@kubbisec/ai-linux-x64 0.1.27 → 0.1.28

package/bundled/node_modules/@kubbisec/shared/dist/security/build-aspm-security-matrix-pipeline-yaml.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAspmSecurityMatrixPipelineYaml = buildAspmSecurityMatrixPipelineYaml;
+const aspm_gate_rules_1 = require("./aspm-gate-rules");
+const security_tool_catalog_1 = require("./security-tool-catalog");
+function formatGateRulesYaml(gateRules) {
+    const lines = [];
+    if (gateRules.vulnerabilities?.max_by_severity) {
+        lines.push("        vulnerabilities:");
+        lines.push("          max_by_severity:");
+        for (const [severity, max] of Object.entries(gateRules.vulnerabilities.max_by_severity)) {
+            lines.push(`            ${severity}: ${max}`);
+        }
+    }
+    if (gateRules.coverage?.min_line_pct != null) {
+        lines.push("        coverage:");
+        lines.push(`          min_line_pct: ${gateRules.coverage.min_line_pct}`);
+    }
+    return lines.join("\n");
+}
+function buildAspmSecurityMatrixPipelineYaml(tools, options) {
+    const normalized = (0, security_tool_catalog_1.normalizeSecurityTools)(tools);
+    const pipelineName = options?.pipelineName?.trim() || "kubbisec-security";
+    const matrixStrategy = options?.matrixStrategy ?? "fanout";
+    const gateRules = options?.gateRules ?? aspm_gate_rules_1.DEFAULT_ASPM_GATE_RULES;
+    const parallelBlock = normalized.map((tool) => `        - tool: ${tool}`).join("\n");
+    const gateYaml = formatGateRulesYaml(gateRules);
+    return `name: "${pipelineName}"
+description: Pipeline de segurança KubbiSec ASPM (matriz gerada automaticamente)
+
+stages:
+  - security
+  - gate
+
+run:
+  - kubbisec_security:
+      display_name: "KubbiSec ASPM: matriz de segurança"
+      stage: security
+      kind: aspm_matrix
+      mode: scan-and-upload
+      matrix_strategy: ${matrixStrategy}
+      parallel:
+${parallelBlock}
+  - kubbisec_gate:
+      display_name: "KubbiSec ASPM gate"
+      stage: gate
+      kind: aspm_gate
+      rules:
+${gateYaml}
+      depends_on:
+        - kubbisec_security
+`;
+}
+//# sourceMappingURL=build-aspm-security-matrix-pipeline-yaml.js.map

package/bundled/node_modules/@kubbisec/shared/dist/security/build-aspm-security-matrix-pipeline-yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-aspm-security-matrix-pipeline-yaml.js","sourceRoot":"","sources":["../../src/security/build-aspm-security-matrix-pipeline-yaml.ts"],"names":[],"mappings":";;AAsBA,kFAqCC;AA3DD,uDAA4D;AAE5D,mEAAiE;AAEjE,SAAS,mBAAmB,CAC1B,SAA2E;IAE3E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YACxF,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,2BAA2B,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,mCAAmC,CACjD,KAAwB,EACxB,OAAgD;IAEhD,MAAM,UAAU,GAAG,IAAA,8CAAsB,EAAC,KAAK,CAAqB,CAAC;IACrE,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC;IAC1E,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,QAAQ,CAAC;IAC3D,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,yCAAuB,CAAC;IAEhE,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAEhD,OAAO,UAAU,YAAY;;;;;;;;;;;;;yBAaN,cAAc;;EAErC,aAAa;;;;;;EAMb,QAAQ;;;CAGT,CAAC;AACF,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/build-github-security-workflow-yaml.d.ts

@@ -0,0 +1,4 @@
+import type { BuildGithubSecurityWorkflowOptions } from "./security-tool.types";
+export declare function buildGithubSecurityWorkflowYaml(tools: readonly string[], options: BuildGithubSecurityWorkflowOptions): string;
+export declare const DEFAULT_GITHUB_WORKFLOW_TRIGGERS: BuildGithubSecurityWorkflowOptions["events"];
+//# sourceMappingURL=build-github-security-workflow-yaml.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/security/build-github-security-workflow-yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-github-security-workflow-yaml.d.ts","sourceRoot":"","sources":["../../src/security/build-github-security-workflow-yaml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kCAAkC,EAAkB,MAAM,uBAAuB,CAAC;AAmDhG,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,kCAAkC,GAC1C,MAAM,CAgBR;AAED,eAAO,MAAM,gCAAgC,EAAE,kCAAkC,CAAC,QAAQ,CAOzF,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/build-github-security-workflow-yaml.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_GITHUB_WORKFLOW_TRIGGERS = void 0;
