@lamalibre/create-lamaste 4.0.0

package/vendor/gatekeeper/dist/lib/groups.js

@@ -0,0 +1,247 @@
+import { PromiseChainMutex } from '@lamalibre/lamaste';
+import { RESERVED_GROUP_NAMES, MAX_GROUPS, MAX_MEMBERS_PER_GROUP, GROUP_NAME_REGEX, MIN_GROUP_NAME_LENGTH, MAX_GROUP_NAME_LENGTH, } from './constants.js';
+import { removeGrantsByPredicate, updateGrantsByPredicate } from './grants.js';
+import { notifyCacheInvalidated } from './cache-bust.js';
+import { getGatekeeperDb } from './state-db.js';
+// ---------------------------------------------------------------------------
+// Promise-chain mutex (preserved from JSON era)
+//
+// SQLite's BEGIN IMMEDIATE already serialises writers, but the existing
+// public API exposes a few read-modify-write sequences (e.g. updateGroup
+// followed by a cascading grant rename). Keeping the mutex preserves the
+// JSON-era atomicity guarantees byte-for-byte during the storage migration.
+// Drop as a follow-up after Step 4 (rodeo) lands.
+// ---------------------------------------------------------------------------
+const groupMutex = new PromiseChainMutex();
+function withGroupLock(fn) {
+    return groupMutex.run(fn);
+}
+let stmts = null;
+async function getStmts() {
+    if (stmts)
+        return stmts;
+    const db = await getGatekeeperDb();
+    stmts = {
+        selectAll: db.prepare('SELECT * FROM groups ORDER BY created_at'),
+        selectByName: db.prepare('SELECT * FROM groups WHERE name = ?'),
+        countAll: db.prepare('SELECT COUNT(*) AS n FROM groups'),
+        insert: db.prepare(`
+      INSERT INTO groups (name, description, members, created_at, created_by)
+      VALUES (?, ?, ?, ?, ?)
+    `),
+        updateDescription: db.prepare('UPDATE groups SET description = ? WHERE name = ?'),
+        updateName: db.prepare('UPDATE groups SET name = ? WHERE name = ?'),
+        updateMembers: db.prepare('UPDATE groups SET members = ? WHERE name = ?'),
+        deleteByName: db.prepare('DELETE FROM groups WHERE name = ?'),
+        begin: db.prepare('BEGIN IMMEDIATE'),
+        commit: db.prepare('COMMIT'),
+        rollback: db.prepare('ROLLBACK'),
+    };
+    return stmts;
+}
+function rowToGroup(row) {
+    return {
+        name: row.name,
+        description: row.description,
+        members: JSON.parse(row.members),
+        createdAt: row.created_at,
+        createdBy: row.created_by,
+    };
+}
+// ---------------------------------------------------------------------------
+// Validation helpers
+// ---------------------------------------------------------------------------
+function validateGroupName(name) {
+    if (name.length < MIN_GROUP_NAME_LENGTH || name.length > MAX_GROUP_NAME_LENGTH) {
+        throw Object.assign(new Error(`Group name must be ${MIN_GROUP_NAME_LENGTH}-${MAX_GROUP_NAME_LENGTH} characters`), { statusCode: 400 });
+    }
+    if (!GROUP_NAME_REGEX.test(name)) {
+        throw Object.assign(new Error('Group name must be lowercase alphanumeric with hyphens, cannot start or end with a hyphen'), { statusCode: 400 });
+    }
+    if (RESERVED_GROUP_NAMES.includes(name)) {
+        throw Object.assign(new Error(`Group name "${name}" is reserved for Authelia identity tiers`), {
+            statusCode: 400,
+        });
+    }
+}
+// ---------------------------------------------------------------------------
+// Public API — signatures preserved byte-identical to the JSON-backed version
+// ---------------------------------------------------------------------------
+export async function createGroup(name, options = {}) {
+    validateGroupName(name);
+    return withGroupLock(async () => {
+        const s = await getStmts();
+        const countRow = s.countAll.get();
+        if (countRow.n >= MAX_GROUPS) {
+            throw Object.assign(new Error(`Maximum number of groups (${MAX_GROUPS}) reached`), {
+                statusCode: 503,
+            });
+        }
+        const existing = s.selectByName.get(name);
+        if (existing) {
+            throw Object.assign(new Error(`Group "${name}" already exists`), { statusCode: 409 });
+        }
+        const group = {
+            name,
+            description: options.description ?? '',
+            members: [],
+            createdAt: new Date().toISOString(),
+            createdBy: options.createdBy ?? 'admin',
+        };
+        s.begin.run();
+        try {
+            s.insert.run(group.name, group.description, JSON.stringify(group.members), group.createdAt, group.createdBy);
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        notifyCacheInvalidated();
+        return group;
+    });
+}
+export async function listGroups() {
+    const s = await getStmts();
+    const rows = s.selectAll.all();
+    return rows.map(rowToGroup);
+}
+export async function getGroup(name) {
