@opentui/ssh 0.0.0-20260612-c3be6d8c

package/index.js

@@ -0,0 +1,988 @@
+// @bun
+// src/errors.ts
+class SshError extends Error {
+  code;
+  constructor(code, message) {
+    super(`@opentui/ssh: ${message}`);
+    this.name = new.target.name;
+    this.code = code;
+  }
+}
+
+class ConfigError extends SshError {
+  constructor(message) {
+    super("CONFIG", message);
+  }
+}
+
+class DenyError extends Error {
+  reason;
+  constructor(reason) {
+    super(reason ?? "session denied");
+    this.name = "DenyError";
+    this.reason = reason;
+  }
+}
+var isDeny = (err) => err instanceof DenyError;
+// src/logging.ts
+var formatAddress = (address) => address.port != null ? `${address.address}:${address.port}` : address.address;
+var formatDuration = (ms) => ms < 1000 ? `${ms}ms` : `${(ms / 1000).toFixed(1)}s`;
+var escapeControls = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+function formatLogEvent(event) {
+  const who = `${escapeControls(event.identity.username)}@${formatAddress(event.remoteAddress)}`;
+  if (event.type === "connect") {
+    const method = event.identity.method === "publickey" ? `publickey ${event.identity.fingerprint}` : event.identity.method;
+    return `connect    ${who}  ${method}  ${escapeControls(event.term)} ${event.cols}\xD7${event.rows}`;
+  }
+  return `disconnect ${who}  ${formatDuration(event.durationMs)}`;
+}
+function logging(options = {}) {
+  const sink = options.log ?? ((event) => console.log(formatLogEvent(event)));
+  const emit = (event) => {
+    try {
+      Promise.resolve(sink(event)).catch(() => {});
+    } catch {}
+  };
+  return async (session, next) => {
+    const start = Date.now();
+    emit({
+      type: "connect",
+      identity: session.identity,
+      remoteAddress: session.remoteAddress,
+      term: session.term,
+      cols: session.cols,
+      rows: session.rows
+    });
+    try {
+      return await next();
+    } finally {
+      emit({
+        type: "disconnect",
+        identity: session.identity,
+        remoteAddress: session.remoteAddress,
+        term: session.term,
+        cols: session.cols,
+        rows: session.rows,
+        durationMs: Date.now() - start
+      });
+    }
+  };
+}
+// src/server.ts
+import ssh22 from "ssh2";
+
+// src/keys.ts
+import { createHash, randomUUID } from "crypto";
+import { existsSync, linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { dirname } from "path";
+import ssh2 from "ssh2";
+var { utils } = ssh2;
+var HOST_KEYGEN_ATTEMPTS = 20;
+var isKeyInput = (value) => typeof value === "string" || Buffer.isBuffer(value);
+function sha256Fingerprint(publicKeyBlob) {
+  const digest = createHash("sha256").update(publicKeyBlob).digest("base64");
+  return `SHA256:${digest.replace(/=+$/, "")}`;
+}
+function parseOneKey(input) {
+  const parsed = utils.parseKey(input);
+  if (parsed instanceof Error)
+    return null;
+  return Array.isArray(parsed) ? parsed[0] : parsed;
+}
+function generateParseableHostKey() {
+  for (let i = 0;i < HOST_KEYGEN_ATTEMPTS; i++) {
+    const pair = utils.generateKeyPairSync("ed25519");
+    if (parseOneKey(pair.private))
+      return pair.private;
+  }
+  throw new ConfigError("could not generate a parseable ed25519 host key");
+}
+function resolveHostKey(config) {
+  const hostKey = config.hostKey;
+  let hostKeyPems;
+  let source;
+  if (hostKey === undefined) {
+    hostKeyPems = [generateParseableHostKey()];
+    source = "ephemeral";
+  } else if (!hostKey || typeof hostKey !== "object" || Array.isArray(hostKey)) {
+    throw new ConfigError("hostKey must contain either path or pem");
+  } else if ("pem" in hostKey) {
+    if ("path" in hostKey)
+      throw new ConfigError("hostKey must contain either path or pem, not both");
+    if (!(isKeyInput(hostKey.pem) || Array.isArray(hostKey.pem) && hostKey.pem.every(isKeyInput))) {
+      throw new ConfigError("hostKey.pem must be a key or array of keys");
+    }
+    hostKeyPems = Array.isArray(hostKey.pem) ? hostKey.pem : [hostKey.pem];
+    source = "provided";
+  } else if ("path" in hostKey) {
+    if (typeof hostKey.path !== "string" || hostKey.path.length === 0) {
