latchkey 3.5.0 → 3.7.0

package/dist/src/services/fastmail.js

@@ -0,0 +1,298 @@
+/**
+ * Fastmail service implementation.
+ *
+ * Fastmail's JMAP API is an OAuth 2.1 protected resource: it advertises an
+ * authorization server at `https://api.fastmail.com` (RFC 8414 metadata at
+ * `/.well-known/oauth-authorization-server`) supporting dynamic client
+ * registration, PKCE (S256) and refresh tokens, with public clients
+ * (`token_endpoint_auth_method: none`). So no API token has to be created by
+ * hand in the account's settings and pasted in — `latchkey auth browser
+ * fastmail` is enough.
+ */
+import { z } from 'zod';
+import { OAuthCredentials } from '../apiCredentials/base.js';
+import { DEFAULT_ACCOUNT, fetchAccountFromEndpoint, tryParseJson, } from '../apiCredentials/account.js';
+import { runCapturedAsync } from '../curl.js';
+import { exchangeCodeForTokens, generateCodeChallenge, generateCodeVerifier, refreshAccessToken, startOAuthCallbackServer, } from '../oauthUtils.js';
+import { Service, ServiceSession, LoginFailedError, LoginCancelledError, buildPreparedCredentials, isBrowserClosedError, } from './core/base.js';
+/**
+ * JSON accepted by `latchkey auth prepare fastmail`: an OAuth client id to
+ * reuse instead of registering a new client dynamically. Fastmail issues
+ * public clients, so no secret is needed. `.strict()` rejects unknown keys so
+ * typos are reported instead of silently ignored.
+ */
+export const FastmailPrepareInputSchema = z
+    .object({
+    clientId: z.string().min(1),
+})
+    .strict();
+// The session document, requested directly. Not `/.well-known/jmap`: that
+// 302s to this URL on a *different* host, and curl drops the Authorization
+// header across a cross-host redirect, so following it reports a missing
+// header even when the credential is fine.
+const SESSION_ENDPOINT = 'https://api.fastmail.com/jmap/session';
+const REGISTRATION_ENDPOINT = 'https://api.fastmail.com/oauth/register';
+const AUTHORIZATION_ENDPOINT = 'https://api.fastmail.com/oauth/authorize';
+// Named `/oauth/refresh` rather than `/oauth/token`, but this is the
+// `token_endpoint` of Fastmail's authorization server metadata: it serves both
+// the authorization_code exchange and the refresh_token grant.
+const TOKEN_ENDPOINT = 'https://api.fastmail.com/oauth/refresh';
+/**
+ * RFC 8707 resource indicator, required by Fastmail: an authorization request
+ * that does not name the resource it is for is refused with `invalid_target`.
+ * This is the `resource` of the protected-resource metadata at
+ * `/.well-known/oauth-protected-resource/jmap/session`, and it is what scopes
+ * the JMAP capabilities to. Fastmail publishes a second, unrelated resource for
+ * its MCP endpoint (`https://api.fastmail.com/mcp`) with its own scope; naming
+ * the wrong one here would yield tokens JMAP will not accept.
+ */
+const JMAP_RESOURCE = 'https://api.fastmail.com/jmap/session';
+/**
+ * One service carries all three JMAP scopes rather than splitting into
+ * per-capability services the way the Google ones do. Google's products are
+ * separate APIs on separate hosts, so a service each disambiguates cleanly;
+ * Fastmail's are one JMAP session behind one host, so sibling services would
+ * all match the same URLs and a request could pick whichever credential
+ * happened to be registered first — including one lacking the needed scope.
+ *
+ * Mail plus a refresh token. Fastmail also offers `…scope:contacts` and
+ * `…scope:calendars`, which JMAP exposes through the same session document —
+ * add them here if latchkey grows callers that need those capabilities, but
+ * asking for them today would over-request on the consent screen.
+ *
+ * These are the names the authorization server's own metadata advertises, and
+ * the only ones its registration endpoint accepts. Fastmail's developer docs
+ * list a different set (`urn:ietf:params:jmap:core`, `urn:ietf:params:jmap:mail`,
+ * …) which apply to clients registered by hand with Fastmail's partnerships
+ * team; passing those to dynamic registration fails outright.
