@zivis/mcp 0.1.0-alpha.1

package/dist/server.js

@@ -0,0 +1,447 @@
+/**
+ * MCP Server
+ *
+ * Sets up the Model Context Protocol server using the official SDK
+ * with stdio transport. Registers all ZIVIS security tools.
+ *
+ * IMPORTANT: This server communicates over stdout (JSON-RPC 2.0).
+ * Never use console.log() — use console.error() for all logging.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ApiClient } from "./api-client.js";
+import { resolveAuth } from "./auth/index.js";
+import { decodeJwtPayload } from "./auth/jwt.js";
+import { loadTokens } from "./auth/token-refresh.js";
+import { detectProjectBinding, validateProjectBinding } from "./project-binding.js";
+import { DEFAULT_CONFIG } from "./types.js";
+/**
+ * Validate that the stored JWT's org matches the project binding's expected org.
+ * This prevents cross-org data leaks when a user is a member of multiple orgs.
+ *
+ * The JWT org_id is the WorkOS org ID. The project binding stores both the
+ * Zivis org UUID (orgId) and the WorkOS org ID (workosOrgId).
+ */
+async function validateJwtOrgBinding(binding, config) {
+    if (!binding.workosOrgId) {
+        // No WorkOS org ID in binding — can't validate. Log warning but don't block.
+        console.error("[zivis] WARNING: Project binding has no workosOrgId — cannot verify JWT org scope.");
+        console.error("[zivis] Run: zivis auth init --session <session> --org-id <zivis-uuid> --workos-org-id <workos-org-id>");
+        return;
+    }
+    const tokens = await loadTokens(config.session);
+    if (!tokens)
+        return; // No tokens stored yet — will fail at session check
+    const payload = decodeJwtPayload(tokens.access_token);
+    if (!payload) {
+        console.error("[zivis] WARNING: Could not decode JWT — cannot verify org scope");
+        return;
+    }
+    const jwtOrgId = payload.org_id;
+    if (!jwtOrgId) {
+        console.error("[zivis] WARNING: JWT has no org_id claim — cannot verify org scope");
+        return;
+    }
+    if (jwtOrgId !== binding.workosOrgId) {
+        const orgLabel = binding.orgName ? ` (${binding.orgName})` : "";
+        console.error("[zivis] SECURITY ERROR: JWT org does not match project binding!");
+        console.error(`[zivis]   JWT org_id:      ${jwtOrgId}`);
+        console.error(`[zivis]   Expected org_id: ${binding.workosOrgId}${orgLabel}`);
+        console.error("");
+        console.error("[zivis] This prevents cross-org data leaks.");
+        console.error(`[zivis] Fix: Re-login for this project's org:`);
+        console.error(`[zivis]   zivis auth login --session ${config.session || "default"}`);
+        process.exit(1);
+    }
+    console.error(`[zivis] JWT org verified: ${jwtOrgId}${binding.orgName ? ` (${binding.orgName})` : ""}`);
+}
+// Tools — Findings
+import { GET_FINDINGS_NAME, GET_FINDINGS_DESCRIPTION, GET_FINDINGS_SCHEMA, createGetFindingsHandler, } from "./tools/get-findings.js";
+import { GET_FINDING_DETAILS_NAME, GET_FINDING_DETAILS_DESCRIPTION, GET_FINDING_DETAILS_SCHEMA, createGetFindingDetailsHandler, } from "./tools/get-finding-details.js";
+import { TRIAGE_FINDING_NAME, TRIAGE_FINDING_DESCRIPTION, TRIAGE_FINDING_SCHEMA, createTriageFindingHandler, } from "./tools/triage-finding.js";
+// Tools — Scans & Artifacts
+import { LIST_SCANS_NAME, LIST_SCANS_DESCRIPTION, LIST_SCANS_SCHEMA, createListScansHandler, } from "./tools/list-scans.js";
+import { LIST_RECON_SCANS_NAME, LIST_RECON_SCANS_DESCRIPTION, LIST_RECON_SCANS_SCHEMA, createListReconScansHandler, } from "./tools/list-recon-scans.js";
+import { GET_RECON_SCAN_NAME, GET_RECON_SCAN_DESCRIPTION, GET_RECON_SCAN_SCHEMA, createGetReconScanHandler, } from "./tools/get-recon-scan.js";
+import { GET_SCAN_OUTPUT_NAME, GET_SCAN_OUTPUT_DESCRIPTION, GET_SCAN_OUTPUT_SCHEMA, createGetScanOutputHandler, } from "./tools/get-scan-output.js";
+import { GET_TEST_CASE_RESULTS_NAME, GET_TEST_CASE_RESULTS_DESCRIPTION, GET_TEST_CASE_RESULTS_SCHEMA, createGetTestCaseResultsHandler, } from "./tools/get-test-case-results.js";
+import { GET_AGENT_TEST_RESULTS_NAME, GET_AGENT_TEST_RESULTS_DESCRIPTION, GET_AGENT_TEST_RESULTS_SCHEMA, createGetAgentTestResultsHandler, } from "./tools/get-agent-test-results.js";
+import { LIST_SCAN_ARTIFACTS_NAME, LIST_SCAN_ARTIFACTS_DESCRIPTION, LIST_SCAN_ARTIFACTS_SCHEMA, createListScanArtifactsHandler, } from "./tools/list-scan-artifacts.js";
+import { GET_ARTIFACT_CONTENT_NAME, GET_ARTIFACT_CONTENT_DESCRIPTION, GET_ARTIFACT_CONTENT_SCHEMA, createGetArtifactContentHandler, } from "./tools/get-artifact-content.js";
+// Tools — PR Safety
+import { SCAN_PR_NAME, SCAN_PR_DESCRIPTION, SCAN_PR_SCHEMA, createScanPrHandler, } from "./tools/scan-pr.js";
+// Tools — OSS Trust
+import { CHECK_REPO_TRUST_NAME, CHECK_REPO_TRUST_DESCRIPTION, CHECK_REPO_TRUST_SCHEMA, createCheckRepoTrustHandler, } from "./tools/check-repo-trust.js";
+// Tools — ZAT & Trust Verification (public)
+import { GET_OSS_ZAT_NAME, GET_OSS_ZAT_DESCRIPTION, GET_OSS_ZAT_SCHEMA, createGetOssZatHandler, } from "./tools/get-oss-zat.js";
