@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.3

package/dist/api-client.d.ts

@@ -1,12 +1,35 @@
+/**
+ * ZIVIS API Client
+ *
+ * HTTPS client that attaches the appropriate auth header
+ * based on the active auth method:
+ * - OAuth: Authorization: Bearer <token>
+ * - API Key: X-API-Key: <key>
+ *
+ * Handles 401 responses by attempting token refresh (OAuth)
+ * before returning an auth error.
+ */
 import type { ZivisConfig } from "./types.js";
 export declare class ApiClient {
     private config;
     constructor(config?: ZivisConfig);
-    resolveEffectiveConfig(cwd?: string): ZivisConfig;
+    /**
+     * Build auth headers from current credentials
+     */
     private buildAuthHeaders;
+    /**
+     * Make an authenticated request to the ZIVIS API.
+     *
+     * Automatically resolves credentials and attaches auth headers.
+     * On 401 with OAuth, attempts one token refresh and retries.
+     */
     request<T>(method: string, path: string, body?: unknown): Promise<T>;
     private doRequest;
     get<T>(path: string): Promise<T>;
+    /**
+     * Fetch a path and return the response as plain text (not JSON).
+     * Used for artifact content streaming where the response is not JSON.
+     */
     getText(path: string): Promise<string>;
     patch<T>(path: string, body: unknown): Promise<T>;
     post<T>(path: string, body: unknown): Promise<T>;

