@kubbisec/ai-linux-x64 0.1.27 → 0.1.28

package/bundled/node_modules/@kubbisec/shared/dist/project-scanner-summary.d.ts

@@ -0,0 +1,24 @@
+/** Scanners surfaced on project detail scanner tabs. */
+export declare const PROJECT_SCANNER_SUMMARY_SOURCES: readonly ["TRIVY", "SEMGREP", "SONAR"];
+export type ProjectScannerSummarySource = (typeof PROJECT_SCANNER_SUMMARY_SOURCES)[number];
+/** Scan source literals (kept local so web `erasableSyntaxOnly` does not pull in shared enums). */
+export declare const SCAN_SOURCE_VALUES: readonly ["TRIVY", "SONAR", "SEMGREP", "NMAP", "SKIPFISH", "OSV", "GITLEAKS", "SYFT", "VULNDB", "KUBBISEC_AI"];
+type SummaryScanSource = (typeof SCAN_SOURCE_VALUES)[number];
+export type ProjectScannerSourceSummary = {
+    totalActive: number;
+    criticalCount: number;
+    highCount: number;
+    mediumCount: number;
+    lowCount: number;
+    infoCount: number;
+    latestReportId: string | null;
+    latestReportImportedAt: string | null;
+};
+export type ProjectScannerSummaryResponse = {
+    summaries: Partial<Record<SummaryScanSource, ProjectScannerSourceSummary>>;
+};
+export declare function isScanSource(value: string): value is SummaryScanSource;
+export declare function parseProjectScannerSummarySources(raw: string | undefined | null): ProjectScannerSummarySource[];
+export declare function emptyProjectScannerSourceSummary(): ProjectScannerSourceSummary;
+export {};
+//# sourceMappingURL=project-scanner-summary.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/project-scanner-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-scanner-summary.d.ts","sourceRoot":"","sources":["../src/project-scanner-summary.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,eAAO,MAAM,+BAA+B,wCAAyC,CAAC;AAEtF,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,mGAAmG;AACnG,eAAO,MAAM,kBAAkB,gHAWrB,CAAC;AAEX,KAAK,iBAAiB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,MAAM,MAAM,2BAA2B,GAAG;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC,CAAC;CAC5E,CAAC;AAIF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,iBAAiB,CAEtE;AAED,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAC7B,2BAA2B,EAAE,CAuB/B;AAED,wBAAgB,gCAAgC,IAAI,2BAA2B,CAW9E"}

package/bundled/node_modules/@kubbisec/shared/dist/project-scanner-summary.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCAN_SOURCE_VALUES = exports.PROJECT_SCANNER_SUMMARY_SOURCES = void 0;
+exports.isScanSource = isScanSource;
+exports.parseProjectScannerSummarySources = parseProjectScannerSummarySources;
+exports.emptyProjectScannerSourceSummary = emptyProjectScannerSourceSummary;
+/** Scanners surfaced on project detail scanner tabs. */
+exports.PROJECT_SCANNER_SUMMARY_SOURCES = ["TRIVY", "SEMGREP", "SONAR"];
+/** Scan source literals (kept local so web `erasableSyntaxOnly` does not pull in shared enums). */
+exports.SCAN_SOURCE_VALUES = [
+    "TRIVY",
+    "SONAR",
+    "SEMGREP",
+    "NMAP",
+    "SKIPFISH",
+    "OSV",
+    "GITLEAKS",
+    "SYFT",
+    "VULNDB",
+    "KUBBISEC_AI",
+];
+const SCAN_SOURCE_SET = new Set(exports.SCAN_SOURCE_VALUES);
+function isScanSource(value) {
+    return SCAN_SOURCE_SET.has(value);
+}
+function parseProjectScannerSummarySources(raw) {
+    if (!raw?.trim()) {
+        return [...exports.PROJECT_SCANNER_SUMMARY_SOURCES];
+    }
+    const parsed = [];
+    const seen = new Set();
+    for (const part of raw.split(",")) {
+        const token = part.trim().toUpperCase();
+        if (!token)
+            continue;
+        if (!isScanSource(token)) {
+            throw new Error(`Invalid scanner source: ${part.trim()}`);
+        }
+        if (!exports.PROJECT_SCANNER_SUMMARY_SOURCES.includes(token)) {
+            throw new Error(`Unsupported scanner source for summary: ${part.trim()}`);
+        }
+        if (seen.has(token))
+            continue;
+        seen.add(token);
+        parsed.push(token);
+    }
+    if (parsed.length === 0) {
+        return [...exports.PROJECT_SCANNER_SUMMARY_SOURCES];
+    }
+    return parsed;
+}
+function emptyProjectScannerSourceSummary() {
+    return {
+        totalActive: 0,
+        criticalCount: 0,
+        highCount: 0,
+        mediumCount: 0,
+        lowCount: 0,
+        infoCount: 0,
+        latestReportId: null,
+        latestReportImportedAt: null,
+    };
+}
+//# sourceMappingURL=project-scanner-summary.js.map

