@fastybird/smart-panel-backend 1.0.0-beta.3 → 1.1.0-alpha.0

package/dist/plugins/remote-access-tailscale/remote-access-tailscale.plugin.d.ts

@@ -0,0 +1,21 @@
+import { OnModuleInit } from '@nestjs/common';
+import { PluginsTypeMapperService } from '../../modules/config/services/plugins-type-mapper.service';
+import { ExtensionsService } from '../../modules/extensions/services/extensions.service';
+import { ManagedServiceManagerService } from '../../modules/extensions/services/managed-service-manager.service';
+import { RemoteAccessProviderRegistryService } from '../../modules/remote-access/services/remote-access-provider-registry.service';
+import { SwaggerModelsRegistryService } from '../../modules/swagger/services/swagger-models-registry.service';
+import { FactoryResetRegistryService } from '../../modules/system/services/factory-reset-registry.service';
+import { TailscaleNodeManagedService } from './services/tailscale-node-managed.service';
+import { TailscaleProviderService } from './services/tailscale-provider.service';
+export declare class RemoteAccessTailscalePlugin implements OnModuleInit {
+    private readonly pluginsMapperService;
+    private readonly swaggerRegistry;
+    private readonly extensionsService;
+    private readonly managedServiceManager;
+    private readonly providerRegistry;
+    private readonly factoryResetRegistry;
+    private readonly nodeManagedService;
+    private readonly providerService;
+    constructor(pluginsMapperService: PluginsTypeMapperService, swaggerRegistry: SwaggerModelsRegistryService, extensionsService: ExtensionsService, managedServiceManager: ManagedServiceManagerService, providerRegistry: RemoteAccessProviderRegistryService, factoryResetRegistry: FactoryResetRegistryService, nodeManagedService: TailscaleNodeManagedService, providerService: TailscaleProviderService);
+    onModuleInit(): void;
+}

package/dist/plugins/remote-access-tailscale/remote-access-tailscale.plugin.js

@@ -0,0 +1,132 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteAccessTailscalePlugin = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const plugins_type_mapper_service_1 = require("../../modules/config/services/plugins-type-mapper.service");
+const extensions_service_1 = require("../../modules/extensions/services/extensions.service");
+const managed_service_manager_service_1 = require("../../modules/extensions/services/managed-service-manager.service");
+const platform_module_1 = require("../../modules/platform/platform.module");
+const remote_access_module_1 = require("../../modules/remote-access/remote-access.module");
+const remote_access_provider_registry_service_1 = require("../../modules/remote-access/services/remote-access-provider-registry.service");
+const api_tag_decorator_1 = require("../../modules/swagger/decorators/api-tag.decorator");
+const swagger_models_registry_service_1 = require("../../modules/swagger/services/swagger-models-registry.service");
+const factory_reset_registry_service_1 = require("../../modules/system/services/factory-reset-registry.service");
+const setup_controller_1 = require("./controllers/setup.controller");
+const status_controller_1 = require("./controllers/status.controller");
+const update_config_dto_1 = require("./dto/update-config.dto");
+const config_model_1 = require("./models/config.model");
+const remote_access_tailscale_constants_1 = require("./remote-access-tailscale.constants");
+const remote_access_tailscale_openapi_1 = require("./remote-access-tailscale.openapi");
+const tailscale_cli_service_1 = require("./services/tailscale-cli.service");
+const tailscale_login_service_1 = require("./services/tailscale-login.service");
+const tailscale_node_managed_service_1 = require("./services/tailscale-node-managed.service");
+const tailscale_provider_service_1 = require("./services/tailscale-provider.service");
+const tailscale_serve_service_1 = require("./services/tailscale-serve.service");
+const tailscale_setup_service_1 = require("./services/tailscale-setup.service");
+const tailscale_status_mapper_service_1 = require("./services/tailscale-status-mapper.service");
+let RemoteAccessTailscalePlugin = class RemoteAccessTailscalePlugin {
+    constructor(pluginsMapperService, swaggerRegistry, extensionsService, managedServiceManager, providerRegistry, factoryResetRegistry, nodeManagedService, providerService) {
+        this.pluginsMapperService = pluginsMapperService;
+        this.swaggerRegistry = swaggerRegistry;
+        this.extensionsService = extensionsService;
+        this.managedServiceManager = managedServiceManager;
+        this.providerRegistry = providerRegistry;
+        this.factoryResetRegistry = factoryResetRegistry;
+        this.nodeManagedService = nodeManagedService;
+        this.providerService = providerService;
+    }
+    onModuleInit() {
+        this.pluginsMapperService.registerMapping({
+            type: remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_NAME,
+            class: config_model_1.RemoteAccessTailscalePluginConfigModel,
+            configDto: update_config_dto_1.UpdateRemoteAccessTailscalePluginConfigDto,
+        });
+        for (const model of remote_access_tailscale_openapi_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_SWAGGER_EXTRA_MODELS) {
+            this.swaggerRegistry.register(model);
+        }
+        this.extensionsService.registerPluginMetadata({
+            type: remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_NAME,
+            name: 'Tailscale',
+            description: 'Reach this installation over a Tailscale mesh network without opening a port.',
+            author: 'FastyBird',
+            defaultEnabled: false,
+            readme: `# Tailscale
+
+> Plugin · by FastyBird · platform: remote-access
+
+Connects this installation to a Tailscale tailnet, a private WireGuard-based mesh network. Once signed in, the admin UI is reachable from any device on the tailnet by its Tailscale IPv4 address or, when MagicDNS is enabled, its tailnet DNS name — no port forwarding and no public exposure required.
