@kubbisec/ai-linux-x64 0.1.23 → 0.1.25

package/bundled/node_modules/@aspm/shared/dist/rbac/member-quota.d.ts

@@ -1,8 +0,0 @@
-/**
- * Org roles that do not consume a billable member seat.
- * Finance users only access billing; they do not use product features.
- */
-export declare const ORG_ROLES_EXEMPT_FROM_MEMBER_QUOTA: readonly ["org_finance"];
-/** Whether a member/invite role counts toward plan member limits and Stripe seat quantity. */
-export declare function orgRoleCountsTowardMemberQuota(role: string | null | undefined): boolean;
-//# sourceMappingURL=member-quota.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/member-quota.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"member-quota.d.ts","sourceRoot":"","sources":["../../src/rbac/member-quota.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0BAEJ,CAAC;AAI5C,8FAA8F;AAC9F,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGvF"}

package/bundled/node_modules/@aspm/shared/dist/rbac/member-quota.js

@@ -1,19 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ORG_ROLES_EXEMPT_FROM_MEMBER_QUOTA = void 0;
-exports.orgRoleCountsTowardMemberQuota = orgRoleCountsTowardMemberQuota;
-const better_auth_org_roles_1 = require("./better-auth-org-roles");
-/**
- * Org roles that do not consume a billable member seat.
- * Finance users only access billing; they do not use product features.
- */
-exports.ORG_ROLES_EXEMPT_FROM_MEMBER_QUOTA = [
-    "org_finance",
-];
-const exemptRoleSet = new Set(exports.ORG_ROLES_EXEMPT_FROM_MEMBER_QUOTA);
-/** Whether a member/invite role counts toward plan member limits and Stripe seat quantity. */
-function orgRoleCountsTowardMemberQuota(role) {
-    const normalized = (0, better_auth_org_roles_1.normalizeStoredOrgRole)(role);
-    return !exemptRoleSet.has(normalized);
-}
-//# sourceMappingURL=member-quota.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/member-quota.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"member-quota.js","sourceRoot":"","sources":["../../src/rbac/member-quota.ts"],"names":[],"mappings":";;;AAcA,wEAGC;AAjBD,mEAAiE;AAGjE;;;GAGG;AACU,QAAA,kCAAkC,GAAG;IAChD,aAAa;CAC4B,CAAC;AAE5C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,0CAAkC,CAAC,CAAC;AAE1E,8FAA8F;AAC9F,SAAgB,8BAA8B,CAAC,IAA+B;IAC5E,MAAM,UAAU,GAAG,IAAA,8CAAsB,EAAC,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.d.ts

@@ -1,14 +0,0 @@
-import type { KubbisecPermission } from "./kubbisec-permissions";
-/** Global `user.role` values used by Better Auth admin plugin + KubbiSec platform staff. */
-export declare const GLOBAL_USER_ROLE_SLUGS: readonly ["user", "admin", "platform_super_admin", "platform_account_manager"];
-export type GlobalUserRoleSlug = (typeof GLOBAL_USER_ROLE_SLUGS)[number];
-export declare const GLOBAL_ROLE_OPTIONS: ReadonlyArray<{
-    value: GlobalUserRoleSlug;
-    label: string;
-}>;
-/** Parses comma-separated global roles from `user.role`. */
-export declare function parseGlobalUserRoles(role: string | null | undefined): string[];
-export declare function isPlatformStaffRole(role: string | null | undefined): boolean;
-export declare function hasPlatformPermission(role: string | null | undefined, permission: KubbisecPermission): boolean;
-export declare function getMergedPlatformPermissions(role: string | null | undefined): ReadonlySet<KubbisecPermission>;
-//# sourceMappingURL=platform-staff.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform-staff.d.ts","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,gFAKzB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAK3F,CAAC;AAQF,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAM9E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAMT;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAQjC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.js