+import { VERIFY_TRUST_MARK_NAME, VERIFY_TRUST_MARK_DESCRIPTION, VERIFY_TRUST_MARK_SCHEMA, createVerifyTrustMarkHandler, } from "./tools/verify-trust-mark.js";
+import { GET_TRUST_KEYS_NAME, GET_TRUST_KEYS_DESCRIPTION, GET_TRUST_KEYS_SCHEMA, createGetTrustKeysHandler, } from "./tools/get-trust-keys.js";
+import { INSPECT_ZAT_NAME, INSPECT_ZAT_DESCRIPTION, INSPECT_ZAT_SCHEMA, createInspectZatHandler, } from "./tools/inspect-zat.js";
+// Tools — Red Team Setup
+import { SETUP_RED_TEAM_TARGET_NAME, SETUP_RED_TEAM_TARGET_DESCRIPTION, SETUP_RED_TEAM_TARGET_SCHEMA, createSetupRedTeamTargetHandler, } from "./tools/setup-red-team-target.js";
+// Tools — Application & Endpoint Management
+import { LIST_APPLICATIONS_NAME, LIST_APPLICATIONS_DESCRIPTION, LIST_APPLICATIONS_SCHEMA, createListApplicationsHandler, } from "./tools/list-applications.js";
+import { GET_APPLICATION_NAME, GET_APPLICATION_DESCRIPTION, GET_APPLICATION_SCHEMA, createGetApplicationHandler, } from "./tools/get-application.js";
+import { GET_APPLICATION_OVERVIEW_NAME, GET_APPLICATION_OVERVIEW_DESCRIPTION, GET_APPLICATION_OVERVIEW_SCHEMA, createGetApplicationOverviewHandler, } from "./tools/get-application-overview.js";
+import { LIST_ENDPOINTS_NAME, LIST_ENDPOINTS_DESCRIPTION, LIST_ENDPOINTS_SCHEMA, createListEndpointsHandler, } from "./tools/list-endpoints.js";
+import { IMPORT_OPENAPI_ENDPOINTS_NAME, IMPORT_OPENAPI_ENDPOINTS_DESCRIPTION, IMPORT_OPENAPI_ENDPOINTS_SCHEMA, createImportOpenApiEndpointsHandler, } from "./tools/import-openapi-endpoints.js";
+import { UPDATE_ENDPOINT_NAME, UPDATE_ENDPOINT_DESCRIPTION, UPDATE_ENDPOINT_SCHEMA, createUpdateEndpointHandler, } from "./tools/update-endpoint.js";
+// Tools — Local Scan
+import { LOCAL_SCAN_NAME, LOCAL_SCAN_DESCRIPTION, LOCAL_SCAN_SCHEMA, createLocalScanHandler, } from "./tools/local-scan.js";
+// Tools — Local Infrastructure Discovery
+import { DISCOVER_LOCAL_INFRA_NAME, DISCOVER_LOCAL_INFRA_DESCRIPTION, DISCOVER_LOCAL_INFRA_SCHEMA, createDiscoverLocalInfraHandler, } from "./tools/discover-local-infra.js";
+// Tools — Diagram Generation
+import { GENERATE_DIAGRAM_NAME, GENERATE_DIAGRAM_DESCRIPTION, GENERATE_DIAGRAM_SCHEMA, createGenerateDiagramHandler, } from "./tools/generate-diagram.js";
+// Tools — Diagram CRUD
+import { LIST_DIAGRAMS_NAME, LIST_DIAGRAMS_DESCRIPTION, LIST_DIAGRAMS_SCHEMA, createListDiagramsHandler, } from "./tools/list-diagrams.js";
+import { GET_DIAGRAM_NAME, GET_DIAGRAM_DESCRIPTION, GET_DIAGRAM_SCHEMA, createGetDiagramHandler, } from "./tools/get-diagram.js";
+import { CREATE_DIAGRAM_NAME, CREATE_DIAGRAM_DESCRIPTION, CREATE_DIAGRAM_SCHEMA, createCreateDiagramHandler, } from "./tools/create-diagram.js";
+import { MANAGE_DIAGRAM_NAME, MANAGE_DIAGRAM_DESCRIPTION, MANAGE_DIAGRAM_SCHEMA, createManageDiagramHandler, } from "./tools/manage-diagram.js";
+import { UPDATE_MERMAID_SOURCE_NAME, UPDATE_MERMAID_SOURCE_DESCRIPTION, UPDATE_MERMAID_SOURCE_SCHEMA, createUpdateMermaidSourceHandler, } from "./tools/update-mermaid-source.js";
+import { LIST_DOCUMENTS_NAME, LIST_DOCUMENTS_DESCRIPTION, LIST_DOCUMENTS_SCHEMA, createListDocumentsHandler, } from "./tools/list-documents.js";
+import { GET_DOCUMENT_NAME, GET_DOCUMENT_DESCRIPTION, GET_DOCUMENT_SCHEMA, createGetDocumentHandler, } from "./tools/get-document.js";
+import { CREATE_DOCUMENT_NAME, CREATE_DOCUMENT_DESCRIPTION, CREATE_DOCUMENT_SCHEMA, createCreateDocumentHandler, } from "./tools/create-document.js";
+import { UPDATE_DOCUMENT_NAME, UPDATE_DOCUMENT_DESCRIPTION, UPDATE_DOCUMENT_SCHEMA, createUpdateDocumentHandler, } from "./tools/update-document.js";
+// Tools — Security Review (composite intelligence)
+import { SECURITY_REVIEW_NAME, SECURITY_REVIEW_DESCRIPTION, SECURITY_REVIEW_SCHEMA, createSecurityReviewHandler, } from "./tools/security-review.js";
+// Tools — Project Binding
+import { CHECK_PROJECT_NAME, CHECK_PROJECT_DESCRIPTION, CHECK_PROJECT_SCHEMA, createCheckProjectHandler, } from "./tools/check-project.js";
+// Tools — Test Library (IP-protected: metadata only, no prompts/patterns)
+import { LIST_TEST_LIBRARY_NAME, LIST_TEST_LIBRARY_DESCRIPTION, LIST_TEST_LIBRARY_SCHEMA, createListTestLibraryHandler, } from "./tools/list-test-library.js";
+import { GET_TEST_DETAILS_NAME, GET_TEST_DETAILS_DESCRIPTION, GET_TEST_DETAILS_SCHEMA, createGetTestDetailsHandler, } from "./tools/get-test-details.js";
+import { LIST_TEST_SCENARIOS_NAME, LIST_TEST_SCENARIOS_DESCRIPTION, LIST_TEST_SCENARIOS_SCHEMA, createListTestScenariosHandler, } from "./tools/list-test-scenarios.js";
+import { GET_SCENARIO_DETAILS_NAME, GET_SCENARIO_DETAILS_DESCRIPTION, GET_SCENARIO_DETAILS_SCHEMA, createGetScenarioDetailsHandler, } from "./tools/get-scenario-details.js";
+import { LIST_AGENT_TEST_CASES_NAME, LIST_AGENT_TEST_CASES_DESCRIPTION, LIST_AGENT_TEST_CASES_SCHEMA, createListAgentTestCasesHandler, } from "./tools/list-agent-test-cases.js";
+import { RUN_TEST_SCENARIO_NAME, RUN_TEST_SCENARIO_DESCRIPTION, RUN_TEST_SCENARIO_SCHEMA, createRunTestScenarioHandler, } from "./tools/run-test-scenario.js";
+// ── Enterprise Tools — Threat Model Management ──
