@zivis/mcp 0.1.0-alpha.1

package/dist/tools/enterprise/manage-test-case.js

@@ -0,0 +1,119 @@
+/**
+ * zivis_manage_test_case — Create, update, or delete test cases in a threat model
+ *
+ * Maps to: POST/PATCH/DELETE /api/threat-models/:id/test-cases
+ */
+import { z } from "zod";
+import { sanitizeResponse } from "../../sanitize.js";
+export const MANAGE_TEST_CASE_NAME = "zivis_manage_test_case";
+export const MANAGE_TEST_CASE_DESCRIPTION = `Create, update, or delete a test case in a threat model.
+
+Test cases define specific security tests to validate whether vulnerabilities exist. They link to attack scenarios and can be automated or manual. Test case IDs follow the TC-X.Y format.
+
+Actions:
+- create: Add a new test case (requires name, description, success_criteria)
+- update: Modify an existing test case (requires test_case_id) — use this to record test results
+- delete: Remove a test case (requires test_case_id)`;
+export const MANAGE_TEST_CASE_SCHEMA = {
+    threat_model_id: z.string().describe("Threat model UUID (from zivis_list_threat_models, NOT a scan ID or agent ID)"),
+    action: z.enum(["create", "update", "delete"]).describe("CRUD action to perform"),
+    test_case_id: z.string().optional().describe("Test case UUID (required for update/delete)"),
+    name: z.string().optional().describe("Test case name (e.g., 'SQL Injection in Login')"),
+    description: z.string().optional().describe("Detailed description of what to test"),
+    attack_scenario_id: z.string().optional().describe("Attack scenario UUID this test validates"),
+    preconditions: z.array(z.string()).optional().describe("Prerequisites before running the test"),
+    test_steps: z.array(z.object({
+        step: z.number(),
+        action: z.string(),
+        expected: z.string(),
+        actual: z.string().optional(),
+    })).optional().describe("Ordered list of test steps with expected outcomes"),
+    success_criteria: z.string().optional().describe("What constitutes a successful test (finding a vulnerability)"),
+    evidence_type: z
+        .enum(["screenshot", "http_request", "code_snippet", "log_entry", "video", "manual_notes"])
+        .optional()
+        .describe("Type of evidence to collect"),
+    result: z
+        .enum(["not_tested", "pass", "fail", "partial", "blocked"])
+        .optional()
+        .describe("Test result (use update action to set this after testing)"),
+    severity: z.enum(["critical", "high", "medium", "low", "info"]).optional().describe("Severity if vulnerability confirmed"),
+    findings: z.string().optional().describe("Description of what was found during testing"),
+    automatable: z.boolean().optional().describe("Whether this test can be automated"),
+    automation_tool: z.string().optional().describe("Tool for automation (nuclei, burp, zap, custom)"),
+};
+export function createManageTestCaseHandler(apiClient) {
+    return async (params) => {
+        try {
+            const { threat_model_id, action, test_case_id } = params;
+            if ((action === "update" || action === "delete") && !test_case_id) {
+                return {
+                    content: [{ type: "text", text: "Error: test_case_id is required for update/delete" }],
+                    isError: true,
+                };
+            }
+            let data;
+            if (action === "create") {
+                if (!params.name || !params.description || !params.success_criteria) {
+                    return {
+                        content: [{ type: "text", text: "Error: name, description, and success_criteria are required for create" }],
+                        isError: true,
+                    };
+                }
+                data = await apiClient.post(`/api/threat-models/${threat_model_id}/test-cases`, {
+                    name: params.name,
+                    description: params.description,
+                    attackScenarioId: params.attack_scenario_id,
+                    preconditions: params.preconditions,
+                    testSteps: params.test_steps,
+                    successCriteria: params.success_criteria,
+                    evidenceType: params.evidence_type || "other",
+                    automatable: params.automatable,
+                    automationTool: params.automation_tool,
+                });
+            }
+            else if (action === "update") {
+                const body = {};
+                if (params.name)
+                    body.name = params.name;
+                if (params.description !== undefined)
+                    body.description = params.description;
+                if (params.attack_scenario_id)
+                    body.attackScenarioId = params.attack_scenario_id;
+                if (params.preconditions)
+                    body.preconditions = params.preconditions;
+                if (params.test_steps)
+                    body.testSteps = params.test_steps;
+                if (params.success_criteria)
+                    body.successCriteria = params.success_criteria;
+                if (params.evidence_type)
+                    body.evidenceType = params.evidence_type;
+                if (params.result)
+                    body.result = params.result;
+                if (params.severity)
+                    body.severity = params.severity;
+                if (params.findings !== undefined)
+                    body.findings = params.findings;
+                if (params.automatable !== undefined)
+                    body.automatable = params.automatable;
+                if (params.automation_tool !== undefined)
+                    body.automationTool = params.automation_tool;
+                data = await apiClient.patch(`/api/threat-models/${threat_model_id}/test-cases/${test_case_id}`, body);
+            }
+            else {
+                data = await apiClient.del(`/api/threat-models/${threat_model_id}/test-cases/${test_case_id}`);
+            }
+            return {
+                content: [{ type: "text", text: JSON.stringify(sanitizeResponse(data), null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to manage test case";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+//# sourceMappingURL=manage-test-case.js.map

