@lamalibre/create-lamaste 4.4.1 → 4.6.0

package/vendor/docs/03-architecture/state-management.md

@@ -32,10 +32,8 @@ This approach works because Lamaste manages a small amount of state (one admin,
 ├── tickets.json            ← Ticket and session store
 ├── storage-config.json     ← Storage server registry and plugin bindings
 ├── storage-master.key      ← 32-byte master key for storage credential encryption
-├── groups.json             ← Lamaste groups (separate from Authelia groups)
-├── access-grants.json      ← Generic access grants (principal → resource)
+├── gatekeeper.db           ← Gatekeeper (SQLite): Lamaste groups, access grants, denied-access log
 ├── gatekeeper.json         ← Gatekeeper settings (cache TTL, admin contact, logging)
-├── access-request-log.json ← Optional denied access log (for admin review)
 └── pki/
     ├── ca.key              ← CA private key
     ├── ca.crt              ← CA certificate
@@ -331,7 +329,7 @@ Read returns `[]` for missing files (ENOENT), enabling the system to start with
 5. `DELETE /api/certs/agent/:label` (revocation) — the agent's app and plugin tunnels lose their `agentLabel` (unassigned), and its `agent-<label>` panel tunnel is removed
 6. At startup (background, fail closed): an ownerless `agent-<label>` panel tunnel is bound to the agent it names when that agent is active; other ownerless tunnels (from versions before tunnel ownership) are bound to the sole active agent, or left unassigned when there are several. Then the pinned Chisel binary, the unit and the authfile are re-established — and Chisel is stopped if they cannot be
 
-Every one of these workflows runs under the single tunnel lock (`withTunnelLock` in `@lamalibre/lamaste@4.4.1/server`), with its validation inside the lock.
+Every one of these workflows runs under the single tunnel lock (`withTunnelLock` in `@lamalibre/lamaste@4.6.0/server`), with its validation inside the lock.
 
 ## Site State (`sites.json`)
 
@@ -466,10 +464,8 @@ Environment variables allow overriding paths for development and testing without
 | `invitations.json`        | `0600` | `lamaste:lamaste`          | Written by Panel Server                                              |
 | `storage-config.json`     | `0600` | `lamaste:lamaste`          | Storage registry (credentials AES-256-GCM encrypted)                 |
 | `storage-master.key`      | `0600` | `lamaste:lamaste`          | 32-byte master key for storage encryption                            |
-| `groups.json`             | `0600` | `lamaste:lamaste`          | Lamaste group definitions and membership                             |
-| `access-grants.json`      | `0600` | `lamaste:lamaste`          | Generic access grants (principal → resource)                         |
+| `gatekeeper.db`           | `0600` | `lamaste:lamaste`          | Gatekeeper (SQLite, WAL): groups, access grants, denied-access log   |
 | `gatekeeper.json`         | `0600` | `lamaste:lamaste`          | Gatekeeper settings (cache TTL, logging)                             |
-| `access-request-log.json` | `0600` | `lamaste:lamaste`          | Optional denied access log                                           |
 | `pki/ca.key`              | `0600` | `lamaste:lamaste`          | CA private key — most sensitive file                                 |
 | `pki/ca.crt`              | `0644` | `lamaste:lamaste`          | CA cert — needs to be readable by nginx                              |
 | `pki/client.key`          | `0600` | `lamaste:lamaste`          | Client private key                                                   |
@@ -486,7 +482,7 @@ The PKI directory belongs to `lamaste` because the panel is the CA (it signs age
 
 The Panel Server is a single-process Node.js application, but a single-threaded event loop does not serialize asynchronous workflows: two requests that each read `tunnels.json`, await a certificate or an nginx test, and then write it back would interleave, and both could pass the same uniqueness check. Serialization is therefore explicit:
 
-**Tunnel state** is guarded by one promise-chain lock, `withTunnelLock` in `@lamalibre/lamaste@4.4.1/server`'s `tunnels.ts`. Every tunnel workflow — create, delete, toggle, assign, reconfigure, the combined `PATCH /api/tunnels/:id`, releasing a revoked agent's tunnels, and startup reconciliation — takes it for its whole duration, and does its validation (subdomain and port uniqueness, reserved ports, agent checks, authorization against the current entry) inside it.
+**Tunnel state** is guarded by one promise-chain lock, `withTunnelLock` in `@lamalibre/lamaste@4.6.0/server`'s `tunnels.ts`. Every tunnel workflow — create, delete, toggle, assign, reconfigure, the combined `PATCH /api/tunnels/:id`, releasing a revoked agent's tunnels, and startup reconciliation — takes it for its whole duration, and does its validation (subdomain and port uniqueness, reserved ports, agent checks, authorization against the current entry) inside it.
 
 **Chisel authfile renders** are serialized by a promise-chain mutex in `chisel-users.ts`, keyed by the credentials file, around every render (enroll, revoke, rotate, tunnel change). The daemon's `syncChisel()` renders after the tunnel state is written and restarts Chisel (`systemctl try-restart`) only when the render withdrew something.
 

package/vendor/docs/03-architecture/system-overview.md

@@ -58,7 +58,7 @@
 │  │                                                                │  │
 │  │   Lamaste Desktop (Tauri v2) — dual mode                      │  │
 │  │    ├─ Agent mode: service discovery + tunnel management        │  │
-│  │    │   (pages from @lamalibre/lamaste-agent-ui@4.4.1)            │  │
+│  │    │   (pages from @lamalibre/lamaste-agent-ui@4.6.0)            │  │
 │  │    ├─ Server mode: full admin panel (via lamaste-server-ui) │  │
 │  │    ├─ Multi-server registry (~/.lamalibre/lamaste/servers.json)         │  │
 │  │    ├─ Cloud provisioning (DigitalOcean via lamaste-cloud)     │  │