@zivis/mcp 0.1.8 → 0.1.10

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 ZIVIS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,19 @@
+# @zivis/mcp
+
+The ZIVIS Model Context Protocol (MCP) server. Exposes ZIVIS's threat modeling, security scanning, and AI red-team tools to AI assistants in your IDE (Cursor, Claude Code, VS Code Copilot, Cline, Windsurf).
+
+You usually don't install or invoke this directly — it's the engine behind [`@zivis/cli`](https://www.npmjs.com/package/@zivis/cli). When you run `zivis mcp serve` (or your IDE calls it automatically), this package is what runs.
+
+## What is ZIVIS?
+
+ZIVIS is an architecture-inspection security platform — it looks at the components in your app, how they connect, and what trust boundaries exist between them. See <https://zivis.ai>.
+
+## Use via the CLI
+
+```bash
+npx @zivis/cli init      # interactive setup, configures your IDE's mcp.json
+```
+
+## License
+
+Apache 2.0 — see [`LICENSE`](./LICENSE).

package/dist/api-client.d.ts

@@ -1,37 +1,15 @@
-/**
- * ZIVIS API Client
- *
- * HTTPS client that attaches the appropriate auth header
- * based on the active auth method:
- * - OAuth: Authorization: Bearer <token>
- * - API Key: X-API-Key: <key>
- *
- * Handles 401 responses by attempting token refresh (OAuth)
- * before returning an auth error.
- */
 import type { ZivisConfig } from "./types.js";
 export declare class ApiClient {
     private config;
     constructor(config?: ZivisConfig);
-    /**
-     * Build auth headers from current credentials
-     */
+    resolveEffectiveConfig(cwd?: string): ZivisConfig;
     private buildAuthHeaders;
-    /**
-     * Make an authenticated request to the ZIVIS API.
-     *
-     * Automatically resolves credentials and attaches auth headers.
-     * On 401 with OAuth, attempts one token refresh and retries.
-     */
     request<T>(method: string, path: string, body?: unknown): Promise<T>;
     private doRequest;
     get<T>(path: string): Promise<T>;
-    /**
-     * Fetch a path and return the response as plain text (not JSON).
-     * Used for artifact content streaming where the response is not JSON.
-     */
     getText(path: string): Promise<string>;
     patch<T>(path: string, body: unknown): Promise<T>;
+    put<T>(path: string, body: unknown): Promise<T>;
     post<T>(path: string, body: unknown): Promise<T>;
     del<T>(path: string): Promise<T>;
 }