+ *
+ * The same string is sent twice: once when registering the client, and again on
+ * the authorization request. They have to agree — see {@link registerClient}.
+ *
+ * These grant read AND write: Fastmail publishes no read-only OAuth scope, and
+ * its registration endpoint rejects every `:readonly` variant. A read-only
+ * credential has to be a hand-made API token ("Read-only access" on the API
+ * token screen) supplied with `latchkey auth set`, which this service also
+ * accepts.
+ */
+const OAUTH_SCOPES = 'urn:ietf:params:oauth:scope:mail ' +
+    'urn:ietf:params:oauth:scope:contacts ' +
+    'urn:ietf:params:oauth:scope:calendars ' +
+    'offline_access';
+const LOGIN_TIMEOUT_MS = 120000;
+/**
+ * Register a public OAuth client via RFC 7591 dynamic client registration.
+ *
+ * Fastmail normalizes a loopback `redirect_uri` by dropping the port (RFC 8252
+ * §7.3 lets a native client's loopback port vary), so one registration keeps
+ * working across the ephemeral ports {@link startOAuthCallbackServer} picks.
+ */
+async function registerClient(redirectUri, clientName) {
+    const body = JSON.stringify({
+        client_name: clientName,
+        redirect_uris: [redirectUri],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+        // Required. Fastmail records the scopes at registration time and rejects an
+        // authorization request asking for anything outside them ("This MUST be a
+        // subset of the scopes registered for the client"). Omitting this registers
+        // the client with an empty scope, and every later authorize call comes back
+        // to the callback with an error and no code.
+        scope: OAUTH_SCOPES,
+    });
+    const result = await runCapturedAsync(['-s', '-X', 'POST', '-H', 'Content-Type: application/json', '-d', body, REGISTRATION_ENDPOINT], 30);
+    if (result.returncode !== 0) {
+        throw new LoginFailedError(`Failed to register OAuth client: ${result.stderr}`);
+    }
+    try {
+        const response = JSON.parse(result.stdout);
+        if (!response.client_id) {
+            throw new LoginFailedError(`Client registration response missing client_id: ${result.stdout}`);
+        }
+        return response;
+    }
+    catch (error) {
+        if (error instanceof LoginFailedError) {
+            throw error;
+        }
+        throw new LoginFailedError(`Failed to parse client registration response: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Absolute expiry for an `expires_in`, or undefined when the server did not send
+ * a usable one. `OAuthCredentials.accessTokenExpiresAt` is optional and
+ * `isExpired()` answers "unknown" without it, so omitting it degrades to
+ * refresh-on-failure. Computing it blindly would turn a missing value into
+ * `new Date(NaN).toISOString()`, which throws RangeError and loses the tokens
+ * that were just successfully obtained.
+ */
+function expiryFromExpiresIn(expiresIn) {
+    if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+        return undefined;
+    }
+    return new Date(Date.now() + expiresIn * 1000).toISOString();
+}
+/**
+ * The JMAP session document names the authenticated account in `username`
+ * (RFC 8620 §2), which for Fastmail is the account's e-mail address.
+ */
+function parseAccountFromSession(responseBody) {
+    const session = tryParseJson(responseBody);
+    return session?.username ?? null;
+}
+class FastmailSession extends ServiceSession {
+    onResponse(_response) {
+        // Not used — login detection is via OAuth callback, not response inspection.
+    }
+    isLoginComplete() {
+        // Not used — we override login() entirely.
+        return false;
+    }
+    finalizeCredentials(_browser, _context, _oldCredentials) {
+        // Not used — we override login() entirely.
