@kubbisec/ai-linux-arm64 0.1.10 → 0.1.12

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-platform-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/resolve-platform-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAO3F;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAMjC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPlatformPermissionsFromGlobalUserRole = getPlatformPermissionsFromGlobalUserRole;
+const kubbisec_permissions_1 = require("./kubbisec-permissions");
+const PLATFORM_ACCOUNT_MANAGER = new Set([
+    "kbsc.platform.org.read",
+    "kbsc.platform.user.read",
+]);
+/**
+ * Maps global `user.role` (Better Auth admin plugin uses `admin`) + future slugs.
+ * `admin` and `platform_super_admin` receive the full `kbsc.*` catalog (tenant + platform).
+ */
+function getPlatformPermissionsFromGlobalUserRole(role) {
+    if (!role)
+        return new Set();
+    const r = role.trim();
+    if (r === "admin" || r === "platform_super_admin")
+        return kubbisec_permissions_1.ALL_KUBBISEC_PERMISSIONS;
+    if (r === "platform_account_manager")
+        return PLATFORM_ACCOUNT_MANAGER;
+    return new Set();
+}
+//# sourceMappingURL=resolve-platform-permissions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-platform-permissions.js","sourceRoot":"","sources":["../../src/rbac/resolve-platform-permissions.ts"],"names":[],"mappings":";;AAWA,4FAQC;AAnBD,iEAA2F;AAE3F,MAAM,wBAAwB,GAAoC,IAAI,GAAG,CAAC;IACxE,wBAAwB;IACxB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,wCAAwC,CACtD,IAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,sBAAsB;QAAE,OAAO,+CAAwB,CAAC;IACnF,IAAI,CAAC,KAAK,0BAA0B;QAAE,OAAO,wBAAwB,CAAC;IACtE,OAAO,IAAI,GAAG,EAAE,CAAC;AACnB,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/redaction.d.ts

@@ -0,0 +1,13 @@
+export declare const REDACTED_VALUE = "[REDACTED]";
+export type RedactionOptions = {
+    redactRawData?: boolean;
+    redactMetadata?: boolean;
+};
+export declare function redactSensitiveData<T>(value: T): T;
+export declare function sanitizeReportPayload<T extends {
+    metadata?: Record<string, unknown>;
+    vulnerabilities?: Array<{
+        rawData?: Record<string, unknown>;
+    }>;
+}>(report: T, options?: RedactionOptions): T;
+//# sourceMappingURL=redaction.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,eAAe,CAAC;AAiD3C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AA+LF,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA2ClD;AAED,wBAAgB,qBAAqB,CACnC,CAAC,SAAS;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAChE,EACD,MAAM,EAAE,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,CAAC,CAyB9C"}

package/bundled/node_modules/@aspm/shared/dist/redaction.js

@@ -0,0 +1,249 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REDACTED_VALUE = void 0;
+exports.redactSensitiveData = redactSensitiveData;
+exports.sanitizeReportPayload = sanitizeReportPayload;
+/**
+ * Structured redaction uses **@pinojs/redact** (Pino / Node.js logging stack), the same path
+ * model as `fast-redact` and Pino log redaction.
+ * @see https://github.com/pinojs/redact
+ *
+ * Key rules (headers vs env, substring keys, allowlist for fingerprint/secretHash) and
+ * inline secret patterns in strings stay defined here for ASPM report shapes.
