@kubbisec/ai-linux-arm64 0.1.14 → 0.1.16

package/bundled/node_modules/@aspm/shared/dist/security/github-workflow-tool-jobs.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KUBBISEC_SCANS_JOB_ID = void 0;
+exports.buildGithubToolJobsSection = buildGithubToolJobsSection;
+const aspm_gate_rules_1 = require("./aspm-gate-rules");
+const github_workflow_action_pins_1 = require("./github-workflow-action-pins");
+exports.KUBBISEC_SCANS_JOB_ID = "kubbisec-scans";
+const ASPM_INSTALL_STEP = `      - name: Install ASPM CLI
+        run: npm install -g @kubbisec/aspm`;
+const CHECKOUT_STEP = `      - uses: ${github_workflow_action_pins_1.GITHUB_CHECKOUT_ACTION}`;
+const CHECKOUT_FULL_HISTORY_STEP = `      - uses: ${github_workflow_action_pins_1.GITHUB_CHECKOUT_ACTION}
+        with:
+          fetch-depth: 0`;
+/**
+ * KubbiSec job env — API URL is omitted (ASPM CLI defaults to https://api.kubbisec.com).
+ * Only secret key + org/project identifiers are required in CI.
+ */
+function buildKubbisecScansJobEnv(inlineEnv) {
+    if (inlineEnv) {
+        return `    env:
+      KUBBISEC_API_KEY: \${{ secrets.KUBBISEC_API_KEY }}
+      KUBBISEC_ORG_ID: ${JSON.stringify(inlineEnv.orgId)}`;
+    }
+    return `    env:
+      KUBBISEC_API_KEY: \${{ secrets.KUBBISEC_API_KEY }}
+      KUBBISEC_ORG_ID: \${{ vars.KUBBISEC_ORG_ID }}`;
+}
+const GITHUB_PROJECT_VAR_REF = "${{ vars.KUBBISEC_PROJECT }}";
+function projectRef(inlineEnv) {
+    return inlineEnv?.projectId ?? GITHUB_PROJECT_VAR_REF;
+}
+/** Scanner-specific steps (official actions where JSON output is compatible with `aspm upload`). */
+function buildToolScanSteps(tool, inlineEnv) {
+    const p = projectRef(inlineEnv);
+    switch (tool) {
+        case "trivy":
+            return `      - name: Trivy filesystem scan
+        uses: ${github_workflow_action_pins_1.TRIVY_ACTION}
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: json
+          output: trivy-report.json
+          exit-code: "0"
+
+      - name: Upload Trivy report
+        run: aspm upload trivy-report.json -s trivy -p ${p}`;
+        case "gitleaks":
+            return `      - name: Gitleaks (GitHub Security)
+        uses: ${github_workflow_action_pins_1.GITLEAKS_ACTION}
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "true"
+          GITLEAKS_VERSION: "${github_workflow_action_pins_1.GITLEAKS_CLI_VERSION}"
+
+      - name: Gitleaks scan (JSON para KubbiSec ASPM)
+        run: |
+          curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v${github_workflow_action_pins_1.GITLEAKS_CLI_VERSION}/gitleaks_${github_workflow_action_pins_1.GITLEAKS_CLI_VERSION}_linux_x64.tar.gz | tar -xz -C /usr/local/bin
+          gitleaks detect --source . --report-format json --report-path gitleaks-report.json --exit-code 0 || true
+
+      - name: Upload Gitleaks report
+        run: aspm upload gitleaks-report.json -s gitleaks -p ${p}`;
+        case "syft":
+            return `      - name: Generate SBOM
+        uses: ${github_workflow_action_pins_1.SBOM_ACTION}
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: sbom.cdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Upload SBOM
+        run: aspm upload sbom.cdx.json -s syft -p ${p}`;
+        case "osv":
+            return `      - name: OSV scan (JSON para KubbiSec ASPM)
+        uses: ${github_workflow_action_pins_1.OSV_SCANNER_ACTION}
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --recursive
+            --format=json
+            --output=osv-report.json
+            ./
+
+      - name: OSV SARIF (GitHub Security)
+        uses: ${github_workflow_action_pins_1.OSV_REPORTER_ACTION}
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --output=osv-results.sarif
+            --new=osv-report.json