@@ -1,56 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GLOBAL_ROLE_OPTIONS = exports.GLOBAL_USER_ROLE_SLUGS = void 0;
-exports.parseGlobalUserRoles = parseGlobalUserRoles;
-exports.isPlatformStaffRole = isPlatformStaffRole;
-exports.hasPlatformPermission = hasPlatformPermission;
-exports.getMergedPlatformPermissions = getMergedPlatformPermissions;
-const resolve_platform_permissions_1 = require("./resolve-platform-permissions");
-/** Global `user.role` values used by Better Auth admin plugin + KubbiSec platform staff. */
-exports.GLOBAL_USER_ROLE_SLUGS = [
-    "user",
-    "admin",
-    "platform_super_admin",
-    "platform_account_manager",
-];
-exports.GLOBAL_ROLE_OPTIONS = [
-    { value: "user", label: "Utilizador" },
-    { value: "admin", label: "Administrador da plataforma" },
-    { value: "platform_super_admin", label: "Super administrador da plataforma" },
-    { value: "platform_account_manager", label: "Gestor de contas" },
-];
-const STAFF_ROLE_SET = new Set([
-    "admin",
-    "platform_super_admin",
-    "platform_account_manager",
-]);
-/** Parses comma-separated global roles from `user.role`. */
-function parseGlobalUserRoles(role) {
-    if (!role?.trim())
-        return ["user"];
-    return role
-        .split(",")
-        .map((r) => r.trim())
-        .filter(Boolean);
-}
-function isPlatformStaffRole(role) {
-    return parseGlobalUserRoles(role).some((r) => STAFF_ROLE_SET.has(r));
-}
-function hasPlatformPermission(role, permission) {
-    const roles = parseGlobalUserRoles(role);
-    for (const r of roles) {
-        if ((0, resolve_platform_permissions_1.getPlatformPermissionsFromGlobalUserRole)(r).has(permission))
-            return true;
-    }
-    return false;
-}
-function getMergedPlatformPermissions(role) {
-    const merged = new Set();
-    for (const r of parseGlobalUserRoles(role)) {
-        for (const p of (0, resolve_platform_permissions_1.getPlatformPermissionsFromGlobalUserRole)(r)) {
-            merged.add(p);
-        }
-    }
-    return merged;
-}
-//# sourceMappingURL=platform-staff.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/platform-staff.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform-staff.js","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":";;;AA2BA,oDAMC;AAED,kDAEC;AAED,sDASC;AAED,oEAUC;AA3DD,iFAA0F;AAE1F,4FAA4F;AAC/E,QAAA,sBAAsB,GAAG;IACpC,MAAM;IACN,OAAO;IACP,sBAAsB;IACtB,0BAA0B;CAClB,CAAC;AAIE,QAAA,mBAAmB,GAAgE;IAC9F,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;IACtC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE;IACxD,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAC7E,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,kBAAkB,EAAE;CACjE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,OAAO;IACP,sBAAsB;IACtB,0BAA0B;CAC3B,CAAC,CAAC;AAEH,4DAA4D;AAC5D,SAAgB,oBAAoB,CAAC,IAA+B;IAClE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAA+B;IACjE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAA+B,EAC/B,UAA8B;IAE9B,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,4BAA4B,CAC1C,IAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.d.ts

@@ -1,10 +0,0 @@
-import { normalizeStoredOrgRole } from "./better-auth-org-roles";
-import type { KubbisecPermission, OrgRoleSlug } from "./kubbisec-permissions";
-/** Maps stored org roles (Kubbisec slugs + legacy Better Auth) → canonical `OrgRoleSlug`. */
-export declare const normalizeOrgMemberRole: typeof normalizeStoredOrgRole;
-/** Effective tenant permissions for an organization member role (see rbac-catalog.md §4). */
-export declare function getTenantPermissionsForOrgRole(role: OrgRoleSlug): ReadonlySet<KubbisecPermission>;
-/** Full tenant permission set (e.g. API-key-only automation, parity with org admin). */
-export declare function getAllTenantPermissions(): ReadonlySet<KubbisecPermission>;
-export declare function parseApiKeyPermissionsJson(raw: string | Record<string, unknown> | unknown[] | null | undefined): KubbisecPermission[] | null;
-//# sourceMappingURL=resolve-org-permissions.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-org-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/resolve-org-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE9E,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,+BAAyB,CAAC;AAqE7D,6FAA6F;AAC7F,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,CA8FjG;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAEzE;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,GAAG,SAAS,GACnE,kBAAkB,EAAE,GAAG,IAAI,CAsB7B"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.js

