@keynv/testers 0.1.0-rc.23

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAShD,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACrD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,EAAE;YACJ,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAa;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,KAAK,EAAE,mBAAmB,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG;YACP,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,KAAe;IACtC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7F,CAAC"}

package/dist/run.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=run.test.d.ts.map

package/dist/run.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.test.d.ts","sourceRoot":"","sources":["../src/run.test.ts"],"names":[],"mappings":""}

package/dist/run.test.js

@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest';
+import { z } from 'zod';
+import { runTest } from './run.js';
+const FakeTarget = z.object({ host: z.string().min(1) });
+function fakeTester(behavior) {
+    return {
+        type: 'http',
+        schema: FakeTarget,
+        test: behavior,
+    };
+}
+describe('runTest', () => {
+    it('returns the tester result on success', async () => {
+        const t = fakeTester(async () => ({ ok: true, latency_ms: 10 }));
+        const r = await runTest({
+            tester: t,
+            secret: { alias: '@x.dev.k', value: 'pw' },
+            target: { host: 'a' },
+        });
+        expect(r.ok).toBe(true);
+    });
+    it('returns a sanitized error from the tester', async () => {
+        const t = fakeTester(async () => ({
+            ok: false,
+            latency_ms: 12,
+            error: 'auth failed for hunter2',
+        }));
+        const r = await runTest({
+            tester: t,
+            secret: { alias: '@x.dev.k', value: 'hunter2' },
+            target: { host: 'a' },
+        });
+        expect(r.ok).toBe(false);
+        expect(r.error).toBe('auth failed for <redacted>');
+    });
+    it('returns a validation error for a malformed target', async () => {
+        const t = fakeTester(async () => ({ ok: true, latency_ms: 0 }));
+        const r = await runTest({
+            tester: t,
+            secret: { alias: '@x.dev.k', value: 'p' },
+            target: { host: '' },
+        });
+        expect(r.ok).toBe(false);
+        expect(r.error).toMatch(/invalid target/);
+    });
+    it('enforces a hard timeout', async () => {
+        const t = fakeTester(() => new Promise(() => undefined));
+        const r = await runTest({
+            tester: t,
+            secret: { alias: '@x.dev.k', value: 'p' },
+            target: { host: 'a' },
+            timeoutMs: 50,
+        });
+        expect(r.ok).toBe(false);
+        expect(r.error).toMatch(/timed out/);
+    });
+    it('catches synchronous throws from the tester', async () => {
+        const t = fakeTester(async () => {
+            throw new Error('boom hunter2');
+        });
+        const r = await runTest({
+            tester: t,
+            secret: { alias: '@x.dev.k', value: 'hunter2' },
+            target: { host: 'a' },
+        });
+        expect(r.error).toBe('boom <redacted>');
+    });
+});
+//# sourceMappingURL=run.test.js.map

package/dist/run.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.test.js","sourceRoot":"","sources":["../src/run.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGnC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAGzD,SAAS,UAAU,CACjB,QAAmE;IAEnE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,QAAQ;KACf,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;IACvB,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;YACtB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;YAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAChC,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,yBAAyB;SACjC,CAAC,CAAC,CAAC;QACJ,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;YACtB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;YACtB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE;YACzC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,CAAC,GAAG,UAAU,CAClB,GAAG,EAAE,CAAC,IAAI,OAAO,CAAa,GAAG,EAAE,CAAC,SAAS,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;YACtB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE;YACzC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACrB,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YAC9B,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;YACtB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/sanitize.d.ts

