@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.3

package/dist/tools/update-endpoint.js

@@ -1,3 +1,8 @@
+/**
+ * zivis_update_endpoint — Update a specific endpoint's configuration
+ *
+ * Maps to: PATCH /api/rt/applications/:id/endpoints/:endpointId
+ */
 import { z } from "zod";
 import { requireApplicationId } from "../resolve-application-id.js";
 import { sanitizeResponse } from "../sanitize.js";
@@ -74,6 +79,7 @@ export function createUpdateEndpointHandler(apiClient) {
         }
         const application_id = req.id;
         const apiPath = `/api/rt/applications/${application_id}/endpoints/${params.endpoint_id}`;
+        // Map snake_case params to camelCase API fields, only including provided values
         const body = {};
         if (params.path !== undefined)
             body.path = params.path;
@@ -136,3 +142,4 @@ export function createUpdateEndpointHandler(apiClient) {
         }
     };
 }
+//# sourceMappingURL=update-endpoint.js.map

package/dist/tools/update-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-endpoint.js","sourceRoot":"","sources":["../../src/tools/update-endpoint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;+CAOI,CAAC;AAEhD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qFAAqF,CACtF;IACH,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,CAAC,uDAAuD,CAAC;IACpE,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,oCAAoC,CAAC;IACjD,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;SAClE,QAAQ,EAAE;SACV,QAAQ,CAAC,aAAa,CAAC;IAC1B,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sBAAsB,CAAC;IACnC,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,uDAAuD,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,+CAA+C,CAAC;IAC5D,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6BAA6B,CAAC;IAC1C,aAAa,EAAE,CAAC;SACb,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;SACjD,QAAQ,EAAE;SACV,QAAQ,CAAC,oCAAoC,CAAC;IACjD,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,mEAAmE,CAAC;IAChF,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sEAAsE,CAAC;IACnF,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC;AAqBF,MAAM,UAAU,2BAA2B,CAAC,SAAoB;IAC9D,OAAO,KAAK,EAAE,MAcb,EAAE,EAAE;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACnE,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,wBAAwB,cAAc,cAAc,MAAM,CAAC,WAAW,EAAE,CAAC;QAEzF,gFAAgF;QAChF,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7D,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAChE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvD,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QACjF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACzE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QACjF,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC1F,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QACjF,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;YAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE7F,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAmB,OAAO,EAAE,IAAI,CAAC,CAAC;YAElE,MAAM,MAAM,GAAG;gBACb,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,YAAY,EAAE,EAAE,CAAC,WAAW;gBAC5B,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,aAAa,EAAE,EAAE,CAAC,YAAY;gBAC9B,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,aAAa,EAAE,EAAE,CAAC,YAAY;gBAC9B,gBAAgB,EAAE,EAAE,CAAC,eAAe;gBACpC,aAAa,EAAE,EAAE,CAAC,YAAY;gBAC9B,iBAAiB,EAAE,EAAE,CAAC,gBAAgB;gBACtC,UAAU,EAAE,EAAE,CAAC,SAAS;gBACxB,UAAU,EAAE,EAAE,CAAC,SAAS;aACzB,CAAC;YAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAE3C,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;qBACzC;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;YACnE,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/update-mermaid-source.d.ts

@@ -1,3 +1,16 @@
+/**
+ * zivis_update_mermaid_source — Update the Mermaid source of a diagram
+ *
+ * Maps to: PATCH /api/diagrams/:id with { content: <mermaidSource> }
+ *
+ * Workflow for an editing AI:
+ *   1. Call zivis_get_diagram with the diagram_id — returns current content (Mermaid text) + metadata.
+ *   2. Reason about the change the user requested. Produce a new Mermaid source string.
+ *   3. Call this tool with the new source to persist it.
+ *
+ * Use this for diagrams whose contentType is "mermaid". For canvas/node diagrams
+ * (contentType = "canvas"), use zivis_manage_diagram instead.
+ */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const UPDATE_MERMAID_SOURCE_NAME = "zivis_update_mermaid_source";

