@kubbisec/ai-linux-arm64 0.1.23 → 0.1.25

package/bundled/node_modules/@kubbisec/shared/dist/product-docs/security-scanner-playbooks.js

@@ -0,0 +1,600 @@
+"use strict";
+/**
+ * Operational playbooks for ASPM scanners (CLI + NAUS).
+ * Duplicated from web guides — API must not import apps/web.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAYBOOK_ASPM_MATRIX_EXAMPLE = exports.SCANNER_META = exports.SECURITY_SCANNER_IDS = void 0;
+exports.listPlaybookNausKindAspmSnippets = listPlaybookNausKindAspmSnippets;
+exports.wrapPlaybookSnippetAsPipelineYaml = wrapPlaybookSnippetAsPipelineYaml;
+exports.isSecurityScannerId = isSecurityScannerId;
+exports.parseSecurityScannerPlaybookArgs = parseSecurityScannerPlaybookArgs;
+exports.buildSecurityScannersCatalogPayload = buildSecurityScannersCatalogPayload;
+exports.buildSecurityScannerPlaybookPayload = buildSecurityScannerPlaybookPayload;
+exports.SECURITY_SCANNER_IDS = [
+    "trivy",
+    "gitleaks",
+    "syft",
+    "osv",
+    "semgrep",
+    "sonar",
+    "nmap",
+    "skipfish",
+];
+const ASPM_CLI_INSTALL = "npm install -g @kubbisec/aspm";
+const NAUS_CLI_INSTALL = "npm install -g @kubbisec/naus";
+const NAUS_CLOUD_DEFAULTS = {
+    enrollUrl: "https://enroll.kubbisec.com",
+    apiUrl: "https://api.kubbisec.com",
+};
+const NAUS_CLI_OPS = {
+    install: NAUS_CLI_INSTALL,
+    validate: "naus validate <pipeline.yml>",
+    check: "naus check <pipeline.yml> (alias of validate)",
+    plan: "naus plan <pipeline.yml> [--format mermaid] [--env-file .env]... [--secret-file .secrets]...",
+    run: "naus run <pipeline.yml> [--env-file .env]... [--secret-file .secrets]... (defaults: .env / .secrets in cwd when present)",
+    register: "naus register [bootstrap-token] [--renew]",
+    start: "naus start",
+    migrate: "naus migrate (legacy token → mTLS certificate)",
+    daemon: "naus daemon list | naus daemon stop",
+    docs: "naus_pipeline_docs (20 web sections + runner-management)",
+    kbsLocalTools: ["naus_local_validate", "naus_local_plan", "naus_local_run"],
+    kbsCloudTools: ["naus_validate_yaml", "trigger_run", "set_pipeline_yaml"],
+};
+exports.SCANNER_META = {
+    trivy: {
+        label: "Trivy",
+        category: "sca",
+        capabilities: ["filesystem CVEs", "container images", "IaC misconfig", "licenses"],
+        defaultReportFile: "trivy-report.json",
+        reportFormats: ["json"],
+        uploadSource: "trivy",
+    },
+    gitleaks: {
+        label: "Gitleaks",
+        category: "secrets",
+        capabilities: ["secrets in git history", "pre-commit hooks"],
+        defaultReportFile: "gitleaks-report.json",
+        reportFormats: ["json", "sarif"],
+        uploadSource: "gitleaks",
+    },
+    syft: {
+        label: "Syft",
+        category: "sbom",
+        capabilities: ["SBOM generation", "CycloneDX", "SPDX"],
+        defaultReportFile: "sbom.json",
+        reportFormats: ["cyclonedx-json", "spdx-json"],
+        uploadSource: "syft",
+    },
+    osv: {
+        label: "OSV-Scanner",
+        category: "sca",
+        capabilities: ["dependency advisories", "lockfiles", "monorepos"],
+        defaultReportFile: "osv-report.json",
+        reportFormats: ["json"],
+        uploadSource: "osv",
+    },
+    semgrep: {
+        label: "Semgrep",
+        category: "sast",
+        capabilities: ["SAST rules", "custom policies", "CI gates"],
+        defaultReportFile: "semgrep-report.json",
+        reportFormats: ["json", "sarif"],
+        uploadSource: "semgrep",
+    },
+    sonar: {
+        label: "SonarQube",
+        category: "sast",
+        capabilities: ["SAST", "code smells", "quality gates via Sonar server"],
+        defaultReportFile: "sonar-report.json",
+        reportFormats: ["json"],
+        uploadSource: "sonar",
+    },
+    nmap: {
+        label: "Nmap",
+        category: "network",
+        capabilities: ["port scan", "service detection", "XML export"],
+        defaultReportFile: "nmap-report.xml",
+        reportFormats: ["xml"],
+        uploadSource: "nmap",
+    },
+    skipfish: {
+        label: "Skipfish",
+        category: "dast",
+        capabilities: ["web crawling", "fuzzing", "DAST-style findings"],
+        defaultReportFile: "skipfish-report.json",
+        reportFormats: ["json"],
+        uploadSource: "skipfish",
+    },
+};
+const PLAYBOOKS = {
+    trivy: {
+        install: {
+            linux: {
+                install: "curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin",
+                extras: [
+                    {
+                        label: "Docker (latest)",
+                        code: 'docker run --rm -v "$(pwd):/work" -w /work aquasec/trivy:latest fs --format json -o trivy-report.json .',
+                    },
+                ],
+            },
+            macos: {
+                install: "brew install trivy",
+                extras: [
+                    {
+                        label: "Gerar relatório (CLI)",
