@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.4

package/dist/server.js

@@ -1,76 +1,98 @@
+/**
+ * MCP Server
+ *
+ * Sets up the Model Context Protocol server using the official SDK
+ * with stdio transport. Registers all ZIVIS security tools.
+ *
+ * IMPORTANT: This server communicates over stdout (JSON-RPC 2.0).
+ * Never use console.log() — use console.error() for all logging.
+ */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { ApiClient } from "./api-client.js";
 import { resolveAuth } from "./auth/index.js";
-import { detectProjectBinding, resolveConfigFromBinding, resolveMcpSessionForWorkspace, validateProjectBinding, } from "./project-binding.js";
+import { decodeJwtPayload } from "./auth/jwt.js";
+import { loadTokens } from "./auth/token-refresh.js";
+import { detectProjectBinding, validateProjectBinding } from "./project-binding.js";
 import { DEFAULT_CONFIG } from "./types.js";
-async function validateApiKeyMatchesBinding(binding, config) {
+/**
+ * Validate that the stored JWT's org matches the project binding's expected org.
+ * This prevents cross-org data leaks when a user is a member of multiple orgs.
+ *
+ * The JWT org_id is the WorkOS org ID. The project binding stores both the
+ * Zivis org UUID (orgId) and the WorkOS org ID (workosOrgId).
+ */
+async function validateJwtOrgBinding(binding, config) {
     if (!binding.workosOrgId) {
-        console.error("[zivis] WARNING: Project binding has no workosOrgId — cannot verify API key org scope.");
+        // No WorkOS org ID in binding — can't validate. Log warning but don't block.
+        console.error("[zivis] WARNING: Project binding has no workosOrgId — cannot verify JWT org scope.");
         console.error("[zivis] Run: zivis auth init --session <session> --org-id <zivis-uuid> --workos-org-id <workos-org-id>");
         return;
     }
-    const creds = await resolveAuth(config, "apikey");
-    if (creds.method !== "apikey" || !creds.apiKey) {
-        console.error("[zivis] INTERNAL: org verification skipped — no API key (session gate should have prevented this)");
+    const tokens = await loadTokens(config.session);
+    if (!tokens)
+        return; // No tokens stored yet — will fail at session check
+    const payload = decodeJwtPayload(tokens.access_token);
+    if (!payload) {
+        console.error("[zivis] WARNING: Could not decode JWT — cannot verify org scope");
         return;
     }
-    let response;
-    try {
-        response = await fetch(`${config.apiBaseUrl}/api/mcp/session`, {
-            headers: {
-                "X-API-Key": creds.apiKey,
-                "User-Agent": "@zivis/mcp",
-            },
-        });
-    }
-    catch (err) {
-        console.error(`[zivis] WARNING: Could not reach API to verify org (${err instanceof Error ? err.message : err})`);
-        return;
-    }
-    if (!response.ok) {
-        const body = await response.text().catch(() => "");
-        console.error(`[zivis] WARNING: API key org probe failed (${response.status}): ${body.slice(0, 200)}`);
+    const jwtOrgId = payload.org_id;
+    if (!jwtOrgId) {
+        console.error("[zivis] WARNING: JWT has no org_id claim — cannot verify org scope");
         return;
     }
-    const payload = (await response.json());
-    const resolved = payload.org?.workosOrgId;
-    if (resolved !== binding.workosOrgId) {
+    if (jwtOrgId !== binding.workosOrgId) {
         const orgLabel = binding.orgName ? ` (${binding.orgName})` : "";
-        console.error("[zivis] SECURITY ERROR: API key org does not match project binding!");
-        console.error(`[zivis]   API resolved WorkOS org: ${resolved ?? "missing"}`);
-        console.error(`[zivis]   Binding expects org:      ${binding.workosOrgId}${orgLabel}`);
+        console.error("[zivis] SECURITY ERROR: JWT org does not match project binding!");
+        console.error(`[zivis]   JWT org_id:      ${jwtOrgId}`);
+        console.error(`[zivis]   Expected org_id: ${binding.workosOrgId}${orgLabel}`);
         console.error("");
         console.error("[zivis] This prevents cross-org data leaks.");
-        console.error(`[zivis] Mint a binding token for this repo's org:`);
-        console.error(`[zivis]   zivis auth bind`);
+        console.error(`[zivis] Fix: Re-login for this project's org:`);
+        console.error(`[zivis]   zivis auth login --session ${config.session || "default"}`);
         process.exit(1);
     }
-    console.error(`[zivis] API key org verified: ${resolved}${binding.orgName ? ` (${binding.orgName})` : ""}`);
+    console.error(`[zivis] JWT org verified: ${jwtOrgId}${binding.orgName ? ` (${binding.orgName})` : ""}`);
 }
-import { registerAllPrompts } from "./prompts/index.js";
-import { GET_STARTED_NAME, GET_STARTED_DESCRIPTION, GET_STARTED_SCHEMA, createGetStartedHandler, } from "./tools/get-started.js";
-import { INSPECT_NAME, INSPECT_DESCRIPTION, INSPECT_SCHEMA, createInspectHandler, } from "./tools/inspect.js";
-import { THREAT_GUIDE_NAME, THREAT_GUIDE_DESCRIPTION, THREAT_GUIDE_SCHEMA, createThreatGuideHandler, } from "./tools/threat-guide.js";
-import { THREAT_LIST_RELEVANT_CAPSULES_NAME, THREAT_LIST_RELEVANT_CAPSULES_DESCRIPTION, THREAT_LIST_RELEVANT_CAPSULES_SCHEMA, createThreatListRelevantCapsulesHandler, } from "./tools/threat-list-relevant-capsules.js";
-import { THREAT_GET_CAPSULE_NAME, THREAT_GET_CAPSULE_DESCRIPTION, THREAT_GET_CAPSULE_SCHEMA, createThreatGetCapsuleHandler, } from "./tools/threat-get-capsule.js";
-import { THREAT_GET_INFERENCE_PROMPT_NAME, THREAT_GET_INFERENCE_PROMPT_DESCRIPTION, THREAT_GET_INFERENCE_PROMPT_SCHEMA, createThreatGetInferencePromptHandler, } from "./tools/threat-get-inference-prompt.js";
-import { THREAT_RUN_MATCHER_NAME, THREAT_RUN_MATCHER_DESCRIPTION, THREAT_RUN_MATCHER_SCHEMA, createThreatRunMatcherHandler, } from "./tools/threat-run-matcher.js";
+// Tools — Findings
+import { GET_FINDINGS_NAME, GET_FINDINGS_DESCRIPTION, GET_FINDINGS_SCHEMA, createGetFindingsHandler, } from "./tools/get-findings.js";
+import { GET_FINDING_DETAILS_NAME, GET_FINDING_DETAILS_DESCRIPTION, GET_FINDING_DETAILS_SCHEMA, createGetFindingDetailsHandler, } from "./tools/get-finding-details.js";