package/dist/tools/update-mermaid-source.js

@@ -1,3 +1,16 @@
+/**
+ * zivis_update_mermaid_source — Update the Mermaid source of a diagram
+ *
+ * Maps to: PATCH /api/diagrams/:id with { content: <mermaidSource> }
+ *
+ * Workflow for an editing AI:
+ *   1. Call zivis_get_diagram with the diagram_id — returns current content (Mermaid text) + metadata.
+ *   2. Reason about the change the user requested. Produce a new Mermaid source string.
+ *   3. Call this tool with the new source to persist it.
+ *
+ * Use this for diagrams whose contentType is "mermaid". For canvas/node diagrams
+ * (contentType = "canvas"), use zivis_manage_diagram instead.
+ */
 import { z } from "zod";
 import { sanitizeResponse } from "../sanitize.js";
 export const UPDATE_MERMAID_SOURCE_NAME = "zivis_update_mermaid_source";
@@ -60,3 +73,4 @@ export function createUpdateMermaidSourceHandler(apiClient) {
         }
     };
 }
+//# sourceMappingURL=update-mermaid-source.js.map

package/dist/tools/update-mermaid-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-mermaid-source.js","sourceRoot":"","sources":["../../src/tools/update-mermaid-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG;;;;;;;;;;;;iIAYgF,CAAC;AAElI,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IAChE,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,8EAA8E,CAAC;IAC3F,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sGAAsG,CAAC;CACpH,CAAC;AAQF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;QAC/D,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,SAAoB;IACnE,OAAO,KAAK,EAAE,MAAiC,EAAE,EAAE;QACjD,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;YAC3D,IAAI,CAAC,UAAU;gBAAE,OAAO,WAAW,CAAC,wBAAwB,CAAC,CAAC;YAC9D,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1D,OAAO,WAAW,CAAC,gDAAgD,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,IAAI,GAA4B,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAClE,IAAI,WAAW;gBAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;YAEhD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,iBAAiB,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3E,OAAO,aAAa,CAAC;gBACnB,EAAE,EAAE,IAAI;gBACR,UAAU;gBACV,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,IAAI,iCAAiC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/verify-trust-mark.d.ts

@@ -1,3 +1,8 @@
+/**
+ * zivis_verify_trust_mark — Verify a trust mark by hash or compact token
+ *
+ * Maps to: GET /api/verify/:hash OR GET /api/verify-token/:token (public, no auth)
+ */
 import { z } from "zod";
 import type { ZivisConfig } from "../types.js";
 export declare const VERIFY_TRUST_MARK_NAME = "zivis_verify_trust_mark";

package/dist/tools/verify-trust-mark.js

@@ -1,3 +1,8 @@
+/**
+ * zivis_verify_trust_mark — Verify a trust mark by hash or compact token
+ *
+ * Maps to: GET /api/verify/:hash OR GET /api/verify-token/:token (public, no auth)
+ */
 import { z } from "zod";
 export const VERIFY_TRUST_MARK_NAME = "zivis_verify_trust_mark";
 export const VERIFY_TRUST_MARK_DESCRIPTION = `Verify a ZIVIS Trust Mark by its SHA-256 hash or Ed25519 compact token.
@@ -100,3 +105,4 @@ export function createVerifyTrustMarkHandler(config) {
         }
     };
 }
+//# sourceMappingURL=verify-trust-mark.js.map