package/bundled/node_modules/@kubbisec/shared/dist/project-scanner-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-scanner-summary.js","sourceRoot":"","sources":["../src/project-scanner-summary.ts"],"names":[],"mappings":";;;AAsCA,oCAEC;AAED,8EAyBC;AAED,4EAWC;AAhFD,wDAAwD;AAC3C,QAAA,+BAA+B,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAItF,mGAAmG;AACtF,QAAA,kBAAkB,GAAG;IAChC,OAAO;IACP,OAAO;IACP,SAAS;IACT,MAAM;IACN,UAAU;IACV,KAAK;IACL,UAAU;IACV,MAAM;IACN,QAAQ;IACR,aAAa;CACL,CAAC;AAmBX,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,0BAAkB,CAAC,CAAC;AAE5D,SAAgB,YAAY,CAAC,KAAa;IACxC,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,iCAAiC,CAC/C,GAA8B;IAE9B,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,uCAA+B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAkC,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,uCAA+B,CAAC,QAAQ,CAAC,KAAoC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,KAAoC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,uCAA+B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,gCAAgC;IAC9C,OAAO;QACL,WAAW,EAAE,CAAC;QACd,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,CAAC;QACZ,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,cAAc,EAAE,IAAI;QACpB,sBAAsB,EAAE,IAAI;KAC7B,CAAC;AACJ,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/better-auth-org-roles.d.ts

@@ -0,0 +1,23 @@
+import type { OrgRoleSlug } from "./kubbisec-permissions";
+/** Stored on `member.role` / invitation; must match Better Auth `organization({ roles })` keys. */
+export declare const BETTER_AUTH_ORG_ROLE_BY_SLUG: {
+    readonly org_administrator: "org_administrator";
+    readonly org_finance: "org_finance";
+    readonly org_security_engineer: "org_security_engineer";
+    readonly org_delivery_engineer: "org_delivery_engineer";
+    readonly org_observer: "org_observer";
+};
+export declare const ORG_INVITE_ROLE_OPTIONS: {
+    value: OrgRoleSlug;
+    label: string;
+}[];
+/** All assignable org roles (invites exclude org_administrator by design). */
+export declare const ORG_MEMBER_ROLE_OPTIONS: {
+    value: OrgRoleSlug;
+    label: string;
+}[];
+/** Maps legacy Better Auth roles and Kubbisec slugs stored in DB → canonical `OrgRoleSlug`. */
+export declare function normalizeStoredOrgRole(raw: string | null | undefined): OrgRoleSlug;
+/** Role string stored by Better Auth / Prisma `member.role` (single slug). */
+export declare function toBetterAuthOrgRole(slug: OrgRoleSlug): OrgRoleSlug;
+//# sourceMappingURL=better-auth-org-roles.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/better-auth-org-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth-org-roles.d.ts","sourceRoot":"","sources":["../../src/rbac/better-auth-org-roles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,mGAAmG;AACnG,eAAO,MAAM,4BAA4B;;;;;;CAMY,CAAC;AAEtD,eAAO,MAAM,uBAAuB,EAAE;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAK1E,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,EAAE;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAG1E,CAAC;AAEF,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,CAyBlF;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAElE"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/better-auth-org-roles.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_MEMBER_ROLE_OPTIONS = exports.ORG_INVITE_ROLE_OPTIONS = exports.BETTER_AUTH_ORG_ROLE_BY_SLUG = void 0;
+exports.normalizeStoredOrgRole = normalizeStoredOrgRole;
+exports.toBetterAuthOrgRole = toBetterAuthOrgRole;
+/** Stored on `member.role` / invitation; must match Better Auth `organization({ roles })` keys. */
+exports.BETTER_AUTH_ORG_ROLE_BY_SLUG = {
+    org_administrator: "org_administrator",
+    org_finance: "org_finance",
+    org_security_engineer: "org_security_engineer",
+    org_delivery_engineer: "org_delivery_engineer",
+    org_observer: "org_observer",
+};
+exports.ORG_INVITE_ROLE_OPTIONS = [
+    { value: "org_finance", label: "Financeiro" },
+    { value: "org_security_engineer", label: "AppSec / DevSecOps" },
+    { value: "org_delivery_engineer", label: "DevOps / entrega" },
+    { value: "org_observer", label: "Observador" },
+];
+/** All assignable org roles (invites exclude org_administrator by design). */
+exports.ORG_MEMBER_ROLE_OPTIONS = [
+    { value: "org_administrator", label: "Administrador da organização" },
+    ...exports.ORG_INVITE_ROLE_OPTIONS,
+];
+/** Maps legacy Better Auth roles and Kubbisec slugs stored in DB → canonical `OrgRoleSlug`. */
+function normalizeStoredOrgRole(raw) {
+    if (!raw)
+        return "org_observer";
+    const r = raw.trim();
+    if (r === "org_administrator" ||
+        r === "org_finance" ||
+        r === "org_security_engineer" ||
+        r === "org_delivery_engineer" ||
+        r === "org_observer") {
+        return r;
+    }
+    const lower = r.toLowerCase();
+    if (lower === "owner" ||
+        lower === "admin" ||
+        lower === "administrator" ||
+        lower === "org_admin") {
+        return "org_administrator";
+    }
+    if (lower === "member" || lower === "org_member") {
+        return "org_delivery_engineer";
+    }
+    return "org_observer";
+}
+/** Role string stored by Better Auth / Prisma `member.role` (single slug). */
+function toBetterAuthOrgRole(slug) {
+    return exports.BETTER_AUTH_ORG_ROLE_BY_SLUG[slug];
+}
