@chilkat/react-native 11.6.1

package/src/specs/SshTunnel.nitro.ts

@@ -0,0 +1,1243 @@
+// Generated by ReactNativeNs.RnGenerator -- do not edit.
+import type { HybridObject } from 'react-native-nitro-modules'
+import type { JsonObject } from './JsonObject.nitro'
+import type { SecureString } from './SecureString.nitro'
+import type { Ssh } from './Ssh.nitro'
+import type { SshKey } from './SshKey.nitro'
+
+/**
+ * Create SSH tunnels for secure local, fixed-destination, dynamic, and multi-hop forwarding.
+ *
+ * `SshTunnel` creates SSH tunnels for forwarding local
+ * client connections through an SSH server to a destination service, such as a
+ * database server or other TCP service. It supports fixed destination
+ * forwarding, dynamic SOCKS-style port forwarding, password and public-key
+ * authentication, keyboard-interactive authentication, proxy connections to the
+ * SSH server, multi-hop SSH connections, background accept threads,
+ * tunnel/client logging, secure secret lookup, and connection diagnostics.
+ *
+ * **Local port forwarding**
+ *
+ * Listen on a local port and forward accepted client connections through an
+ * SSH server to a configured destination host and port.
+ *
+ * **Dynamic forwarding**
+ *
+ * Enable SOCKS-style dynamic port forwarding when each client connection
+ * should choose its own destination through the tunnel.
+ *
+ * **SSH authentication**
+ *
+ * Authenticate to the SSH server using passwords, public keys,
+ * password-plus-key, secure password lookup, or keyboard-interactive
+ * authentication.
+ *
+ * **Proxy and multi-hop access**
+ *
+ * Reach the SSH server through HTTP or SOCKS proxies, or build tunnels
+ * through an existing SSH connection for multi-hop scenarios.
+ *
+ * **Accept and manage clients**
+ *
+ * Start accepting client connections in the background, inspect current
+ * state, stop accepting new clients, and disconnect active tunnel clients.
+ *
+ * **Logging and diagnostics**
+ *
+ * Use accept logs, tunnel logs, current-state XML, and
+ * `LastErrorText` to troubleshoot SSH connection, forwarding,
+ * authentication, or client-connection problems.
+ *
+ * **Common pattern:**
+ * Configure the SSH server, authentication method, local listen settings, and
+ * destination forwarding options, then call `BeginAccepting` to
+ * start the tunnel. Local client applications connect to the tunnel's listen
+ * port, and `SshTunnel` forwards the traffic through SSH. Use
+ * `SshTunnel` for port forwarding; use
+ * `Chilkat.Ssh` for direct SSH sessions, commands, channels, and
+ * shell access.
+ *
+ * **Start with the SSH Tunneling Guide**
+ *
+ * Learn how static forwarding, dynamic SOCKS forwarding, multi-hop tunneling,
+ * proxies, background threads, lifecycle management, and troubleshooting fit
+ * together.
+ *
+ * [Open the SshTunnel Guide](https://www.chilkatsoft.com/sshtunnel_index.asp)
+ *
+ * A shorter API-focused introduction is also available in the
+ * [SshTunnel Class Overview](https://www.chilkatsoft.com/sshtunnel_class_overview.asp).
+ *
+ * Each `SshTunnel` instance owns a native Chilkat object. It is released when the JavaScript object
+ * is
+ * garbage collected, or immediately by `dispose()`; any use after `dispose()` throws.
+ * Create one with `new SshTunnel()`.
+ *
+ * Methods that can take a while (network, files, compression, key generation) also have an
+ * `...Async` form returning a `Promise`; it runs on a native worker thread so the UI keeps
+ * rendering. While such a call is pending, every other call on this object throws, except
+ * {@link SshTunnel.abort} and assigning {@link SshTunnel.onPercentDone} / {@link
+ * SshTunnel.onProgressInfo}.
+ */
+export interface SshTunnel extends HybridObject<{ ios: 'c++', android: 'c++' }> {
+  // ---- Properties ----
+
+  /**
+   * Provides HTML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorHtml: string
+
+  /**
+   * Provides plain text information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorText: string
+
+  /**
+   * Provides XML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorXml: string
+
+  /**
+   * Version of the component/library, such as "10.1.0"
+   *
+   * This property is read-only.
+   */
+  readonly version: string
+
+  /**
+   * If set to a file path, this property logs the LastErrorText of each Chilkat method or property
+   * call to the specified file. This logging helps identify the context and history of Chilkat
+   * calls leading up to any crash or hang, aiding in debugging.
+   *
+   * Enabling the VerboseLogging property provides more detailed information.
+   *
+   * This property is mainly used for debugging rare instances where a Chilkat method call causes a
+   * hang or crash, which should generally not happen.
+   *
+   * Possible causes of hangs include:
+   *
+   * - A timeout property set to 0, indicating an infinite timeout.
+   *
+   * - A hang occurring within an event callback in the application code.
+   *
+   * - An internal bug in the Chilkat code causing the hang.
+   */
+  debugLogFilePath: string
+
+  /**
+   * If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may
+   * contain more verbose information. The default value is `false`. Verbose logging should only be
+   * used for debugging. The potentially large quantity of logged information may adversely affect
+   * peformance.
