@kubbisec/ai-linux-arm64 0.1.10 → 0.1.11

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permission-descriptions.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KUBBISEC_PERMISSION_DESCRIPTIONS = void 0;
+exports.getKubbisecPermissionDescription = getKubbisecPermissionDescription;
+exports.assertKubbisecPermissionDescriptionsComplete = assertKubbisecPermissionDescriptionsComplete;
+const kubbisec_permissions_1 = require("./kubbisec-permissions");
+/**
+ * Human-readable descriptions (pt-BR) — keep in sync with docs/core/rbac-catalog.md
+ */
+exports.KUBBISEC_PERMISSION_DESCRIPTIONS = {
+    "kbsc.org.profile.read": "Nome, slug e metadados não sensíveis da organização.",
+    "kbsc.org.profile.update": "Alterar nome, branding e metadados da organização.",
+    "kbsc.org.settings.manage": "Quotas, defaults do workspace e flags da organização.",
+    "kbsc.org.delete": "Eliminar a organização (operação irreversível).",
+    "kbsc.identity.member.read": "Listar e ver detalhes dos membros do workspace.",
+    "kbsc.identity.member.invite": "Enviar convites e definir o papel na entrada.",
+    "kbsc.identity.member.role.update": "Promover ou rebaixar papéis de membros.",
+    "kbsc.identity.member.remove": "Revogar o acesso de um membro ao workspace.",
+    "kbsc.identity.invitation.manage": "Cancelar ou reenviar convites pendentes.",
+    "kbsc.asset.project.read": "Listar projetos, ativos e repositórios ligados.",
+    "kbsc.asset.project.create": "Registar novos ativos no ASPM.",
+    "kbsc.asset.project.update": "Alterar metadados, ramo default e ligações.",
+    "kbsc.asset.project.delete": "Remover um ativo do workspace.",
+    "kbsc.finding.read": "Ver achados, vulnerabilidades e histórico.",
+    "kbsc.finding.triage.update": "Alterar estados, prioridade e comentários internos.",
+    "kbsc.finding.remediation.manage": "Gerir tickets e workflows de correção.",
+    "kbsc.finding.remediation.auto-apply": "Disparar remediação automática (branch + PR GitHub, sem merge).",
+    "kbsc.finding.export": "Exportar relatórios de achados (PDF/CSV conforme produto).",
+    "kbsc.ingest.report.create": "Ingerir relatórios de scan via API ou runner.",
+    "kbsc.ingest.coverage.create": "Ingerir dados de cobertura de testes.",
+    "kbsc.ingest.bundle.create": "Ingerir bundles de performance e artefactos.",
+    "kbsc.ingest.gate.evaluate": "Avaliar portões de qualidade durante a ingestão.",
+    "kbsc.supply.read": "Ver SBOM, pacotes e metadados de dependências.",
+    "kbsc.supply.policy.comment": "Adicionar anotações de risco sem alterar integrações.",
+    "kbsc.supply.scan.trigger": "Disparar análise manual de supply chain.",
+    "kbsc.governance.read": "Ver políticas, portões e coverage (somente leitura).",
+    "kbsc.governance.gate.manage": "Configurar limiares e regras de bloqueio.",
+    "kbsc.governance.coverage.manage": "Gerir configuração de coverage (org/projeto).",
+    "kbsc.integration.read": "Ver estado das integrações (GitHub, Jira, etc.).",
+    "kbsc.integration.connect": "Ligar integrações via OAuth ou credenciais partilhadas.",
+    "kbsc.integration.disconnect": "Desligar integrações e remover ligações.",
+    "kbsc.integration.secret.write": "Gravar tokens e segredos de integração.",
+    "kbsc.integration.issue.create": "Criar issues em trackers conectados via IA.",
+    "kbsc.integration.pr.create": "Abrir pull requests em repositórios conectados via IA.",
+    "kbsc.integration.pr.merge": "Fazer merge automático de PRs após gates aprovados.",
+    "kbsc.project.ai-autopilot.manage": "Configurar autopilot de IA do projeto (limites, ativação).",
+    "kbsc.project.ai-autopilot.run": "Disparar manualmente um ciclo do autopilot de IA.",
+    "kbsc.ci.read": "Ver pipelines, runners, execuções e histórico.",
+    "kbsc.ci.pipeline.manage": "Criar, editar e apagar definições de pipeline.",
+    "kbsc.ci.pipeline.run": "Disparar execuções manuais de pipeline.",
+    "kbsc.ci.privileged.run": "Executar jobs CI com containers privilegiados (requer runner habilitado).",
+    "kbsc.ci.runner.manage": "Registar, revogar e apagar runners.",
+    "kbsc.ci.envpack.manage": "Gerir pacotes de ambiente e ligações a projetos.",
+    "kbsc.ci.bootstrap.manage": "Gerir tokens de bootstrap para onboarding de runners.",
+    "kbsc.credential.apikey.read": "Listar metadados de API keys (sem expor o segredo).",
+    "kbsc.credential.apikey.create": "Emitir chaves para CLI e automação.",
