ssh-mcp-pro 1.1.2 → 1.1.4

package/dist/remote/oauth-handler.js

@@ -0,0 +1,296 @@
+import { URL } from "node:url";
+import { hashSecret, id, issueAccessToken, nowIso, publicJwkFromPem, randomToken, } from "./crypto.js";
+import { asString, asStringArray, addNoStore, isSafeRedirectUri, pkceChallenge, readJson, readJsonOrForm, redirect, safeError, scopeList, } from "./http-util.js";
+import { REMOTE_SCOPES } from "./types.js";
+import { jsonResponse } from "./util.js";
+/** Handles OAuth 2.0 authorization code flow with PKCE and GitHub identity. */
+export class OAuthHandler {
+    config;
+    store;
+    authorizeTransactions;
+    getJwtKeyPair;
+    audit;
+    constructor(config, store, authorizeTransactions, getJwtKeyPair, audit) {
+        this.config = config;
+        this.store = store;
+        this.authorizeTransactions = authorizeTransactions;
+        this.getJwtKeyPair = getJwtKeyPair;
+        this.audit = audit;
+    }
+    /** GET /.well-known/oauth-protected-resource */
+    protectedResourceMetadata() {
+        return {
+            resource: this.config.mcpResourceUrl,
+            resource_name: "SshAutomator MCP",
+            authorization_servers: [this.config.publicBaseUrl],
+            bearer_methods_supported: ["header"],
+            scopes_supported: REMOTE_SCOPES,
+        };
+    }
+    /** GET /.well-known/oauth-authorization-server */
+    authorizationServerMetadata() {
+        return {
+            issuer: this.config.publicBaseUrl,
+            authorization_endpoint: `${this.config.publicBaseUrl}/oauth/authorize`,
+            token_endpoint: `${this.config.publicBaseUrl}/oauth/token`,
+            registration_endpoint: `${this.config.publicBaseUrl}/oauth/register`,
+            jwks_uri: `${this.config.publicBaseUrl}/oauth/jwks.json`,
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code"],
+            code_challenge_methods_supported: ["S256"],
+            token_endpoint_auth_methods_supported: ["none"],
+            scopes_supported: REMOTE_SCOPES,
+        };
+    }
+    /** POST /oauth/register */
+    async handleRegister(req, res) {
+        const body = await readJson(req);
+        const redirectUris = asStringArray(body.redirect_uris);
+        if (redirectUris.length === 0 || redirectUris.some((uri) => !isSafeRedirectUri(uri))) {
+            throw safeError("INVALID_REDIRECT_URI", "redirect_uris must contain HTTPS URLs or localhost HTTP URLs");
+        }
+        if (this.store.countOAuthClients() >= this.config.maxOAuthClients) {
+            throw safeError("FORBIDDEN", "OAuth client registration limit reached", 429);
+        }
+        const now = nowIso();
+        const client = {
+            id: id("clirow"),
+            clientId: id("cli"),
+            clientName: asString(body.client_name) ?? "ChatGPT Connector",
+            redirectUris,
+            grantTypes: ["authorization_code"],
+            responseTypes: ["code"],
+            tokenEndpointAuthMethod: "none",
+            createdAt: now,
+        };
+        this.store.insertClient(client);
+        this.audit({
+            eventType: "oauth_client_registered",
+            severity: "info",
+            metadata: { client_id: client.clientId, redirect_uri_count: redirectUris.length },
+        });
+        jsonResponse(res, 201, {
+            client_id: client.clientId,
+            client_name: client.clientName,
+            redirect_uris: client.redirectUris,
+            grant_types: client.grantTypes,
+            response_types: client.responseTypes,
+            token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+        }, addNoStore());
+    }
+    /** GET /oauth/authorize */
+    async handleAuthorize(req, res) {
+        const url = new URL(req.url ?? "/oauth/authorize", this.config.publicBaseUrl);
+        const clientId = url.searchParams.get("client_id") ?? "";
+        const redirectUri = url.searchParams.get("redirect_uri") ?? "";
+        const responseType = url.searchParams.get("response_type") ?? "";
+        const codeChallenge = url.searchParams.get("code_challenge") ?? "";
+        const codeChallengeMethod = url.searchParams.get("code_challenge_method") ?? "";
+        const state = url.searchParams.get("state") ?? "";
+        const resource = url.searchParams.get("resource") ?? this.config.mcpResourceUrl;
+        const scope = url.searchParams.get("scope") ?? "hosts:read agents:read status:read logs:read";
+        this.validateAuthorizeParams(clientId, redirectUri, responseType, codeChallenge, codeChallengeMethod, resource, scope);