+    const s = await getStmts();
+    const row = s.selectByName.get(name);
+    return row ? rowToGroup(row) : null;
+}
+export async function updateGroup(name, updates) {
+    return withGroupLock(async () => {
+        const s = await getStmts();
+        const existingRow = s.selectByName.get(name);
+        if (!existingRow) {
+            throw Object.assign(new Error(`Group "${name}" not found`), { statusCode: 404 });
+        }
+        const group = rowToGroup(existingRow);
+        let cascadingRename = null;
+        if (updates.name !== undefined && updates.name !== name) {
+            validateGroupName(updates.name);
+            const conflict = s.selectByName.get(updates.name);
+            if (conflict) {
+                throw Object.assign(new Error(`Group "${updates.name}" already exists`), {
+                    statusCode: 409,
+                });
+            }
+            cascadingRename = updates.name;
+        }
+        if (updates.description !== undefined) {
+            group.description = updates.description;
+        }
+        s.begin.run();
+        try {
+            if (updates.description !== undefined) {
+                s.updateDescription.run(group.description, name);
+            }
+            if (cascadingRename !== null) {
+                s.updateName.run(cascadingRename, name);
+                group.name = cascadingRename;
+            }
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        if (cascadingRename !== null) {
+            // Cascade rename to grants (uses grantLock for safe concurrent access).
+            // Runs outside the SQL transaction because grants writes use their own
+            // mutex + transaction; nesting them would deadlock.
+            const newName = cascadingRename;
+            await updateGrantsByPredicate((g) => g.principalType === 'group' && g.principalId === name, (g) => {
+                g.principalId = newName;
+            });
+        }
+        notifyCacheInvalidated();
+        return group;
+    });
+}
+export async function deleteGroup(name) {
+    validateGroupName(name);
+    return withGroupLock(async () => {
+        const s = await getStmts();
+        const existing = s.selectByName.get(name);
+        if (!existing) {
+            throw Object.assign(new Error(`Group "${name}" not found`), { statusCode: 404 });
+        }
+        s.begin.run();
+        try {
+            s.deleteByName.run(name);
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        notifyCacheInvalidated();
+        // Auto-revoke all grants referencing this group (uses grantLock)
+        const deletedGrants = await removeGrantsByPredicate((g) => g.principalType === 'group' && g.principalId === name);
+        return { deletedGrants };
+    });
+}
+export async function addMembers(groupName, usernames) {
+    return withGroupLock(async () => {
+        const s = await getStmts();
+        const row = s.selectByName.get(groupName);
+        if (!row) {
+            throw Object.assign(new Error(`Group "${groupName}" not found`), { statusCode: 404 });
+        }
+        const group = rowToGroup(row);
+        for (const username of usernames) {
+            if (!group.members.includes(username)) {
+                if (group.members.length >= MAX_MEMBERS_PER_GROUP) {
+                    throw Object.assign(new Error(`Maximum members per group (${MAX_MEMBERS_PER_GROUP}) reached`), { statusCode: 503 });
+                }
+                group.members.push(username);
+            }
+        }
+        s.begin.run();
+        try {
+            s.updateMembers.run(JSON.stringify(group.members), groupName);
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        notifyCacheInvalidated();
+        return group;
+    });
+}
+export async function removeMembers(groupName, usernames) {
+    return withGroupLock(async () => {
+        const s = await getStmts();
+        const row = s.selectByName.get(groupName);
+        if (!row) {
+            throw Object.assign(new Error(`Group "${groupName}" not found`), { statusCode: 404 });
+        }
+        const group = rowToGroup(row);
+        const removeSet = new Set(usernames);
+        group.members = group.members.filter((m) => !removeSet.has(m));
+        s.begin.run();
+        try {
+            s.updateMembers.run(JSON.stringify(group.members), groupName);
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        notifyCacheInvalidated();
+        return group;
+    });
+}
+export async function getGroupsForUser(username) {
+    const s = await getStmts();
+    const rows = s.selectAll.all();
+    return rows
+        .map(rowToGroup)
+        .filter((g) => g.members.includes(username))
+        .map((g) => g.name);
+}
+//# sourceMappingURL=groups.js.map

