@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.4

package/dist/tools/inspect.js

@@ -1,222 +0,0 @@
-import { z } from "zod";
-import * as fs from "node:fs/promises";
-import * as fssync from "node:fs";
-import * as path from "node:path";
-import { spawn } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { detectProjectBinding } from "../project-binding.js";
-import { runMatcher } from "../matcher/index.js";
-import { buildInferenceBundle } from "../matcher/inference-candidates.js";
-import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
-export const INSPECT_NAME = "zivis_inspect";
-export const INSPECT_DESCRIPTION = `Build a local repo graph and run the local pattern matcher to emit threat-model findings. The threat-model-first conversion event.
-
-Prefer zivis_get_started or zivis_threat_guide first — they read the local inspect cache and only call this tool when a fresh artifact is missing. Calling zivis_inspect directly always re-runs (no idempotency at this layer); reach for it when the user explicitly says "re-inspect" / "rebuild the graph" / "/inspect" or when an entry tool tells you to.
-
-Use this when the user says any of:
-- "model this app" / "threat model this repo"
-- "what should we be worried about in this code"
-- "set up security for this project" (after auth/binding is done)
-- "/inspect"
-
-What it does, all locally (no source code leaves the machine):
-  1. Spawns 'zivis inspect' to walk the repo and produce a typed graph artifact
-     (services, endpoints, external dependencies; auth boundaries + dataflow are Phase 1.5)
-  2. Runs the local matcher against the public pattern pack:
-     - AST strategies fire via @ast-grep/napi for TS/JS/Python/Go
-     - META strategies fire via the controls library (when no defending control is present)
-     - INFER strategies emit candidates the host LLM picks up via zivis_threat_get_inference_prompt
-  3. Returns normalized findings with lane (trusted/inferred), confidence, and evidence spans
-
-Trusted-lane findings are evidence-backed (deterministic strategies fired) and ready for the threat model. Inferred-lane findings need host-LLM confirmation via zivis_threat_get_inference_prompt before promotion. Proprietary platform-side eval (Phase 4 cloud upload) and trust-promoted aggregation are separate steps.
-
-This is the conversion moment for the threat-model-first sidekick — the user sees specific patterns naming specific files in their repo, in their IDE, in under 30 seconds.`;
-export const INSPECT_SCHEMA = {
-    cwd: z
-        .string()
-        .optional()
-        .describe("Working directory to inspect (defaults to server working directory)."),
-    application_id: z
-        .string()
-        .optional()
-        .describe("Target application id. If omitted, /inspect resolves it from the project binding. " +
-        "Required if the binding is ambiguous or maps to multiple applications."),
-    skip_matcher: z
-        .boolean()
-        .optional()
-        .describe("If true, only build the graph artifact; do not run the matcher. Default: false (matcher runs)."),
-};
-export function createInspectHandler(_apiClient, _config) {
-    return async (params) => {
-        const cwd = params.cwd || process.cwd();
-        const detected = detectProjectBinding(cwd);
-        if (!detected) {
-            return withNextStepsError("No .zivis/project.json found for this directory. /inspect needs a project binding so the resulting threat model attaches to the correct application and org.", [
-                {
-                    id: "run_auth_init",
-                    label: "Connect this project to your ZIVIS org",
-                    tool: "zivis_check_project",
-                    why: "Run 'zivis auth init' or 'zivis auth login' to create the binding, then re-run /inspect.",
-                },
-            ], "Project not bound — run zivis auth login then re-run /inspect.");
-        }
-        let inspectStderr = "";
-        let artifactPath;
-        try {
-            const result = await spawnInspect(cwd, params.application_id ?? detected.binding.applicationId);
-            inspectStderr = result.stderr;
-            artifactPath = parseArtifactPath(result.stderr);
-        }
-        catch (err) {
-            return withNextStepsError(`Could not run 'zivis inspect': ${err.message}`, [
-                {
-                    id: "install_cli",
-                    label: "Install the ZIVIS CLI globally",
