@zivis/cli 0.1.0-alpha.44 → 0.1.0-alpha.45

package/dist/commands/test/index.js

@@ -6,16 +6,17 @@ import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
 import { requireApplicationId } from "@zivis/mcp/resolve-application-id";
 import { renderSecurityContext } from "../../internal/security-context.js";
 import { startTestRun, listTestScopes } from "../../internal/test-scope.js";
-import { HttpPackRegistryClient, LocalPackRegistryClient, registryDirOverride } from "../../internal/packs/registry-client.js";
+import { LocalPackRegistryClient, registryDirOverride } from "../../internal/packs/registry-client.js";
+import { NpmPackRegistryClient } from "../../internal/packs/npm-registry-client.js";
 import { PackUnavailableError, PackIntegrityError, UnknownScopeError } from "../../internal/packs/types.js";
 import { jsonEnvelope, printJson, EXIT, exitCodeForError, errorMessage, failCommand } from "../../internal/cli-output.js";
 class UsageError extends Error {
 }
-function buildRegistryClient(apiClient) {
+function buildRegistryClient() {
     const override = registryDirOverride();
     if (override)
         return new LocalPackRegistryClient(override);
-    return new HttpPackRegistryClient(apiClient);
+    return new NpmPackRegistryClient();
 }
 function exitCodeForTestError(err) {
     if (err instanceof UnknownScopeError || err instanceof PackIntegrityError)
@@ -46,7 +47,7 @@ export function registerTestCommand(program) {
         const cwd = process.cwd();
         const config = resolveConfigFromBinding(cwd);
         const apiClient = new ApiClient(config);
-        const registryClient = buildRegistryClient(apiClient);
+        const registryClient = buildRegistryClient();
         const cliVersion = getCliVersion();
         if (opts.list) {
             try {

package/dist/commands/threatmodel/index.js

@@ -7,16 +7,17 @@ import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
 import { requireApplicationId } from "@zivis/mcp/resolve-application-id";
 import { renderSecurityContext } from "../../internal/security-context.js";
 import { startThreatModelRun, syncThreatModel, } from "../../internal/threatmodel-run.js";
-import { HttpPackRegistryClient, LocalPackRegistryClient, registryDirOverride } from "../../internal/packs/registry-client.js";
+import { LocalPackRegistryClient, registryDirOverride } from "../../internal/packs/registry-client.js";
+import { NpmPackRegistryClient } from "../../internal/packs/npm-registry-client.js";
 import { PackUnavailableError, PackIntegrityError } from "../../internal/packs/types.js";
 import { jsonEnvelope, printJson, EXIT, exitCodeForError, errorMessage, failCommand } from "../../internal/cli-output.js";
 class UsageError extends Error {
 }
-function buildRegistryClient(apiClient) {
+function buildRegistryClient() {
     const override = registryDirOverride();
     if (override)
         return new LocalPackRegistryClient(override);
-    return new HttpPackRegistryClient(apiClient);
+    return new NpmPackRegistryClient();
 }
 function exitCodeForThreatModelError(err) {
     if (err instanceof PackIntegrityError)
@@ -56,7 +57,7 @@ export function registerThreatmodelCommand(program) {
         const cwd = process.cwd();
         const config = resolveConfigFromBinding(cwd);
         const apiClient = new ApiClient(config);
-        const registryClient = buildRegistryClient(apiClient);
+        const registryClient = buildRegistryClient();
         const cliVersion = getCliVersion();
         try {
             const resolvedApp = requireApplicationId(opts.app, cwd);
@@ -105,7 +106,7 @@ export function registerThreatmodelCommand(program) {
         }
         const config = resolveConfigFromBinding(cwd);
         const apiClient = new ApiClient(config);
-        const registryClient = buildRegistryClient(apiClient);
+        const registryClient = buildRegistryClient();
         try {
             const resolvedApp = requireApplicationId(opts.app, cwd);
             if (!resolvedApp.ok) {

