@fastybird/smart-panel-backend 1.1.0-alpha.6 → 1.1.0-alpha.61

package/dist/plugins/remote-access-tailscale/services/tailscale-node-managed.service.js

@@ -8,20 +8,24 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TailscaleNodeManagedService = void 0;
 exports.compareTailscaleVersions = compareTailscaleVersions;
-const node_child_process_1 = require("node:child_process");
 const os_1 = __importDefault(require("os"));
 const path_1 = require("path");
 const common_1 = require("@nestjs/common");
 const config_1 = require("@nestjs/config");
 const event_emitter_1 = require("@nestjs/event-emitter");
 const logger_1 = require("../../../common/logger");
+const cancellable_exec_utils_1 = require("../../../common/utils/cancellable-exec.utils");
 const config_utils_1 = require("../../../common/utils/config.utils");
+const remote_access_observation_utils_1 = require("../../../common/utils/remote-access-observation.utils");
 const config_service_1 = require("../../../modules/config/services/config.service");
 const base_managed_extension_service_1 = require("../../../modules/extensions/services/base-managed-extension.service");
 const platform_constants_1 = require("../../../modules/platform/platform.constants");
@@ -31,9 +35,9 @@ const config_model_1 = require("../models/config.model");
 const remote_access_tailscale_constants_1 = require("../remote-access-tailscale.constants");
 const remote_access_tailscale_exceptions_1 = require("../remote-access-tailscale.exceptions");
 const tailscale_cli_service_1 = require("./tailscale-cli.service");
+const tailscale_operation_coordinator_service_1 = require("./tailscale-operation-coordinator.service");
 const tailscale_serve_service_1 = require("./tailscale-serve.service");
 const tailscale_status_mapper_service_1 = require("./tailscale-status-mapper.service");
-const TAILSCALE_REQUIREMENTS_PERIODIC_REFRESH_MS = 5 * 60 * 1000;
 const TAILSCALE_PRINT_PLAN_TIMEOUT_MS = 2_000;
 const OPERATOR_GRANTED_SATISFIED_MESSAGE = 'The smart-panel operator is granted.';
 const TAILSCALE_DOCUMENTATION_URL = 'https://smart-panel.fastybird.com/docs';
@@ -52,7 +56,7 @@ function compareTailscaleVersions(a, b) {
 }
 const UNEVALUATED_MESSAGE = 'Not evaluated: the platform requirement is not satisfied.';
 let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base_managed_extension_service_1.BaseManagedExtensionService {
-    constructor(cli, mapper, configService, nestConfigService, platformService, eventEmitter, serveService) {
+    constructor(cli, mapper, configService, nestConfigService, platformService, eventEmitter, serveService, operations = new tailscale_operation_coordinator_service_1.TailscaleOperationCoordinatorService()) {
         super();
         this.cli = cli;
         this.mapper = mapper;
@@ -61,22 +65,120 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
         this.platformService = platformService;
         this.eventEmitter = eventEmitter;
         this.serveService = serveService;
+        this.operations = operations;
         this.logger = (0, logger_1.createExtensionLogger)(remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_NAME, 'TailscaleNodeManagedService');
         this.owner = { kind: 'plugin', type: remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_NAME };
         this.serviceId = 'node';
         this.activationPolicy = 'owner-enabled';
+        this.observations = new remote_access_observation_utils_1.RemoteAccessObservation();
+        this.requirementObservations = new remote_access_observation_utils_1.RemoteAccessObservation();
+        this.authentication = 'unknown';
+        this.identity = {};
+        this.connectPromise = null;
+        this.stopPromise = null;
         this.pollTimer = null;
         this.lastStatus = null;
         this.lastError = null;
         this.pluginConfig = null;
+        this.pendingAdvertiseTags = null;
         this.requirementsCache = null;
-        this.requirementsRefreshedAt = 0;
         this.lastServeConvergeDenied = false;
         this.reconnectAttempts = 0;
         this.nextReconnectAttemptAt = 0;
+        this.operations.onSettled((operation) => {
+            if (operation !== 'serve' && operation !== 'reconnect') {
+                this.schedulePoll(0);
+            }
+        });
+    }
+    getOperationCoordinator() {
+        return this.operations;
+    }
+    getControlState() {
+        return {
+            enabled: this.isPluginEnabled(),
+            serviceState: this.state,
+            authentication: this.authentication,
+            operation: this.operations.getOperation(),
+        };
+    }
+    isPluginEnabled() {
+        try {
+            return this.configService.getPluginConfig(remote_access_tailscale_constants_1.REMOTE_ACCESS_TAILSCALE_PLUGIN_NAME).enabled;
+        }
+        catch {
+            return false;
+        }
+    }
+    clearAuthentication() {
+        this.authentication = 'required';
+        this.identity = {};
+    }
+    observeAuthentication(status) {
+        if (status.BackendState === 'NeedsLogin') {
+            this.clearAuthentication();
+        }
+        else if (['Running', 'Starting', 'Stopped', 'NeedsMachineAuth'].includes(status.BackendState)) {
+            this.authentication = 'authenticated';
+            this.identity = this.mapper.map(status, { port: this.getBackendPort() }).details;
+        }
+    }
+    async onModuleDestroy() {
+        await this.stop();
+    }
+    async ensureSupervisorStartedForLogin() {
+        if (!this.isPluginEnabled()) {
+            throw new remote_access_tailscale_exceptions_1.TailscalePluginDisabledException();
+        }
+        if (this.state !== 'started') {
+            await this.startNode(false);
+        }
+    }
+    assertRequirements(requirements) {
+        const failed = requirements.find((requirement) => !requirement.satisfied);
+        if (failed) {
+            throw new remote_access_tailscale_exceptions_1.TailscaleRequirementUnsatisfiedException(failed);
+        }
+        if (requirements.length === 0) {