-                    tool: "zivis_inspect",
-                    why: "Inspect needs the 'zivis' CLI on PATH (or set ZIVIS_CLI_BIN). pnpm add -g @zivis/cli.",
-                },
-            ], "Install or surface the ZIVIS CLI binary, then retry.");
-        }
-        if (!artifactPath) {
-            return withNextStepsError(`'zivis inspect' completed but no artifact path was reported. stderr tail:\n${inspectStderr.slice(-500)}`, [], "Inspect ran but produced no artifact path; check the CLI output.");
-        }
-        if (params.skip_matcher) {
-            return withNextSteps({
-                status: "graph_only",
-                binding: {
-                    orgName: detected.binding.orgName,
-                    workosOrgId: detected.binding.workosOrgId,
-                    applicationId: params.application_id ?? detected.binding.applicationId ?? null,
-                },
-                artifact_path: artifactPath,
-                inspect_stderr_tail: inspectStderr.split("\n").slice(-6).join("\n"),
-            }, [
-                {
-                    id: "run_matcher_now",
-                    label: "Run the matcher against this artifact",
-                    tool: "zivis_threat_run_matcher",
-                    why: "Emit the threat findings deterministic + inference strategies produce.",
-                },
-            ], "Graph artifact built; matcher skipped per request.");
-        }
-        const matcherResult = await runMatcher({ artifactPath, cwd });
-        const inferenceBundle = await buildInferenceBundle(matcherResult.findings);
-        const headline = matcherResult.summary.total === 0
-            ? `Inspected ${matcherResult.ast_files_scanned} files. No public-pack threat patterns fired against this repo.`
-            : `Inspected ${matcherResult.ast_files_scanned} files. Found ${matcherResult.summary.total} threat${matcherResult.summary.total === 1 ? "" : "s"} (${matcherResult.summary.trusted_count} trusted, ${matcherResult.summary.inferred_count} inferred). ` +
-                (inferenceBundle.inference_candidates.length > 0
-                    ? `IMPORTANT: ${inferenceBundle.inference_candidates.length} inference_candidate${inferenceBundle.inference_candidates.length === 1 ? "" : "s"} require host-side execution before findings are presented to the user — see host_required_action.`
-                    : "");
-        return withNextSteps({
-            status: "complete",
-            binding: {
-                orgName: detected.binding.orgName,
-                workosOrgId: detected.binding.workosOrgId,
-                applicationId: params.application_id ?? detected.binding.applicationId ?? null,
-            },
-            artifact_path: artifactPath,
-            matcher: matcherResult,
-            host_required_action: inferenceBundle.host_required_action,
-            inference_candidates: inferenceBundle.inference_candidates,
-            boundary: {
-                local_only: "Repo walk, graph IR construction, public-pack matching, and inference candidate emission all run on this machine. Inference EXECUTION is by your IDE host model (Mode A); no LLM is invoked by ZIVIS itself.",
-                sent_to_platform: "Nothing yet — proprietary platform-side evaluation (Phase 4) ships graph features + match candidates, not raw source.",
-                stays_on_platform: "Proprietary pattern definitions and final scoring logic.",
-            },
-        }, matcherResult.summary.trusted_count > 0
-            ? [
-                {
-                    id: "review_trusted_findings",
-                    label: `Review the ${matcherResult.summary.trusted_count} trusted-lane finding${matcherResult.summary.trusted_count === 1 ? "" : "s"}`,
-                    tool: "zivis_threat_get_capsule",
-                    why: "Trusted findings are evidence-backed and ready to land in the threat model. Pull each capsule for the full threat narrative + repair contract.",
-                },
-                ...(matcherResult.summary.inferred_count > 0
-                    ? [
-                        {
-                            id: "host_runs_inference",
-                            label: `Confirm the ${matcherResult.summary.inferred_count} inferred-lane finding${matcherResult.summary.inferred_count === 1 ? "" : "s"} via your model`,
-                            tool: "zivis_threat_get_inference_prompt",
