@zivis/mcp 0.1.0-alpha.21 → 0.1.0-alpha.22

package/dist/tools/security-review.js

@@ -138,61 +138,78 @@ export function createSecurityReviewHandler(apiClient, config) {
                 errors.push(`Open findings: ${err instanceof Error ? err.message : "failed"}`);
             }
         }
-        // ── 3. Threat model: security controls ──
-        if (shouldInclude("controls") && threat_model_id) {
+        // ── 3 & 4. Threat model: security controls + attack scenarios ──
+        // Sub-entities (controls, scenarios, actors, components, etc.) live on the
+        // latest ThreatModelVersion, not on the root threat model. Fetch once and
+        // reuse for both sections.
+        if ((shouldInclude("controls") || shouldInclude("attack_scenarios")) && threat_model_id) {
+            let tm = null;
             try {
-                const tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
-                const controls = tm.securityControls || [];
-                const notImplemented = controls.filter((c) => c.status === "not_implemented");
-                const partial = controls.filter((c) => c.status === "partial");
-                const implemented = controls.filter((c) => c.status === "implemented");
-                context.securityControls = {
-                    _instruction: "Verify that code implements these expected security controls. Flag missing or weak implementations.",
-                    summary: {
-                        implemented: implemented.length,
-                        partial: partial.length,
-                        notImplemented: notImplemented.length,
-                    },
-                    gapControls: [...notImplemented, ...partial].map((c) => ({
-                        name: c.name,
-                        type: c.controlType,
-                        status: c.status,
-                        description: c.description,
-                        effectiveness: c.effectivenessRating,
-                    })),
-                    implementedControls: implemented.map((c) => ({
-                        name: c.name,
-                        type: c.controlType,
-                        description: c.description,
-                    })),
-                };
+                tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
             }
             catch (err) {
-                errors.push(`Security controls: ${err instanceof Error ? err.message : "failed"}`);
+                errors.push(`Threat model fetch: ${err instanceof Error ? err.message : "failed"}`);
             }
-        }
-        // ── 4. Threat model: attack scenarios ──
-        if (shouldInclude("attack_scenarios") && threat_model_id) {
-            try {
-                const tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
-                const scenarios = tm.attackScenarios || [];
-                const minSeverity = SEVERITY_ORDER[severity_threshold] || 2;
-                const filtered = scenarios.filter((s) => (SEVERITY_ORDER[s.severity] || 1) >= minSeverity);
-                context.attackScenarios = {
-                    _instruction: "Review code for susceptibility to these known attack vectors. Check that mitigations are in place.",
-                    count: filtered.length,
-                    scenarios: filtered.map((s) => ({
-                        name: s.name,
-                        strideCategory: s.strideCategory,
-                        severity: s.severity,
-                        likelihood: s.likelihood,
-                        attackVector: s.attackVector,
-                        description: s.description,
-                    })),
-                };
+            const versions = Array.isArray(tm?.versions) ? tm.versions : [];
+            const latestVersion = versions[0] || {};
+            if (tm && shouldInclude("controls")) {
+                try {
+                    const controls = Array.isArray(latestVersion.securityControls)
+                        ? latestVersion.securityControls
+                        : [];
+                    const notImplemented = controls.filter((c) => c.status === "not_implemented");
+                    const partial = controls.filter((c) => c.status === "partial");
+                    const implemented = controls.filter((c) => c.status === "implemented");
+                    context.securityControls = {
+                        _instruction: "Verify that code implements these expected security controls. Flag missing or weak implementations.",
+                        summary: {
+                            implemented: implemented.length,
+                            partial: partial.length,
+                            notImplemented: notImplemented.length,
+                        },
+                        gapControls: [...notImplemented, ...partial].map((c) => ({
+                            name: c.name,
+                            type: c.controlType,
+                            status: c.status,
+                            description: c.description,
+                            effectiveness: c.effectivenessRating,
+                        })),
+                        implementedControls: implemented.map((c) => ({
+                            name: c.name,
+                            type: c.controlType,
+                            description: c.description,
+                        })),
+                    };
+                }
+                catch (err) {
+                    errors.push(`Security controls: ${err instanceof Error ? err.message : "failed"}`);
+                }
             }
-            catch (err) {
-                errors.push(`Attack scenarios: ${err instanceof Error ? err.message : "failed"}`);
+            if (tm && shouldInclude("attack_scenarios")) {
+                try {
+                    const scenarios = Array.isArray(latestVersion.attackScenarios)
+                        ? latestVersion.attackScenarios
+                        : [];
+                    const minSeverity = SEVERITY_ORDER[severity_threshold] || 2;
+                    const filtered = scenarios.filter((s) => (SEVERITY_ORDER[s.severity] || 1) >= minSeverity);