+        return Promise.resolve(null);
+    }
+    async login(encryptedStorage, launchOptions = {}, oldCredentials) {
+        const { withTempBrowserContext } = await import('../playwrightUtils.js');
+        return withTempBrowserContext(encryptedStorage, launchOptions, async ({ context }) => {
+            const page = await context.newPage();
+            const abortController = new AbortController();
+            const closeHandler = () => {
+                abortController.abort();
+            };
+            page.on('close', closeHandler);
+            context.on('close', closeHandler);
+            try {
+                // 1. Start OAuth callback server
+                const { port, codePromise } = await startOAuthCallbackServer(LOGIN_TIMEOUT_MS, abortController.signal);
+                const redirectUri = `http://localhost:${port.toString()}/oauth2callback`;
+                // 2. Register client or reuse existing client_id.
+                //
+                // Fastmail fixes a client's scopes at registration, so reusing a stored
+                // client id pins the scopes granted the first time. If OAUTH_SCOPES ever
+                // widens, an existing user's next login is refused for asking outside
+                // the old client's scopes, and `latchkey auth clear fastmail --all`
+                // (which drops the stored client id) is the way out.
+                let clientId;
+                if (oldCredentials instanceof OAuthCredentials && oldCredentials.clientId) {
+                    clientId = oldCredentials.clientId;
+                }
+                else {
+                    const registration = await registerClient(redirectUri, this.generateAppName());
+                    clientId = registration.client_id;
+                }
+                // 3. Generate PKCE verifier/challenge
+                const codeVerifier = generateCodeVerifier();
+                const codeChallenge = generateCodeChallenge(codeVerifier);
+                // 4. Open browser to authorization URL
+                const authUrl = new URL(AUTHORIZATION_ENDPOINT);
+                authUrl.searchParams.set('client_id', clientId);
+                authUrl.searchParams.set('redirect_uri', redirectUri);
+                authUrl.searchParams.set('response_type', 'code');
+                authUrl.searchParams.set('scope', OAUTH_SCOPES);
+                authUrl.searchParams.set('resource', JMAP_RESOURCE);
+                authUrl.searchParams.set('code_challenge', codeChallenge);
+                authUrl.searchParams.set('code_challenge_method', 'S256');
+                await page.goto(authUrl.toString());
+                // 5. Wait for user to authorize and callback to receive code
+                const code = await codePromise;
+                // 6. Exchange code for tokens
+                const tokens = await exchangeCodeForTokens(TOKEN_ENDPOINT, code, clientId, '', // public client, no secret
+                redirectUri, codeVerifier, { resource: JMAP_RESOURCE });
+                const accessTokenExpiresAt = expiryFromExpiresIn(tokens.expires_in);
+                await page.close();
+                const credentials = new OAuthCredentials(clientId, '', // public client
+                tokens.access_token, tokens.refresh_token, accessTokenExpiresAt);
+                return {
+                    credentials,
+                    // The JMAP session document is the only thing that names the
+                    // account; Fastmail's token response carries no identity. A session
+                    // fetch that fails still leaves usable credentials, so fall back to
+                    // the placeholder rather than failing the whole login.
+                    account: (await this.service.getAccount(credentials)) ?? DEFAULT_ACCOUNT,
+                };
+            }
+            catch (error) {
+                if (error instanceof Error && isBrowserClosedError(error)) {
+                    throw new LoginCancelledError();
+                }
+                throw error;
+            }
+            finally {
+                page.off('close', closeHandler);
+                context.off('close', closeHandler);
+            }
+        });
+    }
+}
+export class Fastmail extends Service {
+    name = 'fastmail';
+    displayName = 'Fastmail';
+    /**
+     * Four host shapes, which is why these are patterns rather than plain
+     * prefixes. Session discovery starts at `api.fastmail.com`, but the `apiUrl`
+     * and `downloadUrl` it returns point at the shard the account is homed on
+     * (`phl.api.fastmail.com`, `phl-www.fastmailusercontent.com`, …). Which
+     * shard that is only becomes known after discovery, so the service has to
+     * cover them all up front.
+     *
+     * The blob pattern is anchored on the `www` label rather than accepting any
+     * subdomain: the session document only ever names `www.fastmailusercontent.com`
+     * or `<shard>-www.…`, and this is the domain Fastmail uses to serve user
+     * content, so matching it loosely would offer the access token to hosts the
+     * credential has no business reaching.
