@zincapp/znvault-cli 4.4.0 → 4.5.0

package/dist/commands/kmip/clients.d.ts

@@ -1,12 +1,16 @@
 interface CreateOptions {
     description?: string;
     outputDir?: string;
+    allowedCidrs?: string;
     json?: boolean;
 }
 export declare function createClient(name: string, options: CreateOptions): Promise<void>;
 export declare function listClients(options: {
     json?: boolean;
 }): Promise<void>;
+export declare function setSourceCidrs(id: string, cidrs: string, options: {
+    json?: boolean;
+}): Promise<void>;
 export declare function revokeClient(id: string, options: {
     json?: boolean;
 }): Promise<void>;

package/dist/commands/kmip/clients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/clients.ts"],"names":[],"mappings":"AASA,UAAU,aAAa;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCtF;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B5E;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAezF"}
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/clients.ts"],"names":[],"mappings":"AASA,UAAU,aAAa;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAWD,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCtF;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B5E;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1B,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAezF"}

package/dist/commands/kmip/clients.js

@@ -4,12 +4,23 @@ import fs from 'fs';
 import path from 'path';
 import { client } from '../../lib/client.js';
 import * as output from '../../lib/output.js';
+/** Parse a comma-separated CIDR list into a trimmed string[] (empty if unset). */
+function parseCidrList(raw) {
+    if (raw === undefined)
+        return [];
+    return raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
 export async function createClient(name, options) {
     const spinner = output.spinner(`Creating KMIP client '${name}'...`).start();
     try {
+        const allowedSourceCidrs = parseCidrList(options.allowedCidrs);
         const response = await client.post('/v1/kmip/clients', {
             name,
             description: options.description,
+            ...(allowedSourceCidrs.length > 0 ? { allowedSourceCidrs } : {}),
         });
         spinner.stop();
         if (options.json) {
@@ -64,6 +75,32 @@ export async function listClients(options) {
         process.exit(1);
     }
 }
+export async function setSourceCidrs(id, cidrs, options) {
+    const allowedSourceCidrs = parseCidrList(cidrs);
+    const verb = allowedSourceCidrs.length > 0 ? 'Setting' : 'Clearing';
+    const spinner = output.spinner(`${verb} source-IP allowlist for KMIP client ${id}...`).start();
+    try {
+        const response = await client.put(`/v1/kmip/clients/${id}/source-cidrs`, {
+            allowedSourceCidrs,
+        });
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        if (allowedSourceCidrs.length > 0) {
+            output.success(`Source-IP allowlist set for '${response.name ?? id}': ${allowedSourceCidrs.join(', ')}`);
+        }
+        else {
+            output.success(`Source-IP allowlist cleared for '${response.name ?? id}' (no restriction)`);
+        }
+    }
+    catch (err) {
+        spinner.fail('Failed to set KMIP client source-IP allowlist');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
 export async function revokeClient(id, options) {
     const spinner = output.spinner(`Revoking KMIP client ${id}...`).start();
     try {

package/dist/commands/kmip/clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"clients.js","sourceRoot":"","sources":["../../../src/commands/kmip/clients.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,mCAAmC;AAEnC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAS9C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,OAAsB;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,IAAI,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAA2B,kBAAkB,EAAE;YAC/E,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,WAAW,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC;YACd,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,WAAW,EAAE,QAAQ,CAAC,eAAe;YACrC,SAAS,EAAE,QAAQ,CAAC,YAAY,IAAI,GAAG;SACxC,CAAC,CAAC;QAEH,iFAAiF;QACjF,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,IAAI,EAAE,CAAC;QAChD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,oCAAoC,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgC,kBAAkB,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,EACzD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACxB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM;YACR,GAAG,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;YACpC,CAAC,CAAC,UAAU,IAAI,GAAG;YACnB,CAAC,CAAC,YAAY,IAAI,GAAG;SACtB,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,OAA2B;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAa,oBAAoB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,gBAAgB,QAAQ,CAAC,IAAI,IAAI,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../../../src/commands/kmip/clients.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,mCAAmC;AAEnC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAU9C,kFAAkF;AAClF,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,OAAsB;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,IAAI,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,kBAAkB,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAA2B,kBAAkB,EAAE;YAC/E,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,WAAW,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC;YACd,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,WAAW,EAAE,QAAQ,CAAC,eAAe;YACrC,SAAS,EAAE,QAAQ,CAAC,YAAY,IAAI,GAAG;SACxC,CAAC,CAAC;QAEH,iFAAiF;QACjF,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,IAAI,EAAE,CAAC;QAChD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,oCAAoC,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgC,kBAAkB,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,EACzD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACxB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM;YACR,GAAG,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;YACpC,CAAC,CAAC,UAAU,IAAI,GAAG;YACnB,CAAC,CAAC,YAAY,IAAI,GAAG;SACtB,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,KAAa,EACb,OAA2B;IAE3B,MAAM,kBAAkB,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,wCAAwC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAa,oBAAoB,EAAE,eAAe,EAAE;YACnF,kBAAkB;SACnB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,gCAAgC,QAAQ,CAAC,IAAI,IAAI,EAAE,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,CAAC,oCAAoC,QAAQ,CAAC,IAAI,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,OAA2B;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAa,oBAAoB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,gBAAgB,QAAQ,CAAC,IAAI,IAAI,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/kmip/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,cAAc,YAAY,CAAC;AAE3B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6C3D;AAED,+FAA+F;AAC/F,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CASpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,cAAc,YAAY,CAAC;AAE3B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsD3D;AAED,+FAA+F;AAC/F,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CASpE"}