+                    context.attackScenarios = {
+                        _instruction: "Review code for susceptibility to these known attack vectors. Check that mitigations are in place.",
+                        count: filtered.length,
+                        scenarios: filtered.map((s) => ({
+                            displayId: s.displayId,
+                            title: s.title,
+                            strideCategory: s.strideCategory,
+                            severity: s.severity,
+                            likelihood: s.likelihood,
+                            riskScore: s.riskScore,
+                            status: s.status,
+                            narrative: s.narrative,
+                        })),
+                    };
+                }
+                catch (err) {
+                    errors.push(`Attack scenarios: ${err instanceof Error ? err.message : "failed"}`);
+                }
             }
         }
         // ── 5. Dependency trust scores ──

package/dist/tools/security-review.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-review.js","sourceRoot":"","sources":["../../src/tools/security-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;gFAgBqC,CAAC;AAEjF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IACxG,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yHAAyH,CAC1H;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IACrH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;IAC/F,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;SACpF,QAAQ,EAAE;SACV,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,kBAAkB,EAAE,CAAC;SAClB,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;SACnD,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,mEAAmE,CAAC;IAChF,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,SAAoB,EAAE,MAAmB;IACnF,OAAO,KAAK,EAAE,MASb,EAAE,EAAE;QACH,MAAM,EACJ,IAAI,EACJ,cAAc,EAAE,mBAAmB,EACnC,eAAe,EACf,WAAW,EACX,WAAW,GAAG,CAAC,KAAK,CAAC,EACrB,kBAAkB,GAAG,KAAK,EAC1B,gBAAgB,GAAG,IAAI,EACvB,eAAe,GAChB,GAAG,MAAM,CAAC;QAEX,MAAM,cAAc,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EACF,wFAAwF;4BACxF,qEAAqE;qBACxE,CAAC;gBACF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,OAAO,GAA4B;YACvC,YAAY,EAAE,0EAA0E;YACxF,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE;SACnE,CAAC;QAEF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,kDAAkD;QAClD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACtD,IAAI;oBACJ,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,MAAM,iBAAiB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACvD,IAAI;oBACJ,MAAM,EAAE,gBAAgB;oBACxB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,mDAAmD;gBACnD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;gBAErE,OAAO,CAAC,eAAe,GAAG;oBACxB,YAAY,EAAE,qGAAqG;oBACnH,aAAa,EAAE,gBAAgB,CAAC,MAAM;oBACtC,QAAQ,EAAE,kBAAkB;oBAC5B,aAAa,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAClE,cAAc,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACpE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBAClD,IAAI;oBACJ,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,+BAA+B;gBAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAClC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,mBAAmB,GAAG;oBAC5B,YAAY,EAAE,mGAAmG;oBACjH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,eAAe,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAC5B,sBAAsB,eAAe,cAAc,CACpD,CAAC;gBAEF,MAAM,QAAQ,GAAI,EAAU,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBACpD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;gBACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;gBAE5E,OAAO,CAAC,gBAAgB,GAAG;oBACzB,YAAY,EAAE,qGAAqG;oBACnH,OAAO,EAAE;wBACP,WAAW,EAAE,WAAW,CAAC,MAAM;wBAC/B,OAAO,EAAE,OAAO,CAAC,MAAM;wBACvB,cAAc,EAAE,cAAc,CAAC,MAAM;qBACtC;oBACD,WAAW,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBAC5D,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,WAAW;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,aAAa,EAAE,CAAC,CAAC,mBAAmB;qBACrC,CAAC,CAAC;oBACH,mBAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBAChD,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,WAAW;wBACnB,WAAW,EAAE,CAAC,CAAC,WAAW;qBAC3B,CAAC,CAAC;iBACJ,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,aAAa,CAAC,kBAAkB,CAAC,IAAI,eAAe,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAC5B,sBAAsB,eAAe,cAAc,CACpD,CAAC;gBAEF,MAAM,SAAS,GAAI,EAAU,CAAC,eAAe,IAAI,EAAE,CAAC;gBACpD,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,eAAe,GAAG;oBACxB,YAAY,EAAE,oGAAoG;oBAClH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBACnC,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,cAAc,EAAE,CAAC,CAAC,cAAc;wBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;wBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,YAAY,EAAE,CAAC,CAAC,YAAY;wBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;qBAC3B,CAAC,CAAC;iBACJ,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,aAAa,CAAC,cAAc,CAAC,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,UAAU,GAA8B,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;wBACxD,SAAS;oBACX,CAAC;oBAED,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,OAAO,wBAAwB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAChE,CAAC;oBAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;wBACX,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;wBAC/B,UAAU,CAAC,IAAI,CAAC;4BACd,IAAI,EAAE,GAAG;4BACT,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,QAAQ,EAAE;gCACR,QAAQ,EAAE,KAAK,CAAC,gBAAgB,IAAI,CAAC;gCACrC,IAAI,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC;gCAC7B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC;gCACjC,GAAG,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;6BAC5B;4BACD,WAAW,EAAE,KAAK,CAAC,aAAa;yBACjC,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,GAAG,EAAE,CACtD,CAAC;YAEF,OAAO,CAAC,eAAe,GAAG;gBACxB,YAAY,EAAE,qGAAqG;gBACnH,OAAO,EAAE,UAAU,CAAC,MAAM;gBAC1B,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,YAAY,EAAE,UAAU;aACzB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,GAAG,CAC1C,kBAAkB,WAAW,oBAAoB,CAClD,CAAC;gBAEF,MAAM,QAAQ,GAAI,gBAAwB,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