@zivis/cli 0.1.0-alpha.42 → 0.1.0-alpha.43

package/dist/commands/auth/init.js

@@ -9,6 +9,7 @@ import { discardOauthAfterLogin, tryAutoMintBindingTokenAfterLogin, } from "../.
 import { decodeJwtPayload } from "@zivis/mcp/auth/jwt";
 import { detectIdesInRepo, writeGuidance } from "../../internal/ide-setup.js";
 import { buildLinkagePrompt } from "../../internal/github-linkage-prompt.js";
+import { resolveExistingSessionTokens } from "../../internal/resolve-init-session.js";
 async function maybePromptGitHubLinkage(config) {
     try {
         const msg = await buildLinkagePrompt({ config });
@@ -72,15 +73,23 @@ export async function initCommand(opts) {
     const envLabel = config.apiBaseUrl.includes("staging") ? "staging" : "production";
     console.log(`Environment: ${envLabel} (${config.apiBaseUrl})`);
     console.log("");
-    console.log("Opening browser for authentication...");
-    console.log("Log into the org you want to bind this project to.\n");
     let tokens;
-    try {
-        tokens = await login(config, session, undefined, { skipConfirm: true });
+    const existing = await resolveExistingSessionTokens(config, session);
+    if (existing) {
+        console.log("Existing session found — reusing stored credentials.");
+        console.log("(Run `zivis auth logout` first to switch accounts.)\n");
+        tokens = existing;
     }
-    catch (err) {
-        console.error("Login failed:", err instanceof Error ? err.message : err);
-        process.exit(1);
+    else {
+        console.log("Opening browser for authentication...");
+        console.log("Log into the org you want to bind this project to.\n");
+        try {
+            tokens = await login(config, session, undefined, { skipConfirm: true });
+        }
+        catch (err) {
+            console.error("Login failed:", err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
     }
     const email = extractEmail(tokens.id_token);
     const claims = decodeJwtPayload(tokens.access_token);

package/dist/commands/threatmodel/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerThreatmodelCommand(program: Command): void;

