@kubbisec/ai-linux-x64 0.1.10 → 0.1.12

package/bundled/node_modules/@aspm/shared/dist/rbac/better-auth-org-roles.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_MEMBER_ROLE_OPTIONS = exports.ORG_INVITE_ROLE_OPTIONS = exports.BETTER_AUTH_ORG_ROLE_BY_SLUG = void 0;
+exports.normalizeStoredOrgRole = normalizeStoredOrgRole;
+exports.toBetterAuthOrgRole = toBetterAuthOrgRole;
+/** Stored on `member.role` / invitation; must match Better Auth `organization({ roles })` keys. */
+exports.BETTER_AUTH_ORG_ROLE_BY_SLUG = {
+    org_administrator: "org_administrator",
+    org_finance: "org_finance",
+    org_security_engineer: "org_security_engineer",
+    org_delivery_engineer: "org_delivery_engineer",
+    org_observer: "org_observer",
+};
+exports.ORG_INVITE_ROLE_OPTIONS = [
+    { value: "org_finance", label: "Financeiro" },
+    { value: "org_security_engineer", label: "AppSec / DevSecOps" },
+    { value: "org_delivery_engineer", label: "DevOps / entrega" },
+    { value: "org_observer", label: "Observador" },
+];
+/** All assignable org roles (invites exclude org_administrator by design). */
+exports.ORG_MEMBER_ROLE_OPTIONS = [
+    { value: "org_administrator", label: "Administrador da organização" },
+    { value: "org_finance", label: "Financeiro" },
+    ...exports.ORG_INVITE_ROLE_OPTIONS,
+];
+/** Maps legacy Better Auth roles and Kubbisec slugs stored in DB → canonical `OrgRoleSlug`. */
+function normalizeStoredOrgRole(raw) {
+    if (!raw)
+        return "org_observer";
+    const r = raw.trim();
+    if (r === "org_administrator" ||
+        r === "org_finance" ||
+        r === "org_security_engineer" ||
+        r === "org_delivery_engineer" ||
+        r === "org_observer") {
+        return r;
+    }
+    const lower = r.toLowerCase();
+    if (lower === "owner" ||
+        lower === "admin" ||
+        lower === "administrator" ||
+        lower === "org_admin") {
+        return "org_administrator";
+    }
+    if (lower === "member" || lower === "org_member") {
+        return "org_delivery_engineer";
+    }
+    return "org_observer";
+}
+/** Role string stored by Better Auth / Prisma `member.role` (single slug). */
+function toBetterAuthOrgRole(slug) {
+    return exports.BETTER_AUTH_ORG_ROLE_BY_SLUG[slug];
+}
+//# sourceMappingURL=better-auth-org-roles.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/better-auth-org-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth-org-roles.js","sourceRoot":"","sources":["../../src/rbac/better-auth-org-roles.ts"],"names":[],"mappings":";;;AA0BA,wDAyBC;AAGD,kDAEC;AAtDD,mGAAmG;AACtF,QAAA,4BAA4B,GAAG;IAC1C,iBAAiB,EAAE,mBAAmB;IACtC,WAAW,EAAE,aAAa;IAC1B,qBAAqB,EAAE,uBAAuB;IAC9C,qBAAqB,EAAE,uBAAuB;IAC9C,YAAY,EAAE,cAAc;CACuB,CAAC;AAEzC,QAAA,uBAAuB,GAA4C;IAC9E,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE;IAC7C,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAC/D,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC7D,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;CAC/C,CAAC;AAEF,8EAA8E;AACjE,QAAA,uBAAuB,GAA4C;IAC9E,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,8BAA8B,EAAE;IACrE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE;IAC7C,GAAG,+BAAuB;CAC3B,CAAC;AAEF,+FAA+F;AAC/F,SAAgB,sBAAsB,CAAC,GAA8B;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,cAAc,CAAC;IAChC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IACE,CAAC,KAAK,mBAAmB;QACzB,CAAC,KAAK,aAAa;QACnB,CAAC,KAAK,uBAAuB;QAC7B,CAAC,KAAK,uBAAuB;QAC7B,CAAC,KAAK,cAAc,EACpB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9B,IACE,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,WAAW,EACrB,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,SAAgB,mBAAmB,CAAC,IAAiB;IACnD,OAAO,oCAA4B,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./better-auth-org-roles";
+export * from "./kubbisec-permission-descriptions";
+export * from "./kubbisec-permissions";
+export * from "./platform-staff";
+export * from "./resolve-org-permissions";
+export * from "./resolve-platform-permissions";
+//# sourceMappingURL=index.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,oCAAoC,CAAC;AACnD,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./better-auth-org-roles"), exports);
+__exportStar(require("./kubbisec-permission-descriptions"), exports);
+__exportStar(require("./kubbisec-permissions"), exports);
+__exportStar(require("./platform-staff"), exports);
+__exportStar(require("./resolve-org-permissions"), exports);
+__exportStar(require("./resolve-platform-permissions"), exports);
+//# sourceMappingURL=index.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,qEAAmD;AACnD,yDAAuC;AACvC,mDAAiC;AACjC,4DAA0C;AAC1C,iEAA+C"}

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permission-descriptions.d.ts

@@ -0,0 +1,9 @@
+import { type KubbisecPermission } from "./kubbisec-permissions";
