@zivis/cli 0.1.0-alpha.5 → 0.1.0-alpha.52

package/dist/commands/test/index.js

@@ -0,0 +1,198 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { ApiClient } from "@zivis/mcp/api-client";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { requireApplicationId } from "@zivis/mcp/resolve-application-id";
+import { renderSecurityContext } from "../../internal/security-context.js";
+import { startTestRun, listTestScopes, tryBuildChangeRecommendation, } from "../../internal/test-scope.js";
+import { LocalPackRegistryClient, registryDirOverride } from "../../internal/packs/registry-client.js";
+import { NpmPackRegistryClient } from "../../internal/packs/npm-registry-client.js";
+import { PackUnavailableError, PackIntegrityError, UnknownScopeError } from "../../internal/packs/types.js";
+import { jsonEnvelope, printJson, EXIT, exitCodeForError, errorMessage, failCommand } from "../../internal/cli-output.js";
+class UsageError extends Error {
+}
+function buildRegistryClient() {
+    const override = registryDirOverride();
+    if (override)
+        return new LocalPackRegistryClient(override);
+    return new NpmPackRegistryClient();
+}
+function exitCodeForTestError(err) {
+    if (err instanceof UnknownScopeError || err instanceof PackIntegrityError)
+        return EXIT.INVALID_OR_INDETERMINATE;
+    if (err instanceof PackUnavailableError)
+        return EXIT.CLOUD_UNAVAILABLE;
+    return exitCodeForError(err);
+}
+function getCliVersion() {
+    try {
+        const __dirname = path.dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../../../package.json"), "utf-8"));
+        return pkg.version;
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+export function registerTestCommand(program) {
+    program
+        .command("test [scope]")
+        .description("run a Zivis-guided AppSec review — change-aware by default once a prior run exists, full/adaptive on the first run or with --full, or targeted at a stable scope")
+        .option("--list", "list available scopes from the verified AppSec methodology pack")
+        .option("--app <id>", "Application id (defaults to the bound Application)")
+        .option("--full", "skip the change-aware recommendation and always run a full adaptive review")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (scope, opts) => {
+        const json = !!opts.json;
+        const cwd = process.cwd();
+        const config = resolveConfigFromBinding(cwd);
+        const apiClient = new ApiClient(config);
+        const registryClient = buildRegistryClient();
+        const cliVersion = getCliVersion();
+        const deps = { apiClient, registryClient };
+        if (opts.list) {
+            try {
+                const listing = await listTestScopes(registryClient, cliVersion);
+                if (json) {
+                    printJson(jsonEnvelope("test", { list: true, methodology: { pack: listing.pack, version: listing.version }, scopes: listing.scopes }));
+                }
+                else {
+                    printListHuman(listing);
+                }
+                process.exit(EXIT.OK);
+            }
+            catch (err) {
+                failCommand("test", err, json);
+            }
+            return;
+        }
+        try {
+            const resolvedApp = requireApplicationId(opts.app, cwd);
+            if (!resolvedApp.ok) {
+                throw new UsageError(resolvedApp.message);
+            }
+            let precomputedContext;
+            if (!scope && !opts.full) {
+                const changeOutcome = await tryBuildChangeRecommendation(deps, { applicationId: resolvedApp.id, cwd, cliVersion });
+                if (changeOutcome.kind === "recommendation" || changeOutcome.kind === "up-to-date" || changeOutcome.kind === "no-scope-match") {
+                    if (json) {
+                        printJson(jsonEnvelope("test", changeOutcomeToJson(changeOutcome)));
+                    }
+                    else {
+                        printChangeOutcomeHuman(changeOutcome);
+                    }
+                    process.exit(EXIT.OK);
+                }
+                precomputedContext = changeOutcome.contextOutcome;
+                if (!json && changeOutcome.kind === "sha-not-found") {
+                    console.error(`[zivis] Last-tested commit ${shortSha(changeOutcome.sha)} not found locally (shallow clone, force-push, or unrelated history?) — running a full adaptive review.`);
+                }
+            }
+            const { envelope, resolvedScope, contextOutcome } = await startTestRun(deps, {
+                applicationId: resolvedApp.id,
