@zivis/mcp 0.1.8 → 0.1.10

package/dist/tools/inspect.js

@@ -0,0 +1,222 @@
+import { z } from "zod";
+import * as fs from "node:fs/promises";
+import * as fssync from "node:fs";
+import * as path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { detectProjectBinding } from "../project-binding.js";
+import { runMatcher } from "../matcher/index.js";
+import { buildInferenceBundle } from "../matcher/inference-candidates.js";
+import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
+export const INSPECT_NAME = "zivis_inspect";
+export const INSPECT_DESCRIPTION = `Build a local repo graph and run the local pattern matcher to emit threat-model findings. The threat-model-first conversion event.
+
+Prefer zivis_get_started first — it reads the local inspect cache and only calls this tool when a fresh artifact is missing. Calling zivis_inspect directly always re-runs (no idempotency at this layer); reach for it when the user explicitly says "re-inspect" / "rebuild the graph" / "/inspect" or when an entry tool tells you to.
+
+Use this when the user says any of:
+- "model this app" / "threat model this repo"
+- "what should we be worried about in this code"
+- "set up security for this project" (after auth/binding is done)
+- "/inspect"
+
+What it does, all locally (no source code leaves the machine):
+  1. Spawns 'zivis inspect' to walk the repo and produce a typed graph artifact
+     (services, endpoints, external dependencies; auth boundaries + dataflow are Phase 1.5)
+  2. Runs the local matcher against the public pattern pack:
+     - AST strategies fire via @ast-grep/napi for TS/JS/Python/Go
+     - META strategies fire via the controls library (when no defending control is present)
+     - INFER strategies emit candidates the host LLM picks up via zivis_threat_get_inference_prompt
+  3. Returns normalized findings with lane (trusted/inferred), confidence, and evidence spans
+
+Trusted-lane findings are evidence-backed (deterministic strategies fired) and ready for the threat model. Inferred-lane findings need host-LLM confirmation via zivis_threat_get_inference_prompt before promotion. Proprietary platform-side eval (Phase 4 cloud upload) and trust-promoted aggregation are separate steps.
+
+This is the conversion moment for the threat-model-first sidekick — the user sees specific patterns naming specific files in their repo, in their IDE, in under 30 seconds.`;
+export const INSPECT_SCHEMA = {
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory to inspect (defaults to server working directory)."),
+    application_id: z
+        .string()
+        .optional()
+        .describe("Target application id. If omitted, /inspect resolves it from the project binding. " +
+        "Required if the binding is ambiguous or maps to multiple applications."),
+    skip_matcher: z
+        .boolean()
+        .optional()
+        .describe("If true, only build the graph artifact; do not run the matcher. Default: false (matcher runs)."),
+};
+export function createInspectHandler(_apiClient, _config) {
+    return async (params) => {
+        const cwd = params.cwd || process.cwd();
+        const detected = detectProjectBinding(cwd);
+        if (!detected) {
+            return withNextStepsError("No .zivis/project.json found for this directory. /inspect needs a project binding so the resulting threat model attaches to the correct application and org.", [
+                {
+                    id: "run_auth_init",
+                    label: "Connect this project to your ZIVIS org",
+                    tool: "zivis_check_project",
+                    why: "Run 'zivis auth init' or 'zivis auth login' to create the binding, then re-run /inspect.",
+                },
+            ], "Project not bound — run zivis auth login then re-run /inspect.");
+        }
+        let inspectStderr = "";
+        let artifactPath;
+        try {
+            const result = await spawnInspect(cwd, params.application_id ?? detected.binding.applicationId);
+            inspectStderr = result.stderr;
+            artifactPath = parseArtifactPath(result.stderr);
+        }
+        catch (err) {
+            return withNextStepsError(`Could not run 'zivis inspect': ${err.message}`, [
+                {
+                    id: "install_cli",
+                    label: "Install the ZIVIS CLI globally",
+                    tool: "zivis_inspect",
+                    why: "Inspect needs the 'zivis' CLI on PATH (or set ZIVIS_CLI_BIN). pnpm add -g @zivis/cli.",
+                },
+            ], "Install or surface the ZIVIS CLI binary, then retry.");
+        }
+        if (!artifactPath) {
+            return withNextStepsError(`'zivis inspect' completed but no artifact path was reported. stderr tail:\n${inspectStderr.slice(-500)}`, [], "Inspect ran but produced no artifact path; check the CLI output.");
+        }
+        if (params.skip_matcher) {
+            return withNextSteps({
+                status: "graph_only",
+                binding: {
+                    orgName: detected.binding.orgName,
+                    workosOrgId: detected.binding.workosOrgId,
+                    applicationId: params.application_id ?? detected.binding.applicationId ?? null,
+                },
+                artifact_path: artifactPath,
+                inspect_stderr_tail: inspectStderr.split("\n").slice(-6).join("\n"),
+            }, [
+                {
+                    id: "run_matcher_now",
+                    label: "Run the matcher against this artifact",
+                    tool: "zivis_threat_run_matcher",
+                    why: "Emit the threat findings deterministic + inference strategies produce.",
+                },
+            ], "Graph artifact built; matcher skipped per request.");
+        }
+        const matcherResult = await runMatcher({ artifactPath, cwd });
+        const inferenceBundle = await buildInferenceBundle(matcherResult.findings);
+        const headline = matcherResult.summary.total === 0
+            ? `Inspected ${matcherResult.ast_files_scanned} files. No public-pack threat patterns fired against this repo.`