+import { TRIAGE_FINDING_NAME, TRIAGE_FINDING_DESCRIPTION, TRIAGE_FINDING_SCHEMA, createTriageFindingHandler, } from "./tools/triage-finding.js";
+// Tools — Scans & Artifacts
+import { LIST_SCANS_NAME, LIST_SCANS_DESCRIPTION, LIST_SCANS_SCHEMA, createListScansHandler, } from "./tools/list-scans.js";
+import { LIST_RECON_SCANS_NAME, LIST_RECON_SCANS_DESCRIPTION, LIST_RECON_SCANS_SCHEMA, createListReconScansHandler, } from "./tools/list-recon-scans.js";
+import { GET_RECON_SCAN_NAME, GET_RECON_SCAN_DESCRIPTION, GET_RECON_SCAN_SCHEMA, createGetReconScanHandler, } from "./tools/get-recon-scan.js";
+import { GET_SCAN_OUTPUT_NAME, GET_SCAN_OUTPUT_DESCRIPTION, GET_SCAN_OUTPUT_SCHEMA, createGetScanOutputHandler, } from "./tools/get-scan-output.js";
+import { GET_TEST_CASE_RESULTS_NAME, GET_TEST_CASE_RESULTS_DESCRIPTION, GET_TEST_CASE_RESULTS_SCHEMA, createGetTestCaseResultsHandler, } from "./tools/get-test-case-results.js";
+import { GET_AGENT_TEST_RESULTS_NAME, GET_AGENT_TEST_RESULTS_DESCRIPTION, GET_AGENT_TEST_RESULTS_SCHEMA, createGetAgentTestResultsHandler, } from "./tools/get-agent-test-results.js";
+import { LIST_SCAN_ARTIFACTS_NAME, LIST_SCAN_ARTIFACTS_DESCRIPTION, LIST_SCAN_ARTIFACTS_SCHEMA, createListScanArtifactsHandler, } from "./tools/list-scan-artifacts.js";
+import { GET_ARTIFACT_CONTENT_NAME, GET_ARTIFACT_CONTENT_DESCRIPTION, GET_ARTIFACT_CONTENT_SCHEMA, createGetArtifactContentHandler, } from "./tools/get-artifact-content.js";
+// Tools — PR Safety
+import { SCAN_PR_NAME, SCAN_PR_DESCRIPTION, SCAN_PR_SCHEMA, createScanPrHandler, } from "./tools/scan-pr.js";
+// Tools — OSS Trust
 import { CHECK_REPO_TRUST_NAME, CHECK_REPO_TRUST_DESCRIPTION, CHECK_REPO_TRUST_SCHEMA, createCheckRepoTrustHandler, } from "./tools/check-repo-trust.js";
+// Tools — ZAT & Trust Verification (public)
 import { GET_OSS_ZAT_NAME, GET_OSS_ZAT_DESCRIPTION, GET_OSS_ZAT_SCHEMA, createGetOssZatHandler, } from "./tools/get-oss-zat.js";
 import { VERIFY_TRUST_MARK_NAME, VERIFY_TRUST_MARK_DESCRIPTION, VERIFY_TRUST_MARK_SCHEMA, createVerifyTrustMarkHandler, } from "./tools/verify-trust-mark.js";
 import { GET_TRUST_KEYS_NAME, GET_TRUST_KEYS_DESCRIPTION, GET_TRUST_KEYS_SCHEMA, createGetTrustKeysHandler, } from "./tools/get-trust-keys.js";
 import { INSPECT_ZAT_NAME, INSPECT_ZAT_DESCRIPTION, INSPECT_ZAT_SCHEMA, createInspectZatHandler, } from "./tools/inspect-zat.js";
+// Tools — Red Team Setup
+import { SETUP_RED_TEAM_TARGET_NAME, SETUP_RED_TEAM_TARGET_DESCRIPTION, SETUP_RED_TEAM_TARGET_SCHEMA, createSetupRedTeamTargetHandler, } from "./tools/setup-red-team-target.js";
+// Tools — Application & Endpoint Management
 import { LIST_APPLICATIONS_NAME, LIST_APPLICATIONS_DESCRIPTION, LIST_APPLICATIONS_SCHEMA, createListApplicationsHandler, } from "./tools/list-applications.js";
 import { GET_APPLICATION_NAME, GET_APPLICATION_DESCRIPTION, GET_APPLICATION_SCHEMA, createGetApplicationHandler, } from "./tools/get-application.js";
 import { GET_APPLICATION_OVERVIEW_NAME, GET_APPLICATION_OVERVIEW_DESCRIPTION, GET_APPLICATION_OVERVIEW_SCHEMA, createGetApplicationOverviewHandler, } from "./tools/get-application-overview.js";
 import { LIST_ENDPOINTS_NAME, LIST_ENDPOINTS_DESCRIPTION, LIST_ENDPOINTS_SCHEMA, createListEndpointsHandler, } from "./tools/list-endpoints.js";
 import { IMPORT_OPENAPI_ENDPOINTS_NAME, IMPORT_OPENAPI_ENDPOINTS_DESCRIPTION, IMPORT_OPENAPI_ENDPOINTS_SCHEMA, createImportOpenApiEndpointsHandler, } from "./tools/import-openapi-endpoints.js";
 import { UPDATE_ENDPOINT_NAME, UPDATE_ENDPOINT_DESCRIPTION, UPDATE_ENDPOINT_SCHEMA, createUpdateEndpointHandler, } from "./tools/update-endpoint.js";
-import { MANAGE_APPLICATION_NAME, MANAGE_APPLICATION_DESCRIPTION, MANAGE_APPLICATION_SCHEMA, createManageApplicationHandler, } from "./tools/manage-application.js";
-import { MANAGE_ENDPOINT_LIFECYCLE_NAME, MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION, MANAGE_ENDPOINT_LIFECYCLE_SCHEMA, createManageEndpointLifecycleHandler, } from "./tools/manage-endpoint-lifecycle.js";
+// Tools — Local Scan
+import { LOCAL_SCAN_NAME, LOCAL_SCAN_DESCRIPTION, LOCAL_SCAN_SCHEMA, createLocalScanHandler, } from "./tools/local-scan.js";
+// Tools — Local Infrastructure Discovery
 import { DISCOVER_LOCAL_INFRA_NAME, DISCOVER_LOCAL_INFRA_DESCRIPTION, DISCOVER_LOCAL_INFRA_SCHEMA, createDiscoverLocalInfraHandler, } from "./tools/discover-local-infra.js";
+// Tools — Diagram Generation
 import { GENERATE_DIAGRAM_NAME, GENERATE_DIAGRAM_DESCRIPTION, GENERATE_DIAGRAM_SCHEMA, createGenerateDiagramHandler, } from "./tools/generate-diagram.js";
+// Tools — Diagram CRUD
 import { LIST_DIAGRAMS_NAME, LIST_DIAGRAMS_DESCRIPTION, LIST_DIAGRAMS_SCHEMA, createListDiagramsHandler, } from "./tools/list-diagrams.js";
 import { GET_DIAGRAM_NAME, GET_DIAGRAM_DESCRIPTION, GET_DIAGRAM_SCHEMA, createGetDiagramHandler, } from "./tools/get-diagram.js";
 import { CREATE_DIAGRAM_NAME, CREATE_DIAGRAM_DESCRIPTION, CREATE_DIAGRAM_SCHEMA, createCreateDiagramHandler, } from "./tools/create-diagram.js";
@@ -80,85 +102,125 @@ import { LIST_DOCUMENTS_NAME, LIST_DOCUMENTS_DESCRIPTION, LIST_DOCUMENTS_SCHEMA,
 import { GET_DOCUMENT_NAME, GET_DOCUMENT_DESCRIPTION, GET_DOCUMENT_SCHEMA, createGetDocumentHandler, } from "./tools/get-document.js";
 import { CREATE_DOCUMENT_NAME, CREATE_DOCUMENT_DESCRIPTION, CREATE_DOCUMENT_SCHEMA, createCreateDocumentHandler, } from "./tools/create-document.js";
 import { UPDATE_DOCUMENT_NAME, UPDATE_DOCUMENT_DESCRIPTION, UPDATE_DOCUMENT_SCHEMA, createUpdateDocumentHandler, } from "./tools/update-document.js";
+// Tools — Security Review (composite intelligence)
 import { SECURITY_REVIEW_NAME, SECURITY_REVIEW_DESCRIPTION, SECURITY_REVIEW_SCHEMA, createSecurityReviewHandler, } from "./tools/security-review.js";
+// Tools — Project Binding
 import { CHECK_PROJECT_NAME, CHECK_PROJECT_DESCRIPTION, CHECK_PROJECT_SCHEMA, createCheckProjectHandler, } from "./tools/check-project.js";
+// Tools — Test Library (IP-protected: metadata only, no prompts/patterns)