+     *
+     * Deliberately NOT covering carddav.fastmail.com / caldav.fastmail.com. Those
+     * advertise `WWW-Authenticate: Basic realm=..., Bearer`, so adding them looks
+     * right, but Fastmail's OAuth access tokens are refused there (401 on every
+     * path tried, including the principal and per-user collections) — the DAV
+     * endpoints want an app password over Basic auth, which is a different
+     * credential type than this service issues. Contacts and calendars are
+     * reachable over JMAP on the hosts below instead.
+     */
+    baseApiUrls = [
+        /^https:\/\/([a-z0-9-]+\.)?api\.fastmail\.com\//,
+        /^https:\/\/([a-z0-9-]+-)?www\.fastmailusercontent\.com\//,
+    ];
+    loginUrl = AUTHORIZATION_ENDPOINT;
+    info = 'https://www.fastmail.com/dev/ and https://jmap.io/spec.html. ' +
+        'Start at https://api.fastmail.com/jmap/session: that session document names the apiUrl, ' +
+        'downloadUrl and account ids for everything else, and its `accounts` entries carry ' +
+        '`isReadOnly` and the `accountCapabilities` this credential can reach.';
+    credentialCheckCurlArguments = [SESSION_ENDPOINT];
+    setCredentialsExample(serviceName) {
+        return `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`;
+    }
+    /**
+     * Fastmail accepts an OAuth client id prepared in advance via
+     * `latchkey auth prepare`, stored as token-less OAuth credentials until
+     * login. The login flow reuses this client id instead of registering a new
+     * client dynamically.
+     */
+    prepareFromJson(parsedJson) {
+        return buildPreparedCredentials(this.name, FastmailPrepareInputSchema, parsedJson, ({ clientId }) => new OAuthCredentials(clientId, ''));
+    }
+    getAccount(apiCredentials) {
+        return fetchAccountFromEndpoint(apiCredentials, this.credentialCheckCurlArguments, parseAccountFromSession);
+    }
+    getSession(appNamePrefix) {
+        return new FastmailSession(this, appNamePrefix);
+    }
+    async refreshCredentials(apiCredentials) {
+        if (!(apiCredentials instanceof OAuthCredentials)) {
+            return null;
+        }
+        if (!apiCredentials.refreshToken) {
+            return null;
+        }
+        const tokens = await refreshAccessToken(TOKEN_ENDPOINT, apiCredentials.refreshToken, apiCredentials.clientId, apiCredentials.clientSecret, { resource: JMAP_RESOURCE });
+        if (tokens === null) {
+            return null;
+        }
+        const accessTokenExpiresAt = expiryFromExpiresIn(tokens.expires_in);
+        return new OAuthCredentials(apiCredentials.clientId, apiCredentials.clientSecret, tokens.access_token, tokens.refresh_token ?? apiCredentials.refreshToken, accessTokenExpiresAt, apiCredentials.refreshTokenExpiresAt);
+    }
+}
+export const FASTMAIL = new Fastmail();
+//# sourceMappingURL=fastmail.js.map

package/dist/src/services/fastmail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastmail.js","sourceRoot":"","sources":["../../../src/services/fastmail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,YAAY,GACb,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,cAAc,EAEd,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,2CAA2C;AAC3C,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACjE,MAAM,qBAAqB,GAAG,yCAAyC,CAAC;AACxE,MAAM,sBAAsB,GAAG,0CAA0C,CAAC;AAC1E,qEAAqE;AACrE,+EAA+E;AAC/E,+DAA+D;AAC/D,MAAM,cAAc,GAAG,wCAAwC,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,YAAY,GAChB,mCAAmC;IACnC,uCAAuC;IACvC,wCAAwC;IACxC,gBAAgB,CAAC;AAEnB,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAOhC;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,WAAmB,EACnB,UAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,0BAA0B,EAAE,MAAM;QAClC,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,6CAA6C;QAC7C,KAAK,EAAE,YAAY;KACpB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,CAAC,EAC/F,EAAE,CACH,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAyB,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CACxB,mDAAmD,MAAM,CAAC,MAAM,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,iDAAiD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,SAAkB;IAC7C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAiC,CAAC;IAC3E,OAAO,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,eAAgB,SAAQ,cAAc;IAC1C,UAAU,CAAC,SAAmB;QAC5B,6EAA6E;IAC/E,CAAC;IAES,eAAe;QACvB,2CAA2C;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAES,mBAAmB,CAC3B,QAAiB,EACjB,QAAwB,EACxB,eAAgC;QAEhC,2CAA2C;QAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAEQ,KAAK,CAAC,KAAK,CAClB,gBAAmE,EACnE,gBAAsE,EAAE,EACxE,cAA+B;QAE/B,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEzE,OAAO,sBAAsB,CAAC,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACnF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAErC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,GAAG,EAAE;gBACxB,eAAe,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC;YACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC/B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAElC,IAAI,CAAC;gBACH,iCAAiC;gBACjC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,CAC1D,gBAAgB,EAChB,eAAe,CAAC,MAAM,CACvB,CAAC;gBACF,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBAEzE,kDAAkD;gBAClD,EAAE;gBACF,wEAAwE;gBACxE,yEAAyE;gBACzE,sEAAsE;gBACtE,oEAAoE;gBACpE,qDAAqD;gBACrD,IAAI,QAAgB,CAAC;gBACrB,IAAI,cAAc,YAAY,gBAAgB,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;oBAC1E,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;oBAC/E,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC;gBACpC,CAAC;gBAED,sCAAsC;gBACtC,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;gBAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAE1D,uCAAuC;gBACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;gBACpD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;gBAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;gBAE1D,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAEpC,6DAA6D;gBAC7D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;gBAE/B,8BAA8B;gBAC9B,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,cAAc,EACd,IAAI,EACJ,QAAQ,EACR,EAAE,EAAE,2BAA2B;gBAC/B,WAAW,EACX,YAAY,EACZ,EAAE,QAAQ,EAAE,aAAa,EAAE,CAC5B,CAAC;gBAEF,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAEpE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBAEnB,MAAM,WAAW,GAAG,IAAI,gBAAgB,CACtC,QAAQ,EACR,EAAE,EAAE,gBAAgB;gBACpB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,aAAa,EACpB,oBAAoB,CACrB,CAAC;gBAEF,OAAO;oBACL,WAAW;oBACX,6DAA6D;oBAC7D,oEAAoE;oBACpE,oEAAoE;oBACpE,uDAAuD;oBACvD,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,eAAe;iBACzE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,KAAK,YAAY,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,mBAAmB,EAAE,CAAC;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,QAAS,SAAQ,OAAO;IAC1B,IAAI,GAAG,UAAU,CAAC;IAClB,WAAW,GAAG,UAAU,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACM,WAAW,GAAG;QACrB,gDAAgD;QAChD,0DAA0D;KAClD,CAAC;IAEF,QAAQ,GAAG,sBAAsB,CAAC;IAElC,IAAI,GACX,+DAA+D;QAC/D,0FAA0F;QAC1F,oFAAoF;QACpF,uEAAuE,CAAC;IAEjE,4BAA4B,GAAG,CAAC,gBAAgB,CAAU,CAAC;IAEpE,qBAAqB,CAAC,WAAmB;QACvC,OAAO,qBAAqB,WAAW,qCAAqC,CAAC;IAC/E,CAAC;IAED;;;;;OAKG;IACM,eAAe,CAAC,UAAmB;QAC1C,OAAO,wBAAwB,