+   */
+  verboseLogging: boolean
+
+  /**
+   * Indicates the success or failure of the most recent method call: `true` means success, `false`
+   * means failure. This property remains unchanged by property setters or getters. This method is
+   * present to address challenges in checking for null or Nothing returns in certain programming
+   * languages. Note: This property does not apply to methods that return integer values or to
+   * boolean-returning methods where the boolean does not indicate success or failure.
+   */
+  lastMethodSuccess: boolean
+
+  /**
+   * Contains the in-memory activity log for the background listener thread started by
+   * {@link SshTunnel.beginAccepting}.
+   *
+   * The log is populated only when
+   * {@link SshTunnel.keepAcceptLog} is
+   * `_TRUE_`.
+   */
+  acceptLog: string
+
+  /**
+   * Specifies the local file path where activity from the background listener thread
+   * is written.
+   *
+   * This file-based log is separate from the in-memory
+   * {@link SshTunnel.acceptLog}.
+   */
+  acceptLogPath: string
+
+  /**
+   * Specifies the maximum number of milliseconds allowed for establishing the SSH
+   * connection.
+   *
+   * - The default value is `30000` milliseconds (30 seconds).
+   *
+   * - A value of `0` disables the connection timeout and allows an unlimited wait.
+   *
+   * The timeout applies to more than the initial TCP connection. It also covers
+   * connection setup performed through an HTTP or SOCKS proxy and waiting for the
+   * SSH server identification string after the TCP connection has been established.
+   */
+  connectTimeoutMs: number
+
+  /**
+   * Specifies the destination hostname or IP address for fixed-destination port
+   * forwarding. This is typically the host running the database server or other TCP
+   * service that local clients need to reach.
+   *
+   * The destination is interpreted from the SSH server's network environment. For
+   * example, `localhost` and `127.0.0.1` refer to the SSH
+   * server itself, not the computer running the application. Hostname resolution is
+   * therefore performed as part of the forwarding request on the SSH-server side.
+   *
+   * Traffic accepted by the local listener is carried through SSH, forwarded by the
+   * SSH server to this destination, and returned through the same tunnel.
+   *
+   * This property is ignored when
+   * {@link SshTunnel.dynamicPortForwarding}
+   * is `_TRUE_`. Changing the destination while the listener is
+   * running affects new clients only; existing clients remain connected to the
+   * destination selected when they were accepted.
+   */
+  destHostname: string
+
+  /**
+   * Specifies the TCP port of the destination service used for fixed-destination
+   * forwarding, such as the port of a database server.
+   *
+   * It is used together with
+   * {@link SshTunnel.destHostname} and is ignored
+   * when
+   * {@link SshTunnel.dynamicPortForwarding}
+   * is `_TRUE_`.
+   */
+  destPort: number
+
+  /**
+   * Controls whether the listener performs fixed-destination or dynamic port
+   * forwarding.
+   *
+   * -
+   * When `_FALSE_` (the default), every accepted connection is
+   * forwarded to
+   * {@link SshTunnel.destHostname} and
+   * {@link SshTunnel.destPort}.
+   *
+   * -
+   * When `_TRUE_`, the listener acts as a SOCKS proxy and each
+   * inbound client supplies its own destination.
+   *
+   * The SOCKS version is detected independently from each inbound client handshake;
+   * there is no separate inbound SOCKS-version property. SOCKS4 and SOCKS5
+   * `CONNECT` requests are supported. SOCKS5 `BIND` and
+   * UDP association are not supported.
+   *
+   * Leave
+   * {@link SshTunnel.inboundSocksUsername}
+   * empty to allow SOCKS5 clients to use the no-authentication method. Set the
+   * inbound username and password to require SOCKS5 username/password
+   * authentication. For SOCKS4, only the user ID can be checked because SOCKS4 has
+   * no password field.
+   *
+   * SOCKS4a hostname-form requests are not supported. Use a numeric IPv4 address
+   * with SOCKS4, or use SOCKS5 when the client needs to supply a domain name.
+   */
+  dynamicPortForwarding: boolean
+
+  /**
+   * Specifies the authentication method to use when the outbound connection to the
+   * SSH server passes through an HTTP proxy that requires authentication.
+   *
+   * Valid values are `Basic` and `NTLM`.
+   *
+   * If {@link SshTunnel.socksVersion} is set to `4` or `5`, the SOCKS proxy takes precedence and
+   * these HTTP proxy settings are ignored. The proxies are not chained.
+   */
+  httpProxyAuthMethod: string
+
+  /**
+   * Specifies the optional Windows domain used for NTLM authentication with the HTTP
+   * proxy.
+   *
+   * This applies only to the outbound proxy connection used to reach the SSH server,
+   * and only when
+   * {@link SshTunnel.httpProxyAuthMethod}
+   * is `NTLM`.
+   *
+   * If {@link SshTunnel.socksVersion} is set to `4` or `5`, the SOCKS proxy takes precedence and
+   * these HTTP proxy settings are ignored. The proxies are not chained.
