@camstack/addon-tailscale-ingress 0.1.1

package/dist/index.js

@@ -0,0 +1,7 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+const require_tailscale_ingress_addon = require("./tailscale-ingress.addon.js");
+exports.TailscaleIngressAddon = require_tailscale_ingress_addon.TailscaleIngressAddon;
+exports.default = require_tailscale_ingress_addon.TailscaleIngressAddon;

package/dist/index.mjs

@@ -0,0 +1,2 @@
+import { TailscaleIngressAddon } from "./tailscale-ingress.addon.mjs";
+export { TailscaleIngressAddon, TailscaleIngressAddon as default };

package/dist/tailscale-ingress.addon.js

@@ -0,0 +1,545 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+let _camstack_types = require("@camstack/types");
+let node_crypto = require("node:crypto");
+let node_child_process = require("node:child_process");
+//#region src/tailscale-cli.ts
+/**
+* Thin wrapper around the `tailscale` CLI.
+*
+* Why CLI rather than the local API socket: `tailscaled` exposes its
+* control plane at `/var/run/tailscale/tailscaled.sock` but the wire
+* protocol is undocumented + the Go client is gnarly to port. The
+* `tailscale` CLI is the supported public interface, it covers every
+* action we need (`up`/`down`/`status --json`/`serve`/`funnel`), and
+* its output is stable JSON for `status` + non-fatal stderr for the
+* others.
+*
+* The wrapper:
+*   - resolves the binary path once (PATH lookup + macOS GUI install
+*     fallback at `/Applications/Tailscale.app/Contents/MacOS/Tailscale`).
+*   - exposes Promise-based methods returning typed shapes.
+*   - never spawns long-lived processes — every call is one-shot.
+*
+* Operator-side prerequisite: `tailscaled` must be installed +
+* running. The addon surfaces "binary missing" / "daemon not running"
+* errors verbatim so the operator can act.
+*/
+var execFileP = (0, require("node:util").promisify)(node_child_process.execFile);
+var TAILSCALE_CANDIDATES = [
+	"tailscale",
+	"/usr/bin/tailscale",
+	"/usr/local/bin/tailscale",
+	"/opt/homebrew/bin/tailscale",
+	"/Applications/Tailscale.app/Contents/MacOS/Tailscale"
+];
+var TailscaleCliError = class extends Error {
+	stderr;
+	constructor(message, stderr = "") {
+		super(message);
+		this.stderr = stderr;
+		this.name = "TailscaleCliError";
+	}
+};
+var TailscaleCli = class {
+	resolvedBin = null;
+	/** Locate the `tailscale` binary once and cache the result. */
+	async resolveBin() {
+		if (this.resolvedBin) return this.resolvedBin;
+		for (const candidate of TAILSCALE_CANDIDATES) try {
+			await execFileP(candidate, ["version"], { timeout: 3e3 });
+			this.resolvedBin = candidate;
+			return candidate;
+		} catch {}
+		throw new TailscaleCliError("tailscale binary not found — install Tailscale from https://tailscale.com/download");
+	}
+	async version() {
+		const { stdout } = await execFileP(await this.resolveBin(), ["version"], { timeout: 5e3 });
+		return stdout.trim().split("\n")[0] ?? "";
+	}
+	async status() {
+		const bin = await this.resolveBin();
+		try {
+			const { stdout } = await execFileP(bin, ["status", "--json"], { timeout: 1e4 });
+			return JSON.parse(stdout);
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale status failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/** Bring the daemon up with an auth key. Idempotent — calling
+	*  while already joined returns immediately. */
+	async up(input) {
+		const bin = await this.resolveBin();
+		const args = [
+			"up",
+			"--auth-key",
+			input.authKey,
+			"--reset"
+		];
+		if (input.hostname) args.push(`--hostname=${input.hostname}`);
+		try {
+			await execFileP(bin, args, { timeout: 6e4 });
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale up failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/** Leave the tailnet. After this the host's `100.x` address is
+	*  released until the next `up`. */
+	async down() {
+		const bin = await this.resolveBin();
+		try {
+			await execFileP(bin, ["down"], { timeout: 15e3 });
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale down failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/** `tailscale serve` — exposes a local port to peers in the same
+	*  tailnet over HTTPS with auto-issued cert. Mutating call; the
+	*  daemon persists the rule across restarts.
+	*
+	*  When `targetPath` is provided we pass `--set-path=<path>` so
+	*  multiple serve rules can co-exist under different prefixes
+	*  without overwriting each other. */
+	async serve(input) {
+		const bin = await this.resolveBin();
+		const args = this.buildIngressArgs("serve", input);
+		try {
+			await execFileP(bin, args, { timeout: 15e3 });
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale serve failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/** `tailscale funnel` — exposes a local port to the open internet
+	*  via Tailscale's edge. Requires Funnel ACL grant in the tailnet
+	*  policy. Same shape as `serve`. */
+	async funnel(input) {
+		const bin = await this.resolveBin();
+		const args = this.buildIngressArgs("funnel", input);
+		try {
+			await execFileP(bin, args, { timeout: 15e3 });
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale funnel failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/**
+	* Single source of truth for the serve/funnel arg shape. The CLI
+	* accepts the same flag layout for both verbs, so we share the
+	* builder. `--set-path` is only emitted when the operator picks a
+	* non-root mount.
+	*/
+	buildIngressArgs(verb, input) {
+		const path = (input.targetPath ?? "").trim();
+		if (!input.enabled) {
+			const out = [verb, "--bg"];
+			if (path && path !== "/") out.push(`--set-path=${path}`);
+			out.push("off");
+			return out;
+		}
+		const out = [verb, "--bg"];
+		if (path && path !== "/") out.push(`--set-path=${path}`);
+		out.push(`http://127.0.0.1:${input.port}`);
+		return out;
+	}
+};
+//#endregion
+//#region src/tailscale-ingress.addon.ts
+/**
+* Tailscale Ingress addon — manages `tailscale serve` (in-tailnet
+* HTTPS) and `tailscale funnel` (public HTTPS) ingresses.
+*
+* Depends on `@camstack/addon-tailscale-client` being installed and
+* the host being joined to a tailnet. The mesh readiness check goes
+* through the `mesh-network` cap so we don't have to import the client
+* package directly.
+*
+* Registers the `network-access` collection cap so the Remote Access
+* page can toggle the public Funnel ingress alongside other ingress
+* providers (cloudflare-tunnel, ngrok, …).
+*
+* Per-ingress feature flags (#175, #176, #177):
+*   • `autoStart` — when set, the addon auto-runs `start()` once the
+*     mesh-network cap reports `joined: true` (boot or later state
+*     change). Errors do NOT crash the addon — they're logged + surfaced
+*     via `getStatus().error`.
+*   • `ingresses[]` — array of `{ mode, sourcePort, targetPath? }`
+*     entries. Each entry maps to one `tailscale serve` / `funnel` CLI
+*     invocation. Lets a single addon expose e.g. the hub on Serve AND
+*     a Funnel-exposed status page concurrently.
+*   • Graceful disposer — registered via `ctx.addDisposer(...)` so it
+*     survives addon-disable AND addon-uninstall. Runs `off` for every
+*     active ingress; if the daemon is unreachable we log + skip rather
+*     than zombieing the addon.
+*/
+var DEFAULT_CONFIG = {
+	autoStart: false,
+	ingresses: []
+};
+var TailscaleIngressAddon = class extends _camstack_types.BaseAddon {
+	cli = new TailscaleCli();
+	/**
+	* Map of "live" entries the addon has called `enabled: true` for. Used
+	* by stop()/disposer to know which `off` calls to issue. Keyed by
+	* entry id (mode-port-path). The value retains the entry shape so a
+	* mid-flight config change can't break the cleanup contract.
+	*/
+	activeEntries = /* @__PURE__ */ new Map();
+	/** Set once disposer fires so re-entrant stop() calls are no-ops. */
+	disposed = false;
+	constructor() {
+		super({ ...DEFAULT_CONFIG });
+	}
+	async onInitialize() {
+		let cliReachable = false;
+		try {
+			await this.cli.version();
+			cliReachable = true;
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: Tailscale CLI not found", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+		const provider = {
+			start: () => this.start(),
+			stop: () => this.stop(),
+			getEndpoint: () => this.getPrimaryEndpoint(),
+			getStatus: () => this.getStatus(),
+			listEndpoints: () => this.listEndpoints()
+		};
+		this.ctx.addDisposer(() => this.gracefulShutdown());
+		if (cliReachable && this.config.autoStart) setImmediate(() => {
+			this.autoStartIfReady();
+		});
+		if (this.config.autoStart) this.watchCapability("mesh-network", { onReady: () => {
+			this.autoStartIfReady().catch((err) => {
+				this.ctx.logger.warn("tailscale-ingress: auto-start retry after mesh-ready failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		} });
+		return [{
+			capability: _camstack_types.networkAccessCapability,
+			provider
+		}];
+	}
+	/**
+	* Single-shot bring-up driven by either boot or a mesh-ready event.
+	* Idempotent — start() is itself idempotent w.r.t. already-running
+	* CLI rules, and the active entries map dedupes across calls.
+	*/
+	async autoStartIfReady() {
+		if (this.config.ingresses.length === 0) {
+			this.ctx.logger.info("tailscale-ingress: autoStart on, but no ingresses configured — skipping", { tags: {
+				topic: "tailscale-ingress",
+				phase: "autostart-empty"
+			} });
+			return;
+		}
+		let joined;
+		try {
+			joined = (await this.fetchMeshStatus()).joined;
+		} catch {
+			joined = false;
+		}
+		if (!joined) {
+			this.ctx.logger.info("tailscale-ingress: autoStart waiting for mesh to be joined", { tags: {
+				topic: "tailscale-ingress",
+				phase: "autostart-mesh-not-joined"
+			} });
+			return;
+		}
+		try {
+			await this.start();
+			this.ctx.logger.info("tailscale-ingress: auto-started successfully", {
+				meta: { ingressCount: this.config.ingresses.length },
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "autostart-ok"
+				}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: auto-start failed (will be retried on next mesh-ready event)", {
+				meta: { error: err instanceof Error ? err.message : String(err) },
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "autostart-error"
+				}
+			});
+		}
+	}
+	async start() {
+		if (this.disposed) throw new Error("tailscale-ingress: addon shut down — cannot start");
+		await this.requireClientJoined();
+		if (this.config.ingresses.length === 0) throw new Error("tailscale-ingress: no ingresses configured — add at least one row in the addon settings.");
+		const errors = [];
+		for (const entry of this.config.ingresses) try {
+			await this.applyIngressRule(entry, true);
+			const id = entryId(entry);
+			this.activeEntries.set(id, entry);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			errors.push(`${entry.mode}:${entry.sourcePort}${entry.targetPath || ""} — ${msg}`);
+		}
+		if (this.activeEntries.size === 0) throw new Error(`tailscale-ingress: every ingress failed to start: ${errors.join("; ")}`);
+		const primary = (await this.resolveEndpoints())[0];
+		if (!primary) throw new Error("tailscale-ingress: CLI accepted the ingress but no MagicDNS hostname yet — has the host fully joined the tailnet?");
+		this.ctx.eventBus?.emit({
+			id: (0, node_crypto.randomUUID)(),
+			timestamp: /* @__PURE__ */ new Date(),
+			source: {
+				type: "addon",
+				id: this.ctx.id
+			},
+			category: _camstack_types.EventCategory.NetworkTunnelStarted,
+			data: { url: primary.url }
+		});
+		if (errors.length > 0) this.ctx.logger.warn("tailscale-ingress: started with partial failures", {
+			meta: {
+				errors,
+				succeeded: this.activeEntries.size
+			},
+			tags: {
+				topic: "tailscale-ingress",
+				phase: "start-partial"
+			}
+		});
+		return {
+			url: primary.url,
+			hostname: primary.hostname,
+			port: primary.port,
+			protocol: primary.protocol
+		};
+	}
+	async stop() {
+		const snapshot = Array.from(this.activeEntries.values());
+		this.activeEntries.clear();
+		for (const entry of snapshot) try {
+			await this.applyIngressRule(entry, false);
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: failed to stop entry — will retry on next disposer call", {
+				meta: {
+					entry,
+					error: err instanceof Error ? err.message : String(err)
+				},
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "stop-error"
+				}
+			});
+		}
+		this.ctx.eventBus?.emit({
+			id: (0, node_crypto.randomUUID)(),
+			timestamp: /* @__PURE__ */ new Date(),
+			source: {
+				type: "addon",
+				id: this.ctx.id
+			},
+			category: _camstack_types.EventCategory.NetworkTunnelStopped,
+			data: {}
+		});
+	}
+	/**
+	* Runs from `ctx.addDisposer(...)` on every teardown path:
+	*   - addon disable / uninstall
+	*   - restartAddon
+	*   - full server shutdown
+	*
+	* Strategy: walk every active entry and ask the daemon to clear the
+	* matching rule. If the daemon is unreachable we log the failure and
+	* proceed — leaving the addon zombied with mesh ingress is worse than
+	* a stale rule the operator can clean up by hand.
+	*/
+	async gracefulShutdown() {
+		if (this.disposed) return;
+		this.disposed = true;
+		const snapshot = Array.from(this.activeEntries.values());
+		if (snapshot.length === 0) return;
+		try {
+			await this.cli.version();
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: disposer can't reach tailscale CLI — leaving rules in place", {
+				meta: {
+					error: err instanceof Error ? err.message : String(err),
+					remainingEntries: snapshot.length
+				},
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "dispose-cli-missing"
+				}
+			});
+			this.activeEntries.clear();
+			return;
+		}
+		for (const entry of snapshot) try {
+			await this.applyIngressRule(entry, false);
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: disposer failed to clear entry — continuing", {
+				meta: {
+					entry,
+					error: err instanceof Error ? err.message : String(err)
+				},
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "dispose-entry-error"
+				}
+			});
+		}
+		this.activeEntries.clear();
+	}
+	async getPrimaryEndpoint() {
+		const primary = (await this.resolveEndpoints())[0];
+		if (!primary) return null;
+		return {
+			url: primary.url,
+			hostname: primary.hostname,
+			port: primary.port,
+			protocol: primary.protocol
+		};
+	}
+	async getStatus() {
+		try {
+			const endpoint = await this.getPrimaryEndpoint();
+			return {
+				connected: this.activeEntries.size > 0 && endpoint !== null,
+				endpoint
+			};
+		} catch (err) {
+			return {
+				connected: false,
+				endpoint: null,
+				error: err instanceof TailscaleCliError ? err.message : String(err)
+			};
+		}
+	}
+	async listEndpoints() {
+		return this.resolveEndpoints();
+	}
+	async applyIngressRule(entry, enabled) {
+		const opts = {
+			port: entry.sourcePort,
+			enabled,
+			...entry.targetPath && entry.targetPath !== "/" ? { targetPath: entry.targetPath } : {}
+		};
+		if (entry.mode === "funnel") await this.cli.funnel(opts);
+		else await this.cli.serve(opts);
+	}
+	/**
+	* Build the canonical endpoint list from the active entries map +
+	* the mesh-network MagicDNS hostname. Cold-start safe: when the host
+	* isn't joined yet we return an empty list rather than a half-formed
+	* URL with no hostname.
+	*/
+	async resolveEndpoints() {
+		if (this.activeEntries.size === 0) return [];
+		const meshStatus = await this.fetchMeshStatus().catch(() => null);
+		if (!meshStatus || !meshStatus.joined) return [];
+		const host = meshStatus.magicDnsHostname;
+		if (!host) return [];
+		const out = [];
+		for (const entry of this.activeEntries.values()) {
+			const path = entry.targetPath && entry.targetPath !== "/" ? entry.targetPath : "";
+			out.push({
+				id: entryId(entry),
+				label: `${entry.mode === "funnel" ? "Funnel" : "Serve"} :${entry.sourcePort}${path}`,
+				mode: entry.mode,
+				sourcePort: entry.sourcePort,
+				url: `https://${host}${path}`,
+				hostname: host,
+				port: 443,
+				protocol: "https"
+			});
+		}
+		return out;
+	}
+	/**
+	* Wait for `mesh-network` (the tailscale-client provider) to be
+	* mounted AND report joined. Throws an actionable error otherwise.