+//# sourceMappingURL=better-auth-org-roles.js.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/better-auth-org-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth-org-roles.js","sourceRoot":"","sources":["../../src/rbac/better-auth-org-roles.ts"],"names":[],"mappings":";;;AAyBA,wDAyBC;AAGD,kDAEC;AArDD,mGAAmG;AACtF,QAAA,4BAA4B,GAAG;IAC1C,iBAAiB,EAAE,mBAAmB;IACtC,WAAW,EAAE,aAAa;IAC1B,qBAAqB,EAAE,uBAAuB;IAC9C,qBAAqB,EAAE,uBAAuB;IAC9C,YAAY,EAAE,cAAc;CACuB,CAAC;AAEzC,QAAA,uBAAuB,GAA4C;IAC9E,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE;IAC7C,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAC/D,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC7D,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;CAC/C,CAAC;AAEF,8EAA8E;AACjE,QAAA,uBAAuB,GAA4C;IAC9E,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,8BAA8B,EAAE;IACrE,GAAG,+BAAuB;CAC3B,CAAC;AAEF,+FAA+F;AAC/F,SAAgB,sBAAsB,CAAC,GAA8B;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,cAAc,CAAC;IAChC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IACE,CAAC,KAAK,mBAAmB;QACzB,CAAC,KAAK,aAAa;QACnB,CAAC,KAAK,uBAAuB;QAC7B,CAAC,KAAK,uBAAuB;QAC7B,CAAC,KAAK,cAAc,EACpB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9B,IACE,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,WAAW,EACrB,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,SAAgB,mBAAmB,CAAC,IAAiB;IACnD,OAAO,oCAA4B,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./better-auth-org-roles";
+export * from "./kubbisec-permission-descriptions";
+export * from "./kubbisec-permissions";
+export * from "./member-quota";
+export * from "./platform-staff";
+export * from "./resolve-org-permissions";
+export * from "./resolve-platform-permissions";
+//# sourceMappingURL=index.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,oCAAoC,CAAC;AACnD,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./better-auth-org-roles"), exports);
+__exportStar(require("./kubbisec-permission-descriptions"), exports);
+__exportStar(require("./kubbisec-permissions"), exports);
+__exportStar(require("./member-quota"), exports);
+__exportStar(require("./platform-staff"), exports);
+__exportStar(require("./resolve-org-permissions"), exports);
+__exportStar(require("./resolve-platform-permissions"), exports);
+//# sourceMappingURL=index.js.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,qEAAmD;AACnD,yDAAuC;AACvC,iDAA+B;AAC/B,mDAAiC;AACjC,4DAA0C;AAC1C,iEAA+C"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/kubbisec-permission-descriptions.d.ts

@@ -0,0 +1,9 @@
+import { type KubbisecPermission } from "./kubbisec-permissions";
+/**
+ * Human-readable descriptions (pt-BR) — keep in sync with docs/core/rbac-catalog.md
+ */
+export declare const KUBBISEC_PERMISSION_DESCRIPTIONS: Record<KubbisecPermission, string>;
+export declare function getKubbisecPermissionDescription(permission: KubbisecPermission): string;
+/** Ensures every catalog permission has a pt-BR description at build/test time. */
+export declare function assertKubbisecPermissionDescriptionsComplete(): void;
+//# sourceMappingURL=kubbisec-permission-descriptions.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/kubbisec-permission-descriptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permission-descriptions.d.ts","sourceRoot":"","sources":["../../src/rbac/kubbisec-permission-descriptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEvF;;GAEG;AACH,eAAO,MAAM,gCAAgC,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAuF/E,CAAC;AAEF,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,CAEvF;AAED,mFAAmF;AACnF,wBAAgB,4CAA4C,IAAI,IAAI,CAOnE"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/kubbisec-permission-descriptions.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KUBBISEC_PERMISSION_DESCRIPTIONS = void 0;
+exports.getKubbisecPermissionDescription = getKubbisecPermissionDescription;
+exports.assertKubbisecPermissionDescriptionsComplete = assertKubbisecPermissionDescriptionsComplete;
+const kubbisec_permissions_1 = require("./kubbisec-permissions");
+/**
+ * Human-readable descriptions (pt-BR) — keep in sync with docs/core/rbac-catalog.md
+ */
+exports.KUBBISEC_PERMISSION_DESCRIPTIONS = {
+    "kbsc.org.profile.read": "Nome, slug e metadados não sensíveis da organização.",
+    "kbsc.org.profile.update": "Alterar nome, branding e metadados da organização.",
+    "kbsc.org.settings.manage": "Quotas, defaults do workspace e flags da organização.",
+    "kbsc.org.delete": "Eliminar a organização (operação irreversível).",
+    "kbsc.identity.member.read": "Listar e ver detalhes dos membros do workspace.",
+    "kbsc.identity.member.invite": "Enviar convites e definir o papel na entrada.",
+    "kbsc.identity.member.role.update": "Promover ou rebaixar papéis de membros.",
+    "kbsc.identity.member.remove": "Revogar o acesso de um membro ao workspace.",
+    "kbsc.identity.invitation.manage": "Cancelar ou reenviar convites pendentes.",
+    "kbsc.asset.project.read": "Listar projetos, ativos e repositórios ligados.",
+    "kbsc.asset.project.create": "Registar novos ativos no ASPM.",
+    "kbsc.asset.project.update": "Alterar metadados, ramo default e ligações.",
