@lamalibre/create-lamaste 4.6.0 → 4.7.0

package/vendor/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-docs",
-  "version": "4.6.0",
+  "version": "4.7.0",
   "private": true,
   "description": "Lamaste documentation — markdown files served by the panel and published to GitHub Pages",
   "type": "module",

package/vendor/docs/todo/lib-cli-desktop-refactor.md

@@ -29,7 +29,7 @@ feria                        dev registry — OUT OF SCOPE, do not touch
 
 ### Naming Rules
 
-- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.6.0'`. No `-lib` suffix.
+- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.7.0'`. No `-lib` suffix.
 - **`-d` suffix** for daemons — Unix convention (`httpd`, `sshd`, `mongod`). Instantly signals "long-running process".
 - **`-ui`** for React component libraries — universal term, avoids "serverd serves the panel" tautology.
 - **`create-*`** for all npx one-shot tools — the one npm convention everyone knows.
@@ -74,24 +74,24 @@ lamaste                              core library (types, constants, schemas, pl
 
 | #   | Package (npm name)                  | Type        | Depends on | Purpose                                                                                                             |
 | --- | ----------------------------------- | ----------- | ---------- | ------------------------------------------------------------------------------------------------------------------- |
-| 1   | `@lamalibre/lamaste@4.6.0`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.6.0/agent` — agent domain logic                                                            |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.6.0/server` — server domain logic                                                          |
-| 2   | `@lamalibre/lamaste-agent@4.6.0`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
-| 3   | `@lamalibre/lamaste-agentd@4.6.0`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
-| 4   | `@lamalibre/lamaste-agent-ui@4.6.0`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
-| 5   | `@lamalibre/lamaste-server@4.6.0`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
-| 6   | `@lamalibre/lamaste-serverd@4.6.0`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
-| 7   | `@lamalibre/lamaste-server-ui@4.6.0`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
-| 8   | `@lamalibre/lamaste@4.6.0-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
-| 9   | `@lamalibre/lamaste-cloud@4.6.0`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
-| 10  | `@lamalibre/lamaste-tickets@4.6.0`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
-| 11  | `@lamalibre/lamaste-identity@4.6.0`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
-| 12  | `@lamalibre/create-lamaste@4.6.0`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
-| 13  | `@lamalibre/create-lamaste-agent@4.6.0`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
-| 14  | `@lamalibre/create-lamaste-desktop@4.6.0` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
-| 15  | `@lamalibre/create-lamaste-admin@4.6.0`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
-| 16  | `@lamalibre/create-lamaste-e2e@4.6.0`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
+| 1   | `@lamalibre/lamaste@4.7.0`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.7.0/agent` — agent domain logic                                                            |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.7.0/server` — server domain logic                                                          |
+| 2   | `@lamalibre/lamaste-agent@4.7.0`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
+| 3   | `@lamalibre/lamaste-agentd@4.7.0`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
+| 4   | `@lamalibre/lamaste-agent-ui@4.7.0`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
+| 5   | `@lamalibre/lamaste-server@4.7.0`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
+| 6   | `@lamalibre/lamaste-serverd@4.7.0`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
+| 7   | `@lamalibre/lamaste-server-ui@4.7.0`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
+| 8   | `@lamalibre/lamaste@4.7.0-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
+| 9   | `@lamalibre/lamaste-cloud@4.7.0`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
+| 10  | `@lamalibre/lamaste-tickets@4.7.0`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
+| 11  | `@lamalibre/lamaste-identity@4.7.0`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
+| 12  | `@lamalibre/create-lamaste@4.7.0`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
+| 13  | `@lamalibre/create-lamaste-agent@4.7.0`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
+| 14  | `@lamalibre/create-lamaste-desktop@4.7.0` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
+| 15  | `@lamalibre/create-lamaste-admin@4.7.0`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
+| 16  | `@lamalibre/create-lamaste-e2e@4.7.0`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
 | 17  | `@lamalibre/feria`                  | dev tool    | —          | Dev registry + release runner. **Out of scope — do not touch in this refactor**                                     |
 
 ### Rename Map (1.x → 2.0.0)
@@ -116,7 +116,7 @@ The core library uses **subpath exports** to provide domain-specific entry point
 
 ```json
 {
-  "name": "@lamalibre/lamaste@4.6.0",
+  "name": "@lamalibre/lamaste@4.7.0",
   "exports": {
     ".": "./dist/index.js",
     "./agent": "./dist/agent/index.js",
@@ -126,9 +126,9 @@ The core library uses **subpath exports** to provide domain-specific entry point
 ```
 
 ```typescript
-import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.6.0';
-import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.6.0/agent';
-import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.6.0/server';
+import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.7.0';
+import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.7.0/agent';
+import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.7.0/server';
 ```
 
 **Why subpath exports instead of three packages (`lamaste-lib`, `lamaste-lib-agent`, `lamaste-lib-server`):**
@@ -149,7 +149,7 @@ import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.6.0/server';
 
 | Layer                    | Agent side                                      | Server side                                    |
 | ------------------------ | ----------------------------------------------- | ---------------------------------------------- |
-| **Domain logic**         | `@lamalibre/lamaste@4.6.0/agent`                      | `@lamalibre/lamaste@4.6.0/server`                    |
+| **Domain logic**         | `@lamalibre/lamaste@4.7.0/agent`                      | `@lamalibre/lamaste@4.7.0/server`                    |
 | **Operational CLI**      | `lamaste-agent`                                 | `lamaste-server` (new)                         |
 | **Long-running daemon**  | `lamalibre-lamaste-agentd` on :9393 (extracted) | `lamalibre-lamaste-serverd` on :3100 (renamed) |
 | **UI components**        | `lamaste-agent-ui` (renamed)                    | `lamaste-server-ui` (merged)                   |
@@ -471,7 +471,7 @@ The Rust backend has both `commands.rs` (legacy) and `agents.rs` (multi-agent).
 