+exports.buildGithubSecurityWorkflowYaml = buildGithubSecurityWorkflowYaml;
+const github_workflow_tool_jobs_1 = require("./github-workflow-tool-jobs");
+const security_tool_catalog_1 = require("./security-tool-catalog");
+function buildOnBlock(events) {
+    const lines = ["on:"];
+    if (events.push) {
+        const branches = events.pushBranches.filter(Boolean);
+        if (branches.length > 0) {
+            lines.push("  push:");
+            lines.push("    branches:");
+            for (const branch of branches) {
+                lines.push(`      - ${branch}`);
+            }
+        }
+        else {
+            lines.push("  push:");
+        }
+    }
+    if (events.pullRequest) {
+        lines.push("  pull_request:");
+    }
+    if (events.workflowDispatch) {
+        lines.push("  workflow_dispatch:");
+    }
+    if (events.schedule && events.scheduleCron.trim()) {
+        lines.push("  schedule:");
+        lines.push(`    - cron: ${JSON.stringify(events.scheduleCron.trim())}`);
+    }
+    if (lines.length === 1) {
+        lines.push("  workflow_dispatch:");
+    }
+    return lines.join("\n");
+}
+function buildPermissionsBlock(tools) {
+    const needsCodeScanning = tools.some((tool) => tool === "gitleaks" || tool === "osv");
+    if (!needsCodeScanning) {
+        return `permissions:
+  contents: read`;
+    }
+    return `permissions:
+  contents: read
+  actions: read
+  security-events: write`;
+}
+function buildGithubSecurityWorkflowYaml(tools, options) {
+    const normalized = (0, security_tool_catalog_1.normalizeSecurityTools)(tools);
+    const workflowName = options.workflowName.trim() || "KubbiSec Security";
+    const onBlock = buildOnBlock(options.events);
+    const permissionsBlock = buildPermissionsBlock(normalized);
+    const { jobsYaml } = (0, github_workflow_tool_jobs_1.buildGithubToolJobsSection)(normalized, options.inlineEnv);
+    return `name: ${JSON.stringify(workflowName)}
+
+${onBlock}
+
+${permissionsBlock}
+
+jobs:
+${jobsYaml}
+`;
+}
+exports.DEFAULT_GITHUB_WORKFLOW_TRIGGERS = {
+    push: true,
+    pushBranches: ["main"],
+    pullRequest: true,
+    workflowDispatch: true,
+    schedule: false,
+    scheduleCron: "0 6 * * 1",
+};
+//# sourceMappingURL=build-github-security-workflow-yaml.js.map

package/bundled/node_modules/@kubbisec/shared/dist/security/build-github-security-workflow-yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-github-security-workflow-yaml.js","sourceRoot":"","sources":["../../src/security/build-github-security-workflow-yaml.ts"],"names":[],"mappings":";;;AAoDA,0EAmBC;AAvED,2EAAyE;AAEzE,mEAAiE;AAEjE,SAAS,YAAY,CAAC,MAAoD;IACxE,MAAM,KAAK,GAAa,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAuB;IACpD,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC;IACtF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO;iBACM,CAAC;IAChB,CAAC;IACD,OAAO;;;yBAGgB,CAAC;AAC1B,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAAwB,EACxB,OAA2C;IAE3C,MAAM,UAAU,GAAG,IAAA,8CAAsB,EAAC,KAAK,CAAqB,CAAC;IACrE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,mBAAmB,CAAC;IACxE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,sDAA0B,EAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/E,OAAO,SAAS,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;;EAE5C,OAAO;;EAEP,gBAAgB;;;EAGhB,QAAQ;CACT,CAAC;AACF,CAAC;AAEY,QAAA,gCAAgC,GAAiD;IAC5F,IAAI,EAAE,IAAI;IACV,YAAY,EAAE,CAAC,MAAM,CAAC;IACtB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,WAAW;CAC1B,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/github-workflow-action-pins.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Pinned GitHub Actions / images for KubbiSec workflow templates.
+ * Prefer stable major/minor tags maintained by vendors; pin SHAs in production if policy requires.
