@lamalibre/create-lamaste 4.5.0 → 4.6.0

package/vendor/docs/04-api-reference/tunnels.md

@@ -153,24 +153,24 @@ curl -s --cert client.p12:password \
 
 **Errors:**
 
-| Status | Body                                                                                                          | When                                                         |
-| ------ | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
-| 400    | `{"error":"Validation failed","details":{"issues":[...]}}`                                                    | Invalid subdomain format, port out of range or reserved      |
-| 400    | `{"error":"agentLabel is required: name the agent that will carry the tunnel"}`                               | Admin certificate did not name the carrying agent            |
-| 400    | `{"error":"Failed to create tunnel","details":"Agent 'x' is not enrolled or has been revoked"}`               | `agentLabel` does not name an active agent                   |
-| 400    | `{"error":"Failed to create tunnel","details":"Subdomain 'panel' is reserved"}`                               | Subdomain is in the reserved list                            |
-| 400    | `{"error":"Failed to create tunnel","details":"Subdomain 'app' is already in use"}`                           | Another tunnel uses this subdomain                           |
-| 400    | `{"error":"Failed to create tunnel","details":"Port 3000 is already in use by another tunnel"}`               | Another tunnel uses this port                                |
-| 400    | `{"error":"Failed to create tunnel","details":"Domain 'app.example.com' is already served by a static site"}` | A static site or site alias already answers on this hostname |
-| 400    | `{"error":"Domain and email must be configured before creating tunnels"}`                                     | Domain not set in config                                     |
-| 403    | `{"error":"Agents can only create tunnels they carry themselves"}`                                            | Agent certificate named another agent                        |
-| 403    | `{"error":"Plugin-agent certificates cannot create tunnels — use the agent certificate of ..."}`              | Plugin-agent certificate                                     |
-| 403    | `{"error":"Only administrators can set a body limit above 100 MiB"}`                                          | Agent certificate asked for `maxBodySizeMb` over 100         |
-| 403    | `{"error":"Only administrators can set tunnel access mode to public or authenticated"}`                       | Agent certificate asked for a non-restricted mode            |
-| 500    | `{"error":"Failed to create tunnel","details":"Certificate issuance failed: ..."}`                            | certbot failed                                               |
-| 500    | `{"error":"Failed to create tunnel","details":"Nginx configuration failed: ..."}`                             | nginx vhost write or test failed                             |
-| 500    | `{"error":"Failed to create tunnel","details":"State persistence failed: ..."}`                               | Failed to write tunnels.json                                 |
-| 500    | `{"error":"Failed to create tunnel","details":"Chisel reconfiguration failed: ..."}`                          | Chisel authfile sync failed                                  |
+| Status | Body                                                                                                                  | When                                                                                                                                    |
+| ------ | --------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| 400    | `{"error":"Validation failed","details":{"issues":[...]}}`                                                            | Invalid subdomain format, port out of range or reserved                                                                                 |
+| 400    | `{"error":"agentLabel is required: name the agent that will carry the tunnel"}`                                       | Admin certificate did not name the carrying agent                                                                                       |
+| 400    | `{"error":"Failed to create tunnel","details":"Agent 'x' is not enrolled or has been revoked"}`                       | `agentLabel` does not name an active agent                                                                                              |
+| 400    | `{"error":"Failed to create tunnel","details":"Subdomain 'panel' is reserved"}`                                       | Subdomain is in the reserved list                                                                                                       |
+| 400    | `{"error":"Failed to create tunnel","details":"Subdomain 'app' is already in use"}`                                   | Another tunnel uses this subdomain                                                                                                      |
+| 400    | `{"error":"Failed to create tunnel","details":"Port 3000 is already in use by another tunnel"}`                       | Another tunnel uses this port                                                                                                           |
+| 400    | `{"error":"Failed to create tunnel","details":"Domain 'app.example.com' is already served by a static site ('app')"}` | A static site or site alias already answers on this hostname (checked under the tunnel lock; enabling a tunnel is refused the same way) |
+| 400    | `{"error":"Domain and email must be configured before creating tunnels"}`                                             | Domain not set in config                                                                                                                |
+| 403    | `{"error":"Agents can only create tunnels they carry themselves"}`                                                    | Agent certificate named another agent                                                                                                   |
+| 403    | `{"error":"Plugin-agent certificates cannot create tunnels — use the agent certificate of ..."}`                      | Plugin-agent certificate                                                                                                                |
+| 403    | `{"error":"Only administrators can set a body limit above 100 MiB"}`                                                  | Agent certificate asked for `maxBodySizeMb` over 100                                                                                    |
+| 403    | `{"error":"Only administrators can set tunnel access mode to public or authenticated"}`                               | Agent certificate asked for a non-restricted mode                                                                                       |
+| 500    | `{"error":"Failed to create tunnel","details":"Certificate issuance failed: ..."}`                                    | certbot failed                                                                                                                          |
+| 500    | `{"error":"Failed to create tunnel","details":"Nginx configuration failed: ..."}`                                     | nginx vhost write or test failed                                                                                                        |
+| 500    | `{"error":"Failed to create tunnel","details":"State persistence failed: ..."}`                                       | Failed to write tunnels.json                                                                                                            |
+| 500    | `{"error":"Failed to create tunnel","details":"Chisel reconfiguration failed: ..."}`                                  | Chisel authfile sync failed                                                                                                             |
 