 Create `packages/lamaste/` (TypeScript) with subpath exports:
 
-**Root (`@lamalibre/lamaste@4.6.0`):**
+**Root (`@lamalibre/lamaste@4.7.0`):**
 
 - Types: `AdminClient`, `AgentClient` TypeScript interfaces, plugin manifest types, capability types
 - Constants: Reserved API prefixes, curated plugin list, capability names
@@ -479,7 +479,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Plugin Host: Fastify plugin for plugin route mounting, bundle serving, disabled handler (unified from three routers)
 - File Helpers: Atomic write (temp → fsync → rename), promise-chain mutex
 
-**Agent subpath (`@lamalibre/lamaste@4.6.0/agent`):**
+**Agent subpath (`@lamalibre/lamaste@4.7.0/agent`):**
 
 - Platform: Path helpers, platform detection (from `platform.js`)
 - Registry: Agent registry CRUD, label validation, legacy migration (from `registry.js`)
@@ -491,7 +491,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Server Registry: servers.json and storage-servers.json CRUD (new — from Rust `cloud.rs`)
 - Mode: Server mode and admin cert file operations (new — from Rust `mode.rs`)
 
-**Server subpath (`@lamalibre/lamaste@4.6.0/server`):**
+**Server subpath (`@lamalibre/lamaste@4.7.0/server`):**
 
 - Plugins: Server-side plugin lifecycle (uses shared schema from root)
 - Tunnels: Tunnel creation workflow with rollback (from `routes/tunnels.js`)

package/vendor/gatekeeper/dist/lib/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAcrF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjE;AA+HD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,EAC3B,YAAY,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC5E,OAAO,CAAC,KAAK,CAAC,CAmEhB;AAED,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAkBhF;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAIrE;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAiCjE;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,GACpC,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,GAAG,OAAO,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,EACrC,OAAO,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAgCpF"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAcrF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjE;AA8HD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,EAC3B,YAAY,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC5E,OAAO,CAAC,KAAK,CAAC,CAsEhB;AAED,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAkBhF;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAIrE;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAiCjE;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,GACpC,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,GAAG,OAAO,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,EACrC,OAAO,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAsCpF"}

package/vendor/gatekeeper/dist/lib/grants.js

@@ -38,7 +38,11 @@ async function getStmts() {
         deleteById: db.prepare('DELETE FROM access_grants WHERE grant_id = ?'),
         // Retention sweep: prune consumed grants past GRANT_RETENTION_MS. The
         // matching index (idx_grants_used_used_at) covers the predicate.
-        deleteConsumedBefore: db.prepare('DELETE FROM access_grants WHERE used = 1 AND used_at IS NOT NULL AND used_at < ?'),
+        // Only local plugin grants are ever consumed (a desktop enrolment);
+        // every other grant is access, kept until it is revoked.
+        deleteConsumedBefore: db.prepare(`DELETE FROM access_grants WHERE used = 1 AND used_at IS NOT NULL AND used_at < ?
+         AND resource_type = 'plugin'
+         AND coalesce(json_extract(context, '$.target'), 'local') = 'local'`),
         begin: db.prepare('BEGIN IMMEDIATE'),
         commit: db.prepare('COMMIT'),
         rollback: db.prepare('ROLLBACK'),
@@ -72,18 +76,13 @@ function pruneStaleGrants(s) {
     s.deleteConsumedBefore.run(cutoff);
 }
 /**
- * Check if a grant should be auto-consumed on creation.
- * Tunnel grants and agent-side plugin grants are auto-consumed.
- * Local plugin grants start unused (consumed on enrollment).
+ * Whether a grant is consumable: a local plugin grant, consumed by its
+ * desktop enrolment. Every other grant is access, never consumed.
  */
-function shouldAutoConsume(options) {
-    if (options.resourceType === 'tunnel')
-        return true;
-    if (options.resourceType === 'plugin') {
-        const target = options.context?.['target'] ?? 'local';
-        return target.startsWith('agent:');
-    }
-    return true;
+function isConsumable(grant) {
+    if (grant.resourceType !== 'plugin')
+        return false;
+    return (grant.context['target'] ?? 'local') === 'local';
 }
 /**
  * Check if two grants are duplicates (same principal + resource + context).
@@ -124,7 +123,10 @@ export async function createGrant(options, initialState) {
             throw Object.assign(new Error('Duplicate grant: a grant with the same principal, resource, and context already exists'), { statusCode: 409 });
         }
         const now = new Date().toISOString();
-        const used = initialState?.used ?? shouldAutoConsume(options);
+        // Created unused: a local plugin grant is consumed by its desktop
+        // enrolment; every other grant is access, never consumed, so the
+        // retention sweep never deletes it.
+        const used = initialState?.used ?? false;
         const createdAt = initialState?.createdAt ?? now;
         const usedAt = initialState?.usedAt !== undefined ? initialState.usedAt : used ? now : null;
         const grant = {
@@ -297,6 +299,11 @@ export async function consumeGrant(grantId, username) {
         if (grant.principalType !== 'user' || grant.principalId !== username) {
             throw Object.assign(new Error('Grant does not belong to this user'), { statusCode: 403 });
         }
+        if (!isConsumable(grant)) {
+            throw Object.assign(new Error('Only a local plugin grant can be consumed'), {
+                statusCode: 409,
+            });
+        }
         if (grant.used) {
             throw Object.assign(new Error('Grant has already been consumed'), { statusCode: 409 });
         }