+
+## What you get
+
+- A private mesh address for this installation, reachable from every device you have signed into the same tailnet
+- A MagicDNS name once your tailnet has MagicDNS enabled, so you never have to remember an IP address
+- Setup, sign-in and sign-out that stay entirely within the Smart Panel admin UI
+- The admin UI served over HTTPS on the tailnet through Tailscale Serve, optionally published to the public internet through Tailscale Funnel
+
+## Requirements
+
+- \`raspberry\` or \`generic\` platform with systemd and the existing sudoers allowlist (Docker and the Home Assistant add-on are not supported — see the docs for alternatives)
+- The \`tailscale\` package installed and \`tailscaled\` active, with the \`smart-panel\` service user granted as the Tailscale operator
+
+## Configuration
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| \`hostname\` | Hostname advertised to the tailnet | OS hostname |
+| \`login_server\` | Control-plane URL — override for a self-hosted Headscale server | \`https://controlplane.tailscale.com\` |
+| \`accept_dns\` | Accept the tailnet MagicDNS configuration | \`true\` |
+| \`accept_routes\` | Accept subnet routes advertised by other tailnet nodes | \`false\` |
+| \`advertise_tags\` | ACL tags to advertise for this node | \`[]\` |
+| \`ssh\` | Enable Tailscale SSH on this node | \`false\` |
+| \`serve_https\` | Serve the admin UI over HTTPS through Tailscale Serve | \`true\` |
+| \`funnel\` | Publish the served admin UI to the public internet through Tailscale Funnel | \`false\` |`,
+            links: {
+                documentation: 'https://smart-panel.fastybird.com/docs',
+                repository: 'https://github.com/FastyBird/smart-panel',
+            },
+        });
+        this.providerRegistry.register(this.providerService);
+        this.managedServiceManager.register(this.nodeManagedService);
+        this.factoryResetRegistry.register(remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_NAME, () => this.nodeManagedService.factoryReset(), 90);
+    }
+};
+exports.RemoteAccessTailscalePlugin = RemoteAccessTailscalePlugin;
+exports.RemoteAccessTailscalePlugin = RemoteAccessTailscalePlugin = __decorate([
+    (0, api_tag_decorator_1.ApiTag)({
+        tagName: remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_NAME,
+        displayName: remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_API_TAG_NAME,
+        description: remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_API_TAG_DESCRIPTION,
+    }),
+    (0, common_1.Module)({
+        imports: [remote_access_module_1.RemoteAccessModule, platform_module_1.PlatformModule, config_1.ConfigModule],
+        controllers: [status_controller_1.StatusController, setup_controller_1.SetupController],
+        providers: [
+            tailscale_cli_service_1.TailscaleCliService,
+            tailscale_status_mapper_service_1.TailscaleStatusMapperService,
+            tailscale_serve_service_1.TailscaleServeService,
+            tailscale_node_managed_service_1.TailscaleNodeManagedService,
+            tailscale_provider_service_1.TailscaleProviderService,
+            tailscale_setup_service_1.TailscaleSetupService,
+            tailscale_login_service_1.TailscaleLoginService,
+        ],
+    }),
+    __metadata("design:paramtypes", [plugins_type_mapper_service_1.PluginsTypeMapperService,
+        swagger_models_registry_service_1.SwaggerModelsRegistryService,
+        extensions_service_1.ExtensionsService,
+        managed_service_manager_service_1.ManagedServiceManagerService,
+        remote_access_provider_registry_service_1.RemoteAccessProviderRegistryService,
+        factory_reset_registry_service_1.FactoryResetRegistryService,