+ *
+ * @see https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23 (trivy-action >= v0.35.0)
+ */
+export declare const GITHUB_CHECKOUT_ACTION = "actions/checkout@v4";
+/** aquasecurity/trivy-action — filesystem scan with JSON for `aspm upload`. */
+export declare const TRIVY_ACTION = "aquasecurity/trivy-action@v0.35.0";
+/** anchore/sbom-action — CycloneDX JSON SBOM for `aspm upload`. */
+export declare const SBOM_ACTION = "anchore/sbom-action@v0";
+/** gitleaks/gitleaks-action — Node 24 / LTS track (org repos may need GITLEAKS_LICENSE). */
+export declare const GITLEAKS_ACTION = "gitleaks/gitleaks-action@v3";
+/** google/osv-scanner-action sub-actions (scanner + SARIF reporter). */
+export declare const OSV_SCANNER_ACTION = "google/osv-scanner-action/osv-scanner-action@v2.3.8";
+export declare const OSV_REPORTER_ACTION = "google/osv-scanner-action/osv-reporter-action@v2.3.8";
+/** Upload SARIF to GitHub Security tab (Code Scanning). */
+export declare const CODEQL_UPLOAD_SARIF_ACTION = "github/codeql-action/upload-sarif@v4";
+/** Tag root for reusable OSV workflows (documentação). */
+export declare const OSV_SCANNER_ACTION_REF = "google/osv-scanner-action@v2.3.8";
+/** SonarSource/sonarqube-scan-action — SonarQube Server 2026.1 LTA docs recommend v7. */
+export declare const SONAR_SCAN_ACTION = "SonarSource/sonarqube-scan-action@v7";
+/** Official Semgrep image (semgrep/semgrep-action is deprecated). */
+export declare const SEMGREP_CONTAINER_IMAGE = "semgrep/semgrep:latest";
+/** Pinned Gitleaks CLI when JSON report is required for ASPM (action defaults to SARIF). */
+export declare const GITLEAKS_CLI_VERSION = "8.21.2";
+//# sourceMappingURL=github-workflow-action-pins.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/security/github-workflow-action-pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-workflow-action-pins.d.ts","sourceRoot":"","sources":["../../src/security/github-workflow-action-pins.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,sCAAsC,CAAC;AAEhE,mEAAmE;AACnE,eAAO,MAAM,WAAW,2BAA2B,CAAC;AAEpD,4FAA4F;AAC5F,eAAO,MAAM,eAAe,gCAAgC,CAAC;AAE7D,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,wDAAwD,CAAC;AACxF,eAAO,MAAM,mBAAmB,yDAAyD,CAAC;AAE1F,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,yCAAyC,CAAC;AAEjF,0DAA0D;AAC1D,eAAO,MAAM,sBAAsB,qCAAqC,CAAC;AAEzE,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,yCAAyC,CAAC;AAExE,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAEhE,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,WAAW,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/github-workflow-action-pins.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITLEAKS_CLI_VERSION = exports.SEMGREP_CONTAINER_IMAGE = exports.SONAR_SCAN_ACTION = exports.OSV_SCANNER_ACTION_REF = exports.CODEQL_UPLOAD_SARIF_ACTION = exports.OSV_REPORTER_ACTION = exports.OSV_SCANNER_ACTION = exports.GITLEAKS_ACTION = exports.SBOM_ACTION = exports.TRIVY_ACTION = exports.GITHUB_CHECKOUT_ACTION = void 0;
+/**
+ * Pinned GitHub Actions / images for KubbiSec workflow templates.
+ * Prefer stable major/minor tags maintained by vendors; pin SHAs in production if policy requires.
+ *
+ * @see https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23 (trivy-action >= v0.35.0)
+ */
+exports.GITHUB_CHECKOUT_ACTION = "actions/checkout@v4";
+/** aquasecurity/trivy-action — filesystem scan with JSON for `aspm upload`. */
+exports.TRIVY_ACTION = "aquasecurity/trivy-action@v0.35.0";
+/** anchore/sbom-action — CycloneDX JSON SBOM for `aspm upload`. */
+exports.SBOM_ACTION = "anchore/sbom-action@v0";
+/** gitleaks/gitleaks-action — Node 24 / LTS track (org repos may need GITLEAKS_LICENSE). */
+exports.GITLEAKS_ACTION = "gitleaks/gitleaks-action@v3";
