@appforge-ci/core 0.2.3 → 0.3.1

package/dist/vpn-sandbox.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The contract between the control plane and an agent about the regulated-build sandbox
+ * (macOS Seatbelt, packages/agent/src/lib/sandbox): ONE definition of the profile generation and of
+ * which `requires` entries make a sandbox mandatory, shared by the server that decides and the agent
+ * that enforces so the two can never drift. (The agent refuses a job whose profile version is not
+ * the one it implements, and refuses a job that `requires` a sandbox without carrying this field —
+ * it never runs such a build unsandboxed.)
+ */
+/** The profile generation agents implement. Bump it only together with a new profile template. */
+export declare const SANDBOX_PROFILE_VERSION = 2;
+/** `requires` entries that mean "a sandbox is mandatory" for the build. */
+export declare const SANDBOX_IMPLYING_REQUIRES: ReadonlySet<string>;
+/** The job's `sandbox` field (what the agent's `parseSandboxRequirement` reads). */
+export interface SandboxJobRequirement {
+    profileVersion: number;
+    /** The org that owns the build; scopes the warm caches (`~/appforge/cache.noindex/<orgId>`). */
+    orgId: string;
+}
+/**
+ * What a regulated build left behind on its Mac, as the agent observed it AFTER the steps ended
+ * (agent: `packages/agent/src/lib/sandbox/hygiene.ts`). It is evidence for the attestation, not a
+ * guarantee, and each part has a limit the reader must keep:
+ *
+ *  - `processes`: a best-effort sweep of leftover processes of the agent's own uid (the build shares
+ *    that uid until a dedicated build user exists). `methods` lists the detection methods that ran
+ *    (`env-marker`: the process environment carries this build's `APPFORGE_JOB_DIR`; `cwd-job-dir` /
+ *    `cwd-org-cache`: the working directory is inside the build's job directory / the org's cache).
+ *    A hostile build can hide from both (scrub its environment and `chdir` elsewhere), and macOS hides
+ *    the environment of Apple's own binaries from `ps`, so `remaining: 0` means "nothing the sweep could
+ *    see was left", never "nothing is running". `remaining > 0` means a process of the build is still
+ *    alive after SIGKILL: the host must not be trusted for the next tenant.
+ *  - `wipe`: after the job directory was removed, did it (or the agent's trash copy of it) still
+ *    exist, and how many entries (the directories themselves included) were left. 0 and `true` is the
+ *    only clean result. It says nothing about copies made elsewhere (backups, snapshots, the index).
+ *  - `dataAtRest`: whether the jobs and cache roots are kept out of Spotlight (`excluded`: both paths
+ *    carry a directory name ending in `.noindex`, the rule Spotlight applies, checked by name and not
+ *    observed in the index; `not_verified`: they do not, for example because the operator overrode
+ *    the directories) and out of Time Machine backups (`tmutil isexcluded`; `unknown` when it could not
+ *    be asked). APFS local snapshots are not covered by either.
+ */
+export type SandboxHygieneEvidence = {
+    processes: {
+        scanned: number;
+        found: number;
+        killed: number;
+        remaining: number;
+        methods: string[];
+    };
+    wipe: {
+        jobDirRemoved: boolean;
+        entriesRemaining: number;
+    };
+    dataAtRest: {
+        spotlight: "excluded" | "not_verified";
+        timeMachine: "excluded" | "included" | "unknown";
+    };
+    /** ISO timestamp of the moment the wipe was verified (the last step of the record). */
+    completedAt: string;
+};
+/**
+ * The `sandbox` field to put in a lease for a build whose tunnel needs these capabilities, or
+ * `undefined` when none of them implies a sandbox (a standard or strict-egress-only tunnel). Derived from
+ * the SAME `requires` tokens the scheduler matched the Mac against, so a build is sandboxed exactly when
+ * the Mac was chosen for its sandbox.
+ */
+export declare function sandboxRequirementForJob(requires: readonly string[], orgId: string): SandboxJobRequirement | undefined;
+//# sourceMappingURL=vpn-sandbox.d.ts.map

package/dist/vpn-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-sandbox.d.ts","sourceRoot":"","sources":["../src/vpn-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,kGAAkG;AAClG,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAA6E,CAAC;AAExI,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACpG,IAAI,EAAE;QAAE,aAAa,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,UAAU,EAAE;QAAE,SAAS,EAAE,UAAU,GAAG,cAAc,CAAC;QAAC,WAAW,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAA;KAAE,CAAC;IACzG,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEtH"}