 ### Creation Flow
 
@@ -318,7 +318,7 @@ curl -s --cert client.p12:password \
 | `chiselArgs`               | `string[]`       | Chisel client arguments: `client`, the server URL, and one `R:127.0.0.1:<port>:127.0.0.1:<port>` remote per tunnel. No `--tls-skip-verify` (the agent verifies the relay's certificate) and no credential — the agent supplies its own through the service environment, never argv                                                                                                                                                                                                                                                                             |
 | `chiselCredentialIssuedAt` | `string \| null` | When the agent's current Chisel credential was issued — a timestamp, never the credential. An agent holding a credential with a different issue time (an administrator rotated it) fetches the current one from `GET /api/agents/me/chisel-credential`                                                                                                                                                                                                                                                                                                         |
 | `tunnels`                  | `array`          | The agent's enabled tunnels with port and subdomain                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `hostFactsHash`            | `string \| null` | Agent certificates only: the SHA-256 of the [host facts](agent-hosted-plugins.md#host-facts) the relay stores for the agent, computed as the agent computes it over its own (`hostFactsHash` in `@lamalibre/lamaste@4.5.0`); `null` when it stores none. The agent's sync reports its facts again when this is not the hash of its own, so a record replaced since its last report — the agent enrolled again on its label, the relay restored from a backup — has them again after one sync, not a day. An agent behind a relay without the field reports as before |
+| `hostFactsHash`            | `string \| null` | Agent certificates only: the SHA-256 of the [host facts](agent-hosted-plugins.md#host-facts) the relay stores for the agent, computed as the agent computes it over its own (`hostFactsHash` in `@lamalibre/lamaste@4.6.0`); `null` when it stores none. The agent's sync reports its facts again when this is not the hash of its own, so a record replaced since its last report — the agent enrolled again on its label, the relay restored from a backup — has them again after one sync, not a day. An agent behind a relay without the field reports as before |
 
 **Errors:**
 
@@ -329,6 +329,8 @@ curl -s --cert client.p12:password \
 
 ## User Surface Binding
 
+A plugin that owns a site for its [web surface](agent-hosted-plugins.md#web-surface) serves its user surface there; binding it to a tunnel is refused (`400`). A tunnel bound to one plugin alone can hand its host over to that plugin's web surface in one reload ([Moving from a bound tunnel](agent-hosted-plugins.md#moving-from-a-bound-tunnel)); it stays in the state, disabled and unbound, and cannot be enabled again while the site holds its hostname.
+
 An app tunnel can be **bound** as the user surface of an agent-hosted plugin: its host then serves the plugin's users at `/api/<route>/app` and everything under it — Gatekeeper authenticates the Authelia session and vouches for the user to the panel, and the panel forwards the request to the plugin's agent half with the directory's `userId`, username and the user's roles ([Agent-Hosted Plugins](agent-hosted-plugins.md#the-user-surface)). Every other path of the host goes down the tunnel as before. Admin only, 30 a minute.
 
 **What can be bound.** An enabled app tunnel (`type` `app`, not internal), with access mode `authenticated` or `restricted` — a public host has no signed-in user to vouch for — **carried by the agent that hosts the plugin** (`400` otherwise: "Plugin '…' is hosted on agent '…', but this tunnel is carried by '…'", or "… is not hosted on an agent" before it is hosted). The host whose sessions reach the plugin's users is never another agent's: whatever answers on its other paths — another agent's application — would share the user surface's origin. On a `restricted` tunnel the user also needs a grant for the tunnel. The route must be held by an installed agent-hosted plugin; a plugin's user surface is on one host at most, and one host serves at most 16 plugins' user surfaces. A bound tunnel cannot be made public (`PATCH` answers `409` "… cannot be made public — unbind it first").

package/vendor/docs/05-operations/backup-and-restore.md

@@ -199,7 +199,7 @@ sudo chown lamaste-authelia:lamaste-authelia /etc/authelia/db.sqlite3* /etc/auth
 sudo chmod 600 /etc/authelia/db.sqlite3* /etc/authelia/notifications.txt
 ```
 
-A backup taken on a version before the privilege boundary holds root-owned Authelia files and older unit files. After restoring one, re-run `npx @lamalibre/create-lamaste@4.5.0 --yes`: the redeploy rewrites the `chisel` and `authelia` units and converts the ownership of `/etc/authelia`, the Chisel key and the PKI directory (see [Upgrades](upgrades.md)).
+A backup taken on a version before the privilege boundary holds root-owned Authelia files and older unit files. After restoring one, re-run `npx @lamalibre/create-lamaste@4.6.0 --yes`: the redeploy rewrites the `chisel` and `authelia` units and converts the ownership of `/etc/authelia`, the Chisel key and the PKI directory (see [Upgrades](upgrades.md)).
 
 The panel re-applies the authfile's group and mode itself on every start, so a Chisel that fails to read it before the panel is up is started again by the panel's reconciliation.
 

package/vendor/docs/05-operations/uninstalling.md

@@ -29,7 +29,7 @@ It stops and disables the panel, gatekeeper, Chisel and Authelia; removes their
 The manual guide is also available from the CLI:
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --uninstall
+npx @lamalibre/create-lamaste@4.6.0 --uninstall
 ```
 
 This prints the same steps listed below.

