@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.3

package/dist/auth/keychain.js

@@ -1,3 +1,15 @@
+/**
+ * OS Keychain credential storage
+ *
+ * Uses native OS CLI commands to store/retrieve credentials securely.
+ * No native npm dependencies (no keytar).
+ *
+ * - macOS: Keychain Services via `security` CLI
+ * - Linux: Secret Service API via `secret-tool` CLI
+ * - Windows: DPAPI via PowerShell
+ *
+ * Falls back to encrypted file if keychain CLI is unavailable.
+ */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs/promises";
@@ -6,49 +18,48 @@ import * as os from "node:os";
 import * as crypto from "node:crypto";
 import { ENV_CONFIG } from "../types.js";
 const execFileAsync = promisify(execFile);
-function resolvedStorage(storage) {
-    return (storage ?? {
-        keychainPrefix: ENV_CONFIG.keychainPrefix,
-        configDir: ENV_CONFIG.configDir,
-    });
-}
+// Use environment-aware prefix so staging and production credentials are isolated
+const SERVICE_PREFIX = ENV_CONFIG.keychainPrefix;
+/**
+ * Returns the keychain account key for a given session.
+ * - No session or undefined → "oauth" (backward compatible)
+ * - Named session → "oauth.{session}"
+ */
 export function getSessionAccount(session) {
     return session ? `oauth.${session}` : "oauth";
 }
-function getServiceName(account, keychainPrefix) {
-    return `${keychainPrefix}.${account}`;
+function getServiceName(account) {
+    return `${SERVICE_PREFIX}.${account}`;
 }
-function getFallbackDir(configDir) {
+function getFallbackDir() {
+    // Use environment-aware config dir so staging and production are isolated
+    const configDir = ENV_CONFIG.configDir;
     if (process.platform === "win32") {
         return path.join(process.env.APPDATA || os.homedir(), configDir);
     }
     return path.join(os.homedir(), ".config", configDir);
 }
-function getFallbackPath(account, storage) {
-    return path.join(getFallbackDir(storage.configDir), `${account}.enc`);
-}
-async function macosDeleteAll(service) {
-    for (let i = 0; i < 100; i++) {
-        try {
-            await execFileAsync("security", [
-                "delete-generic-password",
-                "-a",
-                "zivis-mcp",
-                "-s",
-                service,
-            ]);
-        }
-        catch {
-            return;
-        }
-    }
+function getFallbackPath(account) {
+    return path.join(getFallbackDir(), `${account}.enc`);
 }
-async function macosStore(account, value, keychainPrefix) {
-    const service = getServiceName(account, keychainPrefix);
-    await macosDeleteAll(service);
+// ── macOS Keychain ──
+async function macosStore(account, value) {
+    const service = getServiceName(account);
+    // Delete existing entry first (ignore errors if not found)
+    try {
+        await execFileAsync("security", [
+            "delete-generic-password",
+            "-a",
+            "zivis-mcp",
+            "-s",
+            service,
+        ]);
+    }
+    catch {
+        // Entry didn't exist, that's fine
+    }
     await execFileAsync("security", [
         "add-generic-password",
-        "-U",
         "-a",
         "zivis-mcp",
         "-s",
@@ -57,8 +68,8 @@ async function macosStore(account, value, keychainPrefix) {
         value,
     ]);
 }
-async function macosRead(account, keychainPrefix) {
-    const service = getServiceName(account, keychainPrefix);
+async function macosRead(account) {
+    const service = getServiceName(account);
     try {
         const { stdout } = await execFileAsync("security", [
             "find-generic-password",
@@ -74,29 +85,43 @@ async function macosRead(account, keychainPrefix) {
         return null;
     }
 }
-async function macosDelete(account, keychainPrefix) {
-    await macosDeleteAll(getServiceName(account, keychainPrefix));
+async function macosDelete(account) {
+    const service = getServiceName(account);
+    try {
+        await execFileAsync("security", [
+            "delete-generic-password",
+            "-a",
+            "zivis-mcp",
+            "-s",
+            service,
+        ]);
+    }
+    catch {
+        // Entry didn't exist
+    }
 }
-async function linuxStore(account, value, keychainPrefix) {
+// ── Linux Secret Service ──
+async function linuxStore(account, value) {
     const child = execFileAsync("secret-tool", [
         "store",
         "--label",
         `ZIVIS MCP ${account}`,
         "service",
-        keychainPrefix,
+        SERVICE_PREFIX,
         "account",
         account,
     ]);
+    // secret-tool reads value from stdin
     child.child.stdin?.write(value);
     child.child.stdin?.end();
     await child;
 }
-async function linuxRead(account, keychainPrefix) {
+async function linuxRead(account) {
     try {
         const { stdout } = await execFileAsync("secret-tool", [
             "lookup",
             "service",
-            keychainPrefix,
+            SERVICE_PREFIX,
             "account",
             account,
         ]);
@@ -106,39 +131,44 @@ async function linuxRead(account, keychainPrefix) {
         return null;
     }
 }
-async function linuxDelete(account, keychainPrefix) {
+async function linuxDelete(account) {
     try {
         await execFileAsync("secret-tool", [
             "clear",