+            --gh-annotations=false
+            --fail-on-vuln=false
+
+      - name: Upload OSV SARIF to GitHub Security
+        uses: ${github_workflow_action_pins_1.CODEQL_UPLOAD_SARIF_ACTION}
+        if: always()
+        continue-on-error: true
+        with:
+          sarif_file: osv-results.sarif
+          category: kubbisec-osv
+
+      - name: Upload OSV report to KubbiSec
+        run: aspm upload osv-report.json -s osv -p ${p}`;
+        case "semgrep":
+            return `      # semgrep/semgrep-action está deprecated — imagem oficial semgrep/semgrep (Semgrep docs).
+      - name: Semgrep scan
+        run: |
+          docker run --rm -v "$PWD:/src" -w /src ${github_workflow_action_pins_1.SEMGREP_CONTAINER_IMAGE} \\
+            semgrep scan --config auto --json -o semgrep-report.json .
+
+      - name: Upload Semgrep report
+        run: aspm upload semgrep-report.json -s semgrep -p ${p}`;
+        case "sonar":
+            return `      # Configure secrets.SONAR_TOKEN, vars.SONAR_HOST_URL (SonarCloud: https://sonarcloud.io), vars.SONAR_PROJECT_KEY
+      - name: SonarQube scan (SonarSource GitHub Action)
+        uses: ${github_workflow_action_pins_1.SONAR_SCAN_ACTION}
+        env:
+          SONAR_TOKEN: \${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: \${{ vars.SONAR_HOST_URL }}
+        with:
+          args: >
+            -Dsonar.projectKey=\${{ vars.SONAR_PROJECT_KEY }}
+
+      - name: Export Sonar issues (JSON para KubbiSec ASPM)
+        run: |
+          if [ -n "$SONAR_HOST_URL" ] && [ -n "$SONAR_TOKEN" ]; then
+            curl -sS -H "Authorization: Bearer $SONAR_TOKEN" \\
+              "$SONAR_HOST_URL/api/issues/search?componentKeys=$SONAR_PROJECT_KEY&ps=500" \\
+              -o sonar-report.json || echo '{}' > sonar-report.json
+          else
+            echo '{}' > sonar-report.json
+          fi
+        env:
+          SONAR_HOST_URL: \${{ vars.SONAR_HOST_URL }}
+          SONAR_TOKEN: \${{ secrets.SONAR_TOKEN }}
+          SONAR_PROJECT_KEY: \${{ vars.SONAR_PROJECT_KEY }}
+
+      - name: Upload Sonar report to KubbiSec
+        run: aspm upload sonar-report.json -s sonar -p ${p}`;
+        case "nmap":
+            return `      - name: Install Nmap
+        run: sudo apt-get update && sudo apt-get install -y nmap
+
+      - name: Nmap scan placeholder
+        run: |
+          echo "Configure NMAP_TARGET (vars) para varredura real; gerando placeholder."
+          echo '{}' > nmap-report.json
+
+      - name: Upload Nmap report
+        run: aspm upload nmap-report.json -s nmap -p ${p}`;
+        case "skipfish":
+            return `      - name: Install Skipfish
+        run: sudo apt-get update && sudo apt-get install -y skipfish
+
+      - name: Skipfish scan placeholder
+        run: |
+          echo "Configure SKIPFISH_TARGET (vars) para DAST real; gerando placeholder."
+          echo '{}' > skipfish-report.json
+
+      - name: Upload Skipfish report
+        run: aspm upload skipfish-report.json -s skipfish -p ${p}`;
+    }
+}
+function buildGithubToolJobsSection(tools, inlineEnv) {
+    const checkout = tools.includes("gitleaks") ? CHECKOUT_FULL_HISTORY_STEP : CHECKOUT_STEP;
+    const kubbisecScansJobEnv = buildKubbisecScansJobEnv(inlineEnv);
+    const toolSteps = tools.map((tool) => buildToolScanSteps(tool, inlineEnv)).join("\n\n");
+    const jobsYaml = `  ${exports.KUBBISEC_SCANS_JOB_ID}:
+    runs-on: ubuntu-latest
+${kubbisecScansJobEnv}
+    steps:
+${checkout}
+
+${ASPM_INSTALL_STEP}
+
+${toolSteps}
+
+${(0, aspm_gate_rules_1.buildAspmGateGithubWorkflowStep)(undefined, inlineEnv?.projectId)}`;
+    return { jobIds: [exports.KUBBISEC_SCANS_JOB_ID], jobsYaml };
+}
+//# sourceMappingURL=github-workflow-tool-jobs.js.map

