@zivis/cli 0.1.0-alpha.40 → 0.1.0-alpha.6

package/dist/commands/app/index.d.ts

@@ -1,2 +1,10 @@
 import type { Command } from "commander";
+/**
+ * Phase J.4 command group. The customer-facing primitive is "Application" —
+ * the thing they built and want tested. This group replaces the older
+ * `zivis target` set: same keychain layout, but auth config is pulled from
+ * the platform instead of read from a local file. Teammates discover an
+ * Application's IdP by querying the API; their tokens still stay in their
+ * own keychain.
+ */
 export declare function registerAppCommands(program: Command): void;

package/dist/commands/app/index.js

@@ -1,10 +1,18 @@
 import { ApiClient } from "@zivis/mcp/api-client";
-import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { DEFAULT_CONFIG } from "@zivis/mcp/types";
 import { loginApplication, logoutTarget, tokenInfo, getValidTargetToken, } from "../../internal/target-auth/index.js";
 import { getStorageName } from "../../internal/target-auth/keychain.js";
 import { decodeJwtPayload } from "../../internal/target-auth/workos.js";
 import { fetchAuthConfig } from "../../internal/target-auth/api-config.js";
 const DEFAULT_PERSONA = "default";
+/**
+ * Phase J.4 command group. The customer-facing primitive is "Application" —
+ * the thing they built and want tested. This group replaces the older
+ * `zivis target` set: same keychain layout, but auth config is pulled from
+ * the platform instead of read from a local file. Teammates discover an
+ * Application's IdP by querying the API; their tokens still stay in their
+ * own keychain.
+ */
 export function registerAppCommands(program) {
     const app = program
         .command("app")
@@ -46,7 +54,7 @@ export function registerAppCommands(program) {
         .description("create a customer-facing Application configured for ephemeral PKCE auth")
         .requiredOption("--name <name>", "application display name")
         .requiredOption("--base-url <url>", "primary base URL (e.g., https://api.acme.io)")
-        .option("--type <type>", "application | agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url", "agent")
+        .option("--type <type>", "agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url", "agent")
         .option("--description <text>", "optional description")
         .option("--client-id <id>", "OAuth client_id (PKCE public client)")
         .option("--oidc-issuer <url>", "OIDC issuer (for discovery)")
@@ -63,6 +71,9 @@ export function registerAppCommands(program) {
             baseUrl: opts.baseUrl,
             type: opts.type,
             useEphemeralCreds: useEphemeral,
+            // PKCE-only public-client mode is the whole reason for ephemeral creds —
+            // require oauth_pkce as the auth type. Non-PKCE flows (static_token,
+            // client_credentials, bearer_refresh) need their own subcommands.
             authType: "oauth_pkce",
         };
         if (opts.description)
@@ -105,7 +116,7 @@ export function registerAppCommands(program) {
         .description("update an application's metadata (name, type, ephemeral-creds toggle, etc.)")
