@kubbisec/ai-linux-x64 0.1.20 → 0.1.22

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KUBBISEC_PRODUCT_MENTAL_MAP_XML = exports.KUBBISEC_MCP_INSTRUCTIONS = exports.formatMcpKnowledgeForSystemPrompt = exports.KUBBISEC_CLI_REFERENCE_INDEX = exports.buildChatSystemPrompt = exports.buildAssistantSystemPrompt = void 0;
+var build_assistant_system_prompt_1 = require("./build-assistant-system-prompt");
+Object.defineProperty(exports, "buildAssistantSystemPrompt", { enumerable: true, get: function () { return build_assistant_system_prompt_1.buildAssistantSystemPrompt; } });
+var build_chat_system_prompt_1 = require("./build-chat-system-prompt");
+Object.defineProperty(exports, "buildChatSystemPrompt", { enumerable: true, get: function () { return build_chat_system_prompt_1.buildChatSystemPrompt; } });
+var cli_reference_index_1 = require("./cli-reference-index");
+Object.defineProperty(exports, "KUBBISEC_CLI_REFERENCE_INDEX", { enumerable: true, get: function () { return cli_reference_index_1.KUBBISEC_CLI_REFERENCE_INDEX; } });
+var format_mcp_knowledge_1 = require("./format-mcp-knowledge");
+Object.defineProperty(exports, "formatMcpKnowledgeForSystemPrompt", { enumerable: true, get: function () { return format_mcp_knowledge_1.formatMcpKnowledgeForSystemPrompt; } });
+var mcp_instructions_1 = require("./mcp-instructions");
+Object.defineProperty(exports, "KUBBISEC_MCP_INSTRUCTIONS", { enumerable: true, get: function () { return mcp_instructions_1.KUBBISEC_MCP_INSTRUCTIONS; } });
+var mental_map_1 = require("./mental-map");
+Object.defineProperty(exports, "KUBBISEC_PRODUCT_MENTAL_MAP_XML", { enumerable: true, get: function () { return mental_map_1.KUBBISEC_PRODUCT_MENTAL_MAP_XML; } });
+//# sourceMappingURL=index.js.map

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ai/product-knowledge/index.ts"],"names":[],"mappings":";;;AAAA,iFAGyC;AADvC,2IAAA,0BAA0B,OAAA;AAE5B,uEAGoC;AADlC,iIAAA,qBAAqB,OAAA;AAEvB,6DAAqE;AAA5D,mIAAA,4BAA4B,OAAA;AACrC,+DAGgC;AAF9B,yIAAA,iCAAiC,OAAA;AAGnC,uDAA+D;AAAtD,6HAAA,yBAAyB,OAAA;AAClC,2CAA+D;AAAtD,6HAAA,+BAA+B,OAAA"}

