@zivis/mcp 0.1.0-alpha.1

package/dist/auth/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/auth/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,kFAAkF;AAClF,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,GAAG,cAAc,IAAI,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,cAAc;IACrB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,uBAAuB;AAEvB,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,KAAa;IAEb,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB;YACzB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,MAAM,aAAa,CAAC,UAAU,EAAE;QAC9B,sBAAsB;QACtB,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;YACjD,uBAAuB;YACvB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB;YACzB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,KAAa;IAEb,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,EAAE;QACzC,OAAO;QACP,SAAS;QACT,aAAa,OAAO,EAAE;QACtB,SAAS;QACT,cAAc;QACd,SAAS;QACT,OAAO;KACR,CAAC,CAAC;IACH,qCAAqC;IACrC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACzB,MAAM,KAAK,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE;YACpD,QAAQ;YACR,SAAS;YACT,cAAc;YACd,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,aAAa,EAAE;YACjC,OAAO;YACP,SAAS;YACT,cAAc;YACd,SAAS;YACT,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,SAAS,SAAS;IAChB,mDAAmD;IACnD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;IACpE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAAe,EACf,KAAa;IAEb,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,8DAA8D;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAU,EAAE,EAAS,CAAC,CAAC;IAC3E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAEzE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAe;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,GAAU,EACV,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAQ,CAC9B,CAAC;QACF,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACrD,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAe;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,sCAAsC;AAEtC,KAAK,UAAU,mBAAmB;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,GAAmB,IAAI,CAAC;AAE7C,KAAK,UAAU,WAAW;IACxB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,iBAAiB,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,mBAAmB;AAEnB,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,KAAa;IAEb,kFAAkF;IAClF,gFAAgF;IAChF,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEhC,6CAA6C;IAC7C,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe;IAEf,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe;IAEf,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAgB;IACzD,MAAM,cAAc,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAC1D,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,38 @@
+/**
+ * OAuth PKCE Authentication Flow
+ *
+ * Authorization Code Flow with Proof Key for Code Exchange (PKCE)
+ * for native/CLI applications. Uses WorkOS as the identity provider.
+ *
+ * Flow:
+ * 1. Generate PKCE code_verifier + code_challenge
+ * 2. Start localhost callback server
+ * 3. Open browser to WorkOS authorization URL
+ * 4. Receive authorization code via callback
+ * 5. Exchange code + verifier for tokens
+ * 6. Store tokens in OS keychain
+ */
+import type { OAuthTokens, ZivisConfig } from "../types.js";
+/**
+ * Run the full OAuth PKCE login flow.
+ *
+ * 1. Generate PKCE pair + state
+ * 2. Start localhost callback server
+ * 3. Open browser to WorkOS
+ * 4. Wait for callback
+ * 5. Exchange code for tokens
+ * 6. Store tokens in keychain (under session-qualified key)
+ *
+ * @param config - Server configuration
+ * @param session - Optional named session for multi-tenant isolation
+ * @param organizationId - Optional WorkOS org ID to scope the login to a specific org
+ * @param opts - Display and confirmation options
+ * @returns The OAuth tokens
+ */
+export interface LoginOptions {
+    /** Human-readable org name, shown in the pre-browser confirmation prompt. */
+    orgName?: string;
+    /** Skip the pre-browser confirmation prompt (for scripted/interactive-wizard callers). */
+    skipConfirm?: boolean;
+}
+export declare function login(config?: ZivisConfig, session?: string, organizationId?: string, opts?: LoginOptions): Promise<OAuthTokens>;

package/dist/auth/oauth.js

@@ -0,0 +1,241 @@
+/**
+ * OAuth PKCE Authentication Flow
+ *
+ * Authorization Code Flow with Proof Key for Code Exchange (PKCE)
+ * for native/CLI applications. Uses WorkOS as the identity provider.