package/dist/tools/enterprise/manage-test-case.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage-test-case.js","sourceRoot":"","sources":["../../../src/tools/enterprise/manage-test-case.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;qDAOS,CAAC;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8EAA8E,CAAC;IACpH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACjF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IAC3F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IACvF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAC9F,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAC/F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAChH,aAAa,EAAE,CAAC;SACb,IAAI,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;SAC1F,QAAQ,EAAE;SACV,QAAQ,CAAC,6BAA6B,CAAC;IAC1C,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;SAC1D,QAAQ,EAAE;SACV,QAAQ,CAAC,2DAA2D,CAAC;IACxE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IAC1H,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IACxF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAClF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;CACnG,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,SAAoB;IAC9D,OAAO,KAAK,EAAE,MAgBb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;YAEzD,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClE,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC;oBAC/F,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,IAAI,IAA6B,CAAC;YAElC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBACpE,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,wEAAwE,EAAE,CAAC;wBACpH,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CACzB,sBAAsB,eAAe,aAAa,EAClD;oBACE,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,gBAAgB,EAAE,MAAM,CAAC,kBAAkB;oBAC3C,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,eAAe,EAAE,MAAM,CAAC,gBAAgB;oBACxC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO;oBAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,cAAc,EAAE,MAAM,CAAC,eAAe;iBACvC,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAA4B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC5E,IAAI,MAAM,CAAC,kBAAkB;oBAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBACjF,IAAI,MAAM,CAAC,aAAa;oBAAE,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;gBACpE,IAAI,MAAM,CAAC,UAAU;oBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC1D,IAAI,MAAM,CAAC,gBAAgB;oBAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC5E,IAAI,MAAM,CAAC,aAAa;oBAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;gBACnE,IAAI,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/C,IAAI,MAAM,CAAC,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;oBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC5E,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;oBAAE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,eAAe,CAAC;gBAEvF,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAC1B,sBAAsB,eAAe,eAAe,YAAY,EAAE,EAClE,IAAI,CACL,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CACxB,sBAAsB,eAAe,eAAe,YAAY,EAAE,CACnE,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC5F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/enterprise/promote-finding-to-issue.d.ts

@@ -0,0 +1,36 @@
+/**
+ * zivis_promote_finding_to_issue — Promote campaign findings to report issues
+ *
+ * Maps to: POST /api/reports/:reportId/issues/promote
+ * Also uses: POST /api/reports/for-campaign/:campaignId to auto-create report
+ */
+import { z } from "zod";
+import type { ApiClient } from "../../api-client.js";
+export declare const PROMOTE_FINDING_TO_ISSUE_NAME = "zivis_promote_finding_to_issue";
+export declare const PROMOTE_FINDING_TO_ISSUE_DESCRIPTION = "Promote one or more campaign findings to a report issue for the remediation checklist.\n\nCreates a curated report issue from raw scan findings. Multiple findings can be grouped into a single issue (e.g., same root cause across different URLs). The issue gets its own title, description, and recommendation that can differ from the raw finding.\n\nIf no report exists for the campaign yet, one is automatically created.\n\nUse this after reviewing findings to build the official pen test report.";
+export declare const PROMOTE_FINDING_TO_ISSUE_SCHEMA: {
+    campaign_id: z.ZodString;
+    finding_ids: z.ZodArray<z.ZodString>;
+    title: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    recommendation: z.ZodOptional<z.ZodString>;
+};
+export declare function createPromoteFindingToIssueHandler(apiClient: ApiClient): (params: {
+    campaign_id: string;
+    finding_ids: string[];
+    title?: string;
+    description?: string;
+    recommendation?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/enterprise/promote-finding-to-issue.js