@@ -0,0 +1,14 @@
+import type { ResolvedSecret, TestResult } from './types.js';
+/**
+ * Final defense before returning a TestResult to the caller. Even
+ * with per-tester sanitization, driver errors sometimes embed
+ * connection strings or tokens. This pass:
+ *
+ *  1. Replaces the resolved value with `<redacted>` if it shows up
+ *     literally.
+ *  2. Replaces any auxiliary fields (e.g., usernames passed by the
+ *     caller as part of `secret.fields`) the same way.
+ *  3. Runs the redactor pattern bank over the error string.
+ */
+export declare function sanitizeResult(result: TestResult, secret: ResolvedSecret): TestResult;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,UAAU,CAerF"}

package/dist/sanitize.js

@@ -0,0 +1,29 @@
+import { redact } from '@keynv/redactor';
+/**
+ * Final defense before returning a TestResult to the caller. Even
+ * with per-tester sanitization, driver errors sometimes embed
+ * connection strings or tokens. This pass:
+ *
+ *  1. Replaces the resolved value with `<redacted>` if it shows up
+ *     literally.
+ *  2. Replaces any auxiliary fields (e.g., usernames passed by the
+ *     caller as part of `secret.fields`) the same way.
+ *  3. Runs the redactor pattern bank over the error string.
+ */
+export function sanitizeResult(result, secret) {
+    if (!result.error)
+        return result;
+    let cleaned = result.error;
+    if (secret.value.length > 0) {
+        cleaned = cleaned.split(secret.value).join('<redacted>');
+    }
+    if (secret.fields) {
+        for (const v of Object.values(secret.fields)) {
+            if (v && v.length > 0)
+                cleaned = cleaned.split(v).join('<redacted>');
+        }
+    }
+    cleaned = redact(cleaned).text;
+    return { ...result, error: cleaned };
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB,EAAE,MAAsB;IACvE,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAEjC,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAE/B,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC"}

package/dist/sanitize.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sanitize.test.d.ts.map

package/dist/sanitize.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.test.d.ts","sourceRoot":"","sources":["../src/sanitize.test.ts"],"names":[],"mappings":""}

package/dist/sanitize.test.js

@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest';
+import { sanitizeResult } from './sanitize.js';
+describe('sanitizeResult', () => {
+    it('redacts the literal secret value when it appears in the error', () => {
+        const secret = { alias: '@x.dev.k', value: 'super-pass-123' };
+        const result = {
+            ok: false,
+            latency_ms: 12,
+            error: 'auth failed for super-pass-123',
+        };
+        expect(sanitizeResult(result, secret).error).toBe('auth failed for <redacted>');
+    });
+    it('redacts auxiliary fields too', () => {
+        const secret = {
+            alias: '@x.dev.k',
+            value: 'pass',
+            fields: { username: 'super-rare-user' },
+        };
+        const result = {
+            ok: false,
+            latency_ms: 12,
+            error: "no such user 'super-rare-user'",
+        };
+        expect(sanitizeResult(result, secret).error).toBe("no such user '<redacted>'");
+    });
+    it('runs the redactor pattern bank over the error', () => {
+        const secret = { alias: '@x.dev.k', value: 'irrelevant' };
+        const result = {
+            ok: false,
+            latency_ms: 12,
+            error: 'connection failed: postgres://app:hunter2@db.example.com/x',
+        };
+        const cleaned = sanitizeResult(result, secret).error ?? '';
+        expect(cleaned).toContain('<REDACTED:postgres-uri>');
+        expect(cleaned).not.toContain('hunter2');
+    });
+    it('passes ok=true results through unchanged', () => {
+        const secret = { alias: '@x.dev.k', value: 'p' };
+        const result = { ok: true, latency_ms: 24 };
+        expect(sanitizeResult(result, secret)).toEqual(result);
+    });
+});
+//# sourceMappingURL=sanitize.test.js.map

package/dist/sanitize.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.test.js","sourceRoot":"","sources":["../src/sanitize.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAe;YACzB,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,gCAAgC;SACxC,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAmB;YAC7B,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE;SACxC,CAAC;QACF,MAAM,MAAM,GAAe;YACzB,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,gCAAgC;SACxC,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAe;YACzB,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,4DAA4D;SACpE,CAAC;QACF,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACjE,MAAM,MAAM,GAAe,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/ssh.d.ts

