@lamalibre/create-lamaste 4.4.0 → 4.5.0

package/vendor/docs/06-reference/installer-flags.md

@@ -1,11 +1,11 @@
 # Installer Flags
 
-> CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.4.0`.
+> CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.5.0`.
 
 ## Usage
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 [flags]
+npx @lamalibre/create-lamaste@4.5.0 [flags]
 ```
 
 The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-interactive by default — all configuration happens later through the browser-based onboarding wizard.
@@ -26,7 +26,7 @@ The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-
 Prints a description of what the installer does, lists all flags, and exits with code 0. Does not modify anything on the system.
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --help
+npx @lamalibre/create-lamaste@4.5.0 --help
 ```
 
 ### `--yes`, `-y`
@@ -34,7 +34,7 @@ npx @lamalibre/create-lamaste@4.4.0 --help
 Skips the interactive confirmation prompt that appears before installation begins. Useful for automated deployments or scripts where you cannot press Enter.
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --yes
+npx @lamalibre/create-lamaste@4.5.0 --yes
 ```
 
 Without this flag, the installer displays a banner listing all changes it will make and waits for the user to press Enter or Ctrl+C.
@@ -51,7 +51,7 @@ Skips all OS hardening tasks:
 Everything else (Node.js, nginx, mTLS, panel deployment) still runs.
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --skip-harden
+npx @lamalibre/create-lamaste@4.5.0 --skip-harden
 ```
 
 Use this if you manage your own firewall rules, already have fail2ban configured, or are running on a platform that handles security at a different layer.
@@ -61,7 +61,7 @@ Use this if you manage your own firewall rules, already have fail2ban configured
 Allows the installer to run on a machine with a private or non-routable IP address (e.g., `192.168.x.x`, `10.x.x.x`). By default, the installer requires a public IP.
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --dev
+npx @lamalibre/create-lamaste@4.5.0 --dev
 ```
 
 This is useful for:
@@ -76,7 +76,7 @@ When `--dev` is active, the installer prints the detected IP with a note: `(dev
 Forces the installer to run the complete installation pipeline, ignoring skip guards that would normally detect an existing installation. This is useful when an installation is in an inconsistent state and you want to ensure all components are fully deployed.
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --force-full
+npx @lamalibre/create-lamaste@4.5.0 --force-full
 ```
 
 Use this if:
@@ -90,7 +90,7 @@ Use this if:
 Prints a step-by-step guide for manually removing Lamaste from the server, then exits with code 0. Does not modify anything on the system.
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --uninstall
+npx @lamalibre/create-lamaste@4.5.0 --uninstall
 ```
 
 The printed guide first points to the automated removal, `sudo lamaste-server uninstall`, then covers:
@@ -207,25 +207,25 @@ Components that are always redeployed on re-run:
 
 ```bash
 ssh root@203.0.113.42
-npx @lamalibre/create-lamaste@4.4.0
+npx @lamalibre/create-lamaste@4.5.0
 ```
 
 **Automated install (no confirmation prompt):**
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --yes
+npx @lamalibre/create-lamaste@4.5.0 --yes
 ```
 
 **Install without OS hardening:**
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --yes --skip-harden
+npx @lamalibre/create-lamaste@4.5.0 --yes --skip-harden
 ```
 
 **Test in a local VM:**
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --dev
+npx @lamalibre/create-lamaste@4.5.0 --dev
 ```
 
