@methiu/raigal 0.2.4 → 0.2.6

package/dist/{json-BBZKvm0E.js → json-DxIA7CCt.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-CukuIVX4.js";
+import { t as APP_VERSION } from "./version-DtOeK-2T.js";
 import { i as ENGINE_INFO, n as withFindingAssessments, t as summarizeFindingAssessments } from "./finding-assessment-CGpt5YUR.js";
 //#region src/output/json.ts
 const buildJsonOutput = (results, scoreResult, fileCount, elapsedMs, coverage) => {

package/dist/mcp.js

@@ -84,7 +84,7 @@ const getActiveToken = () => {
 };
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.4";
+const APP_VERSION = "0.2.6";
 //#endregion
 //#region src/cloud/contract.ts
 const Severity = z.enum(["error", "warning"]);
@@ -242,6 +242,8 @@ const requestApi = async (endpoint, options = {}) => {
 	};
 	if (options.token) headers.Authorization = `Bearer ${options.token}`;
 	if (options.oidcToken) headers["X-GitHub-OIDC"] = options.oidcToken;
+	const orgId = options.orgId || process.env.RAIGAL_ORG_ID;
+	if (orgId) headers["X-Raigal-Org-Id"] = orgId;
 	let body;
 	if (options.body !== void 0) {
 		headers["Content-Type"] = "application/json";
@@ -273,11 +275,12 @@ const requestApi = async (endpoint, options = {}) => {
 	}
 	return json;
 };
-const fetchEntitlementFromApi = async (token, oidcToken) => {
+const fetchEntitlementFromApi = async (token, oidcToken, orgId) => {
 	const data = await requestApi("/v1/entitlement", {
 		method: "POST",
 		token: token || void 0,
-		oidcToken
+		oidcToken,
+		orgId
 	});
 	return EntitlementResponse.parse(data);
 };
@@ -359,7 +362,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.4", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.6", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -518,7 +521,9 @@ const getEntitlement = async () => {
 		}
 	} else oidcToken = await fetchGitHubOidcToken();
 	try {
-		const response = await fetchEntitlementFromApi(activeToken?.token ?? "", oidcToken);
+		const tokenToPass = activeToken?.token ?? "";
+		const orgId = process.env.RAIGAL_ORG_ID;
+		const response = await fetchEntitlementFromApi(tokenToPass, oidcToken, orgId);
 		const claims = verifyEntitlementJwt(response.entitlement, { nowSeconds: now });
 		saveCachedEntitlement(response.entitlement, response.refresh_after);
 		return {
@@ -532,7 +537,7 @@ const getEntitlement = async () => {
 };
 //#endregion
 //#region src/cloud/owner.ts
-const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
+const GENERIC_GIT_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)[^:/]+(?::(?:\d+\/)?|[:/])|https?:\/\/(?:[^@]+@)?[^/]+\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
 const parseGitRemote = (rawUrl) => {
 	if (!rawUrl) return {
 		owner: null,
@@ -540,18 +545,19 @@ const parseGitRemote = (rawUrl) => {
 		hasRemote: false,
 		isGitHubRemote: false
 	};
-	const match = rawUrl.match(GITHUB_REMOTE_RE);
+	const match = rawUrl.match(GENERIC_GIT_REMOTE_RE);
 	if (!match || !match[1] || !match[2]) return {
 		owner: null,
 		repo: null,
 		hasRemote: true,
 		isGitHubRemote: false
 	};
+	const isGitHub = rawUrl.includes("github.com");
 	return {
 		owner: match[1].toLowerCase(),
 		repo: match[2].toLowerCase(),
 		hasRemote: true,
-		isGitHubRemote: true
+		isGitHubRemote: isGitHub
 	};
 };
 const readGitConfigRemote = (dir) => {
@@ -616,6 +622,27 @@ const detectLocalRepoOwner = (directory) => {
 			isGitHubRemote: true
 		};
 	}