@@ -0,0 +1,65 @@
+/**
+ * zivis_promote_finding_to_issue — Promote campaign findings to report issues
+ *
+ * Maps to: POST /api/reports/:reportId/issues/promote
+ * Also uses: POST /api/reports/for-campaign/:campaignId to auto-create report
+ */
+import { z } from "zod";
+import { sanitizeResponse } from "../../sanitize.js";
+export const PROMOTE_FINDING_TO_ISSUE_NAME = "zivis_promote_finding_to_issue";
+export const PROMOTE_FINDING_TO_ISSUE_DESCRIPTION = `Promote one or more campaign findings to a report issue for the remediation checklist.
+
+Creates a curated report issue from raw scan findings. Multiple findings can be grouped into a single issue (e.g., same root cause across different URLs). The issue gets its own title, description, and recommendation that can differ from the raw finding.
+
+If no report exists for the campaign yet, one is automatically created.
+
+Use this after reviewing findings to build the official pen test report.`;
+export const PROMOTE_FINDING_TO_ISSUE_SCHEMA = {
+    campaign_id: z.string().describe("Campaign UUID — used to find or create the campaign report"),
+    finding_ids: z.array(z.string()).min(1).describe("Array of CampaignFinding UUIDs to promote"),
+    title: z.string().optional().describe("Custom issue title (defaults to finding title)"),
+    description: z.string().optional().describe("Custom issue description"),
+    recommendation: z.string().optional().describe("Custom remediation recommendation"),
+};
+export function createPromoteFindingToIssueHandler(apiClient) {
+    return async (params) => {
+        try {
+            // Step 1: Get or create the report for this campaign
+            const reportData = await apiClient.post(`/api/reports/for-campaign/${params.campaign_id}`, {});
+            const reportId = reportData.reportId;
+            if (!reportId) {
+                return {
+                    content: [{ type: "text", text: "Error: Could not get or create report for campaign" }],
+                    isError: true,
+                };
+            }
+            // Step 2: Promote findings to an issue
+            const issue = await apiClient.post(`/api/reports/${reportId}/issues/promote`, {
+                campaignFindingIds: params.finding_ids,
+                title: params.title,
+                description: params.description,
+                recommendation: params.recommendation,
+            });
+            const result = sanitizeResponse({
+                issue,
+                reportId,
+                nextSteps: [
+                    "Issue added to remediation checklist.",
+                    "Use zivis_list_report_issues to see all issues.",
+                    "Use zivis_update_report_issue to change status (open → in_progress → done).",
+                ],
+            });
+            return {
+                content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to promote finding to issue";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+//# sourceMappingURL=promote-finding-to-issue.js.map

package/dist/tools/enterprise/promote-finding-to-issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promote-finding-to-issue.js","sourceRoot":"","sources":["../../../src/tools/enterprise/promote-finding-to-issue.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,6BAA6B,GAAG,gCAAgC,CAAC;AAE9E,MAAM,CAAC,MAAM,oCAAoC,GAAG;;;;;;yEAMqB,CAAC;AAE1E,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;IAC9F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IACvF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACvE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;CACpF,CAAC;AAEF,MAAM,UAAU,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,MAMb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CACrC,6BAA6B,MAAM,CAAC,WAAW,EAAE,EACjD,EAAE,CACH,CAAC;YAEF,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,oDAAoD,EAAE,CAAC;oBAChG,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,uCAAuC;YACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAChC,gBAAgB,QAAQ,iBAAiB,EACzC;gBACE,kBAAkB,EAAE,MAAM,CAAC,WAAW;gBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CACF,CAAC;YAEF,MAAM,MAAM,GAAG,gBAAgB,CAAC;gBAC9B,KAAK;gBACL,QAAQ;gBACR,SAAS,EAAE;oBACT,uCAAuC;oBACvC,iDAAiD;oBACjD,6EAA6E;iBAC9E;aACF,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,CAAC;YAC1F,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/enterprise/publish-report-version.d.ts