+   */
+  httpProxyDomain: string
+
+  /**
+   * Specifies the hostname or IPv4 address of the HTTP proxy through which the
+   * outbound connection to the SSH server is made.
+   *
+   * Leave this property empty when no HTTP proxy is required.
+   *
+   * If {@link SshTunnel.socksVersion} is set to `4` or `5`, the SOCKS proxy takes precedence and
+   * these HTTP proxy settings are ignored. The proxies are not chained.
+   */
+  httpProxyHostname: string
+
+  /**
+   * Specifies the password used to authenticate with the HTTP proxy for the outbound
+   * connection to the SSH server.
+   *
+   * If {@link SshTunnel.socksVersion} is set to `4` or `5`, the SOCKS proxy takes precedence and
+   * these HTTP proxy settings are ignored. The proxies are not chained.
+   */
+  httpProxyPassword: string
+
+  /**
+   * Specifies the TCP port of the HTTP proxy used for the outbound connection to the
+   * SSH server.
+   *
+   * Common HTTP proxy ports include `8080` and
+   * `3128`.
+   *
+   * If {@link SshTunnel.socksVersion} is set to `4` or `5`, the SOCKS proxy takes precedence and
+   * these HTTP proxy settings are ignored. The proxies are not chained.
+   */
+  httpProxyPort: number
+
+  /**
+   * Specifies the username used to authenticate with the HTTP proxy for the outbound
+   * connection to the SSH server.
+   *
+   * If {@link SshTunnel.socksVersion} is set to `4` or `5`, the SOCKS proxy takes precedence and
+   * these HTTP proxy settings are ignored. The proxies are not chained.
+   */
+  httpProxyUsername: string
+
+  /**
+   * Specifies a stall timeout, in milliseconds, for tunnel data-transfer operations.
+   * The default value is `30000` milliseconds (30 seconds). A value of
+   * `0` disables the timeout.
+   *
+   * This property is not a general inactivity timer for established background
+   * tunnel clients. An otherwise idle client, or a client with data queued while an
+   * SSH channel is flow-controlled, may remain connected beyond this interval.
+   * Applications should not rely on this property to disconnect clients merely
+   * because no application data is flowing.
+   */
+  idleTimeoutMs: number
+
+  /**
+   * Specifies the password required from inbound SOCKS5 clients when
+   * {@link SshTunnel.dynamicPortForwarding}
+   * is `_TRUE_`.
+   *
+   * This property is used together with
+   * {@link SshTunnel.inboundSocksUsername}.
+   * It does not apply to SOCKS4 because the SOCKS4 protocol has no password field.
+   */
+  inboundSocksPassword: string
+
+  /**
+   * Specifies the username required from inbound SOCKS clients when
+   * {@link SshTunnel.dynamicPortForwarding}
+   * is `_TRUE_`.
+   *
+   * - For SOCKS5, setting this property enables username/password authentication.
+   *
+   * - For SOCKS4, the value is compared with the client-supplied user ID.
+   *
+   * - Leave it empty to require no inbound SOCKS username.
+   */
+  inboundSocksUsername: string
+
+  /**
+   * `_TRUE_` when the local listener thread is running and accepting
+   * inbound TCP connections; otherwise `_FALSE_`.
+   *
+   * This property describes only the local listener. It can remain
+   * `_TRUE_` after the SSH connection is lost or after
+   * {@link SshTunnel.closeTunnel} is called. In those
+   * states a client may connect to the local port even though its traffic cannot be
+   * forwarded.
+   *
+   * Use {@link SshTunnel.isSshConnected} separately
+   * when the application also needs to know whether the SSH transport is available.
+   *
+   * This property is read-only.
+   */
+  readonly isAccepting: boolean
+
+  /**
+   * Controls whether activity from the background listener thread is retained in
+   * memory.
+   *
+   * The default value is `_FALSE_`. When enabled, retrieve the log
+   * from {@link SshTunnel.acceptLog}.
+   */
+  keepAcceptLog: boolean
+
+  /**
+   * Controls whether SSH tunnel-thread activity is retained in memory.
+   *
+   * The default value is `_FALSE_`. When enabled, retrieve the log
+   * from {@link SshTunnel.tunnelLog}.
+   */
+  keepTunnelLog: boolean
+
+  /**
+   * Specifies the local IPv4 address to which the tunnel's listening socket is
+   * bound.
+   *
+   * Value
+   * Listener exposure
+   *
+   * | Empty string |
+   * | Binds to `0.0.0.0` and accepts connections on all local IPv4 interfaces, subject to firewall
+   * rules. |
+   *
+   * | `127.0.0.1` |
+   * | Accepts connections only from the local computer through loopback. |
+   *
+   * | A specific local LAN address |
+   * | Accepts connections through that interface only; loopback is not included automatically. |
+   *
+   * For a tunnel intended only for local applications, explicitly set this property
+   * to `127.0.0.1`. Leaving it empty may expose the listening port to
+   * other computers on the network.
+   *
+   * If the value is malformed or is not assigned to a local interface,
+   * {@link SshTunnel.beginAccepting} returns
+   * `_FALSE_` and the bind failure is available in
+   * `LastErrorText` and the accept log.