@@ -1,200 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizeOrgMemberRole = void 0;
-exports.getTenantPermissionsForOrgRole = getTenantPermissionsForOrgRole;
-exports.getAllTenantPermissions = getAllTenantPermissions;
-exports.parseApiKeyPermissionsJson = parseApiKeyPermissionsJson;
-const better_auth_org_roles_1 = require("./better-auth-org-roles");
-/** Maps stored org roles (Kubbisec slugs + legacy Better Auth) → canonical `OrgRoleSlug`. */
-exports.normalizeOrgMemberRole = better_auth_org_roles_1.normalizeStoredOrgRole;
-const ALL_TENANT = new Set([
-    "kbsc.org.profile.read",
-    "kbsc.org.profile.update",
-    "kbsc.org.settings.manage",
-    "kbsc.org.delete",
-    "kbsc.identity.member.read",
-    "kbsc.identity.member.invite",
-    "kbsc.identity.member.role.update",
-    "kbsc.identity.member.remove",
-    "kbsc.identity.invitation.manage",
-    "kbsc.asset.project.read",
-    "kbsc.asset.project.create",
-    "kbsc.asset.project.update",
-    "kbsc.asset.project.delete",
-    "kbsc.finding.read",
-    "kbsc.finding.triage.update",
-    "kbsc.finding.remediation.manage",
-    "kbsc.finding.remediation.auto-apply",
-    "kbsc.finding.export",
-    "kbsc.ingest.report.create",
-    "kbsc.scan.read",
-    "kbsc.scan.trigger",
-    "kbsc.supply.read",
-    "kbsc.supply.policy.comment",
-    "kbsc.supply.scan.trigger",
-    "kbsc.governance.read",
-    "kbsc.governance.coverage.manage",
-    "kbsc.ingest.coverage.create",
-    "kbsc.integration.read",
-    "kbsc.integration.connect",
-    "kbsc.integration.disconnect",
-    "kbsc.integration.secret.write",
-    "kbsc.integration.issue.create",
-    "kbsc.integration.pr.create",
-    "kbsc.ci.read",
-    "kbsc.ci.pipeline.manage",
-    "kbsc.ci.pipeline.run",
-    "kbsc.ci.privileged.run",
-    "kbsc.ci.runner.manage",
-    "kbsc.ci.envpack.manage",
-    "kbsc.ci.bootstrap.manage",
-    "kbsc.credential.apikey.read",
-    "kbsc.credential.apikey.create",
-    "kbsc.credential.apikey.revoke",
-    "kbsc.notification.read",
-    "kbsc.notification.preference.manage",
-    "kbsc.ai.provider.manage",
-    "kbsc.ai.usage.read",
-    "kbsc.ai.assistant.use",
-    "kbsc.ai.automation.auto",
-    "kbsc.project.ai-autopilot.manage",
-    "kbsc.project.ai-autopilot.run",
-    "kbsc.integration.pr.merge",
-    "kbsc.billing.read",
-    "kbsc.billing.manage",
-    "kbsc.contract.read",
-    "kbsc.contract.manage",
-    "kbsc.identity.member.permission.manage",
-    "kbsc.org.security.read",
-    "kbsc.org.security.manage",
-    "kbsc.org.assistant.manage",
-].map((p) => p));
-/** Effective tenant permissions for an organization member role (see rbac-catalog.md §4). */
-function getTenantPermissionsForOrgRole(role) {
-    switch (role) {
-        case "org_administrator":
-            return ALL_TENANT;
-        case "org_finance":
-            return new Set([
-                "kbsc.org.profile.read",
-                "kbsc.identity.member.read",
-                "kbsc.billing.read",
-                "kbsc.billing.manage",
-                "kbsc.contract.read",
-                "kbsc.contract.manage",
-                "kbsc.notification.read",
-            ]);
-        case "org_security_engineer":
-            return new Set([
-                "kbsc.org.profile.read",
-                "kbsc.identity.member.read",
-                "kbsc.asset.project.read",
-                "kbsc.asset.project.create",
-                "kbsc.asset.project.update",
-                "kbsc.finding.read",
-                "kbsc.finding.triage.update",
-                "kbsc.finding.remediation.manage",
-                "kbsc.finding.remediation.auto-apply",
-                "kbsc.finding.export",
-                "kbsc.ingest.report.create",
-                "kbsc.scan.read",
-                "kbsc.scan.trigger",
-                "kbsc.supply.read",
-                "kbsc.supply.policy.comment",
-                "kbsc.supply.scan.trigger",
-                "kbsc.governance.read",
-                "kbsc.governance.coverage.manage",
-                "kbsc.ingest.coverage.create",
-                "kbsc.integration.read",
-                "kbsc.integration.connect",
-                "kbsc.ci.read",
-                "kbsc.credential.apikey.read",
-                "kbsc.notification.read",
-                "kbsc.notification.preference.manage",
-                "kbsc.ai.usage.read",
-                "kbsc.ai.assistant.use",
-                "kbsc.project.ai-autopilot.run",
-            ]);
-        case "org_delivery_engineer":
-            return new Set([
-                "kbsc.org.profile.read",
-                "kbsc.identity.member.read",
-                "kbsc.asset.project.read",
-                "kbsc.asset.project.create",
-                "kbsc.asset.project.update",
-                "kbsc.finding.read",
-                "kbsc.finding.export",
-                "kbsc.ingest.report.create",
-                "kbsc.supply.read",
-                "kbsc.supply.scan.trigger",
-                "kbsc.governance.read",
-                "kbsc.governance.coverage.manage",
-                "kbsc.ingest.coverage.create",
-                "kbsc.integration.read",
-                "kbsc.integration.connect",
-                "kbsc.integration.disconnect",
-                "kbsc.integration.secret.write",
-                "kbsc.ci.read",