+    "kbsc.asset.project.delete": "Remover um ativo do workspace.",
+    "kbsc.finding.read": "Ver achados, vulnerabilidades e histórico.",
+    "kbsc.finding.triage.update": "Alterar estados, prioridade e comentários internos.",
+    "kbsc.finding.remediation.manage": "Gerir tickets e workflows de correção.",
+    "kbsc.finding.remediation.auto-apply": "Disparar remediação automática (branch + PR GitHub, sem merge).",
+    "kbsc.finding.export": "Exportar relatórios de achados (PDF/CSV conforme produto).",
+    "kbsc.ingest.report.create": "Ingerir relatórios de scan via API ou runner.",
+    "kbsc.scan.read": "Ver fila e histórico de scans KubbiSec AI (MCP/CLI).",
+    "kbsc.scan.trigger": "Disparar scan híbrido via MCP ou assistente (enfileira para CLI local).",
+    "kbsc.ingest.coverage.create": "Ingerir dados de cobertura de testes.",
+    "kbsc.ingest.bundle.create": "Ingerir bundles de performance e artefactos.",
+    "kbsc.supply.read": "Ver SBOM, pacotes e metadados de dependências.",
+    "kbsc.supply.policy.comment": "Adicionar anotações de risco sem alterar integrações.",
+    "kbsc.supply.scan.trigger": "Disparar análise manual de supply chain.",
+    "kbsc.governance.read": "Ver políticas, portões e coverage (somente leitura).",
+    "kbsc.governance.coverage.manage": "Gerir configuração de coverage (org/projeto).",
+    "kbsc.integration.read": "Ver estado das integrações (GitHub, Jira, etc.).",
+    "kbsc.integration.connect": "Ligar integrações via OAuth ou credenciais partilhadas.",
+    "kbsc.integration.disconnect": "Desligar integrações e remover ligações.",
+    "kbsc.integration.secret.write": "Gravar tokens e segredos de integração.",
+    "kbsc.integration.issue.create": "Criar issues em trackers conectados via IA.",
+    "kbsc.integration.pr.create": "Abrir pull requests em repositórios conectados via IA.",
+    "kbsc.integration.pr.merge": "Fazer merge automático de PRs após gates aprovados.",
+    "kbsc.project.ai-autopilot.manage": "Configurar autopilot de IA do projeto (limites, ativação).",
+    "kbsc.project.ai-autopilot.run": "Disparar manualmente um ciclo do autopilot de IA.",
+    "kbsc.ci.read": "Ver pipelines, runners, execuções e histórico.",
+    "kbsc.ci.pipeline.manage": "Criar, editar e apagar definições de pipeline.",
+    "kbsc.ci.pipeline.run": "Disparar execuções manuais de pipeline.",
+    "kbsc.ci.privileged.run": "Executar jobs CI com containers privilegiados (requer runner habilitado).",
+    "kbsc.ci.runner.manage": "Registar, revogar e apagar runners.",
+    "kbsc.ci.envpack.manage": "Gerir pacotes de ambiente e ligações a projetos.",
+    "kbsc.ci.bootstrap.manage": "Gerir tokens de bootstrap para onboarding de runners.",
+    "kbsc.credential.apikey.read": "Listar metadados de API keys (sem expor o segredo).",
+    "kbsc.credential.apikey.create": "Emitir chaves para CLI e automação.",
+    "kbsc.credential.apikey.revoke": "Invalidar API keys existentes.",
+    "kbsc.notification.read": "Ver o centro de alertas e notificações.",
+    "kbsc.notification.preference.manage": "Configurar canal, frequência e silenciamento.",
+    "kbsc.ai.provider.manage": "Gerir configuração BYOK do provedor de IA.",
+    "kbsc.ai.usage.read": "Ver resumo e histórico de utilização de IA.",
+    "kbsc.ai.assistant.use": "Usar o assistente de IA in-app (sem alterar dados).",
+    "kbsc.ai.automation.auto": "Executar automação de IA em modo auto (patch, branch, merge sem revisão).",
+    "kbsc.platform.org.read": "Ver organizações de todos os tenants (staff).",
+    "kbsc.platform.org.support": "Executar ações de suporte aprovadas em organizações.",
+    "kbsc.platform.user.read": "Ver utilizadores cross-tenant para diagnóstico.",
+    "kbsc.platform.impersonate.request": "Pedir sessão de suporte com impersonação controlada.",
+    "kbsc.platform.config.manage": "Gerir configuração global da plataforma e feature flags.",
+    "kbsc.ops.metrics.read": "Ver snapshot completo de métricas operacionais da plataforma.",
+    "kbsc.billing.read": "Ver plano, trial, assinatura e resumo financeiro da organização.",
+    "kbsc.billing.manage": "Iniciar checkout Pro, portal Stripe e alterações de billing.",
+    "kbsc.contract.read": "Ver contratos Business/Pilot e estado de assinatura.",
+    "kbsc.contract.manage": "Gerir contratos e fluxos comerciais offline da organização.",
+    "kbsc.identity.member.permission.manage": "Personalizar permissões funcionais por membro (sem escopo de plataforma).",
+    "kbsc.org.security.read": "Ver postura de segurança dos membros (2FA, sessões).",
+    "kbsc.org.security.manage": "Gerir políticas de segurança do workspace.",
+    "kbsc.org.assistant.manage": "Habilitar ou desabilitar o KubbiSec Assistant na organização.",
+};
+function getKubbisecPermissionDescription(permission) {
+    return exports.KUBBISEC_PERMISSION_DESCRIPTIONS[permission];
+}
