@appforge-ci/core 0.3.0 → 0.3.2

package/dist/build-vpn.js

@@ -20,4 +20,31 @@ export function describeBuildVpn(vpn) {
         return "VPN status unknown: no VPN events were recorded for this build";
     return "No VPN";
 }
+/**
+ * One-line, human-readable state of a build's attestation, shared by the dashboard and `appforge build show`. Says plainly when it
+ * is not (yet) evidence: pending, degraded, unsigned, or recording a violation.
+ *   "Evidence: complete, signed, all controls enforced"
+ *   "Evidence: complete, signed, 2 control violations recorded"
+ *   "Evidence: DEGRADED (the agent did not report), signed: server-observed facts only"
+ *   "Evidence: complete, NOT SIGNED (the platform had no signing key)"
+ *   "Evidence: pending (the build's agent has not reported yet)"
+ */
+export function describeBuildAttestation(a) {
+    if (!a)
+        return null;
+    if (a.state === "pending")
+        return "Evidence: pending (the build's agent has not reported yet)";
+    const signed = a.signed ? "signed" : "NOT SIGNED (the platform had no signing key)";
+    if (a.state === "degraded_server_observed")
+        return `Evidence: DEGRADED (the agent did not report), ${signed}: server-observed facts only`;
+    const verdict = a.violations > 0
+        ? `${a.violations} control violation${a.violations === 1 ? "" : "s"} recorded`
+        : a.controlsVerdict === "all_enforced"
+            ? "all controls enforced"
+            : a.controlsVerdict === "network_policy_checked"
+                ? "network policy checked"
+                : "no control verdict";
+    const partial = a.completeness === "partial" ? ", partial" : "";
+    return `Evidence: complete${partial}, ${signed}, ${verdict}`;
+}
 //# sourceMappingURL=build-vpn.js.map

package/dist/build-vpn.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-vpn.js","sourceRoot":"","sources":["../src/build-vpn.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA+B;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,0BAA0B,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC;IACxC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW;YAAE,OAAO,qBAAqB,IAAI,cAAc,CAAC;QAChF,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,sBAAsB,GAAG,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;QAC5G,OAAO,kBAAkB,IAAI,oCAAoC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,gEAAgE,CAAC;IACvG,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"build-vpn.js","sourceRoot":"","sources":["../src/build-vpn.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA+B;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,0BAA0B,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC;IACxC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW;YAAE,OAAO,qBAAqB,IAAI,cAAc,CAAC;QAChF,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,sBAAsB,GAAG,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;QAC5G,OAAO,kBAAkB,IAAI,oCAAoC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,gEAAgE,CAAC;IACvG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,CAAqC;IAC5E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,4DAA4D,CAAC;IAC/F,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,8CAA8C,CAAC;IACpF,IAAI,CAAC,CAAC,KAAK,KAAK,0BAA0B;QAAE,OAAO,kDAAkD,MAAM,8BAA8B,CAAC;IAC1I,MAAM,OAAO,GACX,CAAC,CAAC,UAAU,GAAG,CAAC;QACd,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,qBAAqB,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW;QAC9E,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,cAAc;YACpC,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,wBAAwB;gBAC9C,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,oBAAoB,CAAC;IAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO,qBAAqB,OAAO,KAAK,MAAM,KAAK,OAAO,EAAE,CAAC;AAC/D,CAAC"}

package/dist/fleet-vpn.d.ts

@@ -0,0 +1,64 @@
+import { type EnforcementLevel } from "./agent-readiness.js";
+import type { AgentVpnPin } from "./types.js";
+/**
+ * How the fleet shows an agent's VPN facts, shared by the dashboard's Fleet page
+ * and `appforge-admin agents list` so the two surfaces never disagree about what
+ * a feature id means or what "eligible" is. Pure functions and constants only.
+ *
+ * Honesty rule: every sentence here describes what the CONTROL PLANE knows, i.e.
+ * what the Mac reported at its last heartbeat. A feature chip is a claim the
+ * Mac made, not a proof; the scheduler only trusts it while the heartbeat is
+ * fresh (`agentVpnCapabilitiesCurrent`), and the page says so.
+ */
+/** What each VPN feature id means, as a one-sentence legend. */
+export declare const VPN_FEATURE_LEGEND: Readonly<Record<string, string>>;
+/** Legend sentence for a feature id; a short fallback for an id this build does not know. */
+export declare function describeVpnFeature(id: string): string;
+/** What each enforcement level means. */
+export declare const ENFORCEMENT_LEVEL_LEGEND: Readonly<Record<EnforcementLevel, string>>;
+export declare function describeEnforcementLevel(level: unknown): string;
+/**
+ * The VPN eligibility as the scheduler applies it in `/agents/lease-job`: a Mac
+ * serves VPN builds only when it reports the verified helper (`vpnCapable`), a
+ * platform admin approved it (`vpnApproved`), AND the scheduler currently trusts
+ * the helper report (`agentVpnCapabilitiesCurrent`: a VPN-capable agent version
+ * with a recent heartbeat). `vpnCapable` is sticky between heartbeats, so an
+ * offline or too-old Mac can still carry helper=1 + approved=1 yet is never
+ * leased a VPN build; `stale` is true for exactly that case.
+ *
+ * `agentVersion` and `lastSeenAt` are optional only for callers that cannot
+ * supply them (an older API omits them): when either is absent freshness is
+ * unknown and only the helper and approval halves are judged.
+ */
+export declare function vpnEligibility(a: {
+    vpnCapable?: number;
+    vpnApproved?: number;
+    agentVersion?: string | null;
+    lastSeenAt?: string;
+}, now?: Date): {
+    eligible: boolean;
+    stale: boolean;
+    label: string;
+};
+/**
+ * Whether the reported features / enforcement level / runner flag are still
+ * trusted by the scheduler: a VPN-capable agent version with a recent heartbeat.
+ * When false they are the Mac's LAST report and may be out of date (it is
+ * offline, or too old to be leased VPN builds at all).
+ */
+export declare function agentVpnCapabilitiesCurrent(a: {
+    agentVersion: string | null;
+    lastSeenAt: string;
+}, now?: Date): boolean;
+/** The co-hosted GitHub Actions runner flag in words: 1 yes, 0 no, anything else unreported. */
+export declare function describeCoHostedRunner(coHostedRunner: number | null | undefined): "runner co-hosted" | "no runner" | "runner unreported";
+/** Replace C0/C1 control characters (ESC, CSI, newline...) so tenant-chosen text cannot drive a terminal. */
+export declare function stripControlChars(text: string): string;
+/**
+ * An org as a person reads it: its name when known (with the id for disambiguation), else the id.
+ * The name is tenant-controlled (an org owner sets it), so control characters are neutralised.
+ */
+export declare function orgDisplay(orgId: string, orgName: string | null | undefined): string;
+/** One pin as a short phrase: "Acme (org_1) [dedicated]". */
+export declare function describeVpnPin(pin: AgentVpnPin): string;
+//# sourceMappingURL=fleet-vpn.d.ts.map