package/vendor/gatekeeper/dist/lib/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAKhD,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AACnE,4EAA4E;AAC5E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAI,EAAoB;IACnD,OAAO,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAmBD,IAAI,KAAK,GAAsB,IAAI,CAAC;AAEpC,KAAK,UAAU,QAAQ;IACrB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,KAAK,GAAG;QACN,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC;QACxE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC;QACxE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC;QAC/D,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;;;;KAIlB,CAAC;QACF,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC;QACzF,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,oBAAoB,EAAE,EAAE,CAAC,OAAO,CAC9B,kFAAkF,CACnF;QACD,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KACjC,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAkBD,SAAS,UAAU,CAAC,GAAa;IAC/B,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,aAAa,EAAE,GAAG,CAAC,cAA+B;QAClD,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA4B;QAC3D,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;QACpB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,OAAO;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,CAAa;IACrC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAA2B;IACpD,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,MAAM,GAAI,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAY,IAAI,OAAO,CAAC;QAClE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,CAAa,EAAE,CAAqB;IACvD,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,IAAI,KAAK,IAAI,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B,EAC3B,YAA6E;IAE7E,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAE3B,0EAA0E;QAC1E,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAEpB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAmB,CAAC;QACnD,IAAI,QAAQ,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,UAAU,WAAW,CAAC,EAAE;gBACjF,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,wFAAwF,CACzF,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC;QACjD,MAAM,MAAM,GAAG,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAE5F,MAAM,KAAK,GAAe;YACxB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;YAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,IAAI;YACJ,SAAS;YACT,MAAM;SACP,CAAC;QAEF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAClB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,CACb,CAAC;YACF,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAoB;IACnD,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;IACxD,IAAI,MAAM,GAAiB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEhD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;gBAChF,OAAO,KAAK,CAAC;YACf,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC3F,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAC9F,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YACxF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,gDAAgD;QAChD,IACE,KAAK,CAAC,YAAY,KAAK,QAAQ;YAC9B,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAY,KAAK,OAAO;YACjD,KAAK,CAAC,IAAI,EACV,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,EAAE;gBAC5E,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC;IAErC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAA+B,EAC/B,WAAmB;IAEnB,OAAO,uBAAuB,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,aAAa,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC,EACrC,OAAgC;IAEhC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAE5B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,qEAAqE;YACrE,sEAAsE;YACtE,iEAAiE;YACjE,iEAAiE;YACjE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,YAAY,EACd,CAAC,CAAC,UAAU,EACZ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EACzB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,MAAM,CACT,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAClE,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAKhD,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AACnE,4EAA4E;AAC5E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAI,EAAoB;IACnD,OAAO,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAmBD,IAAI,KAAK,GAAsB,IAAI,CAAC;AAEpC,KAAK,UAAU,QAAQ;IACrB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,KAAK,GAAG;QACN,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC;QACxE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC;QACxE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC;QAC/D,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;;;;KAIlB,CAAC;QACF,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC;QACzF,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,oEAAoE;QACpE,yDAAyD;QACzD,oBAAoB,EAAE,EAAE,CAAC,OAAO,CAC9B;;4EAEsE,CACvE;QACD,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KACjC,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAkBD,SAAS,UAAU,CAAC,GAAa;IAC/B,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,aAAa,EAAE,GAAG,CAAC,cAA+B;QAClD,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA4B;QAC3D,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;QACpB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,OAAO;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,CAAa;IACrC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAA8C;IAClE,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,CAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAwB,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,CAAa,EAAE,CAAqB;IACvD,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,IAAI,KAAK,IAAI,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B,EAC3B,YAA6E;IAE7E,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAE3B,0EAA0E;QAC1E,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAEpB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAmB,CAAC;QACnD,IAAI,QAAQ,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,UAAU,WAAW,CAAC,EAAE;gBACjF,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,wFAAwF,CACzF,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,kEAAkE;QAClE,iEAAiE;QACjE,oCAAoC;QACpC,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,KAAK,CAAC;QACzC,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC;QACjD,MAAM,MAAM,GAAG,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAE5F,MAAM,KAAK,GAAe;YACxB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;YAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,IAAI;YACJ,SAAS;YACT,MAAM;SACP,CAAC;QAEF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAClB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,CACb,CAAC;YACF,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAoB;IACnD,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;IACxD,IAAI,MAAM,GAAiB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEhD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;gBAChF,OAAO,KAAK,CAAC;YACf,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC3F,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAC9F,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YACxF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,gDAAgD;QAChD,IACE,KAAK,CAAC,YAAY,KAAK,QAAQ;YAC9B,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAY,KAAK,OAAO;YACjD,KAAK,CAAC,IAAI,EACV,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,EAAE;gBAC5E,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC;IAErC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAA+B,EAC/B,WAAmB;IAEnB,OAAO,uBAAuB,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,aAAa,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC,EACrC,OAAgC;IAEhC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAE5B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,qEAAqE;YACrE,sEAAsE;YACtE,iEAAiE;YACjE,iEAAiE;YACjE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,YAAY,EACd,CAAC,CAAC,UAAU,EACZ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EACzB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,MAAM,CACT,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAClE,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,EAAE;gBAC1E,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/vendor/gatekeeper/dist/lib/migrations/gatekeeper/0004_unconsume_access_grants.sql