+import { LIST_TEST_LIBRARY_NAME, LIST_TEST_LIBRARY_DESCRIPTION, LIST_TEST_LIBRARY_SCHEMA, createListTestLibraryHandler, } from "./tools/list-test-library.js";
+import { GET_TEST_DETAILS_NAME, GET_TEST_DETAILS_DESCRIPTION, GET_TEST_DETAILS_SCHEMA, createGetTestDetailsHandler, } from "./tools/get-test-details.js";
+import { LIST_TEST_SCENARIOS_NAME, LIST_TEST_SCENARIOS_DESCRIPTION, LIST_TEST_SCENARIOS_SCHEMA, createListTestScenariosHandler, } from "./tools/list-test-scenarios.js";
+import { GET_SCENARIO_DETAILS_NAME, GET_SCENARIO_DETAILS_DESCRIPTION, GET_SCENARIO_DETAILS_SCHEMA, createGetScenarioDetailsHandler, } from "./tools/get-scenario-details.js";
+import { LIST_AGENT_TEST_CASES_NAME, LIST_AGENT_TEST_CASES_DESCRIPTION, LIST_AGENT_TEST_CASES_SCHEMA, createListAgentTestCasesHandler, } from "./tools/list-agent-test-cases.js";
+import { RUN_TEST_SCENARIO_NAME, RUN_TEST_SCENARIO_DESCRIPTION, RUN_TEST_SCENARIO_SCHEMA, createRunTestScenarioHandler, } from "./tools/run-test-scenario.js";
+// ── Enterprise Tools — Threat Model Management ──
 import { GET_THREAT_MODEL_NAME, GET_THREAT_MODEL_DESCRIPTION, GET_THREAT_MODEL_SCHEMA, createGetThreatModelHandler } from "./tools/enterprise/get-threat-model.js";
-import { LIST_THREAT_MODEL_ARTIFACTS_NAME, LIST_THREAT_MODEL_ARTIFACTS_DESCRIPTION, LIST_THREAT_MODEL_ARTIFACTS_SCHEMA, createListThreatModelArtifactsHandler } from "./tools/enterprise/list-threat-model-artifacts.js";
-import { GET_THREAT_MODEL_ARTIFACT_NAME, GET_THREAT_MODEL_ARTIFACT_DESCRIPTION, GET_THREAT_MODEL_ARTIFACT_SCHEMA, createGetThreatModelArtifactHandler } from "./tools/enterprise/get-threat-model-artifact.js";
 import { LIST_THREAT_MODELS_NAME, LIST_THREAT_MODELS_DESCRIPTION, LIST_THREAT_MODELS_SCHEMA, createListThreatModelsHandler } from "./tools/enterprise/list-threat-models.js";
-import { LIST_THREAT_MODEL_VERSIONS_NAME, LIST_THREAT_MODEL_VERSIONS_DESCRIPTION, LIST_THREAT_MODEL_VERSIONS_SCHEMA, createListThreatModelVersionsHandler } from "./tools/enterprise/list-threat-model-versions.js";
-import { LIST_ATTACK_SCENARIOS_NAME, LIST_ATTACK_SCENARIOS_DESCRIPTION, LIST_ATTACK_SCENARIOS_SCHEMA, createListAttackScenariosHandler } from "./tools/enterprise/list-attack-scenarios.js";
-import { LIST_ATTACK_STEP_LIBRARY_TESTS_NAME, LIST_ATTACK_STEP_LIBRARY_TESTS_DESCRIPTION, LIST_ATTACK_STEP_LIBRARY_TESTS_SCHEMA, createListAttackStepLibraryTestsHandler } from "./tools/enterprise/list-attack-step-library-tests.js";
-import { LIST_THREAT_MODEL_REVIEW_ITEMS_NAME, LIST_THREAT_MODEL_REVIEW_ITEMS_DESCRIPTION, LIST_THREAT_MODEL_REVIEW_ITEMS_SCHEMA, createListThreatModelReviewItemsHandler } from "./tools/enterprise/list-threat-model-review-items.js";
 import { MANAGE_ACTOR_NAME, MANAGE_ACTOR_DESCRIPTION, MANAGE_ACTOR_SCHEMA, createManageActorHandler } from "./tools/enterprise/manage-actor.js";
 import { MANAGE_COMPONENT_NAME, MANAGE_COMPONENT_DESCRIPTION, MANAGE_COMPONENT_SCHEMA, createManageComponentHandler } from "./tools/enterprise/manage-component.js";
 import { MANAGE_DATA_FLOW_NAME, MANAGE_DATA_FLOW_DESCRIPTION, MANAGE_DATA_FLOW_SCHEMA, createManageDataFlowHandler } from "./tools/enterprise/manage-data-flow.js";
 import { MANAGE_ATTACK_SCENARIO_NAME, MANAGE_ATTACK_SCENARIO_DESCRIPTION, MANAGE_ATTACK_SCENARIO_SCHEMA, createManageAttackScenarioHandler } from "./tools/enterprise/manage-attack-scenario.js";
-import { MANAGE_THREAT_MODEL_ANALYSIS_NAME, MANAGE_THREAT_MODEL_ANALYSIS_DESCRIPTION, MANAGE_THREAT_MODEL_ANALYSIS_SCHEMA, createManageThreatModelAnalysisHandler } from "./tools/enterprise/manage-threat-model-analysis.js";
-import { MANAGE_THREAT_MODEL_REVIEW_NAME, MANAGE_THREAT_MODEL_REVIEW_DESCRIPTION, MANAGE_THREAT_MODEL_REVIEW_SCHEMA, createManageThreatModelReviewHandler } from "./tools/enterprise/manage-threat-model-review.js";
 import { MANAGE_SECURITY_CONTROL_NAME, MANAGE_SECURITY_CONTROL_DESCRIPTION, MANAGE_SECURITY_CONTROL_SCHEMA, createManageSecurityControlHandler } from "./tools/enterprise/manage-security-control.js";
 import { MANAGE_DATA_ASSET_NAME, MANAGE_DATA_ASSET_DESCRIPTION, MANAGE_DATA_ASSET_SCHEMA, createManageDataAssetHandler } from "./tools/enterprise/manage-data-asset.js";
 import { MANAGE_TEST_CASE_NAME, MANAGE_TEST_CASE_DESCRIPTION, MANAGE_TEST_CASE_SCHEMA, createManageTestCaseHandler } from "./tools/enterprise/manage-test-case.js";
+import { MANAGE_FINDING_NAME, MANAGE_FINDING_DESCRIPTION, MANAGE_FINDING_SCHEMA, createManageFindingHandler } from "./tools/enterprise/manage-finding.js";
+// ── Enterprise Tools — Pen Test Sessions ──
+import { START_PENTEST_SESSION_NAME, START_PENTEST_SESSION_DESCRIPTION, START_PENTEST_SESSION_SCHEMA, createStartPentestSessionHandler } from "./tools/enterprise/start-pentest-session.js";
+import { RECORD_TEST_RESULT_NAME, RECORD_TEST_RESULT_DESCRIPTION, RECORD_TEST_RESULT_SCHEMA, createRecordTestResultHandler } from "./tools/enterprise/record-test-result.js";
+import { END_PENTEST_SESSION_NAME, END_PENTEST_SESSION_DESCRIPTION, END_PENTEST_SESSION_SCHEMA, createEndPentestSessionHandler } from "./tools/enterprise/end-pentest-session.js";
+import { PUBLISH_TEST_TO_LIBRARY_NAME, PUBLISH_TEST_TO_LIBRARY_DESCRIPTION, PUBLISH_TEST_TO_LIBRARY_SCHEMA, createPublishTestToLibraryHandler } from "./tools/enterprise/publish-test-to-library.js";
+// ── Enterprise Tools — Evidence & Reports ──
+import { CAPTURE_EVIDENCE_NAME, CAPTURE_EVIDENCE_DESCRIPTION, CAPTURE_EVIDENCE_SCHEMA, createCaptureEvidenceHandler } from "./tools/enterprise/capture-evidence.js";
+import { GENERATE_REPORT_NAME, GENERATE_REPORT_DESCRIPTION, GENERATE_REPORT_SCHEMA, createGenerateReportHandler } from "./tools/enterprise/generate-report.js";
+import { GET_REPORT_STATUS_NAME, GET_REPORT_STATUS_DESCRIPTION, GET_REPORT_STATUS_SCHEMA, createGetReportStatusHandler } from "./tools/enterprise/get-report-status.js";
+// ── Enterprise Tools — Report Issues & Remediation ──
+import { PROMOTE_FINDING_TO_ISSUE_NAME, PROMOTE_FINDING_TO_ISSUE_DESCRIPTION, PROMOTE_FINDING_TO_ISSUE_SCHEMA, createPromoteFindingToIssueHandler } from "./tools/enterprise/promote-finding-to-issue.js";
