@lamalibre/create-lamaste 4.5.0 → 4.7.0

package/vendor/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-docs",
-  "version": "4.5.0",
+  "version": "4.7.0",
   "private": true,
   "description": "Lamaste documentation — markdown files served by the panel and published to GitHub Pages",
   "type": "module",

package/vendor/docs/todo/lib-cli-desktop-refactor.md

@@ -29,7 +29,7 @@ feria                        dev registry — OUT OF SCOPE, do not touch
 
 ### Naming Rules
 
-- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.5.0'`. No `-lib` suffix.
+- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.7.0'`. No `-lib` suffix.
 - **`-d` suffix** for daemons — Unix convention (`httpd`, `sshd`, `mongod`). Instantly signals "long-running process".
 - **`-ui`** for React component libraries — universal term, avoids "serverd serves the panel" tautology.
 - **`create-*`** for all npx one-shot tools — the one npm convention everyone knows.
@@ -74,24 +74,24 @@ lamaste                              core library (types, constants, schemas, pl
 
 | #   | Package (npm name)                  | Type        | Depends on | Purpose                                                                                                             |
 | --- | ----------------------------------- | ----------- | ---------- | ------------------------------------------------------------------------------------------------------------------- |
-| 1   | `@lamalibre/lamaste@4.5.0`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.5.0/agent` — agent domain logic                                                            |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.5.0/server` — server domain logic                                                          |
-| 2   | `@lamalibre/lamaste-agent@4.5.0`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
-| 3   | `@lamalibre/lamaste-agentd@4.5.0`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
-| 4   | `@lamalibre/lamaste-agent-ui@4.5.0`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
-| 5   | `@lamalibre/lamaste-server@4.5.0`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
-| 6   | `@lamalibre/lamaste-serverd@4.5.0`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
-| 7   | `@lamalibre/lamaste-server-ui@4.5.0`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
-| 8   | `@lamalibre/lamaste@4.5.0-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
-| 9   | `@lamalibre/lamaste-cloud@4.5.0`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
-| 10  | `@lamalibre/lamaste-tickets@4.5.0`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
-| 11  | `@lamalibre/lamaste-identity@4.5.0`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
-| 12  | `@lamalibre/create-lamaste@4.5.0`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
-| 13  | `@lamalibre/create-lamaste-agent@4.5.0`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
-| 14  | `@lamalibre/create-lamaste-desktop@4.5.0` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
-| 15  | `@lamalibre/create-lamaste-admin@4.5.0`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
-| 16  | `@lamalibre/create-lamaste-e2e@4.5.0`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
+| 1   | `@lamalibre/lamaste@4.7.0`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.7.0/agent` — agent domain logic                                                            |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.7.0/server` — server domain logic                                                          |
+| 2   | `@lamalibre/lamaste-agent@4.7.0`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
+| 3   | `@lamalibre/lamaste-agentd@4.7.0`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
+| 4   | `@lamalibre/lamaste-agent-ui@4.7.0`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
+| 5   | `@lamalibre/lamaste-server@4.7.0`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
+| 6   | `@lamalibre/lamaste-serverd@4.7.0`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
+| 7   | `@lamalibre/lamaste-server-ui@4.7.0`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
+| 8   | `@lamalibre/lamaste@4.7.0-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
+| 9   | `@lamalibre/lamaste-cloud@4.7.0`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
+| 10  | `@lamalibre/lamaste-tickets@4.7.0`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
+| 11  | `@lamalibre/lamaste-identity@4.7.0`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
+| 12  | `@lamalibre/create-lamaste@4.7.0`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
+| 13  | `@lamalibre/create-lamaste-agent@4.7.0`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
+| 14  | `@lamalibre/create-lamaste-desktop@4.7.0` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
+| 15  | `@lamalibre/create-lamaste-admin@4.7.0`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
+| 16  | `@lamalibre/create-lamaste-e2e@4.7.0`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
 | 17  | `@lamalibre/feria`                  | dev tool    | —          | Dev registry + release runner. **Out of scope — do not touch in this refactor**                                     |
 
 ### Rename Map (1.x → 2.0.0)
@@ -116,7 +116,7 @@ The core library uses **subpath exports** to provide domain-specific entry point
 
 ```json
 {
-  "name": "@lamalibre/lamaste@4.5.0",
+  "name": "@lamalibre/lamaste@4.7.0",
   "exports": {
     ".": "./dist/index.js",
     "./agent": "./dist/agent/index.js",
@@ -126,9 +126,9 @@ The core library uses **subpath exports** to provide domain-specific entry point
 ```
 
 ```typescript
-import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.5.0';
-import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.5.0/agent';
-import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.5.0/server';
+import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.7.0';
+import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.7.0/agent';
+import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.7.0/server';
 ```
 