+/** google/osv-scanner-action sub-actions (scanner + SARIF reporter). */
+exports.OSV_SCANNER_ACTION = "google/osv-scanner-action/osv-scanner-action@v2.3.8";
+exports.OSV_REPORTER_ACTION = "google/osv-scanner-action/osv-reporter-action@v2.3.8";
+/** Upload SARIF to GitHub Security tab (Code Scanning). */
+exports.CODEQL_UPLOAD_SARIF_ACTION = "github/codeql-action/upload-sarif@v4";
+/** Tag root for reusable OSV workflows (documentação). */
+exports.OSV_SCANNER_ACTION_REF = "google/osv-scanner-action@v2.3.8";
+/** SonarSource/sonarqube-scan-action — SonarQube Server 2026.1 LTA docs recommend v7. */
+exports.SONAR_SCAN_ACTION = "SonarSource/sonarqube-scan-action@v7";
+/** Official Semgrep image (semgrep/semgrep-action is deprecated). */
+exports.SEMGREP_CONTAINER_IMAGE = "semgrep/semgrep:latest";
+/** Pinned Gitleaks CLI when JSON report is required for ASPM (action defaults to SARIF). */
+exports.GITLEAKS_CLI_VERSION = "8.21.2";
+//# sourceMappingURL=github-workflow-action-pins.js.map

package/bundled/node_modules/@kubbisec/shared/dist/security/github-workflow-action-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-workflow-action-pins.js","sourceRoot":"","sources":["../../src/security/github-workflow-action-pins.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACU,QAAA,sBAAsB,GAAG,qBAAqB,CAAC;AAE5D,+EAA+E;AAClE,QAAA,YAAY,GAAG,mCAAmC,CAAC;AAEhE,mEAAmE;AACtD,QAAA,WAAW,GAAG,wBAAwB,CAAC;AAEpD,4FAA4F;AAC/E,QAAA,eAAe,GAAG,6BAA6B,CAAC;AAE7D,wEAAwE;AAC3D,QAAA,kBAAkB,GAAG,qDAAqD,CAAC;AAC3E,QAAA,mBAAmB,GAAG,sDAAsD,CAAC;AAE1F,2DAA2D;AAC9C,QAAA,0BAA0B,GAAG,sCAAsC,CAAC;AAEjF,0DAA0D;AAC7C,QAAA,sBAAsB,GAAG,kCAAkC,CAAC;AAEzE,yFAAyF;AAC5E,QAAA,iBAAiB,GAAG,sCAAsC,CAAC;AAExE,qEAAqE;AACxD,QAAA,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE,4FAA4F;AAC/E,QAAA,oBAAoB,GAAG,QAAQ,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/github-workflow-tool-jobs.d.ts

@@ -0,0 +1,7 @@
+import type { GithubWorkflowInlineEnv, SecurityToolId } from "./security-tool.types";
+export declare const KUBBISEC_SCANS_JOB_ID = "kubbisec-scans";
+export declare function buildGithubToolJobsSection(tools: SecurityToolId[], inlineEnv?: GithubWorkflowInlineEnv): {
+    jobIds: string[];
+    jobsYaml: string;
+};
+//# sourceMappingURL=github-workflow-tool-jobs.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/security/github-workflow-tool-jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-workflow-tool-jobs.d.ts","sourceRoot":"","sources":["../../src/security/github-workflow-tool-jobs.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAErF,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAyKtD,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,cAAc,EAAE,EACvB,SAAS,CAAC,EAAE,uBAAuB,GAClC;IACD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAkBA"}

package/bundled/node_modules/@kubbisec/shared/dist/security/github-workflow-tool-jobs.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KUBBISEC_SCANS_JOB_ID = void 0;
+exports.buildGithubToolJobsSection = buildGithubToolJobsSection;
+const aspm_gate_rules_1 = require("./aspm-gate-rules");
+const github_workflow_action_pins_1 = require("./github-workflow-action-pins");
+exports.KUBBISEC_SCANS_JOB_ID = "kubbisec-scans";
+const ASPM_INSTALL_STEP = `      - name: Install ASPM CLI
+        run: npm install -g @kubbisec/aspm`;
+const CHECKOUT_STEP = `      - uses: ${github_workflow_action_pins_1.GITHUB_CHECKOUT_ACTION}`;
+const CHECKOUT_FULL_HISTORY_STEP = `      - uses: ${github_workflow_action_pins_1.GITHUB_CHECKOUT_ACTION}
+        with:
+          fetch-depth: 0`;
+/**
+ * KubbiSec job env — API URL is omitted (ASPM CLI defaults to https://api.kubbisec.com).
+ * Only secret key + org/project identifiers are required in CI.