+ */
+const redact_1 = __importDefault(require("@pinojs/redact"));
+exports.REDACTED_VALUE = "[REDACTED]";
+const SENSITIVE_KEY_PARTS = [
+    "accesstoken",
+    "apikey",
+    "apitoken",
+    "authorization",
+    "bearertoken",
+    "clientsecret",
+    "credential",
+    "idtoken",
+    "password",
+    "passwd",
+    "privatekey",
+    "refreshtoken",
+    "secret",
+    "session",
+    "token",
+];
+const SENSITIVE_EXACT_KEYS = new Set([
+    "auth",
+    "cookie",
+    "match",
+    "offender",
+    "proxyauthorization",
+    "pwd",
+    "secret",
+    "setcookie",
+]);
+const SENSITIVE_HEADER_KEYS = new Set([
+    "authorization",
+    "cookie",
+    "proxyauthorization",
+    "setcookie",
+    "xapikey",
+    "xauthtoken",
+    "xcsrftoken",
+    "xgithubtoken",
+]);
+const NON_SENSITIVE_EXACT_KEYS = new Set(["fingerprint", "secrethash"]);
+const ENV_CONTAINER_KEYS = new Set(["env", "environment", "environmentvariables", "envvars"]);
+const HEADER_CONTAINER_KEYS = new Set(["header", "headers", "requestheaders", "responseheaders"]);
+const MAX_REDACTION_DEPTH = 20;
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isSensitiveKey(key) {
+    const normalized = normalizeKey(key);
+    if (NON_SENSITIVE_EXACT_KEYS.has(normalized))
+        return false;
+    return (SENSITIVE_EXACT_KEYS.has(normalized) ||
+        SENSITIVE_KEY_PARTS.some((part) => normalized.includes(part)));
+}
+function shouldRedactValue(key, parentKey) {
+    const normalizedKey = normalizeKey(key);
+    const normalizedParentKey = parentKey ? normalizeKey(parentKey) : "";
+    if (HEADER_CONTAINER_KEYS.has(normalizedParentKey)) {
+        return SENSITIVE_HEADER_KEYS.has(normalizedKey) || isSensitiveKey(key);
+    }
+    if (ENV_CONTAINER_KEYS.has(normalizedParentKey)) {
+        return isSensitiveKey(key);
+    }
+    return isSensitiveKey(key);
+}
+function redactString(value) {
+    return value
+        .replace(/\b((?:[A-Z][A-Z0-9_]{1,80})(?:TOKEN|SECRET|PASSWORD|PASSWD|PWD|API_KEY|PRIVATE_KEY|CLIENT_SECRET|AUTH)[A-Z0-9_]*\s*=\s*)(["']?)[^\s"'`]+/gi, `$1$2${exports.REDACTED_VALUE}`)
+        .replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, `$1${exports.REDACTED_VALUE}`)
+        .replace(/\b(Basic\s+)[A-Za-z0-9+/=-]{8,}/gi, `$1${exports.REDACTED_VALUE}`)
+        .replace(/\bgh[pousr]_[A-Za-z0-9_]{20,255}\b/g, exports.REDACTED_VALUE)
+        .replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, exports.REDACTED_VALUE)
+        .replace(/\bAIza[0-9A-Za-z_-]{35}\b/g, exports.REDACTED_VALUE)
+        .replace(/\b(AccountKey|SharedAccessSignature)=([^;\n]+)/gi, `$1=${exports.REDACTED_VALUE}`)
+        .replace(/\b((?:password|passwd|pwd|secret|token|api[_-]?key|client[_-]?secret)\b\s*[:=]\s*)(["'`]?)[^,\s"'`]+/gi, `$1$2${exports.REDACTED_VALUE}`)
+        .replace(/(https?:\/\/)([^/@\s:]+):([^/@\s]+)@/gi, `$1${exports.REDACTED_VALUE}@`);
+}
+/** Path string for @pinojs/redact / fast-redact. */
+function serializeRedactPath(parts) {
+    let out = "";
+    for (const p of parts) {
+        if (typeof p === "number" || (typeof p === "string" && /^\d+$/.test(p))) {
+            const n = typeof p === "number" ? p : Number(p);
+            out += `[${n}]`;
+            continue;
+        }
+        const k = String(p);
+        if (/^[a-zA-Z_$][\w$]*$/.test(k)) {
+            out += out === "" ? k : `.${k}`;
+        }
+        else {
+            const escaped = k.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
+            out += out === "" ? `["${escaped}"]` : `.["${escaped}"]`;
+        }
+    }
+    return out;
+}
+/** Normalize path segments so @pinojs/redact callback keys match our collected paths. */
+function pathKey(parts) {
+    return JSON.stringify(parts.map(String));
+}
+function markFull(parts, fullPathKeys, pinoPaths) {
+    const pk = pathKey(parts);
+    fullPathKeys.add(pk);
+    pinoPaths.add(serializeRedactPath(parts));
+}
+/** Deep clone for JSON-serializable report trees (no cycles, no special types). */
+function cloneReportTree(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+function markString(parts, stringPathKeys, pinoPaths) {
+    const pk = pathKey(parts);
+    stringPathKeys.add(pk);
+    pinoPaths.add(serializeRedactPath(parts));
+}
+/**
+ * Mirrors legacy `redactValue` traversal: `containerKey` is the key passed into `redactValue`
+ * (how the parent refers to this node — array field name for array items, child key for nested objects).