+   */
+  listenBindIpAddress: string
+
+  /**
+   * Contains the local TCP port used by the listener started by
+   * {@link SshTunnel.beginAccepting}.
+   *
+   * -
+   * If `BeginAccepting` succeeds with a nonzero requested port, this
+   * property contains that port.
+   *
+   * -
+   * If `BeginAccepting` succeeds with `0`, the operating
+   * system chooses an available port and this property contains the allocated port
+   * when the method returns.
+   *
+   * -
+   * After a bind failure for an explicitly requested port, this property may still
+   * contain the requested port even though
+   * {@link SshTunnel.isAccepting} is
+   * `_FALSE_`.
+   *
+   * - The value is initially `0`.
+   *
+   * This property is read-only.
+   */
+  readonly listenPort: number
+
+  /**
+   * Specifies the local IP address to which the outbound socket is bound before
+   * connecting to the SSH server.
+   *
+   * Most applications should leave this property empty. Set it only on a
+   * multihomed computer when the SSH connection must originate from a specific
+   * local network interface or IP address.
+   */
+  outboundBindIpAddress: string
+
+  /**
+   * Specifies the local TCP port to bind before making the outbound connection to
+   * the SSH server.
+   *
+   * The default value is `0`, which allows the operating system to
+   * choose an available ephemeral port. Nearly all applications should leave this
+   * property unchanged.
+   */
+  outboundBindPort: number
+
+  /**
+   * Sets the receive-buffer size for the underlying TCP socket.
+   *
+   * The default value is `4194304` bytes. Normally this property
+   * should remain unchanged. If receive performance is unusually slow, testing a
+   * larger value that is a multiple of `4096` may help.
+   */
+  soRcvBuf: number
+
+  /**
+   * Sets the send-buffer size for the underlying TCP socket.
+   *
+   * The default value is `262144` bytes. Normally this property
+   * should remain unchanged. If send performance is unusually slow, testing values
+   * such as `524288` or `1048576` may help. A
+   * multiple of `4096` is recommended.
+   */
+  soSndBuf: number
+
+  /**
+   * Specifies the hostname or IPv4 address of the outbound SOCKS4 or SOCKS5 proxy
+   * used to reach the SSH server.
+   *
+   * This property is used only when
+   * {@link SshTunnel.socksVersion} is
+   * `4` or `5`.
+   */
+  socksHostname: string
+
+  /**
+   * Specifies the password for authenticating with an outbound SOCKS5 proxy used to
+   * reach the SSH server.
+   *
+   * SOCKS4 does not support password authentication, so this property does not apply
+   * when {@link SshTunnel.socksVersion} is
+   * `4`.
+   */
+  socksPassword: string
+
+  /**
+   * Specifies the TCP port of the outbound SOCKS4 or SOCKS5 proxy used to reach the
+   * SSH server.
+   *
+   * The default value is `1080`. This property is used only when
+   * {@link SshTunnel.socksVersion} is
+   * `4` or `5`.
+   */
+  socksPort: number
+
+  /**
+   * Specifies the username for the outbound SOCKS4 or SOCKS5 proxy used to reach the
+   * SSH server.
+   *
+   * This property is used only when
+   * {@link SshTunnel.socksVersion} is
+   * `4` or `5`.
+   */
+  socksUsername: string
+
+  /**
+   * Selects whether the outbound connection to the SSH server is made through a
+   * SOCKS proxy.
+   *
+   * Value
+   * Behavior
+   *
+   * | `0` |
+   * | Do not use a SOCKS proxy. This is the default. |
+   *
+   * | `4` |
+   * | Connect through a SOCKS4 proxy. |
+   *
+   * | `5` |
+   * | Connect through a SOCKS5 proxy. |
+   *
+   * When this property is `4` or `5`, the SOCKS proxy
+   * settings take precedence over the HTTP proxy settings. The SOCKS and HTTP
+   * proxies are not chained.
+   */
+  socksVersion: number
+
+  /**
+   * Controls the `TCP_NODELAY` socket option for the underlying TCP
+   * connection.
+   *
+   * The default value is `_FALSE_`. Setting it to
+   * `_TRUE_` disables the Nagle algorithm, which can reduce latency
+   * when many small amounts of data are sent.
+   */
+  tcpNoDelay: boolean
+
+  /**
+   * Contains the in-memory activity log for the SSH tunnel and client-manager
+   * threads. The log is populated only when
+   * {@link SshTunnel.keepTunnelLog} is
+   * `_TRUE_`.
+   *
+   * Treat this log as sensitive diagnostic data. It can contain hostnames, ports,
+   * usernames, proxy details, SOCKS handshake information, and authentication
+   * failure values. Do not publish or persist it without reviewing and protecting
+   * its contents.
+   */
+  tunnelLog: string
+
+  /**
+   * Specifies the local file path where SSH tunnel-thread activity is written.
+   *
+   * This file-based log is separate from the in-memory
+   * {@link SshTunnel.tunnelLog}.
+   */
+  tunnelLogPath: string
+
+  /**
+   * Contains the SSH server host-key fingerprint after
+   * {@link SshTunnel.connect} or
+   * {@link SshTunnel.connectThroughSsh}
+   * establishes the SSH connection. The value is available before user
+   * authentication.