package/dist/tools/verify-trust-mark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-trust-mark.js","sourceRoot":"","sources":["../../src/tools/verify-trust-mark.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEhE,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;+DAwBkB,CAAC;AAEhE,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;IAC7E,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;CACxE,CAAC;AAEF,MAAM,UAAU,4BAA4B,CAAC,MAAmB;IAC9D,OAAO,KAAK,EAAE,MAAiD,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YAEhF,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,mEAAmE;yBAC1E;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,iEAAiE;yBACxE;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,IAAI,GAAW,CAAC;YAChB,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,eAAe,kBAAkB,CAAC,MAAM,CAAC,IAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACN,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,aAAc,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAE9B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,4BAA4B,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;yBAClF;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;qBACpC;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC;YACrE,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -1,13 +1,18 @@
+/**
+ * Shared types for the ZIVIS MCP Security Server
+ */
 export interface OAuthTokens {
     access_token: string;
-    refresh_token?: string;
+    refresh_token: string;
     expires_at: number;
     id_token?: string;
 }
 export type AuthMethod = "oauth" | "apikey" | "none";
 export interface AuthCredentials {
     method: AuthMethod;
+    /** OAuth access token (when method === "oauth") */
     accessToken?: string;
+    /** WorkOS API key (when method === "apikey") */
     apiKey?: string;
 }
 export interface AuthStatus {
@@ -181,31 +186,26 @@ export interface SessionInfo {
 }
 export type SessionIndex = Record<string, SessionInfo>;
 export interface ProjectBinding {
+    /** Expected ZIVIS_SESSION value (e.g., "zivis", "acme-corp") */
     session: string;
+    /** Zivis org UUID (API) */
     orgId?: string;
+    /** WorkOS org id — OAuth login and JWT org_id use this boundary */
     workosOrgId?: string;
+    /** Human-readable org name */
     orgName?: string;
+    /** RT application UUID when this project is tied to a single app in the org */
     applicationId?: string;
+    /** Display name for that application (optional) */
     applicationName?: string;
-    apiBaseUrl?: string;
-    oauthApiUrl?: string;
-    oauthClientId?: string;
-    keychainPrefix?: string;
-    configDir?: string;
-}
-export interface CredentialStorage {
-    keychainPrefix: string;
-    configDir: string;
 }
 export interface ZivisConfig {
     apiBaseUrl: string;
     oauthClientId: string;
     oauthApiUrl: string;
     callbackPort: number;
+    /** Named session for multi-tenant isolation (from ZIVIS_SESSION env var) */
     session?: string;
-    keychainPrefix?: string;
-    configDir?: string;
-    workspacePath?: string;
 }
 interface EnvConfig {
     apiBaseUrl: string;
@@ -214,7 +214,7 @@ interface EnvConfig {
     keychainPrefix: string;
     configDir: string;
 }
+export declare const BUILD_ENV: "staging" | "production";
 export declare const ENV_CONFIG: EnvConfig;
 export declare const DEFAULT_CONFIG: ZivisConfig;
-export declare function credentialStorageFromConfig(config?: ZivisConfig): CredentialStorage;
 export {};

package/dist/types.js

@@ -1,27 +1,33 @@
-const PRODUCTION_DEFAULTS = {
-    apiBaseUrl: "https://app.zivis.ai",
-    oauthClientId: "client_01KGCPA567YEEVXV307AERCB93",
-    oauthApiUrl: "https://api.workos.com",
-    keychainPrefix: "ai.zivis.mcp",
-    configDir: "zivis",
-};
-export const ENV_CONFIG = {
-    apiBaseUrl: process.env.ZIVIS_API_URL || PRODUCTION_DEFAULTS.apiBaseUrl,
-    oauthClientId: process.env.ZIVIS_OAUTH_CLIENT_ID || PRODUCTION_DEFAULTS.oauthClientId,
-    oauthApiUrl: process.env.ZIVIS_OAUTH_API_URL || PRODUCTION_DEFAULTS.oauthApiUrl,
-    keychainPrefix: process.env.ZIVIS_KEYCHAIN_PREFIX || PRODUCTION_DEFAULTS.keychainPrefix,
-    configDir: process.env.ZIVIS_CONFIG_DIR || PRODUCTION_DEFAULTS.configDir,
+/**
+ * Shared types for the ZIVIS MCP Security Server
+ */
+const ENVIRONMENT_CONFIGS = {
+    staging: {
+        apiBaseUrl: "https://staging.zivis.ai",
+        oauthClientId: "client_01KGCMZ482H9SJPKTVRCC213K0",
+        oauthApiUrl: "https://delightful-abundance-65-staging.authkit.app",
+        keychainPrefix: "io.zivis.mcp.staging",
+        configDir: "zivis-staging",
+    },
+    production: {
+        apiBaseUrl: "https://app.zivis.ai",
+        oauthClientId: "client_01KGCPA567YEEVXV307AERCB93",
+        oauthApiUrl: "https://api.workos.com",
+        keychainPrefix: "io.zivis.mcp",
+        configDir: "zivis",
+    },
 };
+// Build-time environment (defaults to staging for development)
+export const BUILD_ENV = (process.env.ZIVIS_BUILD_ENV || "staging");
+// Get the config for the current build environment
+export const ENV_CONFIG = ENVIRONMENT_CONFIGS[BUILD_ENV] || ENVIRONMENT_CONFIGS.staging;
 export const DEFAULT_CONFIG = {
-    apiBaseUrl: ENV_CONFIG.apiBaseUrl,
-    oauthClientId: ENV_CONFIG.oauthClientId,
-    oauthApiUrl: ENV_CONFIG.oauthApiUrl,
+    // Runtime env vars override build-time defaults (useful for testing)
+    apiBaseUrl: process.env.ZIVIS_API_URL || ENV_CONFIG.apiBaseUrl,
+    oauthClientId: process.env.ZIVIS_OAUTH_CLIENT_ID || ENV_CONFIG.oauthClientId,
+    oauthApiUrl: process.env.ZIVIS_OAUTH_API_URL || ENV_CONFIG.oauthApiUrl,
     callbackPort: 8741,
+    // Session isolation for multi-tenant safety
     session: process.env.ZIVIS_SESSION || undefined,
 };
-export function credentialStorageFromConfig(config) {
-    return {
-        keychainPrefix: config?.keychainPrefix ?? ENV_CONFIG.keychainPrefix,
-        configDir: config?.configDir ?? ENV_CONFIG.configDir,
-    };
-}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoPH,MAAM,mBAAmB,GAA8B;IACrD,OAAO,EAAE;QACP,UAAU,EAAE,0BAA0B;QACtC,aAAa,EAAE,mCAAmC;QAClD,WAAW,EAAE,qDAAqD;QAClE,cAAc,EAAE,sBAAsB;QACtC,SAAS,EAAE,eAAe;KAC3B;IACD,UAAU,EAAE;QACV,UAAU,EAAE,sBAAsB;QAClC,aAAa,EAAE,mCAAmC;QAClD,WAAW,EAAE,wBAAwB;QACrC,cAAc,EAAE,cAAc;QAC9B,SAAS,EAAE,OAAO;KACnB;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAElD,CAAC;AAEjB,mDAAmD;AACnD,MAAM,CAAC,MAAM,UAAU,GACrB,mBAAmB,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;AAEhE,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,UAAU,CAAC,UAAU;IAC9D,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,UAAU,CAAC,aAAa;IAC5E,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,WAAW;IACtE,YAAY,EAAE,IAAI;IAClB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS;CAChD,CAAC"}