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/mcp-instructions.d.ts

@@ -0,0 +1,2 @@
+export declare const KUBBISEC_MCP_INSTRUCTIONS = "<kubbisec-mcp-instructions>\n<kubbisec-product-knowledge>\n  <products>\n    <product id=\"naus\" npm=\"@kubbisec/naus\" bin=\"naus\">KubbiSec CI engine: .naus.yml pipelines, runners, validate/plan/run. Cloud CI uses Env Packs; local run uses --env-file / --secret-file.</product>\n    <product id=\"aspm\" npm=\"@kubbisec/aspm\" bin=\"aspm\">Security CLI: parse/upload scanner reports (trivy, gitleaks, syft, osv, semgrep, sonar, nmap, skipfish), coverage, gate.</product>\n    <product id=\"ai\" npm=\"@kubbisec/ai\" bin=\"kubbisec\">CLI hub: login, findings (ls/show), fix/watch/chat, optional naus/aspm forwarding when binaries are on PATH.</product>\n  </products>\n  <boundaries>\n    <boundary>NAUS YAML is NOT GitHub Actions: top-level run: (never jobs:); script: + depends_on: (never commands:/needs:/steps:); ASPM jobs use kind: aspm|aspm_matrix|aspm_gate with tool: (never scanner:).</boundary>\n    <boundary>aspm-cicd.md / aspm_docs section aspm-cicd describe GitHub Actions only. For KubbiSec native CI use naus_pipeline_docs (naus-aspm-integration, naus-aspm-preset, naus-aspm-matrix, naus-aspm-gate).</boundary>\n    <boundary>Do not mix CLIs: naus for pipelines/runners; aspm for scan upload/parse; kubbisec for AI remediation/chat. Org flag -o uses organization slug.</boundary>\n  </boundaries>\n  <anti-hallucination>\n    <rule>HARD-GATE: never invent CLI flags or full command lines \u2014 call naus_pipeline_docs (naus-commands), aspm_docs (aspm-commands), kubbisec://ai/ai-commands, or security_scanner_playbook first.</rule>\n    <rule>HARD-GATE: never output fenced NAUS pipeline YAML unless naus_validate_yaml (or naus_local_validate) returned ok in this session.</rule>\n    <rule>HARD-GATE: never claim a tool/action succeeded without a successful tool_result in this turn.</rule>\n  </anti-hallucination>\n  <tool-routing>\n    <route intent=\"platform-knowledge\">kubbisec_mcp_knowledge (start of naus/aspm/ai product questions)</route>\n    <route intent=\"naus-docs-yaml\">naus_pipeline_docs \u2192 naus_schema_overview \u2192 naus_validate_yaml</route>\n    <route intent=\"aspm-docs\">aspm_docs; scanners: security_scanners_catalog \u2192 security_scanner_playbook</route>\n    <route intent=\"ai-cli-docs\">kubbisec://ai/* (ai-commands, ai-watch, ai-login)</route>\n    <route intent=\"local-clis\">naus_local_* / aspm_local_* / github_local_* always available in chat (no --extended-context); github uses host-first auth; missing naus/aspm auto-install @kubbisec/naus|aspm</route>\n  </tool-routing>\n</kubbisec-product-knowledge>\n\n<flows>\n  <flow id=\"findings\">Recommended flow: use resolve_project_by_repository with repository_url or repositoryUrl (Git URL or org/repo), then list_vulnerabilities with the same repository fields or project_id/projectId. Tools accept snake_case and camelCase interchangeably. To act on a finding, use get_vulnerability (MCP) or get_finding_summary / list_findings (assistant CLI), then generate_remediation_plan and, if you want automation, start_ai_remediation_run followed by get_ai_remediation_run_status/get_ai_remediation_run_logs (run_id or runId). Pass vulnerabilityId (or vulnerability_id) in tool arguments when using kbs chat \u2014 there is no separate set_active_finding tool. kubbisec:// resources expose the same project \u2194 repository mapping.</flow>\n  <flow id=\"naus-cloud\">Naus CI YAML (cloud / kbs chat): (1) naus_pipeline_docs or kubbisec://naus/* (same web markdown), (2) naus_validate_yaml / validate_naus_pipeline_yaml before persisting, (3) set_editor_yaml \u2192 set_pipeline_yaml \u2192 trigger_run \u2192 get_run_logs_excerpt.</flow>\n  <flow id=\"naus-aspm-local\">Naus / ASPM / git on the developer machine (kbs or kubbisec chat; no --extended-context required): naus_local_validate | naus_local_plan | naus_local_run; aspm_local_scan | aspm_local_upload | aspm_local_doctor; github_local_* uses host-first gh/git auth (platform token only as remediation fallback). Missing naus/aspm binaries auto-install @kubbisec/naus and @kubbisec/aspm globally via npm/pnpm (allowlist). Local naus run/plan: default .secrets and .env in cwd, or --env-file / --secret-file; naus_local_run and naus_local_plan accept envFiles/secretFiles arrays. Cloud runners use Env Packs instead. Runner enrollment (naus register / naus start) is documented in naus_pipeline_docs (runner-management) \u2014 do not spawn long-lived daemons from chat.</flow>\n  <flow id=\"kubbisec-scan\">Hybrid local scan: MCP cannot run Pi/Superpowers on the host. (1) resolve_project_by_repository with repository_url or repositoryUrl (Git URL or org/repo), or project_id/projectId. (2) trigger_kubbisec_scan with profile quick|full|ci (default full), upload (default true), require_scanners/requireScanners optional. (3) get_kubbisec_scan_status with task_id/taskId until status is done, failed, or cancelled; list_kubbisec_scan_tasks or cancel_kubbisec_scan_task as needed. Requires kubbisec watch or kubbisec scan --watch on a developer machine with repo checkout \u2014 task stays pending until claimed. Findings upload with source=KUBBISEC_AI; filter via list_vulnerabilities source=KUBBISEC_AI. Docs: kubbisec://ai/scan, kubbisec://ai/scan-watch, kubbisec://ai/mcp-login. For immediate local scan without queue, user runs kubbisec scan in terminal (not an MCP tool).