@nosana/ssh 2.13.1

package/README.md

@@ -0,0 +1,51 @@
+# @nosana/ssh
+
+The local side of SSH access to Nosana jobs, with no network code:
+
+- generate OpenSSH Ed25519 key pairs in any runtime with Web Crypto;
+- validate and parse `authorized_keys`-style public keys with the node's limits;
+- read and update the SSH keys of a job definition;
+- describe the `ssh` command that reaches a job through its node's proxy.
+
+Talking to a node, which is where keys are granted and web terminals open,
+lives in `@nosana/api` under `api.jobs(job)`. The kit exposes it as
+`client.api.jobs(job)` and re-exports this package's tools.
+
+## Install
+
+```bash
+pnpm add @nosana/ssh
+```
+
+## Usage
+
+```ts
+import {
+  createSshCommand,
+  generateSshKeyPair,
+  parseSshPublicKeys,
+  withSshPublicKeys,
+} from '@nosana/ssh';
+
+const pair = await generateSshKeyPair({ comment: 'laptop' });
+
+const { keys, errors } = parseSshPublicKeys(authorizedKeysText);
+const definition = withSshPublicKeys(jobDefinition, keys);
+
+const command = createSshCommand(
+  { job: jobAddress, node: nodeAddress, nodeDomain: 'node.k8s.prd.nos.ci' },
+  { identityFile: '~/.ssh/id_ed25519' }, // the private half of the key the node was given
+);
+console.log(command.formattedCommand);
+// ssh ... nosana@<jobAddress>-0-ssh.node.k8s.prd.nos.ci
+```
+
+Every operation of a job has its own SSH sidecar; `opIndex` (the operation's
+position in the job definition's `ops`, default 0) picks which one the command
+reaches. The user is always `nosana`. Only interactive shells are served: no
+remote commands, `sftp`, `scp` or forwarding.
+
+A key line is at most one line; a job holds at most 10 keys and 64 KiB of key
+data. `parseSshPublicKeys` reports every problem rather than throwing, and
+`requireSshPublicKey` / `requireSshPublicKeySet` throw for callers that want
+validation before sending.

package/dist/connection.d.ts

@@ -0,0 +1,10 @@
+import type { SshCommandOptions, SshConnectionDescriptor, SshJobTarget } from './types.js';
+/** The only user name a job's SSH sidecar accepts; the hostname names the job. */
+export declare const SSH_USERNAME = "nosana";
+/** The hostname of one operation's SSH sidecar, as published through the node's proxy. */
+export declare function sshHostname(target: SshJobTarget, opIndex?: number): string;
+/** Describes the `ssh` invocation that reaches a job through its node's proxy. */
+export declare function createSshCommand(target: SshJobTarget, options?: SshCommandOptions): SshConnectionDescriptor;
+/** Joins an executable and its arguments into a POSIX shell command that can be pasted as is. */
+export declare function formatSshCommand(executable: string, args: string[]): string;
+//# sourceMappingURL=connection.d.ts.map

package/dist/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI3F,kFAAkF;AAClF,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,SAAI,GAAG,MAAM,CAKrE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,iBAAsB,GAC9B,uBAAuB,CAqBzB;AAWD,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAE3E"}

package/dist/connection.js

@@ -0,0 +1,45 @@
+const DEFAULT_PROXY_PORT = 5002;
+/** The only user name a job's SSH sidecar accepts; the hostname names the job. */
+export const SSH_USERNAME = 'nosana';
+/** The hostname of one operation's SSH sidecar, as published through the node's proxy. */
+export function sshHostname(target, opIndex = 0) {
+    if (!Number.isInteger(opIndex) || opIndex < 0) {
+        throw new Error('SSH operation index must be a non-negative integer.');
+    }
+    return `${target.job}-${opIndex}-ssh.${target.nodeDomain}`;
+}
+/** Describes the `ssh` invocation that reaches a job through its node's proxy. */
+export function createSshCommand(target, options = {}) {
+    const username = SSH_USERNAME;
+    const hostname = sshHostname(target, options.opIndex);
+    const proxyCommand = proxyCommandFor(target.nodeDomain, options);
+    const args = [
+        '-o',
+        'StrictHostKeyChecking=accept-new',
+        '-o',
+        `ProxyCommand=${proxyCommand}`,
+        ...(options.identityFile ? ['-i', options.identityFile] : []),
+        `${username}@${hostname}`,
+    ];
+    return {
+        executable: 'ssh',
+        username,
+        hostname,
+        proxyCommand,
+        args,
+        formattedCommand: formatSshCommand('ssh', args),
+    };
+}
+function proxyCommandFor(nodeDomain, { proxyMode = 'socat', proxyPort = DEFAULT_PROXY_PORT }) {
+    return proxyMode === 'nc'
+        ? `nc -X connect -x ${nodeDomain}:${proxyPort} %h %p`
+        : `socat - PROXY:${nodeDomain}:%h:%p,proxyport=${proxyPort}`;
+}
+/** Joins an executable and its arguments into a POSIX shell command that can be pasted as is. */
+export function formatSshCommand(executable, args) {
+    return [executable, ...args].map(shellQuote).join(' ');
+}
+function shellQuote(value) {
+    return /^[A-Za-z0-9_/:=.,%+@-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=connection.js.map