@@ -0,0 +1,8 @@
+-- Only a local plugin grant is ever consumed (its desktop enrolment). Grants
+-- on tunnels, sites and agent-side plugins were created consumed, and the
+-- retention sweep deleted them 90 days later: access vanished silently. They
+-- are access, kept until revoked.
+UPDATE access_grants SET used = 0, used_at = NULL
+ WHERE used = 1
+   AND NOT (resource_type = 'plugin'
+            AND coalesce(json_extract(context, '$.target'), 'local') = 'local');

package/vendor/gatekeeper/dist/lib/secret.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Whether the presented management secret is Gatekeeper's, compared in
+ * constant time (both sides hashed first, so their lengths never show).
+ */
+export declare function secretMatches(presented: unknown, secret: string): boolean;
+//# sourceMappingURL=secret.d.ts.map

package/vendor/gatekeeper/dist/lib/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/lib/secret.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIzE"}

package/vendor/gatekeeper/dist/lib/secret.js

@@ -0,0 +1,12 @@
+import crypto from 'node:crypto';
+/**
+ * Whether the presented management secret is Gatekeeper's, compared in
+ * constant time (both sides hashed first, so their lengths never show).
+ */
+export function secretMatches(presented, secret) {
+    if (typeof presented !== 'string')
+        return false;
+    const digest = (value) => crypto.createHash('sha256').update(value).digest();
+    return crypto.timingSafeEqual(digest(presented), digest(secret));
+}
+//# sourceMappingURL=secret.js.map

package/vendor/gatekeeper/dist/lib/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/lib/secret.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB,EAAE,MAAc;IAC9D,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7F,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/vendor/gatekeeper/dist/lib/templates.d.ts

@@ -18,4 +18,24 @@ export declare function getAccessRequestTemplates(username: string, resourceName
  * @returns Full HTML page string
  */
 export declare function buildAccessRequestPage(username: string, resourceFqdn: string, options?: TemplateOptions): string;
+/**
+ * The page a signed-in user is answered with on a host of a domain they
+ * are not a member of (the multi-domain relay): no access request — the
+ * whole domain is closed to them — but who to ask, and a way to sign in as
+ * someone else. It names no user (Authelia's refusal carries none). Shares
+ * the access-request page's look. With `site`, the page of a static site
+ * that refused a signed-in user — for its domain or its own user list
+ * (Authelia's 403 does not say which).
+ *
+ * @param domain - The base domain the requested host is under; null when it
+ *   is under none (the page then links to no sign-in: there is none to trust)
+ * @param options - Optional admin contact info
+ * @param host - The requested hostname; `site` when the refusal is a static
+ *   site's (for its domain or its own user list)
+ * @returns Full HTML page string
+ */
+export declare function buildDomainRefusalPage(domain: string | null, options: TemplateOptions | undefined, { host, site }: {
+    host: string;
+    site?: boolean;
+}): string;
 //# sourceMappingURL=templates.d.ts.map

package/vendor/gatekeeper/dist/lib/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/lib/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,sBAAsB,CAmBxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,MAAM,CAmGR"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/lib/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAkB1E;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,sBAAsB,CAmBxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,MAAM,CAsFR;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,EAAE,eAAe,GAAG,SAAS,EACpC,EAAE,IAAI,EAAE,IAAY,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD,MAAM,CAkDR"}