,gBAAgB,GAAG;oBACzB,YAAY,EAAE,2GAA2G;oBACzH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;QAC5B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;iBACzD,CAAC;SACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAEhB,KAAK,UAAU,aAAa,CAC1B,SAAoB,EACpB,MAA0D;IAE1D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,yBAAyB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAA0C,IAAI,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAM;IAC9B,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7C,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAe;IACtC,MAAM,MAAM,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,gBAAuB;IACtD,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkF,CAAC;IAE7G,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,eAAe,KAAK,CAAC,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;SACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,KAAK;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM;QAClB,MAAM,EAAE,oBAAoB,CAAC,CAAC,KAAK,6CAA6C;KACjF,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,OAAO,CAAC,eAAsB,CAAC;IAClD,IAAI,UAAU,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CACX,eAAe,UAAU,CAAC,aAAa,4CAA4C,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,sBAAsB,CAC1I,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,mBAA0B,CAAC;IAChD,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,KAAK,2BAA2B,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,4CAA4C,CACvK,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAuB,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CACX,iBAAiB,IAAI,iFAAiF,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC/C,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,mBAAmB,OAAO,CAAC,KAAK,6DAA6D,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC5C,IAAI,IAAI,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,UAAU,6DAA6D,CAC5F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,yEAAyE,CAC1E,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"security-review.js","sourceRoot":"","sources":["../../src/tools/security-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;gFAgBqC,CAAC;AAEjF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IACxG,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yHAAyH,CAC1H;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IACrH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;IAC/F,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;SACpF,QAAQ,EAAE;SACV,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,kBAAkB,EAAE,CAAC;SAClB,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;SACnD,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,mEAAmE,CAAC;IAChF,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,SAAoB,EAAE,MAAmB;IACnF,OAAO,KAAK,EAAE,MASb,EAAE,EAAE;QACH,MAAM,EACJ,IAAI,EACJ,cAAc,EAAE,mBAAmB,EACnC,eAAe,EACf,WAAW,EACX,WAAW,GAAG,CAAC,KAAK,CAAC,EACrB,kBAAkB,GAAG,KAAK,EAC1B,gBAAgB,GAAG,IAAI,EACvB,eAAe,GAChB,GAAG,MAAM,CAAC;QAEX,MAAM,cAAc,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EACF,wFAAwF;4BACxF,qEAAqE;qBACxE,CAAC;gBACF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,OAAO,GAA4B;YACvC,YAAY,EAAE,0EAA0E;YACxF,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE;SACnE,CAAC;QAEF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,kDAAkD;QAClD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACtD,IAAI;oBACJ,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,MAAM,iBAAiB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACvD,IAAI;oBACJ,MAAM,EAAE,gBAAgB;oBACxB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,mDAAmD;gBACnD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;gBAErE,OAAO,CAAC,eAAe,GAAG;oBACxB,YAAY,EAAE,qGAAqG;oBACnH,aAAa,EAAE,gBAAgB,CAAC,MAAM;oBACtC,QAAQ,EAAE,kBAAkB;oBAC5B,aAAa,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAClE,cAAc,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACpE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBAClD,IAAI;oBACJ,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,+BAA+B;gBAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAClC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,mBAAmB,GAAG;oBAC5B,YAAY,EAAE,mGAAmG;oBACjH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,2BAA2B;QAC3B,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;YACxF,IAAI,EAAE,GAAmC,IAAI,CAAC;YAC9C,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CACtB,sBAAsB,eAAe,cAAc,CACpD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtF,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAE,EAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAE,EAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAExC,IAAI,EAAE,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAU,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC;wBACnE,CAAC,CAAC,aAAa,CAAC,gBAAgB;wBAChC,CAAC,CAAC,EAAE,CAAC;oBACP,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC;oBACnF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;oBACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;oBAE5E,OAAO,CAAC,gBAAgB,GAAG;wBACzB,YAAY,EAAE,qGAAqG;wBACnH,OAAO,EAAE;4BACP,WAAW,EAAE,WAAW,CAAC,MAAM;4BAC/B,OAAO,EAAE,OAAO,CAAC,MAAM;4BACvB,cAAc,EAAE,cAAc,CAAC,MAAM;yBACtC;wBACD,WAAW,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;4BAC5D,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,IAAI,EAAE,CAAC,CAAC,WAAW;4BACnB,MAAM,EAAE,CAAC,CAAC,MAAM;4BAChB,WAAW,EAAE,CAAC,CAAC,WAAW;4BAC1B,aAAa,EAAE,CAAC,CAAC,mBAAmB;yBACrC,CAAC,CAAC;wBACH,mBAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;4BAChD,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,IAAI,EAAE,CAAC,CAAC,WAAW;4BACnB,WAAW,EAAE,CAAC,CAAC,WAAW;yBAC3B,CAAC,CAAC;qBACJ,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YAED,IAAI,EAAE,IAAI,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,MAAM,SAAS,GAAU,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC;wBACnE,CAAC,CAAC,aAAa,CAAC,eAAe;wBAC/B,CAAC,CAAC,EAAE,CAAC;oBACP,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;oBAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;oBAEF,OAAO,CAAC,eAAe,GAAG;wBACxB,YAAY,EAAE,oGAAoG;wBAClH,KAAK,EAAE,QAAQ,CAAC,MAAM;wBACtB,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;4BACnC,SAAS,EAAE,CAAC,CAAC,SAAS;4BACtB,KAAK,EAAE,CAAC,CAAC,KAAK;4BACd,cAAc,EAAE,CAAC,CAAC,cAAc;4BAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;4BACpB,UAAU,EAAE,CAAC,CAAC,UAAU;4BACxB,SAAS,EAAE,CAAC,CAAC,SAAS;4BACtB,MAAM,EAAE,CAAC,CAAC,MAAM;4BAChB,SAAS,EAAE,CAAC,CAAC,SAAS;yBACvB,CAAC,CAAC;qBACJ,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,aAAa,CAAC,cAAc,CAAC,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,UAAU,GAA8B,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;wBACxD,SAAS;oBACX,CAAC;oBAED,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,OAAO,wBAAwB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAChE,CAAC;oBAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;wBACX,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;wBAC/B,UAAU,CAAC,IAAI,CAAC;4BACd,IAAI,EAAE,GAAG;4BACT,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,QAAQ,EAAE;gCACR,QAAQ,EAAE,KAAK,CAAC,gBAAgB,IAAI,CAAC;gCACrC,IAAI,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC;gCAC7B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC;gCACjC,GAAG,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;6BAC5B;4BACD,WAAW,EAAE,KAAK,CAAC,aAAa;yBACjC,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,GAAG,EAAE,CACtD,CAAC;YAEF,OAAO,CAAC,eAAe,GAAG;gBACxB,YAAY,EAAE,qGAAqG;gBACnH,OAAO,EAAE,UAAU,CAAC,MAAM;gBAC1B,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,YAAY,EAAE,UAAU;aACzB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,GAAG,CAC1C,kBAAkB,WAAW,oBAAoB,CAClD,CAAC;gBAEF,MAAM,QAAQ,GAAI,gBAAwB,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,gBAAgB,GAAG;oBACzB,YAAY,EAAE,2GAA2G;oBACzH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;QAC5B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;iBACzD,CAAC;SACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAEhB,KAAK,UAAU,aAAa,CAC1B,SAAoB,EACpB,MAA0D;IAE1D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,yBAAyB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAA0C,IAAI,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAM;IAC9B,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7C,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAe;IACtC,MAAM,MAAM,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,gBAAuB;IACtD,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkF,CAAC;IAE7G,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,eAAe,KAAK,CAAC,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;SACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,KAAK;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM;QAClB,MAAM,EAAE,oBAAoB,CAAC,CAAC,KAAK,6CAA6C;KACjF,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,OAAO,CAAC,eAAsB,CAAC;IAClD,IAAI,UAAU,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CACX,eAAe,UAAU,CAAC,aAAa,4CAA4C,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,sBAAsB,CAC1I,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,mBAA0B,CAAC;IAChD,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,KAAK,2BAA2B,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,4CAA4C,CACvK,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAuB,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CACX,iBAAiB,IAAI,iFAAiF,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC/C,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,mBAAmB,OAAO,CAAC,KAAK,6DAA6D,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC5C,IAAI,IAAI,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,UAAU,6DAA6D,CAC5F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,yEAAyE,CAC1E,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/threat-get-capsule.d.ts

@@ -0,0 +1,25 @@
+/**
+ * zivis_threat_get_capsule — return the full capsule for a pattern id.
+ *
+ * After the LLM has surfaced relevant capsules via zivis_threat_list_relevant_capsules,
+ * this tool returns the full capsule JSON: safe_summary, threats with STRIDE,
+ * risk_hints, architectural_signals, repair_contract, related_patterns, and the
+ * model_task_prompt_ref pointing to the inference prompt template.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 2A)
+ */
+import { z } from "zod";
+export declare const THREAT_GET_CAPSULE_NAME = "zivis_threat_get_capsule";
+export declare const THREAT_GET_CAPSULE_DESCRIPTION = "Return the full capsule for a single threat-model pattern.\n\nUse after zivis_threat_list_relevant_capsules has surfaced an id the user wants to dig into. The capsule includes:\n- safe_summary, detect_when, risk_hints, architectural_signals \u2014 for explaining the pattern in threat-model language\n- threats[] with STRIDE categories and remediations \u2014 for grounding the conversation in component/flow/boundary terms\n- repair_contract.allowed / forbidden \u2014 what refactors are safe\n- related_patterns \u2014 adjacent ids in the library\n- model_task_prompt_ref \u2014 pass to zivis_threat_get_inference_prompt to get the prompt the host LLM should run for a deeper check\n\nCapsule data is read from the local pack (~/Library/Caches/zivis/pattern-packs/) with SHA256 integrity verification on every read.";
+export declare const THREAT_GET_CAPSULE_SCHEMA: {
+    capsule_id: z.ZodString;
+};
+export declare function createThreatGetCapsuleHandler(): (params: {
+    capsule_id: string;
+}) => Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;

package/dist/tools/threat-get-capsule.js

@@ -0,0 +1,64 @@
+/**
+ * zivis_threat_get_capsule — return the full capsule for a pattern id.
+ *
+ * After the LLM has surfaced relevant capsules via zivis_threat_list_relevant_capsules,
+ * this tool returns the full capsule JSON: safe_summary, threats with STRIDE,
+ * risk_hints, architectural_signals, repair_contract, related_patterns, and the
+ * model_task_prompt_ref pointing to the inference prompt template.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 2A)
+ */
+import { z } from "zod";
+import { loadActivePack, getCapsule, listCapsuleIds } from "../pattern-pack/index.js";
+import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
+export const THREAT_GET_CAPSULE_NAME = "zivis_threat_get_capsule";
+export const THREAT_GET_CAPSULE_DESCRIPTION = `Return the full capsule for a single threat-model pattern.