 **Update an existing installation:**
@@ -237,7 +237,7 @@ npx @lamalibre/create-lamaste@latest --yes
 **View the uninstall guide:**
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --uninstall
+npx @lamalibre/create-lamaste@4.5.0 --uninstall
 ```
 
 ## Quick Reference

package/vendor/docs/06-reference/ports-and-services.md

@@ -34,7 +34,7 @@ A tunnel's port is also a loopback port on the relay: its vhost proxies to `127.
 | 9292 | IP-based panel listener |
 | 9294 | Gatekeeper              |
 
-A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.4.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
+A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.5.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
 
 ## Systemd Units
 
@@ -104,31 +104,30 @@ Per agent label, on the agent machine (user-level, no root):
 
 ### Configuration
 
-| Path                                                     | Description                                                                         |
-| -------------------------------------------------------- | ----------------------------------------------------------------------------------- |
-| `/etc/lamalibre/lamaste/panel.json`                      | Panel server configuration                                                          |
-| `/etc/lamalibre/lamaste/tunnels.json`                    | Tunnel definitions                                                                  |
-| `/etc/lamalibre/lamaste/sites.json`                      | Static site definitions                                                             |
-| `/etc/lamalibre/lamaste/chisel-credentials.json`         | Per-agent Chisel credentials                                                        |
-| `/etc/lamalibre/lamaste/chisel-users`                    | Chisel authfile: per-agent credentials + port grants (0640, group `lamaste-chisel`) |
-| `/etc/lamalibre/lamaste/chisel-sentinel`                 | Sentinel Chisel user password                                                       |
-| `/etc/lamalibre/lamaste/ticket-scopes.json`              | Ticket scope registry (scopes, instances, assignments)                              |
-| `/etc/lamalibre/lamaste/tickets.json`                    | Ticket and session store                                                            |
-| `/etc/lamalibre/lamaste/groups.json`                     | Lamaste group definitions and membership                                            |
-| `/etc/lamalibre/lamaste/access-grants.json`              | Generic access grants (principal → resource)                                        |
-| `/etc/lamalibre/lamaste/gatekeeper.json`                 | Gatekeeper settings (cache TTL, logging)                                            |
-| `/etc/lamalibre/lamaste/access-request-log.json`         | Optional denied access log                                                          |
-| `/etc/authelia/configuration.yml`                        | Authelia server configuration                                                       |
-| `/etc/authelia/users.yml`                                | Authelia user database                                                              |
-| `/etc/authelia/.secrets.json`                            | Authelia secrets (JWT, session, encryption)                                         |
-| `/etc/nginx/snippets/lamalibre-lamaste-mtls.conf`        | mTLS configuration snippet                                                          |
-| `/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf` | Gatekeeper proxy_cache zone definition                                              |
-| `/etc/sudoers.d/lamaste`                                 | Sudo rules for lamaste user (fixed command lines, no wildcards)                     |
-| `/usr/local/sbin/lamaste-priv`                           | Root-owned helper: panel vhosts (allow-listed), Authelia TOTP, self-update          |
-| `/usr/local/sbin/lamaste-certbot`                        | Root-owned certbot wrapper (validated, fixed argv)                                  |
-| `/usr/local/sbin/lamaste-cert-info`                      | Root-owned read-only Let's Encrypt certificate queries                              |
-| `/etc/fail2ban/jail.d/lamaste.conf`                      | fail2ban jail configuration                                                         |
-| `/etc/sysctl.d/99-lamaste.conf`                          | Kernel parameter (swappiness)                                                       |
+| Path                                                      | Description                                                                         |
+| --------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| `/etc/lamalibre/lamaste/panel.json`                       | Panel server configuration                                                          |
+| `/etc/lamalibre/lamaste/tunnels.json`                     | Tunnel definitions                                                                  |
+| `/etc/lamalibre/lamaste/sites.json`                       | Static site definitions                                                             |
+| `/etc/lamalibre/lamaste/chisel-credentials.json`          | Per-agent Chisel credentials                                                        |
+| `/etc/lamalibre/lamaste/chisel-users`                     | Chisel authfile: per-agent credentials + port grants (0640, group `lamaste-chisel`) |
+| `/etc/lamalibre/lamaste/chisel-sentinel`                  | Sentinel Chisel user password                                                       |
+| `/etc/lamalibre/lamaste/ticket-scopes.json`               | Ticket scope registry (scopes, instances, assignments)                              |
+| `/etc/lamalibre/lamaste/tickets.json`                     | Ticket and session store                                                            |
+| `/etc/lamalibre/lamaste/gatekeeper.db`                    | Gatekeeper (SQLite): groups, access grants, denied-access log                       |
+| `/etc/lamalibre/lamaste/gatekeeper.json`                  | Gatekeeper settings (cache TTL, logging)                                            |
+| `/etc/authelia/configuration.yml`                         | Authelia server configuration                                                       |
+| `/etc/authelia/users.yml`                                 | Authelia user database                                                              |
+| `/etc/authelia/.secrets.json`                             | Authelia secrets (JWT, session, encryption)                                         |
+| `/etc/nginx/snippets/lamalibre-lamaste-mtls.conf`         | mTLS configuration snippet                                                          |
+| `/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf`  | Gatekeeper proxy_cache zone definition                                              |
+| `/etc/nginx/conf.d/lamalibre-lamaste-backend-cookie.conf` | http-level map: the backends' `Cookie` without Authelia's session cookie            |
+| `/etc/sudoers.d/lamaste`                                  | Sudo rules for lamaste user (fixed command lines, no wildcards)                     |
+| `/usr/local/sbin/lamaste-priv`                            | Root-owned helper: panel vhosts (allow-listed), Authelia TOTP, self-update          |
+| `/usr/local/sbin/lamaste-certbot`                         | Root-owned certbot wrapper (validated, fixed argv)                                  |
+| `/usr/local/sbin/lamaste-cert-info`                       | Root-owned read-only Let's Encrypt certificate queries                              |
+| `/etc/fail2ban/jail.d/lamaste.conf`                       | fail2ban jail configuration                                                         |
+| `/etc/sysctl.d/99-lamaste.conf`                           | Kernel parameter (swappiness)                                                       |
 
 ### PKI Certificates
 

package/vendor/docs/06-reference/troubleshooting.md

@@ -217,7 +217,7 @@ The agent's sync timer applies tunnel changes within about 30 seconds. If that d
 lamaste-agent update     # apply now and (re)install the sync timer
 ```
 
-`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.4.0`); an agent originally set up with `npx` must be installed first.
+`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.5.0`); an agent originally set up with `npx` must be installed first.
 
