@kubbisec/ai-linux-x64 0.1.25 → 0.1.28

package/bundled/node_modules/@kubbisec/shared/dist/rbac/resolve-org-permissions.js

@@ -0,0 +1,200 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeOrgMemberRole = void 0;
+exports.getTenantPermissionsForOrgRole = getTenantPermissionsForOrgRole;
+exports.getAllTenantPermissions = getAllTenantPermissions;
+exports.parseApiKeyPermissionsJson = parseApiKeyPermissionsJson;
+const better_auth_org_roles_1 = require("./better-auth-org-roles");
+/** Maps stored org roles (Kubbisec slugs + legacy Better Auth) → canonical `OrgRoleSlug`. */
+exports.normalizeOrgMemberRole = better_auth_org_roles_1.normalizeStoredOrgRole;
+const ALL_TENANT = new Set([
+    "kbsc.org.profile.read",
+    "kbsc.org.profile.update",
+    "kbsc.org.settings.manage",
+    "kbsc.org.delete",
+    "kbsc.identity.member.read",
+    "kbsc.identity.member.invite",
+    "kbsc.identity.member.role.update",
+    "kbsc.identity.member.remove",
+    "kbsc.identity.invitation.manage",
+    "kbsc.asset.project.read",
+    "kbsc.asset.project.create",
+    "kbsc.asset.project.update",
+    "kbsc.asset.project.delete",
+    "kbsc.finding.read",
+    "kbsc.finding.triage.update",
+    "kbsc.finding.remediation.manage",
+    "kbsc.finding.remediation.auto-apply",
+    "kbsc.finding.export",
+    "kbsc.ingest.report.create",
+    "kbsc.scan.read",
+    "kbsc.scan.trigger",
+    "kbsc.supply.read",
+    "kbsc.supply.policy.comment",
+    "kbsc.supply.scan.trigger",
+    "kbsc.governance.read",
+    "kbsc.governance.coverage.manage",
+    "kbsc.ingest.coverage.create",
+    "kbsc.integration.read",
+    "kbsc.integration.connect",
+    "kbsc.integration.disconnect",
+    "kbsc.integration.secret.write",
+    "kbsc.integration.issue.create",
+    "kbsc.integration.pr.create",
+    "kbsc.ci.read",
+    "kbsc.ci.pipeline.manage",
+    "kbsc.ci.pipeline.run",
+    "kbsc.ci.privileged.run",
+    "kbsc.ci.runner.manage",
+    "kbsc.ci.envpack.manage",
+    "kbsc.ci.bootstrap.manage",
+    "kbsc.credential.apikey.read",
+    "kbsc.credential.apikey.create",
+    "kbsc.credential.apikey.revoke",
+    "kbsc.notification.read",
+    "kbsc.notification.preference.manage",
+    "kbsc.ai.provider.manage",
+    "kbsc.ai.usage.read",
+    "kbsc.ai.assistant.use",
+    "kbsc.ai.automation.auto",
+    "kbsc.project.ai-autopilot.manage",
+    "kbsc.project.ai-autopilot.run",
+    "kbsc.integration.pr.merge",
+    "kbsc.billing.read",
+    "kbsc.billing.manage",
+    "kbsc.contract.read",
+    "kbsc.contract.manage",
+    "kbsc.identity.member.permission.manage",
+    "kbsc.org.security.read",
+    "kbsc.org.security.manage",
+    "kbsc.org.assistant.manage",
+].map((p) => p));
+/** Effective tenant permissions for an organization member role (see rbac-catalog.md §4). */
+function getTenantPermissionsForOrgRole(role) {
+    switch (role) {
+        case "org_administrator":
+            return ALL_TENANT;
+        case "org_finance":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.billing.read",
+                "kbsc.billing.manage",
+                "kbsc.contract.read",
+                "kbsc.contract.manage",
+                "kbsc.notification.read",
+            ]);
+        case "org_security_engineer":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.asset.project.read",
+                "kbsc.asset.project.create",
+                "kbsc.asset.project.update",
+                "kbsc.finding.read",
+                "kbsc.finding.triage.update",
+                "kbsc.finding.remediation.manage",
+                "kbsc.finding.remediation.auto-apply",
+                "kbsc.finding.export",
+                "kbsc.ingest.report.create",
+                "kbsc.scan.read",
+                "kbsc.scan.trigger",
+                "kbsc.supply.read",
+                "kbsc.supply.policy.comment",
+                "kbsc.supply.scan.trigger",
+                "kbsc.governance.read",