+        tailscale_node_managed_service_1.TailscaleNodeManagedService,
+        tailscale_provider_service_1.TailscaleProviderService])
+], RemoteAccessTailscalePlugin);
+//# sourceMappingURL=remote-access-tailscale.plugin.js.map

package/dist/plugins/remote-access-tailscale/remote-access-tailscale.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-access-tailscale.plugin.js","sourceRoot":"","sources":["../../../src/plugins/remote-access-tailscale/remote-access-tailscale.plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAsD;AACtD,2CAAkE;AAElE,2GAAqG;AACrG,6FAAyF;AACzF,uHAAiH;AACjH,4EAAwE;AACxE,2FAAsF;AACtF,0IAAmI;AACnI,0FAA4E;AAC5E,oHAA8G;AAC9G,iHAA2G;AAE3G,qEAAiE;AACjE,uEAAmE;AACnE,+DAAqF;AACrF,wDAA+E;AAC/E,2FAI6C;AAC7C,uFAAwG;AACxG,4EAAuE;AACvE,gFAA2E;AAC3E,8FAAwF;AACxF,sFAAiF;AACjF,gFAA2E;AAC3E,gFAA2E;AAC3E,gGAA0F;AAoBnF,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACvC,YACkB,oBAA8C,EAC9C,eAA6C,EAC7C,iBAAoC,EACpC,qBAAmD,EACnD,gBAAqD,EACrD,oBAAiD,EACjD,kBAA+C,EAC/C,eAAyC;QAPzC,yBAAoB,GAApB,oBAAoB,CAA0B;QAC9C,oBAAe,GAAf,eAAe,CAA8B;QAC7C,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,0BAAqB,GAArB,qBAAqB,CAA8B;QACnD,qBAAgB,GAAhB,gBAAgB,CAAqC;QACrD,yBAAoB,GAApB,oBAAoB,CAA6B;QACjD,uBAAkB,GAAlB,kBAAkB,CAA6B;QAC/C,oBAAe,GAAf,eAAe,CAA0B;IACxD,CAAC;IAEJ,YAAY;QACX,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAGvC;YACD,IAAI,EAAE,uEAAmC;YACzC,KAAK,EAAE,qDAAsC;YAC7C,SAAS,EAAE,8DAA0C;SACrD,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,qFAAmD,EAAE,CAAC;YACzE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC;YAC7C,IAAI,EAAE,uEAAmC;YACzC,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,+EAA+E;YAC5F,MAAM,EAAE,WAAW;YACnB,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yGA6B8F;YACtG,KAAK,EAAE;gBACN,aAAa,EAAE,wCAAwC;gBACvD,UAAU,EAAE,0CAA0C;aACtD;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAErD,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAE7D,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CACjC,uEAAmC,EACnC,GAAmD,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,EAC5F,EAAE,CACF,CAAC;IACH,CAAC;CACD,CAAA;AA9EY,kEAA2B;sCAA3B,2BAA2B;IAlBvC,IAAA,0BAAM,EAAC;QACP,OAAO,EAAE,uEAAmC;QAC5C,WAAW,EAAE,+EAA2C;QACxD,WAAW,EAAE,sFAAkD;KAC/D,CAAC;IACD,IAAA,eAAM,EAAC;QACP,OAAO,EAAE,CAAC,yCAAkB,EAAE,gCAAc,EAAE,qBAAgB,CAAC;QAC/D,WAAW,EAAE,CAAC,oCAAgB,EAAE,kCAAe,CAAC;QAChD,SAAS,EAAE;YACV,2CAAmB;YACnB,8DAA4B;YAC5B,+CAAqB;YACrB,4DAA2B;YAC3B,qDAAwB;YACxB,+CAAqB;YACrB,+CAAqB;SACrB;KACD,CAAC;qCAGuC,sDAAwB;QAC7B,8DAA4B;QAC1B,sCAAiB;QACb,8DAA4B;QACjC,6EAAmC;QAC/B,4DAA2B;QAC7B,4DAA2B;QAC9B,qDAAwB;GAT/C,2BAA2B,CA8EvC"}

package/dist/plugins/remote-access-tailscale/scripts/tailscale-setup.sh

@@ -0,0 +1,175 @@
+#!/bin/bash
+# Privileged Tailscale setup job, run by PrivilegedWorkerService as
+# `sudo -n systemd-run --scope --unit=smart-panel-remote-access bash
+# tailscale-setup.sh` (see TailscaleSetupService.install()). Idempotent:
+# re-running is harmless once every step has already succeeded.
+#
+# Steps: (1) install the `tailscale` package from the signed vendor apt
+# repository if missing — never a downloaded script piped into a shell;
+# (2) enable and start `tailscaled`; (3) grant SMART_PANEL_USER as operator
+# so the backend can drive the daemon without sudo from then on.
+#
+# --dry-run prints the commands each step would run instead of running them
+# and always finishes at "complete" with exit 0, regardless of the host OS —
+# it previews the real branching logic without requiring root, apt, systemd
+# or a Debian-family host, so it can run from a Jest spec on any platform.
+set -e
+# Without this, `curl ... | tee ...` reports tee's exit status, not curl's —
+# a failed download would be silently treated as success by the `|| { ... }`
+# guards below.