+/**
+ * Human-readable descriptions (pt-BR) — keep in sync with docs/core/rbac-catalog.md
+ */
+export declare const KUBBISEC_PERMISSION_DESCRIPTIONS: Record<KubbisecPermission, string>;
+export declare function getKubbisecPermissionDescription(permission: KubbisecPermission): string;
+/** Ensures every catalog permission has a pt-BR description at build/test time. */
+export declare function assertKubbisecPermissionDescriptionsComplete(): void;
+//# sourceMappingURL=kubbisec-permission-descriptions.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permission-descriptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permission-descriptions.d.ts","sourceRoot":"","sources":["../../src/rbac/kubbisec-permission-descriptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEvF;;GAEG;AACH,eAAO,MAAM,gCAAgC,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAqF/E,CAAC;AAEF,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,CAEvF;AAED,mFAAmF;AACnF,wBAAgB,4CAA4C,IAAI,IAAI,CAOnE"}

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permission-descriptions.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KUBBISEC_PERMISSION_DESCRIPTIONS = void 0;
+exports.getKubbisecPermissionDescription = getKubbisecPermissionDescription;
+exports.assertKubbisecPermissionDescriptionsComplete = assertKubbisecPermissionDescriptionsComplete;
+const kubbisec_permissions_1 = require("./kubbisec-permissions");
+/**
+ * Human-readable descriptions (pt-BR) — keep in sync with docs/core/rbac-catalog.md
+ */
+exports.KUBBISEC_PERMISSION_DESCRIPTIONS = {
+    "kbsc.org.profile.read": "Nome, slug e metadados não sensíveis da organização.",
+    "kbsc.org.profile.update": "Alterar nome, branding e metadados da organização.",
+    "kbsc.org.settings.manage": "Quotas, defaults do workspace e flags da organização.",
+    "kbsc.org.delete": "Eliminar a organização (operação irreversível).",
+    "kbsc.identity.member.read": "Listar e ver detalhes dos membros do workspace.",
+    "kbsc.identity.member.invite": "Enviar convites e definir o papel na entrada.",
+    "kbsc.identity.member.role.update": "Promover ou rebaixar papéis de membros.",
+    "kbsc.identity.member.remove": "Revogar o acesso de um membro ao workspace.",
+    "kbsc.identity.invitation.manage": "Cancelar ou reenviar convites pendentes.",
+    "kbsc.asset.project.read": "Listar projetos, ativos e repositórios ligados.",
+    "kbsc.asset.project.create": "Registar novos ativos no ASPM.",
+    "kbsc.asset.project.update": "Alterar metadados, ramo default e ligações.",
+    "kbsc.asset.project.delete": "Remover um ativo do workspace.",
+    "kbsc.finding.read": "Ver achados, vulnerabilidades e histórico.",
+    "kbsc.finding.triage.update": "Alterar estados, prioridade e comentários internos.",
+    "kbsc.finding.remediation.manage": "Gerir tickets e workflows de correção.",
+    "kbsc.finding.remediation.auto-apply": "Disparar remediação automática (branch + PR GitHub, sem merge).",
+    "kbsc.finding.export": "Exportar relatórios de achados (PDF/CSV conforme produto).",
+    "kbsc.ingest.report.create": "Ingerir relatórios de scan via API ou runner.",
+    "kbsc.ingest.coverage.create": "Ingerir dados de cobertura de testes.",
+    "kbsc.ingest.bundle.create": "Ingerir bundles de performance e artefactos.",
+    "kbsc.supply.read": "Ver SBOM, pacotes e metadados de dependências.",
+    "kbsc.supply.policy.comment": "Adicionar anotações de risco sem alterar integrações.",
+    "kbsc.supply.scan.trigger": "Disparar análise manual de supply chain.",
+    "kbsc.governance.read": "Ver políticas, portões e coverage (somente leitura).",
+    "kbsc.governance.coverage.manage": "Gerir configuração de coverage (org/projeto).",
+    "kbsc.integration.read": "Ver estado das integrações (GitHub, Jira, etc.).",
+    "kbsc.integration.connect": "Ligar integrações via OAuth ou credenciais partilhadas.",
+    "kbsc.integration.disconnect": "Desligar integrações e remover ligações.",
+    "kbsc.integration.secret.write": "Gravar tokens e segredos de integração.",
+    "kbsc.integration.issue.create": "Criar issues em trackers conectados via IA.",
+    "kbsc.integration.pr.create": "Abrir pull requests em repositórios conectados via IA.",
+    "kbsc.integration.pr.merge": "Fazer merge automático de PRs após gates aprovados.",
+    "kbsc.project.ai-autopilot.manage": "Configurar autopilot de IA do projeto (limites, ativação).",
+    "kbsc.project.ai-autopilot.run": "Disparar manualmente um ciclo do autopilot de IA.",
+    "kbsc.ci.read": "Ver pipelines, runners, execuções e histórico.",
+    "kbsc.ci.pipeline.manage": "Criar, editar e apagar definições de pipeline.",
+    "kbsc.ci.pipeline.run": "Disparar execuções manuais de pipeline.",
+    "kbsc.ci.privileged.run": "Executar jobs CI com containers privilegiados (requer runner habilitado).",
