@lamalibre/create-lamaste 4.0.0

package/vendor/gatekeeper/dist/boot.js

@@ -0,0 +1,17 @@
+"use strict";
+// Filter the ExperimentalWarning that node:sqlite emits on first import.
+// Imported as the very first import in server/index.ts so its top-level code
+// runs before any module that touches node:sqlite (currently lib/state-db.ts
+// and the domain modules that go through it).
+//
+// `process.on('warning')` adds a listener but does not replace Node's default
+// stderr printer — both fire. We drop all existing listeners (just the
+// default printer at startup), then install a single filtered listener.
+// Non-SQLite warnings continue to print.
+process.removeAllListeners('warning');
+process.on('warning', (warning) => {
+    if (warning.name === 'ExperimentalWarning' && /SQLite/i.test(warning.message))
+        return;
+    console.warn(warning);
+});
+//# sourceMappingURL=boot.js.map

package/vendor/gatekeeper/dist/boot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot.js","sourceRoot":"","sources":["../src/boot.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,8CAA8C;AAC9C,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,wEAAwE;AACxE,yCAAyC;AACzC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACtC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAc,EAAE,EAAE;IACvC,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO;IACtF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC"}

package/vendor/gatekeeper/dist/cli/commands/access.d.ts

@@ -0,0 +1,2 @@
+export declare function accessCommand(args: string[]): Promise<void>;
+//# sourceMappingURL=access.d.ts.map

package/vendor/gatekeeper/dist/cli/commands/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/access.ts"],"names":[],"mappings":"AAEA,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCjE"}

package/vendor/gatekeeper/dist/cli/commands/access.js

@@ -0,0 +1,33 @@
+import { checkAccess } from '../../lib/authz.js';
+export async function accessCommand(args) {
+    const subcommand = args[0];
+    switch (subcommand) {
+        case 'check': {
+            const username = args[1];
+            const resourceType = args[2];
+            const resourceId = args[3];
+            if (!username || !resourceType || !resourceId) {
+                console.error('Usage: lamaste-gatekeeper access check <username> <resourceType> <resourceId>');
+                process.exit(1);
+            }
+            const result = await checkAccess(username, resourceType, resourceId);
+            console.log(JSON.stringify(result, null, 2));
+            if (!result.allowed) {
+                process.exit(1);
+            }
+            break;
+        }
+        case '--help':
+        case '-h':
+        case undefined:
+            console.log(`Usage: lamaste-gatekeeper access <subcommand>
+
+Subcommands:
+  check <username> <resourceType> <resourceId>    Check if user has access`);
+            break;
+        default:
+            console.error(`Unknown subcommand: ${subcommand}`);
+            process.exit(1);
+    }
+}
+//# sourceMappingURL=access.js.map

package/vendor/gatekeeper/dist/cli/commands/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../src/cli/commands/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAE3B,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CACX,+EAA+E,CAChF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAE7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,SAAS;YACZ,OAAO,CAAC,GAAG,CAAC;;;2EAGyD,CAAC,CAAC;YACvE,MAAM;QAER;YACE,OAAO,CAAC,KAAK,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}

package/vendor/gatekeeper/dist/cli/commands/grants.d.ts

@@ -0,0 +1,2 @@
+export declare function grantCommand(args: string[]): Promise<void>;
+//# sourceMappingURL=grants.d.ts.map

package/vendor/gatekeeper/dist/cli/commands/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/grants.ts"],"names":[],"mappings":"AAGA,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6GhE"}