package/bundled/node_modules/@aspm/shared/dist/security/github-workflow-tool-jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-workflow-tool-jobs.js","sourceRoot":"","sources":["../../src/security/github-workflow-tool-jobs.ts"],"names":[],"mappings":";;;AAwLA,gEAwBC;AAhND,uDAAoE;AACpE,+EAWuC;AAG1B,QAAA,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,MAAM,iBAAiB,GAAG;2CACiB,CAAC;AAE5C,MAAM,aAAa,GAAG,iBAAiB,oDAAsB,EAAE,CAAC;AAEhE,MAAM,0BAA0B,GAAG,iBAAiB,oDAAsB;;yBAEjD,CAAC;AAE1B;;;GAGG;AACH,SAAS,wBAAwB,CAAC,SAAmC;IACnE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;;yBAEc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO;;oDAE2C,CAAC;AACrD,CAAC;AAED,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAE9D,SAAS,UAAU,CAAC,SAAmC;IACrD,OAAO,SAAS,EAAE,SAAS,IAAI,sBAAsB,CAAC;AACxD,CAAC;AAED,oGAAoG;AACpG,SAAS,kBAAkB,CAAC,IAAoB,EAAE,SAAmC;IACnF,MAAM,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAEhC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO;gBACG,0CAAY;;;;;;;;;yDAS6B,CAAC,EAAE,CAAC;QACzD,KAAK,UAAU;YACb,OAAO;gBACG,6CAAe;;;;;+BAKA,kDAAoB;;;;8EAI2B,kDAAoB,aAAa,kDAAoB;;;;+DAIpE,CAAC,EAAE,CAAC;QAC/D,KAAK,MAAM;YACT,OAAO;gBACG,yCAAW;;;;;;;;;oDASyB,CAAC,EAAE,CAAC;QACpD,KAAK,KAAK;YACR,OAAO;gBACG,gDAAkB;;;;;;;;;;gBAUlB,iDAAmB;;;;;;;;;;gBAUnB,wDAA0B;;;;;;;;qDAQW,CAAC,EAAE,CAAC;QACrD,KAAK,SAAS;YACZ,OAAO;;;mDAGsC,qDAAuB;;;;6DAIb,CAAC,EAAE,CAAC;QAC7D,KAAK,OAAO;YACV,OAAO;;gBAEG,+CAAiB;;;;;;;;;;;;;;;;;;;;;;;yDAuBwB,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM;YACT,OAAO;;;;;;;;;uDAS0C,CAAC,EAAE,CAAC;QACvD,KAAK,UAAU;YACb,OAAO;;;;;;;;;+DASkD,CAAC,EAAE,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAgB,0BAA0B,CACxC,KAAuB,EACvB,SAAmC;IAKnC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;IACzF,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExF,MAAM,QAAQ,GAAG,KAAK,6BAAqB;;EAE3C,mBAAmB;;EAEnB,QAAQ;;EAER,iBAAiB;;EAEjB,SAAS;;EAET,IAAA,iDAA+B,EAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;IAEnE,OAAO,EAAE,MAAM,EAAE,CAAC,6BAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC;AACvD,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/security/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./security-tool.types";
+export * from "./security-tool-catalog";
+export * from "./aspm-gate-rules";
+export * from "./build-aspm-security-matrix-pipeline-yaml";
+export * from "./build-github-security-workflow-yaml";
+export * from "./github-workflow-action-pins";
+//# sourceMappingURL=index.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4CAA4C,CAAC;AAC3D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/security/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./security-tool.types"), exports);
+__exportStar(require("./security-tool-catalog"), exports);
+__exportStar(require("./aspm-gate-rules"), exports);
+__exportStar(require("./build-aspm-security-matrix-pipeline-yaml"), exports);
+__exportStar(require("./build-github-security-workflow-yaml"), exports);
+__exportStar(require("./github-workflow-action-pins"), exports);
+//# sourceMappingURL=index.js.map