+            : `Inspected ${matcherResult.ast_files_scanned} files. Found ${matcherResult.summary.total} threat${matcherResult.summary.total === 1 ? "" : "s"} (${matcherResult.summary.trusted_count} trusted, ${matcherResult.summary.inferred_count} inferred). ` +
+                (inferenceBundle.inference_candidates.length > 0
+                    ? `IMPORTANT: ${inferenceBundle.inference_candidates.length} inference_candidate${inferenceBundle.inference_candidates.length === 1 ? "" : "s"} require host-side execution before findings are presented to the user — see host_required_action.`
+                    : "");
+        return withNextSteps({
+            status: "complete",
+            binding: {
+                orgName: detected.binding.orgName,
+                workosOrgId: detected.binding.workosOrgId,
+                applicationId: params.application_id ?? detected.binding.applicationId ?? null,
+            },
+            artifact_path: artifactPath,
+            matcher: matcherResult,
+            host_required_action: inferenceBundle.host_required_action,
+            inference_candidates: inferenceBundle.inference_candidates,
+            boundary: {
+                local_only: "Repo walk, graph IR construction, public-pack matching, and inference candidate emission all run on this machine. Inference EXECUTION is by your IDE host model (Mode A); no LLM is invoked by ZIVIS itself.",
+                sent_to_platform: "Nothing yet — proprietary platform-side evaluation (Phase 4) ships graph features + match candidates, not raw source.",
+                stays_on_platform: "Proprietary pattern definitions and final scoring logic.",
+            },
+        }, matcherResult.summary.trusted_count > 0
+            ? [
+                {
+                    id: "review_trusted_findings",
+                    label: `Review the ${matcherResult.summary.trusted_count} trusted-lane finding${matcherResult.summary.trusted_count === 1 ? "" : "s"}`,
+                    tool: "zivis_threat_get_capsule",
+                    why: "Trusted findings are evidence-backed and ready to land in the threat model. Pull each capsule for the full threat narrative + repair contract.",
+                },
+                ...(matcherResult.summary.inferred_count > 0
+                    ? [
+                        {
+                            id: "host_runs_inference",
+                            label: `Confirm the ${matcherResult.summary.inferred_count} inferred-lane finding${matcherResult.summary.inferred_count === 1 ? "" : "s"} via your model`,
+                            tool: "zivis_threat_get_inference_prompt",
+                            why: "Inferred findings need host-LLM confirmation. Pull the prompt bundle, run inference, and the JSON output enters the inferred lane until promotion.",
+                        },
+                    ]
+                    : []),
+            ]
+            : matcherResult.summary.inferred_count > 0
+                ? [
+                    {
+                        id: "host_runs_inference",
+                        label: `Confirm the ${matcherResult.summary.inferred_count} inferred-lane finding${matcherResult.summary.inferred_count === 1 ? "" : "s"} via your model`,
+                        tool: "zivis_threat_get_inference_prompt",
+                        why: "Inferred findings need host-LLM confirmation before they can land in the threat model.",
+                    },
+                ]
+                : [
+                    {
+                        id: "expand_via_platform",
+                        label: "Public pack found nothing — proprietary patterns evaluated server-side may still apply",
+                        tool: "zivis_inspect",
+                        why: "Phase 4 sends the artifact to the platform for proprietary pattern evaluation; that path is queued.",
+                    },
+                ], headline);
+    };
+}
+async function spawnInspect(cwd, applicationId) {
+    const bin = await findZivisCliBin();
+    const args = ["inspect", "--root", cwd];
+    if (applicationId) {
+        args.push("--application", applicationId);
+    }
+    return new Promise((resolve, reject) => {
+        const child = spawn(bin.command, [...bin.prefixArgs, ...args], { cwd });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (d) => (stdout += d.toString()));
+        child.stderr.on("data", (d) => (stderr += d.toString()));
+        child.on("error", (err) => reject(err));
+        child.on("close", (code) => {
+            if (code !== 0) {
+                reject(new Error(`zivis inspect exited ${code}\n${stderr.slice(-500)}`));
+                return;
+            }
+            resolve({ stdout, stderr, code: code ?? 0 });
+        });
+    });
+}
+async function findZivisCliBin() {
+    const envBin = process.env.ZIVIS_CLI_BIN;
+    if (envBin) {
+        if (fssync.existsSync(envBin)) {
+            return { command: process.execPath, prefixArgs: [envBin] };
+        }
+        throw new Error(`ZIVIS_CLI_BIN points to ${envBin} which does not exist`);
+    }
+    const sibling = await tryResolveZivisCli();
+    if (sibling) {
+        return { command: process.execPath, prefixArgs: [sibling] };
+    }
+    return { command: "zivis", prefixArgs: [] };
+}
+async function tryResolveZivisCli() {
+    try {
+        const here = path.dirname(fileURLToPath(import.meta.url));
+        const candidates = [
+            path.resolve(here, "../../../zivis-cli/dist/index.js"),
+            path.resolve(here, "../../node_modules/@zivis/cli/dist/index.js"),
+            path.resolve(here, "../../../node_modules/@zivis/cli/dist/index.js"),
+        ];
+        for (const c of candidates) {
+            if (fssync.existsSync(c))
+                return c;
+        }
+    }
+    catch {
+    }
+    return undefined;
+}
+function parseArtifactPath(stderr) {
+    const match = stderr.match(/wrote\s+(\S+\.json)/);
+    return match?.[1];
+}
+void parseArtifactPath;
+void fs;