+import { GET_THREAT_MODEL_NAME, GET_THREAT_MODEL_DESCRIPTION, GET_THREAT_MODEL_SCHEMA, createGetThreatModelHandler } from "./tools/enterprise/get-threat-model.js";
+import { LIST_THREAT_MODELS_NAME, LIST_THREAT_MODELS_DESCRIPTION, LIST_THREAT_MODELS_SCHEMA, createListThreatModelsHandler } from "./tools/enterprise/list-threat-models.js";
+import { MANAGE_ACTOR_NAME, MANAGE_ACTOR_DESCRIPTION, MANAGE_ACTOR_SCHEMA, createManageActorHandler } from "./tools/enterprise/manage-actor.js";
+import { MANAGE_COMPONENT_NAME, MANAGE_COMPONENT_DESCRIPTION, MANAGE_COMPONENT_SCHEMA, createManageComponentHandler } from "./tools/enterprise/manage-component.js";
+import { MANAGE_DATA_FLOW_NAME, MANAGE_DATA_FLOW_DESCRIPTION, MANAGE_DATA_FLOW_SCHEMA, createManageDataFlowHandler } from "./tools/enterprise/manage-data-flow.js";
+import { MANAGE_ATTACK_SCENARIO_NAME, MANAGE_ATTACK_SCENARIO_DESCRIPTION, MANAGE_ATTACK_SCENARIO_SCHEMA, createManageAttackScenarioHandler } from "./tools/enterprise/manage-attack-scenario.js";
+import { MANAGE_SECURITY_CONTROL_NAME, MANAGE_SECURITY_CONTROL_DESCRIPTION, MANAGE_SECURITY_CONTROL_SCHEMA, createManageSecurityControlHandler } from "./tools/enterprise/manage-security-control.js";
+import { MANAGE_DATA_ASSET_NAME, MANAGE_DATA_ASSET_DESCRIPTION, MANAGE_DATA_ASSET_SCHEMA, createManageDataAssetHandler } from "./tools/enterprise/manage-data-asset.js";
+import { MANAGE_TEST_CASE_NAME, MANAGE_TEST_CASE_DESCRIPTION, MANAGE_TEST_CASE_SCHEMA, createManageTestCaseHandler } from "./tools/enterprise/manage-test-case.js";
+import { MANAGE_FINDING_NAME, MANAGE_FINDING_DESCRIPTION, MANAGE_FINDING_SCHEMA, createManageFindingHandler } from "./tools/enterprise/manage-finding.js";
+// ── Enterprise Tools — Pen Test Sessions ──
+import { START_PENTEST_SESSION_NAME, START_PENTEST_SESSION_DESCRIPTION, START_PENTEST_SESSION_SCHEMA, createStartPentestSessionHandler } from "./tools/enterprise/start-pentest-session.js";
+import { RECORD_TEST_RESULT_NAME, RECORD_TEST_RESULT_DESCRIPTION, RECORD_TEST_RESULT_SCHEMA, createRecordTestResultHandler } from "./tools/enterprise/record-test-result.js";
+import { END_PENTEST_SESSION_NAME, END_PENTEST_SESSION_DESCRIPTION, END_PENTEST_SESSION_SCHEMA, createEndPentestSessionHandler } from "./tools/enterprise/end-pentest-session.js";
+import { PUBLISH_TEST_TO_LIBRARY_NAME, PUBLISH_TEST_TO_LIBRARY_DESCRIPTION, PUBLISH_TEST_TO_LIBRARY_SCHEMA, createPublishTestToLibraryHandler } from "./tools/enterprise/publish-test-to-library.js";
+// ── Enterprise Tools — Evidence & Reports ──
+import { CAPTURE_EVIDENCE_NAME, CAPTURE_EVIDENCE_DESCRIPTION, CAPTURE_EVIDENCE_SCHEMA, createCaptureEvidenceHandler } from "./tools/enterprise/capture-evidence.js";
+import { GENERATE_REPORT_NAME, GENERATE_REPORT_DESCRIPTION, GENERATE_REPORT_SCHEMA, createGenerateReportHandler } from "./tools/enterprise/generate-report.js";
+import { GET_REPORT_STATUS_NAME, GET_REPORT_STATUS_DESCRIPTION, GET_REPORT_STATUS_SCHEMA, createGetReportStatusHandler } from "./tools/enterprise/get-report-status.js";
+// ── Enterprise Tools — Report Issues & Remediation ──
+import { PROMOTE_FINDING_TO_ISSUE_NAME, PROMOTE_FINDING_TO_ISSUE_DESCRIPTION, PROMOTE_FINDING_TO_ISSUE_SCHEMA, createPromoteFindingToIssueHandler } from "./tools/enterprise/promote-finding-to-issue.js";
+import { LIST_REPORT_ISSUES_NAME, LIST_REPORT_ISSUES_DESCRIPTION, LIST_REPORT_ISSUES_SCHEMA, createListReportIssuesHandler } from "./tools/enterprise/list-report-issues.js";
+import { UPDATE_REPORT_ISSUE_NAME, UPDATE_REPORT_ISSUE_DESCRIPTION, UPDATE_REPORT_ISSUE_SCHEMA, createUpdateReportIssueHandler } from "./tools/enterprise/update-report-issue.js";
+import { SYNC_REPORT_SECTION_NAME, SYNC_REPORT_SECTION_DESCRIPTION, SYNC_REPORT_SECTION_SCHEMA, createSyncReportSectionHandler } from "./tools/enterprise/sync-report-section.js";
+import { PUBLISH_REPORT_VERSION_NAME, PUBLISH_REPORT_VERSION_DESCRIPTION, PUBLISH_REPORT_VERSION_SCHEMA, createPublishReportVersionHandler } from "./tools/enterprise/publish-report-version.js";
+import { CREATE_REPORT_TICKET_NAME, CREATE_REPORT_TICKET_DESCRIPTION, CREATE_REPORT_TICKET_SCHEMA, createCreateReportTicketHandler } from "./tools/enterprise/create-report-ticket.js";
+// ── Enterprise Tools — ZAT ──
+import { GET_ORG_ZAT_NAME, GET_ORG_ZAT_DESCRIPTION, GET_ORG_ZAT_SCHEMA, createGetOrgZatHandler } from "./tools/enterprise/get-org-zat.js";
+// ── Enterprise Tools — Agent Instances ──
+import { LIST_AGENTS_NAME, LIST_AGENTS_DESCRIPTION, LIST_AGENTS_SCHEMA, createListAgentsHandler } from "./tools/enterprise/list-agents.js";
+// ── IDE Bridge ──
+import { OPEN_IN_IDE_NAME, OPEN_IN_IDE_DESCRIPTION, OPEN_IN_IDE_SCHEMA, createOpenInIdeHandler, } from "./tools/open-in-ide.js";
+/**
+ * Create and start the MCP server with all tools registered
+ */
+export async function startServer(config = DEFAULT_CONFIG) {
+    // Detect the project binding FIRST so we can auto-adopt its session
+    // when no explicit ZIVIS_SESSION was passed. This makes .zivis/project.json
+    // the single source of truth — cd into a project and the correct tokens
+    // are used without any IDE config to go stale.