+ */
+function collectRedactionTargets(value, parts, containerKey, depth, fullPathKeys, stringPathKeys, pinoPaths) {
+    if (value === null || typeof value !== "object") {
+        return;
+    }
+    if (containerKey !== undefined && shouldRedactValue(containerKey)) {
+        markFull(parts, fullPathKeys, pinoPaths);
+        return;
+    }
+    if (depth >= MAX_REDACTION_DEPTH) {
+        markFull(parts, fullPathKeys, pinoPaths);
+        return;
+    }
+    if (Array.isArray(value)) {
+        const nextDepth = depth + 1;
+        for (let i = 0; i < value.length; i++) {
+            const item = value[i];
+            const itemParts = [...parts, i];
+            if (item === null || typeof item !== "object") {
+                if (typeof item === "string") {
+                    markString(itemParts, stringPathKeys, pinoPaths);
+                }
+                continue;
+            }
+            if (nextDepth >= MAX_REDACTION_DEPTH) {
+                markFull(itemParts, fullPathKeys, pinoPaths);
+                continue;
+            }
+            collectRedactionTargets(item, itemParts, containerKey, nextDepth, fullPathKeys, stringPathKeys, pinoPaths);
+        }
+        return;
+    }
+    const input = value;
+    for (const [childKey, childValue] of Object.entries(input)) {
+        const nextParts = [...parts, childKey];
+        if (shouldRedactValue(childKey, containerKey)) {
+            markFull(nextParts, fullPathKeys, pinoPaths);
+            continue;
+        }
+        if (childValue === null || typeof childValue !== "object") {
+            if (typeof childValue === "string") {
+                markString(nextParts, stringPathKeys, pinoPaths);
+            }
+            continue;
+        }
+        const nextDepth = depth + 1;
+        if (nextDepth >= MAX_REDACTION_DEPTH) {
+            markFull(nextParts, fullPathKeys, pinoPaths);
+            continue;
+        }
+        collectRedactionTargets(childValue, nextParts, childKey, nextDepth, fullPathKeys, stringPathKeys, pinoPaths);
+    }
+}
+function redactSensitiveData(value) {
+    if (value == null || typeof value !== "object") {
+        if (typeof value === "string") {
+            return redactString(value);
+        }
+        return value;
+    }
+    const fullPathKeys = new Set();
+    const stringPathKeys = new Set();
+    const pinoPaths = new Set();
+    collectRedactionTargets(value, [], undefined, 0, fullPathKeys, stringPathKeys, pinoPaths);
+    if (pinoPaths.size === 0) {
+        return value;
+    }
+    const redact = (0, redact_1.default)({
+        paths: [...pinoPaths],
+        serialize: false,
+        strict: false,
+        censor: ((v, keyPath) => {
+            const parts = Array.isArray(keyPath) ? keyPath.map((x) => String(x)) : [];
+            const pk = pathKey(parts);
+            if (fullPathKeys.has(pk)) {
+                return exports.REDACTED_VALUE;
+            }
+            if (typeof v === "string" && stringPathKeys.has(pk)) {
+                return redactString(v);
+            }
+            return v;
+        }),
+    });
+    const raw = redact(cloneReportTree(value));
+    if (typeof raw.restore === "function") {
+        const { restore: _drop, ...rest } = raw;
+        return rest;
+    }
+    return raw;
+}
+function sanitizeReportPayload(report, options = {}) {
+    const { redactRawData = true, redactMetadata = true } = options;
+    return {
+        ...report,
+        ...(redactMetadata && report.metadata
+            ? { metadata: redactSensitiveData(report.metadata) }
+            : {}),
+        ...(Array.isArray(report.vulnerabilities)
+            ? {
+                vulnerabilities: report.vulnerabilities.map((vulnerability) => {
+                    const { rawData, ...vulnerabilityFields } = vulnerability;
+                    const hasRawData = Object.hasOwn(vulnerability, "rawData");
+                    return {
+                        ...redactSensitiveData(vulnerabilityFields),
+                        ...(hasRawData
+                            ? {
+                                rawData: redactRawData && rawData ? redactSensitiveData(rawData) : rawData,
+                            }
+                            : {}),
+                    };
+                }),
+            }
+            : {}),
+    };
+}
+//# sourceMappingURL=redaction.js.map