+   *
+   * Example:
+   * `ssh-ed25519 256 e0:33:b1:81:a5:c6:9a:d2:2e:c9:d3:15:60:ea:cf:4c`
+   *
+   * Compare this value with a trusted expected fingerprint to verify the identity
+   * of the SSH server. For
+   * {@link SshTunnel.connectThroughSsh}, the
+   * fingerprint is for the final SSH server, not the first-hop server.
+   *
+   * The value may remain populated after
+   * {@link SshTunnel.closeTunnel} or after the
+   * connection is lost. Use
+   * {@link SshTunnel.isSshConnected} to determine
+   * current connection state.
+   *
+   * This property is read-only.
+   */
+  readonly hostKeyFingerprint: string
+
+  /**
+   * Set this property to `_TRUE_` from another thread to request that
+   * the currently running foreground operation be aborted. For example, it can
+   * interrupt a synchronous
+   * {@link SshTunnel.connect} that is waiting for an SSH
+   * server response.
+   *
+   * This property does not stop the background listener or terminate established
+   * background tunnel clients.
+   *
+   * Do not assume the property is automatically reset after an operation is
+   * aborted. It may remain `_TRUE_`; set it back to
+   * `_FALSE_` before starting another operation.
+   */
+  abortCurrent: boolean
+
+  /**
+   * Controls which IP version is preferred when a hostname resolves to both IPv4 and
+   * IPv6 addresses.
+   *
+   * - `_FALSE_` (the default) prefers IPv4.
+   *
+   * - `_TRUE_` prefers IPv6.
+   */
+  preferIpv6: boolean
+
+  /**
+   * Provides optional behavior for uncommon requirements. The default value is an
+   * empty string, which is appropriate for most applications.
+   *
+   * To enable more than one option, provide a comma-separated list of keywords.
+   *
+   * Keyword
+   * Effect
+   *
+   * | `ForceUserAuthRsaSha1` |
+   * | Forces `rsa-sha1` for public-key user authentication. Set this before connecting. Added in
+   * v9.5.0.98. |
+   *
+   * | `NoKeepAliveIgnoreMsg` |
+   * | Disables the default SSH `ignore` message sent every 20 seconds to keep an idle connection
+   * alive. Added in v9.5.0.76. |
+   *
+   * | `no-weak-mac-algs` |
+   * | Removes `hmac-sha1-96`, `hmac-sha1`, `hmac-md5`, and `hmac-ripemd160` from the offered MAC
+   * algorithms. Added in v9.5.0.98. |
+   *
+   * | `ProtectFromVpn` |
+   * | On Android, bypasses an installed or active VPN. Added in v9.5.0.80. |
+   *
+   * | `+ssh-hmac-etm` |
+   * | Re-enables SSH encrypt-then-MAC algorithms that were disabled by default in v9.5.0.97 as part
+   * of the Terrapin mitigation. |
+   *
+   * | `+chacha20-poly1305@openssh.com` |
+   * | Re-enables `chacha20-poly1305@openssh.com`, which was removed from the default offer in
+   * v9.5.0.97 as part of the Terrapin mitigation. |
+   */
+  uncommonOptions: string
+
+  /**
+   * Specifies the SSH client-identification string sent when connecting to the SSH
+   * server.
+   *
+   * Starting in Chilkat v9.5.0.99, the default is
+   * `SSH-2.0-Chilkat_` followed by the Chilkat version number, such
+   * as `SSH-2.0-Chilkat_9.5.0.99`.
+   *
+   * The identifier should begin with `SSH-2.0-`. Some SSH servers
+   * disconnect clients that send an invalid identification string.
+   */
+  clientIdentifier: string
+
+  /**
+   * Specifies the local directory where a separate log file is created for each
+   * tunnel client.
+   *
+   * When this property is not empty, files are named using the pattern
+   * `tunnel_client_log_{random_id}.txt`.
+   */
+  clientLogDir: string
+
+  /**
+   * Enables automatic resolution of credentials from secure storage provided by the
+   * operating system.
+   *
+   * When set to `_TRUE_`, supported password properties and methods
+   * may receive a **secret specification string** beginning with
+   * `!!` instead of a literal password. Chilkat resolves the secret
+   * from:
+   *
+   * - Windows Credential Manager on Windows.
+   *
+   * - Apple Keychain on macOS.
+   *
+   * The specification format is:
+   * `!![appName|]service[|domain]|username`
+   *
+   * This applies to
+   * {@link SshTunnel.httpProxyPassword},
+   * {@link SshTunnel.socksPassword},
+   * {@link SshTunnel.authenticatePw}, and
+   * {@link SshTunnel.authenticatePwPk}.
+   *
+   * The default value is `_FALSE_`.
+   */
+  enableSecrets: boolean
+
+  // ---- Methods ----
+
+  /**
+   * Authenticates with the SSH server using public-key authentication.
+   *
+   * The public key corresponding to `privateKey` must already be
+   * installed for `username` on the SSH server.
+   *
+   * Call {@link SshTunnel.connect} or
+   * {@link SshTunnel.connectThroughSsh}
+   * before calling this method.