-                "kbsc.ci.pipeline.manage",
-                "kbsc.ci.pipeline.run",
-                "kbsc.ci.runner.manage",
-                "kbsc.ci.envpack.manage",
-                "kbsc.ci.bootstrap.manage",
-                "kbsc.credential.apikey.read",
-                "kbsc.credential.apikey.create",
-                "kbsc.credential.apikey.revoke",
-                "kbsc.notification.read",
-                "kbsc.notification.preference.manage",
-                "kbsc.ai.usage.read",
-                "kbsc.ai.assistant.use",
-            ]);
-        case "org_observer":
-            return new Set([
-                "kbsc.org.profile.read",
-                "kbsc.identity.member.read",
-                "kbsc.asset.project.read",
-                "kbsc.finding.read",
-                "kbsc.finding.export",
-                "kbsc.supply.read",
-                "kbsc.governance.read",
-                "kbsc.integration.read",
-                "kbsc.ci.read",
-                "kbsc.notification.read",
-                "kbsc.ai.usage.read",
-                "kbsc.ai.assistant.use",
-            ]);
-    }
-}
-/** Full tenant permission set (e.g. API-key-only automation, parity with org admin). */
-function getAllTenantPermissions() {
-    return ALL_TENANT;
-}
-function parseApiKeyPermissionsJson(raw) {
-    if (raw == null)
-        return null;
-    try {
-        const v = typeof raw === "string" ? (raw.trim() === "" ? null : JSON.parse(raw)) : raw;
-        if (v == null)
-            return null;
-        const rawPermissions = (() => {
-            if (Array.isArray(v))
-                return v;
-            if (typeof v === "object" && v !== null)
-                return Object.values(v).flatMap((value) => (Array.isArray(value) ? value : []));
-            return null;
-        })();
-        if (!rawPermissions)
-            return null;
-        const out = new Set();
-        for (const x of rawPermissions) {
-            if (typeof x === "string" && ALL_TENANT.has(x)) {
-                out.add(x);
-            }
-        }
-        return out.size ? [...out] : null;
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=resolve-org-permissions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-org-permissions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-org-permissions.js","sourceRoot":"","sources":["../../src/rbac/resolve-org-permissions.ts"],"names":[],"mappings":";;;AA0EA,wEA8FC;AAGD,0DAEC;AAED,gEAwBC;AAvMD,mEAAiE;AAGjE,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,8CAAsB,CAAC;AAE7D,MAAM,UAAU,GAAoC,IAAI,GAAG,CAEvD;IACE,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,iBAAiB;IACjB,2BAA2B;IAC3B,6BAA6B;IAC7B,kCAAkC;IAClC,6BAA6B;IAC7B,iCAAiC;IACjC,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,mBAAmB;IACnB,4BAA4B;IAC5B,iCAAiC;IACjC,qCAAqC;IACrC,qBAAqB;IACrB,2BAA2B;IAC3B,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,4BAA4B;IAC5B,0BAA0B;IAC1B,sBAAsB;IACtB,iCAAiC;IACjC,6BAA6B;IAC7B,uBAAuB;IACvB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,4BAA4B;IAC5B,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,wBAAwB;IACxB,qCAAqC;IACrC,yBAAyB;IACzB,oBAAoB;IACpB,uBAAuB;IACvB,yBAAyB;IACzB,kCAAkC;IAClC,+BAA+B;IAC/B,2BAA2B;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,wCAAwC;IACxC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;CAE9B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAuB,CAAC,CACtC,CAAC;AAEF,6FAA6F;AAC7F,SAAgB,8BAA8B,CAAC,IAAiB;IAC9D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB;YACtB,OAAO,UAAU,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,mBAAmB;gBACnB,qBAAqB;gBACrB,oBAAoB;gBACpB,sBAAsB;gBACtB,wBAAwB;aACzB,CAAC,CAAC;QACL,KAAK,uBAAuB;YAC1B,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,2BAA2B;gBAC3B,2BAA2B;gBAC3B,mBAAmB;gBACnB,4BAA4B;gBAC5B,iCAAiC;gBACjC,qCAAqC;gBACrC,qBAAqB;gBACrB,2BAA2B;gBAC3B,gBAAgB;gBAChB,mBAAmB;gBACnB,kBAAkB;gBAClB,4BAA4B;gBAC5B,0BAA0B;gBAC1B,sBAAsB;gBACtB,iCAAiC;gBACjC,6BAA6B;gBAC7B,uBAAuB;gBACvB,0BAA0B;gBAC1B,cAAc;gBACd,6BAA6B;gBAC7B,wBAAwB;gBACxB,qCAAqC;gBACrC,oBAAoB;gBACpB,uBAAuB;gBACvB,+BAA+B;aAChC,CAAC,CAAC;QACL,KAAK,uBAAuB;YAC1B,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,2BAA2B;gBAC3B,2BAA2B;gBAC3B,mBAAmB;gBACnB,qBAAqB;gBACrB,2BAA2B;gBAC3B,kBAAkB;gBAClB,0BAA0B;gBAC1B,sBAAsB;gBACtB,iCAAiC;gBACjC,6BAA6B;gBAC7B,uBAAuB;gBACvB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,cAAc;gBACd,yBAAyB;gBACzB,sBAAsB;gBACtB,uBAAuB;gBACvB,wBAAwB;gBACxB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,+BAA+B;gBAC/B,wBAAwB;gBACxB,qCAAqC;gBACrC,oBAAoB;gBACpB,uBAAuB;aACxB,CAAC,CAAC;QACL,KAAK,cAAc;YACjB,OAAO,IAAI,GAAG,CAAqB;gBACjC,uBAAuB;gBACvB,2BAA2B;gBAC3B,yBAAyB;gBACzB,mBAAmB;gBACnB,qBAAqB;gBACrB,kBAAkB;gBAClB,sBAAsB;gBACtB,uBAAuB;gBACvB,cAAc;gBACd,wBAAwB;gBACxB,oBAAoB;gBACpB,uBAAuB;aACxB,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAgB,uBAAuB;IACrC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,0BAA0B,CACxC,GAAoE;IAEpE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvF,IAAI,CAAC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;YAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;gBACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,CAAuB,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,GAAG,CAAC,CAAuB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.d.ts