+    "kbsc.credential.apikey.revoke": "Invalidar API keys existentes.",
+    "kbsc.notification.read": "Ver o centro de alertas e notificações.",
+    "kbsc.notification.preference.manage": "Configurar canal, frequência e silenciamento.",
+    "kbsc.ai.provider.manage": "Gerir configuração BYOK do provedor de IA.",
+    "kbsc.ai.usage.read": "Ver resumo e histórico de utilização de IA.",
+    "kbsc.ai.assistant.use": "Usar o assistente de IA in-app (sem alterar dados).",
+    "kbsc.ai.automation.auto": "Executar automação de IA em modo auto (patch, branch, merge sem revisão).",
+    "kbsc.platform.org.read": "Ver organizações de todos os tenants (staff).",
+    "kbsc.platform.org.support": "Executar ações de suporte aprovadas em organizações.",
+    "kbsc.platform.user.read": "Ver utilizadores cross-tenant para diagnóstico.",
+    "kbsc.platform.impersonate.request": "Pedir sessão de suporte com impersonação controlada.",
+    "kbsc.platform.config.manage": "Gerir configuração global da plataforma e feature flags.",
+    "kbsc.ops.metrics.read": "Ver snapshot completo de métricas operacionais da plataforma.",
+    "kbsc.billing.read": "Ver plano, trial, assinatura e resumo financeiro da organização.",
+    "kbsc.billing.manage": "Iniciar checkout Pro, portal Stripe e alterações de billing.",
+    "kbsc.contract.read": "Ver contratos Business/Pilot e estado de assinatura.",
+    "kbsc.contract.manage": "Gerir contratos e fluxos comerciais offline da organização.",
+    "kbsc.identity.member.permission.manage": "Personalizar permissões funcionais por membro (sem escopo de plataforma).",
+    "kbsc.org.security.read": "Ver postura de segurança dos membros (2FA, sessões).",
+    "kbsc.org.security.manage": "Gerir políticas de segurança do workspace.",
+    "kbsc.org.assistant.manage": "Habilitar ou desabilitar o KubbiSec Assistant na organização.",
+};
+function getKubbisecPermissionDescription(permission) {
+    return exports.KUBBISEC_PERMISSION_DESCRIPTIONS[permission];
+}
+/** Ensures every catalog permission has a pt-BR description at build/test time. */
+function assertKubbisecPermissionDescriptionsComplete() {
+    for (const permission of kubbisec_permissions_1.KUBBISEC_PERMISSIONS) {
+        const description = exports.KUBBISEC_PERMISSION_DESCRIPTIONS[permission];
+        if (!description?.trim()) {
+            throw new Error(`Missing description for permission: ${permission}`);
+        }
+    }
+}
+//# sourceMappingURL=kubbisec-permission-descriptions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permission-descriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permission-descriptions.js","sourceRoot":"","sources":["../../src/rbac/kubbisec-permission-descriptions.ts"],"names":[],"mappings":";;;AAgGA,4EAEC;AAGD,oGAOC;AA5GD,iEAAuF;AAEvF;;GAEG;AACU,QAAA,gCAAgC,GAAuC;IAClF,uBAAuB,EAAE,sDAAsD;IAC/E,yBAAyB,EAAE,oDAAoD;IAC/E,0BAA0B,EAAE,uDAAuD;IACnF,iBAAiB,EAAE,iDAAiD;IAEpE,2BAA2B,EAAE,iDAAiD;IAC9E,6BAA6B,EAAE,+CAA+C;IAC9E,kCAAkC,EAAE,yCAAyC;IAC7E,6BAA6B,EAAE,6CAA6C;IAC5E,iCAAiC,EAAE,0CAA0C;IAE7E,yBAAyB,EAAE,iDAAiD;IAC5E,2BAA2B,EAAE,gCAAgC;IAC7D,2BAA2B,EAAE,6CAA6C;IAC1E,2BAA2B,EAAE,gCAAgC;IAE7D,mBAAmB,EAAE,4CAA4C;IACjE,4BAA4B,EAAE,qDAAqD;IACnF,iCAAiC,EAAE,wCAAwC;IAC3E,qCAAqC,EACnC,iEAAiE;IACnE,qBAAqB,EAAE,4DAA4D;IAEnF,2BAA2B,EAAE,+CAA+C;IAC5E,6BAA6B,EAAE,uCAAuC;IACtE,2BAA2B,EAAE,8CAA8C;IAC3E,2BAA2B,EAAE,kDAAkD;IAE/E,kBAAkB,EAAE,gDAAgD;IACpE,4BAA4B,EAAE,uDAAuD;IACrF,0BAA0B,EAAE,0CAA0C;IAEtE,sBAAsB,EAAE,sDAAsD;IAC9E,6BAA6B,EAAE,2CAA2C;IAC1E,iCAAiC,EAAE,+CAA+C;IAElF,uBAAuB,EAAE,kDAAkD;IAC3E,0BAA0B,EAAE,yDAAyD;IACrF,6BAA6B,EAAE,0CAA0C;IACzE,+BAA+B,EAAE,yCAAyC;IAC1E,+BAA+B,EAAE,6CAA6C;IAC9E,4BAA4B,EAAE,wDAAwD;IACtF,2BAA2B,EAAE,qDAAqD;IAElF,kCAAkC,EAChC,4DAA4D;IAC9D,+BAA+B,EAAE,mDAAmD;IAEpF,cAAc,EAAE,gDAAgD;IAChE,yBAAyB,EAAE,gDAAgD;IAC3E,sBAAsB,EAAE,yCAAyC;IACjE,wBAAwB,EACtB,2EAA2E;IAC7E,uBAAuB,EAAE,qCAAqC;IAC9D,wBAAwB,EAAE,kDAAkD;IAC5E,0BAA0B,EAAE,uDAAuD;IAEnF,6BAA6B,EAAE,qDAAqD;IACpF,+BAA+B,EAAE,qCAAqC;IACtE,+BAA+B,EAAE,gCAAgC;IAEjE,wBAAwB,EAAE,yCAAyC;IACnE,qCAAqC,EAAE,+CAA+C;IAEtF,yBAAyB,EAAE,4CAA4C;IACvE,oBAAoB,EAAE,6CAA6C;IACnE,uBAAuB,EAAE,qDAAqD;IAC9E,yBAAyB,EACvB,2EAA2E;IAE7E,wBAAwB,EAAE,+CAA+C;IACzE,2BAA2B,EAAE,sDAAsD;IACnF,yBAAyB,EAAE,iDAAiD;IAC5E,mCAAmC,EACjC,sDAAsD;IACxD,6BAA6B,EAAE,0DAA0D;IAEzF,uBAAuB,EAAE,+DAA+D;IAExF,mBAAmB,EAAE,kEAAkE;IACvF,qBAAqB,EAAE,8DAA8D;IACrF,oBAAoB,EAAE,sDAAsD;IAC5E,sBAAsB,EAAE,6DAA6D;IACrF,wCAAwC,EACtC,2EAA2E;IAC7E,wBAAwB,EAAE,sDAAsD;IAChF,0BAA0B,EAAE,4CAA4C;IACxE,2BAA2B,EAAE,+DAA+D;CAC7F,CAAC;AAEF,SAAgB,gCAAgC,CAAC,UAA8B;IAC7E,OAAO,wCAAgC,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC;AAED,mFAAmF;AACnF,SAAgB,4CAA4C;IAC1D,KAAK,MAAM,UAAU,IAAI,2CAAoB,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,wCAAgC,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permissions.d.ts