package/dist/vpn-sandbox.js

@@ -0,0 +1,22 @@
+/**
+ * The contract between the control plane and an agent about the regulated-build sandbox
+ * (macOS Seatbelt, packages/agent/src/lib/sandbox): ONE definition of the profile generation and of
+ * which `requires` entries make a sandbox mandatory, shared by the server that decides and the agent
+ * that enforces so the two can never drift. (The agent refuses a job whose profile version is not
+ * the one it implements, and refuses a job that `requires` a sandbox without carrying this field —
+ * it never runs such a build unsandboxed.)
+ */
+/** The profile generation agents implement. Bump it only together with a new profile template. */
+export const SANDBOX_PROFILE_VERSION = 2;
+/** `requires` entries that mean "a sandbox is mandatory" for the build. */
+export const SANDBOX_IMPLYING_REQUIRES = new Set(["sandbox-v1", "enforcement:sandbox", "enforcement:sandbox_uid"]);
+/**
+ * The `sandbox` field to put in a lease for a build whose tunnel needs these capabilities, or
+ * `undefined` when none of them implies a sandbox (a standard or strict-egress-only tunnel). Derived from
+ * the SAME `requires` tokens the scheduler matched the Mac against, so a build is sandboxed exactly when
+ * the Mac was chosen for its sandbox.
+ */
+export function sandboxRequirementForJob(requires, orgId) {
+    return requires.some((r) => SANDBOX_IMPLYING_REQUIRES.has(r)) ? { profileVersion: SANDBOX_PROFILE_VERSION, orgId } : undefined;
+}
+//# sourceMappingURL=vpn-sandbox.js.map

package/dist/vpn-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-sandbox.js","sourceRoot":"","sources":["../src/vpn-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,qBAAqB,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAuCxI;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA2B,EAAE,KAAa;IACjF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjI,CAAC"}

package/dist/vpn-sandbox.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vpn-sandbox.test.d.ts.map

package/dist/vpn-sandbox.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-sandbox.test.d.ts","sourceRoot":"","sources":["../src/vpn-sandbox.test.ts"],"names":[],"mappings":""}

package/dist/vpn-sandbox.test.js

@@ -0,0 +1,34 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { SANDBOX_IMPLYING_REQUIRES, SANDBOX_PROFILE_VERSION, sandboxRequirementForJob } from "./vpn-sandbox.js";
+test("a build is sandboxed exactly when its requires imply a sandbox", () => {
+    assert.equal(sandboxRequirementForJob([], "org-a"), undefined);
+    assert.equal(sandboxRequirementForJob(["egress-policy-v1"], "org-a"), undefined, "strict egress alone is the helper's job, not the sandbox's");
+    assert.equal(sandboxRequirementForJob(["ssh-v1", "egress-policy-v1"], "org-a"), undefined);
+    for (const r of ["sandbox-v1", "enforcement:sandbox", "enforcement:sandbox_uid"]) {
+        assert.deepEqual(sandboxRequirementForJob(["egress-policy-v1", r], "org-a"), { profileVersion: SANDBOX_PROFILE_VERSION, orgId: "org-a" }, r);
+    }
+    assert.equal(sandboxRequirementForJob(["enforcement:none"], "org-a"), undefined);
+});
+test("the implying set is exactly the three entries the agent honours, and the profile version is a positive integer", () => {
+    assert.deepEqual([...SANDBOX_IMPLYING_REQUIRES].sort(), ["enforcement:sandbox", "enforcement:sandbox_uid", "sandbox-v1"]);
+    assert.ok(Number.isInteger(SANDBOX_PROFILE_VERSION) && SANDBOX_PROFILE_VERSION > 0);
+});
+test("SandboxHygieneEvidence is the one record of what a regulated build left on its host, with exactly these fields (the agent writes it, the attestation reads it)", () => {
+    // A compile-time contract: renaming or dropping a field here breaks the agent's hygiene.ts and the later attestation consumer.
+    const record = {
+        processes: { scanned: 412, found: 2, killed: 2, remaining: 0, methods: ["env-marker", "cwd-job-dir", "cwd-org-cache"] },
+        wipe: { jobDirRemoved: true, entriesRemaining: 0 },
+        dataAtRest: { spotlight: "excluded", timeMachine: "excluded" },
+        completedAt: "2026-10-03T12:00:00.000Z",
+    };
+    assert.deepEqual(Object.keys(record).sort(), ["completedAt", "dataAtRest", "processes", "wipe"]);
+    assert.deepEqual(Object.keys(record.processes).sort(), ["found", "killed", "methods", "remaining", "scanned"]);
+    assert.deepEqual(Object.keys(record.wipe).sort(), ["entriesRemaining", "jobDirRemoved"]);
+    assert.deepEqual(Object.keys(record.dataAtRest).sort(), ["spotlight", "timeMachine"]);
+    // The states an honest record can carry for what could not be proven.
+    const unproven = { spotlight: "not_verified", timeMachine: "unknown" };
+    const included = { spotlight: "not_verified", timeMachine: "included" };
+    assert.notDeepEqual(unproven, included);
+});
+//# sourceMappingURL=vpn-sandbox.test.js.map

