latestKnownCommitSha ?? "unknown"} (${c.repo.repoFullName})`);
+    }
+    lines.push(c.lastThreatModeledGitSha
+        ? `Last threat-modeled commit: ${c.lastThreatModeledGitSha}; compare local HEAD using git.`
+        : `No prior threat model on record for this Application.`);
+    if (c.lastTestedGitSha) {
+        lines.push(`Last tested commit: ${c.lastTestedGitSha}; compare local HEAD using git.`);
+    }
+    if (c.openFindings.total > 0) {
+        lines.push(`Prior open findings: ${c.openFindings.total}${c.openFindings.truncated ? ` (showing ${c.openFindings.items.length})` : ""}`);
+        c.openFindings.items.forEach((f) => lines.push(summarizeFinding(f)));
+    }
+    else {
+        lines.push(`No prior open findings on record.`);
+    }
+    if (c.findingsAwaitingRetest.total > 0) {
+        lines.push(`Findings claimed fixed but not yet retested: ${c.findingsAwaitingRetest.total}${c.findingsAwaitingRetest.truncated ? ` (showing ${c.findingsAwaitingRetest.items.length})` : ""}`);
+        c.findingsAwaitingRetest.items.forEach((f) => lines.push(`  - Finding ${f.id} was remediated but has not been retested.${f.dispositionRef ? ` (ref: ${f.dispositionRef})` : ""}`));
+    }
+    if (c.latestThreatModel) {
+        lines.push(`Latest threat model: v${c.latestThreatModel.version}${c.latestThreatModel.methodology ? `, methodology: ${c.latestThreatModel.methodology}` : ""}`);
+    }
+    if (c.trustRoomUrl) {
+        lines.push(`Trust Room: ${c.trustRoomUrl}`);
+    }
+    return lines.join("\n");
+}

package/dist/internal/sync-outbox.d.ts

@@ -0,0 +1,40 @@
+import type { InventorySyncInput, InventorySyncProvenance } from "./inventory-sync.js";
+interface OutboxEntryBase {
+    id: string;
+    queuedAt: string;
+    attempts: number;
+    lastError: string;
+}
+export interface InventorySyncOutboxEntry extends OutboxEntryBase {
+    kind: "inventory-sync";
+    applicationId: string;
+    input: InventorySyncInput;
+    provenance: InventorySyncProvenance;
+}
+export interface DevXRunCompleteOutboxEntry extends OutboxEntryBase {
+    kind: "devx-run-complete";
+    runId: string;
+    contractVersion: string;
+    result: unknown;
+}
+export type OutboxEntry = InventorySyncOutboxEntry | DevXRunCompleteOutboxEntry;
+export declare function writeOutboxEntry(cwd: string, params: {
+    applicationId: string;
+    input: InventorySyncInput;
+    provenance: InventorySyncProvenance;
+    error: string;
+}): string;
+export declare function writeDevXRunCompleteOutboxEntry(cwd: string, params: {
+    runId: string;
+    contractVersion: string;
+    result: unknown;
+    error: string;
+}): string;
+export interface OutboxListing {
+    filePath: string;
+    entry: OutboxEntry;
+}
+export declare function listOutboxEntries(cwd: string): OutboxListing[];
+export declare function removeOutboxEntry(filePath: string): void;
+export declare function recordOutboxRetryFailure(filePath: string, entry: OutboxEntry, error: string): void;
+export {};

package/dist/internal/sync-outbox.js

@@ -0,0 +1,66 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as crypto from "node:crypto";
+import { ensureZivisGitignore } from "./zivis-local-state.js";
+function outboxDir(cwd) {
+    return path.join(cwd, ".zivis", "outbox");
+}
+function writeEntryFile(cwd, entry) {
+    ensureZivisGitignore(cwd);
+    const dir = outboxDir(cwd);
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = path.join(dir, `${entry.queuedAt.replace(/[:.]/g, "-")}-${entry.id.slice(0, 8)}.json`);
+    fs.writeFileSync(filePath, JSON.stringify(entry, null, 2) + "\n");
+    return filePath;
+}
+export function writeOutboxEntry(cwd, params) {
+    const entry = {
+        kind: "inventory-sync",
+        id: crypto.randomUUID(),
+        applicationId: params.applicationId,
+        input: params.input,
+        provenance: params.provenance,
+        queuedAt: new Date().toISOString(),
+        attempts: 1,
+        lastError: params.error,
+    };
+    return writeEntryFile(cwd, entry);
+}
+export function writeDevXRunCompleteOutboxEntry(cwd, params) {
+    const entry = {
+        kind: "devx-run-complete",
+        id: crypto.randomUUID(),
+        runId: params.runId,
+        contractVersion: params.contractVersion,
+        result: params.result,
+        queuedAt: new Date().toISOString(),
+        attempts: 1,
+        lastError: params.error,
+    };
+    return writeEntryFile(cwd, entry);
+}
+export function listOutboxEntries(cwd) {
+    const dir = outboxDir(cwd);
+    if (!fs.existsSync(dir))
+        return [];
+    const files = fs.readdirSync(dir).filter((f) => f.endsWith(".json")).sort();
+    const listings = [];
+    for (const file of files) {
+        const filePath = path.join(dir, file);
+        try {
+            const raw = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+            const entry = (raw.kind ? raw : { ...raw, kind: "inventory-sync" });
+            listings.push({ filePath, entry });
+        }
+        catch {
+        }
+    }
+    return listings;
+}
+export function removeOutboxEntry(filePath) {
+    fs.rmSync(filePath, { force: true });
+}
+export function recordOutboxRetryFailure(filePath, entry, error) {
+    const updated = { ...entry, attempts: entry.attempts + 1, lastError: error };
+    fs.writeFileSync(filePath, JSON.stringify(updated, null, 2) + "\n");
+}

