@kubbisec/ai-linux-x64 0.1.25 → 0.1.28

package/bundled/node_modules/@kubbisec/shared/dist/severity-map.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SKIPFISH_SEVERITY_MAP = exports.SEMGREP_SEVERITY_MAP = exports.SONAR_SEVERITY_MAP = exports.TRIVY_SEVERITY_MAP = void 0;
+exports.mapNmapSeverity = mapNmapSeverity;
+const enums_1 = require("./enums");
+exports.TRIVY_SEVERITY_MAP = {
+    CRITICAL: enums_1.Severity.CRITICAL,
+    HIGH: enums_1.Severity.HIGH,
+    MEDIUM: enums_1.Severity.MEDIUM,
+    LOW: enums_1.Severity.LOW,
+    UNKNOWN: enums_1.Severity.INFO,
+};
+exports.SONAR_SEVERITY_MAP = {
+    BLOCKER: enums_1.Severity.CRITICAL,
+    CRITICAL: enums_1.Severity.HIGH,
+    MAJOR: enums_1.Severity.MEDIUM,
+    MINOR: enums_1.Severity.LOW,
+    INFO: enums_1.Severity.INFO,
+};
+/** Semgrep CLI JSON: extra.severity */
+exports.SEMGREP_SEVERITY_MAP = {
+    ERROR: enums_1.Severity.HIGH,
+    WARNING: enums_1.Severity.MEDIUM,
+    INFO: enums_1.Severity.LOW,
+    INVENTORY: enums_1.Severity.INFO,
+};
+exports.SKIPFISH_SEVERITY_MAP = {
+    5: enums_1.Severity.HIGH,
+    4: enums_1.Severity.MEDIUM,
+    3: enums_1.Severity.LOW,
+    2: enums_1.Severity.LOW,
+    1: enums_1.Severity.INFO,
+};
+function mapNmapSeverity(port, service) {
+    const criticalPorts = [21, 23, 445, 3389, 5900];
+    const highPorts = [22, 25, 53, 110, 143, 389, 636, 1433, 3306, 5432, 6379, 27017];
+    if (criticalPorts.includes(port))
+        return enums_1.Severity.HIGH;
+    if (highPorts.includes(port))
+        return enums_1.Severity.MEDIUM;
+    const riskyServices = ["telnet", "ftp", "vnc", "rdp", "smb"];
+    if (riskyServices.some((s) => service.toLowerCase().includes(s))) {
+        return enums_1.Severity.HIGH;
+    }
+    return enums_1.Severity.LOW;
+}
+//# sourceMappingURL=severity-map.js.map

package/bundled/node_modules/@kubbisec/shared/dist/severity-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-map.js","sourceRoot":"","sources":["../src/severity-map.ts"],"names":[],"mappings":";;;AAkCA,0CAaC;AA/CD,mCAAmC;AAEtB,QAAA,kBAAkB,GAA6B;IAC1D,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;IAC3B,IAAI,EAAE,gBAAQ,CAAC,IAAI;IACnB,MAAM,EAAE,gBAAQ,CAAC,MAAM;IACvB,GAAG,EAAE,gBAAQ,CAAC,GAAG;IACjB,OAAO,EAAE,gBAAQ,CAAC,IAAI;CACvB,CAAC;AAEW,QAAA,kBAAkB,GAA6B;IAC1D,OAAO,EAAE,gBAAQ,CAAC,QAAQ;IAC1B,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,KAAK,EAAE,gBAAQ,CAAC,MAAM;IACtB,KAAK,EAAE,gBAAQ,CAAC,GAAG;IACnB,IAAI,EAAE,gBAAQ,CAAC,IAAI;CACpB,CAAC;AAEF,uCAAuC;AAC1B,QAAA,oBAAoB,GAA6B;IAC5D,KAAK,EAAE,gBAAQ,CAAC,IAAI;IACpB,OAAO,EAAE,gBAAQ,CAAC,MAAM;IACxB,IAAI,EAAE,gBAAQ,CAAC,GAAG;IAClB,SAAS,EAAE,gBAAQ,CAAC,IAAI;CACzB,CAAC;AAEW,QAAA,qBAAqB,GAA6B;IAC7D,CAAC,EAAE,gBAAQ,CAAC,IAAI;IAChB,CAAC,EAAE,gBAAQ,CAAC,MAAM;IAClB,CAAC,EAAE,gBAAQ,CAAC,GAAG;IACf,CAAC,EAAE,gBAAQ,CAAC,GAAG;IACf,CAAC,EAAE,gBAAQ,CAAC,IAAI;CACjB,CAAC;AAEF,SAAgB,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,MAAM,aAAa,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAElF,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAQ,CAAC,IAAI,CAAC;IACvD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAQ,CAAC,MAAM,CAAC;IAErD,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,gBAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,OAAO,gBAAQ,CAAC,GAAG,CAAC;AACtB,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/constants.d.ts