package/dist/fleet-vpn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-vpn.d.ts","sourceRoot":"","sources":["../src/fleet-vpn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoD,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC/G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;GASG;AAEH,gEAAgE;AAChE,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS/D,CAAC;AAEF,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,yCAAyC;AACzC,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAI/E,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EACnG,GAAG,GAAE,IAAiB,GACrB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAStD;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE;IAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAEnI;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,kBAAkB,GAAG,WAAW,GAAG,mBAAmB,CAIxI;AAED,6GAA6G;AAC7G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEpF;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAEvD"}

package/dist/fleet-vpn.js

@@ -0,0 +1,88 @@
+import { agentProvesVpnEnforcement, parseEnforcementLevel } from "./agent-readiness.js";
+/**
+ * How the fleet shows an agent's VPN facts, shared by the dashboard's Fleet page
+ * and `appforge-admin agents list` so the two surfaces never disagree about what
+ * a feature id means or what "eligible" is. Pure functions and constants only.
+ *
+ * Honesty rule: every sentence here describes what the CONTROL PLANE knows, i.e.
+ * what the Mac reported at its last heartbeat. A feature chip is a claim the
+ * Mac made, not a proof; the scheduler only trusts it while the heartbeat is
+ * fresh (`agentVpnCapabilitiesCurrent`), and the page says so.
+ */
+/** What each VPN feature id means, as a one-sentence legend. */
+export const VPN_FEATURE_LEGEND = {
+    "egress-policy-v1": "The verified VPN helper enforces a strict egress allow-list for builds (it refuses everything outside the tunnel's policy). Reported only while a helper of a new enough version is installed and verified.",
+    "ssh-v1": "Git and ssh traffic can be routed through the tunnel with pinned host keys (the verified helper has the connect subcommand). Reported only while that helper is installed and verified.",
+    "sandbox-v1": "Build processes run under a kernel (Seatbelt) sandbox. Reported only while the on-host sandbox self-test has passed recently; a failed or stale self-test withdraws it.",
+    "evidence-v1": "Per-build connection evidence: the verified helper streams per-connection records and the agent reports them after each strict-egress or regulated build, so the control plane can issue a signed attestation. Reported only while a helper with per-build credentials and the accounting pipe is installed and verified.",
+};
+/** Legend sentence for a feature id; a short fallback for an id this build does not know. */
+export function describeVpnFeature(id) {
+    return VPN_FEATURE_LEGEND[id] ?? "A feature id this dashboard does not know (reported by the agent; no description).";
+}
+/** What each enforcement level means. */
+export const ENFORCEMENT_LEVEL_LEGEND = {
+    none: "No kernel-enforced isolation of build processes.",
+    sandbox: "Builds run under a kernel (Seatbelt) sandbox profile whose self-test passed on this Mac. Not a dedicated OS user.",
+    sandbox_uid: "The sandbox plus a dedicated unprivileged OS user for builds.",
+};
+export function describeEnforcementLevel(level) {
+    return ENFORCEMENT_LEVEL_LEGEND[parseEnforcementLevel(level)];
+}
+/**
+ * The VPN eligibility as the scheduler applies it in `/agents/lease-job`: a Mac
+ * serves VPN builds only when it reports the verified helper (`vpnCapable`), a
+ * platform admin approved it (`vpnApproved`), AND the scheduler currently trusts
+ * the helper report (`agentVpnCapabilitiesCurrent`: a VPN-capable agent version
+ * with a recent heartbeat). `vpnCapable` is sticky between heartbeats, so an
+ * offline or too-old Mac can still carry helper=1 + approved=1 yet is never
+ * leased a VPN build; `stale` is true for exactly that case.
+ *
+ * `agentVersion` and `lastSeenAt` are optional only for callers that cannot
+ * supply them (an older API omits them): when either is absent freshness is
+ * unknown and only the helper and approval halves are judged.
+ */
+export function vpnEligibility(a, now = new Date()) {
+    const helper = a.vpnCapable === 1;
+    const approved = a.vpnApproved === 1;
+    if (helper && approved) {
+        const stale = a.agentVersion !== undefined && a.lastSeenAt !== undefined && !agentVpnCapabilitiesCurrent({ agentVersion: a.agentVersion, lastSeenAt: a.lastSeenAt }, now);
+        if (stale)
+            return { eligible: false, stale: true, label: "not eligible now, helper report stale (offline or old agent)" };
+        return { eligible: true, stale: false, label: "eligible" };
+    }
+    return { eligible: false, stale: false, label: `${helper ? "helper ready" : "no helper"}, ${approved ? "approved" : "not approved"}` };
+}
+/**
+ * Whether the reported features / enforcement level / runner flag are still
+ * trusted by the scheduler: a VPN-capable agent version with a recent heartbeat.
+ * When false they are the Mac's LAST report and may be out of date (it is
+ * offline, or too old to be leased VPN builds at all).
+ */
+export function agentVpnCapabilitiesCurrent(a, now = new Date()) {
+    return agentProvesVpnEnforcement(a, now);
+}
+/** The co-hosted GitHub Actions runner flag in words: 1 yes, 0 no, anything else unreported. */
+export function describeCoHostedRunner(coHostedRunner) {
+    if (coHostedRunner === 1)
+        return "runner co-hosted";
+    if (coHostedRunner === 0)
+        return "no runner";
+    return "runner unreported";
+}
+/** Replace C0/C1 control characters (ESC, CSI, newline...) so tenant-chosen text cannot drive a terminal. */
+export function stripControlChars(text) {
+    return text.replace(/[\x00-\x1f\x7f-\x9f]/g, "\uFFFD");
+}
+/**
+ * An org as a person reads it: its name when known (with the id for disambiguation), else the id.
+ * The name is tenant-controlled (an org owner sets it), so control characters are neutralised.
+ */
+export function orgDisplay(orgId, orgName) {
+    return orgName ? `${stripControlChars(orgName)} (${orgId})` : orgId;
+}
+/** One pin as a short phrase: "Acme (org_1) [dedicated]". */
+export function describeVpnPin(pin) {
+    return `${orgDisplay(pin.orgId, pin.orgName)} [${pin.hostPolicy}]`;
+}
+//# sourceMappingURL=fleet-vpn.js.map