@@ -1,7 +0,0 @@
-import { type KubbisecPermission } from "./kubbisec-permissions";
-/**
- * Maps global `user.role` (Better Auth admin plugin uses `admin`) + future slugs.
- * `admin` and `platform_super_admin` receive the full `kbsc.*` catalog (tenant + platform).
- */
-export declare function getPlatformPermissionsFromGlobalUserRole(role: string | null | undefined): ReadonlySet<KubbisecPermission>;
-//# sourceMappingURL=resolve-platform-permissions.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-platform-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/resolve-platform-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAO3F;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAMjC"}

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.js

@@ -1,23 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getPlatformPermissionsFromGlobalUserRole = getPlatformPermissionsFromGlobalUserRole;
-const kubbisec_permissions_1 = require("./kubbisec-permissions");
-const PLATFORM_ACCOUNT_MANAGER = new Set([
-    "kbsc.platform.org.read",
-    "kbsc.platform.user.read",
-]);
-/**
- * Maps global `user.role` (Better Auth admin plugin uses `admin`) + future slugs.
- * `admin` and `platform_super_admin` receive the full `kbsc.*` catalog (tenant + platform).
- */
-function getPlatformPermissionsFromGlobalUserRole(role) {
-    if (!role)
-        return new Set();
-    const r = role.trim();
-    if (r === "admin" || r === "platform_super_admin")
-        return kubbisec_permissions_1.ALL_KUBBISEC_PERMISSIONS;
-    if (r === "platform_account_manager")
-        return PLATFORM_ACCOUNT_MANAGER;
-    return new Set();
-}
-//# sourceMappingURL=resolve-platform-permissions.js.map