package/dist/vpn-sandbox.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-sandbox.test.js","sourceRoot":"","sources":["../src/vpn-sandbox.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,wBAAwB,EAA+B,MAAM,kBAAkB,CAAC;AAE7I,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,4DAA4D,CAAC,CAAC;IAC/I,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,qBAAqB,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,cAAc,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/I,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;AACnF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gHAAgH,EAAE,GAAG,EAAE;IAC1H,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1H,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,GAAG,CAAC,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gKAAgK,EAAE,GAAG,EAAE;IAC1K,+HAA+H;IAC/H,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE;QACvH,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE;QAClD,UAAU,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE;QAC9D,WAAW,EAAE,0BAA0B;KACP,CAAC;IACnC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACjG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/G,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC;IACzF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IACtF,sEAAsE;IACtE,MAAM,QAAQ,GAAyC,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC7G,MAAM,QAAQ,GAAyC,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IAC9G,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC"}

package/dist/vpn-ssh.d.ts

@@ -0,0 +1,138 @@
+/**
+ * SSH material for a VPN build (`VpnJobConfig.sshKnownHosts` / `sshDeployKey`,
+ * the "git over SSH through the tunnel" part of the regulated-VPN program).
+ *
+ * Pure validation shared by whoever stores the values (the control plane) and
+ * whoever applies them (the agent, `packages/agent/src/lib/vpn-ssh.ts`), so the
+ * two can never disagree about what is acceptable:
+ *
+ *  - `sanitizeKnownHosts`: customer-supplied public host keys (or host CAs).
+ *    Free text in the dashboard, so anything that is not exactly one recognised
+ *    host-key line is refused rather than repaired, and a rejected line is never
+ *    echoed back (a pasted private key must not travel into a log or an error).
+ *    There is no trust-on-first-use anywhere: these lines are the ONLY host
+ *    keys a VPN build's ssh will accept.
+ *  - `isPlausibleSshPrivateKey`: a cheap shape check for the deploy key. It
+ *    does not prove the key is usable (ssh-add does that); it keeps obviously
+ *    wrong input (a public key, a huge blob, binary) out of the lease.
+ */
+/** At most this many known_hosts lines are accepted per tunnel. */
+export declare const MAX_KNOWN_HOSTS_LINES = 64;
+/** Longest accepted known_hosts line (a 4096-bit RSA key with a comment is ~800). */
+export declare const MAX_KNOWN_HOSTS_LINE_LENGTH = 2048;
+/** Longest accepted deploy key (an RSA-4096 OpenSSH key is ~3.4 KB). */
+export declare const MAX_SSH_DEPLOY_KEY_LENGTH: number;
+/** At most this many comma-separated host patterns on one known_hosts line. */
+export declare const MAX_KNOWN_HOSTS_PATTERNS_PER_LINE = 16;
+export interface SanitizedKnownHosts {
+    /** Normalised, de-duplicated lines, safe to write to a known_hosts file. */
+    lines: string[];
+    /** 1-based indexes of input lines that were refused. Contents are never echoed. */
+    rejected: number[];
+}
+/**
+ * Validates customer-supplied known_hosts lines. Comments (`# ...`) and blank
+ * lines are dropped silently (`ssh-keyscan` output has them); duplicates are
+ * dropped; every other line must be exactly one recognised host-key (or
+ * `@cert-authority`) line whose key blob really is of the stated type, or it is
+ * listed in `rejected`. Input past `MAX_KNOWN_HOSTS_LINES` accepted lines is
+ * rejected, not silently truncated.
+ */
+export declare function sanitizeKnownHosts(input: readonly unknown[]): SanitizedKnownHosts;
+/**
+ * A cheap shape check for an OpenSSH/PEM private key: one BEGIN/END pair of a
+ * `... PRIVATE KEY` block, bounded size, no NUL. Not a proof of validity.
+ */
+export declare function isPlausibleSshPrivateKey(value: unknown): value is string;
+/** The agent feature that makes a lease's ssh material usable (`appforge-vpn connect` + per-build ssh state). */
+export declare const SSH_FEATURE = "ssh-v1";
+export interface ValidatedKnownHosts {
+    ok: boolean;
+    /** Normalised lines, ready to store (empty when `ok` is false). */
+    lines: string[];
+    /** One human-readable problem per rejected line or per input-level fault. Never echoes line content. */
+    errors: string[];