package/dist/tools/list-applications.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_list_applications — List target applications for the organization
- *
- * Maps to: GET /api/rt/applications
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const LIST_APPLICATIONS_NAME = "zivis_list_applications";
@@ -10,8 +5,8 @@ export declare const LIST_APPLICATIONS_DESCRIPTION = "List target applications c
 export declare const LIST_APPLICATIONS_SCHEMA: {
     status: z.ZodOptional<z.ZodEnum<{
         error: "error";
-        not_connected: "not_connected";
         connected: "connected";
+        not_connected: "not_connected";
         expired: "expired";
     }>>;
     limit: z.ZodDefault<z.ZodNumber>;

package/dist/tools/list-applications.js

@@ -1,8 +1,3 @@
-/**
- * zivis_list_applications — List target applications for the organization
- *
- * Maps to: GET /api/rt/applications
- */
 import { z } from "zod";
 import { sanitizeResponse } from "../sanitize.js";
 export const LIST_APPLICATIONS_NAME = "zivis_list_applications";
@@ -71,4 +66,3 @@ export function createListApplicationsHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=list-applications.js.map

package/dist/tools/list-diagrams.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_list_diagrams — List diagrams for the org
- *
- * Maps to: GET /api/diagrams
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const LIST_DIAGRAMS_NAME = "zivis_list_diagrams";

package/dist/tools/list-diagrams.js

@@ -1,8 +1,3 @@
-/**
- * zivis_list_diagrams — List diagrams for the org
- *
- * Maps to: GET /api/diagrams
- */
 import { z } from "zod";
 import { sanitizeResponse } from "../sanitize.js";
 export const LIST_DIAGRAMS_NAME = "zivis_list_diagrams";
@@ -78,4 +73,3 @@ export function createListDiagramsHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=list-diagrams.js.map

package/dist/tools/list-documents.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_list_documents — List documents in the org.
- *
- * Maps to: GET /api/documents[?threatModelId=<uuid>]
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const LIST_DOCUMENTS_NAME = "zivis_list_documents";