+                scopeId: scope,
+                cwd,
+                cliVersion,
+                precomputedContext,
+            });
+            const output = jsonEnvelope("test", { ...envelope });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                printRunHuman(envelope, resolvedScope, contextOutcome);
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            const code = err instanceof UsageError ? EXIT.INVALID_OR_INDETERMINATE : exitCodeForTestError(err);
+            const message = errorMessage(err);
+            if (json) {
+                printJson(jsonEnvelope("test", { result: "error", scope: scope ?? null, error: message }));
+            }
+            else {
+                console.error(`zivis test: ${message}`);
+                if (err instanceof UnknownScopeError) {
+                    console.error(`Run \`zivis test --list\` for descriptions.`);
+                }
+            }
+            process.exit(code);
+        }
+    });
+}
+function printListHuman(listing) {
+    const lines = [`ZIVIS AppSec methodology — ${listing.pack} v${listing.version}`, ""];
+    const idWidth = Math.max(...listing.scopes.map((s) => s.id.length), "scope".length);
+    for (const s of listing.scopes) {
+        lines.push(`  ${s.id.padEnd(idWidth)}  ${s.label} — ${s.description}`);
+    }
+    lines.push("", "Run `zivis test <scope>` for a focused review, or `zivis test` for a full adaptive review.");
+    console.log(lines.join("\n"));
+}
+function printRunHuman(envelope, resolvedScope, contextOutcome) {
+    console.log(`zivis test: started run ${envelope.run_id}${resolvedScope ? ` (scope: ${resolvedScope.id})` : " (full adaptive review)"}`);
+    console.log(renderSecurityContext(contextOutcome, "human"));
+    console.log(`\nMethodology: ${envelope.methodology.path}`);
+    if (envelope.methodology.scope) {
+        console.log(`Focused scope guidance: ${envelope.methodology.scope.path}`);
+    }
+    console.log(`\nWhen finished: ${envelope.result_contract.complete_command}`);
+}
+function shortSha(sha) {
+    return sha.slice(0, 8);
+}
+function joinWithAnd(items) {
+    if (items.length <= 1)
+        return items[0] ?? "";
+    if (items.length === 2)
+        return `${items[0]} and ${items[1]}`;
+    return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+}
+function filesLabel(count) {
+    return `${count} file${count === 1 ? "" : "s"}`;
+}
+function printChangeOutcomeHuman(outcome) {
+    switch (outcome.kind) {
+        case "up-to-date":
+            console.log(`zivis test: no files changed since last-tested commit ${shortSha(outcome.sha)}. Nothing to recommend.`);
+            console.log(`Run \`zivis test --full\` for a full adaptive review anyway, or \`zivis test <scope>\` for a specific one.`);
+            return;
+        case "no-scope-match":
+            console.log(`${filesLabel(outcome.changedFileCount)} changed since ${shortSha(outcome.sha)}, but none map to a known methodology scope.`);
+            console.log(`Run \`zivis test --full\` for a full adaptive review, \`zivis test <scope>\` for a specific one, or \`zivis test --list\` to see all scopes.`);
+            return;
+        case "recommendation": {
+            const { sha, changedFileCount, scopes, testIds } = outcome;
+            console.log(`${filesLabel(changedFileCount)} changed since ${shortSha(sha)}.`);
+            console.log(`Changes touch ${joinWithAnd(scopes.map((s) => s.label))}.`);
+            console.log("");
+            console.log("Recommended:");
+            for (const s of scopes)
+                console.log(`  zivis test ${s.id}`);
+            if (testIds.length > 0) {
+                console.log("");
+                console.log(`${testIds.join(", ")} ${testIds.length === 1 ? "is" : "are"} especially relevant.`);
+            }
+            console.log("");
+            console.log(`Run \`zivis test --full\` for a full adaptive review instead.`);
+            return;
+        }
+    }
+}
+function changeOutcomeToJson(outcome) {
+    switch (outcome.kind) {
+        case "up-to-date":
+            return { result: "up_to_date", since: outcome.sha };
+        case "no-scope-match":
+            return { result: "no_scope_match", since: outcome.sha, changed_file_count: outcome.changedFileCount };
+        case "recommendation":
+            return {
+                result: "recommendation",
+                since: outcome.sha,
+                changed_file_count: outcome.changedFileCount,
+                scopes: outcome.scopes,
+                test_ids: outcome.testIds,
+            };
+    }
+}