package/bundled/node_modules/@aspm/shared/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":";;;;;;AA6PA,kDA2CC;AAED,sDA8BC;AAxUD;;;;;;;GAOG;AACH,4DAAwC;AAE3B,QAAA,cAAc,GAAG,YAAY,CAAC;AAE3C,MAAM,mBAAmB,GAAG;IAC1B,aAAa;IACb,QAAQ;IACR,UAAU;IACV,eAAe;IACf,aAAa;IACb,cAAc;IACd,YAAY;IACZ,SAAS;IACT,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,SAAS;IACT,OAAO;CACR,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,oBAAoB;IACpB,KAAK;IACL,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,eAAe;IACf,QAAQ;IACR,oBAAoB;IACpB,WAAW;IACX,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;AACxE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9F,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAClG,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAS/B,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,CACL,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC;QACpC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,SAAkB;IACxD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,IAAI,qBAAqB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACnD,OAAO,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAChD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK;SACT,OAAO,CACN,4IAA4I,EAC5I,OAAO,sBAAc,EAAE,CACxB;SACA,OAAO,CAAC,uCAAuC,EAAE,KAAK,sBAAc,EAAE,CAAC;SACvE,OAAO,CAAC,mCAAmC,EAAE,KAAK,sBAAc,EAAE,CAAC;SACnE,OAAO,CAAC,qCAAqC,EAAE,sBAAc,CAAC;SAC9D,OAAO,CAAC,gCAAgC,EAAE,sBAAc,CAAC;SACzD,OAAO,CAAC,4BAA4B,EAAE,sBAAc,CAAC;SACrD,OAAO,CAAC,kDAAkD,EAAE,MAAM,sBAAc,EAAE,CAAC;SACnF,OAAO,CACN,wGAAwG,EACxG,OAAO,sBAAc,EAAE,CACxB;SACA,OAAO,CAAC,wCAAwC,EAAE,KAAK,sBAAc,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,oDAAoD;AACpD,SAAS,mBAAmB,CAAC,KAA6B;IACxD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAChD,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClE,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,IAAI,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,SAAS,OAAO,CAAC,KAA6B;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CACf,KAA6B,EAC7B,YAAyB,EACzB,SAAsB;IAEtB,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrB,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAI,KAAQ;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CACjB,KAA6B,EAC7B,cAA2B,EAC3B,SAAsB;IAEtB,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvB,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,KAA6B,EAC7B,YAAgC,EAChC,KAAa,EACb,YAAyB,EACzB,cAA2B,EAC3B,SAAsB;IAEtB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,IAAI,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,IAAI,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;YAEhC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;gBACnD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,SAAS,IAAI,mBAAmB,EAAE,CAAC;gBACrC,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,uBAAuB,CACrB,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,cAAc,EACd,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,KAAuB,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEvC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1D,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACnC,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;QAC5B,IAAI,SAAS,IAAI,mBAAmB,EAAE,CAAC;YACrC,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QAED,uBAAuB,CACrB,UAAU,EACV,SAAS,EACT,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,cAAc,EACd,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,mBAAmB,CAAI,KAAQ;IAC7C,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,YAAY,CAAC,KAAK,CAAM,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAE1F,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,gBAAU,EAAC;QACxB,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,CAAC,CAAC,CAAU,EAAE,OAAgB,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,OAAO,sBAAc,CAAC;YACxB,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpD,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC,CAA4B;KAC9B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAExC,CAAC;IACF,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACxC,OAAO,IAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,qBAAqB,CAKnC,MAAS,EAAE,UAA4B,EAAE;IACzC,MAAM,EAAE,aAAa,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAEhE,OAAO;QACL,GAAG,MAAM;QACT,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ;YACnC,CAAC,CAAC,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YACvC,CAAC,CAAC;gBACE,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE;oBAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,EAAE,GAAG,aAAa,CAAC;oBAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;oBAC3D,OAAO;wBACL,GAAG,mBAAmB,CAAC,mBAAmB,CAAC;wBAC3C,GAAG,CAAC,UAAU;4BACZ,CAAC,CAAC;gCACE,OAAO,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;6BAC3E;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;gBACJ,CAAC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/severity-map.d.ts