package/vendor/gatekeeper/dist/cli/commands/grants.js

@@ -0,0 +1,110 @@
+import { createGrant, listGrants, getGrant, revokeGrant } from '../../lib/grants.js';
+export async function grantCommand(args) {
+    const subcommand = args[0];
+    switch (subcommand) {
+        case 'create': {
+            const user = getFlag(args, '--user');
+            const group = getFlag(args, '--group');
+            const tunnel = getFlag(args, '--tunnel');
+            const plugin = getFlag(args, '--plugin');
+            const target = getFlag(args, '--target');
+            if (!user && !group) {
+                console.error('Must specify --user <username> or --group <groupname>');
+                process.exit(1);
+            }
+            if (!tunnel && !plugin) {
+                console.error('Must specify --tunnel <tunnelId> or --plugin <pluginName>');
+                process.exit(1);
+            }
+            const principalType = user ? 'user' : 'group';
+            const principalId = (user ?? group);
+            const resourceType = tunnel ? 'tunnel' : 'plugin';
+            const resourceId = (tunnel ?? plugin);
+            const context = {};
+            if (target)
+                context['target'] = target;
+            const grant = await createGrant({
+                principalType,
+                principalId,
+                resourceType,
+                resourceId,
+                context,
+            });
+            console.log(JSON.stringify(grant, null, 2));
+            break;
+        }
+        case 'list': {
+            const user = getFlag(args, '--user');
+            const group = getFlag(args, '--group');
+            const tunnel = getFlag(args, '--tunnel');
+            const plugin = getFlag(args, '--plugin');
+            const filter = {};
+            if (user) {
+                filter.principalType = 'user';
+                filter.principalId = user;
+            }
+            else if (group) {
+                filter.principalType = 'group';
+                filter.principalId = group;
+            }
+            if (tunnel) {
+                filter.resourceType = 'tunnel';
+                filter.resourceId = tunnel;
+            }
+            else if (plugin) {
+                filter.resourceType = 'plugin';
+                filter.resourceId = plugin;
+            }
+            const grants = await listGrants(Object.keys(filter).length > 0 ? filter : undefined);
+            console.log(JSON.stringify(grants, null, 2));
+            break;
+        }
+        case 'show': {
+            const grantId = args[1];
+            if (!grantId) {
+                console.error('Usage: lamaste-gatekeeper grant show <grantId>');
+                process.exit(1);
+            }
+            const grant = await getGrant(grantId);
+            if (!grant) {
+                console.error('Grant not found');
+                process.exit(1);
+            }
+            console.log(JSON.stringify(grant, null, 2));
+            break;
+        }
+        case 'revoke': {
+            const grantId = args[1];
+            if (!grantId) {
+                console.error('Usage: lamaste-gatekeeper grant revoke <grantId>');
+                process.exit(1);
+            }
+            const grant = await revokeGrant(grantId);
+            console.log(`Revoked grant ${grant.grantId}`);
+            break;
+        }
+        case '--help':
+        case '-h':
+        case undefined:
+            console.log(`Usage: lamaste-gatekeeper grant <subcommand>
+
+Subcommands:
+  create --user <username> --tunnel <tunnelId>
+  create --group <groupname> --tunnel <tunnelId>
+  create --user <username> --plugin <pluginName> [--target agent:<label>]
+  list [--user <username>] [--group <groupname>] [--tunnel <id>] [--plugin <name>]
+  show <grantId>
+  revoke <grantId>`);
+            break;
+        default:
+            console.error(`Unknown subcommand: ${subcommand}`);
+            process.exit(1);
+    }
+}
+function getFlag(args, flag) {
+    const idx = args.indexOf(flag);
+    if (idx === -1)
+        return undefined;
+    return args[idx + 1];
+}
+//# sourceMappingURL=grants.js.map

