@zivis/mcp 0.1.0-alpha.11 → 0.1.0-alpha.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/index.d.ts +8 -5
- package/dist/auth/index.js +27 -23
- package/dist/auth/index.js.map +1 -1
- package/package.json +1 -1
package/dist/auth/index.d.ts
CHANGED
|
@@ -2,15 +2,18 @@
|
|
|
2
2
|
* Auth Orchestrator
|
|
3
3
|
*
|
|
4
4
|
* Resolves credentials using the defined precedence:
|
|
5
|
-
* 1. OS Keychain —
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
5
|
+
* 1. OS Keychain — Local Project Binding Token / API key (apikey.<session>)
|
|
6
|
+
* Minted by `zivis auth bind` — org-scoped, never expires, no refresh drift.
|
|
7
|
+
* This is the preferred credential for MCP servers and CLI agent work.
|
|
8
|
+
* 2. ZIVIS_API_KEY env var (CI environments)
|
|
9
|
+
* 3. OS Keychain — OAuth tokens (fallback for `zivis auth login` users)
|
|
10
|
+
* 4. OS Keychain — default API key (no named session)
|
|
11
|
+
* 5. Not authenticated
|
|
9
12
|
*/
|
|
10
13
|
import type { AuthCredentials, AuthMethod, ZivisConfig } from "../types.js";
|
|
11
14
|
export { login } from "./oauth.js";
|
|
12
15
|
export { keychainClearAll, keychainClearSession, getStorageName, getSessionAccount } from "./keychain.js";
|
|
13
|
-
export { keychainStore, keychainRead } from "./keychain.js";
|
|
16
|
+
export { keychainStore, keychainRead, keychainDelete } from "./keychain.js";
|
|
14
17
|
export { loadTokens } from "./token-refresh.js";
|
|
15
18
|
export { loadSessionIndex, saveSessionEntry, removeSessionEntry, listSessions } from "./sessions.js";
|
|
16
19
|
/**
|
package/dist/auth/index.js
CHANGED
|
@@ -2,17 +2,20 @@
|
|
|
2
2
|
* Auth Orchestrator
|
|
3
3
|
*
|
|
4
4
|
* Resolves credentials using the defined precedence:
|
|
5
|
-
* 1. OS Keychain —
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
5
|
+
* 1. OS Keychain — Local Project Binding Token / API key (apikey.<session>)
|
|
6
|
+
* Minted by `zivis auth bind` — org-scoped, never expires, no refresh drift.
|
|
7
|
+
* This is the preferred credential for MCP servers and CLI agent work.
|
|
8
|
+
* 2. ZIVIS_API_KEY env var (CI environments)
|
|
9
|
+
* 3. OS Keychain — OAuth tokens (fallback for `zivis auth login` users)
|
|
10
|
+
* 4. OS Keychain — default API key (no named session)
|
|
11
|
+
* 5. Not authenticated
|
|
9
12
|
*/
|
|
10
13
|
import { keychainRead } from "./keychain.js";
|
|
11
14
|
import { getValidAccessToken } from "./token-refresh.js";
|
|
12
15
|
import { DEFAULT_CONFIG } from "../types.js";
|
|
13
16
|
export { login } from "./oauth.js";
|
|
14
17
|
export { keychainClearAll, keychainClearSession, getStorageName, getSessionAccount } from "./keychain.js";
|
|
15
|
-
export { keychainStore, keychainRead } from "./keychain.js";
|
|
18
|
+
export { keychainStore, keychainRead, keychainDelete } from "./keychain.js";
|
|
16
19
|
export { loadTokens } from "./token-refresh.js";
|
|
17
20
|
export { loadSessionIndex, saveSessionEntry, removeSessionEntry, listSessions } from "./sessions.js";
|
|
18
21
|
/**
|
|
@@ -26,28 +29,29 @@ export { loadSessionIndex, saveSessionEntry, removeSessionEntry, listSessions }
|
|
|
26
29
|
*/
|
|
27
30
|
export async function resolveAuth(config = DEFAULT_CONFIG, forceMethod) {
|
|
28
31
|
const session = config.session;
|
|
29
|
-
// 1.
