@appforge-ci/core 0.2.3 → 0.3.0

package/dist/vpn-egress.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Strict egress policy for the site-to-site VPN helper (`VpnJobConfig.egress`,
+ * see packages/vpn-proxy/PROTOCOL.md, "Strict egress"). Pure: validation, the
+ * canonical form and its SHA-256, so the control plane, the agent and the
+ * helper agree on exactly which policy a build ran under.
+ *
+ * This file is the TypeScript twin of `packages/vpn-proxy/internal/policy`.
+ * Both must accept and reject the same inputs and produce the same canonical
+ * bytes; `packages/vpn-proxy/testdata/egress-policy-vectors.json` is the shared
+ * proof and both test suites run it.
+ *
+ * Hosts are ASCII/punycode only (the control plane converts Unicode names
+ * before storing them): that keeps the two implementations free of IDNA and
+ * Unicode case-mapping differences.
+ */
+import type { VpnEgressPolicy } from "./types.js";
+/** Mirrors `policy.MaxRules` / `policy.MaxPortsPerRule` / `policy.DefaultPort` / `policy.Version`. */
+export declare const VPN_EGRESS_MAX_RULES = 512;
+export declare const VPN_EGRESS_MAX_PORTS_PER_RULE = 16;
+export declare const VPN_EGRESS_DEFAULT_PORT = 443;
+export declare const VPN_EGRESS_POLICY_VERSION = 1;
+/**
+ * Mirrors `config.MaxJobBytes`: the most stdin the helper reads for one job.
+ * It is sized so the largest valid policy (512 rules, 253-byte hosts, 16 ports
+ * each: about 190 KB as compact JSON) plus the rest of the job fits; the agent
+ * still checks the serialised job against it before spawning, because extra
+ * keys inside rules are ignored by validation but would count against the cap.
+ */
+export declare const VPN_JOB_MAX_BYTES: number;
+/**
+ * Normalises one allow-list host: lowercase; either `name.tld` or `*.name.tld`
+ * with at least two labels after any `*.`; no IP literal in any spelling (a
+ * numeric last label is refused, so `10.0.0.1`, `2130706433`, `0x7f.1` all
+ * fail), no trailing dot, no port/scheme/path, no Unicode. Returns `null` when
+ * the host is not acceptable.
+ */
+export declare function normalizeEgressHost(raw: unknown): string | null;
+/**
+ * Every problem with an egress policy (an empty array means valid). Problem
+ * strings name the field, like the helper's own validation
+ * (`egress.allow[3].host`), and never echo a rejected value.
+ */
+export declare function validateVpnEgressPolicy(policy: unknown): string[];
+/**
+ * The exact bytes the helper hashes:
+ *
+ *   {"v":1,"allow":[{"host":"*.googleapis.com","ports":[443]},{"host":"pub.dev","ports":[443]}]}
+ *
+ * Hosts lowercased; one entry per host (duplicates merge, ports unioned);
+ * sorted by host in byte order (so `*.` sorts before letters); ports ascending
+ * and deduplicated with the default 443 made explicit; no whitespace.
+ * Throws on an invalid policy (callers validate first and report the problems).
+ */
+export declare function canonicalVpnEgressPolicy(policy: VpnEgressPolicy): string;
+/** Lowercase hex SHA-256 of `canonicalVpnEgressPolicy`: what the helper echoes as `policyHash`. */
+export declare function vpnEgressPolicyHash(policy: VpnEgressPolicy): Promise<string>;
+//# sourceMappingURL=vpn-egress.d.ts.map

package/dist/vpn-egress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-egress.d.ts","sourceRoot":"","sources":["../src/vpn-egress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,sGAAsG;AACtG,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAChD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAK5C;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAe/D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAiCjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAmBxE;AAED,mGAAmG;AACnG,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlF"}

