Add risk publish to document system

Replace the old snapshot-based system for risks with the publish
document system, mirroring the prior vendor / processing activity / DPIA
/ TIA migration. Includes the GraphQL mutation, MCP tool, CLI command,
n8n operation, frontend publish dialog, e2e tests, and a prosemirror
register template covering name, description, category, treatment,
owner, inherent and residual scoring, and notes.

The risk register lives as a generated DocumentTypeRegister document on
the organization, reused across publishes (the major version bumps on
every republish). Approvers can be passed in to create a draft pending
approval; otherwise the version is published immediately. The frontend
Risks page exposes a Publish button and a Document link button when the
document exists, and pre-fills the previous default approvers.

Risks was the last remaining snapshot type, so this commit also removes
the entire snapshot system: drop snapshotId from the Risk GraphQL type
and RiskFilter; remove RiskSnapshotter, Risks.Snapshot,
InsertRiskSnapshots, and the SnapshotID/SourceID fields on Risk; delete
Snapshot, ControlSnapshot, SnapshotsType, SnapshotOrderField,
Snapshottable, the SnapshotService, the Snapshot console resolvers and
GraphQL schema, the Snapshot MCP types and operations
(list/get/take/listControlSnapshots), the snapshot CLI (prb snapshot),
the snapshot frontend pages, routes, banner, LinkedSnapshotsCard,
SnapshotGraph, snapshot helpers, and the snapshot n8n resource and
control link/unlink snapshot operations. The snapshot_id columns remain
in the database but are now filtered out with snapshot_id IS NULL.

Add Get/Upsert/Clear GeneratedDocumentID methods on Risk backed by a new
risks_document_id column on generated_documents, matching the
ProcessingActivity/Finding/Vendor pattern. The migration command
migrate-risk-snapshots-to-documents uses raw SQL queries instead of the
Go snapshot types, since those are gone.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -274,10 +274,9 @@ func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest,
 
 	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
 
-	noSnapshot := (*gid.GID)(nil)
-	riskFilter := coredata.NewRiskFilter(nil, &noSnapshot)
+	riskFilter := coredata.NewRiskFilter(nil)
 	if input.Filter != nil {
-		riskFilter = coredata.NewRiskFilter(input.Filter.Query, &input.Filter.SnapshotID)
+		riskFilter = coredata.NewRiskFilter(input.Filter.Query)
 	}
 
 	page, err := prb.Risks.ListForOrganizationID(ctx, input.OrganizationID, cursor, riskFilter)
@@ -1511,11 +1510,6 @@ func (r *Resolver) LinkControlTool(ctx context.Context, req *mcp.CallToolRequest
 		if _, _, err := svc.Controls.CreateAuditMapping(ctx, input.ControlID, input.ResourceID); err != nil {
 			return nil, types.LinkControlOutput{}, fmt.Errorf("failed to link control to audit: %w", err)
 		}
-	case coredata.SnapshotEntityType:
-		r.MustAuthorize(ctx, input.ControlID, probo.ActionControlSnapshotMappingCreate)
-		if _, _, err := svc.Controls.CreateSnapshotMapping(ctx, input.ControlID, input.ResourceID); err != nil {
-			return nil, types.LinkControlOutput{}, fmt.Errorf("failed to link control to snapshot: %w", err)
-		}
 	case coredata.ObligationEntityType:
 		r.MustAuthorize(ctx, input.ControlID, probo.ActionControlObligationMappingCreate)
 		if _, _, err := svc.Controls.CreateObligationMapping(ctx, input.ControlID, input.ResourceID); err != nil {
@@ -1547,11 +1541,6 @@ func (r *Resolver) UnlinkControlTool(ctx context.Context, req *mcp.CallToolReque
 		if _, _, err := svc.Controls.DeleteAuditMapping(ctx, input.ControlID, input.ResourceID); err != nil {
 			return nil, types.UnlinkControlOutput{}, fmt.Errorf("failed to unlink control from audit: %w", err)
 		}
-	case coredata.SnapshotEntityType:
-		r.MustAuthorize(ctx, input.ControlID, probo.ActionControlSnapshotMappingDelete)
-		if _, _, err := svc.Controls.DeleteSnapshotMapping(ctx, input.ControlID, input.ResourceID); err != nil {
-			return nil, types.UnlinkControlOutput{}, fmt.Errorf("failed to unlink control from snapshot: %w", err)
-		}
 	case coredata.ObligationEntityType:
 		r.MustAuthorize(ctx, input.ControlID, probo.ActionControlObligationMappingDelete)
 		if _, _, err := svc.Controls.DeleteObligationMapping(ctx, input.ControlID, input.ResourceID); err != nil {
@@ -1668,32 +1657,6 @@ func (r *Resolver) ListControlAuditsTool(ctx context.Context, req *mcp.CallToolR
 	return nil, types.NewListControlAuditsOutput(auditPage), nil
 }
 