+set -o pipefail
+
+STATUS_FILE="${STATUS_FILE:-/var/lib/smart-panel/remote-access/tailscale-setup-status.json}"
+SMART_PANEL_USER="${SMART_PANEL_USER:-$(id -un)}"
+
+DRY_RUN=0
+for arg in "$@"; do
+	case "$arg" in
+	--dry-run) DRY_RUN=1 ;;
+	esac
+done
+
+# Writes the canonical `{ state, step, message }` status PrivilegedWorkerService
+# expects, via a temp file + rename so a concurrent read never sees a
+# half-written file. printf %s (never direct interpolation into the format
+# string) and the sed escape below keep an unexpected value out of the JSON
+# structure.
+write_status() {
+	local state="$1"
+	local step="$2"
+	local message="${3:-}"
+	local tmp_file="${STATUS_FILE}.tmp"
+	local safe_message=""
+
+	if [ -n "$message" ]; then
+		# Strip control characters first (defensive: every message here is a
+		# static literal today, but a future dynamic one — e.g. echoing part of
+		# a command's own output — must not be able to inject a raw newline or
+		# other control byte into the JSON structure), then escape backslashes
+		# and quotes.
+		safe_message=$(printf '%s' "$message" | tr -d '\000-\037' | sed 's/\\/\\\\/g; s/"/\\"/g')
+	fi
+
+	mkdir -p "$(dirname "$STATUS_FILE")"
+
+	printf '{\n\t"state": "%s",\n\t"step": "%s",\n\t"message": "%s"\n}\n' \
+		"$state" "$step" "$safe_message" >"$tmp_file"
+
+	mv "$tmp_file" "$STATUS_FILE"
+}
+
+# Only fires on an exit this script did not already report itself (a crash,
+# an unset-variable error, an unhandled command failure) — a step that
+# already wrote "failed" leaves that status alone.
+cleanup() {
+	local exit_code=$?
+
+	if [ "$exit_code" -ne 0 ]; then
+		if [ -f "$STATUS_FILE" ] && grep -q '"state": "failed"' "$STATUS_FILE" 2>/dev/null; then
+			return
+		fi
+
+		write_status "failed" "unknown" "Setup exited unexpectedly with code $exit_code"
+	fi
+}
+
+trap cleanup EXIT
+
+# ──────────────────────────────────────────────────────────────
+# Step 1: install the tailscale package if missing
+# ──────────────────────────────────────────────────────────────
+if command -v tailscale >/dev/null 2>&1; then
+	write_status "running" "install" "tailscale is already installed"
+else
+	write_status "running" "install" "Installing the tailscale package"
+
+	OS_ID=""
+	VERSION_CODENAME=""
+
+	if [ -f /etc/os-release ]; then
+		# shellcheck source=/dev/null
+		. /etc/os-release
+		OS_ID="${ID:-}"
+		VERSION_CODENAME="${VERSION_CODENAME:-}"
+	fi
+
+	case "$OS_ID" in
+	raspbian | debian | ubuntu)
+		KEYRING="/usr/share/keyrings/tailscale-archive-keyring.gpg"
+		LIST="/etc/apt/sources.list.d/tailscale.list"
+		KEYRING_URL="https://pkgs.tailscale.com/stable/${OS_ID}/${VERSION_CODENAME}.noarmor.gpg"
+		LIST_URL="https://pkgs.tailscale.com/stable/${OS_ID}/${VERSION_CODENAME}.tailscale-keyring.list"
+
+		if [ "$DRY_RUN" -eq 1 ]; then
+			echo "[dry-run] curl -fsSL $KEYRING_URL | tee $KEYRING"
+			echo "[dry-run] curl -fsSL $LIST_URL | tee $LIST"
+			echo "[dry-run] apt-get update -qq"
+			echo "[dry-run] apt-get install -y -qq --no-install-recommends tailscale"
+		else
+			# Only the signed keyring and the apt source list are downloaded —
+			# never a script. apt-get itself verifies every package against
+			# this keyring before installing it.