package/bundled/node_modules/@aspm/shared/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAAsC;AACtC,0DAAwC;AACxC,oDAAkC;AAClC,6EAA2D;AAC3D,wEAAsD;AACtD,gEAA8C"}

package/bundled/node_modules/@aspm/shared/dist/security/security-tool-catalog.d.ts

@@ -0,0 +1,5 @@
+import type { SecurityToolCatalogEntry } from "./security-tool.types";
+export declare const SECURITY_TOOL_CATALOG: readonly SecurityToolCatalogEntry[];
+export declare function isSecurityToolId(value: string): value is SecurityToolCatalogEntry["id"];
+export declare function normalizeSecurityTools(tools: readonly string[] | undefined | null): SecurityToolCatalogEntry["id"][];
+//# sourceMappingURL=security-tool-catalog.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/security/security-tool-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool-catalog.d.ts","sourceRoot":"","sources":["../../src/security/security-tool-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,eAAO,MAAM,qBAAqB,EAAE,SAAS,wBAAwB,EAiD3D,CAAC;AAEX,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAEvF;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,GAC1C,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAalC"}

package/bundled/node_modules/@aspm/shared/dist/security/security-tool-catalog.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECURITY_TOOL_CATALOG = void 0;
+exports.isSecurityToolId = isSecurityToolId;
+exports.normalizeSecurityTools = normalizeSecurityTools;
+exports.SECURITY_TOOL_CATALOG = [
+    {
+        id: "osv",
+        label: "OSV Scanner",
+        category: "sca",
+        description: "Open Source Vulnerabilities em lockfiles e dependências.",
+    },
+    {
+        id: "gitleaks",
+        label: "Gitleaks",
+        category: "secrets",
+        description: "Detecção de segredos no histórico Git.",
+    },
+    {
+        id: "syft",
+        label: "Syft",
+        category: "sbom",
+        description: "Geração de SBOM CycloneDX.",
+    },
+    {
+        id: "trivy",
+        label: "Trivy",
+        category: "sca",
+        description: "CVEs em filesystem, containers e IaC.",
+    },
+    {
+        id: "semgrep",
+        label: "Semgrep",
+        category: "sast",
+        description: "Análise estática com regras auto.",
+    },
+    {
+        id: "sonar",
+        label: "SonarQube",
+        category: "quality",
+        description: "Qualidade e issues via Sonar (requer SONAR_*).",
+    },
+    {
+        id: "nmap",
+        label: "Nmap",
+        category: "network",
+        description: "Varredura de rede (upload manual do relatório).",
+    },
+    {
+        id: "skipfish",
+        label: "Skipfish",
+        category: "dast",
+        description: "DAST web (upload manual do relatório).",
+    },
+];
+function isSecurityToolId(value) {
+    return exports.SECURITY_TOOL_CATALOG.some((entry) => entry.id === value);
+}
+function normalizeSecurityTools(tools) {
+    if (!tools?.length) {
+        return ["osv", "gitleaks", "syft", "trivy", "semgrep"];
+    }
+    const seen = new Set();
+    const normalized = [];
+    for (const raw of tools) {
+        const id = raw.trim().toLowerCase();
+        if (!isSecurityToolId(id) || seen.has(id))
+            continue;
+        seen.add(id);
+        normalized.push(id);
+    }
+    return normalized.length > 0 ? normalized : ["osv", "gitleaks", "syft", "trivy", "semgrep"];
+}
+//# sourceMappingURL=security-tool-catalog.js.map