package/dist/commands/threatmodel/index.js

@@ -0,0 +1,166 @@
+import * as fs from "node:fs/promises";
+import * as fsSync from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { ApiClient } from "@zivis/mcp/api-client";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { requireApplicationId } from "@zivis/mcp/resolve-application-id";
+import { renderSecurityContext } from "../../internal/security-context.js";
+import { startThreatModelRun, syncThreatModel, } from "../../internal/threatmodel-run.js";
+import { HttpPackRegistryClient, LocalPackRegistryClient, registryDirOverride } from "../../internal/packs/registry-client.js";
+import { PackUnavailableError, PackIntegrityError } from "../../internal/packs/types.js";
+import { jsonEnvelope, printJson, EXIT, exitCodeForError, errorMessage, failCommand } from "../../internal/cli-output.js";
+class UsageError extends Error {
+}
+function buildRegistryClient(apiClient) {
+    const override = registryDirOverride();
+    if (override)
+        return new LocalPackRegistryClient(override);
+    return new HttpPackRegistryClient(apiClient);
+}
+function exitCodeForThreatModelError(err) {
+    if (err instanceof PackIntegrityError)
+        return EXIT.INVALID_OR_INDETERMINATE;
+    if (err instanceof PackUnavailableError)
+        return EXIT.CLOUD_UNAVAILABLE;
+    return exitCodeForError(err);
+}
+async function readMarkdownInput(inputArg) {
+    if (inputArg === "-")
+        return readStdin();
+    const content = await fs.readFile(inputArg, "utf-8");
+    if (content.trim().length === 0) {
+        throw new UsageError(`--input file "${inputArg}" is empty.`);
+    }
+    return content;
+}
+async function readStdin() {
+    let data = "";
+    process.stdin.setEncoding("utf-8");
+    for await (const chunk of process.stdin) {
+        data += chunk;
+    }
+    if (data.trim().length === 0) {
+        throw new UsageError("--input - read no content from stdin.");
+    }
+    return data;
+}
+export function registerThreatmodelCommand(program) {
+    const threatmodel = program
+        .command("threatmodel")
+        .description("start (or continue) a Zivis-guided living threat model for the bound Application")
+        .option("--app <id>", "Application id (defaults to the bound Application)")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (opts) => {
+        const json = !!opts.json;
+        const cwd = process.cwd();
+        const config = resolveConfigFromBinding(cwd);
+        const apiClient = new ApiClient(config);
+        const registryClient = buildRegistryClient(apiClient);
+        const cliVersion = getCliVersion();
+        try {
+            const resolvedApp = requireApplicationId(opts.app, cwd);
+            if (!resolvedApp.ok) {
+                throw new UsageError(resolvedApp.message);
+            }
+            const { envelope, contextOutcome } = await startThreatModelRun({ apiClient, registryClient }, { applicationId: resolvedApp.id, cwd, cliVersion });
+            const output = jsonEnvelope("threatmodel", { ...envelope });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                printStartHuman(envelope, contextOutcome);
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            const code = err instanceof UsageError ? EXIT.INVALID_OR_INDETERMINATE : exitCodeForThreatModelError(err);
+            const message = errorMessage(err);
+            if (json) {
+                printJson(jsonEnvelope("threatmodel", { result: "error", error: message }));
+            }
+            else {
+                console.error(`zivis threatmodel: ${message}`);
+            }
+            process.exit(code);
+        }
+    });
+    threatmodel
+        .command("sync")
+        .description("persist the finished Markdown threat model as a new Artifact revision and complete the run")
+        .requiredOption("--input <path>", "path to the finished Markdown threat model, or '-' for stdin")
+        .option("--run <runId>", "override the auto-resolved active threatmodel run")
+        .option("--change-note <text>", "optional human-readable summary of what changed")
+        .option("--app <id>", "Application id (defaults to the bound Application)")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (opts) => {
+        const json = !!opts.json;
+        const cwd = process.cwd();
+        let content;
+        try {
+            content = await readMarkdownInput(opts.input);
+        }
+        catch (err) {
+            failCommand("threatmodel sync", err, json);
+        }
+        const config = resolveConfigFromBinding(cwd);
+        const apiClient = new ApiClient(config);
+        const registryClient = buildRegistryClient(apiClient);
+        try {
+            const resolvedApp = requireApplicationId(opts.app, cwd);
+            if (!resolvedApp.ok) {
+                throw new UsageError(resolvedApp.message);
+            }
+            const result = await syncThreatModel({ apiClient, registryClient }, { applicationId: resolvedApp.id, runId: opts.run, cwd, content, changeNote: opts.changeNote });
+            const output = jsonEnvelope("threatmodel sync", {
+                run_id: result.runId,
+                run_outcome: result.runOutcome,
+                evidence_id: result.evidenceId,
+                version: result.version,
+                unchanged: result.unchanged,
+            });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                console.log(result.unchanged
+                    ? `zivis threatmodel sync: no change (content identical to revision ${result.version}); run ${result.runId} ${result.runOutcome}.`
+                    : `zivis threatmodel sync: created revision ${result.version} (evidence ${result.evidenceId}); run ${result.runId} ${result.runOutcome}.`);
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            const code = err instanceof UsageError ? EXIT.INVALID_OR_INDETERMINATE : exitCodeForThreatModelError(err);
+            const message = errorMessage(err);
+            if (json) {
+                printJson(jsonEnvelope("threatmodel sync", { result: "error", error: message }));
+            }
+            else {
+                console.error(`zivis threatmodel sync: ${message}`);
+            }
+            process.exit(code);
+        }
+    });
+}
+function getCliVersion() {
+    try {
+        const __dirname = path.dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(fsSync.readFileSync(path.join(__dirname, "../../../package.json"), "utf-8"));
+        return pkg.version;
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function printStartHuman(envelope, contextOutcome) {
+    console.log(`zivis threatmodel: started run ${envelope.run_id}`);
+    console.log(renderSecurityContext(contextOutcome, "human"));
+    console.log(`\nMethodology: ${envelope.methodology.path}`);
+    if (envelope.prior_model?.exists) {
+        console.log(`Prior model: ${envelope.prior_model.path} (revision ${envelope.prior_model.version}, last modeled at ${envelope.prior_model.git_commit_sha ?? "unknown"})`);
+    }
+    else {
+        console.log("Prior model: none on record — this will be the first threat model for this Application.");
+    }
+    console.log(`\nWhen finished: ${envelope.result_contract.complete_command}`);
+}