package/vendor/gatekeeper/dist/lib/templates.js

@@ -1,3 +1,18 @@
+/** The look every page Gatekeeper serves shares: the panel's dark terminal style. */
+const BASE_CSS = `    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: ui-monospace, 'Cascadia Code', 'Source Code Pro', Menlo, Consolas, monospace;
+      background: #09090b; color: #e4e4e7;
+      min-height: 100vh; display: flex; align-items: center; justify-content: center;
+      padding: 1rem;
+    }
+    .card {
+      background: #18181b; border: 1px solid #27272a; border-radius: 0.75rem;
+      max-width: 560px; width: 100%; padding: 2rem;
+    }
+    .icon { font-size: 2.5rem; margin-bottom: 1rem; }
+    h1 { font-size: 1.25rem; color: #f4f4f5; margin-bottom: 0.5rem; }
+    .fqdn { color: #22d3ee; }`;
 /**
  * Generate pre-filled message templates for requesting access to a resource.
  *
@@ -44,20 +59,7 @@ export function buildAccessRequestPage(username, resourceFqdn, options) {
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Access Required — ${escapeHtml(resourceFqdn)}</title>
   <style>
-    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
-    body {
-      font-family: ui-monospace, 'Cascadia Code', 'Source Code Pro', Menlo, Consolas, monospace;
-      background: #09090b; color: #e4e4e7;
-      min-height: 100vh; display: flex; align-items: center; justify-content: center;
-      padding: 1rem;
-    }
-    .card {
-      background: #18181b; border: 1px solid #27272a; border-radius: 0.75rem;
-      max-width: 560px; width: 100%; padding: 2rem;
-    }
-    .icon { font-size: 2.5rem; margin-bottom: 1rem; }
-    h1 { font-size: 1.25rem; color: #f4f4f5; margin-bottom: 0.5rem; }
-    .fqdn { color: #22d3ee; }
+${BASE_CSS}
     .subtitle { color: #a1a1aa; font-size: 0.875rem; margin-bottom: 1.5rem; }
     .section-label {
       color: #71717a; font-size: 0.75rem; text-transform: uppercase;
@@ -132,6 +134,70 @@ ${escapeHtml(templates.email.body)}<button class="copy-btn" onclick="copyTemplat
 </body>
 </html>`;
 }
+/**
+ * The page a signed-in user is answered with on a host of a domain they
+ * are not a member of (the multi-domain relay): no access request — the
+ * whole domain is closed to them — but who to ask, and a way to sign in as
+ * someone else. It names no user (Authelia's refusal carries none). Shares
+ * the access-request page's look. With `site`, the page of a static site
+ * that refused a signed-in user — for its domain or its own user list
+ * (Authelia's 403 does not say which).
+ *
+ * @param domain - The base domain the requested host is under; null when it
+ *   is under none (the page then links to no sign-in: there is none to trust)
+ * @param options - Optional admin contact info
+ * @param host - The requested hostname; `site` when the refusal is a static
+ *   site's (for its domain or its own user list)
+ * @returns Full HTML page string
+ */
+export function buildDomainRefusalPage(domain, options, { host, site = false }) {
+    const adminContact = options?.adminContact ?? '';
+    const adminName = options?.adminName ?? 'your administrator';
+    const heading = domain === null || site
+        ? `Not allowed on <span class="fqdn">${escapeHtml(host)}</span>`
+        : `Not a member of <span class="fqdn">${escapeHtml(domain)}</span>`;
+    const explanation = domain === null
+        ? `Your account is signed in, but this host is under none of this relay's domains,
+      so nobody may open it.`
+        : site
+            ? `Your account is signed in, but it may not open this site: it is not a member of
+      ${escapeHtml(domain)}, or not one of the site's users.`
+            : `Your account is signed in, but it is not a member of this domain, so none of its
+      applications are open to it.`;
+    // Only a domain of this relay has a sign-in to send the user to; a host
+    // under none could name a stranger's.
+    const signOut = domain === null
+        ? ''
+        : `<p class="subtitle">
+      <a href="https://auth.${escapeAttr(domain)}/logout">Sign out</a> to sign in with another account.
+    </p>`;
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Not allowed — ${escapeHtml(domain ?? host)}</title>
+  <style>
+${BASE_CSS}
+    .subtitle { color: #a1a1aa; font-size: 0.875rem; margin-bottom: 1rem; }
+    .contact { color: #a1a1aa; font-size: 0.8125rem; margin-top: 1.5rem; }
+    a { color: #22d3ee; text-decoration: none; }
+    a:hover { text-decoration: underline; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="icon">&#128683;</div>
+    <h1>${heading}</h1>
+    <p class="subtitle">
+      ${explanation} Ask ${escapeHtml(adminName)} to add you if you should have access.
+    </p>
+    ${signOut}
+    ${adminContact ? `<p class="contact">Admin: <a href="mailto:${escapeAttr(adminContact)}">${escapeHtml(adminContact)}</a></p>` : ''}
+  </div>
+</body>
+</html>`;
+}
 function escapeHtml(str) {
     return str
         .replace(/&/g, '&amp;')