+    "kbsc.ci.runner.manage": "Registar, revogar e apagar runners.",
+    "kbsc.ci.envpack.manage": "Gerir pacotes de ambiente e ligações a projetos.",
+    "kbsc.ci.bootstrap.manage": "Gerir tokens de bootstrap para onboarding de runners.",
+    "kbsc.credential.apikey.read": "Listar metadados de API keys (sem expor o segredo).",
+    "kbsc.credential.apikey.create": "Emitir chaves para CLI e automação.",
+    "kbsc.credential.apikey.revoke": "Invalidar API keys existentes.",
+    "kbsc.notification.read": "Ver o centro de alertas e notificações.",
+    "kbsc.notification.preference.manage": "Configurar canal, frequência e silenciamento.",
+    "kbsc.ai.provider.manage": "Gerir configuração BYOK do provedor de IA.",
+    "kbsc.ai.usage.read": "Ver resumo e histórico de utilização de IA.",
+    "kbsc.ai.assistant.use": "Usar o assistente de IA in-app (sem alterar dados).",
+    "kbsc.ai.automation.auto": "Executar automação de IA em modo auto (patch, branch, merge sem revisão).",
+    "kbsc.platform.org.read": "Ver organizações de todos os tenants (staff).",
+    "kbsc.platform.org.support": "Executar ações de suporte aprovadas em organizações.",
+    "kbsc.platform.user.read": "Ver utilizadores cross-tenant para diagnóstico.",
+    "kbsc.platform.impersonate.request": "Pedir sessão de suporte com impersonação controlada.",
+    "kbsc.platform.config.manage": "Gerir configuração global da plataforma e feature flags.",
+    "kbsc.ops.metrics.read": "Ver snapshot completo de métricas operacionais da plataforma.",
+    "kbsc.billing.read": "Ver plano, trial, assinatura e resumo financeiro da organização.",
+    "kbsc.billing.manage": "Iniciar checkout Pro, portal Stripe e alterações de billing.",
+    "kbsc.contract.read": "Ver contratos Business/Pilot e estado de assinatura.",
+    "kbsc.contract.manage": "Gerir contratos e fluxos comerciais offline da organização.",
+    "kbsc.identity.member.permission.manage": "Personalizar permissões funcionais por membro (sem escopo de plataforma).",
+    "kbsc.org.security.read": "Ver postura de segurança dos membros (2FA, sessões).",
+    "kbsc.org.security.manage": "Gerir políticas de segurança do workspace.",
+    "kbsc.org.assistant.manage": "Habilitar ou desabilitar o KubbiSec Assistant na organização.",
+};
+function getKubbisecPermissionDescription(permission) {
+    return exports.KUBBISEC_PERMISSION_DESCRIPTIONS[permission];
+}
+/** Ensures every catalog permission has a pt-BR description at build/test time. */
+function assertKubbisecPermissionDescriptionsComplete() {
+    for (const permission of kubbisec_permissions_1.KUBBISEC_PERMISSIONS) {
+        const description = exports.KUBBISEC_PERMISSION_DESCRIPTIONS[permission];
+        if (!description?.trim()) {
+            throw new Error(`Missing description for permission: ${permission}`);
+        }
+    }
+}
+//# sourceMappingURL=kubbisec-permission-descriptions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permission-descriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permission-descriptions.js","sourceRoot":"","sources":["../../src/rbac/kubbisec-permission-descriptions.ts"],"names":[],"mappings":";;;AA4FA,4EAEC;AAGD,oGAOC;AAxGD,iEAAuF;AAEvF;;GAEG;AACU,QAAA,gCAAgC,GAAuC;IAClF,uBAAuB,EAAE,sDAAsD;IAC/E,yBAAyB,EAAE,oDAAoD;IAC/E,0BAA0B,EAAE,uDAAuD;IACnF,iBAAiB,EAAE,iDAAiD;IAEpE,2BAA2B,EAAE,iDAAiD;IAC9E,6BAA6B,EAAE,+CAA+C;IAC9E,kCAAkC,EAAE,yCAAyC;IAC7E,6BAA6B,EAAE,6CAA6C;IAC5E,iCAAiC,EAAE,0CAA0C;IAE7E,yBAAyB,EAAE,iDAAiD;IAC5E,2BAA2B,EAAE,gCAAgC;IAC7D,2BAA2B,EAAE,6CAA6C;IAC1E,2BAA2B,EAAE,gCAAgC;IAE7D,mBAAmB,EAAE,4CAA4C;IACjE,4BAA4B,EAAE,qDAAqD;IACnF,iCAAiC,EAAE,wCAAwC;IAC3E,qCAAqC,EACnC,iEAAiE;IACnE,qBAAqB,EAAE,4DAA4D;IAEnF,2BAA2B,EAAE,+CAA+C;IAC5E,6BAA6B,EAAE,uCAAuC;IACtE,2BAA2B,EAAE,8CAA8C;IAE3E,kBAAkB,EAAE,gDAAgD;IACpE,4BAA4B,EAAE,uDAAuD;IACrF,0BAA0B,EAAE,0CAA0C;IAEtE,sBAAsB,EAAE,sDAAsD;IAC9E,iCAAiC,EAAE,+CAA+C;IAElF,uBAAuB,EAAE,kDAAkD;IAC3E,0BAA0B,EAAE,yDAAyD;IACrF,6BAA6B,EAAE,0CAA0C;IACzE,+BAA+B,EAAE,yCAAyC;IAC1E,+BAA+B,EAAE,6CAA6C;IAC9E,4BAA4B,EAAE,wDAAwD;IACtF,2BAA2B,EAAE,qDAAqD;IAElF,kCAAkC,EAAE,4DAA4D;IAChG,+BAA+B,EAAE,mDAAmD;IAEpF,cAAc,EAAE,gDAAgD;IAChE,yBAAyB,EAAE,gDAAgD;IAC3E,sBAAsB,EAAE,yCAAyC;IACjE,wBAAwB,EACtB,2EAA2E;IAC7E,uBAAuB,EAAE,qCAAqC;IAC9D,wBAAwB,EAAE,kDAAkD;IAC5E,0BAA0B,EAAE,uDAAuD;IAEnF,6BAA6B,EAAE,qDAAqD;IACpF,+BAA+B,EAAE,qCAAqC;IACtE,+BAA+B,EAAE,gCAAgC;IAEjE,wBAAwB,EAAE,yCAAyC;IACnE,qCAAqC,EAAE,+CAA+C;IAEtF,yBAAyB,EAAE,4CAA4C;IACvE,oBAAoB,EAAE,6CAA6C;IACnE,uBAAuB,EAAE,qDAAqD;IAC9E,yBAAyB,EACvB,2EAA2E;IAE7E,wBAAwB,EAAE,+CAA+C;IACzE,2BAA2B,EAAE,sDAAsD;IACnF,yBAAyB,EAAE,iDAAiD;IAC5E,mCAAmC,EAAE,sDAAsD;IAC3F,6BAA6B,EAAE,0DAA0D;IAEzF,uBAAuB,EAAE,+DAA+D;IAExF,mBAAmB,EAAE,kEAAkE;IACvF,qBAAqB,EAAE,8DAA8D;IACrF,oBAAoB,EAAE,sDAAsD;IAC5E,sBAAsB,EAAE,6DAA6D;IACrF,wCAAwC,EACtC,2EAA2E;IAC7E,wBAAwB,EAAE,sDAAsD;IAChF,0BAA0B,EAAE,4CAA4C;IACxE,2BAA2B,EAAE,+DAA+D;CAC7F,CAAC;AAEF,SAAgB,gCAAgC,CAAC,UAA8B;IAC7E,OAAO,wCAAgC,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC;AAED,mFAAmF;AACnF,SAAgB,4CAA4C;IAC1D,KAAK,MAAM,UAAU,IAAI,2CAAoB,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,wCAAgC,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permissions.d.ts