+import { LIST_REPORT_ISSUES_NAME, LIST_REPORT_ISSUES_DESCRIPTION, LIST_REPORT_ISSUES_SCHEMA, createListReportIssuesHandler } from "./tools/enterprise/list-report-issues.js";
+import { UPDATE_REPORT_ISSUE_NAME, UPDATE_REPORT_ISSUE_DESCRIPTION, UPDATE_REPORT_ISSUE_SCHEMA, createUpdateReportIssueHandler } from "./tools/enterprise/update-report-issue.js";
+import { SYNC_REPORT_SECTION_NAME, SYNC_REPORT_SECTION_DESCRIPTION, SYNC_REPORT_SECTION_SCHEMA, createSyncReportSectionHandler } from "./tools/enterprise/sync-report-section.js";
+import { PUBLISH_REPORT_VERSION_NAME, PUBLISH_REPORT_VERSION_DESCRIPTION, PUBLISH_REPORT_VERSION_SCHEMA, createPublishReportVersionHandler } from "./tools/enterprise/publish-report-version.js";
+import { CREATE_REPORT_TICKET_NAME, CREATE_REPORT_TICKET_DESCRIPTION, CREATE_REPORT_TICKET_SCHEMA, createCreateReportTicketHandler } from "./tools/enterprise/create-report-ticket.js";
+// ── Enterprise Tools — ZAT ──
 import { GET_ORG_ZAT_NAME, GET_ORG_ZAT_DESCRIPTION, GET_ORG_ZAT_SCHEMA, createGetOrgZatHandler } from "./tools/enterprise/get-org-zat.js";
+// ── Enterprise Tools — Agent Instances ──
+import { LIST_AGENTS_NAME, LIST_AGENTS_DESCRIPTION, LIST_AGENTS_SCHEMA, createListAgentsHandler } from "./tools/enterprise/list-agents.js";
+// ── IDE Bridge ──
 import { OPEN_IN_IDE_NAME, OPEN_IN_IDE_DESCRIPTION, OPEN_IN_IDE_SCHEMA, createOpenInIdeHandler, } from "./tools/open-in-ide.js";
-export async function startServer(incoming = DEFAULT_CONFIG) {
-    const workspacePath = incoming.workspacePath ?? process.cwd();
-    const detected = detectProjectBinding(workspacePath);
-    const fromBinding = resolveConfigFromBinding(workspacePath);
-    const overlay = {
-        ...incoming,
-        ...fromBinding,
-        workspacePath: incoming.workspacePath,
-    };
-    const config = {
-        ...overlay,
-        session: resolveMcpSessionForWorkspace(incoming, workspacePath, detected, fromBinding),
-    };
-    if (detected) {
-        console.error(`[zivis] Project binding: ${detected.filePath} (session "${detected.binding.session}")`);
+/**
+ * Create and start the MCP server with all tools registered
+ */
+export async function startServer(config = DEFAULT_CONFIG) {
+    // Detect the project binding FIRST so we can auto-adopt its session
+    // when no explicit ZIVIS_SESSION was passed. This makes .zivis/project.json
+    // the single source of truth — cd into a project and the correct tokens
+    // are used without any IDE config to go stale.
+    const detected = detectProjectBinding(process.cwd());
+    if (detected && !config.session) {
+        config = { ...config, session: detected.binding.session };
+        console.error(`[zivis] Auto-adopted session "${config.session}" from ${detected.filePath}`);
     }
     const server = new McpServer({
         name: "zivis-security",
         version: "0.2.0",
-    }, {
-        capabilities: {
-            tools: {},
-            prompts: {},
-        },
     });
     const apiClient = new ApiClient(config);
-    server.registerTool(GET_STARTED_NAME, {
-        description: GET_STARTED_DESCRIPTION,
-        inputSchema: GET_STARTED_SCHEMA,
-    }, createGetStartedHandler(apiClient, config));
-    server.registerTool(INSPECT_NAME, {
-        description: INSPECT_DESCRIPTION,
-        inputSchema: INSPECT_SCHEMA,
-    }, createInspectHandler(apiClient, config));
-    server.registerTool(THREAT_GUIDE_NAME, {
-        description: THREAT_GUIDE_DESCRIPTION,
-        inputSchema: THREAT_GUIDE_SCHEMA,
-    }, createThreatGuideHandler(apiClient));
-    server.registerTool(THREAT_LIST_RELEVANT_CAPSULES_NAME, {
-        description: THREAT_LIST_RELEVANT_CAPSULES_DESCRIPTION,
-        inputSchema: THREAT_LIST_RELEVANT_CAPSULES_SCHEMA,
-    }, createThreatListRelevantCapsulesHandler());
-    server.registerTool(THREAT_GET_CAPSULE_NAME, {
-        description: THREAT_GET_CAPSULE_DESCRIPTION,
-        inputSchema: THREAT_GET_CAPSULE_SCHEMA,
-    }, createThreatGetCapsuleHandler());
-    server.registerTool(THREAT_GET_INFERENCE_PROMPT_NAME, {
-        description: THREAT_GET_INFERENCE_PROMPT_DESCRIPTION,
-        inputSchema: THREAT_GET_INFERENCE_PROMPT_SCHEMA,
-    }, createThreatGetInferencePromptHandler());
-    server.registerTool(THREAT_RUN_MATCHER_NAME, {
-        description: THREAT_RUN_MATCHER_DESCRIPTION,
-        inputSchema: THREAT_RUN_MATCHER_SCHEMA,
-    }, createThreatRunMatcherHandler());
+    // ── Register Tools: Findings ──
+    server.registerTool(GET_FINDINGS_NAME, {
+        description: GET_FINDINGS_DESCRIPTION,
+        inputSchema: GET_FINDINGS_SCHEMA,
+    }, createGetFindingsHandler(apiClient));
+    server.registerTool(GET_FINDING_DETAILS_NAME, {
+        description: GET_FINDING_DETAILS_DESCRIPTION,
+        inputSchema: GET_FINDING_DETAILS_SCHEMA,
+    }, createGetFindingDetailsHandler(apiClient));
+    server.registerTool(TRIAGE_FINDING_NAME, {
+        description: TRIAGE_FINDING_DESCRIPTION,
+        inputSchema: TRIAGE_FINDING_SCHEMA,
+    }, createTriageFindingHandler(apiClient));
+    // ── Register Tools: Scans & Artifacts ──
+    server.registerTool(LIST_SCANS_NAME, {
+        description: LIST_SCANS_DESCRIPTION,
+        inputSchema: LIST_SCANS_SCHEMA,
+    }, createListScansHandler(apiClient));
+    server.registerTool(LIST_RECON_SCANS_NAME, {
+        description: LIST_RECON_SCANS_DESCRIPTION,
+        inputSchema: LIST_RECON_SCANS_SCHEMA,
+    }, createListReconScansHandler(apiClient));
+    server.registerTool(GET_RECON_SCAN_NAME, {
+        description: GET_RECON_SCAN_DESCRIPTION,
+        inputSchema: GET_RECON_SCAN_SCHEMA,
+    }, createGetReconScanHandler(apiClient));
+    server.registerTool(GET_SCAN_OUTPUT_NAME, {
+        description: GET_SCAN_OUTPUT_DESCRIPTION,
+        inputSchema: GET_SCAN_OUTPUT_SCHEMA,
+    }, createGetScanOutputHandler(apiClient));
+    server.registerTool(GET_TEST_CASE_RESULTS_NAME, {
+        description: GET_TEST_CASE_RESULTS_DESCRIPTION,
+        inputSchema: GET_TEST_CASE_RESULTS_SCHEMA,
+    }, createGetTestCaseResultsHandler(apiClient));
+    server.registerTool(GET_AGENT_TEST_RESULTS_NAME, {
+        description: GET_AGENT_TEST_RESULTS_DESCRIPTION,