@@ -0,0 +1,12 @@
+/**
+ * KubbiSec permission slugs — keep in sync with docs/core/rbac-catalog.md
+ */
+export declare const KUBBISEC_PERMISSIONS: readonly ["kbsc.org.profile.read", "kbsc.org.profile.update", "kbsc.org.settings.manage", "kbsc.org.delete", "kbsc.identity.member.read", "kbsc.identity.member.invite", "kbsc.identity.member.role.update", "kbsc.identity.member.remove", "kbsc.identity.invitation.manage", "kbsc.asset.project.read", "kbsc.asset.project.create", "kbsc.asset.project.update", "kbsc.asset.project.delete", "kbsc.finding.read", "kbsc.finding.triage.update", "kbsc.finding.remediation.manage", "kbsc.finding.remediation.auto-apply", "kbsc.finding.export", "kbsc.ingest.report.create", "kbsc.supply.read", "kbsc.supply.policy.comment", "kbsc.supply.scan.trigger", "kbsc.governance.read", "kbsc.governance.gate.manage", "kbsc.governance.coverage.manage", "kbsc.ingest.coverage.create", "kbsc.ingest.bundle.create", "kbsc.ingest.gate.evaluate", "kbsc.integration.read", "kbsc.integration.connect", "kbsc.integration.disconnect", "kbsc.integration.secret.write", "kbsc.integration.issue.create", "kbsc.integration.pr.create", "kbsc.integration.pr.merge", "kbsc.project.ai-autopilot.manage", "kbsc.project.ai-autopilot.run", "kbsc.ci.read", "kbsc.ci.pipeline.manage", "kbsc.ci.pipeline.run", "kbsc.ci.privileged.run", "kbsc.ci.runner.manage", "kbsc.ci.envpack.manage", "kbsc.ci.bootstrap.manage", "kbsc.credential.apikey.read", "kbsc.credential.apikey.create", "kbsc.credential.apikey.revoke", "kbsc.notification.read", "kbsc.notification.preference.manage", "kbsc.ai.provider.manage", "kbsc.ai.usage.read", "kbsc.ai.assistant.use", "kbsc.ai.automation.auto", "kbsc.platform.org.read", "kbsc.platform.org.support", "kbsc.platform.user.read", "kbsc.platform.impersonate.request", "kbsc.platform.config.manage", "kbsc.ops.metrics.read", "kbsc.billing.read", "kbsc.billing.manage", "kbsc.contract.read", "kbsc.contract.manage", "kbsc.identity.member.permission.manage", "kbsc.org.security.read", "kbsc.org.security.manage", "kbsc.org.assistant.manage"];
+export type KubbisecPermission = (typeof KUBBISEC_PERMISSIONS)[number];
+/** Full catalog — super admin / legacy `admin` global role. */
+export declare const ALL_KUBBISEC_PERMISSIONS: ReadonlySet<KubbisecPermission>;
+export declare const ORG_ROLE_SLUGS: readonly ["org_administrator", "org_finance", "org_security_engineer", "org_delivery_engineer", "org_observer"];
+export type OrgRoleSlug = (typeof ORG_ROLE_SLUGS)[number];
+export declare const PLATFORM_ROLE_SLUGS: readonly ["platform_super_admin", "platform_account_manager"];
+export type PlatformRoleSlug = (typeof PLATFORM_ROLE_SLUGS)[number];
+//# sourceMappingURL=kubbisec-permissions.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/kubbisec-permissions.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,oBAAoB,m4DAoEvB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,kBAAkB,CAAiC,CAAC;AAEvG,eAAO,MAAM,cAAc,iHAMjB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,eAAO,MAAM,mBAAmB,+DAAgE,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permissions.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_ROLE_SLUGS = exports.ORG_ROLE_SLUGS = exports.ALL_KUBBISEC_PERMISSIONS = exports.KUBBISEC_PERMISSIONS = void 0;
+/**
+ * KubbiSec permission slugs — keep in sync with docs/core/rbac-catalog.md
+ */
+exports.KUBBISEC_PERMISSIONS = [
+    "kbsc.org.profile.read",
+    "kbsc.org.profile.update",
+    "kbsc.org.settings.manage",
+    "kbsc.org.delete",
+    "kbsc.identity.member.read",
+    "kbsc.identity.member.invite",
+    "kbsc.identity.member.role.update",
+    "kbsc.identity.member.remove",
+    "kbsc.identity.invitation.manage",
+    "kbsc.asset.project.read",
+    "kbsc.asset.project.create",
+    "kbsc.asset.project.update",
+    "kbsc.asset.project.delete",
+    "kbsc.finding.read",
+    "kbsc.finding.triage.update",
+    "kbsc.finding.remediation.manage",
+    "kbsc.finding.remediation.auto-apply",
+    "kbsc.finding.export",
+    "kbsc.ingest.report.create",
+    "kbsc.supply.read",
+    "kbsc.supply.policy.comment",