package/dist/index.js

@@ -7,7 +7,6 @@ import { registerAuthCommands } from "./commands/auth/index.js";
 import { initCommand as authInitCommand } from "./commands/auth/init.js";
 import { registerAppCommands } from "./commands/app/index.js";
 import { registerTargetCommands } from "./commands/target/index.js";
-import { registerTmCommands } from "./commands/tm/index.js";
 import { registerScanCommands } from "./commands/scan/index.js";
 import { registerCheckCommands } from "./commands/check/index.js";
 import { registerInspectCommands } from "./commands/inspect/index.js";
@@ -48,7 +47,6 @@ registerAuthCommands(program);
 registerCheckCommands(program);
 registerAppCommands(program);
 registerTargetCommands(program);
-registerTmCommands(program);
 registerScanCommands(program);
 registerInspectCommands(program);
 registerMcpCommands(program);

package/dist/internal/packs/index.d.ts

@@ -2,9 +2,9 @@ export type { PackType, PackContentEntry, PackScopeEntry, PackSignature, PackMan
 export { PackIntegrityError, PackUnavailableError, UnknownScopeError } from "./types.js";
 export { resolveCompatiblePack, resolveScope, listAvailableScopes } from "./resolve.js";
 export type { ResolveOptions } from "./resolve.js";
-export { HttpPackRegistryClient, LocalPackRegistryClient, registryDirOverride, } from "./registry-client.js";
-export type { MinimalApiClient } from "./registry-client.js";
+export { LocalPackRegistryClient, registryDirOverride, } from "./registry-client.js";
+export { NpmPackRegistryClient } from "./npm-registry-client.js";
 export { userCacheRoot, packsRoot, packTypeDir, packVersionDir } from "./local-paths.js";
-export { verifyManifestSignature, manifestSigningPayload, DEV_PACK_SIGNING_KEY_ID } from "./signing.js";
+export { verifyManifestSignature, manifestSigningPayload, PRODUCTION_PACK_SIGNING_KEY_ID } from "./signing.js";
 export { sha256Hex, verifyContentHash, verifyPack } from "./integrity.js";
 export { compareVersions, satisfiesMinVersion, parseVersion } from "./semver.js";

package/dist/internal/packs/index.js

@@ -1,7 +1,8 @@
 export { PackIntegrityError, PackUnavailableError, UnknownScopeError } from "./types.js";
 export { resolveCompatiblePack, resolveScope, listAvailableScopes } from "./resolve.js";
-export { HttpPackRegistryClient, LocalPackRegistryClient, registryDirOverride, } from "./registry-client.js";
+export { LocalPackRegistryClient, registryDirOverride, } from "./registry-client.js";
+export { NpmPackRegistryClient } from "./npm-registry-client.js";
 export { userCacheRoot, packsRoot, packTypeDir, packVersionDir } from "./local-paths.js";
-export { verifyManifestSignature, manifestSigningPayload, DEV_PACK_SIGNING_KEY_ID } from "./signing.js";
+export { verifyManifestSignature, manifestSigningPayload, PRODUCTION_PACK_SIGNING_KEY_ID } from "./signing.js";
 export { sha256Hex, verifyContentHash, verifyPack } from "./integrity.js";
 export { compareVersions, satisfiesMinVersion, parseVersion } from "./semver.js";

package/dist/internal/packs/npm-registry-client.d.ts

@@ -0,0 +1,14 @@
+import type { PackManifestV1, PackRegistryClient, PackType, PackVersionListing } from "./types.js";
+export declare class NpmPackRegistryClient implements PackRegistryClient {
+    private readonly registryUrl;
+    private readonly packumentCache;
+    private readonly extractionCache;
+    constructor(registryUrl?: string);
+    private packageName;
+    private fetchPackument;
+    listVersions(packType: PackType): Promise<PackVersionListing>;
+    private ensureExtracted;
+    private downloadAndExtract;
+    getManifest(packType: PackType, version: string): Promise<PackManifestV1>;
+    getContent(packType: PackType, version: string, relativePath: string): Promise<string>;
+}