package/dist/api-client.js

@@ -1,24 +1,29 @@
-/**
- * ZIVIS API Client
- *
- * HTTPS client that attaches the appropriate auth header
- * based on the active auth method:
- * - OAuth: Authorization: Bearer <token>
- * - API Key: X-API-Key: <key>
- *
- * Handles 401 responses by attempting token refresh (OAuth)
- * before returning an auth error.
- */
 import { resolveAuth } from "./auth/index.js";
+import { detectProjectBinding, resolveConfigFromBinding, resolveMcpSessionForWorkspace, } from "./project-binding.js";
 import { DEFAULT_CONFIG } from "./types.js";
 export class ApiClient {
     config;
     constructor(config = DEFAULT_CONFIG) {
         this.config = config;
     }
-    /**
-     * Build auth headers from current credentials
-     */
+    resolveEffectiveConfig(cwd) {
+        const ws = this.config.workspacePath ?? cwd ?? process.cwd();
+        const detected = detectProjectBinding(ws);
+        if (!detected) {
+            return this.config;
+        }
+        const { binding } = detected;
+        const fromBinding = resolveConfigFromBinding(ws);
+        return {
+            ...this.config,
+            session: resolveMcpSessionForWorkspace(this.config, ws, detected, fromBinding),
+            ...(binding.apiBaseUrl ? { apiBaseUrl: binding.apiBaseUrl } : {}),
+            ...(binding.oauthApiUrl ? { oauthApiUrl: binding.oauthApiUrl } : {}),
+            ...(binding.oauthClientId ? { oauthClientId: binding.oauthClientId } : {}),
+            ...(binding.keychainPrefix ? { keychainPrefix: binding.keychainPrefix } : {}),
+            ...(binding.configDir ? { configDir: binding.configDir } : {}),
+        };
+    }
     buildAuthHeaders(creds) {
         switch (creds.method) {
             case "oauth":
@@ -29,42 +34,20 @@ export class ApiClient {
                 return {};
         }
     }
-    /**
-     * Make an authenticated request to the ZIVIS API.
-     *
-     * Automatically resolves credentials and attaches auth headers.
-     * On 401 with OAuth, attempts one token refresh and retries.
-     */
     async request(method, path, body) {
-        const creds = await resolveAuth(this.config);
+        const effectiveConfig = this.resolveEffectiveConfig();
+        const creds = await resolveAuth(effectiveConfig, "apikey");
         if (creds.method === "none") {
-            throw new ApiError("Not authenticated. Run: zivis auth login", 401, "AUTH_REQUIRED");
-        }
-        const result = await this.doRequest(method, path, body, creds);
-        // If 401 and using OAuth, try refreshing
-        if (result.status === 401 && creds.method === "oauth") {
-            const freshCreds = await resolveAuth(this.config);
-            if (freshCreds.method === "oauth" &&
-                freshCreds.accessToken !== creds.accessToken) {
-                // Token was refreshed, retry
-                const retryResult = await this.doRequest(method, path, body, freshCreds);
-                if (retryResult.status === 401) {
-                    throw new ApiError("Session expired. Run: zivis auth login", 401, "SESSION_EXPIRED");
-                }
-                if (!retryResult.ok) {
-                    throw new ApiError(retryResult.errorMessage || "API request failed", retryResult.status, "API_ERROR");
-                }
-                return retryResult.data;
-            }
-            throw new ApiError("Session expired. Run: zivis auth login", 401, "SESSION_EXPIRED");
+            throw new ApiError("Not authenticated. MCP uses API keys only — run: zivis auth bind (or zivis auth token sk_... --session <name>)", 401, "AUTH_REQUIRED");
         }
+        const result = await this.doRequest(method, path, body, creds, effectiveConfig.apiBaseUrl);
         if (!result.ok) {
             throw new ApiError(result.errorMessage || `API request failed: ${method} ${path}`, result.status, "API_ERROR");
         }
         return result.data;
     }
-    async doRequest(method, path, body, creds) {
-        const url = `${this.config.apiBaseUrl}${path}`;
+    async doRequest(method, path, body, creds, apiBaseUrl) {
+        const url = `${apiBaseUrl}${path}`;
         const headers = {
             "Content-Type": "application/json",
             "User-Agent": "@zivis-ai/cli",
@@ -90,25 +73,20 @@ export class ApiClient {
             return { ok: true, status: response.status, data };
         }
         catch (err) {
-            // Network error
             const message = err instanceof Error ? err.message : "Network request failed";
             throw new ApiError(`Failed to connect to ZIVIS API (${url}): ${message}`, 0, "NETWORK_ERROR");
         }
     }
-    // ── Convenience methods ──
     async get(path) {
         return this.request("GET", path);
     }
-    /**
-     * Fetch a path and return the response as plain text (not JSON).
-     * Used for artifact content streaming where the response is not JSON.
-     */
     async getText(path) {
-        const creds = await resolveAuth(this.config);
+        const effectiveConfig = this.resolveEffectiveConfig();
+        const creds = await resolveAuth(effectiveConfig, "apikey");
         if (creds.method === "none") {
-            throw new ApiError("Not authenticated. Run: zivis auth login", 401, "AUTH_REQUIRED");
+            throw new ApiError("Not authenticated. MCP uses API keys only — run: zivis auth bind", 401, "AUTH_REQUIRED");
         }
-        const url = `${this.config.apiBaseUrl}${path}`;
+        const url = `${effectiveConfig.apiBaseUrl}${path}`;
         const headers = {
             "User-Agent": "@zivis-ai/cli",
             ...this.buildAuthHeaders(creds),
@@ -125,6 +103,9 @@ export class ApiClient {
     async patch(path, body) {
         return this.request("PATCH", path, body);
     }
+    async put(path, body) {
+        return this.request("PUT", path, body);
+    }
     async post(path, body) {
         return this.request("POST", path, body);
     }
@@ -142,4 +123,3 @@ export class ApiError extends Error {
         this.name = "ApiError";
     }
 }
-//# sourceMappingURL=api-client.js.map