+			curl -fsSL "$KEYRING_URL" | tee "$KEYRING" >/dev/null || {
+				write_status "failed" "install" "Failed to download the Tailscale apt keyring"
+				exit 1
+			}
+			curl -fsSL "$LIST_URL" | tee "$LIST" >/dev/null || {
+				write_status "failed" "install" "Failed to download the Tailscale apt source list"
+				exit 1
+			}
+			apt-get update -qq || {
+				write_status "failed" "install" "apt-get update failed"
+				exit 1
+			}
+			apt-get install -y -qq --no-install-recommends tailscale || {
+				write_status "failed" "install" "apt-get install tailscale failed"
+				exit 1
+			}
+		fi
+		;;
+	*)
+		if [ "$DRY_RUN" -eq 1 ]; then
+			echo "[dry-run] unsupported OS (ID=${OS_ID:-unknown}) — a real run would stop here and report failed/install"
+		else
+			write_status "failed" "install" "Tailscale must be installed manually: https://tailscale.com/download/linux"
+			exit 1
+		fi
+		;;
+	esac
+fi
+
+# ──────────────────────────────────────────────────────────────
+# Step 2: enable and start the daemon
+# ──────────────────────────────────────────────────────────────
+write_status "running" "daemon" "Enabling the tailscaled service"
+
+if [ "$DRY_RUN" -eq 1 ]; then
+	echo "[dry-run] systemctl enable --now tailscaled"
+else
+	systemctl enable --now tailscaled || {
+		write_status "failed" "daemon" "systemctl enable --now tailscaled failed"
+		exit 1
+	}
+fi
+
+# ──────────────────────────────────────────────────────────────
+# Step 3: grant the service user as operator
+# ──────────────────────────────────────────────────────────────
+write_status "running" "operator" "Granting $SMART_PANEL_USER as the Tailscale operator"
+
+if [ "$DRY_RUN" -eq 1 ]; then
+	echo "[dry-run] tailscale set --operator=$SMART_PANEL_USER"
+else
+	tailscale set "--operator=${SMART_PANEL_USER}" || {
+		write_status "failed" "operator" "tailscale set --operator failed"
+		exit 1
+	}
+fi
+
+# ──────────────────────────────────────────────────────────────
+# Done
+# ──────────────────────────────────────────────────────────────
+write_status "complete" "complete" "Tailscale setup completed"
+
+trap - EXIT
+exit 0

package/dist/plugins/remote-access-tailscale/services/tailscale-cli.service.d.ts

@@ -0,0 +1,75 @@
+import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+export type TailscaleCliErrorKind = 'not-installed' | 'permission-denied' | 'daemon-down' | 'needs-login' | 'settings-conflict' | 'timeout' | 'unknown';
+export declare class TailscaleCliError extends Error {
+    readonly kind: TailscaleCliErrorKind;
+    readonly cause?: unknown;
+    constructor(kind: TailscaleCliErrorKind, message: string, cause?: unknown);
+}
+export type TailscaleBackendState = 'NoState' | 'NeedsLogin' | 'NeedsMachineAuth' | 'Stopped' | 'Starting' | 'Running' | 'InUseOtherUser';
+export interface TailscaleSelfStatus {
+    HostName?: string;
+    DNSName?: string;
+    Online?: boolean;
+    TailscaleIPs?: string[];
+    OS?: string;
+    KeyExpiry?: string;
+    CapMap?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface TailscaleTailnetStatus {
+    Name?: string;
+    MagicDNSSuffix?: string;
+    MagicDNSEnabled?: boolean;
+    [key: string]: unknown;
+}
+export interface TailscaleStatus {
+    BackendState: TailscaleBackendState;
+    AuthURL?: string;
+    TailscaleIPs?: string[];
+    Self?: TailscaleSelfStatus;
+    Health?: string[];
+    CurrentTailnet?: TailscaleTailnetStatus;
+    CertDomains?: string[];
+    Version?: string;
+    [key: string]: unknown;
+}
+export interface TailscaleVersionInfo {
+    version: string;
+    raw: Record<string, unknown>;
+}
+export interface TailscaleServeStatus {
+    TCP?: Record<string, {
+        HTTPS?: boolean;
+        HTTP?: boolean;
+        [key: string]: unknown;
+    }>;
+    Web?: Record<string, {
+        Handlers?: Record<string, {
+            Proxy?: string;
+            [key: string]: unknown;
+        }>;
+        [key: string]: unknown;
+    }>;
+    AllowFunnel?: Record<string, boolean>;
+    [key: string]: unknown;
+}
+export declare function redactTailscaleArgs(args: readonly string[]): string[];
+export declare class TailscaleCliService {
+    private readonly logger;
+    getVersion(): Promise<TailscaleVersionInfo>;
+    getStatus(): Promise<TailscaleStatus>;
+    up(args: readonly string[]): Promise<void>;
+    set(args: readonly string[]): Promise<void>;
+    down(): Promise<void>;
+    logout(): Promise<void>;
+    serveReset(): Promise<void>;
+    serve(backendPort: number): Promise<void>;
+    funnelOn(backendPort: number): Promise<void>;
+    serveOff(): Promise<void>;
+    serveStatus(): Promise<TailscaleServeStatus>;
+    spawnUp(args: readonly string[]): ChildProcessWithoutNullStreams;
+    private runManagementCommand;
+    private execServeConfig;
+    private classify;
+    private exec;
+}

package/dist/plugins/remote-access-tailscale/services/tailscale-cli.service.js

@@ -0,0 +1,206 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TailscaleCliService = exports.TailscaleCliError = void 0;
+exports.redactTailscaleArgs = redactTailscaleArgs;