package/dist/index.js

@@ -19,6 +19,7 @@ import { registerAssuranceCommands } from "./commands/assurance/index.js";
 import { registerGateCommand } from "./commands/gate/index.js";
 import { registerRunCommands } from "./commands/run/index.js";
 import { registerTestCommand } from "./commands/test/index.js";
+import { registerThreatmodelCommand } from "./commands/threatmodel/index.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 function getVersion() {
     try {
@@ -58,6 +59,7 @@ registerAssuranceCommands(program);
 registerGateCommand(program);
 registerRunCommands(program);
 registerTestCommand(program);
+registerThreatmodelCommand(program);
 program.parseAsync(process.argv).catch((err) => {
     console.error(err instanceof Error ? err.message : err);
     process.exit(1);

package/dist/internal/resolve-init-session.d.ts

@@ -0,0 +1,6 @@
+import { type ZivisConfig } from "@zivis/mcp/types";
+export interface ExistingSessionTokens {
+    access_token: string;
+    id_token?: string;
+}
+export declare function resolveExistingSessionTokens(config: ZivisConfig, session: string): Promise<ExistingSessionTokens | null>;

package/dist/internal/resolve-init-session.js

@@ -0,0 +1,10 @@
+import { loadTokens } from "@zivis/mcp/auth";
+import { getValidAccessToken } from "@zivis/mcp/auth/token-refresh";
+import { credentialStorageFromConfig } from "@zivis/mcp/types";
+export async function resolveExistingSessionTokens(config, session) {
+    const accessToken = await getValidAccessToken({ ...config, session });
+    if (!accessToken)
+        return null;
+    const stored = await loadTokens(session, credentialStorageFromConfig(config));
+    return { access_token: accessToken, id_token: stored?.id_token };
+}

package/dist/internal/run-workdir.d.ts

@@ -1 +1,2 @@
 export declare function writeRunWorkFile(cwd: string, runId: string, filename: string, data: unknown): string;
+export declare function writeRunWorkTextFile(cwd: string, runId: string, filename: string, text: string): string;

package/dist/internal/run-workdir.js

@@ -9,3 +9,11 @@ export function writeRunWorkFile(cwd, runId, filename, data) {
     fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
     return filePath;
 }
+export function writeRunWorkTextFile(cwd, runId, filename, text) {
+    ensureZivisGitignore(cwd);
+    const dir = path.join(cwd, ".zivis", "work", runId);
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = path.join(dir, filename);
+    fs.writeFileSync(filePath, text);
+    return filePath;
+}

package/dist/internal/threatmodel-run-state.d.ts

@@ -0,0 +1,15 @@
+export declare const THREATMODEL_RUN_STATE_FILENAME = "threatmodel-run.json";
+export interface ThreatModelRunState {
+    runId: string;
+    runType: "threatmodel";
+    applicationId: string;
+    startedAt: string;
+    status: "pending" | "completed";
+    packId: string;
+    packType: string;
+    packVersion: string;
+}
+export declare function recordThreatModelRunState(cwd: string, state: ThreatModelRunState): string;
+export declare function loadThreatModelRunState(cwd: string, runId: string): ThreatModelRunState | null;
+export declare function markThreatModelRunCompleted(cwd: string, runId: string): void;
+export declare function findActiveThreatModelRun(cwd: string): ThreatModelRunState | null;