package/dist/commands/kmip/index.js

@@ -1,6 +1,6 @@
 // Path: src/commands/kmip/index.ts
 // `znvault kmip` command registration.
-import { createClient, listClients, revokeClient } from './clients.js';
+import { createClient, listClients, revokeClient, setSourceCidrs } from './clients.js';
 import { listObjects, getStatus } from './objects.js';
 import { enableKmip, reissueServerCert } from './admin.js';
 export * from './types.js';
@@ -34,9 +34,15 @@ Examples:
         .description('Create a KMIP client and download its certificate bundle')
         .option('--description <text>', 'Optional description')
         .option('--output-dir <dir>', 'Directory to write client.key/client.crt/ca.crt (default: kmip-<name>)')
+        .option('--allowed-cidrs <cidrs>', 'Comma-separated source-IP allowlist (e.g. "192.168.50.4/32"). Defense-in-depth on top of mTLS; empty = no restriction')
         .option('--json', 'Output as JSON (includes the private key)')
         .action(createClient);
     clientCmd.command('list').description('List KMIP clients').option('--json', 'Output as JSON').action(listClients);
+    clientCmd
+        .command('set-cidrs <id> <cidrs>')
+        .description('Set a client source-IP allowlist (comma-separated CIDRs; empty string clears it)')
+        .option('--json', 'Output as JSON')
+        .action(setSourceCidrs);
     clientCmd
         .command('revoke <id>')
         .description('Revoke a KMIP client')

package/dist/commands/kmip/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/kmip/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,uCAAuC;AAGvC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3D,cAAc,YAAY,CAAC;AAE3B,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wDAAwD,CAAC;SACrE,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;CAkBzB,CAAC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEpH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC5E,SAAS;SACN,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;SACtD,MAAM,CAAC,oBAAoB,EAAE,wEAAwE,CAAC;SACtG,MAAM,CAAC,QAAQ,EAAE,2CAA2C,CAAC;SAC7D,MAAM,CAAC,YAAY,CAAC,CAAC;IACxB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClH,SAAS;SACN,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,YAAY,CAAC,CAAC;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,8CAA8C,CAAC,CAAC;IACrG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAElH,OAAO;AACT,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvI,IAAI;SACD,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC;SACnD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/kmip/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,uCAAuC;AAGvC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3D,cAAc,YAAY,CAAC;AAE3B,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wDAAwD,CAAC;SACrE,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;CAkBzB,CAAC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEpH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC5E,SAAS;SACN,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;SACtD,MAAM,CAAC,oBAAoB,EAAE,wEAAwE,CAAC;SACtG,MAAM,CACL,yBAAyB,EACzB,uHAAuH,CACxH;SACA,MAAM,CAAC,QAAQ,EAAE,2CAA2C,CAAC;SAC7D,MAAM,CAAC,YAAY,CAAC,CAAC;IACxB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClH,SAAS;SACN,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,kFAAkF,CAAC;SAC/F,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1B,SAAS;SACN,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,YAAY,CAAC,CAAC;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,8CAA8C,CAAC,CAAC;IACrG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAElH,OAAO;AACT,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvI,IAAI;SACD,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC;SACnD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC"}

package/dist/commands/kmip/types.d.ts

@@ -11,6 +11,7 @@ export interface KmipClient {
     revokedAt: string | null;
     lastSeenAt: string | null;
     lastSeenIp: string | null;
+    allowedSourceCidrs?: string[];
 }
 export interface KmipClientBundle {
     clientKeyPem: string;

package/dist/commands/kmip/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/types.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAChF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/types.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAChF"}

package/dist/commands/ssh/connect.d.ts

@@ -3,6 +3,28 @@
  */
 import type { Command } from 'commander';
 import type { ConnectOptions } from './types.js';
+/**
+ * Result of resolving + signing an SSH-CA connection. Contains everything
+ * needed to build any ssh invocation (interactive, forward, exec).
+ */
+export interface SignedSshBase {
+    keyPath: string;
+    certPath: string;
+    user?: string;
+    host: string;
+    port: string;
+    /** ['-i', key, ('-p', port)?, '-o', `CertificateFile=cert`] — ready to prefix any ssh args */
+    baseSshArgs: string[];
+}
+/**
+ * Resolve the SSH key, ensure a valid vault-CA certificate (auto-signing if
+ * needed), and return the destination parts + base ssh args. No spawning,
+ * no process.exit, no stdio side effects — safe to call from any command.
+ *
+ * Mirrors the key-resolution + sign logic previously inline in executeConnect,
+ * so `ssh connect` and `ssh forward` share one code path.
+ */
+export declare function ensureSignedSshBase(destination: string, options: ConnectOptions): Promise<SignedSshBase>;
 /**
  * Execute SSH connection with certificate authentication
  * Extracted for reuse by both `ssh connect` and `ssh <destination>` shortcuts

package/dist/commands/ssh/connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../src/commands/ssh/connect.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASjD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CAmNf;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAiB5D"}
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../src/commands/ssh/connect.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASjD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA8DxB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAiB5D"}

