@zivis/cli 0.1.0-alpha.5 → 0.1.0-alpha.52

package/dist/internal/packs/resolve.js

@@ -0,0 +1,89 @@
+import { PackIntegrityError, PackUnavailableError, UnknownScopeError } from "./types.js";
+import { verifyPack } from "./integrity.js";
+import { compareVersions, satisfiesMinVersion } from "./semver.js";
+import { listCachedVersions, loadVerifiedFromCache, writeVerifiedPackToCache } from "./cache.js";
+import { packVersionDir } from "./local-paths.js";
+function contentPaths(manifest) {
+    return [manifest.base.path, ...(manifest.scopes ?? []).map((s) => s.path)];
+}
+async function fetchAndVerify(packType, version, client) {
+    const manifest = await client.getManifest(packType, version);
+    const contentByPath = new Map();
+    for (const relPath of contentPaths(manifest)) {
+        contentByPath.set(relPath, await client.getContent(packType, version, relPath));
+    }
+    const result = verifyPack(manifest, contentByPath);
+    if (!result.valid) {
+        throw new PackIntegrityError(`Downloaded ${packType} pack ${version} failed verification: ${result.reason}`);
+    }
+    return { manifest, contentByPath };
+}
+function toResolvedPack(manifest, contentByPath, source, cacheDir) {
+    return {
+        packId: manifest.pack_id,
+        packType: manifest.pack_type,
+        version: manifest.version,
+        minCliVersion: manifest.min_cli_version,
+        source,
+        basePath: `${cacheDir}/${manifest.base.path}`,
+        baseContent: contentByPath.get(manifest.base.path) ?? "",
+        scopes: manifest.scopes ?? [],
+        cacheDir,
+    };
+}
+export async function resolveCompatiblePack(packType, opts) {
+    try {
+        const listing = await opts.registryClient.listVersions(packType);
+        const compatible = listing.versions
+            .filter((v) => satisfiesMinVersion(opts.cliVersion, v.min_cli_version))
+            .sort((a, b) => compareVersions(b.version, a.version));
+        if (compatible.length === 0) {
+            throw new PackUnavailableError(`No ${packType} pack is compatible with @zivis/cli ${opts.cliVersion}. ` +
+                `Available versions: ${listing.versions.map((v) => v.version).join(", ") || "(none)"}`);
+        }
+        const target = compatible[0];
+        const cached = await loadVerifiedFromCache(packType, target.version);
+        if (cached) {
+            return toResolvedPack(cached.manifest, cached.contentByPath, "cache-verified", cached.cacheDir);
+        }
+        const { manifest, contentByPath } = await fetchAndVerify(packType, target.version, opts.registryClient);
+        const cacheDir = await writeVerifiedPackToCache(packType, target.version, manifest, contentByPath);
+        return toResolvedPack(manifest, contentByPath, "network", cacheDir);
+    }
+    catch (err) {
+        if (err instanceof PackIntegrityError || err instanceof PackUnavailableError) {
+            throw err;
+        }
+        return resolveFromOfflineCache(packType, opts.cliVersion, err);
+    }
+}
+async function resolveFromOfflineCache(packType, cliVersion, networkError) {
+    const cachedVersions = await listCachedVersions(packType);
+    const verified = [];
+    for (const version of cachedVersions) {
+        const entry = await loadVerifiedFromCache(packType, version);
+        if (entry && satisfiesMinVersion(cliVersion, entry.manifest.min_cli_version)) {
+            verified.push(entry);
+        }
+    }
+    if (verified.length === 0) {
+        const reason = networkError instanceof Error ? networkError.message : String(networkError);
+        throw new PackUnavailableError(`Could not reach the ZIVIS pack registry (${reason}), and no previously verified ${packType} ` +
+            `pack compatible with @zivis/cli ${cliVersion} is cached at ${packVersionDir(packType, "*")}.`);
+    }
+    verified.sort((a, b) => compareVersions(b.manifest.version, a.manifest.version));
+    const best = verified[0];
+    return toResolvedPack(best.manifest, best.contentByPath, "cache-offline", best.cacheDir);
+}
+export async function resolveScope(resolved, scopeId) {
+    const scope = resolved.scopes.find((s) => s.id === scopeId);
+    if (!scope) {
+        throw new UnknownScopeError(scopeId, resolved.scopes);
+    }
+    const fs = await import("node:fs/promises");
+    const content = await fs.readFile(`${resolved.cacheDir}/${scope.path}`, "utf-8");
+    return { id: scope.id, label: scope.label, description: scope.description, content, tests: scope.tests ?? [] };
+}
+export function listAvailableScopes(resolved) {
+    return resolved.scopes.map(({ id, label, description }) => ({ id, label, description }));
+}