</flow>\n</flows>\n\n<intent-matrix>\n| Intent | Cloud (API/MCP) | Local (host CLI) |\n| Validate YAML | naus_validate_yaml | naus_local_validate |\n| Run pipeline | trigger_run | naus_local_run (prefer cloud for KubbiSec CI) |\n| Dependency graph | \u2014 | naus_local_plan |\n| Upload scan report | CI / findings API | aspm_local_upload |\n| ASPM CLI health | \u2014 | aspm_local_doctor |\n| Hybrid AI scan | trigger_kubbisec_scan | kubbisec scan |\n| Scan status | get_kubbisec_scan_status | stdout / .kubbisec/scan/&lt;runId&gt;/ |\n| Filter AI findings | list_vulnerabilities + source=KUBBISEC_AI | \u2014 |\n| MCP auth | hosted OAuth / device login | kubbisec mcp login |\n</intent-matrix>\n\n<rules>\n  <rule id=\"superpowers-mcp\">MCP agents must NOT invoke Pi/Superpowers skills or spawn kubbisec chat for scan orchestration. Read kubbisec://ai/* and kubbisec://naus/* for documentation only. Scan = trigger_kubbisec_scan; remediation = start_ai_remediation_run.</rule>\n  <rule id=\"hosted-mcp\">Hosted MCP endpoint: https://mcp.kubbisec.com/mcp (OAuth2 for cloud IDEs). Local stdio: set KUBBISEC_ORGANIZATION_SLUG (preferred, e.g. minha-empresa) and KUBBISEC_API_KEY, or run kubbisec mcp login for device flow. Legacy KUBBISEC_ORGANIZATION_ID remains supported.</rule>\n</rules>\n\n<aspm>ASPM CLI: aspm_docs includes web guides plus docs/aspm/docker-cli (init, login, doctor, scan, upload).</aspm>\n</kubbisec-mcp-instructions>";
+//# sourceMappingURL=mcp-instructions.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/mcp-instructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-instructions.d.ts","sourceRoot":"","sources":["../../../src/ai/product-knowledge/mcp-instructions.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,yBAAyB,goNA6BT,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/mcp-instructions.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KUBBISEC_MCP_INSTRUCTIONS = void 0;
+const constants_1 = require("../../mcp/constants");
+const mental_map_1 = require("./mental-map");
+exports.KUBBISEC_MCP_INSTRUCTIONS = `<kubbisec-mcp-instructions>
+${mental_map_1.KUBBISEC_PRODUCT_MENTAL_MAP_XML}
+
+<flows>
+  <flow id="findings">Recommended flow: use resolve_project_by_repository with repository_url or repositoryUrl (Git URL or org/repo), then list_vulnerabilities with the same repository fields or project_id/projectId. Tools accept snake_case and camelCase interchangeably. To act on a finding, use get_vulnerability (MCP) or get_finding_summary / list_findings (assistant CLI), then generate_remediation_plan and, if you want automation, start_ai_remediation_run followed by get_ai_remediation_run_status/get_ai_remediation_run_logs (run_id or runId). Pass vulnerabilityId (or vulnerability_id) in tool arguments when using kbs chat — there is no separate set_active_finding tool. kubbisec:// resources expose the same project ↔ repository mapping.</flow>
+  <flow id="naus-cloud">Naus CI YAML (cloud / kbs chat): (1) naus_pipeline_docs or kubbisec://naus/* (same web markdown), (2) naus_validate_yaml / validate_naus_pipeline_yaml before persisting, (3) set_editor_yaml → set_pipeline_yaml → trigger_run → get_run_logs_excerpt.</flow>
+  <flow id="naus-aspm-local">Naus / ASPM / git on the developer machine (kbs or kubbisec chat; no --extended-context required): naus_local_validate | naus_local_plan | naus_local_run; aspm_local_scan | aspm_local_upload | aspm_local_doctor; github_local_* uses host-first gh/git auth (platform token only as remediation fallback). Missing naus/aspm binaries auto-install @kubbisec/naus and @kubbisec/aspm globally via npm/pnpm (allowlist). Local naus run/plan: default .secrets and .env in cwd, or --env-file / --secret-file; naus_local_run and naus_local_plan accept envFiles/secretFiles arrays. Cloud runners use Env Packs instead. Runner enrollment (naus register / naus start) is documented in naus_pipeline_docs (runner-management) — do not spawn long-lived daemons from chat.</flow>
+  <flow id="kubbisec-scan">Hybrid local scan: MCP cannot run Pi/Superpowers on the host. (1) resolve_project_by_repository with repository_url or repositoryUrl (Git URL or org/repo), or project_id/projectId. (2) trigger_kubbisec_scan with profile quick|full|ci (default full), upload (default true), require_scanners/requireScanners optional. (3) get_kubbisec_scan_status with task_id/taskId until status is done, failed, or cancelled; list_kubbisec_scan_tasks or cancel_kubbisec_scan_task as needed. Requires kubbisec watch or kubbisec scan --watch on a developer machine with repo checkout — task stays pending until claimed. Findings upload with source=KUBBISEC_AI; filter via list_vulnerabilities source=KUBBISEC_AI. Docs: kubbisec://ai/scan, kubbisec://ai/scan-watch, kubbisec://ai/mcp-login. For immediate local scan without queue, user runs kubbisec scan in terminal (not an MCP tool).</flow>
+</flows>
+
+<intent-matrix>
+| Intent | Cloud (API/MCP) | Local (host CLI) |
+| Validate YAML | naus_validate_yaml | naus_local_validate |
+| Run pipeline | trigger_run | naus_local_run (prefer cloud for KubbiSec CI) |
+| Dependency graph | — | naus_local_plan |
+| Upload scan report | CI / findings API | aspm_local_upload |
+| ASPM CLI health | — | aspm_local_doctor |
+| Hybrid AI scan | trigger_kubbisec_scan | kubbisec scan |
+| Scan status | get_kubbisec_scan_status | stdout / .kubbisec/scan/&lt;runId&gt;/ |
+| Filter AI findings | list_vulnerabilities + source=KUBBISEC_AI | — |
+| MCP auth | hosted OAuth / device login | kubbisec mcp login |
+</intent-matrix>
+
+<rules>
+  <rule id="superpowers-mcp">MCP agents must NOT invoke Pi/Superpowers skills or spawn kubbisec chat for scan orchestration. Read kubbisec://ai/* and kubbisec://naus/* for documentation only. Scan = trigger_kubbisec_scan; remediation = start_ai_remediation_run.</rule>
+  <rule id="hosted-mcp">Hosted MCP endpoint: ${constants_1.KUBBISEC_HOSTED_MCP_URL} (OAuth2 for cloud IDEs). Local stdio: set KUBBISEC_ORGANIZATION_SLUG (preferred, e.g. minha-empresa) and KUBBISEC_API_KEY, or run kubbisec mcp login for device flow. Legacy KUBBISEC_ORGANIZATION_ID remains supported.</rule>
+</rules>
+
+<aspm>ASPM CLI: aspm_docs includes web guides plus docs/aspm/docker-cli (init, login, doctor, scan, upload).</aspm>
+</kubbisec-mcp-instructions>`;
+//# sourceMappingURL=mcp-instructions.js.map