-func (r *Resolver) ListControlSnapshotsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlSnapshotsInput) (*mcp.CallToolResult, types.ListControlSnapshotsOutput, error) {
-	r.MustAuthorize(ctx, input.ControlID, probo.ActionControlGet)
-
-	prb := r.ProboService(ctx, input.ControlID)
-
-	pageOrderBy := page.OrderBy[coredata.SnapshotOrderField]{
-		Field:     coredata.SnapshotOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-	if input.OrderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.SnapshotOrderField]{
-			Field:     input.OrderBy.Field,
-			Direction: input.OrderBy.Direction,
-		}
-	}
-
-	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
-
-	snapshotPage, err := prb.Snapshots.ListForControlID(ctx, input.ControlID, cursor)
-	if err != nil {
-		return nil, types.ListControlSnapshotsOutput{}, fmt.Errorf("failed to list control snapshots: %w", err)
-	}
-
-	return nil, types.NewListControlSnapshotsOutput(snapshotPage), nil
-}
-
 func (r *Resolver) ListRiskObligationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRiskObligationsInput) (*mcp.CallToolResult, types.ListRiskObligationsOutput, error) {
 	r.MustAuthorize(ctx, input.RiskID, probo.ActionRiskGet)
 
@@ -1915,68 +1878,6 @@ func (r *Resolver) DeleteTaskTool(ctx context.Context, req *mcp.CallToolRequest,
 	}, nil
 }
 
-func (r *Resolver) ListSnapshotsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListSnapshotsInput) (*mcp.CallToolResult, types.ListSnapshotsOutput, error) {
-	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionSnapshotList)
-
-	prb := r.ProboService(ctx, input.OrganizationID)
-
-	pageOrderBy := page.OrderBy[coredata.SnapshotOrderField]{
-		Field:     coredata.SnapshotOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-	if input.OrderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.SnapshotOrderField]{
-			Field:     input.OrderBy.Field,
-			Direction: input.OrderBy.Direction,
-		}
-	}
-
-	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
-
-	page, err := prb.Snapshots.ListForOrganizationID(ctx, input.OrganizationID, cursor)
-	if err != nil {
-		panic(fmt.Errorf("cannot list organization snapshots: %w", err))
-	}
-
-	return nil, types.NewListSnapshotsOutput(page), nil
-}
-
-func (r *Resolver) GetSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetSnapshotInput) (*mcp.CallToolResult, types.GetSnapshotOutput, error) {
-	r.MustAuthorize(ctx, input.ID, probo.ActionSnapshotGet)
-
-	prb := r.ProboService(ctx, input.ID)
-
-	snapshot, err := prb.Snapshots.Get(ctx, input.ID)
-	if err != nil {
-		return nil, types.GetSnapshotOutput{}, fmt.Errorf("failed to get snapshot: %w", err)
-	}
-	return nil, types.GetSnapshotOutput{
-		Snapshot: types.NewSnapshot(snapshot),
-	}, nil
-}
-
-func (r *Resolver) TakeSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.TakeSnapshotInput) (*mcp.CallToolResult, types.TakeSnapshotOutput, error) {
-	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionSnapshotCreate)
-
-	prb := r.ProboService(ctx, input.OrganizationID)
-
-	snapshot, err := prb.Snapshots.Create(
-		ctx,
-		&probo.CreateSnapshotRequest{
-			OrganizationID: input.OrganizationID,
-			Name:           input.Name,
-			Description:    input.Description,
-			Type:           input.Type,
-		},
-	)
-	if err != nil {
-		return nil, types.TakeSnapshotOutput{}, fmt.Errorf("failed to take snapshot: %w", err)
-	}
-	return nil, types.TakeSnapshotOutput{
-		Snapshot: types.NewSnapshot(snapshot),
-	}, nil
-}
-
 func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentsInput) (*mcp.CallToolResult, types.ListDocumentsOutput, error) {
 	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionDocumentList)
 