package/bundled/node_modules/@aspm/shared/dist/rbac/resolve-platform-permissions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-platform-permissions.js","sourceRoot":"","sources":["../../src/rbac/resolve-platform-permissions.ts"],"names":[],"mappings":";;AAWA,4FAQC;AAnBD,iEAA2F;AAE3F,MAAM,wBAAwB,GAAoC,IAAI,GAAG,CAAC;IACxE,wBAAwB;IACxB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,wCAAwC,CACtD,IAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,sBAAsB;QAAE,OAAO,+CAAwB,CAAC;IACnF,IAAI,CAAC,KAAK,0BAA0B;QAAE,OAAO,wBAAwB,CAAC;IACtE,OAAO,IAAI,GAAG,EAAE,CAAC;AACnB,CAAC"}

package/bundled/node_modules/@aspm/shared/dist/redaction.d.ts

@@ -1,14 +0,0 @@
-export declare const REDACTED_VALUE = "[REDACTED]";
-export type RedactionOptions = {
-    redactRawData?: boolean;
-    redactMetadata?: boolean;
-};
-export declare function redactString(value: string): string;
-export declare function redactSensitiveData<T>(value: T): T;
-export declare function sanitizeReportPayload<T extends {
-    metadata?: Record<string, unknown>;
-    vulnerabilities?: Array<{
-        rawData?: Record<string, unknown>;
-    }>;
-}>(report: T, options?: RedactionOptions): T;
-//# sourceMappingURL=redaction.d.ts.map

package/bundled/node_modules/@aspm/shared/dist/redaction.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,eAAe,CAAC;AAiD3C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AA8BF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqBlD;AAgJD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA2ClD;AAED,wBAAgB,qBAAqB,CACnC,CAAC,SAAS;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAChE,EACD,MAAM,EAAE,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,CAAC,CAyB9C"}