package/vendor/docs/05-operations/upgrades.md

@@ -27,7 +27,7 @@ Coming from 3.x, upgrade the **agents first**, as 4.0 required: agents from befo
 On each agent machine, after the server:
 
 ```bash
-sudo npm install -g @lamalibre/lamaste-agent@4.5.0
+sudo npm install -g @lamalibre/lamaste-agent@4.6.0
 lamaste-agent update
 ```
 
@@ -35,13 +35,22 @@ lamaste-agent update
 
 A machine that hosts app plugins' agent halves needs the root-owned install shown above and its app host helper enabled once with `sudo lamaste-agent apphost enable` (see [App host](../04-api-reference/app-host.md)); after replacing the server's relay signing key, run `sudo lamaste-agent apphost pin` there. An upgrade of `lamaste-agent` does not replace that helper: when a release raises the app host protocol (4.4 speaks 2), run `sudo lamaste-agent apphost enable` again there — until then the agent refuses to install agent halves and the server does not offer it for hosting (`lamaste-agent apphost status` shows the helper as out of date).
 
+### Upgrading to 4.6
+
+4.6 adds plugins' web surfaces ([Web surface](../04-api-reference/agent-hosted-plugins.md#web-surface)). **Only the relay is upgraded**: the panel's **Update** action, or a `create-lamaste@4.6.0 --yes` redeploy.
+
+- **`state.db` migration `0015`** adds `plugins.user_surface` and `plugins.web_tree_sha256`. Existing plugins declare no web surface: their approval digests are unchanged.
+- **`lamaste-priv` must be the 4.6 one** before the panel writes a web surface's vhost: it now accepts a server-level `auth_request`, named locations and a named location as `try_files`' last argument. The Update action and the redeploy install it; a relay whose `lamaste-priv` is older refuses the vhost (`nginx site write failed … directive "auth_request" is not allowed in server`) and keeps the vhost it had.
+- **Web trees live under `/var/www/lamaste/apps/`.** They are copies of approved package contents, made again at the panel's start when missing: nothing there needs a backup.
+- **What changes for existing setups.** Gatekeeper reads `sites.json` as well as `tunnels.json`. The check that a tunnel and a site never share a hostname now runs under the tunnel lock, for enabling a tunnel too. The sites API serves `sites.json` under a lock, and an upload's size is recorded from the file as it is then.
+
 ### Upgrading to 4.5
 
 4.5 adds the user directory and users of agent-hosted plugins ([Users and identity](../04-api-reference/agent-hosted-plugins.md#users-and-identity)). **Only the relay is upgraded**: the panel's **Update** action, or a `create-lamaste@4.5.0 --yes` redeploy.
 
 - **`state.db` migration `0013`.** On its first start the panel creates the user directory (a `directoryId`, a `userId` per user, tombstones), the plugin audiences, the per-plugin feed state and the erasure records, and adds `plugins.identity`. It then reads `users.yml` — without writing it — and gives every existing user a `userId`. Back up `state.db` before upgrading, as before any upgrade: from now on it holds the mapping from usernames to user ids ([Backup and Restore](backup-and-restore.md#backup-considerations)).
 - **The redeploy now touches the IP panel vhost.** Until 4.4 a redeploy left every panel vhost alone. From 4.5 it refreshes `lamalibre-lamaste-panel-ip` — the vhost the installer writes and the panel cannot — when its text differs from the current generator's: written, checked with `nginx -t`, put back on failure, and nginx reloaded; its `sites-enabled` link (which panel 2FA owns) is left as it is. A failure is reported and skipped (`Refreshing the IP panel vhost — Skipped`): the panel keeps working on the vhost it had, which still passes a client's `X-Lamalibre-Relay-Assertion` through to the panel (which accepts only a valid, single-use one Gatekeeper signed) — fix what `nginx -t` names and redeploy. The panel itself rewrites the domain panel, auth portal and tunnel vhosts at start, as since 4.3; each now clears a client's `X-Lamalibre-Relay-Assertion`.
-- **No agent upgrade is needed**, and no agent half must be rebuilt. An agent half built on `@lamalibre/lamaste@4.5.0` 4.4 keeps working and **never receives a user caller**: the panel sends one only after the half has answered the identity feed with protocol 1 for its installed version. A plugin gets users by shipping a version that declares `identity` with a half built on 4.5 — an update that waits for approval — then binding its user surface to a tunnel.
+- **No agent upgrade is needed**, and no agent half must be rebuilt. An agent half built on `@lamalibre/lamaste@4.6.0` 4.4 keeps working and **never receives a user caller**: the panel sends one only after the half has answered the identity feed with protocol 1 for its installed version. A plugin gets users by shipping a version that declares `identity` with a half built on 4.5 — an update that waits for approval — then binding its user surface to a tunnel.
 - **What changes for existing setups.** The admin forwarder no longer reaches an agent half's `/admin/app` or anything under it (on the panel `/api/<route>/app*` is the user surface). The hook preview's `inactiveRoutes` is now `userSurfaceRoutes`. Every write of `users.yml` the panel makes — creating, updating, deleting users, accepting invitations — now runs under one lock, one after the other. Deleting a user keeps a tombstone in the directory and clears the username's grants and group memberships in Gatekeeper. A registry credential must carry the `read` scope as well as `admin` (a `PUT /api/registry-credential` with an admin-only identity is refused).
 