+ */
+function buildKubbisecScansJobEnv(inlineEnv) {
+    if (inlineEnv) {
+        return `    env:
+      KUBBISEC_API_KEY: \${{ secrets.KUBBISEC_API_KEY }}
+      KUBBISEC_ORG_ID: ${JSON.stringify(inlineEnv.orgId)}`;
+    }
+    return `    env:
+      KUBBISEC_API_KEY: \${{ secrets.KUBBISEC_API_KEY }}
+      KUBBISEC_ORG_ID: \${{ vars.KUBBISEC_ORG_ID }}`;
+}
+const GITHUB_PROJECT_VAR_REF = "${{ vars.KUBBISEC_PROJECT }}";
+function projectRef(inlineEnv) {
+    return inlineEnv?.projectId ?? GITHUB_PROJECT_VAR_REF;
+}
+/** Scanner-specific steps (official actions where JSON output is compatible with `aspm upload`). */
+function buildToolScanSteps(tool, inlineEnv) {
+    const p = projectRef(inlineEnv);
+    switch (tool) {
+        case "trivy":
+            return `      - name: Trivy filesystem scan
+        uses: ${github_workflow_action_pins_1.TRIVY_ACTION}
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: json
+          output: trivy-report.json
+          exit-code: "0"
+
+      - name: Upload Trivy report
+        run: aspm upload trivy-report.json -s trivy -p ${p}`;
+        case "gitleaks":
+            return `      - name: Gitleaks (GitHub Security)
+        uses: ${github_workflow_action_pins_1.GITLEAKS_ACTION}
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "true"
+          GITLEAKS_VERSION: "${github_workflow_action_pins_1.GITLEAKS_CLI_VERSION}"
+
+      - name: Gitleaks scan (JSON para KubbiSec ASPM)
+        run: |
+          curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v${github_workflow_action_pins_1.GITLEAKS_CLI_VERSION}/gitleaks_${github_workflow_action_pins_1.GITLEAKS_CLI_VERSION}_linux_x64.tar.gz | tar -xz -C /usr/local/bin
+          gitleaks detect --source . --report-format json --report-path gitleaks-report.json --exit-code 0 || true
+
+      - name: Upload Gitleaks report
+        run: aspm upload gitleaks-report.json -s gitleaks -p ${p}`;
+        case "syft":
+            return `      - name: Generate SBOM
+        uses: ${github_workflow_action_pins_1.SBOM_ACTION}
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: sbom.cdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Upload SBOM
+        run: aspm upload sbom.cdx.json -s syft -p ${p}`;
+        case "osv":
+            return `      - name: OSV scan (JSON para KubbiSec ASPM)
+        uses: ${github_workflow_action_pins_1.OSV_SCANNER_ACTION}
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --recursive
+            --format=json
+            --output=osv-report.json
+            ./
+
+      - name: OSV SARIF (GitHub Security)
+        uses: ${github_workflow_action_pins_1.OSV_REPORTER_ACTION}
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --output=osv-results.sarif
+            --new=osv-report.json
+            --gh-annotations=false
+            --fail-on-vuln=false
+
+      - name: Upload OSV SARIF to GitHub Security
+        uses: ${github_workflow_action_pins_1.CODEQL_UPLOAD_SARIF_ACTION}
+        if: always()
+        continue-on-error: true
+        with:
+          sarif_file: osv-results.sarif
+          category: kubbisec-osv
+
+      - name: Upload OSV report to KubbiSec
+        run: aspm upload osv-report.json -s osv -p ${p}`;
+        case "semgrep":
+            return `      # semgrep/semgrep-action está deprecated — imagem oficial semgrep/semgrep (Semgrep docs).
+      - name: Semgrep scan
+        run: |
+          docker run --rm -v "$PWD:/src" -w /src ${github_workflow_action_pins_1.SEMGREP_CONTAINER_IMAGE} \\
+            semgrep scan --config auto --json -o semgrep-report.json .
+
+      - name: Upload Semgrep report
+        run: aspm upload semgrep-report.json -s semgrep -p ${p}`;
+        case "sonar":
+            return `      # Configure secrets.SONAR_TOKEN, vars.SONAR_HOST_URL (SonarCloud: https://sonarcloud.io), vars.SONAR_PROJECT_KEY
+      - name: SonarQube scan (SonarSource GitHub Action)
+        uses: ${github_workflow_action_pins_1.SONAR_SCAN_ACTION}
+        env:
+          SONAR_TOKEN: \${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: \${{ vars.SONAR_HOST_URL }}
+        with:
+          args: >
+            -Dsonar.projectKey=\${{ vars.SONAR_PROJECT_KEY }}
+
+      - name: Export Sonar issues (JSON para KubbiSec ASPM)
+        run: |
+          if [ -n "$SONAR_HOST_URL" ] && [ -n "$SONAR_TOKEN" ]; then
+            curl -sS -H "Authorization: Bearer $SONAR_TOKEN" \\
+              "$SONAR_HOST_URL/api/issues/search?componentKeys=$SONAR_PROJECT_KEY&ps=500" \\
+              -o sonar-report.json || echo '{}' > sonar-report.json
+          else
+            echo '{}' > sonar-report.json
+          fi
+        env:
+          SONAR_HOST_URL: \${{ vars.SONAR_HOST_URL }}
+          SONAR_TOKEN: \${{ secrets.SONAR_TOKEN }}
+          SONAR_PROJECT_KEY: \${{ vars.SONAR_PROJECT_KEY }}
+
+      - name: Upload Sonar report to KubbiSec
+        run: aspm upload sonar-report.json -s sonar -p ${p}`;
+        case "nmap":
+            return `      - name: Install Nmap
+        run: sudo apt-get update && sudo apt-get install -y nmap
+
+      - name: Nmap scan placeholder
+        run: |
+          echo "Configure NMAP_TARGET (vars) para varredura real; gerando placeholder."