package/bundled/node_modules/@aspm/shared/dist/security/security-tool-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool-catalog.js","sourceRoot":"","sources":["../../src/security/security-tool-catalog.ts"],"names":[],"mappings":";;;AAqDA,4CAEC;AAED,wDAeC;AAtEY,QAAA,qBAAqB,GAAwC;IACxE;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0DAA0D;KACxE;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,wCAAwC;KACtD;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4BAA4B;KAC1C;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,gDAAgD;KAC9D;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,wCAAwC;KACtD;CACO,CAAC;AAEX,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,OAAO,6BAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,sBAAsB,CACpC,KAA2C;IAE3C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAqC,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9F,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/security/security-tool.types.d.ts

@@ -0,0 +1,43 @@
+/** Naus `aspm_matrix` tool ids — must match @naus/validation `aspmToolIdSchema`. */
+export declare const SECURITY_TOOL_IDS: readonly ["osv", "gitleaks", "syft", "trivy", "semgrep", "sonar", "nmap", "skipfish"];
+export type SecurityToolId = (typeof SECURITY_TOOL_IDS)[number];
+export declare const DEFAULT_SECURITY_TOOLS: SecurityToolId[];
+export type SecurityToolCategory = "sca" | "sast" | "secrets" | "sbom" | "network" | "dast" | "quality";
+export type SecurityToolCatalogEntry = {
+    id: SecurityToolId;
+    label: string;
+    category: SecurityToolCategory;
+    description: string;
+};
+export type GithubWorkflowTriggerEvents = {
+    push: boolean;
+    pushBranches: string[];
+    pullRequest: boolean;
+    workflowDispatch: boolean;
+    schedule: boolean;
+    scheduleCron: string;
+};
+/** KubbiSec vars inlined in generated workflows (API URL omitted — ASPM CLI uses cloud default). */
+export type GithubWorkflowInlineEnv = {
+    orgId: string;
+    projectId: string;
+};
+export type BuildGithubSecurityWorkflowOptions = {
+    workflowName: string;
+    tools: SecurityToolId[];
+    events: GithubWorkflowTriggerEvents;
+    inlineEnv?: GithubWorkflowInlineEnv;
+};
+export type BuildAspmSecurityMatrixPipelineOptions = {
+    pipelineName?: string;
+    matrixStrategy?: "chain" | "fanout";
+    gateRules?: {
+        vulnerabilities?: {
+            max_by_severity: Record<string, number>;
+        };
+        coverage?: {
+            min_line_pct: number;
+        };
+    };
+};
+//# sourceMappingURL=security-tool.types.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/security/security-tool.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool.types.d.ts","sourceRoot":"","sources":["../../src/security/security-tool.types.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,uFASpB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,eAAO,MAAM,sBAAsB,EAAE,cAAc,EAMlD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAC5B,KAAK,GACL,MAAM,GACN,SAAS,GACT,MAAM,GACN,SAAS,GACT,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,cAAc,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,MAAM,EAAE,2BAA2B,CAAC;IACpC,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACpC,SAAS,CAAC,EAAE;QACV,eAAe,CAAC,EAAE;YAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAAC;QAC9D,QAAQ,CAAC,EAAE;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;KACrC,CAAC;CACH,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/security/security-tool.types.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SECURITY_TOOLS = exports.SECURITY_TOOL_IDS = void 0;
+/** Naus `aspm_matrix` tool ids — must match @naus/validation `aspmToolIdSchema`. */
+exports.SECURITY_TOOL_IDS = [
+    "osv",
+    "gitleaks",
+    "syft",
+    "trivy",
+    "semgrep",
+    "sonar",
+    "nmap",
+    "skipfish",
+];
+exports.DEFAULT_SECURITY_TOOLS = [
+    "osv",
+    "gitleaks",
+    "syft",
+    "trivy",
+    "semgrep",
+];
+//# sourceMappingURL=security-tool.types.js.map