@@ -0,0 +1,34 @@
+import { z } from 'zod';
+import type { Tester } from './types.js';
+declare const Target: z.ZodObject<{
+    host: z.ZodString;
+    port: z.ZodDefault<z.ZodNumber>;
+    user: z.ZodString;
+    /**
+     * 'password' uses secret.value as a password; 'key' uses
+     * secret.value as a PEM-encoded private key.
+     */
+    auth: z.ZodDefault<z.ZodEnum<["password", "key"]>>;
+    /**
+     * Expected SHA-256 fingerprint of the server host public key
+     * (base64, no padding). When set, the connection is rejected if
+     * the key does not match — preventing MITM attacks.
+     */
+    host_key_sha256: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    auth: "key" | "password";
+    user: string;
+    host: string;
+    port: number;
+    host_key_sha256?: string | undefined;
+}, {
+    user: string;
+    host: string;
+    auth?: "key" | "password" | undefined;
+    port?: number | undefined;
+    host_key_sha256?: string | undefined;
+}>;
+type SshTarget = z.infer<typeof Target>;
+export declare const sshTester: Tester<SshTarget>;
+export {};
+//# sourceMappingURL=ssh.d.ts.map

package/dist/ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.d.ts","sourceRoot":"","sources":["../src/ssh.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAA8B,MAAM,EAAE,MAAM,YAAY,CAAC;AAErE,QAAA,MAAM,MAAM;;;;IAIV;;;OAGG;;IAEH;;;;OAIG;;;;;;;;;;;;;;EAEH,CAAC;AAEH,KAAK,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAExC,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,SAAS,CA6FvC,CAAC"}

package/dist/ssh.js

@@ -0,0 +1,111 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { isBlockedHostResolved } from './ssrf.js';
+const Target = z.object({
+    host: z.string().min(1),
+    port: z.coerce.number().int().min(1).max(65535).default(22),
+    user: z.string().min(1),
+    /**
+     * 'password' uses secret.value as a password; 'key' uses
+     * secret.value as a PEM-encoded private key.
+     */
+    auth: z.enum(['password', 'key']).default('password'),
+    /**
+     * Expected SHA-256 fingerprint of the server host public key
+     * (base64, no padding). When set, the connection is rejected if
+     * the key does not match — preventing MITM attacks.
+     */
+    host_key_sha256: z.string().min(1).optional(),
+});
+export const sshTester = {
+    type: 'ssh',
+    schema: Target,
+    async test(secret, target) {
+        if (await isBlockedHostResolved(target.host)) {
+            return {
+                ok: false,
+                latency_ms: 0,
+                error: 'Target host is blocked (private/internal IP or metadata endpoint).',
+            };
+        }
+        const start = Date.now();
+        const { Client } = await import('ssh2');
+        return new Promise((resolve) => {
+            const client = new Client();
+            let settled = false;
+            const settle = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                try {
+                    client.end();
+                }
+                catch {
+                    /* ignore */
+                }
+                resolve(result);
+            };
+            client.once('ready', () => {
+                client.exec('true', (err, stream) => {
+                    if (err) {
+                        settle({ ok: false, latency_ms: Date.now() - start, error: err.message });
+                        return;
+                    }
+                    stream
+                        .on('close', (code) => {
+                        settle({
+                            ok: code === 0,
+                            latency_ms: Date.now() - start,
+                            ...(code === 0 ? {} : { error: `remote exit code ${code}` }),
+                        });
+                    })
+                        .on('error', (e) => {
+                        settle({ ok: false, latency_ms: Date.now() - start, error: e.message });
+                    });
+                    // We don't need stdout/stderr; just drain.
+                    stream.resume();
+                    stream.stderr?.resume();
+                });
+            });
+            client.once('error', (err) => {
+                settle({ ok: false, latency_ms: Date.now() - start, error: err.message });
+            });
+            try {
+                const connectOpts = {
+                    host: target.host,
+                    port: target.port,
+                    username: target.user,
+                    readyTimeout: 5000,
+                };
+                if (target.auth === 'password') {
+                    connectOpts.password = secret.value;
+                }
+                else {
+                    connectOpts.privateKey = secret.value;
+                }
+                if (target.host_key_sha256) {
+                    const expected = target.host_key_sha256;
+                    connectOpts.hostVerifier = (key) => {
+                        if (typeof key === 'string') {
+                            return (createHash('sha256').update(key, 'utf8').digest('base64').replace(/=+$/, '') ===
+                                expected);
+                        }
+                        if (Buffer.isBuffer(key)) {
+                            return (createHash('sha256').update(key).digest('base64').replace(/=+$/, '') === expected);
+                        }
+                        return false;
+                    };
+                }
+                client.connect(connectOpts);
+            }
+            catch (err) {
+                settle({
+                    ok: false,
+                    latency_ms: Date.now() - start,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+        });
+    },
+};
+//# sourceMappingURL=ssh.js.map