package/dist/vpn-egress.js

@@ -0,0 +1,126 @@
+/** Mirrors `policy.MaxRules` / `policy.MaxPortsPerRule` / `policy.DefaultPort` / `policy.Version`. */
+export const VPN_EGRESS_MAX_RULES = 512;
+export const VPN_EGRESS_MAX_PORTS_PER_RULE = 16;
+export const VPN_EGRESS_DEFAULT_PORT = 443;
+export const VPN_EGRESS_POLICY_VERSION = 1;
+/**
+ * Mirrors `config.MaxJobBytes`: the most stdin the helper reads for one job.
+ * It is sized so the largest valid policy (512 rules, 253-byte hosts, 16 ports
+ * each: about 190 KB as compact JSON) plus the rest of the job fits; the agent
+ * still checks the serialised job against it before spawning, because extra
+ * keys inside rules are ignored by validation but would count against the cap.
+ */
+export const VPN_JOB_MAX_BYTES = 256 * 1024;
+/** Mirrors Go `route.Normalize`: LDH plus `_`, labels 1..63, total <= 253. */
+const LABEL = /^[a-z0-9_-]{1,63}$/;
+/**
+ * Normalises one allow-list host: lowercase; either `name.tld` or `*.name.tld`
+ * with at least two labels after any `*.`; no IP literal in any spelling (a
+ * numeric last label is refused, so `10.0.0.1`, `2130706433`, `0x7f.1` all
+ * fail), no trailing dot, no port/scheme/path, no Unicode. Returns `null` when
+ * the host is not acceptable.
+ */
+export function normalizeEgressHost(raw) {
+    if (typeof raw !== "string")
+        return null;
+    // ASCII only, BEFORE lowercasing: toLowerCase() folds the Kelvin sign (U+212A)
+    // to "k". Mirrors the Go implementation.
+    if (!/^[\x00-\x7f]*$/.test(raw))
+        return null;
+    const host = raw.toLowerCase();
+    const wild = host.startsWith("*.");
+    const name = wild ? host.slice(2) : host;
+    if (name === "" || name.length > 253 || name.endsWith(".") || name.includes("*"))
+        return null;
+    const labels = name.split(".");
+    if (labels.length < 2)
+        return null;
+    for (const l of labels)
+        if (!LABEL.test(l))
+            return null;
+    const last = labels[labels.length - 1];
+    if (last.startsWith("0x") || /^[0-9]+$/.test(last))
+        return null; // an IP in some spelling
+    return wild ? `*.${name}` : name;
+}
+/**
+ * Every problem with an egress policy (an empty array means valid). Problem
+ * strings name the field, like the helper's own validation
+ * (`egress.allow[3].host`), and never echo a rejected value.
+ */
+export function validateVpnEgressPolicy(policy) {
+    const problems = [];
+    if (policy === null || typeof policy !== "object" || Array.isArray(policy))
+        return ["egress: must be an object"];
+    const allow = policy.allow;
+    if (!Array.isArray(allow))
+        return ["egress.allow: must be an array"];
+    if (allow.length > VPN_EGRESS_MAX_RULES)
+        return [`egress.allow: may contain at most ${VPN_EGRESS_MAX_RULES} entries`];
+    allow.forEach((rule, i) => {
+        const at = `egress.allow[${i}]`;
+        if (rule === null || typeof rule !== "object" || Array.isArray(rule)) {
+            problems.push(`${at}: must be an object`);
+            return;
+        }
+        const { host, ports } = rule;
+        if (normalizeEgressHost(host) === null) {
+            problems.push(`${at}.host: must be a hostname like example.com or *.example.com (no IP literals, no bare *, no trailing dot)`);
+            return;
+        }
+        if (ports === undefined || ports === null)
+            return;
+        if (!Array.isArray(ports)) {
+            problems.push(`${at}.ports: must be an array`);
+            return;
+        }
+        if (ports.length > VPN_EGRESS_MAX_PORTS_PER_RULE) {
+            problems.push(`${at}.ports: may contain at most ${VPN_EGRESS_MAX_PORTS_PER_RULE} ports`);
+            return;
+        }
+        if (!ports.every((p) => typeof p === "number" && Number.isInteger(p) && p >= 1 && p <= 65535)) {
+            problems.push(`${at}.ports: each port must be 1-65535`);
+        }
+    });
+    return problems;
+}
+/**
+ * The exact bytes the helper hashes:
+ *
+ *   {"v":1,"allow":[{"host":"*.googleapis.com","ports":[443]},{"host":"pub.dev","ports":[443]}]}
+ *
+ * Hosts lowercased; one entry per host (duplicates merge, ports unioned);
+ * sorted by host in byte order (so `*.` sorts before letters); ports ascending
+ * and deduplicated with the default 443 made explicit; no whitespace.
+ * Throws on an invalid policy (callers validate first and report the problems).
+ */
+export function canonicalVpnEgressPolicy(policy) {
+    const problems = validateVpnEgressPolicy(policy);
+    if (problems.length > 0)
+        throw new Error(`invalid egress policy: ${problems.join("; ")}`);
+    const merged = new Map();
+    for (const rule of policy.allow) {
+        const host = normalizeEgressHost(rule.host);
+        let set = merged.get(host);
+        if (!set)
+            merged.set(host, (set = new Set()));
+        const ports = rule.ports && rule.ports.length > 0 ? rule.ports : [VPN_EGRESS_DEFAULT_PORT];
+        for (const p of ports)
+            set.add(p);
+    }
+    // Default Array.prototype.sort compares UTF-16 code units, which for ASCII is
+    // the same order as Go's byte-wise slices.Sort.
+    const hosts = [...merged.keys()].sort();
+    const entries = hosts.map((h) => {
+        const ports = [...merged.get(h)].sort((a, b) => a - b);
+        return `{"host":"${h}","ports":[${ports.join(",")}]}`;
+    });
+    return `{"v":${VPN_EGRESS_POLICY_VERSION},"allow":[${entries.join(",")}]}`;
+}
+/** Lowercase hex SHA-256 of `canonicalVpnEgressPolicy`: what the helper echoes as `policyHash`. */
+export async function vpnEgressPolicyHash(policy) {
+    const bytes = new TextEncoder().encode(canonicalVpnEgressPolicy(policy));
+    const digest = await crypto.subtle.digest("SHA-256", bytes);
+    return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+//# sourceMappingURL=vpn-egress.js.map