package/dist/internal/target-auth/api-config.d.ts

@@ -1,14 +1,3 @@
-/**
- * Fetches an Application's auth config from the ZIVIS platform.
- *
- * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
- * file the user previously had to write by hand. The Application's IdP
- * discovery (clientId, domain, mode, scopes) lives on the Application
- * record on the platform; the CLI calls this endpoint to learn how to
- * PKCE-auth, then runs the flow locally and stores tokens in the user's
- * keychain. Tokens never leave the user's machine unless the user
- * explicitly ships them with a scenario-run trigger.
- */
 import type { TargetAuthConfig, WorkosMode } from "./types.js";
 interface AuthConfigResponse {
     applicationId: string;
@@ -27,11 +16,5 @@ interface AuthConfigResponse {
     error?: string;
 }
 export declare function fetchAuthConfig(applicationId: string, sessionName?: string): Promise<AuthConfigResponse>;
-/**
- * Adapt the platform's auth-config response into the local TargetAuthConfig
- * shape that the existing PKCE flow consumes. Throws when the application
- * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
- * caller should give a useful error and direct the user elsewhere.
- */
 export declare function adaptToWorkosConfig(resp: AuthConfigResponse): TargetAuthConfig;
 export {};

package/dist/internal/target-auth/api-config.js

@@ -1,14 +1,3 @@
-/**
- * Fetches an Application's auth config from the ZIVIS platform.
- *
- * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
- * file the user previously had to write by hand. The Application's IdP
- * discovery (clientId, domain, mode, scopes) lives on the Application
- * record on the platform; the CLI calls this endpoint to learn how to
- * PKCE-auth, then runs the flow locally and stores tokens in the user's
- * keychain. Tokens never leave the user's machine unless the user
- * explicitly ships them with a scenario-run trigger.
- */
 import { ApiClient } from "@zivis/mcp/api-client";
 import { DEFAULT_CONFIG } from "@zivis/mcp/types";
 export async function fetchAuthConfig(applicationId, sessionName) {
@@ -18,12 +7,6 @@ export async function fetchAuthConfig(applicationId, sessionName) {
     const client = new ApiClient(config);
     return client.request("GET", `/api/applications/${encodeURIComponent(applicationId)}/auth-config`);
 }
-/**
- * Adapt the platform's auth-config response into the local TargetAuthConfig
- * shape that the existing PKCE flow consumes. Throws when the application
- * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
- * caller should give a useful error and direct the user elsewhere.
- */
 export function adaptToWorkosConfig(resp) {
     if (!resp.oauth) {
         throw new Error(resp.hint || resp.error ||
@@ -37,4 +20,3 @@ export function adaptToWorkosConfig(resp) {
         extraScopes: resp.oauth.scopes,
     };
 }
-//# sourceMappingURL=api-config.js.map

package/dist/internal/target-auth/config.d.ts

@@ -1,15 +1,3 @@
-/**
- * Target-auth config storage (local-only, v1).
- *
- * Per-target IdP config (domain, client_id, mode, callback port) lives under
- * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
- * credentials — safe to commit a sanitized version to your repo if you want
- * teammates to share it.
- *
- * v2: ZIVIS will serve target-auth config from the API so any team member's
- * CLI can discover it. For now, configure once locally with `zivis target
- * configure` and check in the file if you want it shared.
- */
 import type { TargetAuthConfig } from "./types.js";
 export declare function loadTargetConfig(targetId: string): Promise<TargetAuthConfig | null>;
 export declare function saveTargetConfig(targetId: string, cfg: TargetAuthConfig): Promise<string>;

