@rakay-technology/kraft 0.7.4

package/dist/chunk-HMJUFZK7.js

@@ -0,0 +1,340 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  isSshAuthError,
+  systemDebug
+} from "./chunk-3CJLKL6E.js";
+import {
+  HOST_CHANNEL_AUTH_REJECTED,
+  HOST_CHANNEL_NOT_PROVISIONED,
+  HOST_CHANNEL_ROW_CREDENTIALS_UNUSED,
+  hostFirewallRule,
+  safeErrorMessage
+} from "./chunk-PVOWHIND.js";
+
+// ../../packages/adapters/src/system/ssh-client.ts
+import { Client } from "ssh2";
+
+// ../../packages/adapters/src/system/ssh-support.ts
+import { execFile } from "child_process";
+import { access } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+function formatSshTarget(config) {
+  return `${config.username ?? "root"}@${config.host}:${config.port ?? 22}`;
+}
+function describeSshAuthFailure(config, originalMessage) {
+  const target = formatSshTarget(config);
+  if (config.hostChannel) {
+    return `${HOST_CHANNEL_AUTH_REJECTED} Dialed ${target} from inside the Kraft API container. ${HOST_CHANNEL_ROW_CREDENTIALS_UNUSED} ${HOST_CHANNEL_NOT_PROVISIONED} (${originalMessage})`;
+  }
+  if (config.password) {
+    return `SSH password authentication failed for ${target}. Check the username/password, or verify that the server allows password login. (${originalMessage})`;
+  }
+  if (config.privateKey || config.sshAgent) {
+    return `SSH key authentication failed for ${target}. Check the username, private key, passphrase, or whether the server accepts this key. (${originalMessage})`;
+  }
+  return `SSH authentication failed for ${target}. (${originalMessage})`;
+}
+function describeSshConnectFailure(config, originalMessage) {
+  const target = formatSshTarget(config);
+  const port = config.port ?? 22;
+  if (config.hostChannel) {
+    return `Cannot reach the host SSH endpoint ${target} from inside the Kraft API container. Host control is configured, but the connection never completed. The usual cause is a host firewall dropping traffic from the Docker bridge to the host's SSH port \u2014 allow it with:
+${hostFirewallRule("unknown", [], port)}
+Or re-run \`kraft up\`, which probes this and offers the exact rule. (${originalMessage})`;
+  }
+  return `Cannot reach ${target} over SSH. Check that the host is up, that port ${port} is open, and that no firewall or security group is dropping the connection. (${originalMessage})`;
+}
+function execFileText(command, args, timeout = 5e3) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, { timeout }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(stderr.trim() || stdout.trim() || err.message));
+        return;
+      }
+      resolve(stdout.trim());
+    });
+  });
+}
+function parseKnownHostsEntries(text) {
+  const entries = /* @__PURE__ */ new Set();
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const parts = trimmed.split(/\s+/);
+    if (parts.length >= 3) {
+      entries.add(`${parts[1]} ${parts[2]}`);
+    }
+  }
+  return entries;
+}
+async function reconcileKnownHosts(config) {
+  const knownHostsPath = join(homedir(), ".ssh", "known_hosts");
+  try {
+    await access(knownHostsPath);
+  } catch {
+    return;
+  }
+  const port = config.port ?? 22;
+  const hostPatterns = port === 22 ? [config.host] : [config.host, `[${config.host}]:${port}`];
+  const knownEntries = /* @__PURE__ */ new Set();
+  for (const pattern of hostPatterns) {
+    try {
+      const output = await execFileText(
+        "ssh-keygen",
+        ["-F", pattern, "-f", knownHostsPath],
+        4e3
+      );
+      for (const entry of parseKnownHostsEntries(output)) {
+        knownEntries.add(entry);
+      }
+    } catch {
+    }
+  }
+  if (knownEntries.size === 0) return;
+  let scanned;
+  try {
+    scanned = await execFileText(
+      "ssh-keyscan",
+      ["-p", String(port), "-T", "5", config.host],
+      7e3
+    );
+  } catch {
+    return;
+  }
+  const scannedEntries = parseKnownHostsEntries(scanned);
+  if (scannedEntries.size === 0) return;
+  for (const entry of knownEntries) {
+    if (scannedEntries.has(entry)) {
+      return;
+    }
+  }
+  for (const pattern of hostPatterns) {
+    try {
+      await execFileText(
+        "ssh-keygen",
+        ["-R", pattern, "-f", knownHostsPath],
+        4e3
+      );
+      systemDebug(
+        "ssh-known-hosts",
+        `removed stale known_hosts entry for ${pattern}`
+      );
+    } catch {
+    }
+  }
+}
+
+// ../../packages/adapters/src/system/ssh-client.ts
+function toHostVerifier(config) {
+  if (!config.hostVerifier) {
+    return void 0;
+  }
+  return (key) => config.hostVerifier(Buffer.isBuffer(key) ? key : Buffer.from(key));
+}
+function toConnectConfig(config) {
+  return {
+    host: config.host,
+    port: config.port ?? 22,
+    username: config.username ?? "root",
+    hostVerifier: toHostVerifier(config),
+    password: config.password,
+    privateKey: config.privateKey,
+    passphrase: config.privateKeyPassphrase,
+    agent: config.sshAgent,
+    tryKeyboard: false,
+    // Explicit rather than relying on ssh2's implicit 20s so callers can shorten it.
+    // The container→host channel does (8s): a filtered SYN there would otherwise
+    // stall every host operation for 20s apiece with no output.