package/dist/vpn-egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-egress.js","sourceRoot":"","sources":["../src/vpn-egress.ts"],"names":[],"mappings":"AAiBA,sGAAsG;AACtG,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE5C,8EAA8E;AAC9E,MAAM,KAAK,GAAG,oBAAoB,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,+EAA+E;IAC/E,yCAAyC;IACzC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACxC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IAC1F,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjH,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,CAAC,qCAAqC,oBAAoB,UAAU,CAAC,CAAC;IACtH,KAAK,CAAC,OAAO,CAAC,CAAC,IAAa,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAA2C,CAAC;QACpE,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CACX,GAAG,EAAE,0GAA0G,CAChH,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,6BAA6B,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,+BAA+B,6BAA6B,QAAQ,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC9F,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAuB;IAC9D,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC;QAC7C,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,8EAA8E;IAC9E,gDAAgD;IAChD,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,yBAAyB,aAAa,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAuB;IAC/D,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC"}

package/dist/vpn-egress.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vpn-egress.test.d.ts.map

package/dist/vpn-egress.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-egress.test.d.ts","sourceRoot":"","sources":["../src/vpn-egress.test.ts"],"names":[],"mappings":""}

package/dist/vpn-egress.test.js

@@ -0,0 +1,133 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { canonicalVpnEgressPolicy, normalizeEgressHost, validateVpnEgressPolicy, vpnEgressPolicyHash, VPN_EGRESS_MAX_PORTS_PER_RULE, VPN_EGRESS_MAX_RULES, VPN_JOB_MAX_BYTES, } from "./vpn-egress.js";
+import { vpnEgressPolicySchema } from "./schemas.js";
+// The Go implementation (packages/vpn-proxy/internal/policy) runs the same file.
+const vectors = JSON.parse(readFileSync(fileURLToPath(new URL("../../vpn-proxy/testdata/egress-policy-vectors.json", import.meta.url)), "utf8"));
+test("shared vectors: same validity, same canonical bytes, same hash as the Go helper", async () => {
+    assert.ok(vectors.length >= 20);
+    assert.ok(vectors.some((v) => v.valid) && vectors.some((v) => !v.valid));
+    for (const v of vectors) {
+        const policy = { allow: v.allow };
+        const problems = validateVpnEgressPolicy(policy);
+        if (!v.valid) {
+            assert.ok(problems.length > 0, `${v.name}: should be rejected`);
+            assert.throws(() => canonicalVpnEgressPolicy(policy), /invalid egress policy/, v.name);
+            continue;
+        }
+        assert.deepEqual(problems, [], `${v.name}: should be valid`);
+        assert.equal(canonicalVpnEgressPolicy(policy), v.canonical, `${v.name}: canonical`);
+        assert.equal(createHash("sha256").update(v.canonical).digest("hex"), v.sha256, `${v.name}: vector hash`);
+        assert.equal(await vpnEgressPolicyHash(policy), v.sha256, `${v.name}: hash`);
+    }
+});
+test("canonical form is insensitive to order, case, duplicates and explicit default ports", () => {
+    const a = canonicalVpnEgressPolicy({
+        allow: [{ host: "B.example.com", ports: [8443, 443] }, { host: "a.example.com" }, { host: "*.c.example.com", ports: [443] }],
+    });
+    const b = canonicalVpnEgressPolicy({
+        allow: [
+            { host: "*.C.example.com" },
+            { host: "a.example.com", ports: [443] },
+            { host: "b.example.com", ports: [443] },
+            { host: "b.example.com", ports: [8443] },
+            { host: "A.EXAMPLE.COM" },
+        ],
+    });
+    assert.equal(a, b);
+    assert.equal(a, '{"v":1,"allow":[{"host":"*.c.example.com","ports":[443]},{"host":"a.example.com","ports":[443]},{"host":"b.example.com","ports":[443,8443]}]}');
+    assert.equal(canonicalVpnEgressPolicy({ allow: [] }), '{"v":1,"allow":[]}');
+    assert.equal(canonicalVpnEgressPolicy({ allow: [{ host: "x.example.com", ports: [] }] }), '{"v":1,"allow":[{"host":"x.example.com","ports":[443]}]}');
+});
+test("the hash is the SHA-256 of the canonical bytes and changes with the policy", async () => {
+    const p = { allow: [{ host: "pub.dev" }] };
+    const h = await vpnEgressPolicyHash(p);
+    assert.match(h, /^[0-9a-f]{64}$/);
+    assert.equal(h, createHash("sha256").update(canonicalVpnEgressPolicy(p)).digest("hex"));
+    assert.notEqual(h, await vpnEgressPolicyHash({ allow: [{ host: "pub.dev", ports: [443, 80] }] }));
+    assert.notEqual(h, await vpnEgressPolicyHash({ allow: [] }));
+    await assert.rejects(() => vpnEgressPolicyHash({ allow: [{ host: "*" }] }), /invalid egress policy/);