+        inputSchema: GET_AGENT_TEST_RESULTS_SCHEMA,
+    }, createGetAgentTestResultsHandler(apiClient));
+    server.registerTool(LIST_SCAN_ARTIFACTS_NAME, {
+        description: LIST_SCAN_ARTIFACTS_DESCRIPTION,
+        inputSchema: LIST_SCAN_ARTIFACTS_SCHEMA,
+    }, createListScanArtifactsHandler(apiClient));
+    server.registerTool(GET_ARTIFACT_CONTENT_NAME, {
+        description: GET_ARTIFACT_CONTENT_DESCRIPTION,
+        inputSchema: GET_ARTIFACT_CONTENT_SCHEMA,
+    }, createGetArtifactContentHandler(apiClient));
+    // ── Register Tools: PR Safety ──
+    server.registerTool(SCAN_PR_NAME, {
+        description: SCAN_PR_DESCRIPTION,
+        inputSchema: SCAN_PR_SCHEMA,
+    }, createScanPrHandler(apiClient));
+    // ── Register Tools: OSS Trust ──
     server.registerTool(CHECK_REPO_TRUST_NAME, {
         description: CHECK_REPO_TRUST_DESCRIPTION,
         inputSchema: CHECK_REPO_TRUST_SCHEMA,
     }, createCheckRepoTrustHandler(config));
+    // ── Register Tools: ZAT & Trust Verification ──
     server.registerTool(GET_OSS_ZAT_NAME, {
         description: GET_OSS_ZAT_DESCRIPTION,
         inputSchema: GET_OSS_ZAT_SCHEMA,
@@ -175,6 +237,12 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
         description: INSPECT_ZAT_DESCRIPTION,
         inputSchema: INSPECT_ZAT_SCHEMA,
     }, createInspectZatHandler());
+    // ── Register Tools: Red Team Setup ──
+    server.registerTool(SETUP_RED_TEAM_TARGET_NAME, {
+        description: SETUP_RED_TEAM_TARGET_DESCRIPTION,
+        inputSchema: SETUP_RED_TEAM_TARGET_SCHEMA,
+    }, createSetupRedTeamTargetHandler(apiClient));
+    // ── Register Tools: Application & Endpoint Management ──
     server.registerTool(LIST_APPLICATIONS_NAME, {
         description: LIST_APPLICATIONS_DESCRIPTION,
         inputSchema: LIST_APPLICATIONS_SCHEMA,
@@ -199,22 +267,22 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
         description: UPDATE_ENDPOINT_DESCRIPTION,
         inputSchema: UPDATE_ENDPOINT_SCHEMA,
     }, createUpdateEndpointHandler(apiClient));
-    server.registerTool(MANAGE_APPLICATION_NAME, {
-        description: MANAGE_APPLICATION_DESCRIPTION,
-        inputSchema: MANAGE_APPLICATION_SCHEMA,
-    }, createManageApplicationHandler(apiClient));
-    server.registerTool(MANAGE_ENDPOINT_LIFECYCLE_NAME, {
-        description: MANAGE_ENDPOINT_LIFECYCLE_DESCRIPTION,
-        inputSchema: MANAGE_ENDPOINT_LIFECYCLE_SCHEMA,
-    }, createManageEndpointLifecycleHandler(apiClient));
+    // ── Register Tools: Local Scan ──
+    server.registerTool(LOCAL_SCAN_NAME, {
+        description: LOCAL_SCAN_DESCRIPTION,
+        inputSchema: LOCAL_SCAN_SCHEMA,
+    }, createLocalScanHandler(apiClient));
+    // ── Register Tools: Local Infrastructure Discovery ──
     server.registerTool(DISCOVER_LOCAL_INFRA_NAME, {
         description: DISCOVER_LOCAL_INFRA_DESCRIPTION,
         inputSchema: DISCOVER_LOCAL_INFRA_SCHEMA,
     }, createDiscoverLocalInfraHandler());
+    // ── Register Tools: Diagram Generation ──
     server.registerTool(GENERATE_DIAGRAM_NAME, {
         description: GENERATE_DIAGRAM_DESCRIPTION,
         inputSchema: GENERATE_DIAGRAM_SCHEMA,
     }, createGenerateDiagramHandler(apiClient));
+    // ── Register Tools: Diagram CRUD ──
     server.registerTool(LIST_DIAGRAMS_NAME, {
         description: LIST_DIAGRAMS_DESCRIPTION,
         inputSchema: LIST_DIAGRAMS_SCHEMA,
@@ -239,24 +307,61 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
     server.registerTool(GET_DOCUMENT_NAME, { description: GET_DOCUMENT_DESCRIPTION, inputSchema: GET_DOCUMENT_SCHEMA }, createGetDocumentHandler(apiClient));
     server.registerTool(CREATE_DOCUMENT_NAME, { description: CREATE_DOCUMENT_DESCRIPTION, inputSchema: CREATE_DOCUMENT_SCHEMA }, createCreateDocumentHandler(apiClient));
     server.registerTool(UPDATE_DOCUMENT_NAME, { description: UPDATE_DOCUMENT_DESCRIPTION, inputSchema: UPDATE_DOCUMENT_SCHEMA }, createUpdateDocumentHandler(apiClient));
+    // ── Register Tools: IDE Bridge ──
     server.registerTool(OPEN_IN_IDE_NAME, { description: OPEN_IN_IDE_DESCRIPTION, inputSchema: OPEN_IN_IDE_SCHEMA }, createOpenInIdeHandler());
+    // ── Register Tools: Security Review ──
     server.registerTool(SECURITY_REVIEW_NAME, {
         description: SECURITY_REVIEW_DESCRIPTION,
         inputSchema: SECURITY_REVIEW_SCHEMA,
     }, createSecurityReviewHandler(apiClient, config));
+    // ── Register Tools: Project Binding ──
     server.registerTool(CHECK_PROJECT_NAME, {
         description: CHECK_PROJECT_DESCRIPTION,
         inputSchema: CHECK_PROJECT_SCHEMA,
     }, createCheckProjectHandler(apiClient, config));
+    // ── Register Tools: Test Library (IP-protected) ──
+    server.registerTool(LIST_TEST_LIBRARY_NAME, {
+        description: LIST_TEST_LIBRARY_DESCRIPTION,
+        inputSchema: LIST_TEST_LIBRARY_SCHEMA,
+    }, createListTestLibraryHandler(apiClient));
+    server.registerTool(GET_TEST_DETAILS_NAME, {
+        description: GET_TEST_DETAILS_DESCRIPTION,
+        inputSchema: GET_TEST_DETAILS_SCHEMA,
+    }, createGetTestDetailsHandler(apiClient));
+    server.registerTool(LIST_TEST_SCENARIOS_NAME, {
+        description: LIST_TEST_SCENARIOS_DESCRIPTION,
+        inputSchema: LIST_TEST_SCENARIOS_SCHEMA,
+    }, createListTestScenariosHandler(apiClient));
+    server.registerTool(GET_SCENARIO_DETAILS_NAME, {
+        description: GET_SCENARIO_DETAILS_DESCRIPTION,
+        inputSchema: GET_SCENARIO_DETAILS_SCHEMA,
+    }, createGetScenarioDetailsHandler(apiClient));
+    server.registerTool(LIST_AGENT_TEST_CASES_NAME, {
+        description: LIST_AGENT_TEST_CASES_DESCRIPTION,
+        inputSchema: LIST_AGENT_TEST_CASES_SCHEMA,
+    }, createListAgentTestCasesHandler(apiClient));
+    server.registerTool(RUN_TEST_SCENARIO_NAME, {
+        description: RUN_TEST_SCENARIO_DESCRIPTION,
+        inputSchema: RUN_TEST_SCENARIO_SCHEMA,
+    }, createRunTestScenarioHandler(apiClient));
+    // ── Register Enterprise Tools ──
+    // These tools are visible to all orgs but return upgrade prompts for non-enterprise.