+	*/
+	async requireClientJoined() {
+		try {
+			await this.ctx.acquireCapability("mesh-network", void 0, { timeoutMs: 3e4 });
+		} catch (err) {
+			throw new Error(`tailscale-ingress: cap 'mesh-network' is not available — is @camstack/addon-tailscale-client installed and enabled? (${err instanceof Error ? err.message : String(err)})`, { cause: err });
+		}
+		if (!(await this.fetchMeshStatus()).joined) throw new Error("tailscale-ingress: tailnet not joined — run Join on the Tailscale Client addon first.");
+	}
+	async fetchMeshStatus() {
+		const api = this.ctx.api;
+		if (!api.meshNetwork?.getStatus?.query) throw new Error("tailscale-ingress: mesh-network cap not exposed on the api surface");
+		return await api.meshNetwork.getStatus.query();
+	}
+	globalSettingsSchema() {
+		return this.schema({ sections: [{
+			id: "tailscale-ingress",
+			title: "Tailscale Ingress",
+			description: "Exposes the hub via Tailscale Serve (in-tailnet HTTPS) or Funnel (public). Add one row per ingress — Serve + Funnel can run concurrently on different ports / paths. Requires the Tailscale Client addon to have the host joined first.",
+			columns: 1,
+			fields: [this.field({
+				type: "boolean",
+				key: "autoStart",
+				label: "Start on boot",
+				description: "Bring every configured ingress up automatically once the host is joined to the tailnet.",
+				default: DEFAULT_CONFIG.autoStart
+			}), {
+				type: "editable-array",
+				key: "ingresses",
+				label: "Ingresses",
+				description: "Each row is a single `tailscale serve` or `tailscale funnel` invocation.",
+				emptyMessage: "No ingresses configured.",
+				addLabel: "Add ingress",
+				rowTitleTemplate: "{mode} :{sourcePort}{targetPath}",
+				defaultItem: {
+					mode: "serve",
+					sourcePort: 4e3,
+					targetPath: ""
+				},
+				itemFields: [
+					{
+						type: "select",
+						key: "mode",
+						label: "Mode",
+						description: "Serve = peers on your tailnet. Funnel = open internet (requires Funnel grant in tailnet ACL).",
+						options: [{
+							value: "serve",
+							label: "Serve (tailnet HTTPS)"
+						}, {
+							value: "funnel",
+							label: "Funnel (public HTTPS)"
+						}],
+						default: "serve"
+					},
+					{
+						type: "number",
+						key: "sourcePort",
+						label: "Local port",
+						description: "Local hub port the ingress should forward to (e.g. 4000).",
+						default: 4e3
+					},
+					{
+						type: "text",
+						key: "targetPath",
+						label: "Mount path (optional)",
+						description: "Public-side path prefix. Leave empty / set \"/\" for root.",
+						placeholder: "/"
+					}
+				]
+			}]
+		}] });
+	}
+	async onConfigChanged() {
+		if (this.activeEntries.size === 0) return;
+		await this.stop();
+		if (this.config.autoStart) await this.autoStartIfReady();
+	}
+};
+function entryId(entry) {
+	const path = entry.targetPath && entry.targetPath !== "/" ? entry.targetPath : "";
+	return `${entry.mode}-${entry.sourcePort}${path}`;
+}
+//#endregion
+exports.TailscaleIngressAddon = TailscaleIngressAddon;
+exports.default = TailscaleIngressAddon;
+
+//# sourceMappingURL=tailscale-ingress.addon.js.map

package/dist/tailscale-ingress.addon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale-ingress.addon.js","names":[],"sources":["../src/tailscale-cli.ts","../src/tailscale-ingress.addon.ts"],"sourcesContent":["/**\n * Thin wrapper around the `tailscale` CLI.\n *\n * Why CLI rather than the local API socket: `tailscaled` exposes its\n * control plane at `/var/run/tailscale/tailscaled.sock` but the wire\n * protocol is undocumented + the Go client is gnarly to port. The\n * `tailscale` CLI is the supported public interface, it covers every\n * action we need (`up`/`down`/`status --json`/`serve`/`funnel`), and\n * its output is stable JSON for `status` + non-fatal stderr for the\n * others.\n *\n * The wrapper:\n *   - resolves the binary path once (PATH lookup + macOS GUI install\n *     fallback at `/Applications/Tailscale.app/Contents/MacOS/Tailscale`).\n *   - exposes Promise-based methods returning typed shapes.\n *   - never spawns long-lived processes — every call is one-shot.\n *\n * Operator-side prerequisite: `tailscaled` must be installed +\n * running. The addon surfaces \"binary missing\" / \"daemon not running\"\n * errors verbatim so the operator can act.\n */\nimport { execFile } from 'node:child_process'\nimport { promisify } from 'node:util'\n\nconst execFileP = promisify(execFile)\n\nconst TAILSCALE_CANDIDATES = [\n  'tailscale',\n  '/usr/bin/tailscale',\n  '/usr/local/bin/tailscale',\n  '/opt/homebrew/bin/tailscale',\n  // macOS GUI install ships the CLI inside the .app bundle.\n  '/Applications/Tailscale.app/Contents/MacOS/Tailscale',\n]\n\nexport class TailscaleCliError extends Error {\n  constructor(message: string, public readonly stderr: string = '') {\n    super(message)\n    this.name = 'TailscaleCliError'\n  }\n}\n\n/** Subset of `tailscale status --json` we actually use. */\nexport interface TailscaleStatusJson {\n  readonly BackendState: 'NoState' | 'NeedsLogin' | 'NeedsMachineAuth' | 'Starting' | 'Running' | 'Stopped'\n  readonly Self?: {\n    readonly ID: string\n    readonly HostName: string\n    readonly DNSName: string // e.g. \"camstack.tail-abc.ts.net.\"\n    readonly TailscaleIPs?: readonly string[]\n    readonly Online: boolean\n    readonly OS: string\n  }\n  readonly Peer?: Record<string, {\n    readonly ID: string\n    readonly HostName: string\n    readonly DNSName: string\n    readonly TailscaleIPs?: readonly string[]\n    readonly Online: boolean\n    readonly OS: string\n    readonly LastSeen: string // ISO 8601\n  }>\n  readonly MagicDNSSuffix?: string\n  readonly CurrentTailnet?: { readonly Name?: string; readonly MagicDNSSuffix?: string }\n}\n\n/**\n * Options for the per-ingress serve/funnel CLI calls. `targetPath` is\n * the public-facing mount path the operator wants the rule to live at\n * (default `/`). Tailscale's `serve` syntax accepts an optional\n * `--set-path=<path>` flag to attach the rule to a non-root prefix —\n * we drive it through this option.\n */\nexport interface IngressRuleOptions {\n  readonly port: number\n  readonly enabled: boolean\n  readonly targetPath?: string\n}\n\nexport class TailscaleCli {\n  private resolvedBin: string | null = null\n\n  /** Locate the `tailscale` binary once and cache the result. */\n  private async resolveBin(): Promise<string> {\n    if (this.resolvedBin) return this.resolvedBin\n    for (const candidate of TAILSCALE_CANDIDATES) {\n      try {\n        await execFileP(candidate, ['version'], { timeout: 3_000 })\n        this.resolvedBin = candidate\n        return candidate\n      } catch {\n        // try next\n      }\n    }\n    throw new TailscaleCliError(\n      'tailscale binary not found — install Tailscale from https://tailscale.com/download',\n    )\n  }\n\n  async version(): Promise<string> {\n    const bin = await this.resolveBin()\n    const { stdout } = await execFileP(bin, ['version'], { timeout: 5_000 })\n    return stdout.trim().split('\\n')[0] ?? ''\n  }\n\n  async status(): Promise<TailscaleStatusJson> {\n    const bin = await this.resolveBin()\n    try {\n      const { stdout } = await execFileP(bin, ['status', '--json'], { timeout: 10_000 })\n      return JSON.parse(stdout) as TailscaleStatusJson\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale status failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /** Bring the daemon up with an auth key. Idempotent — calling\n   *  while already joined returns immediately. */\n  async up(input: { readonly authKey: string; readonly hostname?: string }): Promise<void> {\n    const bin = await this.resolveBin()\n    const args = ['up', '--auth-key', input.authKey, '--reset']\n    if (input.hostname) args.push(`--hostname=${input.hostname}`)\n    try {\n      await execFileP(bin, args, { timeout: 60_000 })\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale up failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /** Leave the tailnet. After this the host's `100.x` address is\n   *  released until the next `up`. */\n  async down(): Promise<void> {\n    const bin = await this.resolveBin()\n    try {\n      await execFileP(bin, ['down'], { timeout: 15_000 })\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale down failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /** `tailscale serve` — exposes a local port to peers in the same\n   *  tailnet over HTTPS with auto-issued cert. Mutating call; the\n   *  daemon persists the rule across restarts.\n   *\n   *  When `targetPath` is provided we pass `--set-path=<path>` so\n   *  multiple serve rules can co-exist under different prefixes\n   *  without overwriting each other. */\n  async serve(input: IngressRuleOptions): Promise<void> {\n    const bin = await this.resolveBin()\n    const args = this.buildIngressArgs('serve', input)\n    try {\n      await execFileP(bin, args, { timeout: 15_000 })\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale serve failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /** `tailscale funnel` — exposes a local port to the open internet\n   *  via Tailscale's edge. Requires Funnel ACL grant in the tailnet\n   *  policy. Same shape as `serve`. */\n  async funnel(input: IngressRuleOptions): Promise<void> {\n    const bin = await this.resolveBin()\n    const args = this.buildIngressArgs('funnel', input)\n    try {\n      await execFileP(bin, args, { timeout: 15_000 })\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale funnel failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /**\n   * Single source of truth for the serve/funnel arg shape. The CLI\n   * accepts the same flag layout for both verbs, so we share the\n   * builder. `--set-path` is only emitted when the operator picks a\n   * non-root mount.\n   */\n  private buildIngressArgs(verb: 'serve' | 'funnel', input: IngressRuleOptions): readonly string[] {\n    const path = (input.targetPath ?? '').trim()\n    if (!input.enabled) {\n      const out: string[] = [verb, '--bg']\n      if (path && path !== '/') out.push(`--set-path=${path}`)\n      out.push('off')\n      return out\n    }\n    const out: string[] = [verb, '--bg']\n    if (path && path !== '/') out.push(`--set-path=${path}`)\n    out.push(`http://127.0.0.1:${input.port}`)\n    return out\n  }\n}\n","/**\n * Tailscale Ingress addon — manages `tailscale serve` (in-tailnet\n * HTTPS) and `tailscale funnel` (public HTTPS) ingresses.\n *\n * Depends on `@camstack/addon-tailscale-client` being installed and\n * the host being joined to a tailnet. The mesh readiness check goes\n * through the `mesh-network` cap so we don't have to import the client\n * package directly.\n *\n * Registers the `network-access` collection cap so the Remote Access\n * page can toggle the public Funnel ingress alongside other ingress\n * providers (cloudflare-tunnel, ngrok, …).\n *\n * Per-ingress feature flags (#175, #176, #177):\n *   • `autoStart` — when set, the addon auto-runs `start()` once the\n *     mesh-network cap reports `joined: true` (boot or later state\n *     change). Errors do NOT crash the addon — they're logged + surfaced\n *     via `getStatus().error`.\n *   • `ingresses[]` — array of `{ mode, sourcePort, targetPath? }`\n *     entries. Each entry maps to one `tailscale serve` / `funnel` CLI\n *     invocation. Lets a single addon expose e.g. the hub on Serve AND\n *     a Funnel-exposed status page concurrently.\n *   • Graceful disposer — registered via `ctx.addDisposer(...)` so it\n *     survives addon-disable AND addon-uninstall. Runs `off` for every\n *     active ingress; if the daemon is unreachable we log + skip rather\n *     than zombieing the addon.\n */\nimport {\n  BaseAddon,\n  EventCategory,\n  networkAccessCapability,\n  type ConfigField,\n  type InferProvider,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ntype NetworkAccessProvider = InferProvider<typeof networkAccessCapability>\nimport { randomUUID } from 'node:crypto'\n\nimport { TailscaleCli, TailscaleCliError } from './tailscale-cli.js'\n\n// ── Settings shape (#176) ───────────────────────────────────────────\n\ntype IngressMode = 'serve' | 'funnel'\n\n/**\n * Single ingress entry. The CLI invocation is one-to-one with an entry:\n * the addon manages independent `tailscale serve|funnel` rules per row.\n * Identity is `{mode}-{sourcePort}-{normalisedTargetPath}` — used as the\n * endpoint id and the cleanup key.\n */\ninterface IngressEntry {\n  readonly mode: IngressMode\n  readonly sourcePort: number\n  /** Public-side mount path. Empty / `/` = root. */\n  readonly targetPath: string\n}\n\ninterface TailscaleIngressConfig {\n  /** When true AND mesh-network is joined, auto-run `start()` on boot. */\n  readonly autoStart: boolean\n  /** All configured ingress rules. */\n  readonly ingresses: readonly IngressEntry[]\n}\n\nconst DEFAULT_CONFIG: TailscaleIngressConfig = {\n  autoStart: false,\n  ingresses: [],\n}\n\ninterface ResolvedEndpoint {\n  readonly id: string\n  readonly label: string\n  readonly mode: IngressMode\n  readonly sourcePort: number\n  readonly url: string\n  readonly hostname: string\n  readonly port: 443\n  readonly protocol: 'https'\n}\n\nexport class TailscaleIngressAddon extends BaseAddon<TailscaleIngressConfig> {\n  private cli = new TailscaleCli()\n  /**\n   * Map of \"live\" entries the addon has called `enabled: true` for. Used\n   * by stop()/disposer to know which `off` calls to issue. Keyed by\n   * entry id (mode-port-path). The value retains the entry shape so a\n   * mid-flight config change can't break the cleanup contract.