+    "kbsc.supply.scan.trigger",
+    "kbsc.governance.read",
+    "kbsc.governance.gate.manage",
+    "kbsc.governance.coverage.manage",
+    "kbsc.ingest.coverage.create",
+    "kbsc.ingest.bundle.create",
+    "kbsc.ingest.gate.evaluate",
+    "kbsc.integration.read",
+    "kbsc.integration.connect",
+    "kbsc.integration.disconnect",
+    "kbsc.integration.secret.write",
+    "kbsc.integration.issue.create",
+    "kbsc.integration.pr.create",
+    "kbsc.integration.pr.merge",
+    "kbsc.project.ai-autopilot.manage",
+    "kbsc.project.ai-autopilot.run",
+    "kbsc.ci.read",
+    "kbsc.ci.pipeline.manage",
+    "kbsc.ci.pipeline.run",
+    "kbsc.ci.privileged.run",
+    "kbsc.ci.runner.manage",
+    "kbsc.ci.envpack.manage",
+    "kbsc.ci.bootstrap.manage",
+    "kbsc.credential.apikey.read",
+    "kbsc.credential.apikey.create",
+    "kbsc.credential.apikey.revoke",
+    "kbsc.notification.read",
+    "kbsc.notification.preference.manage",
+    "kbsc.ai.provider.manage",
+    "kbsc.ai.usage.read",
+    "kbsc.ai.assistant.use",
+    "kbsc.ai.automation.auto",
+    "kbsc.platform.org.read",
+    "kbsc.platform.org.support",
+    "kbsc.platform.user.read",
+    "kbsc.platform.impersonate.request",
+    "kbsc.platform.config.manage",
+    "kbsc.ops.metrics.read",
+    "kbsc.billing.read",
+    "kbsc.billing.manage",
+    "kbsc.contract.read",
+    "kbsc.contract.manage",
+    "kbsc.identity.member.permission.manage",
+    "kbsc.org.security.read",
+    "kbsc.org.security.manage",
+    "kbsc.org.assistant.manage",
+];
+/** Full catalog — super admin / legacy `admin` global role. */
+exports.ALL_KUBBISEC_PERMISSIONS = new Set(exports.KUBBISEC_PERMISSIONS);
+exports.ORG_ROLE_SLUGS = [
+    "org_administrator",
+    "org_finance",
+    "org_security_engineer",
+    "org_delivery_engineer",
+    "org_observer",
+];
+exports.PLATFORM_ROLE_SLUGS = ["platform_super_admin", "platform_account_manager"];
+//# sourceMappingURL=kubbisec-permissions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permissions.js","sourceRoot":"","sources":["../../src/rbac/kubbisec-permissions.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACU,QAAA,oBAAoB,GAAG;IAClC,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,iBAAiB;IACjB,2BAA2B;IAC3B,6BAA6B;IAC7B,kCAAkC;IAClC,6BAA6B;IAC7B,iCAAiC;IACjC,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,mBAAmB;IACnB,4BAA4B;IAC5B,iCAAiC;IACjC,qCAAqC;IACrC,qBAAqB;IACrB,2BAA2B;IAC3B,kBAAkB;IAClB,4BAA4B;IAC5B,0BAA0B;IAC1B,sBAAsB;IACtB,6BAA6B;IAC7B,iCAAiC;IACjC,6BAA6B;IAC7B,2BAA2B;IAC3B,2BAA2B;IAC3B,uBAAuB;IACvB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,4BAA4B;IAC5B,2BAA2B;IAC3B,kCAAkC;IAClC,+BAA+B;IAC/B,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,wBAAwB;IACxB,qCAAqC;IACrC,yBAAyB;IACzB,oBAAoB;IACpB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;IACxB,2BAA2B;IAC3B,yBAAyB;IACzB,mCAAmC;IACnC,6BAA6B;IAC7B,uBAAuB;IACvB,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,wCAAwC;IACxC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;CACnB,CAAC;AAIX,+DAA+D;AAClD,QAAA,wBAAwB,GAAoC,IAAI,GAAG,CAAC,4BAAoB,CAAC,CAAC;AAE1F,QAAA,cAAc,GAAG;IAC5B,mBAAmB;IACnB,aAAa;IACb,uBAAuB;IACvB,uBAAuB;IACvB,cAAc;CACN,CAAC;AAIE,QAAA,mBAAmB,GAAG,CAAC,sBAAsB,EAAE,0BAA0B,CAAU,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.d.ts

@@ -0,0 +1,14 @@
+import type { KubbisecPermission } from "./kubbisec-permissions";
+/** Global `user.role` values used by Better Auth admin plugin + KubbiSec platform staff. */
+export declare const GLOBAL_USER_ROLE_SLUGS: readonly ["user", "admin", "platform_super_admin", "platform_account_manager"];
+export type GlobalUserRoleSlug = (typeof GLOBAL_USER_ROLE_SLUGS)[number];
+export declare const GLOBAL_ROLE_OPTIONS: ReadonlyArray<{
+    value: GlobalUserRoleSlug;
+    label: string;
+}>;
+/** Parses comma-separated global roles from `user.role`. */
+export declare function parseGlobalUserRoles(role: string | null | undefined): string[];
+export declare function isPlatformStaffRole(role: string | null | undefined): boolean;
+export declare function hasPlatformPermission(role: string | null | undefined, permission: KubbisecPermission): boolean;
+export declare function getMergedPlatformPermissions(role: string | null | undefined): ReadonlySet<KubbisecPermission>;
