@nosana/node 1.1.62-rc → 1.1.64-rc

package/dist/.env

@@ -1,7 +1,6 @@
 BACKEND_SOLANA_ADDRESS=7rFPFnxjXHC2sfDy3qrDa9pEb4j49oivMuV7e8sYDPmB
-FRPC_CONTAINER_IMAGE=registry.hub.docker.com/nosana/frpc:v1.0.44
-FRP_SERVER_IMAGE=registry.hub.docker.com/nosana/frpc:v1.0.44
+FRP_SERVER_IMAGE=registry.hub.docker.com/nosana/frpc:v1.0.45
 FRP_SERVER_PORT=7000
 MIN_DISK_SPACE=25
 SIGN_MESSAGE="Hello Nosana Node!"
-API_PORT=8123
+API_PORT=8123

package/dist/.env.dev

@@ -1,4 +1,4 @@
 HOST_MANAGER_BASE_URL=https://host-manager.k8s.dev.nos.ci
 EXPLORER_URL=https://devnet.nosana.io
 FRP_SERVER_ADDRESS=node.k8s.dev.nos.ci
-MIN_DISK_SPACE=20
+MIN_DISK_SPACE=20

package/dist/.env.prd

@@ -1,3 +1,3 @@
 HOST_MANAGER_BASE_URL=https://host-manager.k8s.prd.nos.ci
 EXPLORER_URL=https://explore.nosana.com
-FRP_SERVER_ADDRESS=node.k8s.prd.nos.ci
+FRP_SERVER_ADDRESS=node.k8s.prd.nos.ci

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nosana/node",
-    "version": "1.1.62-rc",
+    "version": "1.1.64-rc",
     "description": "",
     "bin": {
         "nosana-node": "./dist/src/index.js"
@@ -15,7 +15,7 @@
         "generate": "npm run generate:host-manager",
         "generate:host-manager": "openapi-typescript https://host-manager.k8s.dev.nos.ci/swagger/json -o ./src/NodeManager/clients/hostManager/schema.d.ts",
         "test": "APP_ENV=development DOCKER_CERT_PATH= vitest run",
-        "ci:test": "APP_ENV=development DOCKER_CERT_PATH= vitest run --coverage --reporter=junit --outputFile=./test-report.xml",
+        "ci:test": "APP_ENV=development DOCKER_CERT_PATH= vitest run --coverage --reporter=verbose --reporter=junit --outputFile.junit=./test-report.xml",
         "test:watch": "APP_ENV=development DOCKER_CERT_PATH= vitest",
         "test:coverage": "APP_ENV=development DOCKER_CERT_PATH= vitest run --coverage",
         "publish:next": "npm run build && npm publish --tag=next --access public",
@@ -74,6 +74,7 @@
         "@inquirer/prompts": "^4.3.0",
         "@nosana/ipfs": "^2.2.6",
         "@nosana/sdk": "^0.4.87",
+        "@nosana/ssh": "^2.13.1",
         "@solana/web3.js": "^1.78.0",
         "bn.js": "^5.2.1",
         "chalk": "^5.3.0",

package/dist/src/NodeManager/configs/NodeConfigs.d.ts

@@ -3,6 +3,7 @@ export declare class NodeConfigs {
     constructor(options: {
         [key: string]: any;
     });
+    getNetwork(): 'devnet' | 'mainnet';
     loadVariablesToEnv(): void;
 }
 export declare class NodeConfigsSingleton {

package/dist/src/NodeManager/configs/NodeConfigs.js

@@ -5,8 +5,11 @@ export class NodeConfigs {
     constructor(options) {
         this.options = options;
     }
+    getNetwork() {
+        return this.options.network ?? 'mainnet';
+    }
     loadVariablesToEnv() {
-        const network = this.options.network ? this.options.network : 'mainnet';
+        const network = this.getNetwork();
         const env = network === 'mainnet' ? 'prd' : 'dev';
         const modulePath = dirname(fileURLToPath(import.meta.url));
         // Load .env.${env} first (higher priority)