\n   */\n  private activeEntries = new Map<string, IngressEntry>()\n  /** Set once disposer fires so re-entrant stop() calls are no-ops. */\n  private disposed = false\n\n  constructor() {\n    super({ ...DEFAULT_CONFIG })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    // Sanity-probe the CLI early so the operator sees a clear error\n    // when the daemon isn't installed.\n    let cliReachable = false\n    try {\n      await this.cli.version()\n      cliReachable = true\n    } catch (err) {\n      this.ctx.logger.warn('tailscale-ingress: Tailscale CLI not found', {\n        meta: { error: err instanceof Error ? err.message : String(err) },\n      })\n    }\n\n    const provider: NetworkAccessProvider = {\n      start: () => this.start(),\n      stop: () => this.stop(),\n      getEndpoint: () => this.getPrimaryEndpoint(),\n      getStatus: () => this.getStatus(),\n      listEndpoints: () => this.listEndpoints(),\n    }\n\n    // Graceful shutdown disposer (#177) — runs on:\n    //   • addon disable / uninstall (kernel calls `addon.shutdown()`)\n    //   • restartAddon (kernel calls shutdown + re-init)\n    //   • full server shutdown\n    // We don't try to be clever about \"uninstall vs disable\" — for\n    // active ingresses the right cleanup is identical (turn rules off).\n    // Disposers run before `_ctx` is nulled, so logging still works.\n    this.ctx.addDisposer(() => this.gracefulShutdown())\n\n    // Auto-start (#175) — only when the CLI is reachable AND the\n    // operator opted in. We don't crash the addon on failure here:\n    // start() catches its own errors when invoked through this path.\n    if (cliReachable && this.config.autoStart) {\n      // Defer to the next tick so provider registration completes\n      // first. Otherwise `requireClientJoined` may race the cap-ready\n      // event for `mesh-network` on cold boot.\n      setImmediate(() => { void this.autoStartIfReady() })\n    }\n\n    // Subscribe to mesh-network readiness transitions so a delayed\n    // `joined: true` (operator clicks Connect after we booted) also\n    // triggers auto-start without requiring a server restart.\n    if (this.config.autoStart) {\n      // `watchCapability` is a BaseAddon helper that wraps the\n      // `system.ready-state` subscription with type narrowing. We only\n      // care about the `ready` transition — when mesh-network goes\n      // down we want operator-visible feedback (next getStatus call\n      // returns connected: false) but no automatic teardown of rules,\n      // which would race the daemon's own reconnect path.\n      this.watchCapability('mesh-network', {\n        onReady: () => {\n          // Best-effort: silently no-op when auto-start already ran.\n          void this.autoStartIfReady().catch((err) => {\n            this.ctx.logger.warn('tailscale-ingress: auto-start retry after mesh-ready failed', {\n              meta: { error: err instanceof Error ? err.message : String(err) },\n            })\n          })\n        },\n      })\n    }\n\n    return [{ capability: networkAccessCapability, provider }]\n  }\n\n  // ── #175 — autoStart helper ─────────────────────────────────────────\n\n  /**\n   * Single-shot bring-up driven by either boot or a mesh-ready event.\n   * Idempotent — start() is itself idempotent w.r.t. already-running\n   * CLI rules, and the active entries map dedupes across calls.\n   */\n  private async autoStartIfReady(): Promise<void> {\n    if (this.config.ingresses.length === 0) {\n      this.ctx.logger.info('tailscale-ingress: autoStart on, but no ingresses configured — skipping', {\n        tags: { topic: 'tailscale-ingress', phase: 'autostart-empty' },\n      })\n      return\n    }\n    // We re-probe mesh-network status via the cap rather than just\n    // trusting the readiness event — readiness is binary (ready/down)\n    // but the actual mesh may be NeedsLogin / NeedsMachineAuth / etc.\n    let joined: boolean\n    try {\n      const status = await this.fetchMeshStatus()\n      joined = status.joined\n    } catch {\n      // Treat as not joined; don't spam the log on every retry tick.\n      joined = false\n    }\n    if (!joined) {\n      this.ctx.logger.info('tailscale-ingress: autoStart waiting for mesh to be joined', {\n        tags: { topic: 'tailscale-ingress', phase: 'autostart-mesh-not-joined' },\n      })\n      return\n    }\n    try {\n      await this.start()\n      this.ctx.logger.info('tailscale-ingress: auto-started successfully', {\n        meta: { ingressCount: this.config.ingresses.length },\n        tags: { topic: 'tailscale-ingress', phase: 'autostart-ok' },\n      })\n    } catch (err) {\n      // Don't crash — surface the error through the next getStatus().\n      this.ctx.logger.warn('tailscale-ingress: auto-start failed (will be retried on next mesh-ready event)', {\n        meta: { error: err instanceof Error ? err.message : String(err) },\n        tags: { topic: 'tailscale-ingress', phase: 'autostart-error' },\n      })\n    }\n  }\n\n  // ── #176 — multi-ingress lifecycle ──────────────────────────────────\n\n  private async start(): Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }> {\n    if (this.disposed) {\n      throw new Error('tailscale-ingress: addon shut down — cannot start')\n    }\n    await this.requireClientJoined()\n\n    if (this.config.ingresses.length === 0) {\n      throw new Error('tailscale-ingress: no ingresses configured — add at least one row in the addon settings.')\n    }\n\n    // Apply each ingress rule. We collect errors but don't short-circuit\n    // — if entry #2 fails, entry #1 stays up (and is also recorded so\n    // a later stop() cleans it up).\n    const errors: string[] = []\n    for (const entry of this.config.ingresses) {\n      try {\n        await this.applyIngressRule(entry, true)\n        const id = entryId(entry)\n        this.activeEntries.set(id, entry)\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err)\n        errors.push(`${entry.mode}:${entry.sourcePort}${entry.targetPath || ''} — ${msg}`)\n      }\n    }\n\n    if (this.activeEntries.size === 0) {\n      throw new Error(`tailscale-ingress: every ingress failed to start: ${errors.join('; ')}`)\n    }\n\n    const endpoints = await this.resolveEndpoints()\n    const primary = endpoints[0]\n    if (!primary) {\n      throw new Error('tailscale-ingress: CLI accepted the ingress but no MagicDNS hostname yet — has the host fully joined the tailnet?')\n    }\n\n    this.ctx.eventBus?.emit({\n      id: randomUUID(),\n      timestamp: new Date(),\n      source: { type: 'addon', id: this.ctx.id },\n      category: EventCategory.NetworkTunnelStarted,\n      data: { url: primary.url },\n    })\n\n    if (errors.length > 0) {\n      this.ctx.logger.warn('tailscale-ingress: started with partial failures', {\n        meta: { errors, succeeded: this.activeEntries.size },\n        tags: { topic: 'tailscale-ingress', phase: 'start-partial' },\n      })\n    }\n\n    return {\n      url: primary.url,\n      hostname: primary.hostname,\n      port: primary.port,\n      protocol: primary.protocol,\n    }\n  }\n\n  private async stop(): Promise<void> {\n    // Snapshot then clear so re-entrant calls don't double-issue `off`.\n    const snapshot = Array.from(this.activeEntries.values())\n    this.activeEntries.clear()\n    for (const entry of snapshot) {\n      try {\n        await this.applyIngressRule(entry, false)\n      } catch (err) {\n        // Log but don't throw — `stop()` must always succeed from the\n        // operator's POV. A failed off-call is recoverable on the next\n        // boot via the disposer or a manual CLI cleanup.\n        this.ctx.logger.warn('tailscale-ingress: failed to stop entry — will retry on next disposer call', {\n          meta: {\n            entry,\n            error: err instanceof Error ? err.message : String(err),\n          },\n          tags: { topic: 'tailscale-ingress', phase: 'stop-error' },\n        })\n      }\n    }\n    this.ctx.eventBus?.emit({\n      id: randomUUID(),\n      timestamp: new Date(),\n      source: { type: 'addon', id: this.ctx.id },\n      category: EventCategory.NetworkTunnelStopped,\n      data: {},\n    })\n  }\n\n  // ── #177 — graceful disposer ────────────────────────────────────────\n\n  /**\n   * Runs from `ctx.addDisposer(...)` on every teardown path:\n   *   - addon disable / uninstall\n   *   - restartAddon\n   *   - full server shutdown\n   *\n   * Strategy: walk every active entry and ask the daemon to clear the\n   * matching rule. If the daemon is unreachable we log the failure and\n   * proceed — leaving the addon zombied with mesh ingress is worse than\n   * a stale rule the operator can clean up by hand.\n   */\n  private async gracefulShutdown(): Promise<void> {\n    if (this.disposed) return\n    this.disposed = true\n    const snapshot = Array.from(this.activeEntries.values())\n    if (snapshot.length === 0) return\n\n    // Probe the daemon first — a clean \"CLI missing\" path lets us log\n    // the operator-actionable error once instead of N times.\n    try {\n      await this.cli.version()\n    } catch (err) {\n      this.ctx.logger.warn('tailscale-ingress: disposer can\\'t reach tailscale CLI — leaving rules in place', {\n        meta: {\n          error: err instanceof Error ? err.message : String(err),\n          remainingEntries: snapshot.length,\n        },\n        tags: { topic: 'tailscale-ingress', phase: 'dispose-cli-missing' },\n      })\n      this.activeEntries.clear()\n      return\n    }\n\n    for (const entry of snapshot) {\n      try {\n        await this.applyIngressRule(entry, false)\n      } catch (err) {\n        this.ctx.logger.warn('tailscale-ingress: disposer failed to clear entry — continuing', {\n          meta: {\n            entry,\n            error: err instanceof Error ? err.message : String(err),\n          },\n          tags: { topic: 'tailscale-ingress', phase: 'dispose-entry-error' },\n        })\n      }\n    }\n    this.activeEntries.clear()\n  }\n\n  // ── network-access provider impl ───────────────────────────────────\n\n  private async getPrimaryEndpoint(): Promise<\n    { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n  > {\n    const all = await this.resolveEndpoints()\n    const primary = all[0]\n    if (!primary) return null\n    return {\n      url: primary.url,\n      hostname: primary.hostname,\n      port: primary.port,\n      protocol: primary.protocol,\n    }\n  }\n\n  private async getStatus(): Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }> {\n    try {\n      const endpoint = await this.getPrimaryEndpoint()\n      return {\n        connected: this.activeEntries.size > 0 && endpoint !== null,\n        endpoint,\n      }\n    } catch (err) {\n      return {\n        connected: false,\n        endpoint: null,\n        error: err instanceof TailscaleCliError ? err.message : String(err),\n      }\n    }\n  }\n\n  private async listEndpoints(): Promise<ReadonlyArray<{\n    id: string\n    label: string\n    url: string\n    hostname: string\n    port: number\n    protocol: 'http' | 'https'\n    mode?: string\n    sourcePort?: number\n  }>> {\n    return this.resolveEndpoints()\n  }\n\n  // ── Helpers ─────────────────────────────────────────────────────────\n\n  private async applyIngressRule(entry: IngressEntry, enabled: boolean): Promise<void> {\n    const opts: { port: number; enabled: boolean; targetPath?: string } = {\n      port: entry.sourcePort,\n      enabled,\n      ...(entry.targetPath && entry.targetPath !== '/' ? { targetPath: entry.targetPath } : {}),\n    }\n    if (entry.mode === 'funnel') {\n      await this.cli.funnel(opts)\n    } else {\n      await this.cli.serve(opts)\n    }\n  }\n\n  /**\n   * Build the canonical endpoint list from the active entries map +\n   * the mesh-network MagicDNS hostname. Cold-start safe: when the host\n   * isn't joined yet we return an empty list rather than a half-formed\n   * URL with no hostname.\n   */\n  private async resolveEndpoints(): Promise<readonly ResolvedEndpoint[]> {\n    if (this.activeEntries.size === 0) return []\n    const meshStatus = await this.fetchMeshStatus().catch(() => null)\n    if (!meshStatus || !meshStatus.joined) return []\n    const host = meshStatus.magicDnsHostname\n    if (!host) return []\n    const out: ResolvedEndpoint[] = []\n    for (const entry of this.activeEntries.values()) {\n      const path = entry.targetPath && entry.targetPath !== '/' ? entry.targetPath : ''\n      out.push({\n        id: entryId(entry),\n        label: `${entry.mode === 'funnel' ? 'Funnel' : 'Serve'} :${entry.sourcePort}${path}`,\n        mode: entry.mode,\n        sourcePort: entry.sourcePort,\n        url: `https://${host}${path}`,\n        hostname: host,\n        port: 443,\n        protocol: 'https',\n      })\n    }\n    return out\n  }\n\n  /**\n   * Wait for `mesh-network` (the tailscale-client provider) to be\n   * mounted AND report joined. Throws an actionable error otherwise.\n   */\n  private async requireClientJoined(): Promise<void> {\n    try {\n      await this.ctx.acquireCapability('mesh-network', undefined, { timeoutMs: 30_000 })\n    } catch (err) {\n      throw new Error(\n        `tailscale-ingress: cap 'mesh-network' is not available — is @camstack/addon-tailscale-client installed and enabled? (${err instanceof Error ? err.message : String(err)})`,\n        { cause: err },\n      )\n    }\n    const status = await this.fetchMeshStatus()\n    if (!status.joined) {\n      throw new Error('tailscale-ingress: tailnet not joined — run Join on the Tailscale Client addon first.')