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/mcp-instructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-instructions.js","sourceRoot":"","sources":["../../../src/ai/product-knowledge/mcp-instructions.ts"],"names":[],"mappings":";;;AAAA,mDAA8D;AAC9D,6CAA+D;AAElD,QAAA,yBAAyB,GAAG;EACvC,4CAA+B;;;;;;;;;;;;;;;;;;;;;;;;+CAwBc,mCAAuB;;;;6BAIzC,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/mental-map.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Always-on AI product knowledge map (pseudo-XML).
+ * Keep under ~8k chars. Detail lives in tools / kubbisec:// resources.
+ */
+export declare const KUBBISEC_PRODUCT_MENTAL_MAP_XML = "<kubbisec-product-knowledge>\n  <products>\n    <product id=\"naus\" npm=\"@kubbisec/naus\" bin=\"naus\">KubbiSec CI engine: .naus.yml pipelines, runners, validate/plan/run. Cloud CI uses Env Packs; local run uses --env-file / --secret-file.</product>\n    <product id=\"aspm\" npm=\"@kubbisec/aspm\" bin=\"aspm\">Security CLI: parse/upload scanner reports (trivy, gitleaks, syft, osv, semgrep, sonar, nmap, skipfish), coverage, gate.</product>\n    <product id=\"ai\" npm=\"@kubbisec/ai\" bin=\"kubbisec\">CLI hub: login, findings (ls/show), fix/watch/chat, optional naus/aspm forwarding when binaries are on PATH.</product>\n  </products>\n  <boundaries>\n    <boundary>NAUS YAML is NOT GitHub Actions: top-level run: (never jobs:); script: + depends_on: (never commands:/needs:/steps:); ASPM jobs use kind: aspm|aspm_matrix|aspm_gate with tool: (never scanner:).</boundary>\n    <boundary>aspm-cicd.md / aspm_docs section aspm-cicd describe GitHub Actions only. For KubbiSec native CI use naus_pipeline_docs (naus-aspm-integration, naus-aspm-preset, naus-aspm-matrix, naus-aspm-gate).</boundary>\n    <boundary>Do not mix CLIs: naus for pipelines/runners; aspm for scan upload/parse; kubbisec for AI remediation/chat. Org flag -o uses organization slug.</boundary>\n  </boundaries>\n  <anti-hallucination>\n    <rule>HARD-GATE: never invent CLI flags or full command lines \u2014 call naus_pipeline_docs (naus-commands), aspm_docs (aspm-commands), kubbisec://ai/ai-commands, or security_scanner_playbook first.</rule>\n    <rule>HARD-GATE: never output fenced NAUS pipeline YAML unless naus_validate_yaml (or naus_local_validate) returned ok in this session.</rule>\n    <rule>HARD-GATE: never claim a tool/action succeeded without a successful tool_result in this turn.</rule>\n  </anti-hallucination>\n  <tool-routing>\n    <route intent=\"platform-knowledge\">kubbisec_mcp_knowledge (start of naus/aspm/ai product questions)</route>\n    <route intent=\"naus-docs-yaml\">naus_pipeline_docs \u2192 naus_schema_overview \u2192 naus_validate_yaml</route>\n    <route intent=\"aspm-docs\">aspm_docs; scanners: security_scanners_catalog \u2192 security_scanner_playbook</route>\n    <route intent=\"ai-cli-docs\">kubbisec://ai/* (ai-commands, ai-watch, ai-login)</route>\n    <route intent=\"local-clis\">naus_local_* / aspm_local_* / github_local_* always available in chat (no --extended-context); github uses host-first auth; missing naus/aspm auto-install @kubbisec/naus|aspm</route>\n  </tool-routing>\n</kubbisec-product-knowledge>";
+//# sourceMappingURL=mental-map.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/mental-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mental-map.d.ts","sourceRoot":"","sources":["../../../src/ai/product-knowledge/mental-map.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,+BAA+B,++EAuBd,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/mental-map.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KUBBISEC_PRODUCT_MENTAL_MAP_XML = void 0;
+/**
+ * Always-on AI product knowledge map (pseudo-XML).
+ * Keep under ~8k chars. Detail lives in tools / kubbisec:// resources.
+ */
+exports.KUBBISEC_PRODUCT_MENTAL_MAP_XML = `<kubbisec-product-knowledge>
+  <products>
+    <product id="naus" npm="@kubbisec/naus" bin="naus">KubbiSec CI engine: .naus.yml pipelines, runners, validate/plan/run. Cloud CI uses Env Packs; local run uses --env-file / --secret-file.</product>
+    <product id="aspm" npm="@kubbisec/aspm" bin="aspm">Security CLI: parse/upload scanner reports (trivy, gitleaks, syft, osv, semgrep, sonar, nmap, skipfish), coverage, gate.</product>
+    <product id="ai" npm="@kubbisec/ai" bin="kubbisec">CLI hub: login, findings (ls/show), fix/watch/chat, optional naus/aspm forwarding when binaries are on PATH.</product>
+  </products>
+  <boundaries>
+    <boundary>NAUS YAML is NOT GitHub Actions: top-level run: (never jobs:); script: + depends_on: (never commands:/needs:/steps:); ASPM jobs use kind: aspm|aspm_matrix|aspm_gate with tool: (never scanner:).</boundary>
+    <boundary>aspm-cicd.md / aspm_docs section aspm-cicd describe GitHub Actions only. For KubbiSec native CI use naus_pipeline_docs (naus-aspm-integration, naus-aspm-preset, naus-aspm-matrix, naus-aspm-gate).</boundary>
+    <boundary>Do not mix CLIs: naus for pipelines/runners; aspm for scan upload/parse; kubbisec for AI remediation/chat. Org flag -o uses organization slug.</boundary>
+  </boundaries>
+  <anti-hallucination>
+    <rule>HARD-GATE: never invent CLI flags or full command lines — call naus_pipeline_docs (naus-commands), aspm_docs (aspm-commands), kubbisec://ai/ai-commands, or security_scanner_playbook first.</rule>
+    <rule>HARD-GATE: never output fenced NAUS pipeline YAML unless naus_validate_yaml (or naus_local_validate) returned ok in this session.</rule>
+    <rule>HARD-GATE: never claim a tool/action succeeded without a successful tool_result in this turn.</rule>
+  </anti-hallucination>
+  <tool-routing>
+    <route intent="platform-knowledge">kubbisec_mcp_knowledge (start of naus/aspm/ai product questions)</route>
+    <route intent="naus-docs-yaml">naus_pipeline_docs → naus_schema_overview → naus_validate_yaml</route>
+    <route intent="aspm-docs">aspm_docs; scanners: security_scanners_catalog → security_scanner_playbook</route>
+    <route intent="ai-cli-docs">kubbisec://ai/* (ai-commands, ai-watch, ai-login)</route>
+    <route intent="local-clis">naus_local_* / aspm_local_* / github_local_* always available in chat (no --extended-context); github uses host-first auth; missing naus/aspm auto-install @kubbisec/naus|aspm</route>
+  </tool-routing>
+</kubbisec-product-knowledge>`;
+//# sourceMappingURL=mental-map.js.map