 ### Updating Lamaste (Panel Server and Client)
@@ -93,7 +102,7 @@ exit
 
 ### Updating Chisel
 
-Chisel is the tunnel server binary at `/usr/local/bin/chisel`. Lamaste pins it: server and agents run Chisel 1.12.0 (`CHISEL_RELEASE` in `@lamalibre/lamaste@4.5.0`), downloaded from the fixed release URL and verified against a pinned SHA-256 before it is unpacked. **Do not replace the binary by hand.** On the server, `create-lamaste` installs it (as root) and replaces a binary that reports any other version; the panel cannot install binaries, and only logs an error at startup when the installed Chisel is not the pinned release (it then restarts Chisel on every authfile change). Each agent's sync replaces its own copy.
+Chisel is the tunnel server binary at `/usr/local/bin/chisel`. Lamaste pins it: server and agents run Chisel 1.12.0 (`CHISEL_RELEASE` in `@lamalibre/lamaste@4.6.0`), downloaded from the fixed release URL and verified against a pinned SHA-256 before it is unpacked. **Do not replace the binary by hand.** On the server, `create-lamaste` installs it (as root) and replaces a binary that reports any other version; the panel cannot install binaries, and only logs an error at startup when the installed Chisel is not the pinned release (it then restarts Chisel on every authfile change). Each agent's sync replaces its own copy.
 
 A new Chisel version therefore arrives with a Lamaste release that changes the pin: re-run the installer, which installs it and restarts Chisel. To check what is running:
 
@@ -107,7 +116,7 @@ Tunnel clients reconnect on their own after the brief interruption (they retry a
 
 ### Updating Authelia
 
-Authelia is the authentication server binary at `/usr/local/bin/authelia`. Lamaste pins it too: Authelia 4.39.28 (`AUTHELIA_RELEASE` in `@lamalibre/lamaste@4.5.0`), downloaded by `create-lamaste` from its fixed release URL and verified against a pinned SHA-256 per architecture. A new Authelia version arrives with a Lamaste release that changes the pin — re-run the installer. It stops Authelia while it replaces the binary and starts it again.
+Authelia is the authentication server binary at `/usr/local/bin/authelia`. Lamaste pins it too: Authelia 4.39.28 (`AUTHELIA_RELEASE` in `@lamalibre/lamaste@4.6.0`), downloaded by `create-lamaste` from its fixed release URL and verified against a pinned SHA-256 per architecture. A new Authelia version arrives with a Lamaste release that changes the pin — re-run the installer. It stops Authelia while it replaces the binary and starts it again.
 
 An installed Authelia **newer** than the pin is kept, never downgraded: its database may already use a schema the pinned release cannot read, and Authelia refuses to start on a database newer than itself. If you install a newer release by hand, stop the service, replace the binary as root with a `root:root 0755` file, and start it again; check the [Authelia changelog](https://github.com/authelia/authelia/blob/master/CHANGELOG.md) first, since the configuration format may change between versions.
 
@@ -246,7 +255,7 @@ The panel server, CLI, client, docs and gatekeeper are always redeployed (files
 
 ### Version Pinning
 
-Chisel and Authelia are pinned by version and SHA-256 in `packages/core/lib/src/constants.ts` (`CHISEL_RELEASE`, `AUTHELIA_RELEASE`); changing a pin means updating the version and every digest there. The downloads are verified by `downloadVerifiedChisel` / `downloadVerifiedAuthelia` (exported from `@lamalibre/lamaste@4.5.0`) before anything is unpacked; the server installer uses them in `packages/provisioners/server/src/lib/binaries.js`. The configuration the panel writes needs Authelia 4.38 or later.
+Chisel and Authelia are pinned by version and SHA-256 in `packages/core/lib/src/constants.ts` (`CHISEL_RELEASE`, `AUTHELIA_RELEASE`); changing a pin means updating the version and every digest there. The downloads are verified by `downloadVerifiedChisel` / `downloadVerifiedAuthelia` (exported from `@lamalibre/lamaste@4.6.0`) before anything is unpacked; the server installer uses them in `packages/provisioners/server/src/lib/binaries.js`. The configuration the panel writes needs Authelia 4.38 or later.
 
 ### Automated Updates
 
@@ -268,7 +277,7 @@ sudo dpkg-reconfigure -plow unattended-upgrades
 | Panel server | `/opt/lamalibre/lamaste/lamaste-serverd/`      | Re-run `npx @lamalibre/create-lamaste@latest`         |
 | Panel client | `/opt/lamalibre/lamaste/lamaste-server-ui/`    | Re-run `npx @lamalibre/create-lamaste@latest`         |
 | Chisel       | `/usr/local/bin/chisel`                        | Pinned; installed by `create-lamaste`                 |
-| Agents       | `sudo npm install -g @lamalibre/lamaste-agent@4.5.0` | Upgrade after the server, then `lamaste-agent update` |
+| Agents       | `sudo npm install -g @lamalibre/lamaste-agent@4.6.0` | Upgrade after the server, then `lamaste-agent update` |
 | Authelia     | `/usr/local/bin/authelia`                      | Pinned; installed by `create-lamaste` (newer is kept) |
 | nginx        | System package                                 | `sudo apt-get update && sudo apt-get upgrade`         |
 | certbot      | System package                                 | `sudo apt-get update && sudo apt-get upgrade`         |

package/vendor/docs/06-reference/config-files.md

@@ -245,20 +245,24 @@ Stores the array of static sites hosted through Lamaste.
 