package/dist/commands/threatmodel/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerThreatmodelCommand(program: Command): void;

package/dist/commands/threatmodel/index.js

@@ -0,0 +1,167 @@
+import * as fs from "node:fs/promises";
+import * as fsSync from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { ApiClient } from "@zivis/mcp/api-client";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { requireApplicationId } from "@zivis/mcp/resolve-application-id";
+import { renderSecurityContext } from "../../internal/security-context.js";
+import { startThreatModelRun, syncThreatModel, } from "../../internal/threatmodel-run.js";
+import { LocalPackRegistryClient, registryDirOverride } from "../../internal/packs/registry-client.js";
+import { NpmPackRegistryClient } from "../../internal/packs/npm-registry-client.js";
+import { PackUnavailableError, PackIntegrityError } from "../../internal/packs/types.js";
+import { jsonEnvelope, printJson, EXIT, exitCodeForError, errorMessage, failCommand } from "../../internal/cli-output.js";
+class UsageError extends Error {
+}
+function buildRegistryClient() {
+    const override = registryDirOverride();
+    if (override)
+        return new LocalPackRegistryClient(override);
+    return new NpmPackRegistryClient();
+}
+function exitCodeForThreatModelError(err) {
+    if (err instanceof PackIntegrityError)
+        return EXIT.INVALID_OR_INDETERMINATE;
+    if (err instanceof PackUnavailableError)
+        return EXIT.CLOUD_UNAVAILABLE;
+    return exitCodeForError(err);
+}
+async function readMarkdownInput(inputArg) {
+    if (inputArg === "-")
+        return readStdin();
+    const content = await fs.readFile(inputArg, "utf-8");
+    if (content.trim().length === 0) {
+        throw new UsageError(`--input file "${inputArg}" is empty.`);
+    }
+    return content;
+}
+async function readStdin() {
+    let data = "";
+    process.stdin.setEncoding("utf-8");
+    for await (const chunk of process.stdin) {
+        data += chunk;
+    }
+    if (data.trim().length === 0) {
+        throw new UsageError("--input - read no content from stdin.");
+    }
+    return data;
+}
+export function registerThreatmodelCommand(program) {
+    const threatmodel = program
+        .command("threatmodel")
+        .description("start (or continue) a Zivis-guided living threat model for the bound Application")
+        .option("--app <id>", "Application id (defaults to the bound Application)")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (opts) => {
+        const json = !!opts.json;
+        const cwd = process.cwd();
+        const config = resolveConfigFromBinding(cwd);
+        const apiClient = new ApiClient(config);
+        const registryClient = buildRegistryClient();
+        const cliVersion = getCliVersion();
+        try {
+            const resolvedApp = requireApplicationId(opts.app, cwd);
+            if (!resolvedApp.ok) {
+                throw new UsageError(resolvedApp.message);
+            }
+            const { envelope, contextOutcome } = await startThreatModelRun({ apiClient, registryClient }, { applicationId: resolvedApp.id, cwd, cliVersion });
+            const output = jsonEnvelope("threatmodel", { ...envelope });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                printStartHuman(envelope, contextOutcome);
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            const code = err instanceof UsageError ? EXIT.INVALID_OR_INDETERMINATE : exitCodeForThreatModelError(err);
+            const message = errorMessage(err);
+            if (json) {
+                printJson(jsonEnvelope("threatmodel", { result: "error", error: message }));
+            }
+            else {
+                console.error(`zivis threatmodel: ${message}`);
+            }
+            process.exit(code);
+        }
+    });
+    threatmodel
+        .command("sync")
+        .description("persist the finished Markdown threat model as a new Artifact revision and complete the run")
+        .requiredOption("--input <path>", "path to the finished Markdown threat model, or '-' for stdin")
+        .option("--run <runId>", "override the auto-resolved active threatmodel run")
+        .option("--change-note <text>", "optional human-readable summary of what changed")
+        .option("--app <id>", "Application id (defaults to the bound Application)")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (opts) => {
+        const json = !!opts.json;
+        const cwd = process.cwd();
+        let content;
+        try {
+            content = await readMarkdownInput(opts.input);
+        }
+        catch (err) {
+            failCommand("threatmodel sync", err, json);
+        }
+        const config = resolveConfigFromBinding(cwd);
+        const apiClient = new ApiClient(config);
+        const registryClient = buildRegistryClient();
+        try {
+            const resolvedApp = requireApplicationId(opts.app, cwd);
+            if (!resolvedApp.ok) {
+                throw new UsageError(resolvedApp.message);
+            }
+            const result = await syncThreatModel({ apiClient, registryClient }, { applicationId: resolvedApp.id, runId: opts.run, cwd, content, changeNote: opts.changeNote });
+            const output = jsonEnvelope("threatmodel sync", {
+                run_id: result.runId,
+                run_outcome: result.runOutcome,
+                evidence_id: result.evidenceId,
+                version: result.version,
+                unchanged: result.unchanged,
+            });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                console.log(result.unchanged
+                    ? `zivis threatmodel sync: no change (content identical to revision ${result.version}); run ${result.runId} ${result.runOutcome}.`
+                    : `zivis threatmodel sync: created revision ${result.version} (evidence ${result.evidenceId}); run ${result.runId} ${result.runOutcome}.`);
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            const code = err instanceof UsageError ? EXIT.INVALID_OR_INDETERMINATE : exitCodeForThreatModelError(err);
+            const message = errorMessage(err);
+            if (json) {
+                printJson(jsonEnvelope("threatmodel sync", { result: "error", error: message }));
+            }
+            else {
+                console.error(`zivis threatmodel sync: ${message}`);
+            }
+            process.exit(code);
+        }
+    });
+}
+function getCliVersion() {
+    try {
+        const __dirname = path.dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(fsSync.readFileSync(path.join(__dirname, "../../../package.json"), "utf-8"));
+        return pkg.version;
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function printStartHuman(envelope, contextOutcome) {
+    console.log(`zivis threatmodel: started run ${envelope.run_id}`);
+    console.log(renderSecurityContext(contextOutcome, "human"));
+    console.log(`\nMethodology: ${envelope.methodology.path}`);
+    if (envelope.prior_model?.exists) {
+        console.log(`Prior model: ${envelope.prior_model.path} (revision ${envelope.prior_model.version}, last modeled at ${envelope.prior_model.git_commit_sha ?? "unknown"})`);
+    }
+    else {
+        console.log("Prior model: none on record — this will be the first threat model for this Application.");
+    }
+    console.log(`\nWhen finished: ${envelope.result_contract.complete_command}`);
+}

