@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/lib/chisel-reconcile.js

@@ -0,0 +1,232 @@
+/**
+ * Startup reconciliation of the chisel server — fail closed.
+ *
+ * Every time the panel starts it brings chisel in line with persisted state:
+ *
+ * 1. Every active agent has a chisel credential (fresh install, or agents
+ *    enrolled while credential minting failed).
+ * 2. Tunnels persisted before tunnels had owners are bound where the owner is
+ *    certain (see `bindUnownedTunnels`); the rest stay unowned and dark.
+ * 3. Once onboarding has completed: the server key exists and the authfile
+ *    is rewritten from state with its ownership and mode re-applied.
+ * 4. Chisel is restarted when a revocation requires it, and started if it is
+ *    enabled but not running.
+ *
+ * The binary (the pinned release) and the unit are create-lamaste's, which
+ * installs them as root and restarts chisel when either changes. The panel
+ * only checks the installed version: an older chisel does not reload its
+ * authfile reliably, so until the pinned release runs, chisel-runtime.js
+ * restarts it on every authfile change.
+ *
+ * Fail closed: if steps 1–3 cannot establish a correct authfile, chisel is
+ * stopped AND disabled, and a marker file records why. An authfile left by
+ * an older version may grant every agent every port (`.*`) — keeping that
+ * live because reconciliation failed would silently re-open what this
+ * version closes, and a disabled unit keeps a reboot from starting it before
+ * the panel has reconciled. Reconciliation is retried with backoff until it
+ * succeeds; then chisel is enabled and started again and the marker removed.
+ */
+
+import { execa } from 'execa';
+import { rm, writeFile, access } from 'node:fs/promises';
+import path from 'node:path';
+import { AGENT_LABEL_REGEX, CHISEL_RELEASE } from '@lamalibre/lamaste';
+import { bindUnownedTunnels, withTunnelLock, withheldTunnels } from '@lamalibre/lamaste/server';
+import { readTunnels, writeTunnels } from './state.js';
+import { loadAgentRegistry } from './mtls.js';
+import { migrateChiselCredentialsIfNeeded, syncChiselAuthfile } from './chisel-users.js';
+import {
+  ensureChiselKey,
+  getInstalledChiselVersion,
+  isChiselRunning,
+  reloadChisel,
+  startChisel,
+  stopChisel,
+} from './chisel.js';
+import { setChiselRunningPinnedRelease } from './chisel-runtime.js';
+import { getConfig } from './config.js';
+
+/** Chisel is the panel's to run once onboarding has completed. */
+function isOnboarded() {
+  return getConfig().onboarding?.status === 'COMPLETED';
+}
+
+/** Present while chisel is held down by a failed reconciliation. */
+function failClosedMarker() {
+  const stateDir = process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
+  return path.join(stateDir, 'chisel-failed-closed');
+}
+
+async function isFailClosed() {
+  try {
+    await access(failClosedMarker());
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const RETRY_MIN_MS = 30_000;
+const RETRY_MAX_MS = 10 * 60_000;
+
+async function isChiselEnabled() {
+  try {
+    const { stdout } = await execa('systemctl', ['is-enabled', 'chisel']);
+    return stdout.trim() === 'enabled';
+  } catch {
+    return false;
+  }
+}
+
+async function bindOwnership(logger) {
+  await withTunnelLock(async () => {
+    const tunnels = await readTunnels();
+    const registry = await loadAgentRegistry();
+    // Machine agents only: plugin-agent certificates carry no tunnels, and
+    // counting them would make "the sole agent" ambiguous.
+    const activeLabels = registry.agents
+      .filter((a) => !a.revoked && AGENT_LABEL_REGEX.test(a.label))
+      .map((a) => a.label);
+
+    const { tunnels: next, bound, unowned } = bindUnownedTunnels(tunnels, activeLabels);
+    if (bound.length > 0) {
+      await writeTunnels(next);
+      logger.info({ bound }, 'Bound ownerless tunnels to the agent that carries them');
+    }
+    const withheld = withheldTunnels(bound.length > 0 ? next : tunnels);
+    if (withheld.length > 0) {
+      logger.warn(
+        { subdomains: withheld.map((t) => t.subdomain) },
+        'Tunnels on a reserved port or a port another tunnel also claims are carried by no ' +
+          'agent — delete them and recreate each on a free port',
+      );
+    }
+    if (unowned.length > 0) {