package/dist/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAEA,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,kFAAkF;AAClF,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,MAAoB,EAAE,OAAO,GAAG,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,kCAAkC;QAClC,IAAI;QACJ,gBAAgB,YAAY,EAAE;QAC9B,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,QAAQ,IAAI,QAAQ,EAAE;KAC1B,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,QAAQ;QACR,QAAQ;QACR,YAAY;QACZ,IAAI;QACJ,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,UAAkB,EAClB,EAAE,SAAS,GAAG,OAAO,EAAE,SAAS,GAAG,kBAAkB,EAAqB;IAE1E,OAAO,SAAS,KAAK,IAAI;QACvB,CAAC,CAAC,oBAAoB,UAAU,IAAI,SAAS,QAAQ;QACrD,CAAC,CAAC,iBAAiB,UAAU,oBAAoB,SAAS,EAAE,CAAC;AACjE,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAc;IACjE,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC9F,CAAC"}

package/dist/encoding.d.ts

@@ -0,0 +1,10 @@
+/** Byte helpers for the OpenSSH wire format and strict base64 text. */
+export declare function concatBytes(...chunks: Uint8Array[]): Uint8Array;
+export declare function encodeUint32(value: number): Uint8Array;
+export declare function readUint32(bytes: Uint8Array, offset: number): number | undefined;
+/** An SSH `string`: a big-endian uint32 length followed by the bytes. */
+export declare function encodeSshString(value: Uint8Array): Uint8Array;
+export declare function bytesToBase64(bytes: Uint8Array): string;
+/** Decodes canonical base64 only: the bits an encoder leaves unused before the padding must be zero. */
+export declare function base64ToBytes(value: string): Uint8Array | undefined;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../src/encoding.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,wBAAgB,WAAW,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAQ/D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAItD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGhF;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAE7D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIvD;AAKD,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAGnE"}

package/dist/encoding.js

@@ -0,0 +1,46 @@
+/** Byte helpers for the OpenSSH wire format and strict base64 text. */
+export function concatBytes(...chunks) {
+    const result = new Uint8Array(chunks.reduce((total, chunk) => total + chunk.length, 0));
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return result;
+}
+export function encodeUint32(value) {
+    const bytes = new Uint8Array(4);
+    new DataView(bytes.buffer).setUint32(0, value);
+    return bytes;
+}
+export function readUint32(bytes, offset) {
+    if (offset < 0 || offset + 4 > bytes.length)
+        return undefined;
+    return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(offset);
+}
+/** An SSH `string`: a big-endian uint32 length followed by the bytes. */
+export function encodeSshString(value) {
+    return concatBytes(encodeUint32(value.length), value);
+}
+export function bytesToBase64(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+/** Decodes canonical base64 only: the bits an encoder leaves unused before the padding must be zero. */
+export function base64ToBytes(value) {
+    if (value.length === 0 || !BASE64.test(value) || !hasCleanTail(value))
+        return undefined;
+    return Uint8Array.from(atob(value), (character) => character.charCodeAt(0));
+}
+function hasCleanTail(value) {
+    const padding = value.endsWith('==') ? 2 : value.endsWith('=') ? 1 : 0;
+    if (padding === 0)
+        return true;
+    const last = ALPHABET.indexOf(value[value.length - padding - 1]);
+    return (last & (padding === 2 ? 0b1111 : 0b11)) === 0;
+}
+//# sourceMappingURL=encoding.js.map

package/dist/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../src/encoding.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,MAAM,UAAU,WAAW,CAAC,GAAG,MAAoB;IACjD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB,EAAE,MAAc;IAC1D,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAC1F,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,MAAM,GAAG,kEAAkE,CAAC;AAClF,MAAM,QAAQ,GAAG,kEAAkE,CAAC;AAEpF,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC"}

package/dist/expiry.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Validates one SSH grant expiry the way the node's sidecar contract needs it:
+ * a strict ISO 8601 UTC timestamp, in the future, that JavaScript does not
+ * silently normalize (so `2025-02-30` is rejected rather than rolled forward).
+ * Returns the canonical ISO string, or throws.
+ */
+export declare function requireFutureSshExpiry(value: unknown, now?: number): string;
+//# sourceMappingURL=expiry.d.ts.map

package/dist/expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.d.ts","sourceRoot":"","sources":["../src/expiry.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,CAavF"}