\n    }\n  }\n\n  private async fetchMeshStatus(): Promise<{ joined: boolean; magicDnsHostname: string; error?: string }> {\n    const api = this.ctx.api as unknown as {\n      meshNetwork?: {\n        getStatus: {\n          query: (input?: { addonId?: string; nodeId?: string }) => Promise<{\n            joined: boolean\n            magicDnsHostname: string\n            error?: string\n          }>\n        }\n      }\n    }\n    if (!api.meshNetwork?.getStatus?.query) {\n      throw new Error('tailscale-ingress: mesh-network cap not exposed on the api surface')\n    }\n    return await api.meshNetwork.getStatus.query()\n  }\n\n  protected globalSettingsSchema() {\n    const ingressItemFields: readonly ConfigField[] = [\n      {\n        type: 'select',\n        key: 'mode',\n        label: 'Mode',\n        description: 'Serve = peers on your tailnet. Funnel = open internet (requires Funnel grant in tailnet ACL).',\n        options: [\n          { value: 'serve', label: 'Serve (tailnet HTTPS)' },\n          { value: 'funnel', label: 'Funnel (public HTTPS)' },\n        ],\n        default: 'serve',\n      },\n      {\n        type: 'number',\n        key: 'sourcePort',\n        label: 'Local port',\n        description: 'Local hub port the ingress should forward to (e.g. 4000).',\n        default: 4000,\n      },\n      {\n        type: 'text',\n        key: 'targetPath',\n        label: 'Mount path (optional)',\n        description: 'Public-side path prefix. Leave empty / set \"/\" for root.',\n        placeholder: '/',\n      },\n    ]\n    return this.schema({\n      sections: [\n        {\n          id: 'tailscale-ingress',\n          title: 'Tailscale Ingress',\n          description:\n            'Exposes the hub via Tailscale Serve (in-tailnet HTTPS) or Funnel (public). Add one row per ingress — Serve + Funnel can run concurrently on different ports / paths. Requires the Tailscale Client addon to have the host joined first.',\n          columns: 1,\n          fields: [\n            this.field({\n              type: 'boolean',\n              key: 'autoStart',\n              label: 'Start on boot',\n              description: 'Bring every configured ingress up automatically once the host is joined to the tailnet.',\n              default: DEFAULT_CONFIG.autoStart,\n            }),\n            {\n              type: 'editable-array',\n              key: 'ingresses',\n              label: 'Ingresses',\n              description: 'Each row is a single `tailscale serve` or `tailscale funnel` invocation.',\n              emptyMessage: 'No ingresses configured.',\n              addLabel: 'Add ingress',\n              rowTitleTemplate: '{mode} :{sourcePort}{targetPath}',\n              defaultItem: {\n                mode: 'serve',\n                sourcePort: 4000,\n                targetPath: '',\n              },\n              itemFields: ingressItemFields,\n            },\n          ],\n        },\n      ],\n    })\n  }\n\n  protected async onConfigChanged(): Promise<void> {\n    // When ingresses change while running, reconcile the daemon state.\n    // For simplicity we tear everything down and re-apply on the next\n    // start() — operators control re-bring-up via the Remote Access\n    // Start button (or the autoStart flag).\n    if (this.activeEntries.size === 0) return\n    await this.stop()\n    if (this.config.autoStart) {\n      await this.autoStartIfReady()\n    }\n  }\n}\n\nfunction entryId(entry: IngressEntry): string {\n  const path = entry.targetPath && entry.targetPath !== '/' ? entry.targetPath : ''\n  return `${entry.mode}-${entry.sourcePort}${path}`\n}\n\nexport default TailscaleIngressAddon\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,aAAA,uBAAA,CAAA,WAAsB,mBAAA,SAAS;AAErC,IAAM,uBAAuB;CAC3B;CACA;CACA;CACA;CAEA;CACD;AAED,IAAa,oBAAb,cAAuC,MAAM;CACE;CAA7C,YAAY,SAAiB,SAAiC,IAAI;EAChE,MAAM,QAAQ;EAD6B,KAAA,SAAA;EAE3C,KAAK,OAAO;;;AAyChB,IAAa,eAAb,MAA0B;CACxB,cAAqC;;CAGrC,MAAc,aAA8B;EAC1C,IAAI,KAAK,aAAa,OAAO,KAAK;EAClC,KAAK,MAAM,aAAa,sBACtB,IAAI;GACF,MAAM,UAAU,WAAW,CAAC,UAAU,EAAE,EAAE,SAAS,KAAO,CAAC;GAC3D,KAAK,cAAc;GACnB,OAAO;UACD;EAIV,MAAM,IAAI,kBACR,qFACD;;CAGH,MAAM,UAA2B;EAE/B,MAAM,EAAE,WAAW,MAAM,UAAU,MADjB,KAAK,YAAY,EACK,CAAC,UAAU,EAAE,EAAE,SAAS,KAAO,CAAC;EACxE,OAAO,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM;;CAGzC,MAAM,SAAuC;EAC3C,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,IAAI;GACF,MAAM,EAAE,WAAW,MAAM,UAAU,KAAK,CAAC,UAAU,SAAS,EAAE,EAAE,SAAS,KAAQ,CAAC;GAClF,OAAO,KAAK,MAAM,OAAO;WAClB,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,4BAA4B,EAAE,WAC9B,EAAE,UAAU,GACb;;;;;CAML,MAAM,GAAG,OAAgF;EACvF,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,MAAM,OAAO;GAAC;GAAM;GAAc,MAAM;GAAS;GAAU;EAC3D,IAAI,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,WAAW;EAC7D,IAAI;GACF,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,KAAQ,CAAC;WACxC,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,wBAAwB,EAAE,WAC1B,EAAE,UAAU,GACb;;;;;CAML,MAAM,OAAsB;EAC1B,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,IAAI;GACF,MAAM,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,MAAQ,CAAC;WAC5C,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,0BAA0B,EAAE,WAC5B,EAAE,UAAU,GACb;;;;;;;;;;CAWL,MAAM,MAAM,OAA0C;EACpD,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,MAAM,OAAO,KAAK,iBAAiB,SAAS,MAAM;EAClD,IAAI;GACF,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,MAAQ,CAAC;WACxC,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,2BAA2B,EAAE,WAC7B,EAAE,UAAU,GACb;;;;;;CAOL,MAAM,OAAO,OAA0C;EACrD,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,MAAM,OAAO,KAAK,iBAAiB,UAAU,MAAM;EACnD,IAAI;GACF,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,MAAQ,CAAC;WACxC,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,4BAA4B,EAAE,WAC9B,EAAE,UAAU,GACb;;;;;;;;;CAUL,iBAAyB,MAA0B,OAA8C;EAC/F,MAAM,QAAQ,MAAM,cAAc,IAAI,MAAM;EAC5C,IAAI,CAAC,MAAM,SAAS;GAClB,MAAM,MAAgB,CAAC,MAAM,OAAO;GACpC,IAAI,QAAQ,SAAS,KAAK,IAAI,KAAK,cAAc,OAAO;GACxD,IAAI,KAAK,MAAM;GACf,OAAO;;EAET,MAAM,MAAgB,CAAC,MAAM,OAAO;EACpC,IAAI,QAAQ,SAAS,KAAK,IAAI,KAAK,cAAc,OAAO;EACxD,IAAI,KAAK,oBAAoB,MAAM,OAAO;EAC1C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC7IX,IAAM,iBAAyC;CAC7C,WAAW;CACX,WAAW,EAAE;CACd;AAaD,IAAa,wBAAb,cAA2C,gBAAA,UAAkC;CAC3E,MAAc,IAAI,cAAc;;;;;;;CAOhC,gCAAwB,IAAI,KAA2B;;CAEvD,WAAmB;CAEnB,cAAc;EACZ,MAAM,EAAE,GAAG,gBAAgB,CAAC;;CAG9B,MAAgB,eAAgD;EAG9D,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,KAAK,IAAI,SAAS;GACxB,eAAe;WACR,KAAK;GACZ,KAAK,IAAI,OAAO,KAAK,8CAA8C,EACjE,MAAM,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,EAAE,EAClE,CAAC;;EAGJ,MAAM,WAAkC;GACtC,aAAa,KAAK,OAAO;GACzB,YAAY,KAAK,MAAM;GACvB,mBAAmB,KAAK,oBAAoB;GAC5C,iBAAiB,KAAK,WAAW;GACjC,qBAAqB,KAAK,eAAe;GAC1C;EASD,KAAK,IAAI,kBAAkB,KAAK,kBAAkB,CAAC;EAKnD,IAAI,gBAAgB,KAAK,OAAO,WAI9B,mBAAmB;GAAE,KAAU,kBAAkB;IAAG;EAMtD,IAAI,KAAK,OAAO,WAOd,KAAK,gBAAgB,gBAAgB,EACnC,eAAe;GAEb,KAAU,kBAAkB,CAAC,OAAO,QAAQ;IAC1C,KAAK,IAAI,OAAO,KAAK,+DAA+D,EAClF,MAAM,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,EAAE,EAClE,CAAC;KACF;KAEL,CAAC;EAGJ,OAAO,CAAC;GAAE,YAAY,gBAAA;GAAyB;GAAU,CAAC;;;;;;;CAU5D,MAAc,mBAAkC;EAC9C,IAAI,KAAK,OAAO,UAAU,WAAW,GAAG;GACtC,KAAK,IAAI,OAAO,KAAK,2EAA2E,EAC9F,MAAM;IAAE,OAAO;IAAqB,OAAO;IAAmB,EAC/D,CAAC;GACF;;EAKF,IAAI;EACJ,IAAI;GAEF,UAAS,MADY,KAAK,iBAAiB,EAC3B;UACV;GAEN,SAAS;;EAEX,IAAI,CAAC,QAAQ;GACX,KAAK,IAAI,OAAO,KAAK,8DAA8D,EACjF,MAAM;IAAE,OAAO;IAAqB,OAAO;IAA6B,EACzE,CAAC;GACF;;EAEF,IAAI;GACF,MAAM,KAAK,OAAO;GAClB,KAAK,IAAI,OAAO,KAAK,gDAAgD;IACnE,MAAM,EAAE,cAAc,KAAK,OAAO,UAAU,QAAQ;IACpD,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAgB;IAC5D,CAAC;WACK,KAAK;GAEZ,KAAK,IAAI,OAAO,KAAK,mFAAmF;IACtG,MAAM,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,EAAE;IACjE,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAmB;IAC/D,CAAC;;;CAMN,MAAc,QAA8F;EAC1G,IAAI,KAAK,UACP,MAAM,IAAI,MAAM,oDAAoD;EAEtE,MAAM,KAAK,qBAAqB;EAEhC,IAAI,KAAK,OAAO,UAAU,WAAW,GACnC,MAAM,IAAI,MAAM,2FAA2F;EAM7G,MAAM,SAAmB,EAAE;EAC3B,KAAK,MAAM,SAAS,KAAK,OAAO,WAC9B,IAAI;GACF,MAAM,KAAK,iBAAiB,OAAO,KAAK;GACxC,MAAM,KAAK,QAAQ,MAAM;GACzB,KAAK,cAAc,IAAI,IAAI,MAAM;WAC1B,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC5D,OAAO,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM,aAAa,MAAM,cAAc,GAAG,KAAK,MAAM;;EAItF,IAAI,KAAK,cAAc,SAAS,GAC9B,MAAM,IAAI,MAAM,qDAAqD,OAAO,KAAK,KAAK,GAAG;EAI3F,MAAM,WAAU,MADQ,KAAK,kBAAkB,EACrB;EAC1B,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,oHAAoH;EAGtI,KAAK,IAAI,UAAU,KAAK;GACtB,KAAA,GAAA,YAAA,aAAgB;GAChB,2BAAW,IAAI,MAAM;GACrB,QAAQ;IAAE,MAAM;IAAS,IAAI,KAAK,IAAI;IAAI;GAC1C,UAAU,gBAAA,cAAc;GACxB,MAAM,EAAE,KAAK,QAAQ,KAAK;GAC3B,CAAC;EAEF,IAAI,OAAO,SAAS,GAClB,KAAK,IAAI,OAAO,KAAK,oDAAoD;GACvE,MAAM;IAAE;IAAQ,WAAW,KAAK,cAAc;IAAM;GACpD,MAAM;IAAE,OAAO;IAAqB,OAAO;IAAiB;GAC7D,CAAC;EAGJ,OAAO;GACL,KAAK,QAAQ;GACb,UAAU,QAAQ;GAClB,MAAM,QAAQ;GACd,UAAU,QAAQ;GACnB;;CAGH,MAAc,OAAsB;EAElC,MAAM,WAAW,MAAM,KAAK,KAAK,cAAc,QAAQ,CAAC;EACxD,KAAK,cAAc,OAAO;EAC1B,KAAK,MAAM,SAAS,UAClB,IAAI;GACF,MAAM,KAAK,iBAAiB,OAAO,MAAM;WAClC,KAAK;GAIZ,KAAK,IAAI,OAAO,KAAK,8EAA8E;IACjG,MAAM;KACJ;KACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KACxD;IACD,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAc;IAC1D,CAAC;;EAGN,KAAK,IAAI,UAAU,KAAK;GACtB,KAAA,GAAA,YAAA,aAAgB;GAChB,2BAAW,IAAI,MAAM;GACrB,QAAQ;IAAE,MAAM;IAAS,IAAI,KAAK,IAAI;IAAI;GAC1C,UAAU,gBAAA,cAAc;GACxB,MAAM,EAAE;GACT,CAAC;;;;;;;;;;;;;CAgBJ,MAAc,mBAAkC;EAC9C,IAAI,KAAK,UAAU;EACnB,KAAK,WAAW;EAChB,MAAM,WAAW,MAAM,KAAK,KAAK,cAAc,QAAQ,CAAC;EACxD,IAAI,SAAS,WAAW,GAAG;EAI3B,IAAI;GACF,MAAM,KAAK,IAAI,SAAS;WACjB,KAAK;GACZ,KAAK,IAAI,OAAO,KAAK,kFAAmF;IACtG,MAAM;KACJ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KACvD,kBAAkB,SAAS;KAC5B;IACD,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAuB;IACnE,CAAC;GACF,KAAK,cAAc,OAAO;GAC1B;;EAGF,KAAK,MAAM,SAAS,UAClB,IAAI;GACF,MAAM,KAAK,iBAAiB,OAAO,MAAM;WAClC,KAAK;GACZ,KAAK,IAAI,OAAO,KAAK,kEAAkE;IACrF,MAAM;KACJ;KACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KACxD;IACD,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAuB;IACnE,CAAC;;EAGN,KAAK,cAAc,OAAO;;CAK5B,MAAc,qBAEZ;EAEA,MAAM,WAAU,MADE,KAAK,kBAAkB,EACrB;EACpB,IAAI,CAAC,SAAS,OAAO;EACrB,OAAO;GACL,KAAK,QAAQ;GACb,UAAU,QAAQ;GAClB,MAAM,QAAQ;GACd,UAAU,QAAQ;GACnB;;CAGH,MAAc,YAIX;EACD,IAAI;GACF,MAAM,WAAW,MAAM,KAAK,oBAAoB;GAChD,OAAO;IACL,WAAW,KAAK,cAAc,OAAO,KAAK,aAAa;IACvD;IACD;WACM,KAAK;GACZ,OAAO;IACL,WAAW;IACX,UAAU;IACV,OAAO,eAAe,oBAAoB,IAAI,UAAU,OAAO,IAAI;IACpE;;;CAIL,MAAc,gBASV;EACF,OAAO,KAAK,kBAAkB;;CAKhC,MAAc,iBAAiB,OAAqB,SAAiC;EACnF,MAAM,OAAgE;GACpE,MAAM,MAAM;GACZ;GACA,GAAI,MAAM,cAAc,MAAM,eAAe,MAAM,EAAE,YAAY,MAAM,YAAY,GAAG,EAAE;GACzF;EACD,IAAI,MAAM,SAAS,UACjB,MAAM,KAAK,IAAI,OAAO,KAAK;OAE3B,MAAM,KAAK,IAAI,MAAM,KAAK;;;;;;;;CAU9B,MAAc,mBAAyD;EACrE,IAAI,KAAK,cAAc,SAAS,GAAG,OAAO,EAAE;EAC5C,MAAM,aAAa,MAAM,KAAK,iBAAiB,CAAC,YAAY,KAAK;EACjE,IAAI,CAAC,cAAc,CAAC,WAAW,QAAQ,OAAO,EAAE;EAChD,MAAM,OAAO,WAAW;EACxB,IAAI,CAAC,MAAM,OAAO,EAAE;EACpB,MAAM,MAA0B,EAAE;EAClC,KAAK,MAAM,SAAS,KAAK,cAAc,QAAQ,EAAE;GAC/C,MAAM,OAAO,MAAM,cAAc,MAAM,eAAe,MAAM,MAAM,aAAa;GAC/E,IAAI,KAAK;IACP,IAAI,QAAQ,MAAM;IAClB,OAAO,GAAG,MAAM,SAAS,WAAW,WAAW,QAAQ,IAAI,MAAM,aAAa;IAC9E,MAAM,MAAM;IACZ,YAAY,MAAM;IAClB,KAAK,WAAW,OAAO;IACvB,UAAU;IACV,MAAM;IACN,UAAU;IACX,CAAC;;EAEJ,OAAO;;;;;;CAOT,MAAc,sBAAqC;EACjD,IAAI;GACF,MAAM,KAAK,IAAI,kBAAkB,gBAAgB,KAAA,GAAW,EAAE,WAAW,KAAQ,CAAC;WAC3E,KAAK;GACZ,MAAM,IAAI,MACR,wHAAwH,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC,IACzK,EAAE,OAAO,KAAK,CACf;;EAGH,IAAI,EAAC,MADgB,KAAK,iBAAiB,EAC/B,QACV,MAAM,IAAI,MAAM,wFAAwF;;CAI5G,MAAc,kBAA0F;EACtG,MAAM,MAAM,KAAK,IAAI;EAWrB,IAAI,CAAC,IAAI,aAAa,WAAW,OAC/B,MAAM,IAAI,MAAM,qEAAqE;EAEvF,OAAO,MAAM,IAAI,YAAY,UAAU,OAAO;;CAGhD,uBAAiC;EA4B/B,OAAO,KAAK,OAAO,EACjB,UAAU,CACR;GACE,IAAI;GACJ,OAAO;GACP,aACE;GACF,SAAS;GACT,QAAQ,CACN,KAAK,MAAM;IACT,MAAM;IACN,KAAK;IACL,OAAO;IACP,aAAa;IACb,SAAS,eAAe;IACzB,CAAC,EACF;IACE,MAAM;IACN,KAAK;IACL,OAAO;IACP,aAAa;IACb,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,aAAa;KACX,MAAM;KACN,YAAY;KACZ,YAAY;KACb;IACD,YAAY;KAvDpB;MACE,MAAM;MACN,KAAK;MACL,OAAO;MACP,aAAa;MACb,SAAS,CACP;OAAE,OAAO;OAAS,OAAO;OAAyB,EAClD;OAAE,OAAO;OAAU,OAAO;OAAyB,CACpD;MACD,SAAS;MACV;KACD;MACE,MAAM;MACN,KAAK;MACL,OAAO;MACP,aAAa;MACb,SAAS;MACV;KACD;MACE,MAAM;MACN,KAAK;MACL,OAAO;MACP,aAAa;MACb,aAAa;MACd;KA+BmB;IACb,CACF;GACF,CACF,EACF,CAAC;;CAGJ,MAAgB,kBAAiC;EAK/C,IAAI,KAAK,cAAc,SAAS,GAAG;EACnC,MAAM,KAAK,MAAM;EACjB,IAAI,KAAK,OAAO,WACd,MAAM,KAAK,kBAAkB;;;AAKnC,SAAS,QAAQ,OAA6B;CAC5C,MAAM,OAAO,MAAM,cAAc,MAAM,eAAe,MAAM,MAAM,aAAa;CAC/E,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,aAAa"}

package/dist/tailscale-ingress.addon.mjs

@@ -0,0 +1,541 @@
+import { BaseAddon, EventCategory, networkAccessCapability } from "@camstack/types";
+import { randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region src/tailscale-cli.ts
+/**
+* Thin wrapper around the `tailscale` CLI.
+*
+* Why CLI rather than the local API socket: `tailscaled` exposes its
+* control plane at `/var/run/tailscale/tailscaled.sock` but the wire
+* protocol is undocumented + the Go client is gnarly to port. The
+* `tailscale` CLI is the supported public interface, it covers every
+* action we need (`up`/`down`/`status --json`/`serve`/`funnel`), and
+* its output is stable JSON for `status` + non-fatal stderr for the
+* others.