package/vendor/gatekeeper/dist/lib/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../../src/lib/groups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAUhD,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,4EAA4E;AAC5E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAE3C,SAAS,aAAa,CAAI,EAAoB;IAC5C,OAAO,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAoBD,IAAI,KAAK,GAAsB,IAAI,CAAC;AAEpC,KAAK,UAAU,QAAQ;IACrB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,KAAK,GAAG;QACN,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC;QACjE,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC;QAC/D,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;QACxD,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;;;KAGlB,CAAC;QACF,iBAAiB,EAAE,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC;QACjF,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC;QACnE,aAAa,EAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACzE,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC;QAC7D,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KACjC,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAcD,SAAS,UAAU,CAAC,GAAa;IAC/B,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAa;QAC5C,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC/E,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,sBAAsB,qBAAqB,IAAI,qBAAqB,aAAa,CAAC,EAC5F,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,2FAA2F,CAC5F,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IACD,IAAK,oBAA0C,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,IAAI,2CAA2C,CAAC,EAAE;YAC7F,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,UAA8B,EAAE;IAC9E,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAExB,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAE3B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAmB,CAAC;QACnD,IAAI,QAAQ,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,UAAU,WAAW,CAAC,EAAE;gBACjF,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAyB,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,KAAK,GAAe;YACxB,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;YACtC,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;SACxC,CAAC;QAEF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,WAAW,EACjB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,CAChB,CAAC;YACF,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAyB,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAA2B;IACzE,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAyB,CAAC;QACrE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAEtC,IAAI,eAAe,GAAkB,IAAI,CAAC;QAE1C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxD,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEhC,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAyB,CAAC;YAC1E,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,OAAO,CAAC,IAAI,kBAAkB,CAAC,EAAE;oBACvE,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;QACjC,CAAC;QAED,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAC1C,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACtC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;gBAC7B,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBACxC,KAAK,CAAC,IAAI,GAAG,eAAe,CAAC;YAC/B,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,wEAAwE;YACxE,uEAAuE;YACvE,oDAAoD;YACpD,MAAM,OAAO,GAAG,eAAe,CAAC;YAChC,MAAM,uBAAuB,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,EAC5D,CAAC,CAAC,EAAE,EAAE;gBACJ,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAExB,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAyB,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QAEzB,iEAAiE;QACjE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAC7D,CAAC;QAEF,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,SAA4B;IAC9E,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAyB,CAAC;QAClE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;oBAClD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,8BAA8B,qBAAqB,WAAW,CAAC,EACzE,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,SAA4B;IAE5B,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAyB,CAAC;QAClE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/D,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;IACxD,OAAO,IAAI;SACR,GAAG,CAAC,UAAU,CAAC;SACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/vendor/gatekeeper/dist/lib/migration.d.ts