+                        code: "trivy fs --format json --output trivy-report.json .",
+                    },
+                ],
+            },
+            windows: {
+                install: "winget install --id AquaSecurity.Trivy -e",
+                extras: [
+                    { label: "Chocolatey", code: "choco install trivy -y" },
+                    {
+                        label: "Docker",
+                        code: 'docker run --rm -v "${PWD}:/work" -w /work aquasec/trivy:latest fs --format json -o trivy-report.json .',
+                    },
+                ],
+            },
+        },
+        body: {
+            scan: {
+                linux: "trivy fs --format json --output trivy-report.json .",
+                macos: "trivy fs --format json --output trivy-report.json .",
+                windows: "trivy fs --format json --output trivy-report.json .",
+            },
+            upload: 'aspm upload "trivy-report.json" -s trivy -p <project-id> -k <api-key> -o <org-id>',
+            formats: "JSON (default). Image scan: trivy image --format json -o trivy-report.json <image>",
+            naus: {
+                kindAspm: `run:
+  - trivy-scan:
+      kind: aspm
+      tool: trivy
+      mode: scan-and-upload
+      display_name: "Trivy Security Scan"`,
+                kindAspmMatrix: `parallel:
+  - tool: trivy
+    format: json`,
+                kindDockerAspmTrivy: `kind: docker
+registry:
+  server: <registry>
+  auth: { username: "<user>", password: "$REGISTRY_TOKEN" }
+tags: ["<registry>/app:tag"]
+aspm:
+  tool: trivy
+  report_path: trivy-image-report.json
+  scan: { severity: "HIGH,CRITICAL", exit_code: 0 }
+  gate:
+    rules:
+      vulnerabilities:
+        max_by_severity: { CRITICAL: 0 }`,
+            },
+        },
+    },
+    gitleaks: {
+        install: {
+            linux: {
+                install: "curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz | tar -xz -C /usr/local/bin",
+                extras: [
+                    {
+                        label: "Docker",
+                        code: 'docker run --rm -v "$(pwd):/work" -w /work zricethezav/gitleaks detect --source . --report-format json --report-path gitleaks-report.json --exit-code 0',
+                    },
+                ],
+            },
+            macos: {
+                install: "brew install gitleaks",
+                extras: [
+                    {
+                        label: "Docker",
+                        code: 'docker run --rm -v "$(pwd):/work" -w /work zricethezav/gitleaks detect --source . --report-format json --report-path gitleaks-report.json --exit-code 0',
+                    },
+                ],
+            },
+            windows: {
+                install: "choco install gitleaks -y",
+                extras: [{ label: "winget", code: "winget install --id Gitleaks.Gitleaks -e" }],
+            },
+        },
+        body: {
+            scan: {
+                linux: "gitleaks detect --source . --report-format json --report-path gitleaks-report.json --exit-code 0",
+                macos: "gitleaks detect --source . --report-format json --report-path gitleaks-report.json --exit-code 0",
+                windows: "gitleaks detect --source . --report-format json --report-path gitleaks-report.json --exit-code 0",
+            },
+            upload: 'aspm upload "gitleaks-report.json" -s gitleaks -p <project-id> -k <api-key> -o <org-id>',
+            formats: "JSON or SARIF via --report-format",
+            naus: {
+                kindAspm: `run:
+  - secrets:
+      kind: aspm
+      tool: gitleaks
+      mode: scan-and-upload`,
+                kindAspmMatrix: `parallel:
+  - tool: gitleaks`,
+            },
+        },
+    },
+    syft: {
+        install: {
+            linux: {
+                install: "curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin",
+                extras: [
+                    {
+                        label: "Docker",
+                        code: 'docker run --rm -v "$(pwd):/work" -w /work anchore/syft dir:/work -o cyclonedx-json=sbom.json',
+                    },
+                ],
+            },
+            macos: { install: "brew install syft" },
+            windows: { install: "winget install --id Anchore.Syft -e" },
+        },
+        body: {
+            scan: {
+                linux: "syft dir:. -o cyclonedx-json=sbom.json",
+                macos: "syft dir:. -o cyclonedx-json=sbom.json",
+                windows: "syft dir:. -o cyclonedx-json=sbom.json",
+            },
+            upload: 'aspm upload "sbom.json" -s syft -p <project-id> -k <api-key> -o <org-id>',
+            formats: "cyclonedx-json (default sbom.json), spdx-json",
+            naus: {
+                kindAspm: `run:
+  - sbom:
+      kind: aspm
+      tool: syft
+      mode: scan-and-upload`,
+                kindAspmMatrix: `parallel:
+  - tool: syft
+    format: cyclonedx-json`,
+            },
+        },
+    },
+    osv: {
+        install: {