package/dist/src/NodeManager/configs/configs.js

@@ -1,7 +1,7 @@
 import { NodeConfigsSingleton } from './NodeConfigs.js';
 import { loadConfigurationValue } from '../utils/utils.js';
 export const configs = (options) => {
-    NodeConfigsSingleton.getInstance(options);
+    const nodeConfigs = NodeConfigsSingleton.getInstance(options);
     return {
         isNodeRun: options?.isNodeRun,
         hostManagerBaseUrl: loadConfigurationValue('HOST_MANAGER_BASE_URL'),
@@ -17,6 +17,6 @@ export const configs = (options) => {
             port: parseInt(loadConfigurationValue('API_PORT')),
         },
         minDiskSpace: parseInt(loadConfigurationValue('MIN_DISK_SPACE')),
-        network: options?.network ?? 'mainnet',
+        network: options?.network ?? nodeConfigs.getNetwork(),
     };
 };

package/dist/src/NodeManager/db/index.d.ts

@@ -1,7 +1,14 @@
 import { LowSync } from 'lowdb/lib';
 import { Flow } from '@nosana/sdk';
 import { CudaCheckSuccessResponse } from '../types/index.js';
+export type SshKeyGrant = {
+    sshPublicKey: string;
+    expiresAt?: string;
+};
 export type NodeDb = {
+    sshKeyGrants?: Record<string, SshKeyGrant[]>;
+    /** One SSH host key (PKCS#8 PEM) per job, shared by all of its sidecars. */
+    sshHostKeys?: Record<string, string>;
     flows: {
         [key: string]: Flow;
     };
@@ -40,6 +47,22 @@ export type ResourceHistory = {
     usage: number;
     required: boolean;
     isPrivate?: boolean;
+    /**
+     * The project a resource is scoped to when it must not be shared freely
+     * across projects. Absent on shared, public resources.
+     *
+     * For a volume it is set once the resource is mounted writable (`allowWrite`)
+     * or fetched from an auth-gated remote: a writable mount can leave the job's
+     * own bytes behind, and an auth-gated resource is private to the credentials
+     * that fetched it, so the volume is keyed by project and never reused by
+     * another — a different project falls through to a clean copy of its own.
+     *
+     * For a private image it is the project the image was last pulled for. The
+     * daemon holds one copy per image reference, so this gates reuse rather than
+     * separating storage: a job from a different project must re-authenticate
+     * (forcing a pull) before it may reuse the cached copy.
+     */
+    project?: string;
 };
 export type VolumeResource = ResourceHistory & {
     volume: string;

package/dist/src/NodeManager/index.js

@@ -109,7 +109,10 @@ export default class NodeManager {
          * request a market to join from the host manager,
          * we can pass a requested market or let the host manager recommend us one
          */
-        const market = await this.node.requestMarket(marketArg);
+        let market;
+        if (!marketArg) {
+            market = await this.node.requestMarket();
+        }
         /**
          * healthcheck
          *
@@ -129,7 +132,9 @@ export default class NodeManager {
          *
          * this sets up everything need, downloads needed resources ...
          */
-        await this.node.setup(market);
+        if (market) {
+            await this.node.setup(market);
+        }
         /**
          * this variable was added to know when the node has gone past the setup/checks stages
          * and is now starting job work and queueing,
@@ -154,7 +159,7 @@ export default class NodeManager {
              *
              * Enter the queue to wait for a job since we have no pending jobs.
              */
-            await this.node.queue(market.address.toString());
+            await this.node.queue(market ? market.address.toString() : marketArg);
         }
         /**
          *