+    // The handler wrapper checks features at call time via /api/mcp/features.
     let enterpriseFeatures = null;
+    /**
+     * Wraps an enterprise tool handler to check feature access at call time.
+     * Non-enterprise orgs see the tools but get an upgrade message.
+     */
     function wrapEnterpriseHandler(handler, featureKey = "mcpEnterpriseTools") {
         return async (params) => {
+            // Lazy-load features on first enterprise tool call
             if (enterpriseFeatures === null) {
                 try {
                     const resp = await apiClient.get("/api/mcp/features");
                     enterpriseFeatures = resp.features;
                 }
                 catch {
+                    // If feature check fails, allow the call (API will enforce access)
                     enterpriseFeatures = {};
                 }
             }
@@ -265,7 +370,7 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
                     content: [
                         {
                             type: "text",
-                            text: `This tool requires a Pro+, Enterprise, or Demo plan.\n\nUpgrade at https://app.zivis.ai/settings/billing to access enterprise MCP tools including:\n- Threat model management\n- Actor / component / data-flow / data-asset CRUD\n- Attack scenario and security control curation\n- Test case curation\n- Organizational attestation tokens (ZAT)\n\nContact sales@zivis.ai for enterprise pricing.`,
+                            text: `This tool requires a Pro+, Enterprise, or Demo plan.\n\nUpgrade at https://app.zivis.ai/settings/billing to access enterprise MCP tools including:\n- Threat model management\n- Pen test session tracking\n- Evidence capture\n- Report generation\n\nContact sales@zivis.ai for enterprise pricing.`,
                         },
                     ],
                 };
@@ -273,50 +378,70 @@ export async function startServer(incoming = DEFAULT_CONFIG) {
             return handler(params);
         };
     }
+    // Agent Instances
     const enterpriseTools = [
+        [LIST_AGENTS_NAME, LIST_AGENTS_DESCRIPTION, LIST_AGENTS_SCHEMA, createListAgentsHandler(apiClient)],
+        // Threat Model Management
         [GET_THREAT_MODEL_NAME, GET_THREAT_MODEL_DESCRIPTION, GET_THREAT_MODEL_SCHEMA, createGetThreatModelHandler(apiClient)],
-        [LIST_THREAT_MODEL_ARTIFACTS_NAME, LIST_THREAT_MODEL_ARTIFACTS_DESCRIPTION, LIST_THREAT_MODEL_ARTIFACTS_SCHEMA, createListThreatModelArtifactsHandler(apiClient)],
-        [GET_THREAT_MODEL_ARTIFACT_NAME, GET_THREAT_MODEL_ARTIFACT_DESCRIPTION, GET_THREAT_MODEL_ARTIFACT_SCHEMA, createGetThreatModelArtifactHandler(apiClient)],
         [LIST_THREAT_MODELS_NAME, LIST_THREAT_MODELS_DESCRIPTION, LIST_THREAT_MODELS_SCHEMA, createListThreatModelsHandler(apiClient)],
-        [LIST_THREAT_MODEL_VERSIONS_NAME, LIST_THREAT_MODEL_VERSIONS_DESCRIPTION, LIST_THREAT_MODEL_VERSIONS_SCHEMA, createListThreatModelVersionsHandler(apiClient)],
-        [LIST_ATTACK_SCENARIOS_NAME, LIST_ATTACK_SCENARIOS_DESCRIPTION, LIST_ATTACK_SCENARIOS_SCHEMA, createListAttackScenariosHandler(apiClient)],
-        [LIST_ATTACK_STEP_LIBRARY_TESTS_NAME, LIST_ATTACK_STEP_LIBRARY_TESTS_DESCRIPTION, LIST_ATTACK_STEP_LIBRARY_TESTS_SCHEMA, createListAttackStepLibraryTestsHandler(apiClient)],
-        [LIST_THREAT_MODEL_REVIEW_ITEMS_NAME, LIST_THREAT_MODEL_REVIEW_ITEMS_DESCRIPTION, LIST_THREAT_MODEL_REVIEW_ITEMS_SCHEMA, createListThreatModelReviewItemsHandler(apiClient)],
         [MANAGE_ACTOR_NAME, MANAGE_ACTOR_DESCRIPTION, MANAGE_ACTOR_SCHEMA, createManageActorHandler(apiClient)],
         [MANAGE_COMPONENT_NAME, MANAGE_COMPONENT_DESCRIPTION, MANAGE_COMPONENT_SCHEMA, createManageComponentHandler(apiClient)],
         [MANAGE_DATA_FLOW_NAME, MANAGE_DATA_FLOW_DESCRIPTION, MANAGE_DATA_FLOW_SCHEMA, createManageDataFlowHandler(apiClient)],
         [MANAGE_ATTACK_SCENARIO_NAME, MANAGE_ATTACK_SCENARIO_DESCRIPTION, MANAGE_ATTACK_SCENARIO_SCHEMA, createManageAttackScenarioHandler(apiClient)],
-        [MANAGE_THREAT_MODEL_ANALYSIS_NAME, MANAGE_THREAT_MODEL_ANALYSIS_DESCRIPTION, MANAGE_THREAT_MODEL_ANALYSIS_SCHEMA, createManageThreatModelAnalysisHandler(apiClient)],
-        [MANAGE_THREAT_MODEL_REVIEW_NAME, MANAGE_THREAT_MODEL_REVIEW_DESCRIPTION, MANAGE_THREAT_MODEL_REVIEW_SCHEMA, createManageThreatModelReviewHandler(apiClient)],
         [MANAGE_SECURITY_CONTROL_NAME, MANAGE_SECURITY_CONTROL_DESCRIPTION, MANAGE_SECURITY_CONTROL_SCHEMA, createManageSecurityControlHandler(apiClient)],
         [MANAGE_DATA_ASSET_NAME, MANAGE_DATA_ASSET_DESCRIPTION, MANAGE_DATA_ASSET_SCHEMA, createManageDataAssetHandler(apiClient)],
         [MANAGE_TEST_CASE_NAME, MANAGE_TEST_CASE_DESCRIPTION, MANAGE_TEST_CASE_SCHEMA, createManageTestCaseHandler(apiClient)],
+        [MANAGE_FINDING_NAME, MANAGE_FINDING_DESCRIPTION, MANAGE_FINDING_SCHEMA, createManageFindingHandler(apiClient)],
+        // Pen Test Sessions
+        [START_PENTEST_SESSION_NAME, START_PENTEST_SESSION_DESCRIPTION, START_PENTEST_SESSION_SCHEMA, createStartPentestSessionHandler(apiClient)],
+        [RECORD_TEST_RESULT_NAME, RECORD_TEST_RESULT_DESCRIPTION, RECORD_TEST_RESULT_SCHEMA, createRecordTestResultHandler(apiClient)],
+        [END_PENTEST_SESSION_NAME, END_PENTEST_SESSION_DESCRIPTION, END_PENTEST_SESSION_SCHEMA, createEndPentestSessionHandler(apiClient)],
+        [PUBLISH_TEST_TO_LIBRARY_NAME, PUBLISH_TEST_TO_LIBRARY_DESCRIPTION, PUBLISH_TEST_TO_LIBRARY_SCHEMA, createPublishTestToLibraryHandler(apiClient)],
+        // Evidence & Reports
+        [CAPTURE_EVIDENCE_NAME, CAPTURE_EVIDENCE_DESCRIPTION, CAPTURE_EVIDENCE_SCHEMA, createCaptureEvidenceHandler(apiClient)],
+        [GENERATE_REPORT_NAME, GENERATE_REPORT_DESCRIPTION, GENERATE_REPORT_SCHEMA, createGenerateReportHandler(apiClient)],
+        [GET_REPORT_STATUS_NAME, GET_REPORT_STATUS_DESCRIPTION, GET_REPORT_STATUS_SCHEMA, createGetReportStatusHandler(apiClient)],
+        // Report Issues & Remediation
+        [PROMOTE_FINDING_TO_ISSUE_NAME, PROMOTE_FINDING_TO_ISSUE_DESCRIPTION, PROMOTE_FINDING_TO_ISSUE_SCHEMA, createPromoteFindingToIssueHandler(apiClient)],
+        [LIST_REPORT_ISSUES_NAME, LIST_REPORT_ISSUES_DESCRIPTION, LIST_REPORT_ISSUES_SCHEMA, createListReportIssuesHandler(apiClient)],
+        [UPDATE_REPORT_ISSUE_NAME, UPDATE_REPORT_ISSUE_DESCRIPTION, UPDATE_REPORT_ISSUE_SCHEMA, createUpdateReportIssueHandler(apiClient)],
+        [SYNC_REPORT_SECTION_NAME, SYNC_REPORT_SECTION_DESCRIPTION, SYNC_REPORT_SECTION_SCHEMA, createSyncReportSectionHandler(apiClient)],
+        [PUBLISH_REPORT_VERSION_NAME, PUBLISH_REPORT_VERSION_DESCRIPTION, PUBLISH_REPORT_VERSION_SCHEMA, createPublishReportVersionHandler(apiClient)],
+        [CREATE_REPORT_TICKET_NAME, CREATE_REPORT_TICKET_DESCRIPTION, CREATE_REPORT_TICKET_SCHEMA, createCreateReportTicketHandler(apiClient)],