+   *
+   * When requesting support for an authentication failure, include the complete
+   * `LastErrorText`.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.authenticatePkAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticatePk(username: string, privateKey: SshKey): void
+
+  /**
+   * Asynchronous form of {@link SshTunnel.authenticatePk}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticatePkAsync(username: string, privateKey: SshKey): Promise<void>
+
+  /**
+   * Authenticates with the SSH server using `login` and
+   * `password`.
+   *
+   * Establish the SSH connection first by calling
+   * {@link SshTunnel.connect} or
+   * {@link SshTunnel.connectThroughSsh}.
+   * After authentication succeeds, call
+   * {@link SshTunnel.beginAccepting} to begin
+   * accepting tunnel clients.
+   *
+   * - A rejected username or password does not close the SSH connection; the application may
+   *   correct the credentials and call this method again.
+   *
+   * - Calling this method again after authentication has already succeeded returns `_FALSE_` with
+   *   an “Already authenticated” error.
+   *
+   * When requesting support for an authentication failure, include the complete
+   * `LastErrorText` captured immediately after the failed call.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.authenticatePwAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticatePw(login: string, password: string): void
+
+  /**
+   * Asynchronous form of {@link SshTunnel.authenticatePw}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticatePwAsync(login: string, password: string): Promise<void>
+
+  /**
+   * Authenticates with an SSH server that requires both a password and a private key.
+   *
+   * The public key corresponding to `privateKey` must already be
+   * installed for `username` on the SSH server. Most SSH servers
+   * require either password authentication or public-key authentication rather than
+   * both.
+   *
+   * When requesting support for an authentication failure, include the complete
+   * `LastErrorText`.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.authenticatePwPkAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticatePwPk(username: string, password: string, privateKey: SshKey): void
+
+  /**
+   * Asynchronous form of {@link SshTunnel.authenticatePwPk}: the same call on a native worker
+   * thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticatePwPkAsync(username: string, password: string, privateKey: SshKey): Promise<void>
+
+  /**
+   * Creates and starts the local listener on `listenPort`.
+   *
+   * The SSH connection must already have been established. Although the listener
+   * can be started before user authentication, clients accepted in that state
+   * cannot be forwarded. The recommended sequence is to connect, authenticate, and
+   * then call this method.
+   *
+   * - The requested port must not already be in use on the selected local interface.
+   *
+   * - Pass `0` to let the operating system choose an available port, then read {@link
+   *   SshTunnel.listenPort}.
+   *
+   * - Calling this method while the listener is already running returns `_FALSE_`.
+   *
+   * The method waits for the initial bind-and-listen result. It returns
+   * `_FALSE_` for errors such as an occupied port, a malformed bind
+   * address, or an address that is not assigned to the local computer. Details are
+   * available immediately in `LastErrorText` and, when enabled, the
+   * accept log.
+   *
+   * A successful return means the listener was bound and started. No additional
+   * fixed delay is required merely to discover an initial bind failure.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.beginAcceptingAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  beginAccepting(listenPort: number): void
+
+  /**
+   * Asynchronous form of {@link SshTunnel.beginAccepting}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  beginAcceptingAsync(listenPort: number): Promise<void>
+
+  /**
+   * Disconnects active tunnel clients and stops the tunnel-manager thread.
+   *
+   * When `waitForThreads` is `_TRUE_`, the method waits
+   * for the client and tunnel-manager threads to exit. It returns
+   * `_FALSE_` if a worker thread does not stop; capture
+   * `LastErrorText` immediately for details.
+   *
+   * This method does not stop the local listener and does not disconnect or reset
+   * the underlying SSH transport. Call
+   * {@link SshTunnel.stopAccepting} separately to
+   * stop accepting local TCP connections. After this method returns, the listener
+   * may still accept a local connection even though the connection cannot be
+   * forwarded.
+   *
+   * Calling this method more than once is allowed. However, it does not reset the
+   * object for a new call to
+   * {@link SshTunnel.connect}. Use a new
+   * `SshTunnel` object when connecting to a different SSH server.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  closeTunnel(waitForThreads: boolean): void
+
+  /**
+   * Establishes the SSH connection that will carry tunneled traffic. This method
+   * performs the TCP or proxy connection, the SSH protocol handshake, and host-key
+   * negotiation, but it does not authenticate the SSH user.
+   *
+   * After connecting, verify
+   * {@link SshTunnel.hostKeyFingerprint}, then
+   * authenticate by calling one of the `Authenticate*` methods. Finally,
+   * call {@link SshTunnel.beginAccepting} to start
+   * the local listener.
+   *
+   * The host-key fingerprint is available immediately after this method succeeds,
+   * before user authentication. Calling `Connect` again while an SSH
+   * tunnel already exists returns `_FALSE_`.
+   *
+   * Chilkat sends an SSH `ignore` message every 20 seconds to help
+   * keep an unused SSH connection alive. To disable this behavior, add
+   * `NoKeepAliveIgnoreMsg` to
+   * {@link SshTunnel.uncommonOptions} before
+   * connecting.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.connectAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  connect(hostname: string, port: number): void
+
+  /**
+   * Asynchronous form of {@link SshTunnel.connect}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  connectAsync(hostname: string, port: number): Promise<void>
+
+  /**
+   * Disconnects all active tunnel clients while leaving the local listener and SSH
+   * connection available.