@@ -0,0 +1,12 @@
+/**
+ * KubbiSec permission slugs — keep in sync with docs/core/rbac-catalog.md
+ */
+export declare const KUBBISEC_PERMISSIONS: readonly ["kbsc.org.profile.read", "kbsc.org.profile.update", "kbsc.org.settings.manage", "kbsc.org.delete", "kbsc.identity.member.read", "kbsc.identity.member.invite", "kbsc.identity.member.role.update", "kbsc.identity.member.remove", "kbsc.identity.invitation.manage", "kbsc.asset.project.read", "kbsc.asset.project.create", "kbsc.asset.project.update", "kbsc.asset.project.delete", "kbsc.finding.read", "kbsc.finding.triage.update", "kbsc.finding.remediation.manage", "kbsc.finding.remediation.auto-apply", "kbsc.finding.export", "kbsc.ingest.report.create", "kbsc.supply.read", "kbsc.supply.policy.comment", "kbsc.supply.scan.trigger", "kbsc.governance.read", "kbsc.governance.coverage.manage", "kbsc.ingest.coverage.create", "kbsc.ingest.bundle.create", "kbsc.integration.read", "kbsc.integration.connect", "kbsc.integration.disconnect", "kbsc.integration.secret.write", "kbsc.integration.issue.create", "kbsc.integration.pr.create", "kbsc.integration.pr.merge", "kbsc.project.ai-autopilot.manage", "kbsc.project.ai-autopilot.run", "kbsc.ci.read", "kbsc.ci.pipeline.manage", "kbsc.ci.pipeline.run", "kbsc.ci.privileged.run", "kbsc.ci.runner.manage", "kbsc.ci.envpack.manage", "kbsc.ci.bootstrap.manage", "kbsc.credential.apikey.read", "kbsc.credential.apikey.create", "kbsc.credential.apikey.revoke", "kbsc.notification.read", "kbsc.notification.preference.manage", "kbsc.ai.provider.manage", "kbsc.ai.usage.read", "kbsc.ai.assistant.use", "kbsc.ai.automation.auto", "kbsc.platform.org.read", "kbsc.platform.org.support", "kbsc.platform.user.read", "kbsc.platform.impersonate.request", "kbsc.platform.config.manage", "kbsc.ops.metrics.read", "kbsc.billing.read", "kbsc.billing.manage", "kbsc.contract.read", "kbsc.contract.manage", "kbsc.identity.member.permission.manage", "kbsc.org.security.read", "kbsc.org.security.manage", "kbsc.org.assistant.manage"];
+export type KubbisecPermission = (typeof KUBBISEC_PERMISSIONS)[number];
+/** Full catalog — super admin / legacy `admin` global role. */
+export declare const ALL_KUBBISEC_PERMISSIONS: ReadonlySet<KubbisecPermission>;
+export declare const ORG_ROLE_SLUGS: readonly ["org_administrator", "org_finance", "org_security_engineer", "org_delivery_engineer", "org_observer"];
+export type OrgRoleSlug = (typeof ORG_ROLE_SLUGS)[number];
+export declare const PLATFORM_ROLE_SLUGS: readonly ["platform_super_admin", "platform_account_manager"];
+export type PlatformRoleSlug = (typeof PLATFORM_ROLE_SLUGS)[number];
+//# sourceMappingURL=kubbisec-permissions.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/kubbisec-permissions.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,oBAAoB,u0DAkEvB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,kBAAkB,CAEpE,CAAC;AAEF,eAAO,MAAM,cAAc,iHAMjB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,eAAO,MAAM,mBAAmB,+DAAgE,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permissions.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_ROLE_SLUGS = exports.ORG_ROLE_SLUGS = exports.ALL_KUBBISEC_PERMISSIONS = exports.KUBBISEC_PERMISSIONS = void 0;
+/**
+ * KubbiSec permission slugs — keep in sync with docs/core/rbac-catalog.md
+ */
+exports.KUBBISEC_PERMISSIONS = [
+    "kbsc.org.profile.read",
+    "kbsc.org.profile.update",
+    "kbsc.org.settings.manage",
+    "kbsc.org.delete",
+    "kbsc.identity.member.read",
+    "kbsc.identity.member.invite",
+    "kbsc.identity.member.role.update",
+    "kbsc.identity.member.remove",
+    "kbsc.identity.invitation.manage",
+    "kbsc.asset.project.read",
+    "kbsc.asset.project.create",
+    "kbsc.asset.project.update",
+    "kbsc.asset.project.delete",
+    "kbsc.finding.read",
+    "kbsc.finding.triage.update",
+    "kbsc.finding.remediation.manage",
+    "kbsc.finding.remediation.auto-apply",
+    "kbsc.finding.export",
+    "kbsc.ingest.report.create",
+    "kbsc.supply.read",
+    "kbsc.supply.policy.comment",
+    "kbsc.supply.scan.trigger",
+    "kbsc.governance.read",
+    "kbsc.governance.coverage.manage",
+    "kbsc.ingest.coverage.create",
+    "kbsc.ingest.bundle.create",
+    "kbsc.integration.read",
+    "kbsc.integration.connect",
+    "kbsc.integration.disconnect",
+    "kbsc.integration.secret.write",
+    "kbsc.integration.issue.create",
+    "kbsc.integration.pr.create",