package/dist/internal/packs/semver.d.ts

@@ -0,0 +1,9 @@
+export interface ParsedVersion {
+    major: number;
+    minor: number;
+    patch: number;
+    prerelease: (string | number)[];
+}
+export declare function parseVersion(version: string): ParsedVersion;
+export declare function compareVersions(a: string, b: string): number;
+export declare function satisfiesMinVersion(cliVersion: string, minCliVersion: string): boolean;

package/dist/internal/packs/semver.js

@@ -0,0 +1,57 @@
+const SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/;
+export function parseVersion(version) {
+    const m = SEMVER_RE.exec(version.trim());
+    if (!m) {
+        throw new Error(`Not a valid semver-like version: "${version}"`);
+    }
+    const [, major, minor, patch, prerelease] = m;
+    return {
+        major: Number(major),
+        minor: Number(minor),
+        patch: Number(patch),
+        prerelease: prerelease
+            ? prerelease.split(".").map((part) => (/^\d+$/.test(part) ? Number(part) : part))
+            : [],
+    };
+}
+function compareIdentifier(a, b) {
+    if (typeof a === "number" && typeof b === "number")
+        return a - b;
+    const as = String(a);
+    const bs = String(b);
+    if (typeof a === "number")
+        return -1;
+    if (typeof b === "number")
+        return 1;
+    return as < bs ? -1 : as > bs ? 1 : 0;
+}
+export function compareVersions(a, b) {
+    const pa = parseVersion(a);
+    const pb = parseVersion(b);
+    if (pa.major !== pb.major)
+        return pa.major - pb.major;
+    if (pa.minor !== pb.minor)
+        return pa.minor - pb.minor;
+    if (pa.patch !== pb.patch)
+        return pa.patch - pb.patch;
+    if (pa.prerelease.length === 0 && pb.prerelease.length === 0)
+        return 0;
+    if (pa.prerelease.length === 0)
+        return 1;
+    if (pb.prerelease.length === 0)
+        return -1;
+    const len = Math.max(pa.prerelease.length, pb.prerelease.length);
+    for (let i = 0; i < len; i++) {
+        if (i >= pa.prerelease.length)
+            return -1;
+        if (i >= pb.prerelease.length)
+            return 1;
+        const cmp = compareIdentifier(pa.prerelease[i], pb.prerelease[i]);
+        if (cmp !== 0)
+            return cmp;
+    }
+    return 0;
+}
+export function satisfiesMinVersion(cliVersion, minCliVersion) {
+    return compareVersions(cliVersion, minCliVersion) >= 0;
+}

package/dist/internal/packs/signing.d.ts

@@ -0,0 +1,5 @@
+import type { PackManifestV1, PackSignature } from "./types.js";
+export declare const PRODUCTION_PACK_SIGNING_KEY_ID = "zivis-pack-prod-2026-08";
+export declare function manifestSigningPayload(manifest: Omit<PackManifestV1, "signature">): string;
+export declare function verifyManifestSignature(manifest: PackManifestV1): boolean;
+export declare function signManifest(manifest: Omit<PackManifestV1, "signature">, privateKeySpkiB64: string, keyId: string): PackSignature;