+      throw new ConfigError("hostKey.path must be a non-empty string");
+    }
+    if (existsSync(hostKey.path)) {
+      hostKeyPems = [readFileSync(hostKey.path)];
+      source = `loaded ${hostKey.path}`;
+    } else {
+      const pem = generateParseableHostKey();
+      mkdirSync(dirname(hostKey.path), { recursive: true, mode: 448 });
+      const temporaryPath = `${hostKey.path}.${process.pid}.${randomUUID()}.tmp`;
+      try {
+        writeFileSync(temporaryPath, pem, { mode: 384, flag: "wx" });
+        try {
+          linkSync(temporaryPath, hostKey.path);
+          hostKeyPems = [pem];
+          source = `generated ${hostKey.path}`;
+        } catch (error) {
+          if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST")
+            throw error;
+          hostKeyPems = [readFileSync(hostKey.path)];
+          source = `loaded ${hostKey.path}`;
+        }
+      } finally {
+        try {
+          unlinkSync(temporaryPath);
+        } catch {}
+      }
+    }
+  } else {
+    throw new ConfigError("hostKey must contain either path or pem");
+  }
+  const keys = hostKeyPems.map((pem) => parseOneKey(pem));
+  if (keys.length === 0)
+    throw new ConfigError("hostKey.pem must contain at least one host key");
+  if (keys.some((key) => !key))
+    throw new ConfigError(`could not parse host key (${source})`);
+  return {
+    hostKeyPems,
+    fingerprints: keys.map((key) => sha256Fingerprint(key.getPublicSSH())),
+    algorithms: keys.map((key) => key.type),
+    source
+  };
+}
+
+// src/banner.ts
+function formatBanner(info, descriptor) {
+  const displayHost = info.host === "0.0.0.0" || info.host === "::" ? "localhost" : info.host;
+  const urlHost = displayHost.includes(":") ? `[${displayHost}]` : displayHost;
+  const lines = [
+    `@opentui/ssh  \u25B8  ssh://${urlHost}:${info.port}`,
+    ...info.fingerprints.map((fingerprint, index) => `host key      ${fingerprint}  (${descriptor.algorithms[index]}, ${descriptor.source})`),
+    `auth          ${descriptor.methods.join(", ")}`
+  ];
+  if (descriptor.authorizedKeys?.size) {
+    const fps = [...descriptor.authorizedKeys].slice(0, 3).map((b64) => sha256Fingerprint(Buffer.from(b64, "base64")));
+    const more = descriptor.authorizedKeys.size > fps.length ? " \u2026" : "";
+    lines.push(`authorized    ${descriptor.authorizedKeys.size} keys  \xB7  ${fps.join(" ")}${more}`);
+  }
+  return lines;
+}
+
+// src/bridge.ts
+import { Readable, Writable } from "stream";
+import { CliRenderEvents, createCliRenderer } from "@opentui/core";
+
+// src/safe.ts
+function createSafeInvoke(onError) {
+  const report = (err) => {
+    try {
+      onError(err);
+    } catch {}
+  };
+  const safe = async (fn) => {
+    try {
+      await fn();
+    } catch (err) {
+      report(err);
+    }
+  };
+  return Object.assign(safe, { report });
+}
+function ignoreErrors(fn) {
+  try {
+    fn();
+  } catch {}
+}
+
+// src/bridge.ts
+var DEFAULT_PTY = { term: "xterm-256color", cols: 80, rows: 24, hasPty: false };
+var MAX_PTY = { cols: 500, rows: 200 };
+var TRANSPORT_DRAIN_TIMEOUT_MS = 1000;
+var UNKNOWN_REMOTE_ADDRESS = { address: "unknown" };
+function clampPtyDimension(value, fallback, max) {
+  if (!Number.isFinite(value) || value <= 0)
+    return fallback;
+  const integer = Math.floor(value);
+  return integer > 0 ? Math.min(integer, max) : fallback;
+}
+function normalizePtyInfo(pty) {
+  return {
+    term: pty.term || DEFAULT_PTY.term,
+    cols: clampPtyDimension(pty.cols, DEFAULT_PTY.cols, MAX_PTY.cols),
+    rows: clampPtyDimension(pty.rows, DEFAULT_PTY.rows, MAX_PTY.rows),
+    hasPty: pty.hasPty
+  };
+}
+function createSessionStreams(channel, cols, rows, onActivity) {
+  let inputPaused = false;
+  const stdin = new Readable({
+    read() {
+      if (!inputPaused)
+        return;
+      inputPaused = false;
+      channel.resume();
+    }
+  });
+  const onData = (chunk) => {
+    onActivity?.();
+    if (!stdin.push(chunk) && !inputPaused) {
+      inputPaused = true;
+      channel.pause();
+    }
+  };
+  channel.on("data", onData);