+        const pending = {
+            clientId,
+            redirectUri,
+            codeChallenge,
+            resource,
+            scope,
+            state,
+            expiresAt: Date.now() + this.config.authCodeTtlSeconds * 1000,
+        };
+        const testUser = this.testGitHubUser();
+        if (testUser) {
+            const user = this.upsertGitHubUser(testUser);
+            const code = this.issueAuthorizationCode(pending, user.id);
+            const destination = new URL(redirectUri);
+            destination.searchParams.set("code", code);
+            if (state) {
+                destination.searchParams.set("state", state);
+            }
+            redirect(res, destination.toString());
+            return;
+        }
+        if (!this.config.githubClientId || !this.config.githubClientSecret) {
+            throw safeError("FORBIDDEN", "GitHub OAuth is not configured", 503);
+        }
+        const transactionId = id("code");
+        this.authorizeTransactions.set(transactionId, pending);
+        const githubUrl = new URL("https://github.com/login/oauth/authorize");
+        githubUrl.searchParams.set("client_id", this.config.githubClientId);
+        githubUrl.searchParams.set("redirect_uri", this.config.githubCallbackUrl);
+        githubUrl.searchParams.set("scope", "read:user");
+        githubUrl.searchParams.set("state", transactionId);
+        redirect(res, githubUrl.toString());
+    }
+    validateAuthorizeParams(clientId, redirectUri, responseType, codeChallenge, codeChallengeMethod, resource, scope) {
+        const client = this.store.getClient(clientId);
+        if (!client) {
+            throw safeError("INVALID_CLIENT", "Unknown client_id");
+        }
+        if (!client.redirectUris.includes(redirectUri) || !isSafeRedirectUri(redirectUri)) {
+            throw safeError("INVALID_REDIRECT_URI", "redirect_uri is not registered");
+        }
+        if (responseType !== "code") {
+            throw safeError("INVALID_CLIENT", "response_type must be code");
+        }
+        if (!codeChallenge || codeChallengeMethod !== "S256") {
+            throw safeError("PKCE_VALIDATION_FAILED", "PKCE S256 is required");
+        }
+        if (resource !== this.config.mcpResourceUrl) {
+            throw safeError("INVALID_TOKEN", "resource must match MCP resource URL");
+        }
+        scopeList(scope);
+    }
+    /** GET /oauth/callback/github */
+    async handleGitHubCallback(req, res) {
+        const url = new URL(req.url ?? "/oauth/callback/github", this.config.publicBaseUrl);
+        const code = url.searchParams.get("code") ?? "";
+        const state = url.searchParams.get("state") ?? "";
+        const pending = this.authorizeTransactions.get(state);
+        this.authorizeTransactions.delete(state);
+        if (!code || !pending || pending.expiresAt < Date.now()) {
+            throw safeError("INVALID_TOKEN", "OAuth transaction is missing or expired");
+        }
+        const githubUser = await this.fetchGitHubUser(code);
+        const user = this.upsertGitHubUser(githubUser);
+        const authCode = this.issueAuthorizationCode(pending, user.id);
+        const destination = new URL(pending.redirectUri);
+        destination.searchParams.set("code", authCode);
+        if (pending.state) {
+            destination.searchParams.set("state", pending.state);
+        }
+        redirect(res, destination.toString());
+    }
+    async fetchGitHubUser(code) {
+        const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
+            method: "POST",
+            headers: { Accept: "application/json", "Content-Type": "application/json" },
+            body: JSON.stringify({
+                client_id: this.config.githubClientId,
+                client_secret: this.config.githubClientSecret,
+                code,
+                redirect_uri: this.config.githubCallbackUrl,
+            }),
+        });
+        const tokenPayload = (await tokenResponse.json());
+        const accessToken = asString(tokenPayload.access_token);
+        if (!accessToken) {
+            throw safeError("INVALID_TOKEN", "GitHub OAuth token exchange failed", 502);
+        }
+        const userResponse = await fetch("https://api.github.com/user", {
+            headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/vnd.github+json" },
+        });
+        const userPayload = (await userResponse.json());