@@ -0,0 +1,8 @@
+import { Severity } from "./enums";
+export declare const TRIVY_SEVERITY_MAP: Record<string, Severity>;
+export declare const SONAR_SEVERITY_MAP: Record<string, Severity>;
+/** Semgrep CLI JSON: extra.severity */
+export declare const SEMGREP_SEVERITY_MAP: Record<string, Severity>;
+export declare const SKIPFISH_SEVERITY_MAP: Record<number, Severity>;
+export declare function mapNmapSeverity(port: number, service: string): Severity;
+//# sourceMappingURL=severity-map.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/severity-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-map.d.ts","sourceRoot":"","sources":["../src/severity-map.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAMvD,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAMvD,CAAC;AAEF,uCAAuC;AACvC,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAKzD,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAM1D,CAAC;AAEF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,CAavE"}

package/bundled/node_modules/@aspm/shared/dist/severity-map.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SKIPFISH_SEVERITY_MAP = exports.SEMGREP_SEVERITY_MAP = exports.SONAR_SEVERITY_MAP = exports.TRIVY_SEVERITY_MAP = void 0;
+exports.mapNmapSeverity = mapNmapSeverity;
+const enums_1 = require("./enums");
+exports.TRIVY_SEVERITY_MAP = {
+    CRITICAL: enums_1.Severity.CRITICAL,
+    HIGH: enums_1.Severity.HIGH,
+    MEDIUM: enums_1.Severity.MEDIUM,
+    LOW: enums_1.Severity.LOW,
+    UNKNOWN: enums_1.Severity.INFO,
+};
+exports.SONAR_SEVERITY_MAP = {
+    BLOCKER: enums_1.Severity.CRITICAL,
+    CRITICAL: enums_1.Severity.HIGH,
+    MAJOR: enums_1.Severity.MEDIUM,
+    MINOR: enums_1.Severity.LOW,
+    INFO: enums_1.Severity.INFO,
+};
+/** Semgrep CLI JSON: extra.severity */
+exports.SEMGREP_SEVERITY_MAP = {
+    ERROR: enums_1.Severity.HIGH,
+    WARNING: enums_1.Severity.MEDIUM,
+    INFO: enums_1.Severity.LOW,
+    INVENTORY: enums_1.Severity.INFO,
+};
+exports.SKIPFISH_SEVERITY_MAP = {
+    5: enums_1.Severity.HIGH,
+    4: enums_1.Severity.MEDIUM,
+    3: enums_1.Severity.LOW,
+    2: enums_1.Severity.LOW,
+    1: enums_1.Severity.INFO,
+};
+function mapNmapSeverity(port, service) {
+    const criticalPorts = [21, 23, 445, 3389, 5900];
+    const highPorts = [22, 25, 53, 110, 143, 389, 636, 1433, 3306, 5432, 6379, 27017];
+    if (criticalPorts.includes(port))
+        return enums_1.Severity.HIGH;
+    if (highPorts.includes(port))
+        return enums_1.Severity.MEDIUM;
+    const riskyServices = ["telnet", "ftp", "vnc", "rdp", "smb"];
+    if (riskyServices.some((s) => service.toLowerCase().includes(s))) {
+        return enums_1.Severity.HIGH;
+    }
+    return enums_1.Severity.LOW;
+}
+//# sourceMappingURL=severity-map.js.map

package/bundled/node_modules/@aspm/shared/dist/severity-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-map.js","sourceRoot":"","sources":["../src/severity-map.ts"],"names":[],"mappings":";;;AAkCA,0CAaC;AA/CD,mCAAmC;AAEtB,QAAA,kBAAkB,GAA6B;IAC1D,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;IAC3B,IAAI,EAAE,gBAAQ,CAAC,IAAI;IACnB,MAAM,EAAE,gBAAQ,CAAC,MAAM;IACvB,GAAG,EAAE,gBAAQ,CAAC,GAAG;IACjB,OAAO,EAAE,gBAAQ,CAAC,IAAI;CACvB,CAAC;AAEW,QAAA,kBAAkB,GAA6B;IAC1D,OAAO,EAAE,gBAAQ,CAAC,QAAQ;IAC1B,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,KAAK,EAAE,gBAAQ,CAAC,MAAM;IACtB,KAAK,EAAE,gBAAQ,CAAC,GAAG;IACnB,IAAI,EAAE,gBAAQ,CAAC,IAAI;CACpB,CAAC;AAEF,uCAAuC;AAC1B,QAAA,oBAAoB,GAA6B;IAC5D,KAAK,EAAE,gBAAQ,CAAC,IAAI;IACpB,OAAO,EAAE,gBAAQ,CAAC,MAAM;IACxB,IAAI,EAAE,gBAAQ,CAAC,GAAG;IAClB,SAAS,EAAE,gBAAQ,CAAC,IAAI;CACzB,CAAC;AAEW,QAAA,qBAAqB,GAA6B;IAC7D,CAAC,EAAE,gBAAQ,CAAC,IAAI;IAChB,CAAC,EAAE,gBAAQ,CAAC,MAAM;IAClB,CAAC,EAAE,gBAAQ,CAAC,GAAG;IACf,CAAC,EAAE,gBAAQ,CAAC,GAAG;IACf,CAAC,EAAE,gBAAQ,CAAC,IAAI;CACjB,CAAC;AAEF,SAAgB,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,MAAM,aAAa,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAElF,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAQ,CAAC,IAAI,CAAC;IACvD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAQ,CAAC,MAAM,CAAC;IAErD,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,gBAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,OAAO,gBAAQ,CAAC,GAAG,CAAC;AACtB,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/sonar-safe-string.d.ts