+    const detected = detectProjectBinding(process.cwd());
+    if (detected && !config.session) {
+        config = { ...config, session: detected.binding.session };
+        console.error(`[zivis] Auto-adopted session "${config.session}" from ${detected.filePath}`);
+    }
+    const server = new McpServer({
+        name: "zivis-security",
+        version: "0.2.0",
+    });
+    const apiClient = new ApiClient(config);
+    // ── Register Tools: Findings ──
+    server.registerTool(GET_FINDINGS_NAME, {
+        description: GET_FINDINGS_DESCRIPTION,
+        inputSchema: GET_FINDINGS_SCHEMA,
+    }, createGetFindingsHandler(apiClient));
+    server.registerTool(GET_FINDING_DETAILS_NAME, {
+        description: GET_FINDING_DETAILS_DESCRIPTION,
+        inputSchema: GET_FINDING_DETAILS_SCHEMA,
+    }, createGetFindingDetailsHandler(apiClient));
+    server.registerTool(TRIAGE_FINDING_NAME, {
+        description: TRIAGE_FINDING_DESCRIPTION,
+        inputSchema: TRIAGE_FINDING_SCHEMA,
+    }, createTriageFindingHandler(apiClient));
+    // ── Register Tools: Scans & Artifacts ──
+    server.registerTool(LIST_SCANS_NAME, {
+        description: LIST_SCANS_DESCRIPTION,
+        inputSchema: LIST_SCANS_SCHEMA,
+    }, createListScansHandler(apiClient));
+    server.registerTool(LIST_RECON_SCANS_NAME, {
+        description: LIST_RECON_SCANS_DESCRIPTION,
+        inputSchema: LIST_RECON_SCANS_SCHEMA,
+    }, createListReconScansHandler(apiClient));
+    server.registerTool(GET_RECON_SCAN_NAME, {
+        description: GET_RECON_SCAN_DESCRIPTION,
+        inputSchema: GET_RECON_SCAN_SCHEMA,
+    }, createGetReconScanHandler(apiClient));
+    server.registerTool(GET_SCAN_OUTPUT_NAME, {
+        description: GET_SCAN_OUTPUT_DESCRIPTION,
+        inputSchema: GET_SCAN_OUTPUT_SCHEMA,
+    }, createGetScanOutputHandler(apiClient));
+    server.registerTool(GET_TEST_CASE_RESULTS_NAME, {
+        description: GET_TEST_CASE_RESULTS_DESCRIPTION,
+        inputSchema: GET_TEST_CASE_RESULTS_SCHEMA,
+    }, createGetTestCaseResultsHandler(apiClient));
+    server.registerTool(GET_AGENT_TEST_RESULTS_NAME, {
+        description: GET_AGENT_TEST_RESULTS_DESCRIPTION,
+        inputSchema: GET_AGENT_TEST_RESULTS_SCHEMA,
+    }, createGetAgentTestResultsHandler(apiClient));
+    server.registerTool(LIST_SCAN_ARTIFACTS_NAME, {
+        description: LIST_SCAN_ARTIFACTS_DESCRIPTION,
+        inputSchema: LIST_SCAN_ARTIFACTS_SCHEMA,
+    }, createListScanArtifactsHandler(apiClient));
+    server.registerTool(GET_ARTIFACT_CONTENT_NAME, {
+        description: GET_ARTIFACT_CONTENT_DESCRIPTION,
+        inputSchema: GET_ARTIFACT_CONTENT_SCHEMA,
+    }, createGetArtifactContentHandler(apiClient));
+    // ── Register Tools: PR Safety ──
+    server.registerTool(SCAN_PR_NAME, {
+        description: SCAN_PR_DESCRIPTION,
+        inputSchema: SCAN_PR_SCHEMA,
+    }, createScanPrHandler(apiClient));
+    // ── Register Tools: OSS Trust ──
+    server.registerTool(CHECK_REPO_TRUST_NAME, {
+        description: CHECK_REPO_TRUST_DESCRIPTION,
+        inputSchema: CHECK_REPO_TRUST_SCHEMA,
+    }, createCheckRepoTrustHandler(config));
+    // ── Register Tools: ZAT & Trust Verification ──
+    server.registerTool(GET_OSS_ZAT_NAME, {
+        description: GET_OSS_ZAT_DESCRIPTION,
+        inputSchema: GET_OSS_ZAT_SCHEMA,
+    }, createGetOssZatHandler(config));
+    server.registerTool(VERIFY_TRUST_MARK_NAME, {
+        description: VERIFY_TRUST_MARK_DESCRIPTION,
+        inputSchema: VERIFY_TRUST_MARK_SCHEMA,
+    }, createVerifyTrustMarkHandler(config));
+    server.registerTool(GET_TRUST_KEYS_NAME, {
+        description: GET_TRUST_KEYS_DESCRIPTION,
+        inputSchema: GET_TRUST_KEYS_SCHEMA,
+    }, createGetTrustKeysHandler(config));
+    server.registerTool(INSPECT_ZAT_NAME, {
+        description: INSPECT_ZAT_DESCRIPTION,
+        inputSchema: INSPECT_ZAT_SCHEMA,
+    }, createInspectZatHandler());
+    // ── Register Tools: Red Team Setup ──
+    server.registerTool(SETUP_RED_TEAM_TARGET_NAME, {
+        description: SETUP_RED_TEAM_TARGET_DESCRIPTION,
+        inputSchema: SETUP_RED_TEAM_TARGET_SCHEMA,
+    }, createSetupRedTeamTargetHandler(apiClient));
+    // ── Register Tools: Application & Endpoint Management ──
+    server.registerTool(LIST_APPLICATIONS_NAME, {
+        description: LIST_APPLICATIONS_DESCRIPTION,
+        inputSchema: LIST_APPLICATIONS_SCHEMA,
+    }, createListApplicationsHandler(apiClient));
+    server.registerTool(GET_APPLICATION_NAME, {
+        description: GET_APPLICATION_DESCRIPTION,
+        inputSchema: GET_APPLICATION_SCHEMA,
+    }, createGetApplicationHandler(apiClient));
+    server.registerTool(GET_APPLICATION_OVERVIEW_NAME, {
+        description: GET_APPLICATION_OVERVIEW_DESCRIPTION,
+        inputSchema: GET_APPLICATION_OVERVIEW_SCHEMA,
+    }, createGetApplicationOverviewHandler(apiClient));
+    server.registerTool(LIST_ENDPOINTS_NAME, {
+        description: LIST_ENDPOINTS_DESCRIPTION,