+        return { id: String(userPayload.id ?? ""), login: String(userPayload.login ?? "") };
+    }
+    testGitHubUser() {
+        const idValue = process.env.SSHAUTOMATOR_TEST_GITHUB_ID;
+        const login = process.env.SSHAUTOMATOR_TEST_GITHUB_LOGIN;
+        return idValue && login ? { id: idValue, login } : undefined;
+    }
+    upsertGitHubUser(githubUser) {
+        if (!this.isGitHubUserAllowed(githubUser)) {
+            throw safeError("FORBIDDEN", "GitHub user is not allowed");
+        }
+        const existing = this.store.getUserByGitHubId(githubUser.id);
+        const internalId = existing?.id ?? `github:${githubUser.id}`;
+        this.store.upsertUser({ ...githubUser, internalId, now: nowIso() });
+        this.audit({
+            userId: internalId,
+            eventType: "user_login",
+            severity: "info",
+            metadata: { github_id: githubUser.id, github_login: githubUser.login },
+        });
+        return { id: internalId, githubId: githubUser.id, githubLogin: githubUser.login };
+    }
+    isGitHubUserAllowed(user) {
+        return (this.config.allowAllUsers ||
+            this.config.allowedGitHubIds.includes(user.id) ||
+            this.config.allowedGitHubLogins.includes(user.login));
+    }
+    issueAuthorizationCode(pending, userId) {
+        const code = randomToken(32);
+        const now = nowIso();
+        const record = {
+            id: id("code"),
+            codeHash: hashSecret(code),
+            clientId: pending.clientId,
+            userId,
+            redirectUri: pending.redirectUri,
+            codeChallenge: pending.codeChallenge,
+            codeChallengeMethod: "S256",
+            resource: pending.resource,
+            scope: pending.scope,
+            expiresAt: new Date(Date.now() + this.config.authCodeTtlSeconds * 1000).toISOString(),
+            createdAt: now,
+        };
+        this.store.insertAuthorizationCode(record);
+        return code;
+    }
+    /** POST /oauth/token */
+    async handleToken(req, res) {
+        const body = await readJsonOrForm(req);
+        if (body.grant_type !== "authorization_code") {
+            throw safeError("INVALID_CLIENT", "grant_type must be authorization_code");
+        }
+        const clientId = body.client_id ?? "";
+        const client = this.store.getClient(clientId);
+        if (!client) {
+            throw safeError("INVALID_CLIENT", "Unknown client_id");
+        }
+        const code = body.code ?? "";
+        const redirectUri = body.redirect_uri ?? "";
+        const verifier = body.code_verifier ?? "";
+        const codeRecord = this.store.getAuthorizationCodeByHash(hashSecret(code));
+        if (codeRecord?.clientId !== clientId || codeRecord?.redirectUri !== redirectUri) {
+            throw safeError("INVALID_TOKEN", "Invalid authorization code");
+        }
+        if (codeRecord.usedAt || new Date(codeRecord.expiresAt).getTime() < Date.now()) {
+            throw safeError("INVALID_TOKEN", "Authorization code is expired or already used");
+        }
+        if (!verifier || pkceChallenge(verifier) !== codeRecord.codeChallenge) {
+            throw safeError("PKCE_VALIDATION_FAILED", "Invalid PKCE code_verifier");
+        }
+        const jwtKeyPair = this.getJwtKeyPair();
+        const user = this.userFromId(codeRecord.userId);
+        const scopes = scopeList(codeRecord.scope);
+        try {
+            this.store.markAuthorizationCodeUsed(codeRecord.codeHash, nowIso());
+        }
+        catch {
+            throw safeError("INVALID_TOKEN", "Authorization code is expired or already used");
+        }
+        const token = await issueAccessToken(this.config, jwtKeyPair, user, scopes);
+        jsonResponse(res, 200, {
+            access_token: token.token,
+            token_type: "Bearer",
+            expires_in: this.config.accessTokenTtlSeconds,
+            scope: scopes.join(" "),
+        }, addNoStore());
+    }
+    userFromId(userId) {
+        if (userId.startsWith("github:")) {
+            const githubId = userId.slice("github:".length);
+            const user = this.store.getUserByGitHubId(githubId);
+            if (user) {
+                return user;
+            }
+        }
+        throw safeError("UNAUTHORIZED", "User no longer exists", 401);
+    }
+    /** Remove expired pending authorization transactions. */
+    cleanupExpired(now = Date.now()) {
+        for (const [transactionId, transaction] of this.authorizeTransactions.entries()) {
+            if (transaction.expiresAt <= now) {