 **Cause 3: The agent does not carry the tunnel.**
 
@@ -320,7 +320,7 @@ ls -la /usr/local/bin/authelia
 | Missing `panel.json`            | `Config file not found`                 | Re-run installer or create the file manually                                                                                   |
 | Invalid JSON in `panel.json`    | `contains invalid JSON`                 | Fix the JSON syntax                                                                                                            |
 | Port 3100 in use                | `EADDRINUSE`                            | Find and stop the conflicting process: `sudo ss -tlnp sport = :3100`                                                           |
-| Missing Node.js modules         | `Cannot find module`                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
+| Missing Node.js modules         | `Cannot find module`                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.5.0 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
 | Permission denied writing state | `EACCES` under `/etc/lamalibre/lamaste` | Re-run the installer; the redeploy re-applies the ownership of the config and PKI directories                                  |
 
 ### chisel fails to start
@@ -329,7 +329,7 @@ ls -la /usr/local/bin/authelia
 
 | Cause                      | Log Message                                                                           | Fix                                                                                                                                                                                                                               |
 | -------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Binary missing             | `exec format error` or `not found`                                                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries                                                 |
+| Binary missing             | `exec format error` or `not found`                                                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.5.0 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries                                                 |
 | Not the pinned release     | (panel log) `The installed chisel is not the pinned release — run create-lamaste ...` | Re-run the installer. Until then the panel restarts Chisel on every authfile change                                                                                                                                               |
 | Authfile or key unreadable | `permission denied` on `chisel-users` or `chisel-server.key`                          | Both must be `0640 lamaste:lamaste-chisel` and the unit `Group=lamaste-chisel`; restart the panel, which re-applies the authfile's. If the group, the unit or the key's ownership is wrong, re-run the installer in redeploy mode |
 | Stopped by the panel       | (panel log) `Chisel stopped: ...`; unit disabled, `chisel-failed-closed` present      | Reconciliation failed closed; see [Tunnel Client Cannot Connect](#tunnel-client-cannot-connect), Cause 1                                                                                                                          |
@@ -343,7 +343,7 @@ ls -la /usr/local/bin/authelia
 | --------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Invalid `configuration.yml` | `configuration: error`                  | Check YAML syntax with `authelia validate-configuration --config /etc/authelia/configuration.yml`                                                                                                                                                                                                                                                         |
 | Missing `users.yml`         | `cannot open file`                      | Create an initial users file (see [Config Files](config-files.md))                                                                                                                                                                                                                                                                                        |
-| Binary missing              | `not found`                             | Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`); it installs the pinned release                                                                                                                                                                                                                                                              |
+| Binary missing              | `not found`                             | Re-run the installer (`npx @lamalibre/create-lamaste@4.5.0 --yes`); it installs the pinned release                                                                                                                                                                                                                                                              |
 | Wrong permissions           | `permission denied`                     | Authelia runs as `lamaste-authelia`: `/etc/authelia` must be `lamaste:lamaste-authelia 2770`, `configuration.yml` `0640`, `users.yml` `0660`, `db.sqlite3` owned by `lamaste-authelia`. Re-run the installer to re-apply (a root-owned `/etc/authelia` from an older version is converted), or see [Config Files](config-files.md#file-permissions-table) |
 | Database newer than binary  | storage schema version error at startup | A newer Authelia ran against this database and was replaced by an older one; the installer never downgrades an installed Authelia, so reinstall that newer release by hand                                                                                                                                                                                |
 
@@ -516,14 +516,14 @@ sudo systemctl restart authelia
 
 ## Onboarding Fails: "Chisel is not installed" / "Authelia is not installed"
 
-**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.4.0` on the server to repair the installation." (or the same for Authelia).
+**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.5.0` on the server to repair the installation." (or the same for Authelia).
 
 **Cause:** Onboarding downloads nothing: the installer installs both binaries (pinned releases), their systemd units and the `lamaste-authelia` account. The binary at `/usr/local/bin/chisel` or `/usr/local/bin/authelia` is missing — the installer was interrupted, or the file was removed.
 
 **Fix:** Re-run the installer on the server, then start provisioning again from the wizard:
 
 ```bash
-npx @lamalibre/create-lamaste@4.4.0 --yes
+npx @lamalibre/create-lamaste@4.5.0 --yes
 ```
 
 If provisioning then fails writing Authelia's configuration with `/etc/authelia is not writable by the panel — run create-lamaste to repair the installation`, the directory's ownership is wrong; the same command repairs it.
@@ -538,7 +538,7 @@ If provisioning then fails writing Authelia's configuration with `/etc/authelia
 
 **Fix:**
 
-1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.4.0 --yes`
+1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.5.0 --yes`
 2. If it persists on a current install, it is a bug: the vhost generators (`packages/server/daemon/src/lib/nginx.js`) and the allow-list (`packages/provisioners/server/scripts/lamaste-priv`) must change together — `npm test` checks every generated vhost against the allow-list. Do not work around it by editing files in `/etc/nginx` by hand.
 