+  let channelGone = false;
+  let pendingDrain = null;
+  const releasePending = () => {
+    const done = pendingDrain;
+    pendingDrain = null;
+    done?.();
+  };
+  channel.on("close", () => {
+    channelGone = true;
+    releasePending();
+  });
+  channel.on("error", () => {
+    channelGone = true;
+    releasePending();
+  });
+  const stdout = new Writable({
+    write(chunk, _enc, cb) {
+      if (channelGone)
+        return cb();
+      const bytes = Buffer.from(chunk);
+      if (bytes.byteLength === 0)
+        return cb();
+      const ok = channel.write(bytes);
+      if (ok)
+        return cb();
+      pendingDrain = cb;
+      channel.once("drain", releasePending);
+    }
+  });
+  stdout.columns = cols;
+  stdout.rows = rows;
+  return { stdin, stdout, detach: () => channel.removeListener("data", onData) };
+}
+function createSessionBridge(channel, options) {
+  const {
+    pty,
+    identity,
+    idleTimeoutMs,
+    maxTimeoutMs,
+    safe,
+    createRenderer = createCliRenderer,
+    remoteAddress = UNKNOWN_REMOTE_ADDRESS
+  } = options;
+  const initialPty = normalizePtyInfo(pty);
+  let resetIdle = () => {};
+  const { stdin, stdout, detach } = createSessionStreams(channel, initialPty.cols, initialPty.rows, () => resetIdle());
+  let renderer;
+  let cols = initialPty.cols;
+  let rows = initialPty.rows;
+  const context = {};
+  const resizeListeners = new Set;
+  const closeListeners = new Set;
+  let closed = false;
+  let channelClosed = false;
+  let stdoutFinished = false;
+  let pendingRawWrites = 0;
+  let transportCloseTimer;
+  let resolveTransportClosed;
+  const transportClosed = new Promise((resolve) => {
+    resolveTransportClosed = resolve;
+  });
+  let idleTimer;
+  let maxTimer;
+  const session = {
+    get renderer() {
+      if (!renderer) {
+        throw new Error("@opentui/ssh: session.renderer is unavailable until the handler runs \u2014 a middleware must call next() before using it");
+      }
+      return renderer;
+    },
+    identity,
+    context,
+    term: initialPty.term,
+    hasPty: initialPty.hasPty,
+    remoteAddress,
+    get cols() {
+      return cols;
+    },
+    get rows() {
+      return rows;
+    },
+    onResize(listener) {
+      if (closed)
+        return () => {};
+      resizeListeners.add(listener);
+      return () => resizeListeners.delete(listener);
+    },
+    onClose(listener) {
+      if (closed) {
+        safe(listener);
+        return () => {};
+      }
+      closeListeners.add(listener);
+      return () => closeListeners.delete(listener);
+    },
+    write(data) {
+      if (closed)
+        return;
+      pendingRawWrites++;
+      channel.write(data, () => {
+        pendingRawWrites--;
+        finishTransportClose();
+      });
+    },
+    end() {
+      destroy();
+    },
+    deny(reason) {
+      if (reason && !closed) {
+        session.write(/\r?\n$/.test(reason) ? reason : `${reason}\r
+`);
+      }
+      destroy();
+      throw new DenyError(reason);
+    }
+  };
+  const resize = (requestedCols, requestedRows) => {
+    if (closed)
+      return;
+    const nextCols = clampPtyDimension(requestedCols, cols, MAX_PTY.cols);
+    const nextRows = clampPtyDimension(requestedRows, rows, MAX_PTY.rows);
+    cols = nextCols;
+    rows = nextRows;
+    stdout.columns = nextCols;
+    stdout.rows = nextRows;
+    renderer?.resize(nextCols, nextRows);
+    resizeListeners.forEach((listener) => safe(() => listener(nextCols, nextRows)));
+  };
+  const settleTransportClosed = () => {
+    if (transportCloseTimer)
+      clearTimeout(transportCloseTimer);
+    resolveTransportClosed();
+  };
+  const closeTransport = () => {
+    if (channelClosed)
+      return settleTransportClosed();
+    ignoreErrors(() => channel.exit(0));
+    ignoreErrors(() => channel.close());
+    settleTransportClosed();
+  };
+  const finishTransportClose = () => {
+    if (!closed || !stdoutFinished || pendingRawWrites > 0 || channelClosed)
+      return;
+    closeTransport();
+  };
+  const destroy = () => {
+    if (closed)
+      return transportClosed;
+    closed = true;