package/dist/fleet-vpn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-vpn.js","sourceRoot":"","sources":["../src/fleet-vpn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAyB,MAAM,sBAAsB,CAAC;AAG/G;;;;;;;;;GASG;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAqC;IAClE,kBAAkB,EAChB,6MAA6M;IAC/M,QAAQ,EACN,yLAAyL;IAC3L,YAAY,EACV,yKAAyK;IAC3K,aAAa,EACX,2TAA2T;CAC9T,CAAC;AAEF,6FAA6F;AAC7F,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,OAAO,kBAAkB,CAAC,EAAE,CAAC,IAAI,oFAAoF,CAAC;AACxH,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,wBAAwB,GAA+C;IAClF,IAAI,EAAE,kDAAkD;IACxD,OAAO,EAAE,mHAAmH;IAC5H,WAAW,EAAE,+DAA+D;CAC7E,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,CAAmG,EACnG,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,2BAA2B,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1K,IAAI,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC;QAC1H,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;AACzI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAsD,EAAE,MAAY,IAAI,IAAI,EAAE;IACxH,OAAO,yBAAyB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,cAAyC;IAC9E,IAAI,cAAc,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACpD,IAAI,cAAc,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC7C,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,OAAkC;IAC1E,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,GAAgB;IAC7C,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,UAAU,GAAG,CAAC;AACrE,CAAC"}

package/dist/fleet-vpn.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=fleet-vpn.test.d.ts.map

package/dist/fleet-vpn.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-vpn.test.d.ts","sourceRoot":"","sources":["../src/fleet-vpn.test.ts"],"names":[],"mappings":""}