package/dist/src/NodeManager/node/api/ApiHandler.js

@@ -6,8 +6,8 @@ import { configs } from '../../configs/configs.js';
 import { sleep } from '../../utils/utils.js';
 import { stateStreaming } from '../../monitoring/streaming/StateStreamer.js';
 import { applyLoggingProxyToClass } from '../../monitoring/proxy/loggingProxy.js';
-import { verifyJobOwnerSignatureMiddleware, verifyWSJobOwnerSignatureMiddleware, verifyWSNodeOrJobOwnerSignatureMiddleware, } from './middlewares/index.js';
-import { getNodeInfoRoute, getJobResultsRoute, getServiceUrlRoute, postJobDefinitionRoute, postServiceStopRoute, wssLogRoute, wssStatusRoute, getCurrentGroupStatusHandler, getGroupStatusHandler, getOperationsStatusHandler, getOperationStatusHandler, restartGroupOperationHandler, restartOperationHandler, stopGroupOperationHandler, stopOperationHandler, wssTaskManagerLogRoute, getJobDefinitionRoute, getJobInfoRoute, getJobStatsRoute, getJobStatsStreamRoute, } from './routes/index.js';
+import { verifyJobOwnerSignatureMiddleware, verifyWSJobOwnerSignatureMiddleware, } from './middlewares/index.js';
+import { getNodeInfoRoute, getJobResultsRoute, getServiceUrlRoute, postJobDefinitionRoute, postServiceStopRoute, wssLogRoute, wssStatusRoute, wssTerminalRoute, getCurrentGroupStatusHandler, getGroupStatusHandler, getOperationsStatusHandler, getOperationStatusHandler, restartGroupOperationHandler, restartOperationHandler, stopGroupOperationHandler, stopOperationHandler, wssTaskManagerLogRoute, getJobDefinitionRoute, getJobInfoRoute, getJobStatsRoute, getJobStatsStreamRoute, postSshAuthorizeRoute, getSshKeysRoute, deleteSshKeyRoute, } from './routes/index.js';
 import { requestExit } from '../../../exitCodes.js';
 import { NodeAlreadyActiveError } from '../../errors/NodeAlreadyActiveError.js';
 import { reportError } from '../../monitoring/reportError.js';
@@ -91,7 +91,13 @@ export class ApiHandler {
         });
         this.wss.on('connection', (ws) => {
             let keepAliveInterval;
+            let terminalActive = false;
             ws.on('message', async (message) => {
+                // Once a terminal session has taken over the socket, the terminal
+                // route owns all subsequent frames (stdin/resize), so skip the generic
+                // JSON dispatch for them.
+                if (terminalActive)
+                    return;
                 try {
                     const { path, header, body } = JSON.parse(message.toString());
                     keepAliveInterval = setInterval(() => {
@@ -105,7 +111,11 @@ export class ApiHandler {
                             await verifyWSJobOwnerSignatureMiddleware(ws, header, body, wssTaskManagerLogRoute);
                             break;
                         case '/status':
-                            await verifyWSNodeOrJobOwnerSignatureMiddleware(ws, header, body, wssStatusRoute);
+                            await verifyWSJobOwnerSignatureMiddleware(ws, header, body, wssStatusRoute);
+                            break;
+                        case '/terminal':
+                            terminalActive = true;
+                            await wssTerminalRoute(ws, this.provider, this.address, body);
                             break;
                         default:
                             ws.close(3003, 'Invalid Path');
@@ -206,6 +216,9 @@ export class ApiHandler {
         });
         this.api.use(express.json());
         this.api.use('/job/:jobId/*', verifyJobOwnerSignatureMiddleware);
+        this.api.post('/job/:jobId/ssh/authorize', postSshAuthorizeRoute);
+        this.api.get('/job/:jobId/ssh/keys', getSshKeysRoute);
+        this.api.delete('/job/:jobId/ssh/keys', deleteSshKeyRoute);
         // GET Routes
         this.api.get('/node/info', getNodeInfoRoute);
         this.api.get('/', (_, res) => res.send(this.address));

package/dist/src/NodeManager/node/api/middlewares/index.d.ts

@@ -1,4 +1,2 @@
 export * from './rest/verifyJobOwnerSignatureMiddleware.js';
 export * from './ws/verifyWSJobOwnerSignatureMiddleware.js';
-export * from './ws/verifyWSNodeOrJobOwnerSignatureMiddleware.js';
-export * from './ws/verifyWSMiddleware.js';

package/dist/src/NodeManager/node/api/middlewares/index.js

@@ -2,5 +2,3 @@
 export * from './rest/verifyJobOwnerSignatureMiddleware.js';
 // WEBSOCKET MIDDLEWARE
 export * from './ws/verifyWSJobOwnerSignatureMiddleware.js';
-export * from './ws/verifyWSNodeOrJobOwnerSignatureMiddleware.js';
-export * from './ws/verifyWSMiddleware.js';

package/dist/src/NodeManager/node/api/middlewares/rest/verifyJobOwnerSignatureMiddleware.js

@@ -17,6 +17,7 @@ export async function verifyJobOwnerSignatureMiddleware(req, res, next) {
             key: 'authorization',
             expiry: job.timeout,
             publicKey: new PublicKey(job.project),
+            expected_message: jobId,
         })) {
             return res.status(401).send('Unauthorized Request');
         }

package/dist/src/NodeManager/node/api/middlewares/ws/verifyWSJobOwnerSignatureMiddleware.js