-                            why: "Inferred findings need host-LLM confirmation. Pull the prompt bundle, run inference, and the JSON output enters the inferred lane until promotion.",
-                        },
-                    ]
-                    : []),
-            ]
-            : matcherResult.summary.inferred_count > 0
-                ? [
-                    {
-                        id: "host_runs_inference",
-                        label: `Confirm the ${matcherResult.summary.inferred_count} inferred-lane finding${matcherResult.summary.inferred_count === 1 ? "" : "s"} via your model`,
-                        tool: "zivis_threat_get_inference_prompt",
-                        why: "Inferred findings need host-LLM confirmation before they can land in the threat model.",
-                    },
-                ]
-                : [
-                    {
-                        id: "expand_via_platform",
-                        label: "Public pack found nothing — proprietary patterns evaluated server-side may still apply",
-                        tool: "zivis_inspect",
-                        why: "Phase 4 sends the artifact to the platform for proprietary pattern evaluation; that path is queued.",
-                    },
-                ], headline);
-    };
-}
-async function spawnInspect(cwd, applicationId) {
-    const bin = await findZivisCliBin();
-    const args = ["inspect", "--root", cwd];
-    if (applicationId) {
-        args.push("--application", applicationId);
-    }
-    return new Promise((resolve, reject) => {
-        const child = spawn(bin.command, [...bin.prefixArgs, ...args], { cwd });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.on("data", (d) => (stdout += d.toString()));
-        child.stderr.on("data", (d) => (stderr += d.toString()));
-        child.on("error", (err) => reject(err));
-        child.on("close", (code) => {
-            if (code !== 0) {
-                reject(new Error(`zivis inspect exited ${code}\n${stderr.slice(-500)}`));
-                return;
-            }
-            resolve({ stdout, stderr, code: code ?? 0 });
-        });
-    });
-}
-async function findZivisCliBin() {
-    const envBin = process.env.ZIVIS_CLI_BIN;
-    if (envBin) {
-        if (fssync.existsSync(envBin)) {
-            return { command: process.execPath, prefixArgs: [envBin] };
-        }
-        throw new Error(`ZIVIS_CLI_BIN points to ${envBin} which does not exist`);
-    }
-    const sibling = await tryResolveZivisCli();
-    if (sibling) {
-        return { command: process.execPath, prefixArgs: [sibling] };
-    }
-    return { command: "zivis", prefixArgs: [] };
-}
-async function tryResolveZivisCli() {
-    try {
-        const here = path.dirname(fileURLToPath(import.meta.url));
-        const candidates = [
-            path.resolve(here, "../../../zivis-cli/dist/index.js"),
-            path.resolve(here, "../../node_modules/@zivis/cli/dist/index.js"),
-            path.resolve(here, "../../../node_modules/@zivis/cli/dist/index.js"),
-        ];
-        for (const c of candidates) {
-            if (fssync.existsSync(c))
-                return c;
-        }
-    }
-    catch {
-    }
-    return undefined;
-}
-function parseArtifactPath(stderr) {
-    const match = stderr.match(/wrote\s+(\S+\.json)/);
-    return match?.[1];
-}
-void parseArtifactPath;
-void fs;

package/dist/tools/manage-application.d.ts

@@ -1,64 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../api-client.js";
-export declare const MANAGE_APPLICATION_NAME = "zivis_manage_application";
-export declare const MANAGE_APPLICATION_DESCRIPTION = "Create, update, or delete a target application.\n\nActions:\n- create: requires at least name, base_url, auth_type\n- update: patch an existing application (requires application_id)\n- delete: remove an application (requires application_id)";
-export declare const MANAGE_APPLICATION_SCHEMA: {
-    action: z.ZodEnum<{
-        create: "create";
-        update: "update";
-        delete: "delete";
-    }>;
-    application_id: z.ZodOptional<z.ZodString>;
-    name: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
-    base_url: z.ZodOptional<z.ZodString>;
-    api_url: z.ZodOptional<z.ZodString>;
-    auth_type: z.ZodOptional<z.ZodEnum<{
-        none: "none";
-        oauth_pkce: "oauth_pkce";
-        static_token: "static_token";
-        client_credentials: "client_credentials";
