mobbdev 1.4.35 → 1.4.36

package/dist/args/commands/upload_ai_blame.mjs

@@ -1335,9 +1335,10 @@ var init_fix = __esm({
       fixDescription: z2.string(),
       manifestActionsRequired: z2.array(ManifestActionRequiredZ),
       extraContext: z2.array(ExtraContextInternalZ),
-      // E-2015 PR5c: analyzer-served fix-level guidance. default([]) so a query that
+      // E-2015: analyzer-served fix-level guidance. default([]) so a query that
       // omits it still parses, while the output type is a required string[] to match
-      // the non-null GraphQL field. getFixGuidances prefers served then falls back.
+      // the non-null GraphQL field. The analyzer is the sole source; getFixGuidances
+      // uses the served value directly (no fallback).
       guidances: z2.array(z2.string()).default([])
     });
     PatchAndQuestionsZ = z2.object({
@@ -1354,10 +1355,10 @@ var init_fix = __esm({
           extraContext: z2.array(ExtraContextInternalZ),
           inputType: z2.nativeEnum(FixQuestionInputType),
           options: z2.array(z2.string()),
-          // E-2015 PR5: analyzer-served question copy. default('') so a query that
-          // omits these still parses (-> '' -> FE falls back to its own copy), while
-          // the output type stays a required `string` to match the non-null GraphQL
-          // fields. Consumers use `served || storedQuestionData`.
+          // E-2015: analyzer-served question text. default('') so a query that
+          // omits these still parses (-> ''), while the output type stays a required
+          // `string` to match the non-null GraphQL fields. The analyzer is the sole
+          // source; consumers use the served value directly (no fallback).
           content: z2.string().default(""),
           description: z2.string().default(""),
           guidance: z2.string().default("")
@@ -2208,7 +2209,7 @@ var init_types2 = __esm({
 });
 
 // src/features/analysis/scm/shared/src/urlParser/urlParser.ts
-import { z as z12 } from "zod";
+import { z as z9 } from "zod";
 function computeCanonicalUrl(data) {
   const {
     scmType,
@@ -2250,7 +2251,7 @@ function detectAdoUrl(args) {
         scmType: "Ado" /* Ado */,
         organization,
         // project has single repo - repoName === projectName
-        projectName: z12.string().parse(projectName),
+        projectName: z9.string().parse(projectName),
         repoName: projectName,
         prefixPath
       };
@@ -2261,7 +2262,7 @@ function detectAdoUrl(args) {
       return {
         scmType: "Ado" /* Ado */,
         organization,
-        projectName: z12.string().parse(projectName),
+        projectName: z9.string().parse(projectName),
         repoName,
         prefixPath
       };
@@ -2275,7 +2276,7 @@ function detectAdoUrl(args) {
           scmType: "Ado" /* Ado */,
           organization,
           // project has only one repo - repoName === projectName
-          projectName: z12.string().parse(repoName),
+          projectName: z9.string().parse(repoName),
           repoName,
           prefixPath
         };
@@ -2285,7 +2286,7 @@ function detectAdoUrl(args) {
         return {
           scmType: "Ado" /* Ado */,
           organization,
-          projectName: z12.string().parse(projectName),
+          projectName: z9.string().parse(projectName),
           repoName,
           prefixPath
         };
@@ -2361,7 +2362,7 @@ function parseSshUrl(scmURL, scmType) {
     if (pathElements.length === 3) {
       const [organization2, projectName, repoName2] = pathElements;
       if (organization2?.match(NAME_REGEX) && projectName && repoName2?.match(NAME_REGEX)) {
-        const parsedProjectName = z12.string().parse(projectName);
+        const parsedProjectName = z9.string().parse(projectName);
         return {
           scmType: "Ado" /* Ado */,
           hostname: normalizedHostname,
@@ -2589,17 +2590,17 @@ var init_urlParser2 = __esm({
 });
 
 // src/features/analysis/scm/env.ts
-import { z as z15 } from "zod";
+import { z as z12 } from "zod";
 var EnvVariablesZod, GITLAB_API_TOKEN, GITHUB_API_TOKEN, GIT_PROXY_HOST, MAX_UPLOAD_FILE_SIZE_MB, GITHUB_API_CONCURRENCY;
 var init_env = __esm({
   "src/features/analysis/scm/env.ts"() {
     "use strict";
-    EnvVariablesZod = z15.object({
-      GITLAB_API_TOKEN: z15.string().optional(),
-      GITHUB_API_TOKEN: z15.string().optional(),
-      GIT_PROXY_HOST: z15.string().optional().default("http://tinyproxy:8888"),
-      MAX_UPLOAD_FILE_SIZE_MB: z15.coerce.number().gt(0).default(2),
-      GITHUB_API_CONCURRENCY: z15.coerce.number().gt(0).optional().default(10)
+    EnvVariablesZod = z12.object({
+      GITLAB_API_TOKEN: z12.string().optional(),
+      GITHUB_API_TOKEN: z12.string().optional(),
+      GIT_PROXY_HOST: z12.string().optional().default("http://tinyproxy:8888"),
+      MAX_UPLOAD_FILE_SIZE_MB: z12.coerce.number().gt(0).default(2),
+      GITHUB_API_CONCURRENCY: z12.coerce.number().gt(0).optional().default(10)
     });
     ({
       GITLAB_API_TOKEN,
@@ -2633,7 +2634,7 @@ var init_configs = __esm({
 });
 
 // src/utils/blame/gitBlameTypes.ts
-import { z as z18 } from "zod";
+import { z as z15 } from "zod";
 function parseCoAuthorValue(raw) {
   const trimmed = raw.trim();
   if (!trimmed) {
@@ -2669,9 +2670,9 @@ var PrepareGitBlameMessageZ, PrepareGitBlameResponseMessageZ, CommitMetadataZ, L
 var init_gitBlameTypes = __esm({
   "src/utils/blame/gitBlameTypes.ts"() {
     "use strict";
-    PrepareGitBlameMessageZ = z18.object({
-      reportId: z18.string(),
-      repoArchivePath: z18.string(),
+    PrepareGitBlameMessageZ = z15.object({
+      reportId: z15.string(),
+      repoArchivePath: z15.string(),
       // Optional list of file paths to blame. Producers must pick one of two modes:
       //
       //  - **Omit `filePaths`** = "blame every file in the archive". Used by the
@@ -2687,132 +2688,132 @@ var init_gitBlameTypes = __esm({
       // "Login.java" when the actual file is "src/main/java/Login.java") are
       // tolerated — scm_agent's filter matches exact-or-trailing-basename. Empty
       // strings are filtered out defensively.
-      filePaths: z18.array(z18.string()).optional()
+      filePaths: z15.array(z15.string()).optional()
     });
-    PrepareGitBlameResponseMessageZ = z18.object({
-      reportId: z18.string()
+    PrepareGitBlameResponseMessageZ = z15.object({
+      reportId: z15.string()
     });
-    CommitMetadataZ = z18.object({
-      author: z18.string().optional(),
-      "author-mail": z18.string().optional(),
-      "author-time": z18.string().optional(),
-      "author-tz": z18.string().optional(),
-      committer: z18.string().optional(),
-      "committer-mail": z18.string().optional(),
-      "committer-time": z18.string().optional(),
-      "committer-tz": z18.string().optional(),
-      summary: z18.string().optional(),
-      filename: z18.string().optional()
+    CommitMetadataZ = z15.object({
+      author: z15.string().optional(),
+      "author-mail": z15.string().optional(),
+      "author-time": z15.string().optional(),
+      "author-tz": z15.string().optional(),
+      committer: z15.string().optional(),
+      "committer-mail": z15.string().optional(),
+      "committer-time": z15.string().optional(),
+      "committer-tz": z15.string().optional(),
+      summary: z15.string().optional(),
+      filename: z15.string().optional()
     });
-    LineToCommitMapZ = z18.record(z18.string(), z18.string());
-    CommitMetadataMapZ = z18.record(z18.string(), CommitMetadataZ);
-    BlameInfoZ = z18.object({
+    LineToCommitMapZ = z15.record(z15.string(), z15.string());
+    CommitMetadataMapZ = z15.record(z15.string(), CommitMetadataZ);
+    BlameInfoZ = z15.object({
       lineToCommit: LineToCommitMapZ,
       commitMetadata: CommitMetadataMapZ
     });
-    LineRangeZ = z18.object({
+    LineRangeZ = z15.object({
       /** First line in chunk (1-indexed) */
-      start: z18.number(),
+      start: z15.number(),
       /** Last line in chunk (inclusive) */
-      end: z18.number()
+      end: z15.number()
     });
-    PrContextZ = z18.object({
-      prNumber: z18.number(),
-      repositoryUrl: z18.string(),
-      organizationId: z18.string(),
-      userEmail: z18.string(),
-      source: z18.enum(["pr", "github"]),
-      githubContext: z18.object({
-        prNumber: z18.number(),
-        installationId: z18.number(),
-        repositoryURL: z18.string()
+    PrContextZ = z15.object({
+      prNumber: z15.number(),
+      repositoryUrl: z15.string(),
+      organizationId: z15.string(),
+      userEmail: z15.string(),
+      source: z15.enum(["pr", "github"]),
+      githubContext: z15.object({
+        prNumber: z15.number(),
+        installationId: z15.number(),
+        repositoryURL: z15.string()
       }).optional()
     });
-    PrepareCommitBlameMessageZ = z18.object({
+    PrepareCommitBlameMessageZ = z15.object({
       /** Commit blame request ID from database (for tracking and updating status) */
-      commitBlameRequestId: z18.string(),
+      commitBlameRequestId: z15.string(),
       /** Organization ID (for org-scoped caching) */
-      organizationId: z18.string(),
+      organizationId: z15.string(),
       /** Full repository URL (e.g., https://github.com/org/repo) */
-      repositoryUrl: z18.string(),
+      repositoryUrl: z15.string(),
       /** Commit SHA to analyze (typically PR head commit) */
-      commitSha: z18.string(),
+      commitSha: z15.string(),
       /** Authentication headers for repository access (e.g., GitHub token) */
-      extraHeaders: z18.record(z18.string(), z18.string()).default({}),
+      extraHeaders: z15.record(z15.string(), z15.string()).default({}),
       // --- PR analysis fields ---
       /** Target branch name (from getPr() base.ref). When set, enables PR analysis mode. */
-      targetBranch: z18.string().optional(),
+      targetBranch: z15.string().optional(),
       /** Context for triggering blame attribution analysis after SCM agent completes. */
       prContext: PrContextZ.optional(),
       /** User email for blame attribution analysis trigger context (used for both PR and single commit flows). */
-      userEmail: z18.string().optional()
+      userEmail: z15.string().optional()
     });
-    BlameLineInfoZ = z18.object({
+    BlameLineInfoZ = z15.object({
       /** Line number as it appeared in the introducing commit */
-      originalLineNumber: z18.number(),
+      originalLineNumber: z15.number(),
       /** Commit SHA that introduced this line */
-      commitSha: z18.string(),
+      commitSha: z15.string(),
       /** Author name for this line */
-      authorName: z18.string().optional(),
+      authorName: z15.string().optional(),
       /** Author email for this line */
-      authorEmail: z18.string().optional()
+      authorEmail: z15.string().optional()
     }).nullable();
-    FileBlameDataZ = z18.array(BlameLineInfoZ);
-    ChunkFetchResultZ = z18.object({
-      filePath: z18.string(),
-      lines: z18.array(z18.number()),
+    FileBlameDataZ = z15.array(BlameLineInfoZ);
+    ChunkFetchResultZ = z15.object({
+      filePath: z15.string(),
+      lines: z15.array(z15.number()),
       data: FileBlameDataZ.nullable()
     });
-    FileBlameResponseEntryZ = z18.object({
+    FileBlameResponseEntryZ = z15.object({
       /** Chunk index (0 for small files, 0-N for large file chunks) */
-      chunkIndex: z18.number(),
+      chunkIndex: z15.number(),
       /** Blame data array (1-indexed, index 0 is null) */
       blameData: FileBlameDataZ
     });
-    CommitBlameDataZ = z18.record(
-      z18.string(),
+    CommitBlameDataZ = z15.record(
+      z15.string(),
       // fileName
-      z18.array(FileBlameResponseEntryZ)
+      z15.array(FileBlameResponseEntryZ)
     );
-    CommitInfoZ = z18.object({
+    CommitInfoZ = z15.object({
       /** Number of parent commits (1 = normal commit, 2+ = merge commit, null = failed to determine) */
-      parentCount: z18.number().nullable()
+      parentCount: z15.number().nullable()
     });
-    GitIdentityZ = z18.object({
-      name: z18.string(),
-      email: z18.string()
+    GitIdentityZ = z15.object({
+      name: z15.string(),
+      email: z15.string()
     });
     COMMIT_LOG_FORMAT = "%H%x00%ae%x00%an%x00%ce%x00%cn%x00%at%x00%s%x00%(trailers:key=Co-authored-by,valueonly,separator=%x00)";
-    CommitDataZ = z18.object({
-      diff: z18.string(),
+    CommitDataZ = z15.object({
+      diff: z15.string(),
       author: GitIdentityZ,
       committer: GitIdentityZ,
-      coAuthors: z18.array(GitIdentityZ),
-      timestamp: z18.number(),
+      coAuthors: z15.array(GitIdentityZ),
+      timestamp: z15.number(),
       // Unix timestamp in seconds
-      message: z18.string().optional(),
-      parentCount: z18.number().nullable()
+      message: z15.string().optional(),
+      parentCount: z15.number().nullable()
     });
-    PrDiffDataZ = z18.object({
-      diff: z18.string()
+    PrDiffDataZ = z15.object({
+      diff: z15.string()
     });
-    PrStatsZ = z18.object({
-      additions: z18.number(),
-      deletions: z18.number()
+    PrStatsZ = z15.object({
+      additions: z15.number(),
+      deletions: z15.number()
     });
-    CommitsManifestZ = z18.object({
-      commits: z18.array(z18.string())
+    CommitsManifestZ = z15.object({
+      commits: z15.array(z15.string())
       // Array of commit SHAs in order
     });
-    BlameLineEntryZ = z18.object({
+    BlameLineEntryZ = z15.object({
       /** Current file path in the PR head (what git blame was invoked on). */
-      file: z18.string(),
+      file: z15.string(),
       /** Current line number in the PR head. */
-      line: z18.number(),
+      line: z15.number(),
       /** SHA of the commit that originally authored this line. */
-      originalCommitSha: z18.string(),
+      originalCommitSha: z15.string(),
       /** Line number as it was in `originalCommitSha`. */
-      originalLineNumber: z18.number(),
+      originalLineNumber: z15.number(),
       /**
        * File path as it was in `originalCommitSha` at the time that commit
        * authored this line. When a file has been renamed since, this differs
@@ -2825,24 +2826,24 @@ var init_gitBlameTypes = __esm({
        * must treat empty as "fall back to `file`" (see enrichDiffLines,
        * targetedBlame).
        */
-      originalFile: z18.string().default("")
+      originalFile: z15.string().default("")
     });
-    BlameLinesDataZ = z18.object({
-      lines: z18.array(BlameLineEntryZ)
+    BlameLinesDataZ = z15.object({
+      lines: z15.array(BlameLineEntryZ)
     });
-    PrepareCommitBlameResponseMessageZ = z18.object({
+    PrepareCommitBlameResponseMessageZ = z15.object({
       /** Commit blame request ID (matches request, used to update specific DB record) */
-      commitBlameRequestId: z18.string(),
+      commitBlameRequestId: z15.string(),
       /** Organization ID (matches request) */
-      organizationId: z18.string(),
+      organizationId: z15.string(),
       /** Repository URL (matches request) */
-      repositoryUrl: z18.string(),
+      repositoryUrl: z15.string(),
       /** Commit SHA analyzed (matches request) */
-      commitSha: z18.string(),
+      commitSha: z15.string(),
       /** Processing status */
-      status: z18.enum(["success", "failure"]),
+      status: z15.enum(["success", "failure"]),
       /** Error message (only present if status is 'failure') */
-      error: z18.string().optional(),
+      error: z15.string().optional(),
       /**
        * Blame data for all processed files/chunks.
        * Empty dictionary if status is 'failure'.
@@ -2854,29 +2855,29 @@ var init_gitBlameTypes = __esm({
        * Keyed by commit SHA, deduplicated.
        * Empty dictionary if status is 'failure'.
        */
-      commits: z18.record(z18.string(), CommitInfoZ).default({}),
+      commits: z15.record(z15.string(), CommitInfoZ).default({}),
       // --- New PR diff computation response fields ---
       /** S3 paths for commit-level data (commitSha → S3 key). Present in PR analysis mode and single commit mode. */
-      commitDataS3Paths: z18.record(z18.string(), z18.string()).optional(),
+      commitDataS3Paths: z15.record(z15.string(), z15.string()).optional(),
       /** S3 key for PR diff JSON. Present in PR analysis mode. */
-      prDiffS3Path: z18.string().optional(),
+      prDiffS3Path: z15.string().optional(),
       /** S3 key for commits manifest. Present in PR analysis mode. */
-      commitsManifestS3Path: z18.string().optional(),
+      commitsManifestS3Path: z15.string().optional(),
       /** S3 key for per-line targeted blame data. Present in PR analysis mode. */
-      blameLinesS3Path: z18.string().optional(),
+      blameLinesS3Path: z15.string().optional(),
       /** S3 key for PR stats (additions/deletions). Present in PR analysis mode. */
-      prStatsS3Path: z18.string().optional(),
+      prStatsS3Path: z15.string().optional(),
       /** PR context passed through from request for response handler. */
       prContext: PrContextZ.optional(),
       /** PR title from the request metadata (passed through). */
-      prTitle: z18.string().optional(),
+      prTitle: z15.string().optional(),
       /** User email passed through from request for single commit blame attribution analysis trigger. */
-      userEmail: z18.string().optional()
+      userEmail: z15.string().optional()
     });
-    VulnerabilityAttributionMessageZ = z18.object({
-      fixReportId: z18.string().uuid(),
-      vulnerabilityAttributionRequestId: z18.string().uuid(),
-      userEmail: z18.string()
+    VulnerabilityAttributionMessageZ = z15.object({
+      fixReportId: z15.string().uuid(),
+      vulnerabilityAttributionRequestId: z15.string().uuid(),
+      userEmail: z15.string()
     });
   }
 });
@@ -4143,7 +4144,7 @@ import * as os3 from "os";
 import path6 from "path";
 import chalk3 from "chalk";
 import { withFile } from "tmp-promise";
-import z26 from "zod";
+import z23 from "zod";
 