package/dist/internal/packs/signing.js

@@ -0,0 +1,56 @@
+import * as crypto from "node:crypto";
+import { canonicalize } from "./jcs.js";
+export const PRODUCTION_PACK_SIGNING_KEY_ID = "zivis-pack-prod-2026-08";
+const PRODUCTION_PACK_PUBLIC_KEY_SPKI_B64 = "MCowBQYDK2VwAyEAxp1BFtbclfI8mB7NV4hwQ2Gx5OcSM3Irj+w4oZrooss=";
+const KNOWN_PUBLIC_KEYS = {
+    [PRODUCTION_PACK_SIGNING_KEY_ID]: PRODUCTION_PACK_PUBLIC_KEY_SPKI_B64,
+};
+function loadTestOverrideKey(keyId) {
+    const testKeyId = process.env.ZIVIS_PACK_VERIFY_TEST_KEY_ID;
+    const testPublicKey = process.env.ZIVIS_PACK_VERIFY_TEST_PUBLIC_KEY;
+    if (testKeyId && testPublicKey && testKeyId === keyId)
+        return testPublicKey;
+    return null;
+}
+function loadPublicKey(keyId) {
+    const spkiB64 = KNOWN_PUBLIC_KEYS[keyId] ?? loadTestOverrideKey(keyId);
+    if (!spkiB64)
+        return null;
+    return crypto.createPublicKey({
+        key: Buffer.from(spkiB64, "base64"),
+        format: "der",
+        type: "spki",
+    });
+}
+export function manifestSigningPayload(manifest) {
+    return canonicalize(manifest);
+}
+export function verifyManifestSignature(manifest) {
+    const { signature, ...unsigned } = manifest;
+    if (!signature || signature.algorithm !== "ed25519")
+        return false;
+    const publicKey = loadPublicKey(signature.key_id);
+    if (!publicKey)
+        return false;
+    try {
+        const payload = manifestSigningPayload(unsigned);
+        return crypto.verify(null, new Uint8Array(Buffer.from(payload, "utf8")), publicKey, new Uint8Array(Buffer.from(signature.signature, "base64")));
+    }
+    catch {
+        return false;
+    }
+}
+export function signManifest(manifest, privateKeySpkiB64, keyId) {
+    const privateKey = crypto.createPrivateKey({
+        key: Buffer.from(privateKeySpkiB64, "base64"),
+        format: "der",
+        type: "pkcs8",
+    });
+    const payload = manifestSigningPayload(manifest);
+    const sig = crypto.sign(null, new Uint8Array(Buffer.from(payload, "utf8")), privateKey);
+    return {
+        algorithm: "ed25519",
+        key_id: keyId,
+        signature: sig.toString("base64"),
+    };
+}

package/dist/internal/packs/types.d.ts

@@ -0,0 +1,77 @@
+export type PackType = "appsec" | "threatmodel";
+export interface PackContentEntry {
+    path: string;
+    sha256: string;
+}
+export interface PackTestEntry {
+    id: string;
+    title: string;
+    deprecated?: boolean;
+}
+export interface PackScopeEntry extends PackContentEntry {
+    id: string;
+    label: string;
+    description: string;
+    tests?: PackTestEntry[];
+}
+export interface PackSignature {
+    algorithm: "ed25519";
+    key_id: string;
+    signature: string;
+}
+export interface PackManifestV1 {
+    schema_version: "1.0.0";
+    pack_id: string;
+    pack_type: PackType;
+    version: string;
+    min_cli_version: string;
+    description?: string;
+    built_at: string;
+    base: PackContentEntry;
+    scopes?: PackScopeEntry[];
+    signature: PackSignature;
+}
+export interface PackVersionSummary {
+    version: string;
+    min_cli_version: string;
+    manifest_sha256: string;
+    published_at: string;
+}
+export interface PackVersionListing {
+    pack_type: PackType;
+    versions: PackVersionSummary[];
+}
+export type PackSource = "network" | "cache-verified" | "cache-offline";
+export interface ResolvedScope {
+    id: string;
+    label: string;
+    description: string;
+    content: string;
+    tests: PackTestEntry[];
+}
+export interface ResolvedPack {
+    packId: string;
+    packType: PackType;
+    version: string;
+    minCliVersion: string;
+    source: PackSource;
+    basePath: string;
+    baseContent: string;
+    scopes: PackScopeEntry[];
+    cacheDir: string;
+}
+export declare class PackIntegrityError extends Error {
+    constructor(message: string);
+}
+export declare class PackUnavailableError extends Error {
+    constructor(message: string);
+}
+export declare class UnknownScopeError extends Error {
+    readonly availableScopes: PackScopeEntry[];
+    constructor(scopeId: string, availableScopes: PackScopeEntry[]);
+}
+export interface PackRegistryClient {
+    listVersions(packType: PackType): Promise<PackVersionListing>;
+    getManifest(packType: PackType, version: string): Promise<PackManifestV1>;
+    getContent(packType: PackType, version: string, relativePath: string): Promise<string>;
+}