package/dist/internal/threatmodel-run-state.js

@@ -0,0 +1,43 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { writeRunWorkFile } from "./run-workdir.js";
+export const THREATMODEL_RUN_STATE_FILENAME = "threatmodel-run.json";
+export function recordThreatModelRunState(cwd, state) {
+    return writeRunWorkFile(cwd, state.runId, THREATMODEL_RUN_STATE_FILENAME, state);
+}
+function runStatePath(cwd, runId) {
+    return path.join(cwd, ".zivis", "work", runId, THREATMODEL_RUN_STATE_FILENAME);
+}
+export function loadThreatModelRunState(cwd, runId) {
+    const filePath = runStatePath(cwd, runId);
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function markThreatModelRunCompleted(cwd, runId) {
+    const filePath = runStatePath(cwd, runId);
+    const existing = loadThreatModelRunState(cwd, runId);
+    if (!existing)
+        return;
+    fs.writeFileSync(filePath, JSON.stringify({ ...existing, status: "completed" }, null, 2) + "\n");
+}
+export function findActiveThreatModelRun(cwd) {
+    const workDir = path.join(cwd, ".zivis", "work");
+    if (!fs.existsSync(workDir))
+        return null;
+    const candidates = [];
+    for (const runId of fs.readdirSync(workDir)) {
+        const state = loadThreatModelRunState(cwd, runId);
+        if (state && state.status === "pending")
+            candidates.push(state);
+    }
+    if (candidates.length === 0)
+        return null;
+    candidates.sort((a, b) => (a.startedAt < b.startedAt ? 1 : -1));
+    return candidates[0];
+}

package/dist/internal/threatmodel-run.d.ts

@@ -0,0 +1,85 @@
+import { type DevXRunApi } from "./devx-run.js";
+import { type SecurityContextApi, type SecurityContextOutcome } from "./security-context.js";
+import type { PackRegistryClient } from "./packs/types.js";
+export interface ThreatModelArtifactApi {
+    get<T>(path: string): Promise<T>;
+    put<T>(path: string, body: unknown): Promise<T>;
+}
+export interface ThreatModelRunDeps {
+    apiClient: DevXRunApi & SecurityContextApi & ThreatModelArtifactApi;
+    registryClient: PackRegistryClient;
+}
+export interface StartThreatModelRunParams {
+    applicationId: string;
+    cwd: string;
+    cliVersion: string;
+}
+export type PriorThreatModelOutcome = {
+    status: "found";
+    content: string;
+    version: number;
+    gitCommitSha: string | null;
+    updatedAt: string;
+    updatedBy: string;
+} | {
+    status: "none";
+} | {
+    status: "unavailable";
+    reason: string;
+};
+export interface ThreatModelRunEnvelope {
+    run_id: string;
+    application: {
+        id: string;
+    };
+    connection: {
+        mode: "connected";
+    };
+    git: {
+        sha: string | null;
+        dirty: boolean | null;
+    };
+    methodology: {
+        pack: string;
+        version: string;
+        path: string;
+    };
+    context: {
+        path: string;
+    };
+    prior_model: {
+        exists: true;
+        version: number;
+        git_commit_sha: string | null;
+        path: string;
+    } | {
+        exists: false;
+        reason?: string;
+    } | null;
+    result_contract: {
+        schema_version: string;
+        complete_command: string;
+    };
+    agent_instructions: string[];
+}
+export interface StartThreatModelRunResult {
+    envelope: ThreatModelRunEnvelope;
+    contextOutcome: SecurityContextOutcome;
+    priorModel: PriorThreatModelOutcome;
+}
+export declare function startThreatModelRun(deps: ThreatModelRunDeps, params: StartThreatModelRunParams): Promise<StartThreatModelRunResult>;
+export interface SyncThreatModelParams {
+    applicationId: string;
+    runId?: string;
+    cwd: string;
+    content: string;
+    changeNote?: string;
+}
+export interface SyncThreatModelResult {
+    evidenceId: string;
+    version: number;
+    unchanged: boolean;
+    runId: string;
+    runOutcome: "completed" | "cancelled" | "idempotent-replay" | "queued";
+}
+export declare function syncThreatModel(deps: ThreatModelRunDeps, params: SyncThreatModelParams): Promise<SyncThreatModelResult>;