package/dist/commands/ssh/connect.js

@@ -4,205 +4,132 @@ import { getCurrentProfile } from '../../lib/config.js';
 import { getDefaultKeyPath, getCertificatePath, isCertificateValid, signCertificate, } from './helpers.js';
 import { resolveBookmark } from './bookmark.js';
 /**
- * Execute SSH connection with certificate authentication
- * Extracted for reuse by both `ssh connect` and `ssh <destination>` shortcuts
+ * Resolve the SSH key, ensure a valid vault-CA certificate (auto-signing if
+ * needed), and return the destination parts + base ssh args. No spawning,
+ * no process.exit, no stdio side effects — safe to call from any command.
+ *
+ * Mirrors the key-resolution + sign logic previously inline in executeConnect,
+ * so `ssh connect` and `ssh forward` share one code path.
  */
-export async function executeConnect(destination, remoteCommand, options) {
+export async function ensureSignedSshBase(destination, options) {
     const fs = await import('fs');
     const path = await import('path');
-    const { spawn } = await import('child_process');
-    // Get profile config for defaults
     const profile = getCurrentProfile();
-    // Resolve destination: could be a bookmark, user@host, or just host
     let user;
     let host;
     let port = options.port ?? '22';
     let identityOverride = options.identity;
     let principalsOverride = options.principals;
-    // Check if destination is a bookmark
     const bookmark = resolveBookmark(destination);
     if (bookmark) {
         host = bookmark.host;
         user = bookmark.user;
-        if (bookmark.port) {
+        if (bookmark.port)
             port = bookmark.port.toString();
-        }
-        if (bookmark.identity) {
+        if (bookmark.identity)
             identityOverride = bookmark.identity;
-        }
         if (bookmark.principals && !options.principals) {
             principalsOverride = bookmark.principals.join(',');
         }
-        if (options.verbose) {
-            output.info(`Using bookmark '${destination}' → ${bookmark.host}`);
-        }
     }
     else if (destination.includes('@')) {
         const parts = destination.split('@');
         user = parts[0];
-        host = parts.slice(1).join('@'); // Handle IPv6 or multiple @
+        host = parts.slice(1).join('@');
     }
     else {
         host = destination;
-        // Use default user from config if available
-        if (profile.sshUser) {
+        if (profile.sshUser)
             user = profile.sshUser;
-        }
     }
-    // Command line options override bookmark settings
-    if (options.port && options.port !== '22') {
+    if (options.port && options.port !== '22')
         port = options.port;
+    // Resolve key
+    let keyPath;
+    if (identityOverride) {
+        keyPath = path.resolve(identityOverride.replace(/^~/, process.env.HOME ?? ''));
+        if (!fs.existsSync(keyPath))
+            throw new Error(`SSH key not found: ${keyPath}`);
+    }
+    else if (profile.sshIdentity && fs.existsSync(profile.sshIdentity)) {
+        keyPath = profile.sshIdentity;
     }
-    const verbose = (msg) => {
-        if (options.verbose) {
-            output.info(msg);
+    else {
+        const defaultKey = await getDefaultKeyPath();
+        if (!defaultKey) {
+            throw new Error('No SSH key found in ~/.ssh/ — generate one with: ssh-keygen -t ed25519');
         }
-    };
+        keyPath = defaultKey;
+    }
+    const pubKeyPath = `${keyPath}.pub`;
+    if (!fs.existsSync(pubKeyPath))
+        throw new Error(`Public key not found: ${pubKeyPath}`);
+    // Ensure cert
+    const certPath = await getCertificatePath(keyPath);
+    const certStatus = await isCertificateValid(certPath);
+    if (options.forceSign || !certStatus.valid) {
+        await signCertificate(pubKeyPath, certPath, principalsOverride, options.ttl, options.tenant);
+    }
+    // Build base ssh args (identity + cert + optional port)
+    const baseSshArgs = ['-i', keyPath];
+    if (port && port !== '22')
+        baseSshArgs.push('-p', port);
+    baseSshArgs.push('-o', `CertificateFile=${certPath}`);
+    return { keyPath, certPath, user, host, port, baseSshArgs };
+}
+/**
+ * Execute SSH connection with certificate authentication
+ * Extracted for reuse by both `ssh connect` and `ssh <destination>` shortcuts
+ */
+export async function executeConnect(destination, remoteCommand, options) {
+    const { spawn } = await import('child_process');
+    const verbose = (msg) => { if (options.verbose)
+        output.info(msg); };
+    let base;
     try {
-        // Step 1: Find SSH key
-        let keyPath;
-        if (identityOverride) {
-            keyPath = path.resolve(identityOverride.replace(/^~/, process.env.HOME ?? ''));
-            if (!fs.existsSync(keyPath)) {
-                output.error(`SSH key not found: ${keyPath}`);
-                process.exit(1);
-            }
-            verbose(`Using specified key: ${keyPath}`);
-        }
-        else if (profile.sshIdentity && fs.existsSync(profile.sshIdentity)) {
-            // Use configured identity from profile
-            keyPath = profile.sshIdentity;
-            verbose(`Using configured key: ${keyPath}`);
-        }
-        else {
-            const defaultKey = await getDefaultKeyPath();
-            if (!defaultKey) {
-                output.error('No SSH key found in ~/.ssh/');
-                output.info('Generate one with: ssh-keygen -t ed25519');
-                output.info('Or specify a key with: znvault ssh -i /path/to/key user@host');
-                process.exit(1);
-            }
-            keyPath = defaultKey;
-            verbose(`Using default key: ${keyPath}`);
-        }
-        const pubKeyPath = `${keyPath}.pub`;
-        if (!fs.existsSync(pubKeyPath)) {
-            output.error(`Public key not found: ${pubKeyPath}`);
-            process.exit(1);
-        }
-        // Step 2: Check certificate validity
-        const certPath = await getCertificatePath(keyPath);
-        verbose(`Certificate path: ${certPath}`);
-        const certStatus = await isCertificateValid(certPath);
-        const needsSign = options.forceSign || !certStatus.valid;
-        if (options.verbose && !certStatus.valid) {
-            output.warn(`Certificate needs signing: ${certStatus.reason}`);
-        }
-        else if (options.verbose && certStatus.valid) {
-            output.success('Certificate is valid');
-        }
-        // Step 3: Sign if needed
-        if (needsSign) {
-            const spinner = output.spinner('Signing certificate...').start();
-            try {
-                await signCertificate(pubKeyPath, certPath, principalsOverride, options.ttl, options.tenant);
-                spinner.succeed('Certificate signed');
-                // Show certificate info
-                if (options.verbose) {
-                    const { execSync } = await import('child_process');
-                    try {
-                        const certInfo = execSync(`ssh-keygen -L -f "${certPath}"`, { encoding: 'utf8' });
-                        const principalsMatch = certInfo.match(/Principals:\s*([\s\S]*?)(?=\s+Critical Options:)/);
-                        const validMatch = certInfo.match(/Valid:\s+from\s+(\S+)\s+to\s+(\S+)/);
-                        if (principalsMatch) {
-                            const principals = principalsMatch[1].trim().split('\n').map(p => p.trim()).filter(Boolean);
-                            output.info(`Principals: ${principals.join(', ')}`);
-                        }
-                        if (validMatch) {
-                            output.info(`Valid until: ${validMatch[2]}`);
-                        }
-                    }
-                    catch {
-                        // Ignore cert inspection errors
-                    }
-                }
-            }
-            catch (err) {
-                spinner.fail('Failed to sign certificate');
-                output.error(err instanceof Error ? err.message : String(err));
-                process.exit(1);
-            }
-        }
-        else if (!options.verbose) {
-            // In non-verbose mode, just mention we're using existing cert
-            output.info('Using existing valid certificate');
-        }
-        // Step 4: Build SSH command
-        const sshArgs = [];
-        // Add identity file (this tells SSH to use our key + cert)
-        sshArgs.push('-i', keyPath);
-        // Add port if not default
-        if (port && port !== '22') {
-            sshArgs.push('-p', port);
-        }
-        // Add TTY allocation flags
-        if (options.t) {
-            sshArgs.push('-t');
-        }
-        else if (options.T) {
-            sshArgs.push('-T');
-        }
-        // Explicitly tell SSH to use the certificate
-        sshArgs.push('-o', `CertificateFile=${certPath}`);
-        // Add destination
-        if (user) {
-            sshArgs.push(`${user}@${host}`);
-        }
-        else {
-            sshArgs.push(host);
-        }
-        // Add remote command if specified
-        if (remoteCommand && remoteCommand.length > 0) {
-            sshArgs.push(...remoteCommand);
-        }
-        // Step 5: Execute SSH
-        if (options.dryRun) {
-            output.section('Dry Run');
-            output.keyValue({
-                'Key': keyPath,
-                'Certificate': certPath,
-                'Host': host,
-                'User': user ?? '(default)',
-                'Port': port,
-                'Principals': principalsOverride ?? '(from mapping)',
-                'Command': remoteCommand.length > 0 ? remoteCommand.join(' ') : '(interactive shell)',
-            });
-            console.log();
-            output.info(`Would execute: ssh ${sshArgs.join(' ')}`);
-            return;
-        }
-        verbose(`Executing: ssh ${sshArgs.join(' ')}`);
-        // Only print empty line for interactive sessions
-        if (remoteCommand.length === 0) {
-            console.log();
-        }
-        // Spawn SSH with stdio inherited (interactive session)
-        const sshProcess = spawn('ssh', sshArgs, {
-            stdio: 'inherit',
-            env: process.env,
-        });
-        sshProcess.on('close', (code) => {
-            process.exit(code ?? 0);
-        });
-        sshProcess.on('error', (err) => {
-            output.error(`Failed to start SSH: ${err.message}`);
-            process.exit(1);
-        });
+        if (options.verbose)
+            output.info('Resolving SSH certificate...');
+        base = await ensureSignedSshBase(destination, options);
+        if (options.verbose)
+            output.success('Certificate ready');
     }
     catch (err) {
         output.error(err instanceof Error ? err.message : String(err));
         process.exit(1);
+        return;
+    }
+    // Build the interactive ssh args from the shared base
+    const sshArgs = [...base.baseSshArgs];
+    if (options.t)
+        sshArgs.push('-t');
+    else if (options.T)
+        sshArgs.push('-T');
+    sshArgs.push(base.user ? `${base.user}@${base.host}` : base.host);
+    if (remoteCommand && remoteCommand.length > 0)
+        sshArgs.push(...remoteCommand);
+    if (options.dryRun) {
+        output.section('Dry Run');
+        output.keyValue({
+            'Key': base.keyPath,
+            'Certificate': base.certPath,
+            'Host': base.host,
+            'User': base.user ?? '(default)',
+            'Port': base.port,
+            'Command': remoteCommand.length > 0 ? remoteCommand.join(' ') : '(interactive shell)',
+        });
+        console.log();
+        output.info(`Would execute: ssh ${sshArgs.join(' ')}`);
+        return;
     }
+    verbose(`Executing: ssh ${sshArgs.join(' ')}`);
+    if (remoteCommand.length === 0)
+        console.log();
+    const sshProcess = spawn('ssh', sshArgs, { stdio: 'inherit', env: process.env });
+    sshProcess.on('close', (code) => process.exit(code ?? 0));
+    sshProcess.on('error', (err) => {
+        output.error(`Failed to start SSH: ${err.message}`);
+        process.exit(1);
+    });
 }
 export function registerConnectCommand(parent) {
     parent