+          echo '{}' > nmap-report.json
+
+      - name: Upload Nmap report
+        run: aspm upload nmap-report.json -s nmap -p ${p}`;
+        case "skipfish":
+            return `      - name: Install Skipfish
+        run: sudo apt-get update && sudo apt-get install -y skipfish
+
+      - name: Skipfish scan placeholder
+        run: |
+          echo "Configure SKIPFISH_TARGET (vars) para DAST real; gerando placeholder."
+          echo '{}' > skipfish-report.json
+
+      - name: Upload Skipfish report
+        run: aspm upload skipfish-report.json -s skipfish -p ${p}`;
+    }
+}
+function buildGithubToolJobsSection(tools, inlineEnv) {
+    const checkout = tools.includes("gitleaks") ? CHECKOUT_FULL_HISTORY_STEP : CHECKOUT_STEP;
+    const kubbisecScansJobEnv = buildKubbisecScansJobEnv(inlineEnv);
+    const toolSteps = tools.map((tool) => buildToolScanSteps(tool, inlineEnv)).join("\n\n");
+    const jobsYaml = `  ${exports.KUBBISEC_SCANS_JOB_ID}:
+    runs-on: ubuntu-latest
+${kubbisecScansJobEnv}
+    steps:
+${checkout}
+
+${ASPM_INSTALL_STEP}
+
+${toolSteps}
+
+${(0, aspm_gate_rules_1.buildAspmGateGithubWorkflowStep)(undefined, inlineEnv?.projectId)}`;
+    return { jobIds: [exports.KUBBISEC_SCANS_JOB_ID], jobsYaml };
+}
+//# sourceMappingURL=github-workflow-tool-jobs.js.map

package/bundled/node_modules/@kubbisec/shared/dist/security/github-workflow-tool-jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-workflow-tool-jobs.js","sourceRoot":"","sources":["../../src/security/github-workflow-tool-jobs.ts"],"names":[],"mappings":";;;AAwLA,gEAwBC;AAhND,uDAAoE;AACpE,+EAWuC;AAG1B,QAAA,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,MAAM,iBAAiB,GAAG;2CACiB,CAAC;AAE5C,MAAM,aAAa,GAAG,iBAAiB,oDAAsB,EAAE,CAAC;AAEhE,MAAM,0BAA0B,GAAG,iBAAiB,oDAAsB;;yBAEjD,CAAC;AAE1B;;;GAGG;AACH,SAAS,wBAAwB,CAAC,SAAmC;IACnE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;;yBAEc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO;;oDAE2C,CAAC;AACrD,CAAC;AAED,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAE9D,SAAS,UAAU,CAAC,SAAmC;IACrD,OAAO,SAAS,EAAE,SAAS,IAAI,sBAAsB,CAAC;AACxD,CAAC;AAED,oGAAoG;AACpG,SAAS,kBAAkB,CAAC,IAAoB,EAAE,SAAmC;IACnF,MAAM,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAEhC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO;gBACG,0CAAY;;;;;;;;;yDAS6B,CAAC,EAAE,CAAC;QACzD,KAAK,UAAU;YACb,OAAO;gBACG,6CAAe;;;;;+BAKA,kDAAoB;;;;8EAI2B,kDAAoB,aAAa,kDAAoB;;;;+DAIpE,CAAC,EAAE,CAAC;QAC/D,KAAK,MAAM;YACT,OAAO;gBACG,yCAAW;;;;;;;;;oDASyB,CAAC,EAAE,CAAC;QACpD,KAAK,KAAK;YACR,OAAO;gBACG,gDAAkB;;;;;;;;;;gBAUlB,iDAAmB;;;;;;;;;;gBAUnB,wDAA0B;;;;;;;;qDAQW,CAAC,EAAE,CAAC;QACrD,KAAK,SAAS;YACZ,OAAO;;;mDAGsC,qDAAuB;;;;6DAIb,CAAC,EAAE,CAAC;QAC7D,KAAK,OAAO;YACV,OAAO;;gBAEG,+CAAiB;;;;;;;;;;;;;;;;;;;;;;;yDAuBwB,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM;YACT,OAAO;;;;;;;;;uDAS0C,CAAC,EAAE,CAAC;QACvD,KAAK,UAAU;YACb,OAAO;;;;;;;;;+DASkD,CAAC,EAAE,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAgB,0BAA0B,CACxC,KAAuB,EACvB,SAAmC;IAKnC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;IACzF,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExF,MAAM,QAAQ,GAAG,KAAK,6BAAqB;;EAE3C,mBAAmB;;EAEnB,QAAQ;;EAER,iBAAiB;;EAEjB,SAAS;;EAET,IAAA,iDAA+B,EAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;IAEnE,OAAO,EAAE,MAAM,EAAE,CAAC,6BAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC;AACvD,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./aspm-gate-rules";
+export * from "./build-aspm-security-matrix-pipeline-yaml";
+export * from "./build-github-security-workflow-yaml";
+export * from "./github-workflow-action-pins";
+export * from "./security-tool.types";
+export * from "./security-tool-catalog";
+//# sourceMappingURL=index.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,4CAA4C,CAAC;AAC3D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./aspm-gate-rules"), exports);
+__exportStar(require("./build-aspm-security-matrix-pipeline-yaml"), exports);
+__exportStar(require("./build-github-security-workflow-yaml"), exports);
+__exportStar(require("./github-workflow-action-pins"), exports);
+__exportStar(require("./security-tool.types"), exports);
+__exportStar(require("./security-tool-catalog"), exports);
+//# sourceMappingURL=index.js.map

package/bundled/node_modules/@kubbisec/shared/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,6EAA2D;AAC3D,wEAAsD;AACtD,gEAA8C;AAC9C,wDAAsC;AACtC,0DAAwC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/security-tool-catalog.d.ts