@@ -0,0 +1,4 @@
+export declare const KUBBISEC_SHARED_PROJECT_BASE_URL = "https://shared.kubbisec.com";
+export declare const KUBBISEC_SHARED_PROJECT_HOST = "shared.kubbisec.com";
+export declare function buildSharedProjectUrl(sharePrefix: string, shortId: string): string;
+//# sourceMappingURL=constants.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/shared-project/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC,gCAAgC,CAAC;AAC9E,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF"}

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/constants.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KUBBISEC_SHARED_PROJECT_HOST = exports.KUBBISEC_SHARED_PROJECT_BASE_URL = void 0;
+exports.buildSharedProjectUrl = buildSharedProjectUrl;
+exports.KUBBISEC_SHARED_PROJECT_BASE_URL = "https://shared.kubbisec.com";
+exports.KUBBISEC_SHARED_PROJECT_HOST = "shared.kubbisec.com";
+function buildSharedProjectUrl(sharePrefix, shortId) {
+    return `${exports.KUBBISEC_SHARED_PROJECT_BASE_URL}/${sharePrefix}/${shortId}`;
+}
+//# sourceMappingURL=constants.js.map

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/shared-project/constants.ts"],"names":[],"mappings":";;;AAGA,sDAEC;AALY,QAAA,gCAAgC,GAAG,6BAA6B,CAAC;AACjE,QAAA,4BAA4B,GAAG,qBAAqB,CAAC;AAElE,SAAgB,qBAAqB,CAAC,WAAmB,EAAE,OAAe;IACxE,OAAO,GAAG,wCAAgC,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;AACzE,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./constants";
+export * from "./redact-log-lines";
+export * from "./share-prefix";
+//# sourceMappingURL=index.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shared-project/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./constants"), exports);
+__exportStar(require("./redact-log-lines"), exports);
+__exportStar(require("./share-prefix"), exports);
+//# sourceMappingURL=index.js.map

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/shared-project/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,qDAAmC;AACnC,iDAA+B"}

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/redact-log-lines.d.ts

@@ -0,0 +1,2 @@
+export declare function redactLogLines(lines: string[]): string[];
+//# sourceMappingURL=redact-log-lines.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/redact-log-lines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-log-lines.d.ts","sourceRoot":"","sources":["../../src/shared-project/redact-log-lines.ts"],"names":[],"mappings":"AAIA,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAExD"}

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/redact-log-lines.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactLogLines = redactLogLines;
+const redaction_1 = require("../redaction");
+const EMAIL_PATTERN = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
+function redactLogLines(lines) {
+    return lines.map((line) => (0, redaction_1.redactString)(line).replace(EMAIL_PATTERN, "[redacted-email]"));
+}
+//# sourceMappingURL=redact-log-lines.js.map

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/redact-log-lines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-log-lines.js","sourceRoot":"","sources":["../../src/shared-project/redact-log-lines.ts"],"names":[],"mappings":";;AAIA,wCAEC;AAND,4CAA4C;AAE5C,MAAM,aAAa,GAAG,qDAAqD,CAAC;AAE5E,SAAgB,cAAc,CAAC,KAAe;IAC5C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,wBAAY,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC5F,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/share-prefix.d.ts