package/dist/commands/ssh/connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/commands/ssh/connect.ts"],"names":[],"mappings":"AAAA,oCAAoC;AAQpC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,aAAuB,EACvB,OAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAEhD,kCAAkC;IAClC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,oEAAoE;IACpE,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,GAAW,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IACxC,IAAI,gBAAgB,GAAuB,OAAO,CAAC,QAAQ,CAAC;IAC5D,IAAI,kBAAkB,GAAuB,OAAO,CAAC,UAAU,CAAC;IAEhE,qCAAqC;IACrC,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/C,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,mBAAmB,WAAW,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B;IAC/D,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,WAAW,CAAC;QACnB,4CAA4C;QAC5C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1C,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE;QAC9B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,uBAAuB;QACvB,IAAI,OAAe,CAAC;QACpB,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,uCAAuC;YACvC,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;YAC9B,OAAO,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;gBAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,UAAU,CAAC;YACrB,OAAO,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,OAAO,MAAM,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,qCAAqC;QACrC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QAEzC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAEzD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACzC,CAAC;QAED,yBAAyB;QACzB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,KAAK,EAAE,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7F,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;gBAEtC,wBAAwB;gBACxB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;oBACnD,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,qBAAqB,QAAQ,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;wBAClF,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;wBAC3F,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;wBAExE,IAAI,eAAe,EAAE,CAAC;4BACpB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;4BAC5F,MAAM,CAAC,IAAI,CAAC,eAAe,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACtD,CAAC;wBACD,IAAI,UAAU,EAAE,CAAC;4BACf,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBAC/C,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,gCAAgC;oBAClC,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QAED,4BAA4B;QAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,2DAA2D;QAC3D,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE5B,0BAA0B;QAC1B,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAED,6CAA6C;QAC7C,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;QAElD,kBAAkB;QAClB,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAED,kCAAkC;QAClC,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;QACjC,CAAC;QAED,sBAAsB;QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,CAAC,QAAQ,CAAC;gBACd,KAAK,EAAE,OAAO;gBACd,aAAa,EAAE,QAAQ;gBACvB,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI,IAAI,WAAW;gBAC3B,MAAM,EAAE,IAAI;gBACZ,YAAY,EAAE,kBAAkB,IAAI,gBAAgB;gBACpD,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB;aACtF,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE/C,iDAAiD;QACjD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,uDAAuD;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;YACvC,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7B,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,MAAM;SACH,OAAO,CAAC,oCAAoC,CAAC;SAC7C,WAAW,CAAC,uEAAuE,CAAC;SACpF,MAAM,CAAC,uBAAuB,EAAE,sDAAsD,CAAC;SACvF,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0DAA0D,CAAC;SAC/F,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,IAAI,EAAE,6DAA6D,CAAC;SAC3E,MAAM,CAAC,IAAI,EAAE,oCAAoC,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,aAAuB,EAAE,OAAuB,EAAE,EAAE;QACtF,MAAM,cAAc,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/commands/ssh/connect.ts"],"names":[],"mappings":"AAAA,oCAAoC;AAQpC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAgBhD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,OAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,GAAW,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IACxC,IAAI,gBAAgB,GAAuB,OAAO,CAAC,QAAQ,CAAC;IAC5D,IAAI,kBAAkB,GAAuB,OAAO,CAAC,UAAU,CAAC;IAEhE,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,QAAQ,CAAC,IAAI;YAAE,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,QAAQ;YAAE,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC5D,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/C,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,WAAW,CAAC;QACnB,IAAI,OAAO,CAAC,OAAO;YAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;QAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE/D,cAAc;IACd,IAAI,OAAe,CAAC;IACpB,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACrE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,UAAU,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,OAAO,MAAM,CAAC;IACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAC;IAEvF,cAAc;IACd,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3C,MAAM,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/F,CAAC;IAED,wDAAwD;IACxD,MAAM,WAAW,GAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAEtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,aAAuB,EACvB,OAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACjE,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,sDAAsD;IACtD,MAAM,OAAO,GAAa,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC7B,IAAI,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IAE9E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC;YACd,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,aAAa,EAAE,IAAI,CAAC,QAAQ;YAC5B,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB;SACtF,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAE9C,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,MAAM;SACH,OAAO,CAAC,oCAAoC,CAAC;SAC7C,WAAW,CAAC,uEAAuE,CAAC;SACpF,MAAM,CAAC,uBAAuB,EAAE,sDAAsD,CAAC;SACvF,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0DAA0D,CAAC;SAC/F,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,IAAI,EAAE,6DAA6D,CAAC;SAC3E,MAAM,CAAC,IAAI,EAAE,oCAAoC,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,aAAuB,EAAE,OAAuB,EAAE,EAAE;QACtF,MAAM,cAAc,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/ssh/forward.d.ts