@@ -2314,7 +2215,7 @@ func (r *Resolver) ListMeasureRisksTool(ctx context.Context, req *mcp.CallToolRe
 
 	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
 
-	riskPage, err := prb.Risks.ListForMeasureID(ctx, input.MeasureID, cursor, coredata.NewRiskFilter(nil, nil))
+	riskPage, err := prb.Risks.ListForMeasureID(ctx, input.MeasureID, cursor, coredata.NewRiskFilter(nil))
 	if err != nil {
 		return nil, types.ListMeasureRisksOutput{}, fmt.Errorf("failed to list measure risks: %w", err)
 	}
@@ -5190,3 +5091,19 @@ func (r *Resolver) GetCookieConsentRecordTool(ctx context.Context, req *mcp.Call
 	}
 	return nil, types.GetCookieConsentRecordOutput{CookieConsentRecord: types.NewCookieConsentRecord(record)}, nil
 }
+
+func (r *Resolver) PublishRiskListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishRiskListInput) (*mcp.CallToolResult, types.PublishRiskListOutput, error) {
+	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionRiskPublish)
+
+	svc := r.ProboService(ctx, input.OrganizationID)
+
+	document, documentVersion, err := svc.GeneratedDocuments.PublishRiskList(ctx, input.OrganizationID, input.ApproverIds)
+	if err != nil {
+		return nil, types.PublishRiskListOutput{}, fmt.Errorf("cannot publish risk list: %w", err)
+	}
+
+	return nil, types.PublishRiskListOutput{
+		DocumentID:        document.ID,
+		DocumentVersionID: documentVersion.ID,
+	}, nil
+}

pkg/server/api/mcp/v1/specification.yaml

@@ -1499,13 +1499,6 @@ components:
         organization_id:
           $ref: "#/components/schemas/GID"
           description: Organization ID
-        snapshot_id:
-          anyOf:
-            - type: string
-              $ref: "#/components/schemas/GID"
-            - type: "null"
-              description: No snapshot
-          description: Snapshot ID
         name:
           type: string
           description: Risk name
@@ -1579,12 +1572,6 @@ components:
             query:
               type: string
               description: Search query
-            snapshot_id:
-              anyOf:
-                - $ref: "#/components/schemas/GID"
-                - type: "null"
-              description: Filter by snapshot ID. Defaults to null, which returns only risks with no snapshot (current live data). Pass a specific snapshot ID to retrieve risks as they were at that snapshot.
-              default: null
 
     ListRisksOutput:
       type: object
@@ -4772,7 +4759,7 @@ components:
           description: Control ID
         resource_id:
           $ref: "#/components/schemas/GID"
-          description: ID of the resource to link (measure, document, audit, snapshot, or obligation)
+          description: ID of the resource to link (measure, document, audit, or obligation)
 
     LinkControlOutput:
       type: object
@@ -4788,7 +4775,7 @@ components:
           description: Control ID
         resource_id:
           $ref: "#/components/schemas/GID"
-          description: ID of the resource to unlink (measure, document, audit, snapshot, or obligation)
+          description: ID of the resource to unlink (measure, document, audit, or obligation)
 
     UnlinkControlOutput:
       type: object
@@ -4917,37 +4904,6 @@ components:
           items:
             $ref: "#/components/schemas/Audit"
 