package/vendor/gatekeeper/dist/lib/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/lib/templates.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,YAAoB,EACpB,OAAyB;IAEzB,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,eAAe,CAAC;IACxD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,OAAO;QACL,KAAK,EAAE;YACL,OAAO,EAAE,sBAAsB,YAAY,EAAE;YAC7C,IAAI,EACF,MAAM,SAAS,OAAO;gBACtB,iCAAiC,YAAY,KAAK;gBAClD,mBAAmB,QAAQ,MAAM;gBACjC,YAAY;SACf;QACD,KAAK,EAAE,+BAA+B,YAAY,wBAAwB,QAAQ,KAAK;QACvF,KAAK,EAAE,+BAA+B,YAAY,wBAAwB,QAAQ,KAAK;QACvF,QAAQ,EAAE,wBAAwB,YAAY,eAAe,QAAQ,YAAY;QACjF,OAAO,EAAE,sBAAsB,YAAY,IAAI,GAAG,aAAa,QAAQ,GAAG,WAAW,EAAE;KACxF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAyB;IAEzB,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,oBAAoB,CAAC;IAE7D,OAAO;;;;;6BAKoB,UAAU,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDAkDD,UAAU,CAAC,YAAY,CAAC;;;8CAG9B,UAAU,CAAC,QAAQ,CAAC;;;gBAGlD,UAAU,CAAC,SAAS,CAAC;;;;wDAImB,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;;EAEzF,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;;;+CAGa,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;;;kDAGxB,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;;MAE1E,YAAY,CAAC,CAAC,CAAC,6CAA6C,UAAU,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;QAkB9H,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/lib/templates.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,QAAQ,GAAG;;;;;;;;;;;;;8BAaa,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,YAAoB,EACpB,OAAyB;IAEzB,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,eAAe,CAAC;IACxD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,OAAO;QACL,KAAK,EAAE;YACL,OAAO,EAAE,sBAAsB,YAAY,EAAE;YAC7C,IAAI,EACF,MAAM,SAAS,OAAO;gBACtB,iCAAiC,YAAY,KAAK;gBAClD,mBAAmB,QAAQ,MAAM;gBACjC,YAAY;SACf;QACD,KAAK,EAAE,+BAA+B,YAAY,wBAAwB,QAAQ,KAAK;QACvF,KAAK,EAAE,+BAA+B,YAAY,wBAAwB,QAAQ,KAAK;QACvF,QAAQ,EAAE,wBAAwB,YAAY,eAAe,QAAQ,YAAY;QACjF,OAAO,EAAE,sBAAsB,YAAY,IAAI,GAAG,aAAa,QAAQ,GAAG,WAAW,EAAE;KACxF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAyB;IAEzB,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,oBAAoB,CAAC;IAE7D,OAAO;;;;;6BAKoB,UAAU,CAAC,YAAY,CAAC;;EAEnD,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDAmC0C,UAAU,CAAC,YAAY,CAAC;;;8CAG9B,UAAU,CAAC,QAAQ,CAAC;;;gBAGlD,UAAU,CAAC,SAAS,CAAC;;;;wDAImB,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;;EAEzF,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;;;+CAGa,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;;;kDAGxB,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;;MAE1E,YAAY,CAAC,CAAC,CAAC,6CAA6C,UAAU,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;QAkB9H,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAqB,EACrB,OAAoC,EACpC,EAAE,IAAI,EAAE,IAAI,GAAG,KAAK,EAAoC;IAExD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,oBAAoB,CAAC;IAC7D,MAAM,OAAO,GACX,MAAM,KAAK,IAAI,IAAI,IAAI;QACrB,CAAC,CAAC,qCAAqC,UAAU,CAAC,IAAI,CAAC,SAAS;QAChE,CAAC,CAAC,sCAAsC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;IACxE,MAAM,WAAW,GACf,MAAM,KAAK,IAAI;QACb,CAAC,CAAC;6BACqB;QACvB,CAAC,CAAC,IAAI;YACJ,CAAC,CAAC;QACF,UAAU,CAAC,MAAM,CAAC,mCAAmC;YACrD,CAAC,CAAC;mCACyB,CAAC;IAClC,wEAAwE;IACxE,sCAAsC;IACtC,MAAM,OAAO,GACX,MAAM,KAAK,IAAI;QACb,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;8BACsB,UAAU,CAAC,MAAM,CAAC;SACvC,CAAC;IACR,OAAO;;;;;yBAKgB,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;;EAEjD,QAAQ;;;;;;;;;;UAUA,OAAO;;QAET,WAAW,QAAQ,UAAU,CAAC,SAAS,CAAC;;MAE1C,OAAO;MACP,YAAY,CAAC,CAAC,CAAC,6CAA6C,UAAU,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;;;QAG9H,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC"}

package/vendor/gatekeeper/dist/server/index.d.ts

@@ -1,17 +1,21 @@
 import '../boot.js';
 import Fastify from 'fastify';
-import type { RelaySigner, UserSurfaceHost } from '@lamalibre/lamaste';
+import type { DomainsIndex, RelaySigner, UserSurfaceHost } from '@lamalibre/lamaste';
 import type { TunnelInfo, GatekeeperSettings, AutheliaSession } from '../lib/types.js';
 export declare function createServer(): Promise<ReturnType<typeof Fastify>>;
 declare module 'fastify' {
     interface FastifyInstance {
         getTunnels(): TunnelInfo[];
         getUserSurfaceHosts(): UserSurfaceHost[];
+        /** The domains and their members (`domains.json`); null: refuse everyone. */
+        getDomains(): DomainsIndex | null;
         getSettings(): GatekeeperSettings;
         getSessionCache(): Map<string, AutheliaSession>;
         getCacheVersion(): number;
         getRelaySigner(): RelaySigner;
         bustCache(): void;
+        /** Read `domains.json` again now. */
+        reloadDomains(): Promise<void>;
         updateSettings(s: GatekeeperSettings): void;
     }
 }

package/vendor/gatekeeper/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AAEpB,OAAO,OAAO,MAAM,SAAS,CAAC;AAY9B,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAWvE,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AA4IvF,wBAAsB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAsJxE;AAkCD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,UAAU,IAAI,UAAU,EAAE,CAAC;QAC3B,mBAAmB,IAAI,eAAe,EAAE,CAAC;QACzC,WAAW,IAAI,kBAAkB,CAAC;QAClC,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,eAAe,IAAI,MAAM,CAAC;QAC1B,cAAc,IAAI,WAAW,CAAC;QAC9B,SAAS,IAAI,IAAI,CAAC;QAClB,cAAc,CAAC,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;KAC7C;CACF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AAEpB,OAAO,OAAO,MAAM,SAAS,CAAC;AAe9B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAWrF,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AA6JvF,wBAAsB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAoKxE;AAkCD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,UAAU,IAAI,UAAU,EAAE,CAAC;QAC3B,mBAAmB,IAAI,eAAe,EAAE,CAAC;QACzC,6EAA6E;QAC7E,UAAU,IAAI,YAAY,GAAG,IAAI,CAAC;QAClC,WAAW,IAAI,kBAAkB,CAAC;QAClC,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,eAAe,IAAI,MAAM,CAAC;QAC1B,cAAc,IAAI,WAAW,CAAC;QAC9B,SAAS,IAAI,IAAI,CAAC;QAClB,qCAAqC;QACrC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;KAC7C;CACF"}

