ssh_tunnel_proxy 2.1.1 → 3.0.0

package/build/forward-spec.js

@@ -0,0 +1,175 @@
+"use strict";
+/*
+ * forward-spec.ts — pure parsing of the OpenSSH-style forward strings.
+ *
+ * The v1 configuration syntax is preserved so existing config.json files keep
+ * working, but the parsing rules are now explicit: field counts are checked
+ * before destructuring, and ports must be bare decimal integers.
+ *
+ * Local forward (ssh -L):
+ *   "localPort:remoteHost:remotePort"
+ *   "bindAddress:localPort:remoteHost:remotePort"
+ *
+ * Remote forward (ssh -R):
+ *   "bindPort:targetHost:targetPort"
+ *   "bindAddress:bindPort:targetHost:targetPort"
+ *
+ * Note the v1 3-field remote form was "localPort:host:remotePort" with the
+ * fields in an order that read backwards relative to OpenSSH. See MIGRATION.md;
+ * `parseRemoteForwardSpec` documents the mapping it applies.
+ *
+ * License: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_REMOTE_BIND_ADDRESS = exports.DEFAULT_LISTEN_ADDRESS = void 0;
+exports.parseLocalForwardSpec = parseLocalForwardSpec;
+exports.parseRemoteForwardSpec = parseRemoteForwardSpec;
+exports.validateLocalForward = validateLocalForward;
+exports.validateRemoteForward = validateRemoteForward;
+exports.parseAndValidateLocalForward = parseAndValidateLocalForward;
+exports.parseAndValidateRemoteForward = parseAndValidateRemoteForward;
+exports.describeLocalForward = describeLocalForward;
+exports.describeRemoteForward = describeRemoteForward;
+const errors_1 = require("./errors");
+const port_policy_1 = require("./port-policy");
+exports.DEFAULT_LISTEN_ADDRESS = '127.0.0.1';
+exports.DEFAULT_REMOTE_BIND_ADDRESS = 'localhost';
+const LOCAL_FORWARD_SHAPE = 'localPort:remoteHost:remotePort or bindAddress:localPort:remoteHost:remotePort';
+const REMOTE_FORWARD_SHAPE = 'bindPort:targetHost:targetPort or bindAddress:bindPort:targetHost:targetPort';
+function invalid(spec, shape, detail) {
+    const suffix = detail ? ` (${detail})` : '';
+    return new errors_1.TunnelError('INVALID_FORWARD_SPEC', `Invalid forward "${spec}"; expected ${shape}${suffix}`);
+}
+function splitSpec(spec, shape) {
+    if (typeof spec !== 'string' || spec.trim().length === 0) {
+        throw new errors_1.TunnelError('INVALID_FORWARD_SPEC', `Invalid forward ${JSON.stringify(spec)}; expected ${shape}`);
+    }
+    const fields = spec.split(':');
+    if (fields.length < 3 || fields.length > 4) {
+        throw invalid(spec, shape, `got ${fields.length} colon-separated fields`);
+    }
+    return fields;
+}
+function requirePort(spec, text, shape, label) {
+    const port = (0, port_policy_1.parsePort)(text);
+    if (port === undefined) {
+        throw invalid(spec, shape, `${label} "${text}" is not a decimal port in 1-65535`);
+    }
+    return port;
+}
+/**
+ * Parse a local-forward string into a structured {@link LocalForward}.
+ * Syntax only — call {@link validateLocalForward} to apply a {@link PortPolicy}.
+ */
+function parseLocalForwardSpec(spec) {
+    const fields = splitSpec(spec, LOCAL_FORWARD_SHAPE);
+    const [listenHost, listenPortText, targetHostText, targetPortText] = fields.length === 4
+        ? fields
+        : [exports.DEFAULT_LISTEN_ADDRESS, fields[0], fields[1], fields[2]];
+    if (listenHost.trim().length === 0) {
+        throw invalid(spec, LOCAL_FORWARD_SHAPE, 'bind address is empty');
+    }
+    if (targetHostText.trim().length === 0) {
+        throw invalid(spec, LOCAL_FORWARD_SHAPE, 'remote host is required');
+    }
+    return {
+        id: spec,
+        listen: {
+            host: listenHost,
+            port: requirePort(spec, listenPortText, LOCAL_FORWARD_SHAPE, 'local listen port'),
+        },
+        target: {
+            host: targetHostText,
+            port: requirePort(spec, targetPortText, LOCAL_FORWARD_SHAPE, 'remote target port'),
+        },
+    };
+}
+/**
+ * Parse a remote-forward string into a structured {@link RemoteForward}.
+ *
+ * Field mapping, matching v1 behaviour:
+ *   3 fields: bindPort : targetHost : targetPort, bind address defaults to
+ *             "localhost" on the peer.
+ *   4 fields: bindAddress : bindPort : targetHost : targetPort.
+ *
+ * A bind port of 0 asks the SSH peer to assign one; the assigned value is
+ * reported in ForwardStatus.assignedPort.