         .option("--name <name>", "rename the application")
         .option("--description <text>", "update the description")
-        .option("--type <type>", "application | agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url")
+        .option("--type <type>", "agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url")
         .option("--use-ephemeral", "opt into ephemeral-creds mode (Phase J)")
         .option("--no-ephemeral-disable", "opt OUT of ephemeral-creds mode (legacy KV-backed)")
         .option("--base-url <url>", "update base URL")
@@ -228,6 +239,7 @@ export function registerAppCommands(program) {
     });
 }
 function buildClient(opts) {
-    const config = opts.session ? { ...resolveConfigFromBinding(process.cwd()), session: opts.session } : resolveConfigFromBinding(process.cwd());
+    const config = opts.session ? { ...DEFAULT_CONFIG, session: opts.session } : DEFAULT_CONFIG;
     return new ApiClient(config);
 }
+//# sourceMappingURL=index.js.map

package/dist/commands/app/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/app/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAE3E,MAAM,eAAe,GAAG,SAAS,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,iEAAiE,CAAC,CAAC;IAElF,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAE/B,KAAK,EAAE,sBAAsB,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yEAAyE,CAAC;SACtF,cAAc,CAAC,eAAe,EAAE,0BAA0B,CAAC;SAC3D,cAAc,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;SAClF,MAAM,CAAC,eAAe,EAAE,2DAA2D,EAAE,OAAO,CAAC;SAC7F,MAAM,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;SACtD,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;SAClE,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SAC/D,MAAM,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;SAC5D,MAAM,CAAC,iBAAiB,EAAE,yDAAyD,CAAC;SACpF,MAAM,CAAC,gBAAgB,EAAE,yDAAyD,CAAC;SACnF,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;QAC9C,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,iBAAiB,EAAE,YAAY;YAC/B,yEAAyE;YACzE,qEAAqE;YACrE,kEAAkE;YAClE,QAAQ,EAAE,YAAY;SACvB,CAAC;QACF,IAAI,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAC1D,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACvD,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC;QACvD,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CACX,gGAAgG;gBAC9F,kFAAkF,CACrF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAClC,MAAM,EACN,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,6EAA6E,CAAC;SAC1F,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC;SACjD,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;SACxD,MAAM,CAAC,eAAe,EAAE,2DAA2D,CAAC;SACpF,MAAM,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;SACpE,MAAM,CAAC,wBAAwB,EAAE,oDAAoD,CAAC;SACtF,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;SAC7C,MAAM,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;SACpD,MAAM,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;SACnD,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACxE,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,gBAAgB,KAAK,KAAK;YAAE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACpE,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9C,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEvD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CACjC,OAAO,EACP,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EACnD,IAAI,CACL,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;YACjD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,aAAc,WAAmB,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;YAC7D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAE,IAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,sBAAsB,EAAE,iCAAiC,EAAE,eAAe,CAAC;SAClF,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,cAAc,cAAc,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAK,MAA2B,CAAC,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAe,MAA2B,CAAC,GAAG,EAAE,CAAC,CAAC;YACpG,IAAK,MAA6B,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAe,MAA6B,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5G,IAAK,MAA8B,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAe,MAA8B,CAAC,MAAM,EAAE,CAAC,CAAC;YAChH,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,sBAAsB,EAAE,SAAS,EAAE,eAAe,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,4BAA4B,KAAK,cAAc,IAAI,CAAC,OAAO,0BAA0B,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAChH,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,sBAAsB,EAAE,SAAS,EAAE,eAAe,CAAC;SAC1D,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,oCAAoC,KAAK,cAAc,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;QACrE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,sBAAsB,EAAE,SAAS,EAAE,eAAe,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,oCAAoC,KAAK,cAAc,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,IAA0B;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC5F,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/dist/commands/auth/index.js

@@ -1,37 +1,25 @@
-import { bindCommand } from "./bind.js";
 import { loginCommand } from "./login.js";
 import { initCommand } from "./init.js";
 import { statusCommand } from "./status.js";
 import { logoutCommand } from "./logout.js";
 import { sessionsCommand } from "./sessions.js";
-import { tokenCommand } from "./token.js";
 export function registerAuthCommands(program) {
     const auth = program.command("auth").description("authentication");
-    auth
-        .command("bind")
-        .description("mint MCP API key for this repo (OAuth once + stored key). Normally automatic after login — use bind to repair.")