@@ -0,0 +1,3 @@
+export declare function deriveSharePrefixBase(orgName: string): string;
+export declare function nextSharePrefixCandidate(base: string, attempt: number): string;
+//# sourceMappingURL=share-prefix.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/share-prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-prefix.d.ts","sourceRoot":"","sources":["../../src/shared-project/share-prefix.ts"],"names":[],"mappings":"AAAA,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAG9E"}

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/share-prefix.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveSharePrefixBase = deriveSharePrefixBase;
+exports.nextSharePrefixCandidate = nextSharePrefixCandidate;
+function deriveSharePrefixBase(orgName) {
+    const letters = orgName.replace(/[^\p{L}]/gu, "");
+    if (letters.length === 0)
+        return "xx";
+    if (letters.length === 1)
+        return letters.toLowerCase().padEnd(2, "x");
+    return letters.slice(0, 2).toLowerCase();
+}
+function nextSharePrefixCandidate(base, attempt) {
+    if (attempt <= 0)
+        return base;
+    return `${base}${attempt + 1}`;
+}
+//# sourceMappingURL=share-prefix.js.map

package/bundled/node_modules/@kubbisec/shared/dist/shared-project/share-prefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-prefix.js","sourceRoot":"","sources":["../../src/shared-project/share-prefix.ts"],"names":[],"mappings":";;AAAA,sDAKC;AAED,4DAGC;AAVD,SAAgB,qBAAqB,CAAC,OAAe;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,SAAgB,wBAAwB,CAAC,IAAY,EAAE,OAAe;IACpE,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,CAAC,EAAE,CAAC;AACjC,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/sonar-safe-string.d.ts

@@ -0,0 +1,26 @@
+/** Remove trailing `/` without regex (avoids Sonar S5852 ReDoS on `/\/+$/`). */
+export declare function trimTrailingSlashes(value: string): string;
+/** Remove leading and trailing runs of `char` without regex. */
+export declare function trimEdgeChars(value: string, char: string): string;
+/** Slugify display names for pipelines, projects, and K8s-safe identifiers. */
+export declare function slugify(value: string, fallback?: string): string;
+/** Extract a fenced markdown code block without `[\s\S]*?` backtracking. */
+export declare function extractFencedBlock(source: string, language?: string): string | null;
+/** Parse `[prefix] message` log lines without lazy-regex backtracking. */
+export declare function parseBracketPrefixedMessage(message: string): {
+    prefix: string;
+    body: string;
+} | null;
+/** Extract file/path hints from free-form location text (CI / AI outputs). */
+export declare function extractPathHints(location: string): string[];
+/** Remove a leading `api/` segment without regex (Sonar S5852). */
+export declare function stripApiPathPrefix(value: string): string;
+/** Remove leading `/` runs without regex. */
+export declare function stripLeadingSlashes(value: string): string;
+/** Strip optional surrounding ASCII quotes without regex. */
+export declare function trimSurroundingQuotes(value: string): string;
+/** Drop `:line` / `:line:col` suffixes from path-like tokens (CI / scanner locations). */
+export declare function stripLineNumberSuffixes(location: string): string;
+/** Sanitize a string into a Kubernetes resource name (RFC 1123 subset). */
+export declare function sanitizeKubernetesName(value: string, fallback?: string): string;
+//# sourceMappingURL=sonar-safe-string.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/sonar-safe-string.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sonar-safe-string.d.ts","sourceRoot":"","sources":["../src/sonar-safe-string.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjE;AAED,+EAA+E;AAC/E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAkBpE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBnF;AAED,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOzC;AAsBD,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB3D;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKxD;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED,6DAA6D;AAC7D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM3D;AAED,0FAA0F;AAC1F,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAsChE;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAInF"}