 `sudo: a password is required` for `lamaste-priv` means the helper or the sudoers file is missing or outdated: re-run the installer.
@@ -621,7 +621,7 @@ df -h /
 
 **Cause 3: The web root is not writable by the panel (`EACCES`).**
 
-The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.4.0 --yes`); the redeploy converts the tree.
+The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.5.0 --yes`); the redeploy converts the tree.
 
 ---
 

package/vendor/docs/gatekeeper-design.md

@@ -1,10 +1,12 @@
 # Lamaste Gatekeeper — Design Document
 
+> **Status (4.5):** implemented, with these departures from the design below. Groups, grants and the access-request log live in SQLite — `/etc/lamalibre/lamaste/gatekeeper.db` (0600, WAL, numbered migrations) — not in `groups.json`, `access-grants.json` and `access-request-log.json`, which are no longer read; every check reads the database, and only `tunnels.json` and `gatekeeper.json` are watched. The legacy `user-plugin-access.json` grants are **not** migrated (`migrateFromLegacy` exists but nothing calls it). Gatekeeper signs relay assertions with the relay signing key: for plugin tunnels (into lamaste-agentd, since 4.3) and, from 4.5, for the panel on a plugin's user surface (`/authz/user-surface/:fqdn`, the session's username alone). Plain `authenticated` and `restricted` app tunnels pass the user as unsigned `Remote-*` headers. Plugin grants with `context.roles` are agent-hosted plugins' entitlements; Gatekeeper's own API also removes a user principal everywhere (`POST /api/principals/user/remove`) and purges one user's access-log rows (`POST /api/access-log/purge`) — the username in the body, never in a URL. Current behaviour: [Authorization](01-concepts/authorization.md), [Gatekeeper API](04-api-reference/gatekeeper.md).
+
 ## Overview
 
-`@lamalibre/lamaste-gatekeeper@4.4.0` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
+`@lamalibre/lamaste-gatekeeper@4.5.0` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
 
-It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.4.0` — a solid library at the core, with a service, CLI, and desktop as consumers.
+It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.5.0` — a solid library at the core, with a service, CLI, and desktop as consumers.
 
 ---
 
@@ -204,7 +206,7 @@ The grant system is resource-agnostic. It doesn't know what a "tunnel" or "plugi
 
 ```js
 import { createGroup, listGroups, getGroup, updateGroup, deleteGroup,
-         addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.4.0';
+         addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.5.0';
 
 createGroup(name, { description?, createdBy? })
   // → { name, description, members: [], createdAt, createdBy }
@@ -240,7 +242,7 @@ getGroupsForUser(username)
 ### Grants
 
 ```js
-import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.4.0';
+import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.5.0';
 
 createGrant({ principalType, principalId, resourceType, resourceId, context? })
   // → grant object
@@ -267,7 +269,7 @@ revokeGrant(grantId)
 ### Authorization
 
 ```js
-import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.4.0';
+import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.5.0';
 
 checkAccess(username, resourceType, resourceId);
 // 1. Find direct user grants: principalType='user', principalId=username
@@ -282,7 +284,7 @@ checkAccess(username, resourceType, resourceId);
 ### Templates
 
 ```js
-import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.4.0';
+import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.5.0';
 
 getAccessRequestTemplates(username, resourceName, { adminContact?, domain? })
   // → {
@@ -864,14 +866,14 @@ On first startup, gatekeeper checks for legacy files:
 
 ### Panel-Server Refactoring
 
-- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.4.0`)
+- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.5.0`)
 - `lib/access-control-sync.js` → removed (gatekeeper handles authorization at nginx layer, no more Authelia config rewriting for per-user access rules)
 - `routes/user-access.js` → simplified, delegates grant CRUD to gatekeeper
 - Tunnel creation/update routes → call gatekeeper for access mode changes
 
 ### Installer Updates (create-lamaste)
 
-- Install `@lamalibre/lamaste-gatekeeper@4.4.0` package
+- Install `@lamalibre/lamaste-gatekeeper@4.5.0` package
 - Create `/etc/lamalibre/lamaste/groups.json` (empty initial state)
 - Create `/etc/lamalibre/lamaste/access-grants.json` (empty or migrated)
 - Create `lamalibre-lamaste-gatekeeper.service` systemd unit

package/vendor/docs/identity-directory-design.md

@@ -1,10 +1,33 @@
 # Lamaste Identity Directory — Design Document
 
-> **Status:** design, 2026-10-13. Nothing here is implemented yet.
-> **Package:** `@lamalibre/lamaste-identity@4.4.0` (completes the existing SDK).
+> **Status:** design, 2026-10-13. Partly implemented in Lamaste 4.5 for agent-hosted plugins — see [Status](#status-4-5-slice-6).
+> **Package:** `@lamalibre/lamaste-identity@4.5.0` (completes the existing SDK).
 > **Companions:** `gatekeeper-design.md` (authorization),
 > `plugin-development/design/agent-hosted-app-plugins.md` (app plugins).
 
