@zivis/mcp 0.1.0-alpha.21 → 0.1.0-alpha.23

package/dist/tools/inspect.js

@@ -0,0 +1,252 @@
+/**
+ * zivis_inspect — local repo graph build + matcher run.
+ *
+ * Spawns `zivis inspect` (the CLI binary) to build the graph artifact, then
+ * runs the matcher to emit findings — both local-only, no network. The
+ * binding is verified up front so the resulting findings can attach to
+ * the right Application + org when the user later promotes them.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 4 — /inspect orchestration)
+ *
+ * Spawn strategy:
+ *   1. ZIVIS_CLI_BIN env override (for tests / unusual installs)
+ *   2. `zivis` on PATH
+ *   3. Resolved sibling under @zivis/cli's dist/index.js (workspace symlink)
+ *
+ * If none works, returns a structured error pointing the user at the install.
+ */
+import { z } from "zod";
+import * as fs from "node:fs/promises";
+import * as fssync from "node:fs";
+import * as path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { detectProjectBinding } from "../project-binding.js";
+import { runMatcher } from "../matcher/index.js";
+import { buildInferenceBundle } from "../matcher/inference-candidates.js";
+import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
+export const INSPECT_NAME = "zivis_inspect";
+export const INSPECT_DESCRIPTION = `Build a local repo graph and run the local pattern matcher to emit threat-model findings. The threat-model-first conversion event.
+
+Use this when the user says any of:
+- "model this app" / "threat model this repo"
+- "what should we be worried about in this code"
+- "set up security for this project" (after auth/binding is done)
+- "/inspect"
+
+What it does, all locally (no source code leaves the machine):
+  1. Spawns 'zivis inspect' to walk the repo and produce a typed graph artifact
+     (services, endpoints, external dependencies; auth boundaries + dataflow are Phase 1.5)
+  2. Runs the local matcher against the public pattern pack:
+     - AST strategies fire via @ast-grep/napi for TS/JS/Python/Go
+     - META strategies fire via the controls library (when no defending control is present)
+     - INFER strategies emit candidates the host LLM picks up via zivis_threat_get_inference_prompt
+  3. Returns normalized findings with lane (trusted/inferred), confidence, and evidence spans
+
+Trusted-lane findings are evidence-backed (deterministic strategies fired) and ready for the threat model. Inferred-lane findings need host-LLM confirmation via zivis_threat_get_inference_prompt before promotion. Proprietary platform-side eval (Phase 4 cloud upload) and trust-promoted aggregation are separate steps.
+
+This is the conversion moment for the threat-model-first sidekick — the user sees specific patterns naming specific files in their repo, in their IDE, in under 30 seconds.`;
+export const INSPECT_SCHEMA = {
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory to inspect (defaults to server working directory)."),
+    application_id: z
+        .string()
+        .optional()
+        .describe("Target application id. If omitted, /inspect resolves it from the project binding. " +
+        "Required if the binding is ambiguous or maps to multiple applications."),
+    skip_matcher: z
+        .boolean()
+        .optional()
+        .describe("If true, only build the graph artifact; do not run the matcher. Default: false (matcher runs)."),
+};
+export function createInspectHandler(_apiClient, _config) {
+    return async (params) => {
+        const cwd = params.cwd || process.cwd();
+        const detected = detectProjectBinding(cwd);
+        if (!detected) {
+            return withNextStepsError("No .zivis/project.json found for this directory. /inspect needs a project binding so the resulting threat model attaches to the correct application and org.", [
+                {
+                    id: "run_auth_init",
+                    label: "Connect this project to your ZIVIS org",
+                    tool: "zivis_check_project",
+                    why: "Run 'zivis auth init' or 'zivis auth login' to create the binding, then re-run /inspect.",
+                },
+            ], "Project not bound — run zivis auth login then re-run /inspect.");
+        }
+        // Spawn `zivis inspect` to build the graph artifact.
+        let inspectStderr = "";
+        let artifactPath;
+        try {
+            const result = await spawnInspect(cwd, params.application_id ?? detected.binding.applicationId);
+            inspectStderr = result.stderr;
+            artifactPath = parseArtifactPath(result.stderr);
+        }
+        catch (err) {
+            return withNextStepsError(`Could not run 'zivis inspect': ${err.message}`, [
+                {
+                    id: "install_cli",
+                    label: "Install the ZIVIS CLI globally",
+                    tool: "zivis_inspect",
+                    why: "Inspect needs the 'zivis' CLI on PATH (or set ZIVIS_CLI_BIN). pnpm add -g @zivis/cli.",
+                },
+            ], "Install or surface the ZIVIS CLI binary, then retry.");
+        }
+        if (!artifactPath) {
+            return withNextStepsError(`'zivis inspect' completed but no artifact path was reported. stderr tail:\n${inspectStderr.slice(-500)}`, [], "Inspect ran but produced no artifact path; check the CLI output.");
+        }
+        if (params.skip_matcher) {
+            return withNextSteps({
+                status: "graph_only",
+                binding: {
+                    orgName: detected.binding.orgName,
+                    workosOrgId: detected.binding.workosOrgId,
+                    applicationId: params.application_id ?? detected.binding.applicationId ?? null,
+                },
+                artifact_path: artifactPath,
+                inspect_stderr_tail: inspectStderr.split("\n").slice(-6).join("\n"),
+            }, [
+                {
+                    id: "run_matcher_now",
+                    label: "Run the matcher against this artifact",
+                    tool: "zivis_threat_run_matcher",
+                    why: "Emit the threat findings deterministic + inference strategies produce.",
+                },
+            ], "Graph artifact built; matcher skipped per request.");
+        }
+        // Run the matcher against the freshly-produced artifact.