-        .option("-y, --yes", "skip confirmation prompt")
-        .action(async (opts) => {
-        await bindCommand(opts);
-    });
     auth
         .command("init")
         .description("interactive setup: authenticate, pick org, and bind this repo")
         .option("-s, --session <name>", "named session for multi-tenant")
-        .option("--skip-mint-key", "skip MCP API key mint after successful OAuth")
         .action(async (opts) => {
         await initCommand(opts);
     });
     auth
         .command("login")
-        .description("OAuth PKCE login; when this repo has a binding, mints MCP API key automatically")
+        .description("OAuth PKCE login (stores tokens in OS keychain)")
         .option("-s, --session <name>", "named session for multi-tenant")
         .option("-o, --org <workosOrgId>", "scope JWT to a specific WorkOS org")
         .option("-y, --yes", "skip interactive confirmation")
-        .option("--rebind", "switch this project's bound org via interactive picker")
         .option("--bind", "auto-write .zivis/project.json binding")
         .option("--no-bind", "skip project binding")
-        .option("--skip-mint-key", "skip MCP API key mint after successful OAuth")
         .action(async (opts) => {
         await loginCommand(opts);
     });
@@ -57,11 +45,5 @@ export function registerAuthCommands(program) {
         .action(async (opts) => {
         await sessionsCommand(opts);
     });
-    auth
-        .command("token <apiKey>")
-        .description("store a ZIVIS API access token for MCP/CI use (generate at Settings → API Tokens)")
-        .option("-s, --session <name>", "named session to bind this token to (defaults to project binding if present)")
-        .action(async (apiKey, opts) => {
-        await tokenCommand(apiKey, opts);
-    });
 }
+//# sourceMappingURL=index.js.map

package/dist/commands/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAEnE,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,sBAAsB,EAAE,gCAAgC,CAAC;SAChE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CAAC,sBAAsB,EAAE,gCAAgC,CAAC;SAChE,MAAM,CAAC,yBAAyB,EAAE,oCAAoC,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+BAA+B,CAAC;SACpD,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;SAClD,MAAM,CAAC,OAAO,EAAE,4BAA4B,CAAC;SAC7C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/auth/init.d.ts

@@ -1,5 +1,4 @@
 export interface InitCmdOpts {
     session?: string;
-    skipMintKey?: boolean;
 }
 export declare function initCommand(opts: InitCmdOpts): Promise<void>;

package/dist/commands/auth/init.js

@@ -1,21 +1,13 @@
 import * as readline from "node:readline/promises";
-import { login, getStorageName, saveSessionEntry } from "@zivis/mcp/auth";
-import { credentialStorageFromConfig, DEFAULT_CONFIG } from "@zivis/mcp/types";
-import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { login, getStorageName, saveSessionEntry, loadTokens } from "@zivis/mcp/auth";
+import { getValidAccessToken } from "@zivis/mcp/auth/token-refresh";
+import { DEFAULT_CONFIG } from "@zivis/mcp/types";
 import { fetchUserOrgs, extractEmail } from "../../internal/orgs.js";
 import { ensureProjectBinding } from "../../internal/project-binding.js";
-import { discardOauthAfterLogin, tryAutoMintBindingTokenAfterLogin, } from "../../internal/binding-token-mint.js";
-import { decodeJwtPayload } from "@zivis/mcp/auth/jwt";
-import { detectIdesInRepo, writeGuidance } from "../../internal/ide-setup.js";
-import { buildLinkagePrompt } from "../../internal/github-linkage-prompt.js";
-async function maybePromptGitHubLinkage(config) {
-    try {
-        const msg = await buildLinkagePrompt({ config });
-        if (msg)
-            console.log(msg);
-    }
-    catch {
-    }
+/** Parse "received org_01XXX" out of the JWT mismatch error message. */
+function parseReceivedOrgId(msg) {
+    const m = msg.match(/received (org_\w+)/);
+    return m ? m[1] : null;
 }
 async function prompt(question) {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
@@ -26,245 +18,119 @@ async function prompt(question) {
         rl.close();
     }
 }
-async function offerGuidanceInstall(cwd) {
-    const detectedIdes = detectIdesInRepo(cwd);
-    if (detectedIdes.length === 0)
-        return;
-    const ideLabels = {
-        cursor: "Cursor",
-        "claude-code-cli": "Claude Code (CLAUDE.md)",
-        "vscode-copilot": "VS Code (Copilot)",
-        "vscode-claude": "VS Code (Claude)",
-        cline: "Cline",
-        windsurf: "Windsurf",
-    };
-    const ideNames = detectedIdes.map((ide) => ideLabels[ide] ?? ide).join(", ");
-    console.log(`\nDetected IDE configs in this repo: ${ideNames}`);
-    const ans = await prompt("Add ZIVIS guidance so your AI assistant suggests security checks at the right moments?\n" +
-        "(Adds a rule/instruction file. You can edit or remove it anytime.) [Y/n] ");
-    if (ans.toLowerCase() === "n" || ans.toLowerCase() === "no") {
-        console.log("  Skipped. Run 'zivis mcp install --client <ide> --with-guidance' anytime to add later.");
-        return;
+export async function initCommand(opts) {
+    const config = DEFAULT_CONFIG;
+    const session = opts.session || "default";
+    // Reuse a valid stored token — avoids an extra browser open.