package/vendor/gatekeeper/dist/server/index.js

@@ -5,7 +5,7 @@ import rateLimit from '@fastify/rate-limit';
 import { watch } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { atomicWriteJSON, createRelaySigner, logRequestMetadata, RELAY_SIGNING_KEY_FILE, userSurfaceHosts, } from '@lamalibre/lamaste';
+import { atomicWriteJSON, createRelaySigner, DOMAINS_PROJECTION_FILE, indexDomainsProjection, logRequestMetadata, parseDomainsProjection, RELAY_SIGNING_KEY_FILE, userSurfaceHosts, } from '@lamalibre/lamaste';
 import { DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, SITES_FILE, TUNNELS_FILE, GATEKEEPER_PORT, SESSION_CACHE_TTL_MS, } from '../lib/constants.js';
 import { registerCacheInvalidator } from '../lib/cache-bust.js';
 import { tunnelInfoFromState } from '../lib/tunnels.js';
@@ -15,10 +15,12 @@ import { grantRoutes } from './routes/grants.js';
 import { diagnosticRoutes } from './routes/diagnostic.js';
 import { accessRequestRoutes } from './routes/access-request.js';
 import { principalRoutes } from './routes/principals.js';
+import { secretMatches } from '../lib/secret.js';
 const dataDir = process.env.LAMALIBRE_LAMASTE_DATA_DIR ?? DEFAULT_DATA_DIR;
 const tunnelsPath = path.join(dataDir, TUNNELS_FILE);
 const sitesPath = path.join(dataDir, SITES_FILE);
 const settingsPath = path.join(dataDir, SETTINGS_FILE);
+const domainsPath = path.join(dataDir, DOMAINS_PROJECTION_FILE);
 /**
  * The relay's assertion signing key, created by the panel (never here). A
  * plugin tunnel's user is vouched for to the agent with it, and a user on a
@@ -36,6 +38,12 @@ let tunnelsCache = [];
 let userSurfaceHostsCache = [];
 /** Gatekeeper settings cache */
 let settingsCache = {};
+/**
+ * The domains and their members, as the panel last wrote them
+ * (`domains.json`), indexed for lookups; null while it is missing or not a
+ * projection — every authorization is refused then.
+ */
+let domainsCache = null;
 /** Authelia session cache: cookie hash → session data */
 const sessionCache = new Map();
 /** Cache version counter — incremented on cache bust */
@@ -67,6 +75,12 @@ async function loadHostState() {
     // The panel's own reading of both files (core), so both decide alike.
     userSurfaceHostsCache = userSurfaceHosts(tunnels, sites);
 }
+/** How often `domains.json` is read again whatever the watcher saw. */
+const DOMAINS_RELOAD_INTERVAL_MS = 60_000;
+async function loadDomains() {
+    const projection = parseDomainsProjection(await readStateFile(domainsPath));
+    domainsCache = projection ? indexDomainsProjection(projection) : null;
+}
 async function loadSettings() {
     try {
         const raw = await readFile(settingsPath, 'utf-8');
@@ -159,10 +173,12 @@ export async function createServer() {
     });
     // Load initial state
     await loadHostState();
+    await loadDomains();
     settingsCache = await loadSettings();
     // Decorate server with shared state accessors
     server.decorate('getTunnels', () => tunnelsCache);
     server.decorate('getUserSurfaceHosts', () => userSurfaceHostsCache);
+    server.decorate('getDomains', () => domainsCache);
     server.decorate('getSettings', () => settingsCache);
     server.decorate('getSessionCache', () => sessionCache);
     server.decorate('getCacheVersion', () => cacheVersion);
@@ -172,6 +188,7 @@ export async function createServer() {
         sessionCache.clear();
     };
     server.decorate('bustCache', bustCache);
+    server.decorate('reloadDomains', loadDomains);
     registerCacheInvalidator(bustCache);
     server.decorate('updateSettings', (s) => {
         settingsCache = s;
@@ -179,6 +196,15 @@ export async function createServer() {
     // Watch state files for changes
     watchFile(tunnelsPath, loadHostState, server.log);
     watchFile(sitesPath, loadHostState, server.log);
+    watchFile(domainsPath, loadDomains, server.log);
+    // A watch event can be missed, and the panel never rewrites an unchanged
+    // projection: read it again every minute too (and on every cache bust —
+    // the panel busts after each membership change).
+    const domainsTimer = setInterval(() => {
+        loadDomains().catch((err) => server.log.warn({ err: err.message }, 'Could not reload domains.json'));
+    }, DOMAINS_RELOAD_INTERVAL_MS);
+    domainsTimer.unref();
+    server.addHook('onClose', async () => clearInterval(domainsTimer));
     // TODO(sqlite-step-4): groups.json and access-grants.json are now
     // .migrated stubs after first SQLite open. These watch registrations stay
     // attached to the old paths so they never fire — every authz read goes
@@ -245,7 +271,7 @@ export async function createServer() {
     await server.register(async (scope) => {
         scope.addHook('onRequest', async (request, reply) => {
             const auth = request.headers['x-gatekeeper-secret'];
-            if (auth !== apiSecret) {
+            if (!secretMatches(auth, apiSecret)) {
                 return reply.code(401).send({ error: 'Unauthorized' });
             }
         });