+        const matcherResult = await runMatcher({ artifactPath, cwd });
+        // Aggregate inference candidates with full prompt bundles so the host
+        // LLM can run inference without any further tool round-trip.
+        const inferenceBundle = await buildInferenceBundle(matcherResult.findings);
+        const headline = matcherResult.summary.total === 0
+            ? `Inspected ${matcherResult.ast_files_scanned} files. No public-pack threat patterns fired against this repo.`
+            : `Inspected ${matcherResult.ast_files_scanned} files. Found ${matcherResult.summary.total} threat${matcherResult.summary.total === 1 ? "" : "s"} (${matcherResult.summary.trusted_count} trusted, ${matcherResult.summary.inferred_count} inferred). ` +
+                (inferenceBundle.inference_candidates.length > 0
+                    ? `IMPORTANT: ${inferenceBundle.inference_candidates.length} inference_candidate${inferenceBundle.inference_candidates.length === 1 ? "" : "s"} require host-side execution before findings are presented to the user — see host_required_action.`
+                    : "");
+        return withNextSteps({
+            status: "complete",
+            binding: {
+                orgName: detected.binding.orgName,
+                workosOrgId: detected.binding.workosOrgId,
+                applicationId: params.application_id ?? detected.binding.applicationId ?? null,
+            },
+            artifact_path: artifactPath,
+            matcher: matcherResult,
+            host_required_action: inferenceBundle.host_required_action,
+            inference_candidates: inferenceBundle.inference_candidates,
+            boundary: {
+                local_only: "Repo walk, graph IR construction, public-pack matching, and inference candidate emission all run on this machine. Inference EXECUTION is by your IDE host model (Mode A); no LLM is invoked by ZIVIS itself.",
+                sent_to_platform: "Nothing yet — proprietary platform-side evaluation (Phase 4) ships graph features + match candidates, not raw source.",
+                stays_on_platform: "Proprietary pattern definitions and final scoring logic.",
+            },
+        }, matcherResult.summary.trusted_count > 0
+            ? [
+                {
+                    id: "review_trusted_findings",
+                    label: `Review the ${matcherResult.summary.trusted_count} trusted-lane finding${matcherResult.summary.trusted_count === 1 ? "" : "s"}`,
+                    tool: "zivis_threat_get_capsule",
+                    why: "Trusted findings are evidence-backed and ready to land in the threat model. Pull each capsule for the full threat narrative + repair contract.",
+                },
+                ...(matcherResult.summary.inferred_count > 0
+                    ? [
+                        {
+                            id: "host_runs_inference",
+                            label: `Confirm the ${matcherResult.summary.inferred_count} inferred-lane finding${matcherResult.summary.inferred_count === 1 ? "" : "s"} via your model`,
+                            tool: "zivis_threat_get_inference_prompt",
+                            why: "Inferred findings need host-LLM confirmation. Pull the prompt bundle, run inference, and the JSON output enters the inferred lane until promotion.",
+                        },
+                    ]
+                    : []),
+            ]
+            : matcherResult.summary.inferred_count > 0
+                ? [
+                    {
+                        id: "host_runs_inference",
+                        label: `Confirm the ${matcherResult.summary.inferred_count} inferred-lane finding${matcherResult.summary.inferred_count === 1 ? "" : "s"} via your model`,
+                        tool: "zivis_threat_get_inference_prompt",
+                        why: "Inferred findings need host-LLM confirmation before they can land in the threat model.",
+                    },
+                ]
+                : [
+                    {
+                        id: "expand_via_platform",
+                        label: "Public pack found nothing — proprietary patterns evaluated server-side may still apply",
+                        tool: "zivis_inspect",
+                        why: "Phase 4 sends the artifact to the platform for proprietary pattern evaluation; that path is queued.",
+                    },
+                ], headline);
+    };
+}
+async function spawnInspect(cwd, applicationId) {
+    const bin = await findZivisCliBin();
+    const args = ["inspect", "--root", cwd];
+    if (applicationId) {
+        args.push("--application", applicationId);
+    }
+    return new Promise((resolve, reject) => {
+        const child = spawn(bin.command, [...bin.prefixArgs, ...args], { cwd });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (d) => (stdout += d.toString()));
+        child.stderr.on("data", (d) => (stderr += d.toString()));
+        child.on("error", (err) => reject(err));
+        child.on("close", (code) => {
+            if (code !== 0) {
+                reject(new Error(`zivis inspect exited ${code}\n${stderr.slice(-500)}`));
+                return;
+            }
+            resolve({ stdout, stderr, code: code ?? 0 });
+        });
+    });
+}
+async function findZivisCliBin() {
+    // 1. Env override
+    const envBin = process.env.ZIVIS_CLI_BIN;
+    if (envBin) {
+        if (fssync.existsSync(envBin)) {
+            return { command: process.execPath, prefixArgs: [envBin] };
+        }
+        throw new Error(`ZIVIS_CLI_BIN points to ${envBin} which does not exist`);
+    }
+    // 2. Resolved sibling under @zivis/cli (workspace symlink during dev)
+    const sibling = await tryResolveZivisCli();
+    if (sibling) {
+        return { command: process.execPath, prefixArgs: [sibling] };
+    }
+    // 3. `zivis` on PATH (production install)
+    return { command: "zivis", prefixArgs: [] };
+}
+async function tryResolveZivisCli() {
+    try {
+        const here = path.dirname(fileURLToPath(import.meta.url));
+        // dist layout: dist/tools/inspect.js → look up to node_modules/@zivis/cli/dist/index.js
+        const candidates = [
+            path.resolve(here, "../../../zivis-cli/dist/index.js"),
+            path.resolve(here, "../../node_modules/@zivis/cli/dist/index.js"),
+            path.resolve(here, "../../../node_modules/@zivis/cli/dist/index.js"),
+        ];
+        for (const c of candidates) {