 **Why subpath exports instead of three packages (`lamaste-lib`, `lamaste-lib-agent`, `lamaste-lib-server`):**
@@ -149,7 +149,7 @@ import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.5.0/server';
 
 | Layer                    | Agent side                                      | Server side                                    |
 | ------------------------ | ----------------------------------------------- | ---------------------------------------------- |
-| **Domain logic**         | `@lamalibre/lamaste@4.5.0/agent`                      | `@lamalibre/lamaste@4.5.0/server`                    |
+| **Domain logic**         | `@lamalibre/lamaste@4.7.0/agent`                      | `@lamalibre/lamaste@4.7.0/server`                    |
 | **Operational CLI**      | `lamaste-agent`                                 | `lamaste-server` (new)                         |
 | **Long-running daemon**  | `lamalibre-lamaste-agentd` on :9393 (extracted) | `lamalibre-lamaste-serverd` on :3100 (renamed) |
 | **UI components**        | `lamaste-agent-ui` (renamed)                    | `lamaste-server-ui` (merged)                   |
@@ -471,7 +471,7 @@ The Rust backend has both `commands.rs` (legacy) and `agents.rs` (multi-agent).
 
 Create `packages/lamaste/` (TypeScript) with subpath exports:
 
-**Root (`@lamalibre/lamaste@4.5.0`):**
+**Root (`@lamalibre/lamaste@4.7.0`):**
 
 - Types: `AdminClient`, `AgentClient` TypeScript interfaces, plugin manifest types, capability types
 - Constants: Reserved API prefixes, curated plugin list, capability names
@@ -479,7 +479,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Plugin Host: Fastify plugin for plugin route mounting, bundle serving, disabled handler (unified from three routers)
 - File Helpers: Atomic write (temp → fsync → rename), promise-chain mutex
 
-**Agent subpath (`@lamalibre/lamaste@4.5.0/agent`):**
+**Agent subpath (`@lamalibre/lamaste@4.7.0/agent`):**
 
 - Platform: Path helpers, platform detection (from `platform.js`)
 - Registry: Agent registry CRUD, label validation, legacy migration (from `registry.js`)
@@ -491,7 +491,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Server Registry: servers.json and storage-servers.json CRUD (new — from Rust `cloud.rs`)
 - Mode: Server mode and admin cert file operations (new — from Rust `mode.rs`)
 
-**Server subpath (`@lamalibre/lamaste@4.5.0/server`):**
+**Server subpath (`@lamalibre/lamaste@4.7.0/server`):**
 
 - Plugins: Server-side plugin lifecycle (uses shared schema from root)
 - Tunnels: Tunnel creation workflow with rollback (from `routes/tunnels.js`)

package/vendor/gatekeeper/dist/index.d.ts

@@ -1,9 +1,9 @@
-export type { Group, GroupState, CreateGroupOptions, UpdateGroupOptions, DeleteGroupResult, Grant, GrantState, CreateGrantOptions, GrantFilter, AccessAllowed, AccessDenied, AccessResult, AccessRequestTemplates, TemplateOptions, GatekeeperSettings, AccessRequestEntry, TunnelInfo, TunnelUserSurfaceInfo, PluginTunnelTarget, AutheliaSession, GatekeeperLogger, } from './lib/types.js';
-export { PRINCIPAL_TYPES, RESOURCE_TYPES, ACCESS_MODES, RESERVED_GROUP_NAMES, MAX_GROUPS, MAX_GRANTS, GRANT_RETENTION_MS, SESSION_CACHE_TTL_MS, GROUP_NAME_REGEX, MAX_GROUP_NAME_LENGTH, MIN_GROUP_NAME_LENGTH, DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, ACCESS_LOG_FILE, AUTHELIA_VERIFY_URL, GATEKEEPER_PORT, } from './lib/constants.js';
+export type { Group, GroupState, CreateGroupOptions, UpdateGroupOptions, DeleteGroupResult, Grant, GrantState, CreateGrantOptions, GrantFilter, AccessAllowed, AccessDenied, AccessResult, AccessRequestTemplates, TemplateOptions, GatekeeperSettings, AccessRequestEntry, TunnelInfo, PluginTunnelTarget, AutheliaSession, GatekeeperLogger, } from './lib/types.js';
+export { PRINCIPAL_TYPES, RESOURCE_TYPES, ACCESS_MODES, RESERVED_GROUP_NAMES, MAX_GROUPS, MAX_GRANTS, GRANT_RETENTION_MS, SESSION_CACHE_TTL_MS, GROUP_NAME_REGEX, MAX_GROUP_NAME_LENGTH, MIN_GROUP_NAME_LENGTH, DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, TUNNELS_FILE, SITES_FILE, ACCESS_LOG_FILE, AUTHELIA_VERIFY_URL, GATEKEEPER_PORT, } from './lib/constants.js';
 export type { PrincipalType, ResourceType, AccessMode } from './lib/constants.js';
 export { createGroup, listGroups, getGroup, updateGroup, deleteGroup, addMembers, removeMembers, getGroupsForUser, } from './lib/groups.js';
 export { createGrant, listGrants, getGrant, revokeGrant, consumeGrant, removeGrantsByPredicate, removeGrantsByPrincipal, } from './lib/grants.js';
-export { checkAccess } from './lib/authz.js';
+export { checkAccess, isPluginAudienceMember } from './lib/authz.js';
 export { tunnelInfoFromState } from './lib/tunnels.js';
 export { getAccessRequestTemplates, buildAccessRequestPage } from './lib/templates.js';
 export { migrateFromLegacy } from './lib/migration.js';