package/bundled/node_modules/@aspm/shared/dist/redaction.js

@@ -1,251 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.REDACTED_VALUE = void 0;
-exports.redactString = redactString;
-exports.redactSensitiveData = redactSensitiveData;
-exports.sanitizeReportPayload = sanitizeReportPayload;
-/**
- * Structured redaction uses **@pinojs/redact** (Pino / Node.js logging stack), the same path
- * model as `fast-redact` and Pino log redaction.
- * @see https://github.com/pinojs/redact
- *
- * Key rules (headers vs env, substring keys, allowlist for fingerprint/secretHash) and
- * inline secret patterns in strings stay defined here for ASPM report shapes.
- */
-const redact_1 = __importDefault(require("@pinojs/redact"));
-exports.REDACTED_VALUE = "[REDACTED]";
-const SENSITIVE_KEY_PARTS = [
-    "accesstoken",
-    "apikey",
-    "apitoken",
-    "authorization",
-    "bearertoken",
-    "clientsecret",
-    "credential",
-    "idtoken",
-    "password",
-    "passwd",
-    "privatekey",
-    "refreshtoken",
-    "secret",
-    "session",
-    "token",
-];
-const SENSITIVE_EXACT_KEYS = new Set([
-    "auth",
-    "cookie",
-    "match",
-    "offender",
-    "proxyauthorization",
-    "pwd",
-    "secret",
-    "setcookie",
-]);
-const SENSITIVE_HEADER_KEYS = new Set([
-    "authorization",
-    "cookie",
-    "proxyauthorization",
-    "setcookie",
-    "xapikey",
-    "xauthtoken",
-    "xcsrftoken",
-    "xgithubtoken",
-]);
-const NON_SENSITIVE_EXACT_KEYS = new Set(["fingerprint", "secrethash"]);
-const ENV_CONTAINER_KEYS = new Set(["env", "environment", "environmentvariables", "envvars"]);
-const HEADER_CONTAINER_KEYS = new Set(["header", "headers", "requestheaders", "responseheaders"]);
-const MAX_REDACTION_DEPTH = 20;
-function normalizeKey(key) {
-    return key.toLowerCase().replace(/[^a-z0-9]/g, "");
-}
-function isSensitiveKey(key) {
-    const normalized = normalizeKey(key);
-    if (NON_SENSITIVE_EXACT_KEYS.has(normalized))
-        return false;
-    return (SENSITIVE_EXACT_KEYS.has(normalized) ||
-        SENSITIVE_KEY_PARTS.some((part) => normalized.includes(part)));
-}
-function shouldRedactValue(key, parentKey) {
-    const normalizedKey = normalizeKey(key);
-    const normalizedParentKey = parentKey ? normalizeKey(parentKey) : "";
-    if (HEADER_CONTAINER_KEYS.has(normalizedParentKey)) {
-        return SENSITIVE_HEADER_KEYS.has(normalizedKey) || isSensitiveKey(key);
-    }
-    if (ENV_CONTAINER_KEYS.has(normalizedParentKey)) {
-        return isSensitiveKey(key);
-    }
-    return isSensitiveKey(key);
-}
-function redactString(value) {
-    return value
-        .replace(/\b((?:[A-Z][A-Z0-9_]{1,80})(?:TOKEN|SECRET|PASSWORD|PASSWD|PWD|API_KEY|PRIVATE_KEY|CLIENT_SECRET|AUTH)[A-Z0-9_]*\s*=\s*)(["']?)[^\s"'`]+/gi, `$1$2${exports.REDACTED_VALUE}`)
-        .replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, `$1${exports.REDACTED_VALUE}`)
-        .replace(/\b(Basic\s+)[A-Za-z0-9+/=-]{8,}/gi, `$1${exports.REDACTED_VALUE}`)
-        .replace(/\bgh[pousr]_[A-Za-z0-9_]{20,255}\b/g, exports.REDACTED_VALUE)
-        .replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, exports.REDACTED_VALUE)
-        .replace(/\bAIza[0-9A-Za-z_-]{35}\b/g, exports.REDACTED_VALUE)
-        .replace(/\b(AccountKey|SharedAccessSignature)=([^;\n]+)/gi, `$1=${exports.REDACTED_VALUE}`)
-        .replace(/\b((?:password|passwd|pwd|secret|token|api[_-]?key|client[_-]?secret)\b\s*[:=]\s*)(["'`]?)[^,\s"'`]+/gi, `$1$2${exports.REDACTED_VALUE}`)
-        .replace(/\b((?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|rediss):\/\/)([^/@\s:]*):([^/@\s]+)@/gi, `$1${exports.REDACTED_VALUE}@`)
-        .replace(/(https?:\/\/)([^/@\s:]+):([^/@\s]+)@/gi, `$1${exports.REDACTED_VALUE}@`);
-}
-/** Path string for @pinojs/redact / fast-redact. */
-function serializeRedactPath(parts) {
-    let out = "";
-    for (const p of parts) {
-        if (typeof p === "number" || (typeof p === "string" && /^\d+$/.test(p))) {
-            const n = typeof p === "number" ? p : Number(p);
-            out += `[${n}]`;
-            continue;
-        }
-        const k = String(p);
-        if (/^[a-zA-Z_$][\w$]*$/.test(k)) {
-            out += out === "" ? k : `.${k}`;
-        }
-        else {
-            const escaped = k.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
-            out += out === "" ? `["${escaped}"]` : `.["${escaped}"]`;
-        }
-    }
-    return out;
-}
-/** Normalize path segments so @pinojs/redact callback keys match our collected paths. */
-function pathKey(parts) {
-    return JSON.stringify(parts.map(String));
-}
-function markFull(parts, fullPathKeys, pinoPaths) {
-    const pk = pathKey(parts);
-    fullPathKeys.add(pk);
-    pinoPaths.add(serializeRedactPath(parts));
-}
-/** Deep clone for JSON-serializable report trees (no cycles, no special types). */