package/dist/index.js

@@ -4,13 +4,22 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { registerAuthCommands } from "./commands/auth/index.js";
+import { initCommand as authInitCommand } from "./commands/auth/init.js";
 import { registerAppCommands } from "./commands/app/index.js";
 import { registerTargetCommands } from "./commands/target/index.js";
-import { registerTmCommands } from "./commands/tm/index.js";
 import { registerScanCommands } from "./commands/scan/index.js";
+import { registerCheckCommands } from "./commands/check/index.js";
+import { registerInspectCommands } from "./commands/inspect/index.js";
 import { registerMcpCommands } from "./commands/mcp/index.js";
 import { registerCreditsCommands } from "./commands/credits/index.js";
 import { registerOpenCommands } from "./commands/open/index.js";
+import { registerSyncCommands } from "./commands/sync/index.js";
+import { registerAssuranceCommands } from "./commands/assurance/index.js";
+import { registerShareCommands } from "./commands/share/index.js";
+import { registerGateCommand } from "./commands/gate/index.js";
+import { registerRunCommands } from "./commands/run/index.js";
+import { registerTestCommand } from "./commands/test/index.js";
+import { registerThreatmodelCommand } from "./commands/threatmodel/index.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 function getVersion() {
     try {
@@ -26,16 +35,32 @@ program
     .name("zivis")
     .description("ZIVIS CLI — threat modeling, scans, and MCP server")
     .version(getVersion(), "-v, --version", "show version");
+program
+    .command("init")
+    .description("interactive setup: authenticate, pick org, and bind this repo (alias for `zivis auth init`)")
+    .option("-s, --session <name>", "named session for multi-tenant")
+    .option("--skip-mint-key", "skip MCP API key mint after successful OAuth")
+    .option("--application <name-or-id>", "select an existing Application by id or exact name (fails if not found — never creates one)")
+    .action(async (opts) => {
+    await authInitCommand(opts);
+});
 registerAuthCommands(program);
+registerCheckCommands(program);
 registerAppCommands(program);
 registerTargetCommands(program);
-registerTmCommands(program);
 registerScanCommands(program);
+registerInspectCommands(program);
 registerMcpCommands(program);
 registerCreditsCommands(program);
 registerOpenCommands(program);
+registerSyncCommands(program);
+registerAssuranceCommands(program);
+registerShareCommands(program);
+registerGateCommand(program);
+registerRunCommands(program);
+registerTestCommand(program);
+registerThreatmodelCommand(program);
 program.parseAsync(process.argv).catch((err) => {
     console.error(err instanceof Error ? err.message : err);
     process.exit(1);
 });
-//# sourceMappingURL=index.js.map