 // src/commands/handleMobbLogin.ts
 import chalk2 from "chalk";
@@ -4615,7 +4616,7 @@ import debugModule from "debug";
 var debug3 = debugModule("mobb:shared");
 
 // src/features/analysis/scm/utils/index.ts
-import { z as z14 } from "zod";
+import { z as z11 } from "zod";
 
 // src/features/analysis/scm/shared/src/commitDescriptionMarkup.ts
 init_client_generates();
@@ -4633,1560 +4634,6 @@ init_getIssueType();
 
 // src/features/analysis/scm/shared/src/guidances.ts
 init_client_generates();
-init_getIssueType();
-import { z as z11 } from "zod";
-
-// src/features/analysis/scm/shared/src/storedFixData/index.ts
-init_client_generates();
-import { z as z9 } from "zod";
-
-// src/features/analysis/scm/shared/src/storedFixData/passwordInComment.ts
-var passwordInComment = {
-  guidance: () => "Removing sensitive information from the comments is not enough. To ensure the security of your data, you have to rotate passwords and tokens and update all places where they were used."
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/csharp/missingAntiForgeryValidation.ts
-var missingAntiForgeryValidation = {
-  guidance: () => `The \`ValidateAntiForgeryToken\` attribute helps prevent cross-site request forgery (CSRF) attacks.    The token is automatically injected into the view by the [FormTagHelper](https://learn.microsoft.com/en-us/aspnet/core/mvc/views/working-with-forms?view=aspnetcore-8.0#the-form-tag-helper)
-    and is included when the form is submitted by the user.    The token is validated by the \`ValidateAntiForgeryToken\` attribute.    The token could be also generated using the [Html.AntiForgeryToken](https://learn.microsoft.com/en-us/dotnet/api/system.web.mvc.htmlhelper.antiforgerytoken?view=aspnet-mvc-5.2) helper.    
-    
- 
-    
-    
-***Make sure this controller's client provides the validation token before approving this change.***  
-    
- 
-    
-    
-This is an illustration of how the form will look like:
-    
- 
-
-    <form method="post" action="/Action">
-        <!-- Input and Submit elements -->
-        <input name="__RequestVerificationToken" 
-        type="hidden" value="<removed for brevity>">
-    </form>
-    
-    
-***Notice the \`__RequestVerificationToken\` parameters.***
-    `
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/csharp/index.ts
-var vulnerabilities = {
-  ["MISSING_ANTIFORGERY_VALIDATION"]: missingAntiForgeryValidation,
-  ["PASSWORD_IN_COMMENT"]: passwordInComment
-};
-var csharp_default = vulnerabilities;
-
-// src/features/analysis/scm/shared/src/storedFixData/dockerfile/index.ts
-var vulnerabilities2 = {};
-var dockerfile_default = vulnerabilities2;
-
-// src/features/analysis/scm/shared/src/storedFixData/go/index.ts
-var vulnerabilities3 = {};
-var go_default = vulnerabilities3;
-
-// src/features/analysis/scm/shared/src/storedFixData/hcl/index.ts
-var vulnerabilities4 = {};
-var hcl_default = vulnerabilities4;
-
-// src/features/analysis/scm/shared/src/storedFixData/java/insecureDeserialization.ts
-var insecureDeserialization = {
-  guidance: () => "Added a `@Consumes` annotation restricting the endpoint to common safe media types (JSON, XML, form, multipart, octet-stream, plain text). Requests with `Content-Type: application/x-java-serialized-object` are no longer routed to the RESTEasy `SerializableProvider`. If your endpoint legitimately accepts a content type not in this allowlist (e.g. `image/png`, a custom JSON variant), expect HTTP 415 from those clients and extend the `@Consumes` list to include it."
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/java/j2eeGetConnection.ts
-var j2eeGetConnection = {
-  guidance: () => `This fix replaces direct \`DriverManager.getConnection(...)\` calls with a container-managed JNDI \`DataSource\` lookup. The new code expects the app server (Tomcat / WildFly / WebSphere / etc.) to expose a configured connection pool under the JNDI name you specified.
-
-
-&nbsp;
-
-***Make sure the resource pool exists before merging.*** The patched code will throw a \`NamingException\` at runtime if the JNDI name does not resolve. Configure it in your container's resource definition:
-
-- **Tomcat**: declare a \`<Resource>\` element in \`context.xml\` (or per-app \`META-INF/context.xml\`) with the same JNDI name, plus \`url\`, \`username\`, \`password\`, \`driverClassName\`, and any pool sizing.
-- **Spring Boot (embedded Tomcat)**: configure via \`spring.datasource.jndi-name\` and matching \`<Resource>\`, or use \`@ConfigurationProperties\` to bind a \`DataSource\` bean.
-- **WildFly / JBoss EAP**: declare a \`<datasource>\` in the standalone/domain XML and reference its JNDI binding.
-- **WebSphere / WebLogic**: define the JDBC provider and data source through the admin console; bind it to the JNDI name.
-
-
-&nbsp;
-
-Also add a matching \`<resource-ref>\` (or \`<data-source>\`) in your \`WEB-INF/web.xml\` if you use one. The original connection details (URL, user, password) move from the call site into the resource definition \u2014 remove them from any constants / properties files where they were duplicated.
-
-
-&nbsp;
-
-This fix is mandated by the J2EE / Jakarta EE specification (CWE-245) \u2014 direct driver management bypasses the container's pooling, retry, and failover policies.`
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/java/systemInformationLeak.ts
-var systemInformationLeak = {
-  guidance: ({
-    clientMightBeAffected
-  }) => {
-    if (clientMightBeAffected) {
-      return "You should never expose error details to the client. We removed the error details from the response. Ensure the client application code does not rely on the removed information.";
-    }
-    return "";
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/java/index.ts
-var vulnerabilities5 = {
-  ["PASSWORD_IN_COMMENT"]: passwordInComment,
-  ["INSECURE_DESERIALIZATION"]: insecureDeserialization,
-  ["J2EE_GET_CONNECTION"]: j2eeGetConnection,
-  ["SYSTEM_INFORMATION_LEAK"]: systemInformationLeak
-};
-var java_default = vulnerabilities5;
-
-// src/features/analysis/scm/shared/src/storedFixData/python/csrf.ts
-var csrf = {
-  guidance: () => `Please make sure the CSRF middleware is activated by default in the MIDDLEWARE setting. If you override that setting, remember that \`django.middleware.csrf.CsrfViewMiddleware\` should come before any view middleware that assume that CSRF attacks have been dealt with.
-
-
-If you disabled it, which is not recommended, you can use [\`csrf_protect()\`](https://docs.djangoproject.com/en/5.1/ref/csrf/#django.views.decorators.csrf.csrf_protect) annotation on this particular view.
-
-
-See more information [here](https://docs.djangoproject.com/en/5.1/howto/csrf/).`
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/javascript/hardcodedSecrets.ts
-var hardcodedSecrets = {
-  guidance: ({ questions }) => {
-    const envVarName = questions.find((q) => q.key === "env_var_name")?.value || "the";
-    const keepAsDefault = questions.find(
-      (q) => q.key === "keep_as_default"
-    )?.value;
-    let additionalText = "";
-    if (keepAsDefault === "yes") {
-      additionalText = "\n1. Remove the hardcoded secret from the code.\n";
-    }
-    return `Please follow the steps in this specific order:
-
-1. Change the secret that was hardcoded. It is essential because even when you commit the changes, the secret will remain in the git history.${additionalText}
-1. Update the configuration of all your application environments and CI/CD pipelines to set \`${envVarName}\` environment variable.
-1. Commit the changes.`;
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/javascript/noLimitsOrThrottling.ts
-var noLimitsOrThrottling = {
-  guidance: () => "We set the default limit to 60 requests per minute. To customize the rate limit settings, please read the documentation of the [express-rate-limit](https://www.npmjs.com/package/express-rate-limit) package."
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/javascript/ssrf.ts
-var ssrf = {
-  guidance: () => "The server-side validates the domains it has access to, otherwise it throws an error if validation failed. Please make sure you handled the error correctly."
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/javascript/index.ts
-var vulnerabilities6 = {
-  ["SSRF"]: ssrf,
-  ["HARDCODED_SECRETS"]: hardcodedSecrets,
-  ["PASSWORD_IN_COMMENT"]: passwordInComment,
-  ["NO_LIMITS_OR_THROTTLING"]: noLimitsOrThrottling,
-  ["CSRF"]: csrf
-};
-var javascript_default = vulnerabilities6;
-
-// src/features/analysis/scm/shared/src/storedFixData/php/index.ts
-var vulnerabilities7 = {};
-var php_default = vulnerabilities7;
-
-// src/features/analysis/scm/shared/src/storedFixData/python/autoEscapeFalse.ts
-var autoEscapeFalse = {
-  guidance: () => `This fix enables automatic escaping for HTML. When that's enabled, everything is escaped by default except for values explicitly marked as safe. Variables and expressions can be marked as safe either in:
-
-a. The context dictionary by the application with \`markupsafe.Markup\`
-
-b. The template, with the \`|safe\` filter.
-
-&nbsp;
-
-
-See more information [here](https://jinja.palletsprojects.com/en/3.1.x/templates/#working-with-automatic-escaping) and [here](https://pypi.org/project/MarkupSafe/).
-
-&nbsp;
-
-
-***Note: make sure that none of the data you're marking as safe is coming from user input, as this can lead to XSS vulnerabilities!***`
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/python/improperCertificateValidation.ts
-var improperCertificateValidation = {
-  guidance: () => `This fix re-enables TLS certificate validation by changing \`verify=False\` to \`verify=True\` on the HTTP request. Any call that was deliberately reaching a server with a self-signed, expired, or otherwise untrusted certificate will start raising \`ssl.SSLError\` / \`requests.exceptions.SSLError\` after this change.
-
-&nbsp;
-
-***Before merging, confirm that every endpoint reached by this call presents a certificate signed by a trusted CA.*** If the call must talk to an internal service that uses a private CA, prefer pointing \`verify\` at the CA bundle (\`verify="/path/to/ca.pem"\`) over disabling validation. If the certificate cannot be trusted at all, the safe fix is to terminate that connection at a properly configured proxy, not to keep it unvalidated.
-
-&nbsp;
-
-See the [\`requests\` SSL verification docs](https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification) for the supported \`verify\` values.`
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/python/index.ts
-var vulnerabilities8 = {
-  ["AUTO_ESCAPE_FALSE"]: autoEscapeFalse,
-  ["CSRF"]: csrf,
-  ["IMPROPER_CERTIFICATE_VALIDATION"]: improperCertificateValidation
-};
-var python_default = vulnerabilities8;
-
-// src/features/analysis/scm/shared/src/storedFixData/sql/defaultRightsInObjDefinition.ts
-var defaultRightsInObjDefinition = {
-  guidance: () => "***Make sure the user who is supposed to run the procedure has sufficient permissions.***\n\nRead more details about the `EXECUTE AS` statement in [the official Microsoft documentation](https://learn.microsoft.com/en-us/sql/t-sql/statements/execute-as-clause-transact-sql?view=sql-server-ver16&tabs=sqlserver).\n\n`EXECUTE AS CALLER` is the default behavior for SQL Server 2005 and later."
-};
-
-// src/features/analysis/scm/shared/src/storedFixData/sql/index.ts
-var vulnerabilities9 = {
-  ["DEFAULT_RIGHTS_IN_OBJ_DEFINITION"]: defaultRightsInObjDefinition
-};
-var sql_default = vulnerabilities9;
-
-// src/features/analysis/scm/shared/src/storedFixData/xml/index.ts
-var vulnerabilities10 = {
-  ["PASSWORD_IN_COMMENT"]: passwordInComment
-};
-var xml_default = vulnerabilities10;
-
-// src/features/analysis/scm/shared/src/storedFixData/index.ts
-var StoredFixDataItemZ = z9.object({
-  guidance: z9.function().args(z9.any()).returns(z9.string())
-});
-var languages = {
-  ["Java" /* Java */]: java_default,
-  ["JavaScript" /* JavaScript */]: javascript_default,
-  ["CSharp" /* CSharp */]: csharp_default,
-  ["SQL" /* Sql */]: sql_default,
-  ["XML" /* Xml */]: xml_default,
-  ["Python" /* Python */]: python_default,
-  ["PHP" /* Php */]: php_default,
-  ["Go" /* Go */]: go_default,
-  ["Dockerfile" /* Dockerfile */]: dockerfile_default,
-  ["Hcl" /* Hcl */]: hcl_default
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/index.ts
-init_client_generates();
-import { z as z10 } from "zod";
-
-// src/features/analysis/scm/shared/src/storedQuestionData/cpp/commandInjection.ts
-var commandInjection = {
-  isUnixShellCommandPart: {
-    content: () => "Is the input data interpolated into a shell command (not the program name or shell structure)?",
-    description: () => `\`system()\` / \`popen()\` hand the whole string to \`/bin/sh -c\`. Answer **yes** when the input is *data* placed into a fixed command, for example:
-
-- \`sprintf(cmd, "grep %s file.txt", input); system(cmd);\`
-- \`sprintf(cmd, "ping -c 5 %s", input); system(cmd);\`
-
-Answer **no** (the input is not plain data) when the input is:
-
-1. The program/executable itself:
-  - \`system(input);\`
-  - \`sprintf(cmd, "%s -x", input);\`
-2. A command after a pipe or redirect:
-  - \`sprintf(cmd, "cat file.txt | %s", input);\`
-3. A part of a non-Unix or cross-platform shell command.
-4. A part of embedded code in another language:
-  - \`sprintf(cmd, "php -r \\"echo '%s';\\"", input);\`
-  - \`sprintf(cmd, "awk '%s' file", input);\`
-5. A flag/option that controls a tool's behaviour:
-  - \`sprintf(cmd, "git --upload-pack %s", input);\``,
-    guidance: () => "If yes and the command can run without a shell, it is rewritten to a no-shell argument-vector call (`posix_spawn`); if it needs the shell, the tainted argument is escaped in place so the shell keeps working. If the answer is no (the input controls the program or shell structure), there is no safe automatic rewrite, so the fix is withheld and the sink is left for manual review."
-  },
-  executableLocationPath: {
-    content: () => "What is the absolute path of the directory containing the executable?",
-    description: () => `When \`system()\` is rewritten to an \`execv()\` argument-vector call, the program is run by its path with **no \`$PATH\` search**, so a relative program name (e.g. \`tail\`) cannot be resolved and a poisoned \`PATH\` cannot be used to run a look-alike binary.
-
-Provide the absolute directory that contains the executable (e.g. \`/usr/bin\`); the fix prepends it to the bare program name to form an absolute path.`,
-    guidance: () => "Only asked when the program name in the command has no `/`. A program that is already an absolute or relative path (contains `/`) is used as written."
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/cpp/pathManipulation.ts
-var pathManipulation = {
-  baseDirectory: {
-    content: ({ expression }) => `Which directory must \`${expression}\` stay within? Enter the absolute base directory file access is restricted to.`,
-    description: ({ expression }) => `The fix canonicalizes \`${expression}\` (resolving \`.\`, \`..\`, and symlinks) and verifies the result stays inside this base directory. Provide the **absolute** root the application is allowed to read or write under, for example \`/var/app/data\`. The directory must exist at runtime. A path that resolves outside it is rejected at runtime.`,
-    guidance: (_) => "You **must** set this to an absolute path that exists at runtime and that your application confines file access to. If you leave it unset (or give a relative path), the generated fix is emitted with a placeholder identifier (`MOBB_SET_ALLOWED_BASE_DIR`) that **deliberately does not compile**, so a missing security boundary cannot be overlooked \u2014 replace it with your absolute base directory. A relative path would otherwise resolve against the process working directory (moving the boundary). At runtime the guard aborts (C: `exit(EXIT_FAILURE)`) / throws (C++: `std::runtime_error`) on a path that escapes the base. Pick the narrowest directory that still contains every legitimate file the code opens."
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/cpp/index.ts
-var vulnerabilities11 = {
-  ["CMDi"]: commandInjection,
-  ["PT"]: pathManipulation
-};
-var cpp_default = vulnerabilities11;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/httpOnlyCookie.ts
-var httpOnlyCookie = {
-  httpOnlyCookie: {
-    content: () => "Is the cookie value supposed to be exposed to client-side scripting code?",
-    description: () => httpOnlyMessage,
-    guidance: () => ""
-  },
-  cookieVarName: {
-    content: () => "Please define a variable name",
-    description: () => `We need a variable for the new cookie instance`,
-    guidance: () => ""
-  }
-};