-function cloneReportTree(value) {
-    return JSON.parse(JSON.stringify(value));
-}
-function markString(parts, stringPathKeys, pinoPaths) {
-    const pk = pathKey(parts);
-    stringPathKeys.add(pk);
-    pinoPaths.add(serializeRedactPath(parts));
-}
-/**
- * Mirrors legacy `redactValue` traversal: `containerKey` is the key passed into `redactValue`
- * (how the parent refers to this node — array field name for array items, child key for nested objects).
- */
-function collectRedactionTargets(value, parts, containerKey, depth, fullPathKeys, stringPathKeys, pinoPaths) {
-    if (value === null || typeof value !== "object") {
-        return;
-    }
-    if (containerKey !== undefined && shouldRedactValue(containerKey)) {
-        markFull(parts, fullPathKeys, pinoPaths);
-        return;
-    }
-    if (depth >= MAX_REDACTION_DEPTH) {
-        markFull(parts, fullPathKeys, pinoPaths);
-        return;
-    }
-    if (Array.isArray(value)) {
-        const nextDepth = depth + 1;
-        for (let i = 0; i < value.length; i++) {
-            const item = value[i];
-            const itemParts = [...parts, i];
-            if (item === null || typeof item !== "object") {
-                if (typeof item === "string") {
-                    markString(itemParts, stringPathKeys, pinoPaths);
-                }
-                continue;
-            }
-            if (nextDepth >= MAX_REDACTION_DEPTH) {
-                markFull(itemParts, fullPathKeys, pinoPaths);
-                continue;
-            }
-            collectRedactionTargets(item, itemParts, containerKey, nextDepth, fullPathKeys, stringPathKeys, pinoPaths);
-        }
-        return;
-    }
-    const input = value;
-    for (const [childKey, childValue] of Object.entries(input)) {
-        const nextParts = [...parts, childKey];
-        if (shouldRedactValue(childKey, containerKey)) {
-            markFull(nextParts, fullPathKeys, pinoPaths);
-            continue;
-        }
-        if (childValue === null || typeof childValue !== "object") {
-            if (typeof childValue === "string") {
-                markString(nextParts, stringPathKeys, pinoPaths);
-            }
-            continue;
-        }
-        const nextDepth = depth + 1;
-        if (nextDepth >= MAX_REDACTION_DEPTH) {
-            markFull(nextParts, fullPathKeys, pinoPaths);
-            continue;
-        }
-        collectRedactionTargets(childValue, nextParts, childKey, nextDepth, fullPathKeys, stringPathKeys, pinoPaths);
-    }
-}
-function redactSensitiveData(value) {
-    if (value == null || typeof value !== "object") {
-        if (typeof value === "string") {
-            return redactString(value);
-        }
-        return value;
-    }
-    const fullPathKeys = new Set();
-    const stringPathKeys = new Set();
-    const pinoPaths = new Set();
-    collectRedactionTargets(value, [], undefined, 0, fullPathKeys, stringPathKeys, pinoPaths);
-    if (pinoPaths.size === 0) {
-        return value;
-    }
-    const redact = (0, redact_1.default)({
-        paths: [...pinoPaths],
-        serialize: false,
-        strict: false,
-        censor: ((v, keyPath) => {
-            const parts = Array.isArray(keyPath) ? keyPath.map((x) => String(x)) : [];
-            const pk = pathKey(parts);
-            if (fullPathKeys.has(pk)) {
-                return exports.REDACTED_VALUE;
-            }
-            if (typeof v === "string" && stringPathKeys.has(pk)) {
-                return redactString(v);
-            }
-            return v;
-        }),
-    });
-    const raw = redact(cloneReportTree(value));
-    if (typeof raw.restore === "function") {
-        const { restore: _drop, ...rest } = raw;
-        return rest;
-    }
-    return raw;
-}
-function sanitizeReportPayload(report, options = {}) {
-    const { redactRawData = true, redactMetadata = true } = options;
-    return {
-        ...report,
-        ...(redactMetadata && report.metadata
-            ? { metadata: redactSensitiveData(report.metadata) }
-            : {}),
-        ...(Array.isArray(report.vulnerabilities)
-            ? {
-                vulnerabilities: report.vulnerabilities.map((vulnerability) => {
-                    const { rawData, ...vulnerabilityFields } = vulnerability;
-                    const hasRawData = Object.hasOwn(vulnerability, "rawData");
-                    return {
-                        ...redactSensitiveData(vulnerabilityFields),
-                        ...(hasRawData
-                            ? {
-                                rawData: redactRawData && rawData ? redactSensitiveData(rawData) : rawData,
-                            }
-                            : {}),
-                    };
-                }),
-            }
-            : {}),
-    };
-}
-//# sourceMappingURL=redaction.js.map