package/dist/internal/packs/npm-registry-client.js

@@ -0,0 +1,87 @@
+import * as fsp from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as zlib from "node:zlib";
+import { pipeline } from "node:stream/promises";
+import { Readable } from "node:stream";
+import * as tar from "tar";
+const NPM_PACKAGE_NAMES = {
+    appsec: "@zivis/appsec-pack",
+    threatmodel: "@zivis/threatmodel-pack",
+};
+function encodeScopedName(name) {
+    return name.replaceAll("/", "%2f");
+}
+export class NpmPackRegistryClient {
+    registryUrl;
+    packumentCache = new Map();
+    extractionCache = new Map();
+    constructor(registryUrl = "https://registry.npmjs.org") {
+        this.registryUrl = registryUrl;
+    }
+    packageName(packType) {
+        const name = NPM_PACKAGE_NAMES[packType];
+        if (!name)
+            throw new Error(`No npm package mapping for pack type "${packType}"`);
+        return name;
+    }
+    async fetchPackument(packType) {
+        let cached = this.packumentCache.get(packType);
+        if (!cached) {
+            cached = (async () => {
+                const url = `${this.registryUrl}/${encodeScopedName(this.packageName(packType))}`;
+                const res = await fetch(url, { headers: { Accept: "application/json" } });
+                if (!res.ok) {
+                    throw new Error(`npm registry returned HTTP ${res.status} for ${url}`);
+                }
+                return (await res.json());
+            })();
+            this.packumentCache.set(packType, cached);
+        }
+        return cached;
+    }
+    async listVersions(packType) {
+        const packument = await this.fetchPackument(packType);
+        const versions = Object.values(packument.versions)
+            .filter((v) => v.zivisPack?.minCliVersion && v.zivisPack.packType === packType)
+            .map((v) => ({
+            version: v.version,
+            min_cli_version: v.zivisPack.minCliVersion,
+            manifest_sha256: v.dist.shasum ?? "",
+            published_at: packument.time?.[v.version] ?? "",
+        }));
+        return { pack_type: packType, versions };
+    }
+    async ensureExtracted(packType, version) {
+        const key = `${packType}@${version}`;
+        let cached = this.extractionCache.get(key);
+        if (!cached) {
+            cached = this.downloadAndExtract(packType, version);
+            this.extractionCache.set(key, cached);
+        }
+        return cached;
+    }
+    async downloadAndExtract(packType, version) {
+        const packument = await this.fetchPackument(packType);
+        const versionMeta = packument.versions[version];
+        if (!versionMeta) {
+            throw new Error(`${this.packageName(packType)}@${version} not found on the npm registry`);
+        }
+        const tarballRes = await fetch(versionMeta.dist.tarball);
+        if (!tarballRes.ok || !tarballRes.body) {
+            throw new Error(`Failed to download tarball for ${this.packageName(packType)}@${version}: HTTP ${tarballRes.status}`);
+        }
+        const extractDir = await fsp.mkdtemp(path.join(os.tmpdir(), "zivis-pack-"));
+        await pipeline(Readable.fromWeb(tarballRes.body), zlib.createGunzip(), tar.extract({ cwd: extractDir, strip: 1 }));
+        return extractDir;
+    }
+    async getManifest(packType, version) {
+        const extractDir = await this.ensureExtracted(packType, version);
+        const raw = await fsp.readFile(path.join(extractDir, "dist", "manifest.json"), "utf-8");
+        return JSON.parse(raw);
+    }
+    async getContent(packType, version, relativePath) {
+        const extractDir = await this.ensureExtracted(packType, version);
+        return fsp.readFile(path.join(extractDir, "dist", relativePath), "utf-8");
+    }
+}

package/dist/internal/packs/registry-client.d.ts

@@ -1,15 +1,4 @@
 import type { PackManifestV1, PackRegistryClient, PackType, PackVersionListing } from "./types.js";
-export interface MinimalApiClient {
-    get<T>(path: string): Promise<T>;
-    getText(path: string): Promise<string>;
-}
-export declare class HttpPackRegistryClient implements PackRegistryClient {
-    private readonly apiClient;
-    constructor(apiClient: MinimalApiClient);
-    listVersions(packType: PackType): Promise<PackVersionListing>;
-    getManifest(packType: PackType, version: string): Promise<PackManifestV1>;
-    getContent(packType: PackType, version: string, relativePath: string): Promise<string>;
-}
 export declare class LocalPackRegistryClient implements PackRegistryClient {
     private readonly rootDir;
     constructor(rootDir: string);