package/vendor/gatekeeper/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGlF,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGlF,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}

package/vendor/gatekeeper/dist/index.js

@@ -1,11 +1,11 @@
 // Constants
-export { PRINCIPAL_TYPES, RESOURCE_TYPES, ACCESS_MODES, RESERVED_GROUP_NAMES, MAX_GROUPS, MAX_GRANTS, GRANT_RETENTION_MS, SESSION_CACHE_TTL_MS, GROUP_NAME_REGEX, MAX_GROUP_NAME_LENGTH, MIN_GROUP_NAME_LENGTH, DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, ACCESS_LOG_FILE, AUTHELIA_VERIFY_URL, GATEKEEPER_PORT, } from './lib/constants.js';
+export { PRINCIPAL_TYPES, RESOURCE_TYPES, ACCESS_MODES, RESERVED_GROUP_NAMES, MAX_GROUPS, MAX_GRANTS, GRANT_RETENTION_MS, SESSION_CACHE_TTL_MS, GROUP_NAME_REGEX, MAX_GROUP_NAME_LENGTH, MIN_GROUP_NAME_LENGTH, DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, TUNNELS_FILE, SITES_FILE, ACCESS_LOG_FILE, AUTHELIA_VERIFY_URL, GATEKEEPER_PORT, } from './lib/constants.js';
 // Groups
 export { createGroup, listGroups, getGroup, updateGroup, deleteGroup, addMembers, removeMembers, getGroupsForUser, } from './lib/groups.js';
 // Grants
 export { createGrant, listGrants, getGrant, revokeGrant, consumeGrant, removeGrantsByPredicate, removeGrantsByPrincipal, } from './lib/grants.js';
 // Authorization
-export { checkAccess } from './lib/authz.js';
+export { checkAccess, isPluginAudienceMember } from './lib/authz.js';
 // The tunnels Gatekeeper authorizes, as it reads them from tunnels.json
 export { tunnelInfoFromState } from './lib/tunnels.js';
 // Templates

package/vendor/gatekeeper/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAyBA,YAAY;AACZ,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAI5B,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,gBAAgB;AAChB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,wEAAwE;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,YAAY;AACZ,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,YAAY;AACZ,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAI5B,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,SAAS;AACT,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,gBAAgB;AAChB,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAErE,wEAAwE;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,YAAY;AACZ,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}

package/vendor/gatekeeper/dist/lib/authz.d.ts

@@ -13,4 +13,13 @@ import type { AccessResult, TemplateOptions } from './types.js';
  * @returns AccessResult indicating allowed/denied with templates if denied
  */
 export declare function checkAccess(username: string, resourceType: string, resourceId: string, templateOptions?: TemplateOptions): Promise<AccessResult>;
+/**
+ * Whether `username` is in the audience of the plugin at `route`: an
+ * entitlement — a `plugin` grant on the route with roles — to the user or
+ * to one of their Lamaste groups. What a plugin's web surface asks before it
+ * serves the shell; the panel decides again, from its directory, on every
+ * request to the plugin's API (a disabled or removed user, a plugin not
+ * ready).
+ */
+export declare function isPluginAudienceMember(username: string, route: string): Promise<boolean>;
 //# sourceMappingURL=authz.d.ts.map

package/vendor/gatekeeper/dist/lib/authz.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/lib/authz.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,YAAY,CAAC,CA8BvB"}
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/lib/authz.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,YAAY,CAAC,CA8BvB;AAeD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9F"}