+*
+* The wrapper:
+*   - resolves the binary path once (PATH lookup + macOS GUI install
+*     fallback at `/Applications/Tailscale.app/Contents/MacOS/Tailscale`).
+*   - exposes Promise-based methods returning typed shapes.
+*   - never spawns long-lived processes — every call is one-shot.
+*
+* Operator-side prerequisite: `tailscaled` must be installed +
+* running. The addon surfaces "binary missing" / "daemon not running"
+* errors verbatim so the operator can act.
+*/
+var execFileP = promisify(execFile);
+var TAILSCALE_CANDIDATES = [
+	"tailscale",
+	"/usr/bin/tailscale",
+	"/usr/local/bin/tailscale",
+	"/opt/homebrew/bin/tailscale",
+	"/Applications/Tailscale.app/Contents/MacOS/Tailscale"
+];
+var TailscaleCliError = class extends Error {
+	stderr;
+	constructor(message, stderr = "") {
+		super(message);
+		this.stderr = stderr;
+		this.name = "TailscaleCliError";
+	}
+};
+var TailscaleCli = class {
+	resolvedBin = null;
+	/** Locate the `tailscale` binary once and cache the result. */
+	async resolveBin() {
+		if (this.resolvedBin) return this.resolvedBin;
+		for (const candidate of TAILSCALE_CANDIDATES) try {
+			await execFileP(candidate, ["version"], { timeout: 3e3 });
+			this.resolvedBin = candidate;
+			return candidate;
+		} catch {}
+		throw new TailscaleCliError("tailscale binary not found — install Tailscale from https://tailscale.com/download");
+	}
+	async version() {
+		const { stdout } = await execFileP(await this.resolveBin(), ["version"], { timeout: 5e3 });
+		return stdout.trim().split("\n")[0] ?? "";
+	}
+	async status() {
+		const bin = await this.resolveBin();
+		try {
+			const { stdout } = await execFileP(bin, ["status", "--json"], { timeout: 1e4 });
+			return JSON.parse(stdout);
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale status failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/** Bring the daemon up with an auth key. Idempotent — calling
+	*  while already joined returns immediately. */
+	async up(input) {
+		const bin = await this.resolveBin();
+		const args = [
+			"up",
+			"--auth-key",
+			input.authKey,
+			"--reset"
+		];
+		if (input.hostname) args.push(`--hostname=${input.hostname}`);
+		try {
+			await execFileP(bin, args, { timeout: 6e4 });
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale up failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/** Leave the tailnet. After this the host's `100.x` address is
+	*  released until the next `up`. */
+	async down() {
+		const bin = await this.resolveBin();
+		try {
+			await execFileP(bin, ["down"], { timeout: 15e3 });
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale down failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/** `tailscale serve` — exposes a local port to peers in the same
+	*  tailnet over HTTPS with auto-issued cert. Mutating call; the
+	*  daemon persists the rule across restarts.
+	*
+	*  When `targetPath` is provided we pass `--set-path=<path>` so
+	*  multiple serve rules can co-exist under different prefixes
+	*  without overwriting each other. */
+	async serve(input) {
+		const bin = await this.resolveBin();
+		const args = this.buildIngressArgs("serve", input);
+		try {
+			await execFileP(bin, args, { timeout: 15e3 });
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale serve failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/** `tailscale funnel` — exposes a local port to the open internet
+	*  via Tailscale's edge. Requires Funnel ACL grant in the tailnet
+	*  policy. Same shape as `serve`. */
+	async funnel(input) {
+		const bin = await this.resolveBin();
+		const args = this.buildIngressArgs("funnel", input);
+		try {
+			await execFileP(bin, args, { timeout: 15e3 });
+		} catch (err) {
+			const e = err;
+			throw new TailscaleCliError(`tailscale funnel failed: ${e.message}`, e.stderr ?? "");
+		}
+	}
+	/**
+	* Single source of truth for the serve/funnel arg shape. The CLI
+	* accepts the same flag layout for both verbs, so we share the
+	* builder. `--set-path` is only emitted when the operator picks a
+	* non-root mount.
+	*/
+	buildIngressArgs(verb, input) {
+		const path = (input.targetPath ?? "").trim();
+		if (!input.enabled) {
+			const out = [verb, "--bg"];
+			if (path && path !== "/") out.push(`--set-path=${path}`);
+			out.push("off");
+			return out;
+		}
+		const out = [verb, "--bg"];
+		if (path && path !== "/") out.push(`--set-path=${path}`);
+		out.push(`http://127.0.0.1:${input.port}`);
+		return out;
+	}
+};
+//#endregion
+//#region src/tailscale-ingress.addon.ts
+/**
+* Tailscale Ingress addon — manages `tailscale serve` (in-tailnet
+* HTTPS) and `tailscale funnel` (public HTTPS) ingresses.
+*
+* Depends on `@camstack/addon-tailscale-client` being installed and
+* the host being joined to a tailnet. The mesh readiness check goes
+* through the `mesh-network` cap so we don't have to import the client
+* package directly.
+*
+* Registers the `network-access` collection cap so the Remote Access
+* page can toggle the public Funnel ingress alongside other ingress
+* providers (cloudflare-tunnel, ngrok, …).
+*
+* Per-ingress feature flags (#175, #176, #177):
+*   • `autoStart` — when set, the addon auto-runs `start()` once the
+*     mesh-network cap reports `joined: true` (boot or later state
+*     change). Errors do NOT crash the addon — they're logged + surfaced
+*     via `getStatus().error`.
+*   • `ingresses[]` — array of `{ mode, sourcePort, targetPath? }`
+*     entries. Each entry maps to one `tailscale serve` / `funnel` CLI
+*     invocation. Lets a single addon expose e.g. the hub on Serve AND
+*     a Funnel-exposed status page concurrently.
+*   • Graceful disposer — registered via `ctx.addDisposer(...)` so it
+*     survives addon-disable AND addon-uninstall. Runs `off` for every
+*     active ingress; if the daemon is unreachable we log + skip rather
+*     than zombieing the addon.
+*/
+var DEFAULT_CONFIG = {
+	autoStart: false,
+	ingresses: []
+};
+var TailscaleIngressAddon = class extends BaseAddon {
+	cli = new TailscaleCli();
+	/**
+	* Map of "live" entries the addon has called `enabled: true` for. Used
+	* by stop()/disposer to know which `off` calls to issue. Keyed by
+	* entry id (mode-port-path). The value retains the entry shape so a
+	* mid-flight config change can't break the cleanup contract.
+	*/
+	activeEntries = /* @__PURE__ */ new Map();
+	/** Set once disposer fires so re-entrant stop() calls are no-ops. */
+	disposed = false;
+	constructor() {
+		super({ ...DEFAULT_CONFIG });
+	}
+	async onInitialize() {
+		let cliReachable = false;
+		try {
+			await this.cli.version();
+			cliReachable = true;
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: Tailscale CLI not found", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+		const provider = {
+			start: () => this.start(),
+			stop: () => this.stop(),
+			getEndpoint: () => this.getPrimaryEndpoint(),
+			getStatus: () => this.getStatus(),
+			listEndpoints: () => this.listEndpoints()
+		};
+		this.ctx.addDisposer(() => this.gracefulShutdown());
+		if (cliReachable && this.config.autoStart) setImmediate(() => {
+			this.autoStartIfReady();
+		});
+		if (this.config.autoStart) this.watchCapability("mesh-network", { onReady: () => {
+			this.autoStartIfReady().catch((err) => {
+				this.ctx.logger.warn("tailscale-ingress: auto-start retry after mesh-ready failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		} });
+		return [{
+			capability: networkAccessCapability,
+			provider
+		}];
+	}
+	/**
+	* Single-shot bring-up driven by either boot or a mesh-ready event.
+	* Idempotent — start() is itself idempotent w.r.t. already-running
+	* CLI rules, and the active entries map dedupes across calls.
+	*/
+	async autoStartIfReady() {
+		if (this.config.ingresses.length === 0) {
+			this.ctx.logger.info("tailscale-ingress: autoStart on, but no ingresses configured — skipping", { tags: {
+				topic: "tailscale-ingress",
+				phase: "autostart-empty"
+			} });
+			return;
+		}
+		let joined;
+		try {
+			joined = (await this.fetchMeshStatus()).joined;
+		} catch {
+			joined = false;
+		}
+		if (!joined) {
+			this.ctx.logger.info("tailscale-ingress: autoStart waiting for mesh to be joined", { tags: {
+				topic: "tailscale-ingress",
+				phase: "autostart-mesh-not-joined"
+			} });
+			return;
+		}
+		try {
+			await this.start();
+			this.ctx.logger.info("tailscale-ingress: auto-started successfully", {
+				meta: { ingressCount: this.config.ingresses.length },
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "autostart-ok"
+				}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: auto-start failed (will be retried on next mesh-ready event)", {
+				meta: { error: err instanceof Error ? err.message : String(err) },
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "autostart-error"
+				}
+			});
+		}
+	}
+	async start() {
+		if (this.disposed) throw new Error("tailscale-ingress: addon shut down — cannot start");
+		await this.requireClientJoined();
+		if (this.config.ingresses.length === 0) throw new Error("tailscale-ingress: no ingresses configured — add at least one row in the addon settings.");
+		const errors = [];
+		for (const entry of this.config.ingresses) try {
+			await this.applyIngressRule(entry, true);
+			const id = entryId(entry);
+			this.activeEntries.set(id, entry);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			errors.push(`${entry.mode}:${entry.sourcePort}${entry.targetPath || ""} — ${msg}`);
+		}
+		if (this.activeEntries.size === 0) throw new Error(`tailscale-ingress: every ingress failed to start: ${errors.join("; ")}`);
+		const primary = (await this.resolveEndpoints())[0];
+		if (!primary) throw new Error("tailscale-ingress: CLI accepted the ingress but no MagicDNS hostname yet — has the host fully joined the tailnet?");
+		this.ctx.eventBus?.emit({
+			id: randomUUID(),
+			timestamp: /* @__PURE__ */ new Date(),
+			source: {
+				type: "addon",
+				id: this.ctx.id
+			},
+			category: EventCategory.NetworkTunnelStarted,
+			data: { url: primary.url }
+		});
+		if (errors.length > 0) this.ctx.logger.warn("tailscale-ingress: started with partial failures", {
+			meta: {
+				errors,
+				succeeded: this.activeEntries.size
+			},
+			tags: {
+				topic: "tailscale-ingress",
+				phase: "start-partial"
+			}
+		});
+		return {
+			url: primary.url,
+			hostname: primary.hostname,
+			port: primary.port,
+			protocol: primary.protocol
+		};
+	}
+	async stop() {
+		const snapshot = Array.from(this.activeEntries.values());
+		this.activeEntries.clear();
+		for (const entry of snapshot) try {
+			await this.applyIngressRule(entry, false);
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: failed to stop entry — will retry on next disposer call", {
+				meta: {
+					entry,
+					error: err instanceof Error ? err.message : String(err)
+				},
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "stop-error"
+				}
+			});
+		}
+		this.ctx.eventBus?.emit({
+			id: randomUUID(),
+			timestamp: /* @__PURE__ */ new Date(),
+			source: {
+				type: "addon",
+				id: this.ctx.id
+			},
+			category: EventCategory.NetworkTunnelStopped,
+			data: {}
+		});
+	}
+	/**
+	* Runs from `ctx.addDisposer(...)` on every teardown path:
+	*   - addon disable / uninstall
+	*   - restartAddon
+	*   - full server shutdown
+	*
+	* Strategy: walk every active entry and ask the daemon to clear the
+	* matching rule. If the daemon is unreachable we log the failure and
+	* proceed — leaving the addon zombied with mesh ingress is worse than
+	* a stale rule the operator can clean up by hand.
+	*/
+	async gracefulShutdown() {
+		if (this.disposed) return;
+		this.disposed = true;
+		const snapshot = Array.from(this.activeEntries.values());
+		if (snapshot.length === 0) return;
+		try {
+			await this.cli.version();
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: disposer can't reach tailscale CLI — leaving rules in place", {
+				meta: {
+					error: err instanceof Error ? err.message : String(err),
+					remainingEntries: snapshot.length
+				},
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "dispose-cli-missing"
+				}
+			});
+			this.activeEntries.clear();
+			return;
+		}
+		for (const entry of snapshot) try {
+			await this.applyIngressRule(entry, false);
+		} catch (err) {
+			this.ctx.logger.warn("tailscale-ingress: disposer failed to clear entry — continuing", {
+				meta: {
+					entry,
+					error: err instanceof Error ? err.message : String(err)
+				},
+				tags: {
+					topic: "tailscale-ingress",
+					phase: "dispose-entry-error"
+				}
+			});
+		}
+		this.activeEntries.clear();
+	}
+	async getPrimaryEndpoint() {
+		const primary = (await this.resolveEndpoints())[0];
+		if (!primary) return null;
+		return {
+			url: primary.url,
+			hostname: primary.hostname,
+			port: primary.port,
+			protocol: primary.protocol
+		};
+	}
+	async getStatus() {
+		try {
+			const endpoint = await this.getPrimaryEndpoint();
+			return {
+				connected: this.activeEntries.size > 0 && endpoint !== null,
+				endpoint
+			};
+		} catch (err) {
+			return {
+				connected: false,
+				endpoint: null,
+				error: err instanceof TailscaleCliError ? err.message : String(err)
+			};
+		}
+	}
+	async listEndpoints() {
+		return this.resolveEndpoints();
+	}
+	async applyIngressRule(entry, enabled) {
+		const opts = {
+			port: entry.sourcePort,
+			enabled,
+			...entry.targetPath && entry.targetPath !== "/" ? { targetPath: entry.targetPath } : {}
+		};
+		if (entry.mode === "funnel") await this.cli.funnel(opts);
+		else await this.cli.serve(opts);
+	}
+	/**
+	* Build the canonical endpoint list from the active entries map +
+	* the mesh-network MagicDNS hostname. Cold-start safe: when the host
+	* isn't joined yet we return an empty list rather than a half-formed
+	* URL with no hostname.
+	*/
+	async resolveEndpoints() {
+		if (this.activeEntries.size === 0) return [];
+		const meshStatus = await this.fetchMeshStatus().catch(() => null);
+		if (!meshStatus || !meshStatus.joined) return [];
+		const host = meshStatus.magicDnsHostname;
+		if (!host) return [];
+		const out = [];
+		for (const entry of this.activeEntries.values()) {
+			const path = entry.targetPath && entry.targetPath !== "/" ? entry.targetPath : "";
+			out.push({
+				id: entryId(entry),
+				label: `${entry.mode === "funnel" ? "Funnel" : "Serve"} :${entry.sourcePort}${path}`,
+				mode: entry.mode,
+				sourcePort: entry.sourcePort,
+				url: `https://${host}${path}`,
+				hostname: host,
+				port: 443,
+				protocol: "https"
+			});
+		}
+		return out;
+	}
+	/**
+	* Wait for `mesh-network` (the tailscale-client provider) to be
+	* mounted AND report joined. Throws an actionable error otherwise.