-var httpOnlyMessage = `\`HttpOnly\` is a security feature for cookies that can be set by a web server 
-      when sending a Set-Cookie header in an HTTP response. When the HTTP Only flag is set for a cookie, it means that the cookie can only 
-      be accessed and modified by the server, and client-side scripts (like JavaScript) running in the browser are not allowed to access the cookie.      
-      
-&nbsp;
-    
-      
-***If your client-site application needs to access the value of this cookie, making this change might break the application logic.***  
-      
-&nbsp;
-
-`;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/insecureBinderConfiguration.ts
-var insecureBinderConfiguration = {
-  bindAttributeParam: {
-    content: ({ func_param_name }) => `Which properties of the model should be included in model binding for \`${func_param_name}\`?`,
-    description: () => "Provide a comma-separated list of valid property names to be included in model binding. See [the official documentation](https://learn.microsoft.com/en-us/aspnet/core/mvc/models/model-binding?view=aspnetcore-8.0#bind-attribute) for more details.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/insecureCookie.ts
-var insecureCookie = {
-  insecureCookie: {
-    content: () => "Will this cookie be used only in encrypted channels (https)?",
-    description: () => `When a cookie is marked as "secure" in a web environment, it means that the cookie should only be sent over secure, encrypted connections, like HTTPS.
-    In environments like local development or test, setting cookies as secure might have some consequences:    
-    
-&nbsp;    
-    - Development Convenience: When developing locally, you might not always have HTTPS set up, as it often involves 
-    additional configuration and certificates. If cookies are marked as secure, 
-    they won't be sent over HTTP, and this could potentially interfere with the normal 
-    functioning of your application during development.    
-    
-&nbsp;    
-    - Testing for Secure Environments: If your application relies on secure cookies, you should ensure that your 
-    testing environment accurately simulates the production environment's security features. 
-    This may involve setting up HTTPS in your local development environment.    
-    
-&nbsp;    
-    - Debugging Challenges: Debugging may be more challenging when using secure cookies in a 
-    development environment, especially if you need to inspect or manipulate the cookies during 
-    development.`,
-    guidance: () => ""
-  },
-  cookieVarName: {
-    content: () => "Please define a variable name",
-    description: () => `We need a variable for the new cookie instance`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/insecureRandomness.ts
-var insecureRandomness = {
-  isRandomNumberGeneratorAvailable: {
-    content: () => "We use the `RandomNumberGenerator` class from the `System.Security.Cryptography` package. Does this class exist for the .NET version you use?",
-    description: () => "See [the official documentation](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-8.0#applies-to) for more details.",
-    guidance: () => ""
-  },
-  isNetVersionGreaterThan6: {
-    content: () => "We are able to offer a more concise solution if the .NET version is greater then .NET 6",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/insufficientLogging.ts
-var insufficientLogging = {
-  logMessage: {
-    content: () => "Enter the message that you want to appear in the log",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/logForging.ts
-var logForging = {
-  isHtmlDisplay: {
-    content: () => "Is the text written to the log going to be displayed as HTML?",
-    description: () => "",
-    guidance: ({ userInputValue }) => {
-      switch (userInputValue) {
-        case "yes":
-          return "We use the `System.Web` `HttpUtility` to decode the HTML";
-        default:
-          return "";
-      }
-    }
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/overlyBroadCatch.ts
-var overlyBroadCatch = {
-  defaultExceptionsInWhenFilter: {
-    content: () => "Exceptions to filter",
-    description: () => "Coma separated list of the Fully Qualified Exceptions names",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/pt.ts
-var pt = {
-  taintedTermType: {
-    content: ({ expression }) => `Does \`${expression}\` represent a file name or a file path?`,
-    description: ({ expression }) => `We replace all illegal file name characters for Unix, Windows, and macOS operation systems, including slashes. Ensure that \`${expression}\` isn't supposed to contain slashes or other illegal file name characters.`,
-    guidance: () => ""
-  },
-  pathTargetDir: {
-    content: () => "Allowed file path",
-    description: () => "Provide the intended file path destination eg: /tmp/testfiles/users/",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/regexMissingTimeout.ts
-var regexMissingTimeout = {
-  netVersionGreaterOrEqual7: {
-    content: () => "Is your target framework .NET 7 or greater?",
-    description: () => "",
-    guidance: () => ""
-  },
-  timeout: {
-    content: () => "Enter the timeout in milliseconds",
-    description: () => "If the limit is reached a RegexTimeoutException is thrown, this could be caused by excessive backtracking",
-    guidance: () => ""
-  },
-  useBacktrackingOption: {
-    content: () => "Use non backtracking option",
-    description: () => "If the regex does not need to use backtracking we can disable it using regex options",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/requestParametersBoundViaInput.ts
-var requestParametersBoundViaInput = {
-  fieldsToCopy: {
-    content: () => "Please list all the fields you expect as input from the user. Use comma separated list.",
-    description: () => `This is meant to avoid mass assignment vulnerabilities, where the user would enter an inner unexpected field`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/sqlInjection.ts
-var sqlInjection = {
-  databaseProvider: {
-    content: () => "Select the database provider",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/ssrf.ts
-var ssrf2 = {
-  domainsAllowlist: {
-    content: () => "Allowed domains",
-    description: () => "Coma separated list of allowed domains.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/sysLeak.ts
-var sysLeak = {
-  errorMessage: {
-    content: () => "Enter the error message that you want to appear in the log",
-    description: () => "",
-    guidance: () => ""
-  },
-  noLoggerAction: {
-    content: () => "Which of the following you want to use instead of the vulnerable code?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/trustBoundaryViolation.ts
-var trustBoundaryViolation = {
-  validationPattern: {
-    content: ({ expression }) => `What is the expected type of \`${expression}\`?`,
-    description: () => "We use regex to validate the input to avoid runtime surprises",
-    guidance: () => ""
-  },
-  otherPatternValue: {
-    content: () => `Enter the regex pattern you would like to use to validate the input`,
-    description: () => "See patterns at [the regex docs](https://learn.microsoft.com/en-us/dotnet/standard/base-types/regular-expression-language-quick-reference)",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/useOfSystemOutputStream.ts
-var useOfSystemOutputStream = {
-  noLoggerAction: {
-    content: () => "Which of the following you want to use instead of the vulnerable code?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/valueShadowing.ts
-var valueShadowing = {
-  collectionName: {
-    content: () => "Please select the collection to search/index from",
-    description: () => `Accessing the root object eg Request["item"] searches across all available collections and returns the first item that matches. Potentially leading to the correct value being shadowed. Available collections include:
-    - QueryString: The values of variables in the HTTP query string.
-    - Form: The values of form elements in the HTTP request body.
-    - Cookies: The values of cookies sent in the HTTP request.
-    - ClientCertificate: The values of fields stored in the client certificate that is sent in the HTTP request.
-    - ServerVariables: The values of predetermined environment variables.`,
-    guidance: () => `See 
-    - https://learn.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms524948(v=vs.90),
-    - https://learn.microsoft.com/en-us/dotnet/api/system.web.httprequest?view=netframework-4.8.1`
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/wcfMisconfigurationThrottlingNotEnabled.ts
-var wcfMisconfigurationThrottlingNotEnabled = {
-  maxConcurrentCalls: {
-    content: () => "Please define the maximum concurrent calls",
-    description: () => `A positive integer that limits the number of messages that currently process across a ServiceHost. Calls in excess of the limit are queued. Setting this value to 0 is equivalent to setting it to Int32.MaxValue.`,
-    guidance: () => {
-      return "";
-    }
-  },
-  maxConcurrentInstances: {
-    content: () => "Please define the maximum concurrent instances",
-    description: () => `A positive integer that limits the number of InstanceContext objects that execute at one time across a ServiceHost. Requests to create additional instances are queued and complete when a slot below the limit becomes available.`,
-    guidance: () => {
-      return "";
-    }
-  },
-  maxConcurrentSessions: {
-    content: () => "Please define the maximum concurrent sessions",
-    description: () => `A positive integer that limits the number of sessions a ServiceHost object can accept.`,
-    guidance: () => {
-      return "";
-    }
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/xss.ts
-var xss = {
-  allowSpecialCharacters: {
-    content: ({ source_value }) => `Does your code allow encodable HTML characters like '&', '<', '"' etc. in: \`${source_value}\`?`,
-    description: () => "",
-    guidance: () => ""
-  },
-  containsHtml: {
-    content: ({ prop_value }) => `Does your code allow having HTML tags in: \`${prop_value}\`?`,
-    description: () => "",
-    guidance: () => ""
-  },
-  netVersionGreaterOrEqual45: {
-    content: () => "Is your target framework .NET 4.5 or greater?",
-    description: () => "",
-    guidance: () => ""
-  },
-  useHTML4NamedEntities: {
-    content: () => "Would you like to use HTML 4.0 Named entities?",
-    description: () => "See [examples](https://www.w3schools.com/charsets/ref_html_entities_4.asp) and [full description](https://www.w3.org/TR/WD-html40-970708/sgml/entities.html)",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/xxe.ts
-var xxe = {
-  netVersionGreaterOrEqual4: {
-    content: () => "Is your target framework .NET 4.0.0 or greater?",
-    description: () => "",
-    guidance: ({ userInputValue }) => {
-      switch (userInputValue) {
-        case "yes":
-          return "We set `DtdProcessing` to `DtdProcessing.Prohibit` in order to prevent DTD parsing.";
-        default:
-          return "We set `ProhibitDtd` to `true` in order to prevent DTD parsing.";
-      }
-    }
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/csharp/index.ts
-var vulnerabilities12 = {
-  ["LOG_FORGING"]: logForging,
-  ["SSRF"]: ssrf2,
-  ["XXE"]: xxe,
-  ["XSS"]: xss,
-  ["USE_OF_SYSTEM_OUTPUT_STREAM"]: useOfSystemOutputStream,
-  ["SYSTEM_INFORMATION_LEAK"]: sysLeak,
-  ["OVERLY_BROAD_CATCH"]: overlyBroadCatch,
-  ["TRUST_BOUNDARY_VIOLATION"]: trustBoundaryViolation,
-  ["PT"]: pt,
-  ["REGEX_MISSING_TIMEOUT"]: regexMissingTimeout,
-  ["HTTP_ONLY_COOKIE"]: httpOnlyCookie,
-  ["INSECURE_COOKIE"]: insecureCookie,
-  ["WCF_MISCONFIGURATION_THROTTLING_NOT_ENABLED"]: wcfMisconfigurationThrottlingNotEnabled,
-  ["INSECURE_BINDER_CONFIGURATION"]: insecureBinderConfiguration,
-  ["VALUE_SHADOWING"]: valueShadowing,
-  ["INSECURE_RANDOMNESS"]: insecureRandomness,
-  ["INSUFFICIENT_LOGGING"]: insufficientLogging,
-  ["SQL_Injection"]: sqlInjection,
-  ["REQUEST_PARAMETERS_BOUND_VIA_INPUT"]: requestParametersBoundViaInput
-};
-var csharp_default2 = vulnerabilities12;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/go/logForging.ts
-var logForging2 = {
-  isHtmlDisplay: {
-    content: () => "Is the text written to the log going to be displayed as HTML?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/go/missingSslMinversion.ts
-var missingSslMinversion = {
-  minTlsVersion: {
-    content: () => "What is the minimum version of Transport Layer Security (TLS) you allow? Ensure compatibility between the server and clients.",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/go/websocketMissingOriginCheck.ts
-var websocketMissingOriginCheck = {
-  minTlsVersion: {
-    content: () => "Please provide a comma-separated list of valid hosts. This list will serve as an allow list to check the connection `Origin` header.",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/go/index.ts
-var vulnerabilities13 = {
-  ["LOG_FORGING"]: logForging2,
-  ["MISSING_SSL_MINVERSION"]: missingSslMinversion,
-  ["WEBSOCKET_MISSING_ORIGIN_CHECK"]: websocketMissingOriginCheck
-};
-var go_default2 = vulnerabilities13;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/commandInjection.ts
-var commandInjection2 = {
-  isUnixShellCommandPart: {
-    content: () => "Is the input part of Unix shell command?",
-    description: () => `For example:
-
-- \`Runtime.getRuntime().exec(new String[] {"/bin/sh", "-c", "ping -t 5 -c 5 " + input});\`
-- \`Runtime.getRuntime().exec(new String[] {"/bin/bash", "-c", "curl " + input + " > file.txt"});\`
-
-Make sure the input is not:
-
-1. An executable name:
-  - \`Runtime.getRuntime().exec(input);\`
-  - \`Runtime.getRuntime().exec(new String[] {"/bin/bash", input});\`
-  - \`Runtime.getRuntime().exec(new String[] {"/bin/sh", "-c", input + " param"});\`
-  - \`Runtime.getRuntime().exec(new String[] {"/bin/bash", "-c", "cat file.txt | " + input});\`
-  - \`Runtime.getRuntime().exec(new String[] {"/usr/bin/git", "--upload-pack", input});\`
-2. A part of non-unix or cross platform shell command:
-  - \`Runtime.getRuntime().exec(new String[] {"cmd.exe", "/c", "ping " + input});\`
-3. A part of programming language code:
-  - \`Runtime.getRuntime().exec(new String[] {"php", "-r", "echo '" + input + "';"});\`
-  - \`Runtime.getRuntime().exec(new String[] {"perl", "-e", "print '" + input + "'"});\``,
-    guidance: () => ""
-  },
-  installApacheCommonsText: {
-    content: () => "Is the Apache Commons library (org.apache.commons) included in your project, if not, can you add it?",
-    description: () => "Apache Commons Text is a library focused on algorithms working on strings.",
-    guidance: ({ userInputValue }) => userInputValue === "yes" ? "To add the library, modify your pom.xml or build.gradle to include the library. You can find the latest version here https://mvnrepository.com/artifact/org.apache.commons/commons-text" : ""
-  },
-  cmdAllowlist: {
-    content: () => "Allowed Commands",
-    description: () => "Make sure that the list of commands is separated by commas.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/confusingNaming.ts
-var confusingNaming = {
-  newFieldName: {
-    content: () => "Rename the existing field",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/duplicatedStrings.ts
-var duplicatedStrings = {
-  constantName: {
-    content: () => "New constant name",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/erroneousStringCompare.ts
-var erroneousStringCompare = {
-  javaVersionGreaterOrEqual17: {
-    content: () => "Is `java.util.Objects` package available in your runtime?",
-    description: () => "`java.util.Objects` is supported in Java 1.7 or greater.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/errorConditionWithoutAction.ts
-var errorConditionWithoutAction = {
-  errorMessage: {
-    content: () => "Enter the error message that you want to appear in the log",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/httpOnlyCookie.ts
-var httpOnlyCookie2 = {
-  httpOnlyCookie: {
-    content: () => "Is the cookie value supposed to be exposed to client-side scripting code?",
-    description: ({ class_name }) => class_name == "Cookie" ? `${httpOnlyMessage2} ${setHttpOnlyMethodMessage}` : httpOnlyMessage2,
-    guidance: () => ""
-  },
-  cookieVarName: {
-    content: () => "Please define a variable name",
-    description: () => `We need a variable for the new cookie instance`,
-    guidance: () => ""
-  }
-};
-var httpOnlyMessage2 = `\`HttpOnly\` is a security feature for cookies that can be set by a web server 
-      when sending a Set-Cookie header in an HTTP response. When the HTTP Only flag is set for a cookie, it means that the cookie can only 