package/vendor/gatekeeper/dist/lib/authz.js

@@ -39,4 +39,35 @@ export async function checkAccess(username, resourceType, resourceId, templateOp
         templates,
     };
 }
+/**
+ * The roles a grant carries as an entitlement — its `context.roles` when
+ * that is a non-empty list of strings — or null. The panel's rule
+ * (`entitlements.js` `grantRoles`): a grant without roles (a desktop's
+ * local-install grant, one migrated from `user-plugin-access.json`) never
+ * makes anyone a member of a plugin's audience.
+ */
+function entitlementRoles(context) {
+    const roles = context?.['roles'];
+    if (!Array.isArray(roles) || roles.length === 0)
+        return null;
+    return roles.every((role) => typeof role === 'string') ? roles : null;
+}
+/**
+ * Whether `username` is in the audience of the plugin at `route`: an
+ * entitlement — a `plugin` grant on the route with roles — to the user or
+ * to one of their Lamaste groups. What a plugin's web surface asks before it
+ * serves the shell; the panel decides again, from its directory, on every
+ * request to the plugin's API (a disabled or removed user, a plugin not
+ * ready).
+ */
+export async function isPluginAudienceMember(username, route) {
+    const entitlements = (await listGrants({ resourceType: 'plugin', resourceId: route })).filter((g) => entitlementRoles(g.context) !== null);
+    if (entitlements.some((g) => g.principalType === 'user' && g.principalId === username)) {
+        return true;
+    }
+    if (!entitlements.some((g) => g.principalType === 'group'))
+        return false;
+    const groups = await getGroupsForUser(username);
+    return entitlements.some((g) => g.principalType === 'group' && groups.includes(g.principalId));
+}
 //# sourceMappingURL=authz.js.map

package/vendor/gatekeeper/dist/lib/authz.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/lib/authz.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAG3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,YAAoB,EACpB,UAAkB,EAClB,eAAiC;IAEjC,wCAAwC;IACxC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;IAEtE,6BAA6B;IAC7B,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAChE,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QAC9E,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAEnF,OAAO;QACL,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE;QAChD,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/lib/authz.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAG3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,YAAoB,EACpB,UAAkB,EAClB,eAAiC;IAEjC,wCAAwC;IACxC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;IAEtE,6BAA6B;IAC7B,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAChE,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QAC9E,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAEnF,OAAO;QACL,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE;QAChD,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,OAA4C;IACpE,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,KAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,KAAa;IAC1E,MAAM,YAAY,GAAG,CAAC,MAAM,UAAU,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAC3F,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAC5C,CAAC;IACF,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AACjG,CAAC"}

package/vendor/gatekeeper/dist/lib/constants.d.ts

@@ -5,9 +5,10 @@ export declare const PRINCIPAL_TYPES: readonly ["user", "group"];
 export type PrincipalType = (typeof PRINCIPAL_TYPES)[number];
 /**
  * Built-in resource types. The grant system is extensible — new resource types
- * can be added without schema changes.
+ * can be added without schema changes. A `site` grant opens a restricted
+ * plugin-owned site (a plugin's web surface) to its holder.
  */
-export declare const RESOURCE_TYPES: readonly ["tunnel", "plugin"];
+export declare const RESOURCE_TYPES: readonly ["tunnel", "plugin", "site"];
 export type ResourceType = (typeof RESOURCE_TYPES)[number];
 /**
  * Tunnel access modes.
@@ -63,6 +64,8 @@ export declare const DEFAULT_DATA_DIR = "/etc/lamalibre/lamaste";
 export declare const GROUPS_FILE = "groups.json";
 export declare const GRANTS_FILE = "access-grants.json";
 export declare const SETTINGS_FILE = "gatekeeper.json";
+export declare const TUNNELS_FILE = "tunnels.json";
+export declare const SITES_FILE = "sites.json";
 export declare const ACCESS_LOG_FILE = "access-request-log.json";
 /**
  * Authelia verify endpoint (localhost).

package/vendor/gatekeeper/dist/lib/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,eAAe,4BAA6B,CAAC;AAC1D,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,cAAc,+BAAgC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,YAAY,oDAAqD,CAAC;AAC/E,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,6CAA8C,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,UAAU,MAAM,CAAC;AAE9B;;GAEG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B;;GAEG;AACH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAA2B,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAoC,CAAC;AAElE;;GAEG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;GAEG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AAEzD;;GAEG;AACH,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,eAAe,4BAA4B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,iDAAiD,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,eAAe,4BAA6B,CAAC;AAC1D,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,cAAc,uCAAwC,CAAC;AACpE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,YAAY,oDAAqD,CAAC;AAC/E,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,6CAA8C,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,UAAU,MAAM,CAAC;AAE9B;;GAEG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B;;GAEG;AACH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAA2B,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAoC,CAAC;AAElE;;GAEG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;GAEG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AAEzD;;GAEG;AACH,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,eAAe,4BAA4B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,iDAAiD,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC"}