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
32
|
+
// 1. Per-session keychain API key — Local Project Binding Token (preferred).
|
|
33
|
+
// Minted by `zivis auth bind` and stored under `apikey.<session>`.
|
|
34
|
+
// Org-scoped at the WorkOS level, never refreshes, no drift risk.
|
|
35
|
+
// Also covers `zivis auth token sk_xxx --session <name>` for CI injection.
|
|
36
|
+
if (forceMethod !== "oauth") {
|
|
37
|
+
const apiKeyAccount = session ? `apikey.${session}` : null;
|
|
38
|
+
if (apiKeyAccount) {
|
|
39
|
+
const sessionApiKey = await keychainRead(apiKeyAccount);
|
|
40
|
+
if (sessionApiKey) {
|
|
41
|
+
return { method: "apikey", apiKey: sessionApiKey };
|
|
42
|
+
}
|
|
34
43
|
}
|
|
35
44
|
}
|
|
36
|
-
// 2. ZIVIS_API_KEY env var —
|
|
37
|
-
// This is an explicit user action (they set the env var in their MCP config),
|
|
38
|
-
// so it's safe to use regardless of session scope.
|
|
45
|
+
// 2. ZIVIS_API_KEY env var (CI environments — explicit, no session ambiguity).
|
|
39
46
|
const envKey = process.env.ZIVIS_API_KEY;
|
|
40
47
|
if (envKey) {
|
|
41
48
|
return { method: "apikey", apiKey: envKey };
|
|
42
49
|
}
|
|
43
|
-
// 3.
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
const sessionApiKey = await keychainRead(apiKeyAccount);
|
|
49
|
-
if (sessionApiKey) {
|
|
50
|
-
return { method: "apikey", apiKey: sessionApiKey };
|
|
50
|
+
// 3. OAuth tokens (fallback for `zivis auth login` users who haven't run bind).
|
|
51
|
+
if (forceMethod !== "apikey") {
|
|
52
|
+
const accessToken = await getValidAccessToken(config);
|
|
53
|
+
if (accessToken) {
|
|
54
|
+
return { method: "oauth", accessToken };
|
|
51
55
|
}
|
|
52
56
|
}
|
|
53
57
|
// CROSS-TENANT SAFETY: If a named session is active, do NOT fall through
|
|
@@ -56,14 +60,14 @@ export async function resolveAuth(config = DEFAULT_CONFIG, forceMethod) {
|
|
|
56
60
|
if (session) {
|
|
57
61
|
return { method: "none" };
|
|
58
62
|
}
|
|
59
|
-
// 4. API key from keychain (
|
|
63
|
+
// 4. Default API key from keychain (no named session).
|
|
60
64
|
if (forceMethod !== "oauth") {
|
|
61
65
|
const apiKey = await keychainRead("apikey");
|
|
62
66
|
if (apiKey) {
|
|
63
67
|
return { method: "apikey", apiKey };
|
|
64
68
|
}
|
|
65
69
|
}
|
|
66
|
-
//
|
|
70
|
+
// 5. Not authenticated
|
|
67
71
|
return { method: "none" };
|
|
68
72
|
}
|
|
69
73
|
/**
|
package/dist/auth/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAsB,cAAc,EACpC,WAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAE/B,6EAA6E;IAC7E,sEAAsE;IACtE,qEAAqE;IACrE,8EAA8E;IAC9E,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;YACxD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,gFAAgF;IAChF,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,iFAAiF;IACjF,wCAAwC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,uDAAuD;IACvD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAsB,cAAc;IAEpC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,sBAAsB,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,YAAY,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QACpG,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC"}
|