package/dist/auth/index.d.ts

@@ -1,29 +1,8 @@
-/**
- * Auth Orchestrator
- *
- * Resolves credentials using the defined precedence:
- * 1. OS Keychain — OAuth tokens (preferred, user-scoped, auto-refresh)
- * 2. OS Keychain — API key (fallback, org-scoped)
- * 3. ZIVIS_API_KEY env var (CI environments)
- * 4. Not authenticated (tools return auth error with setup instructions)
- */
 import type { AuthCredentials, AuthMethod, ZivisConfig } from "../types.js";
 export { login } from "./oauth.js";
 export { keychainClearAll, keychainClearSession, getStorageName, getSessionAccount } from "./keychain.js";
-export { keychainStore, keychainRead } from "./keychain.js";
+export { keychainStore, keychainRead, keychainDelete } from "./keychain.js";
 export { loadTokens } from "./token-refresh.js";
 export { loadSessionIndex, saveSessionEntry, removeSessionEntry, listSessions } from "./sessions.js";
-/**
- * Resolve current auth credentials following the precedence chain.
- *
- * IMPORTANT: When config.session is set (ZIVIS_SESSION env var), auth resolution
- * is scoped to that session ONLY. It will NOT fall through to the default session
- * or API key — this prevents accidental cross-tenant data access.
- *
- * @param forceMethod - Override the automatic method selection
- */
 export declare function resolveAuth(config?: ZivisConfig, forceMethod?: AuthMethod): Promise<AuthCredentials>;
-/**
- * Get a human-readable description of the current auth state
- */
 export declare function getAuthDescription(config?: ZivisConfig): Promise<string>;

package/dist/auth/index.js

@@ -1,64 +1,44 @@
-/**
- * Auth Orchestrator
- *
- * Resolves credentials using the defined precedence:
- * 1. OS Keychain — OAuth tokens (preferred, user-scoped, auto-refresh)
- * 2. OS Keychain — API key (fallback, org-scoped)
- * 3. ZIVIS_API_KEY env var (CI environments)
- * 4. Not authenticated (tools return auth error with setup instructions)
- */
 import { keychainRead } from "./keychain.js";
 import { getValidAccessToken } from "./token-refresh.js";
-import { DEFAULT_CONFIG } from "../types.js";
+import { DEFAULT_CONFIG, credentialStorageFromConfig } from "../types.js";
 export { login } from "./oauth.js";
 export { keychainClearAll, keychainClearSession, getStorageName, getSessionAccount } from "./keychain.js";
-export { keychainStore, keychainRead } from "./keychain.js";
+export { keychainStore, keychainRead, keychainDelete } from "./keychain.js";
 export { loadTokens } from "./token-refresh.js";
 export { loadSessionIndex, saveSessionEntry, removeSessionEntry, listSessions } from "./sessions.js";
-/**
- * Resolve current auth credentials following the precedence chain.
- *
- * IMPORTANT: When config.session is set (ZIVIS_SESSION env var), auth resolution
- * is scoped to that session ONLY. It will NOT fall through to the default session
- * or API key — this prevents accidental cross-tenant data access.
- *
- * @param forceMethod - Override the automatic method selection
- */
 export async function resolveAuth(config = DEFAULT_CONFIG, forceMethod) {
     const session = config.session;
-    // 1. OAuth tokens (unless forced to apikey)
-    if (forceMethod !== "apikey") {
-        const accessToken = await getValidAccessToken(config);
-        if (accessToken) {
-            return { method: "oauth", accessToken };
+    const st = credentialStorageFromConfig(config);
+    if (forceMethod !== "oauth") {
+        const apiKeyAccount = session ? `apikey.${session}` : null;
+        if (apiKeyAccount) {
+            const sessionApiKey = await keychainRead(apiKeyAccount, st);
+            if (sessionApiKey) {
+                return { method: "apikey", apiKey: sessionApiKey };
+            }
         }
     }
-    // 2. ZIVIS_API_KEY env var — always checked, even for named sessions.
-    // This is an explicit user action (they set the env var in their MCP config),
-    // so it's safe to use regardless of session scope.
     const envKey = process.env.ZIVIS_API_KEY;
     if (envKey) {
         return { method: "apikey", apiKey: envKey };
     }
-    // CROSS-TENANT SAFETY: If a named session is active, do NOT fall through
-    // to default keychain credentials. This prevents accidentally using admin tokens
-    // when working in a customer's project.
+    if (forceMethod !== "apikey") {
+        const accessToken = await getValidAccessToken(config);
+        if (accessToken) {
+            return { method: "oauth", accessToken };
+        }
+    }
     if (session) {
         return { method: "none" };
     }
-    // 3. API key from keychain (only for default/no-session)
     if (forceMethod !== "oauth") {
-        const apiKey = await keychainRead("apikey");
+        const apiKey = await keychainRead("apikey", st);
         if (apiKey) {
             return { method: "apikey", apiKey };
         }
     }
-    // 4. Not authenticated
     return { method: "none" };
 }
-/**
- * Get a human-readable description of the current auth state
- */
 export async function getAuthDescription(config = DEFAULT_CONFIG) {
     const creds = await resolveAuth(config);
     switch (creds.method) {
@@ -70,4 +50,3 @@ export async function getAuthDescription(config = DEFAULT_CONFIG) {
             return "Not authenticated";
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/auth/jwt.d.ts