+      logger.warn(
+        { subdomains: unowned, activeAgents: activeLabels.length },
+        'Tunnels without an owning agent are carried by no agent until an administrator ' +
+          'assigns one (PATCH /api/tunnels/:id with agentLabel)',
+      );
+    }
+  });
+}
+
+/**
+ * One reconciliation pass.
+ * @returns {Promise<{ provisioned: boolean, binaryPinned: boolean }>}
+ */
+export async function reconcileChiselServer(logger) {
+  const provisioned = isOnboarded();
+  let migrateRevoked = false;
+  let revoked;
+  try {
+    // Its authfile write can already be the one that withdraws something
+    // (state persisted before a crash, but never synced) — keep that for the
+    // restart decision below.
+    ({ revoked: migrateRevoked } = await migrateChiselCredentialsIfNeeded(
+      loadAgentRegistry,
+      logger,
+    ));
+    await bindOwnership(logger);
+    if (!provisioned) {
+      // Onboarding has not started chisel yet; keep the authfile correct
+      // for when it does.
+      await syncChiselAuthfile({ force: true });
+      return { provisioned: false, binaryPinned: false };
+    }
+    await ensureChiselKey();
+    ({ revoked } = await syncChiselAuthfile({ force: true }));
+  } catch (err) {
+    await failClosed(logger, provisioned);
+    throw err;
+  }
+  revoked = revoked || migrateRevoked;
+
+  const installed = await getInstalledChiselVersion();
+  const binaryPinned = installed === CHISEL_RELEASE.version;
+  if (!binaryPinned) {
+    logger.error(
+      { installed, pinned: CHISEL_RELEASE.version },
+      'The installed chisel is not the pinned release — run create-lamaste on the server to ' +
+        'install it. Until then chisel is restarted on every authfile change.',
+    );
+  }
+
+  if (await isFailClosed()) {
+    await execa('sudo', ['systemctl', 'enable', 'chisel']);
+    await startChisel();
+    await rm(failClosedMarker(), { force: true });
+    logger.info({}, 'Chisel re-enabled and started: reconciliation succeeded');
+  } else if (await isChiselRunning()) {
+    if (revoked) {
+      await reloadChisel();
+      logger.info({}, 'Chisel restarted after reconciliation withdrew access');
+    }
+  } else if (await isChiselEnabled()) {
+    await startChisel();
+    logger.info({}, 'Chisel started after reconciliation');
+  }
+  setChiselRunningPinnedRelease(binaryPinned);
+  return { provisioned: true, binaryPinned };
+}
+
+async function failClosed(logger, provisioned) {
+  setChiselRunningPinnedRelease(false);
+  if (!provisioned) return;
+  // Stopping comes first and does not depend on the other two steps.
+  try {
+    await stopChisel();
+  } catch (stopErr) {
+    logger.fatal(
+      { err: stopErr },
+      'Chisel could not be reconciled and could not be stopped — check chisel-users by hand',
+    );
+    return;
+  }
+  try {
+    await writeFile(failClosedMarker(), `${new Date().toISOString()}\n`, { mode: 0o600 });
+    await execa('sudo', ['systemctl', 'disable', 'chisel']);
+  } catch (err) {
+    logger.error(
+      { err },
+      'Chisel is stopped but could not be disabled; a reboot would start it before the panel ' +
+        'reconciles',
+    );
+  }
+  logger.error(
+    {},
+    'Chisel stopped: its authfile could not be brought in line with the tunnel ' +
+      'state, and an authfile from an older version may grant more than it should. ' +
+      'Tunnels stay down until reconciliation succeeds; it is retried automatically.',
+  );
+}
+
+/**
+ * Run reconciliation in the background now and, on failure, again with
+ * exponential backoff until it succeeds. Never throws and never blocks
+ * startup: the panel must stay reachable meanwhile — it is how an
+ * administrator fixes whatever made reconciliation fail.
+ */
+export function startChiselReconciler(logger) {
+  let delay = RETRY_MIN_MS;
+  const attempt = async () => {
+    try {
+      await reconcileChiselServer(logger);
+      return true;
+    } catch (err) {
+      logger.error({ err }, 'Chisel reconciliation failed');
+      return false;
+    }
+  };
+  const schedule = () => {
+    const timer = setTimeout(async () => {
+      if (await attempt()) return;
+      delay = Math.min(delay * 2, RETRY_MAX_MS);
+      schedule();
+    }, delay);
+    timer.unref();
+  };
+  void attempt().then((ok) => {
+    if (!ok) schedule();
+  });
+}