package/dist/ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../src/ssh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGlD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB;;;OAGG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACrD;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,SAAS,GAAsB;IAC1C,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,MAAiB;QAClD,IAAI,MAAM,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,oEAAoE;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE;gBAC1C,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;oBAClC,IAAI,GAAG,EAAE,CAAC;wBACR,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC1E,OAAO;oBACT,CAAC;oBACD,MAAM;yBACH,EAAE,CAAC,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE;wBAC5B,MAAM,CAAC;4BACL,EAAE,EAAE,IAAI,KAAK,CAAC;4BACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;4BAC9B,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;yBAC7D,CAAC,CAAC;oBACL,CAAC,CAAC;yBACD,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE;wBACxB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1E,CAAC,CAAC,CAAC;oBACL,2CAA2C;oBAC3C,MAAM,CAAC,MAAM,EAAE,CAAC;oBAChB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC1B,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC3B,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,WAAW,GAA4B;oBAC3C,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,QAAQ,EAAE,MAAM,CAAC,IAAI;oBACrB,YAAY,EAAE,IAAI;iBACnB,CAAC;gBACF,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC/B,WAAW,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;gBACtC,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;gBACxC,CAAC;gBACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC;oBACxC,WAAW,CAAC,YAAY,GAAG,CAAC,GAAY,EAAE,EAAE;wBAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;4BAC5B,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gCAC5E,QAAQ,CACT,CAAC;wBACJ,CAAC;wBACD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;4BACzB,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,QAAQ,CAClF,CAAC;wBACJ,CAAC;wBACD,OAAO,KAAK,CAAC;oBACf,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC;oBACL,EAAE,EAAE,KAAK;oBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/ssrf.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Synchronous classification of a host *literal*. Returns true for blocked
+ * hostnames and for IP literals (IPv4 dotted/numeric, IPv6) that resolve to
+ * an internal range. Returns false for a plain hostname — use
+ * {@link isBlockedHostResolved} to also check what it resolves to.
+ */
+export declare function isBlockedHost(host: string): boolean;
+/**
+ * Like {@link isBlockedHost} but, for a hostname, also resolves it via DNS
+ * and blocks if ANY resolved address is internal. Async because it does I/O.
+ */
+export declare function isBlockedHostResolved(host: string): Promise<boolean>;
+/** Synchronous URL guard (literal host only). */
+export declare function isBlockedUrl(urlStr: string): boolean;
+/** URL guard that also resolves the hostname via DNS. */
+export declare function isBlockedUrlResolved(urlStr: string): Promise<boolean>;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../src/ssrf.ts"],"names":[],"mappings":"AA2FA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAmBnD;AAMD;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa1E;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQpD;AAED,yDAAyD;AACzD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS3E"}