+    if (idleTimer)
+      clearTimeout(idleTimer);
+    if (maxTimer)
+      clearTimeout(maxTimer);
+    ignoreErrors(() => renderer?.destroy());
+    if (!channelClosed) {
+      transportCloseTimer = setTimeout(closeTransport, TRANSPORT_DRAIN_TIMEOUT_MS);
+      queueMicrotask(() => {
+        stdout.end(() => {
+          stdoutFinished = true;
+          finishTransportClose();
+        });
+      });
+    }
+    detach();
+    closeListeners.forEach((listener) => safe(listener));
+    if (channelClosed)
+      settleTransportClosed();
+    return transportClosed;
+  };
+  if (idleTimeoutMs && idleTimeoutMs > 0) {
+    resetIdle = () => {
+      if (closed)
+        return;
+      if (idleTimer)
+        clearTimeout(idleTimer);
+      idleTimer = setTimeout(destroy, idleTimeoutMs);
+    };
+    resetIdle();
+  }
+  if (maxTimeoutMs && maxTimeoutMs > 0) {
+    maxTimer = setTimeout(destroy, maxTimeoutMs);
+  }
+  channel.on("close", () => {
+    channelClosed = true;
+    settleTransportClosed();
+    destroy();
+  });
+  channel.on("error", (error) => {
+    channelClosed = true;
+    settleTransportClosed();
+    safe.report(error);
+    destroy();
+  });
+  const attachRenderer = async () => {
+    if (renderer)
+      return renderer;
+    if (closed)
+      return null;
+    const createdRenderer = await createRenderer({
+      stdin,
+      stdout,
+      width: cols,
+      height: rows,
+      exitOnCtrlC: false,
+      exitSignals: [],
+      consoleMode: "disabled",
+      targetFps: 30
+    });
+    if (closed) {
+      ignoreErrors(() => createdRenderer.destroy());
+      return null;
+    }
+    if (createdRenderer.width !== cols || createdRenderer.height !== rows) {
+      createdRenderer.resize(cols, rows);
+    }
+    createdRenderer.on(CliRenderEvents.DESTROY, destroy);
+    renderer = createdRenderer;
+    return renderer;
+  };
+  const enterApp = async (handler) => {
+    const ended = new Promise((resolve) => session.onClose(resolve));
+    if (closed)
+      return ended;
+    let attachedRenderer;
+    try {
+      attachedRenderer = await attachRenderer();
+    } catch (err) {
+      destroy();
+      throw err;
+    }
+    if (!attachedRenderer)
+      return ended;
+    const handlerDone = Promise.resolve().then(() => handler(session)).then(() => ({ type: "handler" }), (err) => ({ type: "handler-error", err }));
+    const outcome = await Promise.race([handlerDone, ended.then(() => ({ type: "ended" }))]);
+    if (outcome.type === "handler-error")
+      throw outcome.err;
+    if (outcome.type === "handler")
+      await ended;
+    if (outcome.type === "ended") {
+      handlerDone.then((late) => {
+        if (late.type === "handler-error")
+          safe.report(late.err);
+      });
+    }
+  };
+  return {
+    session,
+    get closed() {
+      return closed;
+    },
+    enterApp,
+    resize,
+    destroy
+  };
+}
+
+// src/run-session.ts
+function runSession(middlewares, handler, bridge, safe) {
+  const session = bridge.session;
+  const context = session.context;
+  const dispatch = async (index) => {
+    if (index === middlewares.length)
+      return bridge.enterApp(handler);
+    const mw = middlewares[index];
+    let nextCalled = false;
+    const next = (add) => {
+      if (nextCalled)
+        throw new Error("@opentui/ssh: next() called more than once in a single middleware");
+      nextCalled = true;
+      if (add)
+        Object.assign(context, add);
+      return dispatch(index + 1);
+    };
+    await mw(session, next);
+  };
+  safe(async () => {
+    try {
+      await dispatch(0);
+    } catch (err) {
+      if (!isDeny(err))
+        throw err;
+    } finally {
+      session.end();
+    }
+  });
+}
+
+// src/connection.ts
+var SHUTDOWN_DRAIN_TIMEOUT_MS = 1000;
+var normalizeAddress = (address) => {
+  if (!address)
+    return "unknown";
+  return address.startsWith("::ffff:") ? address.slice("::ffff:".length) : address;
+};
+var toRemoteAddress = (address, port) => ({
+  address: normalizeAddress(address),
+  ...typeof port === "number" ? { port } : {}
+});