+/** Ensures every catalog permission has a pt-BR description at build/test time. */
+function assertKubbisecPermissionDescriptionsComplete() {
+    for (const permission of kubbisec_permissions_1.KUBBISEC_PERMISSIONS) {
+        const description = exports.KUBBISEC_PERMISSION_DESCRIPTIONS[permission];
+        if (!description?.trim()) {
+            throw new Error(`Missing description for permission: ${permission}`);
+        }
+    }
+}
+//# sourceMappingURL=kubbisec-permission-descriptions.js.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/kubbisec-permission-descriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permission-descriptions.js","sourceRoot":"","sources":["../../src/rbac/kubbisec-permission-descriptions.ts"],"names":[],"mappings":";;;AA8FA,4EAEC;AAGD,oGAOC;AA1GD,iEAAuF;AAEvF;;GAEG;AACU,QAAA,gCAAgC,GAAuC;IAClF,uBAAuB,EAAE,sDAAsD;IAC/E,yBAAyB,EAAE,oDAAoD;IAC/E,0BAA0B,EAAE,uDAAuD;IACnF,iBAAiB,EAAE,iDAAiD;IAEpE,2BAA2B,EAAE,iDAAiD;IAC9E,6BAA6B,EAAE,+CAA+C;IAC9E,kCAAkC,EAAE,yCAAyC;IAC7E,6BAA6B,EAAE,6CAA6C;IAC5E,iCAAiC,EAAE,0CAA0C;IAE7E,yBAAyB,EAAE,iDAAiD;IAC5E,2BAA2B,EAAE,gCAAgC;IAC7D,2BAA2B,EAAE,6CAA6C;IAC1E,2BAA2B,EAAE,gCAAgC;IAE7D,mBAAmB,EAAE,4CAA4C;IACjE,4BAA4B,EAAE,qDAAqD;IACnF,iCAAiC,EAAE,wCAAwC;IAC3E,qCAAqC,EACnC,iEAAiE;IACnE,qBAAqB,EAAE,4DAA4D;IAEnF,2BAA2B,EAAE,+CAA+C;IAC5E,gBAAgB,EAAE,sDAAsD;IACxE,mBAAmB,EAAE,yEAAyE;IAC9F,6BAA6B,EAAE,uCAAuC;IACtE,2BAA2B,EAAE,8CAA8C;IAE3E,kBAAkB,EAAE,gDAAgD;IACpE,4BAA4B,EAAE,uDAAuD;IACrF,0BAA0B,EAAE,0CAA0C;IAEtE,sBAAsB,EAAE,sDAAsD;IAC9E,iCAAiC,EAAE,+CAA+C;IAElF,uBAAuB,EAAE,kDAAkD;IAC3E,0BAA0B,EAAE,yDAAyD;IACrF,6BAA6B,EAAE,0CAA0C;IACzE,+BAA+B,EAAE,yCAAyC;IAC1E,+BAA+B,EAAE,6CAA6C;IAC9E,4BAA4B,EAAE,wDAAwD;IACtF,2BAA2B,EAAE,qDAAqD;IAElF,kCAAkC,EAAE,4DAA4D;IAChG,+BAA+B,EAAE,mDAAmD;IAEpF,cAAc,EAAE,gDAAgD;IAChE,yBAAyB,EAAE,gDAAgD;IAC3E,sBAAsB,EAAE,yCAAyC;IACjE,wBAAwB,EACtB,2EAA2E;IAC7E,uBAAuB,EAAE,qCAAqC;IAC9D,wBAAwB,EAAE,kDAAkD;IAC5E,0BAA0B,EAAE,uDAAuD;IAEnF,6BAA6B,EAAE,qDAAqD;IACpF,+BAA+B,EAAE,qCAAqC;IACtE,+BAA+B,EAAE,gCAAgC;IAEjE,wBAAwB,EAAE,yCAAyC;IACnE,qCAAqC,EAAE,+CAA+C;IAEtF,yBAAyB,EAAE,4CAA4C;IACvE,oBAAoB,EAAE,6CAA6C;IACnE,uBAAuB,EAAE,qDAAqD;IAC9E,yBAAyB,EACvB,2EAA2E;IAE7E,wBAAwB,EAAE,+CAA+C;IACzE,2BAA2B,EAAE,sDAAsD;IACnF,yBAAyB,EAAE,iDAAiD;IAC5E,mCAAmC,EAAE,sDAAsD;IAC3F,6BAA6B,EAAE,0DAA0D;IAEzF,uBAAuB,EAAE,+DAA+D;IAExF,mBAAmB,EAAE,kEAAkE;IACvF,qBAAqB,EAAE,8DAA8D;IACrF,oBAAoB,EAAE,sDAAsD;IAC5E,sBAAsB,EAAE,6DAA6D;IACrF,wCAAwC,EACtC,2EAA2E;IAC7E,wBAAwB,EAAE,sDAAsD;IAChF,0BAA0B,EAAE,4CAA4C;IACxE,2BAA2B,EAAE,+DAA+D;CAC7F,CAAC;AAEF,SAAgB,gCAAgC,CAAC,UAA8B;IAC7E,OAAO,wCAAgC,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC;AAED,mFAAmF;AACnF,SAAgB,4CAA4C;IAC1D,KAAK,MAAM,UAAU,IAAI,2CAAoB,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,wCAAgC,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/kubbisec-permissions.d.ts

@@ -0,0 +1,12 @@
+/**
+ * KubbiSec permission slugs — keep in sync with docs/core/rbac-catalog.md
+ */
+export declare const KUBBISEC_PERMISSIONS: readonly ["kbsc.org.profile.read", "kbsc.org.profile.update", "kbsc.org.settings.manage", "kbsc.org.delete", "kbsc.identity.member.read", "kbsc.identity.member.invite", "kbsc.identity.member.role.update", "kbsc.identity.member.remove", "kbsc.identity.invitation.manage", "kbsc.asset.project.read", "kbsc.asset.project.create", "kbsc.asset.project.update", "kbsc.asset.project.delete", "kbsc.finding.read", "kbsc.finding.triage.update", "kbsc.finding.remediation.manage", "kbsc.finding.remediation.auto-apply", "kbsc.finding.export", "kbsc.ingest.report.create", "kbsc.scan.read", "kbsc.scan.trigger", "kbsc.supply.read", "kbsc.supply.policy.comment", "kbsc.supply.scan.trigger", "kbsc.governance.read", "kbsc.governance.coverage.manage", "kbsc.ingest.coverage.create", "kbsc.ingest.bundle.create", "kbsc.integration.read", "kbsc.integration.connect", "kbsc.integration.disconnect", "kbsc.integration.secret.write", "kbsc.integration.issue.create", "kbsc.integration.pr.create", "kbsc.integration.pr.merge", "kbsc.project.ai-autopilot.manage", "kbsc.project.ai-autopilot.run", "kbsc.ci.read", "kbsc.ci.pipeline.manage", "kbsc.ci.pipeline.run", "kbsc.ci.privileged.run", "kbsc.ci.runner.manage", "kbsc.ci.envpack.manage", "kbsc.ci.bootstrap.manage", "kbsc.credential.apikey.read", "kbsc.credential.apikey.create", "kbsc.credential.apikey.revoke", "kbsc.notification.read", "kbsc.notification.preference.manage", "kbsc.ai.provider.manage", "kbsc.ai.usage.read", "kbsc.ai.assistant.use", "kbsc.ai.automation.auto", "kbsc.platform.org.read", "kbsc.platform.org.support", "kbsc.platform.user.read", "kbsc.platform.impersonate.request", "kbsc.platform.config.manage", "kbsc.ops.metrics.read", "kbsc.billing.read", "kbsc.billing.manage", "kbsc.contract.read", "kbsc.contract.manage", "kbsc.identity.member.permission.manage", "kbsc.org.security.read", "kbsc.org.security.manage", "kbsc.org.assistant.manage"];
+export type KubbisecPermission = (typeof KUBBISEC_PERMISSIONS)[number];