@@ -0,0 +1,17 @@
+import type { GatekeeperLogger } from './types.js';
+/**
+ * Migrate legacy `user-plugin-access.json` grants to the new
+ * `access-grants.json` format. Idempotent — skips if already migrated.
+ *
+ * Mapping:
+ * - username → principalType: 'user', principalId: username
+ * - pluginName → resourceType: 'plugin', resourceId: pluginName
+ * - target → context: { target }
+ *
+ * The legacy file is renamed to `.migrated` after successful migration.
+ *
+ * @param logger - Logger for progress reporting
+ * @returns Number of grants migrated
+ */
+export declare function migrateFromLegacy(logger?: GatekeeperLogger): Promise<number>;
+//# sourceMappingURL=migration.d.ts.map

package/vendor/gatekeeper/dist/lib/migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../src/lib/migration.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAqBnD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsElF"}

package/vendor/gatekeeper/dist/lib/migration.js

@@ -0,0 +1,79 @@
+import { readFile, rename } from 'node:fs/promises';
+import path from 'node:path';
+import { DEFAULT_DATA_DIR } from './constants.js';
+import { createGrant } from './grants.js';
+const dataDir = process.env.LAMALIBRE_LAMASTE_DATA_DIR ?? DEFAULT_DATA_DIR;
+const LEGACY_FILE = 'user-plugin-access.json';
+const MIGRATED_SUFFIX = '.migrated';
+/**
+ * Migrate legacy `user-plugin-access.json` grants to the new
+ * `access-grants.json` format. Idempotent — skips if already migrated.
+ *
+ * Mapping:
+ * - username → principalType: 'user', principalId: username
+ * - pluginName → resourceType: 'plugin', resourceId: pluginName
+ * - target → context: { target }
+ *
+ * The legacy file is renamed to `.migrated` after successful migration.
+ *
+ * @param logger - Logger for progress reporting
+ * @returns Number of grants migrated
+ */
+export async function migrateFromLegacy(logger) {
+    const legacyPath = path.join(dataDir, LEGACY_FILE);
+    let raw;
+    try {
+        raw = await readFile(legacyPath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            logger?.info('No legacy user-plugin-access.json found, skipping migration');
+            return 0;
+        }
+        throw err;
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== 'object' || !('grants' in parsed)) {
+        logger?.warn('Legacy file has unexpected format, skipping migration');
+        return 0;
+    }
+    const legacy = parsed;
+    if (!Array.isArray(legacy.grants) || legacy.grants.length === 0) {
+        logger?.info('Legacy file has no grants, renaming to .migrated');
+        await rename(legacyPath, legacyPath + MIGRATED_SUFFIX);
+        return 0;
+    }
+    let migrated = 0;
+    for (const legacyGrant of legacy.grants) {
+        try {
+            // Preserve consumption state from the legacy file so previously-used
+            // local-plugin grants do not become re-usable post-migration.
+            await createGrant({
+                principalType: 'user',
+                principalId: legacyGrant.username,
+                resourceType: 'plugin',
+                resourceId: legacyGrant.pluginName,
+                context: { target: legacyGrant.target },
+            }, {
+                used: legacyGrant.used,
+                createdAt: legacyGrant.createdAt,
+                usedAt: legacyGrant.usedAt,
+            });
+            migrated++;
+        }
+        catch (err) {
+            // Skip duplicates (already migrated or duplicate in source)
+            const error = err;
+            if (error.statusCode === 409) {
+                logger?.info(`Skipping duplicate grant for ${legacyGrant.username} → ${legacyGrant.pluginName}`);
+                continue;
+            }
+            throw err;
+        }
+    }
+    // Rename legacy file to mark as migrated
+    await rename(legacyPath, legacyPath + MIGRATED_SUFFIX);
+    logger?.info({ migrated, total: legacy.grants.length }, `Migrated ${migrated} of ${legacy.grants.length} legacy grants`);
+    return migrated;
+}
+//# sourceMappingURL=migration.js.map