@@ -0,0 +1,49 @@
+/**
+ * SSH local port-forward with vault-CA certificate authentication.
+ *
+ * `znvault ssh forward -L 127.0.0.1:<lport>:<rhost>:<rport> <destination>`
+ * opens `ssh -N -L ...` using an auto-signed vault SSH certificate. The
+ * `--print-port` machine mode binds an OS-chosen local port and prints a
+ * single JSON line so callers (e.g. the payara deploy plugin) can consume it.
+ */
+import type { Command } from 'commander';
+import type { ConnectOptions } from './types.js';
+import type { SignedSshBase } from './connect.js';
+/**
+ * Ask the OS for a free TCP port by binding :0 then releasing it.
+ * Small TOCTOU window between release and ssh re-binding it — acceptable
+ * for a deploy tool (the race would only surface as an ssh bind error, which
+ * is reported and the host marked unreachable).
+ */
+export declare function pickFreePort(): Promise<number>;
+/** A local-forward specification: bind 127.0.0.1:lport → rhost:rport over the ssh channel. */
+export interface ForwardSpec {
+    bindHost: string;
+    localPort: number;
+    remoteHost: string;
+    remotePort: number;
+}
+/**
+ * Build the `ssh -N -L ...` argv from a signed base and a forward spec.
+ * Uses BatchMode + ConnectTimeout to match the codebase idiom (haproxy.ts).
+ */
+export declare function buildForwardArgs(base: SignedSshBase, spec: ForwardSpec, connectTimeoutSeconds: number): string[];
+/** Options accepted by `znvault ssh forward`. Extends ConnectOptions with forward-specific fields. */
+export interface ForwardOptions extends ConnectOptions {
+    /** -L spec: "[bindHost:]lport:rhost:rport". lport 0 = OS-assigned. */
+    L?: string;
+    /** Print one JSON line with the chosen local port and keep running. */
+    printPort?: boolean;
+}
+/**
+ * Parse a `-L` forward spec. Accepts 4-part (bindHost:lport:rhost:rport) or
+ * 3-part (lport:rhost:rport, bindHost defaults to 127.0.0.1).
+ */
+export declare function parseForwardOption(spec: string): ForwardSpec;
+/**
+ * Run the forward: sign the cert, pick a port if lport==0, spawn `ssh -N -L`,
+ * and (in --print-port mode) emit one JSON line to stdout then hold the tunnel.
+ */
+export declare function runForward(destination: string, options: ForwardOptions): Promise<void>;
+export declare function registerForwardCommand(parent: Command): void;
+//# sourceMappingURL=forward.d.ts.map

package/dist/commands/ssh/forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.d.ts","sourceRoot":"","sources":["../../../src/commands/ssh/forward.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAc9C;AAED,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,WAAW,EACjB,qBAAqB,EAAE,MAAM,GAC5B,MAAM,EAAE,CAQV;AAED,sGAAsG;AACtG,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,sEAAsE;IACtE,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAmB5D;AAKD;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CAwEf;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAiB5D"}