+                this.authorizeTransactions.delete(transactionId);
+            }
+        }
+    }
+    /** GET /oauth/jwks.json */
+    async handleJwks(res) {
+        const jwtKeyPair = this.getJwtKeyPair();
+        jsonResponse(res, 200, { keys: [await publicJwkFromPem(jwtKeyPair.publicKeyPem)] }, addNoStore());
+    }
+}
+//# sourceMappingURL=oauth-handler.js.map

package/dist/remote/oauth-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-handler.js","sourceRoot":"","sources":["../../src/remote/oauth-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EACL,UAAU,EACV,EAAE,EACF,gBAAgB,EAChB,MAAM,EACN,gBAAgB,EAChB,WAAW,GAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AASxB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAazC,+EAA+E;AAC/E,MAAM,OAAO,YAAY;IAEJ;IACA;IACA;IACA;IACA;IALnB,YACmB,MAAoB,EACpB,KAAkB,EAClB,qBAAoD,EACpD,aAA+B,EAC/B,KAA4D;QAJ5D,WAAM,GAAN,MAAM,CAAc;QACpB,UAAK,GAAL,KAAK,CAAa;QAClB,0BAAqB,GAArB,qBAAqB,CAA+B;QACpD,kBAAa,GAAb,aAAa,CAAkB;QAC/B,UAAK,GAAL,KAAK,CAAuD;IAC5E,CAAC;IAEJ,gDAAgD;IAChD,yBAAyB;QACvB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YACpC,aAAa,EAAE,kBAAkB;YACjC,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAClD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,gBAAgB,EAAE,aAAa;SAChC,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,2BAA2B;QACzB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACjC,sBAAsB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,kBAAkB;YACtE,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,cAAc;YAC1D,qBAAqB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,iBAAiB;YACpE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,kBAAkB;YACxD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;YAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,gBAAgB,EAAE,aAAa;SAChC,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,cAAc,CAAC,GAAoB,EAAE,GAAmB;QAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrF,MAAM,SAAS,CACb,sBAAsB,EACtB,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAClE,MAAM,SAAS,CAAC,WAAW,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC;YAChB,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC;YACnB,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,mBAAmB;YAC7D,YAAY;YACZ,UAAU,EAAE,CAAC,oBAAoB,CAAC;YAClC,aAAa,EAAE,CAAC,MAAM,CAAC;YACvB,uBAAuB,EAAE,MAAM;YAC/B,SAAS,EAAE,GAAG;SACf,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC;YACT,SAAS,EAAE,yBAAyB;YACpC,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,YAAY,CAAC,MAAM,EAAE;SAClF,CAAC,CAAC;QACH,YAAY,CACV,GAAG,EACH,GAAG,EACH;YACE,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;SAC3D,EACD,UAAU,EAAE,CACb,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,eAAe,CAAC,GAAoB,EAAE,GAAmB;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACnE,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAChF,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,8CAA8C,CAAC;QAE9F,IAAI,CAAC,uBAAuB,CAC1B,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,KAAK,CACN,CAAC;QAEF,MAAM,OAAO,GAAqB;YAChC,QAAQ;YACR,WAAW;YACX,aAAa;YACb,QAAQ;YACR,KAAK;YACL,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,GAAG,IAAI;SAC9D,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACzC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/C,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnE,MAAM,SAAS,CAAC,WAAW,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACtE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC1E,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACjD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,uBAAuB,CAC7B,QAAgB,EAChB,WAAmB,EACnB,YAAoB,EACpB,aAAqB,EACrB,mBAA2B,EAC3B,QAAgB,EAChB,KAAa;QAEb,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,MAAM,SAAS,CAAC,sBAAsB,EAAE,gCAAgC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,SAAS,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,aAAa,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;YACrD,MAAM,SAAS,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,SAAS,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;QAC3E,CAAC;QACD,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,oBAAoB,CAAC,GAAoB,EAAE,GAAmB;QAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxD,MAAM,SAAS,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAY;QACxC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,6CAA6C,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;gBACrC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;gBAC7C,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