+function createConnectionHandler(dependencies) {
+  const { authenticator, middlewares, handler, safe, idleTimeoutMs, maxTimeoutMs, sessionLimits } = dependencies;
+  const clients = new Set;
+  const bridges = new Map;
+  let activeSessions = 0;
+  let acceptingSessions = false;
+  const onConnection = (client, info) => {
+    clients.add(client);
+    let connected = true;
+    let connectionSessions = 0;
+    let identity = { method: "none", username: "unknown" };
+    const remoteAddress = toRemoteAddress(info.ip, info.port);
+    client.on("authentication", async (ctx) => {
+      const outcome = await authenticator.handle(ctx);
+      if (!connected)
+        return;
+      if (outcome.type === "reject")
+        return ctx.reject(outcome.methods);
+      if (outcome.type === "accept")
+        identity = outcome.identity;
+      return ctx.accept();
+    });
+    client.on("ready", () => {
+      client.on("session", (acceptSession) => {
+        const sshSession = acceptSession();
+        let pty = DEFAULT_PTY;
+        let activeBridge;
+        sshSession.on("pty", (accept, _reject, info2) => {
+          pty = {
+            term: info2.term ?? "",
+            cols: info2.cols,
+            rows: info2.rows,
+            hasPty: true
+          };
+          accept?.();
+        });
+        sshSession.on("window-change", (accept, _reject, info2) => {
+          accept?.();
+          activeBridge?.resize(info2.cols, info2.rows);
+        });
+        sshSession.on("shell", (accept, reject) => {
+          if (!acceptingSessions || connectionSessions >= sessionLimits.perConnection || activeSessions >= sessionLimits.global) {
+            reject?.();
+            return;
+          }
+          connectionSessions++;
+          activeSessions++;
+          let released = false;
+          const release = () => {
+            if (released)
+              return;
+            released = true;
+            connectionSessions--;
+            activeSessions--;
+          };
+          let channel;
+          try {
+            channel = accept();
+            const shellBridge = createSessionBridge(channel, {
+              pty,
+              identity,
+              idleTimeoutMs,
+              maxTimeoutMs,
+              safe,
+              remoteAddress
+            });
+            activeBridge = shellBridge;
+            bridges.set(shellBridge, release);
+            shellBridge.session.onClose(() => {
+              shellBridge.destroy().finally(() => {
+                bridges.delete(shellBridge);
+                release();
+              });
+            });
+            runSession(middlewares, handler, shellBridge, safe);
+          } catch (error) {
+            const acceptedChannel = channel;
+            if (acceptedChannel)
+              ignoreErrors(() => acceptedChannel.close());
+            release();
+            safe.report(error);
+          }
+        });
+      });
+    });
+    client.on("close", () => {
+      connected = false;
+      clients.delete(client);
+    });
+    client.on("error", (err) => safe.report(err));
+  };
+  const closeAll = async () => {
+    acceptingSessions = false;
+    const draining = Promise.all([...bridges.keys()].map((bridge) => bridge.destroy()));
+    let timeout;
+    await Promise.race([
+      draining,
+      new Promise((resolve) => {
+        timeout = setTimeout(resolve, SHUTDOWN_DRAIN_TIMEOUT_MS);
+      })
+    ]);
+    if (timeout)
+      clearTimeout(timeout);
+    for (const release of bridges.values())
+      release();
+    bridges.clear();
+    for (const client of clients) {
+      ignoreErrors(() => client.end());
+      ignoreErrors(() => {
+        client._sock?.destroy?.();
+      });
+    }
+    clients.clear();
+  };
+  return {
+    onConnection,
+    closeAll,
+    setAccepting(accepting) {
+      acceptingSessions = accepting;
+    }
+  };
+}
+
+// src/auth.ts
+import { readFileSync as readFileSync2 } from "fs";
+function attemptFromAuthContext(ctx) {
+  switch (ctx.method) {
+    case "none":
+      return { method: "none", username: ctx.username };
+    case "password":