+                "kbsc.governance.coverage.manage",
+                "kbsc.ingest.coverage.create",
+                "kbsc.integration.read",
+                "kbsc.integration.connect",
+                "kbsc.ci.read",
+                "kbsc.credential.apikey.read",
+                "kbsc.notification.read",
+                "kbsc.notification.preference.manage",
+                "kbsc.ai.usage.read",
+                "kbsc.ai.assistant.use",
+                "kbsc.project.ai-autopilot.run",
+            ]);
+        case "org_delivery_engineer":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.asset.project.read",
+                "kbsc.asset.project.create",
+                "kbsc.asset.project.update",
+                "kbsc.finding.read",
+                "kbsc.finding.export",
+                "kbsc.ingest.report.create",
+                "kbsc.supply.read",
+                "kbsc.supply.scan.trigger",
+                "kbsc.governance.read",
+                "kbsc.governance.coverage.manage",
+                "kbsc.ingest.coverage.create",
+                "kbsc.integration.read",
+                "kbsc.integration.connect",
+                "kbsc.integration.disconnect",
+                "kbsc.integration.secret.write",
+                "kbsc.ci.read",
+                "kbsc.ci.pipeline.manage",
+                "kbsc.ci.pipeline.run",
+                "kbsc.ci.runner.manage",
+                "kbsc.ci.envpack.manage",
+                "kbsc.ci.bootstrap.manage",
+                "kbsc.credential.apikey.read",
+                "kbsc.credential.apikey.create",
+                "kbsc.credential.apikey.revoke",
+                "kbsc.notification.read",
+                "kbsc.notification.preference.manage",
+                "kbsc.ai.usage.read",
+                "kbsc.ai.assistant.use",
+            ]);
+        case "org_observer":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.asset.project.read",
+                "kbsc.finding.read",
+                "kbsc.finding.export",
+                "kbsc.supply.read",
+                "kbsc.governance.read",
+                "kbsc.integration.read",
+                "kbsc.ci.read",
+                "kbsc.notification.read",
+                "kbsc.ai.usage.read",
+                "kbsc.ai.assistant.use",
+            ]);
+    }
+}
+/** Full tenant permission set (e.g. API-key-only automation, parity with org admin). */
+function getAllTenantPermissions() {
+    return ALL_TENANT;
+}
+function parseApiKeyPermissionsJson(raw) {
+    if (raw == null)
+        return null;
+    try {
+        const v = typeof raw === "string" ? (raw.trim() === "" ? null : JSON.parse(raw)) : raw;
+        if (v == null)
+            return null;
+        const rawPermissions = (() => {
+            if (Array.isArray(v))
+                return v;
+            if (typeof v === "object" && v !== null)
+                return Object.values(v).flatMap((value) => (Array.isArray(value) ? value : []));
+            return null;
+        })();
+        if (!rawPermissions)
+            return null;
+        const out = new Set();
+        for (const x of rawPermissions) {
+            if (typeof x === "string" && ALL_TENANT.has(x)) {
+                out.add(x);
+            }
+        }
+        return out.size ? [...out] : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=resolve-org-permissions.js.