             "service",
-            keychainPrefix,
+            SERVICE_PREFIX,
             "account",
             account,
         ]);
     }
     catch {
+        // Entry didn't exist
     }
 }
+// ── Encrypted File Fallback (Windows + fallback for all platforms) ──
 function deriveKey() {
+    // Use machine-specific data as encryption key seed
     const seed = `zivis-mcp:${os.hostname()}:${os.userInfo().username}`;
     return crypto.createHash("sha256").update(seed).digest();
 }
-async function fileStore(account, value, storage) {
+async function fileStore(account, value) {
     const key = deriveKey();
     const iv = crypto.randomBytes(16);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
     let encrypted = cipher.update(value, "utf8", "hex");
     encrypted += cipher.final("hex");
     const data = JSON.stringify({ iv: iv.toString("hex"), data: encrypted });
-    const dir = getFallbackDir(storage.configDir);
+    const dir = getFallbackDir();
     await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(getFallbackPath(account, storage), data, { mode: 0o600 });
+    await fs.writeFile(getFallbackPath(account), data, { mode: 0o600 });
 }
-async function fileRead(account, storage) {
+async function fileRead(account) {
     try {
-        const raw = await fs.readFile(getFallbackPath(account, storage), "utf8");
+        const raw = await fs.readFile(getFallbackPath(account), "utf8");
         const { iv, data } = JSON.parse(raw);
         const key = deriveKey();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const decipher = crypto.createDecipheriv("aes-256-cbc", key, Buffer.from(iv, "hex"));
         let decrypted = decipher.update(data, "hex", "utf8");
         decrypted += decipher.final("utf8");
@@ -148,13 +178,15 @@ async function fileRead(account, storage) {
         return null;
     }
 }
-async function fileDelete(account, storage) {
+async function fileDelete(account) {
     try {
-        await fs.unlink(getFallbackPath(account, storage));
+        await fs.unlink(getFallbackPath(account));
     }
     catch {
+        // File didn't exist
     }
 }
+// ── Platform Detection & Dispatch ──
 async function isKeychainAvailable() {
     try {
         if (process.platform === "darwin") {
@@ -178,58 +210,56 @@ async function useKeychain() {
     }
     return keychainAvailable;
 }
-export async function keychainStore(account, value, storage) {
-    const st = resolvedStorage(storage);
-    await fileStore(account, value, st);
+// ── Public API ──
+export async function keychainStore(account, value) {
+    // Always store to encrypted file as fallback (for environments where keychain CLI
+    // may not be available, e.g., MCP servers spawned by IDEs with different $PATH)
+    await fileStore(account, value);
+    // Also store to native keychain if available
     if (await useKeychain()) {
         if (process.platform === "darwin") {
-            await macosStore(account, value, st.keychainPrefix);
+            await macosStore(account, value);
         }
         else if (process.platform === "linux") {
-            await linuxStore(account, value, st.keychainPrefix);
+            await linuxStore(account, value);
         }
     }
 }
-const LEGACY_KEYCHAIN_PREFIX = "io.zivis.mcp";
-async function readFromBucket(account, storage) {
+export async function keychainRead(account) {
     if (await useKeychain()) {
         if (process.platform === "darwin")
-            return macosRead(account, storage.keychainPrefix);
+            return macosRead(account);
         if (process.platform === "linux")
-            return linuxRead(account, storage.keychainPrefix);
-    }
-    return fileRead(account, storage);
-}
-export async function keychainRead(account, storage) {
-    const st = resolvedStorage(storage);
-    const primary = await readFromBucket(account, st);
-    if (primary !== null)
-        return primary;
-    if (st.keychainPrefix !== LEGACY_KEYCHAIN_PREFIX) {
-        return await readFromBucket(account, {
-            ...st,
-            keychainPrefix: LEGACY_KEYCHAIN_PREFIX,
-        });
-    }
-    return null;
-}
-export async function keychainDelete(account, storage) {
-    const st = resolvedStorage(storage);
-    await fileDelete(account, st);
+            return linuxRead(account);
+    }
+    return fileRead(account);
+}
+export async function keychainDelete(account) {
     if (await useKeychain()) {
         if (process.platform === "darwin")
-            return macosDelete(account, st.keychainPrefix);
+            return macosDelete(account);
         if (process.platform === "linux")
-            return linuxDelete(account, st.keychainPrefix);
+            return linuxDelete(account);
     }
+    return fileDelete(account);
 }
-export async function keychainClearSession(session, storage) {
-    await keychainDelete(getSessionAccount(session), storage);
+/**
+ * Delete credentials for a specific session
+ */
+export async function keychainClearSession(session) {
+    await keychainDelete(getSessionAccount(session));
 }
-export async function keychainClearAll(storage) {
-    await keychainDelete("oauth", storage);
-    await keychainDelete("apikey", storage);
+/**
+ * Delete all stored credentials (default OAuth + API key).