+ */
+function parseRemoteForwardSpec(spec) {
+    const fields = splitSpec(spec, REMOTE_FORWARD_SHAPE);
+    const [bindHost, bindPortText, targetHostText, targetPortText] = fields.length === 4
+        ? fields
+        : [exports.DEFAULT_REMOTE_BIND_ADDRESS, fields[0], fields[1], fields[2]];
+    if (bindHost.trim().length === 0) {
+        throw invalid(spec, REMOTE_FORWARD_SHAPE, 'bind address is empty');
+    }
+    if (targetHostText.trim().length === 0) {
+        throw invalid(spec, REMOTE_FORWARD_SHAPE, 'target host is required');
+    }
+    const bindPort = bindPortText === '0' ? 0 : (0, port_policy_1.parsePort)(bindPortText);
+    if (!(0, port_policy_1.isValidBindPort)(bindPort)) {
+        throw invalid(spec, REMOTE_FORWARD_SHAPE, `bind port "${bindPortText}" is not 0-65535`);
+    }
+    return {
+        id: spec,
+        bind: { host: bindHost, port: bindPort },
+        target: {
+            host: targetHostText,
+            port: requirePort(spec, targetPortText, REMOTE_FORWARD_SHAPE, 'target port'),
+        },
+    };
+}
+/**
+ * Apply a {@link PortPolicy} to a structured local forward and return a
+ * normalized copy. Throws a {@link TunnelError} on the first violation.
+ */
+function validateLocalForward(forward, policy = {}) {
+    const id = forward.id ?? describeLocalForward(forward);
+    const listenHost = forward.listen?.host ?? exports.DEFAULT_LISTEN_ADDRESS;
+    (0, port_policy_1.assertHostAllowed)(listenHost, {}, id);
+    const loopbackListen = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+    if (!loopbackListen.has(listenHost)) {
+        throw new errors_1.TunnelError('HOST_NOT_PERMITTED', `Local listen host ${listenHost} is not loopback; bind 127.0.0.1 or ::1`, { forwardId: id });
+    }
+    (0, port_policy_1.assertPortAllowed)(forward.listen?.port, 'local-listen', policy, id);
+    (0, port_policy_1.assertHostAllowed)(forward.target?.host, policy, id);
+    (0, port_policy_1.assertPortAllowed)(forward.target?.port, 'remote-target', policy, id);
+    return {
+        ...forward,
+        id,
+        listen: { host: listenHost, port: forward.listen.port },
+        target: { host: forward.target.host, port: forward.target.port },
+    };
+}
+/** Apply a {@link PortPolicy} to a structured remote forward. */
+function validateRemoteForward(forward, policy = {}) {
+    const id = forward.id ?? describeRemoteForward(forward);
+    const bindHost = forward.bind?.host ?? exports.DEFAULT_REMOTE_BIND_ADDRESS;
+    (0, port_policy_1.assertHostAllowed)(bindHost, {}, id);
+    (0, port_policy_1.assertPortAllowed)(forward.bind?.port, 'remote-bind', policy, id);
+    (0, port_policy_1.assertHostAllowed)(forward.target?.host, {}, id);
+    (0, port_policy_1.assertPortAllowed)(forward.target?.port, 'local-listen', policy, id);
+    return {
+        ...forward,
+        id,
+        bind: { host: bindHost, port: forward.bind.port },
+        target: { host: forward.target.host, port: forward.target.port },
+    };
+}
+/** Parse and validate in one step. */
+function parseAndValidateLocalForward(spec, policy = {}) {
+    return validateLocalForward(parseLocalForwardSpec(spec), policy);
+}
+/** Parse and validate in one step. */
+function parseAndValidateRemoteForward(spec, policy = {}) {
+    return validateRemoteForward(parseRemoteForwardSpec(spec), policy);
+}
+function describeLocalForward(forward) {
+    const host = forward.listen?.host ?? exports.DEFAULT_LISTEN_ADDRESS;
+    return `L:${host}:${forward.listen?.port}->${forward.target?.host}:${forward.target?.port}`;
+}
+function describeRemoteForward(forward) {
+    const host = forward.bind?.host ?? exports.DEFAULT_REMOTE_BIND_ADDRESS;
+    return `R:${host}:${forward.bind?.port}->${forward.target?.host}:${forward.target?.port}`;
+}
+//# sourceMappingURL=forward-spec.js.map

package/build/forward-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-spec.js","sourceRoot":"","sources":["../src/forward-spec.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AA8CH,sDA+BC;AAaD,wDAiCC;AAMD,oDA0BC;AAGD,sDAkBC;AAGD,oEAEC;AAGD,sEAEC;AAED,oDAGC;AAED,sDAGC;AAlMD,qCAAuC;AAEvC,+CAAiG;AAEpF,QAAA,sBAAsB,GAAG,WAAW,CAAC;AACrC,QAAA,2BAA2B,GAAG,WAAW,CAAC;AAEvD,MAAM,mBAAmB,GAAG,gFAAgF,CAAC;AAC7G,MAAM,oBAAoB,GAAG,8EAA8E,CAAC;AAE5G,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,MAAe;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,OAAO,IAAI,oBAAW,CACpB,sBAAsB,EACtB,oBAAoB,IAAI,eAAe,KAAK,GAAG,MAAM,EAAE,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,KAAa;IAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,oBAAW,CACnB,sBAAsB,EACtB,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,KAAK,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,KAAa,EAAE,KAAa;IAC3E,MAAM,IAAI,GAAG,IAAA,uBAAS,EAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,KAAK,IAAI,oCAAoC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,IAAY;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAEpD,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,CAAC,GAChE,MAAM,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,CAAE,MAA2C;QAC9C,CAAC,CAAE,CAAC,8BAAsB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAKvD,CAAC;IAET,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;SAClF;QACD,MAAM,EAAE;YACN,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,CAAC;SACnF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,sBAAsB,CAAC,IAAY;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAErD,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,CAAC,GAC5D,MAAM,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,CAAE,MAA2C;QAC9C,CAAC,CAAE,CAAC,mCAA2B,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAK5D,CAAC;IAET,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,uBAAS,EAAC,YAAY,CAAC,CAAC;IACpE,IAAI,CAAC,IAAA,6BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,cAAc,YAAY,kBAAkB,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAkB,EAAE;QAClD,MAAM,EAAE;YACN,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,oBAAoB,EAAE,aAAa,CAAC;SAC7E;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,OAAqB,EACrB,SAAqB,EAAE;IAEvB,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,8BAAsB,CAAC;IAElE,IAAA,+BAAiB,EAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,oBAAW,CACnB,oBAAoB,EACpB,qBAAqB,UAAU,yCAAyC,EACxE,EAAE,SAAS,EAAE,EAAE,EAAE,CAClB,CAAC;IACJ,CAAC;IACD,IAAA,+BAAiB,EAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACpE,IAAA,+BAAiB,EAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACpD,IAAA,+BAAiB,EAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAErE,OAAO;QACL,GAAG,OAAO;QACV,EAAE;QACF,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAgB,qBAAqB,CACnC,OAAsB,EACtB,SAAqB,EAAE;IAEvB,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,mCAA2B,CAAC;IAEnE,IAAA,+BAAiB,EAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACpC,IAAA,+BAAiB,EAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,IAAA,+BAAiB,EAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,IAAA,+BAAiB,EAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAEpE,OAAO;QACL,GAAG,OAAO;QACV,EAAE;QACF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;QACjD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,sCAAsC;AACtC,SAAgB,4BAA4B,CAAC,IAAY,EAAE,SAAqB,EAAE;IAChF,OAAO,oBAAoB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,sCAAsC;AACtC,SAAgB,6BAA6B,CAAC,IAAY,EAAE,SAAqB,EAAE;IACjF,OAAO,qBAAqB,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAqB;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,8BAAsB,CAAC;IAC5D,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9F,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,mCAA2B,CAAC;IAC/D,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC"}

package/build/index.d.ts

@@ -0,0 +1,19 @@
+export { SSHTunnel } from './tunnel';
+export type { SSHTunnelOptions, TunnelEvents } from './tunnel';
+export { LocalForwardHandle } from './local-forward';
+export { RemoteForwardHandle } from './remote-forward';
+export { ProxiedConnection } from './connection';
+export type { ProxiedConnectionOptions } from './connection';
+export type { TransportBridge } from './bridge';
+export { TUNNEL_ERROR_CODES, TunnelError, isTunnelError, asTunnelError } from './errors';
+export type { TunnelErrorCode, TunnelErrorDetails } from './errors';
+export { DEFAULT_LISTEN_ADDRESS, DEFAULT_REMOTE_BIND_ADDRESS, describeLocalForward, describeRemoteForward, parseAndValidateLocalForward, parseAndValidateRemoteForward, parseLocalForwardSpec, parseRemoteForwardSpec, validateLocalForward, validateRemoteForward, } from './forward-spec';
+export { FIRST_UNPRIVILEGED_PORT, MAX_PORT, MIN_PORT, assertHostAllowed, assertPortAllowed, checkPort, isValidBindPort, isValidHost, isValidPort, parsePort, } from './port-policy';
+export type { PortCheckResult, PortRole } from './port-policy';
+export { credential, expandHome, resolveAgentSocket, resolveCredential } from './credentials';
+export type { CredentialResolver, ResolveOptions } from './credentials';
+export { CONNECTION_STATES, CREDENTIAL_SOURCES, FORWARD_DIRECTIONS, FORWARD_STATES, REACHABILITY_VALUES, TUNNEL_STATES, DEFAULT_KEEPALIVE_COUNT_MAX, DEFAULT_KEEPALIVE_INTERVAL_MS, DEFAULT_READY_TIMEOUT_MS, DEFAULT_RECONNECT_POLICY, MODEL_VERSION, } from './model';
+export type { ConnectionState, ConnectionStatus, CredentialRef, CredentialSource, Endpoint, ForwardDirection, ForwardState, ForwardStatus, LocalForward, PortPolicy, Reachability, ReconnectPolicy, RemoteForward, SshTransport, TunnelConfig, TunnelState, TunnelStatus, } from './model';
+export { SSHTunnelProxy, legacyConfigToTunnelConfig, whitelistToPortPolicy, } from './legacy';
+export type { LegacySSHConfig } from './legacy';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEpE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,uBAAuB,EACvB,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC9F,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,2BAA2B,EAC3B,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,eAAe,EACf,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}

package/build/index.js

@@ -0,0 +1,71 @@
+"use strict";
+/*
+ * ssh_tunnel_proxy v2
+ *
+ * Programmatic local and reverse TCP port forwarding over SSH for Node.js,
+ * built for services and devices that only have an outbound SSH transport.