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/resolve-org-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-org-permissions.js","sourceRoot":"","sources":["../../src/rbac/resolve-org-permissions.ts"],"names":[],"mappings":";;;AA0EA,wEA8FC;AAGD,0DAEC;AAED,gEAwBC;AAvMD,mEAAiE;AAGjE,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,8CAAsB,CAAC;AAE7D,MAAM,UAAU,GAAoC,IAAI,GAAG,CAEvD;IACE,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,iBAAiB;IACjB,2BAA2B;IAC3B,6BAA6B;IAC7B,kCAAkC;IAClC,6BAA6B;IAC7B,iCAAiC;IACjC,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,mBAAmB;IACnB,4BAA4B;IAC5B,iCAAiC;IACjC,qCAAqC;IACrC,qBAAqB;IACrB,2BAA2B;IAC3B,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,4BAA4B;IAC5B,0BAA0B;IAC1B,sBAAsB;IACtB,iCAAiC;IACjC,6BAA6B;IAC7B,uBAAuB;IACvB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,4BAA4B;IAC5B,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,wBAAwB;IACxB,qCAAqC;IACrC,yBAAyB;IACzB,oBAAoB;IACpB,uBAAuB;IACvB,yBAAyB;IACzB,kCAAkC;IAClC,+BAA+B;IAC/B,2BAA2B;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,wCAAwC;IACxC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;CAE9B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAuB,CAAC,CACtC,CAAC;AAEF,6FAA6F;AAC7F,SAAgB,8BAA8B,CAAC,IAAiB;IAC9D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB;YACtB,OAAO,UAAU,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,mBAAmB;gBACnB,qBAAqB;gBACrB,oBAAoB;gBACpB,sBAAsB;gBACtB,wBAAwB;aACzB,CAAC,CAAC;QACL,KAAK,uBAAuB;YAC1B,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,2BAA2B;gBAC3B,2BAA2B;gBAC3B,mBAAmB;gBACnB,4BAA4B;gBAC5B,iCAAiC;gBACjC,qCAAqC;gBACrC,qBAAqB;gBACrB,2BAA2B;gBAC3B,gBAAgB;gBAChB,mBAAmB;gBACnB,kBAAkB;gBAClB,4BAA4B;gBAC5B,0BAA0B;gBAC1B,sBAAsB;gBACtB,iCAAiC;gBACjC,6BAA6B;gBAC7B,uBAAuB;gBACvB,0BAA0B;gBAC1B,cAAc;gBACd,6BAA6B;gBAC7B,wBAAwB;gBACxB,qCAAqC;gBACrC,oBAAoB;gBACpB,uBAAuB;gBACvB,+BAA+B;aAChC,CAAC,CAAC;QACL,KAAK,uBAAuB;YAC1B,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,2BAA2B;gBAC3B,2BAA2B;gBAC3B,mBAAmB;gBACnB,qBAAqB;gBACrB,2BAA2B;gBAC3B,kBAAkB;gBAClB,0BAA0B;gBAC1B,sBAAsB;gBACtB,iCAAiC;gBACjC,6BAA6B;gBAC7B,uBAAuB;gBACvB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,cAAc;gBACd,yBAAyB;gBACzB,sBAAsB;gBACtB,uBAAuB;gBACvB,wBAAwB;gBACxB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,+BAA+B;gBAC/B,wBAAwB;gBACxB,qCAAqC;gBACrC,oBAAoB;gBACpB,uBAAuB;aACxB,CAAC,CAAC;QACL,KAAK,cAAc;YACjB,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,mBAAmB;gBACnB,qBAAqB;gBACrB,kBAAkB;gBAClB,sBAAsB;gBACtB,uBAAuB;gBACvB,cAAc;gBACd,wBAAwB;gBACxB,oBAAoB;gBACpB,uBAAuB;aACxB,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAgB,uBAAuB;IACrC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,0BAA0B,CACxC,GAAoE;IAEpE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvF,IAAI,CAAC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;YAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;gBACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,CAAuB,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,GAAG,CAAC,CAAuB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/resolve-platform-permissions.d.ts

@@ -0,0 +1,7 @@
+import { type KubbisecPermission } from "./kubbisec-permissions";
+/**
+ * Maps global `user.role` (Better Auth admin plugin uses `admin`) + future slugs.
+ * `admin` and `platform_super_admin` receive the full `kbsc.*` catalog (tenant + platform).
+ */
+export declare function getPlatformPermissionsFromGlobalUserRole(role: string | null | undefined): ReadonlySet<KubbisecPermission>;
+//# sourceMappingURL=resolve-platform-permissions.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/resolve-platform-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-platform-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/resolve-platform-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAO3F;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAMjC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/resolve-platform-permissions.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPlatformPermissionsFromGlobalUserRole = getPlatformPermissionsFromGlobalUserRole;
+const kubbisec_permissions_1 = require("./kubbisec-permissions");
+const PLATFORM_ACCOUNT_MANAGER = new Set([
+    "kbsc.platform.org.read",
+    "kbsc.platform.user.read",
+]);
+/**
+ * Maps global `user.role` (Better Auth admin plugin uses `admin`) + future slugs.
+ * `admin` and `platform_super_admin` receive the full `kbsc.*` catalog (tenant + platform).