package/dist/api-client.js

@@ -1,29 +1,24 @@
+/**
+ * ZIVIS API Client
+ *
+ * HTTPS client that attaches the appropriate auth header
+ * based on the active auth method:
+ * - OAuth: Authorization: Bearer <token>
+ * - API Key: X-API-Key: <key>
+ *
+ * Handles 401 responses by attempting token refresh (OAuth)
+ * before returning an auth error.
+ */
 import { resolveAuth } from "./auth/index.js";
-import { detectProjectBinding, resolveConfigFromBinding, resolveMcpSessionForWorkspace, } from "./project-binding.js";
 import { DEFAULT_CONFIG } from "./types.js";
 export class ApiClient {
     config;
     constructor(config = DEFAULT_CONFIG) {
         this.config = config;
     }
-    resolveEffectiveConfig(cwd) {
-        const ws = this.config.workspacePath ?? cwd ?? process.cwd();
-        const detected = detectProjectBinding(ws);
-        if (!detected) {
-            return this.config;
-        }
-        const { binding } = detected;
-        const fromBinding = resolveConfigFromBinding(ws);
-        return {
-            ...this.config,
-            session: resolveMcpSessionForWorkspace(this.config, ws, detected, fromBinding),
-            ...(binding.apiBaseUrl ? { apiBaseUrl: binding.apiBaseUrl } : {}),
-            ...(binding.oauthApiUrl ? { oauthApiUrl: binding.oauthApiUrl } : {}),
-            ...(binding.oauthClientId ? { oauthClientId: binding.oauthClientId } : {}),
-            ...(binding.keychainPrefix ? { keychainPrefix: binding.keychainPrefix } : {}),
-            ...(binding.configDir ? { configDir: binding.configDir } : {}),
-        };
-    }
+    /**
+     * Build auth headers from current credentials
+     */
     buildAuthHeaders(creds) {
         switch (creds.method) {
             case "oauth":
@@ -34,20 +29,42 @@ export class ApiClient {
                 return {};
         }
     }
+    /**
+     * Make an authenticated request to the ZIVIS API.
+     *
+     * Automatically resolves credentials and attaches auth headers.
+     * On 401 with OAuth, attempts one token refresh and retries.
+     */
     async request(method, path, body) {
-        const effectiveConfig = this.resolveEffectiveConfig();
-        const creds = await resolveAuth(effectiveConfig, "apikey");
+        const creds = await resolveAuth(this.config);
         if (creds.method === "none") {
-            throw new ApiError("Not authenticated. MCP uses API keys only — run: zivis auth bind (or zivis auth token sk_... --session <name>)", 401, "AUTH_REQUIRED");
+            throw new ApiError("Not authenticated. Run: zivis auth login", 401, "AUTH_REQUIRED");
+        }
+        const result = await this.doRequest(method, path, body, creds);
+        // If 401 and using OAuth, try refreshing
+        if (result.status === 401 && creds.method === "oauth") {
+            const freshCreds = await resolveAuth(this.config);
+            if (freshCreds.method === "oauth" &&
+                freshCreds.accessToken !== creds.accessToken) {
+                // Token was refreshed, retry
+                const retryResult = await this.doRequest(method, path, body, freshCreds);
+                if (retryResult.status === 401) {
+                    throw new ApiError("Session expired. Run: zivis auth login", 401, "SESSION_EXPIRED");
+                }
+                if (!retryResult.ok) {
+                    throw new ApiError(retryResult.errorMessage || "API request failed", retryResult.status, "API_ERROR");
+                }
+                return retryResult.data;
+            }
+            throw new ApiError("Session expired. Run: zivis auth login", 401, "SESSION_EXPIRED");
         }
-        const result = await this.doRequest(method, path, body, creds, effectiveConfig.apiBaseUrl);
         if (!result.ok) {
             throw new ApiError(result.errorMessage || `API request failed: ${method} ${path}`, result.status, "API_ERROR");
         }
         return result.data;
     }
-    async doRequest(method, path, body, creds, apiBaseUrl) {
-        const url = `${apiBaseUrl}${path}`;
+    async doRequest(method, path, body, creds) {
+        const url = `${this.config.apiBaseUrl}${path}`;
         const headers = {
             "Content-Type": "application/json",
             "User-Agent": "@zivis-ai/cli",
@@ -73,20 +90,25 @@ export class ApiClient {
             return { ok: true, status: response.status, data };
         }
         catch (err) {
+            // Network error
             const message = err instanceof Error ? err.message : "Network request failed";
             throw new ApiError(`Failed to connect to ZIVIS API (${url}): ${message}`, 0, "NETWORK_ERROR");
         }
     }
+    // ── Convenience methods ──
     async get(path) {
         return this.request("GET", path);
     }
+    /**
+     * Fetch a path and return the response as plain text (not JSON).
+     * Used for artifact content streaming where the response is not JSON.
+     */
     async getText(path) {
-        const effectiveConfig = this.resolveEffectiveConfig();
-        const creds = await resolveAuth(effectiveConfig, "apikey");
+        const creds = await resolveAuth(this.config);
         if (creds.method === "none") {
-            throw new ApiError("Not authenticated. MCP uses API keys only — run: zivis auth bind", 401, "AUTH_REQUIRED");
+            throw new ApiError("Not authenticated. Run: zivis auth login", 401, "AUTH_REQUIRED");
         }
-        const url = `${effectiveConfig.apiBaseUrl}${path}`;
+        const url = `${this.config.apiBaseUrl}${path}`;
         const headers = {
             "User-Agent": "@zivis-ai/cli",
             ...this.buildAuthHeaders(creds),
@@ -120,3 +142,4 @@ export class ApiError extends Error {
         this.name = "ApiError";
     }
 }
+//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,OAAO,SAAS;IACZ,MAAM,CAAc;IAE5B,YAAY,SAAsB,cAAc;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,gBAAgB,CACtB,KAAsB;QAEtB,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,OAAO;gBACV,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1D,KAAK,QAAQ;gBACX,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,MAAO,EAAE,CAAC;YACxC,KAAK,MAAM;gBACT,OAAO,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAChB,0CAA0C,EAC1C,GAAG,EACH,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAElE,yCAAyC;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,IACE,UAAU,CAAC,MAAM,KAAK,OAAO;gBAC7B,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAC5C,CAAC;gBACD,6BAA6B;gBAC7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,UAAU,CACX,CAAC;gBACF,IAAI,WAAW,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC/B,MAAM,IAAI,QAAQ,CAChB,wCAAwC,EACxC,GAAG,EACH,iBAAiB,CAClB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;oBACpB,MAAM,IAAI,QAAQ,CAChB,WAAW,CAAC,YAAY,IAAI,oBAAoB,EAChD,WAAW,CAAC,MAAM,EAClB,WAAW,CACZ,CAAC;gBACJ,CAAC;gBACD,OAAO,WAAW,CAAC,IAAK,CAAC;YAC3B,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,wCAAwC,EACxC,GAAG,EACH,iBAAiB,CAClB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,MAAM,CAAC,YAAY,IAAI,uBAAuB,MAAM,IAAI,IAAI,EAAE,EAC9D,MAAM,CAAC,MAAM,EACb,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,IAAK,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,MAAc,EACd,IAAY,EACZ,IAAa,EACb,KAAsB;QAOtB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,eAAe;YAC7B,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;SAChC,CAAC;QAEF,MAAM,YAAY,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtD,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAEhD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,YAAY,EACT,SAAoC,CAAC,OAAO;wBAC5C,SAAoC,CAAC,KAAK;wBAC3C,QAAQ,QAAQ,CAAC,MAAM,EAAE;iBAC5B,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gBAAgB;YAChB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAChE,MAAM,IAAI,QAAQ,CAChB,mCAAmC,GAAG,MAAM,OAAO,EAAE,EACrD,CAAC,EACD,eAAe,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAChB,0CAA0C,EAC1C,GAAG,EACH,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAA2B;YACtC,YAAY,EAAE,eAAe;YAC7B,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;SAChC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,QAAQ,CACf,SAAoC,CAAC,OAAO;gBAC1C,SAAoC,CAAC,KAAK;gBAC3C,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAC3B,QAAQ,CAAC,MAAM,EACf,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAa;QACxC,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -1,8 +1,29 @@
+/**
+ * Auth Orchestrator
+ *
+ * Resolves credentials using the defined precedence:
+ * 1. OS Keychain — OAuth tokens (preferred, user-scoped, auto-refresh)
+ * 2. OS Keychain — API key (fallback, org-scoped)
+ * 3. ZIVIS_API_KEY env var (CI environments)
+ * 4. Not authenticated (tools return auth error with setup instructions)
+ */
 import type { AuthCredentials, AuthMethod, ZivisConfig } from "../types.js";
 export { login } from "./oauth.js";
 export { keychainClearAll, keychainClearSession, getStorageName, getSessionAccount } from "./keychain.js";
-export { keychainStore, keychainRead, keychainDelete } from "./keychain.js";
+export { keychainStore, keychainRead } from "./keychain.js";
 export { loadTokens } from "./token-refresh.js";
 export { loadSessionIndex, saveSessionEntry, removeSessionEntry, listSessions } from "./sessions.js";
+/**
+ * Resolve current auth credentials following the precedence chain.
+ *
+ * IMPORTANT: When config.session is set (ZIVIS_SESSION env var), auth resolution
+ * is scoped to that session ONLY. It will NOT fall through to the default session
+ * or API key — this prevents accidental cross-tenant data access.
+ *
+ * @param forceMethod - Override the automatic method selection
+ */
 export declare function resolveAuth(config?: ZivisConfig, forceMethod?: AuthMethod): Promise<AuthCredentials>;
+/**
+ * Get a human-readable description of the current auth state
+ */
 export declare function getAuthDescription(config?: ZivisConfig): Promise<string>;

