@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.3

package/dist/auth/sessions.js

@@ -1,50 +1,69 @@
+/**
+ * Session Index Management
+ *
+ * Tracks named OAuth sessions in a JSON file so users can list
+ * and manage multiple tenant sessions without enumerating keychain entries.
+ *
+ * Session index file: ~/.config/{configDir}/sessions.json
+ */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
 import { ENV_CONFIG } from "../types.js";
-function resolveSessionStorage(storage) {
-    return (storage ?? {
-        keychainPrefix: ENV_CONFIG.keychainPrefix,
-        configDir: ENV_CONFIG.configDir,
-    });
-}
-function getSessionIndexPath(storage) {
-    const { configDir } = resolveSessionStorage(storage);
+function getSessionIndexPath() {
+    const configDir = ENV_CONFIG.configDir;
     const base = process.platform === "win32"
         ? process.env.APPDATA || os.homedir()
         : path.join(os.homedir(), ".config");
     return path.join(base, configDir, "sessions.json");
 }
-export async function loadSessionIndex(storage) {
+/**
+ * Load the session index from disk.
+ * Returns an empty object if the file doesn't exist.
+ */
+export async function loadSessionIndex() {
     try {
-        const raw = await fs.readFile(getSessionIndexPath(storage), "utf8");
+        const raw = await fs.readFile(getSessionIndexPath(), "utf8");
         return JSON.parse(raw);
     }
     catch {
         return {};
     }
 }
-async function saveSessionIndex(index, storage) {
-    const filePath = getSessionIndexPath(storage);
+/**
+ * Save the full session index to disk.
+ */
+async function saveSessionIndex(index) {
+    const filePath = getSessionIndexPath();
     await fs.mkdir(path.dirname(filePath), { recursive: true });
     await fs.writeFile(filePath, JSON.stringify(index, null, 2) + "\n", {
         mode: 0o600,
     });
 }
-export async function saveSessionEntry(name, email, storage) {
-    const index = await loadSessionIndex(storage);
+/**
+ * Add or update a session entry in the index.
+ */
+export async function saveSessionEntry(name, email) {
+    const index = await loadSessionIndex();
     index[name] = {
         email,
         createdAt: index[name]?.createdAt || new Date().toISOString(),
     };
-    await saveSessionIndex(index, storage);
+    await saveSessionIndex(index);
 }
-export async function removeSessionEntry(name, storage) {
-    const index = await loadSessionIndex(storage);
+/**
+ * Remove a session entry from the index.
+ */
+export async function removeSessionEntry(name) {
+    const index = await loadSessionIndex();
     delete index[name];
-    await saveSessionIndex(index, storage);
+    await saveSessionIndex(index);
 }
-export async function listSessions(storage) {
-    const index = await loadSessionIndex(storage);
+/**
+ * List all sessions with their metadata.
+ */
+export async function listSessions() {
+    const index = await loadSessionIndex();
     return Object.entries(index).map(([name, info]) => ({ name, ...info }));
 }
+//# sourceMappingURL=sessions.js.map

package/dist/auth/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,SAAS,mBAAmB;IAC1B,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE;QACrC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,KAAmB;IACjD,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QAClE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,KAAa;IAEb,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,KAAK;QACL,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC9D,CAAC;IACF,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAGhC,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/auth/token-refresh.d.ts

@@ -1,4 +1,24 @@
-import type { OAuthTokens, ZivisConfig, CredentialStorage } from "../types.js";
-export declare function loadTokens(session?: string, storage?: CredentialStorage): Promise<OAuthTokens | null>;
+/**
+ * Token Refresh
+ *
+ * Handles silent refresh of OAuth access tokens using the stored
+ * refresh token. Checks expiry with a 5-minute buffer to avoid
+ * mid-request expirations.
+ */
+import type { OAuthTokens, ZivisConfig } from "../types.js";
+/**
+ * Load OAuth tokens from keychain
+ * @param session - Optional named session for multi-tenant isolation
+ */
+export declare function loadTokens(session?: string): Promise<OAuthTokens | null>;
+/**
+ * Check if the access token is still valid (with 5-min buffer)
+ */
 export declare function isTokenValid(tokens: OAuthTokens): boolean;
+/**
+ * Get a valid access token, refreshing if necessary.
+ *
+ * Returns the access token string, or null if no tokens stored
+ * or refresh fails (user needs to re-login).
+ */
 export declare function getValidAccessToken(config?: ZivisConfig): Promise<string | null>;