package/package.json

@@ -1,14 +1,7 @@
 {
   "name": "@zivis/mcp",
-  "version": "0.1.0-alpha.26",
+  "version": "0.1.0-alpha.3",
   "description": "ZIVIS MCP server — threat modeling, security scans, and AI red team tools for IDE integration",
-  "license": "Apache-2.0",
-  "homepage": "https://zivis.ai",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/zivisai/zivis-platform.git",
-    "directory": "zivis-mcp-security"
-  },
   "type": "module",
   "bin": {
     "zivis-mcp": "./dist/index.js"
@@ -22,15 +15,11 @@
     "./project-binding": "./dist/project-binding.js",
     "./server": "./dist/server.js",
     "./types": "./dist/types.js",
-    "./cli": "./dist/cli.js",
-    "./pattern-pack": "./dist/pattern-pack/index.js",
-    "./matcher": "./dist/matcher/index.js"
+    "./cli": "./dist/cli.js"
   },
   "files": [
     "dist",
-    "package.json",
-    "README.md",
-    "LICENSE"
+    "package.json"
   ],
   "publishConfig": {
     "access": "restricted"
@@ -39,27 +28,18 @@
     "node": ">=20.0.0"
   },
   "dependencies": {
-    "@ast-grep/lang-go": "^0.0.6",
-    "@ast-grep/lang-python": "^0.0.6",
-    "@ast-grep/napi": "^0.42.1",
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "js-yaml": "^4.1.0",
     "open": "^10.1.0",
     "zod": "^4.0.0"
   },
   "devDependencies": {
-    "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
-    "ajv": "^8.17.1",
-    "ajv-formats": "^3.0.1",
     "husky": "^9.1.7",
-    "tsx": "^4.19.2",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
   },
   "scripts": {
-    "build:pattern-pack": "tsx ../scripts/build-pattern-pack.ts",
-    "build": "tsc -p tsconfig.build.json && pnpm run build:pattern-pack && node scripts/ensure-symlink.cjs",
+    "build": "tsc && node scripts/ensure-symlink.cjs",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "test": "vitest run",

package/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2026 ZIVIS, Inc.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

package/README.md

@@ -1,19 +0,0 @@
-# @zivis/mcp
-
-The ZIVIS Model Context Protocol (MCP) server. Exposes ZIVIS's threat modeling, security scanning, and AI red-team tools to AI assistants in your IDE (Cursor, Claude Code, VS Code Copilot, Cline, Windsurf).
-
-You usually don't install or invoke this directly — it's the engine behind [`@zivis/cli`](https://www.npmjs.com/package/@zivis/cli). When you run `zivis mcp serve` (or your IDE calls it automatically), this package is what runs.
-
-## What is ZIVIS?
-
-ZIVIS is an architecture-inspection security platform — it looks at the components in your app, how they connect, and what trust boundaries exist between them. See <https://zivis.ai>.
-
-## Use via the CLI
-
-```bash
-npx @zivis/cli init      # interactive setup, configures your IDE's mcp.json
-```
-
-## License
-
-Apache 2.0 — see [`LICENSE`](./LICENSE).