package/dist/internal/threatmodel-run.js

@@ -0,0 +1,159 @@
+import { ApiError } from "@zivis/mcp/api-client";
+import { readGitMetadata } from "./git.js";
+import { startDevXRun, completeDevXRunRemote, isRetryableDevXRunError, DEVX_RUN_CONTRACT_VERSION, } from "./devx-run.js";
+import { fetchSecurityContext } from "./security-context.js";
+import { resolveCompatiblePack } from "./packs/resolve.js";
+import { writeRunWorkFile, writeRunWorkTextFile } from "./run-workdir.js";
+import { writeDevXRunCompleteOutboxEntry } from "./sync-outbox.js";
+import { recordThreatModelRunState, loadThreatModelRunState, findActiveThreatModelRun, markThreatModelRunCompleted, } from "./threatmodel-run-state.js";
+async function fetchPriorThreatModel(client, applicationId) {
+    try {
+        const res = await client.get(`/api/rt/applications/${encodeURIComponent(applicationId)}/artifacts/threat_model`);
+        const evidence = res.evidence;
+        return {
+            status: "found",
+            content: res.content,
+            version: evidence.version,
+            gitCommitSha: evidence.gitCommitSha ?? null,
+            updatedAt: evidence.updatedAt,
+            updatedBy: evidence.updatedBy,
+        };
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 404)
+            return { status: "none" };
+        return { status: "unavailable", reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+function buildAgentInstructions(prior) {
+    const common = [
+        "Use your own repository understanding, git, shell, and tools to perform the analysis — this pack describes the methodology, not the storage format.",
+        "When finished, write the Markdown threat model to a local file and run `zivis threatmodel sync --input <file>` to persist it. Do not run the artifact API or `zivis run complete` yourself — `sync` composes both internally.",
+    ];
+    if (prior.status === "found") {
+        return [
+            `Read the methodology at methodology.path, then the prior threat model at prior_model.path (last modeled at commit ${prior.gitCommitSha ?? "unknown"}).`,
+            `Inspect what materially changed between ${prior.gitCommitSha ?? "the prior commit"} and HEAD (git.sha) using git log/diff — architecture, components, data flows, trust boundaries, assumptions, attack paths, and test recommendations.`,
+            "Preserve valid existing analysis. Update only the sections materially affected by what changed — do not regenerate the model from scratch merely because a new run occurred.",
+            ...common,
+        ];
+    }
+    const noPriorReason = prior.status === "unavailable" ? ` (could not confirm: ${prior.reason} — proceed as if none exists, but note this in your output if relevant)` : "";
+    return [
+        `Read the methodology at methodology.path — no prior threat model is on record for this Application${noPriorReason}.`,
+        "Model actors, assets, trust boundaries, and data flows before enumerating threats, then identify assumptions, attack paths, and test recommendations.",
+        ...common,
+    ];
+}
+export async function startThreatModelRun(deps, params) {
+    const [git, contextOutcome, resolvedPack, priorModel] = await Promise.all([
+        readGitMetadata(params.cwd),
+        fetchSecurityContext(deps.apiClient, params.applicationId),
+        resolveCompatiblePack("threatmodel", { registryClient: deps.registryClient, cliVersion: params.cliVersion }),
+        fetchPriorThreatModel(deps.apiClient, params.applicationId),
+    ]);
+    const started = await startDevXRun(deps.apiClient, {
+        applicationId: params.applicationId,
+        runType: "threatmodel",
+        pack: { packId: resolvedPack.packId, packType: resolvedPack.packType, version: resolvedPack.version },
+        cwd: params.cwd,
+    });
+    const contextPath = writeRunWorkFile(params.cwd, started.runId, "context.json", contextOutcome);
+    let priorModelField;
+    if (priorModel.status === "found") {
+        const priorModelPath = writeRunWorkTextFile(params.cwd, started.runId, "prior-threat-model.md", priorModel.content);