+ *
+ * Author: Autonomous
+ * First release: 1-29-2023
+ * License: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.whitelistToPortPolicy = exports.legacyConfigToTunnelConfig = exports.SSHTunnelProxy = exports.MODEL_VERSION = exports.DEFAULT_RECONNECT_POLICY = exports.DEFAULT_READY_TIMEOUT_MS = exports.DEFAULT_KEEPALIVE_INTERVAL_MS = exports.DEFAULT_KEEPALIVE_COUNT_MAX = exports.TUNNEL_STATES = exports.REACHABILITY_VALUES = exports.FORWARD_STATES = exports.FORWARD_DIRECTIONS = exports.CREDENTIAL_SOURCES = exports.CONNECTION_STATES = exports.resolveCredential = exports.resolveAgentSocket = exports.expandHome = exports.credential = exports.parsePort = exports.isValidPort = exports.isValidHost = exports.isValidBindPort = exports.checkPort = exports.assertPortAllowed = exports.assertHostAllowed = exports.MIN_PORT = exports.MAX_PORT = exports.FIRST_UNPRIVILEGED_PORT = exports.validateRemoteForward = exports.validateLocalForward = exports.parseRemoteForwardSpec = exports.parseLocalForwardSpec = exports.parseAndValidateRemoteForward = exports.parseAndValidateLocalForward = exports.describeRemoteForward = exports.describeLocalForward = exports.DEFAULT_REMOTE_BIND_ADDRESS = exports.DEFAULT_LISTEN_ADDRESS = exports.asTunnelError = exports.isTunnelError = exports.TunnelError = exports.TUNNEL_ERROR_CODES = exports.ProxiedConnection = exports.RemoteForwardHandle = exports.LocalForwardHandle = exports.SSHTunnel = void 0;
+var tunnel_1 = require("./tunnel");
+Object.defineProperty(exports, "SSHTunnel", { enumerable: true, get: function () { return tunnel_1.SSHTunnel; } });
+var local_forward_1 = require("./local-forward");
+Object.defineProperty(exports, "LocalForwardHandle", { enumerable: true, get: function () { return local_forward_1.LocalForwardHandle; } });
+var remote_forward_1 = require("./remote-forward");
+Object.defineProperty(exports, "RemoteForwardHandle", { enumerable: true, get: function () { return remote_forward_1.RemoteForwardHandle; } });
+var connection_1 = require("./connection");
+Object.defineProperty(exports, "ProxiedConnection", { enumerable: true, get: function () { return connection_1.ProxiedConnection; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "TUNNEL_ERROR_CODES", { enumerable: true, get: function () { return errors_1.TUNNEL_ERROR_CODES; } });
+Object.defineProperty(exports, "TunnelError", { enumerable: true, get: function () { return errors_1.TunnelError; } });
+Object.defineProperty(exports, "isTunnelError", { enumerable: true, get: function () { return errors_1.isTunnelError; } });
+Object.defineProperty(exports, "asTunnelError", { enumerable: true, get: function () { return errors_1.asTunnelError; } });
+var forward_spec_1 = require("./forward-spec");
+Object.defineProperty(exports, "DEFAULT_LISTEN_ADDRESS", { enumerable: true, get: function () { return forward_spec_1.DEFAULT_LISTEN_ADDRESS; } });
+Object.defineProperty(exports, "DEFAULT_REMOTE_BIND_ADDRESS", { enumerable: true, get: function () { return forward_spec_1.DEFAULT_REMOTE_BIND_ADDRESS; } });
+Object.defineProperty(exports, "describeLocalForward", { enumerable: true, get: function () { return forward_spec_1.describeLocalForward; } });
+Object.defineProperty(exports, "describeRemoteForward", { enumerable: true, get: function () { return forward_spec_1.describeRemoteForward; } });
+Object.defineProperty(exports, "parseAndValidateLocalForward", { enumerable: true, get: function () { return forward_spec_1.parseAndValidateLocalForward; } });
+Object.defineProperty(exports, "parseAndValidateRemoteForward", { enumerable: true, get: function () { return forward_spec_1.parseAndValidateRemoteForward; } });
+Object.defineProperty(exports, "parseLocalForwardSpec", { enumerable: true, get: function () { return forward_spec_1.parseLocalForwardSpec; } });
+Object.defineProperty(exports, "parseRemoteForwardSpec", { enumerable: true, get: function () { return forward_spec_1.parseRemoteForwardSpec; } });