+ */
+function getPlatformPermissionsFromGlobalUserRole(role) {
+    if (!role)
+        return new Set();
+    const r = role.trim();
+    if (r === "admin" || r === "platform_super_admin")
+        return kubbisec_permissions_1.ALL_KUBBISEC_PERMISSIONS;
+    if (r === "platform_account_manager")
+        return PLATFORM_ACCOUNT_MANAGER;
+    return new Set();
+}
+//# sourceMappingURL=resolve-platform-permissions.js.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/resolve-platform-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-platform-permissions.js","sourceRoot":"","sources":["../../src/rbac/resolve-platform-permissions.ts"],"names":[],"mappings":";;AAWA,4FAQC;AAnBD,iEAA2F;AAE3F,MAAM,wBAAwB,GAAoC,IAAI,GAAG,CAAC;IACxE,wBAAwB;IACxB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,wCAAwC,CACtD,IAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,sBAAsB;QAAE,OAAO,+CAAwB,CAAC;IACnF,IAAI,CAAC,KAAK,0BAA0B;QAAE,OAAO,wBAAwB,CAAC;IACtE,OAAO,IAAI,GAAG,EAAE,CAAC;AACnB,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/redaction.d.ts

@@ -0,0 +1,14 @@
+export declare const REDACTED_VALUE = "[REDACTED]";
+export type RedactionOptions = {
+    redactRawData?: boolean;
+    redactMetadata?: boolean;
+};
+export declare function redactString(value: string): string;
+export declare function redactSensitiveData<T>(value: T): T;
+export declare function sanitizeReportPayload<T extends {
+    metadata?: Record<string, unknown>;
+    vulnerabilities?: Array<{
+        rawData?: Record<string, unknown>;
+    }>;
+}>(report: T, options?: RedactionOptions): T;
+//# sourceMappingURL=redaction.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,eAAe,CAAC;AAiD3C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AA8BF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqBlD;AAgJD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA2ClD;AAED,wBAAgB,qBAAqB,CACnC,CAAC,SAAS;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAChE,EACD,MAAM,EAAE,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,CAAC,CAyB9C"}

package/bundled/node_modules/@kubbisec/shared/dist/redaction.js

@@ -0,0 +1,251 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REDACTED_VALUE = void 0;
+exports.redactString = redactString;
+exports.redactSensitiveData = redactSensitiveData;
+exports.sanitizeReportPayload = sanitizeReportPayload;
+/**
+ * Structured redaction uses **@pinojs/redact** (Pino / Node.js logging stack), the same path
+ * model as `fast-redact` and Pino log redaction.
+ * @see https://github.com/pinojs/redact
+ *
+ * Key rules (headers vs env, substring keys, allowlist for fingerprint/secretHash) and
+ * inline secret patterns in strings stay defined here for ASPM report shapes.
+ */
+const redact_1 = __importDefault(require("@pinojs/redact"));
+exports.REDACTED_VALUE = "[REDACTED]";
+const SENSITIVE_KEY_PARTS = [
+    "accesstoken",
+    "apikey",
+    "apitoken",
+    "authorization",
+    "bearertoken",
+    "clientsecret",
+    "credential",
+    "idtoken",
+    "password",
+    "passwd",
+    "privatekey",
+    "refreshtoken",
+    "secret",
+    "session",
+    "token",
+];
+const SENSITIVE_EXACT_KEYS = new Set([
+    "auth",
+    "cookie",
+    "match",
+    "offender",
+    "proxyauthorization",
+    "pwd",
+    "secret",
+    "setcookie",
+]);
+const SENSITIVE_HEADER_KEYS = new Set([
+    "authorization",
+    "cookie",
+    "proxyauthorization",
+    "setcookie",
+    "xapikey",
+    "xauthtoken",
+    "xcsrftoken",
+    "xgithubtoken",
+]);
+const NON_SENSITIVE_EXACT_KEYS = new Set(["fingerprint", "secrethash"]);
+const ENV_CONTAINER_KEYS = new Set(["env", "environment", "environmentvariables", "envvars"]);
+const HEADER_CONTAINER_KEYS = new Set(["header", "headers", "requestheaders", "responseheaders"]);
+const MAX_REDACTION_DEPTH = 20;
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isSensitiveKey(key) {
+    const normalized = normalizeKey(key);
+    if (NON_SENSITIVE_EXACT_KEYS.has(normalized))
+        return false;
+    return (SENSITIVE_EXACT_KEYS.has(normalized) ||
+        SENSITIVE_KEY_PARTS.some((part) => normalized.includes(part)));
+}
+function shouldRedactValue(key, parentKey) {
+    const normalizedKey = normalizeKey(key);
+    const normalizedParentKey = parentKey ? normalizeKey(parentKey) : "";
+    if (HEADER_CONTAINER_KEYS.has(normalizedParentKey)) {
+        return SENSITIVE_HEADER_KEYS.has(normalizedKey) || isSensitiveKey(key);
+    }
+    if (ENV_CONTAINER_KEYS.has(normalizedParentKey)) {
+        return isSensitiveKey(key);
+    }
+    return isSensitiveKey(key);
+}
+function redactString(value) {
+    return value
+        .replace(/\b((?:[A-Z][A-Z0-9_]{1,80})(?:TOKEN|SECRET|PASSWORD|PASSWD|PWD|API_KEY|PRIVATE_KEY|CLIENT_SECRET|AUTH)[A-Z0-9_]*\s*=\s*)(["']?)[^\s"'`]+/gi, `$1$2${exports.REDACTED_VALUE}`)
+        .replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, `$1${exports.REDACTED_VALUE}`)
+        .replace(/\b(Basic\s+)[A-Za-z0-9+/=-]{8,}/gi, `$1${exports.REDACTED_VALUE}`)