package/vendor/gatekeeper/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AACpB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,UAAU,EACV,YAAY,EACZ,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,gBAAgB,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,EAAE;IAChF,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,mDAAmD;AACnD,IAAI,YAAY,GAAiB,EAAE,CAAC;AAEpC,gHAAgH;AAChH,IAAI,qBAAqB,GAAsB,EAAE,CAAC;AAElD,gCAAgC;AAChC,IAAI,aAAa,GAAuB,EAAE,CAAC;AAE3C,yDAAyD;AACzD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;AAExD,wDAAwD;AACxD,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,+FAA+F;AAC/F,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa;IAC1B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,aAAa,CAAC,WAAW,CAAC;QAC1B,aAAa,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IACH,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5C,sEAAsE;IACtE,qBAAqB,GAAG,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;AAE/D,SAAS,SAAS,CAChB,QAAgB,EAChB,MAA2B,EAC3B,MAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,aAAa,GAAyC,IAAI,CAAC;IAE/D,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAC/C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClB,uDAAuD;YACzD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;gBAClC,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,MAAM,EAAE,GAAG,QAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,EAAE;oBAAE,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI;QACZ,sEAAsE;QACtE,kEAAkE;QAClE,sEAAsE;QACtE,4BAA4B;QAC5B,qBAAqB,EAAE,IAAI;QAC3B,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,gEAAgE;QAChE,uEAAuE;QACvE,uEAAuE;QACvE,UAAU,EAAE,WAAW;KACxB,CAAC,CAAC;IAEH,yEAAyE;IACzE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE3B,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC/B,GAAG,EAAE,IAAI;QACT,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,GAAG,EAAE,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IAEH,qBAAqB;IACrB,MAAM,aAAa,EAAE,CAAC;IACtB,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,8CAA8C;IAC9C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC;IACpE,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,YAAY,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAqB,EAAE,EAAE;QAC1D,aAAa,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,gCAAgC;IAChC,SAAS,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAClD,SAAS,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAEhD,kEAAkE;IAClE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,4CAA4C;QAC5C,yEAAyE;QACzE,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,6DAA6D;QAC7D,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,YAAY,EACZ,KAAK,IAAI,EAAE;QACT,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IACvC,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,6DAA6D;IAC7D,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,SAAS,GAAG,MAAM,CAAC;gBACnB,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE3C,qDAAqD;IACrD,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,KAAK,UAAU,KAAK;IAClB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IAEpC,MAAM,MAAM,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AACpB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,UAAU,EACV,YAAY,EACZ,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,gBAAgB,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACvD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,EAAE;IAChF,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,mDAAmD;AACnD,IAAI,YAAY,GAAiB,EAAE,CAAC;AAEpC,gHAAgH;AAChH,IAAI,qBAAqB,GAAsB,EAAE,CAAC;AAElD,gCAAgC;AAChC,IAAI,aAAa,GAAuB,EAAE,CAAC;AAE3C;;;;GAIG;AACH,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C,yDAAyD;AACzD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;AAExD,wDAAwD;AACxD,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,+FAA+F;AAC/F,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa;IAC1B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,aAAa,CAAC,WAAW,CAAC;QAC1B,aAAa,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IACH,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5C,sEAAsE;IACtE,qBAAqB,GAAG,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,uEAAuE;AACvE,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,KAAK,UAAU,WAAW;IACxB,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;AAE/D,SAAS,SAAS,CAChB,QAAgB,EAChB,MAA2B,EAC3B,MAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,aAAa,GAAyC,IAAI,CAAC;IAE/D,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAC/C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClB,uDAAuD;YACzD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;gBAClC,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,MAAM,EAAE,GAAG,QAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,EAAE;oBAAE,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI;QACZ,sEAAsE;QACtE,kEAAkE;QAClE,sEAAsE;QACtE,4BAA4B;QAC5B,qBAAqB,EAAE,IAAI;QAC3B,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,gEAAgE;QAChE,uEAAuE;QACvE,uEAAuE;QACvE,UAAU,EAAE,WAAW;KACxB,CAAC,CAAC;IAEH,yEAAyE;IACzE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE3B,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC/B,GAAG,EAAE,IAAI;QACT,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,GAAG,EAAE,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IAEH,qBAAqB;IACrB,MAAM,aAAa,EAAE,CAAC;IACtB,MAAM,WAAW,EAAE,CAAC;IACpB,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,8CAA8C;IAC9C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC;IACpE,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,YAAY,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAC9C,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAqB,EAAE,EAAE;QAC1D,aAAa,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,gCAAgC;IAChC,SAAS,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAClD,SAAS,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,yEAAyE;IACzE,wEAAwE;IACxE,iDAAiD;IACjD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CACnC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,+BAA+B,CAAC,CAClF,CAAC;IACJ,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAC/B,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnE,kEAAkE;IAClE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,4CAA4C;QAC5C,yEAAyE;QACzE,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,6DAA6D;QAC7D,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,YAAY,EACZ,KAAK,IAAI,EAAE;QACT,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IACvC,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,6DAA6D;IAC7D,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,SAAS,GAAG,MAAM,CAAC;gBACnB,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE3C,qDAAqD;IACrD,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,KAAK,UAAU,KAAK;IAClB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IAEpC,MAAM,MAAM,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}