package/vendor/gatekeeper/dist/cli/commands/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../src/cli/commands/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGrF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAEzC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,aAAa,GAAkB,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7D,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,KAAK,CAAE,CAAC;YACrC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,MAAM,CAAE,CAAC;YACvC,MAAM,OAAO,GAA4B,EAAE,CAAC;YAC5C,IAAI,MAAM;gBAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;YAEvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC;gBAC9B,aAAa;gBACb,WAAW;gBACX,YAAY;gBACZ,UAAU;gBACV,OAAO;aACR,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAEzC,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;gBAC9B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;YAC5B,CAAC;iBAAM,IAAI,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC;gBAC/B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;YAC7B,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC;gBAC/B,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC;YAC7B,CAAC;iBAAM,IAAI,MAAM,EAAE,CAAC;gBAClB,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC;gBAC/B,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACrF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,SAAS;YACZ,OAAO,CAAC,GAAG,CAAC;;;;;;;;mBAQC,CAAC,CAAC;YACf,MAAM;QAER;YACE,OAAO,CAAC,KAAK,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,IAAY;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACvB,CAAC"}

package/vendor/gatekeeper/dist/cli/commands/groups.d.ts

@@ -0,0 +1,2 @@
+export declare function groupCommand(args: string[]): Promise<void>;
+//# sourceMappingURL=groups.d.ts.map

package/vendor/gatekeeper/dist/cli/commands/groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/groups.ts"],"names":[],"mappings":"AAUA,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4GhE"}

package/vendor/gatekeeper/dist/cli/commands/groups.js

@@ -0,0 +1,98 @@
+import { createGroup, listGroups, getGroup, updateGroup, deleteGroup, addMembers, removeMembers, } from '../../lib/groups.js';
+export async function groupCommand(args) {
+    const subcommand = args[0];
+    switch (subcommand) {
+        case 'create': {
+            const name = args[1];
+            if (!name) {
+                console.error('Usage: lamaste-gatekeeper group create <name> [--description "..."]');
+                process.exit(1);
+            }
+            const descIdx = args.indexOf('--description');
+            const description = descIdx !== -1 ? args[descIdx + 1] : undefined;
+            const group = await createGroup(name, { description });
+            console.log(JSON.stringify(group, null, 2));
+            break;
+        }
+        case 'list': {
+            const groups = await listGroups();
+            console.log(JSON.stringify(groups, null, 2));
+            break;
+        }
+        case 'show': {
+            const name = args[1];
+            if (!name) {
+                console.error('Usage: lamaste-gatekeeper group show <name>');
+                process.exit(1);
+            }
+            const group = await getGroup(name);
+            if (!group) {
+                console.error(`Group "${name}" not found`);
+                process.exit(1);
+            }
+            console.log(JSON.stringify(group, null, 2));
+            break;
+        }
+        case 'rename': {
+            const name = args[1];
+            const newName = args[2];
+            if (!name || !newName) {
+                console.error('Usage: lamaste-gatekeeper group rename <name> <new-name>');
+                process.exit(1);
+            }
+            const group = await updateGroup(name, { name: newName });
+            console.log(JSON.stringify(group, null, 2));
+            break;
+        }
+        case 'delete': {
+            const name = args[1];
+            if (!name) {
+                console.error('Usage: lamaste-gatekeeper group delete <name>');
+                process.exit(1);
+            }
+            const result = await deleteGroup(name);
+            console.log(`Deleted group "${name}". Revoked ${result.deletedGrants} grant(s).`);
+            break;
+        }
+        case 'add-member': {
+            const groupName = args[1];
+            const usernames = args.slice(2);
+            if (!groupName || usernames.length === 0) {
+                console.error('Usage: lamaste-gatekeeper group add-member <group> <username> [<username>...]');
+                process.exit(1);
+            }
+            const group = await addMembers(groupName, usernames);
+            console.log(JSON.stringify(group, null, 2));
+            break;
+        }
+        case 'remove-member': {
+            const groupName = args[1];
+            const usernames = args.slice(2);
+            if (!groupName || usernames.length === 0) {
+                console.error('Usage: lamaste-gatekeeper group remove-member <group> <username> [<username>...]');
+                process.exit(1);
+            }
+            const group = await removeMembers(groupName, usernames);
+            console.log(JSON.stringify(group, null, 2));
+            break;
+        }
+        case '--help':
+        case '-h':
+        case undefined:
+            console.log(`Usage: lamaste-gatekeeper group <subcommand>
+
+Subcommands:
+  create <name> [--description "..."]     Create a group
+  list                                     List all groups
+  show <name>                              Show group details
+  rename <name> <new-name>                 Rename a group
+  delete <name>                            Delete a group and revoke its grants
+  add-member <group> <username>...         Add members to a group
+  remove-member <group> <username>...      Remove members from a group`);
+            break;
+        default:
+            console.error(`Unknown subcommand: ${subcommand}`);
+            process.exit(1);
+    }
+}
+//# sourceMappingURL=groups.js.map