@@ -0,0 +1,5 @@
+import type { SecurityToolCatalogEntry } from "./security-tool.types";
+export declare const SECURITY_TOOL_CATALOG: readonly SecurityToolCatalogEntry[];
+export declare function isSecurityToolId(value: string): value is SecurityToolCatalogEntry["id"];
+export declare function normalizeSecurityTools(tools: readonly string[] | undefined | null): SecurityToolCatalogEntry["id"][];
+//# sourceMappingURL=security-tool-catalog.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/security/security-tool-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool-catalog.d.ts","sourceRoot":"","sources":["../../src/security/security-tool-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,eAAO,MAAM,qBAAqB,EAAE,SAAS,wBAAwB,EAiD3D,CAAC;AAEX,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAEvF;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,GAC1C,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAalC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/security-tool-catalog.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECURITY_TOOL_CATALOG = void 0;
+exports.isSecurityToolId = isSecurityToolId;
+exports.normalizeSecurityTools = normalizeSecurityTools;
+exports.SECURITY_TOOL_CATALOG = [
+    {
+        id: "osv",
+        label: "OSV Scanner",
+        category: "sca",
+        description: "Open Source Vulnerabilities em lockfiles e dependências.",
+    },
+    {
+        id: "gitleaks",
+        label: "Gitleaks",
+        category: "secrets",
+        description: "Detecção de segredos no histórico Git.",
+    },
+    {
+        id: "syft",
+        label: "Syft",
+        category: "sbom",
+        description: "Geração de SBOM CycloneDX.",
+    },
+    {
+        id: "trivy",
+        label: "Trivy",
+        category: "sca",
+        description: "CVEs em filesystem, containers e IaC.",
+    },
+    {
+        id: "semgrep",
+        label: "Semgrep",
+        category: "sast",
+        description: "Análise estática com regras auto.",
+    },
+    {
+        id: "sonar",
+        label: "SonarQube",
+        category: "quality",
+        description: "Qualidade e issues via Sonar (requer SONAR_*).",
+    },
+    {
+        id: "nmap",
+        label: "Nmap",
+        category: "network",
+        description: "Varredura de rede (upload manual do relatório).",
+    },
+    {
+        id: "skipfish",
+        label: "Skipfish",
+        category: "dast",
+        description: "DAST web (upload manual do relatório).",
+    },
+];
+function isSecurityToolId(value) {
+    return exports.SECURITY_TOOL_CATALOG.some((entry) => entry.id === value);
+}
+function normalizeSecurityTools(tools) {
+    if (!tools?.length) {
+        return ["osv", "gitleaks", "syft", "trivy", "semgrep"];
+    }
+    const seen = new Set();
+    const normalized = [];
+    for (const raw of tools) {
+        const id = raw.trim().toLowerCase();
+        if (!isSecurityToolId(id) || seen.has(id))
+            continue;
+        seen.add(id);
+        normalized.push(id);
+    }
+    return normalized.length > 0 ? normalized : ["osv", "gitleaks", "syft", "trivy", "semgrep"];
+}
+//# sourceMappingURL=security-tool-catalog.js.map

package/bundled/node_modules/@kubbisec/shared/dist/security/security-tool-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool-catalog.js","sourceRoot":"","sources":["../../src/security/security-tool-catalog.ts"],"names":[],"mappings":";;;AAqDA,4CAEC;AAED,wDAeC;AAtEY,QAAA,qBAAqB,GAAwC;IACxE;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0DAA0D;KACxE;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,wCAAwC;KACtD;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4BAA4B;KAC1C;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,gDAAgD;KAC9D;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,wCAAwC;KACtD;CACO,CAAC;AAEX,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,OAAO,6BAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,sBAAsB,CACpC,KAA2C;IAE3C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAqC,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9F,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/security-tool.types.d.ts

@@ -0,0 +1,43 @@
+/** Naus `aspm_matrix` tool ids — must match @kubbisec/naus-validation `aspmToolIdSchema`. */