+});
+test("normalizeEgressHost accepts hostnames and wildcards, refuses everything IP-shaped or overbroad", () => {
+    for (const [raw, want] of [
+        ["pub.dev", "pub.dev"],
+        ["Repo.Maven.Apache.ORG", "repo.maven.apache.org"],
+        ["*.GoogleAPIs.com", "*.googleapis.com"],
+        ["xn--bcher-kva.example", "xn--bcher-kva.example"],
+        ["_dmarc.example.com", "_dmarc.example.com"],
+    ]) {
+        assert.equal(normalizeEgressHost(raw), want, raw);
+    }
+    for (const bad of [
+        "", "*", "*.", "*.com", "intranet", "a.*.example.com", "*.*.example.com", "a*.example.com", "example.*",
+        "10.0.0.1", "*.10.0.0.1", "2130706433", "0x7f.0.0.1", "127.1", "::1", "[::1]", "example.com.", ".example.com",
+        "a..example.com", "https://example.com", "example.com/x", "example.com:443", "a@example.com", "a b.example.com",
+        "bücher.example", "ＥXAMPLE.com", "Kubernetes.io", "example.123", `${"a".repeat(64)}.example.com`,
+        `${"a.".repeat(130)}com`,
+    ]) {
+        assert.equal(normalizeEgressHost(bad), null, JSON.stringify(bad));
+    }
+    for (const nonString of [undefined, null, 5, {}, []])
+        assert.equal(normalizeEgressHost(nonString), null);
+});
+test("validateVpnEgressPolicy reports every problem, names the field, never echoes the value", () => {
+    const secret = "SUPERSECRET";
+    const problems = validateVpnEgressPolicy({
+        allow: [
+            { host: "ok.example.com" },
+            { host: `${secret}/x` },
+            { host: "10.0.0.1" },
+            { host: "ok.example.com", ports: [0] },
+            { host: "ok.example.com", ports: [65536] },
+            { host: "ok.example.com", ports: [1.5] },
+            { host: "ok.example.com", ports: ["443"] },
+            { host: "ok.example.com", ports: "443" },
+            { host: "ok.example.com", ports: Array.from({ length: VPN_EGRESS_MAX_PORTS_PER_RULE + 1 }, (_, i) => i + 1) },
+            null,
+            "pub.dev",
+        ],
+    });
+    assert.equal(problems.length, 10);
+    assert.ok(problems[0].startsWith("egress.allow[1].host"));
+    assert.ok(problems.every((p) => p.startsWith("egress.allow[")));
+    assert.ok(!problems.some((p) => p.includes(secret)));
+    assert.deepEqual(validateVpnEgressPolicy({ allow: [] }), []);
+    assert.deepEqual(validateVpnEgressPolicy({ allow: [{ host: "pub.dev", ports: null }] }), []);
+    for (const bad of [null, undefined, 5, "x", [], {}, { allow: "pub.dev" }, { allow: null }]) {
+        assert.equal(validateVpnEgressPolicy(bad).length, 1, JSON.stringify(bad));
+    }
+    const tooMany = { allow: Array.from({ length: VPN_EGRESS_MAX_RULES + 1 }, (_, i) => ({ host: `h${i}.example.com` })) };
+    assert.equal(validateVpnEgressPolicy(tooMany).length, 1);
+    assert.deepEqual(validateVpnEgressPolicy({ allow: tooMany.allow.slice(0, VPN_EGRESS_MAX_RULES) }), []);
+});
+test("vpnEgressPolicySchema bounds shape and size", () => {
+    assert.ok(vpnEgressPolicySchema.safeParse({ allow: [] }).success);
+    assert.ok(vpnEgressPolicySchema.safeParse({ allow: [{ host: "pub.dev" }, { host: "*.example.com", ports: [443, 8443] }] }).success);
+    for (const bad of [
+        {}, { allow: "x" }, { allow: [{}] }, { allow: [{ host: "" }] }, { allow: [{ host: "a.example.com", ports: [0] }] },
+        { allow: [{ host: "a.example.com", ports: [1.5] }] }, { allow: [{ host: "a.example.com", ports: [70000] }] },
+        { allow: Array.from({ length: 513 }, () => ({ host: "a.example.com" })) },
+    ]) {
+        assert.ok(!vpnEgressPolicySchema.safeParse(bad).success, JSON.stringify(bad).slice(0, 60));
+    }
+});
+test("wrapper shape: missing or null allow, and wrong-case keys, are invalid (the Go decoder agrees)", () => {
+    for (const bad of [{}, { allow: null }, { Allow: [] }, { allow: [{ Host: "pub.dev" }] }, { allow: [null] }]) {
+        assert.ok(validateVpnEgressPolicy(bad).length > 0, JSON.stringify(bad));
+    }
+});
+test("the largest valid policy fits in the helper's stdin cap with room for the rest of the job", () => {
+    const label = (c, n) => c.repeat(n);
+    const allow = Array.from({ length: VPN_EGRESS_MAX_RULES }, (_, i) => ({
+        host: `${String(i).padStart(3, "0")}${"a".repeat(60)}.${label("b", 63)}.${label("c", 63)}.${label("d", 61)}`,
+        ports: Array.from({ length: VPN_EGRESS_MAX_PORTS_PER_RULE }, (_, k) => 60000 + k),
+    }));
+    assert.equal(allow[0].host.length, 253);
+    assert.deepEqual(validateVpnEgressPolicy({ allow }), []);
+    const bytes = Buffer.byteLength(JSON.stringify({ egress: { allow } }));
+    assert.ok(bytes + 8 * 1024 < VPN_JOB_MAX_BYTES, `${bytes} bytes leaves too little room under ${VPN_JOB_MAX_BYTES}`);
+});
+//# sourceMappingURL=vpn-egress.test.js.map

