@kubbisec/naus 1.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 KubbiSec
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,63 @@
+# @kubbisec/naus
+
+Official **KubbiSec Naus** CLI — register runners, execute pipelines, and validate definitions against the KubbiSec control plane.
+
+Naus connects your infrastructure to **KubbiSec CI/CD**: secure runner enrollment, remote job execution, and local pipeline workflows.
+
+## Features
+
+- **Runner lifecycle** — register with a bootstrap token, start the agent, and report to your organization’s control plane.
+- **Pipelines** — run YAML pipelines locally or integrate with hosted runs.
+- **Validation** — catch pipeline errors before they hit the cluster.
+- **Native binaries** — platform-specific executables via `optionalDependencies` (no `postinstall` scripts; compatible with `npm install --ignore-scripts`).
+
+## Requirements
+
+- **Node.js** 18 or newer (for the global install and launcher).
+- **Docker** (or equivalent) when jobs use containerized steps — see your organization’s documentation.
+
+## Installation
+
+```bash
+npm install -g @kubbisec/naus
+```
+
+## Quick start
+
+```bash
+# Enroll a runner (replace URL with your KubbiSec API / enrollment endpoint)
+naus register <bootstrap-token> --api https://your-api.example.com
+
+# Start the runner process
+naus start
+
+# Run a pipeline file locally
+naus run pipeline.yml
+
+# Validate a pipeline without executing
+naus validate pipeline.yml
+```
+
+Run `naus --help` for the full command tree and flags.
+
+## Supported platforms
+
+The meta-package `@kubbisec/naus` pulls the correct native binary for your OS and CPU:
+
+| OS      | Architecture | npm package                    |
+|---------|--------------|--------------------------------|
+| Linux   | x64          | `@kubbisec/naus-linux-x64`     |
+| Linux   | arm64        | `@kubbisec/naus-linux-arm64`   |
+| macOS   | arm64        | `@kubbisec/naus-darwin-arm64`  |
+| Windows | x64          | `@kubbisec/naus-win32-x64`     |
+
+You normally **do not** install the platform packages directly; install `@kubbisec/naus` globally.
+
+
+## License
+
+MIT — see `LICENSE` in this package.
+
+## Trademarks
+
+**KubbiSec** and related marks are property of their respective owners. This package is distributed by KubbiSec for use with the KubbiSec platform.

package/bin/naus.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+
+/**
+ * @kubbisec/naus — Launcher mínimo
+ *
+ * Detecta a plataforma e arquitetura do host, resolve o pacote de plataforma
+ * correspondente instalado via optionalDependencies e executa o binário nativo.
+ *
+ * Não depende de postinstall scripts. Funciona com --ignore-scripts=true.
+ */
+
+"use strict";
+
+const { execFileSync, spawn } = require("child_process");
+const path = require("path");
+const fs = require("fs");
+
+// ---------------------------------------------------------------------------
+// Mapeamento de plataforma + arch → nome do pacote npm
+// ---------------------------------------------------------------------------
+
+const PLATFORM_MAP = {
+  "linux-x64": "@kubbisec/naus-linux-x64",
+  "linux-arm64": "@kubbisec/naus-linux-arm64",
+  "darwin-arm64": "@kubbisec/naus-darwin-arm64",
+  "win32-x64": "@kubbisec/naus-win32-x64",
+};
+
+const platformKey = `${process.platform}-${process.arch}`;
+const packageName = PLATFORM_MAP[platformKey];
+
+if (!packageName) {
+  console.error(
+    `[naus] Plataforma não suportada: ${process.platform}/${process.arch}\n` +
+      `Plataformas suportadas: ${Object.keys(PLATFORM_MAP)
+        .map((k) => k.replace("-", "/"))
+        .join(", ")}`
+  );
+  process.exit(1);
+}
+
+// ---------------------------------------------------------------------------
+// Resolver caminho do binário nativo
+// ---------------------------------------------------------------------------
+
+const binaryName = process.platform === "win32" ? "naus.exe" : "naus";
+
+let binaryPath = null;
+
+// Estratégia 1: require.resolve do pacote de plataforma
+try {
+  const pkgDir = path.dirname(
+    require.resolve(`${packageName}/package.json`)
+  );
+  const candidate = path.join(pkgDir, "bin", binaryName);
+  if (fs.existsSync(candidate)) {
+    binaryPath = candidate;
+  }
+} catch {
+  // pacote não encontrado via require.resolve
+}
+
+// Estratégia 2: busca relativa (quando instalado globalmente com npm)
+if (!binaryPath) {
+  const globalSearchPaths = [
+    // npm global: node_modules ao lado deste pacote
+    path.resolve(__dirname, "..", "..", packageName, "bin", binaryName),
+    // pnpm global: node_modules/.pnpm/<pkg>/node_modules/<pkg>/bin
+    path.resolve(
+      __dirname,
+      "..",
+      "node_modules",
+      packageName,
+      "bin",
+      binaryName
+    ),
+  ];
+  for (const candidate of globalSearchPaths) {
+    if (fs.existsSync(candidate)) {
+      binaryPath = candidate;
+      break;
+    }
+  }
+}
+
+if (!binaryPath) {
+  console.error(
+    `[naus] Binário nativo não encontrado para ${process.platform}/${process.arch}.\n` +
+      `Pacote esperado: ${packageName}\n` +
+      `Tente reinstalar: npm install -g @kubbisec/naus`
+  );
+  process.exit(1);
+}
+
+// ---------------------------------------------------------------------------
+// Garantir permissão de execução (Unix)
+// ---------------------------------------------------------------------------
+
+if (process.platform !== "win32") {
+  try {
+    fs.chmodSync(binaryPath, 0o755);
+  } catch {
+    // pode falhar se read-only; ignora
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Executar binário nativo herdando stdio, env e sinais
+// ---------------------------------------------------------------------------
+
+const child = spawn(binaryPath, process.argv.slice(2), {
+  stdio: "inherit",
+  env: process.env,
+  windowsHide: true,
+});
+
+// Propagar sinais
+const forwardSignal = (signal) => {
+  try {
+    child.kill(signal);
+  } catch {
+    // processo já pode ter saído
+  }
+};
+
+process.on("SIGINT", () => forwardSignal("SIGINT"));
+process.on("SIGTERM", () => forwardSignal("SIGTERM"));
+
+child.on("error", (err) => {
+  console.error(`[naus] Falha ao executar binário: ${err.message}`);
+  process.exit(1);
+});
+
+child.on("exit", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+  } else {
+    process.exit(code ?? 1);
+  }
+});

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@kubbisec/naus",
+  "version": "1.0.2",
+  "description": "KubbiSec Naus CI/CD Runner — install globally, run anywhere",
+  "license": "MIT",
+  "bin": {
+    "naus": "bin/naus.js"
+  },
+  "files": [
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "optionalDependencies": {
+    "@kubbisec/naus-linux-x64": "1.0.2",
+    "@kubbisec/naus-linux-arm64": "1.0.2",
+    "@kubbisec/naus-darwin-arm64": "1.0.2",
+    "@kubbisec/naus-win32-x64": "1.0.2"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "ci",
+    "cd",
+    "runner",
+    "pipeline",
+    "security",
+    "aspm"
+  ]
+}