 **Schema:** Array of site objects.
 
-| Field               | Type                  | Description                                                                                                                 |
-| ------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------- |
-| `id`                | string                | UUID                                                                                                                        |
-| `name`              | string                | Site name (the subdomain for managed sites)                                                                                 |
-| `fqdn`              | string                | Full domain (e.g., `blog.example.com`)                                                                                      |
-| `type`              | string                | `"managed"` (subdomain of the Lamaste domain) or `"custom"` (your own domain)                                               |
-| `spaMode`           | boolean               | If true, `try_files` falls back to `/index.html`                                                                            |
-| `autheliaProtected` | boolean               | If true, requires Authelia authentication                                                                                   |
-| `allowedUsers`      | string[]              | Authelia users allowed when protected (empty: all authenticated users)                                                      |
-| `dnsVerified`       | boolean               | DNS verified (always `true` for managed sites)                                                                              |
-| `certIssued`        | boolean               | TLS certificate issued and vhost live                                                                                       |
-| `aliases`           | string[] \| undefined | Custom sites only: hostnames answered with a 301 to `https://<fqdn>`. One certificate lineage named after `fqdn` covers all |
-| `rootPath`          | string                | Document root (e.g., `/var/www/lamaste/<id>/`)                                                                              |
-| `createdAt`         | string                | ISO 8601 timestamp                                                                                                          |
+| Field               | Type                  | Description                                                                                                                                                                                                    |
+| ------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `id`                | string                | UUID                                                                                                                                                                                                           |
+| `name`              | string                | Site name (the subdomain for managed sites)                                                                                                                                                                    |
+| `fqdn`              | string                | Full domain (e.g., `blog.example.com`)                                                                                                                                                                         |
+| `type`              | string                | `"managed"` (subdomain of the Lamaste domain) or `"custom"` (your own domain)                                                                                                                                  |
+| `spaMode`           | boolean               | If true, `try_files` falls back to `/index.html`                                                                                                                                                               |
+| `autheliaProtected` | boolean               | If true, requires Authelia authentication                                                                                                                                                                      |
+| `allowedUsers`      | string[]              | Authelia users allowed when protected (empty: all authenticated users)                                                                                                                                         |
+| `dnsVerified`       | boolean               | DNS verified (always `true` for managed sites)                                                                                                                                                                 |
+| `certIssued`        | boolean               | TLS certificate issued and vhost live                                                                                                                                                                          |
+| `aliases`           | string[] \| undefined | Custom sites only: hostnames answered with a 301 to `https://<fqdn>`. One certificate lineage named after `fqdn` covers all                                                                                    |
+| `rootPath`          | string                | Document root (e.g., `/var/www/lamaste/<id>/`)                                                                                                                                                                 |
+| `createdAt`         | string                | ISO 8601 timestamp                                                                                                                                                                                             |
+| `owner`             | object \| undefined   | `{ plugin: <route> }` — a plugin's [web surface](../04-api-reference/agent-hosted-plugins.md#web-surface); its `rootPath` is `/var/www/lamaste/apps/<route>/current` and only the plugin's workflows change it |
+| `accessMode`        | string \| undefined   | A plugin-owned site's: `"authenticated"` or `"restricted"` (a `site` grant in Gatekeeper)                                                                                                                      |
+
+Gatekeeper reads this file too (the hosts of plugins' user surfaces). Every change runs under the panel's sites lock.
 
 **Example:**
 
@@ -818,7 +822,7 @@ Service files use per-agent names:
 - macOS: `com.lamalibre.lamaste.chisel-<label>` (plist label), `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` — mode 0600, because it carries `AUTH` in `EnvironmentVariables`
 - Linux: `lamalibre-lamaste-chisel-<label>` (unit name), `~/.config/systemd/user/lamalibre-lamaste-chisel-<label>.service` — a systemd **user** unit with `EnvironmentFile=` pointing at `chisel.env`; enable lingering (`sudo loginctl enable-linger <user>`) for it to start at boot without a login
 
-Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.5.0/agent` (`chisel-service.ts`) and rewritten by `lamaste-agent setup`, `update` and `sync` — do not edit them by hand. An agent carrying no tunnels has its service unloaded (Chisel cannot run without a remote).
+Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.6.0/agent` (`chisel-service.ts`) and rewritten by `lamaste-agent setup`, `update` and `sync` — do not edit them by hand. An agent carrying no tunnels has its service unloaded (Chisel cannot run without a remote).
 
 The sync timer, which runs `<node> <installed lamaste-agent> sync --label <label> --quiet` (`<node>` is a stable path such as `/opt/homebrew/bin/node` when one on `PATH` resolves to the running binary, so a Node.js upgrade does not break it):
 

package/vendor/docs/06-reference/glossary.md

@@ -24,7 +24,7 @@ If you are reading documentation and hit an unfamiliar term, this is the place t
 
 **Where it appears:**
 
-- Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.5.0`)
+- Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.6.0`)
 - Agent registry: `/etc/lamalibre/lamaste/agents.json` on the server; `~/.lamalibre/lamaste/agents/<label>/` on the agent
 - The **Agent** column and field on the panel's Tunnels page
 
@@ -242,7 +242,7 @@ See also: [mTLS](#mtls-mutual-tls), [CA](#ca-certificate-authority), [PKCS12](#p
 
 **Where it appears:**
 
-- Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.5.0/agent`)
+- Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.6.0/agent`)
 - Installed to `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` on the agent
 - Manages the Chisel client process lifecycle
 
@@ -373,7 +373,7 @@ See also: [Client Certificate](#client-certificate), [CA](#ca-certificate-author
 
 **Plain English:** A small scheduled job on every agent that checks with the panel every 30 seconds and adjusts the tunnel client when the agent's tunnels changed — so tunnels created, disabled or moved in the panel reach the agent without anyone running a command on it.
 