+## Status (4.5, slice 6)
+
+Slice 6 of the agent-hosted app plugins (`plugin-development/design/agent-hosted-app-plugins.md`, _Slice 6 as planned_) implements the part of this design that agent-hosted plugins need. Reference: [Agent-Hosted Plugins — Users and identity](04-api-reference/agent-hosted-plugins.md#users-and-identity), [Users API](04-api-reference/users.md).
+
+**Implemented**, with where it departs from the design below:
+
+- **The directory** in the panel's `state.db` (migration `0013`): a `userId` (UUID v4) per user, `active` / `disabled` / `removed`, a store-wide `seq` stamped by triggers, a `directoryId`. `users.yml` is **not** derived: it stays Authelia's credential file (Authelia's own password reset rewrites it); every Lamaste write goes through one lock that reconciles the directory before Authelia restarts, and the panel reconciles the directory against the file at start, after onboarding and every minute — read only. A re-created username is a new user with a new `userId`.
+- **Disable** (Authelia's `disabled`, effective at once on the user surface), **delete** (a tombstone keeps the `userId` and the last known attributes), **erase** (the tombstone, invitations, Gatekeeper's access-request log rows and Authelia's second factors scrubbed; `remove/erased` written into every plugin's audience — inactive plugins' too, the audience being each plugin's erasure ledger until no agent keeps its data — and acknowledged by the projection's cursor; an erasure is sticky in the projection). One **offboarding** function, keyed by `userId`, runs for every disable and removal, through the API or adopted from `users.yml`: desktop sessions (an epoch keyed by `userId`), registry tokens, legacy plugin-access grants, Gatekeeper's principal and Authelia's second factors (on removal), Gatekeeper's cached sessions. A re-created username inherits no grant, group, role, second factor or session: Gatekeeper's principal and Authelia's second factors are cleared at every creation over a tombstone, a deleted user's username nobody holds takes no grant, and a username Authelia holds an OpenID Connect opaque identifier for is never given again (Authelia cannot delete one).
+- **The manifest `identity` block** (roles, `attributes` ⊆ `displayName`, `email`) for agent-hosted plugins with an agent half, inside the approval digest when present; an update that adds or removes a role or widens the attributes waits for an administrator (`identity.changed`) — auto-approve never covers it.
+- **Entitlements** are Gatekeeper plugin grants with `context.roles`, checked against the manifest; roleless grants never count. `user-plugin-access.json` is **not** migrated: it still gates the desktop's enrolment, not requests.
+- **The audience** per plugin, materialized and recomputed after every panel-side change, every minute and at start.
+- **The feed is pushed, not pulled.** An agent half cannot reach the panel, so the panel sends the data itself through the internal tunnel — `POST /admin/identity/notify`, then `/admin/identity/changes` batches, their changes sealed to the request (AES-256-GCM under a key derived from the installation secret) — with replay from 0 as the snapshot and a daily reconcile whose mismatches are audited. A plugin's users reach it only once its half has applied the feed up to the head. The subscriber is `createIdentityProjection` + `createIdentityHandlers` in `@lamalibre/lamaste@4.5.0/agent`, not an `IdentitySubscriber` in this SDK.
+- **Identity in requests, for agent-hosted plugins:** a tunnel bound as a plugin's user surface serves `/api/<route>/app/*`; Gatekeeper attests the session's username to the panel, and the panel forwards to the agent half with `{ type: "user", userId, username, roles }` in the HMAC caller assertion — not a JWT ([question 6](#open-questions)).
+
+**Not yet:**
+
+- **Renames.** A username cannot be changed; the user is deleted and created again under a new `userId`.
+- **Audience endpoints for server plugins and plain agents** (`GET /api/identity/audience…`, the in-process event, `seq` in the agent sync), and the `IdentitySubscriber` / `verifyIdentity` SDK pieces.
+- **Signed identity for plain tunnels.** An `authenticated` or `restricted` app tunnel still passes unsigned `Remote-*` headers; only plugin tunnels and plugin user surfaces carry a signed identity.
+- **Badges** as user credentials, **connectors** (GitLab), **CSV import** and the directory import API for external systems of record, projection age reporting.
+- **What Authelia keeps on its own** — the OpenID Connect opaque identifier of a username (no CLI deletes one) and its authentication log — is outside erasure, as are nginx's access logs, journald's older entries and earlier backups.
+- **Restore detection.** A relay restored from a backup keeps its `directoryId`; rotating it on restore, so every agent half replays against the restored directory, is future work. Until then an erasure made after the backup must be repeated on the restored relay (the agent halves that applied it keep it: erasure is sticky there).
+
 ## Goal
 
 Lamaste becomes the **directory** for every application in the ecosystem, the
@@ -28,15 +51,15 @@ copy to follow Lamaste.
 