+ *
+ * Flow:
+ * 1. Generate PKCE code_verifier + code_challenge
+ * 2. Start localhost callback server
+ * 3. Open browser to WorkOS authorization URL
+ * 4. Receive authorization code via callback
+ * 5. Exchange code + verifier for tokens
+ * 6. Store tokens in OS keychain
+ */
+import * as crypto from "node:crypto";
+import * as http from "node:http";
+import * as readline from "node:readline/promises";
+import { URL } from "node:url";
+import open from "open";
+import { keychainStore, getSessionAccount } from "./keychain.js";
+import { decodeJwtPayload } from "./jwt.js";
+import { DEFAULT_CONFIG } from "../types.js";
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+function generatePKCE() {
+    const verifier = crypto.randomBytes(32).toString("base64url");
+    const challenge = crypto
+        .createHash("sha256")
+        .update(verifier)
+        .digest("base64url");
+    return { verifier, challenge };
+}
+function generateState() {
+    return crypto.randomBytes(16).toString("hex");
+}
+function buildAuthUrl(config, codeChallenge, state, organizationId) {
+    const params = new URLSearchParams({
+        response_type: "code",
+        client_id: config.oauthClientId,
+        redirect_uri: `http://localhost:${config.callbackPort}/callback`,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+        state,
+        scope: "openid profile email offline_access",
+    });
+    // Scope the OAuth session to a specific org so the JWT has the correct org_id
+    if (organizationId) {
+        params.set("organization_id", organizationId);
+    }
+    // Force the WorkOS login screen even when an active session exists.
+    // Why: users in multiple orgs must visually confirm which identity/org they're using —
+    // silent SSO could let them accidentally bind the wrong org to a project.
+    params.set("prompt", "login");
+    // Handle both WorkOS (auth.workos.com -> /authorize) and custom AuthKit (authkit.app -> /oauth2/authorize)
+    const isAuthKit = config.oauthApiUrl.includes("authkit.app");
+    const authPath = isAuthKit ? "/oauth2/authorize" : "/authorize";
+    const authUrl = `${config.oauthApiUrl}${authPath}?${params.toString()}`;
+    // We used to chain custom AuthKit hosts through /logout?return_to=... so
+    // browser cookies did not override organization_id. AuthKit OIDC metadata
+    // does not advertise end_session_endpoint, and *.authkit.app/logout returns
+    // 404 — so that redirect is unusable. Rely on prompt=login plus
+    // organization_id for org-scoped flows instead.
+    return authUrl;
+}
+/**
+ * Start a localhost HTTP server to receive the OAuth callback.
+ * Returns the authorization code on success.
+ */
+function startCallbackServer(port, expectedState) {
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            const parsedUrl = new URL(req.url || "/", `http://localhost:${port}`);
+            if (parsedUrl.pathname === "/callback") {
+                const code = parsedUrl.searchParams.get("code");
+                const state = parsedUrl.searchParams.get("state");
+                const error = parsedUrl.searchParams.get("error");
+                const errorDesc = parsedUrl.searchParams.get("error_description");
+                res.writeHead(200, { "Content-Type": "text/html" });
+                if (error) {
+                    res.end(callbackHtml(false, errorDesc || error));
+                    server.close();
+                    reject(new Error(errorDesc || error));
+                    return;
+                }
+                if (state !== expectedState) {
+                    res.end(callbackHtml(false, "State mismatch — possible CSRF attack"));
+                    server.close();
+                    reject(new Error("State mismatch"));
+                    return;
+                }
+                if (!code) {
+                    res.end(callbackHtml(false, "No authorization code received"));
+                    server.close();
+                    reject(new Error("No authorization code"));
+                    return;
+                }
+                res.end(callbackHtml(true));
+                server.close();
+                resolve(code);
+            }
+            else {
+                // 404 for any other path
+                res.writeHead(404, { "Content-Type": "text/html" });
+                res.end(`<!DOCTYPE html>
+<html>
+<head><title>Not Found</title></head>
+<body style="font-family:system-ui;text-align:center;padding:50px;background:#0f0f1a;color:#fff;">
+  <h1>404 - Not Found</h1>
+  <p>Expected callback at /callback, got ${parsedUrl.pathname}</p>
+</body>
+</html>`);
+            }
+        });
+        server.on("error", (err) => {