package/bundled/node_modules/@kubbisec/shared/dist/sonar-safe-string.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trimTrailingSlashes = trimTrailingSlashes;
+exports.trimEdgeChars = trimEdgeChars;
+exports.slugify = slugify;
+exports.extractFencedBlock = extractFencedBlock;
+exports.parseBracketPrefixedMessage = parseBracketPrefixedMessage;
+exports.extractPathHints = extractPathHints;
+exports.stripApiPathPrefix = stripApiPathPrefix;
+exports.stripLeadingSlashes = stripLeadingSlashes;
+exports.trimSurroundingQuotes = trimSurroundingQuotes;
+exports.stripLineNumberSuffixes = stripLineNumberSuffixes;
+exports.sanitizeKubernetesName = sanitizeKubernetesName;
+/** Remove trailing `/` without regex (avoids Sonar S5852 ReDoS on `/\/+$/`). */
+function trimTrailingSlashes(value) {
+    if (!value)
+        return value;
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47)
+        end -= 1;
+    return end === value.length ? value : value.slice(0, end);
+}
+/** Remove leading and trailing runs of `char` without regex. */
+function trimEdgeChars(value, char) {
+    if (!value || !char)
+        return value;
+    let start = 0;
+    let end = value.length;
+    while (start < end && value[start] === char)
+        start += 1;
+    while (end > start && value[end - 1] === char)
+        end -= 1;
+    return value.slice(start, end);
+}
+/** Slugify display names for pipelines, projects, and K8s-safe identifiers. */
+function slugify(value, fallback = "pipeline") {
+    const lower = value.trim().toLowerCase();
+    let slug = "";
+    let prevDash = false;
+    for (const ch of lower) {
+        const code = ch.charCodeAt(0);
+        const isAlphaNum = (code >= 48 && code <= 57) || (code >= 97 && code <= 122) || ch === "-";
+        if (isAlphaNum && ch !== "-") {
+            slug += ch;
+            prevDash = false;
+            continue;
+        }
+        if (!prevDash && slug.length > 0) {
+            slug += "-";
+            prevDash = true;
+        }
+    }
+    return trimEdgeChars(slug, "-") || fallback;
+}
+/** Extract a fenced markdown code block without `[\s\S]*?` backtracking. */
+function extractFencedBlock(source, language) {
+    const fence = language ? `\`\`\`${language}` : "```";
+    const lower = source.toLowerCase();
+    const fenceLower = fence.toLowerCase();
+    let searchFrom = 0;
+    let lastContent = null;
+    for (;;) {
+        const start = lower.indexOf(fenceLower, searchFrom);
+        if (start === -1)
+            break;
+        const contentStart = source.indexOf("\n", start + fence.length);
+        if (contentStart === -1)
+            break;
+        const end = source.indexOf("```", contentStart + 1);
+        if (end === -1)
+            break;
+        lastContent = source.slice(contentStart + 1, end).trim();
+        searchFrom = end + 3;
+    }
+    return lastContent;
+}
+/** Parse `[prefix] message` log lines without lazy-regex backtracking. */
+function parseBracketPrefixedMessage(message) {
+    if (!message.startsWith("["))
+        return null;
+    const close = message.indexOf("]");
+    if (close <= 1)
+        return null;
+    const prefix = message.slice(1, close);
+    const body = message.slice(close + 1).trimStart();
+    return { prefix, body };
+}
+const PATH_HINT_EXTENSIONS = new Set([
+    "json",
+    "yaml",
+    "yml",
+    "lock",
+    "toml",
+    "gradle",
+    "csproj",
+    "dockerfile",
+]);
+function trimTokenEdges(token) {
+    let start = 0;
+    let end = token.length;
+    const isAllowed = (ch) => /[a-zA-Z0-9/._-]/.test(ch);
+    while (start < end && !isAllowed(token[start]))
+        start += 1;
+    while (end > start && !isAllowed(token[end - 1]))
+        end -= 1;
+    return token.slice(start, end);
+}
+/** Extract file/path hints from free-form location text (CI / AI outputs). */
+function extractPathHints(location) {
+    const hints = [];
+    for (const token of location.split(/\s+/)) {
+        const cleaned = trimTokenEdges(token);
+        if (!cleaned)
+            continue;
+        if (cleaned.toLowerCase() === "dockerfile") {
+            hints.push(cleaned);
+            continue;
+        }
+        const slash = cleaned.lastIndexOf("/");
+        const dot = cleaned.lastIndexOf(".");
+        if (dot > slash && dot < cleaned.length - 1) {
+            const ext = cleaned.slice(dot + 1).toLowerCase();
+            if (PATH_HINT_EXTENSIONS.has(ext))
+                hints.push(cleaned);
+            continue;
+        }
+        if (slash >= 0 && dot > slash) {
+            const ext = cleaned.slice(dot + 1).toLowerCase();
+            if (ext.length <= 8 && /^[a-z0-9]+$/.test(ext))
+                hints.push(cleaned);
+        }
+    }
+    return hints;
+}
+/** Remove a leading `api/` segment without regex (Sonar S5852). */
+function stripApiPathPrefix(value) {
+    if (!value.startsWith("api"))
+        return value;
+    let index = 3;
+    while (index < value.length && value.charCodeAt(index) === 47)
+        index += 1;
+    return value.slice(index);
+}
+/** Remove leading `/` runs without regex. */
+function stripLeadingSlashes(value) {
+    let start = 0;
+    while (start < value.length && value.charCodeAt(start) === 47)
+        start += 1;
+    return value.slice(start);
+}
+/** Strip optional surrounding ASCII quotes without regex. */
+function trimSurroundingQuotes(value) {
+    let start = 0;
+    let end = value.length;
+    while (start < end && (value[start] === '"' || value[start] === "'"))
+        start += 1;
+    while (end > start && (value[end - 1] === '"' || value[end - 1] === "'"))
+        end -= 1;
+    return value.slice(start, end);
+}
+/** Drop `:line` / `:line:col` suffixes from path-like tokens (CI / scanner locations). */
+function stripLineNumberSuffixes(location) {
+    const tokens = location.split(/\s+/);
+    const cleaned = [];
+    for (const token of tokens) {
+        const colon = token.lastIndexOf(":");
+        if (colon <= 0) {
+            cleaned.push(token);
+            continue;
+        }
+        const dot = token.lastIndexOf(".");
+        if (dot === -1 || dot >= colon) {
+            cleaned.push(token);
+            continue;
+        }
+        let index = colon + 1;
+        let hasDigits = false;
+        while (index < token.length) {
+            const code = token.charCodeAt(index);
+            if (code >= 48 && code <= 57) {
+                hasDigits = true;
+                index += 1;
+                continue;
+            }
+            if (code === 58 && hasDigits) {
+                index += 1;
+                hasDigits = false;
+                continue;
+            }
+            break;
+        }
+        cleaned.push(index === token.length && hasDigits ? token.slice(0, colon) : token);
+    }
+    return cleaned.join(" ");
+}
+/** Sanitize a string into a Kubernetes resource name (RFC 1123 subset). */
+function sanitizeKubernetesName(value, fallback = "naus-job") {
+    const slug = slugify(value, fallback);
+    const trimmed = trimEdgeChars(slug, "-");
+    return trimmed.slice(0, 63) || fallback;
+}
+//# sourceMappingURL=sonar-safe-string.js.map