CAC7B,IAAI,CAAC,IAAI,EACT,0BAA0B,EAC1B,UAAU,EACV,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC,CACrD,CAAC;IACJ,CAAC;IAEQ,UAAU,CAAC,cAA8B;QAChD,OAAO,wBAAwB,CAC7B,cAAc,EACd,IAAI,CAAC,4BAA4B,EACjC,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAEQ,UAAU,CAAC,aAAqB;QACvC,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAClD,CAAC;IAEQ,KAAK,CAAC,kBAAkB,CAC/B,cAA8B;QAE9B,IAAI,CAAC,CAAC,cAAc,YAAY,gBAAgB,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,cAAc,EACd,cAAc,CAAC,YAAY,EAC3B,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,YAAY,EAC3B,EAAE,QAAQ,EAAE,aAAa,EAAE,CAC5B,CAAC;QAEF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEpE,OAAO,IAAI,gBAAgB,CACzB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,YAAY,EAC3B,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,aAAa,IAAI,cAAc,CAAC,YAAY,EACnD,oBAAoB,EACpB,cAAc,CAAC,qBAAqB,CACrC,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC"}

package/dist/src/services/google/gmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gmail.d.ts","sourceRoot":"","sources":["../../../../src/services/google/gmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAOpE,qBAAa,WAAY,SAAQ,aAAa;IAC5C,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,WAAW,kBAAkB;IACtC,QAAQ,CAAC,WAAW,6CAA8C;IAClE,QAAQ,CAAC,IAAI,SAK8D;IAE3E,SAAS,CAAC,QAAQ,CAAC,MAAM,sBAAU;CACpC;AAED,eAAO,MAAM,YAAY,aAAoB,CAAC"}
+{"version":3,"file":"gmail.d.ts","sourceRoot":"","sources":["../../../../src/services/google/gmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAYpE,qBAAa,WAAY,SAAQ,aAAa;IAC5C,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,WAAW,kBAAkB;IACtC,QAAQ,CAAC,WAAW,6CAA8C;IAClE,QAAQ,CAAC,IAAI,SAK8D;IAE3E,SAAS,CAAC,QAAQ,CAAC,MAAM,sBAAU;CACpC;AAED,eAAO,MAAM,YAAY,aAAoB,CAAC"}

package/dist/src/services/google/gmail.js

@@ -1,7 +1,12 @@
 import { GoogleService } from './base.js';
 const CONFIG = {
     apis: ['gmail.googleapis.com'],
-    scopes: ['https://www.googleapis.com/auth/gmail.modify'],
+    scopes: [
+        // gmail.modify covers reading/labeling messages and reading filters/labels,
+        // but creating or deleting filters requires gmail.settings.basic.
+        'https://www.googleapis.com/auth/gmail.modify',
+        'https://www.googleapis.com/auth/gmail.settings.basic',
+    ],
 };
 export class GoogleGmail extends GoogleService {
     name = 'google-gmail';

package/dist/src/services/google/gmail.js.map

@@ -1 +1 @@
-{"version":3,"file":"gmail.js","sourceRoot":"","sources":["../../../../src/services/google/gmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,WAAW,CAAC;AAEpE,MAAM,MAAM,GAAwB;IAClC,IAAI,EAAE,CAAC,sBAAsB,CAAC;IAC9B,MAAM,EAAE,CAAC,8CAA8C,CAAC;CACzD,CAAC;AAEF,MAAM,OAAO,WAAY,SAAQ,aAAa;IACnC,IAAI,GAAG,cAAc,CAAC;IACtB,WAAW,GAAG,cAAc,CAAC;IAC7B,WAAW,GAAG,CAAC,+BAA+B,CAAU,CAAC;IACzD,IAAI,GACX,0DAA0D;QAC1D,+FAA+F;QAC/F,qEAAqE;QACrE,+HAA+H;QAC/H,wEAAwE,CAAC;IAExD,MAAM,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC"}
+{"version":3,"file":"gmail.js","sourceRoot":"","sources":["../../../../src/services/google/gmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,WAAW,CAAC;AAEpE,MAAM,MAAM,GAAwB;IAClC,IAAI,EAAE,CAAC,sBAAsB,CAAC;IAC9B,MAAM,EAAE;QACN,4EAA4E;QAC5E,kEAAkE;QAClE,8CAA8C;QAC9C,sDAAsD;KACvD;CACF,CAAC;AAEF,MAAM,OAAO,WAAY,SAAQ,aAAa;IACnC,IAAI,GAAG,cAAc,CAAC;IACtB,WAAW,GAAG,cAAc,CAAC;IAC7B,WAAW,GAAG,CAAC,+BAA+B,CAAU,CAAC;IACzD,IAAI,GACX,0DAA0D;QAC1D,+FAA+F;QAC/F,qEAAqE;QACrE,+HAA+H;QAC/H,wEAAwE,CAAC;IAExD,MAAM,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/src/services/index.d.ts

@@ -23,6 +23,8 @@ export { GooglePeople, GOOGLE_PEOPLE } from './google/people.js';