@@ -0,0 +1,34 @@
+/**
+ * zivis_publish_report_version — Publish a report version and optionally export PDF
+ *
+ * Maps to: POST /api/reports/:reportId/publish
+ *        + POST /api/reports/:reportId/export (optional)
+ */
+import { z } from "zod";
+import type { ApiClient } from "../../api-client.js";
+export declare const PUBLISH_REPORT_VERSION_NAME = "zivis_publish_report_version";
+export declare const PUBLISH_REPORT_VERSION_DESCRIPTION = "Publish a new version of the campaign report and optionally export as PDF.\n\nPublishing creates an immutable snapshot of the current report state (all sections, issues, remediation status). Each version gets a version number and optional changelog.\n\nUse this when the report is ready for delivery or when you want to checkpoint progress.\n\nWorkflow: Write sections \u2192 promote findings \u2192 publish version \u2192 export PDF.";
+export declare const PUBLISH_REPORT_VERSION_SCHEMA: {
+    campaign_id: z.ZodOptional<z.ZodString>;
+    report_id: z.ZodOptional<z.ZodString>;
+    changelog: z.ZodOptional<z.ZodString>;
+    export_pdf: z.ZodDefault<z.ZodBoolean>;
+};
+export declare function createPublishReportVersionHandler(apiClient: ApiClient): (params: {
+    campaign_id?: string;
+    report_id?: string;
+    changelog?: string;
+    export_pdf?: boolean;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/enterprise/publish-report-version.js

@@ -0,0 +1,75 @@
+/**
+ * zivis_publish_report_version — Publish a report version and optionally export PDF
+ *
+ * Maps to: POST /api/reports/:reportId/publish
+ *        + POST /api/reports/:reportId/export (optional)
+ */
+import { z } from "zod";
+import { sanitizeResponse } from "../../sanitize.js";
+export const PUBLISH_REPORT_VERSION_NAME = "zivis_publish_report_version";
+export const PUBLISH_REPORT_VERSION_DESCRIPTION = `Publish a new version of the campaign report and optionally export as PDF.
+
+Publishing creates an immutable snapshot of the current report state (all sections, issues, remediation status). Each version gets a version number and optional changelog.
+
+Use this when the report is ready for delivery or when you want to checkpoint progress.
+
+Workflow: Write sections → promote findings → publish version → export PDF.`;
+export const PUBLISH_REPORT_VERSION_SCHEMA = {
+    campaign_id: z.string().optional().describe("Campaign UUID — auto-resolves to report"),
+    report_id: z.string().optional().describe("Report UUID (alternative to campaign_id)"),
+    changelog: z.string().optional().describe("What changed in this version (e.g., 'Added SQL injection findings')"),
+    export_pdf: z.boolean().default(false).describe("Also trigger PDF export after publishing"),
+};
+export function createPublishReportVersionHandler(apiClient) {
+    return async (params) => {
+        try {
+            let reportId = params.report_id;
+            // Resolve campaign → report if needed
+            if (!reportId && params.campaign_id) {
+                const reportData = await apiClient.post(`/api/reports/for-campaign/${params.campaign_id}`, {});
+                reportId = reportData.reportId;
+            }
+            if (!reportId) {
+                return {
+                    content: [{ type: "text", text: "Error: Provide either campaign_id or report_id" }],
+                    isError: true,
+                };
+            }
+            // Publish version
+            const version = await apiClient.post(`/api/reports/${reportId}/publish`, { changelog: params.changelog });
+            // Optionally export PDF
+            let pdfExport = null;
+            if (params.export_pdf) {
+                try {
+                    pdfExport = await apiClient.post(`/api/reports/${reportId}/export`, {});
+                }
+                catch (pdfErr) {
+                    console.error("PDF export failed:", pdfErr);
+                }
+            }
+            const result = sanitizeResponse({
+                version,
+                pdfExport,
+                reportId,
+                nextSteps: [
+                    "Version published successfully.",
+                    pdfExport
+                        ? "PDF export triggered. Check status with zivis_get_report_status."
+                        : "Use export_pdf: true to generate a PDF.",
+                    "View the report at the campaign's Report tab in the platform.",
+                ],
+            });
+            return {
+                content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to publish report version";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+//# sourceMappingURL=publish-report-version.js.map