package/vendor/gatekeeper/dist/lib/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.js","sourceRoot":"","sources":["../../src/lib/migration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,gBAAgB,CAAC;AAC3E,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,eAAe,GAAG,WAAW,CAAC;AAiBpC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAyB;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,EAAE,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,EAAE,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,MAAqB,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,EAAE,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,eAAe,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,WAAW,CACf;gBACE,aAAa,EAAE,MAAM;gBACrB,WAAW,EAAE,WAAW,CAAC,QAAQ;gBACjC,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;aACxC,EACD;gBACE,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,MAAM,EAAE,WAAW,CAAC,MAAM;aAC3B,CACF,CAAC;YACF,QAAQ,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,4DAA4D;YAC5D,MAAM,KAAK,GAAG,GAAsC,CAAC;YACrD,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC7B,MAAM,EAAE,IAAI,CACV,gCAAgC,WAAW,CAAC,QAAQ,MAAM,WAAW,CAAC,UAAU,EAAE,CACnF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,eAAe,CAAC,CAAC;IAEvD,MAAM,EAAE,IAAI,CACV,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EACzC,YAAY,QAAQ,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,gBAAgB,CAChE,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/vendor/gatekeeper/dist/lib/migrations/gatekeeper/0001_groups.sql

@@ -0,0 +1,7 @@
+CREATE TABLE groups (
+  name         TEXT    PRIMARY KEY,
+  description  TEXT    NOT NULL DEFAULT '',
+  members      TEXT    NOT NULL DEFAULT '[]',   -- JSON array of usernames
+  created_at   TEXT    NOT NULL,
+  created_by   TEXT    NOT NULL DEFAULT 'admin'
+);

package/vendor/gatekeeper/dist/lib/migrations/gatekeeper/0002_access_grants.sql

@@ -0,0 +1,14 @@
+CREATE TABLE access_grants (
+  grant_id        TEXT    PRIMARY KEY,            -- UUID
+  principal_type  TEXT    NOT NULL,               -- 'user' | 'group'
+  principal_id    TEXT    NOT NULL,
+  resource_type   TEXT    NOT NULL,               -- 'tunnel' | 'plugin' | extensible
+  resource_id     TEXT    NOT NULL,
+  context         TEXT    NOT NULL DEFAULT '{}',  -- JSON object
+  used            INTEGER NOT NULL DEFAULT 0,
+  created_at      TEXT    NOT NULL,
+  used_at         TEXT
+);
+CREATE INDEX idx_grants_principal     ON access_grants(principal_type, principal_id);
+CREATE INDEX idx_grants_resource      ON access_grants(resource_type, resource_id);
+CREATE INDEX idx_grants_used_used_at  ON access_grants(used, used_at);

package/vendor/gatekeeper/dist/lib/migrations/gatekeeper/0003_access_request_log.sql

@@ -0,0 +1,9 @@
+CREATE TABLE access_request_log (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  timestamp     TEXT    NOT NULL,
+  username      TEXT    NOT NULL,
+  resource_type TEXT    NOT NULL,
+  resource_id   TEXT    NOT NULL,
+  resource_fqdn TEXT    NOT NULL
+);
+CREATE INDEX idx_access_log_timestamp ON access_request_log(timestamp);

package/vendor/gatekeeper/dist/lib/migrations/migrations/gatekeeper/0001_groups.sql

@@ -0,0 +1,7 @@
+CREATE TABLE groups (
+  name         TEXT    PRIMARY KEY,
+  description  TEXT    NOT NULL DEFAULT '',
+  members      TEXT    NOT NULL DEFAULT '[]',   -- JSON array of usernames
+  created_at   TEXT    NOT NULL,
+  created_by   TEXT    NOT NULL DEFAULT 'admin'
+);

package/vendor/gatekeeper/dist/lib/migrations/migrations/gatekeeper/0002_access_grants.sql

@@ -0,0 +1,14 @@
+CREATE TABLE access_grants (
+  grant_id        TEXT    PRIMARY KEY,            -- UUID
+  principal_type  TEXT    NOT NULL,               -- 'user' | 'group'
+  principal_id    TEXT    NOT NULL,
+  resource_type   TEXT    NOT NULL,               -- 'tunnel' | 'plugin' | extensible
+  resource_id     TEXT    NOT NULL,
+  context         TEXT    NOT NULL DEFAULT '{}',  -- JSON object
+  used            INTEGER NOT NULL DEFAULT 0,
+  created_at      TEXT    NOT NULL,
+  used_at         TEXT
+);
+CREATE INDEX idx_grants_principal     ON access_grants(principal_type, principal_id);
+CREATE INDEX idx_grants_resource      ON access_grants(resource_type, resource_id);
+CREATE INDEX idx_grants_used_used_at  ON access_grants(used, used_at);

package/vendor/gatekeeper/dist/lib/migrations/migrations/gatekeeper/0003_access_request_log.sql