+        // ZAT
         [GET_ORG_ZAT_NAME, GET_ORG_ZAT_DESCRIPTION, GET_ORG_ZAT_SCHEMA, createGetOrgZatHandler(apiClient)],
     ];
     for (const [name, description, schema, handler] of enterpriseTools) {
         server.registerTool(name, { description: description, inputSchema: schema }, wrapEnterpriseHandler(handler));
     }
+    // ── Project binding check ──
+    // `detected` was resolved at the top of this function so its session could
+    // be auto-adopted into config when no explicit ZIVIS_SESSION was set.
     if (detected) {
         validateProjectBinding(detected.binding, detected.filePath, config);
     }
+    // ── Session safety check ──
     if (config.session) {
         console.error(`[zivis] Session: ${config.session}`);
-        const creds = await resolveAuth(config, "apikey");
+        // Verify the session has credentials before starting
+        const creds = await resolveAuth(config);
         if (creds.method === "none") {
-            console.error(`[zivis] ERROR: Session "${config.session}" has no API key for MCP.`);
-            console.error("[zivis] OAuth is used only to mint an org-scoped API key:");
-            console.error("[zivis]   zivis auth bind");
-            console.error(`[zivis] Or paste a platform token: zivis auth token sk_<...> --session ${config.session}`);
+            console.error(`[zivis] ERROR: Session "${config.session}" has no credentials.`);
+            console.error(`[zivis] Run: zivis auth login --session ${config.session}`);
             process.exit(1);
         }
     }
+    // ── JWT org isolation check ──
+    // Must run AFTER session check (needs valid tokens) but BEFORE connecting.
+    // Prevents cross-org data leaks by verifying the JWT's org matches the project binding.
     if (detected?.binding.workosOrgId) {
-        await validateApiKeyMatchesBinding(detected.binding, config);
+        await validateJwtOrgBinding(detected.binding, config);
     }
-    registerAllPrompts(server);
+    // ── Connect via stdio ──
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error("[zivis] MCP server running on stdio");
     console.error(`[zivis] API: ${config.apiBaseUrl}`);
-    console.error(`[zivis] Tools: public + ${enterpriseTools.length} enterprise registered`);
+    console.error(`[zivis] Tools: 31 public + ${enterpriseTools.length} enterprise`);
 }
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAClC,OAAuB,EACvB,MAAmB;IAEnB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,6EAA6E;QAC7E,OAAO,CAAC,KAAK,CACX,oFAAoF,CACrF,CAAC;QACF,OAAO,CAAC,KAAK,CACX,wGAAwG,CACzG,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,oDAAoD;IAEzE,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACjF,OAAO,CAAC,KAAK,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,8BAA8B,OAAO,CAAC,WAAW,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,wCAAwC,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzF,CAAC;AACJ,CAAC;AAED,mBAAmB;AACnB,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,4BAA4B;AAC5B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,EAClC,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AAEzC,oBAAoB;AACpB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AAErC,4CAA4C;AAC5C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,yBAAyB;AACzB,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,4CAA4C;AAC5C,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,EACpC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,EACpC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qBAAqB;AACrB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,yCAAyC;AACzC,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AAEzC,6BAA6B;AAC7B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAErC,uBAAuB;AACvB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,mDAAmD;AACnD,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,0BAA0B;AAC1B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAElC,0EAA0E;AAC1E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAEtC,mDAAmD;AACnD,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACnK,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC7K,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACpK,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACnK,OAAO,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,8CAA8C,CAAC;AACjM,OAAO,EAAE,4BAA4B,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,kCAAkC,EAAE,MAAM,+CAA+C,CAAC;AACtM,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AACxK,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACnK,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAE1J,6CAA6C;AAC7C,OAAO,EAAE,0BAA0B,EAAE,iCAAiC,EAAE,4BAA4B,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAC5L,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC7K,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAClL,OAAO,EAAE,4BAA4B,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAErM,8CAA8C;AAC9C,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACpK,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAC/J,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AAExK,uDAAuD;AACvD,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC1M,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC7K,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAClL,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAClL,OAAO,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,8CAA8C,CAAC;AACjM,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAEvL,+BAA+B;AAC/B,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE1I,2CAA2C;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAE3I,mBAAmB;AACnB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAsB,cAAc;IAEpC,oEAAoE;IACpE,4EAA4E;IAC5E,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1D,OAAO,CAAC,KAAK,CACX,iCAAiC,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,QAAQ,EAAE,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAExC,iCAAiC;IAEjC,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EAAE,wBAAwB;QACrC,WAAW,EAAE,mBAAmB;KACjC,EACD,wBAAwB,CAAC,SAAS,CAAC,CACpC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE,0BAA0B;KACxC,EACD,8BAA8B,CAAC,SAAS,CAAC,CAC1C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,0CAA0C;IAE1C,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE,iBAAiB;KAC/B,EACD,sBAAsB,CAAC,SAAS,CAAC,CAClC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,uBAAuB;KACrC,EACD,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,yBAAyB,CAAC,SAAS,CAAC,CACrC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,sBAAsB;KACpC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,4BAA4B;KAC1C,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,2BAA2B,EAC3B;QACE,WAAW,EAAE,kCAAkC;QAC/C,WAAW,EAAE,6BAA6B;KAC3C,EACD,gCAAgC,CAAC,SAAS,CAAC,CAC5C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE,0BAA0B;KACxC,EACD,8BAA8B,CAAC,SAAS,CAAC,CAC1