-        bearer_refresh: "bearer_refresh";
-    }>>;
-    has_rag: z.ZodOptional<z.ZodBoolean>;
-    has_tools: z.ZodOptional<z.ZodBoolean>;
-    has_memory: z.ZodOptional<z.ZodBoolean>;
-    is_multi_turn: z.ZodOptional<z.ZodBoolean>;
-    system_context: z.ZodOptional<z.ZodString>;
-    type: z.ZodOptional<z.ZodEnum<{
-        api: "api";
-        chat: "chat";
-        sse: "sse";
-        validation: "validation";
-        web: "web";
-    }>>;
-    use_ephemeral_creds: z.ZodOptional<z.ZodBoolean>;
-};
-export declare function createManageApplicationHandler(apiClient: ApiClient): (params: {
-    action: "create" | "update" | "delete";
-    application_id?: string;
-    name?: string;
-    description?: string;
-    base_url?: string;
-    api_url?: string;
-    auth_type?: "none" | "oauth_pkce" | "static_token" | "client_credentials" | "bearer_refresh";
-    has_rag?: boolean;
-    has_tools?: boolean;
-    has_memory?: boolean;
-    is_multi_turn?: boolean;
-    system_context?: string;
-    type?: "api" | "chat" | "sse" | "validation" | "web";
-    use_ephemeral_creds?: boolean;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: boolean;
-} | {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError?: undefined;
-}>;

package/dist/tools/manage-application.js

@@ -1,129 +0,0 @@
-import { z } from "zod";
-import { requireApplicationId } from "../resolve-application-id.js";
-import { sanitizeResponse } from "../sanitize.js";
-export const MANAGE_APPLICATION_NAME = "zivis_manage_application";
-export const MANAGE_APPLICATION_DESCRIPTION = `Create, update, or delete a target application.
-
-Actions:
-- create: requires at least name, base_url, auth_type
-- update: patch an existing application (requires application_id)
-- delete: remove an application (requires application_id)`;
-export const MANAGE_APPLICATION_SCHEMA = {
-    action: z.enum(["create", "update", "delete"]).describe("CRUD action"),
-    application_id: z
-        .string()
-        .optional()
-        .describe("Required for update/delete. Optional for create."),
-    name: z.string().optional().describe("Application name"),
-    description: z.string().optional().describe("Application description"),
-    base_url: z.string().optional().describe("Base URL, e.g. https://api.example.com"),
-    api_url: z.string().optional().describe("Explicit API URL"),
-    auth_type: z
-        .enum(["none", "oauth_pkce", "static_token", "client_credentials", "bearer_refresh"])
-        .optional()
-        .describe("Application auth type (required for create)"),
-    has_rag: z.boolean().optional().describe("LLM capability flag"),
-    has_tools: z.boolean().optional().describe("LLM capability flag"),
-    has_memory: z.boolean().optional().describe("LLM capability flag"),
-    is_multi_turn: z.boolean().optional().describe("LLM capability flag"),
-    system_context: z.string().optional().describe("System context/prompt context"),
-    type: z
-        .enum(["api", "chat", "sse", "validation", "web"])
-        .optional()
-        .describe("Application type"),
-    use_ephemeral_creds: z
-        .boolean()
-        .optional()
-        .describe("Whether ephemeral credentials are enabled"),
-};
-export function createManageApplicationHandler(apiClient) {
-    return async (params) => {
-        try {
-            const { action } = params;
-            let data;
-            if (action === "create") {
-                if (!params.name || !params.base_url || !params.auth_type) {
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: "Error: create requires name, base_url, and auth_type",
-                            },
-                        ],
-                        isError: true,
-                    };
-                }
-                data = await apiClient.post("/api/rt/applications", {
-                    name: params.name,
-                    description: params.description,
-                    baseUrl: params.base_url,
-                    apiUrl: params.api_url,
-                    authType: params.auth_type,
-                    hasRag: params.has_rag,
-                    hasTools: params.has_tools,
-                    hasMemory: params.has_memory,
-                    isMultiTurn: params.is_multi_turn,
-                    systemContext: params.system_context,
-                    type: params.type,
-                    useEphemeralCreds: params.use_ephemeral_creds,
-                });