package/bundled/node_modules/@kubbisec/shared/dist/sonar-safe-string.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sonar-safe-string.js","sourceRoot":"","sources":["../src/sonar-safe-string.ts"],"names":[],"mappings":";;AACA,kDAKC;AAGD,sCAOC;AAGD,0BAkBC;AAGD,gDAmBC;AAGD,kEASC;AAuBD,4CAsBC;AAGD,gDAKC;AAGD,kDAIC;AAGD,sDAMC;AAGD,0DAsCC;AAGD,wDAIC;AA5LD,gFAAgF;AAChF,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,gEAAgE;AAChE,SAAgB,aAAa,CAAC,KAAa,EAAE,IAAY;IACvD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,KAAK,IAAI,CAAC,CAAC;IACxD,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,+EAA+E;AAC/E,SAAgB,OAAO,CAAC,KAAa,EAAE,QAAQ,GAAG,UAAU;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;QAC3F,IAAI,UAAU,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,IAAI,EAAE,CAAC;YACX,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,IAAI,GAAG,CAAC;YACZ,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,MAAc,EAAE,QAAiB;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM;QACxB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,YAAY,KAAK,CAAC,CAAC;YAAE,MAAM;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM;QACtB,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,UAAU,GAAG,GAAG,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,2BAA2B,CACzC,OAAe;IAEf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAC5D,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,IAAI,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,6CAA6C;AAC7C,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,IAAI,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,SAAgB,qBAAqB,CAAC,KAAa;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IACjF,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,0FAA0F;AAC1F,SAAgB,uBAAuB,CAAC,QAAgB;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;QACtB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC7B,SAAS,GAAG,IAAI,CAAC;gBACjB,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC7B,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS,GAAG,KAAK,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM;QACR,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sBAAsB,CAAC,KAAa,EAAE,QAAQ,GAAG,UAAU;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;AAC1C,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/sort-findings.d.ts