package/bundled/node_modules/@aspm/shared/dist/ai/product-knowledge/mental-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mental-map.js","sourceRoot":"","sources":["../../../src/ai/product-knowledge/mental-map.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACU,QAAA,+BAA+B,GAAG;;;;;;;;;;;;;;;;;;;;;;;8BAuBjB,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/api-key/api-key-scope-groups.d.ts

@@ -0,0 +1,12 @@
+import type { KubbisecPermission } from "../rbac/kubbisec-permissions";
+export type ApiKeyScopeGroup = {
+    id: string;
+    label: string;
+    description?: string;
+    permissions: KubbisecPermission[];
+};
+/** Org API key scopes — GitHub PAT-style groups (excludes platform.*). */
+export declare const ORG_API_KEY_SCOPE_GROUPS: ApiKeyScopeGroup[];
+export declare const ORG_API_KEY_SELECTABLE_PERMISSIONS: KubbisecPermission[];
+export declare function apiKeyPermissionLabel(permission: KubbisecPermission): string;
+//# sourceMappingURL=api-key-scope-groups.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/api-key/api-key-scope-groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-scope-groups.d.ts","sourceRoot":"","sources":["../../src/api-key/api-key-scope-groups.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,EAAE,gBAAgB,EAiFtD,CAAC;AAEF,eAAO,MAAM,kCAAkC,EAAE,kBAAkB,EACH,CAAC;AAEjE,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,CAE5E"}

package/bundled/node_modules/@aspm/shared/dist/api-key/api-key-scope-groups.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_API_KEY_SELECTABLE_PERMISSIONS = exports.ORG_API_KEY_SCOPE_GROUPS = void 0;
+exports.apiKeyPermissionLabel = apiKeyPermissionLabel;
+const kubbisec_permission_descriptions_1 = require("../rbac/kubbisec-permission-descriptions");
+/** Org API key scopes — GitHub PAT-style groups (excludes platform.*). */
+exports.ORG_API_KEY_SCOPE_GROUPS = [
+    {
+        id: "finding",
+        label: "Findings",
+        description: "Read and manage security findings",
+        permissions: [
+            "kbsc.finding.read",
+            "kbsc.finding.triage.update",
+            "kbsc.finding.remediation.manage",
+            "kbsc.finding.remediation.auto-apply",
+            "kbsc.finding.export",
+        ],
+    },
+    {
+        id: "ingest",
+        label: "Ingest & scan",
+        description: "Upload scanner reports and KubbiSec hybrid scan",
+        permissions: [
+            "kbsc.ingest.report.create",
+            "kbsc.ingest.coverage.create",
+            "kbsc.ingest.bundle.create",
+            "kbsc.scan.read",
+            "kbsc.scan.trigger",
+        ],
+    },
+    {
+        id: "ai",
+        label: "AI assistant",
+        description: "CLI proxy, autopilot and in-app assistant",
+        permissions: [
+            "kbsc.ai.assistant.use",
+            "kbsc.project.ai-autopilot.run",
+            "kbsc.project.ai-autopilot.manage",
+            "kbsc.ai.usage.read",
+        ],
+    },
+    {
+        id: "ci",
+        label: "CI / Naus",
+        description: "Pipelines, runners and env packs",
+        permissions: [
+            "kbsc.ci.read",
+            "kbsc.ci.pipeline.manage",
+            "kbsc.ci.pipeline.run",
+            "kbsc.ci.privileged.run",
+            "kbsc.ci.runner.manage",
+            "kbsc.ci.envpack.manage",
+            "kbsc.ci.bootstrap.manage",
+        ],
+    },
+    {
+        id: "integration",
+        label: "Integrations",
+        description: "GitHub, Jira, PR/issue automation",
+        permissions: [
+            "kbsc.integration.read",
+            "kbsc.integration.connect",
+            "kbsc.integration.issue.create",
+            "kbsc.integration.pr.create",
+            "kbsc.integration.pr.merge",
+        ],
+    },
+    {
+        id: "asset",
+        label: "Projects & assets",
+        permissions: [
+            "kbsc.asset.project.read",
+            "kbsc.asset.project.create",
+            "kbsc.asset.project.update",
+        ],
+    },
+    {
+        id: "supply",
+        label: "Supply chain",
+        permissions: ["kbsc.supply.read", "kbsc.supply.scan.trigger"],
+    },
+    {
+        id: "governance",
+        label: "Governance",
+        permissions: ["kbsc.governance.read", "kbsc.governance.coverage.manage"],
+    },
+];
+exports.ORG_API_KEY_SELECTABLE_PERMISSIONS = exports.ORG_API_KEY_SCOPE_GROUPS.flatMap((group) => group.permissions);
+function apiKeyPermissionLabel(permission) {
+    return kubbisec_permission_descriptions_1.KUBBISEC_PERMISSION_DESCRIPTIONS[permission] ?? permission;
+}
+//# sourceMappingURL=api-key-scope-groups.js.map

package/bundled/node_modules/@aspm/shared/dist/api-key/api-key-scope-groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-scope-groups.js","sourceRoot":"","sources":["../../src/api-key/api-key-scope-groups.ts"],"names":[],"mappings":";;;AAiGA,sDAEC;AAnGD,+FAA4F;AAU5F,0EAA0E;AAC7D,QAAA,wBAAwB,GAAuB;IAC1D;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,UAAU;QACjB,WAAW,EAAE,mCAAmC;QAChD,WAAW,EAAE;YACX,mBAAmB;YACnB,4BAA4B;YAC5B,iCAAiC;YACjC,qCAAqC;YACrC,qBAAqB;SACtB;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,iDAAiD;QAC9D,WAAW,EAAE;YACX,2BAA2B;YAC3B,6BAA6B;YAC7B,2BAA2B;YAC3B,gBAAgB;YAChB,mBAAmB;SACpB;KACF;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,2CAA2C;QACxD,WAAW,EAAE;YACX,uBAAuB;YACvB,+BAA+B;YAC/B,kCAAkC;YAClC,oBAAoB;SACrB;KACF;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,kCAAkC;QAC/C,WAAW,EAAE;YACX,cAAc;YACd,yBAAyB;YACzB,sBAAsB;YACtB,wBAAwB;YACxB,uBAAuB;YACvB,wBAAwB;YACxB,0BAA0B;SAC3B;KACF;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,mCAAmC;QAChD,WAAW,EAAE;YACX,uBAAuB;YACvB,0BAA0B;YAC1B,+BAA+B;YAC/B,4BAA4B;YAC5B,2BAA2B;SAC5B;KACF;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE;YACX,yBAAyB;YACzB,2BAA2B;YAC3B,2BAA2B;SAC5B;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;KAC9D;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,CAAC,sBAAsB,EAAE,iCAAiC,CAAC;KACzE;CACF,CAAC;AAEW,QAAA,kCAAkC,GAC7C,gCAAwB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAEjE,SAAgB,qBAAqB,CAAC,UAA8B;IAClE,OAAO,mEAAgC,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;AACpE,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/api-key/api-key-scope-presets.d.ts