+ * Does NOT clear named sessions — use keychainClearSession() for those.
+ */
+export async function keychainClearAll() {
+    await keychainDelete("oauth");
+    await keychainDelete("apikey");
 }
+/**
+ * Returns the storage mechanism name for display purposes
+ */
 export function getStorageName() {
     if (process.platform === "darwin")
         return "macOS Keychain";
@@ -239,3 +269,4 @@ export function getStorageName() {
         return "encrypted file";
     return "encrypted file";
 }
+//# sourceMappingURL=keychain.js.map

package/dist/auth/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/auth/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,kFAAkF;AAClF,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,GAAG,cAAc,IAAI,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,cAAc;IACrB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,uBAAuB;AAEvB,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,KAAa;IAEb,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB;YACzB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,MAAM,aAAa,CAAC,UAAU,EAAE;QAC9B,sBAAsB;QACtB,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;YACjD,uBAAuB;YACvB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB;YACzB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,KAAa;IAEb,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,EAAE;QACzC,OAAO;QACP,SAAS;QACT,aAAa,OAAO,EAAE;QACtB,SAAS;QACT,cAAc;QACd,SAAS;QACT,OAAO;KACR,CAAC,CAAC;IACH,qCAAqC;IACrC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACzB,MAAM,KAAK,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE;YACpD,QAAQ;YACR,SAAS;YACT,cAAc;YACd,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,aAAa,EAAE;YACjC,OAAO;YACP,SAAS;YACT,cAAc;YACd,SAAS;YACT,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,SAAS,SAAS;IAChB,mDAAmD;IACnD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;IACpE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAAe,EACf,KAAa;IAEb,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,8DAA8D;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAU,EAAE,EAAS,CAAC,CAAC;IAC3E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAEzE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAe;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,GAAU,EACV,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAQ,CAC9B,CAAC;QACF,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACrD,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAe;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,sCAAsC;AAEtC,KAAK,UAAU,mBAAmB;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,GAAmB,IAAI,CAAC;AAE7C,KAAK,UAAU,WAAW;IACxB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,iBAAiB,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,mBAAmB;AAEnB,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,KAAa;IAEb,kFAAkF;IAClF,gFAAgF;IAChF,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEhC,6CAA6C;IAC7C,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe;IAEf,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe;IAEf,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAgB;IACzD,MAAM,cAAc,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAC1D,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

package/dist/auth/oauth.d.ts

@@ -1,9 +1,44 @@
+/**
+ * OAuth PKCE Authentication Flow
+ *
+ * Authorization Code Flow with Proof Key for Code Exchange (PKCE)
+ * for native/CLI applications. Uses WorkOS as the identity provider.
+ *
+ * Flow:
+ * 1. Generate PKCE code_verifier + code_challenge
+ * 2. Start localhost callback server
+ * 3. Open browser to WorkOS authorization URL
+ * 4. Receive authorization code via callback
+ * 5. Exchange code + verifier for tokens
+ * 6. Store tokens in OS keychain
+ */
 import type { OAuthTokens, ZivisConfig } from "../types.js";
+/**
+ * Run the full OAuth PKCE login flow.