package/dist/fleet-vpn.test.js

@@ -0,0 +1,69 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { ENFORCEMENT_LEVELS, KNOWN_VPN_FEATURES, MIN_VPN_AGENT_VERSION, VPN_CAPABILITY_MAX_AGE_SECONDS, VPN_FEATURE_LEGEND, agentVpnCapabilitiesCurrent, describeCoHostedRunner, describeEnforcementLevel, describeVpnFeature, describeVpnPin, orgDisplay, vpnEligibility, } from "./index.js";
+test("every feature id the program introduces has a legend sentence, and an unknown id gets an honest fallback", () => {
+    for (const id of KNOWN_VPN_FEATURES) {
+        assert.ok(VPN_FEATURE_LEGEND[id] && VPN_FEATURE_LEGEND[id].length > 20, `no legend for ${id}`);
+        assert.equal(describeVpnFeature(id), VPN_FEATURE_LEGEND[id]);
+    }
+    assert.match(describeVpnFeature("future-thing-v9"), /does not know/);
+});
+test("the legend does not claim compliance, certification or attestation properties the code does not give", () => {
+    const all = [...Object.values(VPN_FEATURE_LEGEND), ...ENFORCEMENT_LEVELS.map(describeEnforcementLevel)].join("\n");
+    assert.ok(!/SOC ?2|FIPS|complian|certif|bank-grade|secure|guarantee/i.test(all), all);
+});
+test("every enforcement level has a description; an unrecognised level reads as none", () => {
+    for (const level of ENFORCEMENT_LEVELS)
+        assert.ok(describeEnforcementLevel(level).length > 10);
+    assert.equal(describeEnforcementLevel("root"), describeEnforcementLevel("none"));
+    assert.equal(describeEnforcementLevel(undefined), describeEnforcementLevel("none"));
+});
+test("vpnEligibility is eligible only with BOTH the helper and the admin approval, and spells out the missing half otherwise", () => {
+    assert.deepEqual(vpnEligibility({ vpnCapable: 1, vpnApproved: 1 }), { eligible: true, stale: false, label: "eligible" });
+    assert.deepEqual(vpnEligibility({ vpnCapable: 1, vpnApproved: 0 }), { eligible: false, stale: false, label: "helper ready, not approved" });
+    assert.deepEqual(vpnEligibility({ vpnCapable: 0, vpnApproved: 1 }), { eligible: false, stale: false, label: "no helper, approved" });
+    assert.deepEqual(vpnEligibility({}), { eligible: false, stale: false, label: "no helper, not approved" });
+});
+test("vpnEligibility is not eligible (stale) for an approved helper Mac that is offline or too old, as the scheduler refuses it", () => {
+    const now = new Date("2026-10-03T12:00:00Z");
+    const seen = (secondsAgo) => new Date(now.getTime() - secondsAgo * 1000).toISOString();
+    const base = { vpnCapable: 1, vpnApproved: 1 };
+    assert.equal(vpnEligibility({ ...base, agentVersion: "0.3.0", lastSeenAt: seen(5) }, now).eligible, true);
+    for (const r of [
+        vpnEligibility({ ...base, agentVersion: "0.3.0", lastSeenAt: seen(VPN_CAPABILITY_MAX_AGE_SECONDS + 5) }, now),
+        vpnEligibility({ ...base, agentVersion: "0.1.9", lastSeenAt: seen(5) }, now),
+        vpnEligibility({ ...base, agentVersion: null, lastSeenAt: seen(5) }, now),
+    ]) {
+        assert.equal(r.eligible, false);
+        assert.equal(r.stale, true);
+        assert.match(r.label, /stale/);
+    }
+});
+test("agentVpnCapabilitiesCurrent follows the scheduler's proof: a VPN-capable version and a recent heartbeat", () => {
+    const now = new Date("2026-10-03T12:00:00Z");
+    const seen = (secondsAgo) => new Date(now.getTime() - secondsAgo * 1000).toISOString();
+    assert.equal(agentVpnCapabilitiesCurrent({ agentVersion: "0.3.0", lastSeenAt: seen(5) }, now), true);
+    assert.equal(agentVpnCapabilitiesCurrent({ agentVersion: "0.3.0", lastSeenAt: seen(VPN_CAPABILITY_MAX_AGE_SECONDS + 5) }, now), false);
+    assert.equal(agentVpnCapabilitiesCurrent({ agentVersion: null, lastSeenAt: seen(5) }, now), false);
+    assert.equal(agentVpnCapabilitiesCurrent({ agentVersion: "0.1.9", lastSeenAt: seen(5) }, now), false);
+    assert.equal(agentVpnCapabilitiesCurrent({ agentVersion: MIN_VPN_AGENT_VERSION, lastSeenAt: seen(5) }, now), true);
+});
+test("the co-hosted runner flag reads yes / no / unreported, and null or undefined are never 'no runner'", () => {
+    assert.equal(describeCoHostedRunner(1), "runner co-hosted");
+    assert.equal(describeCoHostedRunner(0), "no runner");
+    assert.equal(describeCoHostedRunner(null), "runner unreported");
+    assert.equal(describeCoHostedRunner(undefined), "runner unreported");
+});
+test("orgDisplay neutralises control characters in a tenant-chosen org name", () => {
+    const shown = orgDisplay("org_1", "Evil\u001b[2K\u001b]0;pwned\u0007\nName");
+    assert.ok(!/[\x00-\x1f\x7f-\x9f]/.test(shown), JSON.stringify(shown));
+    assert.match(shown, /^Evil.*Name \(org_1\)$/);
+    assert.ok(!/[\x00-\x1f\x7f-\x9f]/.test(describeVpnPin({ orgId: "o", orgName: "a\u001bb", hostPolicy: "pinned" })));
+});
+test("orgDisplay and describeVpnPin show the name with its id, or the bare id when the name does not resolve", () => {
+    assert.equal(orgDisplay("org_1", "Acme"), "Acme (org_1)");
+    assert.equal(orgDisplay("org_1", null), "org_1");
+    assert.equal(describeVpnPin({ orgId: "org_1", orgName: "Acme", hostPolicy: "dedicated" }), "Acme (org_1) [dedicated]");
+    assert.equal(describeVpnPin({ orgId: "org_1", orgName: null, hostPolicy: "pinned" }), "org_1 [pinned]");
+});
+//# sourceMappingURL=fleet-vpn.test.js.map

package/dist/fleet-vpn.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-vpn.test.js","sourceRoot":"","sources":["../src/fleet-vpn.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,8BAA8B,EAC9B,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,IAAI,CAAC,0GAA0G,EAAE,GAAG,EAAE;IACpH,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAE,CAAC,MAAM,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sGAAsG,EAAE,GAAG,EAAE;IAChH,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnH,MAAM,CAAC,EAAE,CAAC,CAAC,0DAA0D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC1F,KAAK,MAAM,KAAK,IAAI,kBAAkB;QAAE,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wHAAwH,EAAE,GAAG,EAAE;IAClI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACzH,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC5I,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACrI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAC5G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2HAA2H,EAAE,GAAG,EAAE;IACrI,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/F,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1G,KAAK,MAAM,CAAC,IAAI;QACd,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,8BAA8B,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC;QAC7G,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC;QAC5E,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC;KAC1E,EAAE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yGAAyG,EAAE,GAAG,EAAE;IACnH,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,8BAA8B,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACvI,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,YAAY,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACrH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oGAAoG,EAAE,GAAG,EAAE;IAC9G,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,yCAAyC,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wGAAwG,EAAE,GAAG,EAAE;IAClH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAC1G,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -2,14 +2,20 @@ export * from "./types.js";
 export * from "./schemas.js";
 export * from "./api-client.js";
 export * from "./agent-readiness.js";
+export * from "./fleet-vpn.js";
 export * from "./ota-rollout.js";
 export * from "./ota-bundle-hash.js";
 export * from "./ota-artifact.js";
 export * from "./vpn-network.js";
 export * from "./vpn-egress.js";
 export * from "./vpn-ssh.js";
+export * from "./vpn-sandbox.js";
+export * from "./ssh-deploy-key.js";
 export * from "./vpn-egress-presets.js";
 export * from "./artifact-upload.js";
 export * from "./build-vpn.js";
 export * from "./attestation.js";
+export * from "./attestation-signing.js";
+export * from "./attestation-keys.js";
+export * from "./vpn-attestation.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC"}