@@ -0,0 +1,13 @@
+import type { KubbisecPermission } from "../rbac/kubbisec-permissions";
+/** Current API key authorization model (GitHub PAT-style scopes). */
+export declare const API_KEY_SCOPES_VERSION = 2;
+export declare const KUBBISEC_API_KEY_DEFAULT_PREFIX = "kbsc_";
+export declare const API_KEY_SCOPE_PRESET_IDS: readonly ["cli-dev", "ci-ingest", "naus-runner", "aspm-ingest", "assistant-chat"];
+export type ApiKeyScopePresetId = (typeof API_KEY_SCOPE_PRESET_IDS)[number];
+export declare const API_KEY_SCOPE_PRESET_LABELS: Record<ApiKeyScopePresetId, string>;
+export declare const API_KEY_SCOPE_PRESETS: Record<ApiKeyScopePresetId, readonly KubbisecPermission[]>;
+export declare function isApiKeyScopePresetId(value: string): value is ApiKeyScopePresetId;
+export declare function resolveApiKeyScopePreset(id: ApiKeyScopePresetId): KubbisecPermission[];
+export declare function permissionsToApiKeyStatements(permissions: KubbisecPermission[]): Record<string, KubbisecPermission[]>;
+export declare function normalizeApiKeyScopeSelection(permissions: KubbisecPermission[]): KubbisecPermission[];
+//# sourceMappingURL=api-key-scope-presets.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/api-key/api-key-scope-presets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-scope-presets.d.ts","sourceRoot":"","sources":["../../src/api-key/api-key-scope-presets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,eAAO,MAAM,+BAA+B,UAAU,CAAC;AAEvD,eAAO,MAAM,wBAAwB,mFAM3B,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAkC5E,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAM3E,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,CAM5F,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,mBAAmB,CAEjF;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,mBAAmB,GAAG,kBAAkB,EAAE,CAEtF;AAED,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,kBAAkB,EAAE,GAChC,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAEtC;AAED,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,kBAAkB,EAAE,GAChC,kBAAkB,EAAE,CAStB"}

package/bundled/node_modules/@aspm/shared/dist/api-key/api-key-scope-presets.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.API_KEY_SCOPE_PRESETS = exports.API_KEY_SCOPE_PRESET_LABELS = exports.API_KEY_SCOPE_PRESET_IDS = exports.KUBBISEC_API_KEY_DEFAULT_PREFIX = exports.API_KEY_SCOPES_VERSION = void 0;
+exports.isApiKeyScopePresetId = isApiKeyScopePresetId;
+exports.resolveApiKeyScopePreset = resolveApiKeyScopePreset;
+exports.permissionsToApiKeyStatements = permissionsToApiKeyStatements;
+exports.normalizeApiKeyScopeSelection = normalizeApiKeyScopeSelection;
+/** Current API key authorization model (GitHub PAT-style scopes). */
+exports.API_KEY_SCOPES_VERSION = 2;
+exports.KUBBISEC_API_KEY_DEFAULT_PREFIX = "kbsc_";
+exports.API_KEY_SCOPE_PRESET_IDS = [
+    "cli-dev",
+    "ci-ingest",
+    "naus-runner",
+    "aspm-ingest",
+    "assistant-chat",
+];
+const CLI_DEV_SCOPES = [
+    "kbsc.ai.assistant.use",
+    "kbsc.finding.read",
+    "kbsc.finding.remediation.manage",
+    "kbsc.project.ai-autopilot.run",
+    "kbsc.ingest.report.create",
+    "kbsc.scan.read",
+    "kbsc.scan.trigger",
+];
+const CI_INGEST_SCOPES = [
+    "kbsc.ingest.report.create",
+    "kbsc.ingest.coverage.create",
+];
+const NAUS_RUNNER_SCOPES = [
+    "kbsc.ci.read",
+    "kbsc.ci.pipeline.manage",
+    "kbsc.ci.privileged.run",
+    "kbsc.ci.runner.manage",
+    "kbsc.ci.envpack.manage",
+    "kbsc.ingest.report.create",
+    "kbsc.ingest.coverage.create",
+];
+const ASPM_INGEST_SCOPES = [
+    "kbsc.ingest.report.create",
+    "kbsc.ingest.coverage.create",
+];
+const ASSISTANT_CHAT_SCOPES = ["kbsc.ai.assistant.use"];
+exports.API_KEY_SCOPE_PRESET_LABELS = {
+    "cli-dev": "KubbiSec CLI (scan, watch, remediation)",
+    "ci-ingest": "CI ingest (reports + coverage, project-scoped)",
+    "naus-runner": "Naus runner + CI + ingest",
+    "aspm-ingest": "ASPM ingest (reports + coverage)",
+    "assistant-chat": "Assistant chat only (in-app / proxy)",
+};
+exports.API_KEY_SCOPE_PRESETS = {
+    "cli-dev": CLI_DEV_SCOPES,
+    "ci-ingest": CI_INGEST_SCOPES,
+    "naus-runner": NAUS_RUNNER_SCOPES,
+    "aspm-ingest": ASPM_INGEST_SCOPES,
+    "assistant-chat": ASSISTANT_CHAT_SCOPES,
+};
+function isApiKeyScopePresetId(value) {
+    return exports.API_KEY_SCOPE_PRESET_IDS.includes(value);
+}
+function resolveApiKeyScopePreset(id) {
+    return [...exports.API_KEY_SCOPE_PRESETS[id]];
+}
+function permissionsToApiKeyStatements(permissions) {
+    return { kubbisec: [...permissions] };
+}
+function normalizeApiKeyScopeSelection(permissions) {
+    const seen = new Set();
+    const ordered = [];
+    for (const perm of permissions) {
+        if (!perm.startsWith("kbsc.") || seen.has(perm))
+            continue;
+        seen.add(perm);
+        ordered.push(perm);
+    }
+    return ordered;
+}
+//# sourceMappingURL=api-key-scope-presets.js.map