 export { Notion, NOTION } from './notion.js';
 export { NotionMcp, NOTION_MCP } from './notion-mcp.js';
 export { Mailchimp, MAILCHIMP } from './mailchimp.js';
+export { Fastmail, FASTMAIL } from './fastmail.js';
+export { FastmailDav, FASTMAIL_DAV } from './fastmail-dav.js';
 export { Gitlab, GITLAB } from './gitlab.js';
 export { Zoom, ZOOM } from './zoom.js';
 export { Telegram, TELEGRAM } from './telegram.js';
@@ -41,4 +43,5 @@ export { Todoist, TODOIST } from './todoist.js';
 export { Ngrok, NGROK } from './ngrok.js';
 export { Huggingface, HUGGINGFACE } from './huggingface.js';
 export { Openrouter, OPENROUTER } from './openrouter.js';
+export { Tailscale, TAILSCALE } from './tailscale.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,YAAY,EACZ,2BAA2B,EAC3B,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,YAAY,EACZ,2BAA2B,EAC3B,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/src/services/index.js

@@ -23,6 +23,8 @@ export { GooglePeople, GOOGLE_PEOPLE } from './google/people.js';
 export { Notion, NOTION } from './notion.js';
 export { NotionMcp, NOTION_MCP } from './notion-mcp.js';
 export { Mailchimp, MAILCHIMP } from './mailchimp.js';
+export { Fastmail, FASTMAIL } from './fastmail.js';
+export { FastmailDav, FASTMAIL_DAV } from './fastmail-dav.js';
 export { Gitlab, GITLAB } from './gitlab.js';
 export { Zoom, ZOOM } from './zoom.js';
 export { Telegram, TELEGRAM } from './telegram.js';
@@ -41,4 +43,5 @@ export { Todoist, TODOIST } from './todoist.js';
 export { Ngrok, NGROK } from './ngrok.js';
 export { Huggingface, HUGGINGFACE } from './huggingface.js';
 export { Openrouter, OPENROUTER } from './openrouter.js';
+export { Tailscale, TAILSCALE } from './tailscale.js';
 //# sourceMappingURL=index.js.map

package/dist/src/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,GAGrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,GAGrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/src/services/tailscale.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Tailscale service implementation.
+ *
+ * The Tailscale admin API (https://api.tailscale.com/api/v2/) authenticates with
+ * an API access token (`tskey-api-...`) that an Owner/Admin creates in the
+ * admin console's Keys page. The token's value is revealed exactly once at
+ * creation time (like Linear, HuggingFace and OpenRouter), so we sign the user
+ * into the admin console, generate a fresh access token on their behalf, and
+ * read its value from the one-time reveal dialog.
+ *
+ * A single API access token grants the full set of actions its owning user may
+ * perform: tailnet-wide user management (role changes, approval, suspension,
+ * deletion), device management, ACL/policy, DNS, and the minting of further
+ * keys (including the auth keys the `tailscale` CLI consumes to bring up
+ * nodes). It expires after at most 90 days, after which the user re-runs the
+ * browser login to mint a new one -- the token is static and is not refreshable.
+ */
+import type { Response, BrowserContext } from 'playwright';
+import { z } from 'zod';
+import { ApiCredentialStatus, ApiCredentials } from '../apiCredentials/base.js';
+import { Service, BrowserFollowupServiceSession, FollowupWork } from './core/base.js';
+/**
+ * Credentials for the Tailscale API: a static API access token plus the tailnet
+ * it belongs to. The tailnet is part of nearly every useful Tailscale API path
+ * and the API exposes no tailnet-independent way to validate a token, so the
+ * connector captures it at mint time (it is shown in the admin console's
+ * navigation) and stores it alongside the token.