package/dist/tools/enterprise/publish-report-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-report-version.js","sourceRoot":"","sources":["../../../src/tools/enterprise/publish-report-version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAE1E,MAAM,CAAC,MAAM,kCAAkC,GAAG;;;;;;4EAM0B,CAAC;AAE7E,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;IAChH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;CAC5F,CAAC;AAEF,MAAM,UAAU,iCAAiC,CAAC,SAAoB;IACpE,OAAO,KAAK,EAAE,MAKb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,IAAI,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;YAEhC,sCAAsC;YACtC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CACrC,6BAA6B,MAAM,CAAC,WAAW,EAAE,EACjD,EAAE,CACH,CAAC;gBACF,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YACjC,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gDAAgD,EAAE,CAAC;oBAC5F,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,kBAAkB;YAClB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAClC,gBAAgB,QAAQ,UAAU,EAClC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAChC,CAAC;YAEF,wBAAwB;YACxB,IAAI,SAAS,GAAmC,IAAI,CAAC;YACrD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAC9B,gBAAgB,QAAQ,SAAS,EACjC,EAAE,CACH,CAAC;gBACJ,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;gBAC9B,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,SAAS,EAAE;oBACT,iCAAiC;oBACjC,SAAS;wBACP,CAAC,CAAC,kEAAkE;wBACpE,CAAC,CAAC,yCAAyC;oBAC7C,+DAA+D;iBAChE;aACF,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,CAAC;YACxF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/enterprise/publish-test-to-library.d.ts

@@ -0,0 +1,31 @@
+/**
+ * zivis_publish_test_to_library — Publish a manual test to the agent test case library
+ *
+ * Maps to: POST /api/pentest-sessions/:id/results/:resultId/publish
+ */
+import { z } from "zod";
+import type { ApiClient } from "../../api-client.js";
+export declare const PUBLISH_TEST_TO_LIBRARY_NAME = "zivis_publish_test_to_library";
+export declare const PUBLISH_TEST_TO_LIBRARY_DESCRIPTION = "Publish a manual test result to the ZIVIS agent test case library.\n\nWhen you discover a good test case during manual pen testing, use this to make it available to automated ZIVIS agents (pen test agent, red team agent). The test case will be added to the specified agent instance's test library with source=\"user\".";
+export declare const PUBLISH_TEST_TO_LIBRARY_SCHEMA: {
+    session_id: z.ZodString;
+    result_id: z.ZodString;
+    agent_instance_id: z.ZodString;
+};
+export declare function createPublishTestToLibraryHandler(apiClient: ApiClient): (params: {
+    session_id: string;
+    result_id: string;
+    agent_instance_id: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+}>;

package/dist/tools/enterprise/publish-test-to-library.js

@@ -0,0 +1,40 @@
+/**
+ * zivis_publish_test_to_library — Publish a manual test to the agent test case library
+ *
+ * Maps to: POST /api/pentest-sessions/:id/results/:resultId/publish
+ */
+import { z } from "zod";
+import { sanitizeResponse } from "../../sanitize.js";
+export const PUBLISH_TEST_TO_LIBRARY_NAME = "zivis_publish_test_to_library";
+export const PUBLISH_TEST_TO_LIBRARY_DESCRIPTION = `Publish a manual test result to the ZIVIS agent test case library.
+
+When you discover a good test case during manual pen testing, use this to make it available to automated ZIVIS agents (pen test agent, red team agent). The test case will be added to the specified agent instance's test library with source="user".`;
+export const PUBLISH_TEST_TO_LIBRARY_SCHEMA = {
+    session_id: z.string().describe("Pen test session UUID"),
+    result_id: z.string().describe("Test result UUID to publish"),
+    agent_instance_id: z.string().describe("Agent instance UUID to add the test case to"),
+};
+export function createPublishTestToLibraryHandler(apiClient) {
+    return async (params) => {
+        try {
+            const data = await apiClient.post(`/api/pentest-sessions/${params.session_id}/results/${params.result_id}/publish`, { agentInstanceId: params.agent_instance_id });
+            const sanitized = sanitizeResponse(data);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify(sanitized, null, 2),
+                    },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to publish test to library";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+//# sourceMappingURL=publish-test-to-library.js.map