+//# sourceMappingURL=platform-staff.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-staff.d.ts","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,gFAKzB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAK3F,CAAC;AAIF,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAM9E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAMT;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAQjC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GLOBAL_ROLE_OPTIONS = exports.GLOBAL_USER_ROLE_SLUGS = void 0;
+exports.parseGlobalUserRoles = parseGlobalUserRoles;
+exports.isPlatformStaffRole = isPlatformStaffRole;
+exports.hasPlatformPermission = hasPlatformPermission;
+exports.getMergedPlatformPermissions = getMergedPlatformPermissions;
+const resolve_platform_permissions_1 = require("./resolve-platform-permissions");
+/** Global `user.role` values used by Better Auth admin plugin + KubbiSec platform staff. */
+exports.GLOBAL_USER_ROLE_SLUGS = [
+    "user",
+    "admin",
+    "platform_super_admin",
+    "platform_account_manager",
+];
+exports.GLOBAL_ROLE_OPTIONS = [
+    { value: "user", label: "Utilizador" },
+    { value: "admin", label: "Administrador da plataforma" },
+    { value: "platform_super_admin", label: "Super administrador da plataforma" },
+    { value: "platform_account_manager", label: "Gestor de contas" },
+];
+const STAFF_ROLE_SET = new Set(["admin", "platform_super_admin", "platform_account_manager"]);
+/** Parses comma-separated global roles from `user.role`. */
+function parseGlobalUserRoles(role) {
+    if (!role?.trim())
+        return ["user"];
+    return role
+        .split(",")
+        .map((r) => r.trim())
+        .filter(Boolean);
+}
+function isPlatformStaffRole(role) {
+    return parseGlobalUserRoles(role).some((r) => STAFF_ROLE_SET.has(r));
+}
+function hasPlatformPermission(role, permission) {
+    const roles = parseGlobalUserRoles(role);
+    for (const r of roles) {
+        if ((0, resolve_platform_permissions_1.getPlatformPermissionsFromGlobalUserRole)(r).has(permission))
+            return true;
+    }
+    return false;
+}
+function getMergedPlatformPermissions(role) {
+    const merged = new Set();
+    for (const r of parseGlobalUserRoles(role)) {
+        for (const p of (0, resolve_platform_permissions_1.getPlatformPermissionsFromGlobalUserRole)(r)) {
+            merged.add(p);
+        }
+    }
+    return merged;
+}
+//# sourceMappingURL=platform-staff.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-staff.js","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":";;;AAuBA,oDAMC;AAED,kDAEC;AAED,sDASC;AAED,oEAUC;AAvDD,iFAA0F;AAE1F,4FAA4F;AAC/E,QAAA,sBAAsB,GAAG;IACpC,MAAM;IACN,OAAO;IACP,sBAAsB;IACtB,0BAA0B;CAClB,CAAC;AAIE,QAAA,mBAAmB,GAAgE;IAC9F,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;IACtC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE;IACxD,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAC7E,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,kBAAkB,EAAE;CACjE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEtG,4DAA4D;AAC5D,SAAgB,oBAAoB,CAAC,IAA+B;IAClE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAA+B;IACjE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAA+B,EAC/B,UAA8B;IAE9B,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,4BAA4B,CAC1C,IAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.d.ts

@@ -0,0 +1,10 @@
+import { normalizeStoredOrgRole } from "./better-auth-org-roles";
+import type { KubbisecPermission, OrgRoleSlug } from "./kubbisec-permissions";
+/** Maps stored org roles (Kubbisec slugs + legacy Better Auth) → canonical `OrgRoleSlug`. */
+export declare const normalizeOrgMemberRole: typeof normalizeStoredOrgRole;
+/** Effective tenant permissions for an organization member role (see rbac-catalog.md §4). */
+export declare function getTenantPermissionsForOrgRole(role: OrgRoleSlug): ReadonlySet<KubbisecPermission>;
+/** Full tenant permission set (e.g. API-key-only automation, parity with org admin). */
+export declare function getAllTenantPermissions(): ReadonlySet<KubbisecPermission>;
+export declare function parseApiKeyPermissionsJson(raw: string | Record<string, unknown> | unknown[] | null | undefined): KubbisecPermission[] | null;
+//# sourceMappingURL=resolve-org-permissions.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-org-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/resolve-org-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE9E,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,+BAAyB,CAAC;AAqE7D,6FAA6F;AAC7F,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,CA+FjG;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAEzE;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,GAAG,SAAS,GACnE,kBAAkB,EAAE,GAAG,IAAI,CAqB7B"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeOrgMemberRole = void 0;