+const node_child_process_1 = require("node:child_process");
+const common_1 = require("@nestjs/common");
+const logger_1 = require("../../../common/logger");
+const remote_access_tailscale_constants_1 = require("../remote-access-tailscale.constants");
+class TailscaleCliError extends Error {
+    constructor(kind, message, cause) {
+        super(message);
+        this.kind = kind;
+        this.cause = cause;
+        this.name = 'TailscaleCliError';
+    }
+}
+exports.TailscaleCliError = TailscaleCliError;
+const AUTH_KEY_FLAG_NAMES = new Set(['--auth-key', '--authkey']);
+function redactTailscaleArgs(args) {
+    const redacted = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        const equalsIndex = arg.indexOf('=');
+        const flagName = equalsIndex === -1 ? arg : arg.slice(0, equalsIndex);
+        if (!AUTH_KEY_FLAG_NAMES.has(flagName)) {
+            redacted.push(arg);
+            continue;
+        }
+        if (equalsIndex === -1) {
+            redacted.push(arg);
+            if (i + 1 < args.length) {
+                const nextValue = args[i + 1];
+                redacted.push(nextValue.startsWith('file:') ? nextValue : '***redacted***');
+                i++;
+            }
+            continue;
+        }
+        const value = arg.slice(equalsIndex + 1);
+        redacted.push(value.startsWith('file:') ? arg : `${flagName}=***redacted***`);
+    }
+    return redacted;
+}
+const SETTINGS_CONFLICT_PATTERN = /must specify all|--reset/i;
+const PERMISSION_DENIED_PATTERN = /access denied|permission denied|must be root,? or operator/i;
+const DAEMON_DOWN_PATTERN = /connection refused|failed to connect to local|couldn't connect|no such file or directory.*sock/i;
+const NEEDS_LOGIN_PATTERN = /not logged in|needs to log in|logged out/i;
+let TailscaleCliService = class TailscaleCliService {
+    constructor() {
+        this.logger = (0, logger_1.createExtensionLogger)(remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_NAME, 'TailscaleCliService');
+    }
+    async getVersion() {
+        const { stdout, stderr, exitCode } = await this.exec(['version', '--json']);
+        if (exitCode !== 0) {
+            throw this.classify(stdout, stderr, `tailscale version --json exited with code ${exitCode}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(stdout);
+        }
+        catch (error) {
+            throw new TailscaleCliError('unknown', 'Failed to parse `tailscale version --json` output.', error);
+        }
+        const version = parsed.majorMinorPatch ?? parsed.short ?? parsed.long;
+        if (typeof version !== 'string' || version.length === 0) {
+            throw new TailscaleCliError('unknown', '`tailscale version --json` did not include a recognizable version field.');
+        }
+        return { version, raw: parsed };
+    }
+    async getStatus() {
+        const { stdout, stderr, exitCode } = await this.exec(['status', '--json']);
+        let parsed;
+        try {
+            parsed = JSON.parse(stdout);
+        }
+        catch (parseError) {
+            throw this.classify(stdout, stderr, `tailscale status --json exited with code ${exitCode}`, parseError);
+        }
+        if (typeof parsed.BackendState !== 'string') {
+            throw this.classify(stdout, stderr, 'tailscale status --json output did not include a BackendState field');
+        }
+        return parsed;
+    }
+    async up(args) {
+        await this.runManagementCommand(['up', ...args]);
+    }
+    async set(args) {
+        await this.runManagementCommand(['set', ...args]);
+    }
+    async down() {
+        await this.runManagementCommand(['down']);
+    }
+    async logout() {
+        await this.runManagementCommand(['logout']);
+    }
+    async serveReset() {
+        await this.runManagementCommand(['serve', 'reset']);
+    }
+    async serve(backendPort) {
+        await this.runManagementCommand([
+            'serve',
+            '--bg',
+            '--https=443',
+            '--set-path=/',
+            `http://127.0.0.1:${backendPort}`,
+        ]);
+    }
+    async funnelOn(backendPort) {
+        await this.runManagementCommand([
+            'funnel',
+            '--bg',
+            '--https=443',
+            '--set-path=/',
+            `http://127.0.0.1:${backendPort}`,
+        ]);
+    }
+    async serveOff() {
+        await this.runManagementCommand(['serve', '--https=443', '--set-path=/', 'off']);
+    }
+    async serveStatus() {
+        return this.execServeConfig(['serve', 'status', '--json']);
+    }
+    spawnUp(args) {
+        const argv = ['up', ...args];
+        this.logger.debug(`Spawning: ${remote_access_tailscale_constants_1.TAILSCALE_BINARY} ${redactTailscaleArgs(argv).join(' ')}`);
+        return (0, node_child_process_1.spawn)(remote_access_tailscale_constants_1.TAILSCALE_BINARY, argv);
+    }
+    async runManagementCommand(args) {
+        const { stdout, stderr, exitCode } = await this.exec(args);
+        if (exitCode !== 0) {
+            throw this.classify(stdout, stderr, `tailscale ${args[0] ?? ''} exited with code ${exitCode}`);