+}
+/**
+ * The strict front door for `sshKnownHosts` from a client: `sanitizeKnownHosts`
+ * plus an all-or-nothing verdict. A line the sanitizer drops is an ERROR here
+ * (the customer must see that part of their paste was refused, instead of the
+ * build later failing "No host key is known" for a server they thought was
+ * pinned), and nothing is stored when any line is bad. An empty list is valid
+ * and means "no ssh through this tunnel". Error text carries line numbers and
+ * the rule broken, never the offending text (a private key pasted by mistake
+ * must not travel into an error, a log or an audit entry).
+ */
+export declare function validateKnownHostsInput(input: unknown): ValidatedKnownHosts;
+/** What the dashboard and CLI show for one pinned host-key line. */
+export interface SshHostKeyEntry {
+    /** The line's host-pattern field, e.g. `git.corp.test,10.20.0.5` or `*.corp.test`. */
+    hosts: string;
+    /** Key algorithm, e.g. `ssh-ed25519`. */
+    keyType: string;
+    /** OpenSSH-style fingerprint of the key blob: `SHA256:<base64 without padding>`. */
+    fingerprint: string;
+    /** True for an `@cert-authority` line: the key is a host CA, not a server's own key. */
+    certAuthority: boolean;
+}
+/** `SHA256:<base64>` of an SSH wire-format key (the blob in a known_hosts or `.pub` line), as `ssh-keygen -l` prints it. */
+export declare function sshKeyFingerprint(keyBase64: string): Promise<string>;
+/**
+ * Fingerprints of already-validated known_hosts lines, computed server-side so a
+ * customer compares what AppForge will actually pin with what their server
+ * prints (`ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub`). Lines that do not
+ * parse (should not happen for stored data) are skipped rather than thrown on,
+ * so a display can never be broken by a corrupt row.
+ */
+export declare function knownHostsFingerprints(lines: readonly string[]): Promise<SshHostKeyEntry[]>;
+/** The fingerprints of two stored lists compared, for the audit entry of a change: fingerprints only, never the lines. */
+export declare function diffFingerprints(before: readonly SshHostKeyEntry[], after: readonly SshHostKeyEntry[]): {
+    added: string[];
+    removed: string[];
+};
+/** A git remote an app may be built from. */
+export interface GitRemote {
+    /** `https`: the transport every app has always used. `ssh`: only through a VPN tunnel with pinned host keys. */
+    kind: "https" | "ssh";
+    /** `url` for `https://` and `ssh://`, `scp` for `user@host:path`. */
+    form: "url" | "scp";
+    user: string | null;
+    host: string;
+    port: number | null;
+    path: string;
+}
+/** Longest accepted `ssh://` / scp-like remote. */
+export declare const MAX_SSH_REMOTE_LENGTH = 1024;
+/**
+ * Parses a git remote into one of the two shapes an app may use, or null.
+ *
+ *  - `https://…` exactly as before (the WHATWG URL parser, scheme `https:`).
+ *  - `ssh://user@host[:port]/path` and the scp-like `user@host:path`: a user name
+ *    is REQUIRED (without it ssh would use the Mac's own account name), the host
+ *    is a plain DNS name or IPv4 address, the path is a conservative character
+ *    set with no `..` segment. Anything an ssh client could read as an option or
+ *    a command (leading `-`, `%`, quotes, `$`, backticks, `;`, whitespace,
+ *    control characters, a `user:password@` form, an IPv6 literal) does not parse.
+ *
+ * This is the SYNTAX gate. Whether a given app may use an ssh remote at all
+ * (useVpn, an active tunnel with pinned host keys) is the control plane's rule,
+ * enforced by the routes and again at lease time.
+ */
+export declare function parseGitRemote(value: unknown): GitRemote | null;
+/** True when `value` is a (valid) ssh git remote: `ssh://` or scp-like. */
+export declare function isSshGitRemote(value: unknown): boolean;
+/**
+ * True when `value` is shaped like it wants a non-https, ssh transport (an ssh
+ * form, whether or not it is well-formed). The agent uses it to refuse, closed,
+ * anything that should have gone through the ssh path but cannot be proven
+ * safe, instead of letting git interpret it.
+ */
+export declare function looksLikeSshGitRemote(value: unknown): boolean;
+/**
+ * What git over SSH through the tunnel does and does NOT give, one line each, shown
+ * by the CLI and the dashboard next to the host-key and deploy-key settings. Kept
+ * here so both surfaces (and docs/vpn.md) say the same, honest thing. Do not add a
+ * claim the code does not back: this is not compliance wording.
+ */
+export declare const SSH_LIMITS: readonly string[];
+//# sourceMappingURL=vpn-ssh.d.ts.map