+    // getValidAccessToken handles refresh; falls back to null if expired/revoked.
+    let bootstrapToken = await getValidAccessToken({ ...config, session });
+    if (bootstrapToken) {
+        const stored = await loadTokens(session);
+        const email = extractEmail(stored?.id_token);
+        console.log(`Using existing session (${email}).`);
+        console.log(`To force re-login first: zivis auth logout && zivis auth init\n`);
     }
-    const written = [];
-    for (const ide of detectedIdes) {
+    else {
+        console.log("Step 1/2: Authenticate (browser will open)...");
         try {
-            const files = writeGuidance({ cwd, client: ide });
-            written.push(...files);
+            const tokens = await login(config, session, undefined, { skipConfirm: true });
+            bootstrapToken = tokens.access_token;
+            const email = extractEmail(tokens.id_token);
+            console.log(`✓ Authenticated as ${email}`);
         }
         catch (err) {
-            console.warn(`  Warning: Could not write guidance for ${ide}: ${err instanceof Error ? err.message : err}`);
+            console.error("Login failed:", err instanceof Error ? err.message : err);
+            process.exit(1);
         }
     }
-    if (written.length > 0) {
-        console.log(`✓ Wrote guidance files:`);
-        for (const f of written)
-            console.log(`  ${f}`);
-    }
-}
-export async function initCommand(opts) {
-    const config = {
-        ...DEFAULT_CONFIG,
-        ...resolveConfigFromBinding(process.cwd()),
-    };
-    const session = opts.session || "default";
-    const envLabel = config.apiBaseUrl.includes("staging") ? "staging" : "production";
-    console.log(`Environment: ${envLabel} (${config.apiBaseUrl})`);
-    console.log("");
-    console.log("Opening browser for authentication...");
-    console.log("Log into the org you want to bind this project to.\n");
-    let tokens;
+    // Fetch the user's orgs
+    let orgs;
     try {
-        tokens = await login(config, session, undefined, { skipConfirm: true });
+        orgs = await fetchUserOrgs(config, bootstrapToken);
     }
     catch (err) {
-        console.error("Login failed:", err instanceof Error ? err.message : err);
+        console.error("Failed to fetch organizations:", err instanceof Error ? err.message : err);
         process.exit(1);
     }
-    const email = extractEmail(tokens.id_token);
-    const claims = decodeJwtPayload(tokens.access_token);
-    const jwtOrgId = claims?.org_id;
-    if (jwtOrgId) {
-        let orgName;
-        try {
-            const orgs = await fetchUserOrgs(config, tokens.access_token);
-            orgName = orgs.find((o) => o.workosOrgId === jwtOrgId)?.name;
-            if (!orgName && orgs.length > 0) {
-                console.log(`\n  ⚠  WorkOS org ${jwtOrgId} is not registered in ZIVIS.`);
-                console.log(`     Your ZIVIS orgs: ${orgs.map((o) => `${o.name} (${o.workosOrgId})`).join(", ")}`);
-                console.log(`     Try logging into ${config.apiBaseUrl} in your browser first, then re-run init.\n`);
-            }
-        }
-        catch (e) {
-            console.error(`  (note: org name lookup failed — ${e instanceof Error ? e.message : e})`);
-        }
-        const orgLabel = orgName ?? `unknown org (${jwtOrgId})`;
-        console.log(`\nAuthenticated as: ${email}`);
-        console.log(`Org:              ${orgLabel}`);
-        console.log(`Environment:      ${envLabel} (${config.apiBaseUrl})\n`);
-        const confirm = await prompt(`Bind this project to "${orgLabel}"? [Y/n] `);
-        if (confirm.toLowerCase() === "n" || confirm.toLowerCase() === "no") {
-            console.log("");
-            const retry = await prompt("Retry login in a private/incognito window? [Y/n] ");
-            if (retry.toLowerCase() !== "n" && retry.toLowerCase() !== "no") {
-                console.log("\nOpening a private/incognito window — log into the correct org...\n");
-                let retryTokens;
-                try {
-                    retryTokens = await login(config, session, undefined, { skipConfirm: true, incognito: true });
-                }
-                catch (err) {
-                    console.error("Login failed:", err instanceof Error ? err.message : err);