@@ -0,0 +1,18 @@
+/** Remove trailing `/` without regex (avoids Sonar S5852 ReDoS on `/\/+$/`). */
+export declare function trimTrailingSlashes(value: string): string;
+/** Remove leading and trailing runs of `char` without regex. */
+export declare function trimEdgeChars(value: string, char: string): string;
+/** Slugify display names for pipelines, projects, and K8s-safe identifiers. */
+export declare function slugify(value: string, fallback?: string): string;
+/** Extract a fenced markdown code block without `[\s\S]*?` backtracking. */
+export declare function extractFencedBlock(source: string, language?: string): string | null;
+/** Parse `[prefix] message` log lines without lazy-regex backtracking. */
+export declare function parseBracketPrefixedMessage(message: string): {
+    prefix: string;
+    body: string;
+} | null;
+/** Extract file/path hints from free-form location text (CI / AI outputs). */
+export declare function extractPathHints(location: string): string[];
+/** Sanitize a string into a Kubernetes resource name (RFC 1123 subset). */
+export declare function sanitizeKubernetesName(value: string, fallback?: string): string;
+//# sourceMappingURL=sonar-safe-string.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/sonar-safe-string.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sonar-safe-string.d.ts","sourceRoot":"","sources":["../src/sonar-safe-string.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjE;AAED,+EAA+E;AAC/E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAkBpE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBnF;AAED,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOzC;AAsBD,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB3D;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAInF"}

package/bundled/node_modules/@aspm/shared/dist/sonar-safe-string.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trimTrailingSlashes = trimTrailingSlashes;
+exports.trimEdgeChars = trimEdgeChars;
+exports.slugify = slugify;
+exports.extractFencedBlock = extractFencedBlock;
+exports.parseBracketPrefixedMessage = parseBracketPrefixedMessage;
+exports.extractPathHints = extractPathHints;
+exports.sanitizeKubernetesName = sanitizeKubernetesName;
+/** Remove trailing `/` without regex (avoids Sonar S5852 ReDoS on `/\/+$/`). */
+function trimTrailingSlashes(value) {
+    if (!value)
+        return value;
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47)
+        end -= 1;
+    return end === value.length ? value : value.slice(0, end);
+}
+/** Remove leading and trailing runs of `char` without regex. */
+function trimEdgeChars(value, char) {
+    if (!value || !char)
+        return value;
+    let start = 0;
+    let end = value.length;
+    while (start < end && value[start] === char)
+        start += 1;
+    while (end > start && value[end - 1] === char)
+        end -= 1;
+    return value.slice(start, end);
+}
+/** Slugify display names for pipelines, projects, and K8s-safe identifiers. */
+function slugify(value, fallback = "pipeline") {
+    const lower = value.trim().toLowerCase();
+    let slug = "";
+    let prevDash = false;
+    for (const ch of lower) {
+        const code = ch.charCodeAt(0);
+        const isAlphaNum = (code >= 48 && code <= 57) || (code >= 97 && code <= 122) || ch === "-";
+        if (isAlphaNum && ch !== "-") {
+            slug += ch;
+            prevDash = false;
+            continue;
+        }
+        if (!prevDash && slug.length > 0) {
+            slug += "-";
+            prevDash = true;
+        }
+    }
+    return trimEdgeChars(slug, "-") || fallback;
+}
+/** Extract a fenced markdown code block without `[\s\S]*?` backtracking. */
+function extractFencedBlock(source, language) {
+    const fence = language ? `\`\`\`${language}` : "```";
+    const lower = source.toLowerCase();
+    const fenceLower = fence.toLowerCase();
+    let searchFrom = 0;
+    let lastContent = null;
+    for (;;) {
+        const start = lower.indexOf(fenceLower, searchFrom);
+        if (start === -1)
+            break;
+        const contentStart = source.indexOf("\n", start + fence.length);
+        if (contentStart === -1)
+            break;
+        const end = source.indexOf("```", contentStart + 1);
+        if (end === -1)
+            break;
+        lastContent = source.slice(contentStart + 1, end).trim();