+            if (fssync.existsSync(c))
+                return c;
+        }
+    }
+    catch {
+        // ignore
+    }
+    return undefined;
+}
+/**
+ * Parse the artifact path from `zivis inspect`'s stderr summary line:
+ *   "  wrote /Users/.../inspect/runs/abc.json"
+ */
+function parseArtifactPath(stderr) {
+    const match = stderr.match(/wrote\s+(\S+\.json)/);
+    return match?.[1];
+}
+// Re-exported so the file isn't unused when spawnInspect's stdout is unread:
+void parseArtifactPath;
+void fs;
+//# sourceMappingURL=inspect.js.map

package/dist/tools/inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.js","sourceRoot":"","sources":["../../src/tools/inspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEzE,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAE5C,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;4KAmByI,CAAC;AAE7K,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sEAAsE,CAAC;IACnF,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,wEAAwE,CAC3E;IACH,YAAY,EAAE,CAAC;SACZ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,gGAAgG,CACjG;CACJ,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,UAAqB,EAAE,OAAoB;IAC9E,OAAO,KAAK,EAAE,MAAyE,EAAE,EAAE;QACzF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,kBAAkB,CACvB,8JAA8J,EAC9J;gBACE;oBACE,EAAE,EAAE,eAAe;oBACnB,KAAK,EAAE,wCAAwC;oBAC/C,IAAI,EAAE,qBAAqB;oBAC3B,GAAG,EAAE,0FAA0F;iBAChG;aACF,EACD,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,qDAAqD;QACrD,IAAI,aAAa,GAAG,EAAE,CAAC;QACvB,IAAI,YAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAChG,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,kBAAkB,CACvB,kCAAmC,GAAa,CAAC,OAAO,EAAE,EAC1D;gBACE;oBACE,EAAE,EAAE,aAAa;oBACjB,KAAK,EAAE,gCAAgC;oBACvC,IAAI,EAAE,eAAe;oBACrB,GAAG,EAAE,uFAAuF;iBAC7F;aACF,EACD,sDAAsD,CACvD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,kBAAkB,CACvB,8EAA8E,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,EACzG,EAAE,EACF,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,aAAa,CAClB;gBACE,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE;oBACP,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;oBACjC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW;oBACzC,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI;iBAC/E;gBACD,aAAa,EAAE,YAAY;gBAC3B,mBAAmB,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aACpE,EACD;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,KAAK,EAAE,uCAAuC;oBAC9C,IAAI,EAAE,0BAA0B;oBAChC,GAAG,EAAE,wEAAwE;iBAC9E;aACF,EACD,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAE9D,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE3E,MAAM,QAAQ,GACZ,aAAa,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC;YAC/B,CAAC,CAAC,aAAa,aAAa,CAAC,iBAAiB,iEAAiE;YAC/G,CAAC,CAAC,aAAa,aAAa,CAAC,iBAAiB,iBAAiB,aAAa,CAAC,OAAO,CAAC,KAAK,UAAU,aAAa,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,aAAa,aAAa,aAAa,CAAC,OAAO,CAAC,cAAc,cAAc;gBACrP,CAAC,eAAe,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC9C,CAAC,CAAC,cAAc,eAAe,CAAC,oBAAoB,CAAC,MAAM,uBAAuB,eAAe,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,oGAAoG;oBAClP,CAAC,CAAC,EAAE,CAAC,CAAC;QAEd,OAAO,aAAa,CAClB;YACE,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE;gBACP,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;gBACjC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW;gBACzC,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI;aAC/E;YACD,aAAa,EAAE,YAAY;YAC3B,OAAO,EAAE,aAAa;YACtB,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;YAC1D,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;YAC1D,QAAQ,EAAE;gBACR,UAAU,EACR,8MAA8M;gBAChN,gBAAgB,EACd,uHAAuH;gBACzH,iBAAiB,EACf,0DAA0D;aAC7D;SACF,EACD,aAAa,CAAC,OAAO,CAAC,aAAa,GAAG,CAAC;YACrC,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,yBAAyB;oBAC7B,KAAK,EAAE,cAAc,aAAa,CAAC,OAAO,CAAC,aAAa,wBAAwB,aAAa,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;oBACtI,IAAI,EAAE,0BAA0B;oBAChC,GAAG,EAAE,gJAAgJ;iBACtJ;gBACD,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC;oBAC1C,CAAC,CAAC;wBACE;4BACE,EAAE,EAAE,qBAAqB;4BACzB,KAAK,EAAE,eAAe,aAAa,CAAC,OAAO,CAAC,cAAc,yBAAyB,aAAa,CAAC,OAAO,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iBAAiB;4BACzJ,IAAI,EAAE,mCAAmC;4BACzC,GAAG,EAAE,oJAAoJ;yBAC1J;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC;gBACxC,CAAC,CAAC;oBACE;wBACE,EAAE,EAAE,qBAAqB;wBACzB,KAAK,EAAE,eAAe,aAAa,CAAC,OAAO,CAAC,cAAc,yBAAyB,aAAa,CAAC,OAAO,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iBAAiB;wBACzJ,IAAI,EAAE,mCAAmC;wBACzC,GAAG,EAAE,wFAAwF;qBAC9F;iBACF;gBACH,CAAC,CAAC;oBACE;wBACE,EAAE,EAAE,qBAAqB;wBACzB,KAAK,EAAE,wFAAwF;wBAC/F,IAAI,EAAE,eAAe;wBACrB,GAAG,EAAE,qGAAqG;qBAC3G;iBACF,EACP,QAAQ,CACT,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,aAAsB;IAC7D,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzE,OAAO;YACT,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,KAAK,UAAU,eAAe;IAC5B,kBAAkB;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,uBAAuB,CAAC,CAAC;IAC5E,CAAC;IAED,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,0CAA0C;IAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,wFAAwF;QACxF,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,kCAAkC,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,6CAA6C,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,gDAAgD,CAAC;SACrE,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAClD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,6EAA6E;AAC7E,KAAK,iBAAiB,CAAC;AACvB,KAAK,EAAE,CAAC"}

package/dist/tools/manage-application.d.ts

@@ -23,8 +23,8 @@ export declare const MANAGE_APPLICATION_SCHEMA: {
     api_url: z.ZodOptional<z.ZodString>;
     auth_type: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        static_token: "static_token";
         oauth_pkce: "oauth_pkce";
+        static_token: "static_token";
         client_credentials: "client_credentials";
         bearer_refresh: "bearer_refresh";
     }>>;

package/dist/tools/security-review.js

@@ -138,61 +138,78 @@ export function createSecurityReviewHandler(apiClient, config) {
                 errors.push(`Open findings: ${err instanceof Error ? err.message : "failed"}`);
             }
         }
-        // ── 3. Threat model: security controls ──
-        if (shouldInclude("controls") && threat_model_id) {
+        // ── 3 & 4. Threat model: security controls + attack scenarios ──
+        // Sub-entities (controls, scenarios, actors, components, etc.) live on the
+        // latest ThreatModelVersion, not on the root threat model. Fetch once and
+        // reuse for both sections.