+            throw new tailscale_cli_service_1.TailscaleCliError('unknown', 'Tailscale setup could not be verified. Re-check setup before connecting.');
+        }
+    }
+    async connect() {
+        if (!this.isPluginEnabled()) {
+            throw new remote_access_tailscale_exceptions_1.TailscalePluginDisabledException();
+        }
+        if (this.connectPromise !== null) {
+            return this.connectPromise;
+        }
+        this.connectPromise = (this.state === 'started'
+            ? this.operations.run('connect', async (token) => {
+                const config = this.getPluginConfig();
+                const requirements = await this.refreshRequirements('start');
+                this.operations.assertCurrent(token);
+                this.assertRequirements(requirements);
+                const status = await this.cli.getStatus();
+                this.operations.assertCurrent(token);
+                this.observeAuthentication(status);
+                if (!this.mapper.hasExistingKey(status)) {
+                    throw new tailscale_cli_service_1.TailscaleCliError('needs-login', 'Sign in to Tailscale before connecting.');
+                }
+                if (this.mapper.map(status, { port: this.getBackendPort() }).state === 'connected') {
+                    return;
+                }
+                await this.applyNodePreferences(config);
+                this.operations.assertCurrent(token);
+                this.schedulePoll(0);
+            })
+            : this.startNode(true)).finally(() => {
+            this.connectPromise = null;
+        });
+        return this.connectPromise;
     }
     async start() {
-        await this.withLock(async () => {
+        return this.startNode(false);
+    }
+    async startNode(strict) {
+        await this.operations.run('connect', async (token) => {
             if (this.state === 'started') {
                 return;
             }
@@ -85,18 +187,33 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
             this.reconnectAttempts = 0;
             this.nextReconnectAttemptAt = 0;
             const config = this.getPluginConfig();
+            this.pendingAdvertiseTags = config.advertiseTags.join(',');
             this.logger.log('Starting Tailscale node service');
             try {
                 const requirements = await this.refreshRequirements('start');
+                this.operations.assertCurrent(token);
+                if (strict) {
+                    this.assertRequirements(requirements);
+                }
                 if (this.requirementsSatisfied(requirements)) {
                     const status = await this.getStatusOrNull();
+                    this.operations.assertCurrent(token);
+                    if (status) {
+                        this.observeAuthentication(status);
+                    }
                     if (status && this.mapper.hasExistingKey(status)) {
-                        await this.cli.set(this.buildPreferenceFlags(config));
-                        await this.cli.up(this.buildUpFlags(config));
+                        await this.applyNodePreferences(config);
                     }
                 }
             }
             catch (error) {
+                this.operations.assertCurrent(token);
+                if (strict) {
+                    this.state = 'error';
+                    this.lastError = error instanceof Error ? error.message : 'Unknown Tailscale failure.';
+                    await this.emitStatus();
+                    throw error;
+                }
                 if (error instanceof tailscale_cli_service_1.TailscaleCliError && error.kind === 'permission-denied') {
                     await this.refreshRequirements('permission-denied').catch(() => undefined);
                 }
@@ -109,59 +226,155 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
                     });
                 });
             }
-            this.schedulePoll(0);
+            this.operations.assertCurrent(token);
             this.state = 'started';
+            this.lastError = null;
+            this.schedulePoll(0);
             this.logger.log('Tailscale node service started');
         });
+        if (strict && this.authentication !== 'authenticated') {
+            throw new tailscale_cli_service_1.TailscaleCliError('needs-login', 'Sign in to Tailscale before connecting.');
+        }
     }
     async stop() {
-        await this.withLock(async () => {
-            if (this.state === 'stopped') {
+        if (this.stopPromise !== null) {
+            return this.stopPromise;
+        }
+        const shouldDown = this.state !== 'stopped' || this.operations.getOperation() !== null || this.operations.hasPendingChildren();
+        this.state = 'stopping';
+        this.observations.invalidate();
+        this.requirementObservations.invalidate();
+        this.clearPoll();
+        this.stopPromise = this.operations
+            .interrupt('disconnect', async (token) => {
+            if (!shouldDown) {
+                this.state = 'stopped';
+                await this.emitStatus();
                 return;
             }
-            this.state = 'stopping';
-            this.clearPoll();
             try {
                 await this.cli.down();
+                this.operations.assertCurrent(token);
                 this.state = 'stopped';
             }
             catch (error) {
-                if (await this.isStopFailureTolerated(error)) {
-                    this.logger.debug('tailscale down failed while stopping (safe to ignore if the node was already down)', {
-                        message: error instanceof Error ? error.message : String(error),
-                    });
-                    this.state = 'stopped';
-                }
-                else {
-                    const message = error instanceof Error ? error.message : String(error);
-                    this.state = 'error';
-                    this.lastError = message;
