@knpkv/herdr-tailscale 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 knpkv
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,13 @@
+# `@knpkv/herdr-tailscale`
+
+Read-only Tailscale adapter for Herdr fleet discovery and caller authentication.
+
+The Effect service runs only these commands:
+
+- `tailscale status --json`
+- `tailscale whois --json <address>`
+- `tailscale ip -4`
+
+Each command has a ten-second timeout. JSON is decoded with Schema before it reaches callers. Command, decode, and authorization failures remain distinct typed errors. This package never changes Tailscale state.
+
+`discoverFleetPeers` resolves every configured machine by its stable Tailscale node ID, then verifies the advertised hostname. Missing, duplicate, or hostname-mismatched identities fail closed; mutable hostname matches are never an authorization path. Offline machines remain present when their stable identity is still reported. `authorizeWhois` requires an allowed login and, when supplied, an allowed stable node ID.

package/dist/index.d.ts

@@ -0,0 +1,104 @@
+import { Context, Effect, Layer, Schema } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+export declare const TailIpv4: Schema.String;
+export declare const TailIp: Schema.String;
+export declare const TailNode: Schema.Struct<{
+    readonly DNSName: Schema.optionalKey<Schema.String>;
+    readonly HostName: Schema.String;
+    readonly ID: Schema.String;
+    readonly Online: Schema.Boolean;
+    readonly TailscaleIPs: Schema.$Array<Schema.String>;
+}>;
+export interface TailNode extends Schema.Schema.Type<typeof TailNode> {
+}
+export declare const TailStatus: Schema.Struct<{
+    readonly Peer: Schema.decodeTo<Schema.$Record<Schema.String, Schema.Struct<{
+        readonly DNSName: Schema.optionalKey<Schema.String>;
+        readonly HostName: Schema.String;
+        readonly ID: Schema.String;
+        readonly Online: Schema.Boolean;
+        readonly TailscaleIPs: Schema.$Array<Schema.String>;
+    }>>, Schema.NullOr<Schema.$Record<Schema.String, Schema.Struct<{
+        readonly DNSName: Schema.optionalKey<Schema.String>;
+        readonly HostName: Schema.String;
+        readonly ID: Schema.String;
+        readonly Online: Schema.Boolean;
+        readonly TailscaleIPs: Schema.$Array<Schema.String>;
+    }>>>, never, never>;
+    readonly Self: Schema.Struct<{
+        readonly DNSName: Schema.optionalKey<Schema.String>;
+        readonly HostName: Schema.String;
+        readonly ID: Schema.String;
+        readonly Online: Schema.Boolean;
+        readonly TailscaleIPs: Schema.$Array<Schema.String>;
+    }>;
+}>;
+export interface TailStatus extends Schema.Schema.Type<typeof TailStatus> {
+}
+export declare const TailWhois: Schema.Struct<{
+    readonly Node: Schema.Struct<{
+        readonly StableID: Schema.String;
+    }>;
+    readonly UserProfile: Schema.Struct<{
+        readonly LoginName: Schema.String;
+    }>;
+}>;
+export interface TailWhois extends Schema.Schema.Type<typeof TailWhois> {
+}
+export declare const FleetPeer: Schema.Struct<{
+    readonly host: Schema.String;
+    readonly ipv4: Schema.NullOr<Schema.String>;
+    readonly online: Schema.Boolean;
+}>;
+export interface FleetPeer extends Schema.Schema.Type<typeof FleetPeer> {
+}
+declare const TailscaleCommandError_base: Schema.Class<TailscaleCommandError, Schema.TaggedStruct<"HerdrTailscale.CommandError", {
+    readonly cause: Schema.Defect;
+    readonly operation: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class TailscaleCommandError extends TailscaleCommandError_base {
+}
+declare const TailscaleDecodeError_base: Schema.Class<TailscaleDecodeError, Schema.TaggedStruct<"HerdrTailscale.DecodeError", {
+    readonly cause: Schema.Defect;
+    readonly operation: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class TailscaleDecodeError extends TailscaleDecodeError_base {
+}
+declare const TailscaleAuthorizationError_base: Schema.Class<TailscaleAuthorizationError, Schema.TaggedStruct<"HerdrTailscale.AuthorizationError", {
+    readonly actor: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class TailscaleAuthorizationError extends TailscaleAuthorizationError_base {
+}
+declare const TailscaleFleetIdentityError_base: Schema.Class<TailscaleFleetIdentityError, Schema.TaggedStruct<"HerdrTailscale.FleetIdentityError", {
+    readonly host: Schema.String;