-    ListControlSnapshotsInput:
-      type: object
-      required:
-        - control_id
-      properties:
-        control_id:
-          $ref: "#/components/schemas/GID"
-          description: Control ID
-        cursor:
-          $ref: "#/components/schemas/CursorKey"
-          description: Page cursor
-        size:
-          type: integer
-          description: Page size
-        order_by:
-          $ref: "#/components/schemas/SnapshotOrderBy"
-          description: Snapshot order by
-
-    ListControlSnapshotsOutput:
-      type: object
-      required:
-        - snapshots
-      properties:
-        next_cursor:
-          $ref: "#/components/schemas/CursorKey"
-          description: Next cursor
-        snapshots:
-          type: array
-          items:
-            $ref: "#/components/schemas/Snapshot"
-
     ListRiskObligationsInput:
       type: object
       required:
@@ -5354,150 +5310,6 @@ components:
           $ref: "#/components/schemas/GID"
           description: Deleted task ID
 
-    SnapshotsType:
-      type: string
-      enum:
-        - RISKS
-        - NONCONFORMITIES
-        - OBLIGATIONS
-        - CONTINUAL_IMPROVEMENTS
-        - PROCESSING_ACTIVITIES
-        - STATEMENTS_OF_APPLICABILITY
-      go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.SnapshotsType
-
-    SnapshotOrderField:
-      type: string
-      enum:
-        - CREATED_AT
-        - NAME
-        - TYPE
-      go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.SnapshotOrderField
-
-    SnapshotOrderBy:
-      type: object
-      required:
-        - field
-        - direction
-      properties:
-        field:
-          $ref: "#/components/schemas/SnapshotOrderField"
-          description: Snapshot order field
-        direction:
-          $ref: "#/components/schemas/OrderDirection"
-          description: Snapshot order direction
-
-    Snapshot:
-      type: object
-      required:
-        - id
-        - organization_id
-        - name
-        - type
-        - created_at
-      properties:
-        id:
-          $ref: "#/components/schemas/GID"
-          description: Snapshot ID
-        organization_id:
-          $ref: "#/components/schemas/GID"
-          description: Organization ID
-        name:
-          type: string
-          description: Snapshot name
-        description:
-          anyOf:
-            - type: string
-              description: Snapshot description
-            - type: "null"
-              description: No description
-          description: Snapshot description
-        type:
-          $ref: "#/components/schemas/SnapshotsType"
-          description: Snapshot type
-        created_at:
-          type: string
-          format: date-time
-          description: Creation timestamp
-
-    ListSnapshotsInput:
-      type: object
-      required:
-        - organization_id
-      properties:
-        organization_id:
-          $ref: "#/components/schemas/GID"
-          description: Organization ID
-        order_by:
-          $ref: "#/components/schemas/SnapshotOrderBy"
-          description: Snapshot order by
-        size:
-          type: integer
-          description: Page size
-        cursor:
-          $ref: "#/components/schemas/CursorKey"
-          description: Page cursor
-
-    ListSnapshotsOutput:
-      type: object
-      required:
-        - snapshots
-      properties:
-        snapshots:
-          type: array
-          items:
-            $ref: "#/components/schemas/Snapshot"
-          description: List of snapshots
-        next_cursor:
-          anyOf:
-            - $ref: "#/components/schemas/CursorKey"
-            - type: "null"
-          description: Next page cursor
-
-    GetSnapshotInput:
-      type: object
-      required:
-        - id
-      properties:
-        id:
-          $ref: "#/components/schemas/GID"
-          description: Snapshot ID
-
-    GetSnapshotOutput:
-      type: object
-      required:
-        - snapshot
-      properties:
-        snapshot:
-          $ref: "#/components/schemas/Snapshot"
-
-    TakeSnapshotInput:
-      type: object
-      required:
-        - organization_id
-        - name
-        - type
-      properties:
-        organization_id:
-          $ref: "#/components/schemas/GID"
-          description: Organization ID
-        name:
-          type: string
-          description: Snapshot name
-        description:
-          type: string
-          description: Snapshot description
-        type:
-          $ref: "#/components/schemas/SnapshotsType"
-          description: Snapshot type (determines which collection to snapshot)
-
-    TakeSnapshotOutput:
-      type: object
-      required:
-        - snapshot
-      properties:
-        snapshot:
-          $ref: "#/components/schemas/Snapshot"
-
     DocumentType:
       type: string
       enum:
@@ -6815,16 +6627,6 @@ components:
         cursor:
           $ref: "#/components/schemas/CursorKey"
           description: Page cursor
-        filter:
-          type: object
-          properties:
-            snapshot_id:
-              anyOf:
-                - $ref: "#/components/schemas/GID"
-                - type: "null"
-              description: Filter by snapshot ID. Defaults to null, which returns only statements of applicability with no snapshot (current live data). Pass a specific snapshot ID to retrieve statements of applicability as they were at that snapshot.
-              default: null
-
     ListStatementsOfApplicabilityOutput:
       type: object
       required:
@@ -7131,6 +6933,33 @@ components:
           $ref: "#/components/schemas/GID"
           description: Created document version ID
 