package/bundled/node_modules/@aspm/shared/dist/security/security-tool.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool.types.js","sourceRoot":"","sources":["../../src/security/security-tool.types.ts"],"names":[],"mappings":";;;AAAA,oFAAoF;AACvE,QAAA,iBAAiB,GAAG;IAC/B,KAAK;IACL,UAAU;IACV,MAAM;IACN,OAAO;IACP,SAAS;IACT,OAAO;IACP,MAAM;IACN,UAAU;CACF,CAAC;AAIE,QAAA,sBAAsB,GAAqB;IACtD,KAAK;IACL,UAAU;IACV,MAAM;IACN,OAAO;IACP,SAAS;CACV,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/sonar-safe-string.d.ts

@@ -13,6 +13,14 @@ export declare function parseBracketPrefixedMessage(message: string): {
 } | null;
 /** Extract file/path hints from free-form location text (CI / AI outputs). */
 export declare function extractPathHints(location: string): string[];
+/** Remove a leading `api/` segment without regex (Sonar S5852). */
+export declare function stripApiPathPrefix(value: string): string;
+/** Remove leading `/` runs without regex. */
+export declare function stripLeadingSlashes(value: string): string;
+/** Strip optional surrounding ASCII quotes without regex. */
+export declare function trimSurroundingQuotes(value: string): string;
+/** Drop `:line` / `:line:col` suffixes from path-like tokens (CI / scanner locations). */
+export declare function stripLineNumberSuffixes(location: string): string;
 /** Sanitize a string into a Kubernetes resource name (RFC 1123 subset). */
 export declare function sanitizeKubernetesName(value: string, fallback?: string): string;
 //# sourceMappingURL=sonar-safe-string.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/sonar-safe-string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sonar-safe-string.d.ts","sourceRoot":"","sources":["../src/sonar-safe-string.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjE;AAED,+EAA+E;AAC/E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAkBpE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBnF;AAED,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOzC;AAsBD,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB3D;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAInF"}
+{"version":3,"file":"sonar-safe-string.d.ts","sourceRoot":"","sources":["../src/sonar-safe-string.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjE;AAED,+EAA+E;AAC/E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAkBpE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBnF;AAED,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOzC;AAsBD,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB3D;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKxD;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED,6DAA6D;AAC7D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM3D;AAED,0FAA0F;AAC1F,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAsChE;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAInF"}

package/bundled/node_modules/@aspm/shared/dist/sonar-safe-string.js

@@ -6,6 +6,10 @@ exports.slugify = slugify;
 exports.extractFencedBlock = extractFencedBlock;
 exports.parseBracketPrefixedMessage = parseBracketPrefixedMessage;
 exports.extractPathHints = extractPathHints;
+exports.stripApiPathPrefix = stripApiPathPrefix;
+exports.stripLeadingSlashes = stripLeadingSlashes;
+exports.trimSurroundingQuotes = trimSurroundingQuotes;
+exports.stripLineNumberSuffixes = stripLineNumberSuffixes;
 exports.sanitizeKubernetesName = sanitizeKubernetesName;
 /** Remove trailing `/` without regex (avoids Sonar S5852 ReDoS on `/\/+$/`). */
 function trimTrailingSlashes(value) {
@@ -128,6 +132,67 @@ function extractPathHints(location) {
     }
     return hints;
 }
+/** Remove a leading `api/` segment without regex (Sonar S5852). */
+function stripApiPathPrefix(value) {
+    if (!value.startsWith("api"))
+        return value;
+    let index = 3;
+    while (index < value.length && value.charCodeAt(index) === 47)
+        index += 1;
+    return value.slice(index);
+}
+/** Remove leading `/` runs without regex. */
+function stripLeadingSlashes(value) {
+    let start = 0;
+    while (start < value.length && value.charCodeAt(start) === 47)
+        start += 1;
+    return value.slice(start);
+}
+/** Strip optional surrounding ASCII quotes without regex. */
+function trimSurroundingQuotes(value) {
+    let start = 0;
+    let end = value.length;
+    while (start < end && (value[start] === '"' || value[start] === "'"))
+        start += 1;
+    while (end > start && (value[end - 1] === '"' || value[end - 1] === "'"))
+        end -= 1;
+    return value.slice(start, end);
+}
+/** Drop `:line` / `:line:col` suffixes from path-like tokens (CI / scanner locations). */
+function stripLineNumberSuffixes(location) {
+    const tokens = location.split(/\s+/);
+    const cleaned = [];
+    for (const token of tokens) {
+        const colon = token.lastIndexOf(":");
+        if (colon <= 0) {
+            cleaned.push(token);
+            continue;
+        }
+        const dot = token.lastIndexOf(".");
+        if (dot === -1 || dot >= colon) {
+            cleaned.push(token);
+            continue;
+        }
+        let index = colon + 1;
+        let hasDigits = false;
+        while (index < token.length) {
+            const code = token.charCodeAt(index);
+            if (code >= 48 && code <= 57) {
+                hasDigits = true;
+                index += 1;
+                continue;
+            }
+            if (code === 58 && hasDigits) {
+                index += 1;
+                hasDigits = false;
+                continue;
+            }
+            break;
+        }
+        cleaned.push(index === token.length && hasDigits ? token.slice(0, colon) : token);
+    }
+    return cleaned.join(" ");
+}
 /** Sanitize a string into a Kubernetes resource name (RFC 1123 subset). */
 function sanitizeKubernetesName(value, fallback = "naus-job") {
     const slug = slugify(value, fallback);