+        searchFrom = end + 3;
+    }
+    return lastContent;
+}
+/** Parse `[prefix] message` log lines without lazy-regex backtracking. */
+function parseBracketPrefixedMessage(message) {
+    if (!message.startsWith("["))
+        return null;
+    const close = message.indexOf("]");
+    if (close <= 1)
+        return null;
+    const prefix = message.slice(1, close);
+    const body = message.slice(close + 1).trimStart();
+    return { prefix, body };
+}
+const PATH_HINT_EXTENSIONS = new Set([
+    "json",
+    "yaml",
+    "yml",
+    "lock",
+    "toml",
+    "gradle",
+    "csproj",
+    "dockerfile",
+]);
+function trimTokenEdges(token) {
+    let start = 0;
+    let end = token.length;
+    const isAllowed = (ch) => /[a-zA-Z0-9/._-]/.test(ch);
+    while (start < end && !isAllowed(token[start]))
+        start += 1;
+    while (end > start && !isAllowed(token[end - 1]))
+        end -= 1;
+    return token.slice(start, end);
+}
+/** Extract file/path hints from free-form location text (CI / AI outputs). */
+function extractPathHints(location) {
+    const hints = [];
+    for (const token of location.split(/\s+/)) {
+        const cleaned = trimTokenEdges(token);
+        if (!cleaned)
+            continue;
+        if (cleaned.toLowerCase() === "dockerfile") {
+            hints.push(cleaned);
+            continue;
+        }
+        const slash = cleaned.lastIndexOf("/");
+        const dot = cleaned.lastIndexOf(".");
+        if (dot > slash && dot < cleaned.length - 1) {
+            const ext = cleaned.slice(dot + 1).toLowerCase();
+            if (PATH_HINT_EXTENSIONS.has(ext))
+                hints.push(cleaned);
+            continue;
+        }
+        if (slash >= 0 && dot > slash) {
+            const ext = cleaned.slice(dot + 1).toLowerCase();
+            if (ext.length <= 8 && /^[a-z0-9]+$/.test(ext))
+                hints.push(cleaned);
+        }
+    }
+    return hints;
+}
+/** Sanitize a string into a Kubernetes resource name (RFC 1123 subset). */
+function sanitizeKubernetesName(value, fallback = "naus-job") {
+    const slug = slugify(value, fallback);
+    const trimmed = trimEdgeChars(slug, "-");
+    return trimmed.slice(0, 63) || fallback;
+}
+//# sourceMappingURL=sonar-safe-string.js.map

package/bundled/node_modules/@aspm/shared/dist/sonar-safe-string.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sonar-safe-string.js","sourceRoot":"","sources":["../src/sonar-safe-string.ts"],"names":[],"mappings":";;AACA,kDAKC;AAGD,sCAOC;AAGD,0BAkBC;AAGD,gDAmBC;AAGD,kEASC;AAuBD,4CAsBC;AAGD,wDAIC;AA3HD,gFAAgF;AAChF,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,gEAAgE;AAChE,SAAgB,aAAa,CAAC,KAAa,EAAE,IAAY;IACvD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,KAAK,IAAI,CAAC,CAAC;IACxD,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,+EAA+E;AAC/E,SAAgB,OAAO,CAAC,KAAa,EAAE,QAAQ,GAAG,UAAU;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;QAC3F,IAAI,UAAU,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,IAAI,EAAE,CAAC;YACX,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,IAAI,GAAG,CAAC;YACZ,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,MAAc,EAAE,QAAiB;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM;QACxB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,YAAY,KAAK,CAAC,CAAC;YAAE,MAAM;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM;QACtB,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,UAAU,GAAG,GAAG,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,2BAA2B,CACzC,OAAe;IAEf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAC5D,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sBAAsB,CAAC,KAAa,EAAE,QAAQ,GAAG,UAAU;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;AAC1C,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/sort-findings.d.ts

@@ -0,0 +1,16 @@
+/** Matches SecurityFilterPanel status order (active → closed). */
+export declare const FINDING_STATUS_SORT_ORDER: readonly ["OPEN", "CONFIRMED", "REOPENED", "PENDING_REMED_REVIEW", "FIXED", "ACCEPTED", "FALSE_POSITIVE"];
+export type SortableFinding = {
+    severity: string;
+    status: string;
+    createdAt: string | Date;
+    lastSeenAt?: string | Date | null;
+    fixedAt?: string | Date | null;
+};
+/**
+ * Workbench list order: status (Aberto→…→Corrigido→…, matching the filter panel),
+ * then severity (Crítico→…→Info), then most recently seen within the same bucket.
+ * Closed findings (incl. Corrigido) always appear after all active ones.