package/dist/internal/application-binding.d.ts

@@ -0,0 +1,8 @@
+import type { ZivisConfig } from "@zivis/mcp/types";
+export interface EnsureApplicationBindingOpts {
+    config: ZivisConfig;
+    accessToken: string;
+    cwd: string;
+    explicitApplication?: string;
+}
+export declare function ensureApplicationBinding(opts: EnsureApplicationBindingOpts): Promise<void>;

package/dist/internal/application-binding.js

@@ -0,0 +1,167 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as readline from "node:readline/promises";
+import * as child_process from "node:child_process";
+import { detectProjectBinding } from "@zivis/mcp/project-binding";
+async function apiFetch(config, accessToken, method, path, body) {
+    const response = await fetch(`${config.apiBaseUrl}${path}`, {
+        method,
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+            "User-Agent": "@zivis/cli",
+        },
+        ...(body ? { body: JSON.stringify(body) } : {}),
+    });
+    if (!response.ok) {
+        const errorBody = (await response.json().catch(() => ({})));
+        throw new Error(errorBody.message || errorBody.error || `HTTP ${response.status}`);
+    }
+    return (await response.json());
+}
+async function fetchApplications(config, accessToken) {
+    const result = await apiFetch(config, accessToken, "GET", "/api/rt/applications?limit=100");
+    return result.applications;
+}
+async function createApplication(config, accessToken, name) {
+    const result = await apiFetch(config, accessToken, "POST", "/api/rt/applications", { name, placeholder: true });
+    return result.application;
+}
+function defaultApplicationName(cwd) {
+    try {
+        const remote = child_process
+            .execSync("git remote get-url origin 2>/dev/null", { cwd, encoding: "utf8" })
+            .trim();
+        const match = remote.match(/\/([^/]+?)(\.git)?$/);
+        if (match?.[1])
+            return match[1];
+    }
+    catch {
+    }
+    return path.basename(cwd);
+}
+async function prompt(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return (await rl.question(question)).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+async function promptForApplicationName(defaultName) {
+    const answer = await prompt(`Application name [${defaultName}]: `);
+    return answer || defaultName;
+}
+const NON_INTERACTIVE_HELP = "Pass --application <name-or-id> to select an existing one non-interactively " +
+    "(it will not create one), or set applicationId manually in .zivis/project.json.";
+export async function ensureApplicationBinding(opts) {
+    const { config, accessToken, cwd, explicitApplication } = opts;
+    const detected = detectProjectBinding(cwd);
+    if (!detected)
+        return;
+    if (detected.binding.applicationId) {
+        console.log(`✓ Application binding verified: ${detected.binding.applicationName ?? detected.binding.applicationId}`);
+        return;
+    }
+    let apps;
+    try {
+        apps = await fetchApplications(config, accessToken);
+    }
+    catch (err) {
+        console.log(`  WARNING: Could not list applications: ${err instanceof Error ? err.message : err}`);
+        console.log("  Skipping application binding — set applicationId manually in .zivis/project.json.");
+        return;
+    }
+    const interactive = process.stderr.isTTY === true && process.stdin.isTTY === true;
+    let selected;
+    if (explicitApplication) {
+        const byId = apps.find((a) => a.id === explicitApplication);
+        const byName = byId
+            ? []
+            : apps.filter((a) => a.name.toLowerCase() === explicitApplication.toLowerCase());
+        if (byId) {
+            selected = byId;
+            console.log(`\nUsing existing application: ${selected.name}`);
+        }
+        else if (byName.length > 1) {
+            console.log(`\n  AMBIGUOUS: ${byName.length} applications named "${explicitApplication}" found — ` +
+                `refusing to guess which one you mean.`);
+            for (const a of byName)
+                console.log(`    ${a.id}  ${a.name}`);
+            console.log("  Use the Application ID instead of the name, or run `zivis init` interactively.");
+            return;