+Object.defineProperty(exports, "validateLocalForward", { enumerable: true, get: function () { return forward_spec_1.validateLocalForward; } });
+Object.defineProperty(exports, "validateRemoteForward", { enumerable: true, get: function () { return forward_spec_1.validateRemoteForward; } });
+var port_policy_1 = require("./port-policy");
+Object.defineProperty(exports, "FIRST_UNPRIVILEGED_PORT", { enumerable: true, get: function () { return port_policy_1.FIRST_UNPRIVILEGED_PORT; } });
+Object.defineProperty(exports, "MAX_PORT", { enumerable: true, get: function () { return port_policy_1.MAX_PORT; } });
+Object.defineProperty(exports, "MIN_PORT", { enumerable: true, get: function () { return port_policy_1.MIN_PORT; } });
+Object.defineProperty(exports, "assertHostAllowed", { enumerable: true, get: function () { return port_policy_1.assertHostAllowed; } });
+Object.defineProperty(exports, "assertPortAllowed", { enumerable: true, get: function () { return port_policy_1.assertPortAllowed; } });
+Object.defineProperty(exports, "checkPort", { enumerable: true, get: function () { return port_policy_1.checkPort; } });
+Object.defineProperty(exports, "isValidBindPort", { enumerable: true, get: function () { return port_policy_1.isValidBindPort; } });
+Object.defineProperty(exports, "isValidHost", { enumerable: true, get: function () { return port_policy_1.isValidHost; } });
+Object.defineProperty(exports, "isValidPort", { enumerable: true, get: function () { return port_policy_1.isValidPort; } });
+Object.defineProperty(exports, "parsePort", { enumerable: true, get: function () { return port_policy_1.parsePort; } });
+var credentials_1 = require("./credentials");
+Object.defineProperty(exports, "credential", { enumerable: true, get: function () { return credentials_1.credential; } });
+Object.defineProperty(exports, "expandHome", { enumerable: true, get: function () { return credentials_1.expandHome; } });
+Object.defineProperty(exports, "resolveAgentSocket", { enumerable: true, get: function () { return credentials_1.resolveAgentSocket; } });
+Object.defineProperty(exports, "resolveCredential", { enumerable: true, get: function () { return credentials_1.resolveCredential; } });
+var model_1 = require("./model");
+Object.defineProperty(exports, "CONNECTION_STATES", { enumerable: true, get: function () { return model_1.CONNECTION_STATES; } });
+Object.defineProperty(exports, "CREDENTIAL_SOURCES", { enumerable: true, get: function () { return model_1.CREDENTIAL_SOURCES; } });
+Object.defineProperty(exports, "FORWARD_DIRECTIONS", { enumerable: true, get: function () { return model_1.FORWARD_DIRECTIONS; } });
+Object.defineProperty(exports, "FORWARD_STATES", { enumerable: true, get: function () { return model_1.FORWARD_STATES; } });
+Object.defineProperty(exports, "REACHABILITY_VALUES", { enumerable: true, get: function () { return model_1.REACHABILITY_VALUES; } });
+Object.defineProperty(exports, "TUNNEL_STATES", { enumerable: true, get: function () { return model_1.TUNNEL_STATES; } });
+Object.defineProperty(exports, "DEFAULT_KEEPALIVE_COUNT_MAX", { enumerable: true, get: function () { return model_1.DEFAULT_KEEPALIVE_COUNT_MAX; } });
+Object.defineProperty(exports, "DEFAULT_KEEPALIVE_INTERVAL_MS", { enumerable: true, get: function () { return model_1.DEFAULT_KEEPALIVE_INTERVAL_MS; } });
+Object.defineProperty(exports, "DEFAULT_READY_TIMEOUT_MS", { enumerable: true, get: function () { return model_1.DEFAULT_READY_TIMEOUT_MS; } });
+Object.defineProperty(exports, "DEFAULT_RECONNECT_POLICY", { enumerable: true, get: function () { return model_1.DEFAULT_RECONNECT_POLICY; } });
+Object.defineProperty(exports, "MODEL_VERSION", { enumerable: true, get: function () { return model_1.MODEL_VERSION; } });
+// v1 compatibility. New code should use SSHTunnel.