package/dist/tools/enterprise/publish-test-to-library.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-test-to-library.js","sourceRoot":"","sources":["../../../src/tools/enterprise/publish-test-to-library.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE5E,MAAM,CAAC,MAAM,mCAAmC,GAAG;;uPAEoM,CAAC;AAExP,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC7D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACtF,CAAC;AAEF,MAAM,UAAU,iCAAiC,CAAC,SAAoB;IACpE,OAAO,KAAK,EAAE,MAIb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAC/B,yBAAyB,MAAM,CAAC,UAAU,YAAY,MAAM,CAAC,SAAS,UAAU,EAChF,EAAE,eAAe,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAC9C,CAAC;YAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAEzC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;qBACzC;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC;YACzF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/enterprise/record-test-result.d.ts

@@ -0,0 +1,67 @@
+/**
+ * zivis_record_test_result — Record a test result in a pen test session
+ *
+ * Maps to: POST /api/pentest-sessions/:id/results
+ */
+import { z } from "zod";
+import type { ApiClient } from "../../api-client.js";
+export declare const RECORD_TEST_RESULT_NAME = "zivis_record_test_result";
+export declare const RECORD_TEST_RESULT_DESCRIPTION = "Record the result of a specific test within a pen test session.\n\nAfter running a manual test (e.g., SQL injection attempt, auth bypass), use this tool to log the outcome. If the test is linked to a threat model test case, the test case result will be updated automatically.\n\nInclude evidence IDs from zivis_capture_evidence to link screenshots or terminal output to the result.";
+export declare const RECORD_TEST_RESULT_SCHEMA: {
+    session_id: z.ZodString;
+    test_name: z.ZodString;
+    result: z.ZodEnum<{
+        partial: "partial";
+        not_tested: "not_tested";
+        pass: "pass";
+        fail: "fail";
+        blocked: "blocked";
+    }>;
+    test_description: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        medium: "medium";
+        low: "low";
+        info: "info";
+    }>>;
+    findings: z.ZodOptional<z.ZodString>;
+    steps_performed: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        step: z.ZodNumber;
+        action: z.ZodString;
+        expected: z.ZodString;
+        actual: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    evidence_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    test_case_id: z.ZodOptional<z.ZodString>;
+    threat_finding_id: z.ZodOptional<z.ZodString>;
+};
+export declare function createRecordTestResultHandler(apiClient: ApiClient): (params: {
+    session_id: string;
+    test_name: string;
+    result: string;
+    test_description?: string;
+    severity?: string;
+    findings?: string;
+    steps_performed?: Array<{
+        step: number;
+        action: string;
+        expected: string;
+        actual?: string;
+    }>;
+    evidence_ids?: string[];
+    test_case_id?: string;
+    threat_finding_id?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+}>;