+	*/
+	async requireClientJoined() {
+		try {
+			await this.ctx.acquireCapability("mesh-network", void 0, { timeoutMs: 3e4 });
+		} catch (err) {
+			throw new Error(`tailscale-ingress: cap 'mesh-network' is not available — is @camstack/addon-tailscale-client installed and enabled? (${err instanceof Error ? err.message : String(err)})`, { cause: err });
+		}
+		if (!(await this.fetchMeshStatus()).joined) throw new Error("tailscale-ingress: tailnet not joined — run Join on the Tailscale Client addon first.");
+	}
+	async fetchMeshStatus() {
+		const api = this.ctx.api;
+		if (!api.meshNetwork?.getStatus?.query) throw new Error("tailscale-ingress: mesh-network cap not exposed on the api surface");
+		return await api.meshNetwork.getStatus.query();
+	}
+	globalSettingsSchema() {
+		return this.schema({ sections: [{
+			id: "tailscale-ingress",
+			title: "Tailscale Ingress",
+			description: "Exposes the hub via Tailscale Serve (in-tailnet HTTPS) or Funnel (public). Add one row per ingress — Serve + Funnel can run concurrently on different ports / paths. Requires the Tailscale Client addon to have the host joined first.",
+			columns: 1,
+			fields: [this.field({
+				type: "boolean",
+				key: "autoStart",
+				label: "Start on boot",
+				description: "Bring every configured ingress up automatically once the host is joined to the tailnet.",
+				default: DEFAULT_CONFIG.autoStart
+			}), {
+				type: "editable-array",
+				key: "ingresses",
+				label: "Ingresses",
+				description: "Each row is a single `tailscale serve` or `tailscale funnel` invocation.",
+				emptyMessage: "No ingresses configured.",
+				addLabel: "Add ingress",
+				rowTitleTemplate: "{mode} :{sourcePort}{targetPath}",
+				defaultItem: {
+					mode: "serve",
+					sourcePort: 4e3,
+					targetPath: ""
+				},
+				itemFields: [
+					{
+						type: "select",
+						key: "mode",
+						label: "Mode",
+						description: "Serve = peers on your tailnet. Funnel = open internet (requires Funnel grant in tailnet ACL).",
+						options: [{
+							value: "serve",
+							label: "Serve (tailnet HTTPS)"
+						}, {
+							value: "funnel",
+							label: "Funnel (public HTTPS)"
+						}],
+						default: "serve"
+					},
+					{
+						type: "number",
+						key: "sourcePort",
+						label: "Local port",
+						description: "Local hub port the ingress should forward to (e.g. 4000).",
+						default: 4e3
+					},
+					{
+						type: "text",
+						key: "targetPath",
+						label: "Mount path (optional)",
+						description: "Public-side path prefix. Leave empty / set \"/\" for root.",
+						placeholder: "/"
+					}
+				]
+			}]
+		}] });
+	}
+	async onConfigChanged() {
+		if (this.activeEntries.size === 0) return;
+		await this.stop();
+		if (this.config.autoStart) await this.autoStartIfReady();
+	}
+};
+function entryId(entry) {
+	const path = entry.targetPath && entry.targetPath !== "/" ? entry.targetPath : "";
+	return `${entry.mode}-${entry.sourcePort}${path}`;
+}
+//#endregion
+export { TailscaleIngressAddon, TailscaleIngressAddon as default };
+
+//# sourceMappingURL=tailscale-ingress.addon.mjs.map

package/dist/tailscale-ingress.addon.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale-ingress.addon.mjs","names":[],"sources":["../src/tailscale-cli.ts","../src/tailscale-ingress.addon.ts"],"sourcesContent":["/**\n * Thin wrapper around the `tailscale` CLI.\n *\n * Why CLI rather than the local API socket: `tailscaled` exposes its\n * control plane at `/var/run/tailscale/tailscaled.sock` but the wire\n * protocol is undocumented + the Go client is gnarly to port. The\n * `tailscale` CLI is the supported public interface, it covers every\n * action we need (`up`/`down`/`status --json`/`serve`/`funnel`), and\n * its output is stable JSON for `status` + non-fatal stderr for the\n * others.\n *\n * The wrapper:\n *   - resolves the binary path once (PATH lookup + macOS GUI install\n *     fallback at `/Applications/Tailscale.app/Contents/MacOS/Tailscale`).\n *   - exposes Promise-based methods returning typed shapes.\n *   - never spawns long-lived processes — every call is one-shot.\n *\n * Operator-side prerequisite: `tailscaled` must be installed +\n * running. The addon surfaces \"binary missing\" / \"daemon not running\"\n * errors verbatim so the operator can act.\n */\nimport { execFile } from 'node:child_process'\nimport { promisify } from 'node:util'\n\nconst execFileP = promisify(execFile)\n\nconst TAILSCALE_CANDIDATES = [\n  'tailscale',\n  '/usr/bin/tailscale',\n  '/usr/local/bin/tailscale',\n  '/opt/homebrew/bin/tailscale',\n  // macOS GUI install ships the CLI inside the .app bundle.\n  '/Applications/Tailscale.app/Contents/MacOS/Tailscale',\n]\n\nexport class TailscaleCliError extends Error {\n  constructor(message: string, public readonly stderr: string = '') {\n    super(message)\n    this.name = 'TailscaleCliError'\n  }\n}\n\n/** Subset of `tailscale status --json` we actually use. */\nexport interface TailscaleStatusJson {\n  readonly BackendState: 'NoState' | 'NeedsLogin' | 'NeedsMachineAuth' | 'Starting' | 'Running' | 'Stopped'\n  readonly Self?: {\n    readonly ID: string\n    readonly HostName: string\n    readonly DNSName: string // e.g. \"camstack.tail-abc.ts.net.\"\n    readonly TailscaleIPs?: readonly string[]\n    readonly Online: boolean\n    readonly OS: string\n  }\n  readonly Peer?: Record<string, {\n    readonly ID: string\n    readonly HostName: string\n    readonly DNSName: string\n    readonly TailscaleIPs?: readonly string[]\n    readonly Online: boolean\n    readonly OS: string\n    readonly LastSeen: string // ISO 8601\n  }>\n  readonly MagicDNSSuffix?: string\n  readonly CurrentTailnet?: { readonly Name?: string; readonly MagicDNSSuffix?: string }\n}\n\n/**\n * Options for the per-ingress serve/funnel CLI calls. `targetPath` is\n * the public-facing mount path the operator wants the rule to live at\n * (default `/`). Tailscale's `serve` syntax accepts an optional\n * `--set-path=<path>` flag to attach the rule to a non-root prefix —\n * we drive it through this option.\n */\nexport interface IngressRuleOptions {\n  readonly port: number\n  readonly enabled: boolean\n  readonly targetPath?: string\n}\n\nexport class TailscaleCli {\n  private resolvedBin: string | null = null\n\n  /** Locate the `tailscale` binary once and cache the result. */\n  private async resolveBin(): Promise<string> {\n    if (this.resolvedBin) return this.resolvedBin\n    for (const candidate of TAILSCALE_CANDIDATES) {\n      try {\n        await execFileP(candidate, ['version'], { timeout: 3_000 })\n        this.resolvedBin = candidate\n        return candidate\n      } catch {\n        // try next\n      }\n    }\n    throw new TailscaleCliError(\n      'tailscale binary not found — install Tailscale from https://tailscale.com/download',\n    )\n  }\n\n  async version(): Promise<string> {\n    const bin = await this.resolveBin()\n    const { stdout } = await execFileP(bin, ['version'], { timeout: 5_000 })\n    return stdout.trim().split('\\n')[0] ?? ''\n  }\n\n  async status(): Promise<TailscaleStatusJson> {\n    const bin = await this.resolveBin()\n    try {\n      const { stdout } = await execFileP(bin, ['status', '--json'], { timeout: 10_000 })\n      return JSON.parse(stdout) as TailscaleStatusJson\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale status failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /** Bring the daemon up with an auth key. Idempotent — calling\n   *  while already joined returns immediately. */\n  async up(input: { readonly authKey: string; readonly hostname?: string }): Promise<void> {\n    const bin = await this.resolveBin()\n    const args = ['up', '--auth-key', input.authKey, '--reset']\n    if (input.hostname) args.push(`--hostname=${input.hostname}`)\n    try {\n      await execFileP(bin, args, { timeout: 60_000 })\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale up failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /** Leave the tailnet. After this the host's `100.x` address is\n   *  released until the next `up`. */\n  async down(): Promise<void> {\n    const bin = await this.resolveBin()\n    try {\n      await execFileP(bin, ['down'], { timeout: 15_000 })\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale down failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /** `tailscale serve` — exposes a local port to peers in the same\n   *  tailnet over HTTPS with auto-issued cert. Mutating call; the\n   *  daemon persists the rule across restarts.\n   *\n   *  When `targetPath` is provided we pass `--set-path=<path>` so\n   *  multiple serve rules can co-exist under different prefixes\n   *  without overwriting each other. */\n  async serve(input: IngressRuleOptions): Promise<void> {\n    const bin = await this.resolveBin()\n    const args = this.buildIngressArgs('serve', input)\n    try {\n      await execFileP(bin, args, { timeout: 15_000 })\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale serve failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /** `tailscale funnel` — exposes a local port to the open internet\n   *  via Tailscale's edge. Requires Funnel ACL grant in the tailnet\n   *  policy. Same shape as `serve`. */\n  async funnel(input: IngressRuleOptions): Promise<void> {\n    const bin = await this.resolveBin()\n    const args = this.buildIngressArgs('funnel', input)\n    try {\n      await execFileP(bin, args, { timeout: 15_000 })\n    } catch (err) {\n      const e = err as { stderr?: string; message: string }\n      throw new TailscaleCliError(\n        `tailscale funnel failed: ${e.message}`,\n        e.stderr ?? '',\n      )\n    }\n  }\n\n  /**\n   * Single source of truth for the serve/funnel arg shape. The CLI\n   * accepts the same flag layout for both verbs, so we share the\n   * builder. `--set-path` is only emitted when the operator picks a\n   * non-root mount.\n   */\n  private buildIngressArgs(verb: 'serve' | 'funnel', input: IngressRuleOptions): readonly string[] {\n    const path = (input.targetPath ?? '').trim()\n    if (!input.enabled) {\n      const out: string[] = [verb, '--bg']\n      if (path && path !== '/') out.push(`--set-path=${path}`)\n      out.push('off')\n      return out\n    }\n    const out: string[] = [verb, '--bg']\n    if (path && path !== '/') out.push(`--set-path=${path}`)\n    out.push(`http://127.0.0.1:${input.port}`)\n    return out\n  }\n}\n","/**\n * Tailscale Ingress addon — manages `tailscale serve` (in-tailnet\n * HTTPS) and `tailscale funnel` (public HTTPS) ingresses.\n *\n * Depends on `@camstack/addon-tailscale-client` being installed and\n * the host being joined to a tailnet. The mesh readiness check goes\n * through the `mesh-network` cap so we don't have to import the client\n * package directly.\n *\n * Registers the `network-access` collection cap so the Remote Access\n * page can toggle the public Funnel ingress alongside other ingress\n * providers (cloudflare-tunnel, ngrok, …).\n *\n * Per-ingress feature flags (#175, #176, #177):\n *   • `autoStart` — when set, the addon auto-runs `start()` once the\n *     mesh-network cap reports `joined: true` (boot or later state\n *     change). Errors do NOT crash the addon — they're logged + surfaced\n *     via `getStatus().error`.\n *   • `ingresses[]` — array of `{ mode, sourcePort, targetPath? }`\n *     entries. Each entry maps to one `tailscale serve` / `funnel` CLI\n *     invocation. Lets a single addon expose e.g. the hub on Serve AND\n *     a Funnel-exposed status page concurrently.\n *   • Graceful disposer — registered via `ctx.addDisposer(...)` so it\n *     survives addon-disable AND addon-uninstall. Runs `off` for every\n *     active ingress; if the daemon is unreachable we log + skip rather\n *     than zombieing the addon.\n */\nimport {\n  BaseAddon,\n  EventCategory,\n  networkAccessCapability,\n  type ConfigField,\n  type InferProvider,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ntype NetworkAccessProvider = InferProvider<typeof networkAccessCapability>\nimport { randomUUID } from 'node:crypto'\n\nimport { TailscaleCli, TailscaleCliError } from './tailscale-cli.js'\n\n// ── Settings shape (#176) ───────────────────────────────────────────\n\ntype IngressMode = 'serve' | 'funnel'\n\n/**\n * Single ingress entry. The CLI invocation is one-to-one with an entry:\n * the addon manages independent `tailscale serve|funnel` rules per row.\n * Identity is `{mode}-{sourcePort}-{normalisedTargetPath}` — used as the\n * endpoint id and the cleanup key.\n */\ninterface IngressEntry {\n  readonly mode: IngressMode\n  readonly sourcePort: number\n  /** Public-side mount path. Empty / `/` = root. */\n  readonly targetPath: string\n}\n\ninterface TailscaleIngressConfig {\n  /** When true AND mesh-network is joined, auto-run `start()` on boot. */\n  readonly autoStart: boolean\n  /** All configured ingress rules. */\n  readonly ingresses: readonly IngressEntry[]\n}\n\nconst DEFAULT_CONFIG: TailscaleIngressConfig = {\n  autoStart: false,\n  ingresses: [],\n}\n\ninterface ResolvedEndpoint {\n  readonly id: string\n  readonly label: string\n  readonly mode: IngressMode\n  readonly sourcePort: number\n  readonly url: string\n  readonly hostname: string\n  readonly port: 443\n  readonly protocol: 'https'\n}\n\nexport class TailscaleIngressAddon extends BaseAddon<TailscaleIngressConfig> {\n  private cli = new TailscaleCli()\n  /**\n   * Map of \"live\" entries the addon has called `enabled: true` for. Used\n   * by stop()/disposer to know which `off` calls to issue. Keyed by\n   * entry id (mode-port-path). The value retains the entry shape so a\n   * mid-flight config change can't break the cleanup contract.