package/dist/index.js

@@ -2,14 +2,20 @@ export * from "./types.js";
 export * from "./schemas.js";
 export * from "./api-client.js";
 export * from "./agent-readiness.js";
+export * from "./fleet-vpn.js";
 export * from "./ota-rollout.js";
 export * from "./ota-bundle-hash.js";
 export * from "./ota-artifact.js";
 export * from "./vpn-network.js";
 export * from "./vpn-egress.js";
 export * from "./vpn-ssh.js";
+export * from "./vpn-sandbox.js";
+export * from "./ssh-deploy-key.js";
 export * from "./vpn-egress-presets.js";
 export * from "./artifact-upload.js";
 export * from "./build-vpn.js";
 export * from "./attestation.js";
+export * from "./attestation-signing.js";
+export * from "./attestation-keys.js";
+export * from "./vpn-attestation.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC"}

package/dist/schemas-repo-url.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schemas-repo-url.test.d.ts.map

package/dist/schemas-repo-url.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas-repo-url.test.d.ts","sourceRoot":"","sources":["../src/schemas-repo-url.test.ts"],"names":[],"mappings":""}

package/dist/schemas-repo-url.test.js

@@ -0,0 +1,67 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createAppSchema, setVpnSshHostsSchema, updateAppSchema } from "./schemas.js";
+const create = (repoUrl) => createAppSchema.safeParse({ name: "a", platform: "flutter", repoUrl });
+const update = (repoUrl) => updateAppSchema.safeParse({ repoUrl });
+// The transport matrix: https as always; ssh syntactically valid (the routes decide whether THIS app may use it).
+const ACCEPTED = [
+    "https://github.com/org/repo",
+    "https://github.com/org/repo.git",
+    "https://git.corp.test:8443/org/repo.git",
+    "ssh://git@git.corp.test/org/repo.git",
+    "ssh://git@10.20.0.5:2222/srv/git/repo.git",
+    "git@git.corp.test:org/repo.git",
+    "git@git.corp.test:/srv/git/repo.git",
+];
+const REJECTED = [
+    "http://github.com/org/repo",
+    "git://github.com/org/repo",
+    "file:///etc/passwd",
+    "/local/path",
+    "ext::sh -c id",
+    "ssh://git.corp.test/org/repo.git", // no user
+    "ssh://git@-oProxyCommand=id/x",
+    "ssh://git@git.corp.test/org/repo.git;id",
+    "git@git.corp.test:org/$(id)",
+    "git@git.corp.test:../x",
+    "git.corp.test:org/repo.git",
+    "git+ssh://git@git.corp.test/org/repo.git",
+    "not a url",
+    "",
+];
+test("repoUrl: https and strictly-formed ssh remotes are accepted by create and update", () => {
+    for (const u of ACCEPTED) {
+        assert.equal(create(u).success, true, `create ${u}`);
+        assert.equal(update(u).success, true, `update ${u}`);
+    }
+});
+test("repoUrl: every other transport and every malformed ssh remote is refused, with a message", () => {
+    for (const u of REJECTED) {
+        const c = create(u);
+        assert.equal(c.success, false, `create ${u}`);
+        assert.equal(update(u).success, false, `update ${u}`);
+        if (!c.success)
+            assert.ok(c.error.issues[0].message.length > 0);
+    }
+    assert.equal(create(42).success, false);
+    assert.equal(create(undefined).success, false);
+});
+test("repoUrl: the https-only wording is kept for an unsupported scheme and mentions the ssh exception", () => {
+    const r = create("git://github.com/org/repo");
+    assert.equal(r.success, false);
+    if (!r.success)
+        assert.match(r.error.issues[0].message, /https:\/\/ URL, or an ssh remote/);
+});
+test("createAppSchema takes an optional useVpn", () => {
+    assert.equal(createAppSchema.safeParse({ name: "a", platform: "ios", repoUrl: "https://github.com/o/r", useVpn: true }).success, true);
+    assert.equal(createAppSchema.safeParse({ name: "a", platform: "ios", repoUrl: "https://github.com/o/r", useVpn: "yes" }).success, false);
+});
+test("setVpnSshHostsSchema bounds the shape only", () => {
+    assert.equal(setVpnSshHostsSchema.safeParse({ knownHosts: [] }).success, true);
+    assert.equal(setVpnSshHostsSchema.safeParse({ knownHosts: ["a b c"] }).success, true);
+    assert.equal(setVpnSshHostsSchema.safeParse({ knownHosts: "text" }).success, false);
+    assert.equal(setVpnSshHostsSchema.safeParse({}).success, false);
+    assert.equal(setVpnSshHostsSchema.safeParse({ knownHosts: Array(513).fill("x") }).success, false);
+    assert.equal(setVpnSshHostsSchema.safeParse({ knownHosts: ["x".repeat(5000)] }).success, false);
+});
+//# sourceMappingURL=schemas-repo-url.test.js.map