+        }
+        else if (byName.length === 1) {
+            selected = byName[0];
+            console.log(`\nUsing existing application: ${selected.name}`);
+        }
+        else {
+            console.log(`\n  NOT FOUND: no application matches id or name "${explicitApplication}".`);
+            console.log("  --application selects an EXISTING application — it does not create one.");
+            console.log("  Check the id/name (`zivis app list`), or run `zivis init` interactively to create a new one.");
+            return;
+        }
+    }
+    else if (apps.length === 0) {
+        if (!interactive) {
+            console.log("\n  WARNING: No applications found and no TTY to prompt — skipping application binding.");
+            console.log(`  ${NON_INTERACTIVE_HELP}`);
+            return;
+        }
+        console.log("\nNo applications found in this org — let's create one.");
+        const name = await promptForApplicationName(defaultApplicationName(cwd));
+        try {
+            selected = await createApplication(config, accessToken, name);
+        }
+        catch (err) {
+            console.log(`  WARNING: Could not create application: ${err instanceof Error ? err.message : err}`);
+            return;
+        }
+        console.log(`✓ Created application ${selected.name} (${selected.id})`);
+    }
+    else if (!interactive) {
+        console.log(`\n  WARNING: ${apps.length} application(s) found and no TTY to prompt — skipping application binding.`);
+        console.log("  Never auto-selecting the sole application without explicit confirmation.");
+        console.log(`  ${NON_INTERACTIVE_HELP}`);
+        return;
+    }
+    else {
+        console.log("\nWhich application are you working on?");
+        apps.forEach((a, i) => console.log(`  ${i + 1}. ${a.name}`));
+        console.log(`  ${apps.length + 1}. Create a new application`);
+        const answer = await prompt(`\n> `);
+        const idx = parseInt(answer, 10) - 1;
+        if (idx === apps.length) {
+            const name = await promptForApplicationName(defaultApplicationName(cwd));
+            try {
+                selected = await createApplication(config, accessToken, name);
+            }
+            catch (err) {
+                console.log(`  WARNING: Could not create application: ${err instanceof Error ? err.message : err}`);
+                return;
+            }
+            console.log(`✓ Created application ${selected.name} (${selected.id})`);
+        }
+        else if (!Number.isNaN(idx) && idx >= 0 && idx < apps.length) {
+            selected = apps[idx];
+        }
+        else {
+            console.log("  Invalid selection — skipping application binding. Set applicationId manually in .zivis/project.json.");
+            return;
+        }
+    }
+    if (!selected)
+        return;
+    const current = detectProjectBinding(cwd);
+    if (!current)
+        return;
+    const updated = {
+        ...current.binding,
+        applicationId: selected.id,
+        applicationName: selected.name,
+    };
+    fs.writeFileSync(current.filePath, JSON.stringify(updated, null, 2) + "\n");
+    console.log(`✓ Repo bound to application: ${selected.name}`);
+    console.log(`  File: ${current.filePath}`);
+}

package/dist/internal/binding-token-mint.d.ts

@@ -0,0 +1,33 @@
+import { type ZivisConfig } from "@zivis/mcp/types";
+export type MintBindingTokenResult = {
+    ok: true;
+    keyName: string;
+    key: string;
+    orgName: string;
+    workosOrgId: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function mintLocalProjectBindingToken(params: {
+    config: ZivisConfig;
+    session: string;
+    accessToken: string;
+    cwd: string;
+}): Promise<MintBindingTokenResult>;
+export interface TryAutoMintOptions {
+    cwd: string;
+    sessionName: string;
+    accessToken: string;
+    skip?: boolean;
+    warnOnFailure: boolean;
+}
+export declare function tryAutoMintBindingTokenAfterLogin(opts: TryAutoMintOptions): Promise<{
+    ran: boolean;
+    ok: boolean;
+    message?: string;
+}>;
+export declare function discardOauthAfterLogin(params: {
+    session: string | undefined;
+    config: ZivisConfig;
+}): Promise<void>;