-                    process.exit(1);
-                }
-                tokens = retryTokens;
-                const retryClaims = decodeJwtPayload(retryTokens.access_token);
-                const retryOrgId = retryClaims?.org_id;
-                if (!retryOrgId) {
-                    console.error("JWT returned no org scope. Try `zivis auth logout` then `zivis auth init` again.");
-                    process.exit(1);
-                }
-                let retryOrgName;
-                try {
-                    const retryOrgs = await fetchUserOrgs(config, retryTokens.access_token);
-                    retryOrgName = retryOrgs.find((o) => o.workosOrgId === retryOrgId)?.name;
-                }
-                catch (e) {
-                    console.error(`  (note: org name lookup failed — ${e instanceof Error ? e.message : e})`);
-                }
-                const retryLabel = retryOrgName ?? retryOrgId;
-                const retryEmail = extractEmail(retryTokens.id_token);
-                console.log(`\nAuthenticated as: ${retryEmail}`);
-                console.log(`Org:              ${retryLabel}\n`);
-                const retryConfirm = await prompt(`Bind this project to "${retryLabel}"? [Y/n] `);
-                if (retryConfirm.toLowerCase() === "n" || retryConfirm.toLowerCase() === "no") {
-                    console.log("Aborted.");
-                    process.exit(0);
-                }
-                const storageName2 = getStorageName();
-                await saveSessionEntry(session, retryEmail, credentialStorageFromConfig(config));
-                console.log(`\n✓ Logged in as ${retryEmail} → ${retryLabel}`);
-                console.log(`✓ Credentials stored in ${storageName2}`);
-                await ensureProjectBinding({
-                    config, session, accessToken: retryTokens.access_token,
-                    organizationId: retryOrgId, cwd: process.cwd(), autoBind: true, skipBind: false, force: true,
-                });
-                await tryAutoMintBindingTokenAfterLogin({
-                    cwd: process.cwd(),
-                    sessionName: session,
-                    accessToken: retryTokens.access_token,
-                    skip: opts.skipMintKey === true,
-                    warnOnFailure: true,
-                });
-                await discardOauthAfterLogin({ session, config });
-                await offerGuidanceInstall(process.cwd());
-                await maybePromptGitHubLinkage(config);
-                process.exit(0);
-            }
-            console.log("\nAborted. Switch orgs in your browser then run `zivis auth logout && zivis auth init`.");
-            process.exit(0);
+    if (orgs.length === 0) {
+        console.error("No organizations found for this account. Contact support.");
+        process.exit(1);
+    }
+    let selectedOrg = orgs[0];
+    if (orgs.length > 1) {
+        console.log("Your organizations:");
+        orgs.forEach((org, i) => console.log(`  ${i + 1}. ${org.name}`));
+        const answer = await prompt(`\nSelect org [1-${orgs.length}]: `);
+        const idx = parseInt(answer, 10) - 1;
+        if (isNaN(idx) || idx < 0 || idx >= orgs.length) {
+            console.error("Invalid selection.");
+            process.exit(1);
         }
-        const storageName = getStorageName();
-        await saveSessionEntry(session, email, credentialStorageFromConfig(config));
-        console.log(`\n✓ Logged in as ${email} → ${orgLabel}`);
-        console.log(`✓ Credentials stored in ${storageName}`);
-        await ensureProjectBinding({
-            config,
-            session,
-            accessToken: tokens.access_token,
-            organizationId: jwtOrgId,
-            cwd: process.cwd(),
-            autoBind: true,
-            skipBind: false,
-            force: true,
-        });
-        await tryAutoMintBindingTokenAfterLogin({
-            cwd: process.cwd(),
-            sessionName: session,
-            accessToken: tokens.access_token,
-            skip: opts.skipMintKey === true,
-            warnOnFailure: true,
-        });
-        await discardOauthAfterLogin({ session, config });
-        await offerGuidanceInstall(process.cwd());
-        await maybePromptGitHubLinkage(config);
+        selectedOrg = orgs[idx];
     }
     else {