package/bundled/node_modules/@aspm/shared/dist/sonar-safe-string.js.map

@@ -1 +1 @@
-{"version":3,"file":"sonar-safe-string.js","sourceRoot":"","sources":["../src/sonar-safe-string.ts"],"names":[],"mappings":";;AACA,kDAKC;AAGD,sCAOC;AAGD,0BAkBC;AAGD,gDAmBC;AAGD,kEASC;AAuBD,4CAsBC;AAGD,wDAIC;AA3HD,gFAAgF;AAChF,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,gEAAgE;AAChE,SAAgB,aAAa,CAAC,KAAa,EAAE,IAAY;IACvD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,KAAK,IAAI,CAAC,CAAC;IACxD,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,+EAA+E;AAC/E,SAAgB,OAAO,CAAC,KAAa,EAAE,QAAQ,GAAG,UAAU;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;QAC3F,IAAI,UAAU,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,IAAI,EAAE,CAAC;YACX,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,IAAI,GAAG,CAAC;YACZ,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,MAAc,EAAE,QAAiB;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM;QACxB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,YAAY,KAAK,CAAC,CAAC;YAAE,MAAM;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM;QACtB,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,UAAU,GAAG,GAAG,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,2BAA2B,CACzC,OAAe;IAEf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAC5D,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sBAAsB,CAAC,KAAa,EAAE,QAAQ,GAAG,UAAU;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"sonar-safe-string.js","sourceRoot":"","sources":["../src/sonar-safe-string.ts"],"names":[],"mappings":";;AACA,kDAKC;AAGD,sCAOC;AAGD,0BAkBC;AAGD,gDAmBC;AAGD,kEASC;AAuBD,4CAsBC;AAGD,gDAKC;AAGD,kDAIC;AAGD,sDAMC;AAGD,0DAsCC;AAGD,wDAIC;AA5LD,gFAAgF;AAChF,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,gEAAgE;AAChE,SAAgB,aAAa,CAAC,KAAa,EAAE,IAAY;IACvD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,KAAK,IAAI,CAAC,CAAC;IACxD,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,+EAA+E;AAC/E,SAAgB,OAAO,CAAC,KAAa,EAAE,QAAQ,GAAG,UAAU;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;QAC3F,IAAI,UAAU,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,IAAI,EAAE,CAAC;YACX,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,IAAI,GAAG,CAAC;YACZ,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,MAAc,EAAE,QAAiB;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM;QACxB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,YAAY,KAAK,CAAC,CAAC;YAAE,MAAM;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM;QACtB,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,UAAU,GAAG,GAAG,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,2BAA2B,CACzC,OAAe;IAEf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAC5D,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,IAAI,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,6CAA6C;AAC7C,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,IAAI,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,SAAgB,qBAAqB,CAAC,KAAa;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IACjF,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,0FAA0F;AAC1F,SAAgB,uBAAuB,CAAC,QAAgB;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;QACtB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC7B,SAAS,GAAG,IAAI,CAAC;gBACjB,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC7B,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS,GAAG,KAAK,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM;QACR,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sBAAsB,CAAC,KAAa,EAAE,QAAQ,GAAG,UAAU;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;AAC1C,CAAC"}