package/vendor/gatekeeper/dist/cli/commands/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../../../src/cli/commands/groups.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,cAAc,MAAM,CAAC,aAAa,YAAY,CAAC,CAAC;YAClF,MAAM;QACR,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,KAAK,CACX,+EAA+E,CAChF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,KAAK,CACX,kFAAkF,CACnF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,SAAS;YACZ,OAAO,CAAC,GAAG,CAAC;;;;;;;;;uEASqD,CAAC,CAAC;YACnE,MAAM;QAER;YACE,OAAO,CAAC,KAAK,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}

package/vendor/gatekeeper/dist/cli/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/vendor/gatekeeper/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":""}

package/vendor/gatekeeper/dist/cli/index.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { groupCommand } from './commands/groups.js';
+import { grantCommand } from './commands/grants.js';
+import { accessCommand } from './commands/access.js';
+const args = process.argv.slice(2);
+const command = args[0];
+async function main() {
+    switch (command) {
+        case 'group':
+            await groupCommand(args.slice(1));
+            break;
+        case 'grant':
+            await grantCommand(args.slice(1));
+            break;
+        case 'access':
+            await accessCommand(args.slice(1));
+            break;
+        case '--help':
+        case '-h':
+        case undefined:
+            printHelp();
+            break;
+        default:
+            console.error(`Unknown command: ${command}`);
+            printHelp();
+            process.exit(1);
+    }
+}
+function printHelp() {
+    console.log(`lamaste-gatekeeper — authorization management CLI
+
+Usage: lamaste-gatekeeper <command> [options]
+
+Commands:
+  group    Manage Lamaste access control groups
+  grant    Manage access grants
+  access   Check access and run diagnostics
+
+Run 'lamaste-gatekeeper <command> --help' for command-specific help.`);
+}
+main().catch((err) => {
+    console.error('Error:', err.message);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/vendor/gatekeeper/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAExB,KAAK,UAAU,IAAI;IACjB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM;QACR,KAAK,OAAO;YACV,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM;QACR,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,SAAS;YACZ,SAAS,EAAE,CAAC;YACZ,MAAM;QACR;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC7C,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;qEASuD,CAAC,CAAC;AACvE,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/vendor/gatekeeper/dist/index.d.ts

@@ -0,0 +1,9 @@
+export type { Group, GroupState, CreateGroupOptions, UpdateGroupOptions, DeleteGroupResult, Grant, GrantState, CreateGrantOptions, GrantFilter, AccessAllowed, AccessDenied, AccessResult, AccessRequestTemplates, TemplateOptions, GatekeeperSettings, AccessRequestEntry, TunnelInfo, AutheliaSession, GatekeeperLogger, } from './lib/types.js';
+export { PRINCIPAL_TYPES, RESOURCE_TYPES, ACCESS_MODES, RESERVED_GROUP_NAMES, MAX_GROUPS, MAX_GRANTS, GRANT_RETENTION_MS, SESSION_CACHE_TTL_MS, GROUP_NAME_REGEX, MAX_GROUP_NAME_LENGTH, MIN_GROUP_NAME_LENGTH, DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, ACCESS_LOG_FILE, AUTHELIA_VERIFY_URL, GATEKEEPER_PORT, } from './lib/constants.js';
+export type { PrincipalType, ResourceType, AccessMode } from './lib/constants.js';
+export { createGroup, listGroups, getGroup, updateGroup, deleteGroup, addMembers, removeMembers, getGroupsForUser, } from './lib/groups.js';
+export { createGrant, listGrants, getGrant, revokeGrant, consumeGrant, removeGrantsByPredicate, removeGrantsByPrincipal, } from './lib/grants.js';
+export { checkAccess } from './lib/authz.js';
+export { getAccessRequestTemplates, buildAccessRequestPage } from './lib/templates.js';
+export { migrateFromLegacy } from './lib/migration.js';
+//# sourceMappingURL=index.d.ts.map