package/dist/ssrf.js

@@ -0,0 +1,185 @@
+/**
+ * SSRF protection for testers. A tester runs with a real secret value and
+ * the user's connection target, so it must never be coaxed into hitting an
+ * internal/loopback/link-local/metadata address.
+ *
+ * Defense in depth:
+ *  - Literal-IP classification covers IPv4 (incl. decimal/hex integer forms),
+ *    IPv6 (loopback, unspecified, link-local fe80::/10, ULA fc00::/7,
+ *    multicast, IPv4-mapped ::ffff:a.b.c.d), and the reserved/TEST-NET ranges.
+ *  - {@link isBlockedHostResolved} additionally resolves a *hostname* via DNS
+ *    and rejects it if ANY resolved address is internal. This closes the
+ *    "public DNS name with an A record pointing at 127.0.0.1 / 169.254.169.254"
+ *    bypass that a pure string blacklist cannot see.
+ *
+ * Residual: a determined attacker controlling DNS can still rebind between
+ * our check and the client library's own resolution (TOCTOU). Pinning the
+ * resolved IP into every client (pg/mysql/redis/ssh) without breaking TLS
+ * SNI is out of scope here; the resolved check removes the trivial bypass.
+ */
+import { lookup } from 'node:dns/promises';
+const BLOCKED_HOSTNAMES = new Set([
+    'localhost',
+    'metadata.google.internal',
+    'metadata.internal',
+    'instance-data',
+]);
+function isLoopbackAllowed() {
+    return !!process.env['KEYNV_ALLOW_LOOPBACK_TESTERS'];
+}
+/** Strip brackets and an IPv6 zone id; lowercase. */
+function normalizeHost(host) {
+    return host.trim().toLowerCase().replace(/^\[/, '').replace(/\]$/, '').replace(/%.*$/, '');
+}
+/**
+ * If `host` is a bare integer (2130706433) or hex (0x7f000001) IPv4, return
+ * its dotted-quad form; otherwise null. These numeric forms are accepted by
+ * many resolvers/clients and would otherwise slip past dotted-quad CIDRs.
+ */
+function normalizeNumericIPv4(host) {
+    let n = null;
+    if (/^\d+$/.test(host))
+        n = Number(host);
+    else if (/^0x[0-9a-f]+$/i.test(host))
+        n = Number.parseInt(host.slice(2), 16);
+    if (n === null || !Number.isInteger(n) || n < 0 || n > 0xffffffff)
+        return null;
+    return [(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff].join('.');
+}
+function isDottedIPv4(host) {
+    return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+/** True if a dotted-quad IPv4 is private/loopback/link-local/reserved/metadata. */
+function isPrivateIPv4(ip) {
+    const parts = ip.split('.').map((p) => Number(p));
+    if (parts.length !== 4 || parts.some((o) => !Number.isInteger(o) || o < 0 || o > 255)) {
+        return false;
+    }
+    const [a, b, c] = parts;
+    if (a === 0)
+        return true; // 0.0.0.0/8 "this network"
+    if (a === 10)
+        return true; // 10.0.0.0/8
+    if (a === 127)
+        return true; // loopback 127.0.0.0/8
+    if (a === 169 && b === 254)
+        return true; // link-local + cloud metadata 169.254.169.254
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16.0.0/12
+    if (a === 192 && b === 0 && (c === 0 || c === 2))
+        return true; // 192.0.0.0/24, TEST-NET-1
+    if (a === 192 && b === 168)
+        return true; // 192.168.0.0/16
+    if (a === 198 && (b === 18 || b === 19))
+        return true; // 198.18.0.0/15 benchmarking
+    if (a === 198 && b === 51 && c === 100)
+        return true; // TEST-NET-2
+    if (a === 203 && b === 0 && c === 113)
+        return true; // TEST-NET-3
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // CGNAT 100.64.0.0/10
+    if (a >= 224)
+        return true; // multicast 224/4 + reserved 240/4 + 255.255.255.255
+    return false;
+}
+/** True if an IPv6 literal is loopback/unspecified/link-local/ULA/multicast/mapped-internal. */
+function isPrivateIPv6(ip) {
+    const s = normalizeHost(ip);
+    // IPv4-mapped / -embedded in dotted form: ::ffff:127.0.0.1, ::127.0.0.1
+    const mapped = s.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (s.startsWith('::') && mapped)
+        return isPrivateIPv4(mapped[1]);
+    if (s === '::1')
+        return true; // loopback
+    if (s === '::')
+        return true; // unspecified
+    if (/^fe[89ab]/.test(s))
+        return true; // link-local fe80::/10
+    if (/^f[cd]/.test(s))
+        return true; // unique local fc00::/7
+    if (/^ff/.test(s))
+        return true; // multicast ff00::/8
+    if (/^fec/.test(s))
+        return true; // deprecated site-local fec0::/10
+    return false;
+}
+/**
