import * as z from "zod/v4";
export function registerVulnerabilityTriagePrompt(server) {
    server.registerPrompt("vulnerability-triage", {
        description: "Triage security vulnerabilities across pipelines and artifacts, prioritize by severity and exploitability",
        argsSchema: {
            projectId: z.string().describe("Project identifier").optional(),
            severity: z.string().describe("Severity filter: critical, high, medium, low (comma-separated)").optional(),
        },
    }, async ({ projectId, severity }) => {
        const projectFilter = projectId ? `, project_id="${projectId}"` : "";
        const severityFilter = severity ? `, severity="${severity}"` : `, severity="critical,high"`;
        return {
            messages: [{
                    role: "user",
                    content: {
                        type: "text",
                        text: `Triage security vulnerabilities and provide prioritized remediation guidance.

Steps:
1. **STO issues**: Call harness_list with resource_type="security_issue"${projectFilter}${severityFilter} to get pipeline security scan findings
2. **Artifact security**: Call harness_list with resource_type="artifact_security"${projectFilter} to check artifact-level vulnerabilities
3. **Code repo security**: Call harness_list with resource_type="code_repo_security"${projectFilter} to check source code security findings
4. **Check exemptions**: Call harness_list with resource_type="security_exemption"${projectFilter} to see existing exemptions (avoid duplicating work)
5. **Triage and prioritize**: Create a priority matrix:
   - **P0 (Immediate)**: Critical severity + exploitable + in production
   - **P1 (This week)**: High severity OR critical but not yet in production
   - **P2 (This sprint)**: Medium severity in production
   - **P3 (Backlog)**: Low severity or already mitigated
6. **For each P0/P1 vulnerability**:
   - Affected artifact/service/repo
   - CVE details and CVSS score
   - Exploitability assessment
   - Specific remediation (upgrade version, patch, configuration change)
   - Workaround if immediate fix isn't possible

Present the triage summary table, then detailed remediation for critical items.

## Suggested next steps

After presenting the triage summary and detailed P0/P1 remediations, append
a final section titled "## Suggested next steps" containing 3–5 personalized
follow-up prompts. Use human-readable titles (CVE ID, component name, target,
scan tool, pipeline) — NEVER raw issue UUIDs in the visible text. Mix
single-entity actions with bulk actions when patterns emerge.

Format: a markdown bullet list of complete, send-as-is sentences.

Example shape (use real titles/targets/scanners from your output, not these literals):
- Triage all Critical SAST findings for target payment-api
- Filter security_issue by scan_tool=<scanner-from-response> to see all <scanner> findings
- Show all Critical issues for pipeline <pipeline-name-from-response>
- List Approved exemptions for target <target-from-response>

Rules:
- Use CVE IDs / component / target / scan-tool / pipeline names visible to the user; never paste UUIDs
- Prefer bulk actions when 3+ issues share a pattern
- Maximum 5 suggestions; mix at least one bulk action when applicable
- Each line is a single, complete imperative sentence
- Order: most-actionable first (deep dive on the top P0), then bulk, then broader exploration
- Omit the section entirely if no findings were returned`,
                    },
                }],
        };
    });
}
//# sourceMappingURL=vulnerability-triage.js.map