+
+Use after zivis_threat_list_relevant_capsules has surfaced an id the user wants to dig into. The capsule includes:
+- safe_summary, detect_when, risk_hints, architectural_signals — for explaining the pattern in threat-model language
+- threats[] with STRIDE categories and remediations — for grounding the conversation in component/flow/boundary terms
+- repair_contract.allowed / forbidden — what refactors are safe
+- related_patterns — adjacent ids in the library
+- model_task_prompt_ref — pass to zivis_threat_get_inference_prompt to get the prompt the host LLM should run for a deeper check
+
+Capsule data is read from the local pack (~/Library/Caches/zivis/pattern-packs/) with SHA256 integrity verification on every read.`;
+export const THREAT_GET_CAPSULE_SCHEMA = {
+    capsule_id: z
+        .string()
+        .describe("Capsule id, e.g. 'agents.privilege-separation'. Discoverable via zivis_threat_list_relevant_capsules."),
+};
+export function createThreatGetCapsuleHandler() {
+    return async (params) => {
+        const handle = await loadActivePack();
+        let capsule;
+        try {
+            capsule = await getCapsule(handle, params.capsule_id);
+        }
+        catch (err) {
+            const ids = await listCapsuleIds(handle);
+            return withNextStepsError(`Capsule '${params.capsule_id}' not found in pack ${handle.manifest.pack_id}@${handle.manifest.version}. ${err.message}`, [
+                {
+                    id: "list_relevant_capsules_first",
+                    label: "Find relevant capsules for the current repo first",
+                    tool: "zivis_threat_list_relevant_capsules",
+                    why: "Returns ids you can pass back into zivis_threat_get_capsule.",
+                },
+            ], `Available capsule ids in this pack: ${ids.join(", ")}`);
+        }
+        return withNextSteps({
+            pack: { id: handle.manifest.pack_id, version: handle.manifest.version },
+            capsule,
+        }, capsule.model_task_prompt_ref
+            ? [
+                {
+                    id: "get_inference_prompt",
+                    label: "Get the inference prompt template the host LLM should run",
+                    tool: "zivis_threat_get_inference_prompt",
+                    args_hint: { capsule_id: capsule.id },
+                    why: "Inference prompt + expected_output_schema together form the prompt bundle the IDE LLM executes.",
+                },
+            ]
+            : [], `Capsule ${capsule.id}@${capsule.version} (${capsule.lifecycle}, ${capsule.sensitivity_level ?? "unspecified-tier"}). Threats: ${(capsule.threats?.length ?? 0)}.`);
+    };
+}
+//# sourceMappingURL=threat-get-capsule.js.map

package/dist/tools/threat-get-capsule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-get-capsule.js","sourceRoot":"","sources":["../../src/tools/threat-get-capsule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;;;;;mIASqF,CAAC;AAEpI,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,CACP,uGAAuG,CACxG;CACJ,CAAC;AAEF,MAAM,UAAU,6BAA6B;IAC3C,OAAO,KAAK,EAAE,MAA8B,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;QAEtC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,kBAAkB,CACvB,YAAY,MAAM,CAAC,UAAU,uBAAuB,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,EACnI;gBACE;oBACE,EAAE,EAAE,8BAA8B;oBAClC,KAAK,EAAE,mDAAmD;oBAC1D,IAAI,EAAE,qCAAqC;oBAC3C,GAAG,EAAE,8DAA8D;iBACpE;aACF,EACD,uCAAuC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC;QACJ,CAAC;QAED,OAAO,aAAa,CAClB;YACE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE;YACvE,OAAO;SACR,EACD,OAAO,CAAC,qBAAqB;YAC3B,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,sBAAsB;oBAC1B,KAAK,EAAE,2DAA2D;oBAClE,IAAI,EAAE,mCAAmC;oBACzC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;oBACrC,GAAG,EAAE,iGAAiG;iBACvG;aACF;YACH,CAAC,CAAC,EAAE,EACN,WAAW,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,iBAAiB,IAAI,kBAAkB,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CACnK,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/threat-get-inference-prompt.d.ts

@@ -0,0 +1,32 @@
+/**
+ * zivis_threat_get_inference_prompt — return the prompt bundle for a capsule's
+ * INFER strategy so the host LLM can run local inference.
+ *
+ * MCP servers cannot invoke the customer's LLM. The host (Cursor, Claude Code)
+ * runs the model. This tool returns:
+ *   - the prompt template (markdown)
+ *   - the capsule's expected_output_schema
+ *   - the capsule's safe_summary as ambient context
+ *   - guidance on which evidence spans the host should attach
+ *
+ * The host LLM consumes the bundle, gathers code spans per minimum_context_required,
+ * runs the inference, and returns structured JSON. That JSON enters the
+ * `inferred` lane until promoted to `trusted` per the platform's promotion policy.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 2A)
+ */
+import { z } from "zod";
+export declare const THREAT_GET_INFERENCE_PROMPT_NAME = "zivis_threat_get_inference_prompt";
+export declare const THREAT_GET_INFERENCE_PROMPT_DESCRIPTION = "Return the prompt bundle for the host LLM to run local inference for a capsule.\n\nZIVIS doesn't run an LLM itself \u2014 the host (Cursor, Claude Code, etc.) does. This tool returns the prompt template + structured output schema + ambient capsule context so the host model can run the inference and produce JSON the inferred lane accepts.\n\nUse this when:\n- After zivis_threat_get_capsule, the user wants the host LLM to actually evaluate whether the pattern is present in the code\n- The user says \"go check if my code does this\" / \"is this pattern actually in my repo\"\n- The matcher emits an INFER candidate that needs host-LLM evaluation\n\nThe bundle includes:\n- prompt: the markdown inference prompt\n- expected_output_schema: JSON Schema for the structured response\n- safe_summary: ambient capsule context\n- minimum_context_required: hint to the host for how much code to attach\n- evidence_focus: spans the deterministic strategies already flagged\n\nThe host LLM is expected to gather the indicated code spans, fill in the prompt, return JSON matching the schema. That output then flows back into the inferred lane.";
+export declare const THREAT_GET_INFERENCE_PROMPT_SCHEMA: {
+    capsule_id: z.ZodString;
+};
+export declare function createThreatGetInferencePromptHandler(): (params: {
+    capsule_id: string;
+}) => Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;

package/dist/tools/threat-get-inference-prompt.js

@@ -0,0 +1,91 @@
+/**
+ * zivis_threat_get_inference_prompt — return the prompt bundle for a capsule's
+ * INFER strategy so the host LLM can run local inference.