+export declare const SECURITY_TOOL_IDS: readonly ["osv", "gitleaks", "syft", "trivy", "semgrep", "sonar", "nmap", "skipfish"];
+export type SecurityToolId = (typeof SECURITY_TOOL_IDS)[number];
+export declare const DEFAULT_SECURITY_TOOLS: SecurityToolId[];
+export type SecurityToolCategory = "sca" | "sast" | "secrets" | "sbom" | "network" | "dast" | "quality";
+export type SecurityToolCatalogEntry = {
+    id: SecurityToolId;
+    label: string;
+    category: SecurityToolCategory;
+    description: string;
+};
+export type GithubWorkflowTriggerEvents = {
+    push: boolean;
+    pushBranches: string[];
+    pullRequest: boolean;
+    workflowDispatch: boolean;
+    schedule: boolean;
+    scheduleCron: string;
+};
+/** KubbiSec vars inlined in generated workflows (API URL omitted — ASPM CLI uses cloud default). */
+export type GithubWorkflowInlineEnv = {
+    orgId: string;
+    projectId: string;
+};
+export type BuildGithubSecurityWorkflowOptions = {
+    workflowName: string;
+    tools: SecurityToolId[];
+    events: GithubWorkflowTriggerEvents;
+    inlineEnv?: GithubWorkflowInlineEnv;
+};
+export type BuildAspmSecurityMatrixPipelineOptions = {
+    pipelineName?: string;
+    matrixStrategy?: "chain" | "fanout";
+    gateRules?: {
+        vulnerabilities?: {
+            max_by_severity: Record<string, number>;
+        };
+        coverage?: {
+            min_line_pct: number;
+        };
+    };
+};
+//# sourceMappingURL=security-tool.types.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/security/security-tool.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool.types.d.ts","sourceRoot":"","sources":["../../src/security/security-tool.types.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,uFASpB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,eAAO,MAAM,sBAAsB,EAAE,cAAc,EAMlD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAC5B,KAAK,GACL,MAAM,GACN,SAAS,GACT,MAAM,GACN,SAAS,GACT,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,cAAc,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,MAAM,EAAE,2BAA2B,CAAC;IACpC,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACpC,SAAS,CAAC,EAAE;QACV,eAAe,CAAC,EAAE;YAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAAC;QAC9D,QAAQ,CAAC,EAAE;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;KACrC,CAAC;CACH,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/security/security-tool.types.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SECURITY_TOOLS = exports.SECURITY_TOOL_IDS = void 0;
+/** Naus `aspm_matrix` tool ids — must match @kubbisec/naus-validation `aspmToolIdSchema`. */
+exports.SECURITY_TOOL_IDS = [
+    "osv",
+    "gitleaks",
+    "syft",
+    "trivy",
+    "semgrep",
+    "sonar",
+    "nmap",
+    "skipfish",
+];
+exports.DEFAULT_SECURITY_TOOLS = [
+    "osv",
+    "gitleaks",
+    "syft",
+    "trivy",
+    "semgrep",
+];
+//# sourceMappingURL=security-tool.types.js.map

package/bundled/node_modules/@kubbisec/shared/dist/security/security-tool.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool.types.js","sourceRoot":"","sources":["../../src/security/security-tool.types.ts"],"names":[],"mappings":";;;AAAA,6FAA6F;AAChF,QAAA,iBAAiB,GAAG;IAC/B,KAAK;IACL,UAAU;IACV,MAAM;IACN,OAAO;IACP,SAAS;IACT,OAAO;IACP,MAAM;IACN,UAAU;CACF,CAAC;AAIE,QAAA,sBAAsB,GAAqB;IACtD,KAAK;IACL,UAAU;IACV,MAAM;IACN,OAAO;IACP,SAAS;CACV,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/severity-map.d.ts

@@ -0,0 +1,8 @@
+import { Severity } from "./enums";
+export declare const TRIVY_SEVERITY_MAP: Record<string, Severity>;
+export declare const SONAR_SEVERITY_MAP: Record<string, Severity>;
+/** Semgrep CLI JSON: extra.severity */
+export declare const SEMGREP_SEVERITY_MAP: Record<string, Severity>;
+export declare const SKIPFISH_SEVERITY_MAP: Record<number, Severity>;
+export declare function mapNmapSeverity(port: number, service: string): Severity;
+//# sourceMappingURL=severity-map.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/severity-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-map.d.ts","sourceRoot":"","sources":["../src/severity-map.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAMvD,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAMvD,CAAC;AAEF,uCAAuC;AACvC,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAKzD,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAM1D,CAAC;AAEF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,CAavE"}