+/** Full catalog — super admin / legacy `admin` global role. */
+export declare const ALL_KUBBISEC_PERMISSIONS: ReadonlySet<KubbisecPermission>;
+export declare const ORG_ROLE_SLUGS: readonly ["org_administrator", "org_finance", "org_security_engineer", "org_delivery_engineer", "org_observer"];
+export type OrgRoleSlug = (typeof ORG_ROLE_SLUGS)[number];
+export declare const PLATFORM_ROLE_SLUGS: readonly ["platform_super_admin", "platform_account_manager"];
+export type PlatformRoleSlug = (typeof PLATFORM_ROLE_SLUGS)[number];
+//# sourceMappingURL=kubbisec-permissions.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/kubbisec-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/kubbisec-permissions.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,oBAAoB,82DAoEvB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,kBAAkB,CAEpE,CAAC;AAEF,eAAO,MAAM,cAAc,iHAMjB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,eAAO,MAAM,mBAAmB,+DAAgE,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/kubbisec-permissions.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_ROLE_SLUGS = exports.ORG_ROLE_SLUGS = exports.ALL_KUBBISEC_PERMISSIONS = exports.KUBBISEC_PERMISSIONS = void 0;
+/**
+ * KubbiSec permission slugs — keep in sync with docs/core/rbac-catalog.md
+ */
+exports.KUBBISEC_PERMISSIONS = [
+    "kbsc.org.profile.read",
+    "kbsc.org.profile.update",
+    "kbsc.org.settings.manage",
+    "kbsc.org.delete",
+    "kbsc.identity.member.read",
+    "kbsc.identity.member.invite",
+    "kbsc.identity.member.role.update",
+    "kbsc.identity.member.remove",
+    "kbsc.identity.invitation.manage",
+    "kbsc.asset.project.read",
+    "kbsc.asset.project.create",
+    "kbsc.asset.project.update",
+    "kbsc.asset.project.delete",
+    "kbsc.finding.read",
+    "kbsc.finding.triage.update",
+    "kbsc.finding.remediation.manage",
+    "kbsc.finding.remediation.auto-apply",
+    "kbsc.finding.export",
+    "kbsc.ingest.report.create",
+    "kbsc.scan.read",
+    "kbsc.scan.trigger",
+    "kbsc.supply.read",
+    "kbsc.supply.policy.comment",
+    "kbsc.supply.scan.trigger",
+    "kbsc.governance.read",
+    "kbsc.governance.coverage.manage",
+    "kbsc.ingest.coverage.create",
+    "kbsc.ingest.bundle.create",
+    "kbsc.integration.read",
+    "kbsc.integration.connect",
+    "kbsc.integration.disconnect",
+    "kbsc.integration.secret.write",
+    "kbsc.integration.issue.create",
+    "kbsc.integration.pr.create",
+    "kbsc.integration.pr.merge",
+    "kbsc.project.ai-autopilot.manage",
+    "kbsc.project.ai-autopilot.run",
+    "kbsc.ci.read",
+    "kbsc.ci.pipeline.manage",
+    "kbsc.ci.pipeline.run",
+    "kbsc.ci.privileged.run",
+    "kbsc.ci.runner.manage",
+    "kbsc.ci.envpack.manage",
+    "kbsc.ci.bootstrap.manage",
+    "kbsc.credential.apikey.read",
+    "kbsc.credential.apikey.create",
+    "kbsc.credential.apikey.revoke",
+    "kbsc.notification.read",
+    "kbsc.notification.preference.manage",
+    "kbsc.ai.provider.manage",
+    "kbsc.ai.usage.read",
+    "kbsc.ai.assistant.use",
+    "kbsc.ai.automation.auto",
+    "kbsc.platform.org.read",
+    "kbsc.platform.org.support",
+    "kbsc.platform.user.read",
+    "kbsc.platform.impersonate.request",
+    "kbsc.platform.config.manage",
+    "kbsc.ops.metrics.read",
+    "kbsc.billing.read",
+    "kbsc.billing.manage",
+    "kbsc.contract.read",
+    "kbsc.contract.manage",
+    "kbsc.identity.member.permission.manage",
+    "kbsc.org.security.read",
+    "kbsc.org.security.manage",
+    "kbsc.org.assistant.manage",
+];
+/** Full catalog — super admin / legacy `admin` global role. */
+exports.ALL_KUBBISEC_PERMISSIONS = new Set(exports.KUBBISEC_PERMISSIONS);
+exports.ORG_ROLE_SLUGS = [
+    "org_administrator",
+    "org_finance",
+    "org_security_engineer",
+    "org_delivery_engineer",
+    "org_observer",
+];
+exports.PLATFORM_ROLE_SLUGS = ["platform_super_admin", "platform_account_manager"];
+//# sourceMappingURL=kubbisec-permissions.js.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/kubbisec-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubbisec-permissions.js","sourceRoot":"","sources":["../../src/rbac/kubbisec-permissions.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACU,QAAA,oBAAoB,GAAG;IAClC,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,iBAAiB;IACjB,2BAA2B;IAC3B,6BAA6B;IAC7B,kCAAkC;IAClC,6BAA6B;IAC7B,iCAAiC;IACjC,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,mBAAmB;IACnB,4BAA4B;IAC5B,iCAAiC;IACjC,qCAAqC;IACrC,qBAAqB;IACrB,2BAA2B;IAC3B,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,4BAA4B;IAC5B,0BAA0B;IAC1B,sBAAsB;IACtB,iCAAiC;IACjC,6BAA6B;IAC7B,2BAA2B;IAC3B,uBAAuB;IACvB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,4BAA4B;IAC5B,2BAA2B;IAC3B,kCAAkC;IAClC,+BAA+B;IAC/B,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,+BAA+B;IAC/B,wBAAwB;IACxB,qCAAqC;IACrC,yBAAyB;IACzB,oBAAoB;IACpB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;IACxB,2BAA2B;IAC3B,yBAAyB;IACzB,mCAAmC;IACnC,6BAA6B;IAC7B,uBAAuB;IACvB,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,wCAAwC;IACxC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;CACnB,CAAC;AAIX,+DAA+D;AAClD,QAAA,wBAAwB,GAAoC,IAAI,GAAG,CAC9E,4BAAoB,CACrB,CAAC;AAEW,QAAA,cAAc,GAAG;IAC5B,mBAAmB;IACnB,aAAa;IACb,uBAAuB;IACvB,uBAAuB;IACvB,cAAc;CACN,CAAC;AAIE,QAAA,mBAAmB,GAAG,CAAC,sBAAsB,EAAE,0BAA0B,CAAU,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/member-quota.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Org roles that do not consume a billable member seat.
