@gjermundgaraba/clankerbox-sdk 0.15.3 → 0.15.4

package/dist/{client-CtI-rSJQ.mjs → client-pUFgD6Xz.mjs}

@@ -129,7 +129,7 @@ const formatId = (host, name) => {
 };
 //#endregion
 //#region package.json
-var version$1 = "0.15.3";
+var version$1 = "0.15.4";
 //#endregion
 //#region src/resources.ts
 /** The resources a host reports: machines, checkpoints and the host itself. */

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { A as Invalid, C as ClankerboxError, D as HostError, E as ErrorTag, M as Precondition, N as Unavailable, O as HostErrorTag, P as hostErrors, S as Capacity, T as ConflictKind, _ as Setup, b as release, c as ActionRecord, d as Host, f as Limit, g as Runtime, h as Profile, i as Interface, j as NotFound, k as Internal, l as Checkpoint, m as MachineSpec, n as CreateOptions, o as client_d_exports, p as Machine, s as ActionName, u as CreateRequest, v as SshEndpoint, w as Conflict, x as version, y as SshLogin } from "./client-Cn1bj4It.mjs";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
-import { Duration, Effect, FileSystem, Path, PlatformError, Schema } from "effect";
+import { Duration, Effect, FileSystem, Path, PlatformError, Schema, Scope } from "effect";
 //#region src/api.d.ts
 /**
  * How long a client waits for a read's reply from one host, unless it sets its own. A host
@@ -381,6 +381,28 @@ export declare const packRecipe: (directory: string) => Effect.Effect<string, In
 /** Reads a setup: a script file's text, or a recipe directory packed into one script. */
 export declare const readSetup: (path: string) => Effect.Effect<string, Invalid, FileSystem.FileSystem>;
 //#endregion
+//#region src/ssh.d.ts
+/** What ssh needs of a machine: where it is reached, as whom, and the host key to pin. */
+export interface SshTarget {
+  readonly id: string;
+  readonly login: SshLogin;
+  readonly hostKey: string;
+}
+/**
+ * The machine's SSH target, or what it lacks: an endpoint, which only a running machine has, or
+ * a host key, which preparation records.
+ */
+export declare const sshTarget: (machine: Machine) => SshTarget | {
+  readonly lacks: "SSH endpoint" | "SSH host key on record";
+};
+/**
+ * Writes a one-line known-hosts file pinning the target's host key, and returns the arguments
+ * that run ssh against it with strict host key checking, as `user`. The file lasts as long as
+ * the scope, which must outlast the ssh it is for. Ports change on fork and restore, and on
+ * boat at every start, so a target is read anew for each ssh.
+ */
+export declare const pinnedSsh: (target: SshTarget, user: string, extra: ReadonlyArray<string>) => Effect.Effect<Array<string>, PlatformError.PlatformError, FileSystem.FileSystem | Path.Path | Scope.Scope>;
+//#endregion
 //#region src/text.d.ts
 /**
  * A RAM size, exactly, as a size flag takes one: GiB when it is whole or half GiB, `32G` or