+var legacy_1 = require("./legacy");
+Object.defineProperty(exports, "SSHTunnelProxy", { enumerable: true, get: function () { return legacy_1.SSHTunnelProxy; } });
+Object.defineProperty(exports, "legacyConfigToTunnelConfig", { enumerable: true, get: function () { return legacy_1.legacyConfigToTunnelConfig; } });
+Object.defineProperty(exports, "whitelistToPortPolicy", { enumerable: true, get: function () { return legacy_1.whitelistToPortPolicy; } });
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,mCAAqC;AAA5B,mGAAA,SAAS,OAAA;AAGlB,iDAAqD;AAA5C,mHAAA,kBAAkB,OAAA;AAC3B,mDAAuD;AAA9C,qHAAA,mBAAmB,OAAA;AAC5B,2CAAiD;AAAxC,+GAAA,iBAAiB,OAAA;AAI1B,mCAAyF;AAAhF,4GAAA,kBAAkB,OAAA;AAAE,qGAAA,WAAW,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,uGAAA,aAAa,OAAA;AAGtE,+CAWwB;AAVtB,sHAAA,sBAAsB,OAAA;AACtB,2HAAA,2BAA2B,OAAA;AAC3B,oHAAA,oBAAoB,OAAA;AACpB,qHAAA,qBAAqB,OAAA;AACrB,4HAAA,4BAA4B,OAAA;AAC5B,6HAAA,6BAA6B,OAAA;AAC7B,qHAAA,qBAAqB,OAAA;AACrB,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,qHAAA,qBAAqB,OAAA;AAGvB,6CAWuB;AAVrB,sHAAA,uBAAuB,OAAA;AACvB,uGAAA,QAAQ,OAAA;AACR,uGAAA,QAAQ,OAAA;AACR,gHAAA,iBAAiB,OAAA;AACjB,gHAAA,iBAAiB,OAAA;AACjB,wGAAA,SAAS,OAAA;AACT,8GAAA,eAAe,OAAA;AACf,0GAAA,WAAW,OAAA;AACX,0GAAA,WAAW,OAAA;AACX,wGAAA,SAAS,OAAA;AAIX,6CAA8F;AAArF,yGAAA,UAAU,OAAA;AAAE,yGAAA,UAAU,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAAE,gHAAA,iBAAiB,OAAA;AAGtE,iCAYiB;AAXf,0GAAA,iBAAiB,OAAA;AACjB,2GAAA,kBAAkB,OAAA;AAClB,2GAAA,kBAAkB,OAAA;AAClB,uGAAA,cAAc,OAAA;AACd,4GAAA,mBAAmB,OAAA;AACnB,sGAAA,aAAa,OAAA;AACb,oHAAA,2BAA2B,OAAA;AAC3B,sHAAA,6BAA6B,OAAA;AAC7B,iHAAA,wBAAwB,OAAA;AACxB,iHAAA,wBAAwB,OAAA;AACxB,sGAAA,aAAa,OAAA;AAsBf,mDAAmD;AACnD,mCAIkB;AAHhB,wGAAA,cAAc,OAAA;AACd,oHAAA,0BAA0B,OAAA;AAC1B,+GAAA,qBAAqB,OAAA"}

package/build/legacy.d.ts

@@ -0,0 +1,70 @@
+import { EventEmitter } from 'node:events';
+import type { Writable } from 'node:stream';
+import type { Client } from 'ssh2';
+import type { ForwardStatus, PortPolicy, TunnelConfig, TunnelStatus } from './model';
+import { SSHTunnel } from './tunnel';
+/** The v1 configuration object, minus the options that v2 removed. */
+export interface LegacySSHConfig {
+    hostname?: string;
+    username: string;
+    password?: string;
+    host?: string;
+    port?: string | number;
+    proxy_ports?: string[];
+    remote_ports?: string[];
+    private_key?: string | null;
+    private_key_filename?: string | null;
+    whitelist?: Record<string, unknown> | null;
+    keepaliveInterval?: number;
+    server_name?: string;
+    disabled?: boolean;
+    /** Commands to run once the tunnel is up, as in v1. */
+    exec?: string[];
+    ngrok_api?: string;
+    service_name?: string;
+    shell?: boolean;
+}
+export declare function whitelistToPortPolicy(whitelist?: Record<string, unknown> | null): PortPolicy;
+/** Translate a v1 config into a v2 {@link TunnelConfig}. */
+export declare function legacyConfigToTunnelConfig(opts: LegacySSHConfig, whitelist?: Record<string, unknown> | null): TunnelConfig;
+/**
+ * Drop-in replacement for the v1 class, implemented on top of {@link SSHTunnel}.
+ *
+ * New code should use SSHTunnel directly: it exposes forward ids, per-connection
+ * state, atomic multi-forward setup, and typed lifecycle events, none of which
+ * the v1 method names can express.
+ */
+export declare class SSHTunnelProxy extends EventEmitter {
+    debug_en: boolean;
+    debug_ssh: boolean;
+    private tunnel?;
+    /** Kept for source compatibility; port policy is now explicit. */
+    validate_port_number(port: number, whitelist?: Record<string, unknown> | null): boolean;
+    /** Kept for source compatibility; throws a TunnelError on the first bad spec. */
+    validate_local_forward(proxy_ports?: string[] | null, whitelist?: Record<string, unknown> | null): boolean;
+    private announcedReady;
+    connectSSH(opts: LegacySSHConfig, whitelist?: Record<string, unknown> | null): Promise<void>;
+    /**
+     * v1 returned nothing here. v2 returns the resulting forward statuses, which is
+     * a superset: existing callers that ignore the return value are unaffected, and
+     * new code can read back the port a `0` bind was actually given.
+     */
+    setupProxyPorts(proxy_ports: string[]): Promise<ForwardStatus[]>;
+    setupRemotePorts(remote_ports: string[]): Promise<ForwardStatus[]>;
+    /**
+     * Like v1: with no streams supplied the output goes to this process's stdout and
+     * stderr. Unlike v1, the collected stdout is also returned.