;aAC5C,CAAC;SACH,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC7E,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,SAAS,CAAC,eAAe,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;YAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE;SAC3F,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC;IAEO,cAAc;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QACzD,OAAO,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IAEO,gBAAgB,CAAC,UAAsB;QAK7C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,SAAS,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,QAAQ,EAAE,EAAE,IAAI,UAAU,UAAU,CAAC,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,YAAY;YACvB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,KAAK,EAAE;SACvE,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACpF,CAAC;IAEO,mBAAmB,CAAC,IAAgB;QAC1C,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,aAAa;YACzB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CACrD,CAAC;IACJ,CAAC;IAEO,sBAAsB,CAAC,OAAyB,EAAE,MAAc;QACtE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAA2B;YACrC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;YACd,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,mBAAmB,EAAE,MAAM;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACrF,SAAS,EAAE,GAAG;SACf,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB;IACxB,KAAK,CAAC,WAAW,CAAC,GAAoB,EAAE,GAAmB;QACzD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,MAAM,SAAS,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,UAAU,EAAE,QAAQ,KAAK,QAAQ,IAAI,UAAU,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACjF,MAAM,SAAS,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/E,MAAM,SAAS,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;YACtE,MAAM,SAAS,CAAC,wBAAwB,EAAE,4BAA4B,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,SAAS,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5E,YAAY,CACV,GAAG,EACH,GAAG,EACH;YACE,YAAY,EAAE,KAAK,CAAC,KAAK;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;YAC7C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,EACD,UAAU,EAAE,CACb,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,MAAc;QAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC,cAAc,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,yDAAyD;IACzD,cAAc,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC7B,KAAK,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,EAAE,CAAC;YAChF,IAAI,WAAW,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBACjC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,UAAU,CAAC,GAAmB;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,YAAY,CACV,GAAG,EACH,GAAG,EACH,EAAE,IAAI,EAAE,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,EAC3D,UAAU,EAAE,CACb,CAAC;IACJ,CAAC;CACF"}

package/dist/session-auth.d.ts

@@ -0,0 +1,39 @@
+import type { Config } from "node-ssh";
+import type { Logger } from "./logging.js";
+/**
+ * SSH authentication configuration
+ */
+export interface SSHAuthConfig {
+    password?: string;
+    privateKey?: string;
+    passphrase?: string;
+    agent?: string;
+}
+export type SSHConnectConfig = Config & {
+    knownHosts?: string;
+    hostHash?: "md5" | "sha1" | "sha256";
+};
+export declare const KNOWN_HOST_KEY_TYPES: Set<string>;
+/** Normalize a SHA256 fingerprint by stripping the SHA256: prefix. */
+export declare function normalizeSha256Fingerprint(fingerprint: string): string;
+/** Compute SHA256 fingerprint(s) from a base64 key blob. */
+export declare function knownHostKeyFingerprints(keyBlob: string): string[];
+/** Generate a unique session ID. */
+export declare function generateSessionId(): string;
+/** Build SSH agent authentication config. */
+export declare function buildAgentAuth(): SSHAuthConfig;
+/** Load a private key from a file path. */
+export declare function loadPrivateKeyFromPath(keyPath: string, passphrase?: string): Promise<SSHAuthConfig>;
+/** Auto-discover private keys in standard SSH locations. */
+export declare function discoverPrivateKeys(passphrase: string | undefined, logger?: Logger): Promise<SSHAuthConfig>;
+/** Parse a single known_hosts line into its components. */
+export declare function parseKnownHostLine(line: string): {
+    marker?: string;
+    hosts: string;
+    keyBlob: string;
+} | undefined;
+/** Check whether a known_hosts pattern matches the given host and port. */
+export declare function knownHostPatternMatches(hosts: string, host: string, port: number): boolean;
+/** Match a hashed known_hosts entry against a set of candidate host strings. */