package/dist/vpn-egress.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-egress.test.js","sourceRoot":"","sources":["../src/vpn-egress.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAWrD,iFAAiF;AACjF,MAAM,OAAO,GAAa,IAAI,CAAC,KAAK,CAClC,YAAY,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,qDAAqD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CACrH,CAAC;AAEF,IAAI,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAoB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC;QACpF,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC;QAC1G,MAAM,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,CAAC,GAAG,wBAAwB,CAAC;QACjC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;KAC7H,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,wBAAwB,CAAC;QACjC,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,iBAAiB,EAAE;YAC3B,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE;YACvC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE;YACvC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE;YACxC,EAAE,IAAI,EAAE,eAAe,EAAE;SAC1B;KACF,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnB,MAAM,CAAC,KAAK,CACV,CAAC,EACD,+IAA+I,CAChJ,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,0DAA0D,CAAC,CAAC;AACxJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;IAC5F,MAAM,CAAC,GAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxF,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,mBAAmB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAC;AACvG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,GAAG,EAAE;IAC1G,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI;QACxB,CAAC,SAAS,EAAE,SAAS,CAAC;QACtB,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;QAClD,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACxC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;QAClD,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;KACpC,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,WAAW;QACvG,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc;QAC7G,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB;QAC/G,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc;QAChG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;KACzB,EAAE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wFAAwF,EAAE,GAAG,EAAE;IAClG,MAAM,MAAM,GAAG,aAAa,CAAC;IAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACvC,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE;YAC1B,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,EAAE;YACvB,EAAE,IAAI,EAAE,UAAU,EAAE;YACpB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;YACtC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;YAC1C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE;YACxC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;YAC1C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE;YACxC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE;YAC7G,IAAI;YACJ,SAAS;SACV;KACF,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3F,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACzG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACpI,KAAK,MAAM,GAAG,IAAI;QAChB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAClH,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;QAC5G,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE;KAC1E,EAAE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,GAAG,EAAE;IAC1G,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5G,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,GAAG,EAAE;IACrG,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAC5G,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;KAClF,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,iBAAiB,EAAE,GAAG,KAAK,uCAAuC,iBAAiB,EAAE,CAAC,CAAC;AACtH,CAAC,CAAC,CAAC"}

package/dist/vpn-ssh.d.ts

@@ -0,0 +1,45 @@
+/**
+ * SSH material for a VPN build (`VpnJobConfig.sshKnownHosts` / `sshDeployKey`,
+ * the "git over SSH through the tunnel" part of the regulated-VPN program).
+ *
+ * Pure validation shared by whoever stores the values (the control plane) and
+ * whoever applies them (the agent, `packages/agent/src/lib/vpn-ssh.ts`), so the
+ * two can never disagree about what is acceptable:
+ *
+ *  - `sanitizeKnownHosts`: customer-supplied public host keys (or host CAs).
+ *    Free text in the dashboard, so anything that is not exactly one recognised
+ *    host-key line is refused rather than repaired, and a rejected line is never
+ *    echoed back (a pasted private key must not travel into a log or an error).
+ *    There is no trust-on-first-use anywhere: these lines are the ONLY host
+ *    keys a VPN build's ssh will accept.
+ *  - `isPlausibleSshPrivateKey`: a cheap shape check for the deploy key. It
+ *    does not prove the key is usable (ssh-add does that); it keeps obviously
+ *    wrong input (a public key, a huge blob, binary) out of the lease.
+ */
+/** At most this many known_hosts lines are accepted per tunnel. */
+export declare const MAX_KNOWN_HOSTS_LINES = 64;
+/** Longest accepted known_hosts line (a 4096-bit RSA key with a comment is ~800). */
+export declare const MAX_KNOWN_HOSTS_LINE_LENGTH = 2048;
+/** Longest accepted deploy key (an RSA-4096 OpenSSH key is ~3.4 KB). */
+export declare const MAX_SSH_DEPLOY_KEY_LENGTH: number;
+export interface SanitizedKnownHosts {
+    /** Normalised, de-duplicated lines, safe to write to a known_hosts file. */
+    lines: string[];
+    /** 1-based indexes of input lines that were refused. Contents are never echoed. */
+    rejected: number[];
+}
+/**
+ * Validates customer-supplied known_hosts lines. Comments (`# ...`) and blank
+ * lines are dropped silently (`ssh-keyscan` output has them); duplicates are
+ * dropped; every other line must be exactly one recognised host-key (or
+ * `@cert-authority`) line whose key blob really is of the stated type, or it is
+ * listed in `rejected`. Input past `MAX_KNOWN_HOSTS_LINES` accepted lines is
+ * rejected, not silently truncated.
+ */
+export declare function sanitizeKnownHosts(input: readonly unknown[]): SanitizedKnownHosts;
+/**
+ * A cheap shape check for an OpenSSH/PEM private key: one BEGIN/END pair of a
+ * `... PRIVATE KEY` block, bounded size, no NUL. Not a proof of validity.
+ */
+export declare function isPlausibleSshPrivateKey(value: unknown): value is string;
+//# sourceMappingURL=vpn-ssh.d.ts.map