+ *
+ * 1. Generate PKCE pair + state
+ * 2. Start localhost callback server
+ * 3. Open browser to WorkOS
+ * 4. Wait for callback
+ * 5. Exchange code for tokens
+ * 6. Store tokens in keychain (under session-qualified key)
+ *
+ * @param config - Server configuration
+ * @param session - Optional named session for multi-tenant isolation
+ * @param organizationId - Optional WorkOS org ID to scope the login to a specific org
+ * @param opts - Display and confirmation options
+ * @returns The OAuth tokens
+ */
 export interface LoginOptions {
+    /** Human-readable org name, shown in the pre-browser confirmation prompt. */
     orgName?: string;
-    sessionLabel?: string;
+    /** Skip the pre-browser confirmation prompt (for scripted/interactive-wizard callers). */
     skipConfirm?: boolean;
+    /**
+     * Instead of auto-opening the browser, print the auth URL and wait for the user
+     * to paste it into a private/incognito window manually. Useful when the browser
+     * already has a session for a different org that would override the requested org.
+     */
     printUrlOnly?: boolean;
-    incognito?: boolean;
 }
 export declare function login(config?: ZivisConfig, session?: string, organizationId?: string, opts?: LoginOptions): Promise<OAuthTokens>;

package/dist/auth/oauth.js

@@ -1,3 +1,17 @@
+/**
+ * OAuth PKCE Authentication Flow
+ *
+ * Authorization Code Flow with Proof Key for Code Exchange (PKCE)
+ * for native/CLI applications. Uses WorkOS as the identity provider.
+ *
+ * Flow:
+ * 1. Generate PKCE code_verifier + code_challenge
+ * 2. Start localhost callback server
+ * 3. Open browser to WorkOS authorization URL
+ * 4. Receive authorization code via callback
+ * 5. Exchange code + verifier for tokens
+ * 6. Store tokens in OS keychain
+ */
 import * as crypto from "node:crypto";
 import * as http from "node:http";
 import * as readline from "node:readline/promises";
@@ -5,8 +19,8 @@ import { URL } from "node:url";
 import open from "open";
 import { keychainStore, getSessionAccount } from "./keychain.js";
 import { decodeJwtPayload } from "./jwt.js";
-import { DEFAULT_CONFIG, credentialStorageFromConfig } from "../types.js";
-const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+import { DEFAULT_CONFIG } from "../types.js";
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
 function generatePKCE() {
     const verifier = crypto.randomBytes(32).toString("base64url");
     const challenge = crypto
@@ -28,15 +42,29 @@ function buildAuthUrl(config, codeChallenge, state, organizationId) {
         state,
         scope: "openid profile email offline_access",
     });
+    // Scope the OAuth session to a specific org so the JWT has the correct org_id
     if (organizationId) {
         params.set("organization_id", organizationId);
     }
+    // Force the WorkOS login screen even when an active session exists.
+    // Why: users in multiple orgs must visually confirm which identity/org they're using —
+    // silent SSO could let them accidentally bind the wrong org to a project.
     params.set("prompt", "login");
+    // Handle both WorkOS (auth.workos.com -> /authorize) and custom AuthKit (authkit.app -> /oauth2/authorize)
     const isAuthKit = config.oauthApiUrl.includes("authkit.app");
     const authPath = isAuthKit ? "/oauth2/authorize" : "/authorize";
     const authUrl = `${config.oauthApiUrl}${authPath}?${params.toString()}`;
+    // We used to chain custom AuthKit hosts through /logout?return_to=... so
+    // browser cookies did not override organization_id. AuthKit OIDC metadata
+    // does not advertise end_session_endpoint, and *.authkit.app/logout returns
+    // 404 — so that redirect is unusable. Rely on prompt=login plus
+    // organization_id for org-scoped flows instead.
     return authUrl;
 }
+/**
+ * Start a localhost HTTP server to receive the OAuth callback.
+ * Returns the authorization code on success.