+        priorModelField = { exists: true, version: priorModel.version, git_commit_sha: priorModel.gitCommitSha, path: priorModelPath };
+    }
+    else if (priorModel.status === "none") {
+        priorModelField = { exists: false };
+    }
+    else {
+        priorModelField = { exists: false, reason: priorModel.reason };
+    }
+    const runState = {
+        runId: started.runId,
+        runType: "threatmodel",
+        applicationId: params.applicationId,
+        startedAt: started.startedAt,
+        status: "pending",
+        packId: resolvedPack.packId,
+        packType: resolvedPack.packType,
+        packVersion: resolvedPack.version,
+    };
+    recordThreatModelRunState(params.cwd, runState);
+    const envelope = {
+        run_id: started.runId,
+        application: { id: params.applicationId },
+        connection: { mode: "connected" },
+        git: { sha: git.commitSha ?? null, dirty: git.dirty ?? null },
+        methodology: { pack: resolvedPack.packType, version: resolvedPack.version, path: resolvedPack.basePath },
+        context: { path: contextPath },
+        prior_model: priorModelField,
+        result_contract: {
+            schema_version: DEVX_RUN_CONTRACT_VERSION,
+            complete_command: "zivis threatmodel sync --input <file>",
+        },
+        agent_instructions: buildAgentInstructions(priorModel),
+    };
+    return { envelope, contextOutcome, priorModel };
+}
+function resolveRunState(cwd, explicitRunId) {
+    const state = explicitRunId ? loadThreatModelRunState(cwd, explicitRunId) : findActiveThreatModelRun(cwd);
+    if (!state) {
+        throw new Error(explicitRunId
+            ? `No local threatmodel run state found for run ${explicitRunId}. Start one with \`zivis threatmodel\`.`
+            : "No active `zivis threatmodel` run found under .zivis/work. Start one with `zivis threatmodel`, or pass --run <runId> explicitly.");
+    }
+    if (state.status !== "pending") {
+        throw new Error(`Run ${state.runId} has already been synced. Start a new run with \`zivis threatmodel\`.`);
+    }
+    return state;
+}
+export async function syncThreatModel(deps, params) {
+    const runState = resolveRunState(params.cwd, params.runId);
+    const git = await readGitMetadata(params.cwd);
+    const putResult = await deps.apiClient.put(`/api/rt/applications/${encodeURIComponent(params.applicationId)}/artifacts/threat_model`, {
+        content: params.content,
+        changeNote: params.changeNote,
+        gitCommitSha: git.commitSha ?? null,
+        methodology: `${runState.packId}@${runState.packVersion}`,
+        methodologyPackId: runState.packId,
+        methodologyVersion: runState.packVersion,
+        runId: runState.runId,
+        source: "cli",
+    });
+    const evidence = putResult.evidence;
+    const resultEnvelope = {
+        generatedArtifacts: {
+            threatModel: { evidenceId: evidence.id, version: evidence.version, unchanged: putResult.unchanged },
+        },
+    };
+    let runOutcome;
+    try {
+        const completion = await completeDevXRunRemote(deps.apiClient, {
+            runId: runState.runId,
+            contractVersion: DEVX_RUN_CONTRACT_VERSION,
+            result: resultEnvelope,
+        });
+        runOutcome = completion.outcome;
+    }
+    catch (err) {
+        if (!isRetryableDevXRunError(err))
+            throw err;
+        writeDevXRunCompleteOutboxEntry(params.cwd, {
+            runId: runState.runId,
+            contractVersion: DEVX_RUN_CONTRACT_VERSION,
+            result: resultEnvelope,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        runOutcome = "queued";
+    }
+    markThreatModelRunCompleted(params.cwd, runState.runId);
+    return {
+        evidenceId: evidence.id,
+        version: evidence.version,
+        unchanged: putResult.unchanged,
+        runId: runState.runId,
+        runOutcome,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/cli",
-  "version": "0.1.0-alpha.42",
+  "version": "0.1.0-alpha.43",
   "description": "ZIVIS CLI — threat modeling, scans, and MCP server for IDE integration",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",