@@ -0,0 +1,9 @@
+CREATE TABLE access_request_log (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  timestamp     TEXT    NOT NULL,
+  username      TEXT    NOT NULL,
+  resource_type TEXT    NOT NULL,
+  resource_id   TEXT    NOT NULL,
+  resource_fqdn TEXT    NOT NULL
+);
+CREATE INDEX idx_access_log_timestamp ON access_request_log(timestamp);

package/vendor/gatekeeper/dist/lib/state-db.d.ts

@@ -0,0 +1,16 @@
+import type { DatabaseSync } from 'node:sqlite';
+/**
+ * Returns the singleton `gatekeeper.db` handle for lamaste-gatekeeper.
+ * Lazy-opens on first call; subsequent calls return the cached handle. Safe to
+ * call concurrently from multiple modules at startup — the open is wrapped in
+ * a promise singleton so only one open ever races.
+ */
+export declare function getGatekeeperDb(): Promise<DatabaseSync>;
+/**
+ * Apply every pending migration in `migrationsDir` against `db`. Idempotent —
+ * the second call is a no-op once `schema_migrations` has caught up. Each
+ * migration runs inside `BEGIN IMMEDIATE` … `COMMIT`; a failure rolls the
+ * statement back and rethrows with the migration filename in the message.
+ */
+export declare function ensureMigrations(db: DatabaseSync, migrationsDir: string): Promise<void>;
+//# sourceMappingURL=state-db.d.ts.map

package/vendor/gatekeeper/dist/lib/state-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-db.d.ts","sourceRoot":"","sources":["../../src/lib/state-db.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA+ChD;;;;;GAKG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,CAS7D;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C7F"}