package/bundled/node_modules/@aspm/shared/dist/api-key/api-key-scope-presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-scope-presets.js","sourceRoot":"","sources":["../../src/api-key/api-key-scope-presets.ts"],"names":[],"mappings":";;;AAiEA,sDAEC;AAED,4DAEC;AAED,sEAIC;AAED,sEAWC;AAxFD,qEAAqE;AACxD,QAAA,sBAAsB,GAAG,CAAC,CAAC;AAE3B,QAAA,+BAA+B,GAAG,OAAO,CAAC;AAE1C,QAAA,wBAAwB,GAAG;IACtC,SAAS;IACT,WAAW;IACX,aAAa;IACb,aAAa;IACb,gBAAgB;CACR,CAAC;AAIX,MAAM,cAAc,GAAG;IACrB,uBAAuB;IACvB,mBAAmB;IACnB,iCAAiC;IACjC,+BAA+B;IAC/B,2BAA2B;IAC3B,gBAAgB;IAChB,mBAAmB;CACW,CAAC;AAEjC,MAAM,gBAAgB,GAAG;IACvB,2BAA2B;IAC3B,6BAA6B;CACC,CAAC;AAEjC,MAAM,kBAAkB,GAAG;IACzB,cAAc;IACd,yBAAyB;IACzB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,6BAA6B;CACC,CAAC;AAEjC,MAAM,kBAAkB,GAAG;IACzB,2BAA2B;IAC3B,6BAA6B;CACC,CAAC;AAEjC,MAAM,qBAAqB,GAAG,CAAC,uBAAuB,CAAgC,CAAC;AAE1E,QAAA,2BAA2B,GAAwC;IAC9E,SAAS,EAAE,yCAAyC;IACpD,WAAW,EAAE,gDAAgD;IAC7D,aAAa,EAAE,2BAA2B;IAC1C,aAAa,EAAE,kCAAkC;IACjD,gBAAgB,EAAE,sCAAsC;CACzD,CAAC;AAEW,QAAA,qBAAqB,GAA+D;IAC/F,SAAS,EAAE,cAAc;IACzB,WAAW,EAAE,gBAAgB;IAC7B,aAAa,EAAE,kBAAkB;IACjC,aAAa,EAAE,kBAAkB;IACjC,gBAAgB,EAAE,qBAAqB;CACxC,CAAC;AAEF,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAQ,gCAA8C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAuB;IAC9D,OAAO,CAAC,GAAG,6BAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,6BAA6B,CAC3C,WAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAgB,6BAA6B,CAC3C,WAAiC;IAEjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/api-key/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./api-key-scope-groups";
+export * from "./api-key-scope-presets";
+export * from "./migrate-api-key-metadata";
+//# sourceMappingURL=index.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/api-key/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api-key/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/api-key/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./api-key-scope-groups"), exports);
+__exportStar(require("./api-key-scope-presets"), exports);
+__exportStar(require("./migrate-api-key-metadata"), exports);
+//# sourceMappingURL=index.js.map

package/bundled/node_modules/@aspm/shared/dist/api-key/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api-key/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,0DAAwC;AACxC,6DAA2C"}

package/bundled/node_modules/@aspm/shared/dist/api-key/migrate-api-key-metadata.d.ts

@@ -0,0 +1,20 @@
+import type { KubbisecPermission } from "../rbac/kubbisec-permissions";
+import { type ApiKeyScopePresetId } from "./api-key-scope-presets";
+export declare const PROJECT_CI_API_KEY_KIND: "project-ci-aspm-connection";
+export declare const KBS_CLI_API_KEY_KIND: "kbs_cli";
+export type ApiKeyMetadataRecord = Record<string, unknown>;
+export type MigrateApiKeyRowInput = {
+    metadata: string | null;
+    permissions: string | null;
+    prefix: string | null;
+};
+export type MigrateApiKeyRowResult = {
+    metadata: ApiKeyMetadataRecord;
+    permissions: KubbisecPermission[];
+    scopePreset: ApiKeyScopePresetId | null;
+};
+/**
+ * Maps legacy product/kind keys to explicit scope lists (scopes v2).
+ */
+export declare function migrateApiKeyRow(input: MigrateApiKeyRowInput): MigrateApiKeyRowResult;
+//# sourceMappingURL=migrate-api-key-metadata.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/api-key/migrate-api-key-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-api-key-metadata.d.ts","sourceRoot":"","sources":["../../src/api-key/migrate-api-key-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAGL,KAAK,mBAAmB,EAGzB,MAAM,yBAAyB,CAAC;AAEjC,eAAO,MAAM,uBAAuB,EAAG,4BAAqC,CAAC;AAC7E,eAAO,MAAM,oBAAoB,EAAG,SAAkB,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE3D,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,WAAW,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACzC,CAAC;AAmCF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAgCrF"}

