Update

vendor/tailscale.com/internal/client/tailscale/awsparamstore.go

@@ -0,0 +1,21 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tailscale
+
+import (
+	"context"
+
+	"tailscale.com/feature"
+)
+
+// ResolvePrefixAWSParameterStore is the string prefix for values that can be
+// resolved from AWS Parameter Store.
+const ResolvePrefixAWSParameterStore = "arn:aws:ssm:"
+
+// HookResolveValueFromParameterStore resolves to [awsparamstore.ResolveValue] when
+// the corresponding feature tag is enabled in the build process.
+//
+// It fetches a value from AWS Parameter Store given an ARN. If the provided
+// value is not an Parameter Store ARN, it returns the value unchanged.
+var HookResolveValueFromParameterStore feature.Hook[func(ctx context.Context, valueOrARN string) (string, error)]

vendor/tailscale.com/internal/client/tailscale/identityfederation.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 package tailscale
@@ -9,21 +9,32 @@ import (
 	"tailscale.com/feature"
 )
 
+type ResolveAuthKeyWIFArgs struct {
+	// BaseURL is the URL of the control server used for token exchange and authkey generation.
+	BaseURL string
+	// ClientID is the federated client ID used for token exchange.
+	ClientID string
+	// IDToken is the Identity token from the identity provider.
+	IDToken string
+	// Audience is the federated audience acquired by configuring the trust credential in the admin UI.
+	Audience string
+	// Tags is the list of tags to be associated with the auth key.
+	Tags []string
+}
+
+type ExchangeJWTForTokenWIFArgs struct {
+	// BaseURL is the URL of the control server used for token exchange.
+	BaseURL string
+	// ClientID is the federated client ID used for token exchange.
+	ClientID string
+	// IDToken is a JWT identity token to use in the token exchange operation.
+	IDToken string
+}
+
 // HookResolveAuthKeyViaWIF resolves to [identityfederation.resolveAuthKey] when the
 // corresponding feature tag is enabled in the build process.
-//
-// baseURL is the URL of the control server used for token exchange and authkey generation.
-// clientID is the federated client ID used for token exchange
-// idToken is the Identity token from the identity provider
-// tags is the list of tags to be associated with the auth key
-// audience is the federated audience acquired by configuring
-// the trusted credential in the admin UI
-var HookResolveAuthKeyViaWIF feature.Hook[func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error)]
+var HookResolveAuthKeyViaWIF feature.Hook[func(ctx context.Context, args ResolveAuthKeyWIFArgs) (string, error)]
 
 // HookExchangeJWTForTokenViaWIF resolves to [identityfederation.exchangeJWTForToken] when the
 // corresponding feature tag is enabled in the build process.
-//
-// baseURL is the URL of the control server used for token exchange
-// clientID is the federated client ID used for token exchange
-// idToken is the Identity token from the identity provider
-var HookExchangeJWTForTokenViaWIF feature.Hook[func(ctx context.Context, baseURL, clientID, idToken string) (string, error)]
+var HookExchangeJWTForTokenViaWIF feature.Hook[func(ctx context.Context, arg ExchangeJWTForTokenWIFArgs) (string, error)]

vendor/tailscale.com/internal/client/tailscale/oauthkeys.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 package tailscale
@@ -9,12 +9,15 @@ import (
 	"tailscale.com/feature"
 )
 
+type ResolveAuthKeyArgs struct {
+	// Authkey is a standard device auth key or an OAuth client secret to resolve into an auth key.
+	AuthKey string
+	// Tags is the list of tags being advertised by the client (required to be provided for the
+	// OAuth secret case, and required to be the same as the list of tags for which the OAuth
+	// secret is allowed to issue auth keys).
+	Tags []string
+}
+
 // HookResolveAuthKey resolves to [oauthkey.ResolveAuthKey] when the
 // corresponding feature tag is enabled in the build process.
-//
-// authKey is a standard device auth key or an OAuth client secret to
-// resolve into an auth key.
-// tags is the list of tags being advertised by the client (required to be
-// provided for the OAuth secret case, and required to be the same as the
-// list of tags for which the OAuth secret is allowed to issue auth keys).
-var HookResolveAuthKey feature.Hook[func(ctx context.Context, authKey string, tags []string) (string, error)]
+var HookResolveAuthKey feature.Hook[func(ctx context.Context, args ResolveAuthKeyArgs) (string, error)]

vendor/tailscale.com/internal/client/tailscale/tailscale.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 // Package tailscale provides a minimal control plane API client for internal

vendor/tailscale.com/internal/client/tailscale/vip_service.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 package tailscale