package/dist/expiry.js

@@ -0,0 +1,23 @@
+/** ISO 8601 UTC, seconds precision with optional milliseconds: `2025-01-02T03:04:05Z`. */
+const ISO_8601_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/;
+/**
+ * Validates one SSH grant expiry the way the node's sidecar contract needs it:
+ * a strict ISO 8601 UTC timestamp, in the future, that JavaScript does not
+ * silently normalize (so `2025-02-30` is rejected rather than rolled forward).
+ * Returns the canonical ISO string, or throws.
+ */
+export function requireFutureSshExpiry(value, now = Date.now()) {
+    if (typeof value !== 'string' || !ISO_8601_UTC.test(value)) {
+        throw new Error('SSH expiry must be an ISO 8601 UTC timestamp.');
+    }
+    const date = new Date(value);
+    if (!Number.isFinite(date.getTime()) || date.getTime() <= now) {
+        throw new Error('SSH expiry must be in the future.');
+    }
+    // A real date round-trips; a normalized one (for example February 30) does not.
+    if (date.toISOString().slice(0, 19) !== value.slice(0, 19)) {
+        throw new Error('SSH expiry is not a valid date.');
+    }
+    return date.toISOString();
+}
+//# sourceMappingURL=expiry.js.map

package/dist/expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.js","sourceRoot":"","sources":["../src/expiry.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,YAAY,GAAG,sDAAsD,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,gFAAgF;IAChF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { createSshCommand, formatSshCommand, sshHostname, SSH_USERNAME } from './connection.js';
+export { bytesToBase64 } from './encoding.js';
+export { requireFutureSshExpiry } from './expiry.js';
+export { getSshPublicKeys, withSshPublicKeys } from './jobDefinition.js';
+export { generateSshKeyPair, SSH_ED25519 } from './keyPair.js';
+export { getSshKeyIdentity, isValidSshPublicKey, parseSshPublicKeys, requireSshPublicKey, requireSshPublicKeySet, MAX_SSH_PUBLIC_KEYS, MAX_SSH_PUBLIC_KEY_LINE_LENGTH, MAX_SSH_PUBLIC_KEYS_BYTES, SSH_PUBLIC_KEY_ALGORITHMS, } from './publicKeys.js';
+export { buildTerminalAuthorizationMessage, isSafeTerminalOperation, parseTerminalAuthorizationMessage, TERMINAL_AUTHORIZATION_AUDIENCE, TERMINAL_AUTHORIZATION_MAX_TTL_MS, TERMINAL_AUTHORIZATION_MESSAGE_HEADER, } from './terminalAuthorization.js';
+export type { ParsedTerminalAuthorizationMessage, TerminalAuthorizationMessageOptions, } from './terminalAuthorization.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AACpC,mBAAmB,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export { createSshCommand, formatSshCommand, sshHostname, SSH_USERNAME } from './connection.js';
+export { bytesToBase64 } from './encoding.js';
+export { requireFutureSshExpiry } from './expiry.js';
+export { getSshPublicKeys, withSshPublicKeys } from './jobDefinition.js';
+export { generateSshKeyPair, SSH_ED25519 } from './keyPair.js';
+export { getSshKeyIdentity, isValidSshPublicKey, parseSshPublicKeys, requireSshPublicKey, requireSshPublicKeySet, MAX_SSH_PUBLIC_KEYS, MAX_SSH_PUBLIC_KEY_LINE_LENGTH, MAX_SSH_PUBLIC_KEYS_BYTES, SSH_PUBLIC_KEY_ALGORITHMS, } from './publicKeys.js';
+export { buildTerminalAuthorizationMessage, isSafeTerminalOperation, parseTerminalAuthorizationMessage, TERMINAL_AUTHORIZATION_AUDIENCE, TERMINAL_AUTHORIZATION_MAX_TTL_MS, TERMINAL_AUTHORIZATION_MESSAGE_HEADER, } from './terminalAuthorization.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,4BAA4B,CAAC"}

package/dist/jobDefinition.d.ts

@@ -0,0 +1,6 @@
+import type { JobDefinition } from '@nosana/types';
+/** The SSH public keys a job definition grants access to, ignoring blank entries. */
+export declare function getSshPublicKeys(definition: JobDefinition): string[];
+/** A copy of `definition` granting exactly `publicKeys`; an empty list drops the `ssh` block. */
+export declare function withSshPublicKeys(definition: JobDefinition, publicKeys: string[]): JobDefinition;
+//# sourceMappingURL=jobDefinition.d.ts.map

package/dist/jobDefinition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobDefinition.d.ts","sourceRoot":"","sources":["../src/jobDefinition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,aAAa,GAAG,MAAM,EAAE,CAIpE;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,aAAa,CAIhG"}