+      return { method: "password", username: ctx.username, password: ctx.password };
+    case "keyboard-interactive":
+      return {
+        method: "keyboard-interactive",
+        username: ctx.username,
+        prompt: (questions) => new Promise((resolve) => {
+          ctx.prompt(questions, (answers) => resolve(answers ?? []));
+        })
+      };
+    case "publickey":
+      return {
+        method: "publickey",
+        username: ctx.username,
+        key: { algorithm: ctx.key.algo, blob: ctx.key.data },
+        signature: ctx.signature,
+        blob: ctx.blob,
+        hashAlgo: ctx.hashAlgo
+      };
+    default:
+      return null;
+  }
+}
+function parseAttemptKey(key) {
+  return parseOneKey(`${key.algorithm} ${key.blob.toString("base64")}`);
+}
+function createAuthenticator(auth, authorizedKeys, onError = () => {}) {
+  const guard = async (fn) => {
+    try {
+      return await fn() === true;
+    } catch (err) {
+      onError(err);
+      return false;
+    }
+  };
+  const advertisedMethods = () => {
+    const methods = [];
+    if (auth.publicKey || authorizedKeys)
+      methods.push("publickey");
+    if (auth.password)
+      methods.push("password");
+    if (auth.keyboardInteractive)
+      methods.push("keyboard-interactive");
+    if (auth.none)
+      methods.push("none");
+    return methods;
+  };
+  const reject = () => ({ type: "reject", methods: advertisedMethods() });
+  const allowFn = typeof auth.publicKey === "object" ? auth.publicKey.allow : undefined;
+  const staticAdmits = (attempt) => auth.publicKey === "any" || authorizedKeys?.has(attempt.key.blob.toString("base64")) === true;
+  const authenticate = async (attempt) => {
+    switch (attempt.method) {
+      case "none":
+        return auth.none ? { type: "accept", identity: { method: "none", username: attempt.username } } : reject();
+      case "password": {
+        const fn = auth.password;
+        if (!fn)
+          return reject();
+        const ok = await guard(() => fn({ username: attempt.username, password: attempt.password }));
+        return ok ? { type: "accept", identity: { method: "password", username: attempt.username } } : reject();
+      }
+      case "keyboard-interactive": {
+        const fn = auth.keyboardInteractive;
+        if (!fn)
+          return reject();
+        const ok = await guard(() => fn({ username: attempt.username, prompt: attempt.prompt }));
+        return ok ? { type: "accept", identity: { method: "keyboard-interactive", username: attempt.username } } : reject();
+      }
+      case "publickey": {
+        if (!auth.publicKey && !authorizedKeys)
+          return reject();
+        if (!attempt.signature) {
+          if (staticAdmits(attempt) || typeof allowFn === "function")
+            return { type: "acceptProbe" };
+          return reject();
+        }
+        const signature = attempt.signature;
+        const fingerprint = sha256Fingerprint(attempt.key.blob);
+        if (!attempt.blob)
+          return reject();
+        const blob = attempt.blob;
+        const parsed = parseAttemptKey(attempt.key);
+        const verified = await guard(() => parsed?.verify(blob, signature, attempt.hashAlgo) === true);
+        if (!verified)
+          return reject();
+        if (!staticAdmits(attempt)) {
+          if (!allowFn)
+            return reject();
+          const allowed = await guard(() => allowFn({ username: attempt.username, fingerprint, publicKey: attempt.key }));
+          if (!allowed)
+            return reject();
+        }
+        return {
+          type: "accept",
+          identity: { method: "publickey", username: attempt.username, fingerprint, publicKey: attempt.key }
+        };
+      }
+      default: {
+        const _exhaustive = attempt;
+        return reject();
+      }
+    }
+  };
+  const handle = async (ctx) => {
+    const attempt = attemptFromAuthContext(ctx);
+    if (!attempt)
+      return reject();
+    try {
+      return await authenticate(attempt);
+    } catch (err) {
+      onError(err);
+      return reject();
+    }
+  };