+ *
+ * MCP servers cannot invoke the customer's LLM. The host (Cursor, Claude Code)
+ * runs the model. This tool returns:
+ *   - the prompt template (markdown)
+ *   - the capsule's expected_output_schema
+ *   - the capsule's safe_summary as ambient context
+ *   - guidance on which evidence spans the host should attach
+ *
+ * The host LLM consumes the bundle, gathers code spans per minimum_context_required,
+ * runs the inference, and returns structured JSON. That JSON enters the
+ * `inferred` lane until promoted to `trusted` per the platform's promotion policy.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 2A)
+ */
+import { z } from "zod";
+import { loadActivePack, getCapsule, getInferencePrompt } from "../pattern-pack/index.js";
+import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
+export const THREAT_GET_INFERENCE_PROMPT_NAME = "zivis_threat_get_inference_prompt";
+export const THREAT_GET_INFERENCE_PROMPT_DESCRIPTION = `Return the prompt bundle for the host LLM to run local inference for a capsule.
+
+ZIVIS doesn't run an LLM itself — the host (Cursor, Claude Code, etc.) does. This tool returns the prompt template + structured output schema + ambient capsule context so the host model can run the inference and produce JSON the inferred lane accepts.
+
+Use this when:
+- After zivis_threat_get_capsule, the user wants the host LLM to actually evaluate whether the pattern is present in the code
+- The user says "go check if my code does this" / "is this pattern actually in my repo"
+- The matcher emits an INFER candidate that needs host-LLM evaluation
+
+The bundle includes:
+- prompt: the markdown inference prompt
+- expected_output_schema: JSON Schema for the structured response
+- safe_summary: ambient capsule context
+- minimum_context_required: hint to the host for how much code to attach
+- evidence_focus: spans the deterministic strategies already flagged
+
+The host LLM is expected to gather the indicated code spans, fill in the prompt, return JSON matching the schema. That output then flows back into the inferred lane.`;
+export const THREAT_GET_INFERENCE_PROMPT_SCHEMA = {
+    capsule_id: z
+        .string()
+        .describe("Capsule id whose INFER prompt should be returned (e.g. 'agents.privilege-separation')."),
+};
+export function createThreatGetInferencePromptHandler() {
+    return async (params) => {
+        const handle = await loadActivePack();
+        let capsule;
+        try {
+            capsule = await getCapsule(handle, params.capsule_id);
+        }
+        catch (err) {
+            return withNextStepsError(`Capsule '${params.capsule_id}' not found. ${err.message}`, [
+                {
+                    id: "list_relevant_capsules_first",
+                    label: "List relevant capsules for the current repo first",
+                    tool: "zivis_threat_list_relevant_capsules",
+                    why: "Returns ids you can pass back here.",
+                },
+            ], "Capsule not found — list first to discover ids.");
+        }
+        if (!capsule.model_task_prompt_ref) {
+            return withNextStepsError(`Capsule '${capsule.id}' has no inference prompt defined (model_task_prompt_ref missing). This capsule is deterministic-only.`, [
+                {
+                    id: "get_capsule",
+                    label: "Read the full capsule to see its deterministic strategies",
+                    tool: "zivis_threat_get_capsule",
+                    args_hint: { capsule_id: capsule.id },
+                    why: "Some capsules have no INFER strategy — only AST/GRAPH/META/etc. that the matcher runs locally.",
+                },
+            ], "No inference prompt for this capsule (deterministic only).");
+        }
+        const promptText = await getInferencePrompt(handle, capsule.model_task_prompt_ref);
+        return withNextSteps({
+            pack: { id: handle.manifest.pack_id, version: handle.manifest.version },
+            capsule_id: capsule.id,
+            prompt: promptText,
+            expected_output_schema: capsule.expected_output_schema ?? null,
+            safe_summary: capsule.safe_summary ?? null,
+            minimum_context_required: capsule.minimum_context_required ?? null,
+            host_instructions: "Gather the code spans indicated by minimum_context_required.symbols (or any deterministic match spans the matcher already flagged), attach them to the prompt above, run inference with your model, and return JSON matching expected_output_schema. The structured output flows back into the inferred lane.",
+        }, [
+            {
+                id: "host_runs_inference",
+                label: "Host LLM runs inference now (no further tool call)",
+                tool: "zivis_threat_get_inference_prompt",
+                why: "MCP cannot invoke your model. The host orchestrates the inference using this bundle.",
+            },
+        ], `Prompt bundle ready for host-side inference of ${capsule.id}.`);
+    };
+}
+//# sourceMappingURL=threat-get-inference-prompt.js.map