package/dist/vpn-ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-ssh.d.ts","sourceRoot":"","sources":["../src/vpn-ssh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,qFAAqF;AACrF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAY,CAAC;AAoBnD,+EAA+E;AAC/E,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAmCpD,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA0BD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,mBAAmB,CAqBjF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAIxE;AAOD,iHAAiH;AACjH,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,mEAAmE;IACnE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wGAAwG;IACxG,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAU3E;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,aAAa,EAAE,OAAO,CAAC;CACxB;AAgBD,4HAA4H;AAC5H,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAYjG;AAED,0HAA0H;AAC1H,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAI9I;AAID,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,gHAAgH;IAChH,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IACtB,qEAAqE;IACrE,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mDAAmD;AACnD,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAe1C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CA0B/D;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAM7D;AAID;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAMvC,CAAC"}

package/dist/vpn-ssh.js

@@ -0,0 +1,320 @@
+/**
+ * SSH material for a VPN build (`VpnJobConfig.sshKnownHosts` / `sshDeployKey`,
+ * the "git over SSH through the tunnel" part of the regulated-VPN program).
+ *
+ * Pure validation shared by whoever stores the values (the control plane) and
+ * whoever applies them (the agent, `packages/agent/src/lib/vpn-ssh.ts`), so the
+ * two can never disagree about what is acceptable:
+ *
+ *  - `sanitizeKnownHosts`: customer-supplied public host keys (or host CAs).
+ *    Free text in the dashboard, so anything that is not exactly one recognised
+ *    host-key line is refused rather than repaired, and a rejected line is never
+ *    echoed back (a pasted private key must not travel into a log or an error).
+ *    There is no trust-on-first-use anywhere: these lines are the ONLY host
+ *    keys a VPN build's ssh will accept.
+ *  - `isPlausibleSshPrivateKey`: a cheap shape check for the deploy key. It
+ *    does not prove the key is usable (ssh-add does that); it keeps obviously
+ *    wrong input (a public key, a huge blob, binary) out of the lease.
+ */
+/** At most this many known_hosts lines are accepted per tunnel. */
+export const MAX_KNOWN_HOSTS_LINES = 64;
+/** Longest accepted known_hosts line (a 4096-bit RSA key with a comment is ~800). */
+export const MAX_KNOWN_HOSTS_LINE_LENGTH = 2048;
+/** Longest accepted deploy key (an RSA-4096 OpenSSH key is ~3.4 KB). */
+export const MAX_SSH_DEPLOY_KEY_LENGTH = 16 * 1024;
+const KEY_TYPES = [
+    "ssh-ed25519",
+    "ecdsa-sha2-nistp256",
+    "ecdsa-sha2-nistp384",
+    "ecdsa-sha2-nistp521",
+    "ssh-rsa",
+    "sk-ssh-ed25519@openssh.com",
+    "sk-ecdsa-sha2-nistp256@openssh.com",
+];
+// [@cert-authority ]<host patterns> <keytype> <base64> [comment]. No other
+// markers (@revoked is not accepted: the customer revokes by removing the key),
+// no leading ssh option fields (`command=...`), single spaces only.
+const HOSTS = String.raw `[A-Za-z0-9.*?!,:_\-\[\]|=+/]+`;
+const KNOWN_HOSTS_LINE = new RegExp(`^(@cert-authority )?(${HOSTS}) (${KEY_TYPES.map((t) => t.replace(/[.]/g, "\\.")).join("|")}) ([A-Za-z0-9+/]{20,}={0,3})( [\\x20-\\x7e]{0,200})?$`);
+/** At most this many comma-separated host patterns on one known_hosts line. */
+export const MAX_KNOWN_HOSTS_PATTERNS_PER_LINE = 16;
+/**
+ * True when a line's host-pattern field names something specific: at most
+ * `MAX_KNOWN_HOSTS_PATTERNS_PER_LINE` patterns, none empty, at least one of them
+ * a positive (not `!`-negated) pattern, and every positive pattern carries at
+ * least one literal character. A bare `*`, `?`, `*.*` or `[*]:22` would pin ONE
+ * key as the identity of EVERY server, which defeats pinning (and, as a
+ * `@cert-authority` line, would trust a CA for every host); a line of only
+ * negations matches nothing and is a typo. Hashed (`|1|salt|hash`) patterns are
+ * opaque and always count as specific.
+ */
+function hostPatternsAreSpecific(field) {
+    const patterns = field.split(",");
+    if (patterns.length > MAX_KNOWN_HOSTS_PATTERNS_PER_LINE)
+        return false;
+    let positives = 0;
+    for (const p of patterns) {
+        if (p === "" || p === "!")
+            return false;
+        if (p.startsWith("|")) {
+            positives++;
+            continue;
+        }
+        if (p.startsWith("!"))
+            continue;
+        positives++;
+        // `[host]:port` pins a port: the literal part is the host, never the port digits.
+        // For a non-default port ssh looks a host up as `[host]:PORT`, so an unbracketed
+        // `*:2222` or `*]:2222` would match every host on that port: strip any trailing
+        // `]:port` / `:port` suffix(es) before looking for a literal character.
+        const bracket = /^\[(.*)\](?::\d+)?$/.exec(p);
+        const host = (bracket ? bracket[1] : p).replace(/(\]?:\d+)+$/, "");
+        if (!/[A-Za-z0-9]/.test(host.replace(/[*?.\-_]/g, "")))
+            return false;
+    }
+    return positives > 0;
+}
+/** True when the base64 blob is a well-formed SSH wire key of type `keyType`:
+ *  a sequence of length-prefixed strings that consumes the blob exactly (so a
+ *  truncated or padded blob is refused), the first of which is the type name
+ *  (what ssh itself checks first), followed by at least one key field. */
+function blobMatchesType(b64, keyType) {
+    let bin;
+    try {
+        bin = atob(b64);
+    }
+    catch {
+        return false;
+    }
+    let pos = 0;
+    const fields = [];
+    while (pos < bin.length) {
+        if (pos + 4 > bin.length)
+            return false;