+export declare function hashedKnownHostPatternMatches(pattern: string, candidates: Set<string>): boolean;
+//# sourceMappingURL=session-auth.d.ts.map

package/dist/session-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-auth.d.ts","sourceRoot":"","sources":["../src/session-auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;CACtC,CAAC;AAEF,eAAO,MAAM,oBAAoB,aAmB/B,CAAC;AAEH,sEAAsE;AACtE,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,4DAA4D;AAC5D,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAKlE;AAED,oCAAoC;AACpC,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,6CAA6C;AAC7C,wBAAgB,cAAc,IAAI,aAAa,CAU9C;AAED,2CAA2C;AAC3C,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC,CAaxB;AAED,4DAA4D;AAC5D,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC,CAsBxB;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,GACX;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAyBjE;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA2B1F;AAED,gFAAgF;AAChF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAoB/F"}

package/dist/session-auth.js

@@ -0,0 +1,148 @@
+import { createHash, createHmac, randomUUID } from "node:crypto";
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { createAuthError } from "./errors.js";
+export const KNOWN_HOST_KEY_TYPES = new Set([
+    "ssh-ed25519",
+    "ssh-ed25519-cert-v01@openssh.com",
+    "ssh-rsa",
+    "ssh-rsa-cert-v01@openssh.com",
+    "rsa-sha2-256",
+    "rsa-sha2-256-cert-v01@openssh.com",
+    "rsa-sha2-512",
+    "rsa-sha2-512-cert-v01@openssh.com",
+    "ecdsa-sha2-nistp256",
+    "ecdsa-sha2-nistp256-cert-v01@openssh.com",
+    "ecdsa-sha2-nistp384",
+    "ecdsa-sha2-nistp384-cert-v01@openssh.com",
+    "ecdsa-sha2-nistp521",
+    "ecdsa-sha2-nistp521-cert-v01@openssh.com",
+    "sk-ssh-ed25519@openssh.com",
+    "sk-ssh-ed25519-cert-v01@openssh.com",
+    "sk-ecdsa-sha2-nistp256@openssh.com",
+    "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com",
+]);
+/** Normalize a SHA256 fingerprint by stripping the SHA256: prefix. */
+export function normalizeSha256Fingerprint(fingerprint) {
+    return fingerprint.replace(/^SHA256:/i, "").trim();
+}
+/** Compute SHA256 fingerprint(s) from a base64 key blob. */
+export function knownHostKeyFingerprints(keyBlob) {
+    const key = Buffer.from(keyBlob, "base64");
+    const base64 = createHash("sha256").update(key).digest("base64").replace(/=+$/, "");
+    const hex = createHash("sha256").update(key).digest("hex");
+    return [base64, hex];
+}
+/** Generate a unique session ID. */
+export function generateSessionId() {
+    return `ssh-${randomUUID()}`;
+}
+/** Build SSH agent authentication config. */
+export function buildAgentAuth() {
+    const authSock = process.env.SSH_AUTH_SOCK;
+    if (!authSock) {
+        throw createAuthError("SSH agent not available", "Set SSH_AUTH_SOCK environment variable or use a different auth method");
+    }
+    return { agent: authSock };
+}
+/** Load a private key from a file path. */
+export async function loadPrivateKeyFromPath(keyPath, passphrase) {
+    try {
+        const privateKey = await fs.promises.readFile(keyPath, "utf8");
+        return {
+            privateKey,
+            ...(passphrase !== undefined ? { passphrase } : {}),
+        };
+    }
+    catch {
+        throw createAuthError(`Failed to load private key from ${keyPath}`, "Check if the file exists and is readable");
+    }
+}
+/** Auto-discover private keys in standard SSH locations. */
+export async function discoverPrivateKeys(passphrase, logger) {
+    const homeDir = os.homedir();
+    const keyDir = process.env.SSH_DEFAULT_KEY_DIR ?? path.join(homeDir, ".ssh");
+    const keyFiles = ["id_ed25519", "id_ecdsa", "id_ed25519_sk", "id_ecdsa_sk", "id_rsa"];
+    for (const keyFile of keyFiles) {
+        const keyPath = path.join(keyDir, keyFile);
+        try {
+            await fs.promises.access(keyPath, fs.constants.R_OK);
+            logger?.debug?.("Found SSH key", { path: keyPath });
+            return await loadPrivateKeyFromPath(keyPath, passphrase);
+        }
+        catch {
+            logger?.debug?.("SSH key not found or not readable", { path: keyPath });
+        }
+    }
+    throw createAuthError("No SSH private keys found in standard locations", `Checked: ${keyFiles.map((f) => path.join(keyDir, f)).join(", ")}`);
+}
+/** Parse a single known_hosts line into its components. */
+export function parseKnownHostLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+        return undefined;