package/vendor/gatekeeper/dist/lib/constants.js

@@ -4,9 +4,10 @@
 export const PRINCIPAL_TYPES = ['user', 'group'];
 /**
  * Built-in resource types. The grant system is extensible — new resource types
- * can be added without schema changes.
+ * can be added without schema changes. A `site` grant opens a restricted
+ * plugin-owned site (a plugin's web surface) to its holder.
  */
-export const RESOURCE_TYPES = ['tunnel', 'plugin'];
+export const RESOURCE_TYPES = ['tunnel', 'plugin', 'site'];
 /**
  * Tunnel access modes.
  */
@@ -60,6 +61,8 @@ export const DEFAULT_DATA_DIR = '/etc/lamalibre/lamaste';
 export const GROUPS_FILE = 'groups.json';
 export const GRANTS_FILE = 'access-grants.json';
 export const SETTINGS_FILE = 'gatekeeper.json';
+export const TUNNELS_FILE = 'tunnels.json';
+export const SITES_FILE = 'sites.json';
 export const ACCESS_LOG_FILE = 'access-request-log.json';
 /**
  * Authelia verify endpoint (localhost).

package/vendor/gatekeeper/dist/lib/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAG1D;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG5D;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAU,CAAC;AAG/E;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAU,CAAC;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAE9B;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAE/B;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAEzD;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,8CAA8C,CAAC;AAElF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAG1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAGpE;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAU,CAAC;AAG/E;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAU,CAAC;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAE9B;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAE/B;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAEzD;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,8CAA8C,CAAC;AAElF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC"}

package/vendor/gatekeeper/dist/lib/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAcrF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjE;AA+HD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,EAC3B,YAAY,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC5E,OAAO,CAAC,KAAK,CAAC,CAmEhB;AAED,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAkBhF;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAIrE;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAiCjE;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,GACpC,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,GAAG,OAAO,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,EACrC,OAAO,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAgCpF"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAcrF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjE;AA8HD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,EAC3B,YAAY,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC5E,OAAO,CAAC,KAAK,CAAC,CAsEhB;AAED,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAkBhF;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAIrE;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAiCjE;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,GACpC,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,GAAG,OAAO,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,EACrC,OAAO,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAsCpF"}

package/vendor/gatekeeper/dist/lib/grants.js

@@ -38,7 +38,11 @@ async function getStmts() {
         deleteById: db.prepare('DELETE FROM access_grants WHERE grant_id = ?'),
         // Retention sweep: prune consumed grants past GRANT_RETENTION_MS. The
         // matching index (idx_grants_used_used_at) covers the predicate.
-        deleteConsumedBefore: db.prepare('DELETE FROM access_grants WHERE used = 1 AND used_at IS NOT NULL AND used_at < ?'),
+        // Only local plugin grants are ever consumed (a desktop enrolment);
+        // every other grant is access, kept until it is revoked.
+        deleteConsumedBefore: db.prepare(`DELETE FROM access_grants WHERE used = 1 AND used_at IS NOT NULL AND used_at < ?
+         AND resource_type = 'plugin'
+         AND coalesce(json_extract(context, '$.target'), 'local') = 'local'`),
         begin: db.prepare('BEGIN IMMEDIATE'),
         commit: db.prepare('COMMIT'),
         rollback: db.prepare('ROLLBACK'),
@@ -72,18 +76,13 @@ function pruneStaleGrants(s) {
     s.deleteConsumedBefore.run(cutoff);
 }
 /**
- * Check if a grant should be auto-consumed on creation.
- * Tunnel grants and agent-side plugin grants are auto-consumed.
- * Local plugin grants start unused (consumed on enrollment).
+ * Whether a grant is consumable: a local plugin grant, consumed by its
+ * desktop enrolment. Every other grant is access, never consumed.
  */
-function shouldAutoConsume(options) {
-    if (options.resourceType === 'tunnel')
-        return true;
-    if (options.resourceType === 'plugin') {
-        const target = options.context?.['target'] ?? 'local';
-        return target.startsWith('agent:');
-    }
-    return true;
+function isConsumable(grant) {
+    if (grant.resourceType !== 'plugin')
+        return false;
+    return (grant.context['target'] ?? 'local') === 'local';
 }
 /**
  * Check if two grants are duplicates (same principal + resource + context).
@@ -124,7 +123,10 @@ export async function createGrant(options, initialState) {
             throw Object.assign(new Error('Duplicate grant: a grant with the same principal, resource, and context already exists'), { statusCode: 409 });
         }
         const now = new Date().toISOString();
-        const used = initialState?.used ?? shouldAutoConsume(options);
+        // Created unused: a local plugin grant is consumed by its desktop
+        // enrolment; every other grant is access, never consumed, so the
+        // retention sweep never deletes it.
+        const used = initialState?.used ?? false;
         const createdAt = initialState?.createdAt ?? now;
         const usedAt = initialState?.usedAt !== undefined ? initialState.usedAt : used ? now : null;
         const grant = {
@@ -297,6 +299,11 @@ export async function consumeGrant(grantId, username) {
         if (grant.principalType !== 'user' || grant.principalId !== username) {
             throw Object.assign(new Error('Grant does not belong to this user'), { statusCode: 403 });
         }
+        if (!isConsumable(grant)) {
+            throw Object.assign(new Error('Only a local plugin grant can be consumed'), {
+                statusCode: 409,
+            });
+        }
         if (grant.used) {
             throw Object.assign(new Error('Grant has already been consumed'), { statusCode: 409 });
         }