package/vendor/gatekeeper/dist/lib/state-db.js

@@ -0,0 +1,154 @@
+// Foundation for SQLite-backed state in lamaste-gatekeeper. Owns the singleton
+// DB handle, PRAGMA tuning, file-permission tightening, and the forward-only
+// numbered-migrations runner. Domain modules consume this via
+// `getGatekeeperDb()` and never instantiate `DatabaseSync` themselves.
+//
+// Mirrors the serverd foundation at packages/server/daemon/src/lib/state-db.js.
+// Duplicated rather than hoisted to core per design note §2 — hoist once both
+// copies are green and identical in shape.
+import { chmod, readdir, readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const DATA_DIR_ENV = 'LAMALIBRE_LAMASTE_DATA_DIR';
+const DEFAULT_DATA_DIR = '/etc/lamalibre/lamaste';
+const GATEKEEPER_DB_FILENAME = 'gatekeeper.db';
+// Migrations live as raw .sql files under src/lib/migrations/gatekeeper/.
+// `tsc` does not copy non-TS assets into `dist/`, so at runtime the compiled
+// state-db.js sits in `dist/lib/` while the migration sources sit in
+// `src/lib/migrations/gatekeeper/` (one level up + over). We prefer the
+// `dist`-relative location so a future build-time copy step (or a published
+// package that bundles SQL into dist) just works, and we fall back to the
+// `src`-relative location when running from a checkout where dist doesn't
+// have its own copy. The fallback walks up looking for the first ancestor
+// that contains a `package.json` and reaches into its `src/lib/migrations/...`
+// from there, mirroring how serverd's pure-JS foundation finds the same path
+// via `__dirname`.
+const GATEKEEPER_MIGRATIONS_DIR = resolveMigrationsDir();
+function resolveMigrationsDir() {
+    const distRelative = path.join(__dirname, 'migrations', 'gatekeeper');
+    if (existsSync(distRelative))
+        return distRelative;
+    // Walk up from __dirname looking for the package root (the directory whose
+    // parent contains `package.json`). This handles the dev/test path where
+    // `tsc` emitted to `dist/` but did not copy the SQL files alongside.
+    let cursor = __dirname;
+    for (let i = 0; i < 6; i += 1) {
+        const candidatePkg = path.join(cursor, 'package.json');
+        if (existsSync(candidatePkg)) {
+            const srcCandidate = path.join(cursor, 'src', 'lib', 'migrations', 'gatekeeper');
+            if (existsSync(srcCandidate))
+                return srcCandidate;
+            break;
+        }
+        const parent = path.dirname(cursor);
+        if (parent === cursor)
+            break;
+        cursor = parent;
+    }
+    return distRelative; // fall through; ensureMigrations will ENOENT-shortcut
+}
+const MIGRATION_FILENAME_RE = /^\d{4}_[a-z0-9_]+\.sql$/;
+let dbPromise = null;
+/**
+ * Returns the singleton `gatekeeper.db` handle for lamaste-gatekeeper.
+ * Lazy-opens on first call; subsequent calls return the cached handle. Safe to
+ * call concurrently from multiple modules at startup — the open is wrapped in
+ * a promise singleton so only one open ever races.
+ */
+export async function getGatekeeperDb() {
+    if (!dbPromise) {
+        const dataDir = process.env[DATA_DIR_ENV] ?? DEFAULT_DATA_DIR;
+        dbPromise = openManagedDb({
+            path: path.join(dataDir, GATEKEEPER_DB_FILENAME),
+            migrationsDir: GATEKEEPER_MIGRATIONS_DIR,
+        });
+    }
+    return dbPromise;
+}
+/**
+ * Apply every pending migration in `migrationsDir` against `db`. Idempotent —
+ * the second call is a no-op once `schema_migrations` has caught up. Each
+ * migration runs inside `BEGIN IMMEDIATE` … `COMMIT`; a failure rolls the
+ * statement back and rethrows with the migration filename in the message.
+ */
+export async function ensureMigrations(db, migrationsDir) {
+    db.exec(`CREATE TABLE IF NOT EXISTS schema_migrations (
+    id         INTEGER PRIMARY KEY,
+    name       TEXT NOT NULL UNIQUE,
+    applied_at TEXT NOT NULL
+  )`);
+    const applied = new Set(db
+        .prepare('SELECT name FROM schema_migrations')
+        .all()
+        .map((r) => r.name));
+    let entries;
+    try {
+        entries = await readdir(migrationsDir);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return;
+        throw err;
+    }
+    const files = entries.filter((f) => MIGRATION_FILENAME_RE.test(f)).sort();
+    for (const file of files) {
+        if (applied.has(file))
+            continue;
+        const sql = await readFile(path.join(migrationsDir, file), 'utf-8');
+        const id = Number(file.slice(0, 4));
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            db.exec(sql);
+            db.prepare('INSERT INTO schema_migrations (id, name, applied_at) VALUES (?, ?, ?)').run(id, file, new Date().toISOString());
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            db.exec('ROLLBACK');
+            throw new Error(`Migration ${file} failed: ${err.message}`);
+        }
+    }
+}
+/**
+ * Open `path`, apply PRAGMAs, tighten file modes, and run any pending
+ * migrations from `migrationsDir`. Single source of truth for DB lifecycle —
+ * `getGatekeeperDb()` is a thin wrapper that supplies gatekeeper's
+ * path/migrations.
+ *
+ * `node:sqlite` is dynamically imported so `boot.ts`'s `process.on('warning')`
+ * filter (installed during user-code evaluation) catches the
+ * ExperimentalWarning. A static import would emit it during ESM link.
+ */
+async function openManagedDb({ path: dbPath, migrationsDir, }) {
+    const { DatabaseSync } = await import('node:sqlite');
+    const db = new DatabaseSync(dbPath);
+    // PRAGMA order matters: journal_mode must be set before any write that
+    // would lock the rollback journal. cache_size = -2048 caps the page cache
+    // at 2 MiB (negative = KiB). synchronous = NORMAL is safe with WAL and
+    // skips the per-commit fsync.
+    db.exec(`
+    PRAGMA journal_mode = WAL;
+    PRAGMA synchronous = NORMAL;
+    PRAGMA foreign_keys = ON;
+    PRAGMA cache_size = -2048;
+    PRAGMA temp_store = MEMORY;
+    PRAGMA busy_timeout = 5000;
+  `);
+    // 0o600 on the DB plus its WAL/SHM sidecars (which appear lazily on first
+    // write — guard with existsSync). Best-effort: a failure here is logged by
+    // the caller's surrounding context, not fatal.
+    try {
+        await chmod(dbPath, 0o600);
+        if (existsSync(`${dbPath}-wal`))
+            await chmod(`${dbPath}-wal`, 0o600);
+        if (existsSync(`${dbPath}-shm`))
+            await chmod(`${dbPath}-shm`, 0o600);
+    }
+    catch {
+        // best-effort
+    }
+    await ensureMigrations(db, migrationsDir);
+    return db;
+}
+//# sourceMappingURL=state-db.js.map