package/bundled/node_modules/@aspm/shared/dist/api-key/migrate-api-key-metadata.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KBS_CLI_API_KEY_KIND = exports.PROJECT_CI_API_KEY_KIND = void 0;
+exports.migrateApiKeyRow = migrateApiKeyRow;
+const resolve_org_permissions_1 = require("../rbac/resolve-org-permissions");
+const api_key_scope_presets_1 = require("./api-key-scope-presets");
+exports.PROJECT_CI_API_KEY_KIND = "project-ci-aspm-connection";
+exports.KBS_CLI_API_KEY_KIND = "kbs_cli";
+function parseMetadata(raw) {
+    if (!raw)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // ignore
+    }
+    return {};
+}
+function readExistingPermissions(raw) {
+    if (!raw)
+        return [];
+    try {
+        const json = JSON.parse(raw);
+        return (0, resolve_org_permissions_1.parseApiKeyPermissionsJson)(json) ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+function inferPreset(metadata, prefix) {
+    if (metadata.kind === exports.PROJECT_CI_API_KEY_KIND)
+        return "ci-ingest";
+    if (metadata.kind === exports.KBS_CLI_API_KEY_KIND)
+        return "cli-dev";
+    if (metadata.product === "naus")
+        return "naus-runner";
+    if (metadata.product === "assistant")
+        return "cli-dev";
+    if (metadata.product === "aspm" || prefix === "aspm")
+        return "aspm-ingest";
+    if (prefix === "kbs_" || prefix === "kbsc" || prefix === "kbsc_")
+        return "cli-dev";
+    return "aspm-ingest";
+}
+/**
+ * Maps legacy product/kind keys to explicit scope lists (scopes v2).
+ */
+function migrateApiKeyRow(input) {
+    const metadata = parseMetadata(input.metadata);
+    const existing = readExistingPermissions(input.permissions);
+    const scopePresetFromMeta = typeof metadata.scopePreset === "string" && (0, api_key_scope_presets_1.isApiKeyScopePresetId)(metadata.scopePreset)
+        ? metadata.scopePreset
+        : null;
+    const scopePreset = scopePresetFromMeta ?? inferPreset(metadata, input.prefix);
+    const presetScopes = [...api_key_scope_presets_1.API_KEY_SCOPE_PRESETS[scopePreset]];
+    const permissions = existing.length > 0
+        ? (0, api_key_scope_presets_1.normalizeApiKeyScopeSelection)(existing)
+        : (0, api_key_scope_presets_1.normalizeApiKeyScopeSelection)(presetScopes);
+    const nextMetadata = {
+        ...metadata,
+        scopesVersion: api_key_scope_presets_1.API_KEY_SCOPES_VERSION,
+        scopePreset,
+    };
+    if (metadata.product != null) {
+        nextMetadata.legacyProduct = metadata.product;
+        delete nextMetadata.product;
+    }
+    return {
+        metadata: nextMetadata,
+        permissions,
+        scopePreset,
+    };
+}
+//# sourceMappingURL=migrate-api-key-metadata.js.map

package/bundled/node_modules/@aspm/shared/dist/api-key/migrate-api-key-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-api-key-metadata.js","sourceRoot":"","sources":["../../src/api-key/migrate-api-key-metadata.ts"],"names":[],"mappings":";;;AA+DA,4CAgCC;AA9FD,6EAA6E;AAC7E,mEAMiC;AAEpB,QAAA,uBAAuB,GAAG,4BAAqC,CAAC;AAChE,QAAA,oBAAoB,GAAG,SAAkB,CAAC;AAgBvD,SAAS,aAAa,CAAC,GAAkB;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO,MAA8B,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAkB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqD,CAAC;QACjF,OAAO,IAAA,oDAA0B,EAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAA8B,EAAE,MAAqB;IACxE,IAAI,QAAQ,CAAC,IAAI,KAAK,+BAAuB;QAAE,OAAO,WAAW,CAAC;IAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,4BAAoB;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,QAAQ,CAAC,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IAC3E,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACnF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE5D,MAAM,mBAAmB,GACvB,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAA,6CAAqB,EAAC,QAAQ,CAAC,WAAW,CAAC;QACrF,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,WAAW,GAAG,mBAAmB,IAAI,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,CAAC,GAAG,6CAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GACf,QAAQ,CAAC,MAAM,GAAG,CAAC;QACjB,CAAC,CAAC,IAAA,qDAA6B,EAAC,QAAQ,CAAC;QACzC,CAAC,CAAC,IAAA,qDAA6B,EAAC,YAAY,CAAC,CAAC;IAElD,MAAM,YAAY,GAAyB;QACzC,GAAG,QAAQ;QACX,aAAa,EAAE,8CAAsB;QACrC,WAAW;KACZ,CAAC;IAEF,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QAC7B,YAAY,CAAC,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC9C,OAAO,YAAY,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,WAAW;QACX,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/assistant/assistant-thread.d.ts

@@ -0,0 +1,19 @@
+export declare const ASSISTANT_THREAD_STORAGE_VERSION: 2;
+export declare const ASSISTANT_MAX_ACTIVE_THREADS = 50;
+export declare const ASSISTANT_THREAD_TITLE_MAX = 80;
+export declare function deriveAssistantThreadTitle(firstUserMessage: string): string;
+/** Extrai texto legível de uma mensagem (content string ou blocks markdown). */
+export declare function extractAssistantMessagePlainText(message: unknown): string;
+export declare function extractFirstUserMessagePlainText(messages: unknown[]): string;
+/** Título amigável para listagens (corrige títulos antigos serializados em JSON). */
+export declare function formatAssistantThreadTitleDisplay(title: string): string;
+/** Título curto da conversa ativa para o header; null se ainda não há mensagem do utilizador. */
+export declare function deriveActiveThreadTitleFromText(text: string): string | null;
+export declare function composeAssistantThreadIdbKey(threadId: string): string;
+export declare function composeActiveThreadSessionKey(input: {
+    organizationId: string;
+    userId: string;
+    mode: string;
+    entityId: string;
+}): string;
+//# sourceMappingURL=assistant-thread.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/assistant/assistant-thread.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assistant-thread.d.ts","sourceRoot":"","sources":["../../src/assistant/assistant-thread.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAC3D,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAM3E;AAkBD,gFAAgF;AAChF,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAUzE;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAS5E;AAmDD,qFAAqF;AACrF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED,iGAAiG;AACjG,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3E;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CAET"}