package/dist/tools/threat-get-inference-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-get-inference-prompt.js","sourceRoot":"","sources":["../../src/tools/threat-get-inference-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEzE,MAAM,CAAC,MAAM,gCAAgC,GAAG,mCAAmC,CAAC;AAEpF,MAAM,CAAC,MAAM,uCAAuC,GAAG;;;;;;;;;;;;;;;;sKAgB+G,CAAC;AAEvK,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,CAAC,wFAAwF,CAAC;CACtG,CAAC;AAEF,MAAM,UAAU,qCAAqC;IACnD,OAAO,KAAK,EAAE,MAA8B,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;QAEtC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,kBAAkB,CACvB,YAAY,MAAM,CAAC,UAAU,gBAAiB,GAAa,CAAC,OAAO,EAAE,EACrE;gBACE;oBACE,EAAE,EAAE,8BAA8B;oBAClC,KAAK,EAAE,mDAAmD;oBAC1D,IAAI,EAAE,qCAAqC;oBAC3C,GAAG,EAAE,qCAAqC;iBAC3C;aACF,EACD,iDAAiD,CAClD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;YACnC,OAAO,kBAAkB,CACvB,YAAY,OAAO,CAAC,EAAE,wGAAwG,EAC9H;gBACE;oBACE,EAAE,EAAE,aAAa;oBACjB,KAAK,EAAE,2DAA2D;oBAClE,IAAI,EAAE,0BAA0B;oBAChC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;oBACrC,GAAG,EAAE,gGAAgG;iBACtG;aACF,EACD,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAEnF,OAAO,aAAa,CAClB;YACE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE;YACvE,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,MAAM,EAAE,UAAU;YAClB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,IAAI,IAAI;YAC9D,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,IAAI,IAAI;YAClE,iBAAiB,EACf,+SAA+S;SAClT,EACD;YACE;gBACE,EAAE,EAAE,qBAAqB;gBACzB,KAAK,EAAE,oDAAoD;gBAC3D,IAAI,EAAE,mCAAmC;gBACzC,GAAG,EAAE,sFAAsF;aAC5F;SACF,EACD,kDAAkD,OAAO,CAAC,EAAE,GAAG,CAChE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/threat-list-relevant-capsules.d.ts

@@ -0,0 +1,30 @@
+/**
+ * zivis_threat_list_relevant_capsules — surface threat-model patterns
+ * relevant to the user's current repo, mid-IDE-conversation.
+ *
+ * Reads the latest RepoGraphArtifactV1 from the user cache, evaluates
+ * every capsule's relevance_filter against it, and returns the matching
+ * capsules with their safe_summary so the host LLM can frame the
+ * conversation in threat-model terms.
+ *
+ * Tier 1 / public pack only. Proprietary patterns are evaluated platform-side.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 2A)
+ */
+import { z } from "zod";
+export declare const THREAT_LIST_RELEVANT_CAPSULES_NAME = "zivis_threat_list_relevant_capsules";
+export declare const THREAT_LIST_RELEVANT_CAPSULES_DESCRIPTION = "List threat-model patterns relevant to the user's current repo.\n\nUse this when the user asks any of:\n- \"what should I be worried about in this code\"\n- \"what threats apply to my app\"\n- \"are there known patterns that match my architecture\"\n- \"what's in my threat model\"\n- mid-conversation when the user describes a feature that touches deps the threat library covers\n\nReads the latest local repo graph artifact (produced by 'zivis inspect') from the user cache, runs every capsule's relevance_filter against it, and returns the subset whose filter passes \u2014 together with each capsule's safe_summary so you can frame the conversation in threat-model terms (component, flow, trust boundary, scenario).\n\nIf no graph artifact exists yet for this repo, the tool returns a next-step pointing to 'zivis inspect'. Always speak in threat-model vocabulary even when the user doesn't.";
+export declare const THREAT_LIST_RELEVANT_CAPSULES_SCHEMA: {
+    artifact_path: z.ZodOptional<z.ZodString>;
+    cwd: z.ZodOptional<z.ZodString>;
+};
+export declare function createThreatListRelevantCapsulesHandler(): (params: {
+    artifact_path?: string;
+    cwd?: string;
+}) => Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;

package/dist/tools/threat-list-relevant-capsules.js

@@ -0,0 +1,176 @@
+/**
+ * zivis_threat_list_relevant_capsules — surface threat-model patterns
+ * relevant to the user's current repo, mid-IDE-conversation.
+ *
+ * Reads the latest RepoGraphArtifactV1 from the user cache, evaluates
+ * every capsule's relevance_filter against it, and returns the matching
+ * capsules with their safe_summary so the host LLM can frame the
+ * conversation in threat-model terms.
+ *
+ * Tier 1 / public pack only. Proprietary patterns are evaluated platform-side.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 2A)
+ */
+import { z } from "zod";
+import * as fs from "node:fs/promises";
+import * as fssync from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { loadActivePack, findRelevantCapsules, } from "../pattern-pack/index.js";
+import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
+export const THREAT_LIST_RELEVANT_CAPSULES_NAME = "zivis_threat_list_relevant_capsules";
+export const THREAT_LIST_RELEVANT_CAPSULES_DESCRIPTION = `List threat-model patterns relevant to the user's current repo.
+
+Use this when the user asks any of:
+- "what should I be worried about in this code"
+- "what threats apply to my app"
+- "are there known patterns that match my architecture"
+- "what's in my threat model"
+- mid-conversation when the user describes a feature that touches deps the threat library covers
+
+Reads the latest local repo graph artifact (produced by 'zivis inspect') from the user cache, runs every capsule's relevance_filter against it, and returns the subset whose filter passes — together with each capsule's safe_summary so you can frame the conversation in threat-model terms (component, flow, trust boundary, scenario).