package/dist/internal/packs/types.js

@@ -0,0 +1,20 @@
+export class PackIntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PackIntegrityError";
+    }
+}
+export class PackUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PackUnavailableError";
+    }
+}
+export class UnknownScopeError extends Error {
+    availableScopes;
+    constructor(scopeId, availableScopes) {
+        super(`Unknown scope "${scopeId}". Available scopes: ${availableScopes.map((s) => s.id).join(", ") || "(none)"}`);
+        this.name = "UnknownScopeError";
+        this.availableScopes = availableScopes;
+    }
+}

package/dist/internal/project-binding.d.ts

@@ -7,5 +7,6 @@ export interface EnsureBindingOpts {
     cwd: string;
     autoBind: boolean;
     skipBind: boolean;
+    force?: boolean;
 }
 export declare function ensureProjectBinding(opts: EnsureBindingOpts): Promise<void>;

package/dist/internal/project-binding.js

@@ -7,25 +7,31 @@ import { fetchUserOrgs } from "./orgs.js";
 export async function ensureProjectBinding(opts) {
     const { config, session, accessToken, cwd, autoBind, skipBind } = opts;
     const claims = decodeJwtPayload(accessToken);
-    const jwtOrgId = claims?.org_id;
+    const jwtOrgId = claims?.org_id ?? opts.organizationId;
     if (!jwtOrgId) {
         console.log("");
-        console.log("  Note: JWT has no org_id — skipping project binding.");
+        console.log("  Note: no org_id available (JWT has none, and no organizationId was supplied) — skipping project binding.");
         return;
     }
-    const detected = detectProjectBinding(cwd);
+    let detected = detectProjectBinding(cwd);
     if (detected?.binding.workosOrgId === jwtOrgId) {
         console.log(`✓ Project binding verified: ${detected.filePath}`);
         return;
     }
     if (detected?.binding.workosOrgId && detected.binding.workosOrgId !== jwtOrgId) {
-        console.error("");
-        console.error("[zivis] ERROR: Project binding org mismatches JWT org.");
-        console.error(`[zivis]   Binding file: ${detected.filePath}`);
-        console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
-        console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
-        console.error("[zivis] This should not happen — investigate before proceeding.");
-        process.exit(1);
+        if (!opts.force) {
+            console.error("");
+            console.error("[zivis] ERROR: Project binding org mismatches JWT org.");
+            console.error(`[zivis]   Binding file: ${detected.filePath}`);
+            console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+            console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
+            console.error("[zivis] This should not happen — investigate before proceeding.");
+            process.exit(1);
+        }
+        const oldLabel = detected.binding.orgName ?? detected.binding.workosOrgId;
+        console.log(`  Replacing existing binding (was: ${oldLabel})`);
+        fs.unlinkSync(detected.filePath);
+        detected = null;
     }
     let orgInfo;
     try {
@@ -93,4 +99,3 @@ export async function ensureProjectBinding(opts) {
     console.log(`  File: ${bindingPath}`);
     console.log("  Commit this file so future sessions in this repo are org-locked.");
 }
-//# sourceMappingURL=project-binding.js.map