@@ -16,6 +16,7 @@ export async function verifyWSJobOwnerSignatureMiddleware(ws, headers, body, nex
         try {
             if (sdk.authorization.validate(headers, {
                 publicKey: new PublicKey(job.project),
+                expected_message: jobId,
             })) {
                 await nextFunction(ws, headers, body);
             }

package/dist/src/NodeManager/node/api/routes/get/node-info.js

@@ -11,13 +11,15 @@ export function getNodeInfoRoute(req, res) {
             ...info,
             gpus: {
                 ...info.gpus,
-                devices: info.gpus.devices.map(({ index, name, uuid, memory, network_architecture }) => ({
-                    index,
-                    name,
-                    uuid,
-                    memory,
-                    network_architecture,
-                })),
+                devices: info.gpus.devices
+                    ? info.gpus.devices.map(({ index, name, uuid, memory, network_architecture }) => ({
+                        index,
+                        name,
+                        uuid,
+                        memory,
+                        network_architecture,
+                    }))
+                    : [],
             },
             network: networkRedacted,
         },

package/dist/src/NodeManager/node/api/routes/post/index.d.ts

@@ -1,3 +1,4 @@
 export * from './job-definition.js';
 export * from './service-stop.js';
 export * from './job-operation-actions.js';
+export * from './ssh-authorize.js';

package/dist/src/NodeManager/node/api/routes/post/index.js

@@ -1,3 +1,4 @@
 export * from './job-definition.js';
 export * from './service-stop.js';
 export * from './job-operation-actions.js';
+export * from './ssh-authorize.js';

package/dist/src/NodeManager/node/api/routes/post/ssh-authorize.d.ts

@@ -0,0 +1,17 @@
+import { Response } from 'express';
+import { NodeAPIRequest } from '../../types/index.js';
+export type SshAuthorizationRequestBody = {
+    sshPublicKey: string;
+    expiresAt?: string;
+};
+export declare function postSshAuthorizeRoute(req: NodeAPIRequest<{
+    jobId: string;
+}, SshAuthorizationRequestBody>, res: Response): Promise<void>;
+export declare function getSshKeysRoute(req: NodeAPIRequest<{
+    jobId: string;
+}>, res: Response): Promise<void>;
+export declare function deleteSshKeyRoute(req: NodeAPIRequest<{
+    jobId: string;
+}, {
+    sshPublicKey: string;
+}>, res: Response): Promise<void>;

package/dist/src/NodeManager/node/api/routes/post/ssh-authorize.js

@@ -0,0 +1,53 @@
+import { SSH_SIDECAR_USER } from '../../../../provider/sshSidecar.js';
+import { isActiveSshFlow, SshAccessError, validateSshKey, validateSshExpiry, } from '../../../../provider/SshAccessManager.js';
+/**
+ * The job owner's signature has already been checked by the shared
+ * verifyJobOwnerSignatureMiddleware; this only maps the SSH operation onto
+ * an active flow and onto HTTP statuses.
+ */
+async function handleSshRequest(req, res, action) {
+    try {
+        const jobId = req.params.jobId;
+        const flow = req.repository?.getFlow(jobId);
+        if (!flow || !isActiveSshFlow(flow))
+            throw new SshAccessError('Could not find active job', 404);
+        if (!req.provider)
+            throw new SshAccessError('SSH provider is not available', 503);
+        const result = await action(jobId);
+        res
+            .status(result.status ?? 200)
+            .json({ job: jobId, sshUser: SSH_SIDECAR_USER, ...result.body });
+    }
+    catch (error) {
+        res.status(error instanceof SshAccessError ? error.status : 502).json({
+            error: error instanceof SshAccessError
+                ? error.message
+                : 'Could not apply SSH access on the node',
+        });
+    }
+}
+export async function postSshAuthorizeRoute(req, res) {
+    return handleSshRequest(req, res, async (jobId) => {
+        const sshPublicKey = validateSshKey(req.body?.sshPublicKey);
+        const expiresAt = validateSshExpiry(req.body?.expiresAt);
+        await req.provider.authorizeSshKeyForJob(jobId, sshPublicKey, expiresAt);
+        return {
+            status: 201,
+            body: {
+                authorized: true,
+                ...(expiresAt === undefined ? {} : { expiresAt }),
+            },
+        };
+    });
+}
+export async function getSshKeysRoute(req, res) {
+    return handleSshRequest(req, res, async (jobId) => ({
+        body: { keys: await req.provider.listSshKeysForJob(jobId) },
+    }));
+}
+export async function deleteSshKeyRoute(req, res) {
+    return handleSshRequest(req, res, async (jobId) => {
+        await req.provider.revokeSshKeyForJob(jobId, validateSshKey(req.body?.sshPublicKey));
+        return { body: { revoked: true } };
+    });
+}