+            linux: {
+                install: "go install github.com/google/osv-scanner/cmd/osv-scanner@latest",
+                extras: [
+                    {
+                        label: "Binary download",
+                        code: "curl -sSL https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64 -o osv-scanner && chmod +x osv-scanner",
+                    },
+                ],
+            },
+            macos: { install: "brew install osv-scanner" },
+            windows: {
+                install: "winget install --id Google.OSVScanner -e",
+                extras: [{ label: "Chocolatey", code: "choco install osv-scanner -y" }],
+            },
+        },
+        body: {
+            scan: {
+                linux: "osv-scanner scan --recursive --format json --output osv-report.json .",
+                macos: "osv-scanner scan --recursive --format json --output osv-report.json .",
+                windows: "osv-scanner scan --recursive --format json --output osv-report.json .",
+            },
+            upload: 'aspm upload "osv-report.json" -s osv -p <project-id> -k <api-key> -o <org-id>',
+            formats: "JSON",
+            naus: {
+                kindAspm: `run:
+  - deps:
+      kind: aspm
+      tool: osv
+      mode: scan-and-upload`,
+                kindAspmMatrix: `parallel:
+  - tool: osv`,
+            },
+        },
+    },
+    semgrep: {
+        install: {
+            linux: {
+                install: "pip install semgrep",
+                extras: [
+                    {
+                        label: "Docker",
+                        code: 'docker run --rm -v "$(pwd):/work" -w /work semgrep/semgrep semgrep scan --config auto --json -o semgrep-report.json /work',
+                    },
+                ],
+            },
+            macos: {
+                install: "brew install semgrep",
+                extras: [
+                    {
+                        label: "Docker",
+                        code: 'docker run --rm -v "$(pwd):/work" -w /work semgrep/semgrep semgrep scan --config auto --json -o semgrep-report.json /work',
+                    },
+                ],
+            },
+            windows: {
+                install: "pip install semgrep",
+                extras: [
+                    {
+                        label: "Docker",
+                        code: 'docker run --rm -v "%cd%:/work" -w /work semgrep/semgrep semgrep scan --config auto --json -o semgrep-report.json /work',
+                    },
+                ],
+            },
+        },
+        body: {
+            scan: {
+                linux: "semgrep scan --config auto --json -o semgrep-report.json",
+                macos: "semgrep scan --config auto --json -o semgrep-report.json",
+                windows: "semgrep scan --config auto --json -o semgrep-report.json",
+            },
+            upload: 'aspm upload "semgrep-report.json" -s semgrep -p <project-id> -k <api-key> -o <org-id>',
+            formats: "JSON, SARIF",
+            naus: {
+                kindAspm: `run:
+  - sast:
+      kind: aspm
+      tool: semgrep
+      mode: scan-and-upload
+      display_name: "Semgrep SAST"`,
+                kindAspmMatrix: `parallel:
+  - tool: semgrep`,
+            },
+        },
+    },
+    sonar: {
+        install: {
+            linux: {
+                install: "mkdir -p /tmp/sonar-local # copie docker-compose.yml e setup-and-scan.sh das tabs Sonar",
+                extras: [
+                    {
+                        label: "Subir Sonar local + scan rápido",
+                        code: "docker compose -f /tmp/sonar-local/docker-compose.yml up -d && /tmp/sonar-local/setup-and-scan.sh",
+                    },
+                    {
+                        label: "Export issues (SonarCloud ou server existente)",
+                        code: 'curl -fsSL -H "Authorization: Bearer $SONAR_TOKEN" "$SONAR_HOST_URL/api/issues/search?componentKeys=$SONAR_PROJECT_KEY&ps=500" -o sonar-report.json',
+                    },
+                ],
+            },
+            macos: {
+                install: "mkdir -p /tmp/sonar-local # copie docker-compose.yml e setup-and-scan.sh das tabs Sonar",
+                extras: [
+                    {
+                        label: "Subir Sonar local + scan rápido",
+                        code: "docker compose -f /tmp/sonar-local/docker-compose.yml up -d && /tmp/sonar-local/setup-and-scan.sh",
+                    },
+                    {
+                        label: "Export issues (SonarCloud ou server existente)",
+                        code: 'curl -fsSL -H "Authorization: Bearer $SONAR_TOKEN" "$SONAR_HOST_URL/api/issues/search?componentKeys=$SONAR_PROJECT_KEY&ps=500" -o sonar-report.json',
+                    },
+                ],
+            },
+            windows: {
+                install: "mkdir -p /tmp/sonar-local # copie docker-compose.yml e setup-and-scan.sh das tabs Sonar",