+    }
+    const parts = trimmed.split(/\s+/);
+    if (parts[0]?.startsWith("@")) {
+        if (parts.length < 4) {
+            return undefined;
+        }
+        if (!KNOWN_HOST_KEY_TYPES.has(parts[2] ?? "")) {
+            return undefined;
+        }
+        return { marker: parts[0], hosts: parts[1] ?? "", keyBlob: parts[3] ?? "" };
+    }
+    if (parts.length < 3) {
+        return undefined;
+    }
+    if (!KNOWN_HOST_KEY_TYPES.has(parts[1] ?? "")) {
+        return undefined;
+    }
+    return { hosts: parts[0] ?? "", keyBlob: parts[2] ?? "" };
+}
+/** Check whether a known_hosts pattern matches the given host and port. */
+export function knownHostPatternMatches(hosts, host, port) {
+    const candidates = new Set([host, `[${host}]:${port}`]);
+    for (const pattern of hosts.split(",")) {
+        if (pattern.startsWith("|")) {
+            if (hashedKnownHostPatternMatches(pattern, candidates)) {
+                return true;
+            }
+            continue;
+        }
+        if (candidates.has(pattern)) {
+            return true;
+        }
+        const regex = new RegExp(`^${pattern
+            .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+            .replace(/\*/g, ".*")
+            .replace(/\?/g, ".")}$`);
+        if (regex.test(host)) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Match a hashed known_hosts entry against a set of candidate host strings. */
+export function hashedKnownHostPatternMatches(pattern, candidates) {
+    const match = /^\|1\|([^|]+)\|([^|]+)$/u.exec(pattern);
+    if (!match) {
+        return false;
+    }
+    try {
+        const salt = Buffer.from(match[1] ?? "", "base64");
+        const expected = match[2] ?? "";
+        for (const candidate of candidates) {
+            const digest = createHmac("sha1", salt).update(candidate).digest("base64");
+            if (digest === expected) {
+                return true;
+            }
+        }
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+//# sourceMappingURL=session-auth.js.map

package/dist/session-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-auth.js","sourceRoot":"","sources":["../src/session-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkB9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IAC1C,aAAa;IACb,kCAAkC;IAClC,SAAS;IACT,8BAA8B;IAC9B,cAAc;IACd,mCAAmC;IACnC,cAAc;IACd,mCAAmC;IACnC,qBAAqB;IACrB,0CAA0C;IAC1C,qBAAqB;IACrB,0CAA0C;IAC1C,qBAAqB;IACrB,0CAA0C;IAC1C,4BAA4B;IAC5B,qCAAqC;IACrC,oCAAoC;IACpC,6CAA6C;CAC9C,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,OAAO,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,UAAU,EAAE,EAAE,CAAC;AAC/B,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,eAAe,CACnB,yBAAyB,EACzB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,UAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO;YACL,UAAU;YACV,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,eAAe,CACnB,mCAAmC,OAAO,EAAE,EAC5C,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA8B,EAC9B,MAAe;IAEf,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEtF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE3C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,EAAE,KAAK,EAAE,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,KAAK,EAAE,CAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,MAAM,eAAe,CACnB,iDAAiD,EACjD,YAAY,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnE,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAChC,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,IAAY,EAAE,IAAY;IAC/E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAExD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,6BAA6B,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,IAAI,OAAO;aACR,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;aACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;aACpB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAC1B,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,6BAA6B,CAAC,OAAe,EAAE,UAAuB;IACpF,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/session.d.ts

@@ -27,6 +27,16 @@ export declare class SessionManager {
     private cleanupInterval;
     private readonly acceptedHostKeys;
     private readonly closeListeners;
+    /**
+     * Tracks sessions that are currently being closed.
+     * Used to exclude them from active-session reporting.
+     */
+    private readonly closingSessions;
+    /**
+     * Tracks in-flight operations per session.
+     * Cleanup and eviction skip sessions with a non-zero count.