+        inputSchema: LIST_ENDPOINTS_SCHEMA,
+    }, createListEndpointsHandler(apiClient));
+    server.registerTool(IMPORT_OPENAPI_ENDPOINTS_NAME, {
+        description: IMPORT_OPENAPI_ENDPOINTS_DESCRIPTION,
+        inputSchema: IMPORT_OPENAPI_ENDPOINTS_SCHEMA,
+    }, createImportOpenApiEndpointsHandler(apiClient));
+    server.registerTool(UPDATE_ENDPOINT_NAME, {
+        description: UPDATE_ENDPOINT_DESCRIPTION,
+        inputSchema: UPDATE_ENDPOINT_SCHEMA,
+    }, createUpdateEndpointHandler(apiClient));
+    // ── Register Tools: Local Scan ──
+    server.registerTool(LOCAL_SCAN_NAME, {
+        description: LOCAL_SCAN_DESCRIPTION,
+        inputSchema: LOCAL_SCAN_SCHEMA,
+    }, createLocalScanHandler(apiClient));
+    // ── Register Tools: Local Infrastructure Discovery ──
+    server.registerTool(DISCOVER_LOCAL_INFRA_NAME, {
+        description: DISCOVER_LOCAL_INFRA_DESCRIPTION,
+        inputSchema: DISCOVER_LOCAL_INFRA_SCHEMA,
+    }, createDiscoverLocalInfraHandler());
+    // ── Register Tools: Diagram Generation ──
+    server.registerTool(GENERATE_DIAGRAM_NAME, {
+        description: GENERATE_DIAGRAM_DESCRIPTION,
+        inputSchema: GENERATE_DIAGRAM_SCHEMA,
+    }, createGenerateDiagramHandler(apiClient));
+    // ── Register Tools: Diagram CRUD ──
+    server.registerTool(LIST_DIAGRAMS_NAME, {
+        description: LIST_DIAGRAMS_DESCRIPTION,
+        inputSchema: LIST_DIAGRAMS_SCHEMA,
+    }, createListDiagramsHandler(apiClient));
+    server.registerTool(GET_DIAGRAM_NAME, {
+        description: GET_DIAGRAM_DESCRIPTION,
+        inputSchema: GET_DIAGRAM_SCHEMA,
+    }, createGetDiagramHandler(apiClient));
+    server.registerTool(CREATE_DIAGRAM_NAME, {
+        description: CREATE_DIAGRAM_DESCRIPTION,
+        inputSchema: CREATE_DIAGRAM_SCHEMA,
+    }, createCreateDiagramHandler(apiClient));
+    server.registerTool(MANAGE_DIAGRAM_NAME, {
+        description: MANAGE_DIAGRAM_DESCRIPTION,
+        inputSchema: MANAGE_DIAGRAM_SCHEMA,
+    }, createManageDiagramHandler(apiClient));
+    server.registerTool(UPDATE_MERMAID_SOURCE_NAME, {
+        description: UPDATE_MERMAID_SOURCE_DESCRIPTION,
+        inputSchema: UPDATE_MERMAID_SOURCE_SCHEMA,
+    }, createUpdateMermaidSourceHandler(apiClient));
+    server.registerTool(LIST_DOCUMENTS_NAME, { description: LIST_DOCUMENTS_DESCRIPTION, inputSchema: LIST_DOCUMENTS_SCHEMA }, createListDocumentsHandler(apiClient));
+    server.registerTool(GET_DOCUMENT_NAME, { description: GET_DOCUMENT_DESCRIPTION, inputSchema: GET_DOCUMENT_SCHEMA }, createGetDocumentHandler(apiClient));
+    server.registerTool(CREATE_DOCUMENT_NAME, { description: CREATE_DOCUMENT_DESCRIPTION, inputSchema: CREATE_DOCUMENT_SCHEMA }, createCreateDocumentHandler(apiClient));
+    server.registerTool(UPDATE_DOCUMENT_NAME, { description: UPDATE_DOCUMENT_DESCRIPTION, inputSchema: UPDATE_DOCUMENT_SCHEMA }, createUpdateDocumentHandler(apiClient));
+    // ── Register Tools: IDE Bridge ──
+    server.registerTool(OPEN_IN_IDE_NAME, { description: OPEN_IN_IDE_DESCRIPTION, inputSchema: OPEN_IN_IDE_SCHEMA }, createOpenInIdeHandler());
+    // ── Register Tools: Security Review ──
+    server.registerTool(SECURITY_REVIEW_NAME, {
+        description: SECURITY_REVIEW_DESCRIPTION,
+        inputSchema: SECURITY_REVIEW_SCHEMA,
+    }, createSecurityReviewHandler(apiClient, config));
+    // ── Register Tools: Project Binding ──
+    server.registerTool(CHECK_PROJECT_NAME, {
+        description: CHECK_PROJECT_DESCRIPTION,
+        inputSchema: CHECK_PROJECT_SCHEMA,
+    }, createCheckProjectHandler(apiClient, config));
+    // ── Register Tools: Test Library (IP-protected) ──
+    server.registerTool(LIST_TEST_LIBRARY_NAME, {
+        description: LIST_TEST_LIBRARY_DESCRIPTION,
+        inputSchema: LIST_TEST_LIBRARY_SCHEMA,
+    }, createListTestLibraryHandler(apiClient));
+    server.registerTool(GET_TEST_DETAILS_NAME, {
+        description: GET_TEST_DETAILS_DESCRIPTION,
+        inputSchema: GET_TEST_DETAILS_SCHEMA,
+    }, createGetTestDetailsHandler(apiClient));
+    server.registerTool(LIST_TEST_SCENARIOS_NAME, {
+        description: LIST_TEST_SCENARIOS_DESCRIPTION,
+        inputSchema: LIST_TEST_SCENARIOS_SCHEMA,
+    }, createListTestScenariosHandler(apiClient));
+    server.registerTool(GET_SCENARIO_DETAILS_NAME, {
+        description: GET_SCENARIO_DETAILS_DESCRIPTION,
+        inputSchema: GET_SCENARIO_DETAILS_SCHEMA,
+    }, createGetScenarioDetailsHandler(apiClient));
+    server.registerTool(LIST_AGENT_TEST_CASES_NAME, {
+        description: LIST_AGENT_TEST_CASES_DESCRIPTION,
+        inputSchema: LIST_AGENT_TEST_CASES_SCHEMA,
+    }, createListAgentTestCasesHandler(apiClient));
+    server.registerTool(RUN_TEST_SCENARIO_NAME, {
+        description: RUN_TEST_SCENARIO_DESCRIPTION,
+        inputSchema: RUN_TEST_SCENARIO_SCHEMA,
+    }, createRunTestScenarioHandler(apiClient));
+    // ── Register Enterprise Tools ──
+    // These tools are visible to all orgs but return upgrade prompts for non-enterprise.