 ## What exists today
 
-| Piece                                                    | State                                                                                                              |
-| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| User store                                               | Authelia's `users.yml`, keyed by **username**. No stable id.                                                       |
-| `GET /api/identity/users`, `/users/:username`, `/groups` | Read `users.yml`; admin or agent with `identity:query`.                                                            |
-| `GET /api/identity/self`                                 | Echoes `Remote-*` headers; only meaningful behind Authelia.                                                        |
-| SDK `IdentityClient`                                     | `listUsers`, `getUser`, `listGroups` over mTLS.                                                                    |
-| SDK `parseIdentity` + Fastify plugin                     | Parses `Remote-User/Name/Email/Groups` headers.                                                                    |
-| Tunnel vhosts                                            | **Blank** `Remote-User` and `Remote-Groups` before proxying — apps receive no identity.                            |
-| Entitlements                                             | Two models: per-plugin grants (`user-plugin-access.json`, by username) and Gatekeeper grants (groups → resources). |
+| Piece                                                    | State                                                                                                                  |
+| -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| User store                                               | Authelia's `users.yml`, keyed by **username**. No stable id.                                                           |
+| `GET /api/identity/users`, `/users/:username`, `/groups` | Read `users.yml`; admin or agent with `identity:query`.                                                                |
+| `GET /api/identity/self`                                 | Echoes `Remote-*` headers; only meaningful behind Authelia.                                                            |
+| SDK `IdentityClient`                                     | `listUsers`, `getUser`, `listGroups` over mTLS.                                                                        |
+| SDK `parseIdentity` + Fastify plugin                     | Parses `Remote-User/Name/Email/Groups` headers.                                                                        |
+| Tunnel vhosts                                            | Set `Remote-*` from Gatekeeper's answer (replacing the client's) — **unsigned**; plugin tunnels add a relay assertion. |
+| Entitlements                                             | Two models: per-plugin grants (`user-plugin-access.json`, by username) and Gatekeeper grants (groups → resources).     |
 
 So the SDK can list users, but nothing gives an application a stable key, a
 scoped user list, a change feed, or a trustworthy identity on a request.
@@ -178,7 +201,7 @@ and compares it with the local projection (by `userId` and `version`). It
 applies differences and logs how many it found — a non-zero count on a
 healthy system is a bug in the change feed and is reported to the panel.
 
-## SDK (`@lamalibre/lamaste-identity@4.4.0`)
+## SDK (`@lamalibre/lamaste-identity@4.5.0`)
 
 Today's surface stays; three pieces are added.
 
@@ -434,11 +457,22 @@ directory and one out of it.
 2. **PDKS's source of truth:** samplepark pushes into Lamaste, or Lamaste
    mirrors samplepark?
 3. **Erasure:** which plugins hold data that must be anonymised on request,
-   and is a single `erased` event enough for them?
+   and is a single `erased` event enough for them? _(Decided 2026-10-22 for
+   agent-hosted plugins: deleting keeps a tombstone, erasing is a separate
+   action; one `remove/erased` change, the half scrubs its row and runs the
+   plugin's anonymiser in the same transaction, and its cursor passing the
+   change is the acknowledgement.)_
 4. **Door hardware:** which doors, and are their readers able to use
    cryptographic cards (DESFire)? Until then, doors stay out of scope.
 5. **GitLab password sign-in:** turn it off once OIDC sign-in works (keeps
    offboarding single-action), with the root account as the only exception?
 6. **Signing:** Gatekeeper signs assertions (it is already on the request
    path), or the panel issues them and Gatekeeper only forwards — which keeps
-   Gatekeeper free of keys, as its design intends?
+   Gatekeeper free of keys, as its design intends? _(Decided 2026-10-22:
+   both, each for what it knows. **Gatekeeper attests the session** — an
+   Ed25519 relay assertion for the panel, with the relay signing key it has
+   held since 4.3, naming the Authelia username alone and bound to the
+   method and the raw request path. **The panel issues the identity
+   applications see** — the directory's `userId`, the username and the
+   plugin's roles, in the caller assertion it signs for the agent half.
+   Gatekeeper never signs a role or an attribute.)_

package/vendor/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-docs",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "private": true,
   "description": "Lamaste documentation — markdown files served by the panel and published to GitHub Pages",
   "type": "module",

package/vendor/docs/todo/lib-cli-desktop-refactor.md

@@ -29,7 +29,7 @@ feria                        dev registry — OUT OF SCOPE, do not touch
 
 ### Naming Rules
 
-- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.4.0'`. No `-lib` suffix.
+- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.5.0'`. No `-lib` suffix.
 - **`-d` suffix** for daemons — Unix convention (`httpd`, `sshd`, `mongod`). Instantly signals "long-running process".
 - **`-ui`** for React component libraries — universal term, avoids "serverd serves the panel" tautology.
 - **`create-*`** for all npx one-shot tools — the one npm convention everyone knows.
@@ -74,24 +74,24 @@ lamaste                              core library (types, constants, schemas, pl
 