+        .replace(/\bgh[pousr]_[A-Za-z0-9_]{20,255}\b/g, exports.REDACTED_VALUE)
+        .replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, exports.REDACTED_VALUE)
+        .replace(/\bAIza[0-9A-Za-z_-]{35}\b/g, exports.REDACTED_VALUE)
+        .replace(/\b(AccountKey|SharedAccessSignature)=([^;\n]+)/gi, `$1=${exports.REDACTED_VALUE}`)
+        .replace(/\b((?:password|passwd|pwd|secret|token|api[_-]?key|client[_-]?secret)\b\s*[:=]\s*)(["'`]?)[^,\s"'`]+/gi, `$1$2${exports.REDACTED_VALUE}`)
+        .replace(/\b((?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|rediss):\/\/)([^/@\s:]*):([^/@\s]+)@/gi, `$1${exports.REDACTED_VALUE}@`)
+        .replace(/(https?:\/\/)([^/@\s:]+):([^/@\s]+)@/gi, `$1${exports.REDACTED_VALUE}@`);
+}
+/** Path string for @pinojs/redact / fast-redact. */
+function serializeRedactPath(parts) {
+    let out = "";
+    for (const p of parts) {
+        if (typeof p === "number" || (typeof p === "string" && /^\d+$/.test(p))) {
+            const n = typeof p === "number" ? p : Number(p);
+            out += `[${n}]`;
+            continue;
+        }
+        const k = String(p);
+        if (/^[a-zA-Z_$][\w$]*$/.test(k)) {
+            out += out === "" ? k : `.${k}`;
+        }
+        else {
+            const escaped = k.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
+            out += out === "" ? `["${escaped}"]` : `.["${escaped}"]`;
+        }
+    }
+    return out;
+}
+/** Normalize path segments so @pinojs/redact callback keys match our collected paths. */
+function pathKey(parts) {
+    return JSON.stringify(parts.map(String));
+}
+function markFull(parts, fullPathKeys, pinoPaths) {
+    const pk = pathKey(parts);
+    fullPathKeys.add(pk);
+    pinoPaths.add(serializeRedactPath(parts));
+}
+/** Deep clone for JSON-serializable report trees (no cycles, no special types). */
+function cloneReportTree(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+function markString(parts, stringPathKeys, pinoPaths) {
+    const pk = pathKey(parts);
+    stringPathKeys.add(pk);
+    pinoPaths.add(serializeRedactPath(parts));
+}
+/**
+ * Mirrors legacy `redactValue` traversal: `containerKey` is the key passed into `redactValue`
+ * (how the parent refers to this node — array field name for array items, child key for nested objects).
+ */
+function collectRedactionTargets(value, parts, containerKey, depth, fullPathKeys, stringPathKeys, pinoPaths) {
+    if (value === null || typeof value !== "object") {
+        return;
+    }
+    if (containerKey !== undefined && shouldRedactValue(containerKey)) {
+        markFull(parts, fullPathKeys, pinoPaths);
+        return;
+    }
+    if (depth >= MAX_REDACTION_DEPTH) {
+        markFull(parts, fullPathKeys, pinoPaths);
+        return;
+    }
+    if (Array.isArray(value)) {
+        const nextDepth = depth + 1;
+        for (let i = 0; i < value.length; i++) {
+            const item = value[i];
+            const itemParts = [...parts, i];
+            if (item === null || typeof item !== "object") {
+                if (typeof item === "string") {
+                    markString(itemParts, stringPathKeys, pinoPaths);
+                }
+                continue;
+            }
+            if (nextDepth >= MAX_REDACTION_DEPTH) {
+                markFull(itemParts, fullPathKeys, pinoPaths);
+                continue;
+            }
+            collectRedactionTargets(item, itemParts, containerKey, nextDepth, fullPathKeys, stringPathKeys, pinoPaths);
+        }
+        return;
+    }
+    const input = value;
+    for (const [childKey, childValue] of Object.entries(input)) {
+        const nextParts = [...parts, childKey];
+        if (shouldRedactValue(childKey, containerKey)) {
+            markFull(nextParts, fullPathKeys, pinoPaths);
+            continue;
+        }
+        if (childValue === null || typeof childValue !== "object") {
+            if (typeof childValue === "string") {
+                markString(nextParts, stringPathKeys, pinoPaths);
+            }
+            continue;
+        }
+        const nextDepth = depth + 1;
+        if (nextDepth >= MAX_REDACTION_DEPTH) {
+            markFull(nextParts, fullPathKeys, pinoPaths);
+            continue;
+        }
+        collectRedactionTargets(childValue, nextParts, childKey, nextDepth, fullPathKeys, stringPathKeys, pinoPaths);
+    }
+}
+function redactSensitiveData(value) {
+    if (value == null || typeof value !== "object") {
+        if (typeof value === "string") {
+            return redactString(value);
+        }
+        return value;
+    }
+    const fullPathKeys = new Set();
+    const stringPathKeys = new Set();
+    const pinoPaths = new Set();
+    collectRedactionTargets(value, [], undefined, 0, fullPathKeys, stringPathKeys, pinoPaths);
+    if (pinoPaths.size === 0) {
+        return value;
+    }
+    const redact = (0, redact_1.default)({
+        paths: [...pinoPaths],
+        serialize: false,
+        strict: false,