package/dist/lib/inspect-cache.d.ts

@@ -1,10 +0,0 @@
-export interface LocatedArtifact {
-    path: string;
-    mtimeMs: number;
-}
-export declare function userCacheRoot(): string;
-export declare function deriveRepoId(cwd: string): Promise<string>;
-export declare function locateLatestArtifact(cwd: string): Promise<LocatedArtifact | undefined>;
-export declare const DEFAULT_INSPECT_CACHE_TTL_MS: number;
-export declare function inspectCacheTtlMs(): number;
-export declare function isFresh(mtimeMs: number, now?: number): boolean;

package/dist/lib/inspect-cache.js

@@ -1,75 +0,0 @@
-import * as fs from "node:fs/promises";
-import * as fssync from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import * as crypto from "node:crypto";
-import { exec } from "node:child_process";
-import { promisify } from "node:util";
-const execAsync = promisify(exec);
-export function userCacheRoot() {
-    const home = os.homedir();
-    if (process.platform === "darwin") {
-        return path.join(home, "Library", "Caches", "zivis");
-    }
-    if (process.platform === "win32") {
-        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
-        return path.join(localAppData, "zivis", "Cache");
-    }
-    const xdg = process.env.XDG_CACHE_HOME;
-    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
-}
-export async function deriveRepoId(cwd) {
-    const remote = await tryGit(cwd, "remote get-url origin");
-    if (remote) {
-        return "remote-" + sha256Short(remote);
-    }
-    return "path-" + sha256Short(cwd);
-}
-async function tryGit(cwd, args) {
-    try {
-        const { stdout } = await execAsync(`git ${args}`, { cwd });
-        const value = stdout.trim();
-        return value || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function sha256Short(value) {
-    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
-}
-export async function locateLatestArtifact(cwd) {
-    const repoId = await deriveRepoId(cwd);
-    const runsDir = path.join(userCacheRoot(), "repos", repoId, "inspect", "runs");
-    if (!fssync.existsSync(runsDir))
-        return undefined;
-    const candidates = [];
-    for (const entry of await fs.readdir(runsDir)) {
-        if (!entry.endsWith(".json"))
-            continue;
-        const full = path.join(runsDir, entry);
-        try {
-            const stat = await fs.stat(full);
-            candidates.push({ path: full, mtimeMs: stat.mtimeMs });
-        }
-        catch {
-        }
-    }
-    if (candidates.length === 0)
-        return undefined;
-    candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
-    return candidates[0];
-}
-export const DEFAULT_INSPECT_CACHE_TTL_MS = 15 * 60 * 1000;
-export function inspectCacheTtlMs() {
-    const raw = process.env.ZIVIS_INSPECT_CACHE_TTL_MS;
-    if (!raw)
-        return DEFAULT_INSPECT_CACHE_TTL_MS;
-    const parsed = Number.parseInt(raw, 10);
-    if (!Number.isFinite(parsed) || parsed <= 0)
-        return DEFAULT_INSPECT_CACHE_TTL_MS;
-    return parsed;
-}
-export function isFresh(mtimeMs, now = Date.now()) {
-    return now - mtimeMs <= inspectCacheTtlMs();
-}

package/dist/lib/next-steps.d.ts

@@ -1,27 +0,0 @@
-export interface NextStep {
-    id: string;
-    label: string;
-    tool: string;
-    args_hint?: Record<string, unknown>;
-    why: string;
-    requires_tier?: "free" | "pro" | "enterprise";
-}
-export interface ZivisToolPayload<T> {
-    result: T;
-    next_steps?: NextStep[];
-    summary?: string;
-}
-export declare function withNextSteps<T>(result: T, nextSteps: NextStep[], summary?: string): {
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-    isError?: boolean;
-};
-export declare function withNextStepsError(message: string, nextSteps: NextStep[], summary?: string): {
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-    isError: true;
-};