package/dist/vpn-ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-ssh.d.ts","sourceRoot":"","sources":["../src/vpn-ssh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,qFAAqF;AACrF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAY,CAAC;AAoBnD,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA0BD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,mBAAmB,CAqBjF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAIxE"}

package/dist/vpn-ssh.js

@@ -0,0 +1,108 @@
+/**
+ * SSH material for a VPN build (`VpnJobConfig.sshKnownHosts` / `sshDeployKey`,
+ * the "git over SSH through the tunnel" part of the regulated-VPN program).
+ *
+ * Pure validation shared by whoever stores the values (the control plane) and
+ * whoever applies them (the agent, `packages/agent/src/lib/vpn-ssh.ts`), so the
+ * two can never disagree about what is acceptable:
+ *
+ *  - `sanitizeKnownHosts`: customer-supplied public host keys (or host CAs).
+ *    Free text in the dashboard, so anything that is not exactly one recognised
+ *    host-key line is refused rather than repaired, and a rejected line is never
+ *    echoed back (a pasted private key must not travel into a log or an error).
+ *    There is no trust-on-first-use anywhere: these lines are the ONLY host
+ *    keys a VPN build's ssh will accept.
+ *  - `isPlausibleSshPrivateKey`: a cheap shape check for the deploy key. It
+ *    does not prove the key is usable (ssh-add does that); it keeps obviously
+ *    wrong input (a public key, a huge blob, binary) out of the lease.
+ */
+/** At most this many known_hosts lines are accepted per tunnel. */
+export const MAX_KNOWN_HOSTS_LINES = 64;
+/** Longest accepted known_hosts line (a 4096-bit RSA key with a comment is ~800). */
+export const MAX_KNOWN_HOSTS_LINE_LENGTH = 2048;
+/** Longest accepted deploy key (an RSA-4096 OpenSSH key is ~3.4 KB). */
+export const MAX_SSH_DEPLOY_KEY_LENGTH = 16 * 1024;
+const KEY_TYPES = [
+    "ssh-ed25519",
+    "ecdsa-sha2-nistp256",
+    "ecdsa-sha2-nistp384",
+    "ecdsa-sha2-nistp521",
+    "ssh-rsa",
+    "sk-ssh-ed25519@openssh.com",
+    "sk-ecdsa-sha2-nistp256@openssh.com",
+];
+// [@cert-authority ]<host patterns> <keytype> <base64> [comment]. No other
+// markers (@revoked is not accepted: the customer revokes by removing the key),
+// no leading ssh option fields (`command=...`), single spaces only.
+const HOSTS = String.raw `[A-Za-z0-9.*?!,:_\-\[\]|=+/]+`;
+const KNOWN_HOSTS_LINE = new RegExp(`^(@cert-authority )?(${HOSTS}) (${KEY_TYPES.map((t) => t.replace(/[.]/g, "\\.")).join("|")}) ([A-Za-z0-9+/]{20,}={0,3})( [\\x20-\\x7e]{0,200})?$`);
+/** True when the base64 blob is a well-formed SSH wire key of type `keyType`:
+ *  a sequence of length-prefixed strings that consumes the blob exactly (so a
+ *  truncated or padded blob is refused), the first of which is the type name
+ *  (what ssh itself checks first), followed by at least one key field. */
+function blobMatchesType(b64, keyType) {
+    let bin;
+    try {
+        bin = atob(b64);
+    }
+    catch {
+        return false;
+    }
+    let pos = 0;
+    const fields = [];
+    while (pos < bin.length) {
+        if (pos + 4 > bin.length)
+            return false;
+        const len = (bin.charCodeAt(pos) * 0x1000000) + ((bin.charCodeAt(pos + 1) << 16) | (bin.charCodeAt(pos + 2) << 8) | bin.charCodeAt(pos + 3));
+        pos += 4;
+        if (len > bin.length - pos)
+            return false;
+        fields.push(bin.slice(pos, pos + len));
+        pos += len;
+    }
+    return fields.length >= 2 && fields[0] === keyType;
+}
+/**
+ * Validates customer-supplied known_hosts lines. Comments (`# ...`) and blank
+ * lines are dropped silently (`ssh-keyscan` output has them); duplicates are
+ * dropped; every other line must be exactly one recognised host-key (or
+ * `@cert-authority`) line whose key blob really is of the stated type, or it is
+ * listed in `rejected`. Input past `MAX_KNOWN_HOSTS_LINES` accepted lines is
+ * rejected, not silently truncated.
+ */
+export function sanitizeKnownHosts(input) {
+    const lines = [];
+    const rejected = [];
+    const seen = new Set();
+    input.forEach((raw, i) => {
+        if (typeof raw !== "string") {
+            rejected.push(i + 1);
+            return;
+        }
+        const line = raw.trim();
+        if (line === "" || line.startsWith("#"))
+            return;
+        const m = line.length <= MAX_KNOWN_HOSTS_LINE_LENGTH ? KNOWN_HOSTS_LINE.exec(line) : null;
+        if (!m || !blobMatchesType(m[4], m[3]) || lines.length >= MAX_KNOWN_HOSTS_LINES) {
+            rejected.push(i + 1);
+            return;
+        }
+        if (seen.has(line))
+            return;
+        seen.add(line);
+        lines.push(line);
+    });
+    return { lines, rejected };
+}
+/**
+ * A cheap shape check for an OpenSSH/PEM private key: one BEGIN/END pair of a
+ * `... PRIVATE KEY` block, bounded size, no NUL. Not a proof of validity.
+ */
+export function isPlausibleSshPrivateKey(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > MAX_SSH_DEPLOY_KEY_LENGTH)
+        return false;
+    if (value.includes("\u0000"))
+        return false;
+    return /^-----BEGIN [A-Z0-9 ]{0,30}PRIVATE KEY-----\r?\n[A-Za-z0-9+/=\r\n: ,.-]+\r?\n-----END [A-Z0-9 ]{0,30}PRIVATE KEY-----\s*$/.test(value);
+}
+//# sourceMappingURL=vpn-ssh.js.map