package/dist/src/NodeManager/node/api/routes/wss/index.d.ts

@@ -1,2 +1,4 @@
 export * from './log.js';
 export * from './status.js';
+export * from './terminal/terminal.js';
+export * from './terminal/terminalAuthorization.js';

package/dist/src/NodeManager/node/api/routes/wss/index.js

@@ -1,2 +1,4 @@
 export * from './log.js';
 export * from './status.js';
+export * from './terminal/terminal.js';
+export * from './terminal/terminalAuthorization.js';

package/dist/src/NodeManager/node/api/routes/wss/log.js

@@ -1,4 +1,5 @@
 import WebSocket from 'ws';
+import { sleep } from '@nosana/sdk';
 import { logStreaming } from '../../../../monitoring/streaming/LogStreamer.js';
 import { getSDK } from '../../../../sdk/index.js';
 import { TaskManagerRegistry } from '../../../task/TaskManagerRegistry.js';
@@ -19,7 +20,7 @@ export async function wssTaskManagerLogRoute(ws, _, { jobAddress, group, opId, t
     // definition and registering its TaskManager. Keep the authenticated socket
     // open during that short startup window instead of forcing clients to race it.
     while (!task && Date.now() < deadline && ws.readyState === WebSocket.OPEN) {
-        await new Promise((resolve) => setTimeout(resolve, 250));
+        await sleep(0.25);
         task = registry.get(jobAddress);
     }
     if (!task)

package/dist/src/NodeManager/node/api/routes/wss/terminal/terminal.d.ts

@@ -0,0 +1,21 @@
+import WebSocket from 'ws';
+import { PublicKey } from '@solana/web3.js';
+import { Provider } from '../../../../../provider/Provider.js';
+import { TerminalAuthorizationRequest } from './terminalAuthorization.js';
+export type TerminalWSBody = TerminalAuthorizationRequest & {
+    jobAddress: string;
+    cols?: number;
+    rows?: number;
+};
+/**
+ * Validates a wallet-signed terminal grant and bridges an interactive PTY exec
+ * session in the job container to the websocket.
+ *
+ * Wire protocol after the (already validated) handshake frame:
+ *  - client -> node : JSON text frames
+ *      { "type": "stdin",  "data": "<string>" }
+ *      { "type": "resize", "cols": <n>, "rows": <n> }
+ *  - node -> client : binary frames carry raw stdout/stderr bytes
+ *      JSON text frame { "type": "exit",  "code": <n> } on shell exit
+ */
+export declare function wssTerminalRoute(ws: WebSocket, provider: Provider, nodeAddress: PublicKey, body: TerminalWSBody): Promise<void>;