+    PublishRiskListInput:
+      type: object
+      required:
+        - organization_id
+      properties:
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        approver_ids:
+          type: array
+          items:
+            $ref: "#/components/schemas/GID"
+          description: Optional approver profile IDs. If provided, creates a draft pending approval instead of publishing immediately.
+
+    PublishRiskListOutput:
+      type: object
+      required:
+        - document_id
+        - document_version_id
+      properties:
+        document_id:
+          $ref: "#/components/schemas/GID"
+          description: Created or updated document ID
+        document_version_id:
+          $ref: "#/components/schemas/GID"
+          description: Created document version ID
+
     PublishStatementOfApplicabilityInput:
       type: object
       required:
@@ -7201,11 +7030,6 @@ components:
         organization_id:
           $ref: "#/components/schemas/GID"
           description: Organization ID
-        snapshot_id:
-          anyOf:
-            - $ref: "#/components/schemas/GID"
-            - type: "null"
-          description: Snapshot ID
         applicability:
           type: boolean
           description: Whether the control is applicable
@@ -10842,7 +10666,7 @@ tools:
     outputSchema:
       $ref: "#/components/schemas/UpdateControlOutput"
   - name: linkControl
-    description: Link a resource to a control (measure, document, audit, snapshot, or obligation). The resource type is determined from the resource_id GID.
+    description: Link a resource to a control (measure, document, audit, or obligation). The resource type is determined from the resource_id GID.
     hints:
       readonly: false
     inputSchema:
@@ -10850,7 +10674,7 @@ tools:
     outputSchema:
       $ref: "#/components/schemas/LinkControlOutput"
   - name: unlinkControl
-    description: Unlink a resource from a control (measure, document, audit, snapshot, or obligation). The resource type is determined from the resource_id GID.
+    description: Unlink a resource from a control (measure, document, audit, or obligation). The resource type is determined from the resource_id GID.
     hints:
       readonly: false
     inputSchema:
@@ -10893,15 +10717,6 @@ tools:
       $ref: "#/components/schemas/ListControlAuditsInput"
     outputSchema:
       $ref: "#/components/schemas/ListControlAuditsOutput"
-  - name: listControlSnapshots
-    description: List snapshots linked to a control
-    hints:
-      readonly: true
-      idempotent: true
-    inputSchema:
-      $ref: "#/components/schemas/ListControlSnapshotsInput"
-    outputSchema:
-      $ref: "#/components/schemas/ListControlSnapshotsOutput"
   - name: listRiskObligations
     description: List obligations linked to a risk
     hints:
@@ -10986,32 +10801,6 @@ tools:
       $ref: "#/components/schemas/DeleteTaskInput"
     outputSchema:
       $ref: "#/components/schemas/DeleteTaskOutput"
-  - name: listSnapshots
-    description: List all snapshots for the organization
-    hints:
-      readonly: true
-      idempotent: true
-    inputSchema:
-      $ref: "#/components/schemas/ListSnapshotsInput"
-    outputSchema:
-      $ref: "#/components/schemas/ListSnapshotsOutput"
-  - name: getSnapshot
-    description: Get a snapshot by ID
-    hints:
-      readonly: true
-      idempotent: true
-    inputSchema:
-      $ref: "#/components/schemas/GetSnapshotInput"
-    outputSchema:
-      $ref: "#/components/schemas/GetSnapshotOutput"
-  - name: takeSnapshot
-    description: Take a snapshot of a collection of objects (risks, vendors, findings, obligations, or processing activities)
-    hints:
-      readonly: false
-    inputSchema:
-      $ref: "#/components/schemas/TakeSnapshotInput"
-    outputSchema:
-      $ref: "#/components/schemas/TakeSnapshotOutput"
   - name: listDocuments
     description: List documents for the organization. By default only ACTIVE documents are returned; pass status filter to include ARCHIVED.
     hints:
@@ -11281,6 +11070,14 @@ tools:
       $ref: "#/components/schemas/PublishVendorListInput"
     outputSchema:
       $ref: "#/components/schemas/PublishVendorListOutput"
+  - name: publishRiskList
+    description: Publish the risk register for an organization as a document. If a document already exists, a new version is created.
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/PublishRiskListInput"
+    outputSchema:
+      $ref: "#/components/schemas/PublishRiskListOutput"
   - name: publishStatementOfApplicability
     description: Publish a statement of applicability as a document. If a document already exists, a new version is created.
     hints:

pkg/server/api/mcp/v1/types/risk.go

@@ -35,7 +35,6 @@ func NewRisk(r *coredata.Risk) *Risk {
 		ResidualLikelihood: r.ResidualLikelihood,
 		ResidualImpact:     r.ResidualImpact,
 		ResidualRiskScore:  r.ResidualRiskScore,
-		SnapshotID:         r.SnapshotID,
 		CreatedAt:          r.CreatedAt,
 		UpdatedAt:          r.UpdatedAt,
 	}

pkg/server/api/mcp/v1/types/snapshot.go

@@ -1,66 +0,0 @@
-// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-
-package types
-
-import (
-	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/page"
-)
-
-func NewSnapshot(s *coredata.Snapshot) *Snapshot {
-	return &Snapshot{
-		ID:             s.ID,
-		OrganizationID: s.OrganizationID,
-		Name:           s.Name,
-		Type:           s.Type,
-		Description:    s.Description,
-		CreatedAt:      s.CreatedAt,
-	}
-}
-
-func NewListControlSnapshotsOutput(snapshotPage *page.Page[*coredata.Snapshot, coredata.SnapshotOrderField]) ListControlSnapshotsOutput {
-	snapshots := make([]*Snapshot, 0, len(snapshotPage.Data))
-	for _, s := range snapshotPage.Data {
-		snapshots = append(snapshots, NewSnapshot(s))
-	}
-
-	var nextCursor *page.CursorKey
-	if len(snapshotPage.Data) > 0 {
-		cursorKey := snapshotPage.Data[len(snapshotPage.Data)-1].CursorKey(snapshotPage.Cursor.OrderBy.Field)
-		nextCursor = &cursorKey
-	}
-
-	return ListControlSnapshotsOutput{
-		NextCursor: nextCursor,
-		Snapshots:  snapshots,
-	}
-}
-
-func NewListSnapshotsOutput(snapshotPage *page.Page[*coredata.Snapshot, coredata.SnapshotOrderField]) ListSnapshotsOutput {
-	snapshots := make([]*Snapshot, 0, len(snapshotPage.Data))
-	for _, s := range snapshotPage.Data {
-		snapshots = append(snapshots, NewSnapshot(s))
-	}
-
-	var nextCursor *page.CursorKey
-	if len(snapshotPage.Data) > 0 {
-		cursorKey := snapshotPage.Data[len(snapshotPage.Data)-1].CursorKey(snapshotPage.Cursor.OrderBy.Field)
-		nextCursor = &cursorKey
-	}
-
-	return ListSnapshotsOutput{
-		NextCursor: nextCursor,
-		Snapshots:  snapshots,
-	}
-}

pkg/server/api/mcp/v1/types/statement_of_applicability.go

@@ -51,7 +51,6 @@ func NewApplicabilityStatement(a *coredata.ApplicabilityStatement) *Applicabilit
 		StatementOfApplicabilityID: a.StatementOfApplicabilityID,
 		ControlID:                  a.ControlID,
 		OrganizationID:             a.OrganizationID,
-		SnapshotID:                 a.SnapshotID,
 		Applicability:              a.Applicability,
 		Justification:              a.Justification,
 		CreatedAt:                  a.CreatedAt,