+
+If no graph artifact exists yet for this repo, the tool returns a next-step pointing to 'zivis inspect'. Always speak in threat-model vocabulary even when the user doesn't.`;
+export const THREAT_LIST_RELEVANT_CAPSULES_SCHEMA = {
+    artifact_path: z
+        .string()
+        .optional()
+        .describe("Optional path to a specific RepoGraphArtifactV1 JSON. If omitted, the tool finds the most recent artifact in ~/Library/Caches/zivis/repos/<repo-id>/inspect/runs/ for the repo at cwd."),
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory whose repo cache to search (defaults to server cwd)."),
+};
+export function createThreatListRelevantCapsulesHandler() {
+    return async (params) => {
+        const cwd = params.cwd ?? process.cwd();
+        let artifact;
+        let artifactPath;
+        try {
+            const resolved = await resolveArtifactPath(params.artifact_path, cwd);
+            artifactPath = resolved;
+            const raw = await fs.readFile(resolved, "utf8");
+            artifact = JSON.parse(raw);
+        }
+        catch (err) {
+            return withNextStepsError(`No repo graph artifact found. ${err.message}`, [
+                {
+                    id: "run_zivis_inspect",
+                    label: "Run `zivis inspect` to build the local repo graph",
+                    tool: "zivis_inspect",
+                    why: "The relevance evaluation reads from the latest inspect run in the user cache.",
+                },
+            ], "Run `zivis inspect` first; this tool reads from its output.");
+        }
+        const handle = await loadActivePack();
+        const relevant = await findRelevantCapsules(handle, artifact);
+        const summaries = relevant.map((cap) => ({
+            id: cap.id,
+            title: cap.title,
+            category: cap.category,
+            safe_summary: cap.safe_summary,
+            applicable_languages: cap.applicable_languages,
+            matched_on: matchedTerms(cap, artifact),
+        }));
+        return withNextSteps({
+            artifact_path: artifactPath,
+            pack: { id: handle.manifest.pack_id, version: handle.manifest.version },
+            languages_in_scope: artifact.scope.languages ?? [],
+            relevant_count: summaries.length,
+            relevant_capsules: summaries,
+        }, summaries.length > 0
+            ? [
+                {
+                    id: "get_capsule_details",
+                    label: "Pull the full capsule for any item the user wants to investigate",
+                    tool: "zivis_threat_get_capsule",
+                    why: "The full capsule has threats (with STRIDE), risk_hints, repair_contract, related_patterns.",
+                },
+                {
+                    id: "get_inference_prompt",
+                    label: "Get the inference prompt for the host LLM to run a deeper check",
+                    tool: "zivis_threat_get_inference_prompt",
+                    why: "INFER strategies in each capsule reference a prompt template the user's IDE model executes.",
+                },
+            ]
+            : [
+                {
+                    id: "no_relevant_patterns",
+                    label: "No public-pack patterns matched this repo",
+                    tool: "zivis_threat_list_relevant_capsules",
+                    why: "This is normal for repos without agentic / RAG / self-consistency / multi-tenant patterns. Proprietary patterns may still apply server-side.",
+                },
+            ], summaries.length > 0
+            ? `Found ${summaries.length} relevant capsule(s) in the threat library.`
+            : "No public-pack capsules matched this repo. Proprietary patterns evaluated server-side may still apply.");
+    };
+}
+// ── Helpers ──
+function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+async function resolveArtifactPath(explicit, cwd) {
+    if (explicit) {
+        if (!fssync.existsSync(explicit)) {
+            throw new Error(`Artifact path does not exist: ${explicit}`);
+        }
+        return explicit;
+    }
+    const reposRoot = path.join(userCacheRoot(), "repos");
+    if (!fssync.existsSync(reposRoot)) {
+        throw new Error(`No inspect cache found at ${reposRoot}. Run \`zivis inspect\` from the repo to populate it.`);
+    }
+    // Best-effort: find the newest .json under any repo's inspect/runs/ directory.
+    // The future improvement is to derive the repo-id from cwd's git remote and
+    // pick its newest run only.
+    const candidates = [];
+    for (const repo of await fs.readdir(reposRoot, { withFileTypes: true })) {
+        if (!repo.isDirectory())
+            continue;
+        const runs = path.join(reposRoot, repo.name, "inspect", "runs");
+        if (!fssync.existsSync(runs))
+            continue;
+        for (const entry of await fs.readdir(runs)) {
+            if (!entry.endsWith(".json"))
+                continue;
+            const full = path.join(runs, entry);
+            const stat = await fs.stat(full);
+            candidates.push({ file: full, mtime: stat.mtimeMs });
+        }
+    }
+    if (candidates.length === 0) {
+        throw new Error(`No inspect runs found under ${reposRoot}. Run \`zivis inspect\` from the repo to produce one.`);
+    }
+    candidates.sort((a, b) => b.mtime - a.mtime);
+    return candidates[0].file;
+}
+function matchedTerms(cap, artifact) {
+    const matched = [];
+    const pkgs = new Set();
+    for (const node of artifact.nodes) {
+        if (node.type === "external_dependency" && node.attributes?.package) {
+            pkgs.add(node.attributes.package);
+        }
+    }
+    const langs = new Set(artifact.scope.languages ?? []);
+    const f = cap.relevance_filter;
+    if (!f)
+        return ["always-applicable (no relevance_filter set)"];
+    for (const term of [...(f.any_of ?? []), ...(f.all_of ?? [])]) {
+        if (term.dependency && pkgs.has(term.dependency))
+            matched.push(`dep:${term.dependency}`);
+        if (term.language && langs.has(term.language))
+            matched.push(`language:${term.language}`);
+    }
+    return matched.length > 0 ? matched : ["language match only"];
+}
+//# sourceMappingURL=threat-list-relevant-capsules.js.map