package/vendor/gatekeeper/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGlF,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}

package/vendor/gatekeeper/dist/index.js

@@ -0,0 +1,13 @@
+// Constants
+export { PRINCIPAL_TYPES, RESOURCE_TYPES, ACCESS_MODES, RESERVED_GROUP_NAMES, MAX_GROUPS, MAX_GRANTS, GRANT_RETENTION_MS, SESSION_CACHE_TTL_MS, GROUP_NAME_REGEX, MAX_GROUP_NAME_LENGTH, MIN_GROUP_NAME_LENGTH, DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, ACCESS_LOG_FILE, AUTHELIA_VERIFY_URL, GATEKEEPER_PORT, } from './lib/constants.js';
+// Groups
+export { createGroup, listGroups, getGroup, updateGroup, deleteGroup, addMembers, removeMembers, getGroupsForUser, } from './lib/groups.js';
+// Grants
+export { createGrant, listGrants, getGrant, revokeGrant, consumeGrant, removeGrantsByPredicate, removeGrantsByPrincipal, } from './lib/grants.js';
+// Authorization
+export { checkAccess } from './lib/authz.js';
+// Templates
+export { getAccessRequestTemplates, buildAccessRequestPage } from './lib/templates.js';
+// Migration
+export { migrateFromLegacy } from './lib/migration.js';
+//# sourceMappingURL=index.js.map

package/vendor/gatekeeper/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuBA,YAAY;AACZ,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAI5B,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,gBAAgB;AAChB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,YAAY;AACZ,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}

package/vendor/gatekeeper/dist/lib/authz.d.ts

@@ -0,0 +1,16 @@
+import type { AccessResult, TemplateOptions } from './types.js';
+/**
+ * Check if a user has access to a resource.
+ *
+ * Resolution order:
+ * 1. Direct user grants (principalType='user', principalId=username)
+ * 2. Group grants (principalType='group', principalId in user's Lamaste groups)
+ *
+ * @param username - The Authelia username to check
+ * @param resourceType - The resource type (e.g., 'tunnel', 'plugin')
+ * @param resourceId - The resource identifier (e.g., tunnel UUID, plugin name)
+ * @param templateOptions - Options for generating access request templates
+ * @returns AccessResult indicating allowed/denied with templates if denied
+ */
+export declare function checkAccess(username: string, resourceType: string, resourceId: string, templateOptions?: TemplateOptions): Promise<AccessResult>;
+//# sourceMappingURL=authz.d.ts.map

package/vendor/gatekeeper/dist/lib/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/lib/authz.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,YAAY,CAAC,CA8BvB"}