@@ -0,0 +1,16 @@
+/** Matches SecurityFilterPanel status order (active → closed). */
+export declare const FINDING_STATUS_SORT_ORDER: readonly ["OPEN", "CONFIRMED", "REOPENED", "PENDING_REMED_REVIEW", "FIXED", "ACCEPTED", "FALSE_POSITIVE"];
+export type SortableFinding = {
+    severity: string;
+    status: string;
+    createdAt: string | Date;
+    lastSeenAt?: string | Date | null;
+    fixedAt?: string | Date | null;
+};
+/**
+ * Workbench list order: status (Aberto→…→Corrigido→…, matching the filter panel),
+ * then severity (Crítico→…→Info), then most recently seen within the same bucket.
+ * Closed findings (incl. Corrigido) always appear after all active ones.
+ */
+export declare function sortFindingsForDisplay<T extends SortableFinding>(findings: T[]): T[];
+//# sourceMappingURL=sort-findings.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/sort-findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sort-findings.d.ts","sourceRoot":"","sources":["../src/sort-findings.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,2GAQ5B,CAAC;AAcX,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;CAChC,CAAC;AAmCF;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAYpF"}

package/bundled/node_modules/@kubbisec/shared/dist/sort-findings.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FINDING_STATUS_SORT_ORDER = void 0;
+exports.sortFindingsForDisplay = sortFindingsForDisplay;
+/** Matches SecurityFilterPanel status order (active → closed). */
+exports.FINDING_STATUS_SORT_ORDER = [
+    "OPEN",
+    "CONFIRMED",
+    "REOPENED",
+    "PENDING_REMED_REVIEW",
+    "FIXED",
+    "ACCEPTED",
+    "FALSE_POSITIVE",
+];
+const SEVERITY_ORDER = new Map([
+    ["CRITICAL", 0],
+    ["HIGH", 1],
+    ["MEDIUM", 2],
+    ["LOW", 3],
+    ["INFO", 4],
+]);
+const STATUS_ORDER = new Map(exports.FINDING_STATUS_SORT_ORDER.map((status, index) => [status, index]));
+function toTimestamp(value) {
+    if (value == null)
+        return 0;
+    const time = value instanceof Date ? value.getTime() : new Date(value).getTime();
+    return Number.isFinite(time) ? time : 0;
+}
+function lifecycleTime(finding) {
+    return Math.max(toTimestamp(finding.createdAt), toTimestamp(finding.lastSeenAt), toTimestamp(finding.fixedAt));
+}
+function normalizeStatus(status) {
+    return status.trim().toUpperCase();
+}
+function statusSortRank(finding) {
+    const normalized = normalizeStatus(finding.status);
+    const fixedRank = STATUS_ORDER.get("FIXED") ?? exports.FINDING_STATUS_SORT_ORDER.length;
+    const activeLastRank = STATUS_ORDER.get("PENDING_REMED_REVIEW") ?? 3;
+    if (finding.fixedAt) {
+        const rank = STATUS_ORDER.get(normalized);
+        if (rank === undefined || rank <= activeLastRank)
+            return fixedRank;
+    }
+    const rank = STATUS_ORDER.get(normalized);
+    if (rank !== undefined)
+        return rank;
+    return 0;
+}
+/**
+ * Workbench list order: status (Aberto→…→Corrigido→…, matching the filter panel),
+ * then severity (Crítico→…→Info), then most recently seen within the same bucket.
+ * Closed findings (incl. Corrigido) always appear after all active ones.
+ */
+function sortFindingsForDisplay(findings) {
+    return [...findings].sort((a, b) => {
+        const statusA = statusSortRank(a);
+        const statusB = statusSortRank(b);
+        if (statusA !== statusB)
+            return statusA - statusB;
+        const severityA = SEVERITY_ORDER.get(a.severity) ?? Number.MAX_SAFE_INTEGER;
+        const severityB = SEVERITY_ORDER.get(b.severity) ?? Number.MAX_SAFE_INTEGER;
+        if (severityA !== severityB)
+            return severityA - severityB;
+        return lifecycleTime(b) - lifecycleTime(a);
+    });
+}
+//# sourceMappingURL=sort-findings.js.map