 | #   | Package (npm name)                  | Type        | Depends on | Purpose                                                                                                             |
 | --- | ----------------------------------- | ----------- | ---------- | ------------------------------------------------------------------------------------------------------------------- |
-| 1   | `@lamalibre/lamaste@4.4.0`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.4.0/agent` — agent domain logic                                                            |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.4.0/server` — server domain logic                                                          |
-| 2   | `@lamalibre/lamaste-agent@4.4.0`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
-| 3   | `@lamalibre/lamaste-agentd@4.4.0`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
-| 4   | `@lamalibre/lamaste-agent-ui@4.4.0`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
-| 5   | `@lamalibre/lamaste-server@4.4.0`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
-| 6   | `@lamalibre/lamaste-serverd@4.4.0`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
-| 7   | `@lamalibre/lamaste-server-ui@4.4.0`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
-| 8   | `@lamalibre/lamaste@4.4.0-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
-| 9   | `@lamalibre/lamaste-cloud@4.4.0`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
-| 10  | `@lamalibre/lamaste-tickets@4.4.0`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
-| 11  | `@lamalibre/lamaste-identity@4.4.0`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
-| 12  | `@lamalibre/create-lamaste@4.4.0`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
-| 13  | `@lamalibre/create-lamaste-agent@4.4.0`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
-| 14  | `@lamalibre/create-lamaste-desktop@4.4.0` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
-| 15  | `@lamalibre/create-lamaste-admin@4.4.0`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
-| 16  | `@lamalibre/create-lamaste-e2e@4.4.0`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
+| 1   | `@lamalibre/lamaste@4.5.0`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.5.0/agent` — agent domain logic                                                            |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.5.0/server` — server domain logic                                                          |
+| 2   | `@lamalibre/lamaste-agent@4.5.0`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
+| 3   | `@lamalibre/lamaste-agentd@4.5.0`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
+| 4   | `@lamalibre/lamaste-agent-ui@4.5.0`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
+| 5   | `@lamalibre/lamaste-server@4.5.0`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
+| 6   | `@lamalibre/lamaste-serverd@4.5.0`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
+| 7   | `@lamalibre/lamaste-server-ui@4.5.0`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
+| 8   | `@lamalibre/lamaste@4.5.0-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
+| 9   | `@lamalibre/lamaste-cloud@4.5.0`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
+| 10  | `@lamalibre/lamaste-tickets@4.5.0`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
+| 11  | `@lamalibre/lamaste-identity@4.5.0`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
+| 12  | `@lamalibre/create-lamaste@4.5.0`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
+| 13  | `@lamalibre/create-lamaste-agent@4.5.0`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
+| 14  | `@lamalibre/create-lamaste-desktop@4.5.0` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
+| 15  | `@lamalibre/create-lamaste-admin@4.5.0`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
+| 16  | `@lamalibre/create-lamaste-e2e@4.5.0`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
 | 17  | `@lamalibre/feria`                  | dev tool    | —          | Dev registry + release runner. **Out of scope — do not touch in this refactor**                                     |
 
 ### Rename Map (1.x → 2.0.0)
@@ -116,7 +116,7 @@ The core library uses **subpath exports** to provide domain-specific entry point
 
 ```json
 {
-  "name": "@lamalibre/lamaste@4.4.0",
+  "name": "@lamalibre/lamaste@4.5.0",
   "exports": {
     ".": "./dist/index.js",
     "./agent": "./dist/agent/index.js",
@@ -126,9 +126,9 @@ The core library uses **subpath exports** to provide domain-specific entry point
 ```
 
 ```typescript
-import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.4.0';
-import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.4.0/agent';
-import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.4.0/server';
+import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.5.0';
+import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.5.0/agent';
+import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.5.0/server';
 ```
 
 **Why subpath exports instead of three packages (`lamaste-lib`, `lamaste-lib-agent`, `lamaste-lib-server`):**
@@ -149,7 +149,7 @@ import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.4.0/server';
 
 | Layer                    | Agent side                                      | Server side                                    |
 | ------------------------ | ----------------------------------------------- | ---------------------------------------------- |
-| **Domain logic**         | `@lamalibre/lamaste@4.4.0/agent`                      | `@lamalibre/lamaste@4.4.0/server`                    |
+| **Domain logic**         | `@lamalibre/lamaste@4.5.0/agent`                      | `@lamalibre/lamaste@4.5.0/server`                    |
 | **Operational CLI**      | `lamaste-agent`                                 | `lamaste-server` (new)                         |
 | **Long-running daemon**  | `lamalibre-lamaste-agentd` on :9393 (extracted) | `lamalibre-lamaste-serverd` on :3100 (renamed) |
 | **UI components**        | `lamaste-agent-ui` (renamed)                    | `lamaste-server-ui` (merged)                   |
@@ -471,7 +471,7 @@ The Rust backend has both `commands.rs` (legacy) and `agents.rs` (multi-agent).
 