+                extras: [
+                    {
+                        label: "Subir Sonar local + scan rápido",
+                        code: "docker compose -f /tmp/sonar-local/docker-compose.yml up -d && /tmp/sonar-local/setup-and-scan.sh",
+                    },
+                    {
+                        label: "Export issues (SonarCloud ou server existente)",
+                        code: 'curl -fsSL -H "Authorization: Bearer $SONAR_TOKEN" "$SONAR_HOST_URL/api/issues/search?componentKeys=$SONAR_PROJECT_KEY&ps=500" -o sonar-report.json',
+                    },
+                ],
+            },
+        },
+        body: {
+            scan: {
+                linux: "docker compose -f /tmp/sonar-local/docker-compose.yml up -d && /tmp/sonar-local/setup-and-scan.sh",
+                macos: "docker compose -f /tmp/sonar-local/docker-compose.yml up -d && /tmp/sonar-local/setup-and-scan.sh",
+                windows: "docker compose -f /tmp/sonar-local/docker-compose.yml up -d && /tmp/sonar-local/setup-and-scan.sh",
+            },
+            upload: 'aspm upload "sonar-report.json" -s sonar -p <project-id> -k <api-key> -o <org-id>',
+            formats: "JSON export from SonarQube API (issues search)",
+            naus: {
+                kindAspm: `run:
+  - sonar:
+      kind: aspm
+      tool: sonar
+      mode: upload
+      report_path: sonar-report.json`,
+                kindAspmMatrix: `parallel:
+  - tool: sonar`,
+            },
+        },
+    },
+    nmap: {
+        install: {
+            linux: {
+                install: "sudo apt-get update && sudo apt-get install -y nmap",
+                extras: [{ label: "Fedora/RHEL", code: "sudo dnf install -y nmap" }],
+            },
+            macos: { install: "brew install nmap" },
+            windows: {
+                install: "winget install --id Insecure.Nmap -e",
+                extras: [{ label: "Chocolatey", code: "choco install nmap -y" }],
+            },
+        },
+        body: {
+            scan: {
+                linux: "nmap -sV -oX nmap-report.xml 192.168.1.1",
+                macos: "nmap -sV -oX nmap-report.xml 192.168.1.1",
+                windows: "nmap -sV -oX nmap-report.xml 192.168.1.1",
+            },
+            upload: 'aspm upload "nmap-report.xml" -s nmap -p <project-id> -k <api-key> -o <org-id>',
+            formats: "XML (-oX)",
+            naus: {
+                kindAspm: `run:
+  - network:
+      kind: aspm
+      tool: nmap
+      mode: scan-and-upload
+      target: "192.168.1.0/24"`,
+                kindAspmMatrix: `parallel:
+  - tool: nmap`,
+            },
+        },
+    },
+    skipfish: {
+        install: {
+            linux: { install: "sudo apt-get update && sudo apt-get install -y skipfish" },
+            macos: { install: "brew install skipfish" },
+            windows: {
+                install: "choco install skipfish -y",
+                extras: [
+                    {
+                        label: "WSL",
+                        code: "wsl sudo apt-get update && wsl sudo apt-get install -y skipfish",
+                    },
+                ],
+            },
+        },
+        body: {
+            scan: {
+                linux: "skipfish -o skipfish-out https://app.example.com",
+                macos: "skipfish -o skipfish-out https://app.example.com",
+                windows: "skipfish -o skipfish-out https://app.example.com",
+            },
+            upload: 'aspm upload "skipfish-report.json" -s skipfish -p <project-id> -k <api-key> -o <org-id>',
+            formats: "JSON report path (convert/export per skipfish output dir)",
+            naus: {
+                kindAspm: `run:
+  - dast:
+      kind: aspm
+      tool: skipfish
+      mode: scan-and-upload
+      target: "https://app.example.com"`,
+                kindAspmMatrix: `parallel:
+  - tool: skipfish`,
+            },
+        },
+    },
+};
+/** NAUS matrix job example shared across scanner playbooks (for docs + contract tests). */
+exports.PLAYBOOK_ASPM_MATRIX_EXAMPLE = `kind: aspm_matrix
+matrix_strategy: fanout
+parallel:
+  - tool: trivy
+  - tool: gitleaks
+  - tool: osv`;
+function listPlaybookNausKindAspmSnippets() {
+    return exports.SECURITY_SCANNER_IDS.map((scanner) => ({
+        scanner,
+        snippet: PLAYBOOKS[scanner].body.naus.kindAspm,
+    }));
+}
+function wrapPlaybookSnippetAsPipelineYaml(snippet, name = "playbook-test") {
+    const trimmed = snippet.trim();
+    if (trimmed.startsWith("run:")) {
+        return `name: ${name}\n${trimmed}`;
+    }
+    return `name: ${name}\nrun:\n  - job:\n${trimmed
+        .split("\n")
+        .map((line) => `      ${line}`)
+        .join("\n")}`;
+}
+function isSecurityScannerId(value) {
+    return exports.SECURITY_SCANNER_IDS.includes(value);
+}
+function parseSecurityScannerPlaybookArgs(argsRaw) {
+    let parsed;
+    try {
+        parsed = argsRaw.trim() ? JSON.parse(argsRaw) : {};
+    }
+    catch {