+    // The handler wrapper checks features at call time via /api/mcp/features.
+    let enterpriseFeatures = null;
+    /**
+     * Wraps an enterprise tool handler to check feature access at call time.
+     * Non-enterprise orgs see the tools but get an upgrade message.
+     */
+    function wrapEnterpriseHandler(handler, featureKey = "mcpEnterpriseTools") {
+        return async (params) => {
+            // Lazy-load features on first enterprise tool call
+            if (enterpriseFeatures === null) {
+                try {
+                    const resp = await apiClient.get("/api/mcp/features");
+                    enterpriseFeatures = resp.features;
+                }
+                catch {
+                    // If feature check fails, allow the call (API will enforce access)
+                    enterpriseFeatures = {};
+                }
+            }
+            if (enterpriseFeatures[featureKey] === false) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `This tool requires a Pro+, Enterprise, or Demo plan.\n\nUpgrade at https://app.zivis.ai/settings/billing to access enterprise MCP tools including:\n- Threat model management\n- Pen test session tracking\n- Evidence capture\n- Report generation\n\nContact sales@zivis.ai for enterprise pricing.`,
+                        },
+                    ],
+                };
+            }
+            return handler(params);
+        };
+    }
+    // Agent Instances
+    const enterpriseTools = [
+        [LIST_AGENTS_NAME, LIST_AGENTS_DESCRIPTION, LIST_AGENTS_SCHEMA, createListAgentsHandler(apiClient)],
+        // Threat Model Management
+        [GET_THREAT_MODEL_NAME, GET_THREAT_MODEL_DESCRIPTION, GET_THREAT_MODEL_SCHEMA, createGetThreatModelHandler(apiClient)],
+        [LIST_THREAT_MODELS_NAME, LIST_THREAT_MODELS_DESCRIPTION, LIST_THREAT_MODELS_SCHEMA, createListThreatModelsHandler(apiClient)],
+        [MANAGE_ACTOR_NAME, MANAGE_ACTOR_DESCRIPTION, MANAGE_ACTOR_SCHEMA, createManageActorHandler(apiClient)],
+        [MANAGE_COMPONENT_NAME, MANAGE_COMPONENT_DESCRIPTION, MANAGE_COMPONENT_SCHEMA, createManageComponentHandler(apiClient)],
+        [MANAGE_DATA_FLOW_NAME, MANAGE_DATA_FLOW_DESCRIPTION, MANAGE_DATA_FLOW_SCHEMA, createManageDataFlowHandler(apiClient)],
+        [MANAGE_ATTACK_SCENARIO_NAME, MANAGE_ATTACK_SCENARIO_DESCRIPTION, MANAGE_ATTACK_SCENARIO_SCHEMA, createManageAttackScenarioHandler(apiClient)],
+        [MANAGE_SECURITY_CONTROL_NAME, MANAGE_SECURITY_CONTROL_DESCRIPTION, MANAGE_SECURITY_CONTROL_SCHEMA, createManageSecurityControlHandler(apiClient)],
+        [MANAGE_DATA_ASSET_NAME, MANAGE_DATA_ASSET_DESCRIPTION, MANAGE_DATA_ASSET_SCHEMA, createManageDataAssetHandler(apiClient)],
+        [MANAGE_TEST_CASE_NAME, MANAGE_TEST_CASE_DESCRIPTION, MANAGE_TEST_CASE_SCHEMA, createManageTestCaseHandler(apiClient)],
+        [MANAGE_FINDING_NAME, MANAGE_FINDING_DESCRIPTION, MANAGE_FINDING_SCHEMA, createManageFindingHandler(apiClient)],
+        // Pen Test Sessions
+        [START_PENTEST_SESSION_NAME, START_PENTEST_SESSION_DESCRIPTION, START_PENTEST_SESSION_SCHEMA, createStartPentestSessionHandler(apiClient)],
+        [RECORD_TEST_RESULT_NAME, RECORD_TEST_RESULT_DESCRIPTION, RECORD_TEST_RESULT_SCHEMA, createRecordTestResultHandler(apiClient)],
+        [END_PENTEST_SESSION_NAME, END_PENTEST_SESSION_DESCRIPTION, END_PENTEST_SESSION_SCHEMA, createEndPentestSessionHandler(apiClient)],
+        [PUBLISH_TEST_TO_LIBRARY_NAME, PUBLISH_TEST_TO_LIBRARY_DESCRIPTION, PUBLISH_TEST_TO_LIBRARY_SCHEMA, createPublishTestToLibraryHandler(apiClient)],
+        // Evidence & Reports
+        [CAPTURE_EVIDENCE_NAME, CAPTURE_EVIDENCE_DESCRIPTION, CAPTURE_EVIDENCE_SCHEMA, createCaptureEvidenceHandler(apiClient)],
+        [GENERATE_REPORT_NAME, GENERATE_REPORT_DESCRIPTION, GENERATE_REPORT_SCHEMA, createGenerateReportHandler(apiClient)],
+        [GET_REPORT_STATUS_NAME, GET_REPORT_STATUS_DESCRIPTION, GET_REPORT_STATUS_SCHEMA, createGetReportStatusHandler(apiClient)],
+        // Report Issues & Remediation
+        [PROMOTE_FINDING_TO_ISSUE_NAME, PROMOTE_FINDING_TO_ISSUE_DESCRIPTION, PROMOTE_FINDING_TO_ISSUE_SCHEMA, createPromoteFindingToIssueHandler(apiClient)],
+        [LIST_REPORT_ISSUES_NAME, LIST_REPORT_ISSUES_DESCRIPTION, LIST_REPORT_ISSUES_SCHEMA, createListReportIssuesHandler(apiClient)],
+        [UPDATE_REPORT_ISSUE_NAME, UPDATE_REPORT_ISSUE_DESCRIPTION, UPDATE_REPORT_ISSUE_SCHEMA, createUpdateReportIssueHandler(apiClient)],
+        [SYNC_REPORT_SECTION_NAME, SYNC_REPORT_SECTION_DESCRIPTION, SYNC_REPORT_SECTION_SCHEMA, createSyncReportSectionHandler(apiClient)],
+        [PUBLISH_REPORT_VERSION_NAME, PUBLISH_REPORT_VERSION_DESCRIPTION, PUBLISH_REPORT_VERSION_SCHEMA, createPublishReportVersionHandler(apiClient)],
+        [CREATE_REPORT_TICKET_NAME, CREATE_REPORT_TICKET_DESCRIPTION, CREATE_REPORT_TICKET_SCHEMA, createCreateReportTicketHandler(apiClient)],
+        // ZAT
+        [GET_ORG_ZAT_NAME, GET_ORG_ZAT_DESCRIPTION, GET_ORG_ZAT_SCHEMA, createGetOrgZatHandler(apiClient)],
+    ];
+    for (const [name, description, schema, handler] of enterpriseTools) {
+        server.registerTool(name, { description: description, inputSchema: schema }, wrapEnterpriseHandler(handler));
+    }
+    // ── Project binding check ──
+    // `detected` was resolved at the top of this function so its session could
+    // be auto-adopted into config when no explicit ZIVIS_SESSION was set.