-                    this.logger.error('Failed to stop the Tailscale node service', { message });
-                    await this.emitStatus();
-                    throw new remote_access_tailscale_exceptions_1.TailscaleNodeStopFailedException(message);
+                this.operations.assertCurrent(token);
+                const tolerated = await this.isStopFailureTolerated(error);
+                this.operations.assertCurrent(token);
+                if (!tolerated) {
+                    throw error;
                 }
+                this.state = 'stopped';
+            }
+            this.lastError = null;
+            await this.emitStatus();
+        })
+            .catch(async (error) => {
+            if (error instanceof remote_access_tailscale_exceptions_1.TailscaleOperationCancelledException) {
+                throw error;
             }
+            this.state = 'error';
+            this.lastError = error instanceof Error ? error.message : 'Unknown Tailscale failure.';
             await this.emitStatus();
-            this.logger.log('Tailscale node service stopped');
+            if (error instanceof Error && 'code' in error) {
+                throw error;
+            }
+            throw new remote_access_tailscale_exceptions_1.TailscaleNodeStopFailedException(this.lastError);
+        })
+            .finally(() => {
+            this.stopPromise = null;
         });
+        return this.stopPromise;
     }
     async isStopFailureTolerated(error) {
         if (error instanceof tailscale_cli_service_1.TailscaleCliError &&
             (error.kind === 'needs-login' || error.kind === 'daemon-down' || error.kind === 'not-installed')) {
             return true;
         }
-        const status = await this.getStatusOrNull();
+        const status = await this.getStatusOrNullWithin(remote_access_tailscale_constants_1.TAILSCALE_STOP_STATUS_TIMEOUT_MS);
         return status?.BackendState === 'Stopped';
     }
+    async getStatusOrNullWithin(timeoutMs) {
+        let timer;
+        try {
+            return await Promise.race([
+                this.getStatusOrNull(),
+                new Promise((resolve, reject) => {
+                    timer = setTimeout(() => {
+                        void this.operations.reapPendingChildren().then(() => resolve(null), reject);
+                    }, timeoutMs);
+                }),
+            ]);
+        }
+        finally {
+            if (timer) {
+                clearTimeout(timer);
+            }
+        }
+    }
     async emitStatus() {
-        const status = await this.computeStatus();
+        const generation = this.operations.getGeneration();
+        const status = this.state === 'stopped' || this.state === 'stopping' || this.state === 'error'
+            ? this.buildStatus(this.state === 'error' ? 'error' : 'disconnected', this.lastError ?? 'The node service is stopped.', this.identity)
+            : await this.computeStatus();
+        if (!this.operations.isCurrent(generation)) {
+            return;
+        }
+        this.operations.assertCurrent();
         this.lastStatus = status;
-        this.eventEmitter.emit(remote_access_constants_1.EventType.PROVIDER_STATUS, status);
+        this.eventEmitter.emit(remote_access_constants_1.EventType.PROVIDER_OBSERVATION, {
+            status,
+            metadata: { requirements: this.getRequirements(), control: this.getControlState() },
+        });
     }
     async onConfigChanged() {
+        this.observations.invalidate();
+        this.requirementObservations.invalidate();
+        if (this.stopPromise !== null) {
+            await this.stopPromise;
+        }
+        this.clearPoll();
+        return this.operations.interrupt('config', async (token) => {
+            let result;
+            try {
+                result = await this.applyConfigChange();
+            }
+            catch (error) {
+                this.operations.assertCurrent(token);
+                this.state = 'error';
+                this.lastError = error instanceof Error ? error.message : 'Unknown Tailscale failure.';
+                await this.emitStatus();
+                throw error;
+            }
+            this.operations.assertCurrent(token);
+            if (this.isPollable()) {
+                this.schedulePoll(0);
+            }
+            return result;
+        });
+    }
+    async applyConfigChange() {
         const previous = this.pluginConfig;
         this.pluginConfig = null;
         const next = this.getPluginConfig();
+        if (this.pendingAdvertiseTags !== null || previous?.advertiseTags.join(',') !== next.advertiseTags.join(',')) {
+            this.pendingAdvertiseTags = next.advertiseTags.join(',');
+        }
+        if (!next.enabled) {
+            this.state = 'stopping';
+            try {
+                await this.cli.down();
+            }
+            catch (error) {
+                if (!(await this.isStopFailureTolerated(error))) {
+                    throw error;
+                }
+            }
+            this.operations.assertCurrent();
+            this.state = 'stopped';
+            await this.emitStatus();
+            return { restartRequired: false };
+        }
         if (!previous || previous.loginServer !== next.loginServer) {
             this.logger.log('Tailscale login_server changed (or its prior value was unknown), restart required');
             try {
@@ -178,22 +391,41 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
                     throw error;
                 }
             }
+            this.operations.assertCurrent();
+            this.clearAuthentication();
             return { restartRequired: true };
         }
+        if (!this.isPollable()) {
+            return { restartRequired: false };
+        }
         try {
             const requirements = await this.refreshRequirements('start');
             if (this.requirementsSatisfied(requirements)) {
-                const status = await this.getStatusOrNull();
+                let status = await this.getStatusOrNull();