package/vendor/serverd/src/lib/chisel-runtime.js

@@ -0,0 +1,46 @@
+/**
+ * When an authfile change must restart chisel.
+ *
+ * Chisel >= 1.12.0 reloads its authfile on every atomic replace, and the
+ * reload applies to new sessions: a new agent, a new password or a new port
+ * grant takes effect without a restart. What a live session already holds —
+ * its authenticated user and the reverse listeners it bound — survives a
+ * reload, so a change that *revokes* something (a removed or rotated
+ * password, a withdrawn port) needs a restart to take effect.
+ *
+ * An older chisel does not reload reliably across atomic renames, so until
+ * this process has seen chisel running the pinned release, every change
+ * restarts it. Startup reconciliation and onboarding set that flag after they
+ * (re)start chisel on the pinned binary.
+ */
+
+import { execa } from 'execa';
+import { reloadChiselAuth } from '@lamalibre/lamaste/server';
+
+let runningPinnedRelease = false;
+
+/** Record whether the chisel process now running is the pinned release. */
+export function setChiselRunningPinnedRelease(value) {
+  runningPinnedRelease = value === true;
+}
+
+/** True when an additive authfile change takes effect without a restart. */
+export function chiselReloadsAuthfile() {
+  return runningPinnedRelease;
+}
+
+/**
+ * Restart chisel if the change requires it. `try-restart` leaves a stopped
+ * chisel stopped (see chisel-reconcile.js: a server that failed to reconcile
+ * keeps chisel down until it succeeds).
+ *
+ * @param {{ changed: boolean, revoked: boolean }} change
+ * @param {import('pino').Logger} [logger]
+ * @returns {Promise<{ restartOk: boolean, restartError?: string }>}
+ */
+export async function applyAuthfileChange(change, logger) {
+  const needsRestart = change.revoked || (change.changed && !runningPinnedRelease);
+  if (!needsRestart) return { restartOk: true };
+  const result = await reloadChiselAuth(execa, logger);
+  return result.ok ? { restartOk: true } : { restartOk: false, restartError: result.error };
+}