+     */
+    execCmd(cmd: string, dataStream?: Writable, errStream?: Writable): Promise<string>;
+    getStatus(): TunnelStatus;
+    /** Escape hatch for code that reached into the ssh2 client directly. */
+    getClient(): Client;
+    /** The v2 tunnel behind this shim, for incremental migration. */
+    getTunnel(): SSHTunnel;
+    close(): Promise<void>;
+    /** v1 no-ops retained so existing Electron wiring keeps compiling. */
+    onNetworkOnline(): void;
+    onNetworkOffline(): void;
+    private requireTunnel;
+}
+//# sourceMappingURL=legacy.d.ts.map

package/build/legacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy.d.ts","sourceRoot":"","sources":["../src/legacy.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAKnC,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAErF,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAGhB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAQD,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,UAAU,CAM5F;AAED,4DAA4D;AAC5D,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,eAAe,EACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GACzC,YAAY,CA4Cd;AAED;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,YAAY;IACvC,QAAQ,UAAS;IACjB,SAAS,UAAS;IAEzB,OAAO,CAAC,MAAM,CAAC,CAAY;IAE3B,kEAAkE;IAC3D,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,OAAO;IAI9F,iFAAiF;IAC1E,sBAAsB,CAC3B,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GACzC,OAAO;IASV,OAAO,CAAC,cAAc,CAAS;IAElB,UAAU,CACrB,IAAI,EAAE,eAAe,EACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GACzC,OAAO,CAAC,IAAI,CAAC;IAqChB;;;;OAIG;IACU,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAIhE,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAI/E;;;OAGG;IACU,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxF,SAAS,IAAI,YAAY;IAIhC,wEAAwE;IACjE,SAAS,IAAI,MAAM;IAU1B,iEAAiE;IAC1D,SAAS,IAAI,SAAS;IAIhB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC,sEAAsE;IAC/D,eAAe,IAAI,IAAI;IACvB,gBAAgB,IAAI,IAAI;IAE/B,OAAO,CAAC,aAAa;CAMtB"}

package/build/legacy.js

@@ -0,0 +1,188 @@
+"use strict";
+/*
+ * legacy.ts — v1 compatibility surface.
+ *
+ * Existing callers keep `proxy_ports` / `remote_ports` string arrays, the
+ * `whitelist` object, and the `ssh_tunnel_ready` / `status` events. Everything is
+ * translated into the v2 model and executed by SSHTunnel.
+ *
+ * Options that were removed rather than renamed throw immediately with a pointer
+ * to MIGRATION.md, so nobody silently loses key management or ngrok resolution.
+ *
+ * License: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SSHTunnelProxy = void 0;
+exports.whitelistToPortPolicy = whitelistToPortPolicy;
+exports.legacyConfigToTunnelConfig = legacyConfigToTunnelConfig;
+const node_events_1 = require("node:events");
+const credentials_1 = require("./credentials");
+const errors_1 = require("./errors");
+const forward_spec_1 = require("./forward-spec");
+const port_policy_1 = require("./port-policy");
+const tunnel_1 = require("./tunnel");
+const REMOVED_OPTIONS = [
+    ['ngrok_api', 'ngrok resolution was removed; point transport.endpoint at an existing SSH listener'],
+    ['service_name', 'system-keychain key storage was removed; use transport.privateKey with a file/env/callback ref'],
+    ['shell', 'interactive shell support was removed; use a terminal client'],
+];
+function whitelistToPortPolicy(whitelist) {
+    if (!whitelist)
+        return {};
+    const ports = Object.keys(whitelist)
+        .map((key) => Number(key))
+        .filter((port) => Number.isInteger(port) && port > 0 && port < 1024);
+    return ports.length > 0 ? { allowedPrivilegedPorts: ports } : {};
+}
+/** Translate a v1 config into a v2 {@link TunnelConfig}. */
+function legacyConfigToTunnelConfig(opts, whitelist) {
+    for (const [key, advice] of REMOVED_OPTIONS) {
+        if (opts[key] !== undefined && opts[key] !== null && opts[key] !== false) {
+            throw new errors_1.TunnelError('INVALID_FORWARD_SPEC', `Option "${String(key)}" is no longer supported in ssh_tunnel_proxy v2: ${advice}. See MIGRATION.md.`);
+        }
+    }
+    const host = opts.host ?? opts.hostname;
+    if (!host) {
+        throw new errors_1.TunnelError('INVALID_FORWARD_SPEC', 'A host (or hostname) is required');
+    }
+    const port = Number(opts.port ?? 22);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new errors_1.TunnelError('INVALID_FORWARD_SPEC', `Invalid SSH port: ${String(opts.port)}`);
+    }
+    const config = {
+        id: opts.server_name ?? `${host}:${port}`,
+        transport: {
+            endpoint: { host, port },
+            username: opts.username,
+            keepaliveIntervalMs: opts.keepaliveInterval,
+        },
+        portPolicy: whitelistToPortPolicy(whitelist ?? opts.whitelist),
+    };
+    // proxy_ports / remote_ports stay as spec strings and are handed to
+    // SSHTunnel.addLocalForwards / addRemoteForwards after connect, so the v1
+    // string syntax has exactly one parser.