package/vendor/gatekeeper/dist/lib/authz.js

@@ -0,0 +1,42 @@
+import { listGrants } from './grants.js';
+import { getGroupsForUser } from './groups.js';
+import { getAccessRequestTemplates } from './templates.js';
+/**
+ * Check if a user has access to a resource.
+ *
+ * Resolution order:
+ * 1. Direct user grants (principalType='user', principalId=username)
+ * 2. Group grants (principalType='group', principalId in user's Lamaste groups)
+ *
+ * @param username - The Authelia username to check
+ * @param resourceType - The resource type (e.g., 'tunnel', 'plugin')
+ * @param resourceId - The resource identifier (e.g., tunnel UUID, plugin name)
+ * @param templateOptions - Options for generating access request templates
+ * @returns AccessResult indicating allowed/denied with templates if denied
+ */
+export async function checkAccess(username, resourceType, resourceId, templateOptions) {
+    // Get all grants matching this resource
+    const resourceGrants = await listGrants({ resourceType, resourceId });
+    // Check 1: Direct user grant
+    const hasUserGrant = resourceGrants.some((g) => g.principalType === 'user' && g.principalId === username);
+    if (hasUserGrant) {
+        return { allowed: true };
+    }
+    // Check 2: Group grant — resolve user's Lamaste groups
+    const userGroups = await getGroupsForUser(username);
+    if (userGroups.length > 0) {
+        const groupGrants = resourceGrants.filter((g) => g.principalType === 'group');
+        const hasGroupGrant = groupGrants.some((g) => userGroups.includes(g.principalId));
+        if (hasGroupGrant) {
+            return { allowed: true };
+        }
+    }
+    // Denied — generate templates
+    const templates = getAccessRequestTemplates(username, resourceId, templateOptions);
+    return {
+        allowed: false,
+        resource: { type: resourceType, id: resourceId },
+        templates,
+    };
+}
+//# sourceMappingURL=authz.js.map

package/vendor/gatekeeper/dist/lib/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/lib/authz.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAG3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,YAAoB,EACpB,UAAkB,EAClB,eAAiC;IAEjC,wCAAwC;IACxC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;IAEtE,6BAA6B;IAC7B,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAChE,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QAC9E,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAEnF,OAAO;QACL,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE;QAChD,SAAS;KACV,CAAC;AACJ,CAAC"}

package/vendor/gatekeeper/dist/lib/cache-bust.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Cache invalidation hook registered by the gatekeeper server at startup.
+ *
+ * Library writers (grants, groups) call {@link notifyCacheInvalidated} after a
+ * successful write so the in-memory session cache and version counter can be
+ * updated deterministically — `fs.watch` is unreliable on network filesystems
+ * and container bind mounts, so the explicit notification closes that gap.
+ *
+ * If no server is registered (e.g. a CLI-only process touching the files),
+ * the notifier is a no-op.
+ */
+export type CacheInvalidator = () => void;
+export declare function registerCacheInvalidator(fn: CacheInvalidator): void;
+export declare function notifyCacheInvalidated(): void;
+//# sourceMappingURL=cache-bust.d.ts.map

package/vendor/gatekeeper/dist/lib/cache-bust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-bust.d.ts","sourceRoot":"","sources":["../../src/lib/cache-bust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC;AAI1C,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,CAEnE;AAED,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}

package/vendor/gatekeeper/dist/lib/cache-bust.js

@@ -0,0 +1,19 @@
+/**
+ * Cache invalidation hook registered by the gatekeeper server at startup.
+ *
+ * Library writers (grants, groups) call {@link notifyCacheInvalidated} after a
+ * successful write so the in-memory session cache and version counter can be
+ * updated deterministically — `fs.watch` is unreliable on network filesystems
+ * and container bind mounts, so the explicit notification closes that gap.
+ *
+ * If no server is registered (e.g. a CLI-only process touching the files),
+ * the notifier is a no-op.
+ */
+let invalidator = null;
+export function registerCacheInvalidator(fn) {
+    invalidator = fn;
+}
+export function notifyCacheInvalidated() {
+    invalidator?.();
+}
+//# sourceMappingURL=cache-bust.js.map

package/vendor/gatekeeper/dist/lib/cache-bust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-bust.js","sourceRoot":"","sources":["../../src/lib/cache-bust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,IAAI,WAAW,GAA4B,IAAI,CAAC;AAEhD,MAAM,UAAU,wBAAwB,CAAC,EAAoB;IAC3D,WAAW,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,WAAW,EAAE,EAAE,CAAC;AAClB,CAAC"}

