@zivis/mcp 0.1.8 → 0.1.10

package/dist/auth/sessions.js

@@ -1,69 +1,50 @@
-/**
- * Session Index Management
- *
- * Tracks named OAuth sessions in a JSON file so users can list
- * and manage multiple tenant sessions without enumerating keychain entries.
- *
- * Session index file: ~/.config/{configDir}/sessions.json
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
 import { ENV_CONFIG } from "../types.js";
-function getSessionIndexPath() {
-    const configDir = ENV_CONFIG.configDir;
+function resolveSessionStorage(storage) {
+    return (storage ?? {
+        keychainPrefix: ENV_CONFIG.keychainPrefix,
+        configDir: ENV_CONFIG.configDir,
+    });
+}
+function getSessionIndexPath(storage) {
+    const { configDir } = resolveSessionStorage(storage);
     const base = process.platform === "win32"
         ? process.env.APPDATA || os.homedir()
         : path.join(os.homedir(), ".config");
     return path.join(base, configDir, "sessions.json");
 }
-/**
- * Load the session index from disk.
- * Returns an empty object if the file doesn't exist.
- */
-export async function loadSessionIndex() {
+export async function loadSessionIndex(storage) {
     try {
-        const raw = await fs.readFile(getSessionIndexPath(), "utf8");
+        const raw = await fs.readFile(getSessionIndexPath(storage), "utf8");
         return JSON.parse(raw);
     }
     catch {
         return {};
     }
 }
-/**
- * Save the full session index to disk.
- */
-async function saveSessionIndex(index) {
-    const filePath = getSessionIndexPath();
+async function saveSessionIndex(index, storage) {
+    const filePath = getSessionIndexPath(storage);
     await fs.mkdir(path.dirname(filePath), { recursive: true });
     await fs.writeFile(filePath, JSON.stringify(index, null, 2) + "\n", {
         mode: 0o600,
     });
 }
-/**
- * Add or update a session entry in the index.
- */
-export async function saveSessionEntry(name, email) {
-    const index = await loadSessionIndex();
+export async function saveSessionEntry(name, email, storage) {
+    const index = await loadSessionIndex(storage);
     index[name] = {
         email,
         createdAt: index[name]?.createdAt || new Date().toISOString(),
     };
-    await saveSessionIndex(index);
+    await saveSessionIndex(index, storage);
 }
-/**
- * Remove a session entry from the index.
- */
-export async function removeSessionEntry(name) {
-    const index = await loadSessionIndex();
+export async function removeSessionEntry(name, storage) {
+    const index = await loadSessionIndex(storage);
     delete index[name];
-    await saveSessionIndex(index);
+    await saveSessionIndex(index, storage);
 }
-/**
- * List all sessions with their metadata.
- */
-export async function listSessions() {
-    const index = await loadSessionIndex();
+export async function listSessions(storage) {
+    const index = await loadSessionIndex(storage);
     return Object.entries(index).map(([name, info]) => ({ name, ...info }));
 }
-//# sourceMappingURL=sessions.js.map

package/dist/auth/token-refresh.d.ts

@@ -1,24 +1,4 @@
-/**
- * Token Refresh
- *
- * Handles silent refresh of OAuth access tokens using the stored
- * refresh token. Checks expiry with a 5-minute buffer to avoid
- * mid-request expirations.
- */
-import type { OAuthTokens, ZivisConfig } from "../types.js";
-/**
- * Load OAuth tokens from keychain
- * @param session - Optional named session for multi-tenant isolation
- */
-export declare function loadTokens(session?: string): Promise<OAuthTokens | null>;
-/**
- * Check if the access token is still valid (with 5-min buffer)
- */
+import type { OAuthTokens, ZivisConfig, CredentialStorage } from "../types.js";
+export declare function loadTokens(session?: string, storage?: CredentialStorage): Promise<OAuthTokens | null>;
 export declare function isTokenValid(tokens: OAuthTokens): boolean;
-/**
- * Get a valid access token, refreshing if necessary.
- *
- * Returns the access token string, or null if no tokens stored
- * or refresh fails (user needs to re-login).
- */
 export declare function getValidAccessToken(config?: ZivisConfig): Promise<string | null>;