package/vendor/gatekeeper/dist/lib/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAKhD,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AACnE,4EAA4E;AAC5E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAI,EAAoB;IACnD,OAAO,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAmBD,IAAI,KAAK,GAAsB,IAAI,CAAC;AAEpC,KAAK,UAAU,QAAQ;IACrB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,KAAK,GAAG;QACN,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC;QACxE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC;QACxE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC;QAC/D,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;;;;KAIlB,CAAC;QACF,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC;QACzF,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,oBAAoB,EAAE,EAAE,CAAC,OAAO,CAC9B,kFAAkF,CACnF;QACD,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KACjC,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAkBD,SAAS,UAAU,CAAC,GAAa;IAC/B,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,aAAa,EAAE,GAAG,CAAC,cAA+B;QAClD,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA4B;QAC3D,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;QACpB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,OAAO;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,CAAa;IACrC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAA2B;IACpD,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,MAAM,GAAI,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAY,IAAI,OAAO,CAAC;QAClE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,CAAa,EAAE,CAAqB;IACvD,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,IAAI,KAAK,IAAI,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B,EAC3B,YAA6E;IAE7E,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAE3B,0EAA0E;QAC1E,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAEpB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAmB,CAAC;QACnD,IAAI,QAAQ,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,UAAU,WAAW,CAAC,EAAE;gBACjF,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,wFAAwF,CACzF,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC;QACjD,MAAM,MAAM,GAAG,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAE5F,MAAM,KAAK,GAAe;YACxB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;YAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,IAAI;YACJ,SAAS;YACT,MAAM;SACP,CAAC;QAEF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAClB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,CACb,CAAC;YACF,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAoB;IACnD,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;IACxD,IAAI,MAAM,GAAiB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEhD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;gBAChF,OAAO,KAAK,CAAC;YACf,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC3F,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAC9F,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YACxF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,gDAAgD;QAChD,IACE,KAAK,CAAC,YAAY,KAAK,QAAQ;YAC9B,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAY,KAAK,OAAO;YACjD,KAAK,CAAC,IAAI,EACV,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,EAAE;gBAC5E,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC;IAErC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAA+B,EAC/B,WAAmB;IAEnB,OAAO,uBAAuB,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,aAAa,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC,EACrC,OAAgC;IAEhC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAE5B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,qEAAqE;YACrE,sEAAsE;YACtE,iEAAiE;YACjE,iEAAiE;YACjE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,YAAY,EACd,CAAC,CAAC,UAAU,EACZ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EACzB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,MAAM,CACT,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAClE,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAKhD,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AACnE,4EAA4E;AAC5E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAI,EAAoB;IACnD,OAAO,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAmBD,IAAI,KAAK,GAAsB,IAAI,CAAC;AAEpC,KAAK,UAAU,QAAQ;IACrB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,KAAK,GAAG;QACN,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC;QACxE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC;QACxE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC;QAC/D,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;;;;KAIlB,CAAC;QACF,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC;QACzF,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,oEAAoE;QACpE,yDAAyD;QACzD,oBAAoB,EAAE,EAAE,CAAC,OAAO,CAC9B;;4EAEsE,CACvE;QACD,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KACjC,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAkBD,SAAS,UAAU,CAAC,GAAa;IAC/B,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,aAAa,EAAE,GAAG,CAAC,cAA+B;QAClD,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA4B;QAC3D,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;QACpB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,OAAO;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,CAAa;IACrC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAA8C;IAClE,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,CAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAwB,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,CAAa,EAAE,CAAqB;IACvD,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,IAAI,KAAK,IAAI,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B,EAC3B,YAA6E;IAE7E,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAE3B,0EAA0E;QAC1E,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAEpB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAmB,CAAC;QACnD,IAAI,QAAQ,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,UAAU,WAAW,CAAC,EAAE;gBACjF,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,wFAAwF,CACzF,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,kEAAkE;QAClE,iEAAiE;QACjE,oCAAoC;QACpC,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,KAAK,CAAC;QACzC,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC;QACjD,MAAM,MAAM,GAAG,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAE5F,MAAM,KAAK,GAAe;YACxB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;YAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,IAAI;YACJ,SAAS;YACT,MAAM;SACP,CAAC;QAEF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAClB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,CACb,CAAC;YACF,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAoB;IACnD,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;IACxD,IAAI,MAAM,GAAiB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEhD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;gBAChF,OAAO,KAAK,CAAC;YACf,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC3F,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAC9F,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YACxF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,gDAAgD;QAChD,IACE,KAAK,CAAC,YAAY,KAAK,QAAQ;YAC9B,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAY,KAAK,OAAO;YACjD,KAAK,CAAC,IAAI,EACV,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,EAAE;gBAC5E,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC;IAErC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAA+B,EAC/B,WAAmB;IAEnB,OAAO,uBAAuB,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,aAAa,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC,EACrC,OAAgC;IAEhC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAE5B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,qEAAqE;YACrE,sEAAsE;YACtE,iEAAiE;YACjE,iEAAiE;YACjE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,YAAY,EACd,CAAC,CAAC,UAAU,EACZ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EACzB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,MAAM,CACT,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAClE,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,EAAE;gBAC1E,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/vendor/gatekeeper/dist/lib/migrations/gatekeeper/0004_unconsume_access_grants.sql