package/dist/vpn-ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-ssh.js","sourceRoot":"","sources":["../src/vpn-ssh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,qFAAqF;AACrF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,SAAS,GAAG;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;IACrB,qBAAqB;IACrB,SAAS;IACT,4BAA4B;IAC5B,oCAAoC;CAC5B,CAAC;AAEX,2EAA2E;AAC3E,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,+BAA+B,CAAC;AACxD,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,wBAAwB,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uDAAuD,CACnJ,CAAC;AASF;;;0EAG0E;AAC1E,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7I,GAAG,IAAI,CAAC,CAAC;QACT,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,GAAG,IAAI,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAClF,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,KAAK,CAAC;IAC9G,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,2HAA2H,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjJ,CAAC"}

package/dist/vpn-ssh.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vpn-ssh.test.d.ts.map

package/dist/vpn-ssh.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-ssh.test.d.ts","sourceRoot":"","sources":["../src/vpn-ssh.test.ts"],"names":[],"mappings":""}

package/dist/vpn-ssh.test.js

@@ -0,0 +1,75 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { isPlausibleSshPrivateKey, MAX_KNOWN_HOSTS_LINES, sanitizeKnownHosts } from "./vpn-ssh.js";
+const ED = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK91pDfs6YOw64Pk/1OQrblxsDl0obAVDxwCRQdDWeVM";
+const ECDSA = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBvuulkZYdqW+h/n3m7I39sGrSATHP+KNj8oDXKvXuio3bne5GoiF6ePP8jCxnH/fhJ3rMy4Sidwg3aYllX4110=";
+test("sanitizeKnownHosts accepts host-key and cert-authority lines, drops comments, blanks and duplicates", () => {
+    const r = sanitizeKnownHosts([
+        "# ssh-keyscan -t ed25519 git.corp.test",
+        "",
+        "   ",
+        `git.corp.test ${ED}`,
+        `[git.corp.test]:2222,10.20.0.5 ${ED} root@host`,
+        `git.corp.test ${ED}`,
+        `@cert-authority *.corp.test ${ED}`,
+        `|1|c2FsdHNhbHRzYWx0c2FsdA==|aGFzaGhhc2hoYXNoaGFzaA== ${ED}`,
+        `git2.corp.test ${ECDSA}`,
+    ]);
+    assert.equal(r.lines.length, 5);
+    assert.deepEqual(r.rejected, []);
+    assert.equal(r.lines[0], `git.corp.test ${ED}`);
+});
+test("sanitizeKnownHosts refuses anything that is not exactly one host-key line, without echoing it", () => {
+    const r = sanitizeKnownHosts([
+        "-----BEGIN OPENSSH PRIVATE KEY-----",
+        `@revoked git.corp.test ${ED}`,
+        `command="rm -rf /" git.corp.test ${ED}`,
+        "git.corp.test ssh-dss AAAAB3NzaC1kc3MAAACBAP",
+        `git.corp.test ${ED}\nsecond line smuggled`,
+        `git.corp.test ${ED} ` + "x".repeat(3000),
+        "git.corp.test",
+        `git.corp.test  ${ED}`, // two spaces
+        `git.corp.test\t${ED}`, // tab
+        `git.corp.test ${ED} comment\u0000with-nul`,
+        `git.corp.test ${ED} comment\u2028with-separator`,
+        42,
+        null,
+    ]);
+    assert.deepEqual(r.lines, []);
+    assert.deepEqual(r.rejected, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13]);
+});
+test("sanitizeKnownHosts requires the key blob to really be of the stated type", () => {
+    const mismatched = "ssh-ed25519 " + ECDSA.split(" ")[1];
+    const garbage = "ssh-ed25519 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+    const notBase64Length = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK91pDfs6YOw64Pk/1OQrblxsDl0obAVDxwCRQdDWeV";
+    const r = sanitizeKnownHosts([`h ${mismatched}`, `h ${garbage}`, `h ${notBase64Length}`, `h ${ED}`]);
+    assert.deepEqual(r.lines, [`h ${ED}`]);
+    assert.deepEqual(r.rejected, [1, 2, 3]);
+});
+test("sanitizeKnownHosts caps the number of lines and rejects (not truncates) the rest", () => {
+    const many = Array.from({ length: 100 }, (_, i) => `h${i}.corp.test ${ED}`);
+    const r = sanitizeKnownHosts(many);
+    assert.equal(r.lines.length, MAX_KNOWN_HOSTS_LINES);
+    assert.equal(r.rejected.length, 36);
+    assert.equal(r.rejected[0], 65);
+});
+test("isPlausibleSshPrivateKey: a PEM/OpenSSH private-key block of sane size, nothing else", () => {
+    const body = "b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZWQyNTUxOQ";
+    assert.equal(isPlausibleSshPrivateKey(`-----BEGIN OPENSSH PRIVATE KEY-----\n${body}\n-----END OPENSSH PRIVATE KEY-----\n`), true);
+    assert.equal(isPlausibleSshPrivateKey(`-----BEGIN RSA PRIVATE KEY-----\r\n${body}\r\n-----END RSA PRIVATE KEY-----`), true);
+    for (const bad of [
+        "",
+        ED, // a PUBLIC key
+        "-----BEGIN CERTIFICATE-----\nAAAA\n-----END CERTIFICATE-----\n",
+        `-----BEGIN OPENSSH PRIVATE KEY-----\n${body}\u0000\n-----END OPENSSH PRIVATE KEY-----\n`,
+        `-----BEGIN OPENSSH PRIVATE KEY-----\n${"A".repeat(20000)}\n-----END OPENSSH PRIVATE KEY-----\n`,
+        `-----BEGIN OPENSSH PRIVATE KEY-----\n${body}\n`,
+        `x-----BEGIN OPENSSH PRIVATE KEY-----\n${body}\n-----END OPENSSH PRIVATE KEY-----\n`,
+        42,
+        null,
+        undefined,
+    ]) {
+        assert.equal(isPlausibleSshPrivateKey(bad), false, String(bad).slice(0, 40));
+    }
+});
+//# sourceMappingURL=vpn-ssh.test.js.map