                 if (status && this.mapper.hasExistingKey(status)) {
-                    await this.cli.set(this.buildPreferenceFlags(next));
+                    this.operations.assertCurrent();
+                    if (this.pendingAdvertiseTags !== null) {
+                        await this.applyNodePreferences(next);
+                        this.operations.assertCurrent();
+                        status = await this.getStatusOrNull();
+                        this.operations.assertCurrent();
+                        if (status) {
+                            this.observeAuthentication(status);
+                        }
+                    }
+                    else {
+                        await this.cli.set(this.buildPreferenceFlags(next));
+                        this.operations.assertCurrent();
+                    }
                     const port = this.getBackendPort();
-                    if (this.mapper.map(status, { port }).state === 'connected') {
+                    if (status && this.mapper.map(status, { port }).state === 'connected') {
                         await this.convergeServe(next, port, status);
                     }
                 }
             }
         }
         catch (error) {
+            this.operations.assertCurrent();
             if (error instanceof tailscale_cli_service_1.TailscaleCliError && error.kind === 'permission-denied') {
                 await this.refreshRequirements('permission-denied').catch(() => undefined);
             }
@@ -204,52 +436,112 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
         return { restartRequired: false };
     }
     async isHealthy() {
+        const generation = this.operations.getGeneration();
+        if (!this.isPollable()) {
+            return false;
+        }
         if (!this.requirementsSatisfied(this.getRequirements())) {
             return false;
         }
         try {
-            const status = await this.cli.getStatus();
-            return status.BackendState === 'Running' && status.Self?.Online === true;
+            const { raw: status } = await this.computeStatusWithRawStatus();
+            return (this.isPollable() &&
+                this.operations.isCurrent(generation) &&
+                status?.BackendState === 'Running' &&
+                status.Self?.Online === true);
         }
         catch {
             return false;
         }
     }
     async factoryReset() {
-        await this.cli.serveReset().catch(() => undefined);
+        this.state = 'stopping';
+        this.observations.invalidate();
+        this.requirementObservations.invalidate();
+        this.clearPoll();
         try {
-            await this.cli.logout();
-            return { success: true };
+            return await this.operations.interrupt('reset', async (token) => {
+                await this.cli.down().catch((error) => this.isStopFailureTolerated(error).then((safe) => {
+                    if (!safe) {
+                        throw error;
+                    }
+                }));
+                this.operations.assertCurrent(token);
+                await this.cli.serveReset().catch(() => undefined);
+                this.operations.assertCurrent(token);
+                await this.cli.logout().catch((error) => {
+                    if (!(error instanceof tailscale_cli_service_1.TailscaleCliError && ['not-installed', 'needs-login', 'daemon-down'].includes(error.kind))) {
+                        throw error;
+                    }
+                });
+                this.operations.assertCurrent(token);
+                this.clearAuthentication();
+                this.state = 'stopped';
+                await this.emitStatus();
+                return { success: true };
+            });
         }
         catch (error) {
-            if (error instanceof tailscale_cli_service_1.TailscaleCliError && (error.kind === 'not-installed' || error.kind === 'needs-login')) {
-                return { success: true };
+            if (!(error instanceof remote_access_tailscale_exceptions_1.TailscaleOperationCancelledException)) {
+                this.state = 'error';
+                this.lastError = error instanceof Error ? error.message : 'Unknown error';
+                await this.emitStatus();
             }
             return { success: false, reason: error instanceof Error ? error.message : 'Unknown error' };
         }
     }
     async evaluateRequirements() {
-        return this.refreshRequirements('status-read');
+        return this.refreshRequirements('setup-complete');
+    }
+    async reconcileSetup(generation) {
+        if (!this.operations.isCurrent(generation) || !this.getControlState().enabled) {
+            return;
+        }
+        await this.operations.run('config', async (token) => {
+            this.operations.assertCurrent(token);
+            if (!this.operations.isCurrent(generation)) {
+                return;
+            }
+            if (this.state !== 'started') {
+                await this.startNode(false);
+            }
+            else {
+                const status = await this.cli.getStatus();
+                this.operations.assertCurrent(token);
+                this.observeAuthentication(status);
+                if (this.mapper.hasExistingKey(status)) {
+                    await this.applyNodePreferences(this.getPluginConfig());
+                    this.operations.assertCurrent(token);
+                }
+                this.schedulePoll(0);
+            }
+        });
     }
     getRequirements() {
         return this.requirementsCache ?? [];
     }
-    async refreshRequirements(reason) {
-        if (reason === 'periodic' &&
-            this.requirementsCache &&
-            Date.now() - this.requirementsRefreshedAt < TAILSCALE_REQUIREMENTS_PERIODIC_REFRESH_MS) {
-            return this.requirementsCache;
+    async refreshRequirements(reason, signal) {
+        const generation = this.operations.getGeneration();