+    readonly nodeId: Schema.String;
+    readonly reason: Schema.Literals<readonly ["duplicate", "host_mismatch", "missing"]>;
+}>, import("effect/Cause").YieldableError>;
+export declare class TailscaleFleetIdentityError extends TailscaleFleetIdentityError_base {
+}
+export interface ConfiguredFleetNode {
+    readonly host: string;
+    readonly nodeId: string;
+}
+export interface TailscaleClient {
+    readonly ipv4: Effect.Effect<string, TailscaleCommandError | TailscaleDecodeError>;
+    readonly status: Effect.Effect<TailStatus, TailscaleCommandError | TailscaleDecodeError>;
+    readonly whois: (address: string) => Effect.Effect<TailWhois, TailscaleCommandError | TailscaleDecodeError>;
+}
+declare const Tailscale_base: Context.ServiceClass<Tailscale, "@knpkv/herdr-tailscale/Tailscale", TailscaleClient>;
+export declare class Tailscale extends Tailscale_base {
+}
+export declare const make: (executable: string) => Effect.Effect<TailscaleClient, never, ChildProcessSpawner.ChildProcessSpawner>;
+export declare const layer: (executable: string) => Layer.Layer<Tailscale, never, ChildProcessSpawner.ChildProcessSpawner>;
+export declare const nodeIpv4: (node: TailNode) => string | undefined;
+export declare const resolveFleetNode: (status: TailStatus, machine: ConfiguredFleetNode) => Effect.Effect<{
+    readonly DNSName?: string;
+    readonly HostName: string;
+    readonly ID: string;
+    readonly Online: boolean;
+    readonly TailscaleIPs: readonly string[];
+}, TailscaleFleetIdentityError, never>;
+export declare const discoverFleetPeers: (localHost: string, machines: readonly ConfiguredFleetNode[]) => Effect.Effect<FleetPeer[], TailscaleCommandError | TailscaleDecodeError | TailscaleFleetIdentityError, Tailscale>;
+export declare const authorizeWhois: (identity: TailWhois, allowedUsers: readonly string[], requiredNodeIds: readonly string[] | null) => Effect.Effect<string, TailscaleAuthorizationError, never>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAwB,MAAM,QAAQ,CAAA;AAC7E,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAI3E,eAAO,MAAM,QAAQ,eAKpB,CAAA;AACD,eAAO,MAAM,MAAM,eAOlB,CAAA;AAED,eAAO,MAAM,QAAQ;;;;;;EAMnB,CAAA;AACF,MAAM,WAAW,QAAS,SAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC;CAAG;AASxE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;EAGrB,CAAA;AACF,MAAM,WAAW,UAAW,SAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,UAAU,CAAC;CAAG;AAE5E,eAAO,MAAM,SAAS;;;;;;;EAGpB,CAAA;AACF,MAAM,WAAW,SAAU,SAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,SAAS,CAAC;CAAG;AAE1E,eAAO,MAAM,SAAS;;;;EAIpB,CAAA;AACF,MAAM,WAAW,SAAU,SAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,SAAS,CAAC;CAAG;;;;;AAE1E,qBAAa,qBAAsB,SAAQ,0BAG1C;CAAG;;;;;AAEJ,qBAAa,oBAAqB,SAAQ,yBAGzC;CAAG;;;;AAEJ,qBAAa,2BAA4B,SAAQ,gCAGhD;CAAG;;;;;;AAEJ,qBAAa,2BAA4B,SAAQ,gCAOhD;CAAG;AAEJ,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,oBAAoB,CAAC,CAAA;IAClF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,GAAG,oBAAoB,CAAC,CAAA;IACxF,QAAQ,CAAC,KAAK,EAAE,CACd,OAAO,EAAE,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,qBAAqB,GAAG,oBAAoB,CAAC,CAAA;CAC5E;;AAOD,qBAAa,SAAU,SAAQ,cAE9B;CAAG;AA+EJ,eAAO,MAAM,IAAI,wGA4Bf,CAAA;AAEF,eAAO,MAAM,KAAK,eAAgB,MAAM,2EAA8C,CAAA;AAEtF,eAAO,MAAM,QAAQ,SAAU,QAAQ,KAAG,MAAM,GAAG,SAA2C,CAAA;AAE9F,eAAO,MAAM,gBAAgB;;;;;;sCA8B3B,CAAA;AAEF,eAAO,MAAM,kBAAkB,oLAmB7B,CAAA;AAEF,eAAO,MAAM,cAAc,gKAazB,CAAA"}

package/dist/index.js

@@ -0,0 +1,138 @@
+import { Context, Effect, Layer, Schema, SchemaGetter, Stream } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+import { isIPv4, isIPv6 } from "node:net";
+const BoundedName = Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(256));
+export const TailIpv4 = Schema.String.check(Schema.makeFilter((address) => isIPv4(address) && address !== "0.0.0.0", { expected: "a specified IPv4 address" }));
+export const TailIp = Schema.String.check(Schema.makeFilter((address) => (isIPv4(address) && address !== "0.0.0.0") ||
+    (isIPv6(address) && address !== "::"), { expected: "a specified IPv4 or IPv6 address" }));
+export const TailNode = Schema.Struct({
+    DNSName: Schema.optionalKey(Schema.String),
+    HostName: BoundedName,
+    ID: BoundedName,
+    Online: Schema.Boolean,
+    TailscaleIPs: Schema.Array(TailIp)
+});
+const TailPeers = Schema.NullOr(Schema.Record(Schema.String, TailNode)).pipe(Schema.decodeTo(Schema.Record(Schema.String, TailNode), {