+        const len = (bin.charCodeAt(pos) * 0x1000000) + ((bin.charCodeAt(pos + 1) << 16) | (bin.charCodeAt(pos + 2) << 8) | bin.charCodeAt(pos + 3));
+        pos += 4;
+        if (len > bin.length - pos)
+            return false;
+        fields.push(bin.slice(pos, pos + len));
+        pos += len;
+    }
+    return fields.length >= 2 && fields[0] === keyType;
+}
+/**
+ * Validates customer-supplied known_hosts lines. Comments (`# ...`) and blank
+ * lines are dropped silently (`ssh-keyscan` output has them); duplicates are
+ * dropped; every other line must be exactly one recognised host-key (or
+ * `@cert-authority`) line whose key blob really is of the stated type, or it is
+ * listed in `rejected`. Input past `MAX_KNOWN_HOSTS_LINES` accepted lines is
+ * rejected, not silently truncated.
+ */
+export function sanitizeKnownHosts(input) {
+    const lines = [];
+    const rejected = [];
+    const seen = new Set();
+    input.forEach((raw, i) => {
+        if (typeof raw !== "string") {
+            rejected.push(i + 1);
+            return;
+        }
+        const line = raw.trim();
+        if (line === "" || line.startsWith("#"))
+            return;
+        const m = line.length <= MAX_KNOWN_HOSTS_LINE_LENGTH ? KNOWN_HOSTS_LINE.exec(line) : null;
+        if (!m || !blobMatchesType(m[4], m[3]) || !hostPatternsAreSpecific(m[2]) || lines.length >= MAX_KNOWN_HOSTS_LINES) {
+            rejected.push(i + 1);
+            return;
+        }
+        if (seen.has(line))
+            return;
+        seen.add(line);
+        lines.push(line);
+    });
+    return { lines, rejected };
+}
+/**
+ * A cheap shape check for an OpenSSH/PEM private key: one BEGIN/END pair of a
+ * `... PRIVATE KEY` block, bounded size, no NUL. Not a proof of validity.
+ */
+export function isPlausibleSshPrivateKey(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > MAX_SSH_DEPLOY_KEY_LENGTH)
+        return false;
+    if (value.includes("\u0000"))
+        return false;
+    return /^-----BEGIN [A-Z0-9 ]{0,30}PRIVATE KEY-----\r?\n[A-Za-z0-9+/=\r\n: ,.-]+\r?\n-----END [A-Z0-9 ]{0,30}PRIVATE KEY-----\s*$/.test(value);
+}
+// ---------------------------------------------------------------------------
+// Control-plane side (PR-G): validating what a customer pastes, showing it back
+// with fingerprints, and deciding which git remotes may use ssh at all.
+// ---------------------------------------------------------------------------
+/** The agent feature that makes a lease's ssh material usable (`appforge-vpn connect` + per-build ssh state). */
+export const SSH_FEATURE = "ssh-v1";
+/**
+ * The strict front door for `sshKnownHosts` from a client: `sanitizeKnownHosts`
+ * plus an all-or-nothing verdict. A line the sanitizer drops is an ERROR here
+ * (the customer must see that part of their paste was refused, instead of the
+ * build later failing "No host key is known" for a server they thought was
+ * pinned), and nothing is stored when any line is bad. An empty list is valid
+ * and means "no ssh through this tunnel". Error text carries line numbers and
+ * the rule broken, never the offending text (a private key pasted by mistake
+ * must not travel into an error, a log or an audit entry).
+ */
+export function validateKnownHostsInput(input) {
+    if (!Array.isArray(input))
+        return { ok: false, lines: [], errors: ["knownHosts must be a list of host-key lines"] };
+    // A hard ceiling BEFORE the per-line work, so an oversized paste is one cheap error.
+    if (input.length > MAX_KNOWN_HOSTS_LINES * 4) {
+        return { ok: false, lines: [], errors: [`knownHosts has too many lines (at most ${MAX_KNOWN_HOSTS_LINES} host keys are accepted)`] };
+    }
+    const { lines, rejected } = sanitizeKnownHosts(input);
+    const errors = rejected.slice(0, 20).map((n) => `line ${n} is not an acceptable host-key line (use "host[,host...] <key-type> <base64-key>" or "@cert-authority <host-pattern> <key-type> <base64-key>", as printed by ssh-keyscan; no options, no private keys, no catch-all host patterns)`);
+    if (rejected.length > 20)
+        errors.push(`${rejected.length - 20} more line(s) were also refused`);
+    return errors.length > 0 ? { ok: false, lines: [], errors } : { ok: true, lines, errors: [] };
+}
+function toB64NoPad(bytes) {
+    const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let bin = "";
+    for (const b of u8)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/=+$/, "");
+}
+function fromB64(b64) {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+/** `SHA256:<base64>` of an SSH wire-format key (the blob in a known_hosts or `.pub` line), as `ssh-keygen -l` prints it. */
+export async function sshKeyFingerprint(keyBase64) {
+    const digest = await crypto.subtle.digest("SHA-256", fromB64(keyBase64));
+    return `SHA256:${toB64NoPad(digest)}`;
+}
+/**
+ * Fingerprints of already-validated known_hosts lines, computed server-side so a
+ * customer compares what AppForge will actually pin with what their server
+ * prints (`ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub`). Lines that do not
+ * parse (should not happen for stored data) are skipped rather than thrown on,
+ * so a display can never be broken by a corrupt row.
+ */
+export async function knownHostsFingerprints(lines) {
+    const out = [];
+    for (const line of lines) {
+        const m = KNOWN_HOSTS_LINE.exec(line);
+        if (!m)
+            continue;
+        try {
+            out.push({ hosts: m[2], keyType: m[3], fingerprint: await sshKeyFingerprint(m[4]), certAuthority: m[1] !== undefined });
+        }
+        catch {
+            /* corrupt stored line: not shown */
+        }
+    }
+    return out;
+}
+/** The fingerprints of two stored lists compared, for the audit entry of a change: fingerprints only, never the lines. */
+export function diffFingerprints(before, after) {
+    const b = new Set(before.map((e) => e.fingerprint));