+        censor: ((v, keyPath) => {
+            const parts = Array.isArray(keyPath) ? keyPath.map((x) => String(x)) : [];
+            const pk = pathKey(parts);
+            if (fullPathKeys.has(pk)) {
+                return exports.REDACTED_VALUE;
+            }
+            if (typeof v === "string" && stringPathKeys.has(pk)) {
+                return redactString(v);
+            }
+            return v;
+        }),
+    });
+    const raw = redact(cloneReportTree(value));
+    if (typeof raw.restore === "function") {
+        const { restore: _drop, ...rest } = raw;
+        return rest;
+    }
+    return raw;
+}
+function sanitizeReportPayload(report, options = {}) {
+    const { redactRawData = true, redactMetadata = true } = options;
+    return {
+        ...report,
+        ...(redactMetadata && report.metadata
+            ? { metadata: redactSensitiveData(report.metadata) }
+            : {}),
+        ...(Array.isArray(report.vulnerabilities)
+            ? {
+                vulnerabilities: report.vulnerabilities.map((vulnerability) => {
+                    const { rawData, ...vulnerabilityFields } = vulnerability;
+                    const hasRawData = Object.hasOwn(vulnerability, "rawData");
+                    return {
+                        ...redactSensitiveData(vulnerabilityFields),
+                        ...(hasRawData
+                            ? {
+                                rawData: redactRawData && rawData ? redactSensitiveData(rawData) : rawData,
+                            }
+                            : {}),
+                    };
+                }),
+            }
+            : {}),
+    };
+}
+//# sourceMappingURL=redaction.js.map

package/bundled/node_modules/@kubbisec/shared/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":";;;;;;AA4FA,oCAqBC;AAgJD,kDA2CC;AAED,sDA8BC;AA5UD;;;;;;;GAOG;AACH,4DAAwC;AAE3B,QAAA,cAAc,GAAG,YAAY,CAAC;AAE3C,MAAM,mBAAmB,GAAG;IAC1B,aAAa;IACb,QAAQ;IACR,UAAU;IACV,eAAe;IACf,aAAa;IACb,cAAc;IACd,YAAY;IACZ,SAAS;IACT,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,SAAS;IACT,OAAO;CACR,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,oBAAoB;IACpB,KAAK;IACL,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,eAAe;IACf,QAAQ;IACR,oBAAoB;IACpB,WAAW;IACX,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;AACxE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9F,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAClG,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAS/B,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,CACL,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC;QACpC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,SAAkB;IACxD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,IAAI,qBAAqB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACnD,OAAO,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAChD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK;SACT,OAAO,CACN,4IAA4I,EAC5I,OAAO,sBAAc,EAAE,CACxB;SACA,OAAO,CAAC,uCAAuC,EAAE,KAAK,sBAAc,EAAE,CAAC;SACvE,OAAO,CAAC,mCAAmC,EAAE,KAAK,sBAAc,EAAE,CAAC;SACnE,OAAO,CAAC,qCAAqC,EAAE,sBAAc,CAAC;SAC9D,OAAO,CAAC,gCAAgC,EAAE,sBAAc,CAAC;SACzD,OAAO,CAAC,4BAA4B,EAAE,sBAAc,CAAC;SACrD,OAAO,CAAC,kDAAkD,EAAE,MAAM,sBAAc,EAAE,CAAC;SACnF,OAAO,CACN,wGAAwG,EACxG,OAAO,sBAAc,EAAE,CACxB;SACA,OAAO,CACN,oGAAoG,EACpG,KAAK,sBAAc,GAAG,CACvB;SACA,OAAO,CAAC,wCAAwC,EAAE,KAAK,sBAAc,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,oDAAoD;AACpD,SAAS,mBAAmB,CAAC,KAA6B;IACxD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAChD,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClE,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,IAAI,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,SAAS,OAAO,CAAC,KAA6B;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CACf,KAA6B,EAC7B,YAAyB,EACzB,SAAsB;IAEtB,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrB,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAI,KAAQ;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CACjB,KAA6B,EAC7B,cAA2B,EAC3B,SAAsB;IAEtB,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvB,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,KAA6B,EAC7B,YAAgC,EAChC,KAAa,EACb,YAAyB,EACzB,cAA2B,EAC3B,SAAsB;IAEtB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,IAAI,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,IAAI,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;YAEhC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;gBACnD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,SAAS,IAAI,mBAAmB,EAAE,CAAC;gBACrC,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,uBAAuB,CACrB,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,cAAc,EACd,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,KAAuB,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEvC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1D,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACnC,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;QAC5B,IAAI,SAAS,IAAI,mBAAmB,EAAE,CAAC;YACrC,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QAED,uBAAuB,CACrB,UAAU,EACV,SAAS,EACT,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,cAAc,EACd,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,mBAAmB,CAAI,KAAQ;IAC7C,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,YAAY,CAAC,KAAK,CAAM,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAE1F,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,gBAAU,EAAC;QACxB,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,CAAC,CAAC,CAAU,EAAE,OAAgB,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,OAAO,sBAAc,CAAC;YACxB,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpD,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC,CAA4B;KAC9B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAExC,CAAC;IACF,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACxC,OAAO,IAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,qBAAqB,CAKnC,MAAS,EAAE,UAA4B,EAAE;IACzC,MAAM,EAAE,aAAa,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAEhE,OAAO;QACL,GAAG,MAAM;QACT,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ;YACnC,CAAC,CAAC,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YACvC,CAAC,CAAC;gBACE,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE;oBAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,EAAE,GAAG,aAAa,CAAC;oBAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;oBAC3D,OAAO;wBACL,GAAG,mBAAmB,CAAC,mBAAmB,CAAC;wBAC3C,GAAG,CAAC,UAAU;4BACZ,CAAC,CAAC;gCACE,OAAO,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;6BAC3E;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;gBACJ,CAAC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/aspm-gate-rules.d.ts

@@ -0,0 +1,19 @@
+export type AspmGateRules = {
+    vulnerabilities?: {
+        max_by_severity: Record<string, number>;
+    };
+    coverage?: {
+        min_line_pct: number;
+    };
+};
+export declare const DEFAULT_ASPM_GATE_RULES: AspmGateRules;
+/** Base64 payload for `aspm gate --rules` (wraps rules in `{ rules: ... }`). */
+export declare function encodeAspmGateRulesBase64(rules?: AspmGateRules): string;
+/** Pretty JSON for `aspm gate --rules-file` (wraps rules in `{ rules: ... }`). */
+export declare function formatAspmGateRulesJson(rules?: AspmGateRules): string;
+/**
+ * GitHub Actions step with human-readable gate rules JSON and `aspm gate --rules-file`.
+ * Same semantics as Naus `aspm_gate`, without base64 or Node wrappers in the YAML.
+ */
+export declare function buildAspmGateGithubWorkflowStep(rules?: AspmGateRules, projectId?: string): string;
+//# sourceMappingURL=aspm-gate-rules.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/security/aspm-gate-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aspm-gate-rules.d.ts","sourceRoot":"","sources":["../../src/security/aspm-gate-rules.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAC1B,eAAe,CAAC,EAAE;QAChB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,aAOrC,CAAC;AAmBF,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,KAAK,GAAE,aAAuC,GAAG,MAAM,CAGhG;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,KAAK,GAAE,aAAuC,GAAG,MAAM,CAG9F;AAWD;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,GAAE,aAAuC,EAC9C,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAaR"}

package/bundled/node_modules/@kubbisec/shared/dist/security/aspm-gate-rules.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ASPM_GATE_RULES = void 0;
+exports.encodeAspmGateRulesBase64 = encodeAspmGateRulesBase64;
+exports.formatAspmGateRulesJson = formatAspmGateRulesJson;
+exports.buildAspmGateGithubWorkflowStep = buildAspmGateGithubWorkflowStep;
+exports.DEFAULT_ASPM_GATE_RULES = {
+    vulnerabilities: {
+        max_by_severity: {
+            CRITICAL: 0,
+            HIGH: 0,
+        },
+    },
+};
+function encodeUtf8ToBase64(value) {
+    const bufferCtor = globalThis.Buffer;
+    if (bufferCtor) {
+        return bufferCtor.from(value, "utf8").toString("base64");
+    }
+    const bytes = new TextEncoder().encode(value);
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+/** Base64 payload for `aspm gate --rules` (wraps rules in `{ rules: ... }`). */
+function encodeAspmGateRulesBase64(rules = exports.DEFAULT_ASPM_GATE_RULES) {
+    const body = rules && Object.keys(rules).length > 0 ? { rules } : {};
+    return encodeUtf8ToBase64(JSON.stringify(body));
+}
+/** Pretty JSON for `aspm gate --rules-file` (wraps rules in `{ rules: ... }`). */
+function formatAspmGateRulesJson(rules = exports.DEFAULT_ASPM_GATE_RULES) {
+    const body = rules && Object.keys(rules).length > 0 ? { rules } : {};
+    return JSON.stringify(body, null, 2);
+}
+const KUBBISEC_GATE_RULES_FILENAME = "kubbisec-gate-rules.json";
+function indentForYamlRunBlock(text, indent = "          ") {
+    return text
+        .split("\n")
+        .map((line) => (line.length > 0 ? `${indent}${line}` : line))
+        .join("\n");
+}
+/**
+ * GitHub Actions step with human-readable gate rules JSON and `aspm gate --rules-file`.