package/vendor/gatekeeper/dist/lib/state-db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-db.js","sourceRoot":"","sources":["../../src/lib/state-db.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,8DAA8D;AAC9D,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,2CAA2C;AAE3C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAE/C,0EAA0E;AAC1E,6EAA6E;AAC7E,qEAAqE;AACrE,wEAAwE;AACxE,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,mBAAmB;AACnB,MAAM,yBAAyB,GAAG,oBAAoB,EAAE,CAAC;AAEzD,SAAS,oBAAoB;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAElD,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,MAAM,GAAG,SAAS,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,UAAU,CAAC,YAAY,CAAC;gBAAE,OAAO,YAAY,CAAC;YAClD,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,MAAM;YAAE,MAAM;QAC7B,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,sDAAsD;AAC7E,CAAC;AAED,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAExD,IAAI,SAAS,GAAiC,IAAI,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,gBAAgB,CAAC;QAC9D,SAAS,GAAG,aAAa,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC;YAChD,aAAa,EAAE,yBAAyB;SACzC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAgB,EAAE,aAAqB;IAC5E,EAAE,CAAC,IAAI,CAAC;;;;IAIN,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,EAAE;SACC,OAAO,CAAC,oCAAoC,CAAC;SAC7C,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAsB,CAAC,IAAI,CAAC,CAC5C,CAAC;IAEF,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEpC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,EAAE,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC,GAAG,CACrF,EAAE,EACF,IAAI,EACJ,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CACzB,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,YAAa,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAAC,EAC3B,IAAI,EAAE,MAAM,EACZ,aAAa,GAId;IACC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAEpC,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,8BAA8B;IAC9B,EAAE,CAAC,IAAI,CAAC;;;;;;;GAOP,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3B,IAAI,UAAU,CAAC,GAAG,MAAM,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,GAAG,MAAM,MAAM,EAAE,KAAK,CAAC,CAAC;QACrE,IAAI,UAAU,CAAC,GAAG,MAAM,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,GAAG,MAAM,MAAM,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,MAAM,gBAAgB,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAE1C,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/vendor/gatekeeper/dist/lib/templates.d.ts

@@ -0,0 +1,21 @@
+import type { AccessRequestTemplates, TemplateOptions } from './types.js';
+/**
+ * Generate pre-filled message templates for requesting access to a resource.
+ *
+ * @param username - The authenticated user's username
+ * @param resourceName - Human-readable resource name (e.g., FQDN or plugin name)
+ * @param options - Optional admin contact info and domain
+ * @returns Templates for email, Slack, Teams, WhatsApp, and generic
+ */
+export declare function getAccessRequestTemplates(username: string, resourceName: string, options?: TemplateOptions): AccessRequestTemplates;
+/**
+ * Build an HTML page for the access-request denial page.
+ * Server-rendered with inline CSS, no external dependencies.
+ *
+ * @param username - The authenticated user's username
+ * @param resourceFqdn - The tunnel FQDN the user tried to access
+ * @param options - Optional admin contact info
+ * @returns Full HTML page string
+ */
+export declare function buildAccessRequestPage(username: string, resourceFqdn: string, options?: TemplateOptions): string;
+//# sourceMappingURL=templates.d.ts.map

package/vendor/gatekeeper/dist/lib/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/lib/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,sBAAsB,CAmBxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,MAAM,CAmGR"}