package/vendor/serverd/src/lib/chisel-users.js

@@ -0,0 +1,109 @@
+/**
+ * Shim — chisel authfile credential management lives in
+ * `@lamalibre/lamaste/server`. This file resolves the chisel credential /
+ * authfile paths from env, wires the daemon's execa instance and the
+ * persisted tunnel state (the source of per-agent port grants) to the
+ * parameterized core API, and applies the restart policy of
+ * chisel-runtime.js to every change.
+ */
+
+import path from 'node:path';
+import { execa } from 'execa';
+import {
+  addChiselCredential as addChiselCredentialCore,
+  removeChiselCredential as removeChiselCredentialCore,
+  rotateChiselCredential as rotateChiselCredentialCore,
+  getChiselCredential as getChiselCredentialCore,
+  getChiselCredentialIssuedAt as getChiselCredentialIssuedAtCore,
+  migrateChiselCredentialsIfNeeded as migrateChiselCredentialsIfNeededCore,
+  loadChiselCredentials as loadChiselCredentialsCore,
+  syncChiselAuthfile as syncChiselAuthfileCore,
+} from '@lamalibre/lamaste/server';
+import { readTunnels } from './state.js';
+import { applyAuthfileChange } from './chisel-runtime.js';
+
+function paths() {
+  const stateDir = process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
+  return {
+    credentialsFile: path.join(stateDir, 'chisel-credentials.json'),
+    authFilePath:
+      process.env.LAMALIBRE_LAMASTE_CHISEL_AUTHFILE || path.join(stateDir, 'chisel-users'),
+    sentinelFile: path.join(stateDir, 'chisel-sentinel'),
+  };
+}
+
+export function loadChiselCredentials() {
+  return loadChiselCredentialsCore(paths());
+}
+
+/**
+ * Mint a credential for a new agent. Hot-reloaded by chisel; no restart.
+ * @returns {Promise<{ user: string, password: string, createdAt: string, restartOk: boolean, restartError?: string }>}
+ */
+export async function addChiselCredential(label, logger) {
+  const result = await addChiselCredentialCore(label, paths(), readTunnels, execa);
+  const restart = await applyAuthfileChange(result, logger);
+  return { user: result.user, password: result.password, createdAt: result.createdAt, ...restart };
+}
+
+/**
+ * Remove an agent's credential. Restarts chisel so a live session using it ends.
+ * @returns {Promise<{ removed: boolean, restartOk: boolean, restartError?: string }>}
+ */
+export async function removeChiselCredential(label, logger) {
+  const result = await removeChiselCredentialCore(label, paths(), readTunnels, execa);
+  const restart = await applyAuthfileChange(result, logger);
+  return { removed: result.removed, ...restart };
+}
+
+/**
+ * Replace an agent's credential. Restarts chisel so the old password stops working.
+ * @returns {Promise<{ user: string, password: string, createdAt: string, restartOk: boolean, restartError?: string }>}
+ */
+export async function rotateChiselCredential(label, logger) {
+  const result = await rotateChiselCredentialCore(label, paths(), readTunnels, execa);
+  const restart = await applyAuthfileChange(result, logger);
+  return { user: result.user, password: result.password, createdAt: result.createdAt, ...restart };
+}
+
+export function getChiselCredential(label) {
+  return getChiselCredentialCore(label, paths());
+}
+
+/** When the agent's current chisel password was issued (not secret), or null. */
+export function getChiselCredentialIssuedAt(label) {
+  return getChiselCredentialIssuedAtCore(label, paths());
+}
+
+/**
+ * Mint credentials for active agents that lack one and re-render the
+ * authfile. Does not restart chisel — the caller (onboarding, startup
+ * reconciliation) owns the chisel lifecycle at that point.
+ */
+export function migrateChiselCredentialsIfNeeded(loadAgentRegistry, logger) {
+  return migrateChiselCredentialsIfNeededCore(
+    loadAgentRegistry,
+    paths(),
+    readTunnels,
+    execa,
+    logger,
+  );
+}
+
+/**
+ * Re-render the authfile from the credential store and tunnel state.
+ * `force` rewrites unchanged content too, re-applying ownership and mode.
+ * @param {{ force?: boolean }} [options]
+ * @returns {Promise<{ changed: boolean, revoked: boolean }>}
+ */
+export function syncChiselAuthfile(options = {}) {
+  return syncChiselAuthfileCore(paths(), readTunnels, execa, options);
+}
+
+export function getAuthfilePath() {
+  return paths().authFilePath;
+}
+
+export function getCredentialsPath() {
+  return paths().credentialsFile;
+}