package/dist/jobDefinition.js

@@ -0,0 +1,15 @@
+/** The SSH public keys a job definition grants access to, ignoring blank entries. */
+export function getSshPublicKeys(definition) {
+    const keys = definition.ssh?.public_keys;
+    if (!Array.isArray(keys))
+        return [];
+    return keys.filter((key) => typeof key === 'string' && key.trim().length > 0);
+}
+/** A copy of `definition` granting exactly `publicKeys`; an empty list drops the `ssh` block. */
+export function withSshPublicKeys(definition, publicKeys) {
+    const { ssh, ...rest } = definition;
+    if (publicKeys.length === 0)
+        return rest;
+    return { ...rest, ssh: { ...ssh, public_keys: [...publicKeys] } };
+}
+//# sourceMappingURL=jobDefinition.js.map

package/dist/jobDefinition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobDefinition.js","sourceRoot":"","sources":["../src/jobDefinition.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,UAAyB;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,UAAyB,EAAE,UAAoB;IAC/E,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;IACpC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE,CAAC;AACpE,CAAC"}

package/dist/keyPair.d.ts

@@ -0,0 +1,5 @@
+import type { GenerateSshKeyPairOptions, SshKeyPair } from './types.js';
+export declare const SSH_ED25519 = "ssh-ed25519";
+/** Generates an unencrypted, OpenSSH-formatted Ed25519 key pair. */
+export declare function generateSshKeyPair(options?: GenerateSshKeyPairOptions): Promise<SshKeyPair>;
+//# sourceMappingURL=keyPair.d.ts.map

package/dist/keyPair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyPair.d.ts","sourceRoot":"","sources":["../src/keyPair.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3F,eAAO,MAAM,WAAW,gBAAgB,CAAC;AASzC,oEAAoE;AACpE,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,UAAU,CAAC,CAkBrB"}

package/dist/keyPair.js

@@ -0,0 +1,47 @@
+import nacl from 'tweetnacl';
+import { bytesToBase64, concatBytes, encodeSshString, encodeUint32 } from './encoding.js';
+export const SSH_ED25519 = 'ssh-ed25519';
+const OPENSSH_KEY_MAGIC = 'openssh-key-v1\0';
+const OPENSSH_KEY_BLOCK_SIZE = 8;
+const DEFAULT_COMMENT = 'nosana';
+const PEM_LINE_LENGTH = 64;
+const encoder = new TextEncoder();
+/** Generates an unencrypted, OpenSSH-formatted Ed25519 key pair. */
+export async function generateSshKeyPair(options = {}) {
+    const random = randomSource(options.cryptoProvider ?? globalThis.crypto);
+    const seed = random(32);
+    const { publicKey } = nacl.sign.keyPair.fromSeed(seed);
+    const comment = normalizeComment(options.comment);
+    const publicKeyBlob = concatBytes(encodeSshString(encoder.encode(SSH_ED25519)), encodeSshString(publicKey));
+    return {
+        algorithm: SSH_ED25519,
+        publicKey: [SSH_ED25519, bytesToBase64(publicKeyBlob), comment].filter(Boolean).join(' '),
+        privateKey: toPem('OPENSSH PRIVATE KEY', encodePrivateKey({ seed, publicKey, publicKeyBlob, comment, checkInteger: random(4) })),
+    };
+}
+function randomSource(provider) {
+    if (typeof provider?.getRandomValues !== 'function') {
+        throw new Error('Secure SSH key generation is not supported in this runtime.');
+    }
+    return (length) => provider.getRandomValues(new Uint8Array(length));
+}
+/** OpenSSH comments are one word; whitespace would split the key line. */
+function normalizeComment(comment) {
+    return (comment ?? DEFAULT_COMMENT).trim().replace(/\s+/g, '-');
+}
+/** The `openssh-key-v1` container holding one unencrypted key. */
+function encodePrivateKey(parts) {
+    const privateSection = concatBytes(parts.checkInteger, parts.checkInteger, encodeSshString(encoder.encode(SSH_ED25519)), encodeSshString(parts.publicKey), encodeSshString(concatBytes(parts.seed, parts.publicKey)), encodeSshString(encoder.encode(parts.comment)));
+    const paddingLength = OPENSSH_KEY_BLOCK_SIZE - (privateSection.length % OPENSSH_KEY_BLOCK_SIZE);
+    const padding = Uint8Array.from({ length: paddingLength }, (_, index) => index + 1);
+    return concatBytes(encoder.encode(OPENSSH_KEY_MAGIC), encodeSshString(encoder.encode('none')), // cipher
+    encodeSshString(encoder.encode('none')), // key derivation
+    encodeSshString(new Uint8Array()), // key derivation options
+    encodeUint32(1), // number of keys
+    encodeSshString(parts.publicKeyBlob), encodeSshString(concatBytes(privateSection, padding)));
+}
+function toPem(label, bytes) {
+    const lines = bytesToBase64(bytes).match(new RegExp(`.{1,${PEM_LINE_LENGTH}}`, 'g')) ?? [];
+    return `-----BEGIN ${label}-----\n${lines.join('\n')}\n-----END ${label}-----\n`;
+}
+//# sourceMappingURL=keyPair.js.map