+        const readOnly = reason === 'periodic' || reason === 'status-read';
+        const requirements = await (readOnly
+            ? this.requirementObservations.run((readSignal) => this.evaluateRequirementsLive(generation, false, readSignal), signal)
+            : this.evaluateRequirementsLive(generation, true, signal));
+        signal?.throwIfAborted();
+        if (!this.operations.isCurrent(generation)) {
+            return this.getRequirements();
         }
-        const requirements = await this.evaluateRequirementsLive();
         this.requirementsCache = requirements;
-        this.requirementsRefreshedAt = Date.now();
         return requirements;
     }
     requirementsSatisfied(requirements) {
         return requirements.length > 0 && requirements.every((requirement) => requirement.satisfied);
     }
-    async evaluateRequirementsLive() {
+    async evaluateRequirementsLive(generation, allowProbe = false, signal) {
         const platform = await this.evaluatePlatformSupported();
+        signal?.throwIfAborted();
+        if (!this.operations.isCurrent(generation)) {
+            return this.getRequirements();
+        }
         if (!platform.satisfied) {
             return [
                 await this.finalizeRequirement(platform),
@@ -259,20 +551,34 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
                 this.unevaluatedRequirement('version-supported'),
             ];
         }
-        const [{ binary, version }, daemonActive, operatorGranted] = await Promise.all([
-            this.evaluateBinaryAndVersion(),
-            this.evaluateDaemonActive(),
-            this.evaluateOperatorGranted(),
+        const results = await Promise.allSettled([
+            this.evaluateBinaryAndVersion(signal),
+            this.evaluateDaemonActive(signal),
+            this.evaluateOperatorGranted(generation, allowProbe, signal),
         ]);
-        return this.attachRemedies([platform, binary, daemonActive, operatorGranted, version]);
+        signal?.throwIfAborted();
+        const [binaryResult, daemonResult, operatorResult] = results;
+        if (binaryResult.status === 'rejected') {
+            throw binaryResult.reason;
+        }
+        if (daemonResult.status === 'rejected') {
+            throw daemonResult.reason;
+        }
+        if (operatorResult.status === 'rejected') {
+            throw operatorResult.reason;
+        }
+        const { binary, version } = binaryResult.value;
+        const daemonActive = daemonResult.value;
+        const operatorGranted = operatorResult.value;
+        return this.attachRemedies([platform, binary, daemonActive, operatorGranted, version], signal);
     }
     unevaluatedRequirement(code) {
         return { code, satisfied: false, message: UNEVALUATED_MESSAGE, remedy: null };
     }
-    async attachRemedies(requirements) {
+    async attachRemedies(requirements, signal) {
         let installRemedyPromise = null;
         const getInstallRemedy = () => {
-            installRemedyPromise ??= this.buildInstallRemedy();
+            installRemedyPromise ??= this.buildInstallRemedy(signal);
             return installRemedyPromise;
         };
         return Promise.all(requirements.map((requirement) => this.finalizeRequirement(requirement, getInstallRemedy)));
@@ -301,9 +607,9 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
                 return { commands: [], note: TAILSCALE_DOCUMENTATION_URL };
         }
     }
-    async buildInstallRemedy() {
+    async buildInstallRemedy(signal) {
         try {
-            const stdout = await this.runSetupScriptPrintPlan('install');
+            const stdout = await this.runSetupScriptPrintPlan(signal);
             const lines = stdout
                 .split('\n')
                 .map((line) => line.trim())
@@ -323,37 +629,100 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
             return { commands: [], note: TAILSCALE_VENDOR_DOWNLOAD_URL };
         }
     }
-    runSetupScriptPrintPlan(step) {
+    async runSetupScriptPrintPlan(signal) {
         const script = (0, path_1.join)(__dirname, '..', 'scripts', 'tailscale-setup.sh');
-        return new Promise((resolve, reject) => {
-            (0, node_child_process_1.execFile)('bash', [script, '--print-plan', `--step=${step}`], { timeout: TAILSCALE_PRINT_PLAN_TIMEOUT_MS }, (error, stdout) => {
-                if (error) {
-                    reject(error);
-                    return;
-                }
-                resolve(stdout ?? '');
-            });
-        });
+        return (await (0, cancellable_exec_utils_1.cancellableExecFile)('bash', [script, '--print-plan', '--step=install'], signal, TAILSCALE_PRINT_PLAN_TIMEOUT_MS)).stdout;
     }
-    async computeStatus(requirementsReason = 'status-read') {
-        return (await this.computeStatusWithRawStatus(requirementsReason)).status;
+    async computeStatus(_requirementsReason = 'status-read', options) {
+        return (await this.computeStatusWithRawStatus(options)).status;
     }
-    async computeStatusWithRawStatus(requirementsReason = 'status-read') {
+    async awaitObservationIdle() {
+        await Promise.all([this.observations.awaitIdle(), this.requirementObservations.awaitIdle()]);
+    }
+    async getStatusSnapshot(options) {
+        const observation = await this.computeStatusWithRawStatus(options);
+        return {
+            status: observation.status,
+            metadata: { requirements: observation.requirements, control: this.getControlState() },
+        };
+    }
+    async computeStatusWithRawStatus(options) {
+        const generation = this.operations.getGeneration();
+        const revision = this.operations.getObservationRevision();
+        try {
+            const result = await this.observations.run(async (signal) => {
+                const requirements = await this.refreshRequirements('status-read', signal);
+                const collected = await this.collectStatusWithRawStatus(generation, signal, requirements);
+                signal.throwIfAborted();