\n   */\n  private activeEntries = new Map<string, IngressEntry>()\n  /** Set once disposer fires so re-entrant stop() calls are no-ops. */\n  private disposed = false\n\n  constructor() {\n    super({ ...DEFAULT_CONFIG })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    // Sanity-probe the CLI early so the operator sees a clear error\n    // when the daemon isn't installed.\n    let cliReachable = false\n    try {\n      await this.cli.version()\n      cliReachable = true\n    } catch (err) {\n      this.ctx.logger.warn('tailscale-ingress: Tailscale CLI not found', {\n        meta: { error: err instanceof Error ? err.message : String(err) },\n      })\n    }\n\n    const provider: NetworkAccessProvider = {\n      start: () => this.start(),\n      stop: () => this.stop(),\n      getEndpoint: () => this.getPrimaryEndpoint(),\n      getStatus: () => this.getStatus(),\n      listEndpoints: () => this.listEndpoints(),\n    }\n\n    // Graceful shutdown disposer (#177) — runs on:\n    //   • addon disable / uninstall (kernel calls `addon.shutdown()`)\n    //   • restartAddon (kernel calls shutdown + re-init)\n    //   • full server shutdown\n    // We don't try to be clever about \"uninstall vs disable\" — for\n    // active ingresses the right cleanup is identical (turn rules off).\n    // Disposers run before `_ctx` is nulled, so logging still works.\n    this.ctx.addDisposer(() => this.gracefulShutdown())\n\n    // Auto-start (#175) — only when the CLI is reachable AND the\n    // operator opted in. We don't crash the addon on failure here:\n    // start() catches its own errors when invoked through this path.\n    if (cliReachable && this.config.autoStart) {\n      // Defer to the next tick so provider registration completes\n      // first. Otherwise `requireClientJoined` may race the cap-ready\n      // event for `mesh-network` on cold boot.\n      setImmediate(() => { void this.autoStartIfReady() })\n    }\n\n    // Subscribe to mesh-network readiness transitions so a delayed\n    // `joined: true` (operator clicks Connect after we booted) also\n    // triggers auto-start without requiring a server restart.\n    if (this.config.autoStart) {\n      // `watchCapability` is a BaseAddon helper that wraps the\n      // `system.ready-state` subscription with type narrowing. We only\n      // care about the `ready` transition — when mesh-network goes\n      // down we want operator-visible feedback (next getStatus call\n      // returns connected: false) but no automatic teardown of rules,\n      // which would race the daemon's own reconnect path.\n      this.watchCapability('mesh-network', {\n        onReady: () => {\n          // Best-effort: silently no-op when auto-start already ran.\n          void this.autoStartIfReady().catch((err) => {\n            this.ctx.logger.warn('tailscale-ingress: auto-start retry after mesh-ready failed', {\n              meta: { error: err instanceof Error ? err.message : String(err) },\n            })\n          })\n        },\n      })\n    }\n\n    return [{ capability: networkAccessCapability, provider }]\n  }\n\n  // ── #175 — autoStart helper ─────────────────────────────────────────\n\n  /**\n   * Single-shot bring-up driven by either boot or a mesh-ready event.\n   * Idempotent — start() is itself idempotent w.r.t. already-running\n   * CLI rules, and the active entries map dedupes across calls.\n   */\n  private async autoStartIfReady(): Promise<void> {\n    if (this.config.ingresses.length === 0) {\n      this.ctx.logger.info('tailscale-ingress: autoStart on, but no ingresses configured — skipping', {\n        tags: { topic: 'tailscale-ingress', phase: 'autostart-empty' },\n      })\n      return\n    }\n    // We re-probe mesh-network status via the cap rather than just\n    // trusting the readiness event — readiness is binary (ready/down)\n    // but the actual mesh may be NeedsLogin / NeedsMachineAuth / etc.\n    let joined: boolean\n    try {\n      const status = await this.fetchMeshStatus()\n      joined = status.joined\n    } catch {\n      // Treat as not joined; don't spam the log on every retry tick.\n      joined = false\n    }\n    if (!joined) {\n      this.ctx.logger.info('tailscale-ingress: autoStart waiting for mesh to be joined', {\n        tags: { topic: 'tailscale-ingress', phase: 'autostart-mesh-not-joined' },\n      })\n      return\n    }\n    try {\n      await this.start()\n      this.ctx.logger.info('tailscale-ingress: auto-started successfully', {\n        meta: { ingressCount: this.config.ingresses.length },\n        tags: { topic: 'tailscale-ingress', phase: 'autostart-ok' },\n      })\n    } catch (err) {\n      // Don't crash — surface the error through the next getStatus().\n      this.ctx.logger.warn('tailscale-ingress: auto-start failed (will be retried on next mesh-ready event)', {\n        meta: { error: err instanceof Error ? err.message : String(err) },\n        tags: { topic: 'tailscale-ingress', phase: 'autostart-error' },\n      })\n    }\n  }\n\n  // ── #176 — multi-ingress lifecycle ──────────────────────────────────\n\n  private async start(): Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }> {\n    if (this.disposed) {\n      throw new Error('tailscale-ingress: addon shut down — cannot start')\n    }\n    await this.requireClientJoined()\n\n    if (this.config.ingresses.length === 0) {\n      throw new Error('tailscale-ingress: no ingresses configured — add at least one row in the addon settings.')\n    }\n\n    // Apply each ingress rule. We collect errors but don't short-circuit\n    // — if entry #2 fails, entry #1 stays up (and is also recorded so\n    // a later stop() cleans it up).\n    const errors: string[] = []\n    for (const entry of this.config.ingresses) {\n      try {\n        await this.applyIngressRule(entry, true)\n        const id = entryId(entry)\n        this.activeEntries.set(id, entry)\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err)\n        errors.push(`${entry.mode}:${entry.sourcePort}${entry.targetPath || ''} — ${msg}`)\n      }\n    }\n\n    if (this.activeEntries.size === 0) {\n      throw new Error(`tailscale-ingress: every ingress failed to start: ${errors.join('; ')}`)\n    }\n\n    const endpoints = await this.resolveEndpoints()\n    const primary = endpoints[0]\n    if (!primary) {\n      throw new Error('tailscale-ingress: CLI accepted the ingress but no MagicDNS hostname yet — has the host fully joined the tailnet?')\n    }\n\n    this.ctx.eventBus?.emit({\n      id: randomUUID(),\n      timestamp: new Date(),\n      source: { type: 'addon', id: this.ctx.id },\n      category: EventCategory.NetworkTunnelStarted,\n      data: { url: primary.url },\n    })\n\n    if (errors.length > 0) {\n      this.ctx.logger.warn('tailscale-ingress: started with partial failures', {\n        meta: { errors, succeeded: this.activeEntries.size },\n        tags: { topic: 'tailscale-ingress', phase: 'start-partial' },\n      })\n    }\n\n    return {\n      url: primary.url,\n      hostname: primary.hostname,\n      port: primary.port,\n      protocol: primary.protocol,\n    }\n  }\n\n  private async stop(): Promise<void> {\n    // Snapshot then clear so re-entrant calls don't double-issue `off`.\n    const snapshot = Array.from(this.activeEntries.values())\n    this.activeEntries.clear()\n    for (const entry of snapshot) {\n      try {\n        await this.applyIngressRule(entry, false)\n      } catch (err) {\n        // Log but don't throw — `stop()` must always succeed from the\n        // operator's POV. A failed off-call is recoverable on the next\n        // boot via the disposer or a manual CLI cleanup.\n        this.ctx.logger.warn('tailscale-ingress: failed to stop entry — will retry on next disposer call', {\n          meta: {\n            entry,\n            error: err instanceof Error ? err.message : String(err),\n          },\n          tags: { topic: 'tailscale-ingress', phase: 'stop-error' },\n        })\n      }\n    }\n    this.ctx.eventBus?.emit({\n      id: randomUUID(),\n      timestamp: new Date(),\n      source: { type: 'addon', id: this.ctx.id },\n      category: EventCategory.NetworkTunnelStopped,\n      data: {},\n    })\n  }\n\n  // ── #177 — graceful disposer ────────────────────────────────────────\n\n  /**\n   * Runs from `ctx.addDisposer(...)` on every teardown path:\n   *   - addon disable / uninstall\n   *   - restartAddon\n   *   - full server shutdown\n   *\n   * Strategy: walk every active entry and ask the daemon to clear the\n   * matching rule. If the daemon is unreachable we log the failure and\n   * proceed — leaving the addon zombied with mesh ingress is worse than\n   * a stale rule the operator can clean up by hand.\n   */\n  private async gracefulShutdown(): Promise<void> {\n    if (this.disposed) return\n    this.disposed = true\n    const snapshot = Array.from(this.activeEntries.values())\n    if (snapshot.length === 0) return\n\n    // Probe the daemon first — a clean \"CLI missing\" path lets us log\n    // the operator-actionable error once instead of N times.\n    try {\n      await this.cli.version()\n    } catch (err) {\n      this.ctx.logger.warn('tailscale-ingress: disposer can\\'t reach tailscale CLI — leaving rules in place', {\n        meta: {\n          error: err instanceof Error ? err.message : String(err),\n          remainingEntries: snapshot.length,\n        },\n        tags: { topic: 'tailscale-ingress', phase: 'dispose-cli-missing' },\n      })\n      this.activeEntries.clear()\n      return\n    }\n\n    for (const entry of snapshot) {\n      try {\n        await this.applyIngressRule(entry, false)\n      } catch (err) {\n        this.ctx.logger.warn('tailscale-ingress: disposer failed to clear entry — continuing', {\n          meta: {\n            entry,\n            error: err instanceof Error ? err.message : String(err),\n          },\n          tags: { topic: 'tailscale-ingress', phase: 'dispose-entry-error' },\n        })\n      }\n    }\n    this.activeEntries.clear()\n  }\n\n  // ── network-access provider impl ───────────────────────────────────\n\n  private async getPrimaryEndpoint(): Promise<\n    { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n  > {\n    const all = await this.resolveEndpoints()\n    const primary = all[0]\n    if (!primary) return null\n    return {\n      url: primary.url,\n      hostname: primary.hostname,\n      port: primary.port,\n      protocol: primary.protocol,\n    }\n  }\n\n  private async getStatus(): Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }> {\n    try {\n      const endpoint = await this.getPrimaryEndpoint()\n      return {\n        connected: this.activeEntries.size > 0 && endpoint !== null,\n        endpoint,\n      }\n    } catch (err) {\n      return {\n        connected: false,\n        endpoint: null,\n        error: err instanceof TailscaleCliError ? err.message : String(err),\n      }\n    }\n  }\n\n  private async listEndpoints(): Promise<ReadonlyArray<{\n    id: string\n    label: string\n    url: string\n    hostname: string\n    port: number\n    protocol: 'http' | 'https'\n    mode?: string\n    sourcePort?: number\n  }>> {\n    return this.resolveEndpoints()\n  }\n\n  // ── Helpers ─────────────────────────────────────────────────────────\n\n  private async applyIngressRule(entry: IngressEntry, enabled: boolean): Promise<void> {\n    const opts: { port: number; enabled: boolean; targetPath?: string } = {\n      port: entry.sourcePort,\n      enabled,\n      ...(entry.targetPath && entry.targetPath !== '/' ? { targetPath: entry.targetPath } : {}),\n    }\n    if (entry.mode === 'funnel') {\n      await this.cli.funnel(opts)\n    } else {\n      await this.cli.serve(opts)\n    }\n  }\n\n  /**\n   * Build the canonical endpoint list from the active entries map +\n   * the mesh-network MagicDNS hostname. Cold-start safe: when the host\n   * isn't joined yet we return an empty list rather than a half-formed\n   * URL with no hostname.\n   */\n  private async resolveEndpoints(): Promise<readonly ResolvedEndpoint[]> {\n    if (this.activeEntries.size === 0) return []\n    const meshStatus = await this.fetchMeshStatus().catch(() => null)\n    if (!meshStatus || !meshStatus.joined) return []\n    const host = meshStatus.magicDnsHostname\n    if (!host) return []\n    const out: ResolvedEndpoint[] = []\n    for (const entry of this.activeEntries.values()) {\n      const path = entry.targetPath && entry.targetPath !== '/' ? entry.targetPath : ''\n      out.push({\n        id: entryId(entry),\n        label: `${entry.mode === 'funnel' ? 'Funnel' : 'Serve'} :${entry.sourcePort}${path}`,\n        mode: entry.mode,\n        sourcePort: entry.sourcePort,\n        url: `https://${host}${path}`,\n        hostname: host,\n        port: 443,\n        protocol: 'https',\n      })\n    }\n    return out\n  }\n\n  /**\n   * Wait for `mesh-network` (the tailscale-client provider) to be\n   * mounted AND report joined. Throws an actionable error otherwise.\n   */\n  private async requireClientJoined(): Promise<void> {\n    try {\n      await this.ctx.acquireCapability('mesh-network', undefined, { timeoutMs: 30_000 })\n    } catch (err) {\n      throw new Error(\n        `tailscale-ingress: cap 'mesh-network' is not available — is @camstack/addon-tailscale-client installed and enabled? (${err instanceof Error ? err.message : String(err)})`,\n        { cause: err },\n      )\n    }\n    const status = await this.fetchMeshStatus()\n    if (!status.joined) {\n      throw new Error('tailscale-ingress: tailnet not joined — run Join on the Tailscale Client addon first.')