package/dist/commands/ssh/forward.js

@@ -0,0 +1,151 @@
+// Path: src/commands/ssh/forward.ts
+import * as net from 'node:net';
+import * as output from '../../lib/output.js';
+import { ensureSignedSshBase } from './connect.js';
+/**
+ * Ask the OS for a free TCP port by binding :0 then releasing it.
+ * Small TOCTOU window between release and ssh re-binding it — acceptable
+ * for a deploy tool (the race would only surface as an ssh bind error, which
+ * is reported and the host marked unreachable).
+ */
+export function pickFreePort() {
+    return new Promise((resolve, reject) => {
+        const srv = net.createServer();
+        srv.once('error', reject);
+        srv.listen(0, '127.0.0.1', () => {
+            const addr = srv.address();
+            if (addr && typeof addr === 'object') {
+                const port = addr.port;
+                srv.close(() => { resolve(port); });
+            }
+            else {
+                srv.close(() => { reject(new Error('Failed to obtain a free port')); });
+            }
+        });
+    });
+}
+/**
+ * Build the `ssh -N -L ...` argv from a signed base and a forward spec.
+ * Uses BatchMode + ConnectTimeout to match the codebase idiom (haproxy.ts).
+ */
+export function buildForwardArgs(base, spec, connectTimeoutSeconds) {
+    const args = [...base.baseSshArgs];
+    args.push('-o', 'BatchMode=yes');
+    args.push('-o', `ConnectTimeout=${connectTimeoutSeconds}`);
+    args.push('-N');
+    args.push('-L', `${spec.bindHost}:${spec.localPort}:${spec.remoteHost}:${spec.remotePort}`);
+    args.push(base.user ? `${base.user}@${base.host}` : base.host);
+    return args;
+}
+/**
+ * Parse a `-L` forward spec. Accepts 4-part (bindHost:lport:rhost:rport) or
+ * 3-part (lport:rhost:rport, bindHost defaults to 127.0.0.1).
+ */
+export function parseForwardOption(spec) {
+    const parts = spec.split(':');
+    if (parts.length === 4) {
+        return {
+            bindHost: parts[0],
+            localPort: Number(parts[1]),
+            remoteHost: parts[2],
+            remotePort: Number(parts[3]),
+        };
+    }
+    if (parts.length === 3) {
+        return {
+            bindHost: '127.0.0.1',
+            localPort: Number(parts[0]),
+            remoteHost: parts[1],
+            remotePort: Number(parts[2]),
+        };
+    }
+    throw new Error(`Invalid forward spec "${spec}". Use "[bindHost:]localPort:remoteHost:remotePort".`);
+}
+const DEFAULT_FORWARD_REMOTE_PORT = 9100;
+const FORWARD_CONNECT_TIMEOUT_SECONDS = 10;
+/**
+ * Run the forward: sign the cert, pick a port if lport==0, spawn `ssh -N -L`,
+ * and (in --print-port mode) emit one JSON line to stdout then hold the tunnel.
+ */
+export async function runForward(destination, options) {
+    const { spawn } = await import('child_process');
+    const spec = options.L
+        ? parseForwardOption(options.L)
+        : { bindHost: '127.0.0.1', localPort: 0, remoteHost: '127.0.0.1', remotePort: DEFAULT_FORWARD_REMOTE_PORT };
+    // Resolve a concrete local port (O1): pick a free one when 0 was requested.
+    if (spec.localPort === 0) {
+        spec.localPort = await pickFreePort();
+    }
+    let base;
+    try {
+        base = await ensureSignedSshBase(destination, options);
+    }
+    catch (err) {
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+        return;
+    }
+    const sshArgs = buildForwardArgs(base, spec, FORWARD_CONNECT_TIMEOUT_SECONDS);
+    if (options.dryRun) {
+        output.section('Dry Run');
+        output.keyValue({
+            'Key': base.keyPath,
+            'Certificate': base.certPath,
+            'Forward': `${spec.bindHost}:${spec.localPort} → ${base.host}:${spec.remotePort}`,
+            'User': base.user ?? '(default)',
+        });
+        console.log();
+        output.info(`Would execute: ssh ${sshArgs.join(' ')}`);
+        return;
+    }
+    // All human/log output goes to STDERR so stdout stays a clean machine channel.
+    const sshProcess = spawn('ssh', sshArgs, {
+        stdio: ['ignore', 'ignore', 'inherit'],
+        env: process.env,
+    });
+    let exited = false;
+    sshProcess.on('error', (err) => {
+        exited = true;
+        process.stderr.write(`Failed to start SSH: ${err.message}\n`);
+        process.exit(1);
+    });
+    sshProcess.on('close', (code) => {
+        exited = true;
+        process.exit(code ?? 0);
+    });
+    // Teardown on our own termination so we never orphan the ssh -N child.
+    const cleanup = () => { if (!exited && sshProcess.pid)
+        sshProcess.kill('SIGTERM'); };
+    process.on('SIGINT', () => { cleanup(); process.exit(0); });
+    process.on('SIGTERM', () => { cleanup(); process.exit(0); });
+    if (options.printPort) {
+        // ssh -N has no "ready" signal on stdout; give it a moment to establish,
+        // then emit the contract line. forwardUp = ssh started + port bound by us.
+        await new Promise((r) => setTimeout(r, 300));
+        if (!exited) {
+            process.stdout.write(JSON.stringify({ localPort: spec.localPort, pid: sshProcess.pid, forwardUp: true }) + '\n');
+        }
+    }
+    else {
+        process.stderr.write(`Forwarding 127.0.0.1:${spec.localPort} → ${base.host}:${spec.remotePort} (Ctrl-C to stop)\n`);
+    }
+}
+export function registerForwardCommand(parent) {
+    parent
+        .command('forward <destination>')
+        .description('Open an SSH local port-forward authenticated by the vault SSH CA')
+        .option('-L <spec>', 'Forward spec: [bindHost:]localPort:remoteHost:remotePort (localPort 0 = auto)')
+        .option('--print-port', 'Print {"localPort","pid","forwardUp"} JSON then hold the tunnel (machine mode)')
+        .option('-i, --identity <file>', 'Path to SSH private key')
+        .option('-p, --port <port>', 'SSH port', '22')
+        .option('--principals <principals>', 'Principals for signing (comma-separated)')
+        .option('--ttl <ttl>', 'Certificate TTL (e.g., 8h, 1d)')
+        .option('--tenant <id>', 'Tenant ID (superadmin only)')
+        .option('--force-sign', 'Force re-signing even if certificate is valid')
+        .option('--dry-run', 'Show what would be done without executing SSH')
+        .option('-v, --verbose', 'Show verbose output')
+        .action(async (destination, options) => {
+        await runForward(destination, options);
+    });
+}
+//# sourceMappingURL=forward.js.map