+                return { ...collected, requirements };
+            }, options?.signal);
+            if (!this.operations.isCurrent(generation) || !this.operations.isObservationCurrent(revision)) {
+                return this.supersededObservation();
+            }
+            if (result.raw && this.isPollable()) {
+                this.observeAuthentication(result.raw);
+            }
+            return result;
+        }
+        catch (error) {
+            if (!this.operations.isCurrent(generation) ||
+                !this.operations.isObservationCurrent(revision) ||
+                !this.isPollable()) {
+                return this.supersededObservation();
+            }
+            return {
+                status: this.buildStatus('error', error instanceof Error ? error.message : 'The status observation failed.'),
+                raw: null,
+                requirements: this.getRequirements(),
+            };
+        }
+    }
+    supersededObservation() {
+        return {
+            status: this.buildStatus(this.state === 'error' ? 'error' : 'disconnected', this.lastError ?? 'The observation was superseded by a lifecycle action.'),
+            raw: null,
+            requirements: this.getRequirements(),
+        };
+    }
+    async collectStatusWithRawStatus(generation = this.operations.getGeneration(), signal, requirements = this.getRequirements()) {
         if (this.state === 'stopped' || this.state === 'stopping') {
-            return { status: this.buildStatus('disconnected', 'The node service is stopped.'), raw: null };
+            return { status: this.buildStatus('disconnected', 'The node service is stopped.', this.identity), raw: null };
         }
         if (this.state === 'error') {
             return { status: this.buildStatus('error', this.lastError ?? 'The Tailscale node service failed.'), raw: null };
         }
-        const platform = await this.evaluatePlatformSupported();
+        const platform = requirements.find((requirement) => requirement.code === 'platform-supported') ?? {
+            satisfied: false,
+            message: 'Platform detection did not complete.',
+        };
+        signal?.throwIfAborted();
+        if (!this.operations.isCurrent(generation)) {
+            return {
+                status: this.buildStatus('disconnected', 'The observation was superseded by a lifecycle action.', this.identity),
+                raw: null,
+            };
+        }
         if (!platform.satisfied) {
             return { status: this.buildStatus('unsupported', platform.message), raw: null };
         }
         try {
-            const status = await this.cli.getStatus();
+            const status = await this.cli.getStatus(signal);
+            signal?.throwIfAborted();
+            if (!this.operations.isCurrent(generation)) {
+                return {
+                    status: this.buildStatus('disconnected', 'The observation was superseded by a lifecycle action.', this.identity),
+                    raw: null,
+                };
+            }
             const port = this.getBackendPort();
             const postureAdvisories = this.buildPostureAdvisories(status);
-            const requirements = await this.refreshRequirements(requirementsReason);
+            signal?.throwIfAborted();
+            if (!this.operations.isCurrent(generation)) {
+                return {
+                    status: this.buildStatus('disconnected', 'The observation was superseded by a lifecycle action.', this.identity),
+                    raw: null,
+                };
+            }
             const operatorRequirement = requirements.find((requirement) => requirement.code === 'operator-granted');
             if (operatorRequirement && !operatorRequirement.satisfied) {
                 return {
@@ -372,7 +741,7 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
                 };
             }
             const config = this.getPluginConfig();
-            const serveResult = await this.serveService.read(config, port, status);
+            const serveResult = await this.serveService.read(config, port, status, signal);
             return {
                 status: this.buildStatus(mapped.state, mapped.message, mapped.details, [...mapped.proxyAddresses, ...serveResult.proxyAddresses], [...mapped.endpoints, ...serveResult.endpoints], [...postureAdvisories, ...serveResult.advisories]),
                 raw: status,
@@ -398,7 +767,11 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
         }
     }
     async convergeServe(config, port, status) {
-        const result = await this.serveService.converge(config, port, status);
+        const result = await this.operations.run('serve', async (token) => {
+            const converged = await this.serveService.converge(config, port, status);
+            this.operations.assertCurrent(token);
+            return converged;
+        }, false);
         if (result.permissionDenied) {
             if (!this.lastServeConvergeDenied) {
                 this.lastServeConvergeDenied = true;
@@ -437,9 +810,9 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
             message: `Tailscale is not supported on the '${platformType}' platform.`,
         };
     }
-    async evaluateBinaryAndVersion() {
+    async evaluateBinaryAndVersion(signal) {
         try {
-            const info = await this.cli.getVersion();
+            const info = await this.cli.getVersion(signal);
             const supported = compareTailscaleVersions(info.version, remote_access_tailscale_constants_1.TAILSCALE_MIN_VERSION) >= 0;
             return {
                 binary: { code: 'binary-installed', satisfied: true, message: `Tailscale ${info.version} is installed.` },
@@ -468,21 +841,24 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
             };
         }
     }
-    async evaluateDaemonActive() {
-        const active = await this.isSystemdUnitActive('tailscaled');
+    async evaluateDaemonActive(signal) {