+ * Same semantics as Naus `aspm_gate`, without base64 or Node wrappers in the YAML.
+ */
+function buildAspmGateGithubWorkflowStep(rules = exports.DEFAULT_ASPM_GATE_RULES, projectId) {
+    const rulesJson = indentForYamlRunBlock(formatAspmGateRulesJson(rules));
+    const projectRef = projectId ?? `\${{ vars.KUBBISEC_PROJECT }}`;
+    return `      # Quality gate KubbiSec: avalia os relatórios locais desta job (modelo Naus aspm_gate)
+      - name: KubbiSec ASPM gate
+        env:
+          KUBBISEC_PROJECT: ${projectRef}
+        run: |
+          cat > ${KUBBISEC_GATE_RULES_FILENAME} <<'EOF'
+${rulesJson}
+          EOF
+          aspm gate --rules-file ${KUBBISEC_GATE_RULES_FILENAME} -p ${projectRef}`;
+}
+//# sourceMappingURL=aspm-gate-rules.js.map

package/bundled/node_modules/@kubbisec/shared/dist/security/aspm-gate-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aspm-gate-rules.js","sourceRoot":"","sources":["../../src/security/aspm-gate-rules.ts"],"names":[],"mappings":";;;AAoCA,8DAGC;AAGD,0DAGC;AAeD,0EAgBC;AAnEY,QAAA,uBAAuB,GAAkB;IACpD,eAAe,EAAE;QACf,eAAe,EAAE;YACf,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;SACR;KACF;CACF,CAAC;AAEF,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,UAAU,GACd,UAGD,CAAC,MAAM,CAAC;IACT,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,gFAAgF;AAChF,SAAgB,yBAAyB,CAAC,QAAuB,+BAAuB;IACtF,MAAM,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,OAAO,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,kFAAkF;AAClF,SAAgB,uBAAuB,CAAC,QAAuB,+BAAuB;IACpF,MAAM,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AAEhE,SAAS,qBAAqB,CAAC,IAAY,EAAE,MAAM,GAAG,YAAY;IAChE,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAgB,+BAA+B,CAC7C,QAAuB,+BAAuB,EAC9C,SAAkB;IAElB,MAAM,SAAS,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,SAAS,IAAI,+BAA+B,CAAC;IAEhE,OAAO;;;8BAGqB,UAAU;;kBAEtB,4BAA4B;EAC5C,SAAS;;mCAEwB,4BAA4B,OAAO,UAAU,EAAE,CAAC;AACnF,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/build-aspm-security-matrix-pipeline-yaml.d.ts

@@ -0,0 +1,3 @@
+import type { BuildAspmSecurityMatrixPipelineOptions } from "./security-tool.types";
+export declare function buildAspmSecurityMatrixPipelineYaml(tools: readonly string[], options?: BuildAspmSecurityMatrixPipelineOptions): string;
+//# sourceMappingURL=build-aspm-security-matrix-pipeline-yaml.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/security/build-aspm-security-matrix-pipeline-yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-aspm-security-matrix-pipeline-yaml.d.ts","sourceRoot":"","sources":["../../src/security/build-aspm-security-matrix-pipeline-yaml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sCAAsC,EAAkB,MAAM,uBAAuB,CAAC;AAqBpG,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE,sCAAsC,GAC/C,MAAM,CAkCR"}