+        }
+    }
+    async execServeConfig(args) {
+        const { stdout, stderr, exitCode } = await this.exec(args);
+        if (exitCode !== 0) {
+            throw this.classify(stdout, stderr, `tailscale ${args.join(' ')} exited with code ${exitCode}`);
+        }
+        try {
+            return JSON.parse(stdout || '{}');
+        }
+        catch (error) {
+            throw new TailscaleCliError('unknown', `Failed to parse \`tailscale ${args.join(' ')}\` output.`, error);
+        }
+    }
+    classify(stdout, stderr, context, cause) {
+        const text = `${stderr}\n${stdout}`;
+        let kind = 'unknown';
+        if (SETTINGS_CONFLICT_PATTERN.test(text)) {
+            kind = 'settings-conflict';
+        }
+        else if (PERMISSION_DENIED_PATTERN.test(text)) {
+            kind = 'permission-denied';
+        }
+        else if (DAEMON_DOWN_PATTERN.test(text)) {
+            kind = 'daemon-down';
+        }
+        else if (NEEDS_LOGIN_PATTERN.test(text)) {
+            kind = 'needs-login';
+        }
+        const detail = stderr.trim() || stdout.trim();
+        return new TailscaleCliError(kind, detail ? `${context}: ${detail}` : context, cause);
+    }
+    exec(args, timeoutMs = remote_access_tailscale_constants_1.TAILSCALE_CLI_DEFAULT_TIMEOUT_MS) {
+        const argv = [...args];
+        this.logger.debug(`Running: ${remote_access_tailscale_constants_1.TAILSCALE_BINARY} ${redactTailscaleArgs(argv).join(' ')}`);
+        return new Promise((resolve, reject) => {
+            (0, node_child_process_1.execFile)(remote_access_tailscale_constants_1.TAILSCALE_BINARY, argv, { timeout: timeoutMs, maxBuffer: remote_access_tailscale_constants_1.TAILSCALE_CLI_MAX_BUFFER_BYTES }, (error, stdout, stderr) => {
+                const out = stdout ?? '';
+                const err = stderr ?? '';
+                if (error) {
+                    const nodeError = error;
+                    if (nodeError.code === 'ENOENT') {
+                        this.logger.warn(`tailscale binary not found: ${remote_access_tailscale_constants_1.TAILSCALE_BINARY} ${redactTailscaleArgs(argv).join(' ')}`);
+                        reject(new TailscaleCliError('not-installed', 'The tailscale CLI is not installed or not on PATH.', error));
+                        return;
+                    }
+                    if (nodeError.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER') {
+                        this.logger.warn(`tailscale call output exceeded the ${remote_access_tailscale_constants_1.TAILSCALE_CLI_MAX_BUFFER_BYTES}-byte buffer: ${remote_access_tailscale_constants_1.TAILSCALE_BINARY} ${redactTailscaleArgs(argv).join(' ')}`);
+                        reject(new TailscaleCliError('unknown', `tailscale ${argv[0] ?? ''} produced more than ${remote_access_tailscale_constants_1.TAILSCALE_CLI_MAX_BUFFER_BYTES} bytes of output.`, error));
+                        return;
+                    }
+                    if (nodeError.killed) {
+                        this.logger.warn(`tailscale call timed out: ${remote_access_tailscale_constants_1.TAILSCALE_BINARY} ${redactTailscaleArgs(argv).join(' ')}`);
+                        reject(new TailscaleCliError('timeout', `tailscale ${argv[0] ?? ''} did not complete within ${timeoutMs}ms.`, error));
+                        return;
+                    }
+                    const exitCode = typeof nodeError.code === 'number' ? nodeError.code : -1;
+                    resolve({ stdout: out, stderr: err, exitCode });
+                    return;
+                }
+                resolve({ stdout: out, stderr: err, exitCode: 0 });
+            });
+        });
+    }
+};
+exports.TailscaleCliService = TailscaleCliService;
+exports.TailscaleCliService = TailscaleCliService = __decorate([
+    (0, common_1.Injectable)()
+], TailscaleCliService);
+//# sourceMappingURL=tailscale-cli.service.js.map

package/dist/plugins/remote-access-tailscale/services/tailscale-cli.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale-cli.service.js","sourceRoot":"","sources":["../../../../src/plugins/remote-access-tailscale/services/tailscale-cli.service.ts"],"names":[],"mappings":";;;;;;;;;AAqIA,kDAoCC;AAzKD,2DAA0F;AAE1F,2CAA4C;AAE5C,mDAA+D;AAC/D,4FAK8C;AAe9C,MAAa,iBAAkB,SAAQ,KAAK;IAC3C,YACiB,IAA2B,EAC3C,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAuB;QAE3B,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACjC,CAAC;CACD;AATD,8CASC;AAyFD,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AAUtF,SAAgB,mBAAmB,CAAC,IAAuB;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAEtE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEnB,SAAS;QACV,CAAC;QAED,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;YAIxB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEnB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAE9B,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;gBAC5E,CAAC,EAAE,CAAC;YACL,CAAC;YAED,SAAS;QACV,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QAEzC