+    readyTimeout: config.readyTimeoutMs ?? 2e4,
+    keepaliveInterval: 15e3,
+    // 10 (~150s) rather than 3 (45s): a small server pegged by a heavy
+    // `docker build` / `bun install` can briefly starve sshd of keepalive
+    // replies, and 45s was dropping the SSH channel mid-build (build failed with
+    // a bare "exited with code 1"). Still detects a truly-dead link within ~2.5m.
+    keepaliveCountMax: 10
+  };
+}
+async function connectSshClient(config) {
+  await reconcileKnownHosts(config);
+  const client = new Client();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    client.on("ready", () => {
+      if (settled) return;
+      settled = true;
+      resolve(client);
+    });
+    client.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      if (isSshAuthError(err)) {
+        reject(new Error(describeSshAuthFailure(config, err.message)));
+        return;
+      }
+      reject(new Error(describeSshConnectFailure(config, err.message)));
+    });
+    client.on("close", () => {
+      if (settled) return;
+      settled = true;
+      reject(
+        new Error(
+          describeSshConnectFailure(
+            config,
+            "SSH connection closed before ready"
+          )
+        )
+      );
+    });
+    client.connect(toConnectConfig(config));
+  });
+}
+async function openSftp(client) {
+  return new Promise((resolve, reject) => {
+    client.sftp((err, sftp) => {
+      if (err) reject(err);
+      else resolve(sftp);
+    });
+  });
+}
+async function openSshUnixSocket(client, socketPath) {
+  return new Promise((resolve, reject) => {
+    if (!client.openssh_forwardOutStreamLocal) {
+      reject(
+        new Error(
+          "SSH server/client does not support OpenSSH streamlocal socket forwarding."
+        )
+      );
+      return;
+    }
+    client.openssh_forwardOutStreamLocal(socketPath, (err, stream) => {
+      if (err) {
+        reject(err);
+        return;
+      }
+      resolve(stream);
+    });
+  });
+}
+var DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio";
+async function openSshExecChannel(client, command) {
+  return new Promise((resolve, reject) => {
+    client.exec(command, (err, stream) => {
+      if (err) {
+        reject(err);
+        return;
+      }
+      resolve(stream);
+    });
+  });
+}
+var DIAL_STDIO_DIAGNOSTICS = /* @__PURE__ */ Symbol("kraft.dialStdioDiagnostics");
+var DIAL_STDIO_STDERR_CAP = 4096;
+function attachDialStdioDiagnostics(stream) {
+  const channel = stream;
+  if (channel[DIAL_STDIO_DIAGNOSTICS]) return stream;
+  const diagnostics = {
+    stderr: "",
+    exitCode: null,
+    signal: null,
+    error: null
+  };
+  channel[DIAL_STDIO_DIAGNOSTICS] = diagnostics;
+  const stderr = stream.stderr;
+  stderr?.on("data", (chunk) => {
+    if (diagnostics.stderr.length >= DIAL_STDIO_STDERR_CAP) return;
+    diagnostics.stderr = (diagnostics.stderr + chunk.toString("utf8")).slice(
+      0,
+      DIAL_STDIO_STDERR_CAP
+    );
+  });
+  stream.on("exit", (code, signal) => {
+    diagnostics.exitCode = typeof code === "number" ? code : null;
+    diagnostics.signal = typeof signal === "string" ? signal : null;
+  });
+  stream.on("error", (err) => {
+    diagnostics.error ??= safeErrorMessage(err);
+  });
+  return stream;
+}
+function dialStdioDiagnostics(stream) {
+  const diagnostics = stream?.[DIAL_STDIO_DIAGNOSTICS];
+  if (!diagnostics) return "";
+  const parts = [];
+  const stderr = diagnostics.stderr.trim();
+  if (stderr) parts.push(stderr.replace(/\s+/g, " "));
+  if (diagnostics.error) parts.push(diagnostics.error);
+  if (diagnostics.signal) parts.push(`killed by ${diagnostics.signal}`);
+  else if (diagnostics.exitCode)
+    parts.push(`exit code ${diagnostics.exitCode}`);
+  if (parts.length === 0) return "";
+  return `\`${DOCKER_DIAL_STDIO_COMMAND}\` reported: ${parts.join(" \u2014 ")}`;
+}
+async function openDockerDialStdioChannel(client) {
+  return attachDialStdioDiagnostics(
+    await openSshExecChannel(client, DOCKER_DIAL_STDIO_COMMAND)
+  );
+}
+async function execSshCommand(client, command, timeout = 1e4) {
+  return new Promise((resolve, reject) => {
+    let stdout = "";
+    let stderr = "";
+    let stream;
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      if (stream) {
+        try {
+          stream.close();
+        } catch {
+        }
+      }
+      reject(new Error(`SSH command timed out after ${timeout}ms: ${command}`));
+    }, timeout);
+    client.exec(command, (err, execStream) => {
+      if (err) {
+        clearTimeout(timer);
+        reject(err);
+        return;
+      }
+      stream = execStream;
+      if (timedOut) {
+        try {
+          stream.close();
+        } catch {
+        }
+        return;
+      }
+      stream.on("data", (chunk) => {
+        stdout += chunk.toString();
+      });
+      stream.stderr.on("data", (chunk) => {
+        stderr += chunk.toString();
+      });
+      stream.on("close", (code) => {
+        clearTimeout(timer);
+        resolve({
+          stdout: stdout.trim(),
+          stderr: stderr.trim(),
+          code: code ?? 1
+        });
+      });
+    });
+  });
+}
+
+export {
+  reconcileKnownHosts,
+  connectSshClient,
+  openSftp,
+  openSshUnixSocket,
+  DOCKER_DIAL_STDIO_COMMAND,
+  openSshExecChannel,
+  attachDialStdioDiagnostics,
+  dialStdioDiagnostics,
+  openDockerDialStdioChannel,
+  execSshCommand
+};