-      be accessed and modified by the server, and client-side scripts (like JavaScript) running in the browser are not allowed to access the cookie.      
-      
-&nbsp;
-    
-      
-***If your client-site application needs to access the value of this cookie, making this change might break the application logic.***  
-      
-&nbsp;
-
-`;
-var setHttpOnlyMethodMessage = `Beware that if your application is using a version of the javax.servlet-api package < 3.0
-      this change will not work since the method "setHttpOnly" is not present in previous of the package.`;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/insecureCookie.ts
-var insecureCookie2 = {
-  insecureCookie: {
-    content: () => "Will this cookie be used only in encrypted channels (https)?",
-    description: () => `When a cookie is marked as "secure" in a web environment, it means that the cookie should only be sent over secure, encrypted connections, like HTTPS.
-    In environments like local development or test, setting cookies as secure might have some consequences:    
-    
-&nbsp;    
-    - Development Convenience: When developing locally, you might not always have HTTPS set up, as it often involves 
-    additional configuration and certificates. If cookies are marked as secure, 
-    they won't be sent over HTTP, and this could potentially interfere with the normal 
-    functioning of your application during development.    
-    
-&nbsp;    
-    - Testing for Secure Environments: If your application relies on secure cookies, you should ensure that your 
-    testing environment accurately simulates the production environment's security features. 
-    This may involve setting up HTTPS in your local development environment.    
-    
-&nbsp;    
-    - Debugging Challenges: Debugging may be more challenging when using secure cookies in a 
-    development environment, especially if you need to inspect or manipulate the cookies during 
-    development.`,
-    guidance: () => ""
-  },
-  cookieVarName: {
-    content: () => "Please define a variable name",
-    description: () => `We need a variable for the new cookie instance`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/j2eeGetConnection.ts
-var j2eeGetConnection2 = {
-  jndiResourceName: {
-    content: () => "What JNDI name is the database connection pool registered under?",
-    description: () => 'We need the JNDI name your app server uses to expose its container-managed `DataSource`. The fix performs `new InitialContext().lookup(<jndi-name>)` to retrieve the pool, so this value must exactly match the resource definition (e.g. `<Resource name="...">` in Tomcat `context.xml`, or the binding declared in WildFly / WebSphere / WebLogic). The default `java:comp/env/jdbc/myDataSource` is the canonical Tomcat / Spring convention; replace it with whatever your environment uses.',
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/leftoverDebugCode.ts
-var leftoverDebugCode = {
-  isCodeUsed: {
-    content: () => "The function seems to be a remnant of debug code. Is it still being used?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/localeDependentComparison.ts
-var localeDependentComparison = {
-  localeType: {
-    content: ({ variable }) => `Is ${variable} locale dependent?`,
-    description: () => `Select "locale insensitive" for string comparisons that are not dependent on the locale.
-
-    Select "default locale" for string comparisons that uses the default locale.
-
-    Select "custom locale" for string comparisons that are dependent on a specific locale language.`,
-    guidance: () => ""
-  },
-  customLocaleLanguage: {
-    content: () => "What is your locale language?",
-    description: () => "A list of locales can be found [here](https://www.oracle.com/java/technologies/javase/jdk8-jre8-suported-locales.html)",
-    guidance: () => ""
-  },
-  customLocaleCountry: {
-    content: () => "What is your locale country?",
-    description: () => "A list of locales can be found [here](https://www.oracle.com/java/technologies/javase/jdk8-jre8-suported-locales.html)",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/logForging.ts
-var logForging3 = {
-  isHtmlDisplay: {
-    content: () => "Is the text written to the log going to be displayed as HTML?",
-    description: () => "",
-    guidance: () => ""
-  },
-  htmlEscapingLib: {
-    content: () => "Which HTML escaping library would you like to use?",
-    description: () => `
-  - If you use the Spring framework, you likely already have \`org.springframework.web.util.HtmlUtils\`
-  - Another \`option is org.apache.commons.text.StringEscapeUtils\``,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/missingCheckAgainstNull.ts
-var missingCheckAgainstNull = {
-  preferredAction: {
-    content: ({ tainted_expression }) => `What is expected behavior if \`${tainted_expression}\` returns null?`,
-    description: () => "",
-    guidance: () => ""
-  },
-  javaVersionGreaterOrEqual17: {
-    content: () => "Is `java.util.Objects` package available in your runtime?",
-    description: () => "`java.util.Objects` is supported in Java 1.7 or greater.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/openRedirect.ts
-var openRedirect = {
-  allowlist: {
-    content: () => "Allowed domains",
-    description: () => "Add a comma separated list of allowed domains (e.g. 'google.com,example.com')",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/overlyBroadCatch.ts
-var overlyBroadCatch2 = {
-  handleRuntimeExceptions: {
-    content: () => "Does the code intentionally catch `RuntimeException` instances like `ArithmeticException` or `NullPointerException` in the `catch` block?",
-    description: () => "Usually, when catching the general `Exception` class catching of `RuntimeException` is implied and not necessarily the wanted/safe behavior. The application needs to deal with it explicitly in a different way, as the Mobb fix suggests.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/privacyViolation.ts
-var privacyViolation = {
-  remediationOption: {
-    content: () => "Preferred fix solution",
-    description: () => `
-      - Completely Remove the log message
-      - Replace the sensitive data with the string [Redacted]
-      - SHA 256 Hash the sensitive information in the log message`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/pt.ts
-var pt2 = {
-  isPathRelativeOnly: {
-    content: ({ expression }) => `Do you expect \`${expression}\` to be a relative path?`,
-    description: () => "You most likely want to serve files relative to the web server's static files folder in web applications. If so, your answer should be `yes`. In CLI applications, you probably would like to give the user more flexibility and allow them to specify absolute paths to any location on the disk \u2013 your answer should be `no` in such cases.",
-    guidance: () => ""
-  },
-  isFileName: {
-    content: ({ expression }) => `Does \`${expression}\` represent a file name or a file name part?`,
-    description: ({ expression }) => `We replace all illegal file name characters for Unix, Windows, and macOS operation systems, including slashes. Ensure that \`${expression}\` isn't supposed to contain slashes or other illegal file name characters. If  \`${expression}\` is supposed to legitimately include such characters, the answer should be "no".`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/relativePathCommand.ts
-var relativePathCommand = {
-  executableLocationPath: {
-    content: () => "What is the absolute path of the directory containing the executable?",
-    description: () => "We need the absolute path to the executable to protect your application from command injection and ensure malicious actors cannot execute arbitrary commands on your system.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/ssrf.ts
-var ssrf3 = {
-  domainsAllowlist: {
-    content: () => "Allowed URL prefixes",
-    description: () => `The security risk of this issue is the ability of an attacker to provide input that shoots HTTP requests from your server to arbitrary URLs, including internal ones, like \`https://admin.mycompany.com\`    
-&nbsp;    
-&nbsp;    To eliminate the risk and fix the issue, check out your app logic and make a whitelist of URLs this API should be allowed to call.`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/sysLeak.ts
-var sysLeak2 = {
-  errorMessage: {
-    content: () => "Enter the error message that you want to appear in the log",
-    description: () => "",
-    guidance: () => ""
-  },
-  noLoggerAction: {
-    content: () => "Which of the following you want to use instead of the vulnerable code?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/trustBoundaryViolation.ts
-var trustBoundaryViolation2 = {
-  validationPattern: {
-    content: ({ expression }) => `What is the expected type of \`${expression}\`?`,
-    description: () => "We use regex to validate the input to avoid runtime surprises",
-    guidance: () => ""
-  },
-  otherPatternValue: {
-    content: () => `Enter the regex pattern you would like to use to validate the input`,
-    description: () => "See patterns at [the regex javadoc](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/regex/Pattern.html)",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/uncheckedLoopCondition.ts
-var uncheckedLoopCondition = {
-  loopLimit: {
-    content: () => "Please define a maximum loop limit",
-    description: () => `Setting this number to a reasonable value will prevent the vulnerability`,
-    guidance: () => ""
-  },
-  varName: {
-    content: () => "Please define a variable name",
-    description: () => `We need to define a variable to be used as a counter to limit the loop`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/unsafeReflection.ts
-var unsafeReflection = {
-  classAllowlist: {
-    content: () => "Allowed class names for reflection",
-    description: () => `Provide a comma-separated list of fully-qualified class names that are permitted to be loaded via reflection (e.g. \`com.example.MyClass\`). Any other class name will be rejected at runtime.`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/useOfSystemOutputStream.ts
-var useOfSystemOutputStream2 = {
-  noLoggerAction: {
-    content: () => "Which of the following you want to use instead of the vulnerable code?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/xss.ts
-var xss2 = {
-  isHtmlOrSafeAttribute: {
-    content: ({ tainted_variable }) => `Where is \`${tainted_variable}\` written to?`,
-    description: () => `Answer examples:
-
-- a text in an HTML tag or a value of a safe HTML attribute:
-    - \`<li><%= name %></li>\`
-    - \`<div>Name: <%= name %></div>\`
-    - \`<input value="<%= name %>" name="name"/>\`
-    - \`<div data-name="<%= name %>"></div>\`
-- a JavaScript code block:
-    - \`<script>const name = "<%= name %>";</script>\`
-- an event attribute of an HTML tag:
-    - \`<a onclick="alert('<%= name %>')">click me</a>\`
-    - \`<img onmouseover="alert('<%= name %>')"/>\`
-- a src-like attribute of an HTML tag:
-    - \`<a href="/user/<%= name %>">me</a>\`
-    - \`<img src="/img/<%= name %>"/>\`
-    - \`<form action="<%= name %>"></form>\`
-    - \`<iframe srcdoc="<%= name %>"/>\`
-- a part of an HTML tag attributes list:
-    - \`<a <%= name %>>text</a>\`
-
-See more details about safe and unsafe HTML attributes:
-- [PortSwigger cheat-sheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet)
-- [DOMPurify attributes filter implementation](https://github.com/cure53/DOMPurify/blob/c29aa900a1c286b82ee4f48a7ffab96cab3e84fa/src/attrs.js)
-`,
-    guidance: () => ""
-  },
-  isHtmlEncoded: {
-    content: () => "Is the user input already encoded as HTML text?",
-    description: () => "If you are unsure, we will decode the user input and encode it again to ensure it is safe and the data is kept the same.",
-    guidance: () => ""
-  },
-  htmlEscapingLib: {
-    content: () => "Which HTML escaping library would you like to use?",
-    description: () => `
-  - If you use the Spring framework, you likely already have \`org.springframework.web.util.HtmlUtils\`
-  - Another option is \`org.apache.commons.text.StringEscapeUtils\``,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/xxe.ts
-var xxe2 = {
-  factoryVarName: {
-    content: () => "Name the new Factory variable",
-    description: () => "We needed to create a new variable for this fix. We actually like the name we picked, but maybe you follow different naming conventions, so you can change it here.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/java/index.ts
-var vulnerabilities14 = {
-  ["CMDi_relative_path_command"]: relativePathCommand,
-  ["CMDi"]: commandInjection2,
-  ["CONFUSING_NAMING"]: confusingNaming,
-  ["ERROR_CONDTION_WITHOUT_ACTION"]: errorConditionWithoutAction,
-  ["XXE"]: xxe2,
-  ["XSS"]: xss2,
-  ["PRIVACY_VIOLATION"]: privacyViolation,
-  ["PT"]: pt2,
-  ["SSRF"]: ssrf3,
-  ["LOG_FORGING"]: logForging3,
-  ["LOCALE_DEPENDENT_COMPARISON"]: localeDependentComparison,
-  ["MISSING_CHECK_AGAINST_NULL"]: missingCheckAgainstNull,
-  ["OPEN_REDIRECT"]: openRedirect,
-  ["OVERLY_BROAD_CATCH"]: overlyBroadCatch2,
-  ["SYSTEM_INFORMATION_LEAK"]: sysLeak2,
-  ["USE_OF_SYSTEM_OUTPUT_STREAM"]: useOfSystemOutputStream2,
-  ["HTTP_ONLY_COOKIE"]: httpOnlyCookie2,
-  ["UNCHECKED_LOOP_CONDITION"]: uncheckedLoopCondition,
-  ["INSECURE_COOKIE"]: insecureCookie2,
-  ["TRUST_BOUNDARY_VIOLATION"]: trustBoundaryViolation2,
-  ["UNSAFE_REFLECTION"]: unsafeReflection,
-  ["J2EE_GET_CONNECTION"]: j2eeGetConnection2,
-  ["LEFTOVER_DEBUG_CODE"]: leftoverDebugCode,
-  ["ERRONEOUS_STRING_COMPARE"]: erroneousStringCompare,
-  ["DUPLICATED_STRINGS"]: duplicatedStrings
-};
-var java_default2 = vulnerabilities14;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/python/csrf.ts
-var csrf2 = {
-  isPythonDjangoTemplate: {
-    content: () => "Is the reported file Python Django template?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/commandInjection.ts
-var commandInjection3 = {
-  isCommandExecutable: {
-    content: () => "Commands can be intrinsically unsafe if they call out to other executables or run arbitary code",
-    description: () => `Does the command fall into one of the following categories:
-
-1. An executable name:
-  - \`exec(input);\`
-  - \`exec("/bin/bash " + input);\`
-  - \`exec("/bin/sh -c" + input + " param");\`
-  - \`exec("/bin/bash -c cat file.txt | " + input);\`
-  - \`exec("/usr/bin/git --upload-pack " + input);\`
-2. A part of non-unix or cross platform shell command:
-  - \`exec("cmd.exe /c ping " + input);\`
-3. A part of programming language code:
-  - \`exec("php -r echo '" + input + "';");\`
-  - \`exec("perl -e print '" + input + "'");\``,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/graphqlDepthLimit.ts
-var graphqlDepthLimit = {
-  depthLimit: {
-    content: () => "Please define a maximum query depth",
-    description: () => `Setting this number to a reasonable value will prevent the attack.
-Make sure to pick a value large enough to allowed the nessecary amount of nested queries.`,
-    guidance: () => {
-      return "We use `graphql-depth-limit` npm package to limit the depth of nested queries. Please make sure you install the package using `npm install graphql-depth-limit`.";
-    }
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/hardcodedDomainInHtml.ts
-var hardcodedDomainInHtml = {
-  isCDNFixedVersion: {
-    content: ({ url }) => `Does the content of \`${url}\` change over time? If it does, we can't offer this fix.`,
-    description: () => "You need to make sure the content of the file you are loading from the external source is persistent. To guarantee the integrity hash does not change over time, please make sure you use a proper CDN and version of the script you are loading is pinned.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/hardcodedSecrets.ts
-var hardcodedSecrets2 = {
-  envVarName: {
-    content: () => "Please define an environment variable name",
-    description: () => `We will use this environment variable instead of the hardcoded secret`,
-    guidance: () => ""
-  },
-  keepAsDefault: {
-    content: () => "Do you want to keep the hardcoded secret in the code for now?",
-    description: () => 'Answer "yes" if you cannot set the environment variable in all environments right away.',
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/iframeWithoutSandbox.ts
-var iframeWithoutSandbox = {
-  iframeRestrictions: {
-    content: () => "Please define a comma-separated list of iframe sandbox restrictions (optional)",
-    description: () => `Possible values:
-- allow-downloads