package/dist/internal/target-auth/config.js

@@ -1,15 +1,3 @@
-/**
- * Target-auth config storage (local-only, v1).
- *
- * Per-target IdP config (domain, client_id, mode, callback port) lives under
- * `~/.config/zivis/target-configs/<targetId>.json`. This is *config*, not
- * credentials — safe to commit a sanitized version to your repo if you want
- * teammates to share it.
- *
- * v2: ZIVIS will serve target-auth config from the API so any team member's
- * CLI can discover it. For now, configure once locally with `zivis target
- * configure` and check in the file if you want it shared.
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
@@ -55,4 +43,3 @@ export async function listTargetConfigs() {
 export function getConfigPath(targetId) {
     return configPath(targetId);
 }
-//# sourceMappingURL=config.js.map

package/dist/internal/target-auth/index.d.ts

@@ -1,23 +1,5 @@
-/**
- * Target-auth orchestrator: load config, run the right IdP flow, manage tokens.
- *
- * Public API:
- *   getValidTargetToken(targetId, persona) — returns access_token; refreshes if near expiry
- *   loginTarget(targetId, persona)         — runs the appropriate IdP flow
- *   logoutTarget(targetId, persona)        — clears stored tokens
- *
- * Designed so RT-runner-side ephemeral cred plumbing only sees a flat
- * { accessToken, refreshToken?, expiresAt, idpType } bundle — no IdP
- * specifics leak past this boundary.
- */
 import type { EphemeralTargetCreds, TargetTokens } from "./types.js";
 export declare function loginTarget(targetId: string, persona: string): Promise<TargetTokens>;
-/**
- * J.4 path: log in against an Application by id. Auth config comes from
- * the platform (no local config file required). Tokens are stored under
- * the existing keychain namespace using applicationId as the key — same
- * keychain layout, no migration needed for already-stored tokens.
- */
 export declare function loginApplication(applicationId: string, persona: string, sessionName?: string): Promise<TargetTokens>;
 export declare function logoutTarget(targetId: string, persona: string): Promise<void>;
 export declare function getValidTargetToken(targetId: string, persona: string): Promise<TargetTokens | null>;

package/dist/internal/target-auth/index.js

@@ -1,15 +1,3 @@
-/**
- * Target-auth orchestrator: load config, run the right IdP flow, manage tokens.
- *
- * Public API:
- *   getValidTargetToken(targetId, persona) — returns access_token; refreshes if near expiry
- *   loginTarget(targetId, persona)         — runs the appropriate IdP flow
- *   logoutTarget(targetId, persona)        — clears stored tokens
- *
- * Designed so RT-runner-side ephemeral cred plumbing only sees a flat
- * { accessToken, refreshToken?, expiresAt, idpType } bundle — no IdP
- * specifics leak past this boundary.
- */
 import { loadTargetConfig } from "./config.js";
 import { loadTokens, storeTokens, deleteTokens } from "./keychain.js";
 import { loginWorkos, refreshWorkos } from "./workos.js";
@@ -21,12 +9,6 @@ export async function loginTarget(targetId, persona) {
     await storeTokens(targetId, persona, tokens);
     return tokens;
 }
-/**
- * J.4 path: log in against an Application by id. Auth config comes from
- * the platform (no local config file required). Tokens are stored under
- * the existing keychain namespace using applicationId as the key — same
- * keychain layout, no migration needed for already-stored tokens.
- */
 export async function loginApplication(applicationId, persona, sessionName) {
     const resp = await fetchAuthConfig(applicationId, sessionName);
     const cfg = adaptToWorkosConfig(resp);
@@ -98,4 +80,3 @@ async function runRefresh(cfg, refreshToken) {
             throw new Error(`Unsupported IdP type: ${cfg.type}`);
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/internal/target-auth/keychain.d.ts

@@ -1,21 +1,3 @@
-/**
- * Target-auth keychain.
- *
- * Distinct namespace from the user's ZIVIS-platform tokens (handled by
- * `zivis-mcp-security`'s keychain module). A user can be logged into
- * ZIVIS itself AND to N customer-target IdPs simultaneously, each with
- * multiple personas (admin, user_a, …) for permutation testing.
- *
- * Storage layout
- *   service: zivis.target.<targetId>.<persona>
- *   account: zivis-target
- *   value:   JSON-serialised TargetTokens
- *
- * macOS-only for v1 (matches the engagement helper). Linux/Windows fall
- * back to an encrypted file on disk; the underlying impl lives in
- * `@zivis/mcp/auth/keychain.ts` for the platform login — we
- * deliberately don't share that module to keep the namespaces isolated.
- */
 import type { TargetTokens } from "./types.js";
 export declare function storeTokens(targetId: string, persona: string, tokens: TargetTokens): Promise<void>;
 export declare function loadTokens(targetId: string, persona: string): Promise<TargetTokens | null>;