+            reject(new Error(`Failed to start callback server on port ${port}: ${err.message}`));
+        });
+        server.listen(port, "127.0.0.1");
+        // Timeout
+        setTimeout(() => {
+            server.close();
+            reject(new Error("Authentication timed out after 5 minutes"));
+        }, LOGIN_TIMEOUT_MS);
+    });
+}
+function callbackHtml(success, errorMessage) {
+    if (success) {
+        return `<!DOCTYPE html>
+<html>
+<head><title>Authentication Successful</title></head>
+<body style="font-family:system-ui;text-align:center;padding:50px;background:#0f0f1a;color:#fff;">
+  <h1 style="color:#00d4aa;">Authentication Successful!</h1>
+  <p>You can close this window and return to your IDE.</p>
+  <script>window.close();</script>
+</body>
+</html>`;
+    }
+    return `<!DOCTYPE html>
+<html>
+<head><title>Authentication Failed</title></head>
+<body style="font-family:system-ui;text-align:center;padding:50px;background:#0f0f1a;color:#fff;">
+  <h1 style="color:#ff5252;">Authentication Failed</h1>
+  <p>${errorMessage || "Unknown error"}</p>
+  <p>You can close this window.</p>
+</body>
+</html>`;
+}
+/**
+ * Exchange authorization code for tokens via WorkOS token endpoint
+ */
+async function exchangeCodeForTokens(config, code, codeVerifier) {
+    // Handle both WorkOS (auth.workos.com -> /oauth/token) and custom AuthKit (authkit.app -> /oauth2/token)
+    const tokenPath = config.oauthApiUrl.includes("authkit.app") ? "/oauth2/token" : "/oauth/token";
+    const tokenUrl = `${config.oauthApiUrl}${tokenPath}`;
+    const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            grant_type: "authorization_code",
+            client_id: config.oauthClientId,
+            code,
+            code_verifier: codeVerifier,
+            redirect_uri: `http://localhost:${config.callbackPort}/callback`,
+        }),
+    });
+    if (!response.ok) {
+        const error = (await response.json().catch(() => ({})));
+        const errorMsg = error.error_description || error.error || "Token exchange failed";
+        console.error(`[zivis] Token exchange error (${response.status}):`, errorMsg);
+        console.error(`[zivis] Full response:`, JSON.stringify(error));
+        throw new Error(errorMsg);
+    }
+    const data = (await response.json());
+    return {
+        access_token: data.access_token,
+        refresh_token: data.refresh_token,
+        expires_at: Date.now() + data.expires_in * 1000,
+        id_token: data.id_token,
+    };
+}
+export async function login(config = DEFAULT_CONFIG, session, organizationId, opts = {}) {
+    if (!config.oauthClientId) {
+        throw new Error("OAuth client ID not configured. Set ZIVIS_OAUTH_CLIENT_ID environment variable or contact support.");
+    }
+    const { verifier, challenge } = generatePKCE();
+    const state = generateState();
+    const authUrl = buildAuthUrl(config, challenge, state, organizationId);
+    // Pre-browser confirmation: only when an org is scoped AND the terminal is interactive.
+    // Protects users in multiple orgs from accidentally authenticating to the wrong tenant.
+    if (organizationId && !opts.skipConfirm && process.stderr.isTTY && process.stdin.isTTY) {
+        const orgLabel = opts.orgName
+            ? `${opts.orgName} (${organizationId})`
+            : organizationId;
+        const sessionLabel = session ? ` as session "${session}"` : "";
+        console.error("");
+        console.error(`[zivis] About to authenticate to org: ${orgLabel}${sessionLabel}`);
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+        });
+        try {
+            const answer = (await rl.question("[zivis] Continue? [Y/n] ")).trim().toLowerCase();
+            if (answer === "n" || answer === "no") {
+                throw new Error("Login cancelled by user");
+            }
+        }
+        finally {
+            rl.close();
+        }
+    }
+    else if (organizationId) {
+        console.error(`[zivis] Login scoped to organization: ${organizationId}`);
+    }
+    // Start callback server before opening browser
+    const codePromise = startCallbackServer(config.callbackPort, state);
+    console.error("[zivis] Opening browser for authentication...");
+    await open(authUrl);
+    console.error("[zivis] Waiting for login...");
+    // Wait for the authorization code
+    const code = await codePromise;
+    // Exchange code for tokens
+    const tokens = await exchangeCodeForTokens(config, code, verifier);
+    // Hard verification: if we requested a specific org, the returned JWT
+    // MUST be scoped to that org. Refuse to store mismatched tokens — this is
+    // the last-ditch guard against silently binding the wrong tenant.