+    const a = new Set(after.map((e) => e.fingerprint));
+    return { added: [...a].filter((f) => !b.has(f)).sort(), removed: [...b].filter((f) => !a.has(f)).sort() };
+}
+/** Longest accepted `ssh://` / scp-like remote. */
+export const MAX_SSH_REMOTE_LENGTH = 1024;
+const SSH_USER = String.raw `[A-Za-z0-9_][A-Za-z0-9._-]{0,63}`;
+// A DNS name or an IPv4 address: letters, digits, dots and inner hyphens, never a leading
+// hyphen (it would be read as an ssh option), never `%`, `:`, brackets or whitespace.
+const SSH_HOST = String.raw `[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?`;
+// Path characters git hosts actually use. No `-` first (option-looking), no `?`, `#`, `%`, `\`, quotes, `$`, `;`, `|`, `&`, backticks or whitespace.
+const SSH_PATH = String.raw `[A-Za-z0-9_~+][A-Za-z0-9_~+./-]{0,500}`;
+const SSH_URL_RE = new RegExp(String.raw `^ssh://(${SSH_USER})@(${SSH_HOST})(?::([0-9]{1,5}))?/(${SSH_PATH})$`);
+const SCP_RE = new RegExp(String.raw `^(${SSH_USER})@(${SSH_HOST}):(/?${SSH_PATH})$`);
+function safeRepoPath(path) {
+    return !path.split("/").some((seg) => seg === "..");
+}
+/**
+ * Parses a git remote into one of the two shapes an app may use, or null.
+ *
+ *  - `https://…` exactly as before (the WHATWG URL parser, scheme `https:`).
+ *  - `ssh://user@host[:port]/path` and the scp-like `user@host:path`: a user name
+ *    is REQUIRED (without it ssh would use the Mac's own account name), the host
+ *    is a plain DNS name or IPv4 address, the path is a conservative character
+ *    set with no `..` segment. Anything an ssh client could read as an option or
+ *    a command (leading `-`, `%`, quotes, `$`, backticks, `;`, whitespace,
+ *    control characters, a `user:password@` form, an IPv6 literal) does not parse.
+ *
+ * This is the SYNTAX gate. Whether a given app may use an ssh remote at all
+ * (useVpn, an active tunnel with pinned host keys) is the control plane's rule,
+ * enforced by the routes and again at lease time.
+ */
+export function parseGitRemote(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > MAX_SSH_REMOTE_LENGTH)
+        return null;
+    if (value.startsWith("https://")) {
+        try {
+            const u = new URL(value);
+            if (u.protocol !== "https:")
+                return null;
+            return { kind: "https", form: "url", user: null, host: u.hostname, port: u.port ? Number(u.port) : null, path: u.pathname };
+        }
+        catch {
+            return null;
+        }
+    }
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x20\x7f-\x9f]|\p{Zl}|\p{Zp}/u.test(value))
+        return null;
+    if (value.startsWith("ssh://")) {
+        const m = SSH_URL_RE.exec(value);
+        if (!m)
+            return null;
+        const port = m[3] === undefined ? null : Number(m[3]);
+        if (port !== null && (port < 1 || port > 65535))
+            return null;
+        if (!safeRepoPath(m[4]))
+            return null;
+        return { kind: "ssh", form: "url", user: m[1], host: m[2], port, path: `/${m[4]}` };
+    }
+    // scp-like: no scheme. `://` anywhere means some other scheme, never scp.
+    if (value.includes("://"))
+        return null;
+    const m = SCP_RE.exec(value);
+    if (!m || !safeRepoPath(m[3]))
+        return null;
+    return { kind: "ssh", form: "scp", user: m[1], host: m[2], port: null, path: m[3] };
+}
+/** True when `value` is a (valid) ssh git remote: `ssh://` or scp-like. */
+export function isSshGitRemote(value) {
+    return parseGitRemote(value)?.kind === "ssh";
+}
+/**
+ * True when `value` is shaped like it wants a non-https, ssh transport (an ssh
+ * form, whether or not it is well-formed). The agent uses it to refuse, closed,
+ * anything that should have gone through the ssh path but cannot be proven
+ * safe, instead of letting git interpret it.
+ */
+export function looksLikeSshGitRemote(value) {
+    if (typeof value !== "string")
+        return false;
+    if (value.startsWith("ssh://"))
+        return true;
+    if (value.startsWith("https://") || value.includes("://"))
+        return false;
+    // `[user@]host:path` with no slash before the colon is git's own scp test.
+    return /^[^/:]+:/.test(value) && !/^[A-Za-z]:[\\/]/.test(value);
+}
+// --- customer-facing wording -------------------------------------------------
+/**
+ * What git over SSH through the tunnel does and does NOT give, one line each, shown
+ * by the CLI and the dashboard next to the host-key and deploy-key settings. Kept
+ * here so both surfaces (and docs/vpn.md) say the same, honest thing. Do not add a
+ * claim the code does not back: this is not compliance wording.
+ */
+export const SSH_LIMITS = [
+    "Host keys are pinned, never trusted on first use: ssh connects only to servers whose key you registered here, and refuses an unknown or changed key. Compare the fingerprints with what your own server prints (ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub) before you rely on them.",
+    "AppForge generates each app's deploy key and shows you only the public half. Install it on your git server as a read-only deploy key. The private half is stored encrypted and is handed only to the Mac that runs that app's build.",
+    "During a build the key sits in a per-build ssh-agent: build scripts can ask it to sign for your registered servers, but cannot read the key out. It is never written to disk by AppForge. Build scripts run as the same macOS user as the build agent on that Mac, so treat the deploy key as readable by the code you build: keep it read-only and scoped to one repository.",
+    "git and rsync use the tunnel automatically. A bare 'ssh host' in a build script is NOT routed through it; use ssh -F \"$APPFORGE_SSH_CONFIG\" host. Where the build is not kernel-sandboxed, a script that bypasses that wiring is not stopped from connecting elsewhere by this feature.",
+    "Clone speed through the tunnel for large repositories has not been measured.",
+];
+//# sourceMappingURL=vpn-ssh.js.map