package/vendor/serverd/src/lib/chisel.js

@@ -0,0 +1,81 @@
+/**
+ * Shim — chisel service lifecycle lives in `@lamalibre/lamaste/server`.
+ * This file wires the daemon's execa instance and resolved authfile path
+ * to the parameterized core API.
+ *
+ * The binary and the unit are create-lamaste's (installed as root); the
+ * panel manages the key, the authfile and the service state.
+ */
+
+import { execa } from 'execa';
+import { access } from 'node:fs/promises';
+import { CHISEL_BIN } from '@lamalibre/lamaste/server';
+import {
+  getInstalledChiselVersion as getInstalledChiselVersionCore,
+  ensureChiselKey as ensureChiselKeyCore,
+  startChisel as startChiselCore,
+  reloadChisel as reloadChiselCore,
+  stopChisel as stopChiselCore,
+  isChiselRunning as isChiselRunningCore,
+  getChiselStatus as getChiselStatusCore,
+} from '@lamalibre/lamaste/server';
+import { syncChiselAuthfile } from './chisel-users.js';
+import { applyAuthfileChange } from './chisel-runtime.js';
+
+function keyFilePath() {
+  return process.env.LAMALIBRE_LAMASTE_CHISEL_KEYFILE || '/etc/lamalibre/lamaste/chisel-server.key';
+}
+
+/** True once create-lamaste has installed the chisel binary. */
+export async function isChiselInstalled() {
+  try {
+    await access(CHISEL_BIN);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function getInstalledChiselVersion() {
+  return getInstalledChiselVersionCore(execa);
+}
+
+export function ensureChiselKey() {
+  return ensureChiselKeyCore(keyFilePath(), execa);
+}
+
+export function startChisel() {
+  return startChiselCore(execa);
+}
+
+export function reloadChisel() {
+  return reloadChiselCore(execa);
+}
+
+export function stopChisel() {
+  return stopChiselCore(execa);
+}
+
+export function isChiselRunning() {
+  return isChiselRunningCore(execa);
+}
+
+export function getChiselStatus() {
+  return getChiselStatusCore(execa);
+}
+
+/**
+ * Bring chisel in line with the persisted tunnel state: re-render the
+ * authfile (each agent may bind only the ports of the enabled tunnels it
+ * owns). Chisel reloads the file by itself; when the new file withdraws a
+ * grant, chisel is restarted so live sessions drop the binding. Call only
+ * after the tunnel state has been written. Throws if the restart fails,
+ * since a withdrawn grant would otherwise stay live.
+ */
+export async function syncChisel() {
+  const change = await syncChiselAuthfile();
+  const { restartOk, restartError } = await applyAuthfileChange(change);
+  if (!restartOk) {
+    throw new Error(`Chisel restart failed after withdrawing a port grant: ${restartError}`);
+  }
+}