+   *
+   * When `waitForThreads` is `_TRUE_`, the method waits
+   * for the current client threads to exit before returning. The listener continues
+   * accepting new clients, and newly accepted clients can be forwarded normally.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  disconnectAllClients(waitForThreads: boolean): void
+
+  /**
+   * Stops the local listener so that no new client connections are accepted.
+   * Existing forwarded clients remain connected and continue exchanging data.
+   *
+   * - When `waitForThread` is `_TRUE_`, the method waits for the listener thread to exit before
+   *   returning.
+   *
+   * - When it is `_FALSE_`, shutdown is asynchronous and {@link SshTunnel.isAccepting} may remain
+   *   `_TRUE_` briefly after the method returns.
+   *
+   * Call {@link SshTunnel.beginAccepting} again to
+   * resume accepting connections. The listener can be restarted on the same port
+   * after the previous listener has stopped.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  stopAccepting(waitForThread: boolean): void
+
+  /**
+   * Connects to a second SSH server through the existing connected and authenticated
+   * `Ssh` object supplied in `ssh`.
+   *
+   * ```
+   * application -> first SSH server -> second SSH server
+   * ```
+   *
+   * `hostname` and `port` identify the second SSH server.
+   * After this method succeeds, call an authentication method on this
+   * `SshTunnel` object to authenticate with the second server.
+   *
+   * The supplied `Ssh` object is borrowed, not copied. It must remain
+   * alive, connected, and authenticated for as long as this tunnel is used. If the
+   * first-hop object is disconnected, existing forwarded clients stop working and
+   * new local connections cannot be forwarded. The local listener may nevertheless
+   * remain active until explicitly stopped.
+   *
+   * {@link SshTunnel.hostKeyFingerprint} reports
+   * the fingerprint of the second SSH server. After the connection is established,
+   * fixed forwarding destinations such as `127.0.0.1` are interpreted
+   * from the second server's network environment.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.connectThroughSshAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  connectThroughSsh(ssh: Ssh, hostname: string, port: number): void
+
+  /**
+   * Asynchronous form of {@link SshTunnel.connectThroughSsh}: the same call on a native worker
+   * thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  connectThroughSshAsync(ssh: Ssh, hostname: string, port: number): Promise<void>
+
+  /**
+   * Returns `_TRUE_` when the SSH transport used by this tunnel is
+   * connected; otherwise returns `_FALSE_`.
+   *
+   * This is independent of the local listener state. The listener may still be
+   * accepting local TCP connections when this method returns `_FALSE_`,
+   * but those connections cannot be forwarded until a usable SSH transport exists.
+   *
+   * For a tunnel created with
+   * {@link SshTunnel.connectThroughSsh}, this
+   * method becomes `_FALSE_` when the borrowed first-hop
+   * `Ssh` connection is disconnected.
+   */
+  isSshConnected(): boolean
+
+  /**
+   * Returns an XML snapshot describing the tunnel manager, SSH channels, and current
+   * tunnel clients. The returned data is intended for diagnostics and monitoring.
+   *
+   * A typical result has the following structure:
+   *
+   * ```
+   * _LT_CurrentState_GT_
+   *   _LT_tunnelManager rcvByteCount="433" sndByteCount="34"
+   *       threadRunning="1" dynamicPortForwarding="0"
+   *       staticDestHost="localhost" staticDestPort="18080"_GT_
+   *     _LT_openChannels count="1"_GT_
+   *       _LT_channel num="101" channelType="direct-tcpip"
+   *           clientWinSize="2096927" serverWinSize="2097127" /_GT_
+   *     _LT_/openChannels_GT_
+   *     _LT_closedChannels count="0" /_GT_
+   *   _LT_/tunnelManager_GT_
+   *   _LT_clients count="1"_GT_
+   *     _LT_client destIp="localhost" destPort="18080"
+   *         sshChannelNum="101" threadRunning="1"
+   *         rcvByteCount="25" sndByteCount="225" /_GT_
+   *   _LT_/clients_GT_
+   * _LT_/CurrentState_GT_
+   * ```
+   *
+   * The exact child elements can vary with state. For example, channel collections
+   * may be empty, and some transport details may be omitted before the tunnel is
+   * started or after it stops.