package/dist/keyPair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyPair.js","sourceRoot":"","sources":["../src/keyPair.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI1F,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AAEzC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACjC,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAqC,EAAE;IAEvC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,WAAW,CAC/B,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAC5C,eAAe,CAAC,SAAS,CAAC,CAC3B,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACzF,UAAU,EAAE,KAAK,CACf,qBAAqB,EACrB,gBAAgB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CACvF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAuC;IAC3D,IAAI,OAAO,QAAQ,EAAE,eAAe,KAAK,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,OAA2B;IACnD,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAWD,kEAAkE;AAClE,SAAS,gBAAgB,CAAC,KAAsB;IAC9C,MAAM,cAAc,GAAG,WAAW,CAChC,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,YAAY,EAClB,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAC5C,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,EAChC,eAAe,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EACzD,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAC/C,CAAC;IACF,MAAM,aAAa,GAAG,sBAAsB,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEpF,OAAO,WAAW,CAChB,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,EACjC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS;IAClD,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB;IAC1D,eAAe,CAAC,IAAI,UAAU,EAAE,CAAC,EAAE,yBAAyB;IAC5D,YAAY,CAAC,CAAC,CAAC,EAAE,iBAAiB;IAClC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,EACpC,eAAe,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,KAAiB;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,eAAe,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3F,OAAO,cAAc,KAAK,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC;AACnF,CAAC"}

package/dist/publicKeys.d.ts

@@ -0,0 +1,26 @@
+import type { SshPublicKeyParseResult } from './types.js';
+export declare const MAX_SSH_PUBLIC_KEYS = 10;
+export declare const MAX_SSH_PUBLIC_KEY_LINE_LENGTH = 8192;
+export declare const MAX_SSH_PUBLIC_KEYS_BYTES: number;
+export declare const SSH_PUBLIC_KEY_ALGORITHMS: ReadonlySet<string>;
+/**
+ * Whether `value` is one OpenSSH public-key line: a supported algorithm, a
+ * base64 blob that names the same algorithm, and at most one comment word.
+ */
+export declare function isValidSshPublicKey(value: string): boolean;
+/**
+ * A key's identity for deduplication and revocation: its algorithm and blob,
+ * with the comment dropped. Two lines that differ only by comment name the
+ * same key, so both the node and the client collapse them to one.
+ */
+export declare function getSshKeyIdentity(key: string): string;
+/** Returns the trimmed key, or throws when `value` is not exactly one valid OpenSSH public key. */
+export declare function requireSshPublicKey(value: unknown): string;
+/**
+ * Parses one key per line. Blank lines are skipped and duplicates collapsed;
+ * every problem is reported rather than thrown so callers can show them all.
+ */
+export declare function parseSshPublicKeys(input: string): SshPublicKeyParseResult;
+/** Validates a key set the way the node does, throwing with every problem found. */
+export declare function requireSshPublicKeySet(values: unknown): string[];
+//# sourceMappingURL=publicKeys.d.ts.map

package/dist/publicKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicKeys.d.ts","sourceRoot":"","sources":["../src/publicKeys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA0B,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAElF,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,eAAO,MAAM,8BAA8B,OAAO,CAAC;AACnD,eAAO,MAAM,yBAAyB,QAAY,CAAC;AAEnD,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAQxD,CAAC;AAKH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAWD,mGAAmG;AACnG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAK1D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAmBzE;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAKhE"}