-- allow-forms
-- allow-modals
-- allow-orientation-lock
-- allow-pointer-lock
-- allow-popups
-- allow-popups-to-escape-sandbox
-- allow-presentation
-- allow-same-origin
-- allow-scripts
-- allow-storage-access-by-user-activation
-- allow-top-navigation
-- allow-top-navigation-by-user-activation
-- allow-top-navigation-to-custom-protocols
-
-See more info [here](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox).`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/incompleteUrlSanitization.ts
-var incompleteUrlSanitization = {
-  allowedRootDomain: {
-    content: () => "The root domain of your application",
-    description: () => "We needed to strengthen the security check by ensuring that the url is under the root domain of your application.",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/insecureRandomness.ts
-var insecureRandomness2 = {
-  isGetRandomValuesSupported: {
-    content: () => "Is getRandomValues() function supported by your JavaScript engine?",
-    description: () => "[getRandomValues()](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues) is supported by [more than 97% of browsers](https://caniuse.com/?search=getRandomValues) and [Node.js >= 15.0.0](https://nodejs.org/api/webcrypto.html#cryptogetrandomvaluestypedarray).",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/logForging.ts
-var logForging4 = {
-  isHtmlDisplay: {
-    content: () => "Is the text written to the log going to be displayed as HTML?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/missingCSPHeader.ts
-var cspHeaderValue = {
-  cspHeaderValue: {
-    content: () => "Please provide the value for the Content-Security-Policy header",
-    description: () => `The Content-Security-Policy (CSP) header is a critical security measure that helps protect websites from various attacks, particularly Cross-Site Scripting (XSS) and other code injection attacks. Here's a concise explanation:
-    
-&nbsp;    
-&nbsp;
-    **What it does**:
-    
-&nbsp;    
-&nbsp;
-    CSP lets you specify which content sources the browser should consider valid, essentially creating a whitelist of trusted content. It controls things like:
-    
-&nbsp;    
-&nbsp;
-    - Which scripts can execute.    
-&nbsp;    - Where images can be loaded from.    
-&nbsp;    - Which styles can be applied.    
-&nbsp;    - Which forms can be submitted to.    
-&nbsp;    - What domains can be connected to.    
-&nbsp;    
-&nbsp;    Default value explanation:    
-&nbsp;    
-&nbsp;    - default-src 'self: Only allows resources from the same origin by default.    
-&nbsp;    - script-src 'self': Only allows scripts to be loaded from the same origin.    
-&nbsp;    - style-src 'self': Only allows styles from the same origin.    
-&nbsp;    - object-src 'none': Disallows <object>, <embed>, and <applet> elements.    
-&nbsp;    - base-uri 'self': Restricts where the <base> tag can point to.    
-&nbsp;    - frame-ancestors 'self': Ensures that only the same origin can embed the page using an iframe.
-    
-&nbsp;    
-&nbsp;    **This kind of \`CSP\` is more secure but may require adjustments for your specific application, especially if you need to load resources from external domains or use inline scripts/styles.**`,
-    guidance: () => ``
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/missingHSTSHeader.ts
-var headerMaxAge = {
-  headerMaxAge: {
-    content: () => "Please provide the maximum age of the header",
-    description: () => `This is the time, in seconds, that the browser should remember that the site is only to be accessed using \`HTTPS\`.    
-&nbsp;    
-&nbsp; 
-    Setting the \`max-age\` to \`0\` (over an https connection) will immediately expire the Strict-Transport-Security header, allowing access via \`HTTP\`.
-
-    
-&nbsp;    
-&nbsp;
-    The HTTP Strict-Transport-Security response header (\`HSTS\`) informs browsers that the site 
-    should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically 
-    be converted to HTTPS.
-
-    
-&nbsp;    
-&nbsp;
-    If a website accepts a connection through \`HTTP\` and redirects to \`HTTPS\`, visitors may initially communicate with 
-    the non-encrypted version of the site before being redirected, if, for example, the visitor 
-    types \`http://www.example.com\` or even just \`example.com\`. This creates an opportunity for a man-in-the-middle attack. 
-    The redirect could be exploited to direct visitors to a malicious site instead of the secure version of the original site.
-    
-&nbsp;    
-&nbsp;
-    The \`HTTP\` Strict Transport Security header informs the browser that it should never load a site using \`HTTP\` 
-    and should automatically convert all attempts to access the site using \`HTTP\` to \`HTTPS\` requests instead.`,
-    guidance: () => ``
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/missingXFrameOptions.ts
-var xFrameOptionsValue = {
-  xFrameOptionsValue: {
-    content: () => "Please provide the value for the X-Frame-Options header",
-    description: () => `The \`X-Frame-Options\` HTTP response header tells the browser whether the page is allowed to be rendered inside a \`<frame>\`, \`<iframe>\`, \`<embed>\` or \`<object>\`. Without it, attackers can embed your application in an invisible iframe and trick users into clicking on it \u2014 a class of attacks known as clickjacking (UI redressing).    
-&nbsp;    
-&nbsp;    **Allowed values:**    
-&nbsp;    - \`DENY\` \u2014 the page cannot be framed by any site, including your own. Recommended default for any page that does not need to be embedded.    
-&nbsp;    - \`SAMEORIGIN\` \u2014 the page can only be framed by pages served from the same origin. Use this only if your own application legitimately embeds this page in an iframe.`,
-    guidance: () => ``
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/noLimitsOrThrottling.ts
-var noLimitsOrThrottling2 = {
-  setGlobalLimiter: {
-    content: () => "Would you like to use a global rate limit for all your endpoints within the same file?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/openRedirect.ts
-var openRedirect2 = {
-  isExternal: {
-    content: () => "Does the redirect go to an external site?",
-    description: () => "",
-    guidance: () => ""
-  },
-  domainAllowlist: {
-    content: () => "Allowed domains names",
-    description: () => "please provide a coma separated list of allowed domains names (example.com, example.org, etc.)",
-    guidance: () => ""
-  },
-  pathAllowlist: {
-    content: () => "Allowed paths (URIs)",
-    description: () => "please provide a coma separated list of allowed path (/health, /api/v1/health, etc.)",
-    guidance: () => ""
-  },
-  includeProtocolValidation: {
-    content: () => "Should HTTP or HTTPS protocol be enforced?",
-    description: () => "please indicate if the protocol should be enforced",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/pt.ts
-var pt3 = {
-  taintedTermType: {
-    content: ({ expression }) => `Does \`${expression}\` represent a file name, a relative path or an absolute path?`,
-    description: ({ expression }) => `We replace all illegal file name characters for Unix, Windows, and macOS operation systems, including slashes. Ensure that \`${expression}\` isn't supposed to contain slashes or other illegal file name characters.`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/ssrf.ts
-var ssrf4 = {
-  domainsAllowlist: {
-    content: () => "List of allowed domain names",
-    description: () => `The security risk of this issue is the ability of an attacker to provide input that shoots HTTP requests from your server to arbitrary domains.
-    
-&nbsp;    
-&nbsp;    To eliminate the risk and fix the issue, check out your app logic and make a whitelist of domains the server should be allowed to call.`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/sysLeak.ts
-var sysLeak3 = {
-  errorMessage: {
-    content: () => "Enter the error message that you want to appear in the log",
-    description: () => "",
-    guidance: () => ""
-  },
-  noLoggerAction: {
-    content: () => "Which of the following you want to use instead of the vulnerable code?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/sysLeakExternal.ts
-var sysLeakExternal = {
-  errorMessage: {
-    content: () => "Enter the error message that you want to appear to the user",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/typeConfusion.ts
-var typeConfusion = {
-  argumentType: {
-    content: () => "What is the type of the HTTP argument?",
-    description: () => "What is the type of the HTTP argument?",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/uncheckedLoopCondition.ts
-var uncheckedLoopCondition2 = {
-  loopLimit: {
-    content: () => "Please define a maximum loop limit",
-    description: () => `Setting this number to a reasonable value will prevent the vulnerability`,
-    guidance: () => ""
-  },
-  varName: {
-    content: () => "Please define a variable name",
-    description: () => `We need to define a variable to be used as a counter to limit the loop`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/xss.ts
-var xss3 = {
-  containsHtml: {
-    content: () => "Does the element or variable contain HTML formatting",
-    description: () => "",
-    guidance: () => ""
-  },
-  isParamTypeString: {
-    content: () => "Is the parameter passed to the $() function a string",
-    description: () => "",
-    guidance: () => ""
-  },
-  isSanitized: {
-    content: ({ expression }) => `Is the expression \`${expression}\` supposed to be not sanitized in this context?`,
-    description: () => "You are using unsafe string substitution in the template. This means that if the expression can contain maliciously crafted data, it may lead to XSS injection. To apply the fix, you have to make sure the expression is not sanitized on the backend already, and it does not represent an HTML code block.",
-    guidance: () => ""
-  },
-  isServerSideCode: {
-    content: () => "Is this code running on the server side (a NodeJS application)",
-    description: () => "The fix to this vulnerability is different is the code runs in the client (browser) or the server side (NodeJs)",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/js/index.ts
-var vulnerabilities15 = {
-  ["CMDi"]: commandInjection3,
-  ["GRAPHQL_DEPTH_LIMIT"]: graphqlDepthLimit,
-  ["INSECURE_RANDOMNESS"]: insecureRandomness2,
-  ["SSRF"]: ssrf4,
-  ["TYPE_CONFUSION"]: typeConfusion,
-  ["INCOMPLETE_URL_SANITIZATION"]: incompleteUrlSanitization,
-  ["LOG_FORGING"]: logForging4,
-  ["XSS"]: xss3,
-  ["OPEN_REDIRECT"]: openRedirect2,
-  ["SYSTEM_INFORMATION_LEAK"]: sysLeak3,
-  ["SYSTEM_INFORMATION_LEAK_EXTERNAL"]: sysLeakExternal,
-  ["IFRAME_WITHOUT_SANDBOX"]: iframeWithoutSandbox,
-  ["PT"]: pt3,
-  ["HARDCODED_SECRETS"]: hardcodedSecrets2,
-  ["MISSING_HSTS_HEADER"]: headerMaxAge,
-  ["UNCHECKED_LOOP_CONDITION"]: uncheckedLoopCondition2,
-  ["NO_LIMITS_OR_THROTTLING"]: noLimitsOrThrottling2,
-  ["MISSING_CSP_HEADER"]: cspHeaderValue,
-  ["MISSING_X_FRAME_OPTIONS"]: xFrameOptionsValue,
-  ["HARDCODED_DOMAIN_IN_HTML"]: hardcodedDomainInHtml,
-  ["CSRF"]: csrf2
-};
-var js_default = vulnerabilities15;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/python/duplicatedStrings.ts
-var duplicatedStrings2 = {
-  constantName: {
-    content: () => "New constant name",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/python/logForging.ts
-var logForging5 = {
-  isHtmlDisplay: {
-    content: () => "Is the text written to the log going to be displayed as HTML?",
-    description: () => "",
-    guidance: ({ userInputValue }) => {
-      switch (userInputValue) {
-        case "yes":
-          return "We use `html.escape` to decode the HTML";
-        default:
-          return "";
-      }
-    }
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/python/missingEncoding.ts
-var missingEncoding = {
-  fEncoding: {
-    content: () => "Enter the encoding of the file",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/python/openRedirect.ts
-var openRedirect3 = {
-  allowed_hosts: {
-    content: () => "Allowed domains/paths",
-    description: () => "If external, provide a coma separated list of allowed domains. If internal, provide a coma seperated list of allowed paths",
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/python/ssrf.ts
-var ssrf5 = {
-  domainsAllowlist: {
-    content: () => "Allowed URL prefixes",
-    description: () => `The security risk of this issue is the ability of an attacker to provide input that shoots HTTP requests from your server to arbitrary URLs, including internal ones, like \`https://admin.mycompany.com\`    
-&nbsp;    
-&nbsp;    To eliminate the risk and fix the issue, check out your app logic and make a whitelist of URLs this API should be allowed to call.`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/python/uncheckedLoopCondition.ts
-var uncheckedLoopCondition3 = {
-  loopLimit: {
-    content: () => "Please define a maximum loop limit",
-    description: () => `Setting this number to a reasonable value will prevent the vulnerability`,
-    guidance: () => ""
-  },
-  varName: {
-    content: () => "Please define a variable name",
-    description: () => `We need to define a variable to be used as a counter to limit the loop`,
-    guidance: () => ""
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/python/index.ts
-var vulnerabilities16 = {
-  ["CSRF"]: csrf2,
-  ["LOG_FORGING"]: logForging5,
-  ["OPEN_REDIRECT"]: openRedirect3,
-  ["UNCHECKED_LOOP_CONDITION"]: uncheckedLoopCondition3,
-  ["DUPLICATED_STRINGS"]: duplicatedStrings2,
-  ["MISSING_ENCODING_FILE_OPEN"]: missingEncoding,
-  ["SSRF"]: ssrf5
-};
-var python_default2 = vulnerabilities16;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/xml/unboundedOccurrences.ts
-var unboundedOccurrences = {
-  maxOccursLimit: {
-    content: () => "The number of allowed repetitions of the element.",
-    description: () => "",
-    guidance: () => `Setting this number to a reasonable value will prevent the attack. 
-A value too low will prevent valid XMLs from being processed. 
-A value too high will cause performance issues up to and including denial of service.`
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/xml/index.ts
-var vulnerabilities17 = {
-  ["WEAK_XML_SCHEMA_UNBOUNDED_OCCURRENCES"]: unboundedOccurrences
-};
-var xml_default2 = vulnerabilities17;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/yaml/noNewPrivileges.ts
-var noNewPrivileges = {
-  requireNewPrivileges: {
-    content: () => "Does the container require new privileges?",
-    description: () => "",
-    guidance: () => `If the container requires new privileges, setting the no-new-privileges option might harm the container functionality.`
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/yaml/portAllInterfaces.ts
-var portAllInterfaces = {
-  trustedIP: {
-    content: () => "Enter trusted Network IP",
-    description: () => "",
-    guidance: () => `Properly set this value to prevent access from untrusted network adapters. Setting this to a wrong value would prevent accessing the container and might break the system.`
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/yaml/writableFilesystemService.ts
-var writableFilesystemService = {
-  requireWriteAccess: {
-    content: () => "Does the container require writable filesystem access?",
-    description: () => "",
-    guidance: () => `If the container requires writable filesystem access, setting the filesystem as readonly might harm the container functionality.`
-  }
-};
-
-// src/features/analysis/scm/shared/src/storedQuestionData/yaml/index.ts
-var vulnerabilities18 = {
-  ["PORT_ALL_INTERFACES"]: portAllInterfaces,
-  ["WRITABLE_FILESYSTEM_SERVICE"]: writableFilesystemService,
-  ["NO_NEW_PRIVILEGES"]: noNewPrivileges
-};
-var yaml_default = vulnerabilities18;
-
-// src/features/analysis/scm/shared/src/storedQuestionData/index.ts
-var StoredQuestionDataItemZ = z10.object({
-  content: z10.function().args(z10.any()).returns(z10.string()),
-  description: z10.function().args(z10.any()).returns(z10.string()),
-  guidance: z10.function().args(z10.any()).returns(z10.string())
-});
-var languages2 = {
-  ["Java" /* Java */]: java_default2,
-  ["JavaScript" /* JavaScript */]: js_default,
-  ["XML" /* Xml */]: xml_default2,
-  ["CSharp" /* CSharp */]: csharp_default2,
-  ["Python" /* Python */]: python_default2,
-  ["Go" /* Go */]: go_default2,
-  ["Cpp" /* Cpp */]: cpp_default,
-  ["YAML" /* Yaml */]: yaml_default
-};
-
-// src/features/analysis/scm/shared/src/guidances.ts
-var IssueTypeAndLanguageZ = z11.object({
-  issueType: SafeIssueTypeStringZ,
-  issueLanguage: z11.nativeEnum(IssueLanguage_Enum)
-});
 