+  return { advertisedMethods, authenticate, handle };
+}
+function loadAuthorizedKeys(source) {
+  let lines;
+  if (typeof source === "string") {
+    try {
+      lines = readFileSync2(source, "utf8").split(`
+`);
+    } catch {
+      throw new ConfigError(`could not read authorizedKeys file: ${source}`);
+    }
+  } else {
+    lines = source;
+  }
+  const set = new Set;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const key = parseOneKey(line);
+    if (!key)
+      throw new ConfigError(`invalid authorizedKeys entry: ${line.slice(0, 40)}`);
+    set.add(key.getPublicSSH().toString("base64"));
+  }
+  if (set.size === 0)
+    throw new ConfigError("authorizedKeys did not contain any public keys");
+  return set;
+}
+function resolveAuth(auth, onError) {
+  const isOpen = auth === undefined || auth === "open";
+  if (!isOpen) {
+    if (!auth || typeof auth !== "object" || Array.isArray(auth))
+      throw new ConfigError("invalid auth configuration");
+    if ("none" in auth)
+      throw new ConfigError('auth.none is invalid \u2014 use auth: "open" for no authentication');
+    if (auth.password !== undefined && typeof auth.password !== "function") {
+      throw new ConfigError("auth.password must be a function");
+    }
+    if (auth.keyboardInteractive !== undefined && typeof auth.keyboardInteractive !== "function") {
+      throw new ConfigError("auth.keyboardInteractive must be a function");
+    }
+    const publicKey = auth.publicKey;
+    if (publicKey !== undefined && publicKey !== "any") {
+      if (!publicKey || typeof publicKey !== "object" || Array.isArray(publicKey)) {
+        throw new ConfigError('auth.publicKey must be "any" or a policy object');
+      }
+      if (publicKey.allow !== undefined && typeof publicKey.allow !== "function") {
+        throw new ConfigError("auth.publicKey.allow must be a function");
+      }
+      const authorizedKeys2 = publicKey.authorizedKeys;
+      if (authorizedKeys2 !== undefined && typeof authorizedKeys2 !== "string" && !(Array.isArray(authorizedKeys2) && authorizedKeys2.every((key) => typeof key === "string"))) {
+        throw new ConfigError("auth.publicKey.authorizedKeys must be a path or array of public keys");
+      }
+    }
+  }
+  const authConfig = isOpen ? { none: true } : auth;
+  const publicKeyPolicy = typeof authConfig.publicKey === "object" ? authConfig.publicKey : undefined;
+  if (publicKeyPolicy && !publicKeyPolicy.authorizedKeys && typeof publicKeyPolicy.allow !== "function") {
+    throw new ConfigError('auth.publicKey must set "any", authorizedKeys, or allow');
+  }
+  const authorizedKeys = publicKeyPolicy?.authorizedKeys ? loadAuthorizedKeys(publicKeyPolicy.authorizedKeys) : undefined;
+  const authenticator = createAuthenticator(authConfig, authorizedKeys, onError);
+  const methods = authenticator.advertisedMethods();
+  if (!isOpen && methods.length === 0) {
+    throw new ConfigError("auth: {} configures no authentication methods \u2014 no client could connect. " + 'Set publicKey / password / keyboardInteractive, or use auth: "open" for no authentication.');
+  }
+  return { authenticator, noneOnly: isOpen, authorizedKeys };
+}
+
+// src/runtime.ts
+var MAX_DURATION_MS = 24 * 60 * 60 * 1000;
+var DURATION_UNITS = { ms: 1, s: 1000, m: 60000, h: 3600000 };
+var DEFAULT_SESSION_LIMITS = { perConnection: 1, global: 100 };
+function parseDuration(name, value) {
+  let ms;
+  if (typeof value === "number") {
+    ms = value;
+  } else {
+    const match = /^(\d+)\s*(ms|s|m|h)?$/.exec(value.trim());
+    if (!match)
+      throw new ConfigError(`invalid ${name}: ${value}`);
+    const unit = match[2];
+    ms = Number(match[1]) * DURATION_UNITS[unit ?? "ms"];
+  }
+  if (!Number.isSafeInteger(ms) || ms <= 0 || ms > MAX_DURATION_MS)
+    throw new ConfigError(`invalid ${name}: ${value}`);
+  return ms;
+}
+function parseLimit(name, value, fallback) {
+  const limit = value === undefined ? fallback : value;
+  if (!Number.isSafeInteger(limit) || limit <= 0)
+    throw new ConfigError(`invalid ${name}: ${limit}`);
+  return limit;
+}
+function resolveRuntime(config) {