package/vendor/gatekeeper/dist/lib/constants.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Principal types for grants.
+ */
+export declare const PRINCIPAL_TYPES: readonly ["user", "group"];
+export type PrincipalType = (typeof PRINCIPAL_TYPES)[number];
+/**
+ * Built-in resource types. The grant system is extensible — new resource types
+ * can be added without schema changes.
+ */
+export declare const RESOURCE_TYPES: readonly ["tunnel", "plugin"];
+export type ResourceType = (typeof RESOURCE_TYPES)[number];
+/**
+ * Tunnel access modes.
+ */
+export declare const ACCESS_MODES: readonly ["public", "authenticated", "restricted"];
+export type AccessMode = (typeof ACCESS_MODES)[number];
+/**
+ * Reserved Authelia group names (identity tier). These cannot be used as
+ * Lamaste group names to avoid confusion between the two group systems.
+ */
+export declare const RESERVED_GROUP_NAMES: readonly ["admins", "internal", "external"];
+/**
+ * Hard cap on Lamaste groups (DoS protection).
+ */
+export declare const MAX_GROUPS = 200;
+/**
+ * Hard cap on grants (DoS protection).
+ */
+export declare const MAX_GRANTS = 1000;
+/**
+ * Hard cap on members per group (DoS protection).
+ */
+export declare const MAX_MEMBERS_PER_GROUP = 1000;
+/**
+ * Consumed grant retention period (90 days in ms).
+ * Grants older than this are pruned during write operations.
+ */
+export declare const GRANT_RETENTION_MS: number;
+/**
+ * Gatekeeper in-memory session cache TTL (30 seconds in ms).
+ */
+export declare const SESSION_CACHE_TTL_MS: number;
+/**
+ * Group name validation regex: lowercase alphanumeric + hyphens,
+ * cannot start or end with a hyphen, 2-63 chars.
+ */
+export declare const GROUP_NAME_REGEX: RegExp;
+/**
+ * Maximum group name length.
+ */
+export declare const MAX_GROUP_NAME_LENGTH = 63;
+/**
+ * Minimum group name length.
+ */
+export declare const MIN_GROUP_NAME_LENGTH = 2;
+/**
+ * Default data directory path.
+ */
+export declare const DEFAULT_DATA_DIR = "/etc/lamalibre/lamaste";
+/**
+ * State file names.
+ */
+export declare const GROUPS_FILE = "groups.json";
+export declare const GRANTS_FILE = "access-grants.json";
+export declare const SETTINGS_FILE = "gatekeeper.json";
+export declare const ACCESS_LOG_FILE = "access-request-log.json";
+/**
+ * Authelia verify endpoint (localhost).
+ *
+ * We call the nginx-flavored `/api/authz/auth-request` endpoint because we
+ * forward the origin request as `X-Original-URL` (+ `X-Original-Method`), the
+ * header contract that endpoint expects. The `/api/authz/forward-auth`
+ * endpoint is for Traefik-style callers that send `X-Forwarded-Host` /
+ * `X-Forwarded-Uri` and errors out with "missing host value" when given
+ * `X-Original-URL` — which was the prior default here.
+ */
+export declare const AUTHELIA_VERIFY_URL = "http://127.0.0.1:9091/api/authz/auth-request";
+/**
+ * Gatekeeper service port.
+ */
+export declare const GATEKEEPER_PORT = 9294;
+//# sourceMappingURL=constants.d.ts.map

package/vendor/gatekeeper/dist/lib/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,eAAe,4BAA6B,CAAC;AAC1D,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,cAAc,+BAAgC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,YAAY,oDAAqD,CAAC;AAC/E,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,6CAA8C,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,UAAU,MAAM,CAAC;AAE9B;;GAEG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B;;GAEG;AACH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAA2B,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAoC,CAAC;AAElE;;GAEG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;GAEG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AAEzD;;GAEG;AACH,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,eAAe,4BAA4B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,iDAAiD,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC"}