package/dist/internal/packs/registry-client.js

@@ -1,20 +1,5 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-export class HttpPackRegistryClient {
-    apiClient;
-    constructor(apiClient) {
-        this.apiClient = apiClient;
-    }
-    listVersions(packType) {
-        return this.apiClient.get(`/api/zivis-packs/${packType}`);
-    }
-    getManifest(packType, version) {
-        return this.apiClient.get(`/api/zivis-packs/${packType}/${version}/manifest.json`);
-    }
-    getContent(packType, version, relativePath) {
-        return this.apiClient.getText(`/api/zivis-packs/${packType}/${version}/content/${relativePath}`);
-    }
-}
 export class LocalPackRegistryClient {
     rootDir;
     constructor(rootDir) {

package/dist/internal/packs/signing.d.ts

@@ -1,5 +1,5 @@
 import type { PackManifestV1, PackSignature } from "./types.js";
-export declare const DEV_PACK_SIGNING_KEY_ID = "zivis-pack-dev-2026-08";
+export declare const PRODUCTION_PACK_SIGNING_KEY_ID = "zivis-pack-prod-2026-08";
 export declare function manifestSigningPayload(manifest: Omit<PackManifestV1, "signature">): string;
 export declare function verifyManifestSignature(manifest: PackManifestV1): boolean;
-export declare function signManifestDev(manifest: Omit<PackManifestV1, "signature">, privateKeySpkiB64: string): PackSignature;
+export declare function signManifest(manifest: Omit<PackManifestV1, "signature">, privateKeySpkiB64: string, keyId: string): PackSignature;

package/dist/internal/packs/signing.js

@@ -1,12 +1,19 @@
 import * as crypto from "node:crypto";
 import { canonicalize } from "./jcs.js";
-export const DEV_PACK_SIGNING_KEY_ID = "zivis-pack-dev-2026-08";
-const DEV_PACK_PUBLIC_KEY_SPKI_B64 = "MCowBQYDK2VwAyEA1xfF9X57KKlqMA8vbHg7DEuU6K5aTURJaFINYk6wRvA=";
+export const PRODUCTION_PACK_SIGNING_KEY_ID = "zivis-pack-prod-2026-08";
+const PRODUCTION_PACK_PUBLIC_KEY_SPKI_B64 = "MCowBQYDK2VwAyEAxp1BFtbclfI8mB7NV4hwQ2Gx5OcSM3Irj+w4oZrooss=";
 const KNOWN_PUBLIC_KEYS = {
-    [DEV_PACK_SIGNING_KEY_ID]: DEV_PACK_PUBLIC_KEY_SPKI_B64,
+    [PRODUCTION_PACK_SIGNING_KEY_ID]: PRODUCTION_PACK_PUBLIC_KEY_SPKI_B64,
 };
+function loadTestOverrideKey(keyId) {
+    const testKeyId = process.env.ZIVIS_PACK_VERIFY_TEST_KEY_ID;
+    const testPublicKey = process.env.ZIVIS_PACK_VERIFY_TEST_PUBLIC_KEY;
+    if (testKeyId && testPublicKey && testKeyId === keyId)
+        return testPublicKey;
+    return null;
+}
 function loadPublicKey(keyId) {
-    const spkiB64 = KNOWN_PUBLIC_KEYS[keyId];
+    const spkiB64 = KNOWN_PUBLIC_KEYS[keyId] ?? loadTestOverrideKey(keyId);
     if (!spkiB64)
         return null;
     return crypto.createPublicKey({
@@ -33,7 +40,7 @@ export function verifyManifestSignature(manifest) {
         return false;
     }
 }
-export function signManifestDev(manifest, privateKeySpkiB64) {
+export function signManifest(manifest, privateKeySpkiB64, keyId) {
     const privateKey = crypto.createPrivateKey({
         key: Buffer.from(privateKeySpkiB64, "base64"),
         format: "der",
@@ -43,7 +50,7 @@ export function signManifestDev(manifest, privateKeySpkiB64) {
     const sig = crypto.sign(null, new Uint8Array(Buffer.from(payload, "utf8")), privateKey);
     return {
         algorithm: "ed25519",
-        key_id: DEV_PACK_SIGNING_KEY_ID,
+        key_id: keyId,
         signature: sig.toString("base64"),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/cli",
-  "version": "0.1.0-alpha.44",
+  "version": "0.1.0-alpha.45",
   "description": "ZIVIS CLI — threat modeling, scans, and MCP server for IDE integration",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",
@@ -32,8 +32,9 @@
     "ignore": "^7.0.5",
     "js-yaml": "^4.1.0",
     "open": "^10.1.0",
+    "tar": "^7.5.22",
     "web-tree-sitter": "^0.26.8",
-    "@zivis/mcp": "0.1.6"
+    "@zivis/mcp": "0.1.7"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/dist/commands/tm/index.d.ts