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAC9D,MAAM,yBAAyB,GAAG,6DAA6D,CAAC;AAChG,MAAM,mBAAmB,GACxB,iGAAiG,CAAC;AACnG,MAAM,mBAAmB,GAAG,2CAA2C,CAAC;AAYjE,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAAzB;QACW,WAAM,GAAG,IAAA,8BAAqB,EAAC,uEAAmC,EAAE,qBAAqB,CAAC,CAAC;IA8R7G,CAAC;IA5RA,KAAK,CAAC,UAAU;QACf,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE5E,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,6CAA6C,QAAQ,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,MAA+B,CAAC;QAEpC,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA4B,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,oDAAoD,EAAE,KAAK,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC;QAEtE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,iBAAiB,CAC1B,SAAS,EACT,0EAA0E,CAC1E,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAQD,KAAK,CAAC,SAAS;QACd,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE3E,IAAI,MAA+B,CAAC;QAEpC,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA4B,CAAC;QACxD,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,4CAA4C,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;QACzG,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,qEAAqE,CAAC,CAAC;QAC5G,CAAC;QAED,OAAO,MAAoC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,IAAuB;QAC/B,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAuB;QAChC,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,IAAI;QACT,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM;QACX,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC;IAQD,KAAK,CAAC,UAAU;QACf,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAgBD,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC9B,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC/B,OAAO;YACP,MAAM;YACN,aAAa;YACb,cAAc;YACd,oBAAoB,WAAW,EAAE;SACjC,CAAC,CAAC;IACJ,CAAC;IAYD,KAAK,CAAC,QAAQ,CAAC,WAAmB;QACjC,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC/B,QAAQ;YACR,MAAM;YACN,aAAa;YACb,cAAc;YACd,oBAAoB,WAAW,EAAE;SACjC,CAAC,CAAC;IACJ,CAAC;IAUD,KAAK,CAAC,QAAQ;QACb,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;IAClF,CAAC;IAUD,KAAK,CAAC,WAAW;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5D,CAAC;IAYD,OAAO,CAAC,IAAuB;QAC9B,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,oDAAgB,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE1F,OAAO,IAAA,0BAAK,EAAC,oDAAgB,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,IAAuB;QACzD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3D,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QAChG,CAAC;IACF,CAAC;IAGO,KAAK,CAAC,eAAe,CAAC,IAAuB;QACpD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3D,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAyB,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe,EAAE,KAAe;QAChF,MAAM,IAAI,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;QAEpC,IAAI,IAAI,GAA0B,SAAS,CAAC;QAE5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,GAAG,mBAAmB,CAAC;QAC5B,CAAC;aAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,mBAAmB,CAAC;QAC5B,CAAC;aAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,aAAa,CAAC;QACtB,CAAC;aAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,aAAa,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvF,CAAC;IAEO,IAAI,CACX,IAAuB,EACvB,YAAoB,oEAAgC;QAEpD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAEvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,oDAAgB,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEzF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,IAAA,6BAAQ,EACP,oDAAgB,EAChB,IAAI,EACJ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,kEAA8B,EAAE,EACjE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBACzB,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;gBAEzB,IAAI,KAAK,EAAE,CAAC;oBACX,MAAM,SAAS,GAAG,KAAqD,CAAC;oBAExE,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,+BAA+B,oDAAgB,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACxF,CAAC;wBAEF,MAAM,CACL,IAAI,iBAAiB,CAAC,eAAe,EAAE,oDAAoD,EAAE,KAAK,CAAC,CACnG,CAAC;wBAEF,OAAO;oBACR,CAAC;oBAMD,IAAI,SAAS,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;wBAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,sCAAsC,kEAA8B,iBAAiB,oDAAgB,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC9I,CAAC;wBAEF,MAAM,CACL,IAAI,iBAAiB,CACpB,SAAS,EACT,aAAa,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,uBAAuB,kEAA8B,mBAAmB,EAClG,KAAK,CACL,CACD,CAAC;wBAEF,OAAO;oBACR,CAAC;oBAED,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;wBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,oDAAgB,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAEzG,MAAM,CACL,IAAI,iBAAiB,CACpB,SAAS,EACT,aAAa,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,4BAA4B,SAAS,KAAK,EACpE,KAAK,CACL,CACD,CAAC;wBAEF,OAAO;oBACR,CAAC;oBAED,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAE1E,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAEhD,OAAO;gBACR,CAAC;gBAED,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC,CACD,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;AA/RY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;GACA,mBAAmB,CA+R/B"}