+ * Finance users only access billing; they do not use product features.
+ */
+export declare const ORG_ROLES_EXEMPT_FROM_MEMBER_QUOTA: readonly ["org_finance"];
+/** Whether a member/invite role counts toward plan member limits and Stripe seat quantity. */
+export declare function orgRoleCountsTowardMemberQuota(role: string | null | undefined): boolean;
+//# sourceMappingURL=member-quota.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/member-quota.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-quota.d.ts","sourceRoot":"","sources":["../../src/rbac/member-quota.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0BAEJ,CAAC;AAI5C,8FAA8F;AAC9F,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGvF"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/member-quota.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_ROLES_EXEMPT_FROM_MEMBER_QUOTA = void 0;
+exports.orgRoleCountsTowardMemberQuota = orgRoleCountsTowardMemberQuota;
+const better_auth_org_roles_1 = require("./better-auth-org-roles");
+/**
+ * Org roles that do not consume a billable member seat.
+ * Finance users only access billing; they do not use product features.
+ */
+exports.ORG_ROLES_EXEMPT_FROM_MEMBER_QUOTA = [
+    "org_finance",
+];
+const exemptRoleSet = new Set(exports.ORG_ROLES_EXEMPT_FROM_MEMBER_QUOTA);
+/** Whether a member/invite role counts toward plan member limits and Stripe seat quantity. */
+function orgRoleCountsTowardMemberQuota(role) {
+    const normalized = (0, better_auth_org_roles_1.normalizeStoredOrgRole)(role);
+    return !exemptRoleSet.has(normalized);
+}
+//# sourceMappingURL=member-quota.js.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/member-quota.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-quota.js","sourceRoot":"","sources":["../../src/rbac/member-quota.ts"],"names":[],"mappings":";;;AAcA,wEAGC;AAjBD,mEAAiE;AAGjE;;;GAGG;AACU,QAAA,kCAAkC,GAAG;IAChD,aAAa;CAC4B,CAAC;AAE5C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,0CAAkC,CAAC,CAAC;AAE1E,8FAA8F;AAC9F,SAAgB,8BAA8B,CAAC,IAA+B;IAC5E,MAAM,UAAU,GAAG,IAAA,8CAAsB,EAAC,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/platform-staff.d.ts

@@ -0,0 +1,16 @@
+import type { KubbisecPermission } from "./kubbisec-permissions";
+/** Global `user.role` values used by Better Auth admin plugin + KubbiSec platform staff. */
+export declare const GLOBAL_USER_ROLE_SLUGS: readonly ["user", "admin", "platform_super_admin", "platform_account_manager"];
+export type GlobalUserRoleSlug = (typeof GLOBAL_USER_ROLE_SLUGS)[number];
+export declare const GLOBAL_ROLE_OPTIONS: ReadonlyArray<{
+    value: GlobalUserRoleSlug;
+    label: string;
+}>;
+/** Parses comma-separated global roles from `user.role`. */
+export declare function parseGlobalUserRoles(role: string | null | undefined): string[];
+export declare function isPlatformStaffRole(role: string | null | undefined): boolean;
+/** Platform admins with full catalog (`admin`, `platform_super_admin`) act as org admin in tenant UI. */
+export declare function globalRoleGrantsFullTenantPermissions(role: string | null | undefined): boolean;
+export declare function hasPlatformPermission(role: string | null | undefined, permission: KubbisecPermission): boolean;
+export declare function getMergedPlatformPermissions(role: string | null | undefined): ReadonlySet<KubbisecPermission>;
+//# sourceMappingURL=platform-staff.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/platform-staff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-staff.d.ts","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,gFAKzB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAK3F,CAAC;AAQF,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAM9E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED,yGAAyG;AACzG,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE9F;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAMT;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,WAAW,CAAC,kBAAkB,CAAC,CAQjC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/platform-staff.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GLOBAL_ROLE_OPTIONS = exports.GLOBAL_USER_ROLE_SLUGS = void 0;
+exports.parseGlobalUserRoles = parseGlobalUserRoles;
+exports.isPlatformStaffRole = isPlatformStaffRole;
+exports.globalRoleGrantsFullTenantPermissions = globalRoleGrantsFullTenantPermissions;
+exports.hasPlatformPermission = hasPlatformPermission;