package/dist/auth/index.js

@@ -1,44 +1,64 @@
+/**
+ * Auth Orchestrator
+ *
+ * Resolves credentials using the defined precedence:
+ * 1. OS Keychain — OAuth tokens (preferred, user-scoped, auto-refresh)
+ * 2. OS Keychain — API key (fallback, org-scoped)
+ * 3. ZIVIS_API_KEY env var (CI environments)
+ * 4. Not authenticated (tools return auth error with setup instructions)
+ */
 import { keychainRead } from "./keychain.js";
 import { getValidAccessToken } from "./token-refresh.js";
-import { DEFAULT_CONFIG, credentialStorageFromConfig } from "../types.js";
+import { DEFAULT_CONFIG } from "../types.js";
 export { login } from "./oauth.js";
 export { keychainClearAll, keychainClearSession, getStorageName, getSessionAccount } from "./keychain.js";
-export { keychainStore, keychainRead, keychainDelete } from "./keychain.js";
+export { keychainStore, keychainRead } from "./keychain.js";
 export { loadTokens } from "./token-refresh.js";
 export { loadSessionIndex, saveSessionEntry, removeSessionEntry, listSessions } from "./sessions.js";
+/**
+ * Resolve current auth credentials following the precedence chain.
+ *
+ * IMPORTANT: When config.session is set (ZIVIS_SESSION env var), auth resolution
+ * is scoped to that session ONLY. It will NOT fall through to the default session
+ * or API key — this prevents accidental cross-tenant data access.
+ *
+ * @param forceMethod - Override the automatic method selection
+ */
 export async function resolveAuth(config = DEFAULT_CONFIG, forceMethod) {
     const session = config.session;
-    const st = credentialStorageFromConfig(config);
-    if (forceMethod !== "oauth") {
-        const apiKeyAccount = session ? `apikey.${session}` : null;
-        if (apiKeyAccount) {
-            const sessionApiKey = await keychainRead(apiKeyAccount, st);
-            if (sessionApiKey) {
-                return { method: "apikey", apiKey: sessionApiKey };
-            }
-        }
-    }
-    const envKey = process.env.ZIVIS_API_KEY;
-    if (envKey) {
-        return { method: "apikey", apiKey: envKey };
-    }
+    // 1. OAuth tokens (unless forced to apikey)
     if (forceMethod !== "apikey") {
         const accessToken = await getValidAccessToken(config);
         if (accessToken) {
             return { method: "oauth", accessToken };
         }
     }
+    // 2. ZIVIS_API_KEY env var — always checked, even for named sessions.
+    // This is an explicit user action (they set the env var in their MCP config),
+    // so it's safe to use regardless of session scope.
+    const envKey = process.env.ZIVIS_API_KEY;
+    if (envKey) {
+        return { method: "apikey", apiKey: envKey };
+    }
+    // CROSS-TENANT SAFETY: If a named session is active, do NOT fall through
+    // to default keychain credentials. This prevents accidentally using admin tokens
+    // when working in a customer's project.
     if (session) {
         return { method: "none" };
     }
+    // 3. API key from keychain (only for default/no-session)
     if (forceMethod !== "oauth") {
-        const apiKey = await keychainRead("apikey", st);
+        const apiKey = await keychainRead("apikey");
         if (apiKey) {
             return { method: "apikey", apiKey };
         }
     }
+    // 4. Not authenticated
     return { method: "none" };
 }
+/**
+ * Get a human-readable description of the current auth state
+ */
 export async function getAuthDescription(config = DEFAULT_CONFIG) {
     const creds = await resolveAuth(config);
     switch (creds.method) {
@@ -50,3 +70,4 @@ export async function getAuthDescription(config = DEFAULT_CONFIG) {
             return "Not authenticated";
     }
 }
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAsB,cAAc,EACpC,WAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAE/B,4CAA4C;IAC5C,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,8EAA8E;IAC9E,mDAAmD;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,yEAAyE;IACzE,iFAAiF;IACjF,wCAAwC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,yDAAyD;IACzD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAsB,cAAc;IAEpC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,sBAAsB,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,YAAY,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QACpG,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/auth/jwt.d.ts