 // src/features/analysis/scm/shared/src/index.ts
 init_issueTypeCatalog();
@@ -6195,19 +4642,19 @@ init_urlParser2();
 init_validations();
 
 // src/features/analysis/scm/types.ts
-import { z as z13 } from "zod";
+import { z as z10 } from "zod";
 var ReferenceType = /* @__PURE__ */ ((ReferenceType2) => {
   ReferenceType2["BRANCH"] = "BRANCH";
   ReferenceType2["COMMIT"] = "COMMIT";
   ReferenceType2["TAG"] = "TAG";
   return ReferenceType2;
 })(ReferenceType || {});
-var GithubFullShaZ = z13.string().regex(/^[a-f0-9]{40}$/);
-var MergedPrSurvivalMetadataZ = z13.object({
-  mergeCommitShas: z13.array(GithubFullShaZ).min(1).refine((shas) => new Set(shas).size === shas.length, {
+var GithubFullShaZ = z10.string().regex(/^[a-f0-9]{40}$/);
+var MergedPrSurvivalMetadataZ = z10.object({
+  mergeCommitShas: z10.array(GithubFullShaZ).min(1).refine((shas) => new Set(shas).size === shas.length, {
     message: "mergeCommitShas must contain unique SHAs"
   }),
-  targetBranch: z13.string().min(1)
+  targetBranch: z10.string().min(1)
 });
 var scmCloudHostname = {
   ["GitLab" /* GitLab */]: new URL(scmCloudUrl.GitLab).hostname,
@@ -6227,10 +4674,10 @@ var scmTypeToScmLibScmType = {
   ["Ado" /* Ado */]: "ADO" /* ADO */,
   ["Bitbucket" /* Bitbucket */]: "BITBUCKET" /* BITBUCKET */
 };
-var GetReferenceResultZ = z13.object({
-  date: z13.date().optional(),
-  sha: z13.string(),
-  type: z13.nativeEnum(ReferenceType)
+var GetReferenceResultZ = z10.object({
+  date: z10.date().optional(),
+  sha: z10.string(),
+  type: z10.nativeEnum(ReferenceType)
 });
 