-            }
-            else {
-                const req = requireApplicationId(params.application_id);
-                if (!req.ok) {
-                    return {
-                        content: [{ type: "text", text: `Error: ${req.message}` }],
-                        isError: true,
-                    };
-                }
-                if (action === "delete") {
-                    data = await apiClient.del(`/api/rt/applications/${req.id}`);
-                }
-                else {
-                    const body = {};
-                    if (params.name !== undefined)
-                        body.name = params.name;
-                    if (params.description !== undefined)
-                        body.description = params.description;
-                    if (params.base_url !== undefined)
-                        body.baseUrl = params.base_url;
-                    if (params.api_url !== undefined)
-                        body.apiUrl = params.api_url;
-                    if (params.auth_type !== undefined)
-                        body.authType = params.auth_type;
-                    if (params.has_rag !== undefined)
-                        body.hasRag = params.has_rag;
-                    if (params.has_tools !== undefined)
-                        body.hasTools = params.has_tools;
-                    if (params.has_memory !== undefined)
-                        body.hasMemory = params.has_memory;
-                    if (params.is_multi_turn !== undefined)
-                        body.isMultiTurn = params.is_multi_turn;
-                    if (params.system_context !== undefined)
-                        body.systemContext = params.system_context;
-                    if (params.type !== undefined)
-                        body.type = params.type;
-                    if (params.use_ephemeral_creds !== undefined) {
-                        body.useEphemeralCreds = params.use_ephemeral_creds;
-                    }
-                    data = await apiClient.patch(`/api/rt/applications/${req.id}`, body);
-                }
-            }
-            const sanitized = sanitizeResponse({
-                action,
-                application_id: params.application_id,
-                result: data,
-            });
-            return {
-                content: [{ type: "text", text: JSON.stringify(sanitized, null, 2) }],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to manage application";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}

package/dist/tools/manage-endpoint-lifecycle.d.ts

@@ -1,80 +0,0 @@
-import { z } from "zod";
-import type { ApiClient } from "../api-client.js";
-export declare const MANAGE_ENDPOINT_LIFECYCLE_NAME = "zivis_manage_endpoint_lifecycle";
-export declare const MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION = "Manage endpoint lifecycle for an application.\n\nActions:\n- create: create a single endpoint\n- update: patch an endpoint\n- delete: delete a single endpoint\n- bulk_delete: delete endpoints by source (e.g., openapi)\n- import_openapi: import endpoints from an OpenAPI spec";
-export declare const MANAGE_ENDPOINT_LIFECYCLE_SCHEMA: {
-    application_id: z.ZodOptional<z.ZodString>;
-    action: z.ZodEnum<{
-        create: "create";
-        update: "update";
-        delete: "delete";
-        bulk_delete: "bulk_delete";
-        import_openapi: "import_openapi";
-    }>;
-    endpoint_id: z.ZodOptional<z.ZodString>;
-    path: z.ZodOptional<z.ZodString>;
-    method: z.ZodOptional<z.ZodEnum<{
-        POST: "POST";
-        GET: "GET";
-        PATCH: "PATCH";
-        DELETE: "DELETE";
-        PUT: "PUT";
-        HEAD: "HEAD";
-        OPTIONS: "OPTIONS";
-    }>>;
-    summary: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
-    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    auth_required: z.ZodOptional<z.ZodBoolean>;
-    deprecated: z.ZodOptional<z.ZodBoolean>;
-    endpoint_type: z.ZodOptional<z.ZodEnum<{
-        api: "api";
-        chat: "chat";
-        sse: "sse";
-        validation: "validation";
-        web: "web";
-    }>>;
-    request_template: z.ZodOptional<z.ZodString>;
-    response_path: z.ZodOptional<z.ZodString>;
-    streaming_enabled: z.ZodOptional<z.ZodBoolean>;
-    source: z.ZodOptional<z.ZodEnum<{
-        openapi: "openapi";
-        manual: "manual";
-        discovery: "discovery";
-    }>>;
-    spec_url: z.ZodOptional<z.ZodString>;