+        if ((shouldInclude("controls") || shouldInclude("attack_scenarios")) && threat_model_id) {
+            let tm = null;
             try {
-                const tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
-                const controls = tm.securityControls || [];
-                const notImplemented = controls.filter((c) => c.status === "not_implemented");
-                const partial = controls.filter((c) => c.status === "partial");
-                const implemented = controls.filter((c) => c.status === "implemented");
-                context.securityControls = {
-                    _instruction: "Verify that code implements these expected security controls. Flag missing or weak implementations.",
-                    summary: {
-                        implemented: implemented.length,
-                        partial: partial.length,
-                        notImplemented: notImplemented.length,
-                    },
-                    gapControls: [...notImplemented, ...partial].map((c) => ({
-                        name: c.name,
-                        type: c.controlType,
-                        status: c.status,
-                        description: c.description,
-                        effectiveness: c.effectivenessRating,
-                    })),
-                    implementedControls: implemented.map((c) => ({
-                        name: c.name,
-                        type: c.controlType,
-                        description: c.description,
-                    })),
-                };
+                tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
             }
             catch (err) {
-                errors.push(`Security controls: ${err instanceof Error ? err.message : "failed"}`);
+                errors.push(`Threat model fetch: ${err instanceof Error ? err.message : "failed"}`);
             }
-        }
-        // ── 4. Threat model: attack scenarios ──
-        if (shouldInclude("attack_scenarios") && threat_model_id) {
-            try {
-                const tm = await apiClient.get(`/api/threat-models/${threat_model_id}?include=all`);
-                const scenarios = tm.attackScenarios || [];
-                const minSeverity = SEVERITY_ORDER[severity_threshold] || 2;
-                const filtered = scenarios.filter((s) => (SEVERITY_ORDER[s.severity] || 1) >= minSeverity);
-                context.attackScenarios = {
-                    _instruction: "Review code for susceptibility to these known attack vectors. Check that mitigations are in place.",
-                    count: filtered.length,
-                    scenarios: filtered.map((s) => ({
-                        name: s.name,
-                        strideCategory: s.strideCategory,
-                        severity: s.severity,
-                        likelihood: s.likelihood,
-                        attackVector: s.attackVector,
-                        description: s.description,
-                    })),
-                };
+            const versions = Array.isArray(tm?.versions) ? tm.versions : [];
+            const latestVersion = versions[0] || {};
+            if (tm && shouldInclude("controls")) {
+                try {
+                    const controls = Array.isArray(latestVersion.securityControls)
+                        ? latestVersion.securityControls
+                        : [];
+                    const notImplemented = controls.filter((c) => c.status === "not_implemented");
+                    const partial = controls.filter((c) => c.status === "partial");
+                    const implemented = controls.filter((c) => c.status === "implemented");
+                    context.securityControls = {
+                        _instruction: "Verify that code implements these expected security controls. Flag missing or weak implementations.",
+                        summary: {
+                            implemented: implemented.length,
+                            partial: partial.length,
+                            notImplemented: notImplemented.length,
+                        },
+                        gapControls: [...notImplemented, ...partial].map((c) => ({
+                            name: c.name,
+                            type: c.controlType,
+                            status: c.status,
+                            description: c.description,
+                            effectiveness: c.effectivenessRating,
+                        })),
+                        implementedControls: implemented.map((c) => ({
+                            name: c.name,
+                            type: c.controlType,
+                            description: c.description,
+                        })),
+                    };
+                }
+                catch (err) {
+                    errors.push(`Security controls: ${err instanceof Error ? err.message : "failed"}`);
+                }
             }
-            catch (err) {
-                errors.push(`Attack scenarios: ${err instanceof Error ? err.message : "failed"}`);
+            if (tm && shouldInclude("attack_scenarios")) {
+                try {
+                    const scenarios = Array.isArray(latestVersion.attackScenarios)
+                        ? latestVersion.attackScenarios
+                        : [];
+                    const minSeverity = SEVERITY_ORDER[severity_threshold] || 2;
+                    const filtered = scenarios.filter((s) => (SEVERITY_ORDER[s.severity] || 1) >= minSeverity);
+                    context.attackScenarios = {
+                        _instruction: "Review code for susceptibility to these known attack vectors. Check that mitigations are in place.",
+                        count: filtered.length,
+                        scenarios: filtered.map((s) => ({
+                            displayId: s.displayId,
+                            title: s.title,
+                            strideCategory: s.strideCategory,