+exports.getTenantPermissionsForOrgRole = getTenantPermissionsForOrgRole;
+exports.getAllTenantPermissions = getAllTenantPermissions;
+exports.parseApiKeyPermissionsJson = parseApiKeyPermissionsJson;
+const better_auth_org_roles_1 = require("./better-auth-org-roles");
+/** Maps stored org roles (Kubbisec slugs + legacy Better Auth) → canonical `OrgRoleSlug`. */
+exports.normalizeOrgMemberRole = better_auth_org_roles_1.normalizeStoredOrgRole;
+const ALL_TENANT = new Set([
+    "kbsc.org.profile.read",
+    "kbsc.org.profile.update",
+    "kbsc.org.settings.manage",
+    "kbsc.org.delete",
+    "kbsc.identity.member.read",
+    "kbsc.identity.member.invite",
+    "kbsc.identity.member.role.update",
+    "kbsc.identity.member.remove",
+    "kbsc.identity.invitation.manage",
+    "kbsc.asset.project.read",
+    "kbsc.asset.project.create",
+    "kbsc.asset.project.update",
+    "kbsc.asset.project.delete",
+    "kbsc.finding.read",
+    "kbsc.finding.triage.update",
+    "kbsc.finding.remediation.manage",
+    "kbsc.finding.remediation.auto-apply",
+    "kbsc.finding.export",
+    "kbsc.ingest.report.create",
+    "kbsc.supply.read",
+    "kbsc.supply.policy.comment",
+    "kbsc.supply.scan.trigger",
+    "kbsc.governance.read",
+    "kbsc.governance.gate.manage",
+    "kbsc.governance.coverage.manage",
+    "kbsc.ingest.coverage.create",
+    "kbsc.ingest.gate.evaluate",
+    "kbsc.integration.read",
+    "kbsc.integration.connect",
+    "kbsc.integration.disconnect",
+    "kbsc.integration.secret.write",
+    "kbsc.integration.issue.create",
+    "kbsc.integration.pr.create",
+    "kbsc.ci.read",
+    "kbsc.ci.pipeline.manage",
+    "kbsc.ci.pipeline.run",
+    "kbsc.ci.privileged.run",
+    "kbsc.ci.runner.manage",
+    "kbsc.ci.envpack.manage",
+    "kbsc.ci.bootstrap.manage",
+    "kbsc.credential.apikey.read",
+    "kbsc.credential.apikey.create",
+    "kbsc.credential.apikey.revoke",
+    "kbsc.notification.read",
+    "kbsc.notification.preference.manage",
+    "kbsc.ai.provider.manage",
+    "kbsc.ai.usage.read",
+    "kbsc.ai.assistant.use",
+    "kbsc.ai.automation.auto",
+    "kbsc.project.ai-autopilot.manage",
+    "kbsc.project.ai-autopilot.run",
+    "kbsc.integration.pr.merge",
+    "kbsc.billing.read",
+    "kbsc.billing.manage",
+    "kbsc.contract.read",
+    "kbsc.contract.manage",
+    "kbsc.identity.member.permission.manage",
+    "kbsc.org.security.read",
+    "kbsc.org.security.manage",
+    "kbsc.org.assistant.manage",
+].map((p) => p));
+/** Effective tenant permissions for an organization member role (see rbac-catalog.md §4). */
+function getTenantPermissionsForOrgRole(role) {
+    switch (role) {
+        case "org_administrator":
+            return ALL_TENANT;
+        case "org_finance":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.billing.read",
+                "kbsc.billing.manage",
+                "kbsc.contract.read",
+                "kbsc.contract.manage",
+                "kbsc.notification.read",
+            ]);
+        case "org_security_engineer":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.asset.project.read",
+                "kbsc.asset.project.create",
+                "kbsc.asset.project.update",
+                "kbsc.finding.read",
+                "kbsc.finding.triage.update",
+                "kbsc.finding.remediation.manage",
+                "kbsc.finding.remediation.auto-apply",
+                "kbsc.finding.export",
+                "kbsc.ingest.report.create",
+                "kbsc.supply.read",
+                "kbsc.supply.policy.comment",
+                "kbsc.supply.scan.trigger",
+                "kbsc.governance.read",
+                "kbsc.governance.gate.manage",
+                "kbsc.governance.coverage.manage",
+                "kbsc.ingest.coverage.create",
+                "kbsc.ingest.gate.evaluate",
+                "kbsc.integration.read",
+                "kbsc.integration.connect",
+                "kbsc.ci.read",
+                "kbsc.credential.apikey.read",
+                "kbsc.notification.read",
+                "kbsc.notification.preference.manage",
+                "kbsc.ai.usage.read",
+                "kbsc.ai.assistant.use",
+                "kbsc.project.ai-autopilot.run",
+            ]);