@@ -0,0 +1,8 @@
+-- Only a local plugin grant is ever consumed (its desktop enrolment). Grants
+-- on tunnels, sites and agent-side plugins were created consumed, and the
+-- retention sweep deleted them 90 days later: access vanished silently. They
+-- are access, kept until revoked.
+UPDATE access_grants SET used = 0, used_at = NULL
+ WHERE used = 1
+   AND NOT (resource_type = 'plugin'
+            AND coalesce(json_extract(context, '$.target'), 'local') = 'local');

package/vendor/gatekeeper/dist/lib/secret.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Whether the presented management secret is Gatekeeper's, compared in
+ * constant time (both sides hashed first, so their lengths never show).
+ */
+export declare function secretMatches(presented: unknown, secret: string): boolean;
+//# sourceMappingURL=secret.d.ts.map

package/vendor/gatekeeper/dist/lib/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/lib/secret.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIzE"}

package/vendor/gatekeeper/dist/lib/secret.js

@@ -0,0 +1,12 @@
+import crypto from 'node:crypto';
+/**
+ * Whether the presented management secret is Gatekeeper's, compared in
+ * constant time (both sides hashed first, so their lengths never show).
+ */
+export function secretMatches(presented, secret) {
+    if (typeof presented !== 'string')
+        return false;
+    const digest = (value) => crypto.createHash('sha256').update(value).digest();
+    return crypto.timingSafeEqual(digest(presented), digest(secret));
+}
+//# sourceMappingURL=secret.js.map

package/vendor/gatekeeper/dist/lib/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/lib/secret.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB,EAAE,MAAc;IAC9D,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7F,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/vendor/gatekeeper/dist/lib/templates.d.ts

@@ -18,4 +18,24 @@ export declare function getAccessRequestTemplates(username: string, resourceName
  * @returns Full HTML page string
  */
 export declare function buildAccessRequestPage(username: string, resourceFqdn: string, options?: TemplateOptions): string;
+/**
+ * The page a signed-in user is answered with on a host of a domain they
+ * are not a member of (the multi-domain relay): no access request — the
+ * whole domain is closed to them — but who to ask, and a way to sign in as
+ * someone else. It names no user (Authelia's refusal carries none). Shares
+ * the access-request page's look. With `site`, the page of a static site
+ * that refused a signed-in user — for its domain or its own user list
+ * (Authelia's 403 does not say which).
+ *
+ * @param domain - The base domain the requested host is under; null when it
+ *   is under none (the page then links to no sign-in: there is none to trust)
+ * @param options - Optional admin contact info
+ * @param host - The requested hostname; `site` when the refusal is a static
+ *   site's (for its domain or its own user list)
+ * @returns Full HTML page string
+ */
+export declare function buildDomainRefusalPage(domain: string | null, options: TemplateOptions | undefined, { host, site }: {
+    host: string;
+    site?: boolean;
+}): string;
 //# sourceMappingURL=templates.d.ts.map

package/vendor/gatekeeper/dist/lib/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/lib/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,sBAAsB,CAmBxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,MAAM,CAmGR"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/lib/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAkB1E;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,sBAAsB,CAmBxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,MAAM,CAsFR;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,EAAE,eAAe,GAAG,SAAS,EACpC,EAAE,IAAI,EAAE,IAAY,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD,MAAM,CAkDR"}