package/dist/schemas-repo-url.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas-repo-url.test.js","sourceRoot":"","sources":["../src/schemas-repo-url.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtF,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5G,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAE5E,kHAAkH;AAClH,MAAM,QAAQ,GAAG;IACf,6BAA6B;IAC7B,iCAAiC;IACjC,yCAAyC;IACzC,sCAAsC;IACtC,2CAA2C;IAC3C,gCAAgC;IAChC,qCAAqC;CACtC,CAAC;AACF,MAAM,QAAQ,GAAG;IACf,4BAA4B;IAC5B,2BAA2B;IAC3B,oBAAoB;IACpB,aAAa;IACb,eAAe;IACf,kCAAkC,EAAE,UAAU;IAC9C,+BAA+B;IAC/B,yCAAyC;IACzC,6BAA6B;IAC7B,wBAAwB;IACxB,4BAA4B;IAC5B,0CAA0C;IAC1C,WAAW;IACX,EAAE;CACH,CAAC;AAEF,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0FAA0F,EAAE,GAAG,EAAE;IACpG,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kGAAkG,EAAE,GAAG,EAAE;IAC5G,MAAM,CAAC,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACpD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC3I,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;IACtD,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAClG,CAAC,CAAC,CAAC"}

package/dist/schemas.d.ts

@@ -471,15 +471,20 @@ export declare const createAppSchema: z.ZodObject<{
     platform: z.ZodEnum<["ios", "android", "flutter", "react-native"]>;
     repoUrl: z.ZodEffects<z.ZodString, string, string>;
     defaultBranch: z.ZodDefault<z.ZodString>;
+    /** Build through the org's site-to-site VPN tunnel from the start. Needed to create an app with an ssh
+     *  `repoUrl` (the route requires it, and an owner/admin); the same rules as `PATCH /apps/:appId`'s `useVpn`. */
+    useVpn: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     name: string;
     platform: "ios" | "android" | "flutter" | "react-native";
     repoUrl: string;
     defaultBranch: string;
+    useVpn?: boolean | undefined;
 }, {
     name: string;
     platform: "ios" | "android" | "flutter" | "react-native";
     repoUrl: string;
+    useVpn?: boolean | undefined;
     defaultBranch?: string | undefined;
 }>;
 export declare const updateAppSchema: z.ZodObject<{
@@ -1233,4 +1238,17 @@ export declare const reportVpnEventSchema: z.ZodObject<{
     event: "tunnel_up" | "tunnel_down" | "handshake_ok" | "handshake_failed";
     detail?: string | undefined;
 }>;
+/**
+ * `PUT /orgs/:orgId/vpn/ssh-hosts` (regulated-VPN program, PR-G): replaces the
+ * tunnel's pinned SSH host keys. Only the SHAPE is checked here (bounded array of
+ * bounded strings); the content rules, with their per-line error messages, are
+ * `validateKnownHostsInput` in vpn-ssh.ts, run by the route. `[]` clears them.
+ */
+export declare const setVpnSshHostsSchema: z.ZodObject<{
+    knownHosts: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    knownHosts: string[];
+}, {
+    knownHosts: string[];
+}>;
 //# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,cAAc,0DAAwD,CAAC;AAEpF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwBjC;;;sEAGkE;;IAElE,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO7E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAf/B;;;0EAGkE;;QAElE,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe7E,CAAC;AAgCH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;EAKvB,CAAC;AAEH,eAAO,MAAM,WAAW;;;IAGtB;;;uEAGmE;;IAEnE;;yCAEqC;;;;;;;;;;;;EAErC,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AAEH;;;;;;;;;;;;uEAYuE;AACvE,eAAO,MAAM,iBAAiB;;;;;;;;;EAG5B,CAAC;AAEH;;;4CAG4C;AAC5C,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AAEH;;;;;;;;;;;;;;;4CAe4C;AAC5C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAC;AAEH;;;;;wDAKwD;AACxD,eAAO,MAAM,oBAAoB;;;;;;;;;EAG/B,CAAC;AAEH;;;;;gEAKgE;AAChE,eAAO,MAAM,oBAAoB;;;;;;EAE/B,CAAC;AAEH;;;4BAG4B;AAC5B,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAC;AAuCH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;EAK1B,CAAC;AAKH,eAAO,MAAM,eAAe;;;;IAI1B;;iEAE6D;;;;;;;;;;;;EAE7D,CAAC;AAQH,eAAO,MAAM,eAAe;;;;;;;;;EAU1B,CAAC;AA0EH,eAAO,MAAM,kBAAkB;;;;;;;;;EAiB7B,CAAC;AAiBH,eAAO,MAAM,kBAAkB,0EAA2E,CAAC;AAE3G,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQlE,eAAO,MAAM,oBAAoB;;;;;;;;;EAe/B,CAAC;AAeH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAS7B,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;EAEtB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;EAE/B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;IA4B/B,iDAAiD;;IAEjD;;2EAEuE;;IAEvE;;;;wCAIoC;;IAEpC;;;;qEAIiE;;IAEjE;6DACyD;;IAEzD;;;uEAGmE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEnE,CAAC;AAgBH,eAAO,MAAM,eAAe;;;;;;;;;EAG1B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4B9B,CAAC;AASH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAC;AAOH,