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { A as parseName, B as Unavailable, C as release, D as Name, E as Id, F as HostErrorTag, I as Internal, L as Invalid, M as Conflict, N as ConflictKind, O as formatId, P as ErrorTag, R as NotFound, S as SshLogin, T as HostId, V as hostErrors, _ as MachineSpec, a as describeIssues, b as Setup, c as readTimeout, d as ActionRecord, f as Checkpoint, g as Machine, h as Limit, i as describeFileError, j as Capacity, k as parseId, l as versionHeader, m as Host, n as client_exports, o as formatMib, p as CreateRequest, s as Http, u as ActionName, v as Profile, w as version, x as SshEndpoint, y as Runtime, z as Precondition } from "./client-CtI-rSJQ.mjs";
+import { A as parseName, B as Unavailable, C as release, D as Name, E as Id, F as HostErrorTag, I as Internal, L as Invalid, M as Conflict, N as ConflictKind, O as formatId, P as ErrorTag, R as NotFound, S as SshLogin, T as HostId, V as hostErrors, _ as MachineSpec, a as describeIssues, b as Setup, c as readTimeout, d as ActionRecord, f as Checkpoint, g as Machine, h as Limit, i as describeFileError, j as Capacity, k as parseId, l as versionHeader, m as Host, n as client_exports, o as formatMib, p as CreateRequest, s as Http, u as ActionName, v as Profile, w as version, x as SshEndpoint, y as Runtime, z as Precondition } from "./client-pUFgD6Xz.mjs";
 import { Effect, FileSystem, Option, Path, Predicate, Schema } from "effect";
 //#region src/prebuild.ts
 /**
@@ -218,4 +218,71 @@ const readSetup = (path) => Effect.gen(function* () {
 	return yield* fs.readFileString(path);
 }).pipe(Effect.catchTag("PlatformError", (error) => Effect.fail(new Invalid({ message: `couldn't read setup ${path}: ${describeFileError(error)}` }))));
 //#endregion
-export { ActionName, ActionRecord, Capacity, Checkpoint, client_exports as Client, Conflict, ConflictKind, CreateRequest, ErrorTag, Host, HostErrorTag, HostId, Http, Id, Internal, Invalid, Limit, Machine, MachineSpec, Name, NotFound, prebuild_exports as Prebuild, Precondition, Profile, Runtime, Setup, SshEndpoint, SshLogin, Unavailable, describeFileError, describeIssues, formatId, formatMib, hostErrors, loadProfile, packRecipe, parseId, parseName, readSetup, readTimeout, release, version, versionHeader };
+//#region src/ssh.ts
+/**
+* The system `ssh`'s arguments for a machine, pinned to its host key: what `clankerbox ssh` runs,
+* and what anything else that reaches a guest through port 22 does, such as a port forward.
+*/
+/**
+* The machine's SSH target, or what it lacks: an endpoint, which only a running machine has, or
+* a host key, which preparation records.
+*/
+const sshTarget = (machine) => {
+	const { id, ssh: login, hostKey } = machine;
+	if (login === void 0) return { lacks: "SSH endpoint" };
+	return hostKey === void 0 ? { lacks: "SSH host key on record" } : {
+		id,
+		login,
+		hostKey
+	};
+};
+/**
+* The known-hosts line pinning the machine's host key under its ID: ssh looks the key up by
+* `HostKeyAlias`, so the line doesn't depend on the endpoint, which changes.
+*/
+const knownHostsLine = (id, hostKey) => {
+	const [type = "", key = ""] = hostKey.trim().split(/\s+/u);
+	return `${id} ${type} ${key}\n`;
+};
+/**
+* ssh's arguments. OpenSSH keeps the first user it is given, so the leading `-l` decides it:
+* one in the caller's arguments or in an ssh config doesn't apply. The destination is the
+* machine's ID, so a `Host <pattern>` block in the user's ssh config can set keys and options
+* per machine; the endpoint and the pinned host key come from command-line options, which no
+* config overrides. The caller's arguments go after the destination, where OpenSSH still reads
+* options (`-L …`) before a remote command.
+*/
+const sshArguments = (target, user, knownHosts, extra) => [
+	"-l",
+	user,
+	"-o",
+	`HostName=${target.login.host}`,
+	"-o",
+	`Port=${target.login.port}`,
+	"-o",
+	`HostKeyAlias=${target.id}`,
+	"-o",
+	`UserKnownHostsFile=${knownHosts}`,
+	"-o",
+	"GlobalKnownHostsFile=/dev/null",
+	"-o",
+	"StrictHostKeyChecking=yes",
+	target.id,
+	...extra
+];
+/**
+* Writes a one-line known-hosts file pinning the target's host key, and returns the arguments
+* that run ssh against it with strict host key checking, as `user`. The file lasts as long as
+* the scope, which must outlast the ssh it is for. Ports change on fork and restore, and on
+* boat at every start, so a target is read anew for each ssh.
+*/
+const pinnedSsh = (target, user, extra) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const directory = yield* fs.makeTempDirectoryScoped({ prefix: "clankerbox-ssh-" });
+	const knownHosts = path.join(directory, "known_hosts");
+	yield* fs.writeFileString(knownHosts, knownHostsLine(target.id, target.hostKey));
+	return sshArguments(target, user, knownHosts, extra);
+});
+//#endregion
+export { ActionName, ActionRecord, Capacity, Checkpoint, client_exports as Client, Conflict, ConflictKind, CreateRequest, ErrorTag, Host, HostErrorTag, HostId, Http, Id, Internal, Invalid, Limit, Machine, MachineSpec, Name, NotFound, prebuild_exports as Prebuild, Precondition, Profile, Runtime, Setup, SshEndpoint, SshLogin, Unavailable, describeFileError, describeIssues, formatId, formatMib, hostErrors, loadProfile, packRecipe, parseId, parseName, pinnedSsh, readSetup, readTimeout, release, sshTarget, version, versionHeader };

package/dist/node.mjs

@@ -1,4 +1,4 @@
-import { r as make, t as Client } from "./client-CtI-rSJQ.mjs";
+import { r as make, t as Client } from "./client-pUFgD6Xz.mjs";
 import { Layer } from "effect";
 import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
 //#region src/node.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankerbox-sdk",
-  "version": "0.15.3",
+  "version": "0.15.4",
   "description": "clankerbox's API contract and client library, for Effect",
   "license": "MIT",
   "repository": {