+        case "org_delivery_engineer":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.asset.project.read",
+                "kbsc.asset.project.create",
+                "kbsc.asset.project.update",
+                "kbsc.finding.read",
+                "kbsc.finding.export",
+                "kbsc.ingest.report.create",
+                "kbsc.supply.read",
+                "kbsc.supply.scan.trigger",
+                "kbsc.governance.read",
+                "kbsc.governance.coverage.manage",
+                "kbsc.ingest.coverage.create",
+                "kbsc.ingest.gate.evaluate",
+                "kbsc.integration.read",
+                "kbsc.integration.connect",
+                "kbsc.integration.disconnect",
+                "kbsc.integration.secret.write",
+                "kbsc.ci.read",
+                "kbsc.ci.pipeline.manage",
+                "kbsc.ci.pipeline.run",
+                "kbsc.ci.runner.manage",
+                "kbsc.ci.envpack.manage",
+                "kbsc.ci.bootstrap.manage",
+                "kbsc.credential.apikey.read",
+                "kbsc.credential.apikey.create",
+                "kbsc.credential.apikey.revoke",
+                "kbsc.notification.read",
+                "kbsc.notification.preference.manage",
+                "kbsc.ai.usage.read",
+                "kbsc.ai.assistant.use",
+            ]);
+        case "org_observer":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.asset.project.read",
+                "kbsc.finding.read",
+                "kbsc.finding.export",
+                "kbsc.supply.read",
+                "kbsc.governance.read",
+                "kbsc.integration.read",
+                "kbsc.ci.read",
+                "kbsc.notification.read",
+                "kbsc.ai.usage.read",
+                "kbsc.ai.assistant.use",
+            ]);
+    }
+}
+/** Full tenant permission set (e.g. API-key-only automation, parity with org admin). */
+function getAllTenantPermissions() {
+    return ALL_TENANT;
+}
+function parseApiKeyPermissionsJson(raw) {
+    if (raw == null)
+        return null;
+    try {
+        const v = typeof raw === "string" ? (raw.trim() === "" ? null : JSON.parse(raw)) : raw;
+        if (v == null)
+            return null;
+        const rawPermissions = Array.isArray(v)
+            ? v
+            : typeof v === "object" && v !== null
+                ? Object.values(v).flatMap((value) => (Array.isArray(value) ? value : []))
+                : null;
+        if (!rawPermissions)
+            return null;
+        const out = new Set();
+        for (const x of rawPermissions) {
+            if (typeof x === "string" && ALL_TENANT.has(x)) {
+                out.add(x);
+            }
+        }
+        return out.size ? [...out] : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=resolve-org-permissions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-org-permissions.js","sourceRoot":"","sources":["../../src/rbac/resolve-org-permissions.ts"],"names":[],"mappings":";;;AA0EA,wEA+FC;AAGD,0DAEC;AAED,gEAuBC;AAvMD,mEAAiE;AAGjE,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,8CAAsB,CAAC;AAE7D,MAAM,UAAU,GAAoC,IAAI,GAAG,CAEvD;IACE,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,iBAAiB;IACjB,2BAA2B;IAC3B,6BAA6B;IAC7B,kCAAkC;IAClC,6BAA6B;IAC7B,iCAAiC;IACjC,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,mBAAmB;IACnB,4BAA4B;IAC5B,iCAAiC;IACjC,qCAAqC;IACrC,qBAAqB;IACrB,2BAA2B;IAC3B,kBAAkB;IAClB,4BAA4B;IAC5B,0BAA0B;IAC1B,sBAAsB;IACtB,6BAA6B;IAC7B,iCAAiC;IACjC,6BAA6B;IAC7B,2BAA2B;IAC3B,uBAAuB;IACvB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,4BAA4B;IAC5B,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,wBAAwB;IACxB,qCAAqC;IACrC,yBAAyB;IACzB,oBAAoB;IACpB,uBAAuB;IACvB,yBAAyB;IACzB,kCAAkC;IAClC,+BAA+B;IAC/B,2BAA2B;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,wCAAwC;IACxC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;CAE9B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAuB,CAAC,CACtC,CAAC;AAEF,6FAA6F;AAC7F,SAAgB,8BAA8B,CAAC,IAAiB;IAC9D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB;YACtB,OAAO,UAAU,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,mBAAmB;gBACnB,qBAAqB;gBACrB,oBAAoB;gBACpB,sBAAsB;gBACtB,wBAAwB;aACzB,CAAC,CAAC;QACL,KAAK,uBAAuB;YAC1B,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,2BAA2B;gBAC3B,2BAA2B;gBAC3B,mBAAmB;gBACnB,4BAA4B;gBAC5B,iCAAiC;gBACjC,qCAAqC;gBACrC,qBAAqB;gBACrB,2BAA2B;gBAC3B,kBAAkB;gBAClB,4BAA4B;gBAC5B,0BAA