package/dist/internal/resolve-init-session.d.ts

@@ -0,0 +1,8 @@
+import { type ZivisConfig } from "@zivis/mcp/types";
+export interface ExistingSessionAuth {
+    accessToken: string;
+    idToken?: string;
+    organizationId?: string;
+    email?: string;
+}
+export declare function resolveExistingSessionAuth(config: ZivisConfig, session: string, cwd: string): Promise<ExistingSessionAuth | null>;

package/dist/internal/resolve-init-session.js

@@ -0,0 +1,36 @@
+import { loadTokens, loadSessionIndex, resolveAuth } from "@zivis/mcp/auth";
+import { getValidAccessToken } from "@zivis/mcp/auth/token-refresh";
+import { credentialStorageFromConfig } from "@zivis/mcp/types";
+import { detectProjectBinding } from "@zivis/mcp/project-binding";
+import { fetchUserOrgs } from "./orgs.js";
+export async function resolveExistingSessionAuth(config, session, cwd) {
+    const sessionConfig = { ...config, session };
+    const oauthAccessToken = await getValidAccessToken(sessionConfig);
+    if (oauthAccessToken) {
+        const stored = await loadTokens(session, credentialStorageFromConfig(config));
+        return { accessToken: oauthAccessToken, idToken: stored?.id_token };
+    }
+    const creds = await resolveAuth(sessionConfig, "apikey");
+    if (creds.method !== "apikey" || !creds.apiKey)
+        return null;
+    const binding = detectProjectBinding(cwd);
+    const workosOrgId = binding?.binding.workosOrgId;
+    if (!workosOrgId)
+        return null;
+    let orgs;
+    try {
+        orgs = await fetchUserOrgs(config, creds.apiKey);
+    }
+    catch {
+        return null;
+    }
+    if (!orgs.some((o) => o.workosOrgId === workosOrgId)) {
+        return null;
+    }
+    const index = await loadSessionIndex(credentialStorageFromConfig(config));
+    return {
+        accessToken: creds.apiKey,
+        organizationId: workosOrgId,
+        email: index[session]?.email,
+    };
+}

package/dist/internal/run-workdir.d.ts

@@ -0,0 +1,2 @@
+export declare function writeRunWorkFile(cwd: string, runId: string, filename: string, data: unknown): string;
+export declare function writeRunWorkTextFile(cwd: string, runId: string, filename: string, text: string): string;

package/dist/internal/run-workdir.js

@@ -0,0 +1,19 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { ensureZivisGitignore } from "./zivis-local-state.js";
+export function writeRunWorkFile(cwd, runId, filename, data) {
+    ensureZivisGitignore(cwd);
+    const dir = path.join(cwd, ".zivis", "work", runId);
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = path.join(dir, filename);
+    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+    return filePath;
+}
+export function writeRunWorkTextFile(cwd, runId, filename, text) {
+    ensureZivisGitignore(cwd);
+    const dir = path.join(cwd, ".zivis", "work", runId);
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = path.join(dir, filename);
+    fs.writeFileSync(filePath, text);
+    return filePath;
+}