+ */
 function startCallbackServer(port, expectedState) {
     return new Promise((resolve, reject) => {
         const server = http.createServer((req, res) => {
@@ -70,6 +98,7 @@ function startCallbackServer(port, expectedState) {
                 resolve(code);
             }
             else {
+                // 404 for any other path
                 res.writeHead(404, { "Content-Type": "text/html" });
                 res.end(`<!DOCTYPE html>
 <html>
@@ -85,6 +114,7 @@ function startCallbackServer(port, expectedState) {
             reject(new Error(`Failed to start callback server on port ${port}: ${err.message}`));
         });
         server.listen(port, "127.0.0.1");
+        // Timeout
         setTimeout(() => {
             server.close();
             reject(new Error("Authentication timed out after 5 minutes"));
@@ -113,7 +143,11 @@ function callbackHtml(success, errorMessage) {
 </body>
 </html>`;
 }
+/**
+ * Exchange authorization code for tokens via WorkOS token endpoint
+ */
 async function exchangeCodeForTokens(config, code, codeVerifier) {
+    // Handle both WorkOS (auth.workos.com -> /oauth/token) and custom AuthKit (authkit.app -> /oauth2/token)
     const tokenPath = config.oauthApiUrl.includes("authkit.app") ? "/oauth2/token" : "/oauth/token";
     const tokenUrl = `${config.oauthApiUrl}${tokenPath}`;
     const response = await fetch(tokenUrl, {
@@ -135,14 +169,6 @@ async function exchangeCodeForTokens(config, code, codeVerifier) {
         throw new Error(errorMsg);
     }
     const data = (await response.json());
-    if (!data.refresh_token) {
-        console.error("[zivis] WARNING: WorkOS did not return a refresh_token. " +
-            "Verify the OAuth client has Refresh Tokens / offline_access enabled in the WorkOS dashboard. " +
-            "Without this, sessions will expire and require manual re-login.");
-    }
-    else {
-        console.error("[zivis] Token exchange complete — refresh_token received, session will auto-renew.");
-    }
     return {
         access_token: data.access_token,
         refresh_token: data.refresh_token,
@@ -157,12 +183,13 @@ export async function login(config = DEFAULT_CONFIG, session, organizationId, op
     const { verifier, challenge } = generatePKCE();
     const state = generateState();
     const authUrl = buildAuthUrl(config, challenge, state, organizationId);
+    // Pre-browser confirmation: only when an org is scoped AND the terminal is interactive.
+    // Protects users in multiple orgs from accidentally authenticating to the wrong tenant.
     if (organizationId && !opts.skipConfirm && process.stderr.isTTY && process.stdin.isTTY) {
         const orgLabel = opts.orgName
             ? `${opts.orgName} (${organizationId})`
             : organizationId;
-        const displaySession = opts.sessionLabel ?? session;
-        const sessionLabel = displaySession ? ` as session "${displaySession}"` : "";
+        const sessionLabel = session ? ` as session "${session}"` : "";
         console.error("");
         console.error(`[zivis] About to authenticate to org: ${orgLabel}${sessionLabel}`);
         const rl = readline.createInterface({
@@ -182,6 +209,7 @@ export async function login(config = DEFAULT_CONFIG, session, organizationId, op
     else if (organizationId) {
         console.error(`[zivis] Login scoped to organization: ${organizationId}`);
     }
+    // Start callback server before opening browser
     const codePromise = startCallbackServer(config.callbackPort, state);
     if (opts.printUrlOnly) {
         console.error("[zivis] Open this URL in a private/incognito browser window:");
@@ -190,38 +218,18 @@ export async function login(config = DEFAULT_CONFIG, session, organizationId, op
         console.error("");
         console.error("[zivis] Waiting for login...");
     }
-    else if (opts.incognito) {
-        let opened = false;
-        for (const app of [
-            { name: "google chrome", args: ["--incognito"] },
-            { name: "chromium", args: ["--incognito"] },
-            { name: "firefox", args: ["-private-window"] },
-        ]) {
-            try {
-                await open(authUrl, { app: { name: app.name, arguments: [authUrl, ...app.args] } });
-                console.error(`[zivis] Opened private window in ${app.name} — waiting for login...`);
-                opened = true;
-                break;
-            }
-            catch {
-            }
-        }
-        if (!opened) {
-            console.error("[zivis] Could not open an incognito window automatically.");
-            console.error("[zivis] Paste this URL into a private/incognito browser window:");
-            console.error("");
-            console.error(`  ${authUrl}`);
-            console.error("");
-            console.error("[zivis] Waiting for login...");
-        }
-    }
     else {
         console.error("[zivis] Opening browser for authentication...");
         await open(authUrl);
         console.error("[zivis] Waiting for login...");
     }
+    // Wait for the authorization code
     const code = await codePromise;
+    // Exchange code for tokens
     const tokens = await exchangeCodeForTokens(config, code, verifier);
+    // Hard verification: if we requested a specific org, the returned JWT
+    // MUST be scoped to that org. Refuse to store mismatched tokens — this is
+    // the last-ditch guard against silently binding the wrong tenant.