package/vendor/gatekeeper/dist/lib/templates.js

@@ -1,3 +1,18 @@
+/** The look every page Gatekeeper serves shares: the panel's dark terminal style. */
+const BASE_CSS = `    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: ui-monospace, 'Cascadia Code', 'Source Code Pro', Menlo, Consolas, monospace;
+      background: #09090b; color: #e4e4e7;
+      min-height: 100vh; display: flex; align-items: center; justify-content: center;
+      padding: 1rem;
+    }
+    .card {
+      background: #18181b; border: 1px solid #27272a; border-radius: 0.75rem;
+      max-width: 560px; width: 100%; padding: 2rem;
+    }
+    .icon { font-size: 2.5rem; margin-bottom: 1rem; }
+    h1 { font-size: 1.25rem; color: #f4f4f5; margin-bottom: 0.5rem; }
+    .fqdn { color: #22d3ee; }`;
 /**
  * Generate pre-filled message templates for requesting access to a resource.
  *
@@ -44,20 +59,7 @@ export function buildAccessRequestPage(username, resourceFqdn, options) {
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Access Required — ${escapeHtml(resourceFqdn)}</title>
   <style>
-    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
-    body {
-      font-family: ui-monospace, 'Cascadia Code', 'Source Code Pro', Menlo, Consolas, monospace;
-      background: #09090b; color: #e4e4e7;
-      min-height: 100vh; display: flex; align-items: center; justify-content: center;
-      padding: 1rem;
-    }
-    .card {
-      background: #18181b; border: 1px solid #27272a; border-radius: 0.75rem;
-      max-width: 560px; width: 100%; padding: 2rem;
-    }
-    .icon { font-size: 2.5rem; margin-bottom: 1rem; }
-    h1 { font-size: 1.25rem; color: #f4f4f5; margin-bottom: 0.5rem; }
-    .fqdn { color: #22d3ee; }
+${BASE_CSS}
     .subtitle { color: #a1a1aa; font-size: 0.875rem; margin-bottom: 1.5rem; }
     .section-label {
       color: #71717a; font-size: 0.75rem; text-transform: uppercase;
@@ -132,6 +134,70 @@ ${escapeHtml(templates.email.body)}<button class="copy-btn" onclick="copyTemplat
 </body>
 </html>`;
 }
+/**
+ * The page a signed-in user is answered with on a host of a domain they
+ * are not a member of (the multi-domain relay): no access request — the
+ * whole domain is closed to them — but who to ask, and a way to sign in as
+ * someone else. It names no user (Authelia's refusal carries none). Shares
+ * the access-request page's look. With `site`, the page of a static site
+ * that refused a signed-in user — for its domain or its own user list
+ * (Authelia's 403 does not say which).
+ *
+ * @param domain - The base domain the requested host is under; null when it
+ *   is under none (the page then links to no sign-in: there is none to trust)
+ * @param options - Optional admin contact info
+ * @param host - The requested hostname; `site` when the refusal is a static
+ *   site's (for its domain or its own user list)
+ * @returns Full HTML page string
+ */
+export function buildDomainRefusalPage(domain, options, { host, site = false }) {
+    const adminContact = options?.adminContact ?? '';
+    const adminName = options?.adminName ?? 'your administrator';
+    const heading = domain === null || site
+        ? `Not allowed on <span class="fqdn">${escapeHtml(host)}</span>`
+        : `Not a member of <span class="fqdn">${escapeHtml(domain)}</span>`;
+    const explanation = domain === null
+        ? `Your account is signed in, but this host is under none of this relay's domains,
+      so nobody may open it.`
+        : site
+            ? `Your account is signed in, but it may not open this site: it is not a member of
+      ${escapeHtml(domain)}, or not one of the site's users.`
+            : `Your account is signed in, but it is not a member of this domain, so none of its
+      applications are open to it.`;
+    // Only a domain of this relay has a sign-in to send the user to; a host
+    // under none could name a stranger's.
+    const signOut = domain === null
+        ? ''
+        : `<p class="subtitle">
+      <a href="https://auth.${escapeAttr(domain)}/logout">Sign out</a> to sign in with another account.
+    </p>`;
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Not allowed — ${escapeHtml(domain ?? host)}</title>
+  <style>
+${BASE_CSS}
+    .subtitle { color: #a1a1aa; font-size: 0.875rem; margin-bottom: 1rem; }
+    .contact { color: #a1a1aa; font-size: 0.8125rem; margin-top: 1.5rem; }
+    a { color: #22d3ee; text-decoration: none; }
+    a:hover { text-decoration: underline; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="icon">&#128683;</div>
+    <h1>${heading}</h1>
+    <p class="subtitle">
+      ${explanation} Ask ${escapeHtml(adminName)} to add you if you should have access.
+    </p>
+    ${signOut}
+    ${adminContact ? `<p class="contact">Admin: <a href="mailto:${escapeAttr(adminContact)}">${escapeHtml(adminContact)}</a></p>` : ''}
+  </div>
+</body>
+</html>`;
+}
 function escapeHtml(str) {
     return str
         .replace(/&/g, '&amp;')