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAC;AAEH;;;;;oBAKoB;AACpB,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAC;AAEH;;;;2EAI2E;AAC3E,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAC;AAEH;;;;qDAIqD;AACrD,eAAO,MAAM,0BAA0B;;;;;;EAErC,CAAC;AAEH;;;uEAGuE;AACvE,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAC;AAEH;;;;;oEAKoE;AACpE,eAAO,MAAM,kCAAkC;;;;;;EAE7C,CAAC;AAEH;;;;;;oDAMoD;AACpD,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAC;AAgDH;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IAnCpC,uFAAuF;;;IAGvF,qCAAqC;;IAErC,qGAAqG;;;;;;;;;;;;;;;;;IAqCrG;+DAC2D;;IAE3D;2EACuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGvE,CAAC;AAEH,eAAO,MAAM,yBAAyB;IAnDpC,uFAAuF;;;IAGvF,qCAAqC;;IAErC,qGAAqG;;;;;;;;;;;;;;;IAmDrG,8DAA8D;;;;IAI9D,4EAA4E;;IAE5E;;8CAE0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG1C,CAAC;AAEH,uHAAuH;AACvH,eAAO,MAAM,qBAAqB;IAtEhC,uFAAuF;;;IAGvF,qCAAqC;;IAErC,qGAAqG;;;;;;;;;;;;;;;;;IAqCrG;+DAC2D;;IAE3D;2EACuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwB0B,CAAC;AAEpG,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB;IAzEhC,uFAAuF;;;IAGvF,qCAAqC;;IAErC,qGAAqG;;;;;;;;;;;;;;;IAmDrG,8DAA8D;;;;IAI9D,4EAA4E;;IAE5E;;8CAE0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASuD,CAAC;AAEpG;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;EAShC,CAAC;AAEH;;;;gEAIgE;AAChE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,cAAc,0DAAwD,CAAC;AAEpF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwBjC;;;sEAGkE;;IAElE,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO7E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAf/B;;;0EAGkE;;QAElE,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe7E,CAAC;AAgCH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;EAKvB,CAAC;AAEH,eAAO,MAAM,WAAW;;;IAGtB;;;uEAGmE;;IAEnE;;yCAEqC;;;;;;;;;;;;EAErC,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AAEH;;;;;;;;;;;;uEAYuE;AACvE,eAAO,MAAM,iBAAiB;;;;;;;;;EAG5B,CAAC;AAEH;;;4CAG4C;AAC5C,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AAEH;;;;;;;;;;;;;;;4CAe4C;AAC5C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAC;AAEH;;;;;wDAKwD;AACxD,eAAO,MAAM,oBAAoB;;;;;;;;;EAG/B,CAAC;AAEH;;;;;gEAKgE;AAChE,eAAO,MAAM,oBAAoB;;;;;;EAE/B,CAAC;AAEH;;;4BAG4B;AAC5B,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAC;AAuEH,eAAO,MAAM,eAAe;;;;;IAK1B;oHACgH;;;;;;;;;;;;;;EAEhH,CAAC;AAKH,eAAO,MAAM,eAAe;;;;IAI1B;;iEAE6D;;;;;;;;;;;;EAE7D,CAAC;AAQH,eAAO,MAAM,eAAe;;;;;;;;;EAU1B,CAAC;AA0EH,eAAO,MAAM,kBAAkB;;;;;;;;;EAiB7B,CAAC;AAiBH,eAAO,MAAM,kBAAkB,0EAA2E,CAAC;AAE3G,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQlE,eAAO,MAAM,oBAAoB;;;;;;;;;EAe/B,CAAC;AAeH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAS7B,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;EAEtB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;EAE/B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;IA4B/B,iDAAiD;;IAEjD;;2EAEuE;;IAEvE;;;;wCAIoC;;IAEpC;;;;qEAIiE;;IAEjE;6DACyD;;IAEzD;;;uEAGmE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEnE,CAAC;AAgBH,eAAO,MAAM,eAAe;;;;;;;;;EAG1B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4B9B,CAAC;AASH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAC;AAOH,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAC;AAEH;;;;;oBAKoB;AACpB,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAC;AAEH;;;;2EAI2E;AAC3E,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAC;AAEH;;;;qDAIqD;AACrD,eAAO,MAAM,0BAA0B;;;;;;EAErC,CAAC;AAEH;;;uEAGuE;AACvE,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAC;AAEH;;;;;oEAKoE;AACpE,eAAO,MAAM,kCAAkC;;;;;;EAE7C,CAAC;AAEH;;;;;;oDAMoD;AACpD,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAC;AAgDH;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IAnCpC,uFAAuF;;;IAGvF,qCAAqC;;IAErC,qGAAqG;;;;;;;;;;;;;;;;;IAqCrG;+DAC2D;;IAE3D;2EACuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGvE,CAAC;AAEH,eAAO,MAAM,yBAAyB;IAnDpC,uFAAuF;;;IAGvF,qCAAqC;;IAErC,qGAAqG;;;;;;;;;;;;;;;IAmDrG,8DAA8D;;;;IAI9D,4EAA4E;;IAE5E;;8CAE0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG1C,CAAC;AAEH,uHAAuH;AACvH,eAAO,MAAM,qBAAqB;IAtEhC,uFAAuF;;;IAGvF,qCAAqC;;IAErC,qGAAqG;;;;;;;;;;;;;;;;;IAqCrG;+DAC2D;;IAE3D;2EACuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwB0B,CAAC;AAEpG,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB;IAzEhC,uFAAuF;;;IAGvF,qCAAqC;;IAErC,qGAAqG;;;;;;;;;;;;;;;IAmDrG,8DAA8D;;;;IAI9D,4EAA4E;;IAE5E;;8CAE0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASuD,CAAC;AAEpG;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;EAShC,CAAC;AAEH;;;;gEAIgE;AAChE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AAGH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;EAE/B,CAAC"}