package/dist/auth/token-refresh.js

@@ -1,19 +1,8 @@
-/**
- * Token Refresh
- *
- * Handles silent refresh of OAuth access tokens using the stored
- * refresh token. Checks expiry with a 5-minute buffer to avoid
- * mid-request expirations.
- */
 import { keychainRead, keychainStore, keychainDelete, getSessionAccount } from "./keychain.js";
-import { DEFAULT_CONFIG } from "../types.js";
-const EXPIRY_BUFFER_MS = 5 * 60 * 1000; // 5 minutes
-/**
- * Load OAuth tokens from keychain
- * @param session - Optional named session for multi-tenant isolation
- */
-export async function loadTokens(session) {
-    const raw = await keychainRead(getSessionAccount(session));
+import { DEFAULT_CONFIG, credentialStorageFromConfig } from "../types.js";
+const EXPIRY_BUFFER_MS = 30 * 1000;
+export async function loadTokens(session, storage) {
+    const raw = await keychainRead(getSessionAccount(session), storage);
     if (!raw)
         return null;
     try {
@@ -23,18 +12,16 @@ export async function loadTokens(session) {
         return null;
     }
 }
-/**
- * Check if the access token is still valid (with 5-min buffer)
- */
 export function isTokenValid(tokens) {
     return tokens.expires_at > Date.now() + EXPIRY_BUFFER_MS;
 }
-/**
- * Refresh the access token using the refresh token
- */
+const FATAL_REFRESH_ERRORS = new Set([
+    "invalid_grant",
+    "invalid_client",
+    "unauthorized_client",
+]);
 async function refreshAccessToken(refreshToken, config) {
-    // Handle both WorkOS (auth.workos.com -> /oauth/token) and custom AuthKit (authkit.app -> /oauth2/token)
-    const tokenPath = config.oauthApiUrl.includes("authkit.app") ? "/oauth2/token" : "/oauth/token";
+    const tokenPath = config.oauthApiUrl.includes("workos.com") ? "/oauth/token" : "/oauth2/token";
     const tokenUrl = `${config.oauthApiUrl}${tokenPath}`;
     const response = await fetch(tokenUrl, {
         method: "POST",
@@ -47,45 +34,55 @@ async function refreshAccessToken(refreshToken, config) {
     });
     if (!response.ok) {
         const error = (await response.json().catch(() => ({})));
-        throw new Error(error.error_description || error.error || "Token refresh failed");
+        const errorCode = error.error || "";
+        const errorMsg = error.error_description || errorCode || "Token refresh failed";
+        const err = new Error(errorMsg);
+        err.oauthErrorCode = errorCode;
+        throw err;
     }
     const data = (await response.json());
     return {
         access_token: data.access_token,
-        // Use new refresh token if provided (rotation), otherwise keep existing
         refresh_token: data.refresh_token || refreshToken,
         expires_at: Date.now() + data.expires_in * 1000,
         id_token: data.id_token,
     };
 }
-/**
- * Get a valid access token, refreshing if necessary.
- *
- * Returns the access token string, or null if no tokens stored
- * or refresh fails (user needs to re-login).
- */
 export async function getValidAccessToken(config = DEFAULT_CONFIG) {
     const session = config.session;
     const account = getSessionAccount(session);
-    const tokens = await loadTokens(session);
+    const st = credentialStorageFromConfig(config);
+    const tokens = await loadTokens(session, st);
     if (!tokens) {
         return null;
     }
     if (isTokenValid(tokens)) {
         return tokens.access_token;
     }
+    const expiresInSec = Math.round((tokens.expires_at - Date.now()) / 1000);
     if (tokens.refresh_token) {
+        console.error(`[zivis] Access token expiring in ${expiresInSec}s — refreshing silently...`);
         try {
             const newTokens = await refreshAccessToken(tokens.refresh_token, config);
-            await keychainStore(account, JSON.stringify(newTokens));
+            await keychainStore(account, JSON.stringify(newTokens), st);
+            const newExpiresInMin = Math.round((newTokens.expires_at - Date.now()) / 1000 / 60);
+            console.error(`[zivis] Token refreshed successfully — new token valid for ~${newExpiresInMin}m`);
             return newTokens.access_token;
         }
         catch (err) {
-            console.error("[zivis] Token refresh failed:", err instanceof Error ? err.message : err);
-            await keychainDelete(account);
+            const oauthCode = err.oauthErrorCode;
+            const isFatal = oauthCode && FATAL_REFRESH_ERRORS.has(oauthCode);
+            console.error(`[zivis] Token refresh failed (${oauthCode ?? "network/server error"}):`, err instanceof Error ? err.message : err);
+            if (isFatal) {
+                console.error("[zivis] Refresh token revoked or expired — clearing stored credentials. Run: zivis auth login");
+                await keychainDelete(account, st);
+            }
+            else {
+                console.error("[zivis] Transient refresh error — keeping stored credentials, will retry on next request.");
+            }
             return null;
         }
     }
+    console.error(`[zivis] Access token expired ${Math.abs(expiresInSec)}s ago and no refresh token stored — re-login required`);
     return null;
 }
-//# sourceMappingURL=token-refresh.js.map

package/dist/cli.d.ts

@@ -1,23 +1,6 @@
-/**
- * CLI Commands
- *
- * Handles all user-facing CLI interactions:
- * - login: OAuth PKCE browser login (with optional --session for multi-tenant)
- * - configure: API key setup (interactive or --api-key flag)
- * - status: Show auth state, org, plan usage
- * - logout: Clear stored credentials (with optional --session)
- * - sessions: List all stored sessions
- * - serve: Start MCP server (called by IDE, not by user directly)
- */
 import type { ZivisConfig } from "./types.js";
-/**
- * Parse CLI arguments into a command and options
- */
 export declare function parseArgs(argv: string[]): {
     command: string;
     options: Record<string, string>;
 };
-/**
- * Run the appropriate CLI command
- */
-export declare function runCli(command: string, options: Record<string, string>, config?: ZivisConfig): Promise<void>;
+export declare function runCli(command: string, _options: Record<string, string>, config?: ZivisConfig): Promise<void>;