package/dist/auth/token-refresh.js

@@ -1,8 +1,19 @@
+/**
+ * Token Refresh
+ *
+ * Handles silent refresh of OAuth access tokens using the stored
+ * refresh token. Checks expiry with a 5-minute buffer to avoid
+ * mid-request expirations.
+ */
 import { keychainRead, keychainStore, keychainDelete, getSessionAccount } from "./keychain.js";
-import { DEFAULT_CONFIG, credentialStorageFromConfig } from "../types.js";
-const EXPIRY_BUFFER_MS = 30 * 1000;
-export async function loadTokens(session, storage) {
-    const raw = await keychainRead(getSessionAccount(session), storage);
+import { DEFAULT_CONFIG } from "../types.js";
+const EXPIRY_BUFFER_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Load OAuth tokens from keychain
+ * @param session - Optional named session for multi-tenant isolation
+ */
+export async function loadTokens(session) {
+    const raw = await keychainRead(getSessionAccount(session));
     if (!raw)
         return null;
     try {
@@ -12,15 +23,17 @@ export async function loadTokens(session, storage) {
         return null;
     }
 }
+/**
+ * Check if the access token is still valid (with 5-min buffer)
+ */
 export function isTokenValid(tokens) {
     return tokens.expires_at > Date.now() + EXPIRY_BUFFER_MS;
 }
-const FATAL_REFRESH_ERRORS = new Set([
-    "invalid_grant",
-    "invalid_client",
-    "unauthorized_client",
-]);
+/**
+ * Refresh the access token using the refresh token
+ */
 async function refreshAccessToken(refreshToken, config) {
+    // Handle both WorkOS (auth.workos.com -> /oauth/token) and custom AuthKit (authkit.app -> /oauth2/token)
     const tokenPath = config.oauthApiUrl.includes("authkit.app") ? "/oauth2/token" : "/oauth/token";
     const tokenUrl = `${config.oauthApiUrl}${tokenPath}`;
     const response = await fetch(tokenUrl, {
@@ -34,55 +47,45 @@ async function refreshAccessToken(refreshToken, config) {
     });
     if (!response.ok) {
         const error = (await response.json().catch(() => ({})));
-        const errorCode = error.error || "";
-        const errorMsg = error.error_description || errorCode || "Token refresh failed";
-        const err = new Error(errorMsg);
-        err.oauthErrorCode = errorCode;
-        throw err;
+        throw new Error(error.error_description || error.error || "Token refresh failed");
     }
     const data = (await response.json());
     return {
         access_token: data.access_token,
+        // Use new refresh token if provided (rotation), otherwise keep existing
         refresh_token: data.refresh_token || refreshToken,
         expires_at: Date.now() + data.expires_in * 1000,
         id_token: data.id_token,
     };
 }
+/**
+ * Get a valid access token, refreshing if necessary.
+ *
+ * Returns the access token string, or null if no tokens stored
+ * or refresh fails (user needs to re-login).
+ */
 export async function getValidAccessToken(config = DEFAULT_CONFIG) {
     const session = config.session;
     const account = getSessionAccount(session);
-    const st = credentialStorageFromConfig(config);
-    const tokens = await loadTokens(session, st);
+    const tokens = await loadTokens(session);
     if (!tokens) {
         return null;
     }
     if (isTokenValid(tokens)) {
         return tokens.access_token;
     }
-    const expiresInSec = Math.round((tokens.expires_at - Date.now()) / 1000);
     if (tokens.refresh_token) {
-        console.error(`[zivis] Access token expiring in ${expiresInSec}s — refreshing silently...`);
         try {
             const newTokens = await refreshAccessToken(tokens.refresh_token, config);
-            await keychainStore(account, JSON.stringify(newTokens), st);
-            const newExpiresInMin = Math.round((newTokens.expires_at - Date.now()) / 1000 / 60);
-            console.error(`[zivis] Token refreshed successfully — new token valid for ~${newExpiresInMin}m`);
+            await keychainStore(account, JSON.stringify(newTokens));
             return newTokens.access_token;
         }
         catch (err) {
-            const oauthCode = err.oauthErrorCode;
-            const isFatal = oauthCode && FATAL_REFRESH_ERRORS.has(oauthCode);
-            console.error(`[zivis] Token refresh failed (${oauthCode ?? "network/server error"}):`, err instanceof Error ? err.message : err);
-            if (isFatal) {
-                console.error("[zivis] Refresh token revoked or expired — clearing stored credentials. Run: zivis auth login");
-                await keychainDelete(account, st);
-            }
-            else {
-                console.error("[zivis] Transient refresh error — keeping stored credentials, will retry on next request.");
-            }
+            console.error("[zivis] Token refresh failed:", err instanceof Error ? err.message : err);
+            await keychainDelete(account);
             return null;
         }
     }
-    console.error(`[zivis] Access token expired ${Math.abs(expiresInSec)}s ago and no refresh token stored — re-login required`);
     return null;
 }
+//# sourceMappingURL=token-refresh.js.map

package/dist/auth/token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../src/auth/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE/F,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEpD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB;IAC/C,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,OAAO,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,YAAoB,EACpB,MAAmB;IAEnB,yGAAyG;IACzG,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IAChG,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,SAAS,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGrD,CAAC;QACF,MAAM,IAAI,KAAK,CACb,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,IAAI,sBAAsB,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,wEAAwE;QACxE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;QACjD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;QAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAsB,cAAc;IAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACzE,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YACxD,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,+BAA+B,EAC/B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;YACF,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli.d.ts

@@ -1,6 +1,23 @@
+/**
+ * CLI Commands
+ *
+ * Handles all user-facing CLI interactions:
+ * - login: OAuth PKCE browser login (with optional --session for multi-tenant)
+ * - configure: API key setup (interactive or --api-key flag)
+ * - status: Show auth state, org, plan usage
+ * - logout: Clear stored credentials (with optional --session)
+ * - sessions: List all stored sessions
+ * - serve: Start MCP server (called by IDE, not by user directly)
+ */
 import type { ZivisConfig } from "./types.js";
+/**
+ * Parse CLI arguments into a command and options
+ */
 export declare function parseArgs(argv: string[]): {
     command: string;
     options: Record<string, string>;
 };
-export declare function runCli(command: string, _options: Record<string, string>, config?: ZivisConfig): Promise<void>;
+/**
+ * Run the appropriate CLI command
+ */
+export declare function runCli(command: string, options: Record<string, string>, config?: ZivisConfig): Promise<void>;