package/dist/internal/security-context.d.ts

@@ -0,0 +1,63 @@
+export interface SecurityContextFinding {
+    id: string;
+    title: string;
+    severity: string;
+    status: string;
+    owaspId: string | null;
+    sourceSubtype: string;
+    resourceId: string | null;
+    firstDetectedAt: string;
+    dispositionAt?: string | null;
+    dispositionRef?: string | null;
+}
+export interface SecurityContext {
+    application: {
+        id: string;
+        name: string;
+    };
+    repo: {
+        repoFullName: string;
+        defaultBranch: string | null;
+        latestKnownCommitSha: string | null;
+        revisionSyncedAt: string | null;
+    } | null;
+    lastTestedGitSha: string | null;
+    lastThreatModeledGitSha: string | null;
+    openFindings: {
+        total: number;
+        truncated: boolean;
+        items: SecurityContextFinding[];
+    };
+    findingsAwaitingRetest: {
+        total: number;
+        truncated: boolean;
+        items: SecurityContextFinding[];
+    };
+    inconclusiveAreas: unknown[];
+    weakOrUncoveredAreas: unknown[];
+    latestThreatModel: {
+        version: number;
+        gitCommitSha: string | null;
+        updatedAt: string;
+        methodology: string | null;
+    } | null;
+    trustRoomUrl: string | null;
+    trustRoomSource?: string | null;
+    generatedAt: string;
+    gaps: {
+        field: string;
+        reason: string;
+    }[];
+}
+export interface SecurityContextApi {
+    get<T>(path: string): Promise<T>;
+}
+export type SecurityContextOutcome = {
+    available: true;
+    context: SecurityContext;
+} | {
+    available: false;
+    reason: string;
+};
+export declare function fetchSecurityContext(client: SecurityContextApi, applicationId: string): Promise<SecurityContextOutcome>;
+export declare function renderSecurityContext(outcome: SecurityContextOutcome, format?: "human" | "json"): string;

package/dist/internal/security-context.js

@@ -0,0 +1,50 @@
+export async function fetchSecurityContext(client, applicationId) {
+    try {
+        const context = await client.get(`/api/rt/applications/${encodeURIComponent(applicationId)}/security-context`);
+        return { available: true, context };
+    }
+    catch (err) {
+        return { available: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+function summarizeFinding(f) {
+    return `  - [${f.severity}] ${f.title} (${f.id})${f.owaspId ? ` — ${f.owaspId}` : ""}`;
+}
+export function renderSecurityContext(outcome, format = "human") {
+    if (format === "json") {
+        return JSON.stringify(outcome, null, 2);
+    }
+    if (!outcome.available) {
+        return `[zivis] No connected security context available (${outcome.reason}). Continuing with local-only context.`;
+    }
+    const c = outcome.context;
+    const lines = [];
+    lines.push(`ZIVIS connected security context — ${c.application.name}`);
+    if (c.repo) {
+        lines.push(`Last known repo commit: ${c.repo.latestKnownCommitSha ?? "unknown"} (${c.repo.repoFullName})`);
+    }
+    lines.push(c.lastThreatModeledGitSha
+        ? `Last threat-modeled commit: ${c.lastThreatModeledGitSha}; compare local HEAD using git.`
+        : `No prior threat model on record for this Application.`);
+    if (c.lastTestedGitSha) {
+        lines.push(`Last tested commit: ${c.lastTestedGitSha}; compare local HEAD using git.`);
+    }
+    if (c.openFindings.total > 0) {
+        lines.push(`Prior open findings: ${c.openFindings.total}${c.openFindings.truncated ? ` (showing ${c.openFindings.items.length})` : ""}`);
+        c.openFindings.items.forEach((f) => lines.push(summarizeFinding(f)));
+    }
+    else {
+        lines.push(`No prior open findings on record.`);
+    }
+    if (c.findingsAwaitingRetest.total > 0) {
+        lines.push(`Findings claimed fixed but not yet retested: ${c.findingsAwaitingRetest.total}${c.findingsAwaitingRetest.truncated ? ` (showing ${c.findingsAwaitingRetest.items.length})` : ""}`);
+        c.findingsAwaitingRetest.items.forEach((f) => lines.push(`  - Finding ${f.id} was remediated but has not been retested.${f.dispositionRef ? ` (ref: ${f.dispositionRef})` : ""}`));
+    }
+    if (c.latestThreatModel) {
+        lines.push(`Latest threat model: v${c.latestThreatModel.version}${c.latestThreatModel.methodology ? `, methodology: ${c.latestThreatModel.methodology}` : ""}`);
+    }
+    if (c.trustRoomUrl) {
+        lines.push(`Trust Room: ${c.trustRoomUrl}`);
+    }
+    return lines.join("\n");
+}