package/dist/tools/list-documents.js

@@ -1,8 +1,3 @@
-/**
- * zivis_list_documents — List documents in the org.
- *
- * Maps to: GET /api/documents[?threatModelId=<uuid>]
- */
 import { z } from "zod";
 import { sanitizeResponse } from "../sanitize.js";
 export const LIST_DOCUMENTS_NAME = "zivis_list_documents";
@@ -47,4 +42,3 @@ export function createListDocumentsHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=list-documents.js.map

package/dist/tools/list-endpoints.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_list_endpoints — List API endpoints for an application
- *
- * Maps to: GET /api/rt/applications/:id/endpoints
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const LIST_ENDPOINTS_NAME = "zivis_list_endpoints";
@@ -14,8 +9,8 @@ export declare const LIST_ENDPOINTS_SCHEMA: {
         POST: "POST";
         GET: "GET";
         PATCH: "PATCH";
-        DELETE: "DELETE";
         PUT: "PUT";
+        DELETE: "DELETE";
         HEAD: "HEAD";
         OPTIONS: "OPTIONS";
     }>>;

package/dist/tools/list-endpoints.js

@@ -1,8 +1,3 @@
-/**
- * zivis_list_endpoints — List API endpoints for an application
- *
- * Maps to: GET /api/rt/applications/:id/endpoints
- */
 import { z } from "zod";
 import { requireApplicationId } from "../resolve-application-id.js";
 import { sanitizeResponse } from "../sanitize.js";
@@ -95,4 +90,3 @@ export function createListEndpointsHandler(apiClient) {
         }
     };
 }
-//# sourceMappingURL=list-endpoints.js.map

package/dist/tools/list-signals.d.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const LIST_SIGNALS_NAME = "zivis_list_signals";
+export declare const LIST_SIGNALS_DESCRIPTION = "List the application's current Signals \u2014 the unified \"needs attention\" stream.\n\nA Signal is ZIVIS's promoted artifact that crosses source families (threat-model Observations, red-team / pen-test Findings, behavior-monitoring Behaviors / Patterns). Each Signal carries severity, status, the chain reference when applicable, and the source family discriminator.\n\nUse this when the user asks:\n- \"what are the open security issues\" / \"what threats does ZIVIS show\"\n- \"what's high or critical\" (filter by severity)\n- \"what's still open\" (filter by status)\n\nReturns display-shaped DTOs. `id` is an opaque token \u2014 pass to `zivis_get_signal` for detail.\n\nSECURITY: This is a low-cost read. Caller must be authorized for the application; cross-org reads return empty.";
+export declare const LIST_SIGNALS_SCHEMA: {
+    application_id: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        medium: "medium";
+        low: "low";
+        info: "info";
+    }>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        open: "open";
+        in_progress: "in_progress";
+        resolved: "resolved";
+        dismissed: "dismissed";
+    }>>;
+};
+export declare function createListSignalsHandler(apiClient: ApiClient): (params: {
+    application_id?: string;
+    severity?: string;
+    status?: string;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/list-signals.js