package/dist/src/NodeManager/node/api/routes/wss/terminal/terminal.js

@@ -0,0 +1,165 @@
+import WebSocket from 'ws';
+import { getSDK } from '../../../../../sdk/index.js';
+import { configs } from '../../../../../configs/configs.js';
+import { validateTerminalAuthorizationRequest, } from './terminalAuthorization.js';
+const MAX_TERMINAL_INPUT_BYTES = 1024 * 64;
+/** Pause the PTY while the socket holds this much unsent output. */
+const TERMINAL_OUTPUT_HIGH_WATER_BYTES = 1024 * 1024;
+/** Close the session when a shell that stopped reading has this much queued. */
+const MAX_TERMINAL_PENDING_INPUT_BYTES = 1024 * 1024;
+/**
+ * Validates a wallet-signed terminal grant and bridges an interactive PTY exec
+ * session in the job container to the websocket.
+ *
+ * Wire protocol after the (already validated) handshake frame:
+ *  - client -> node : JSON text frames
+ *      { "type": "stdin",  "data": "<string>" }
+ *      { "type": "resize", "cols": <n>, "rows": <n> }
+ *  - node -> client : binary frames carry raw stdout/stderr bytes
+ *      JSON text frame { "type": "exit",  "code": <n> } on shell exit
+ */
+export async function wssTerminalRoute(ws, provider, nodeAddress, body) {
+    const jobId = body?.jobAddress;
+    if (!jobId) {
+        closeWith(ws, 1008, 'Expected body to contain jobAddress.');
+        return;
+    }
+    const sdk = getSDK();
+    let session;
+    try {
+        const job = await sdk.jobs.get(jobId);
+        if (!job) {
+            closeWith(ws, 1008, `Could not find job with id ${jobId}`);
+            return;
+        }
+        const authorization = validateTerminalAuthorizationRequest({
+            body,
+            expectedJobId: jobId,
+            expectedNodeId: nodeAddress.toString(),
+            expectedSigner: job.project.toString(),
+            now: new Date(),
+            network: configs().network,
+        });
+        session = await provider.createJobTerminalSession(jobId, {
+            op: authorization.op,
+            cols: body.cols,
+            rows: body.rows,
+        });
+    }
+    catch (error) {
+        closeWith(ws, 4001, `Unauthorized Request: ${error.message}`);
+        return;
+    }
+    bridgeTerminalSession(ws, session);
+}
+function bridgeTerminalSession(ws, session) {
+    let closed = false;
+    const cleanup = (code) => {
+        if (closed)
+            return;
+        closed = true;
+        session.close();
+        if (ws.readyState === WebSocket.OPEN ||
+            ws.readyState === WebSocket.CONNECTING) {
+            try {
+                ws.close(code ?? 1000);
+            }
+            catch {
+                // best effort
+            }
+        }
+    };
+    // A shell prints faster than a browser drains; stop reading the PTY while
+    // the socket has a backlog and resume once it has been flushed.
+    let paused = false;
+    const resumeOutput = () => {
+        if (paused && ws.bufferedAmount <= TERMINAL_OUTPUT_HIGH_WATER_BYTES) {
+            paused = false;
+            session.stream.resume();
+        }
+    };
+    session.stream.on('data', (chunk) => {
+        if (ws.readyState !== WebSocket.OPEN)
+            return;
+        try {
+            ws.send(chunk, { binary: true }, resumeOutput);
+        }
+        catch {
+            // best effort
+        }
+        if (!paused && ws.bufferedAmount > TERMINAL_OUTPUT_HIGH_WATER_BYTES) {
+            paused = true;
+            session.stream.pause();
+        }
+    });
+    const writeInput = (buffer) => {
+        if (buffer.byteLength > MAX_TERMINAL_INPUT_BYTES)
+            return;
+        if (!session.stream.write(buffer) &&
+            session.stream.writableLength > MAX_TERMINAL_PENDING_INPUT_BYTES) {
+            cleanup(1013);
+        }
+    };
+    session.stream.on('end', async () => {
+        const code = await session.inspectExitCode();
+        if (ws.readyState === WebSocket.OPEN) {
+            try {
+                ws.send(JSON.stringify({ type: 'exit', code }));
+            }
+            catch {
+                // best effort
+            }
+        }
+        cleanup(1000);
+    });
+    session.stream.on('error', () => cleanup(1011));
+    ws.on('message', (message, isBinary) => {
+        if (closed)
+            return;
+        if (isBinary) {
+            writeInput(toBuffer(message));
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(toBuffer(message).toString('utf8'));
+        }
+        catch {
+            return;
+        }
+        switch (parsed.type) {
+            case 'stdin':
+                if (typeof parsed.data === 'string') {
+                    writeInput(Buffer.from(parsed.data, 'utf8'));
+                }
+                break;
+            case 'resize':
+                if (typeof parsed.cols === 'number' &&
+                    typeof parsed.rows === 'number') {
+                    void session.resize({ cols: parsed.cols, rows: parsed.rows });
+                }
+                break;
+            default:
+                break;
+        }
+    });
+    ws.on('close', () => cleanup());
+    ws.on('error', () => cleanup(1011));
+}
+/**
+ * A close reason is capped at 123 bytes on the wire; ws throws past that after
+ * already moving to CLOSING, which would leave the socket hanging.
+ */
+function closeWith(ws, code, reason) {
+    let text = reason;
+    while (Buffer.byteLength(text, 'utf8') > 123)
+        text = text.slice(0, -1);
+    ws.close(code, text);
+}
+function toBuffer(data) {
+    if (Buffer.isBuffer(data))
+        return data;
+    if (Array.isArray(data))
+        return Buffer.concat(data);
+    return Buffer.from(data);
+}

package/dist/src/NodeManager/node/api/routes/wss/terminal/terminalAuthorization.d.ts