+    decode: SchemaGetter.transform((peers) => peers ?? {}),
+    encode: SchemaGetter.transform((peers) => peers)
+}));
+export const TailStatus = Schema.Struct({
+    Peer: TailPeers,
+    Self: TailNode
+});
+export const TailWhois = Schema.Struct({
+    Node: Schema.Struct({ StableID: BoundedName }),
+    UserProfile: Schema.Struct({ LoginName: BoundedName })
+});
+export const FleetPeer = Schema.Struct({
+    host: BoundedName,
+    ipv4: Schema.NullOr(TailIpv4),
+    online: Schema.Boolean
+});
+export class TailscaleCommandError extends Schema.TaggedError()("HerdrTailscale.CommandError", { cause: Schema.Defect(), operation: Schema.String }) {
+}
+export class TailscaleDecodeError extends Schema.TaggedError()("HerdrTailscale.DecodeError", { cause: Schema.Defect(), operation: Schema.String }) {
+}
+export class TailscaleAuthorizationError extends Schema.TaggedError()("HerdrTailscale.AuthorizationError", { actor: Schema.String }) {
+}
+export class TailscaleFleetIdentityError extends Schema.TaggedError()("HerdrTailscale.FleetIdentityError", {
+    host: BoundedName,
+    nodeId: BoundedName,
+    reason: Schema.Literals(["duplicate", "host_mismatch", "missing"])
+}) {
+}
+export class Tailscale extends Context.Service()("@knpkv/herdr-tailscale/Tailscale") {
+}
+const decodeJson = (operation, schema, output) => Effect.try({
+    try: () => Schema.decodeUnknownSync(schema)(JSON.parse(output)),
+    catch: (cause) => new TailscaleDecodeError({ cause, operation })
+});
+const run = Effect.fn("HerdrTailscale.run")(function* (spawner, executable, operation, args) {
+    const collect = (stream) => stream.pipe(Stream.mapError((cause) => new TailscaleCommandError({ cause, operation })), Stream.runFoldEffect(() => ({ bytes: 0, chunks: [] }), (output, chunk) => {
+        const bytes = output.bytes + chunk.byteLength;
+        return bytes > 1024 * 1024
+            ? Effect.fail(new TailscaleCommandError({
+                cause: bytes,
+                operation: `${operation}.output_limit`
+            }))
+            : Effect.succeed({ bytes, chunks: [...output.chunks, chunk] });
+    }), Effect.flatMap((output) => Stream.fromIterable(output.chunks).pipe(Stream.decodeText(), Stream.mkString, Effect.mapError((cause) => new TailscaleCommandError({ cause, operation })))));
+    return yield* Effect.scoped(spawner.spawn(ChildProcess.make(executable, args)).pipe(Effect.mapError((cause) => new TailscaleCommandError({ cause, operation })), Effect.flatMap((handle) => Effect.all({
+        exitCode: handle.exitCode.pipe(Effect.mapError((cause) => new TailscaleCommandError({ cause, operation }))),
+        stderr: collect(handle.stderr),
+        stdout: collect(handle.stdout)
+    }, { concurrency: "unbounded" })), Effect.flatMap(({ exitCode, stderr, stdout }) => Number(exitCode) === 0
+        ? Effect.succeed(stdout)
+        : Effect.fail(new TailscaleCommandError({
+            cause: { exitCode, stderr },
+            operation
+        }))), Effect.timeoutOrElse({
+        duration: "10 seconds",
+        orElse: () => Effect.fail(new TailscaleCommandError({
+            cause: "10 seconds",
+            operation: `${operation}.timeout`
+        }))
+    })));
+});
+export const make = Effect.fn("HerdrTailscale.make")(function* (executable) {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const status = run(spawner, executable, "tailscale.status", ["status", "--json"]).pipe(Effect.flatMap((output) => decodeJson("tailscale.status.decode", TailStatus, output)));
+    const whois = Effect.fn("HerdrTailscale.whois")(function* (address) {
+        const output = yield* run(spawner, executable, "tailscale.whois", ["whois", "--json", address]);
+        return yield* decodeJson("tailscale.whois.decode", TailWhois, output);
+    });
+    const ipv4 = run(spawner, executable, "tailscale.ipv4", ["ip", "-4"]).pipe(Effect.map((output) => output.trim()), Effect.flatMap((address) => Schema.decodeUnknownEffect(TailIpv4)(address).pipe(Effect.mapError((cause) => new TailscaleDecodeError({
+        cause,
+        operation: "tailscale.ipv4"
+    })))));
+    return Tailscale.of({ ipv4, status, whois });
+});
+export const layer = (executable) => Layer.effect(Tailscale, make(executable));
+export const nodeIpv4 = (node) => node.TailscaleIPs.find(isIPv4);
+export const resolveFleetNode = Effect.fn("HerdrTailscale.resolveFleetNode")(function* (status, machine) {