-**Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.5.0`.
+**Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.6.0`.
 
 **Where it appears:**
 

package/vendor/docs/06-reference/installer-flags.md

@@ -1,11 +1,11 @@
 # Installer Flags
 
-> CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.5.0`.
+> CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.6.0`.
 
 ## Usage
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 [flags]
+npx @lamalibre/create-lamaste@4.6.0 [flags]
 ```
 
 The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-interactive by default — all configuration happens later through the browser-based onboarding wizard.
@@ -26,7 +26,7 @@ The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-
 Prints a description of what the installer does, lists all flags, and exits with code 0. Does not modify anything on the system.
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --help
+npx @lamalibre/create-lamaste@4.6.0 --help
 ```
 
 ### `--yes`, `-y`
@@ -34,7 +34,7 @@ npx @lamalibre/create-lamaste@4.5.0 --help
 Skips the interactive confirmation prompt that appears before installation begins. Useful for automated deployments or scripts where you cannot press Enter.
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --yes
+npx @lamalibre/create-lamaste@4.6.0 --yes
 ```
 
 Without this flag, the installer displays a banner listing all changes it will make and waits for the user to press Enter or Ctrl+C.
@@ -51,7 +51,7 @@ Skips all OS hardening tasks:
 Everything else (Node.js, nginx, mTLS, panel deployment) still runs.
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --skip-harden
+npx @lamalibre/create-lamaste@4.6.0 --skip-harden
 ```
 
 Use this if you manage your own firewall rules, already have fail2ban configured, or are running on a platform that handles security at a different layer.
@@ -61,7 +61,7 @@ Use this if you manage your own firewall rules, already have fail2ban configured
 Allows the installer to run on a machine with a private or non-routable IP address (e.g., `192.168.x.x`, `10.x.x.x`). By default, the installer requires a public IP.
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --dev
+npx @lamalibre/create-lamaste@4.6.0 --dev
 ```
 
 This is useful for:
@@ -76,7 +76,7 @@ When `--dev` is active, the installer prints the detected IP with a note: `(dev
 Forces the installer to run the complete installation pipeline, ignoring skip guards that would normally detect an existing installation. This is useful when an installation is in an inconsistent state and you want to ensure all components are fully deployed.
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --force-full
+npx @lamalibre/create-lamaste@4.6.0 --force-full
 ```
 
 Use this if:
@@ -90,7 +90,7 @@ Use this if:
 Prints a step-by-step guide for manually removing Lamaste from the server, then exits with code 0. Does not modify anything on the system.
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --uninstall
+npx @lamalibre/create-lamaste@4.6.0 --uninstall
 ```
 
 The printed guide first points to the automated removal, `sudo lamaste-server uninstall`, then covers:
@@ -207,25 +207,25 @@ Components that are always redeployed on re-run:
 
 ```bash
 ssh root@203.0.113.42
-npx @lamalibre/create-lamaste@4.5.0
+npx @lamalibre/create-lamaste@4.6.0
 ```
 
 **Automated install (no confirmation prompt):**
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --yes
+npx @lamalibre/create-lamaste@4.6.0 --yes
 ```
 
 **Install without OS hardening:**
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --yes --skip-harden
+npx @lamalibre/create-lamaste@4.6.0 --yes --skip-harden
 ```
 
 **Test in a local VM:**
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --dev
+npx @lamalibre/create-lamaste@4.6.0 --dev
 ```
 
 **Update an existing installation:**
@@ -237,7 +237,7 @@ npx @lamalibre/create-lamaste@latest --yes
 **View the uninstall guide:**
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --uninstall
+npx @lamalibre/create-lamaste@4.6.0 --uninstall
 ```
 
 ## Quick Reference

package/vendor/docs/06-reference/ports-and-services.md

@@ -34,7 +34,7 @@ A tunnel's port is also a loopback port on the relay: its vhost proxies to `127.
 | 9292 | IP-based panel listener |
 | 9294 | Gatekeeper              |
 
-A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.5.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
+A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.6.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
 
 ## Systemd Units
 

package/vendor/docs/06-reference/troubleshooting.md

@@ -217,7 +217,7 @@ The agent's sync timer applies tunnel changes within about 30 seconds. If that d
 lamaste-agent update     # apply now and (re)install the sync timer
 ```
 
-`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.5.0`); an agent originally set up with `npx` must be installed first.
+`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.6.0`); an agent originally set up with `npx` must be installed first.
 