package/bundled/node_modules/@aspm/shared/package.json

@@ -9,6 +9,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./security": {
+      "types": "./dist/security/index.d.ts",
+      "default": "./dist/security/index.js"
+    },
     "./github/kubbisec-github-label": {
       "types": "./dist/github/kubbisec-github-label.d.ts",
       "default": "./dist/github/kubbisec-github-label.js"

package/bundled/skills/aspm-platform/SKILL.md

@@ -7,7 +7,7 @@ description: KubbiSec ASPM — uploads, gates, projetos e integração com NAUS/
 
 `npm install -g @kubbisec/aspm` → binário `aspm`.
 
-**Docs:** `aspm_docs` (secção `aspm-commands` + guias por scanner). **HARD-GATE:** chamar `aspm_docs` ou `security_scanner_playbook` antes de citar flags completas — não inventar sintaxe.
+**Docs:** `aspm_docs` (secção `aspm-commands` + guias por scanner com install Linux/macOS/Windows). Recursos: `kubbisec://aspm/aspm-scanner-{trivy|gitleaks|osv|syft|semgrep|sonar|nmap|skipfish}`, `kubbisec://aspm/aspm-coverage` (Jest, Vitest, pytest, JaCoCo, Go). **HARD-GATE:** chamar `aspm_docs` ou `security_scanner_playbook` antes de citar flags completas — não inventar sintaxe.
 
 ## Comandos CLI
 
@@ -23,11 +23,16 @@ description: KubbiSec ASPM — uploads, gates, projetos e integração com NAUS/
 | `aspm coverage <file>` | Upload de coverage (lcov) |
 | `aspm parse-coverage <file>` | Parse coverage local |
 | `aspm projects` | Listar projetos da organização |
-| `aspm dashboard` | Abrir dashboard no browser |
+| `aspm gate` | Avaliar relatórios locais contra regras inline |
+| `aspm dashboard` | Resumo de postura no terminal |
+
+### Credenciais
+
+API key: **Perfil → API Keys** (`/profile/api-keys`). `-o/--org` = **slug** da organização (ex.: `minha-empresa`).
 
 ### Flags globais
 
-`-k/--api-key`, `-o/--org`, `-p/--project`, `-v/--version`, `-h/--help`
+`-k/--api-key`, `-o/--org` (slug), `-p/--project`, `-v/--version`, `-h/--help`
 
 ### Variáveis de ambiente (precedência: flags CLI > env > `~/.kubbisec/config.json`)
 
@@ -35,7 +40,7 @@ description: KubbiSec ASPM — uploads, gates, projetos e integração com NAUS/
 |----------|-----------|
 | `KUBBISEC_API_URL` / `ASPM_API_URL` | URL da API |
 | `KUBBISEC_API_KEY` / `ASPM_API_KEY` | API key |
-| `KUBBISEC_ORG_ID` / `ASPM_ORG_ID` | Organization ID |
+| `KUBBISEC_ORG_ID` / `ASPM_ORG_ID` | Slug da organização |
 | `KUBBISEC_PROJECT` / `KUBBISEC_PROJECT_ID` / `ASPM_PROJECT_ID` | Project ID |
 
 ## Scanners ↔ `-s` ↔ ficheiro de relatório

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubbisec/ai-linux-arm64",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "KubbiSec CLI — Linux arm64 binary",
   "license": "UNLICENSED",
   "os": [