     if (organizationId) {
         const claims = decodeJwtPayload(tokens.access_token);
         const jwtOrgId = claims?.org_id;
@@ -235,6 +243,8 @@ export async function login(config = DEFAULT_CONFIG, session, organizationId, op
         }
         console.error(`[zivis] \u2713 JWT org_id verified: ${jwtOrgId}`);
     }
-    await keychainStore(getSessionAccount(session), JSON.stringify(tokens), credentialStorageFromConfig(config));
+    // Store in keychain (session-qualified key for multi-tenant isolation)
+    await keychainStore(getSessionAccount(session), JSON.stringify(tokens));
     return tokens;
 }
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAOpD,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CACnB,MAAmB,EACnB,aAAqB,EACrB,KAAa,EACb,cAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,aAAa;QAC/B,YAAY,EAAE,oBAAoB,MAAM,CAAC,YAAY,WAAW;QAChE,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IAEH,8EAA8E;IAC9E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAChD,CAAC;IAED,oEAAoE;IACpE,uFAAuF;IACvF,0EAA0E;IAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE9B,2GAA2G;IAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAChE,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAExE,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,gDAAgD;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,aAAqB;IAErB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAEtE,IAAI,SAAS,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClD,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAElE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBAEpD,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;oBACjD,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;oBACtC,OAAO;gBACT,CAAC;gBAED,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC5B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC,CAAC;oBACtE,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBACpC,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC,CAAC;oBAC/D,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5B,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC;;;;;2CAK2B,SAAS,CAAC,QAAQ;;QAErD,CAAC,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CACJ,IAAI,KAAK,CAAC,2CAA2C,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAC7E,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjC,UAAU;QACV,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;QAChE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB,EAAE,YAAqB;IAC3D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;;;;;;;;QAQH,CAAC;IACP,CAAC;IACD,OAAO;;;;;OAKF,YAAY,IAAI,eAAe;;;QAG9B,CAAC;AACT,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,MAAmB,EACnB,IAAY,EACZ,YAAoB;IAEpB,yGAAyG;IACzG,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IAChG,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,SAAS,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,IAAI;YACJ,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,oBAAoB,MAAM,CAAC,YAAY,WAAW;SACjE,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGrD,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,IAAI,uBAAuB,CAAC;QACnF,OAAO,CAAC,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;QAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AA+BD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,SAAsB,cAAc,EACpC,OAAgB,EAChB,cAAuB,EACvB,OAAqB,EAAE;IAEvB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAEvE,wFAAwF;IACxF,wFAAwF;IACxF,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO;YAC3B,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,KAAK,cAAc,GAAG;YACvC,CAAC,CAAC,cAAc,CAAC;QACnB,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,yCAAyC,QAAQ,GAAG,YAAY,EAAE,CAAC,CAAC;QAClF,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpF,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,yCAAyC,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,+CAA+C;IAC/C,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAEpE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;IAED,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;IAE/B,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEnE,sEAAsE;IACtE,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,2DAA2D;gBAC3D,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,+BAA+B,cAAc,cAAc,QAAQ,IAAI;gBACvE,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,MAAM,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAExE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/sessions.d.ts

@@ -1,8 +1,28 @@
+/**
+ * Session Index Management
+ *
+ * Tracks named OAuth sessions in a JSON file so users can list
+ * and manage multiple tenant sessions without enumerating keychain entries.
+ *
+ * Session index file: ~/.config/{configDir}/sessions.json
+ */
 import type { SessionIndex, SessionInfo } from "../types.js";
-import { type CredentialStorage } from "../types.js";
-export declare function loadSessionIndex(storage?: CredentialStorage): Promise<SessionIndex>;
-export declare function saveSessionEntry(name: string, email: string, storage?: CredentialStorage): Promise<void>;
-export declare function removeSessionEntry(name: string, storage?: CredentialStorage): Promise<void>;
-export declare function listSessions(storage?: CredentialStorage): Promise<Array<{
+/**
+ * Load the session index from disk.
+ * Returns an empty object if the file doesn't exist.
+ */
+export declare function loadSessionIndex(): Promise<SessionIndex>;
+/**
+ * Add or update a session entry in the index.
+ */
+export declare function saveSessionEntry(name: string, email: string): Promise<void>;
+/**
+ * Remove a session entry from the index.
+ */
+export declare function removeSessionEntry(name: string): Promise<void>;
+/**
+ * List all sessions with their metadata.
+ */
+export declare function listSessions(): Promise<Array<{
     name: string;
 } & SessionInfo>>;