+                            severity: s.severity,
+                            likelihood: s.likelihood,
+                            riskScore: s.riskScore,
+                            status: s.status,
+                            narrative: s.narrative,
+                        })),
+                    };
+                }
+                catch (err) {
+                    errors.push(`Attack scenarios: ${err instanceof Error ? err.message : "failed"}`);
+                }
             }
         }
         // ── 5. Dependency trust scores ──

package/dist/tools/security-review.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-review.js","sourceRoot":"","sources":["../../src/tools/security-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;gFAgBqC,CAAC;AAEjF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IACxG,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yHAAyH,CAC1H;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IACrH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;IAC/F,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;SACpF,QAAQ,EAAE;SACV,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,kBAAkB,EAAE,CAAC;SAClB,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;SACnD,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,mEAAmE,CAAC;IAChF,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,SAAoB,EAAE,MAAmB;IACnF,OAAO,KAAK,EAAE,MASb,EAAE,EAAE;QACH,MAAM,EACJ,IAAI,EACJ,cAAc,EAAE,mBAAmB,EACnC,eAAe,EACf,WAAW,EACX,WAAW,GAAG,CAAC,KAAK,CAAC,EACrB,kBAAkB,GAAG,KAAK,EAC1B,gBAAgB,GAAG,IAAI,EACvB,eAAe,GAChB,GAAG,MAAM,CAAC;QAEX,MAAM,cAAc,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EACF,wFAAwF;4BACxF,qEAAqE;qBACxE,CAAC;gBACF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,OAAO,GAA4B;YACvC,YAAY,EAAE,0EAA0E;YACxF,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE;SACnE,CAAC;QAEF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,kDAAkD;QAClD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACtD,IAAI;oBACJ,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,MAAM,iBAAiB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACvD,IAAI;oBACJ,MAAM,EAAE,gBAAgB;oBACxB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,mDAAmD;gBACnD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;gBAErE,OAAO,CAAC,eAAe,GAAG;oBACxB,YAAY,EAAE,qGAAqG;oBACnH,aAAa,EAAE,gBAAgB,CAAC,MAAM;oBACtC,QAAQ,EAAE,kBAAkB;oBAC5B,aAAa,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAClE,cAAc,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACpE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBAClD,IAAI;oBACJ,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,+BAA+B;gBAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAClC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,mBAAmB,GAAG;oBAC5B,YAAY,EAAE,mGAAmG;oBACjH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,eAAe,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAC5B,sBAAsB,eAAe,cAAc,CACpD,CAAC;gBAEF,MAAM,QAAQ,GAAI,EAAU,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBACpD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;gBACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;gBAE5E,OAAO,CAAC,gBAAgB,GAAG;oBACzB,YAAY,EAAE,qGAAqG;oBACnH,OAAO,EAAE;wBACP,WAAW,EAAE,WAAW,CAAC,MAAM;wBAC/B,OAAO,EAAE,OAAO,CAAC,MAAM;wBACvB,cAAc,EAAE,cAAc,CAAC,MAAM;qBACtC;oBACD,WAAW,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBAC5D,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,WAAW;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,aAAa,EAAE,CAAC,CAAC,mBAAmB;qBACrC,CAAC,CAAC;oBACH,mBAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBAChD,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,WAAW;wBACnB,WAAW,EAAE,CAAC,CAAC,WAAW;qBAC3B,CAAC,CAAC;iBACJ,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,aAAa,CAAC,kBAAkB,CAAC,IAAI,eAAe,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAC5B,sBAAsB,eAAe,cAAc,CACpD,CAAC;gBAEF,MAAM,SAAS,GAAI,EAAU,CAAC,eAAe,IAAI,EAAE,CAAC;gBACpD,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,eAAe,GAAG;oBACxB,YAAY,EAAE,oGAAoG;oBAClH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBACnC,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,cAAc,EAAE,CAAC,CAAC,cAAc;wBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;wBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,YAAY,EAAE,CAAC,CAAC,YAAY;wBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;qBAC3B,CAAC,CAAC;iBACJ,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,aAAa,CAAC,cAAc,CAAC,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,UAAU,GAA8B,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;wBACxD,SAAS;oBACX,CAAC;oBAED,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,OAAO,wBAAwB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAChE,CAAC;oBAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;wBACX,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;wBAC/B,UAAU,CAAC,IAAI,CAAC;4BACd,IAAI,EAAE,GAAG;4BACT,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,QAAQ,EAAE;gCACR,QAAQ,EAAE,KAAK,CAAC,gBAAgB,IAAI,CAAC;gCACrC,IAAI,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC;gCAC7B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC;gCACjC,GAAG,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;6BAC5B;4BACD,WAAW,EAAE,KAAK,CAAC,aAAa;yBACjC,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,GAAG,EAAE,CACtD,CAAC;YAEF,OAAO,CAAC,eAAe,GAAG;gBACxB,YAAY,EAAE,qGAAqG;gBACnH,OAAO,EAAE,UAAU,CAAC,MAAM;gBAC1B,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,YAAY,EAAE,UAAU;aACzB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,GAAG,CAC1C,kBAAkB,WAAW,oBAAoB,CAClD,CAAC;gBAEF,MAAM,QAAQ,GAAI,gBAAwB,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,gBAAgB,GAAG;oBACzB,YAAY,EAAE,2GAA2G;oBACzH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;QAC5B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;iBACzD,CAAC;SACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAEhB,KAAK,UAAU,aAAa,CAC1B,SAAoB,EACpB,MAA0D;IAE1D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,yBAAyB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAA0C,IAAI,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAM;IAC9B,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7C,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAe;IACtC,MAAM,MAAM,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,gBAAuB;IACtD,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkF,CAAC;IAE7G,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,eAAe,KAAK,CAAC,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;SACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,KAAK;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM;QAClB,MAAM,EAAE,oBAAoB,CAAC,CAAC,KAAK,6CAA6C;KACjF,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,OAAO,CAAC,eAAsB,CAAC;IAClD,IAAI,UAAU,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CACX,eAAe,UAAU,CAAC,aAAa,4CAA4C,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,sBAAsB,CAC1I,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,mBAA0B,CAAC;IAChD,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,KAAK,2BAA2B,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,4CAA4C,CACvK,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAuB,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CACX,iBAAiB,IAAI,iFAAiF,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC/C,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,mBAAmB,OAAO,CAAC,KAAK,6DAA6D,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC5C,IAAI,IAAI,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,UAAU,6DAA6D,CAC5F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,yEAAyE,CAC1E,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"security-review.js","sourceRoot":"","sources":["../../src/tools/security-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;gFAgBqC,CAAC;AAEjF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IACxG,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yHAAyH,CAC1H;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IACrH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;IAC/F,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;SACpF,QAAQ,EAAE;SACV,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,kBAAkB,EAAE,CAAC;SAClB,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;SACnD,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,mEAAmE,CAAC;IAChF,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,SAAoB,EAAE,MAAmB;IACnF,OAAO,KAAK,EAAE,MASb,EAAE,EAAE;QACH,MAAM,EACJ,IAAI,EACJ,cAAc,EAAE,mBAAmB,EACnC,eAAe,EACf,WAAW,EACX,WAAW,GAAG,CAAC,KAAK,CAAC,EACrB,kBAAkB,GAAG,KAAK,EAC1B,gBAAgB,GAAG,IAAI,EACvB,eAAe,GAChB,GAAG,MAAM,CAAC;QAEX,MAAM,cAAc,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EACF,wFAAwF;4BACxF,qEAAqE;qBACxE,CAAC;gBACF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,OAAO,GAA4B;YACvC,YAAY,EAAE,0EAA0E;YACxF,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE;SACnE,CAAC;QAEF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,kDAAkD;QAClD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACtD,IAAI;oBACJ,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,MAAM,iBAAiB,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBACvD,IAAI;oBACJ,MAAM,EAAE,gBAAgB;oBACxB,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,mDAAmD;gBACnD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;gBAErE,OAAO,CAAC,eAAe,GAAG;oBACxB,YAAY,EAAE,qGAAqG;oBACnH,aAAa,EAAE,gBAAgB,CAAC,MAAM;oBACtC,QAAQ,EAAE,kBAAkB;oBAC5B,aAAa,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAClE,cAAc,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACpE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;oBAClD,IAAI;oBACJ,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;gBAEH,+BAA+B;gBAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAClC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,mBAAmB,GAAG;oBAC5B,YAAY,EAAE,mGAAmG;oBACjH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,2BAA2B;QAC3B,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;YACxF,IAAI,EAAE,GAAmC,IAAI,CAAC;YAC9C,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CACtB,sBAAsB,eAAe,cAAc,CACpD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtF,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAE,EAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAE,EAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAExC,IAAI,EAAE,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAU,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC;wBACnE,CAAC,CAAC,aAAa,CAAC,gBAAgB;wBAChC,CAAC,CAAC,EAAE,CAAC;oBACP,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC;oBACnF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;oBACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;oBAE5E,OAAO,CAAC,gBAAgB,GAAG;wBACzB,YAAY,EAAE,qGAAqG;wBACnH,OAAO,EAAE;4BACP,WAAW,EAAE,WAAW,CAAC,MAAM;4BAC/B,OAAO,EAAE,OAAO,CAAC,MAAM;4BACvB,cAAc,EAAE,cAAc,CAAC,MAAM;yBACtC;wBACD,WAAW,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;4BAC5D,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,IAAI,EAAE,CAAC,CAAC,WAAW;4BACnB,MAAM,EAAE,CAAC,CAAC,MAAM;4BAChB,WAAW,EAAE,CAAC,CAAC,WAAW;4BAC1B,aAAa,EAAE,CAAC,CAAC,mBAAmB;yBACrC,CAAC,CAAC;wBACH,mBAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;4BAChD,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,IAAI,EAAE,CAAC,CAAC,WAAW;4BACnB,WAAW,EAAE,CAAC,CAAC,WAAW;yBAC3B,CAAC,CAAC;qBACJ,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YAED,IAAI,EAAE,IAAI,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,MAAM,SAAS,GAAU,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC;wBACnE,CAAC,CAAC,aAAa,CAAC,eAAe;wBAC/B,CAAC,CAAC,EAAE,CAAC;oBACP,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;oBAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;oBAEF,OAAO,CAAC,eAAe,GAAG;wBACxB,YAAY,EAAE,oGAAoG;wBAClH,KAAK,EAAE,QAAQ,CAAC,MAAM;wBACtB,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;4BACnC,SAAS,EAAE,CAAC,CAAC,SAAS;4BACtB,KAAK,EAAE,CAAC,CAAC,KAAK;4BACd,cAAc,EAAE,CAAC,CAAC,cAAc;4BAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;4BACpB,UAAU,EAAE,CAAC,CAAC,UAAU;4BACxB,SAAS,EAAE,CAAC,CAAC,SAAS;4BACtB,MAAM,EAAE,CAAC,CAAC