package/dist/vpn-ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-ssh.js","sourceRoot":"","sources":["../src/vpn-ssh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,qFAAqF;AACrF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,SAAS,GAAG;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;IACrB,qBAAqB;IACrB,SAAS;IACT,4BAA4B;IAC5B,oCAAoC;CAC5B,CAAC;AAEX,2EAA2E;AAC3E,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,+BAA+B,CAAC;AACxD,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,wBAAwB,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uDAAuD,CACnJ,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAEpD;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,GAAG,iCAAiC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,SAAS,EAAE,CAAC;QACZ,kFAAkF;QAClF,iFAAiF;QACjF,gFAAgF;QAChF,wEAAwE;QACxE,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,GAAG,CAAC,CAAC;AACvB,CAAC;AASD;;;0EAG0E;AAC1E,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7I,GAAG,IAAI,CAAC,CAAC;QACT,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,GAAG,IAAI,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YACrH,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,KAAK,CAAC;IAC9G,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,2HAA2H,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjJ,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAE9E,iHAAiH;AACjH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAUpC;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,6CAA6C,CAAC,EAAE,CAAC;IACpH,qFAAqF;IACrF,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,0CAA0C,qBAAqB,0BAA0B,CAAC,EAAE,CAAC;IACvI,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,oOAAoO,CAAC,CAAC;IAC/R,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAChG,CAAC;AAcD,SAAS,UAAU,CAAC,KAA+B;IACjD,MAAM,EAAE,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4HAA4H;AAC5H,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,OAAO,UAAU,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAwB;IACnE,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;QAC7H,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,gBAAgB,CAAC,MAAkC,EAAE,KAAiC;IACpG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACnD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC5G,CAAC;AAgBD,mDAAmD;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,kCAAkC,CAAC;AAC9D,0FAA0F;AAC1F,sFAAsF;AACtF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,iDAAiD,CAAC;AAC7E,qJAAqJ;AACrJ,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,wCAAwC,CAAC;AACpE,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,WAAW,QAAQ,MAAM,QAAQ,wBAAwB,QAAQ,IAAI,CAAC,CAAC;AAC/G,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,QAAQ,MAAM,QAAQ,QAAQ,QAAQ,IAAI,CAAC,CAAC;AAErF,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,IAAI,CAAC;IACzG,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9H,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,4CAA4C;IAC5C,IAAI,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,0EAA0E;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AACzF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,2EAA2E;IAC3E,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAsB;IAC3C,4RAA4R;IAC5R,sOAAsO;IACtO,+WAA+W;IAC/W,2RAA2R;IAC3R,8EAA8E;CAC/E,CAAC"}

package/dist/vpn-ssh.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vpn-ssh.test.d.ts.map

package/dist/vpn-ssh.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-ssh.test.d.ts","sourceRoot":"","sources":["../src/vpn-ssh.test.ts"],"names":[],"mappings":""}