C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,2BAA2B;KACzC,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,kCAAkC;IAElC,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EAAE,mBAAmB;QAChC,WAAW,EAAE,cAAc;KAC5B,EACD,mBAAmB,CAAC,SAAS,CAAC,CAC/B,CAAC;IAEF,kCAAkC;IAElC,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,uBAAuB;KACrC,EACD,2BAA2B,CAAC,MAAM,CAAC,CACpC,CAAC;IAEF,iDAAiD;IAEjD,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,kBAAkB;KAChC,EACD,sBAAsB,CAAC,MAAM,CAAC,CAC/B,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE,wBAAwB;KACtC,EACD,4BAA4B,CAAC,MAAM,CAAC,CACrC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,yBAAyB,CAAC,MAAM,CAAC,CAClC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,kBAAkB;KAChC,EACD,uBAAuB,EAAE,CAC1B,CAAC;IAEF,uCAAuC;IAEvC,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,4BAA4B;KAC1C,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,0DAA0D;IAE1D,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE,wBAAwB;KACtC,EACD,6BAA6B,CAAC,SAAS,CAAC,CACzC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,sBAAsB;KACpC,EACD,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,WAAW,EAAE,oCAAoC;QACjD,WAAW,EAAE,+BAA+B;KAC7C,EACD,mCAAmC,CAAC,SAAS,CAAC,CAC/C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,WAAW,EAAE,oCAAoC;QACjD,WAAW,EAAE,+BAA+B;KAC7C,EACD,mCAAmC,CAAC,SAAS,CAAC,CAC/C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,sBAAsB;KACpC,EACD,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,mCAAmC;IAEnC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE,iBAAiB;KAC/B,EACD,sBAAsB,CAAC,SAAS,CAAC,CAClC,CAAC;IAEF,uDAAuD;IAEvD,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,2BAA2B;KACzC,EACD,+BAA+B,EAAE,CAClC,CAAC;IAEF,2CAA2C;IAE3C,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,uBAAuB;KACrC,EACD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;IAEF,qCAAqC;IAErC,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,oBAAoB;KAClC,EACD,yBAAyB,CAAC,SAAS,CAAC,CACrC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,kBAAkB;KAChC,EACD,uBAAuB,CAAC,SAAS,CAAC,CACnC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,qBAAqB;KACnC,EACD,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,4BAA4B;KAC1C,EACD,gCAAgC,CAAC,SAAS,CAAC,CAC5C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAC/E,0BAA0B,CAAC,SAAS,CAAC,CACtC,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAC3E,wBAAwB,CAAC,SAAS,CAAC,CACpC,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB,EAAE,WAAW,EAAE,2BAA2B,EAAE,WAAW,EAAE,sBAAsB,EAAE,EACjF,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB,EAAE,WAAW,EAAE,2BAA2B,EAAE,WAAW,EAAE,sBAAsB,EAAE,EACjF,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,mCAAmC;IAEnC,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,kBAAkB,EAAE,EACzE,sBAAsB,EAAE,CACzB,CAAC;IAEF,wCAAwC;IAExC,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,sBAAsB;KACpC,EACD,2BAA2B,CAAC,SAAS,EAAE,MAAM,CAAC,CAC/C,CAAC;IAEF,wCAAwC;IAExC,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,oBAAoB;KAClC,EACD,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,CAC7C,CAAC;IAEF,oDAAoD;IAEpD,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE,wBAAwB;KACtC,EACD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,uBAAuB;KACrC,EACD,2BAA2B,CAAC,SAAS,CAAC,CACvC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE,0BAA0B;KACxC,EACD,8BAA8B,CAAC,SAAS,CAAC,CAC1C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,2BAA2B;KACzC,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,4BAA4B;KAC1C,EACD,+BAA+B,CAAC,SAAS,CAAC,CAC3C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE,wBAAwB;KACtC,EACD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;IAEF,kCAAkC;IAClC,qFAAqF;IACrF,0EAA0E;IAE1E,IAAI,kBAAkB,GAAmC,IAAI,CAAC;IAE9D;;;OAGG;IACH,SAAS,qBAAqB,CAC5B,OAAsG,EACtG,aAAqB,oBAAoB;QAEzC,OAAO,KAAK,EAAE,MAAS,EAAE,EAAE;YACzB,mDAAmD;YACnD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAwC,mBAAmB,CAAC,CAAC;oBAC7F,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,kBAAkB,GAAG,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,IAAI,kBAAkB,CAAC,UAAU,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC7C,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,uSAAuS;yBAC9S;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,MAAM,eAAe,GAAG;QACtB,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACnG,0BAA0B;QAC1B,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACtH,CAAC,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAC9H,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACvG,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACvH,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACtH,CAAC,2BAA2B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,iCAAiC,CAAC,SAAS,CAAC,CAAC;QAC9I,CAAC,4BAA4B,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,kCAAkC,CAAC,SAAS,CAAC,CAAC;QAClJ,CAAC,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC;QAC1H,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACtH,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC/G,oBAAoB;QACpB,CAAC,0BAA0B,EAAE,iCAAiC,EAAE,4BAA4B,EAAE,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAC1I,CAAC,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAC9H,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,SAAS,CAAC,CAAC;QAClI,CAAC,4BAA4B,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,iCAAiC,CAAC,SAAS,CAAC,CAAC;QACjJ,qBAAqB;QACrB,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACvH,CAAC,oBAAoB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACnH,CAAC,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC;QAC1H,8BAA8B;QAC9B,CAAC,6BAA6B,EAAE,oCAAoC,EAAE,+BAA+B,EAAE,kCAAkC,CAAC,SAAS,CAAC,CAAC;QACrJ,CAAC,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAC9H,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,SAAS,CAAC,CAAC;QAClI,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,SAAS,CAAC,CAAC;QAClI,CAAC,2BAA2B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,iCAAiC,CAAC,SAAS,CAAC,CAAC;QAC9I,CAAC,yBAAyB,EAAE,gCAAgC,EAAE,2BAA2B,EAAE,+BAA+B,CAAC,SAAS,CAAC,CAAC;QACtI,MAAM;QACN,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;KAC1F,CAAC;IAEX,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,eAAe,EAAE,CAAC;QACnE,MAAM,CAAC,YAAY,CACjB,IAAc,EACd,EAAE,WAAW,EAAE,WAAqB,EAAE,WAAW,EAAE,MAAa,EAAE,EAClE,qBAAqB,CAAC,OAA8G,CAAC,CACtI,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,6BAA6B;IAE7B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,qDAAqD;QACrD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;YAChF,OAAO,CAAC,KAAK,CAAC,2CAA2C,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,2EAA2E;IAC3E,wFAAwF;IAExF,IAAI,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAED,0BAA0B;IAE1B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,CACX,gBAAgB,MAAM,CAAC,UAAU,EAAE,CACpC,CAAC;IACF,OAAO,CAAC,KAAK,CACX,8BAA8B,eAAe,CAAC,MAAM,aAAa,CAClE,CAAC;AACJ,CAAC"}