@@ -1,2 +0,0 @@
-import type { Command } from "commander";
-export declare function registerTmCommands(program: Command): void;

package/dist/commands/tm/index.js

@@ -1,263 +0,0 @@
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import { ApiClient } from "@zivis/mcp/api-client";
-import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
-import { getEphemeralCreds } from "../../internal/target-auth/index.js";
-import { runExtractor } from "../../internal/extractor/index.js";
-import { ensureZivisGitignore } from "../../internal/zivis-local-state.js";
-function buildClient(opts) {
-    const config = opts.session
-        ? { ...resolveConfigFromBinding(process.cwd()), session: opts.session }
-        : resolveConfigFromBinding(process.cwd());
-    return new ApiClient(config);
-}
-function collect(value, previous) {
-    return previous.concat([value]);
-}
-function defaultOutPath(extractedAt) {
-    const ts = extractedAt.replace(/[:.]/g, "-");
-    return `.zivis/extracted/${ts}.json`;
-}
-export function registerTmCommands(program) {
-    const tm = program.command("tm").description("threat model operations");
-    tm.command("list")
-        .description("list threat models in the active org")
-        .option("-s, --session <name>", "named session")
-        .option("--app <applicationId>", "filter by application id")
-        .option("--json", "emit raw JSON")
-        .action(async (opts) => {
-        const client = buildClient(opts);
-        const query = opts.app ? `?applicationId=${encodeURIComponent(opts.app)}` : "";
-        const list = await client.request("GET", `/api/threat-models${query}`);
-        if (opts.json) {
-            process.stdout.write(JSON.stringify(list, null, 2) + "\n");
-            return;
-        }
-        if (list.length === 0) {
-            console.log("No threat models found.");
-            return;
-        }
-        for (const tm of list) {
-            const v = tm.latestVersion;
-            const stats = v
-                ? `v${v.versionNumber} ${v.analysisStatus} · ${v.totalThreats} threats (${v.criticalCount}C/${v.highCount}H)`
-                : "no analysis";
-            const app = tm.applicationName ? ` [${tm.applicationName}]` : "";
-            console.log(`${tm.id}  ${tm.name}${app}`);
-            console.log(`  ${tm.status} · ${stats}`);
-        }
-    });
-    tm.command("get <threatModelId>")
-        .description("dump a threat model as JSON")
-        .option("-s, --session <name>", "named session")
-        .action(async (id, opts) => {
-        const client = buildClient(opts);
-        const tm = await client.request("GET", `/api/threat-models/${encodeURIComponent(id)}`);
-        process.stdout.write(JSON.stringify(tm, null, 2) + "\n");
-    });
-    tm.command("pull <threatModelId>")
-        .description("write a threat model to a local JSON file (default: ./<id>.json)")
-        .option("-s, --session <name>", "named session")
-        .option("-o, --out <file>", "output file path")
-        .action(async (id, opts) => {
-        const client = buildClient(opts);
-        const tm = await client.request("GET", `/api/threat-models/${encodeURIComponent(id)}`);
-        const outPath = path.resolve(opts.out ?? `${id}.json`);
-        await fs.writeFile(outPath, JSON.stringify(tm, null, 2) + "\n", "utf8");
-        console.log(`✓ Wrote ${outPath}`);
-        if (tm.name)
-            console.log(`  ${tm.name}`);
-    });
-    tm.command("push <threatModelId>")
-        .description("update a threat model from a local JSON file (only name/description/status fields)")
-        .option("-s, --session <name>", "named session")
-        .option("-f, --file <file>", "JSON file to read (default: ./<id>.json)")
-        .option("--dry-run", "print the PATCH payload without sending")
-        .action(async (id, opts) => {
-        const inPath = path.resolve(opts.file ?? `${id}.json`);
-        const raw = await fs.readFile(inPath, "utf8").catch((err) => {
-            console.error(`Could not read ${inPath}: ${err.message}`);
-            process.exit(1);
-        });
-        const parsed = JSON.parse(raw);
-        const payload = {};
-        for (const k of ["name", "description", "status", "campaignId"]) {
-            if (parsed[k] !== undefined)
-                payload[k] = parsed[k];
-        }
-        if (Object.keys(payload).length === 0) {
-            console.error("No updatable fields found in file (name/description/status/campaignId).");