+ */
+export declare function sortFindingsForDisplay<T extends SortableFinding>(findings: T[]): T[];
+//# sourceMappingURL=sort-findings.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/sort-findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sort-findings.d.ts","sourceRoot":"","sources":["../src/sort-findings.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,2GAQ5B,CAAC;AAcX,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;CAChC,CAAC;AAmCF;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAYpF"}

package/bundled/node_modules/@aspm/shared/dist/sort-findings.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FINDING_STATUS_SORT_ORDER = void 0;
+exports.sortFindingsForDisplay = sortFindingsForDisplay;
+/** Matches SecurityFilterPanel status order (active → closed). */
+exports.FINDING_STATUS_SORT_ORDER = [
+    "OPEN",
+    "CONFIRMED",
+    "REOPENED",
+    "PENDING_REMED_REVIEW",
+    "FIXED",
+    "ACCEPTED",
+    "FALSE_POSITIVE",
+];
+const SEVERITY_ORDER = new Map([
+    ["CRITICAL", 0],
+    ["HIGH", 1],
+    ["MEDIUM", 2],
+    ["LOW", 3],
+    ["INFO", 4],
+]);
+const STATUS_ORDER = new Map(exports.FINDING_STATUS_SORT_ORDER.map((status, index) => [status, index]));
+function toTimestamp(value) {
+    if (value == null)
+        return 0;
+    const time = value instanceof Date ? value.getTime() : new Date(value).getTime();
+    return Number.isFinite(time) ? time : 0;
+}
+function lifecycleTime(finding) {
+    return Math.max(toTimestamp(finding.createdAt), toTimestamp(finding.lastSeenAt), toTimestamp(finding.fixedAt));
+}
+function normalizeStatus(status) {
+    return status.trim().toUpperCase();
+}
+function statusSortRank(finding) {
+    const normalized = normalizeStatus(finding.status);
+    const fixedRank = STATUS_ORDER.get("FIXED") ?? exports.FINDING_STATUS_SORT_ORDER.length;
+    const activeLastRank = STATUS_ORDER.get("PENDING_REMED_REVIEW") ?? 3;
+    if (finding.fixedAt) {
+        const rank = STATUS_ORDER.get(normalized);
+        if (rank === undefined || rank <= activeLastRank)
+            return fixedRank;
+    }
+    const rank = STATUS_ORDER.get(normalized);
+    if (rank !== undefined)
+        return rank;
+    return 0;
+}
+/**
+ * Workbench list order: status (Aberto→…→Corrigido→…, matching the filter panel),
+ * then severity (Crítico→…→Info), then most recently seen within the same bucket.
+ * Closed findings (incl. Corrigido) always appear after all active ones.
+ */
+function sortFindingsForDisplay(findings) {
+    return [...findings].sort((a, b) => {
+        const statusA = statusSortRank(a);
+        const statusB = statusSortRank(b);
+        if (statusA !== statusB)
+            return statusA - statusB;
+        const severityA = SEVERITY_ORDER.get(a.severity) ?? Number.MAX_SAFE_INTEGER;
+        const severityB = SEVERITY_ORDER.get(b.severity) ?? Number.MAX_SAFE_INTEGER;
+        if (severityA !== severityB)
+            return severityA - severityB;
+        return lifecycleTime(b) - lifecycleTime(a);
+    });
+}
+//# sourceMappingURL=sort-findings.js.map

package/bundled/node_modules/@aspm/shared/dist/sort-findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sort-findings.js","sourceRoot":"","sources":["../src/sort-findings.ts"],"names":[],"mappings":";;;AAqEA,wDAYC;AAjFD,kEAAkE;AACrD,QAAA,yBAAyB,GAAG;IACvC,MAAM;IACN,WAAW;IACX,UAAU;IACV,sBAAsB;IACtB,OAAO;IACP,UAAU;IACV,gBAAgB;CACR,CAAC;AAEX,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,MAAM,EAAE,CAAC,CAAC;IACX,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,KAAK,EAAE,CAAC,CAAC;IACV,CAAC,MAAM,EAAE,CAAC,CAAC;CACZ,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,iCAAyB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAClE,CAAC;AAUF,SAAS,WAAW,CAAC,KAAuC;IAC1D,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IACjF,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB;IAC7C,OAAO,IAAI,CAAC,GAAG,CACb,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAC9B,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAC/B,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,iCAAyB,CAAC,MAAM,CAAC;IAChF,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAErE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,cAAc;YAAE,OAAO,SAAS,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAA4B,QAAa;IAC7E,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,OAAO,GAAG,OAAO,CAAC;QAElD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC;QAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC;QAC5E,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,GAAG,SAAS,CAAC;QAE1D,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}