-    spec_content: z.ZodOptional<z.ZodString>;
-    replace_existing: z.ZodOptional<z.ZodBoolean>;
-};
-export declare function createManageEndpointLifecycleHandler(apiClient: ApiClient): (params: {
-    application_id?: string;
-    action: "create" | "update" | "delete" | "bulk_delete" | "import_openapi";
-    endpoint_id?: string;
-    path?: string;
-    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
-    summary?: string;
-    description?: string;
-    tags?: string[];
-    auth_required?: boolean;
-    deprecated?: boolean;
-    endpoint_type?: "api" | "chat" | "sse" | "validation" | "web";
-    request_template?: string;
-    response_path?: string;
-    streaming_enabled?: boolean;
-    source?: "openapi" | "manual" | "discovery";
-    spec_url?: string;
-    spec_content?: string;
-    replace_existing?: boolean;
-}) => Promise<{
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: boolean;
-} | {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError?: undefined;
-}>;

package/dist/tools/manage-endpoint-lifecycle.js

@@ -1,180 +0,0 @@
-import { z } from "zod";
-import { requireApplicationId } from "../resolve-application-id.js";
-import { sanitizeResponse } from "../sanitize.js";
-export const MANAGE_ENDPOINT_LIFECYCLE_NAME = "zivis_manage_endpoint_lifecycle";
-export const MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION = `Manage endpoint lifecycle for an application.
-
-Actions:
-- create: create a single endpoint
-- update: patch an endpoint
-- delete: delete a single endpoint
-- bulk_delete: delete endpoints by source (e.g., openapi)
-- import_openapi: import endpoints from an OpenAPI spec`;
-export const MANAGE_ENDPOINT_LIFECYCLE_SCHEMA = {
-    application_id: z
-        .string()
-        .optional()
-        .describe("Application UUID. If omitted, uses applicationId from .zivis/project.json when set."),
-    action: z
-        .enum(["create", "update", "delete", "bulk_delete", "import_openapi"])
-        .describe("Endpoint lifecycle action"),
-    endpoint_id: z.string().optional().describe("Required for update/delete actions"),
-    path: z.string().optional().describe("Endpoint path, e.g. /api/chat"),
-    method: z
-        .enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"])
-        .optional()
-        .describe("HTTP method"),
-    summary: z.string().optional().describe("Endpoint summary"),
-    description: z.string().optional().describe("Endpoint description"),
-    tags: z.array(z.string()).optional().describe("Endpoint tags"),
-    auth_required: z.boolean().optional().describe("Whether auth is required"),
-    deprecated: z.boolean().optional().describe("Whether endpoint is deprecated"),
-    endpoint_type: z
-        .enum(["api", "chat", "sse", "validation", "web"])
-        .optional()
-        .describe("Endpoint type"),
-    request_template: z
-        .string()
-        .optional()
-        .describe("AI request template, usually includes {{message}}"),
-    response_path: z
-        .string()
-        .optional()
-        .describe("JSON path to pull response text"),
-    streaming_enabled: z.boolean().optional().describe("Whether streaming is enabled"),
-    source: z
-        .enum(["openapi", "manual", "discovery"])
-        .optional()
-        .describe("Source filter for bulk_delete"),
-    spec_url: z.string().optional().describe("OpenAPI spec URL for import_openapi"),
-    spec_content: z.string().optional().describe("Raw OpenAPI spec content"),
-    replace_existing: z
-        .boolean()
-        .optional()
-        .describe("When import_openapi, remove previous openapi endpoints first"),
-};
-export function createManageEndpointLifecycleHandler(apiClient) {
-    return async (params) => {
-        const req = requireApplicationId(params.application_id);
-        if (!req.ok) {
-            return {
-                content: [{ type: "text", text: `Error: ${req.message}` }],
-                isError: true,
-            };
-        }
-        const applicationId = req.id;
-        const action = params.action;
-        try {
-            let data;
-            if (action === "create") {
-                if (!params.path || !params.method) {
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: "Error: create requires path and method",
-                            },
-                        ],
-                        isError: true,
-                    };
-                }