package/dist/publicKeys.js

@@ -0,0 +1,114 @@
+import { base64ToBytes, readUint32 } from './encoding.js';
+export const MAX_SSH_PUBLIC_KEYS = 10;
+export const MAX_SSH_PUBLIC_KEY_LINE_LENGTH = 8192;
+export const MAX_SSH_PUBLIC_KEYS_BYTES = 64 * 1024;
+export const SSH_PUBLIC_KEY_ALGORITHMS = new Set([
+    'ssh-ed25519',
+    'ssh-rsa',
+    'ecdsa-sha2-nistp256',
+    'ecdsa-sha2-nistp384',
+    'ecdsa-sha2-nistp521',
+    'sk-ssh-ed25519@openssh.com',
+    'sk-ecdsa-sha2-nistp256@openssh.com',
+]);
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/**
+ * Whether `value` is one OpenSSH public-key line: a supported algorithm, a
+ * base64 blob that names the same algorithm, and at most one comment word.
+ */
+export function isValidSshPublicKey(value) {
+    const key = value.trim();
+    if (!key || key.length > MAX_SSH_PUBLIC_KEY_LINE_LENGTH)
+        return false;
+    // One line only: an embedded newline could smuggle a second authorized_keys entry.
+    if (/[\r\n]/.test(key))
+        return false;
+    const [algorithm, blob, , ...rest] = key.split(/\s+/);
+    if (rest.length > 0 || !blob || !SSH_PUBLIC_KEY_ALGORITHMS.has(algorithm))
+        return false;
+    return blobAlgorithm(blob) === algorithm;
+}
+/**
+ * A key's identity for deduplication and revocation: its algorithm and blob,
+ * with the comment dropped. Two lines that differ only by comment name the
+ * same key, so both the node and the client collapse them to one.
+ */
+export function getSshKeyIdentity(key) {
+    return key.trim().split(/\s+/).slice(0, 2).join(' ');
+}
+/** The algorithm name an OpenSSH public-key blob declares in its first field. */
+function blobAlgorithm(blob) {
+    const bytes = base64ToBytes(blob);
+    if (!bytes)
+        return undefined;
+    const length = readUint32(bytes, 0);
+    if (!length || 4 + length >= bytes.length)
+        return undefined;
+    return decoder.decode(bytes.subarray(4, 4 + length));
+}
+/** Returns the trimmed key, or throws when `value` is not exactly one valid OpenSSH public key. */
+export function requireSshPublicKey(value) {
+    if (typeof value !== 'string' || !isValidSshPublicKey(value)) {
+        throw new Error('A valid OpenSSH public key is required.');
+    }
+    return value.trim();
+}
+/**
+ * Parses one key per line. Blank lines are skipped and duplicates collapsed;
+ * every problem is reported rather than thrown so callers can show them all.
+ */
+export function parseSshPublicKeys(input) {
+    const keys = [];
+    const errors = [];
+    input.split(/\r?\n/).forEach((line, index) => {
+        const key = line.trim();
+        if (!key)
+            return;
+        if (isValidSshPublicKey(key)) {
+            keys.push(key);
+        }
+        else {
+            errors.push({
+                code: 'INVALID_KEY',
+                line: index + 1,
+                message: `Line ${index + 1} is not a valid OpenSSH public key.`,
+            });
+        }
+    });
+    return collectSshPublicKeys(keys, errors);
+}
+/** Validates a key set the way the node does, throwing with every problem found. */
+export function requireSshPublicKeySet(values) {
+    if (!Array.isArray(values))
+        throw new Error('Expected an array of SSH public keys.');
+    const { keys, errors } = collectSshPublicKeys(values.map(requireSshPublicKey));
+    if (errors.length > 0)
+        throw new Error(errors.map((error) => error.message).join(' '));
+    return keys;
+}
+/** Deduplicates keys that are already valid and reports the set limits the node enforces. */
+function collectSshPublicKeys(keys, errors = []) {
+    const byIdentity = new Map();
+    for (const key of keys) {
+        const identity = getSshKeyIdentity(key);
+        if (!byIdentity.has(identity))
+            byIdentity.set(identity, key);
+    }
+    const unique = [...byIdentity.values()];
+    if (unique.length > MAX_SSH_PUBLIC_KEYS) {
+        errors.push({
+            code: 'TOO_MANY_KEYS',
+            message: `A job can contain at most ${MAX_SSH_PUBLIC_KEYS} SSH public keys.`,
+        });
+    }
+    const totalBytes = unique.reduce((total, key) => total + encoder.encode(key).length, 0);
+    if (totalBytes > MAX_SSH_PUBLIC_KEYS_BYTES) {
+        errors.push({
+            code: 'KEY_SET_TOO_LARGE',
+            message: `SSH public keys can use at most ${MAX_SSH_PUBLIC_KEYS_BYTES} bytes in total.`,
+        });
+    }
+    return { keys: unique, errors };
+}
+//# sourceMappingURL=publicKeys.js.map