@@ -1,24 +1,8 @@
-/**
- * JWT helpers for local safety checks.
- *
- * The API is the authoritative verifier of JWT signatures. These helpers
- * decode the payload only to read claims locally (org_id, email, sub) so
- * the CLI/MCP server can enforce project-binding guardrails before making
- * any API calls.
- */
 export interface JwtClaims {
-    /** WorkOS user sub (e.g., "user_01HXYZ...") */
     sub?: string;
-    /** WorkOS org ID (e.g., "org_01HXYZ...") */
     org_id?: string;
-    /** Email (present on id_token, sometimes on access_token) */
     email?: string;
-    /** Expiry (unix seconds) */
     exp?: number;
     [key: string]: unknown;
 }
-/**
- * Decode a JWT payload WITHOUT verifying the signature.
- * Returns null if the token is malformed.
- */
 export declare function decodeJwtPayload(token: string): JwtClaims | null;

package/dist/auth/jwt.js

@@ -1,15 +1,3 @@
-/**
- * JWT helpers for local safety checks.
- *
- * The API is the authoritative verifier of JWT signatures. These helpers
- * decode the payload only to read claims locally (org_id, email, sub) so
- * the CLI/MCP server can enforce project-binding guardrails before making
- * any API calls.
- */
-/**
- * Decode a JWT payload WITHOUT verifying the signature.
- * Returns null if the token is malformed.
- */
 export function decodeJwtPayload(token) {
     try {
         const parts = token.split(".");
@@ -22,4 +10,3 @@ export function decodeJwtPayload(token) {
         return null;
     }
 }
-//# sourceMappingURL=jwt.js.map

package/dist/auth/keychain.d.ts

@@ -1,34 +1,8 @@
-/**
- * OS Keychain credential storage
- *
- * Uses native OS CLI commands to store/retrieve credentials securely.
- * No native npm dependencies (no keytar).
- *
- * - macOS: Keychain Services via `security` CLI
- * - Linux: Secret Service API via `secret-tool` CLI
- * - Windows: DPAPI via PowerShell
- *
- * Falls back to encrypted file if keychain CLI is unavailable.
- */
-/**
- * Returns the keychain account key for a given session.
- * - No session or undefined → "oauth" (backward compatible)
- * - Named session → "oauth.{session}"
- */
+import { type CredentialStorage } from "../types.js";
 export declare function getSessionAccount(session?: string): string;
-export declare function keychainStore(account: string, value: string): Promise<void>;
-export declare function keychainRead(account: string): Promise<string | null>;
-export declare function keychainDelete(account: string): Promise<void>;
-/**
- * Delete credentials for a specific session
- */
-export declare function keychainClearSession(session?: string): Promise<void>;
-/**
- * Delete all stored credentials (default OAuth + API key).
- * Does NOT clear named sessions — use keychainClearSession() for those.
- */
-export declare function keychainClearAll(): Promise<void>;
-/**
- * Returns the storage mechanism name for display purposes
- */
+export declare function keychainStore(account: string, value: string, storage?: CredentialStorage): Promise<void>;
+export declare function keychainRead(account: string, storage?: CredentialStorage): Promise<string | null>;
+export declare function keychainDelete(account: string, storage?: CredentialStorage): Promise<void>;
+export declare function keychainClearSession(session?: string, storage?: CredentialStorage): Promise<void>;
+export declare function keychainClearAll(storage?: CredentialStorage): Promise<void>;
 export declare function getStorageName(): string;