+        const active = await this.isSystemdUnitActive('tailscaled', signal);
         return {
             code: 'daemon-active',
             satisfied: active,
             message: active ? 'tailscaled is active.' : 'tailscaled is not active. Run setup or start the service.',
         };
     }
-    async evaluateOperatorGranted() {
+    async evaluateOperatorGranted(generation = this.operations.getGeneration(), allowProbe = false, signal) {
         const serviceUser = os_1.default.userInfo().username;
         try {
-            const prefs = await this.cli.getPrefs();
+            const prefs = await this.cli.getPrefs(signal);
             return this.buildOperatorRequirement(prefs.OperatorUser === serviceUser, serviceUser);
         }
         catch (error) {
+            if (!this.operations.isCurrent(generation)) {
+                return { code: 'operator-granted', satisfied: false, message: 'The requirement observation was superseded.' };
+            }
             if (error instanceof tailscale_cli_service_1.TailscaleCliError) {
                 if (error.kind === 'daemon-down') {
                     return {
@@ -499,12 +875,22 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
                     };
                 }
             }
+            if (!allowProbe) {
+                const verified = this.getRequirements().find((requirement) => requirement.code === 'operator-granted');
+                return verified?.satisfied
+                    ? verified
+                    : {
+                        code: 'operator-granted',
+                        satisfied: false,
+                        message: 'The operator grant cannot be verified by this Tailscale version. Run Set up or Connect to verify management access.',
+                    };
+            }
             return this.evaluateOperatorGrantedViaProbe(serviceUser);
         }
     }
     async evaluateOperatorGrantedViaProbe(serviceUser) {
         try {
-            await this.cli.set([`--operator=${serviceUser}`]);
+            await this.operations.run('preferences', async () => this.cli.set([`--operator=${serviceUser}`]), false);
             return this.buildOperatorRequirement(true, serviceUser);
         }
         catch (error) {
@@ -547,16 +933,15 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
             return null;
         }
     }
-    isSystemdUnitActive(unit) {
-        return new Promise((resolve) => {
-            (0, node_child_process_1.execFile)('systemctl', ['is-active', unit], { timeout: remote_access_tailscale_constants_1.TAILSCALE_SYSTEMCTL_PROBE_TIMEOUT_MS }, (error, stdout) => {
-                if (error) {
-                    resolve(false);
-                    return;
-                }
-                resolve((stdout ?? '').trim() === 'active');
-            });
-        });
+    async isSystemdUnitActive(unit, signal) {
+        try {
+            const result = await (0, cancellable_exec_utils_1.cancellableExecFile)('systemctl', ['is-active', unit], signal, remote_access_tailscale_constants_1.TAILSCALE_SYSTEMCTL_PROBE_TIMEOUT_MS);
+            return result.exitCode === 0 && result.stdout.trim() === 'active';
+        }
+        catch {
+            signal?.throwIfAborted();
+            return false;
+        }
     }
     isPollable() {
         return this.state === 'starting' || this.state === 'started';
@@ -567,7 +952,7 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
             return;
         }
         this.pollTimer = setTimeout(() => {
-            void this.pollTick();
+            this.operations.withoutOperation(() => void this.pollTick());
         }, delayMs);
         this.pollTimer.unref?.();
     }
@@ -578,9 +963,13 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
         }
     }
     async pollTick() {
+        const generation = this.operations.getGeneration();
+        let revision = this.operations.getObservationRevision();
         try {
-            let { status, raw } = await this.computeStatusWithRawStatus('periodic');
-            if (!this.isPollable()) {
+            let { status, raw, requirements } = await this.computeStatusWithRawStatus();
+            if (!this.isPollable() ||
+                !this.operations.isCurrent(generation) ||
+                !this.operations.isObservationCurrent(revision)) {
                 return;
             }
             if (status.state === 'connected') {
@@ -593,27 +982,39 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
                 this.requirementsSatisfied(this.getRequirements()) &&
                 Date.now() >= this.nextReconnectAttemptAt) {
                 const reconnected = await this.attemptReconnect();
-                if (!this.isPollable()) {
+                revision = this.operations.getObservationRevision();
+                if (!this.isPollable() || !this.operations.isCurrent(generation)) {
                     return;
                 }
                 if (reconnected) {
-                    ({ status, raw } = await this.computeStatusWithRawStatus('periodic'));
-                    if (!this.isPollable()) {
+                    ({ status, raw, requirements } = await this.computeStatusWithRawStatus());
+                    if (!this.isPollable() || !this.operations.isCurrent(generation)) {
                         return;
                     }
                 }
             }
-            if (raw && status.state === 'connected' && this.requirementsSatisfied(this.getRequirements())) {
-                await this.convergeServe(this.getPluginConfig(), this.getBackendPort(), raw);
+            if (!this.isPollable() ||
+                !this.operations.isCurrent(generation) ||
+                !this.operations.isObservationCurrent(revision)) {
+                return;
             }
             if (this.hasStatusChanged(this.lastStatus, status)) {
                 this.lastStatus = status;
-                this.eventEmitter.emit(remote_access_constants_1.EventType.PROVIDER_STATUS, status);