package/vendor/serverd/src/lib/config.js

@@ -0,0 +1,190 @@
+import crypto from 'node:crypto';
+import { readFile, writeFile, rename, open } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { z } from 'zod';
+
+const ConfigSchema = z.object({
+  ip: z.string().min(1),
+  domain: z.string().nullable(),
+  email: z.string().email().nullable(),
+  dataDir: z.string().min(1),
+  serverId: z.string().uuid().optional(),
+  staticDir: z.string().optional(),
+  maxSiteSize: z
+    .number()
+    .optional()
+    .default(500 * 1024 * 1024),
+  adminAuthMode: z.enum(['p12', 'hardware-bound']).optional().default('p12'),
+  panel2fa: z
+    .object({
+      enabled: z.boolean(),
+      secret: z.string().nullable(),
+      setupComplete: z.boolean(),
+    })
+    .optional()
+    .default({ enabled: false, secret: null, setupComplete: false }),
+  sessionSecret: z.string().nullable().optional().default(null),
+  // Per-user invalidation epochs (Unix seconds). When a user is deleted from
+  // Authelia, their epoch is bumped so any in-flight user-access session token
+  // issued before that timestamp is rejected by the session middleware. The
+  // entry is preserved (never deleted) so that re-creating the same username
+  // does not resurrect old sessions.
+  userEpochs: z.record(z.string(), z.number().int().nonnegative()).optional().default({}),
+  onboarding: z.object({
+    status: z.enum(['FRESH', 'DOMAIN_SET', 'DNS_READY', 'PROVISIONING', 'COMPLETED']),
+  }),
+});
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const packageRoot = path.resolve(__dirname, '..', '..');
+
+let config = null;
+let configPath = null;
+
+/**
+ * Promise-chain mutex serializing all panel.json writes so concurrent
+ * updateConfig() calls cannot race (e.g. two simultaneous user deletes both
+ * bumping userEpochs).
+ */
+let configWriteLock = Promise.resolve();
+function withConfigLock(fn) {
+  const prev = configWriteLock;
+  let resolve;
+  configWriteLock = new Promise((r) => {
+    resolve = r;
+  });
+  return prev.then(fn).finally(resolve);
+}
+
+function resolveConfigPath() {
+  if (process.env.LAMALIBRE_LAMASTE_CONFIG) {
+    return process.env.LAMALIBRE_LAMASTE_CONFIG;
+  }
+
+  const isDev = !process.env.NODE_ENV || process.env.NODE_ENV === 'development';
+
+  if (isDev) {
+    return path.resolve(packageRoot, 'dev', 'panel.json');
+  }
+
+  return '/etc/lamalibre/lamaste/panel.json';
+}
+
+export async function loadConfig() {
+  configPath = resolveConfigPath();
+
+  let raw;
+  try {
+    raw = await readFile(configPath, 'utf-8');
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      throw new Error(`Config file not found at ${configPath}. Run create-lamaste to initialize.`);
+    }
+    throw new Error(`Failed to read config file at ${configPath}: ${err.message}`);
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`Config file at ${configPath} contains invalid JSON.`);
+  }
+
+  const validated = ConfigSchema.parse(parsed);
+
+  // Auto-generate serverId if missing — used as bucket prefix for multi-server isolation
+  if (!validated.serverId) {
+    validated.serverId = crypto.randomUUID();
+    const tmpPath = `${configPath}.tmp`;
+    await writeFile(tmpPath, JSON.stringify(validated, null, 2) + '\n', {
+      encoding: 'utf-8',
+      mode: 0o600,
+    });
+    const fd = await open(tmpPath, 'r');
+    await fd.sync();
+    await fd.close();
+    await rename(tmpPath, configPath);
+  }
+
+  config = validated;
+  return structuredClone(config);
+}
+
+export function getConfig() {
+  if (config === null) {
+    throw new Error('Config not loaded. Call loadConfig() first.');
+  }
+  return structuredClone(config);
+}
+
+export function updateConfig(patch) {
+  if (config === null) {
+    throw new Error('Config not loaded. Call loadConfig() first.');
+  }
+
+  return withConfigLock(async () => {
+    const merged = structuredClone(config);
+
+    for (const key of Object.keys(patch)) {
+      if (
+        key === 'onboarding' &&
+        typeof patch.onboarding === 'object' &&
+        patch.onboarding !== null
+      ) {
+        merged.onboarding = { ...merged.onboarding, ...patch.onboarding };
+      } else if (
+        key === 'panel2fa' &&
+        typeof patch.panel2fa === 'object' &&
+        patch.panel2fa !== null
+      ) {
+        merged.panel2fa = { ...merged.panel2fa, ...patch.panel2fa };
+      } else if (
+        key === 'userEpochs' &&
+        typeof patch.userEpochs === 'object' &&
+        patch.userEpochs !== null
+      ) {
+        merged.userEpochs = { ...(merged.userEpochs ?? {}), ...patch.userEpochs };
+      } else {
+        merged[key] = patch[key];
+      }
+    }
+
+    const validated = ConfigSchema.parse(merged);
+
+    const tmpPath = `${configPath}.tmp`;
+    await writeFile(tmpPath, JSON.stringify(validated, null, 2) + '\n', {
+      encoding: 'utf-8',
+      mode: 0o600,
+    });
+    const fd = await open(tmpPath, 'r');
+    await fd.sync();
+    await fd.close();
+    await rename(tmpPath, configPath);
+
+    config = validated;
+    return structuredClone(config);
+  });
+}
+
+/**
+ * Bump a user's session-invalidation epoch to "now" (Unix seconds). Any
+ * user-access session whose `iat` (issued-at) is older than this epoch
+ * is considered revoked by the session middleware.
+ *
+ * Idempotent: calling twice in quick succession is safe (the later
+ * timestamp simply replaces the earlier one).
+ *
+ * @param {string} username
+ * @returns {Promise<number>} The new epoch (Unix seconds)
+ */
+export async function bumpUserEpoch(username) {
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  await updateConfig({ userEpochs: { [username]: nowSeconds } });
+  return nowSeconds;
+}
+
+export function getConfigPath() {
+  return configPath ?? resolveConfigPath();
+}

package/vendor/serverd/src/lib/constants.js

@@ -0,0 +1,8 @@
+/**
+ * Re-export core constants from @lamalibre/lamaste.
+ *
+ * During the transition, existing imports within lamaste-serverd continue
+ * to resolve via this file. New code should import directly from the core
+ * library.
+ */
+export { RESERVED_API_PREFIXES } from '@lamalibre/lamaste';