+     */
+    private readonly activeOperations;
     constructor(maxSessions?: number, defaultTtlMs?: number, cleanupIntervalMs?: number, security?: ServerConfig["security"], policy?: Pick<PolicyEngine, "assertAllowed"> | undefined);
     /**
      * Destroys the session manager, cleaning up all sessions and intervals
@@ -57,33 +67,14 @@ export declare class SessionManager {
      * Builds key-based authentication
      */
     private buildKeyAuth;
-    /**
-     * Builds SSH agent authentication
-     */
-    private buildAgentAuth;
     /**
      * Builds automatic authentication (tries password, then key, then agent)
      */
     private buildAutoAuth;
-    /**
-     * Loads private key from file path
-     */
-    private loadPrivateKeyFromPath;
-    /**
-     * Auto-discovers private keys in standard locations
-     */
-    private discoverPrivateKeys;
-    /**
-     * Generates a unique session ID
-     */
-    private generateSessionId;
     private notifySessionClose;
     private resolveHostKeyPolicy;
     private verifyAcceptNewHostKey;
     private verifyKnownHostKey;
-    private parseKnownHostLine;
-    private knownHostPatternMatches;
-    private hashedKnownHostPatternMatches;
     /**
      * Evicts the oldest (least recently used) session
      */
@@ -93,7 +84,21 @@ export declare class SessionManager {
      */
     private cleanupExpiredSessions;
     /**
-     * Gets information about all active sessions
+     * Records that an operation is starting on a session.
+     * Prevents cleanup/eviction from removing the session while busy.
+     */
+    beginOperation(sessionId: string): void;
+    /**
+     * Records that an operation on a session has completed.
+     * Must be called in a finally block paired with beginOperation.
+     */
+    endOperation(sessionId: string): void;
+    /**
+     * Returns whether a session has in-flight operations.
+     */
+    private hasActiveOperations;
+    /**
+     * Returns information about all active non-expired non-closing sessions.
      */
     getActiveSessions(): SessionInfo[];
     /**

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAKxC,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,MAAM,EAGP,MAAM,YAAY,CAAC;AAUpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AA8C/E;;GAEG;AACH,qBAAa,cAAc;IAYvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAMzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAjB1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmC;gBAGhE,WAAW,SAAK,EAChB,YAAY,SAAU,EACtB,iBAAiB,SAAS,EACT,QAAQ,GAAE,YAAY,CAAC,UAAU,CAKjD,EACgB,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,YAAA;IAW/D;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO1D;;OAEG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAenD;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+LnE;;OAEG;IACG,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBvD;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAerD;;OAEG;YACW,eAAe;IAqB7B;;OAEG;YACW,YAAY;IAmB1B;;OAEG;YACW,cAAc;IAa5B;;OAEG;YACW,aAAa;IAuB3B;;OAEG;YACW,sBAAsB;IAkBpC;;OAEG;YACW,mBAAmB;IAwBjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;YAIX,kBAAkB;IAgChC,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,sBAAsB;IAc9B,OAAO,CAAC,kBAAkB;IA2C1B,OAAO,CAAC,kBAAkB;IA6B1B,OAAO,CAAC,uBAAuB;IA6B/B,OAAO,CAAC,6BAA6B;IAsBrC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiB1B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAgB9B;;OAEG;IACH,iBAAiB,IAAI,WAAW,EAAE;IAMlC;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAKvC;;OAEG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAgCxE;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezD;;OAEG;IACG,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;CAsBlF"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAgBxC,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,MAAM,EAGP,MAAM,YAAY,CAAC;AAUpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE/E;;GAEG;AACH,qBAAa,cAAc;IAwBvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAMzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IA7B1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmC;IAElE;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;gBAG5D,WAAW,SAAK,EAChB,YAAY,SAAU,EACtB,iBAAiB,SAAS,EACT,QAAQ,GAAE,YAAY,CAAC,UAAU,CAKjD,EACgB,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,YAAA;IAW/D;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO1D;;OAEG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAenD;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+LnE;;OAEG;IACG,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCvD;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAkBrD;;OAEG;YACW,eAAe;IAqB7B;;OAEG;YACW,YAAY;IAmB1B;;OAEG;YACW,aAAa;YAuBb,kBAAkB;IAgChC,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,sBAAsB;IAc9B,OAAO,CAAC,kBAAkB;IA2C1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAuB1B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAsB9B;;;OAGG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKvC;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAarC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACH,iBAAiB,IAAI,WAAW,EAAE;IAkBlC;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAKvC;;OAEG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAgCxE;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezD;;OAEG;IACG,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;CAsBlF"}