package/bundled/node_modules/@kubbisec/shared/dist/sort-findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sort-findings.js","sourceRoot":"","sources":["../src/sort-findings.ts"],"names":[],"mappings":";;;AAqEA,wDAYC;AAjFD,kEAAkE;AACrD,QAAA,yBAAyB,GAAG;IACvC,MAAM;IACN,WAAW;IACX,UAAU;IACV,sBAAsB;IACtB,OAAO;IACP,UAAU;IACV,gBAAgB;CACR,CAAC;AAEX,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,MAAM,EAAE,CAAC,CAAC;IACX,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,KAAK,EAAE,CAAC,CAAC;IACV,CAAC,MAAM,EAAE,CAAC,CAAC;CACZ,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,iCAAyB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAClE,CAAC;AAUF,SAAS,WAAW,CAAC,KAAuC;IAC1D,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IACjF,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB;IAC7C,OAAO,IAAI,CAAC,GAAG,CACb,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAC9B,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAC/B,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,iCAAyB,CAAC,MAAM,CAAC;IAChF,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAErE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,cAAc;YAAE,OAAO,SAAS,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAA4B,QAAa;IAC7E,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,OAAO,GAAG,OAAO,CAAC;QAElD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC;QAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC;QAC5E,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,GAAG,SAAS,CAAC;QAE1D,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/trusted-path.d.ts

@@ -0,0 +1,7 @@
+/** Fixed PATH for child_process (Sonar S4036). Literal string for static analysis. */
+export declare const TRUSTED_PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+/** Minimal env with a fixed PATH — spread at exec/spawn call sites for Sonar. */
+export declare function trustedChildEnv(overrides?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Resolve a binary under trusted system directories (avoids `which` + PATH). */
+export declare function resolveTrustedExecutable(command: string, extraDirs?: string[], exists?: (path: string) => boolean): string | null;
+//# sourceMappingURL=trusted-path.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/trusted-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-path.d.ts","sourceRoot":"","sources":["../src/trusted-path.ts"],"names":[],"mappings":"AAGA,sFAAsF;AACtF,eAAO,MAAM,YAAY,EAAG,8DAAuE,CAAC;AAIpG,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,SAAS,GAAE,MAAM,CAAC,UAAe,GAAG,MAAM,CAAC,UAAU,CAOpF;AAED,iFAAiF;AACjF,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,MAAM,EAAO,EACxB,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GAC7C,MAAM,GAAG,IAAI,CAOf"}