+                this.eventEmitter.emit(remote_access_constants_1.EventType.PROVIDER_OBSERVATION, {
+                    status,
+                    metadata: { requirements, control: this.getControlState() },
+                });
+            }
+            if (raw && status.state === 'connected' && this.requirementsSatisfied(this.getRequirements())) {
+                await this.convergeServe(this.getPluginConfig(), this.getBackendPort(), raw);
+            }
+            if (!this.isPollable() || !this.operations.isCurrent(generation)) {
+                return;
             }
             this.schedulePoll(status.state === 'connecting' ? remote_access_tailscale_constants_1.TAILSCALE_POLL_INTERVAL_TRANSITIONING_MS : remote_access_tailscale_constants_1.TAILSCALE_POLL_INTERVAL_STABLE_MS);
         }
         catch (error) {
-            if (!this.isPollable()) {
+            if (!this.isPollable() || !this.operations.isCurrent(generation)) {
                 return;
             }
             this.logger.error('Tailscale status poll failed', {
@@ -623,20 +1024,21 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
         }
     }
     async attemptReconnect() {
-        return this.withLock(async () => {
+        return this.operations.run('reconnect', async (token) => {
             if (this.state !== 'started') {
                 return false;
             }
             try {
                 const config = this.getPluginConfig();
-                await this.cli.set(this.buildPreferenceFlags(config));
-                await this.cli.up(this.buildUpFlags(config));
+                await this.applyNodePreferences(config);
+                this.operations.assertCurrent(token);
                 this.reconnectAttempts = 0;
                 this.nextReconnectAttemptAt = 0;
                 this.logger.log('Tailscale node reconnected automatically after being found unexpectedly disconnected.');
                 return true;
             }
             catch (error) {
+                this.operations.assertCurrent(token);
                 this.reconnectAttempts += 1;
                 const delayMs = Math.min(remote_access_tailscale_constants_1.TAILSCALE_RECONNECT_BASE_DELAY_MS * 2 ** (this.reconnectAttempts - 1), remote_access_tailscale_constants_1.TAILSCALE_RECONNECT_MAX_DELAY_MS);
                 this.nextReconnectAttemptAt = Date.now() + delayMs;
@@ -663,18 +1065,56 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
             JSON.stringify(previous.proxyAddresses) !== JSON.stringify(next.proxyAddresses) ||
             JSON.stringify(previous.advisories) !== JSON.stringify(next.advisories));
     }
+    async applyNodePreferences(config) {
+        this.operations.assertCurrent();
+        const tags = config.advertiseTags.join(',');
+        this.pendingAdvertiseTags = tags;
+        await this.cli.set(this.buildPreferenceFlags(config));
+        this.operations.assertCurrent();
+        const upOnlyPreferencesMatch = await this.upOnlyPreferencesMatch(config);
+        this.operations.assertCurrent();
+        await this.cli.up(upOnlyPreferencesMatch ? [] : this.buildUpFlags(config));
+        this.operations.assertCurrent();
+        if (this.pendingAdvertiseTags === tags) {
+            this.pendingAdvertiseTags = null;
+        }
+    }
+    async upOnlyPreferencesMatch(config) {
+        try {
+            const prefs = await this.cli.getPrefs();
+            this.operations.assertCurrent();
+            if (typeof prefs.ControlURL !== 'string') {
+                return false;
+            }
+            const controlUrl = prefs.ControlURL || remote_access_tailscale_constants_1.TAILSCALE_DEFAULT_LOGIN_SERVER;
+            const tags = prefs.AdvertiseTags === null ? [] : prefs.AdvertiseTags;
+            if (controlUrl !== config.loginServer || !Array.isArray(tags) || !tags.every((tag) => typeof tag === 'string')) {
+                return false;
+            }
+            const advertisedTags = new Set(tags);
+            const configuredTags = new Set(config.advertiseTags);
+            return advertisedTags.size === configuredTags.size && [...configuredTags].every((tag) => advertisedTags.has(tag));
+        }
+        catch {
+            this.operations.assertCurrent();
+            return false;
+        }
+    }
     buildPreferenceFlags(config) {
         return [
             `--hostname=${config.hostname}`,
             `--accept-dns=${config.acceptDns}`,
             `--accept-routes=${config.acceptRoutes}`,
-            `--advertise-tags=${config.advertiseTags.join(',')}`,
             `--ssh=${config.ssh}`,
             `--operator=${os_1.default.userInfo().username}`,
         ];
     }
     buildUpFlags(config) {
-        return [...this.buildPreferenceFlags(config), `--login-server=${config.loginServer}`];
+        return [
+            ...this.buildPreferenceFlags(config),
+            `--advertise-tags=${config.advertiseTags.join(',')}`,
+            `--login-server=${config.loginServer}`,
+        ];
     }
     buildStatus(state, message, details = {}, proxyAddresses = [], endpoints = [], advisories = []) {
         return {
@@ -730,12 +1170,14 @@ let TailscaleNodeManagedService = class TailscaleNodeManagedService extends base
 exports.TailscaleNodeManagedService = TailscaleNodeManagedService;
 exports.TailscaleNodeManagedService = TailscaleNodeManagedService = __decorate([
     (0, common_1.Injectable)(),
+    __param(7, (0, common_1.Optional)()),
     __metadata("design:paramtypes", [tailscale_cli_service_1.TailscaleCliService,
         tailscale_status_mapper_service_1.TailscaleStatusMapperService,
         config_service_1.ConfigService,
         config_1.ConfigService,
         platform_service_1.PlatformService,
         event_emitter_1.EventEmitter2,
-        tailscale_serve_service_1.TailscaleServeService])
+        tailscale_serve_service_1.TailscaleServeService,
+        tailscale_operation_coordinator_service_1.TailscaleOperationCoordinatorService])
 ], TailscaleNodeManagedService);
 //# sourceMappingURL=tailscale-node-managed.service.js.map