+   *
+   * Section
+   * Information
+   *
+   * | `tunnelManager` |
+   * | Aggregate byte counts, worker-thread state, forwarding mode, and configured fixed
+   * destination. |
+   *
+   * | `openChannels` and `closedChannels` |
+   * | SSH channel numbers, close/EOF flags, packet sizes, and flow-control window sizes. |
+   *
+   * | `clients` |
+   * | Per-client destination, SSH channel number, worker state, age/activity counters, pending-data
+   * flags, and byte counts. |
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  getCurrentState(): string
+
+  /**
+   * Performs the same password authentication as
+   * {@link SshTunnel.authenticatePw}, but receives
+   * the login and password in `SecureString` objects.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.authenticateSecPwAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticateSecPw(login: SecureString, password: SecureString): void
+
+  /**
+   * Asynchronous form of {@link SshTunnel.authenticateSecPw}: the same call on a native worker
+   * thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticateSecPwAsync(login: SecureString, password: SecureString): Promise<void>
+
+  /**
+   * Performs the same combined password-and-private-key authentication as
+   * {@link SshTunnel.authenticatePwPk}, but
+   * receives the username and password in `SecureString` objects.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.authenticateSecPwPkAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticateSecPwPk(username: SecureString, password: SecureString, privateKey: SshKey): void
+
+  /**
+   * Asynchronous form of {@link SshTunnel.authenticateSecPwPk}: the same call on a native worker
+   * thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  authenticateSecPwPkAsync(username: SecureString, password: SecureString, privateKey: SshKey): Promise<void>
+
+  /**
+   * Begins keyboard-interactive authentication for `login`.
+   *
+   * When the server requests one or more responses, the returned XML contains the
+   * request name, instructions, and prompts:
+   *
+   * ```
+   * _LT_infoRequest numPrompts="N"_GT_
+   *   _LT_name_GT_name text_LT_/name_GT_
+   *   _LT_instruction_GT_instruction text_LT_/instruction_GT_
+   *   _LT_prompt1 echo="1_or_0"_GT_prompt text_LT_/prompt1_GT_
+   *   ...
+   *   _LT_promptN echo="1_or_0"_GT_prompt text_LT_/promptN_GT_
+   * _LT_/infoRequest_GT_
+   * ```
+   *
+   * The `echo` attribute indicates whether the response should be
+   * displayed while entered.
+   *
+   * If authentication immediately succeeds or fails without requiring a response,
+   * the returned XML has one of these forms:
+   *
+   * ```
+   * _LT_success_GT_success message_LT_/success_GT_
+   *
+   * _LT_error_GT_error message_LT_/error_GT_
+   * ```
+   *
+   * Pass the requested response or responses to
+   * {@link SshTunnel.continueKeyboardAuth}.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.startKeyboardAuthAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  startKeyboardAuth(login: string): string
+
+  /**
+   * Asynchronous form of {@link SshTunnel.startKeyboardAuth}: the same call on a native worker
+   * thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  startKeyboardAuthAsync(login: string): Promise<string>
+
+  /**
+   * Continues a keyboard-interactive authentication exchange started by
+   * {@link SshTunnel.startKeyboardAuth}.
+   *
+   * If the server requested one response, pass that value directly in
+   * `response`. If it requested multiple responses, pass XML in the
+   * following form:
+   *
+   * ```
+   * _LT_response_GT_
+   *   _LT_response1_GT_response to first prompt_LT_/response1_GT_
+   *   _LT_response2_GT_response to second prompt_LT_/response2_GT_
+   *   ...
+   *   _LT_responseN_GT_response to Nth prompt_LT_/responseN_GT_
+   * _LT_/response_GT_
+   * ```
+   *
+   * When authentication completes, the returned XML indicates success or failure:
+   *
+   * ```
+   * _LT_success_GT_success message_LT_/success_GT_
+   *
+   * _LT_error_GT_error message_LT_/error_GT_
+   * ```
+   *
+   * If another challenge is required, the method returns another
+   * `infoRequest` XML document containing the next set of prompts.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link SshTunnel.continueKeyboardAuthAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  continueKeyboardAuth(response: string): string
+
+  /**
+   * Asynchronous form of {@link SshTunnel.continueKeyboardAuth}: the same call on a native worker
+   * thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link SshTunnel.abort} (which cancels it) and the {@link SshTunnel.onPercentDone} /
+   * {@link SshTunnel.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  continueKeyboardAuthAsync(response: string): Promise<string>
+
+  /**
+   * Restricts the SSH connection to the algorithms specified in
+   * `json`.
+   *
+   * This allows an application to define the exact algorithm set that may be used
+   * during SSH negotiation.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link SshTunnel.lastErrorText}.
+   */
+  setAllowedAlgorithms(json: JsonObject): void
+
+  // ---- Events (ReactNativeGen_DESIGN.md §6) ----
+
+  /**
+   * Called with the percent completed (0..100) while a long-running method runs, when Chilkat
+   * can measure progress. Runs on the JavaScript thread, so it is only useful with the
+   * `...Async` methods (during a synchronous call the thread is busy and the events arrive
+   * after it returns). Assign `undefined` to remove.
+   */
+  onPercentDone?: (pctDone: number) => void
+
+  /**
+   * Called with a name/value pair of progress information while a long-running method runs
+   * (what is reported depends on the class and method). Runs on the JavaScript thread; see
+   * {@link SshTunnel.onPercentDone}. Assign `undefined` to remove.
+   */
+  onProgressInfo?: (name: string, value: string) => void
+
+  /**
+   * Requests that the pending `...Async` call on this object stop at its next progress check.
+   * The promise then rejects with Chilkat's abort error. Chilkat checks at least every
+   * `heartbeatMs` milliseconds on the classes that have that property, so set it (e.g. 250)
+   * for a responsive cancel. Harmless when nothing is pending.
+   */
+  abort(): void
+}