+    const matches = [status.Self, ...Object.values(status.Peer)].filter(({ ID }) => ID === machine.nodeId);
+    const node = matches[0];
+    if (node === undefined) {
+        return yield* new TailscaleFleetIdentityError({
+            host: machine.host,
+            nodeId: machine.nodeId,
+            reason: "missing"
+        });
+    }
+    if (matches.length !== 1) {
+        return yield* new TailscaleFleetIdentityError({
+            host: machine.host,
+            nodeId: machine.nodeId,
+            reason: "duplicate"
+        });
+    }
+    if (node.HostName.toLowerCase() !== machine.host.toLowerCase()) {
+        return yield* new TailscaleFleetIdentityError({
+            host: machine.host,
+            nodeId: machine.nodeId,
+            reason: "host_mismatch"
+        });
+    }
+    return node;
+});
+export const discoverFleetPeers = Effect.fn("HerdrTailscale.discoverFleetPeers")(function* (localHost, machines) {
+    const tailscale = yield* Tailscale;
+    const status = yield* tailscale.status;
+    const resolved = yield* Effect.forEach(machines, (machine) => resolveFleetNode(status, machine).pipe(Effect.map((node) => ({
+        host: machine.host,
+        ipv4: nodeIpv4(node) ?? null,
+        online: node.Online
+    }))));
+    return resolved.filter(({ host }) => host.toLowerCase() !== localHost.toLowerCase());
+});
+export const authorizeWhois = Effect.fn("HerdrTailscale.authorizeWhois")(function* (identity, allowedUsers, requiredNodeIds) {
+    const login = identity.UserProfile.LoginName;
+    if (!allowedUsers.includes(login)) {
+        return yield* new TailscaleAuthorizationError({ actor: login });
+    }
+    if (requiredNodeIds !== null && !requiredNodeIds.includes(identity.Node.StableID)) {
+        return yield* new TailscaleAuthorizationError({ actor: identity.Node.StableID });
+    }
+    return login;
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7E,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAEzC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACzC,MAAM,CAAC,UAAU,CACf,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,SAAS,EACrD,EAAE,QAAQ,EAAE,0BAA0B,EAAE,CACzC,CACF,CAAA;AACD,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACvC,MAAM,CAAC,UAAU,CACf,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,SAAS,CAAC;IAC1C,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,IAAI,CAAC,EACvC,EAAE,QAAQ,EAAE,kCAAkC,EAAE,CACjD,CACF,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,WAAW;IACrB,EAAE,EAAE,WAAW;IACf,MAAM,EAAE,MAAM,CAAC,OAAO;IACtB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;CACnC,CAAC,CAAA;AAGF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAC1E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IACtD,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;IACtD,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC;CACjD,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,QAAQ;CACf,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;CACvD,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC,OAAO;CACvB,CAAC,CAAA;AAGF,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CACpF,6BAA6B,EAC7B,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CACrD;CAAG;AAEJ,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,EAAwB,CAClF,4BAA4B,EAC5B,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CACrD;CAAG;AAEJ,MAAM,OAAO,2BAA4B,SAAQ,MAAM,CAAC,WAAW,EAA+B,CAChG,mCAAmC,EACnC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CACzB;CAAG;AAEJ,MAAM,OAAO,2BAA4B,SAAQ,MAAM,CAAC,WAAW,EAA+B,CAChG,mCAAmC,EACnC;IACE,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CACnE,CACF;CAAG;AAoBJ,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,OAAO,EAA8B,CAC1E,kCAAkC,CACnC;CAAG;AAEJ,MAAM,UAAU,GAAG,CACjB,SAAiB,EACjB,MAA8C,EAC9C,MAAc,EACd,EAAE,CACF,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;CACjE,CAAC,CAAA;AAEJ,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EACnD,OAA2D,EAC3D,UAAkB,EAClB,SAAiB,EACjB,IAA2B;IAE3B,MAAM,OAAO,GAAG,CAAC,MAA0C,EAAE,EAAE,CAC7D,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAC3E,MAAM,CAAC,aAAa,CAClB,GAAoB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EACjD,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAA;QAC7C,OAAO,KAAK,GAAG,IAAI,GAAG,IAAI;YACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CACX,IAAI,qBAAqB,CAAC;gBACxB,