-        console.log("\nYour account isn't scoped to a specific org yet.");
-        console.log("Fetching your organizations...\n");
-        let orgs;
+        console.log(`One org found: ${selectedOrg.name}`);
+    }
+    if (!selectedOrg.workosOrgId) {
+        console.error(`Org "${selectedOrg.name}" has no WorkOS organization ID — cannot scope login.`);
+        process.exit(1);
+    }
+    // Attempt org-scoped login, with graceful handling for browser-session mismatches
+    let scopedTokens;
+    let finalOrgId = selectedOrg.workosOrgId;
+    let finalOrgName = selectedOrg.name;
+    for (let attempt = 0; attempt < 2; attempt++) {
+        console.log(`\nStep ${orgs.length > 1 ? "2/2" : "1/1"}: Logging in to ${finalOrgName} (browser will open)...`);
         try {
-            orgs = await fetchUserOrgs(config, tokens.access_token);
+            scopedTokens = await login(config, session, finalOrgId, {
+                orgName: finalOrgName,
+                skipConfirm: true,
+            });
+            break; // success
         }
         catch (err) {
-            console.error("Failed to fetch organizations:", err instanceof Error ? err.message : err);
-            process.exit(1);
-        }
-        if (orgs.length === 0) {
-            console.error("No organizations found. Contact support.");
-            process.exit(1);
-        }
-        if (orgs.length === 1) {
-            console.log(`One org found: ${orgs[0].name}. Re-authenticating scoped to that org...`);
-        }
-        else {
-            console.log("Your organizations:");
-            orgs.forEach((org, i) => console.log(`  ${i + 1}. ${org.name}`));
-            const answer = await prompt(`\nSelect org to bind this project to [1-${orgs.length}]: `);
-            const idx = parseInt(answer, 10) - 1;
-            if (isNaN(idx) || idx < 0 || idx >= orgs.length) {
-                console.error("Invalid selection.");
+            const msg = err instanceof Error ? err.message : String(err);
+            const receivedOrgId = parseReceivedOrgId(msg);
+            if (!receivedOrgId) {
+                console.error("Login failed:", msg);
                 process.exit(1);
             }
-            const selected = orgs[idx];
-            if (!selected.workosOrgId) {
-                console.error(`Org "${selected.name}" has no WorkOS org ID.`);
+            // Browser authenticated to a different org than selected
+            const receivedOrg = orgs.find((o) => o.workosOrgId === receivedOrgId);
+            const receivedName = receivedOrg?.name ?? receivedOrgId;
+            console.error(`\n⚠  Browser authenticated to "${receivedName}" instead of "${finalOrgName}".`);
+            console.error(`   This happens when your browser's active session is for a different org.\n`);
+            if (attempt >= 1) {
+                console.error("Still mismatched after retry. Run `zivis auth init` again after switching orgs in your browser.");
                 process.exit(1);
             }
-            console.log(`\nRe-opening browser scoped to ${selected.name}...`);
-            console.log("(Tip: if your browser logs into the wrong org, use option 2 to get a URL for a private/incognito window)\n");
-            try {
-                const scopedTokens = await login(config, session, selected.workosOrgId, {
-                    orgName: selected.name,
-                    skipConfirm: true,
-                });
-                const storageName2 = getStorageName();
-                await saveSessionEntry(session, email, credentialStorageFromConfig(config));
-                console.log(`\n✓ Logged in as ${email} → ${selected.name}`);
-                console.log(`✓ Credentials stored in ${storageName2}`);
-                await ensureProjectBinding({
-                    config,
-                    session,
-                    accessToken: scopedTokens.access_token,
-                    organizationId: selected.workosOrgId,
-                    cwd: process.cwd(),
-                    autoBind: true,
-                    skipBind: false,
-                    force: true,
-                });
-                await tryAutoMintBindingTokenAfterLogin({
-                    cwd: process.cwd(),
-                    sessionName: session,
-                    accessToken: scopedTokens.access_token,