package/dist/schemas.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { ENFORCEMENT_LEVELS, MAX_VPN_FEATURES, VPN_FEATURE_ID_PATTERN, VPN_HOST_POLICIES } from "./agent-readiness.js";
+import { looksLikeSshGitRemote, MAX_KNOWN_HOSTS_LINE_LENGTH, parseGitRemote } from "./vpn-ssh.js";
 import { VPN_COMPLIANCE_MODES, VPN_EGRESS_MAX_CUSTOM_RULES, VPN_EGRESS_MAX_PRESETS, validateEgressSettings } from "./vpn-egress-presets.js";
 export const platformSchema = z.enum(["ios", "android", "flutter", "react-native"]);
 export const appforgeWorkflowSchema = z.object({
@@ -190,22 +191,58 @@ export const resetPasswordSchema = z.object({
 // transport ever reaches a real `git clone` on shared, multi-tenant
 // infrastructure (`agents.ts`'s own docblock: "the fleet is a shared
 // pool... not one Mac mini per customer"). This product only ever
-// integrates public GitHub repos over HTTPS (no SSH-deploy-key feature
-// exists anywhere in this codebase), so restricting to exactly `https:`
-// isn't just "safe enough," it's the only scheme any legitimate caller
-// ever needs. See `packages/agent/src/lib/builder.ts`'s own `runScript`
-// git-clone call for the matching defense-in-depth restriction applied
-// at the point of the actual clone, in case a repoUrl ever reaches the
+// integrates public GitHub repos over HTTPS, and a private git server only
+// through a customer's site-to-site VPN tunnel (see below), so the set of
+// transports is exactly those two. See `packages/agent/src/lib/builder.ts`'s own
+// `runScript` git-clone call for the matching defense-in-depth restriction
+// applied at the point of the actual clone, in case a repoUrl ever reaches the
 // agent by some path other than this schema.
-const repoUrlSchema = z
-    .string()
-    .url()
-    .refine((v) => new URL(v).protocol === "https:", "must be an https:// URL — no other transport (file:, ext:, ssh:, git:, ...) is supported");
+//
+// Regulated-VPN program, PR-G: an `ssh://user@host[:port]/path` or scp-like
+// `user@host:path` remote is now SYNTACTICALLY accepted (strict grammar, see
+// `parseGitRemote` in vpn-ssh.ts: a user is required, the host is a DNS name or
+// IPv4 address, nothing an ssh client could read as an option or a command).
+// That is only the shape check. Whether THIS app may use one is a cross-resource
+// rule this schema cannot know and the routes enforce (`POST /orgs/:orgId/apps`,
+// `PATCH /apps/:appId`): the app must use the org's VPN tunnel, the tunnel must
+// not be disabled and must have pinned SSH host keys, and the change needs an org
+// owner/admin. The lease re-checks all of it, and the agent clones an ssh remote
+// only through the build's pinned-host-key ssh config (never directly, never over
+// https instead). `file:`, `git:`, `ext::`, plain `http:` and every other scheme
+// stay refused.
+const repoUrlSchema = z.string().superRefine((v, ctx) => {
+    if (looksLikeSshGitRemote(v)) {
+        if (parseGitRemote(v)?.kind !== "ssh") {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "not a valid ssh remote: use ssh://user@host[:port]/path or user@host:path (a user name is required; the host is a DNS name or IPv4 address)",
+            });
+        }
+        return;
+    }
+    let protocol = null;
+    try {
+        protocol = new URL(v).protocol;
+    }
+    catch {
+        ctx.addIssue({ code: z.ZodIssueCode.invalid_string, validation: "url", message: "Invalid url" });
+        return;
+    }
+    if (protocol !== "https:") {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "must be an https:// URL, or an ssh remote for an app that builds through a VPN tunnel with SSH host keys — no other transport (file:, ext:, git:, http:, ...) is supported",
+        });
+    }
+});
 export const createAppSchema = z.object({
     name: z.string().min(1).max(255, "must be at most 255 characters"),
     platform: platformSchema,
     repoUrl: repoUrlSchema,
     defaultBranch: z.string().min(1).default("main"),
+    /** Build through the org's site-to-site VPN tunnel from the start. Needed to create an app with an ssh
+     *  `repoUrl` (the route requires it, and an owner/admin); the same rules as `PATCH /apps/:appId`'s `useVpn`. */
+    useVpn: z.boolean().optional(),
 });
 // `platform` is deliberately excluded — see updateApp's own docblock in
 // packages/db/src/apps.ts. Every field optional; the route only applies
@@ -699,4 +736,13 @@ export const reportVpnEventSchema = z.object({
     event: z.enum(["tunnel_up", "tunnel_down", "handshake_ok", "handshake_failed"]),
     detail: z.string().max(300).optional(),
 });
+/**
+ * `PUT /orgs/:orgId/vpn/ssh-hosts` (regulated-VPN program, PR-G): replaces the
+ * tunnel's pinned SSH host keys. Only the SHAPE is checked here (bounded array of
+ * bounded strings); the content rules, with their per-line error messages, are
+ * `validateKnownHostsInput` in vpn-ssh.ts, run by the route. `[]` clears them.
+ */
+export const setVpnSshHostsSchema = z.object({
+    knownHosts: z.array(z.string().max(MAX_KNOWN_HOSTS_LINE_LENGTH * 2)).max(512),
+});
 //# sourceMappingURL=schemas.js.map