@lamalibre/create-lamaste 4.6.0 → 4.7.0

package/vendor/docs/gatekeeper-design.md

@@ -4,9 +4,9 @@
 
 ## Overview
 
-`@lamalibre/lamaste-gatekeeper@4.6.0` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
+`@lamalibre/lamaste-gatekeeper@4.7.0` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
 
-It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.6.0` — a solid library at the core, with a service, CLI, and desktop as consumers.
+It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.7.0` — a solid library at the core, with a service, CLI, and desktop as consumers.
 
 ---
 
@@ -206,7 +206,7 @@ The grant system is resource-agnostic. It doesn't know what a "tunnel" or "plugi
 
 ```js
 import { createGroup, listGroups, getGroup, updateGroup, deleteGroup,
-         addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.6.0';
+         addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.7.0';
 
 createGroup(name, { description?, createdBy? })
   // → { name, description, members: [], createdAt, createdBy }
@@ -242,7 +242,7 @@ getGroupsForUser(username)
 ### Grants
 
 ```js
-import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.6.0';
+import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.7.0';
 
 createGrant({ principalType, principalId, resourceType, resourceId, context? })
   // → grant object
@@ -269,7 +269,7 @@ revokeGrant(grantId)
 ### Authorization
 
 ```js
-import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.6.0';
+import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.7.0';
 
 checkAccess(username, resourceType, resourceId);
 // 1. Find direct user grants: principalType='user', principalId=username
@@ -284,7 +284,7 @@ checkAccess(username, resourceType, resourceId);
 ### Templates
 
 ```js
-import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.6.0';
+import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.7.0';
 
 getAccessRequestTemplates(username, resourceName, { adminContact?, domain? })
   // → {
@@ -866,14 +866,14 @@ On first startup, gatekeeper checks for legacy files:
 
 ### Panel-Server Refactoring
 
-- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.6.0`)
+- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.7.0`)
 - `lib/access-control-sync.js` → removed (gatekeeper handles authorization at nginx layer, no more Authelia config rewriting for per-user access rules)
 - `routes/user-access.js` → simplified, delegates grant CRUD to gatekeeper
 - Tunnel creation/update routes → call gatekeeper for access mode changes
 
 ### Installer Updates (create-lamaste)
 
-- Install `@lamalibre/lamaste-gatekeeper@4.6.0` package
+- Install `@lamalibre/lamaste-gatekeeper@4.7.0` package
 - Create `/etc/lamalibre/lamaste/groups.json` (empty initial state)
 - Create `/etc/lamalibre/lamaste/access-grants.json` (empty or migrated)
 - Create `lamalibre-lamaste-gatekeeper.service` systemd unit

package/vendor/docs/identity-directory-design.md

@@ -1,7 +1,7 @@
 # Lamaste Identity Directory — Design Document
 
 > **Status:** design, 2026-10-13. Partly implemented in Lamaste 4.5 for agent-hosted plugins — see [Status](#status-4-5-slice-6).
-> **Package:** `@lamalibre/lamaste-identity@4.6.0` (completes the existing SDK).
+> **Package:** `@lamalibre/lamaste-identity@4.7.0` (completes the existing SDK).
 > **Companions:** `gatekeeper-design.md` (authorization),
 > `plugin-development/design/agent-hosted-app-plugins.md` (app plugins).
 
@@ -16,7 +16,7 @@ Slice 6 of the agent-hosted app plugins (`plugin-development/design/agent-hosted
 - **The manifest `identity` block** (roles, `attributes` ⊆ `displayName`, `email`) for agent-hosted plugins with an agent half, inside the approval digest when present; an update that adds or removes a role or widens the attributes waits for an administrator (`identity.changed`) — auto-approve never covers it.
 - **Entitlements** are Gatekeeper plugin grants with `context.roles`, checked against the manifest; roleless grants never count. `user-plugin-access.json` is **not** migrated: it still gates the desktop's enrolment, not requests.
 - **The audience** per plugin, materialized and recomputed after every panel-side change, every minute and at start.
-- **The feed is pushed, not pulled.** An agent half cannot reach the panel, so the panel sends the data itself through the internal tunnel — `POST /admin/identity/notify`, then `/admin/identity/changes` batches, their changes sealed to the request (AES-256-GCM under a key derived from the installation secret) — with replay from 0 as the snapshot and a daily reconcile whose mismatches are audited. A plugin's users reach it only once its half has applied the feed up to the head. The subscriber is `createIdentityProjection` + `createIdentityHandlers` in `@lamalibre/lamaste@4.6.0/agent`, not an `IdentitySubscriber` in this SDK.
+- **The feed is pushed, not pulled.** An agent half cannot reach the panel, so the panel sends the data itself through the internal tunnel — `POST /admin/identity/notify`, then `/admin/identity/changes` batches, their changes sealed to the request (AES-256-GCM under a key derived from the installation secret) — with replay from 0 as the snapshot and a daily reconcile whose mismatches are audited. A plugin's users reach it only once its half has applied the feed up to the head. The subscriber is `createIdentityProjection` + `createIdentityHandlers` in `@lamalibre/lamaste@4.7.0/agent`, not an `IdentitySubscriber` in this SDK.
 - **Identity in requests, for agent-hosted plugins:** a tunnel bound as a plugin's user surface serves `/api/<route>/app/*`; Gatekeeper attests the session's username to the panel, and the panel forwards to the agent half with `{ type: "user", userId, username, roles }` in the HMAC caller assertion — not a JWT ([question 6](#open-questions)).
 
 **Not yet:**
@@ -201,7 +201,7 @@ and compares it with the local projection (by `userId` and `version`). It
 applies differences and logs how many it found — a non-zero count on a
 healthy system is a bug in the change feed and is reported to the panel.
 
-## SDK (`@lamalibre/lamaste-identity@4.6.0`)
+## SDK (`@lamalibre/lamaste-identity@4.7.0`)
 
 Today's surface stays; three pieces are added.