+        return { ok: false, error: "invalid_json", hint: "args must be JSON" };
+    }
+    const scannerValue = parsed.scanner ?? parsed.tool;
+    const scannerRaw = (scannerValue == null ? "" : String(scannerValue)).trim().toLowerCase();
+    if (!scannerRaw || !isSecurityScannerId(scannerRaw)) {
+        return {
+            ok: false,
+            error: "invalid_scanner",
+            hint: `scanner must be one of: ${exports.SECURITY_SCANNER_IDS.join(", ")}`,
+        };
+    }
+    const platformValue = parsed.platform ?? "linux";
+    const platformRaw = (platformValue == null ? "linux" : String(platformValue))
+        .trim()
+        .toLowerCase();
+    const platform = (() => {
+        if (platformRaw === "macos" || platformRaw === "darwin")
+            return "macos";
+        if (platformRaw === "windows" || platformRaw === "win32")
+            return "windows";
+        return "linux";
+    })();
+    const topicValue = parsed.topic ?? "all";
+    const topicRaw = (topicValue == null ? "all" : String(topicValue)).trim().toLowerCase();
+    const topic = ["install", "scan", "upload", "naus", "formats", "all"].includes(topicRaw)
+        ? topicRaw
+        : "all";
+    return { ok: true, scanner: scannerRaw, platform, topic };
+}
+function buildSecurityScannersCatalogPayload() {
+    const scanners = exports.SECURITY_SCANNER_IDS.map((id) => ({
+        id,
+        platforms: ["linux", "macos", "windows"],
+        ...exports.SCANNER_META[id],
+    }));
+    return {
+        scanners,
+        aspmCliInstall: ASPM_CLI_INSTALL,
+        uploadFlag: "aspm upload <file> -s <scanner> -p <project-id> -k <api-key> -o <org-id>",
+        nausTools: [...exports.SECURITY_SCANNER_IDS],
+        assistantTools: {
+            catalog: "security_scanners_catalog",
+            playbook: "security_scanner_playbook(scanner, platform?, topic?)",
+        },
+    };
+}
+function pickTopicSections(topic, sections) {
+    if (topic === "all")
+        return sections;
+    const key = topic;
+    if (key in sections)
+        return { [key]: sections[key] };
+    return { error: "topic_empty", requested: topic };
+}
+function buildSecurityScannerPlaybookPayload(scanner, platform, topic) {
+    const meta = exports.SCANNER_META[scanner];
+    const playbook = PLAYBOOKS[scanner];
+    const installBlock = playbook.install[platform];
+    const sections = {
+        scanner: scanner,
+        label: meta.label,
+        category: meta.category,
+        capabilities: meta.capabilities,
+        platform,
+        installAspm: ASPM_CLI_INSTALL,
+        install: {
+            command: installBlock.install,
+            extras: installBlock.extras ?? [],
+        },
+        scan: { command: playbook.body.scan[platform] },
+        upload: {
+            command: playbook.body.upload,
+            defaultReportFile: meta.defaultReportFile,
+            source: meta.uploadSource,
+        },
+        formats: {
+            summary: playbook.body.formats,
+            defaultReportFile: meta.defaultReportFile,
+            accepted: meta.reportFormats,
+        },
+        naus: {
+            kind_aspm: playbook.body.naus.kindAspm,
+            ...(playbook.body.naus.kindAspmMatrix
+                ? { kind_aspm_matrix_snippet: playbook.body.naus.kindAspmMatrix }
+                : {}),
+            ...(playbook.body.naus.kindDockerAspmTrivy
+                ? { kind_docker_aspm_trivy: playbook.body.naus.kindDockerAspmTrivy }
+                : {}),
+            cli: NAUS_CLI_OPS,
+            cloudDefaults: NAUS_CLOUD_DEFAULTS,
+            envForUpload: ["ASPM_API_URL", "ASPM_API_KEY", "ASPM_PROJECT_ID", "ASPM_ORG_ID"],
+            matrixExample: exports.PLAYBOOK_ASPM_MATRIX_EXAMPLE,
+        },
+    };
+    return {
+        source: "security-scanner-playbooks",
+        ...pickTopicSections(topic, sections),
+    };
+}
+//# sourceMappingURL=security-scanner-playbooks.js.map

package/bundled/node_modules/@kubbisec/shared/dist/product-docs/security-scanner-playbooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scanner-playbooks.js","sourceRoot":"","sources":["../../src/product-docs/security-scanner-playbooks.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AA0gBH,4EAQC;AAED,8EASC;AAED,kDAEC;AAED,4EA4CC;AAED,kFAuBC;AAYD,kFAkDC;AApqBY,QAAA,oBAAoB,GAAG;IAClC,OAAO;IACP,UAAU;IACV,MAAM;IACN,KAAK;IACL,SAAS;IACT,OAAO;IACP,MAAM;IACN,UAAU;CACF,CAAC;AAMX,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,mBAAmB,GAAG;IAC1B,SAAS,EAAE,6BAA6B;IACxC,MAAM,EAAE,0BAA0B;CAC1B,CAAC;AAEX,MAAM,YAAY,GAAG;IACnB,OAAO,EAAE,gBAAgB;IACzB,QAAQ,EAAE,8BAA8B;IACxC,KAAK,EAAE,+CAA+C;IACtD,IAAI,EAAE,8FAA8F;IACpG,GAAG,EAAE,0HAA0H;IAC/H,QAAQ,EAAE,2CAA2C;IACrD,KAAK,EAAE,YAAY;IACnB,OAAO,EAAE,gDAAgD;IACzD,MAAM,EAAE,qCAAqC;IAC7C,IAAI,EAAE,0DAA0D;IAChE,aAAa,EAAE,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;IAC3E,aAAa,EAAE,CAAC,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,CAAC;CACjE,CAAC;AAaE,QAAA,YAAY,GAGrB;IACF,KAAK,EAAE;QACL,