@@ -0,0 +1,83 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const LIST_SIGNALS_NAME = "zivis_list_signals";
+export const LIST_SIGNALS_DESCRIPTION = `List the application's current Signals — the unified "needs attention" stream.
+
+A Signal is ZIVIS's promoted artifact that crosses source families (threat-model Observations, red-team / pen-test Findings, behavior-monitoring Behaviors / Patterns). Each Signal carries severity, status, the chain reference when applicable, and the source family discriminator.
+
+Use this when the user asks:
+- "what are the open security issues" / "what threats does ZIVIS show"
+- "what's high or critical" (filter by severity)
+- "what's still open" (filter by status)
+
+Returns display-shaped DTOs. \`id\` is an opaque token — pass to \`zivis_get_signal\` for detail.
+
+SECURITY: This is a low-cost read. Caller must be authorized for the application; cross-org reads return empty.`;
+export const LIST_SIGNALS_SCHEMA = {
+    application_id: z
+        .string()
+        .optional()
+        .describe("Application UUID (from zivis_list_applications). If omitted, uses applicationId from .zivis/project.json when set."),
+    severity: z
+        .enum(["critical", "high", "medium", "low", "info"])
+        .optional()
+        .describe("Filter by severity. Omit to return all."),
+    status: z
+        .enum(["open", "in_progress", "resolved", "dismissed"])
+        .optional()
+        .describe("Filter by wire status. Omit to return all."),
+};
+export function createListSignalsHandler(apiClient) {
+    return async (params) => {
+        const req = requireApplicationId(params.application_id);
+        if (!req.ok) {
+            return {
+                content: [{ type: "text", text: `Error: ${req.message}` }],
+                isError: true,
+            };
+        }
+        const application_id = req.id;
+        const qs = new URLSearchParams();
+        if (params.severity)
+            qs.set("severity", params.severity);
+        if (params.status)
+            qs.set("status", params.status);
+        const path = `/api/apps/${application_id}/signals${qs.toString() ? `?${qs}` : ""}`;
+        try {
+            const data = await apiClient.get(path);
+            const result = {
+                total: data.length,
+                items: data.map((s) => ({
+                    id: s.id,
+                    source: s.source,
+                    severity: s.severity,
+                    status: s.status,
+                    confidence: s.confidence,
+                    title: s.title,
+                    category: s.category,
+                    attack_chain: s.attackChain
+                        ? {
+                            name: s.attackChain.chainName,
+                            step: `${s.attackChain.stepIndex}/${s.attackChain.totalSteps}`,
+                        }
+                        : null,
+                    components: s.components?.map((c) => c.name) ?? [],
+                    recommended_action: s.recommendedAction,
+                })),
+            };
+            return {
+                content: [
+                    { type: "text", text: JSON.stringify(sanitizeResponse(result), null, 2) },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to list signals";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/dist/tools/manage-application.d.ts

@@ -0,0 +1,64 @@
+import { z } from "zod";
+import type { ApiClient } from "../api-client.js";
+export declare const MANAGE_APPLICATION_NAME = "zivis_manage_application";
+export declare const MANAGE_APPLICATION_DESCRIPTION = "Create, update, or delete a target application.\n\nActions:\n- create: requires at least name, base_url, auth_type\n- update: patch an existing application (requires application_id)\n- delete: remove an application (requires application_id)";
+export declare const MANAGE_APPLICATION_SCHEMA: {
+    action: z.ZodEnum<{
+        create: "create";
+        update: "update";
+        delete: "delete";
+    }>;
+    application_id: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    base_url: z.ZodOptional<z.ZodString>;
+    api_url: z.ZodOptional<z.ZodString>;
+    auth_type: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        oauth_pkce: "oauth_pkce";
+        static_token: "static_token";
+        client_credentials: "client_credentials";
+        bearer_refresh: "bearer_refresh";
+    }>>;
+    has_rag: z.ZodOptional<z.ZodBoolean>;
+    has_tools: z.ZodOptional<z.ZodBoolean>;
+    has_memory: z.ZodOptional<z.ZodBoolean>;
+    is_multi_turn: z.ZodOptional<z.ZodBoolean>;
+    system_context: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodEnum<{
+        api: "api";
+        chat: "chat";
+        sse: "sse";
+        validation: "validation";
+        web: "web";
+    }>>;
+    use_ephemeral_creds: z.ZodOptional<z.ZodBoolean>;
+};
+export declare function createManageApplicationHandler(apiClient: ApiClient): (params: {
+    action: "create" | "update" | "delete";
+    application_id?: string;
+    name?: string;
+    description?: string;
+    base_url?: string;
+    api_url?: string;
+    auth_type?: "none" | "oauth_pkce" | "static_token" | "client_credentials" | "bearer_refresh";
+    has_rag?: boolean;
+    has_tools?: boolean;
+    has_memory?: boolean;
+    is_multi_turn?: boolean;
+    system_context?: string;
+    type?: "api" | "chat" | "sse" | "validation" | "web";
+    use_ephemeral_creds?: boolean;
+}) => Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;