+  const { hostKeyPems, fingerprints, algorithms, source } = resolveHostKey(config);
+  const idleTimeoutMs = config.idleTimeout != null ? parseDuration("idleTimeout", config.idleTimeout) : undefined;
+  const maxTimeoutMs = config.maxTimeout != null ? parseDuration("maxTimeout", config.maxTimeout) : undefined;
+  const sessionLimits = {
+    perConnection: parseLimit("limits.session.perConnection", config.limits?.session?.perConnection, DEFAULT_SESSION_LIMITS.perConnection),
+    global: parseLimit("limits.session.global", config.limits?.session?.global, DEFAULT_SESSION_LIMITS.global)
+  };
+  const onError = config.onError ?? ((err) => console.error(err));
+  const safe = createSafeInvoke(onError);
+  const { authenticator, noneOnly, authorizedKeys } = resolveAuth(config.auth, safe.report);
+  const banner = { algorithms, source, methods: authenticator.advertisedMethods(), authorizedKeys };
+  return {
+    hostKeys: hostKeyPems,
+    fingerprints,
+    authenticator,
+    idleTimeoutMs,
+    maxTimeoutMs,
+    sessionLimits,
+    safe,
+    noneOnly,
+    banner
+  };
+}
+
+// src/server.ts
+var { Server: Ssh2Server } = ssh22;
+var isLoopback = (h) => h === "127.0.0.1" || h === "::1" || h === "localhost";
+function buildServer(config, middlewares, handler) {
+  const runtime = resolveRuntime(config);
+  const connectionHandler = createConnectionHandler({
+    authenticator: runtime.authenticator,
+    middlewares,
+    handler,
+    safe: runtime.safe,
+    idleTimeoutMs: runtime.idleTimeoutMs,
+    maxTimeoutMs: runtime.maxTimeoutMs,
+    sessionLimits: runtime.sessionLimits
+  });
+  const sshServer = new Ssh2Server({ hostKeys: runtime.hostKeys }, connectionHandler.onConnection);
+  let reportsServerErrors = false;
+  let bindingAttempts = 0;
+  sshServer.on("error", (err) => {
+    if (bindingAttempts === 0 && reportsServerErrors)
+      runtime.safe.report(err);
+  });
+  return {
+    listen(port = 2222, host = "127.0.0.1") {
+      return new Promise((resolve, reject) => {
+        if (runtime.noneOnly && !isLoopback(host)) {
+          console.warn(`@opentui/ssh: no authentication configured while listening on ${host}. ` + "Anyone who can reach this port, including through published container ports, tunnels, " + "or proxies, gets a session. Set `auth` to restrict access.");
+        }
+        bindingAttempts++;
+        const onError = (err) => {
+          bindingAttempts--;
+          reject(err);
+        };
+        sshServer.once("error", onError);
+        try {
+          sshServer.listen(port, host, () => {
+            bindingAttempts--;
+            sshServer.removeListener("error", onError);
+            reportsServerErrors = true;
+            connectionHandler.setAccepting(true);
+            const addressInfo = sshServer.address();
+            const actualPort = typeof addressInfo === "object" && addressInfo ? addressInfo.port : port;
+            const boundHost = typeof addressInfo === "object" && addressInfo ? addressInfo.address : host;
+            const info = { host: boundHost, port: actualPort, fingerprints: runtime.fingerprints };
+            if (config.startupBanner !== false) {
+              console.log(formatBanner(info, runtime.banner).join(`
+`));
+            }
+            resolve(info);
+          });
+        } catch (error) {
+          bindingAttempts--;
+          sshServer.removeListener("error", onError);
+          reject(error);
+        }
+      });
+    },
+    async close() {
+      await connectionHandler.closeAll();
+      return new Promise((resolve) => {
+        sshServer.close(() => resolve());
+      });
+    }
+  };
+}
+function makeBuilder(config, middlewares) {
+  return {
+    use(mw) {
+      return makeBuilder(config, [...middlewares, mw]);
+    },
+    serve(handler) {
+      return buildServer(config, middlewares, handler);
+    }
+  };
+}
+function createServer(config = {}) {
+  return makeBuilder(config, []);
+}
+export {
+  logging,
+  createServer,
+  SshError,
+  DenyError,
+  ConfigError
+};
+
+//# debugId=AE7EAB0B30F431B864756E2164756E21
+//# sourceMappingURL=index.js.map