package/bundled/node_modules/@kubbisec/shared/dist/trusted-path.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRUSTED_PATH = void 0;
+exports.trustedChildEnv = trustedChildEnv;
+exports.resolveTrustedExecutable = resolveTrustedExecutable;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/** Fixed PATH for child_process (Sonar S4036). Literal string for static analysis. */
+exports.TRUSTED_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+const TRUSTED_PATH_DIRS = exports.TRUSTED_PATH.split(":");
+/** Minimal env with a fixed PATH — spread at exec/spawn call sites for Sonar. */
+function trustedChildEnv(overrides = {}) {
+    return {
+        HOME: process.env.HOME ?? "/tmp",
+        LANG: process.env.LANG ?? "C.UTF-8",
+        ...overrides,
+        PATH: exports.TRUSTED_PATH,
+    };
+}
+/** Resolve a binary under trusted system directories (avoids `which` + PATH). */
+function resolveTrustedExecutable(command, extraDirs = [], exists = node_fs_1.existsSync) {
+    const dirs = [...extraDirs, ...TRUSTED_PATH_DIRS];
+    for (const dir of dirs) {
+        const candidate = (0, node_path_1.join)(dir, command);
+        if (exists(candidate))
+            return candidate;
+    }
+    return null;
+}
+//# sourceMappingURL=trusted-path.js.map

package/bundled/node_modules/@kubbisec/shared/dist/trusted-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-path.js","sourceRoot":"","sources":["../src/trusted-path.ts"],"names":[],"mappings":";;;AASA,0CAOC;AAGD,4DAWC;AA9BD,qCAAqC;AACrC,yCAAiC;AAEjC,sFAAsF;AACzE,QAAA,YAAY,GAAG,8DAAuE,CAAC;AAEpG,MAAM,iBAAiB,GAAG,oBAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAElD,iFAAiF;AACjF,SAAgB,eAAe,CAAC,YAA+B,EAAE;IAC/D,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM;QAChC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS;QACnC,GAAG,SAAS;QACZ,IAAI,EAAE,oBAAY;KACnB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,wBAAwB,CACtC,OAAe,EACf,YAAsB,EAAE,EACxB,SAAoC,oBAAU;IAE9C,MAAM,IAAI,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,iBAAiB,CAAC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/bundled/node_modules/@kubbisec/shared/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@kubbisec/shared",
+  "version": "0.0.1",
+  "private": true,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./security": {
+      "types": "./dist/security/index.d.ts",
+      "default": "./dist/security/index.js"
+    },
+    "./ci": {
+      "types": "./dist/ci/index.d.ts",
+      "default": "./dist/ci/index.js"
+    },
+    "./github/kubbisec-github-label": {
+      "types": "./dist/github/kubbisec-github-label.d.ts",
+      "default": "./dist/github/kubbisec-github-label.js"
+    },
+    "./cli-user-error": {
+      "types": "./dist/cli-user-error.d.ts",
+      "default": "./dist/cli-user-error.js"
+    },
+    "./sonar-safe-string": {
+      "types": "./dist/sonar-safe-string.d.ts",
+      "default": "./dist/sonar-safe-string.js"
+    },
+    "./trusted-path": {
+      "types": "./dist/trusted-path.d.ts",
+      "default": "./dist/trusted-path.js"
+    },
+    "./api-key": {
+      "types": "./dist/api-key/index.d.ts",
+      "default": "./dist/api-key/index.js"
+    },
+    "./billing": {
+      "types": "./dist/billing/index.d.ts",
+      "default": "./dist/billing/index.js"
+    },
+    "./mcp": {
+      "types": "./dist/mcp/constants.d.ts",
+      "default": "./dist/mcp/constants.js"
+    },
+    "./shared-project": {
+      "types": "./dist/shared-project/index.d.ts",
+      "default": "./dist/shared-project/index.js"
+    },
+    "./product-docs": {
+      "types": "./dist/product-docs/index.d.ts",
+      "default": "./dist/product-docs/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist",
+    "check-types": "tsc --noEmit",
+    "test": "vitest",
+    "test:run": "vitest run"
+  },
+  "dependencies": {
+    "@pinojs/redact": "^0.4.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "reflect-metadata": "^0.2.2",
+    "typescript": "~5.9.3",
+    "vitest": "^4.1.10"
+  }
+}