+	const gitlabRepo = process.env.CI_PROJECT_PATH?.trim();
+	if (gitlabRepo && gitlabRepo.includes("/")) {
+		const parts = gitlabRepo.split("/");
+		const repo = parts.pop() ?? "";
+		return {
+			owner: (parts[0] ?? "").toLowerCase(),
+			repo: repo.toLowerCase(),
+			hasRemote: true,
+			isGitHubRemote: false
+		};
+	}
+	const bitbucketRepo = (process.env.BITBUCKET_REPO_FULL_NAME || process.env.BITBUCKET_REPO_SLUG)?.trim();
+	if (bitbucketRepo) {
+		const [owner = process.env.BITBUCKET_WORKSPACE || "", repo = ""] = bitbucketRepo.includes("/") ? bitbucketRepo.split("/") : [process.env.BITBUCKET_WORKSPACE || "", bitbucketRepo];
+		return {
+			owner: owner.toLowerCase(),
+			repo: repo.toLowerCase(),
+			hasRemote: true,
+			isGitHubRemote: false
+		};
+	}
 	const gitRoot = findGitRoot$1(directory);
 	if (!gitRoot) return {
 		owner: null,
@@ -627,26 +654,17 @@ const detectLocalRepoOwner = (directory) => {
 	if (rawUrl !== null) return parseGitRemote(rawUrl);
 	return parseGitRemote(spawnGitRemote(gitRoot));
 };
-const isNonGitHubCi = () => {
-	const env = process.env;
-	if (!(env.CI === "true" || env.CI === "1")) return false;
-	return Boolean(env.GITLAB_CI || env.BITBUCKET_BUILD_NUMBER || env.CIRCLECI && !env.CIRCLE_PROJECT_REPONAME?.includes("/") || env.BUILDKITE || env.TRAVIS || env.JENKINS_URL);
-};
 const checkOwnerAgainstAllowlist = (detected, allowedOwners, tokenKind) => {
-	if (isNonGitHubCi()) return {
-		allowed: false,
-		reason: "Non-GitHub CI environments are unsupported under organization allowlists."
-	};
 	if (!detected.hasRemote) {
 		if (tokenKind === "session") return { allowed: true };
 		return {
 			allowed: false,
-			reason: "Repository has no GitHub remote. CI and API key runs require an origin remote matching an allowed organization."
+			reason: "Repository has no origin remote. CI and API key runs require an origin remote matching an allowed organization."
 		};
 	}
-	if (!detected.isGitHubRemote || !detected.owner) return {
+	if (!detected.owner) return {
 		allowed: false,
-		reason: "Repository remote is not hosted on GitHub or could not be determined."
+		reason: "Repository remote owner could not be determined."
 	};
 	const lowerOwner = detected.owner.toLowerCase();
 	if (!allowedOwners.some((allowed) => allowed.login.toLowerCase() === lowerOwner)) {
@@ -654,7 +672,7 @@ const checkOwnerAgainstAllowlist = (detected, allowedOwners, tokenKind) => {
 		return {
 			allowed: false,
 			owner: lowerOwner,
-			reason: `GitHub owner '${detected.owner}' is not on the organization allowlist (${allowedLogins || "none"}).`
+			reason: `Repository owner '${detected.owner}' is not on the organization allowlist (${allowedLogins || "none"}).`
 		};
 	}
 	return {

package/dist/{sarif-Lt31Ld5t.js → sarif-Cu7Rm1Ma.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-CukuIVX4.js";
+import { t as APP_VERSION } from "./version-DtOeK-2T.js";
 import { n as isSecretClassRule, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import path from "node:path";
 //#region src/output/sarif.ts

package/dist/{version-CukuIVX4.js → version-DtOeK-2T.js}

@@ -1,6 +1,6 @@
 import "node:fs";
 import "node:url";
 //#region src/version.ts
-const APP_VERSION = "0.2.4";
+const APP_VERSION = "0.2.6";
 //#endregion
 export { APP_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@methiu/raigal",
-	"version": "0.2.4",
+	"version": "0.2.6",
 	"publishConfig": {
 		"access": "public"
 	},