KAAK,EAAE,KAAK;gBACZ,SAAS,EAAE,GAAG,SAAS,eAAe;aACvC,CAAC,CACH;YACD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;IAClE,CAAC,CACF,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,UAAU,EAAE,EACnB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAC5E,CACF,CACF,CAAA;IACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CACzB,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAC3E,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAC5E;QACD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;KAC/B,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CACjC,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAC9C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CACX,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YAC3B,SAAS;SACV,CAAC,CACH,CACJ,EACD,MAAM,CAAC,aAAa,CAAC;QACnB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,IAAI,CACT,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,GAAG,SAAS,UAAU;SAClC,CAAC,CACH;KACJ,CAAC,CACH,CACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAAC,UAAkB;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAA;IAE9D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CACpF,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,yBAAyB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CACtF,CAAA;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAAC,OAAe;QACvE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;QAC/F,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,wBAAwB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CACxE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EACrC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;QACvB,KAAK;QACL,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CACL,CACF,CACF,CACF,CAAA;IAED,OAAO,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;AAC9C,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;AAEtF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAc,EAAsB,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EACpF,MAAkB,EAClB,OAA4B;IAE5B,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CACjE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,CAClC,CAAA;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,CAAC,IAAI,2BAA2B,CAAC;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,IAAI,2BAA2B,CAAC;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,WAAW;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,CAAC,IAAI,2BAA2B,CAAC;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,eAAe;SACxB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAAC,EACxF,SAAiB,EACjB,QAA4C;IAE5C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAA;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3D,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CACR,CAAC,IAAI,EAAa,EAAE,CAAC,CAAC;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI;QAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CACH,CACF,CAAC,CAAA;IACJ,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,CAC7D,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAChF,QAAmB,EACnB,YAAmC,EACnC,eAA6C;IAE7C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAA;IAC5C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,IAAI,2BAA2B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,eAAe,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,OAAO,KAAK,CAAC,CAAC,IAAI,2BAA2B,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA"}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@knpkv/herdr-tailscale",
+  "version": "0.2.0",
+  "description": "Effect adapter for authenticated Herdr fleet discovery over Tailscale",
+  "license": "MIT",
+  "author": "knpkv",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/knpkv/npm.git",
+    "directory": "packages/herdr-tailscale"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=26"
+  },
+  "dependencies": {
+    "effect": "4.0.0-rc.109"
+  },
+  "devDependencies": {
+    "@effect/platform-node": "4.0.0-rc.109",
+    "@effect/vitest": "4.0.0-rc.109",
+    "@types/node": "^26.2.0",
+    "rimraf": "^6.1.3",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "vitest": "^4.1.10"
+  },
+  "scripts": {
+    "build": "rimraf dist && tsc -b --force",
+    "check": "tsc -b tsconfig.json",
+    "clean": "rimraf dist *.tsbuildinfo",
+    "lint": "eslint \"{src,test}/**/*.ts\"",
+    "pack:deterministic": "pnpm build && node ../../scripts/pack-herdr.mjs .",
+    "test": "vitest run"
+  }
+}