package/dist/commands/ssh/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../../src/commands/ssh/forward.ts"],"names":[],"mappings":"AAAA,oCAAoC;AAYpC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;YAC3B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAmB,EACnB,IAAiB,EACjB,qBAA6B;IAE7B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,qBAAqB,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;YACpB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC7B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;YACpB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC7B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,sDAAsD,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,OAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC;QACpB,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAAC;IAE9G,4EAA4E;IAC5E,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAE9E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC;YACd,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,aAAa,EAAE,IAAI,CAAC,QAAQ;YAC5B,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE;YACjF,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;QACvC,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;QACtC,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,OAAO,GAAG,GAAS,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG;QAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,qBAAqB,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,MAAM;SACH,OAAO,CAAC,uBAAuB,CAAC;SAChC,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,WAAW,EAAE,+EAA+E,CAAC;SACpG,MAAM,CAAC,cAAc,EAAE,gFAAgF,CAAC;SACxG,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0CAA0C,CAAC;SAC/E,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,OAAuB,EAAE,EAAE;QAC7D,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/ssh/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/ssh/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAkDtC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,IAAI,CAuDjF;AAGD,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/ssh/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAkDtC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,IAAI,CA8DjF;AAGD,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/commands/ssh/index.js

@@ -5,6 +5,7 @@ import { registerMappingCommands } from './mapping.js';
 import { registerServerGroupCommands } from './server-group.js';
 import { registerConfigCommands } from './config.js';
 import { registerConnectCommand, executeConnect } from './connect.js';
+import { registerForwardCommand } from './forward.js';
 import { registerBookmarkCommands, resolveBookmark } from './bookmark.js';
 import { registerSCPCommand } from './scp.js';
 import { registerHostsCommand } from './hosts.js';
@@ -13,7 +14,7 @@ import { resolveContext, withRegisterContext, } from '../../lib/command-context.
 // Known subcommands that should NOT be treated as destinations
 const SSH_SUBCOMMANDS = new Set([
     'ca', 'cert', 'mapping', 'server-group', 'config',
-    'bookmark', 'bm', 'hosts', 'scp', 'connect', 'exec',
+    'bookmark', 'bm', 'hosts', 'scp', 'connect', 'exec', 'forward',
     'help', '--help', '-h',
 ]);
 /**
@@ -55,6 +56,12 @@ export function registerSSHCommands(parent, opts) {
     const ssh = parent
         .command('ssh')
         .description('SSH CA management and quick connect (znvault ssh user@host)')
+        // Parse options relative to position: options that appear AFTER a subcommand
+        // name (e.g. `ssh connect --dry-run ...`) are handed to the subcommand rather
+        // than being swallowed by this parent (which also declares --dry-run/--ttl/-i
+        // for the `ssh user@host` shortcut). Without this, Commander attributes those
+        // options to the parent and the subcommand's action sees them as undefined.
+        .enablePositionalOptions()
         .argument('[destination]', 'Host to connect to (user@host or bookmark name)')
         .argument('[command...]', 'Remote command to execute')
         .option('-i, --identity <file>', 'Path to SSH private key')
@@ -102,6 +109,7 @@ export function registerSSHCommands(parent, opts) {
         registerHostsCommand(ssh);
         registerSCPCommand(ssh);
         registerConnectCommand(ssh);
+        registerForwardCommand(ssh);
         registerExecCommand(ssh);
     });
 }