+    if (organizationId) {
+        const claims = decodeJwtPayload(tokens.access_token);
+        const jwtOrgId = claims?.org_id;
+        if (!jwtOrgId) {
+            throw new Error("JWT has no org_id claim — refusing to store credentials. " +
+                "This may indicate a misconfigured OAuth client.");
+        }
+        if (jwtOrgId !== organizationId) {
+            throw new Error(`JWT org mismatch: requested ${organizationId}, received ${jwtOrgId}. ` +
+                "Refusing to store credentials.");
+        }
+        console.error(`[zivis] \u2713 JWT org_id verified: ${jwtOrgId}`);
+    }
+    // Store in keychain (session-qualified key for multi-tenant isolation)
+    await keychainStore(getSessionAccount(session), JSON.stringify(tokens));
+    return tokens;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAOpD,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CACnB,MAAmB,EACnB,aAAqB,EACrB,KAAa,EACb,cAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,aAAa;QAC/B,YAAY,EAAE,oBAAoB,MAAM,CAAC,YAAY,WAAW;QAChE,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IAEH,8EAA8E;IAC9E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAChD,CAAC;IAED,oEAAoE;IACpE,uFAAuF;IACvF,0EAA0E;IAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE9B,2GAA2G;IAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAChE,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAExE,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,gDAAgD;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,aAAqB;IAErB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAEtE,IAAI,SAAS,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClD,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAElE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBAEpD,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;oBACjD,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;oBACtC,OAAO;gBACT,CAAC;gBAED,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC5B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC,CAAC;oBACtE,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBACpC,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC,CAAC;oBAC/D,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5B,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC;;;;;2CAK2B,SAAS,CAAC,QAAQ;;QAErD,CAAC,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CACJ,IAAI,KAAK,CAAC,2CAA2C,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAC7E,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjC,UAAU;QACV,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;QAChE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB,EAAE,YAAqB;IAC3D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;;;;;;;;QAQH,CAAC;IACP,CAAC;IACD,OAAO;;;;;OAKF,YAAY,IAAI,eAAe;;;QAG9B,CAAC;AACT,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,MAAmB,EACnB,IAAY,EACZ,YAAoB;IAEpB,yGAAyG;IACzG,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IAChG,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,SAAS,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,IAAI;YACJ,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,oBAAoB,MAAM,CAAC,YAAY,WAAW;SACjE,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGrD,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,IAAI,uBAAuB,CAAC;QACnF,OAAO,CAAC,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;QAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAyBD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,SAAsB,cAAc,EACpC,OAAgB,EAChB,cAAuB,EACvB,OAAqB,EAAE;IAEvB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAEvE,wFAAwF;IACxF,wFAAwF;IACxF,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO;YAC3B,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,KAAK,cAAc,GAAG;YACvC,CAAC,CAAC,cAAc,CAAC;QACnB,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,yCAAyC,QAAQ,GAAG,YAAY,EAAE,CAAC,CAAC;QAClF,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpF,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,yCAAyC,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,+CAA+C;IAC/C,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAEpE,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE9C,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;IAE/B,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEnE,sEAAsE;IACtE,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,2DAA2D;gBAC3D,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,+BAA+B,cAAc,cAAc,QAAQ,IAAI;gBACvE,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,MAAM,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAExE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/sessions.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Session Index Management
+ *
+ * Tracks named OAuth sessions in a JSON file so users can list
+ * and manage multiple tenant sessions without enumerating keychain entries.