package/dist/tools/manage-application.js

@@ -0,0 +1,129 @@
+import { z } from "zod";
+import { requireApplicationId } from "../resolve-application-id.js";
+import { sanitizeResponse } from "../sanitize.js";
+export const MANAGE_APPLICATION_NAME = "zivis_manage_application";
+export const MANAGE_APPLICATION_DESCRIPTION = `Create, update, or delete a target application.
+
+Actions:
+- create: requires at least name, base_url, auth_type
+- update: patch an existing application (requires application_id)
+- delete: remove an application (requires application_id)`;
+export const MANAGE_APPLICATION_SCHEMA = {
+    action: z.enum(["create", "update", "delete"]).describe("CRUD action"),
+    application_id: z
+        .string()
+        .optional()
+        .describe("Required for update/delete. Optional for create."),
+    name: z.string().optional().describe("Application name"),
+    description: z.string().optional().describe("Application description"),
+    base_url: z.string().optional().describe("Base URL, e.g. https://api.example.com"),
+    api_url: z.string().optional().describe("Explicit API URL"),
+    auth_type: z
+        .enum(["none", "oauth_pkce", "static_token", "client_credentials", "bearer_refresh"])
+        .optional()
+        .describe("Application auth type (required for create)"),
+    has_rag: z.boolean().optional().describe("LLM capability flag"),
+    has_tools: z.boolean().optional().describe("LLM capability flag"),
+    has_memory: z.boolean().optional().describe("LLM capability flag"),
+    is_multi_turn: z.boolean().optional().describe("LLM capability flag"),
+    system_context: z.string().optional().describe("System context/prompt context"),
+    type: z
+        .enum(["api", "chat", "sse", "validation", "web"])
+        .optional()
+        .describe("Application type"),
+    use_ephemeral_creds: z
+        .boolean()
+        .optional()
+        .describe("Whether ephemeral credentials are enabled"),
+};
+export function createManageApplicationHandler(apiClient) {
+    return async (params) => {
+        try {
+            const { action } = params;
+            let data;
+            if (action === "create") {
+                if (!params.name || !params.base_url || !params.auth_type) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: "Error: create requires name, base_url, and auth_type",
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                data = await apiClient.post("/api/rt/applications", {
+                    name: params.name,
+                    description: params.description,
+                    baseUrl: params.base_url,
+                    apiUrl: params.api_url,
+                    authType: params.auth_type,
+                    hasRag: params.has_rag,
+                    hasTools: params.has_tools,
+                    hasMemory: params.has_memory,
+                    isMultiTurn: params.is_multi_turn,
+                    systemContext: params.system_context,
+                    type: params.type,
+                    useEphemeralCreds: params.use_ephemeral_creds,
+                });
+            }
+            else {
+                const req = requireApplicationId(params.application_id);
+                if (!req.ok) {
+                    return {
+                        content: [{ type: "text", text: `Error: ${req.message}` }],
+                        isError: true,
+                    };
+                }
+                if (action === "delete") {
+                    data = await apiClient.del(`/api/rt/applications/${req.id}`);
+                }
+                else {
+                    const body = {};
+                    if (params.name !== undefined)
+                        body.name = params.name;
+                    if (params.description !== undefined)
+                        body.description = params.description;
+                    if (params.base_url !== undefined)
+                        body.baseUrl = params.base_url;
+                    if (params.api_url !== undefined)
+                        body.apiUrl = params.api_url;
+                    if (params.auth_type !== undefined)
+                        body.authType = params.auth_type;
+                    if (params.has_rag !== undefined)
+                        body.hasRag = params.has_rag;
+                    if (params.has_tools !== undefined)
+                        body.hasTools = params.has_tools;
+                    if (params.has_memory !== undefined)
+                        body.hasMemory = params.has_memory;
+                    if (params.is_multi_turn !== undefined)
+                        body.isMultiTurn = params.is_multi_turn;
+                    if (params.system_context !== undefined)
+                        body.systemContext = params.system_context;
+                    if (params.type !== undefined)
+                        body.type = params.type;
+                    if (params.use_ephemeral_creds !== undefined) {
+                        body.useEphemeralCreds = params.use_ephemeral_creds;
+                    }
+                    data = await apiClient.patch(`/api/rt/applications/${req.id}`, body);
+                }
+            }
+            const sanitized = sanitizeResponse({
+                action,
+                application_id: params.application_id,
+                result: data,
+            });
+            return {
+                content: [{ type: "text", text: JSON.stringify(sanitized, null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to manage application";
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}

package/dist/tools/manage-diagram.d.ts

@@ -1,8 +1,3 @@
-/**
- * zivis_manage_diagram — Update, delete, or modify diagram content
- *
- * Maps to: PATCH/DELETE /api/diagrams/:id and sub-resource endpoints
- */
 import { z } from "zod";
 import type { ApiClient } from "../api-client.js";
 export declare const MANAGE_DIAGRAM_NAME = "zivis_manage_diagram";