 **Cause 3: The agent does not carry the tunnel.**
 
@@ -320,7 +320,7 @@ ls -la /usr/local/bin/authelia
 | Missing `panel.json`            | `Config file not found`                 | Re-run installer or create the file manually                                                                                   |
 | Invalid JSON in `panel.json`    | `contains invalid JSON`                 | Fix the JSON syntax                                                                                                            |
 | Port 3100 in use                | `EADDRINUSE`                            | Find and stop the conflicting process: `sudo ss -tlnp sport = :3100`                                                           |
-| Missing Node.js modules         | `Cannot find module`                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.5.0 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
+| Missing Node.js modules         | `Cannot find module`                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.6.0 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
 | Permission denied writing state | `EACCES` under `/etc/lamalibre/lamaste` | Re-run the installer; the redeploy re-applies the ownership of the config and PKI directories                                  |
 
 ### chisel fails to start
@@ -329,7 +329,7 @@ ls -la /usr/local/bin/authelia
 
 | Cause                      | Log Message                                                                           | Fix                                                                                                                                                                                                                               |
 | -------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Binary missing             | `exec format error` or `not found`                                                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.5.0 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries                                                 |
+| Binary missing             | `exec format error` or `not found`                                                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.6.0 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries                                                 |
 | Not the pinned release     | (panel log) `The installed chisel is not the pinned release — run create-lamaste ...` | Re-run the installer. Until then the panel restarts Chisel on every authfile change                                                                                                                                               |
 | Authfile or key unreadable | `permission denied` on `chisel-users` or `chisel-server.key`                          | Both must be `0640 lamaste:lamaste-chisel` and the unit `Group=lamaste-chisel`; restart the panel, which re-applies the authfile's. If the group, the unit or the key's ownership is wrong, re-run the installer in redeploy mode |
 | Stopped by the panel       | (panel log) `Chisel stopped: ...`; unit disabled, `chisel-failed-closed` present      | Reconciliation failed closed; see [Tunnel Client Cannot Connect](#tunnel-client-cannot-connect), Cause 1                                                                                                                          |
@@ -343,7 +343,7 @@ ls -la /usr/local/bin/authelia
 | --------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Invalid `configuration.yml` | `configuration: error`                  | Check YAML syntax with `authelia validate-configuration --config /etc/authelia/configuration.yml`                                                                                                                                                                                                                                                         |
 | Missing `users.yml`         | `cannot open file`                      | Create an initial users file (see [Config Files](config-files.md))                                                                                                                                                                                                                                                                                        |
-| Binary missing              | `not found`                             | Re-run the installer (`npx @lamalibre/create-lamaste@4.5.0 --yes`); it installs the pinned release                                                                                                                                                                                                                                                              |
+| Binary missing              | `not found`                             | Re-run the installer (`npx @lamalibre/create-lamaste@4.6.0 --yes`); it installs the pinned release                                                                                                                                                                                                                                                              |
 | Wrong permissions           | `permission denied`                     | Authelia runs as `lamaste-authelia`: `/etc/authelia` must be `lamaste:lamaste-authelia 2770`, `configuration.yml` `0640`, `users.yml` `0660`, `db.sqlite3` owned by `lamaste-authelia`. Re-run the installer to re-apply (a root-owned `/etc/authelia` from an older version is converted), or see [Config Files](config-files.md#file-permissions-table) |
 | Database newer than binary  | storage schema version error at startup | A newer Authelia ran against this database and was replaced by an older one; the installer never downgrades an installed Authelia, so reinstall that newer release by hand                                                                                                                                                                                |
 
@@ -516,14 +516,14 @@ sudo systemctl restart authelia
 
 ## Onboarding Fails: "Chisel is not installed" / "Authelia is not installed"
 
-**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.5.0` on the server to repair the installation." (or the same for Authelia).
+**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.6.0` on the server to repair the installation." (or the same for Authelia).
 
 **Cause:** Onboarding downloads nothing: the installer installs both binaries (pinned releases), their systemd units and the `lamaste-authelia` account. The binary at `/usr/local/bin/chisel` or `/usr/local/bin/authelia` is missing — the installer was interrupted, or the file was removed.
 
 **Fix:** Re-run the installer on the server, then start provisioning again from the wizard:
 
 ```bash
-npx @lamalibre/create-lamaste@4.5.0 --yes
+npx @lamalibre/create-lamaste@4.6.0 --yes
 ```
 
 If provisioning then fails writing Authelia's configuration with `/etc/authelia is not writable by the panel — run create-lamaste to repair the installation`, the directory's ownership is wrong; the same command repairs it.
@@ -538,7 +538,7 @@ If provisioning then fails writing Authelia's configuration with `/etc/authelia
 
 **Fix:**
 
-1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.5.0 --yes`
+1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.6.0 --yes`
 2. If it persists on a current install, it is a bug: the vhost generators (`packages/server/daemon/src/lib/nginx.js`) and the allow-list (`packages/provisioners/server/scripts/lamaste-priv`) must change together — `npm test` checks every generated vhost against the allow-list. Do not work around it by editing files in `/etc/nginx` by hand.
 
 `sudo: a password is required` for `lamaste-priv` means the helper or the sudoers file is missing or outdated: re-run the installer.
@@ -621,7 +621,7 @@ df -h /
 
 **Cause 3: The web root is not writable by the panel (`EACCES`).**
 
-The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.5.0 --yes`); the redeploy converts the tree.
+The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.6.0 --yes`); the redeploy converts the tree.
 
 ---
 

package/vendor/docs/gatekeeper-design.md

@@ -4,9 +4,9 @@
 
 ## Overview
 
-`@lamalibre/lamaste-gatekeeper@4.5.0` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
+`@lamalibre/lamaste-gatekeeper@4.6.0` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
 
-It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.5.0` — a solid library at the core, with a service, CLI, and desktop as consumers.
+It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.6.0` — a solid library at the core, with a service, CLI, and desktop as consumers.
 