+    "kbsc.integration.pr.merge",
+    "kbsc.project.ai-autopilot.manage",
+    "kbsc.project.ai-autopilot.run",
+    "kbsc.ci.read",
+    "kbsc.ci.pipeline.manage",
+    "kbsc.ci.pipeline.run",
+    "kbsc.ci.privileged.run",
+    "kbsc.ci.runner.manage",
+    "kbsc.ci.envpack.manage",
+    "kbsc.ci.bootstrap.manage",
+    "kbsc.credential.apikey.read",
+    "kbsc.credential.apikey.create",
+    "kbsc.credential.apikey.revoke",
+    "kbsc.notification.read",
+    "kbsc.notification.preference.manage",
+    "kbsc.ai.provider.manage",
+    "kbsc.ai.usage.read",
+    "kbsc.ai.assistant.use",
+    "kbsc.ai.automation.auto",
+    "kbsc.platform.org.read",
+    "kbsc.platform.org.support",
+    "kbsc.platform.user.read",
+    "kbsc.platform.impersonate.request",
+    "kbsc.platform.config.manage",
+    "kbsc.ops.metrics.read",
+    "kbsc.billing.read",
+    "kbsc.billing.manage",
+    "kbsc.contract.read",
+    "kbsc.contract.manage",
+    "kbsc.identity.member.permission.manage",
+    "kbsc.org.security.read",
+    "kbsc.org.security.manage",
+    "kbsc.org.assistant.manage",
+];
+/** Full catalog — super admin / legacy `admin` global role. */
+exports.ALL_KUBBISEC_PERMISSIONS = new Set(exports.KUBBISEC_PERMISSIONS);
+exports.ORG_ROLE_SLUGS = [
+    "org_administrator",
+    "org_finance",
+    "org_security_engineer",
+    "org_delivery_engineer",
+    "org_observer",
+];
+exports.PLATFORM_ROLE_SLUGS = ["platform_super_admin", "platform_account_manager"];
+//# sourceMappingURL=kubbisec-permissions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/kubbisec-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permissions.js","sourceRoot":"","sources":["../../src/rbac/kubbisec-permissions.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACU,QAAA,oBAAoB,GAAG;IAClC,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,iBAAiB;IACjB,2BAA2B;IAC3B,6BAA6B;IAC7B,kCAAkC;IAClC,6BAA6B;IAC7B,iCAAiC;IACjC,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,mBAAmB;IACnB,4BAA4B;IAC5B,iCAAiC;IACjC,qCAAqC;IACrC,qBAAqB;IACrB,2BAA2B;IAC3B,kBAAkB;IAClB,4BAA4B;IAC5B,0BAA0B;IAC1B,sBAAsB;IACtB,iCAAiC;IACjC,6BAA6B;IAC7B,2BAA2B;IAC3B,uBAAuB;IACvB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,4BAA4B;IAC5B,2BAA2B;IAC3B,kCAAkC;IAClC,+BAA+B;IAC/B,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,wBAAwB;IACxB,qCAAqC;IACrC,yBAAyB;IACzB,oBAAoB;IACpB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;IACxB,2BAA2B;IAC3B,yBAAyB;IACzB,mCAAmC;IACnC,6BAA6B;IAC7B,uBAAuB;IACvB,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,wCAAwC;IACxC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;CACnB,CAAC;AAIX,+DAA+D;AAClD,QAAA,wBAAwB,GAAoC,IAAI,GAAG,CAC9E,4BAAoB,CACrB,CAAC;AAEW,QAAA,cAAc,GAAG;IAC5B,mBAAmB;IACnB,aAAa;IACb,uBAAuB;IACvB,uBAAuB;IACvB,cAAc;CACN,CAAC;AAIE,QAAA,mBAAmB,GAAG,CAAC,sBAAsB,EAAE,0BAA0B,CAAU,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.d.ts

@@ -0,0 +1,14 @@
+import type { KubbisecPermission } from "./kubbisec-permissions";
+/** Global `user.role` values used by Better Auth admin plugin + KubbiSec platform staff. */
+export declare const GLOBAL_USER_ROLE_SLUGS: readonly ["user", "admin", "platform_super_admin", "platform_account_manager"];
+export type GlobalUserRoleSlug = (typeof GLOBAL_USER_ROLE_SLUGS)[number];
+export declare const GLOBAL_ROLE_OPTIONS: ReadonlyArray<{
+    value: GlobalUserRoleSlug;
+    label: string;
+}>;
+/** Parses comma-separated global roles from `user.role`. */
+export declare function parseGlobalUserRoles(role: string | null | undefined): string[];
+export declare function isPlatformStaffRole(role: string | null | undefined): boolean;
+export declare function hasPlatformPermission(role: string | null | undefined, permission: KubbisecPermission): boolean;
+export declare function getMergedPlatformPermissions(role: string | null | undefined): ReadonlySet<KubbisecPermission>;
+//# sourceMappingURL=platform-staff.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-staff.d.ts","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,gFAKzB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAK3F,CAAC;AAQF,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAM9E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAMT;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAQjC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GLOBAL_ROLE_OPTIONS = exports.GLOBAL_USER_ROLE_SLUGS = void 0;
+exports.parseGlobalUserRoles = parseGlobalUserRoles;
+exports.isPlatformStaffRole = isPlatformStaffRole;
+exports.hasPlatformPermission = hasPlatformPermission;
+exports.getMergedPlatformPermissions = getMergedPlatformPermissions;
+const resolve_platform_permissions_1 = require("./resolve-platform-permissions");
+/** Global `user.role` values used by Better Auth admin plugin + KubbiSec platform staff. */
+exports.GLOBAL_USER_ROLE_SLUGS = [