+ *
+ * Session index file: ~/.config/{configDir}/sessions.json
+ */
+import type { SessionIndex, SessionInfo } from "../types.js";
+/**
+ * Load the session index from disk.
+ * Returns an empty object if the file doesn't exist.
+ */
+export declare function loadSessionIndex(): Promise<SessionIndex>;
+/**
+ * Add or update a session entry in the index.
+ */
+export declare function saveSessionEntry(name: string, email: string): Promise<void>;
+/**
+ * Remove a session entry from the index.
+ */
+export declare function removeSessionEntry(name: string): Promise<void>;
+/**
+ * List all sessions with their metadata.
+ */
+export declare function listSessions(): Promise<Array<{
+    name: string;
+} & SessionInfo>>;

package/dist/auth/sessions.js

@@ -0,0 +1,69 @@
+/**
+ * Session Index Management
+ *
+ * Tracks named OAuth sessions in a JSON file so users can list
+ * and manage multiple tenant sessions without enumerating keychain entries.
+ *
+ * Session index file: ~/.config/{configDir}/sessions.json
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import { ENV_CONFIG } from "../types.js";
+function getSessionIndexPath() {
+    const configDir = ENV_CONFIG.configDir;
+    const base = process.platform === "win32"
+        ? process.env.APPDATA || os.homedir()
+        : path.join(os.homedir(), ".config");
+    return path.join(base, configDir, "sessions.json");
+}
+/**
+ * Load the session index from disk.
+ * Returns an empty object if the file doesn't exist.
+ */
+export async function loadSessionIndex() {
+    try {
+        const raw = await fs.readFile(getSessionIndexPath(), "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Save the full session index to disk.
+ */
+async function saveSessionIndex(index) {
+    const filePath = getSessionIndexPath();
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    await fs.writeFile(filePath, JSON.stringify(index, null, 2) + "\n", {
+        mode: 0o600,
+    });
+}
+/**
+ * Add or update a session entry in the index.
+ */
+export async function saveSessionEntry(name, email) {
+    const index = await loadSessionIndex();
+    index[name] = {
+        email,
+        createdAt: index[name]?.createdAt || new Date().toISOString(),
+    };
+    await saveSessionIndex(index);
+}
+/**
+ * Remove a session entry from the index.
+ */
+export async function removeSessionEntry(name) {
+    const index = await loadSessionIndex();
+    delete index[name];
+    await saveSessionIndex(index);
+}
+/**
+ * List all sessions with their metadata.
+ */
+export async function listSessions() {
+    const index = await loadSessionIndex();
+    return Object.entries(index).map(([name, info]) => ({ name, ...info }));
+}
+//# sourceMappingURL=sessions.js.map

package/dist/auth/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,SAAS,mBAAmB;IAC1B,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE;QACrC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,KAAmB;IACjD,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QAClE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,KAAa;IAEb,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,KAAK;QACL,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC9D,CAAC;IACF,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAGhC,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/auth/token-refresh.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Token Refresh
+ *
+ * Handles silent refresh of OAuth access tokens using the stored
+ * refresh token. Checks expiry with a 5-minute buffer to avoid
+ * mid-request expirations.
+ */
+import type { OAuthTokens, ZivisConfig } from "../types.js";
+/**
+ * Load OAuth tokens from keychain
+ * @param session - Optional named session for multi-tenant isolation
+ */
+export declare function loadTokens(session?: string): Promise<OAuthTokens | null>;
+/**
+ * Check if the access token is still valid (with 5-min buffer)
+ */
+export declare function isTokenValid(tokens: OAuthTokens): boolean;
+/**
+ * Get a valid access token, refreshing if necessary.
+ *
+ * Returns the access token string, or null if no tokens stored
+ * or refresh fails (user needs to re-login).
+ */
+export declare function getValidAccessToken(config?: ZivisConfig): Promise<string | null>;

package/dist/auth/token-refresh.js

@@ -0,0 +1,91 @@
+/**
+ * Token Refresh
+ *
+ * Handles silent refresh of OAuth access tokens using the stored
+ * refresh token. Checks expiry with a 5-minute buffer to avoid
+ * mid-request expirations.