 ---
 
@@ -206,7 +206,7 @@ The grant system is resource-agnostic. It doesn't know what a "tunnel" or "plugi
 
 ```js
 import { createGroup, listGroups, getGroup, updateGroup, deleteGroup,
-         addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.5.0';
+         addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.6.0';
 
 createGroup(name, { description?, createdBy? })
   // → { name, description, members: [], createdAt, createdBy }
@@ -242,7 +242,7 @@ getGroupsForUser(username)
 ### Grants
 
 ```js
-import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.5.0';
+import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.6.0';
 
 createGrant({ principalType, principalId, resourceType, resourceId, context? })
   // → grant object
@@ -269,7 +269,7 @@ revokeGrant(grantId)
 ### Authorization
 
 ```js
-import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.5.0';
+import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.6.0';
 
 checkAccess(username, resourceType, resourceId);
 // 1. Find direct user grants: principalType='user', principalId=username
@@ -284,7 +284,7 @@ checkAccess(username, resourceType, resourceId);
 ### Templates
 
 ```js
-import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.5.0';
+import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.6.0';
 
 getAccessRequestTemplates(username, resourceName, { adminContact?, domain? })
   // → {
@@ -866,14 +866,14 @@ On first startup, gatekeeper checks for legacy files:
 
 ### Panel-Server Refactoring
 
-- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.5.0`)
+- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.6.0`)
 - `lib/access-control-sync.js` → removed (gatekeeper handles authorization at nginx layer, no more Authelia config rewriting for per-user access rules)
 - `routes/user-access.js` → simplified, delegates grant CRUD to gatekeeper
 - Tunnel creation/update routes → call gatekeeper for access mode changes
 
 ### Installer Updates (create-lamaste)
 
-- Install `@lamalibre/lamaste-gatekeeper@4.5.0` package
+- Install `@lamalibre/lamaste-gatekeeper@4.6.0` package
 - Create `/etc/lamalibre/lamaste/groups.json` (empty initial state)
 - Create `/etc/lamalibre/lamaste/access-grants.json` (empty or migrated)
 - Create `lamalibre-lamaste-gatekeeper.service` systemd unit

package/vendor/docs/identity-directory-design.md

@@ -1,7 +1,7 @@
 # Lamaste Identity Directory — Design Document
 
 > **Status:** design, 2026-10-13. Partly implemented in Lamaste 4.5 for agent-hosted plugins — see [Status](#status-4-5-slice-6).
-> **Package:** `@lamalibre/lamaste-identity@4.5.0` (completes the existing SDK).
+> **Package:** `@lamalibre/lamaste-identity@4.6.0` (completes the existing SDK).
 > **Companions:** `gatekeeper-design.md` (authorization),
 > `plugin-development/design/agent-hosted-app-plugins.md` (app plugins).
 
@@ -16,7 +16,7 @@ Slice 6 of the agent-hosted app plugins (`plugin-development/design/agent-hosted
 - **The manifest `identity` block** (roles, `attributes` ⊆ `displayName`, `email`) for agent-hosted plugins with an agent half, inside the approval digest when present; an update that adds or removes a role or widens the attributes waits for an administrator (`identity.changed`) — auto-approve never covers it.
 - **Entitlements** are Gatekeeper plugin grants with `context.roles`, checked against the manifest; roleless grants never count. `user-plugin-access.json` is **not** migrated: it still gates the desktop's enrolment, not requests.
 - **The audience** per plugin, materialized and recomputed after every panel-side change, every minute and at start.
-- **The feed is pushed, not pulled.** An agent half cannot reach the panel, so the panel sends the data itself through the internal tunnel — `POST /admin/identity/notify`, then `/admin/identity/changes` batches, their changes sealed to the request (AES-256-GCM under a key derived from the installation secret) — with replay from 0 as the snapshot and a daily reconcile whose mismatches are audited. A plugin's users reach it only once its half has applied the feed up to the head. The subscriber is `createIdentityProjection` + `createIdentityHandlers` in `@lamalibre/lamaste@4.5.0/agent`, not an `IdentitySubscriber` in this SDK.
+- **The feed is pushed, not pulled.** An agent half cannot reach the panel, so the panel sends the data itself through the internal tunnel — `POST /admin/identity/notify`, then `/admin/identity/changes` batches, their changes sealed to the request (AES-256-GCM under a key derived from the installation secret) — with replay from 0 as the snapshot and a daily reconcile whose mismatches are audited. A plugin's users reach it only once its half has applied the feed up to the head. The subscriber is `createIdentityProjection` + `createIdentityHandlers` in `@lamalibre/lamaste@4.6.0/agent`, not an `IdentitySubscriber` in this SDK.
 - **Identity in requests, for agent-hosted plugins:** a tunnel bound as a plugin's user surface serves `/api/<route>/app/*`; Gatekeeper attests the session's username to the panel, and the panel forwards to the agent half with `{ type: "user", userId, username, roles }` in the HMAC caller assertion — not a JWT ([question 6](#open-questions)).
 
 **Not yet:**
@@ -201,7 +201,7 @@ and compares it with the local projection (by `userId` and `version`). It
 applies differences and logs how many it found — a non-zero count on a
 healthy system is a bug in the change feed and is reported to the panel.
 
-## SDK (`@lamalibre/lamaste-identity@4.5.0`)
+## SDK (`@lamalibre/lamaste-identity@4.6.0`)
 
 Today's surface stays; three pieces are added.
 

package/vendor/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-docs",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "private": true,
   "description": "Lamaste documentation — markdown files served by the panel and published to GitHub Pages",
   "type": "module",