+    "user",
+    "admin",
+    "platform_super_admin",
+    "platform_account_manager",
+];
+exports.GLOBAL_ROLE_OPTIONS = [
+    { value: "user", label: "Utilizador" },
+    { value: "admin", label: "Administrador da plataforma" },
+    { value: "platform_super_admin", label: "Super administrador da plataforma" },
+    { value: "platform_account_manager", label: "Gestor de contas" },
+];
+const STAFF_ROLE_SET = new Set([
+    "admin",
+    "platform_super_admin",
+    "platform_account_manager",
+]);
+/** Parses comma-separated global roles from `user.role`. */
+function parseGlobalUserRoles(role) {
+    if (!role?.trim())
+        return ["user"];
+    return role
+        .split(",")
+        .map((r) => r.trim())
+        .filter(Boolean);
+}
+function isPlatformStaffRole(role) {
+    return parseGlobalUserRoles(role).some((r) => STAFF_ROLE_SET.has(r));
+}
+function hasPlatformPermission(role, permission) {
+    const roles = parseGlobalUserRoles(role);
+    for (const r of roles) {
+        if ((0, resolve_platform_permissions_1.getPlatformPermissionsFromGlobalUserRole)(r).has(permission))
+            return true;
+    }
+    return false;
+}
+function getMergedPlatformPermissions(role) {
+    const merged = new Set();
+    for (const r of parseGlobalUserRoles(role)) {
+        for (const p of (0, resolve_platform_permissions_1.getPlatformPermissionsFromGlobalUserRole)(r)) {
+            merged.add(p);
+        }
+    }
+    return merged;
+}
+//# sourceMappingURL=platform-staff.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-staff.js","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":";;;AA2BA,oDAMC;AAED,kDAEC;AAED,sDASC;AAED,oEAUC;AA3DD,iFAA0F;AAE1F,4FAA4F;AAC/E,QAAA,sBAAsB,GAAG;IACpC,MAAM;IACN,OAAO;IACP,sBAAsB;IACtB,0BAA0B;CAClB,CAAC;AAIE,QAAA,mBAAmB,GAAgE;IAC9F,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;IACtC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE;IACxD,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAC7E,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,kBAAkB,EAAE;CACjE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,OAAO;IACP,sBAAsB;IACtB,0BAA0B;CAC3B,CAAC,CAAC;AAEH,4DAA4D;AAC5D,SAAgB,oBAAoB,CAAC,IAA+B;IAClE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAA+B;IACjE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAA+B,EAC/B,UAA8B;IAE9B,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,4BAA4B,CAC1C,IAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.d.ts

@@ -0,0 +1,10 @@
+import { normalizeStoredOrgRole } from "./better-auth-org-roles";
+import type { KubbisecPermission, OrgRoleSlug } from "./kubbisec-permissions";
+/** Maps stored org roles (Kubbisec slugs + legacy Better Auth) → canonical `OrgRoleSlug`. */
+export declare const normalizeOrgMemberRole: typeof normalizeStoredOrgRole;
+/** Effective tenant permissions for an organization member role (see rbac-catalog.md §4). */
+export declare function getTenantPermissionsForOrgRole(role: OrgRoleSlug): ReadonlySet<KubbisecPermission>;
+/** Full tenant permission set (e.g. API-key-only automation, parity with org admin). */
+export declare function getAllTenantPermissions(): ReadonlySet<KubbisecPermission>;
+export declare function parseApiKeyPermissionsJson(raw: string | Record<string, unknown> | unknown[] | null | undefined): KubbisecPermission[] | null;
+//# sourceMappingURL=resolve-org-permissions.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-org-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/resolve-org-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE9E,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,+BAAyB,CAAC;AAmE7D,6FAA6F;AAC7F,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,CA4FjG;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAEzE;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,GAAG,SAAS,GACnE,kBAAkB,EAAE,GAAG,IAAI,CAsB7B"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeOrgMemberRole = void 0;
+exports.getTenantPermissionsForOrgRole = getTenantPermissionsForOrgRole;
+exports.getAllTenantPermissions = getAllTenantPermissions;
+exports.parseApiKeyPermissionsJson = parseApiKeyPermissionsJson;
+const better_auth_org_roles_1 = require("./better-auth-org-roles");
+/** Maps stored org roles (Kubbisec slugs + legacy Better Auth) → canonical `OrgRoleSlug`. */
+exports.normalizeOrgMemberRole = better_auth_org_roles_1.normalizeStoredOrgRole;
+const ALL_TENANT = new Set([
+    "kbsc.org.profile.read",
+    "kbsc.org.profile.update",
+    "kbsc.org.settings.manage",
+    "kbsc.org.delete",
+    "kbsc.identity.member.read",
+    "kbsc.identity.member.invite",
+    "kbsc.identity.member.role.update",
+    "kbsc.identity.member.remove",
+    "kbsc.identity.invitation.manage",
+    "kbsc.asset.project.read",
+    "kbsc.asset.project.create",