 // src/features/analysis/scm/ado/constants.ts
@@ -6242,39 +4689,39 @@ init_env();
 import querystring from "querystring";
 import * as api from "azure-devops-node-api";
 import Debug3 from "debug";
-import { z as z17 } from "zod";
+import { z as z14 } from "zod";
 
 // src/features/analysis/scm/ado/validation.ts
-import { z as z16 } from "zod";
-var ValidPullRequestStatusZ = z16.union([
-  z16.literal(1 /* Active */),
-  z16.literal(2 /* Abandoned */),
-  z16.literal(3 /* Completed */)
+import { z as z13 } from "zod";
+var ValidPullRequestStatusZ = z13.union([
+  z13.literal(1 /* Active */),
+  z13.literal(2 /* Abandoned */),
+  z13.literal(3 /* Completed */)
 ]);
-var AdoAuthResultZ = z16.object({
-  access_token: z16.string().min(1),
-  token_type: z16.string().min(1),
-  refresh_token: z16.string().min(1)
+var AdoAuthResultZ = z13.object({
+  access_token: z13.string().min(1),
+  token_type: z13.string().min(1),
+  refresh_token: z13.string().min(1)
 });
 var AdoAuthResultWithOrgsZ = AdoAuthResultZ.extend({
-  scmOrgs: z16.array(z16.string())
+  scmOrgs: z13.array(z13.string())
 });
-var profileZ = z16.object({
-  displayName: z16.string(),
-  publicAlias: z16.string().min(1),
-  emailAddress: z16.string(),
-  coreRevision: z16.number(),
-  timeStamp: z16.string(),
-  id: z16.string(),
-  revision: z16.number()
+var profileZ = z13.object({
+  displayName: z13.string(),
+  publicAlias: z13.string().min(1),
+  emailAddress: z13.string(),
+  coreRevision: z13.number(),
+  timeStamp: z13.string(),
+  id: z13.string(),
+  revision: z13.number()
 });
-var accountsZ = z16.object({
-  count: z16.number(),
-  value: z16.array(
-    z16.object({
-      accountId: z16.string(),
-      accountUri: z16.string(),
-      accountName: z16.string()
+var accountsZ = z13.object({
+  count: z13.number(),
+  value: z13.array(
+    z13.object({
+      accountId: z13.string(),
+      accountUri: z13.string(),
+      accountName: z13.string()
     })
   )
 });
@@ -6295,39 +4742,39 @@ import querystring2 from "querystring";
 import * as bitbucketPkgNode from "bitbucket";
 import bitbucketPkg from "bitbucket";
 import Debug4 from "debug";
-import { z as z20 } from "zod";
+import { z as z17 } from "zod";
 