package/dist/vpn-ssh.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-ssh.test.js","sourceRoot":"","sources":["../src/vpn-ssh.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEnG,MAAM,EAAE,GAAG,kFAAkF,CAAC;AAC9F,MAAM,KAAK,GAAG,kKAAkK,CAAC;AAEjL,IAAI,CAAC,qGAAqG,EAAE,GAAG,EAAE;IAC/G,MAAM,CAAC,GAAG,kBAAkB,CAAC;QAC3B,wCAAwC;QACxC,EAAE;QACF,KAAK;QACL,iBAAiB,EAAE,EAAE;QACrB,kCAAkC,EAAE,YAAY;QAChD,iBAAiB,EAAE,EAAE;QACrB,+BAA+B,EAAE,EAAE;QACnC,wDAAwD,EAAE,EAAE;QAC5D,kBAAkB,KAAK,EAAE;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,GAAG,EAAE;IACzG,MAAM,CAAC,GAAG,kBAAkB,CAAC;QAC3B,qCAAqC;QACrC,0BAA0B,EAAE,EAAE;QAC9B,oCAAoC,EAAE,EAAE;QACxC,8CAA8C;QAC9C,iBAAiB,EAAE,wBAAwB;QAC3C,iBAAiB,EAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACzC,eAAe;QACf,kBAAkB,EAAE,EAAE,EAAE,aAAa;QACrC,kBAAkB,EAAE,EAAE,EAAE,MAAM;QAC9B,iBAAiB,EAAE,wBAAwB;QAC3C,iBAAiB,EAAE,8BAA8B;QACjD,EAAE;QACF,IAAI;KACL,CAAC,CAAC;IACH,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,UAAU,GAAG,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,kDAAkD,CAAC;IACnE,MAAM,eAAe,GAAG,iFAAiF,CAAC;IAC1G,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,KAAK,UAAU,EAAE,EAAE,KAAK,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,GAAG,EAAE;IAChG,MAAM,IAAI,GAAG,gFAAgF,CAAC;IAC9F,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,wCAAwC,IAAI,uCAAuC,CAAC,EAAE,IAAI,CAAC,CAAC;IAClI,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,sCAAsC,IAAI,mCAAmC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5H,KAAK,MAAM,GAAG,IAAI;QAChB,EAAE;QACF,EAAE,EAAE,eAAe;QACnB,gEAAgE;QAChE,wCAAwC,IAAI,6CAA6C;QACzF,wCAAwC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC;QAChG,wCAAwC,IAAI,IAAI;QAChD,yCAAyC,IAAI,uCAAuC;QACpF,EAAE;QACF,IAAI;QACJ,SAAS;KACV,EAAE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appforge-ci/core",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"