+ */
+export declare const TailscaleCredentialsSchema: z.ZodObject<{
+    objectType: z.ZodLiteral<"tailscale">;
+    token: z.ZodString;
+    tailnet: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    objectType: "tailscale";
+    token: string;
+    tailnet: string;
+}, {
+    objectType: "tailscale";
+    token: string;
+    tailnet: string;
+}>;
+export type TailscaleCredentialsData = z.infer<typeof TailscaleCredentialsSchema>;
+export declare class TailscaleCredentials implements ApiCredentials {
+    readonly objectType: "tailscale";
+    readonly token: string;
+    readonly tailnet: string;
+    constructor(token: string, tailnet: string);
+    injectIntoCurlCall(curlArguments: readonly string[]): Promise<readonly string[]>;
+    isExpired(): boolean | undefined;
+    toJSON(): TailscaleCredentialsData;
+    static fromJSON(data: TailscaleCredentialsData): TailscaleCredentials;
+}
+declare class TailscaleServiceSession extends BrowserFollowupServiceSession {
+    protected readonly followupWork = FollowupWork.CreateApiToken;
+    private isLoggedIn;
+    onResponse(response: Response): void;
+    protected isLoginComplete(): boolean;
+    protected performBrowserFollowup(context: BrowserContext, _oldCredentials?: ApiCredentials): Promise<ApiCredentials | null>;
+}
+export declare class Tailscale extends Service {
+    readonly name = "tailscale";
+    readonly displayName = "Tailscale";
+    readonly baseApiUrls: readonly ["https://api.tailscale.com/"];
+    readonly loginUrl = "https://login.tailscale.com/admin";
+    readonly info: string;
+    readonly credentialCheckCurlArguments: readonly [];
+    checkApiCredentials(apiCredentials: ApiCredentials): Promise<ApiCredentialStatus>;
+    setCredentialsExample(serviceName: string): string;
+    getAccount(apiCredentials: ApiCredentials): Promise<string | null>;
+    getSession(appNamePrefix: string): TailscaleServiceSession;
+}
+export declare const TAILSCALE: Tailscale;
+export {};
+//# sourceMappingURL=tailscale.d.ts.map

package/dist/src/services/tailscale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale.d.ts","sourceRoot":"","sources":["../../../src/services/tailscale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGhF,OAAO,EACL,OAAO,EACP,6BAA6B,EAC7B,YAAY,EAIb,MAAM,gBAAgB,CAAC;AA4BxB;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;EAIrC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAElF,qBAAa,oBAAqB,YAAW,cAAc;IACzD,QAAQ,CAAC,UAAU,EAAG,WAAW,CAAU;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAK1C,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAOhF,SAAS,IAAI,OAAO,GAAG,SAAS;IAIhC,MAAM,IAAI,wBAAwB;IAQlC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,GAAG,oBAAoB;CAGtE;AAED,cAAM,uBAAwB,SAAQ,6BAA6B;IACjE,SAAS,CAAC,QAAQ,CAAC,YAAY,+BAA+B;IAC9D,OAAO,CAAC,UAAU,CAAS;IAE3B,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAqBpC,SAAS,CAAC,eAAe,IAAI,OAAO;cAIpB,sBAAsB,CACpC,OAAO,EAAE,cAAc,EACvB,eAAe,CAAC,EAAE,cAAc,GAC/B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;CA+DlC;AAED,qBAAa,SAAU,SAAQ,OAAO;IACpC,QAAQ,CAAC,IAAI,eAAe;IAC5B,QAAQ,CAAC,WAAW,eAAe;IACnC,QAAQ,CAAC,WAAW,0CAAqC;IACzD,QAAQ,CAAC,QAAQ,uCAAuB;IACxC,QAAQ,CAAC,IAAI,SAO4B;IAKzC,QAAQ,CAAC,4BAA4B,cAAe;IAErC,mBAAmB,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA4BhG,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAOzC,UAAU,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAOlE,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,uBAAuB;CAGpE;AAED,eAAO,MAAM,SAAS,WAAkB,CAAC"}