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,CAAC;QAClF,iBAAiB,EAAE,mBAAmB;QACtC,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,YAAY,EAAE,OAAO;KACtB;IACD,QAAQ,EAAE;QACR,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;QAC5D,iBAAiB,EAAE,sBAAsB;QACzC,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAChC,YAAY,EAAE,UAAU;KACzB;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,CAAC,iBAAiB,EAAE,WAAW,EAAE,MAAM,CAAC;QACtD,iBAAiB,EAAE,WAAW;QAC9B,aAAa,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC9C,YAAY,EAAE,MAAM;KACrB;IACD,GAAG,EAAE;QACH,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,CAAC,uBAAuB,EAAE,WAAW,EAAE,WAAW,CAAC;QACjE,iBAAiB,EAAE,iBAAiB;QACpC,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,YAAY,EAAE,KAAK;KACpB;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAC;QAC3D,iBAAiB,EAAE,qBAAqB;QACxC,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAChC,YAAY,EAAE,SAAS;KACxB;IACD,KAAK,EAAE;QACL,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,gCAAgC,CAAC;QACvE,iBAAiB,EAAE,mBAAmB;QACtC,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,YAAY,EAAE,OAAO;KACtB;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,WAAW,EAAE,mBAAmB,EAAE,YAAY,CAAC;QAC9D,iBAAiB,EAAE,iBAAiB;QACpC,aAAa,EAAE,CAAC,KAAK,CAAC;QACtB,YAAY,EAAE,MAAM;KACrB;IACD,QAAQ,EAAE;QACR,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,qBAAqB,CAAC;QAChE,iBAAiB,EAAE,sBAAsB;QACzC,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,YAAY,EAAE,UAAU;KACzB;CACF,CAAC;AAkBF,MAAM,SAAS,GAGX;IACF,KAAK,EAAE;QACL,OAAO,EAAE;YACP,KAAK,EAAE;gBACL,OAAO,EACL,qHAAqH;gBACvH,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,iBAAiB;wBACxB,IAAI,EAAE,yGAAyG;qBAChH;iBACF;aACF;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,uBAAuB;wBAC9B,IAAI,EAAE,qDAAqD;qBAC5D;iBACF;aACF;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,2CAA2C;gBACpD,MAAM,EAAE;oBACN,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,wBAAwB,EAAE;oBACvD;wBACE,KAAK,EAAE,QAAQ;wBACf,IAAI,EAAE,yGAAyG;qBAChH;iBACF;aACF;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,KAAK,EAAE,qDAAqD;gBAC5D,KAAK,EAAE,qDAAqD;gBAC5D,OAAO,EAAE,qDAAqD;aAC/D;YACD,MAAM,EAAE,mFAAmF;YAC3F,OAAO,EAAE,oFAAoF;YAC7F,IAAI,EAAE;gBACJ,QAAQ,EAAE;;;;;0CAKwB;gBAClC,cAAc,EAAE;;iBAEP;gBACT,mBAAmB,EAAE;;;;;;;;;;;;yCAYY;aAClC;SACF;KACF;IACD,QAAQ,EAAE;QACR,OAAO,EAAE;YACP,KAAK,EAAE;gBACL,OAAO,EACL,uIAAuI;gBACzI,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,QAAQ;wBACf,IAAI,EAAE,yJAAyJ;qBAChK;iBACF;aACF;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,uBAAuB;gBAChC,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,QAAQ;wBACf,IAAI,EAAE,yJAAyJ;qBAChK;iBACF;aACF;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,2BAA2B;gBACpC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,0CAA0C,EAAE,CAAC;aAChF;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,KAAK,EACH,kGAAkG;gBACpG,KAAK,EACH,kGAAkG;gBACpG,OAAO,EACL,kGAAkG;aACrG;YACD,MAAM,EACJ,yFAAyF;YAC3F,OAAO,EAAE,mCAAmC;YAC5C,IAAI,EAAE;gBACJ,QAAQ,EAAE;;;;4BAIU;gBACpB,cAAc,EAAE;mBACL;aACZ;SACF;KACF;IACD,IAAI,EAAE;QACJ,OAAO,EAAE;YACP,KAAK,EAAE;gBACL,OAAO,EACL,wGAAwG;gBAC1G,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,QAAQ;wBACf,IAAI,EAAE,+FAA+F;qBACtG;iBACF;aACF;YACD,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE;YACvC,OAAO,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE;SAC5D;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,KAAK,EAAE,wCAAwC;gBAC/C,KAAK,EAAE,wCAAwC;gBAC/C,OAAO,EAAE,wCAAwC;aAClD;YACD,MAAM,EAAE,0EAA0E;YAClF,OAAO,EAAE,+CAA+C;YACxD,IAAI,EAAE;gBACJ,QAAQ,EAAE;;;;4BAIU;gBACpB,cAAc,EAAE;;2BAEG;aACpB;SACF;KACF;IACD,GAAG,EAAE;QACH,OAAO,EAAE;YACP,KAAK,EAAE;gBACL,OAAO,EAAE,iEAAiE;gBAC1E,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,iBAAiB;wBACxB,IAAI,EAAE,yIAAyI;qBAChJ;iBACF;aACF;YACD,KAAK,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE;YAC9C,OAAO,EAAE;gBACP,OAAO,EAAE,0CAA0C;gBACnD,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;aACxE;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,KAAK,EAAE,uEAAuE;gBAC9E,KAAK,EAAE,uEAAuE;gBAC9E,OAAO,EAAE,uEAAuE;aACjF;YACD,MAAM,EAAE,+EAA+E;YACvF,OAAO,EAAE,MAAM;YACf,IAAI,EAAE;gBACJ,QAAQ,EAAE;;;;4BAIU;gBACpB,cAAc,EAAE;cACV;aACP;SACF;KACF;IACD,OAAO,EAAE;QACP,OAAO,EAAE;YACP,KAAK,EAAE;gBACL,OAAO,EAAE,qBAAqB;gBAC9B,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,QAAQ;wBACf,IAAI,EAAE,2HAA2H;qBAClI;iBACF;aACF;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,sBAAsB;gBAC/B,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,QAAQ;wBACf,IAAI,EAAE,2HAA2H;qBAClI;iBACF;aACF;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,qBAAqB;gBAC9B,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,QAAQ;wBACf,IAAI,EAAE,yHAAyH;qBAChI;iBACF;aACF;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,KAAK,EAAE,0DAA0D;gBACjE,KAAK,EAAE,0DAA0D;gBACjE,OAAO,EAAE,0DAA0D;aACpE;YACD,MAAM,EACJ,uFAAuF;YACzF,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE;gBACJ,QAAQ,EAAE;;;;;mCAKiB;gBAC3B,cAAc,EAAE;kBACN;aACX;SACF;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE;YACP,KAAK,EAAE;gBACL,OAAO,EACL,yFAAyF;gBAC3F,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,iCAAiC;wBACxC,IAAI,EAAE,mGAAmG;qBAC1G;oBACD;wBACE,KAAK,EAAE,gDAAgD;wBACvD,IAAI,EAAE,qJAAqJ;qBAC5J;iBACF;aACF;YACD,KAAK,EAAE;gBACL,OAAO,EACL,yFAAyF;gBAC3F,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,iCAAiC;wBACxC,IAAI,EAAE,mGAAmG;qBAC1G;oBACD;wBACE,KAAK,EAAE,gDAAgD;wBACvD,IAAI,EAAE,qJAAqJ;qBAC5J;iBACF;aACF;YACD,OAAO,EAAE;gBACP,OAAO,EACL,yFAAyF;gBAC3F,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,iCAAiC;wBACxC,IAAI,EAAE,mGAAmG;qBAC1G;oBACD;wBACE,KAAK,EAAE,gDAAgD;wBACvD,IAAI,EAAE,qJAAqJ;qBAC5J;iBACF;aACF;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,KAAK,EACH,mGAAmG;gBACrG,KAAK,EACH,mGAAmG;gBACrG,OAAO,EACL,mGAAmG;aACtG;YACD,MAAM,EAAE,mFAAmF;YAC3F,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE;gBACJ,QAAQ,EAAE;;;;;qCAKmB;gBAC7B,cAAc,EAAE;gBACR;aACT;SACF;KACF;IACD,IAAI,EAAE;QACJ,OAAO,EAAE;YACP,KAAK,EAAE;gBACL,OAAO,EAAE,qDAAqD;gBAC9D,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;aACrE;YACD,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE;YACvC,OAAO,EAAE;gBACP,OAAO,EAAE,sCAAsC;gBAC/C,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;aACjE;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,KAAK,EAAE,0CAA0C;gBACjD,KAAK,EAAE,0CAA0C;gBACjD,OAAO,EAAE,0CAA0C;aACpD;YACD,MAAM,EAAE,gFAAgF;YACxF,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE;gBACJ,QAAQ,EAAE;;;;;+BAKa;gBACvB,cAAc,EAAE;eACT;aACR;SACF;KACF;IACD,QAAQ,EAAE;QACR,OAAO,EAAE;YACP,KAAK,EAAE,EAAE,OAAO,EAAE,yDAAyD,EAAE;YAC7E,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;YAC3C,OAAO,EAAE;gBACP,OAAO,EAAE,2BAA2B;gBACpC,MAAM,EAAE;oBACN;wBACE,KAAK,EAAE,KAAK;wBACZ,IAAI,EAAE,iEAAiE;qBACxE;iBACF;aACF;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,KAAK,EAAE,kDAAkD;gBACzD,KAAK,EAAE,kDAAkD;gBACzD,OAAO,EAAE,kDAAkD;aAC5D;YACD,MAAM,EACJ,yFAAyF;YAC3F,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE;gBACJ,QAAQ,EAAE;;;;;wCAKsB;gBAChC,cAAc,EAAE;mBACL;aACZ;SACF;KACF;CACF,CAAC;AAEF,2FAA2F;AAC9E,QAAA,4BAA4B,GAAG;;;;;cAKrB,CAAC;AAExB,SAAgB,gCAAgC;IAI9C,OAAO,4BAAoB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO;QACP,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAgB,iCAAiC,CAAC,OAAe,EAAE,IAAI,GAAG,eAAe;IACvF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,IAAI,KAAK,OAAO,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,IAAI,qBAAqB,OAAO;SAC7C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;SAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,OAAQ,4BAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAgB,gCAAgC,CAAC,OAAe;IAQ9D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC;IACnD,MAAM,UAAU,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3F,IAAI,CAAC,UAAU,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,2BAA2B,4BAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC;IACjD,MAAM,WAAW,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;SAC1E,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;QACrB,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACxE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QAC3E,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxF,MAAM,KAAK,GAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAW,CAAC,QAAQ,CACvF,QAAyB,CAC1B;QACC,CAAC,CAAE,QAA0B;QAC7B,CAAC,CAAC,KAAK,CAAC;IAEV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,SAAgB,mCAAmC;IAOjD,MAAM,QAAQ,GAA2B,4BAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACzE,EAAE;QACF,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;QACxC,GAAG,oBAAY,CAAC,EAAE,CAAC;KACpB,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,QAAQ;QACR,cAAc,EAAE,gBAAgB;QAChC,UAAU,EAAE,0EAA0E;QACtF,SAAS,EAAE,CAAC,GAAG,4BAAoB,CAAC;QACpC,cAAc,EAAE;YACd,OAAO,EAAE,2BAA2B;YACpC,QAAQ,EAAE,uDAAuD;SAClE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAoB,EACpB,QAAiC;IAEjC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC;IAClB,IAAI,GAAG,IAAI,QAAQ;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,SAAgB,mCAAmC,CACjD,OAA0B,EAC1B,QAAyB,EACzB,KAAoB;IAEpB,MAAM,IAAI,GAAG,oBAAY,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAA4B;QACxC,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ;QACR,WAAW,EAAE,gBAAgB;QAC7B,OAAO,EAAE;YACP,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,EAAE;SAClC;QACD,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC/C,MAAM,EAAE;YACN,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;YAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B;QACD,OAAO,EAAE;YACP,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO;YAC9B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,QAAQ,EAAE,IAAI,CAAC,aAAa;SAC7B;QACD,IAAI,EAAE;YACJ,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;YACtC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBACnC,CAAC,CAAC,EAAE,wBAAwB,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;gBACxC,CAAC,CAAC,EAAE,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE;gBACpE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,EAAE,YAAY;YACjB,aAAa,EAAE,mBAAmB;YAClC,YAAY,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,CAAC;YAChF,aAAa,EAAE,oCAA4B;SAC5C;KACF,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,4BAA4B;QACpC,GAAG,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC;KACtC,CAAC;AACJ,CAAC"}