\n    }\n  }\n\n  private async fetchMeshStatus(): Promise<{ joined: boolean; magicDnsHostname: string; error?: string }> {\n    const api = this.ctx.api as unknown as {\n      meshNetwork?: {\n        getStatus: {\n          query: (input?: { addonId?: string; nodeId?: string }) => Promise<{\n            joined: boolean\n            magicDnsHostname: string\n            error?: string\n          }>\n        }\n      }\n    }\n    if (!api.meshNetwork?.getStatus?.query) {\n      throw new Error('tailscale-ingress: mesh-network cap not exposed on the api surface')\n    }\n    return await api.meshNetwork.getStatus.query()\n  }\n\n  protected globalSettingsSchema() {\n    const ingressItemFields: readonly ConfigField[] = [\n      {\n        type: 'select',\n        key: 'mode',\n        label: 'Mode',\n        description: 'Serve = peers on your tailnet. Funnel = open internet (requires Funnel grant in tailnet ACL).',\n        options: [\n          { value: 'serve', label: 'Serve (tailnet HTTPS)' },\n          { value: 'funnel', label: 'Funnel (public HTTPS)' },\n        ],\n        default: 'serve',\n      },\n      {\n        type: 'number',\n        key: 'sourcePort',\n        label: 'Local port',\n        description: 'Local hub port the ingress should forward to (e.g. 4000).',\n        default: 4000,\n      },\n      {\n        type: 'text',\n        key: 'targetPath',\n        label: 'Mount path (optional)',\n        description: 'Public-side path prefix. Leave empty / set \"/\" for root.',\n        placeholder: '/',\n      },\n    ]\n    return this.schema({\n      sections: [\n        {\n          id: 'tailscale-ingress',\n          title: 'Tailscale Ingress',\n          description:\n            'Exposes the hub via Tailscale Serve (in-tailnet HTTPS) or Funnel (public). Add one row per ingress — Serve + Funnel can run concurrently on different ports / paths. Requires the Tailscale Client addon to have the host joined first.',\n          columns: 1,\n          fields: [\n            this.field({\n              type: 'boolean',\n              key: 'autoStart',\n              label: 'Start on boot',\n              description: 'Bring every configured ingress up automatically once the host is joined to the tailnet.',\n              default: DEFAULT_CONFIG.autoStart,\n            }),\n            {\n              type: 'editable-array',\n              key: 'ingresses',\n              label: 'Ingresses',\n              description: 'Each row is a single `tailscale serve` or `tailscale funnel` invocation.',\n              emptyMessage: 'No ingresses configured.',\n              addLabel: 'Add ingress',\n              rowTitleTemplate: '{mode} :{sourcePort}{targetPath}',\n              defaultItem: {\n                mode: 'serve',\n                sourcePort: 4000,\n                targetPath: '',\n              },\n              itemFields: ingressItemFields,\n            },\n          ],\n        },\n      ],\n    })\n  }\n\n  protected async onConfigChanged(): Promise<void> {\n    // When ingresses change while running, reconcile the daemon state.\n    // For simplicity we tear everything down and re-apply on the next\n    // start() — operators control re-bring-up via the Remote Access\n    // Start button (or the autoStart flag).\n    if (this.activeEntries.size === 0) return\n    await this.stop()\n    if (this.config.autoStart) {\n      await this.autoStartIfReady()\n    }\n  }\n}\n\nfunction entryId(entry: IngressEntry): string {\n  const path = entry.targetPath && entry.targetPath !== '/' ? entry.targetPath : ''\n  return `${entry.mode}-${entry.sourcePort}${path}`\n}\n\nexport default TailscaleIngressAddon\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,YAAY,UAAU,SAAS;AAErC,IAAM,uBAAuB;CAC3B;CACA;CACA;CACA;CAEA;CACD;AAED,IAAa,oBAAb,cAAuC,MAAM;CACE;CAA7C,YAAY,SAAiB,SAAiC,IAAI;EAChE,MAAM,QAAQ;EAD6B,KAAA,SAAA;EAE3C,KAAK,OAAO;;;AAyChB,IAAa,eAAb,MAA0B;CACxB,cAAqC;;CAGrC,MAAc,aAA8B;EAC1C,IAAI,KAAK,aAAa,OAAO,KAAK;EAClC,KAAK,MAAM,aAAa,sBACtB,IAAI;GACF,MAAM,UAAU,WAAW,CAAC,UAAU,EAAE,EAAE,SAAS,KAAO,CAAC;GAC3D,KAAK,cAAc;GACnB,OAAO;UACD;EAIV,MAAM,IAAI,kBACR,qFACD;;CAGH,MAAM,UAA2B;EAE/B,MAAM,EAAE,WAAW,MAAM,UAAU,MADjB,KAAK,YAAY,EACK,CAAC,UAAU,EAAE,EAAE,SAAS,KAAO,CAAC;EACxE,OAAO,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM;;CAGzC,MAAM,SAAuC;EAC3C,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,IAAI;GACF,MAAM,EAAE,WAAW,MAAM,UAAU,KAAK,CAAC,UAAU,SAAS,EAAE,EAAE,SAAS,KAAQ,CAAC;GAClF,OAAO,KAAK,MAAM,OAAO;WAClB,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,4BAA4B,EAAE,WAC9B,EAAE,UAAU,GACb;;;;;CAML,MAAM,GAAG,OAAgF;EACvF,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,MAAM,OAAO;GAAC;GAAM;GAAc,MAAM;GAAS;GAAU;EAC3D,IAAI,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,WAAW;EAC7D,IAAI;GACF,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,KAAQ,CAAC;WACxC,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,wBAAwB,EAAE,WAC1B,EAAE,UAAU,GACb;;;;;CAML,MAAM,OAAsB;EAC1B,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,IAAI;GACF,MAAM,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,MAAQ,CAAC;WAC5C,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,0BAA0B,EAAE,WAC5B,EAAE,UAAU,GACb;;;;;;;;;;CAWL,MAAM,MAAM,OAA0C;EACpD,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,MAAM,OAAO,KAAK,iBAAiB,SAAS,MAAM;EAClD,IAAI;GACF,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,MAAQ,CAAC;WACxC,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,2BAA2B,EAAE,WAC7B,EAAE,UAAU,GACb;;;;;;CAOL,MAAM,OAAO,OAA0C;EACrD,MAAM,MAAM,MAAM,KAAK,YAAY;EACnC,MAAM,OAAO,KAAK,iBAAiB,UAAU,MAAM;EACnD,IAAI;GACF,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,MAAQ,CAAC;WACxC,KAAK;GACZ,MAAM,IAAI;GACV,MAAM,IAAI,kBACR,4BAA4B,EAAE,WAC9B,EAAE,UAAU,GACb;;;;;;;;;CAUL,iBAAyB,MAA0B,OAA8C;EAC/F,MAAM,QAAQ,MAAM,cAAc,IAAI,MAAM;EAC5C,IAAI,CAAC,MAAM,SAAS;GAClB,MAAM,MAAgB,CAAC,MAAM,OAAO;GACpC,IAAI,QAAQ,SAAS,KAAK,IAAI,KAAK,cAAc,OAAO;GACxD,IAAI,KAAK,MAAM;GACf,OAAO;;EAET,MAAM,MAAgB,CAAC,MAAM,OAAO;EACpC,IAAI,QAAQ,SAAS,KAAK,IAAI,KAAK,cAAc,OAAO;EACxD,IAAI,KAAK,oBAAoB,MAAM,OAAO;EAC1C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC7IX,IAAM,iBAAyC;CAC7C,WAAW;CACX,WAAW,EAAE;CACd;AAaD,IAAa,wBAAb,cAA2C,UAAkC;CAC3E,MAAc,IAAI,cAAc;;;;;;;CAOhC,gCAAwB,IAAI,KAA2B;;CAEvD,WAAmB;CAEnB,cAAc;EACZ,MAAM,EAAE,GAAG,gBAAgB,CAAC;;CAG9B,MAAgB,eAAgD;EAG9D,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,KAAK,IAAI,SAAS;GACxB,eAAe;WACR,KAAK;GACZ,KAAK,IAAI,OAAO,KAAK,8CAA8C,EACjE,MAAM,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,EAAE,EAClE,CAAC;;EAGJ,MAAM,WAAkC;GACtC,aAAa,KAAK,OAAO;GACzB,YAAY,KAAK,MAAM;GACvB,mBAAmB,KAAK,oBAAoB;GAC5C,iBAAiB,KAAK,WAAW;GACjC,qBAAqB,KAAK,eAAe;GAC1C;EASD,KAAK,IAAI,kBAAkB,KAAK,kBAAkB,CAAC;EAKnD,IAAI,gBAAgB,KAAK,OAAO,WAI9B,mBAAmB;GAAE,KAAU,kBAAkB;IAAG;EAMtD,IAAI,KAAK,OAAO,WAOd,KAAK,gBAAgB,gBAAgB,EACnC,eAAe;GAEb,KAAU,kBAAkB,CAAC,OAAO,QAAQ;IAC1C,KAAK,IAAI,OAAO,KAAK,+DAA+D,EAClF,MAAM,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,EAAE,EAClE,CAAC;KACF;KAEL,CAAC;EAGJ,OAAO,CAAC;GAAE,YAAY;GAAyB;GAAU,CAAC;;;;;;;CAU5D,MAAc,mBAAkC;EAC9C,IAAI,KAAK,OAAO,UAAU,WAAW,GAAG;GACtC,KAAK,IAAI,OAAO,KAAK,2EAA2E,EAC9F,MAAM;IAAE,OAAO;IAAqB,OAAO;IAAmB,EAC/D,CAAC;GACF;;EAKF,IAAI;EACJ,IAAI;GAEF,UAAS,MADY,KAAK,iBAAiB,EAC3B;UACV;GAEN,SAAS;;EAEX,IAAI,CAAC,QAAQ;GACX,KAAK,IAAI,OAAO,KAAK,8DAA8D,EACjF,MAAM;IAAE,OAAO;IAAqB,OAAO;IAA6B,EACzE,CAAC;GACF;;EAEF,IAAI;GACF,MAAM,KAAK,OAAO;GAClB,KAAK,IAAI,OAAO,KAAK,gDAAgD;IACnE,MAAM,EAAE,cAAc,KAAK,OAAO,UAAU,QAAQ;IACpD,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAgB;IAC5D,CAAC;WACK,KAAK;GAEZ,KAAK,IAAI,OAAO,KAAK,mFAAmF;IACtG,MAAM,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,EAAE;IACjE,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAmB;IAC/D,CAAC;;;CAMN,MAAc,QAA8F;EAC1G,IAAI,KAAK,UACP,MAAM,IAAI,MAAM,oDAAoD;EAEtE,MAAM,KAAK,qBAAqB;EAEhC,IAAI,KAAK,OAAO,UAAU,WAAW,GACnC,MAAM,IAAI,MAAM,2FAA2F;EAM7G,MAAM,SAAmB,EAAE;EAC3B,KAAK,MAAM,SAAS,KAAK,OAAO,WAC9B,IAAI;GACF,MAAM,KAAK,iBAAiB,OAAO,KAAK;GACxC,MAAM,KAAK,QAAQ,MAAM;GACzB,KAAK,cAAc,IAAI,IAAI,MAAM;WAC1B,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC5D,OAAO,KAAK,GAAG,MAAM,KAAK,GAAG,MAAM,aAAa,MAAM,cAAc,GAAG,KAAK,MAAM;;EAItF,IAAI,KAAK,cAAc,SAAS,GAC9B,MAAM,IAAI,MAAM,qDAAqD,OAAO,KAAK,KAAK,GAAG;EAI3F,MAAM,WAAU,MADQ,KAAK,kBAAkB,EACrB;EAC1B,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,oHAAoH;EAGtI,KAAK,IAAI,UAAU,KAAK;GACtB,IAAI,YAAY;GAChB,2BAAW,IAAI,MAAM;GACrB,QAAQ;IAAE,MAAM;IAAS,IAAI,KAAK,IAAI;IAAI;GAC1C,UAAU,cAAc;GACxB,MAAM,EAAE,KAAK,QAAQ,KAAK;GAC3B,CAAC;EAEF,IAAI,OAAO,SAAS,GAClB,KAAK,IAAI,OAAO,KAAK,oDAAoD;GACvE,MAAM;IAAE;IAAQ,WAAW,KAAK,cAAc;IAAM;GACpD,MAAM;IAAE,OAAO;IAAqB,OAAO;IAAiB;GAC7D,CAAC;EAGJ,OAAO;GACL,KAAK,QAAQ;GACb,UAAU,QAAQ;GAClB,MAAM,QAAQ;GACd,UAAU,QAAQ;GACnB;;CAGH,MAAc,OAAsB;EAElC,MAAM,WAAW,MAAM,KAAK,KAAK,cAAc,QAAQ,CAAC;EACxD,KAAK,cAAc,OAAO;EAC1B,KAAK,MAAM,SAAS,UAClB,IAAI;GACF,MAAM,KAAK,iBAAiB,OAAO,MAAM;WAClC,KAAK;GAIZ,KAAK,IAAI,OAAO,KAAK,8EAA8E;IACjG,MAAM;KACJ;KACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KACxD;IACD,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAc;IAC1D,CAAC;;EAGN,KAAK,IAAI,UAAU,KAAK;GACtB,IAAI,YAAY;GAChB,2BAAW,IAAI,MAAM;GACrB,QAAQ;IAAE,MAAM;IAAS,IAAI,KAAK,IAAI;IAAI;GAC1C,UAAU,cAAc;GACxB,MAAM,EAAE;GACT,CAAC;;;;;;;;;;;;;CAgBJ,MAAc,mBAAkC;EAC9C,IAAI,KAAK,UAAU;EACnB,KAAK,WAAW;EAChB,MAAM,WAAW,MAAM,KAAK,KAAK,cAAc,QAAQ,CAAC;EACxD,IAAI,SAAS,WAAW,GAAG;EAI3B,IAAI;GACF,MAAM,KAAK,IAAI,SAAS;WACjB,KAAK;GACZ,KAAK,IAAI,OAAO,KAAK,kFAAmF;IACtG,MAAM;KACJ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KACvD,kBAAkB,SAAS;KAC5B;IACD,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAuB;IACnE,CAAC;GACF,KAAK,cAAc,OAAO;GAC1B;;EAGF,KAAK,MAAM,SAAS,UAClB,IAAI;GACF,MAAM,KAAK,iBAAiB,OAAO,MAAM;WAClC,KAAK;GACZ,KAAK,IAAI,OAAO,KAAK,kEAAkE;IACrF,MAAM;KACJ;KACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KACxD;IACD,MAAM;KAAE,OAAO;KAAqB,OAAO;KAAuB;IACnE,CAAC;;EAGN,KAAK,cAAc,OAAO;;CAK5B,MAAc,qBAEZ;EAEA,MAAM,WAAU,MADE,KAAK,kBAAkB,EACrB;EACpB,IAAI,CAAC,SAAS,OAAO;EACrB,OAAO;GACL,KAAK,QAAQ;GACb,UAAU,QAAQ;GAClB,MAAM,QAAQ;GACd,UAAU,QAAQ;GACnB;;CAGH,MAAc,YAIX;EACD,IAAI;GACF,MAAM,WAAW,MAAM,KAAK,oBAAoB;GAChD,OAAO;IACL,WAAW,KAAK,cAAc,OAAO,KAAK,aAAa;IACvD;IACD;WACM,KAAK;GACZ,OAAO;IACL,WAAW;IACX,UAAU;IACV,OAAO,eAAe,oBAAoB,IAAI,UAAU,OAAO,IAAI;IACpE;;;CAIL,MAAc,gBASV;EACF,OAAO,KAAK,kBAAkB;;CAKhC,MAAc,iBAAiB,OAAqB,SAAiC;EACnF,MAAM,OAAgE;GACpE,MAAM,MAAM;GACZ;GACA,GAAI,MAAM,cAAc,MAAM,eAAe,MAAM,EAAE,YAAY,MAAM,YAAY,GAAG,EAAE;GACzF;EACD,IAAI,MAAM,SAAS,UACjB,MAAM,KAAK,IAAI,OAAO,KAAK;OAE3B,MAAM,KAAK,IAAI,MAAM,KAAK;;;;;;;;CAU9B,MAAc,mBAAyD;EACrE,IAAI,KAAK,cAAc,SAAS,GAAG,OAAO,EAAE;EAC5C,MAAM,aAAa,MAAM,KAAK,iBAAiB,CAAC,YAAY,KAAK;EACjE,IAAI,CAAC,cAAc,CAAC,WAAW,QAAQ,OAAO,EAAE;EAChD,MAAM,OAAO,WAAW;EACxB,IAAI,CAAC,MAAM,OAAO,EAAE;EACpB,MAAM,MAA0B,EAAE;EAClC,KAAK,MAAM,SAAS,KAAK,cAAc,QAAQ,EAAE;GAC/C,MAAM,OAAO,MAAM,cAAc,MAAM,eAAe,MAAM,MAAM,aAAa;GAC/E,IAAI,KAAK;IACP,IAAI,QAAQ,MAAM;IAClB,OAAO,GAAG,MAAM,SAAS,WAAW,WAAW,QAAQ,IAAI,MAAM,aAAa;IAC9E,MAAM,MAAM;IACZ,YAAY,MAAM;IAClB,KAAK,WAAW,OAAO;IACvB,UAAU;IACV,MAAM;IACN,UAAU;IACX,CAAC;;EAEJ,OAAO;;;;;;CAOT,MAAc,sBAAqC;EACjD,IAAI;GACF,MAAM,KAAK,IAAI,kBAAkB,gBAAgB,KAAA,GAAW,EAAE,WAAW,KAAQ,CAAC;WAC3E,KAAK;GACZ,MAAM,IAAI,MACR,wHAAwH,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC,IACzK,EAAE,OAAO,KAAK,CACf;;EAGH,IAAI,EAAC,MADgB,KAAK,iBAAiB,EAC/B,QACV,MAAM,IAAI,MAAM,wFAAwF;;CAI5G,MAAc,kBAA0F;EACtG,MAAM,MAAM,KAAK,IAAI;EAWrB,IAAI,CAAC,IAAI,aAAa,WAAW,OAC/B,MAAM,IAAI,MAAM,qEAAqE;EAEvF,OAAO,MAAM,IAAI,YAAY,UAAU,OAAO;;CAGhD,uBAAiC;EA4B/B,OAAO,KAAK,OAAO,EACjB,UAAU,CACR;GACE,IAAI;GACJ,OAAO;GACP,aACE;GACF,SAAS;GACT,QAAQ,CACN,KAAK,MAAM;IACT,MAAM;IACN,KAAK;IACL,OAAO;IACP,aAAa;IACb,SAAS,eAAe;IACzB,CAAC,EACF;IACE,MAAM;IACN,KAAK;IACL,OAAO;IACP,aAAa;IACb,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,aAAa;KACX,MAAM;KACN,YAAY;KACZ,YAAY;KACb;IACD,YAAY;KAvDpB;MACE,MAAM;MACN,KAAK;MACL,OAAO;MACP,aAAa;MACb,SAAS,CACP;OAAE,OAAO;OAAS,OAAO;OAAyB,EAClD;OAAE,OAAO;OAAU,OAAO;OAAyB,CACpD;MACD,SAAS;MACV;KACD;MACE,MAAM;MACN,KAAK;MACL,OAAO;MACP,aAAa;MACb,SAAS;MACV;KACD;MACE,MAAM;MACN,KAAK;MACL,OAAO;MACP,aAAa;MACb,aAAa;MACd;KA+BmB;IACb,CACF;GACF,CACF,EACF,CAAC;;CAGJ,MAAgB,kBAAiC;EAK/C,IAAI,KAAK,cAAc,SAAS,GAAG;EACnC,MAAM,KAAK,MAAM;EACjB,IAAI,KAAK,OAAO,WACd,MAAM,KAAK,kBAAkB;;;AAKnC,SAAS,QAAQ,OAA6B;CAC5C,MAAM,OAAO,MAAM,cAAc,MAAM,eAAe,MAAM,MAAM,aAAa;CAC/E,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,aAAa"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@camstack/addon-tailscale-ingress",
+  "version": "0.1.1",
+  "description": "Tailscale Serve / Funnel ingress addon for CamStack — exposes the hub via tailnet HTTPS or public Funnel.",
+  "keywords": [
+    "camstack",
+    "addon",
+    "camstack-addon",
+    "tailscale",
+    "funnel",
+    "serve",
+    "ingress"
+  ],
+  "license": "MIT",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "camstack": {
+    "displayName": "Tailscale Ingress",
+    "addons": [
+      {
+        "id": "tailscale-ingress",
+        "name": "Tailscale Ingress",
+        "version": "1.0.0",
+        "description": "Exposes the CamStack hub on the tailnet (Serve) or the public internet (Funnel). Requires `@camstack/addon-tailscale-client` to be installed and joined first.",
+        "entry": "./dist/tailscale-ingress.addon.js",
+        "execution": {
+          "placement": "hub-only",
+          "group": "tailscale-ingress"
+        },
+        "capabilities": [
+          {
+            "name": "network-access"
+          }
+        ]
+      }
+    ]
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "vite build",
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@camstack/types": "^0.1.0"
+  },
+  "devDependencies": {
+    "@camstack/types": "*",
+    "typescript": "~5.9.0",
+    "vite": "^8.0.11",
+    "vite-plugin-dts": "^5.0.0"
+  }
+}