-                    skip: opts.skipMintKey === true,
-                    warnOnFailure: true,
-                });
-                await discardOauthAfterLogin({ session, config });
-                await offerGuidanceInstall(process.cwd());
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                const m = msg.match(/received (org_\w+)/);
-                if (m) {
-                    console.error(`\n⚠  Browser authenticated to a different org than selected.`);
-                    console.error(`   Your browser has an active session for a different org.\n`);
-                    console.error(`   To fix: run \`zivis auth init\` again and paste the URL into a private/incognito window.`);
-                }
-                else {
-                    console.error("Login failed:", msg);
-                }
-                process.exit(1);
+            const choice = await prompt(`Use "${receivedName}" instead? [Y/n] `);
+            if (choice.toLowerCase() === "n" || choice.toLowerCase() === "no") {
+                console.log("Aborted. Log into the correct org in your browser then run `zivis auth init` again.");
+                process.exit(0);
             }
+            // Retry scoped to what the browser actually has
+            finalOrgId = receivedOrgId;
+            finalOrgName = receivedName;
         }
     }
+    if (!scopedTokens) {
+        process.exit(1);
+    }
+    const email = extractEmail(scopedTokens.id_token);
+    const storageName = getStorageName();
+    await saveSessionEntry(session, email);
+    console.log(`\n✓ Logged in as ${email} → ${finalOrgName}`);
+    console.log(`✓ Credentials stored in ${storageName}`);
+    await ensureProjectBinding({
+        config,
+        session,
+        accessToken: scopedTokens.access_token,
+        organizationId: finalOrgId,
+        cwd: process.cwd(),
+        autoBind: true,
+        skipBind: false,
+    });
     process.exit(0);
 }
+//# sourceMappingURL=init.js.map

package/dist/commands/auth/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/commands/auth/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAMzE,wEAAwE;AACxE,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAiB;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;IAE1C,6DAA6D;IAC7D,8EAA8E;IAC9E,IAAI,cAAc,GAAkB,MAAM,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IACjF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC;YACrC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,IAA+C,CAAC;IACpD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,QAAQ,WAAW,CAAC,IAAI,uDAAuD,CAAC,CAAC;QAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kFAAkF;IAClF,IAAI,YAAY,CAAC;IACjB,IAAI,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC;IACzC,IAAI,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC;IAEpC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,mBAAmB,YAAY,yBAAyB,CAAC,CAAC;QAC/G,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;gBACtD,OAAO,EAAE,YAAY;gBACrB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,MAAM,CAAC,UAAU;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAE9C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,yDAAyD;YACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC;YACtE,MAAM,YAAY,GAAG,WAAW,EAAE,IAAI,IAAI,aAAa,CAAC;YAExD,OAAO,CAAC,KAAK,CAAC,kCAAkC,YAAY,iBAAiB,YAAY,IAAI,CAAC,CAAC;YAC/F,OAAO,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;YAE9F,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,CAAC,iGAAiG,CAAC,CAAC;gBACjH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,YAAY,mBAAmB,CAAC,CAAC;YACrE,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;gBAClE,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;gBACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,gDAAgD;YAChD,UAAU,GAAG,aAAa,CAAC;YAC3B,YAAY,GAAG,YAAY,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,YAAY,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAC;IAEtD,MAAM,oBAAoB,CAAC;QACzB,MAAM;QACN,OAAO;QACP,WAAW,EAAE,YAAY,CAAC,YAAY;QACtC,cAAc,EAAE,UAAU;QAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/commands/auth/login.d.ts

@@ -4,7 +4,5 @@ export interface LoginCmdOpts {
     yes?: boolean;
     bind?: boolean;
     noBind?: boolean;
-    rebind?: boolean;
-    skipMintKey?: boolean;
 }
 export declare function loginCommand(opts: LoginCmdOpts): Promise<void>;