+    if (detected) {
+        validateProjectBinding(detected.binding, detected.filePath, config);
+    }
+    // ── Session safety check ──
+    if (config.session) {
+        console.error(`[zivis] Session: ${config.session}`);
+        // Verify the session has credentials before starting
+        const creds = await resolveAuth(config);
+        if (creds.method === "none") {
+            console.error(`[zivis] ERROR: Session "${config.session}" has no credentials.`);
+            console.error(`[zivis] Run: zivis auth login --session ${config.session}`);
+            process.exit(1);
+        }
+    }
+    // ── JWT org isolation check ──
+    // Must run AFTER session check (needs valid tokens) but BEFORE connecting.
+    // Prevents cross-org data leaks by verifying the JWT's org matches the project binding.
+    if (detected?.binding.workosOrgId) {
+        await validateJwtOrgBinding(detected.binding, config);
+    }
+    // ── Connect via stdio ──
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("[zivis] MCP server running on stdio");
+    console.error(`[zivis] API: ${config.apiBaseUrl}`);
+    console.error(`[zivis] Tools: 31 public + ${enterpriseTools.length} enterprise`);
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAClC,OAAuB,EACvB,MAAmB;IAEnB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,6EAA6E;QAC7E,OAAO,CAAC,KAAK,CACX,oFAAoF,CACrF,CAAC;QACF,OAAO,CAAC,KAAK,CACX,wGAAwG,CACzG,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,oDAAoD;IAEzE,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACjF,OAAO,CAAC,KAAK,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,8BAA8B,OAAO,CAAC,WAAW,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,wCAAwC,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzF,CAAC;AACJ,CAAC;AAED,mBAAmB;AACnB,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,4BAA4B;AAC5B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,EAClC,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AAEzC,oBAAoB;AACpB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AAErC,4CAA4C;AAC5C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,yBAAyB;AACzB,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,4CAA4C;AAC5C,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,EACpC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,EACpC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qBAAqB;AACrB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,yCAAyC;AACzC,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AAEzC,6BAA6B;AAC7B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAErC,uBAAuB;AACvB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,mDAAmD;AACnD,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,0BAA0B;AAC1B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAElC,0EAA0E;AAC1E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAEtC,mDAAmD;AACnD,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACnK,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC7K,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACpK,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACnK,OAAO,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,8CAA8C,CAAC;AACjM,OAAO,EAAE,4BAA4B,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,kCAAkC,EAAE,MAAM,+CAA+C,CAAC;AACtM,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AACxK,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACnK,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAE1J,6CAA6C;AAC7C,OAAO,EAAE,0BAA0B,EAAE,iCAAiC,EAAE,4BAA4B,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAC5L,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC7K,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAClL,OAAO,EAAE,4BAA4B,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAErM,8CAA8C;AAC9C,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACpK,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAC/J,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AAExK,uDAAuD;AACvD,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC1M,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC7K,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAClL,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAClL,OAAO,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,8CAA8C,CAAC;AACjM,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAEvL,+BAA+B;AAC/B,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE1I,2CAA2C;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAE3I,mBAAmB;AACnB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAsB,cAAc;IAEpC,oEAAoE;IACpE,4EAA4E;IAC5E,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1D,OAAO,CAAC,KAAK,CACX,iCAAiC,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,QAAQ,EAAE,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAExC,iCAAiC;IAEjC,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EAAE,wBAAwB;QACrC,WAAW,EAAE,mBAAmB;KACjC,EACD,wBAAwB,CAAC,SAAS,CAAC,CACpC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE,0BAA0B;KACxC,EACD,8BAA8B,CAAC,SAAS,CAAC,CAC1C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,0CAA0C;IAE1C,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE,iBAAiB;KAC/B,EACD,sBAAsB,CAAC,SAAS,CAAC,CAClC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,uBAAuB;KACrC,EACD,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,yBAAyB,CAAC,SAAS,CAAC,CACrC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,sBAAsB;KACpC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,4BAA4B;KAC1C,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,2BAA2B,EAC3B;QACE,WAAW,EAAE,kCAAkC;QAC/C,WAAW,EAAE,6BAA6B;KAC3C,EACD,gCAAgC,CAAC,SAAS,CAAC,CAC5C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE,0BAA0B;KACxC,EACD,8BAA8B,CAAC,SAAS,CAAC,CAC1C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,2BAA2B;KACzC,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,kCAAkC;IAElC,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EAAE,mBAAmB;QAChC,WAAW,EAAE,cAAc;KAC5B,EACD,mBAAmB,CAAC,SAAS,CAAC,CAC/B,CAAC;IAEF,kCAAkC;IAElC,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,uBAAuB;KACrC,EACD,2BAA2B,CAAC,MAAM,CAAC,CACpC,CAAC;IAEF,iDAAiD;IAEjD,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,kBAAkB;KAChC,EACD,sBAAsB,CAAC,MAAM,CAAC,CAC/B,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE,wBAAwB;KACtC,EACD,4BAA4B,CAAC,MAAM,CAAC,CACrC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,yBAAyB,CAAC,MAAM,CAAC,CAClC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,kBAAkB;KAChC,EACD,uBAAuB,EAAE,CAC1B,CAAC;IAEF,uCAAuC;IAEvC,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,4BAA4B;KAC1C,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,0DAA0D;IAE1D,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE,wBAAwB;KACtC,EACD,6BAA6B,CAAC,SAAS,CAAC,CACzC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,sBAAsB;KACpC,EACD,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,WAAW,EAAE,oCAAoC;QACjD,WAAW,EAAE,+BAA+B;KAC7C,EACD,mCAAmC,CAAC,SAAS,CAAC,CAC/C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,WAAW,EAAE,oCAAoC;QACjD,WAAW,EAAE,+BAA+B;KAC7C,EACD,mCAAmC,CAAC,SAAS,CAAC,CAC/C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,sBAAsB;KACpC,EACD,