package/dist/commands/ssh/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/ssh/index.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAsBlC,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,+DAA+D;AAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ;IACjD,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM;IACnD,MAAM,EAAE,QAAQ,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,kDAAkD;IAClD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qCAAqC;IACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;IAChB,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,sDAAsD;QACtD,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,IAAsB;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM;SACf,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,6DAA6D,CAAC;SAC1E,QAAQ,CAAC,eAAe,EAAE,iDAAiD,CAAC;SAC5E,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC;SACrD,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0CAA0C,CAAC;SAC/E,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,IAAI,EAAE,kCAAkC,CAAC;SAChD,MAAM,CAAC,IAAI,EAAE,oCAAoC,CAAC;SAClD,kBAAkB,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,KAAK,EAAE,WAA+B,EAAE,aAAuB,EAAE,OAAuB,EAAE,EAAE;QAClG,wCAAwC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,MAAM,cAAc,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,wBAAwB;YACxB,OAAO,CAAC,KAAK,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACrE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAC7E,iFAAiF;IACjF,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE;QAC5B,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC7B,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACjC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,cAAc,YAAY,CAAC;AAE3B,wCAAwC;AACxC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,8BAA8B;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/ssh/index.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAsBlC,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,+DAA+D;AAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ;IACjD,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS;IAC9D,MAAM,EAAE,QAAQ,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,kDAAkD;IAClD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qCAAqC;IACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;IAChB,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,sDAAsD;QACtD,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,IAAsB;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM;SACf,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,6DAA6D,CAAC;QAC3E,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;SAC3E,uBAAuB,EAAE;SACzB,QAAQ,CAAC,eAAe,EAAE,iDAAiD,CAAC;SAC5E,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC;SACrD,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0CAA0C,CAAC;SAC/E,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,IAAI,EAAE,kCAAkC,CAAC;SAChD,MAAM,CAAC,IAAI,EAAE,oCAAoC,CAAC;SAClD,kBAAkB,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,KAAK,EAAE,WAA+B,EAAE,aAAuB,EAAE,OAAuB,EAAE,EAAE;QAClG,wCAAwC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,MAAM,cAAc,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,wBAAwB;YACxB,OAAO,CAAC,KAAK,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACrE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAC7E,iFAAiF;IACjF,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE;QAC5B,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC7B,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACjC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,cAAc,YAAY,CAAC;AAE3B,wCAAwC;AACxC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,8BAA8B;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -49,6 +49,12 @@ const program = new Command();
 program
     .name('znvault')
     .description('ZnVault Administration CLI')
+    // Enable positional options on the root program so that options appearing after
+    // a subcommand name are parsed relative to position. Commander requires this on
+    // ancestor commands for nested positional parsing to reach grandchild commands
+    // (e.g. `znvault ssh connect --dry-run`), where the `ssh` parent also declares
+    // its own options for the `ssh user@host` shortcut. See src/commands/ssh/index.ts.
+    .enablePositionalOptions()
     .version(getVersion())
     .option('--url <url>', 'Vault server URL')
     .option('--insecure', 'Skip TLS certificate verification')
@@ -80,6 +86,13 @@ program
     if (parentName === 'completion' || cmdPath === 'completion') {
         return;
     }
+    // Skip profile indicator for `ssh forward --print-port` — its stdout is a
+    // machine channel (JSON contract line) consumed by the deploy tunnel manager.
+    if (cmdPath === 'forward' &&
+        parentName === 'ssh' &&
+        actionCommand.opts().printPort === true) {
+        return;
+    }
     // Show current profile indicator
     const config = getConfig();
     profileIndicator(getActiveProfileName(), config.url);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,iFAAiF;AACjF,qDAAqD;AACrD,uBAAuB,CAAC,OAAO,CAAC,SAAqE,CAAC,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAsB,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,4BAA4B,CAAC;KACzC,OAAO,CAAC,UAAU,EAAE,CAAC;KACrB,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;KACzC,MAAM,CAAC,YAAY,EAAE,mCAAmC,CAAC;KACzD,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;KAClE,MAAM,CAAC,SAAS,EAAE,0CAA0C,CAAC;KAC7D,MAAM,CAAC,aAAa,EAAE,kEAAkE,CAAC;KACzF,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE;IAChD,uBAAuB;IACvB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAiB,CAAC;IAE/C,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,+BAA+B;IAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,gFAAgF;IAChF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,UAAU,KAAK,YAAY,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,qEAAqE;AACrE,EAAE;AACF,8EAA8E;AAC9E,iDAAiD;AACjD,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,mEAAmE;AACnE,+CAA+C;AAC/C,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACtC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACxC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,6EAA6E;AAC7E,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAEpC,kFAAkF;AAClF,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,6CAA6C;AAC7C,wBAAwB,EAAE,CAAC;AAE3B;;GAEG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IAEzC,IAAI,UAAU,GAA8B,MAAM,CAAC;IACnD,IAAI,QAA4B,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IAErC,IAAI,SAAS,EAAE,EAAE,CAAC;QAChB,UAAU,GAAG,QAAQ,CAAC;QACtB,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7B,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,EAAE,WAAW,EAAE,CAAC;QACpC,UAAU,GAAG,KAAK,CAAC;QACnB,2CAA2C;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAwC,CAAC;YAC7G,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,eAAe,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,EAAE;QACrB,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU;QACV,QAAQ;QACR,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,yBAAyB;AACzB,KAAK,UAAU,IAAI;IACjB,mDAAmD;IACnD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,mBAAmB;IACnB,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;IACnC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,aAAa,EACb,MAAM,EACN,SAAS,EACT,oBAAoB,CACrB,CAAC;YACF,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,WAAW;AACX,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,iFAAiF;AACjF,qDAAqD;AACrD,uBAAuB,CAAC,OAAO,CAAC,SAAqE,CAAC,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAsB,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,4BAA4B,CAAC;IAC1C,gFAAgF;IAChF,gFAAgF;IAChF,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;KAClF,uBAAuB,EAAE;KACzB,OAAO,CAAC,UAAU,EAAE,CAAC;KACrB,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;KACzC,MAAM,CAAC,YAAY,EAAE,mCAAmC,CAAC;KACzD,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;KAClE,MAAM,CAAC,SAAS,EAAE,0CAA0C,CAAC;KAC7D,MAAM,CAAC,aAAa,EAAE,kEAAkE,CAAC;KACzF,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE;IAChD,uBAAuB;IACvB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAiB,CAAC;IAE/C,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,+BAA+B;IAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,gFAAgF;IAChF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,UAAU,KAAK,YAAY,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,IACE,OAAO,KAAK,SAAS;QACrB,UAAU,KAAK,KAAK;QACpB,aAAa,CAAC,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI,EACvC,CAAC;QACD,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,qEAAqE;AACrE,EAAE;AACF,8EAA8E;AAC9E,iDAAiD;AACjD,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,mEAAmE;AACnE,+CAA+C;AAC/C,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACtC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACxC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,6EAA6E;AAC7E,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAEpC,kFAAkF;AAClF,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,6CAA6C;AAC7C,wBAAwB,EAAE,CAAC;AAE3B;;GAEG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IAEzC,IAAI,UAAU,GAA8B,MAAM,CAAC;IACnD,IAAI,QAA4B,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IAErC,IAAI,SAAS,EAAE,EAAE,CAAC;QAChB,UAAU,GAAG,QAAQ,CAAC;QACtB,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7B,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,EAAE,WAAW,EAAE,CAAC;QACpC,UAAU,GAAG,KAAK,CAAC;QACnB,2CAA2C;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAwC,CAAC;YAC7G,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,eAAe,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,EAAE;QACrB,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU;QACV,QAAQ;QACR,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,yBAAyB;AACzB,KAAK,UAAU,IAAI;IACjB,mDAAmD;IACnD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,mBAAmB;IACnB,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;IACnC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,aAAa,EACb,MAAM,EACN,SAAS,EACT,oBAAoB,CACrB,CAAC;YACF,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,WAAW;AACX,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zincapp/znvault-cli",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "description": "Official CLI for ZnVault administration",
   "type": "module",
   "main": "dist/index.js",