 // src/features/analysis/scm/bitbucket/validation.ts
-import { z as z19 } from "zod";
-var BitbucketAuthResultZ = z19.object({
-  access_token: z19.string(),
-  token_type: z19.string(),
-  refresh_token: z19.string()
+import { z as z16 } from "zod";
+var BitbucketAuthResultZ = z16.object({
+  access_token: z16.string(),
+  token_type: z16.string(),
+  refresh_token: z16.string()
 });
 
 // src/features/analysis/scm/bitbucket/bitbucket.ts
 var debug5 = Debug4("scm:bitbucket");
 var BITBUCKET_HOSTNAME = "bitbucket.org";
-var TokenExpiredErrorZ = z20.object({
-  status: z20.number(),
-  error: z20.object({
-    type: z20.string(),
-    error: z20.object({
-      message: z20.string()
+var TokenExpiredErrorZ = z17.object({
+  status: z17.number(),
+  error: z17.object({
+    type: z17.string(),
+    error: z17.object({
+      message: z17.string()
     })
   })
 });
 var BITBUCKET_ACCESS_TOKEN_URL = `https://${BITBUCKET_HOSTNAME}/site/oauth2/access_token`;
-var BitbucketParseResultZ = z20.object({
-  organization: z20.string(),
-  repoName: z20.string(),
-  hostname: z20.literal(BITBUCKET_HOSTNAME)
+var BitbucketParseResultZ = z17.object({
+  organization: z17.string(),
+  repoName: z17.string(),
+  hostname: z17.literal(BITBUCKET_HOSTNAME)
 });
-var UserWorkspacePermissionsRepositoriesResponseZ = z20.object({
-  values: z20.array(
-    z20.object({
-      repository: z20.object({
-        full_name: z20.string().optional()
+var UserWorkspacePermissionsRepositoriesResponseZ = z17.object({
+  values: z17.array(
+    z17.object({
+      repository: z17.object({
+        full_name: z17.string().optional()
       }).optional()
     })
   ).optional()
@@ -6335,7 +4782,7 @@ var UserWorkspacePermissionsRepositoriesResponseZ = z20.object({
 
 // src/features/analysis/scm/bitbucket/BitbucketSCMLib.ts
 import { setTimeout as setTimeout3 } from "timers/promises";
-import { z as z21 } from "zod";
+import { z as z18 } from "zod";
 
 // src/features/analysis/scm/constants.ts
 var REPORT_DEFAULT_FILE_NAME = "report.json";
@@ -6345,7 +4792,7 @@ init_env();
 
 // src/features/analysis/scm/github/GithubSCMLib.ts
 import pLimit3 from "p-limit";
-import { z as z22 } from "zod";
+import { z as z19 } from "zod";
 init_client_generates();
 
 // src/features/analysis/scm/github/github.ts
@@ -6378,11 +4825,11 @@ import {
 init_env();
 
 // src/features/analysis/scm/gitlab/types.ts
-import { z as z23 } from "zod";
-var GitlabAuthResultZ = z23.object({
-  access_token: z23.string(),
-  token_type: z23.string(),
-  refresh_token: z23.string()
+import { z as z20 } from "zod";
+var GitlabAuthResultZ = z20.object({
+  access_token: z20.string(),
+  token_type: z20.string(),
+  refresh_token: z20.string()
 });
 
 // src/features/analysis/scm/gitlab/gitlab.ts
@@ -6393,69 +4840,69 @@ import pLimit5 from "p-limit";
 init_client_generates();
 
 // src/features/analysis/scm/scmFactory.ts
-import { z as z24 } from "zod";
+import { z as z21 } from "zod";
 
 // src/features/analysis/graphql/gql.ts
 init_client_generates();
 
 // src/features/analysis/graphql/types.ts
 init_client_generates();
-import { z as z25 } from "zod";
-var VulnerabilityReportIssueCodeNodeZ = z25.object({
-  vulnerabilityReportIssueId: z25.string(),
-  path: z25.string(),
-  startLine: z25.number(),
-  vulnerabilityReportIssue: z25.object({
-    fixId: z25.string(),
-    category: z25.nativeEnum(Vulnerability_Report_Issue_Category_Enum),
-    safeIssueType: z25.string(),
-    vulnerabilityReportIssueTags: z25.array(
-      z25.object({
-        tag: z25.nativeEnum(Vulnerability_Report_Issue_Tag_Enum)
+import { z as z22 } from "zod";
+var VulnerabilityReportIssueCodeNodeZ = z22.object({
+  vulnerabilityReportIssueId: z22.string(),
+  path: z22.string(),
+  startLine: z22.number(),
+  vulnerabilityReportIssue: z22.object({
+    fixId: z22.string(),
+    category: z22.nativeEnum(Vulnerability_Report_Issue_Category_Enum),
+    safeIssueType: z22.string(),
+    vulnerabilityReportIssueTags: z22.array(
+      z22.object({
+        tag: z22.nativeEnum(Vulnerability_Report_Issue_Tag_Enum)
       })
     )
   })
 });
-var VulnerabilityReportIssueNoFixCodeNodeZ = z25.object({
-  vulnerabilityReportIssues: z25.array(
-    z25.object({
-      id: z25.string(),
-      fixId: z25.string().nullable(),
-      category: z25.nativeEnum(Vulnerability_Report_Issue_Category_Enum),
-      safeIssueType: z25.string(),
-      fpId: z25.string().uuid().nullable(),
-      codeNodes: z25.array(
-        z25.object({
-          path: z25.string(),
-          startLine: z25.number()
+var VulnerabilityReportIssueNoFixCodeNodeZ = z22.object({
+  vulnerabilityReportIssues: z22.array(
+    z22.object({
+      id: z22.string(),
+      fixId: z22.string().nullable(),
+      category: z22.nativeEnum(Vulnerability_Report_Issue_Category_Enum),
+      safeIssueType: z22.string(),
+      fpId: z22.string().uuid().nullable(),
+      codeNodes: z22.array(
+        z22.object({
+          path: z22.string(),
+          startLine: z22.number()
         })
       ),
-      vulnerabilityReportIssueTags: z25.array(
-        z25.object({
-          tag: z25.nativeEnum(Vulnerability_Report_Issue_Tag_Enum)
+      vulnerabilityReportIssueTags: z22.array(
+        z22.object({
+          tag: z22.nativeEnum(Vulnerability_Report_Issue_Tag_Enum)
         })
       )
     })
   )
 });
-var GetVulByNodesMetadataZ = z25.object({
-  vulnerabilityReportIssueCodeNodes: z25.array(VulnerabilityReportIssueCodeNodeZ),
-  nonFixablePrVuls: z25.object({
-    aggregate: z25.object({
-      count: z25.number()
+var GetVulByNodesMetadataZ = z22.object({
+  vulnerabilityReportIssueCodeNodes: z22.array(VulnerabilityReportIssueCodeNodeZ),
+  nonFixablePrVuls: z22.object({
+    aggregate: z22.object({
+      count: z22.number()
     })
   }),
-  fixablePrVuls: z25.object({
-    aggregate: z25.object({
-      count: z25.number()
+  fixablePrVuls: z22.object({
+    aggregate: z22.object({
+      count: z22.number()
     })
   }),
-  totalScanVulnerabilities: z25.object({
-    aggregate: z25.object({
-      count: z25.number()
+  totalScanVulnerabilities: z22.object({
+    aggregate: z22.object({
+      count: z22.number()
     })
   }),
-  irrelevantVulnerabilityReportIssue: z25.array(
+  irrelevantVulnerabilityReportIssue: z22.array(
     VulnerabilityReportIssueNoFixCodeNodeZ
   )
 });
@@ -7755,8 +6202,8 @@ var defaultLogger2 = {
     }
   }
 };
-var PromptItemZ = z26.object({
-  type: z26.enum([
+var PromptItemZ = z23.object({
+  type: z23.enum([
     "USER_PROMPT",
     "AI_RESPONSE",
     "TOOL_EXECUTION",
@@ -7764,32 +6211,32 @@ var PromptItemZ = z26.object({
     "MCP_TOOL_CALL"
     // MCP (Model Context Protocol) tool invocation
   ]),
-  attachedFiles: z26.array(
-    z26.object({
-      relativePath: z26.string(),
-      startLine: z26.number().optional()
+  attachedFiles: z23.array(
+    z23.object({
+      relativePath: z23.string(),
+      startLine: z23.number().optional()
     })
   ).optional(),
-  tokens: z26.object({
-    inputCount: z26.number(),
-    outputCount: z26.number()
+  tokens: z23.object({
+    inputCount: z23.number(),
+    outputCount: z23.number()
   }).optional(),
-  text: z26.string().optional(),
-  date: z26.date().optional(),
-  tool: z26.object({
-    name: z26.string(),
-    parameters: z26.string(),
-    result: z26.string(),
-    rawArguments: z26.string().optional(),
-    accepted: z26.boolean().optional(),
+  text: z23.string().optional(),
+  date: z23.date().optional(),
+  tool: z23.object({
+    name: z23.string(),
+    parameters: z23.string(),
+    result: z23.string(),
+    rawArguments: z23.string().optional(),
+    accepted: z23.boolean().optional(),
     // MCP-specific fields (only populated for MCP_TOOL_CALL type)
-    mcpServer: z26.string().optional(),
+    mcpServer: z23.string().optional(),
     // MCP server name (e.g., "datadog", "mobb-mcp")
-    mcpToolName: z26.string().optional()
+    mcpToolName: z23.string().optional()
     // MCP tool name without prefix (e.g., "scan_and_fix_vulnerabilities")
   }).optional()
 });
-var PromptItemArrayZ = z26.array(PromptItemZ);
+var PromptItemArrayZ = z23.array(PromptItemZ);
 var NULL_REPO_STATE = {
   repositoryUrl: null,
   branch: null,