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,mCAAmC;IAEnC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE,iBAAiB;KAC/B,EACD,sBAAsB,CAAC,SAAS,CAAC,CAClC,CAAC;IAEF,uDAAuD;IAEvD,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,2BAA2B;KACzC,EACD,+BAA+B,EAAE,CAClC,CAAC;IAEF,2CAA2C;IAE3C,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,uBAAuB;KACrC,EACD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;IAEF,qCAAqC;IAErC,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,oBAAoB;KAClC,EACD,yBAAyB,CAAC,SAAS,CAAC,CACrC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,kBAAkB;KAChC,EACD,uBAAuB,CAAC,SAAS,CAAC,CACnC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,4BAA4B;KAC1C,EACD,gCAAgC,CAAC,SAAS,CAAC,CAC5C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAC/E,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAC3E,wBAAwB,CAAC,SAAS,CAAC,CACpC,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB,EAAE,WAAW,EAAE,2BAA2B,EAAE,WAAW,EAAE,sBAAsB,EAAE,EACjF,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB,EAAE,WAAW,EAAE,2BAA2B,EAAE,WAAW,EAAE,sBAAsB,EAAE,EACjF,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,mCAAmC;IAEnC,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,kBAAkB,EAAE,EACzE,sBAAsB,EAAE,CACzB,CAAC;IAEF,wCAAwC;IAExC,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,sBAAsB;KACpC,EACD,2BAA2B,CAAC,SAAS,EAAE,MAAM,CAAC,CAC/C,CAAC;IAEF,wCAAwC;IAExC,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,oBAAoB;KAClC,EACD,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,CAC7C,CAAC;IAEF,oDAAoD;IAEpD,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE,wBAAwB;KACtC,EACD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,uBAAuB;KACrC,EACD,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE,0BAA0B;KACxC,EACD,8BAA8B,CAAC,SAAS,CAAC,CAC1C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,2BAA2B;KACzC,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,4BAA4B;KAC1C,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE,wBAAwB;KACtC,EACD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;IAEF,kCAAkC;IAClC,qFAAqF;IACrF,0EAA0E;IAE1E,IAAI,kBAAkB,GAAmC,IAAI,CAAC;IAE9D;;;OAGG;IACH,SAAS,qBAAqB,CAC5B,OAAsG,EACtG,aAAqB,oBAAoB;QAEzC,OAAO,KAAK,EAAE,MAAS,EAAE,EAAE;YACzB,mDAAmD;YACnD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAwC,mBAAmB,CAAC,CAAC;oBAC7F,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,kBAAkB,GAAG,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,IAAI,kBAAkB,CAAC,UAAU,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC7C,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,uSAAuS;yBAC9S;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,MAAM,eAAe,GAAG;QACtB,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACnG,0BAA0B;QAC1B,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACtH,CAAC,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAC9H,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACvG,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACvH,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACtH,CAAC,2BAA2B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,iCAAiC,CAAC,SAAS,CAAC,CAAC;QAC9I,CAAC,4BAA4B,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,kCAAkC,CAAC,SAAS,CAAC,CAAC;QAClJ,CAAC,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC;QAC1H,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACtH,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC/G,oBAAoB;QACpB,CAAC,0BAA0B,EAAE,iCAAiC,EAAE,4BAA4B,EAAE,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAC1I,CAAC,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAC9H,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,SAAS,CAAC,CAAC;QAClI,CAAC,4BAA4B,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,iCAAiC,CAAC,SAAS,CAAC,CAAC;QACjJ,qBAAqB;QACrB,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACvH,CAAC,oBAAoB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACnH,CAAC,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC;QAC1H,8BAA8B;QAC9B,CAAC,6BAA6B,EAAE,oCAAoC,EAAE,+BAA+B,EAAE,kCAAkC,CAAC,SAAS,CAAC,CAAC;QACrJ,CAAC,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAC9H,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,SAAS,CAAC,CAAC;QAClI,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,SAAS,CAAC,CAAC;QAClI,CAAC,2BAA2B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,iCAAiC,CAAC,SAAS,CAAC,CAAC;QAC9I,CAAC,yBAAyB,EAAE,gCAAgC,EAAE,2BAA2B,EAAE,+BAA+B,CAAC,SAAS,CAAC,CAAC;QACtI,MAAM;QACN,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;KAC1F,CAAC;IAEX,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,eAAe,EAAE,CAAC;QACnE,MAAM,CAAC,YAAY,CACjB,IAAc,EACd,EAAE,WAAW,EAAE,WAAqB,EAAE,WAAW,EAAE,MAAa,EAAE,EAClE,qBAAqB,CAAC,OAA8G,CAAC,CACtI,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,6BAA6B;IAE7B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,qDAAqD;QACrD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;YAChF,OAAO,CAAC,KAAK,CAAC,2CAA2C,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,2EAA2E;IAC3E,wFAAwF;IAExF,IAAI,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAED,0BAA0B;IAE1B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,CACX,gBAAgB,MAAM,CAAC,UAAU,EAAE,CACpC,CAAC;IACF,OAAO,CAAC,KAAK,CACX,8BAA8B,eAAe,CAAC,MAAM,aAAa,CAClE,CAAC;AACJ,CAAC"}

package/dist/tools/check-project.d.ts

@@ -0,0 +1,32 @@
+/**
+ * zivis_check_project — Three-way org alignment check
+ *
+ * Answers: "am I safe to do tenant-scoped work in this project right now?"
+ *
+ * Verifies all three sources of truth agree on the org:
+ *   1. BINDING — .zivis/project.json's workosOrgId (what the project expects)
+ *   2. LOCAL JWT — the stored access token's org_id claim (what the token says)
+ *   3. API — GET /api/mcp/session (what the server resolves from the JWT)
+ *
+ * If any mismatch: returns isError=true with a concrete fix action.
+ * If no binding exists: isError=true (refuses to operate without cross-org safety).
+ */
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+import type { ZivisConfig } from "../types.js";
+export declare const CHECK_PROJECT_NAME = "zivis_check_project";
+export declare const CHECK_PROJECT_DESCRIPTION = "Pre-flight: verify the project, the stored JWT, and the API ALL agree on the org.\n\nThis is a defense-in-depth check that must pass before any tenant-scoped MCP\noperation (triage, create scan, manage threat model, etc.). It compares three\nindependent sources of truth:\n\n  1. Project binding (.zivis/project.json workosOrgId)\n  2. Local JWT org_id claim\n  3. API's resolved org (round-trip to /api/mcp/session)\n\nReturns isError=true on ANY mismatch or missing binding. Call this at the\nstart of any workflow where polluting another tenant with data would be bad.\n\nSet local_only=true to skip the API round-trip (faster, but weaker guarantee).";
+export declare const CHECK_PROJECT_SCHEMA: {
+    cwd: z.ZodOptional<z.ZodString>;
+    local_only: z.ZodOptional<z.ZodBoolean>;
+};
+export declare function createCheckProjectHandler(apiClient: ApiClient, config: ZivisConfig): (params: {
+    cwd?: string;
+    local_only?: boolean;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+}>;