-                data = await apiClient.post(`/api/rt/applications/${applicationId}/endpoints`, {
-                    path: params.path,
-                    method: params.method,
-                    summary: params.summary,
-                    description: params.description,
-                    tags: params.tags,
-                    authRequired: params.auth_required,
-                    deprecated: params.deprecated,
-                    endpointType: params.endpoint_type,
-                    requestTemplate: params.request_template,
-                    responsePath: params.response_path,
-                    streamingEnabled: params.streaming_enabled,
-                });
-            }
-            else if (action === "update") {
-                if (!params.endpoint_id) {
-                    return {
-                        content: [
-                            { type: "text", text: "Error: endpoint_id is required for update" },
-                        ],
-                        isError: true,
-                    };
-                }
-                const body = {};
-                if (params.path !== undefined)
-                    body.path = params.path;
-                if (params.method !== undefined)
-                    body.method = params.method;
-                if (params.summary !== undefined)
-                    body.summary = params.summary;
-                if (params.description !== undefined)
-                    body.description = params.description;
-                if (params.tags !== undefined)
-                    body.tags = params.tags;
-                if (params.auth_required !== undefined)
-                    body.authRequired = params.auth_required;
-                if (params.deprecated !== undefined)
-                    body.deprecated = params.deprecated;
-                if (params.endpoint_type !== undefined)
-                    body.endpointType = params.endpoint_type;
-                if (params.request_template !== undefined)
-                    body.requestTemplate = params.request_template;
-                if (params.response_path !== undefined)
-                    body.responsePath = params.response_path;
-                if (params.streaming_enabled !== undefined) {
-                    body.streamingEnabled = params.streaming_enabled;
-                }
-                data = await apiClient.patch(`/api/rt/applications/${applicationId}/endpoints/${params.endpoint_id}`, body);
-            }
-            else if (action === "delete") {
-                if (!params.endpoint_id) {
-                    return {
-                        content: [
-                            { type: "text", text: "Error: endpoint_id is required for delete" },
-                        ],
-                        isError: true,
-                    };
-                }
-                data = await apiClient.del(`/api/rt/applications/${applicationId}/endpoints/${params.endpoint_id}`);
-            }
-            else if (action === "bulk_delete") {
-                if (!params.source) {
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: "Error: source is required for bulk_delete (openapi/manual/discovery)",
-                            },
-                        ],
-                        isError: true,
-                    };
-                }
-                data = await apiClient.del(`/api/rt/applications/${applicationId}/endpoints?source=${encodeURIComponent(params.source)}`);
-            }
-            else {
-                data = await apiClient.post(`/api/rt/applications/${applicationId}/endpoints/import-openapi`, {
-                    specUrl: params.spec_url,
-                    specContent: params.spec_content,
-                    replaceExisting: params.replace_existing ?? false,
-                });
-            }
-            const sanitized = sanitizeResponse({
-                action,
-                application_id: applicationId,
-                endpoint_id: params.endpoint_id,
-                result: data,
-            });
-            return {
-                content: [{ type: "text", text: JSON.stringify(sanitized, null, 2) }],
-            };
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Failed to manage endpoint lifecycle";
-            return {
-                content: [{ type: "text", text: `Error: ${message}` }],
-                isError: true,
-            };
-        }
-    };
-}