package/dist/tools/enterprise/record-test-result.js

@@ -0,0 +1,75 @@
+/**
+ * zivis_record_test_result — Record a test result in a pen test session
+ *
+ * Maps to: POST /api/pentest-sessions/:id/results
+ */
+import { z } from "zod";
+import { sanitizeResponse } from "../../sanitize.js";
+export const RECORD_TEST_RESULT_NAME = "zivis_record_test_result";
+export const RECORD_TEST_RESULT_DESCRIPTION = `Record the result of a specific test within a pen test session.
+
+After running a manual test (e.g., SQL injection attempt, auth bypass), use this tool to log the outcome. If the test is linked to a threat model test case, the test case result will be updated automatically.
+
+Include evidence IDs from zivis_capture_evidence to link screenshots or terminal output to the result.`;
+export const RECORD_TEST_RESULT_SCHEMA = {
+    session_id: z.string().describe("Pen test session UUID"),
+    test_name: z.string().describe("Name of the test performed"),
+    result: z
+        .enum(["pass", "fail", "partial", "blocked", "not_tested"])
+        .describe("Test result (pass = no vulnerability found, fail = vulnerability confirmed)"),
+    test_description: z.string().optional().describe("Description of what was tested"),
+    severity: z
+        .enum(["critical", "high", "medium", "low", "info"])
+        .optional()
+        .describe("Severity if vulnerability found (typically set when result is 'fail')"),
+    findings: z.string().optional().describe("Description of what was discovered"),
+    steps_performed: z
+        .array(z.object({
+        step: z.number(),
+        action: z.string(),
+        expected: z.string(),
+        actual: z.string().optional(),
+    }))
+        .optional()
+        .describe("Steps performed during the test"),
+    evidence_ids: z
+        .array(z.string())
+        .optional()
+        .describe("Evidence UUIDs to link to this result (from zivis_capture_evidence)"),
+    test_case_id: z.string().optional().describe("Threat model test case UUID (auto-updates the test case result)"),
+    threat_finding_id: z.string().optional().describe("Existing threat finding UUID to link this result to"),
+};
+export function createRecordTestResultHandler(apiClient) {
+    return async (params) => {
+        try {
+            const data = await apiClient.post(`/api/pentest-sessions/${params.session_id}/results`, {
+                testName: params.test_name,
+                result: params.result,
+                testDescription: params.test_description,
+                severity: params.severity,
+                findings: params.findings,
+                stepsPerformed: params.steps_performed,
+                evidenceIds: params.evidence_ids,
+                testCaseId: params.test_case_id,
+                threatFindingId: params.threat_finding_id,
+            });
+            const sanitized = sanitizeResponse(data);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify(sanitized, null, 2),
+                    },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to record test result";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+//# sourceMappingURL=record-test-result.js.map

package/dist/tools/enterprise/record-test-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-test-result.js","sourceRoot":"","sources":["../../../src/tools/enterprise/record-test-result.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;uGAIyD,CAAC;AAExG,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IAC5D,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;SAC1D,QAAQ,CAAC,6EAA6E,CAAC;IAC1F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAClF,QAAQ,EAAE,CAAC;SACR,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;SACnD,QAAQ,EAAE;SACV,QAAQ,CAAC,uEAAuE,CAAC;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC9E,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CAAC;SACF,QAAQ,EAAE;SACV,QAAQ,CAAC,iCAAiC,CAAC;IAC9C,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;IAC/G,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CACzG,CAAC;AAEF,MAAM,UAAU,6BAA6B,CAAC,SAAoB;IAChE,OAAO,KAAK,EAAE,MAWb,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAC/B,yBAAyB,MAAM,CAAC,UAAU,UAAU,EACpD;gBACE,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,eAAe,EAAE,MAAM,CAAC,gBAAgB;gBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,cAAc,EAAE,MAAM,CAAC,eAAe;gBACtC,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,UAAU,EAAE,MAAM,CAAC,YAAY;gBAC/B,eAAe,EAAE,MAAM,CAAC,iBAAiB;aAC1C,CACF,CAAC;YAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAEzC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;qBACzC;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC;YACpF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/enterprise/start-pentest-session.d.ts

@@ -0,0 +1,35 @@
+/**
+ * zivis_start_pentest_session — Start a manual pen test session
+ *
+ * Maps to: POST /api/pentest-sessions
+ */
+import { z } from "zod";
+import type { ApiClient } from "../../api-client.js";
+export declare const START_PENTEST_SESSION_NAME = "zivis_start_pentest_session";
+export declare const START_PENTEST_SESSION_DESCRIPTION = "Start a new manual pen test session. This creates a tracking record for your pen testing work in Claude Code.\n\nOptionally link the session to a threat model and/or campaign for organizational context. Test results recorded during this session will be tracked and can be published to the agent test case library.\n\nReturns the session ID which you'll need for recording test results and ending the session.";
+export declare const START_PENTEST_SESSION_SCHEMA: {
+    name: z.ZodString;
+    tester_name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    threat_model_id: z.ZodOptional<z.ZodString>;
+    campaign_id: z.ZodOptional<z.ZodString>;
+};
+export declare function createStartPentestSessionHandler(apiClient: ApiClient): (params: {
+    name: string;
+    tester_name: string;
+    description?: string;
+    threat_model_id?: string;
+    campaign_id?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+}>;