,MAAM;4BAChB,SAAS,EAAE,CAAC,CAAC,SAAS;yBACvB,CAAC,CAAC;qBACJ,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,aAAa,CAAC,cAAc,CAAC,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,UAAU,GAA8B,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;wBACxD,SAAS;oBACX,CAAC;oBAED,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,OAAO,wBAAwB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAChE,CAAC;oBAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;wBACX,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;wBAC/B,UAAU,CAAC,IAAI,CAAC;4BACd,IAAI,EAAE,GAAG;4BACT,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,QAAQ,EAAE;gCACR,QAAQ,EAAE,KAAK,CAAC,gBAAgB,IAAI,CAAC;gCACrC,IAAI,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC;gCAC7B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC;gCACjC,GAAG,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;6BAC5B;4BACD,WAAW,EAAE,KAAK,CAAC,aAAa;yBACjC,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,GAAG,EAAE,CACtD,CAAC;YAEF,OAAO,CAAC,eAAe,GAAG;gBACxB,YAAY,EAAE,qGAAqG;gBACnH,OAAO,EAAE,UAAU,CAAC,MAAM;gBAC1B,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,YAAY,EAAE,UAAU;aACzB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,GAAG,CAC1C,kBAAkB,WAAW,oBAAoB,CAClD,CAAC;gBAEF,MAAM,QAAQ,GAAI,gBAAwB,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAC7D,CAAC;gBAEF,OAAO,CAAC,gBAAgB,GAAG;oBACzB,YAAY,EAAE,2GAA2G;oBACzH,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACtD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;QAC5B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;iBACzD,CAAC;SACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAEhB,KAAK,UAAU,aAAa,CAC1B,SAAoB,EACpB,MAA0D;IAE1D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,yBAAyB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAA0C,IAAI,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAM;IAC9B,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7C,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAe;IACtC,MAAM,MAAM,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,gBAAuB;IACtD,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkF,CAAC;IAE7G,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,eAAe,KAAK,CAAC,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;SACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,KAAK;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM;QAClB,MAAM,EAAE,oBAAoB,CAAC,CAAC,KAAK,6CAA6C;KACjF,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,OAAO,CAAC,eAAsB,CAAC;IAClD,IAAI,UAAU,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CACX,eAAe,UAAU,CAAC,aAAa,4CAA4C,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,sBAAsB,CAC1I,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,mBAA0B,CAAC;IAChD,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,KAAK,2BAA2B,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,4CAA4C,CACvK,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAuB,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CACX,iBAAiB,IAAI,iFAAiF,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC/C,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,mBAAmB,OAAO,CAAC,KAAK,6DAA6D,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,eAAsB,CAAC;IAC5C,IAAI,IAAI,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,UAAU,6DAA6D,CAC5F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,yEAAyE,CAC1E,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/threat-get-capsule.d.ts

@@ -0,0 +1,25 @@
+/**
+ * zivis_threat_get_capsule — return the full capsule for a pattern id.
+ *
+ * After the LLM has surfaced relevant capsules via zivis_threat_list_relevant_capsules,
+ * this tool returns the full capsule JSON: safe_summary, threats with STRIDE,
+ * risk_hints, architectural_signals, repair_contract, related_patterns, and the
+ * model_task_prompt_ref pointing to the inference prompt template.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 2A)
+ */
+import { z } from "zod";
+export declare const THREAT_GET_CAPSULE_NAME = "zivis_threat_get_capsule";
+export declare const THREAT_GET_CAPSULE_DESCRIPTION = "Return the full capsule for a single threat-model pattern.\n\nUse after zivis_threat_list_relevant_capsules has surfaced an id the user wants to dig into. The capsule includes:\n- safe_summary, detect_when, risk_hints, architectural_signals \u2014 for explaining the pattern in threat-model language\n- threats[] with STRIDE categories and remediations \u2014 for grounding the conversation in component/flow/boundary terms\n- repair_contract.allowed / forbidden \u2014 what refactors are safe\n- related_patterns \u2014 adjacent ids in the library\n- model_task_prompt_ref \u2014 pass to zivis_threat_get_inference_prompt to get the prompt the host LLM should run for a deeper check\n\nCapsule data is read from the local pack (~/Library/Caches/zivis/pattern-packs/) with SHA256 integrity verification on every read.";
+export declare const THREAT_GET_CAPSULE_SCHEMA: {
+    capsule_id: z.ZodString;
+};
+export declare function createThreatGetCapsuleHandler(): (params: {
+    capsule_id: string;
+}) => Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;

package/dist/tools/threat-get-capsule.js

@@ -0,0 +1,64 @@
+/**
+ * zivis_threat_get_capsule — return the full capsule for a pattern id.
+ *
+ * After the LLM has surfaced relevant capsules via zivis_threat_list_relevant_capsules,
+ * this tool returns the full capsule JSON: safe_summary, threats with STRIDE,
+ * risk_hints, architectural_signals, repair_contract, related_patterns, and the
+ * model_task_prompt_ref pointing to the inference prompt template.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 2A)
+ */
+import { z } from "zod";
+import { loadActivePack, getCapsule, listCapsuleIds } from "../pattern-pack/index.js";
+import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
+export const THREAT_GET_CAPSULE_NAME = "zivis_threat_get_capsule";
+export const THREAT_GET_CAPSULE_DESCRIPTION = `Return the full capsule for a single threat-model pattern.