 Create `packages/lamaste/` (TypeScript) with subpath exports:
 
-**Root (`@lamalibre/lamaste@4.4.0`):**
+**Root (`@lamalibre/lamaste@4.5.0`):**
 
 - Types: `AdminClient`, `AgentClient` TypeScript interfaces, plugin manifest types, capability types
 - Constants: Reserved API prefixes, curated plugin list, capability names
@@ -479,7 +479,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Plugin Host: Fastify plugin for plugin route mounting, bundle serving, disabled handler (unified from three routers)
 - File Helpers: Atomic write (temp → fsync → rename), promise-chain mutex
 
-**Agent subpath (`@lamalibre/lamaste@4.4.0/agent`):**
+**Agent subpath (`@lamalibre/lamaste@4.5.0/agent`):**
 
 - Platform: Path helpers, platform detection (from `platform.js`)
 - Registry: Agent registry CRUD, label validation, legacy migration (from `registry.js`)
@@ -491,7 +491,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Server Registry: servers.json and storage-servers.json CRUD (new — from Rust `cloud.rs`)
 - Mode: Server mode and admin cert file operations (new — from Rust `mode.rs`)
 
-**Server subpath (`@lamalibre/lamaste@4.4.0/server`):**
+**Server subpath (`@lamalibre/lamaste@4.5.0/server`):**
 
 - Plugins: Server-side plugin lifecycle (uses shared schema from root)
 - Tunnels: Tunnel creation workflow with rollback (from `routes/tunnels.js`)

package/vendor/gatekeeper/dist/index.d.ts

@@ -1,9 +1,10 @@
-export type { Group, GroupState, CreateGroupOptions, UpdateGroupOptions, DeleteGroupResult, Grant, GrantState, CreateGrantOptions, GrantFilter, AccessAllowed, AccessDenied, AccessResult, AccessRequestTemplates, TemplateOptions, GatekeeperSettings, AccessRequestEntry, TunnelInfo, AutheliaSession, GatekeeperLogger, } from './lib/types.js';
+export type { Group, GroupState, CreateGroupOptions, UpdateGroupOptions, DeleteGroupResult, Grant, GrantState, CreateGrantOptions, GrantFilter, AccessAllowed, AccessDenied, AccessResult, AccessRequestTemplates, TemplateOptions, GatekeeperSettings, AccessRequestEntry, TunnelInfo, TunnelUserSurfaceInfo, PluginTunnelTarget, AutheliaSession, GatekeeperLogger, } from './lib/types.js';
 export { PRINCIPAL_TYPES, RESOURCE_TYPES, ACCESS_MODES, RESERVED_GROUP_NAMES, MAX_GROUPS, MAX_GRANTS, GRANT_RETENTION_MS, SESSION_CACHE_TTL_MS, GROUP_NAME_REGEX, MAX_GROUP_NAME_LENGTH, MIN_GROUP_NAME_LENGTH, DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, ACCESS_LOG_FILE, AUTHELIA_VERIFY_URL, GATEKEEPER_PORT, } from './lib/constants.js';
 export type { PrincipalType, ResourceType, AccessMode } from './lib/constants.js';
 export { createGroup, listGroups, getGroup, updateGroup, deleteGroup, addMembers, removeMembers, getGroupsForUser, } from './lib/groups.js';
 export { createGrant, listGrants, getGrant, revokeGrant, consumeGrant, removeGrantsByPredicate, removeGrantsByPrincipal, } from './lib/grants.js';
 export { checkAccess } from './lib/authz.js';
+export { tunnelInfoFromState } from './lib/tunnels.js';
 export { getAccessRequestTemplates, buildAccessRequestPage } from './lib/templates.js';
 export { migrateFromLegacy } from './lib/migration.js';
 //# sourceMappingURL=index.d.ts.map

package/vendor/gatekeeper/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGlF,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGlF,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}

package/vendor/gatekeeper/dist/index.js

@@ -6,6 +6,8 @@ export { createGroup, listGroups, getGroup, updateGroup, deleteGroup, addMembers
 export { createGrant, listGrants, getGrant, revokeGrant, consumeGrant, removeGrantsByPredicate, removeGrantsByPrincipal, } from './lib/grants.js';
 // Authorization
 export { checkAccess } from './lib/authz.js';
+// The tunnels Gatekeeper authorizes, as it reads them from tunnels.json
+export { tunnelInfoFromState } from './lib/tunnels.js';
 // Templates
 export { getAccessRequestTemplates, buildAccessRequestPage } from './lib/templates.js';
 // Migration

package/vendor/gatekeeper/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuBA,YAAY;AACZ,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAI5B,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,gBAAgB;AAChB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,YAAY;AACZ,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAyBA,YAAY;AACZ,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAI5B,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,gBAAgB;AAChB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,wEAAwE;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,YAAY;AACZ,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}

package/vendor/gatekeeper/dist/lib/grants.d.ts

@@ -1,4 +1,10 @@
 import type { Grant, GrantState, CreateGrantOptions, GrantFilter } from './types.js';
+/**
+ * Run `fn` holding the grants lock. A caller that also holds the groups
+ * lock takes that one first (`withGroupLock`, then this) — the order every
+ * cascade uses.
+ */
+export declare function withGrantLock<T>(fn: () => Promise<T>): Promise<T>;
 export declare function createGrant(options: CreateGrantOptions, initialState?: {
     used?: boolean;
     createdAt?: string;