-            process.exit(1);
-        }
-        if (opts.dryRun) {
-            console.log("Would PATCH:");
-            console.log(JSON.stringify(payload, null, 2));
-            return;
-        }
-        const client = buildClient(opts);
-        const updated = await client.request("PATCH", `/api/threat-models/${encodeURIComponent(id)}`, payload);
-        console.log(`✓ Updated ${updated.id}`);
-        if (updated.name)
-            console.log(`  ${updated.name}`);
-    });
-    tm.command("extract")
-        .description("walk the local repo with tree-sitter and emit structural metadata as JSON (Phase J.2)")
-        .option("--root <dir>", "directory to scan (default: cwd)")
-        .option("--out <file>", "write JSON to a file (default: .zivis/extracted/<ts>.json; '-' for stdout)")
-        .option("--ignore <pattern>", "extra ignore pattern (repeatable)", collect, [])
-        .option("--privacy-audit", "print exactly what would be sent without sending — never makes network calls")
-        .option("--lang <list>", "comma-separated subset of adapters to run: typescript,go,python")
-        .action(async (opts) => {
-        const rootDir = path.resolve(opts.root ?? process.cwd());
-        const cliPkg = JSON.parse(await fs.readFile(path.join(path.dirname(new URL(import.meta.url).pathname), "../../../package.json"), "utf8"));
-        const langs = opts.lang
-            ? String(opts.lang).split(",").map((s) => s.trim()).filter(Boolean)
-            : undefined;
-        const result = await runExtractor({
-            rootDir,
-            languages: langs,
-            extraIgnores: opts.ignore,
-            extractorVersion: cliPkg.version,
-        });
-        if (opts.privacyAudit) {
-            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-            process.stderr.write(`\n[zivis] Privacy audit: ${result.scope.filesScanned} files scanned, ` +
-                `${result.components.length} component(s), ${result.externalServices.length} external service(s), ` +
-                `${result.dataStores.length} data store(s), ${result.manifests.length} manifest(s).\n` +
-                `[zivis] Nothing was sent. Run without --privacy-audit + --apply <tm-id> to upload.\n`);
-            return;
-        }
-        const target = opts.out ?? defaultOutPath(result.extractedAt);
-        if (target === "-") {
-            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-            return;
-        }
-        const absOut = path.isAbsolute(target) ? target : path.join(rootDir, target);
-        if (absOut.startsWith(path.join(rootDir, ".zivis") + path.sep)) {
-            ensureZivisGitignore(rootDir);
-        }
-        await fs.mkdir(path.dirname(absOut), { recursive: true });
-        await fs.writeFile(absOut, JSON.stringify(result, null, 2) + "\n", "utf8");
-        console.log(`✓ Wrote ${absOut}`);
-        console.log(`  ${result.scope.filesScanned} files scanned in ${result.scope.durationMs}ms — ` +
-            `${result.components.length} component(s), ${result.externalServices.length} external service(s), ` +
-            `${result.dataStores.length} data store(s).`);
-    });
-    tm.command("threats")
-        .description("show threats touching a file (Phase J.3 — IDE/CLI surface)")
-        .requiredOption("--tm <threatModelId>", "threat model to query")
-        .requiredOption("--file <path>", "file path (repo-relative, matches ThreatModelComponent.sourceFiles)")
-        .option("-s, --session <name>", "named session")
-        .option("--json", "emit raw JSON")
-        .action(async (opts) => {
-        const client = buildClient(opts);
-        const path = `/api/threat-models/${encodeURIComponent(opts.tm)}/files/threats?path=${encodeURIComponent(opts.file)}`;
-        const result = await client.request("GET", path);
-        if (opts.json) {
-            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-            return;
-        }
-        if (result.components.length === 0) {
-            console.log(`No components reference ${result.path} in this threat model.`);
-            return;
-        }
-        console.log(`${result.path}`);
-        for (const c of result.components) {
-            const idLabel = c.displayId ? `[${c.displayId}]` : `[${c.id.slice(0, 8)}]`;
-            console.log(`  ${idLabel} ${c.name} (${c.componentType}) — ${c.threatCount} threat(s)`);
-            for (const t of c.threats) {