+    "kbsc.asset.project.update",
+    "kbsc.asset.project.delete",
+    "kbsc.finding.read",
+    "kbsc.finding.triage.update",
+    "kbsc.finding.remediation.manage",
+    "kbsc.finding.remediation.auto-apply",
+    "kbsc.finding.export",
+    "kbsc.ingest.report.create",
+    "kbsc.supply.read",
+    "kbsc.supply.policy.comment",
+    "kbsc.supply.scan.trigger",
+    "kbsc.governance.read",
+    "kbsc.governance.coverage.manage",
+    "kbsc.ingest.coverage.create",
+    "kbsc.integration.read",
+    "kbsc.integration.connect",
+    "kbsc.integration.disconnect",
+    "kbsc.integration.secret.write",
+    "kbsc.integration.issue.create",
+    "kbsc.integration.pr.create",
+    "kbsc.ci.read",
+    "kbsc.ci.pipeline.manage",
+    "kbsc.ci.pipeline.run",
+    "kbsc.ci.privileged.run",
+    "kbsc.ci.runner.manage",
+    "kbsc.ci.envpack.manage",
+    "kbsc.ci.bootstrap.manage",
+    "kbsc.credential.apikey.read",
+    "kbsc.credential.apikey.create",
+    "kbsc.credential.apikey.revoke",
+    "kbsc.notification.read",
+    "kbsc.notification.preference.manage",
+    "kbsc.ai.provider.manage",
+    "kbsc.ai.usage.read",
+    "kbsc.ai.assistant.use",
+    "kbsc.ai.automation.auto",
+    "kbsc.project.ai-autopilot.manage",
+    "kbsc.project.ai-autopilot.run",
+    "kbsc.integration.pr.merge",
+    "kbsc.billing.read",
+    "kbsc.billing.manage",
+    "kbsc.contract.read",
+    "kbsc.contract.manage",
+    "kbsc.identity.member.permission.manage",
+    "kbsc.org.security.read",
+    "kbsc.org.security.manage",
+    "kbsc.org.assistant.manage",
+].map((p) => p));
+/** Effective tenant permissions for an organization member role (see rbac-catalog.md §4). */
+function getTenantPermissionsForOrgRole(role) {
+    switch (role) {
+        case "org_administrator":
+            return ALL_TENANT;
+        case "org_finance":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.billing.read",
+                "kbsc.billing.manage",
+                "kbsc.contract.read",
+                "kbsc.contract.manage",
+                "kbsc.notification.read",
+            ]);
+        case "org_security_engineer":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.asset.project.read",
+                "kbsc.asset.project.create",
+                "kbsc.asset.project.update",
+                "kbsc.finding.read",
+                "kbsc.finding.triage.update",
+                "kbsc.finding.remediation.manage",
+                "kbsc.finding.remediation.auto-apply",
+                "kbsc.finding.export",
+                "kbsc.ingest.report.create",
+                "kbsc.supply.read",
+                "kbsc.supply.policy.comment",
+                "kbsc.supply.scan.trigger",
+                "kbsc.governance.read",
+                "kbsc.governance.coverage.manage",
+                "kbsc.ingest.coverage.create",
+                "kbsc.integration.read",
+                "kbsc.integration.connect",
+                "kbsc.ci.read",
+                "kbsc.credential.apikey.read",
+                "kbsc.notification.read",
+                "kbsc.notification.preference.manage",
+                "kbsc.ai.usage.read",
+                "kbsc.ai.assistant.use",
+                "kbsc.project.ai-autopilot.run",
+            ]);
+        case "org_delivery_engineer":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.asset.project.read",
+                "kbsc.asset.project.create",
+                "kbsc.asset.project.update",
+                "kbsc.finding.read",
+                "kbsc.finding.export",
+                "kbsc.ingest.report.create",
+                "kbsc.supply.read",
+                "kbsc.supply.scan.trigger",
+                "kbsc.governance.read",
+                "kbsc.governance.coverage.manage",
+                "kbsc.ingest.coverage.create",
+                "kbsc.integration.read",
+                "kbsc.integration.connect",
+                "kbsc.integration.disconnect",
+                "kbsc.integration.secret.write",
+                "kbsc.ci.read",
+                "kbsc.ci.pipeline.manage",
+                "kbsc.ci.pipeline.run",
+                "kbsc.ci.runner.manage",
+                "kbsc.ci.envpack.manage",
+                "kbsc.ci.bootstrap.manage",
+                "kbsc.credential.apikey.read",
+                "kbsc.credential.apikey.create",
+                "kbsc.credential.apikey.revoke",
+                "kbsc.notification.read",
+                "kbsc.notification.preference.manage",
+                "kbsc.ai.usage.read",
+                "kbsc.ai.assistant.use",
+            ]);
+        case "org_observer":
+            return new Set([
+                "kbsc.org.profile.read",
+                "kbsc.identity.member.read",
+                "kbsc.asset.project.read",
+                "kbsc.finding.read",