+
+Use after zivis_threat_list_relevant_capsules has surfaced an id the user wants to dig into. The capsule includes:
+- safe_summary, detect_when, risk_hints, architectural_signals — for explaining the pattern in threat-model language
+- threats[] with STRIDE categories and remediations — for grounding the conversation in component/flow/boundary terms
+- repair_contract.allowed / forbidden — what refactors are safe
+- related_patterns — adjacent ids in the library
+- model_task_prompt_ref — pass to zivis_threat_get_inference_prompt to get the prompt the host LLM should run for a deeper check
+
+Capsule data is read from the local pack (~/Library/Caches/zivis/pattern-packs/) with SHA256 integrity verification on every read.`;
+export const THREAT_GET_CAPSULE_SCHEMA = {
+    capsule_id: z
+        .string()
+        .describe("Capsule id, e.g. 'agents.privilege-separation'. Discoverable via zivis_threat_list_relevant_capsules."),
+};
+export function createThreatGetCapsuleHandler() {
+    return async (params) => {
+        const handle = await loadActivePack();
+        let capsule;
+        try {
+            capsule = await getCapsule(handle, params.capsule_id);
+        }
+        catch (err) {
+            const ids = await listCapsuleIds(handle);
+            return withNextStepsError(`Capsule '${params.capsule_id}' not found in pack ${handle.manifest.pack_id}@${handle.manifest.version}. ${err.message}`, [
+                {
+                    id: "list_relevant_capsules_first",
+                    label: "Find relevant capsules for the current repo first",
+                    tool: "zivis_threat_list_relevant_capsules",
+                    why: "Returns ids you can pass back into zivis_threat_get_capsule.",
+                },
+            ], `Available capsule ids in this pack: ${ids.join(", ")}`);
+        }
+        return withNextSteps({
+            pack: { id: handle.manifest.pack_id, version: handle.manifest.version },
+            capsule,
+        }, capsule.model_task_prompt_ref
+            ? [
+                {
+                    id: "get_inference_prompt",
+                    label: "Get the inference prompt template the host LLM should run",
+                    tool: "zivis_threat_get_inference_prompt",
+                    args_hint: { capsule_id: capsule.id },
+                    why: "Inference prompt + expected_output_schema together form the prompt bundle the IDE LLM executes.",
+                },
+            ]
+            : [], `Capsule ${capsule.id}@${capsule.version} (${capsule.lifecycle}, ${capsule.sensitivity_level ?? "unspecified-tier"}). Threats: ${(capsule.threats?.length ?? 0)}.`);
+    };
+}
+//# sourceMappingURL=threat-get-capsule.js.map

package/dist/tools/threat-get-capsule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-get-capsule.js","sourceRoot":"","sources":["../../src/tools/threat-get-capsule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;;;;;mIASqF,CAAC;AAEpI,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,CACP,uGAAuG,CACxG;CACJ,CAAC;AAEF,MAAM,UAAU,6BAA6B;IAC3C,OAAO,KAAK,EAAE,MAA8B,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;QAEtC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,kBAAkB,CACvB,YAAY,MAAM,CAAC,UAAU,uBAAuB,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,EACnI;gBACE;oBACE,EAAE,EAAE,8BAA8B;oBAClC,KAAK,EAAE,mDAAmD;oBAC1D,IAAI,EAAE,qCAAqC;oBAC3C,GAAG,EAAE,8DAA8D;iBACpE;aACF,EACD,uCAAuC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC;QACJ,CAAC;QAED,OAAO,aAAa,CAClB;YACE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE;YACvE,OAAO;SACR,EACD,OAAO,CAAC,qBAAqB;YAC3B,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,sBAAsB;oBAC1B,KAAK,EAAE,2DAA2D;oBAClE,IAAI,EAAE,mCAAmC;oBACzC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;oBACrC,GAAG,EAAE,iGAAiG;iBACvG;aACF;YACH,CAAC,CAAC,EAAE,EACN,WAAW,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,iBAAiB,IAAI,kBAAkB,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CACnK,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/threat-get-inference-prompt.d.ts

@@ -0,0 +1,32 @@
+/**
+ * zivis_threat_get_inference_prompt — return the prompt bundle for a capsule's
+ * INFER strategy so the host LLM can run local inference.
+ *
+ * MCP servers cannot invoke the customer's LLM. The host (Cursor, Claude Code)
+ * runs the model. This tool returns:
+ *   - the prompt template (markdown)
+ *   - the capsule's expected_output_schema
+ *   - the capsule's safe_summary as ambient context
+ *   - guidance on which evidence spans the host should attach
+ *
+ * The host LLM consumes the bundle, gathers code spans per minimum_context_required,
+ * runs the inference, and returns structured JSON. That JSON enters the
+ * `inferred` lane until promoted to `trusted` per the platform's promotion policy.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 2A)
+ */
+import { z } from "zod";
+export declare const THREAT_GET_INFERENCE_PROMPT_NAME = "zivis_threat_get_inference_prompt";
+export declare const THREAT_GET_INFERENCE_PROMPT_DESCRIPTION = "Return the prompt bundle for the host LLM to run local inference for a capsule.\n\nZIVIS doesn't run an LLM itself \u2014 the host (Cursor, Claude Code, etc.) does. This tool returns the prompt template + structured output schema + ambient capsule context so the host model can run the inference and produce JSON the inferred lane accepts.\n\nUse this when:\n- After zivis_threat_get_capsule, the user wants the host LLM to actually evaluate whether the pattern is present in the code\n- The user says \"go check if my code does this\" / \"is this pattern actually in my repo\"\n- The matcher emits an INFER candidate that needs host-LLM evaluation\n\nThe bundle includes:\n- prompt: the markdown inference prompt\n- expected_output_schema: JSON Schema for the structured response\n- safe_summary: ambient capsule context\n- minimum_context_required: hint to the host for how much code to attach\n- evidence_focus: spans the deterministic strategies already flagged\n\nThe host LLM is expected to gather the indicated code spans, fill in the prompt, return JSON matching the schema. That output then flows back into the inferred lane.";
+export declare const THREAT_GET_INFERENCE_PROMPT_SCHEMA: {
+    capsule_id: z.ZodString;
+};
+export declare function createThreatGetInferencePromptHandler(): (params: {
+    capsule_id: string;
+}) => Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;