0B;gBAC1B,sBAAsB;gBACtB,6BAA6B;gBAC7B,iCAAiC;gBACjC,6BAA6B;gBAC7B,2BAA2B;gBAC3B,uBAAuB;gBACvB,0BAA0B;gBAC1B,cAAc;gBACd,6BAA6B;gBAC7B,wBAAwB;gBACxB,qCAAqC;gBACrC,oBAAoB;gBACpB,uBAAuB;gBACvB,+BAA+B;aAChC,CAAC,CAAC;QACL,KAAK,uBAAuB;YAC1B,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,2BAA2B;gBAC3B,2BAA2B;gBAC3B,mBAAmB;gBACnB,qBAAqB;gBACrB,2BAA2B;gBAC3B,kBAAkB;gBAClB,0BAA0B;gBAC1B,sBAAsB;gBACtB,iCAAiC;gBACjC,6BAA6B;gBAC7B,2BAA2B;gBAC3B,uBAAuB;gBACvB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,cAAc;gBACd,yBAAyB;gBACzB,sBAAsB;gBACtB,uBAAuB;gBACvB,wBAAwB;gBACxB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,+BAA+B;gBAC/B,wBAAwB;gBACxB,qCAAqC;gBACrC,oBAAoB;gBACpB,uBAAuB;aACxB,CAAC,CAAC;QACL,KAAK,cAAc;YACjB,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,mBAAmB;gBACnB,qBAAqB;gBACrB,kBAAkB;gBAClB,sBAAsB;gBACtB,uBAAuB;gBACvB,cAAc;gBACd,wBAAwB;gBACxB,oBAAoB;gBACpB,uBAAuB;aACxB,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAgB,uBAAuB;IACrC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,0BAA0B,CACxC,GAAoE;IAEpE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvF,IAAI,CAAC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;gBACnC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC1E,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,CAAuB,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,GAAG,CAAC,CAAuB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.d.ts

@@ -0,0 +1,7 @@
+import { type KubbisecPermission } from "./kubbisec-permissions";
+/**
+ * Maps global `user.role` (Better Auth admin plugin uses `admin`) + future slugs.
+ * `admin` and `platform_super_admin` receive the full `kbsc.*` catalog (tenant + platform).
+ */
+export declare function getPlatformPermissionsFromGlobalUserRole(role: string | null | undefined): ReadonlySet<KubbisecPermission>;
+//# sourceMappingURL=resolve-platform-permissions.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-platform-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/resolve-platform-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAO3F;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAMjC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPlatformPermissionsFromGlobalUserRole = getPlatformPermissionsFromGlobalUserRole;
+const kubbisec_permissions_1 = require("./kubbisec-permissions");
+const PLATFORM_ACCOUNT_MANAGER = new Set([
+    "kbsc.platform.org.read",
+    "kbsc.platform.user.read",
+]);
+/**
+ * Maps global `user.role` (Better Auth admin plugin uses `admin`) + future slugs.
+ * `admin` and `platform_super_admin` receive the full `kbsc.*` catalog (tenant + platform).
+ */
+function getPlatformPermissionsFromGlobalUserRole(role) {
+    if (!role)
+        return new Set();
+    const r = role.trim();
+    if (r === "admin" || r === "platform_super_admin")
+        return kubbisec_permissions_1.ALL_KUBBISEC_PERMISSIONS;
+    if (r === "platform_account_manager")
+        return PLATFORM_ACCOUNT_MANAGER;
+    return new Set();
+}
+//# sourceMappingURL=resolve-platform-permissions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-platform-permissions.js","sourceRoot":"","sources":["../../src/rbac/resolve-platform-permissions.ts"],"names":[],"mappings":";;AAWA,4FAQC;AAnBD,iEAA2F;AAE3F,MAAM,wBAAwB,GAAoC,IAAI,GAAG,CAAC;IACxE,wBAAwB;IACxB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,wCAAwC,CACtD,IAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,sBAAsB;QAAE,OAAO,+CAAwB,CAAC;IACnF,IAAI,CAAC,KAAK,0BAA0B;QAAE,OAAO,wBAAwB,CAAC;IACtE,OAAO,IAAI,GAAG,EAAE,CAAC;AACnB,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/redaction.d.ts

@@ -0,0 +1,13 @@
+export declare const REDACTED_VALUE = "[REDACTED]";
+export type RedactionOptions = {
+    redactRawData?: boolean;
+    redactMetadata?: boolean;
+};
+export declare function redactSensitiveData<T>(value: T): T;
+export declare function sanitizeReportPayload<T extends {
+    metadata?: Record<string, unknown>;
+    vulnerabilities?: Array<{
+        rawData?: Record<string, unknown>;
+    }>;
+}>(report: T, options?: RedactionOptions): T;
+//# sourceMappingURL=redaction.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,eAAe,CAAC;AAiD3C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AA+LF,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA2ClD;AAED,wBAAgB,qBAAqB,CACnC,CAAC,SAAS;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAChE,EACD,MAAM,EAAE,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,CAAC,CA0B9C"}