@@ -1,8 +1,24 @@
+/**
+ * JWT helpers for local safety checks.
+ *
+ * The API is the authoritative verifier of JWT signatures. These helpers
+ * decode the payload only to read claims locally (org_id, email, sub) so
+ * the CLI/MCP server can enforce project-binding guardrails before making
+ * any API calls.
+ */
 export interface JwtClaims {
+    /** WorkOS user sub (e.g., "user_01HXYZ...") */
     sub?: string;
+    /** WorkOS org ID (e.g., "org_01HXYZ...") */
     org_id?: string;
+    /** Email (present on id_token, sometimes on access_token) */
     email?: string;
+    /** Expiry (unix seconds) */
     exp?: number;
     [key: string]: unknown;
 }
+/**
+ * Decode a JWT payload WITHOUT verifying the signature.
+ * Returns null if the token is malformed.
+ */
 export declare function decodeJwtPayload(token: string): JwtClaims | null;

package/dist/auth/jwt.js

@@ -1,3 +1,15 @@
+/**
+ * JWT helpers for local safety checks.
+ *
+ * The API is the authoritative verifier of JWT signatures. These helpers
+ * decode the payload only to read claims locally (org_id, email, sub) so
+ * the CLI/MCP server can enforce project-binding guardrails before making
+ * any API calls.
+ */
+/**
+ * Decode a JWT payload WITHOUT verifying the signature.
+ * Returns null if the token is malformed.
+ */
 export function decodeJwtPayload(token) {
     try {
         const parts = token.split(".");
@@ -10,3 +22,4 @@ export function decodeJwtPayload(token) {
         return null;
     }
 }
+//# sourceMappingURL=jwt.js.map

package/dist/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/auth/keychain.d.ts

@@ -1,8 +1,34 @@
-import { type CredentialStorage } from "../types.js";
+/**
+ * OS Keychain credential storage
+ *
+ * Uses native OS CLI commands to store/retrieve credentials securely.
+ * No native npm dependencies (no keytar).
+ *
+ * - macOS: Keychain Services via `security` CLI
+ * - Linux: Secret Service API via `secret-tool` CLI
+ * - Windows: DPAPI via PowerShell
+ *
+ * Falls back to encrypted file if keychain CLI is unavailable.
+ */
+/**
+ * Returns the keychain account key for a given session.
+ * - No session or undefined → "oauth" (backward compatible)
+ * - Named session → "oauth.{session}"
+ */
 export declare function getSessionAccount(session?: string): string;
-export declare function keychainStore(account: string, value: string, storage?: CredentialStorage): Promise<void>;
-export declare function keychainRead(account: string, storage?: CredentialStorage): Promise<string | null>;
-export declare function keychainDelete(account: string, storage?: CredentialStorage): Promise<void>;
-export declare function keychainClearSession(session?: string, storage?: CredentialStorage): Promise<void>;
-export declare function keychainClearAll(storage?: CredentialStorage): Promise<void>;
+export declare function keychainStore(account: string, value: string): Promise<void>;
+export declare function keychainRead(account: string): Promise<string | null>;
+export declare function keychainDelete(account: string): Promise<void>;
+/**
+ * Delete credentials for a specific session
+ */
+export declare function keychainClearSession(session?: string): Promise<void>;
+/**
+ * Delete all stored credentials (default OAuth + API key).
+ * Does NOT clear named sessions — use keychainClearSession() for those.
+ */
+export declare function keychainClearAll(): Promise<void>;
+/**
+ * Returns the storage mechanism name for display purposes
+ */
 export declare function getStorageName(): string;