+ * Synchronous classification of a host *literal*. Returns true for blocked
+ * hostnames and for IP literals (IPv4 dotted/numeric, IPv6) that resolve to
+ * an internal range. Returns false for a plain hostname — use
+ * {@link isBlockedHostResolved} to also check what it resolves to.
+ */
+export function isBlockedHost(host) {
+    let h = normalizeHost(host);
+    if (BLOCKED_HOSTNAMES.has(h)) {
+        if (isLoopbackAllowed() && h === 'localhost')
+            return false;
+        return true;
+    }
+    const numeric = normalizeNumericIPv4(h);
+    if (numeric)
+        h = numeric;
+    if (isDottedIPv4(h)) {
+        const blocked = isPrivateIPv4(h);
+        if (blocked && isLoopbackAllowed() && /^127\./.test(h))
+            return false;
+        return blocked;
+    }
+    if (h.includes(':')) {
+        const blocked = isPrivateIPv6(h);
+        if (blocked && isLoopbackAllowed() && h === '::1')
+            return false;
+        return blocked;
+    }
+    return false;
+}
+function isIpLiteral(h) {
+    return isDottedIPv4(h) || h.includes(':') || normalizeNumericIPv4(h) !== null;
+}
+/**
+ * Like {@link isBlockedHost} but, for a hostname, also resolves it via DNS
+ * and blocks if ANY resolved address is internal. Async because it does I/O.
+ */
+export async function isBlockedHostResolved(host) {
+    if (isBlockedHost(host))
+        return true;
+    const h = normalizeHost(host);
+    // Already an IP literal → isBlockedHost was authoritative.
+    if (isIpLiteral(h))
+        return false;
+    let addrs;
+    try {
+        addrs = await lookup(host, { all: true });
+    }
+    catch {
+        // Unresolvable: let the tester surface its own connection error.
+        return false;
+    }
+    return addrs.some((a) => isBlockedHost(a.address));
+}
+/** Synchronous URL guard (literal host only). */
+export function isBlockedUrl(urlStr) {
+    try {
+        const parsed = new URL(urlStr);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+            return true;
+        return isBlockedHost(parsed.hostname);
+    }
+    catch {
+        return true;
+    }
+}
+/** URL guard that also resolves the hostname via DNS. */
+export async function isBlockedUrlResolved(urlStr) {
+    let parsed;
+    try {
+        parsed = new URL(urlStr);
+    }
+    catch {
+        return true;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return true;
+    return isBlockedHostResolved(parsed.hostname);
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../src/ssrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,0BAA0B;IAC1B,mBAAmB;IACnB,eAAe;CAChB,CAAC,CAAC;AAEH,SAAS,iBAAiB;IACxB,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;AACvD,CAAC;AAED,qDAAqD;AACrD,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,CAAC,GAAkB,IAAI,CAAC;IAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;SACpC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAyC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IACrD,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACxC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,8CAA8C;IACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB;IAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IAC1F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IACnF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;IACzE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,qDAAqD;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC5B,wEAAwE;IACxE,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAW,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IACzC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,cAAc;IAC3C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC3D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IACrD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,iBAAiB,EAAE,IAAI,CAAC,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO;QAAE,CAAC,GAAG,OAAO,CAAC;IACzB,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,OAAO,IAAI,iBAAiB,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,OAAO,IAAI,iBAAiB,EAAE,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,2DAA2D;IAC3D,IAAI,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC"}

package/dist/ssrf.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ssrf.test.d.ts.map

package/dist/ssrf.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.test.d.ts","sourceRoot":"","sources":["../src/ssrf.test.ts"],"names":[],"mappings":""}