package/bundled/node_modules/{@aspm → @kubbisec}/shared/dist/rbac/platform-staff.d.ts

@@ -9,6 +9,8 @@ export declare const GLOBAL_ROLE_OPTIONS: ReadonlyArray<{
 /** Parses comma-separated global roles from `user.role`. */
 export declare function parseGlobalUserRoles(role: string | null | undefined): string[];
 export declare function isPlatformStaffRole(role: string | null | undefined): boolean;
+/** Platform admins with full catalog (`admin`, `platform_super_admin`) act as org admin in tenant UI. */
+export declare function globalRoleGrantsFullTenantPermissions(role: string | null | undefined): boolean;
 export declare function hasPlatformPermission(role: string | null | undefined, permission: KubbisecPermission): boolean;
 export declare function getMergedPlatformPermissions(role: string | null | undefined): ReadonlySet<KubbisecPermission>;
 //# sourceMappingURL=platform-staff.d.ts.map

package/bundled/node_modules/{@aspm → @kubbisec}/shared/dist/rbac/platform-staff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-staff.d.ts","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,gFAKzB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAK3F,CAAC;AAQF,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAM9E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAMT;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAQjC"}
+{"version":3,"file":"platform-staff.d.ts","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,gFAKzB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAK3F,CAAC;AAQF,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAM9E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED,yGAAyG;AACzG,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE9F;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAMT;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAQjC"}

package/bundled/node_modules/{@aspm → @kubbisec}/shared/dist/rbac/platform-staff.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GLOBAL_ROLE_OPTIONS = exports.GLOBAL_USER_ROLE_SLUGS = void 0;
 exports.parseGlobalUserRoles = parseGlobalUserRoles;
 exports.isPlatformStaffRole = isPlatformStaffRole;
+exports.globalRoleGrantsFullTenantPermissions = globalRoleGrantsFullTenantPermissions;
 exports.hasPlatformPermission = hasPlatformPermission;
 exports.getMergedPlatformPermissions = getMergedPlatformPermissions;
 const resolve_platform_permissions_1 = require("./resolve-platform-permissions");
@@ -36,6 +37,10 @@ function parseGlobalUserRoles(role) {
 function isPlatformStaffRole(role) {
     return parseGlobalUserRoles(role).some((r) => STAFF_ROLE_SET.has(r));
 }
+/** Platform admins with full catalog (`admin`, `platform_super_admin`) act as org admin in tenant UI. */
+function globalRoleGrantsFullTenantPermissions(role) {
+    return parseGlobalUserRoles(role).some((r) => r === "admin" || r === "platform_super_admin");
+}
 function hasPlatformPermission(role, permission) {
     const roles = parseGlobalUserRoles(role);
     for (const r of roles) {

package/bundled/node_modules/@kubbisec/shared/dist/rbac/platform-staff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-staff.js","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":";;;AA2BA,oDAMC;AAED,kDAEC;AAGD,sFAEC;AAED,sDASC;AAED,oEAUC;AAhED,iFAA0F;AAE1F,4FAA4F;AAC/E,QAAA,sBAAsB,GAAG;IACpC,MAAM;IACN,OAAO;IACP,sBAAsB;IACtB,0BAA0B;CAClB,CAAC;AAIE,QAAA,mBAAmB,GAAgE;IAC9F,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;IACtC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE;IACxD,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAC7E,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,kBAAkB,EAAE;CACjE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,OAAO;IACP,sBAAsB;IACtB,0BAA0B;CAC3B,CAAC,CAAC;AAEH,4DAA4D;AAC5D,SAAgB,oBAAoB,CAAC,IAA+B;IAClE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAA+B;IACjE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,yGAAyG;AACzG,SAAgB,qCAAqC,CAAC,IAA+B;IACnF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,sBAAsB,CAAC,CAAC;AAC/F,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAA+B,EAC/B,UAA8B;IAE9B,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,4BAA4B,CAC1C,IAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/bundled/node_modules/{@aspm → @kubbisec}/shared/dist/security/security-tool.types.d.ts

@@ -1,4 +1,4 @@
-/** Naus `aspm_matrix` tool ids — must match @naus/validation `aspmToolIdSchema`. */
+/** Naus `aspm_matrix` tool ids — must match @kubbisec/naus-validation `aspmToolIdSchema`. */
 export declare const SECURITY_TOOL_IDS: readonly ["osv", "gitleaks", "syft", "trivy", "semgrep", "sonar", "nmap", "skipfish"];
 export type SecurityToolId = (typeof SECURITY_TOOL_IDS)[number];
 export declare const DEFAULT_SECURITY_TOOLS: SecurityToolId[];