+                "kbsc.finding.export",
+                "kbsc.supply.read",
+                "kbsc.governance.read",
+                "kbsc.integration.read",
+                "kbsc.ci.read",
+                "kbsc.notification.read",
+                "kbsc.ai.usage.read",
+                "kbsc.ai.assistant.use",
+            ]);
+    }
+}
+/** Full tenant permission set (e.g. API-key-only automation, parity with org admin). */
+function getAllTenantPermissions() {
+    return ALL_TENANT;
+}
+function parseApiKeyPermissionsJson(raw) {
+    if (raw == null)
+        return null;
+    try {
+        const v = typeof raw === "string" ? (raw.trim() === "" ? null : JSON.parse(raw)) : raw;
+        if (v == null)
+            return null;
+        const rawPermissions = (() => {
+            if (Array.isArray(v))
+                return v;
+            if (typeof v === "object" && v !== null)
+                return Object.values(v).flatMap((value) => (Array.isArray(value) ? value : []));
+            return null;
+        })();
+        if (!rawPermissions)
+            return null;
+        const out = new Set();
+        for (const x of rawPermissions) {
+            if (typeof x === "string" && ALL_TENANT.has(x)) {
+                out.add(x);
+            }
+        }
+        return out.size ? [...out] : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=resolve-org-permissions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-org-permissions.js","sourceRoot":"","sources":["../../src/rbac/resolve-org-permissions.ts"],"names":[],"mappings":";;;AAwEA,wEA4FC;AAGD,0DAEC;AAED,gEAwBC;AAnMD,mEAAiE;AAGjE,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,8CAAsB,CAAC;AAE7D,MAAM,UAAU,GAAoC,IAAI,GAAG,CAEvD;IACE,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,iBAAiB;IACjB,2BAA2B;IAC3B,6BAA6B;IAC7B,kCAAkC;IAClC,6BAA6B;IAC7B,iCAAiC;IACjC,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,mBAAmB;IACnB,4BAA4B;IAC5B,iCAAiC;IACjC,qCAAqC;IACrC,qBAAqB;IACrB,2BAA2B;IAC3B,kBAAkB;IAClB,4BAA4B;IAC5B,0BAA0B;IAC1B,sBAAsB;IACtB,iCAAiC;IACjC,6BAA6B;IAC7B,uBAAuB;IACvB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,4BAA4B;IAC5B,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,wBAAwB;IACxB,qCAAqC;IACrC,yBAAyB;IACzB,oBAAoB;IACpB,uBAAuB;IACvB,yBAAyB;IACzB,kCAAkC;IAClC,+BAA+B;IAC/B,2BAA2B;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,wCAAwC;IACxC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;CAE9B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAuB,CAAC,CACtC,CAAC;AAEF,6FAA6F;AAC7F,SAAgB,8BAA8B,CAAC,IAAiB;IAC9D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB;YACtB,OAAO,UAAU,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,mBAAmB;gBACnB,qBAAqB;gBACrB,oBAAoB;gBACpB,sBAAsB;gBACtB,wBAAwB;aACzB,CAAC,CAAC;QACL,KAAK,uBAAuB;YAC1B,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,2BAA2B;gBAC3B,2BAA2B;gBAC3B,mBAAmB;gBACnB,4BAA4B;gBAC5B,iCAAiC;gBACjC,qCAAqC;gBACrC,qBAAqB;gBACrB,2BAA2B;gBAC3B,kBAAkB;gBAClB,4BAA4B;gBAC5B,0BAA0B;gBAC1B,sBAAsB;gBACtB,iCAAiC;gBACjC,6BAA6B;gBAC7B,uBAAuB;gBACvB,0BAA0B;gBAC1B,cAAc;gBACd,6BAA6B;gBAC7B,wBAAwB;gBACxB,qCAAqC;gBACrC,oBAAoB;gBACpB,uBAAuB;gBACvB,+BAA+B;aAChC,CAAC,CAAC;QACL,KAAK,uBAAuB;YAC1B,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,2BAA2B;gBAC3B,2BAA2B;gBAC3B,mBAAmB;gBACnB,qBAAqB;gBACrB,2BAA2B;gBAC3B,kBAAkB;gBAClB,0BAA0B;gBAC1B,sBAAsB;gBACtB,iCAAiC;gBACjC,6BAA6B;gBAC7B,uBAAuB;gBACvB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,cAAc;gBACd,yBAAyB;gBACzB,sBAAsB;gBACtB,uBAAuB;gBACvB,wBAAwB;gBACxB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,+BAA+B;gBAC/B,wBAAwB;gBACxB,qCAAqC;gBACrC,oBAAoB;gBACpB,uBAAuB;aACxB,CAAC,CAAC;QACL,KAAK,cAAc;YACjB,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,mBAAmB;gBACnB,qBAAqB;gBACrB,kBAAkB;gBAClB,sBAAsB;gBACtB,uBAAuB;gBACvB,cAAc;gBACd,wBAAwB;gBACxB,oBAAoB;gBACpB,uBAAuB;aACxB,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAgB,uBAAuB;IACrC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,0BAA0B,CACxC,GAAoE;IAEpE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvF,IAAI,CAAC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;YAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;gBACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,CAAuB,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,GAAG,CAAC,CAAuB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.d.ts

@@ -0,0 +1,7 @@
+import { type KubbisecPermission } from "./kubbisec-permissions";
+/**
+ * Maps global `user.role` (Better Auth admin plugin uses `admin`) + future slugs.
+ * `admin` and `platform_super_admin` receive the full `kbsc.*` catalog (tenant + platform).
+ */
+export declare function getPlatformPermissionsFromGlobalUserRole(role: string | null | undefined): ReadonlySet<KubbisecPermission>;
+//# sourceMappingURL=resolve-platform-permissions.d.ts.map