package/dist/publicKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicKeys.js","sourceRoot":"","sources":["../src/publicKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAI1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IACpE,aAAa;IACb,SAAS;IACT,qBAAqB;IACrB,qBAAqB;IACrB,qBAAqB;IACrB,4BAA4B;IAC5B,oCAAoC;CACrC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,8BAA8B;QAAE,OAAO,KAAK,CAAC;IACtE,mFAAmF;IACnF,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,AAAD,EAAG,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,MAAM,GAA6B,EAAE,CAAC;IAE5C,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,OAAO,EAAE,QAAQ,KAAK,GAAG,CAAC,qCAAqC;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACrF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,SAAS,oBAAoB,CAC3B,IAAc,EACd,SAAmC,EAAE;IAErC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,6BAA6B,mBAAmB,mBAAmB;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,mCAAmC,yBAAyB,kBAAkB;SACxF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/terminalAuthorization.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The wire contract for a signed, short-lived web-terminal authorization: the
+ * exact message the client signs and the node verifies. Both sides import this
+ * module so the format, field order and limits cannot drift between them.
+ */
+export declare const TERMINAL_AUTHORIZATION_MESSAGE_HEADER = "Nosana Terminal Authorization v1";
+export declare const TERMINAL_AUTHORIZATION_AUDIENCE = "nosana-web-terminal";
+export declare const TERMINAL_AUTHORIZATION_MAX_TTL_MS: number;
+export interface TerminalAuthorizationMessageOptions {
+    job: string;
+    node: string;
+    /** ISO 8601 UTC timestamp. */
+    expiresAt: string;
+    op?: string;
+    network: string;
+}
+export interface ParsedTerminalAuthorizationMessage {
+    job: string;
+    node: string;
+    expiresAt: string;
+    op?: string;
+    network?: string;
+    audience?: string;
+}
+/** An operation selector is interpolated into the signed message, so it must stay one plain token. */
+export declare function isSafeTerminalOperation(op: string): boolean;
+/** The exact text the node verifies; line order is part of the contract. */
+export declare function buildTerminalAuthorizationMessage(options: TerminalAuthorizationMessageOptions): string;
+/**
+ * Parses a terminal authorization message back into its fields. Enforces the
+ * header and that `job`, `node` and `expiresAt` are present; the caller checks
+ * the values and the signature. Duplicate or malformed lines are rejected.
+ */
+export declare function parseTerminalAuthorizationMessage(message: string): ParsedTerminalAuthorizationMessage;
+//# sourceMappingURL=terminalAuthorization.d.ts.map

package/dist/terminalAuthorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminalAuthorization.d.ts","sourceRoot":"","sources":["../src/terminalAuthorization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,qCAAqC,qCAAqC,CAAC;AACxF,eAAO,MAAM,+BAA+B,wBAAwB,CAAC;AACrE,eAAO,MAAM,iCAAiC,QAAgB,CAAC;AAE/D,MAAM,WAAW,mCAAmC;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kCAAkC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sGAAsG;AACtG,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,4EAA4E;AAC5E,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,mCAAmC,GAC3C,MAAM,CAWR;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,MAAM,GACd,kCAAkC,CA8BpC"}

package/dist/terminalAuthorization.js

@@ -0,0 +1,59 @@
+/**
+ * The wire contract for a signed, short-lived web-terminal authorization: the
+ * exact message the client signs and the node verifies. Both sides import this
+ * module so the format, field order and limits cannot drift between them.
+ */
+export const TERMINAL_AUTHORIZATION_MESSAGE_HEADER = 'Nosana Terminal Authorization v1';
+export const TERMINAL_AUTHORIZATION_AUDIENCE = 'nosana-web-terminal';
+export const TERMINAL_AUTHORIZATION_MAX_TTL_MS = 5 * 60 * 1000;
+/** An operation selector is interpolated into the signed message, so it must stay one plain token. */
+export function isSafeTerminalOperation(op) {
+    return /^[A-Za-z0-9._:-]+$/.test(op);
+}
+/** The exact text the node verifies; line order is part of the contract. */
+export function buildTerminalAuthorizationMessage(options) {
+    return [
+        TERMINAL_AUTHORIZATION_MESSAGE_HEADER,
+        '',
+        `job: ${options.job}`,
+        `node: ${options.node}`,
+        `expiresAt: ${options.expiresAt}`,
+        ...(options.op ? [`op: ${options.op}`] : []),
+        `network: ${options.network}`,
+        `audience: ${TERMINAL_AUTHORIZATION_AUDIENCE}`,
+    ].join('\n');
+}
+/**
+ * Parses a terminal authorization message back into its fields. Enforces the
+ * header and that `job`, `node` and `expiresAt` are present; the caller checks
+ * the values and the signature. Duplicate or malformed lines are rejected.
+ */
+export function parseTerminalAuthorizationMessage(message) {
+    const lines = message.split(/\r?\n/);
+    if (lines[0] !== TERMINAL_AUTHORIZATION_MESSAGE_HEADER) {
+        throw new Error('Invalid terminal authorization message header');
+    }
+    const fields = {};
+    for (const line of lines.slice(1)) {
+        if (!line.trim())
+            continue;
+        const separator = line.indexOf(':');
+        if (separator === -1) {
+            throw new Error('Invalid terminal authorization message field');
+        }
+        const key = line.slice(0, separator).trim();
+        const value = line.slice(separator + 1).trim();
+        if (!key || !value || fields[key]) {
+            throw new Error('Invalid terminal authorization message field');
+        }
+        fields[key] = value;
+    }
+    for (const required of ['job', 'node', 'expiresAt']) {
+        if (!fields[required]) {
+            throw new Error(`Missing terminal authorization field: ${required}`);
+        }
+    }
+    // The required fields are present by the check above; the rest are optional.
+    return fields;
+}
+//# sourceMappingURL=terminalAuthorization.js.map