+exports.getMergedPlatformPermissions = getMergedPlatformPermissions;
+const resolve_platform_permissions_1 = require("./resolve-platform-permissions");
+/** Global `user.role` values used by Better Auth admin plugin + KubbiSec platform staff. */
+exports.GLOBAL_USER_ROLE_SLUGS = [
+    "user",
+    "admin",
+    "platform_super_admin",
+    "platform_account_manager",
+];
+exports.GLOBAL_ROLE_OPTIONS = [
+    { value: "user", label: "Utilizador" },
+    { value: "admin", label: "Administrador da plataforma" },
+    { value: "platform_super_admin", label: "Super administrador da plataforma" },
+    { value: "platform_account_manager", label: "Gestor de contas" },
+];
+const STAFF_ROLE_SET = new Set([
+    "admin",
+    "platform_super_admin",
+    "platform_account_manager",
+]);
+/** Parses comma-separated global roles from `user.role`. */
+function parseGlobalUserRoles(role) {
+    if (!role?.trim())
+        return ["user"];
+    return role
+        .split(",")
+        .map((r) => r.trim())
+        .filter(Boolean);
+}
+function isPlatformStaffRole(role) {
+    return parseGlobalUserRoles(role).some((r) => STAFF_ROLE_SET.has(r));
+}
+/** Platform admins with full catalog (`admin`, `platform_super_admin`) act as org admin in tenant UI. */
+function globalRoleGrantsFullTenantPermissions(role) {
+    return parseGlobalUserRoles(role).some((r) => r === "admin" || r === "platform_super_admin");
+}
+function hasPlatformPermission(role, permission) {
+    const roles = parseGlobalUserRoles(role);
+    for (const r of roles) {
+        if ((0, resolve_platform_permissions_1.getPlatformPermissionsFromGlobalUserRole)(r).has(permission))
+            return true;
+    }
+    return false;
+}
+function getMergedPlatformPermissions(role) {
+    const merged = new Set();
+    for (const r of parseGlobalUserRoles(role)) {
+        for (const p of (0, resolve_platform_permissions_1.getPlatformPermissionsFromGlobalUserRole)(r)) {
+            merged.add(p);
+        }
+    }
+    return merged;
+}
+//# sourceMappingURL=platform-staff.js.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/platform-staff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-staff.js","sourceRoot":"","sources":["../../src/rbac/platform-staff.ts"],"names":[],"mappings":";;;AA2BA,oDAMC;AAED,kDAEC;AAGD,sFAEC;AAED,sDASC;AAED,oEAUC;AAhED,iFAA0F;AAE1F,4FAA4F;AAC/E,QAAA,sBAAsB,GAAG;IACpC,MAAM;IACN,OAAO;IACP,sBAAsB;IACtB,0BAA0B;CAClB,CAAC;AAIE,QAAA,mBAAmB,GAAgE;IAC9F,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;IACtC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE;IACxD,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAC7E,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,kBAAkB,EAAE;CACjE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,OAAO;IACP,sBAAsB;IACtB,0BAA0B;CAC3B,CAAC,CAAC;AAEH,4DAA4D;AAC5D,SAAgB,oBAAoB,CAAC,IAA+B;IAClE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAA+B;IACjE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,yGAAyG;AACzG,SAAgB,qCAAqC,CAAC,IAA+B;IACnF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,sBAAsB,CAAC,CAAC;AAC/F,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAA+B,EAC/B,UAA8B;IAE9B,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,4BAA4B,CAC1C,IAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,IAAA,uEAAwC,EAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/bundled/node_modules/@kubbisec/shared/dist/rbac/resolve-org-permissions.d.ts

@@ -0,0 +1,10 @@
+import { normalizeStoredOrgRole } from "./better-auth-org-roles";
+import type { KubbisecPermission, OrgRoleSlug } from "./kubbisec-permissions";
+/** Maps stored org roles (Kubbisec slugs + legacy Better Auth) → canonical `OrgRoleSlug`. */
+export declare const normalizeOrgMemberRole: typeof normalizeStoredOrgRole;
+/** Effective tenant permissions for an organization member role (see rbac-catalog.md §4). */
+export declare function getTenantPermissionsForOrgRole(role: OrgRoleSlug): ReadonlySet<KubbisecPermission>;
+/** Full tenant permission set (e.g. API-key-only automation, parity with org admin). */
+export declare function getAllTenantPermissions(): ReadonlySet<KubbisecPermission>;
+export declare function parseApiKeyPermissionsJson(raw: string | Record<string, unknown> | unknown[] | null | undefined): KubbisecPermission[] | null;
+//# sourceMappingURL=resolve-org-permissions.d.ts.map

package/bundled/node_modules/@kubbisec/shared/dist/rbac/resolve-org-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-org-permissions.d.ts","sourceRoot":"","sources":["../../src/rbac/resolve-org-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE9E,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,+BAAyB,CAAC;AAqE7D,6FAA6F;AAC7F,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,CA8FjG;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAEzE;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,GAAG,SAAS,GACnE,kBAAkB,EAAE,GAAG,IAAI,CAsB7B"}