@@ -0,0 +1,18 @@
+import { TERMINAL_AUTHORIZATION_AUDIENCE, TERMINAL_AUTHORIZATION_MAX_TTL_MS, TERMINAL_AUTHORIZATION_MESSAGE_HEADER } from '@nosana/ssh';
+export { TERMINAL_AUTHORIZATION_AUDIENCE, TERMINAL_AUTHORIZATION_MAX_TTL_MS, TERMINAL_AUTHORIZATION_MESSAGE_HEADER, };
+export type { ParsedTerminalAuthorizationMessage } from '@nosana/ssh';
+export type TerminalAuthorizationRequest = {
+    message?: string;
+    signature?: string | number[];
+};
+export declare function validateTerminalAuthorizationRequest({ body, expectedJobId, expectedNodeId, expectedSigner, now, network, }: {
+    body: TerminalAuthorizationRequest;
+    expectedJobId: string;
+    expectedNodeId: string;
+    expectedSigner: string;
+    now: Date;
+    network: string;
+}): {
+    expiresAt: Date;
+    op?: string;
+};

package/dist/src/NodeManager/node/api/routes/wss/terminal/terminalAuthorization.js

@@ -0,0 +1,61 @@
+import { PublicKey } from '@solana/web3.js';
+import nacl from 'tweetnacl';
+import { isSafeTerminalOperation, parseTerminalAuthorizationMessage, TERMINAL_AUTHORIZATION_AUDIENCE, TERMINAL_AUTHORIZATION_MAX_TTL_MS, TERMINAL_AUTHORIZATION_MESSAGE_HEADER, } from '@nosana/ssh';
+// The message contract now lives in @nosana/ssh, shared with the client; re-exported
+// here so callers and tests keep importing it from this module.
+export { TERMINAL_AUTHORIZATION_AUDIENCE, TERMINAL_AUTHORIZATION_MAX_TTL_MS, TERMINAL_AUTHORIZATION_MESSAGE_HEADER, };
+export function validateTerminalAuthorizationRequest({ body, expectedJobId, expectedNodeId, expectedSigner, now, network, }) {
+    if (!body?.message || !body.signature) {
+        throw new Error('Expected message and signature');
+    }
+    const parsed = parseTerminalAuthorizationMessage(body.message);
+    if (parsed.job !== expectedJobId) {
+        throw new Error('Terminal authorization job mismatch');
+    }
+    if (parsed.node !== expectedNodeId) {
+        throw new Error('Terminal authorization node mismatch');
+    }
+    if (parsed.network && parsed.network !== network) {
+        throw new Error('Terminal authorization network mismatch');
+    }
+    if (parsed.audience && parsed.audience !== TERMINAL_AUTHORIZATION_AUDIENCE) {
+        throw new Error('Terminal authorization audience mismatch');
+    }
+    if (parsed.op && !isSafeTerminalOperation(parsed.op)) {
+        throw new Error('Invalid terminal operation selector');
+    }
+    const expiresAt = new Date(parsed.expiresAt);
+    if (!Number.isFinite(expiresAt.getTime())) {
+        throw new Error('Invalid terminal authorization expiry');
+    }
+    if (expiresAt.getTime() <= now.getTime()) {
+        throw new Error('Terminal authorization has expired');
+    }
+    if (expiresAt.getTime() > now.getTime() + TERMINAL_AUTHORIZATION_MAX_TTL_MS) {
+        throw new Error('Terminal authorization expiry is too far in the future');
+    }
+    const signature = decodeSignature(body.signature);
+    const signer = new PublicKey(expectedSigner);
+    const verified = nacl.sign.detached.verify(Buffer.from(body.message, 'utf8'), signature, signer.toBytes());
+    if (!verified) {
+        throw new Error('Invalid terminal authorization signature');
+    }
+    return {
+        expiresAt,
+        op: parsed.op,
+    };
+}
+function decodeSignature(signature) {
+    if (Array.isArray(signature)) {
+        if (signature.length !== 64 ||
+            !signature.every((value) => Number.isInteger(value) && value >= 0 && value <= 255)) {
+            throw new Error('Invalid terminal authorization signature');
+        }
+        return Uint8Array.from(signature);
+    }
+    const decoded = Buffer.from(signature, 'base64');
+    if (decoded.length !== 64 || decoded.toString('base64') !== signature) {
+        throw new Error('Invalid terminal authorization signature');
+    }
+    return decoded;
+}