+ */
+import { keychainRead, keychainStore, keychainDelete, getSessionAccount } from "./keychain.js";
+import { DEFAULT_CONFIG } from "../types.js";
+const EXPIRY_BUFFER_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Load OAuth tokens from keychain
+ * @param session - Optional named session for multi-tenant isolation
+ */
+export async function loadTokens(session) {
+    const raw = await keychainRead(getSessionAccount(session));
+    if (!raw)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check if the access token is still valid (with 5-min buffer)
+ */
+export function isTokenValid(tokens) {
+    return tokens.expires_at > Date.now() + EXPIRY_BUFFER_MS;
+}
+/**
+ * Refresh the access token using the refresh token
+ */
+async function refreshAccessToken(refreshToken, config) {
+    // Handle both WorkOS (auth.workos.com -> /oauth/token) and custom AuthKit (authkit.app -> /oauth2/token)
+    const tokenPath = config.oauthApiUrl.includes("authkit.app") ? "/oauth2/token" : "/oauth/token";
+    const tokenUrl = `${config.oauthApiUrl}${tokenPath}`;
+    const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            grant_type: "refresh_token",
+            client_id: config.oauthClientId,
+            refresh_token: refreshToken,
+        }),
+    });
+    if (!response.ok) {
+        const error = (await response.json().catch(() => ({})));
+        throw new Error(error.error_description || error.error || "Token refresh failed");
+    }
+    const data = (await response.json());
+    return {
+        access_token: data.access_token,
+        // Use new refresh token if provided (rotation), otherwise keep existing
+        refresh_token: data.refresh_token || refreshToken,
+        expires_at: Date.now() + data.expires_in * 1000,
+        id_token: data.id_token,
+    };
+}
+/**
+ * Get a valid access token, refreshing if necessary.
+ *
+ * Returns the access token string, or null if no tokens stored
+ * or refresh fails (user needs to re-login).
+ */
+export async function getValidAccessToken(config = DEFAULT_CONFIG) {
+    const session = config.session;
+    const account = getSessionAccount(session);
+    const tokens = await loadTokens(session);
+    if (!tokens) {
+        return null;
+    }
+    if (isTokenValid(tokens)) {
+        return tokens.access_token;
+    }
+    if (tokens.refresh_token) {
+        try {
+            const newTokens = await refreshAccessToken(tokens.refresh_token, config);
+            await keychainStore(account, JSON.stringify(newTokens));
+            return newTokens.access_token;
+        }
+        catch (err) {
+            console.error("[zivis] Token refresh failed:", err instanceof Error ? err.message : err);
+            await keychainDelete(account);
+            return null;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=token-refresh.js.map

package/dist/auth/token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../src/auth/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE/F,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEpD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB;IAC/C,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,OAAO,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,YAAoB,EACpB,MAAmB;IAEnB,yGAAyG;IACzG,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IAChG,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,SAAS,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGrD,CAAC;QACF,MAAM,IAAI,KAAK,CACb,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,IAAI,sBAAsB,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,wEAAwE;QACxE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;QACjD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;QAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAsB,cAAc;IAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACzE,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YACxD,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,+BAA+B,EAC/B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;YACF,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,23 @@
+/**
+ * CLI Commands
+ *
+ * Handles all user-facing CLI interactions:
+ * - login: OAuth PKCE browser login (with optional --session for multi-tenant)
+ * - configure: API key setup (interactive or --api-key flag)
+ * - status: Show auth state, org, plan usage
+ * - logout: Clear stored credentials (with optional --session)
+ * - sessions: List all stored sessions
+ * - serve: Start MCP server (called by IDE, not by user directly)
+ */
+import type { ZivisConfig } from "./types.js";
+/**
+ * Parse CLI arguments into a command and options
+ */
+export declare function parseArgs(argv: string[]): {
+    command: string;
+    options: Record<string, string>;
+};
+/**
+ * Run the appropriate CLI command
+ */
+export declare function runCli(command: string, options: Record<string, string>, config?: ZivisConfig): Promise<void>;