package/dist/terminalAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminalAuthorization.js","sourceRoot":"","sources":["../src/terminalAuthorization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,qCAAqC,GAAG,kCAAkC,CAAC;AACxF,MAAM,CAAC,MAAM,+BAA+B,GAAG,qBAAqB,CAAC;AACrE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAoB/D,sGAAsG;AACtG,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,OAAO,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iCAAiC,CAC/C,OAA4C;IAE5C,OAAO;QACL,qCAAqC;QACrC,EAAE;QACF,QAAQ,OAAO,CAAC,GAAG,EAAE;QACrB,SAAS,OAAO,CAAC,IAAI,EAAE;QACvB,cAAc,OAAO,CAAC,SAAS,EAAE;QACjC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,YAAY,OAAO,CAAC,OAAO,EAAE;QAC7B,aAAa,+BAA+B,EAAE;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAAe;IAEf,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,qCAAqC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAU,EAAE,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,OAAO,MAAuD,CAAC;AACjE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,60 @@
+/** The job an SSH command reaches, and the node that runs it. */
+export interface SshJobTarget {
+    job: string;
+    node: string;
+    /** The proxy domain of the node's network; the sidecar hostname hangs under it. */
+    nodeDomain: string;
+}
+export type SshProxyMode = 'socat' | 'nc';
+/** How the local `ssh` client should reach the node's proxy. */
+export interface SshCommandOptions {
+    /** Port of the node's CONNECT proxy; defaults to 5002. */
+    proxyPort?: string | number;
+    /** Which local tool tunnels through the proxy; defaults to `socat`. */
+    proxyMode?: SshProxyMode;
+    /** The private key to connect with, passed to `ssh -i`. */
+    identityFile?: string;
+    /**
+     * Which operation of the job to reach, as its position in the job
+     * definition's `ops`; every operation has its own SSH sidecar. Defaults to 0.
+     */
+    opIndex?: number;
+}
+export interface SshConnectionDescriptor {
+    executable: 'ssh';
+    username: string;
+    hostname: string;
+    proxyCommand: string;
+    args: string[];
+    /** The full command, shell-quoted for copy and paste. */
+    formattedCommand: string;
+}
+/** A source of cryptographically secure random bytes, such as Web Crypto. */
+export interface SshCryptoProvider {
+    getRandomValues<T extends ArrayBufferView>(array: T): T;
+}
+export interface GenerateSshKeyPairOptions {
+    /** Trailing comment of the public key; defaults to `nosana`. */
+    comment?: string;
+    /** Defaults to `globalThis.crypto`. */
+    cryptoProvider?: SshCryptoProvider;
+}
+export interface SshKeyPair {
+    algorithm: 'ssh-ed25519';
+    /** One OpenSSH `authorized_keys` line. */
+    publicKey: string;
+    /** PEM-wrapped, unencrypted OpenSSH private key. */
+    privateKey: string;
+}
+export type SshPublicKeyParseErrorCode = 'INVALID_KEY' | 'TOO_MANY_KEYS' | 'KEY_SET_TOO_LARGE';
+export interface SshPublicKeyParseError {
+    code: SshPublicKeyParseErrorCode;
+    /** 1-based line of the offending key; absent for whole-set errors. */
+    line?: number;
+    message: string;
+}
+export interface SshPublicKeyParseResult {
+    keys: string[];
+    errors: SshPublicKeyParseError[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,IAAI,CAAC;AAE1C,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,uEAAuE;IACvE,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,KAAK,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yDAAyD;IACzD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,eAAe,CAAC,CAAC,SAAS,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,aAAa,CAAC;IACzB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAE/F,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,0BAA0B,CAAC;IACjC,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,sBAAsB,EAAE,CAAC;CAClC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@nosana/ssh",
+  "version": "2.13.1",
+  "description": "SSH tooling for Nosana jobs: OpenSSH key pairs, public-key validation, job definition keys and the ssh command that reaches a job",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "author": "Nosana",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nosana-ci/nosana-kit.git",
+    "directory": "packages/ssh"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc --build",
+    "build:with-deps": "pnpm --filter $npm_package_name... run build",
+    "dev": "tsc --watch",
+    "dev:with-deps": "pnpm --filter $npm_package_name... --parallel run dev",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "lint": "eslint ./src",
+    "lint:fix": "eslint --fix ./src",
+    "format": "prettier --config ../../.prettierrc --check \"src/**/*.ts\"",
+    "format:fix": "prettier --config ../../.prettierrc --write \"src/**/*.ts\""
+  },
+  "dependencies": {
+    "@nosana/types": "2.13.0",
+    "tweetnacl": "^1.0.3"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.14",
+    "@vitest/coverage-v8": "^4.0.16",
+    "prettier": "^3.7.4",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.16"
+  },
+  "packageManager": "pnpm@10.28.1",
+  "engines": {
+    "node": ">=20.18.0"
+  },
+  "gitHead": "694cadb116a2dcb5d27a591ceba5f91daaf39c73"
+}