-                const sev = t.severity ? `[${t.severity}]` : "";
-                console.log(`    • ${sev} ${t.title ?? t.id}`);
-            }
-        }
-    });
-    const scenario = tm
-        .command("scenario")
-        .description("threat model scenario operations");
-    scenario
-        .command("list")
-        .description("list scenarios in a threat model")
-        .requiredOption("--tm <threatModelId>", "threat model id")
-        .option("-s, --session <name>", "named session")
-        .option("--json", "emit raw JSON")
-        .action(async (opts) => {
-        const client = buildClient(opts);
-        const result = await client.request("GET", `/api/threat-models/${encodeURIComponent(opts.tm)}/scenarios`);
-        const scenarios = Array.isArray(result) ? result : result.data ?? [];
-        if (opts.json) {
-            process.stdout.write(JSON.stringify(scenarios, null, 2) + "\n");
-            return;
-        }
-        if (scenarios.length === 0) {
-            console.log("No scenarios in this threat model.");
-            return;
-        }
-        for (const s of scenarios) {
-            const sev = s.severity ? ` [${s.severity}]` : "";
-            console.log(`${s.id}  ${s.status.padEnd(10)} ${s.title ?? "(untitled)"}${sev}`);
-        }
-    });
-    scenario
-        .command("show <scenarioId>")
-        .description("dump a scenario as JSON (uses /api/scenarios/:id, no --tm needed)")
-        .option("-s, --session <name>", "named session")
-        .action(async (scenarioId, opts) => {
-        const client = buildClient(opts);
-        const result = await client.request("GET", `/api/scenarios/${encodeURIComponent(scenarioId)}`);
-        process.stdout.write(JSON.stringify(result.data ?? result, null, 2) + "\n");
-    });
-    scenario
-        .command("run <scenarioId>")
-        .description("trigger a manual scenario run (scenario must be in 'testing' status)")
-        .option("-s, --session <name>", "named session")
-        .option("--app <applicationId>", "the customer-facing Application to test against (Phase J.4 — preferred over --target)")
-        .option("--target <targetId>", "[deprecated alias for --app] interpreted as applicationId; also used as keychain key for ephemeral creds")
-        .option("-p, --persona <name>", "target-system persona to use (default: default)", "default")
-        .option("--no-creds", "skip the ephemeral-creds path even if --app is set")
-        .option("--json", "emit raw JSON")
-        .action(async (scenarioId, opts) => {
-        const client = buildClient(opts);
-        const path = `/api/scenarios/${encodeURIComponent(scenarioId)}/run`;
-        const appId = opts.app ?? opts.target;
-        if (opts.target && !opts.app) {
-            console.warn("[zivis] --target is deprecated; use --app <applicationId>");
-        }
-        const body = {};
-        if (appId) {
-            body.applicationId = appId;
-            if (opts.creds !== false) {
-                const creds = await getEphemeralCreds(appId, opts.persona);
-                if (!creds) {
-                    console.error(`No valid token for application ${appId} (persona: ${opts.persona}).`);
-                    console.error(`Run: zivis app auth ${appId} -p ${opts.persona}`);
-                    process.exit(2);
-                }
-                body.targetCreds = creds;
-            }
-        }
-        try {
-            const result = await client.request("POST", path, Object.keys(body).length ? body : undefined);
-            if (opts.json) {
-                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-                return;
-            }
-            console.log(`✓ Triggered scenario run ${result.data.runId}`);
-            if (result.threatModelId) {
-                console.log(`  Threat model: ${result.threatModelId}`);
-            }
-            if (result.credsAccepted) {
-                console.log(`  Ephemeral creds accepted (persona: ${opts.persona}, ttl: ${result.credsTtlSec ?? "?"}s)`);
-            }
-            if (result.scanId) {
-                console.log(`  Dispatched RT scan: ${result.scanId}`);
-            }
-            else if (result.dispatchSkippedReason) {
-                console.log(`  Dispatch: ${result.dispatchSkippedReason}`);
-            }
-        }
-        catch (err) {
-            console.error("Run failed:", err instanceof Error ? err.message : err);
-            process.exit(1);
-        }
-    });
-}