package/dist/internal/sync-outbox.d.ts

@@ -0,0 +1,40 @@
+import type { InventorySyncInput, InventorySyncProvenance } from "./inventory-sync.js";
+interface OutboxEntryBase {
+    id: string;
+    queuedAt: string;
+    attempts: number;
+    lastError: string;
+}
+export interface InventorySyncOutboxEntry extends OutboxEntryBase {
+    kind: "inventory-sync";
+    applicationId: string;
+    input: InventorySyncInput;
+    provenance: InventorySyncProvenance;
+}
+export interface DevXRunCompleteOutboxEntry extends OutboxEntryBase {
+    kind: "devx-run-complete";
+    runId: string;
+    contractVersion: string;
+    result: unknown;
+}
+export type OutboxEntry = InventorySyncOutboxEntry | DevXRunCompleteOutboxEntry;
+export declare function writeOutboxEntry(cwd: string, params: {
+    applicationId: string;
+    input: InventorySyncInput;
+    provenance: InventorySyncProvenance;
+    error: string;
+}): string;
+export declare function writeDevXRunCompleteOutboxEntry(cwd: string, params: {
+    runId: string;
+    contractVersion: string;
+    result: unknown;
+    error: string;
+}): string;
+export interface OutboxListing {
+    filePath: string;
+    entry: OutboxEntry;
+}
+export declare function listOutboxEntries(cwd: string): OutboxListing[];
+export declare function removeOutboxEntry(filePath: string): void;
+export declare function recordOutboxRetryFailure(filePath: string, entry: OutboxEntry, error: string): void;
+export {};

package/dist/internal/sync-outbox.js

@@ -0,0 +1,66 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as crypto from "node:crypto";
+import { ensureZivisGitignore } from "./zivis-local-state.js";
+function outboxDir(cwd) {
+    return path.join(cwd, ".zivis", "outbox");
+}
+function writeEntryFile(cwd, entry) {
+    ensureZivisGitignore(cwd);
+    const dir = outboxDir(cwd);
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = path.join(dir, `${entry.queuedAt.replace(/[:.]/g, "-")}-${entry.id.slice(0, 8)}.json`);
+    fs.writeFileSync(filePath, JSON.stringify(entry, null, 2) + "\n");
+    return filePath;
+}
+export function writeOutboxEntry(cwd, params) {
+    const entry = {
+        kind: "inventory-sync",
+        id: crypto.randomUUID(),
+        applicationId: params.applicationId,
+        input: params.input,
+        provenance: params.provenance,
+        queuedAt: new Date().toISOString(),
+        attempts: 1,
+        lastError: params.error,
+    };
+    return writeEntryFile(cwd, entry);
+}
+export function writeDevXRunCompleteOutboxEntry(cwd, params) {
+    const entry = {
+        kind: "devx-run-complete",
+        id: crypto.randomUUID(),
+        runId: params.runId,
+        contractVersion: params.contractVersion,
+        result: params.result,
+        queuedAt: new Date().toISOString(),
+        attempts: 1,
+        lastError: params.error,
+    };
+    return writeEntryFile(cwd, entry);
+}
+export function listOutboxEntries(cwd) {
+    const dir = outboxDir(cwd);
+    if (!fs.existsSync(dir))
+        return [];
+    const files = fs.readdirSync(dir).filter((f) => f.endsWith(".json")).sort();
+    const listings = [];
+    for (const file of files) {
+        const filePath = path.join(dir, file);
+        try {
+            const raw = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+            const entry = (raw.kind ? raw : { ...raw, kind: "inventory-sync" });
+            listings.push({ filePath, entry });
+        }
+        catch {
+        }
+    }
+    return listings;
+}
+export function removeOutboxEntry(filePath) {
+    fs.rmSync(filePath, { force: true });
+}
+export function recordOutboxRetryFailure(filePath, entry, error) {
+    const updated = { ...entry, attempts: entry.attempts + 1, lastError: error };
+    fs.writeFileSync(filePath, JSON.stringify(updated, null, 2) + "\n");
+}