+    if (opts.private_key_filename) {
+        config.transport.privateKey = credentials_1.credential.file(opts.private_key_filename);
+    }
+    else if (opts.private_key) {
+        config.transport.privateKey = credentials_1.credential.inline(opts.private_key);
+    }
+    if (opts.password && opts.password.length > 0) {
+        config.transport.password = credentials_1.credential.inline(opts.password);
+    }
+    return config;
+}
+/**
+ * Drop-in replacement for the v1 class, implemented on top of {@link SSHTunnel}.
+ *
+ * New code should use SSHTunnel directly: it exposes forward ids, per-connection
+ * state, atomic multi-forward setup, and typed lifecycle events, none of which
+ * the v1 method names can express.
+ */
+class SSHTunnelProxy extends node_events_1.EventEmitter {
+    debug_en = false;
+    debug_ssh = false;
+    tunnel;
+    /** Kept for source compatibility; port policy is now explicit. */
+    validate_port_number(port, whitelist) {
+        return (0, port_policy_1.checkPort)(port, 'remote-target', whitelistToPortPolicy(whitelist)).allowed;
+    }
+    /** Kept for source compatibility; throws a TunnelError on the first bad spec. */
+    validate_local_forward(proxy_ports, whitelist) {
+        if (!proxy_ports)
+            return true;
+        const policy = whitelistToPortPolicy(whitelist);
+        for (const spec of proxy_ports) {
+            (0, forward_spec_1.parseAndValidateLocalForward)(spec, policy);
+        }
+        return true;
+    }
+    announcedReady = false;
+    async connectSSH(opts, whitelist) {
+        const config = legacyConfigToTunnelConfig(opts, whitelist);
+        const tunnel = new tunnel_1.SSHTunnel(config, { debugSsh: this.debug_ssh });
+        this.tunnel = tunnel;
+        tunnel.on('debug', (message, ...args) => {
+            if (this.debug_en)
+                console.log(message, ...args);
+            this.emit('debug', message, ...args);
+        });
+        tunnel.on('error', (error) => this.emit('error', error));
+        tunnel.on('ready', (status) => {
+            this.emit('status', '', 'ready', `${status.endpoint.host}:${status.endpoint.port}`);
+            // v1 signalled readiness once the forwards were usable. On the first connect
+            // that happens below, after the ports are set up; on a reconnect the forwards
+            // are re-established before `ready`, so signal again here.
+            if (this.announcedReady)
+                this.emit('ssh_tunnel_ready', {});
+        });
+        tunnel.on('close', () => this.emit('status', '', 'closed', ''));
+        await tunnel.connect();
+        if (opts.proxy_ports && opts.proxy_ports.length > 0) {
+            await tunnel.addLocalForwards(opts.proxy_ports);
+        }
+        if (opts.remote_ports && opts.remote_ports.length > 0) {
+            await tunnel.addRemoteForwards(opts.remote_ports);
+        }
+        this.announcedReady = true;
+        this.emit('ssh_tunnel_ready', {});
+        // v1 ran `opts.exec` commands once the tunnel was up.
+        for (const cmd of opts.exec ?? []) {
+            await this.execCmd(cmd);
+        }
+    }
+    /**
+     * v1 returned nothing here. v2 returns the resulting forward statuses, which is
+     * a superset: existing callers that ignore the return value are unaffected, and
+     * new code can read back the port a `0` bind was actually given.
+     */
+    async setupProxyPorts(proxy_ports) {
+        return this.requireTunnel().addLocalForwards(proxy_ports);
+    }
+    async setupRemotePorts(remote_ports) {
+        return this.requireTunnel().addRemoteForwards(remote_ports);
+    }
+    /**
+     * Like v1: with no streams supplied the output goes to this process's stdout and
+     * stderr. Unlike v1, the collected stdout is also returned.
+     */
+    async execCmd(cmd, dataStream, errStream) {
+        const result = await this.requireTunnel().exec(cmd, {
+            stdout: dataStream ?? process.stdout,
+            stderr: errStream ?? process.stderr,
+        });
+        return result.stdout;
+    }
+    getStatus() {
+        return this.requireTunnel().getStatus();
+    }
+    /** Escape hatch for code that reached into the ssh2 client directly. */
+    getClient() {
+        const tunnel = this.requireTunnel();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const client = tunnel.client;
+        if (!client) {
+            throw new errors_1.TunnelError('TRANSPORT_NOT_READY', 'No SSH client; call connectSSH first');
+        }
+        return client;
+    }
+    /** The v2 tunnel behind this shim, for incremental migration. */
+    getTunnel() {
+        return this.requireTunnel();
+    }
+    async close() {
+        if (this.tunnel)
+            await this.tunnel.close();
+    }
+    /** v1 no-ops retained so existing Electron wiring keeps compiling. */
+    onNetworkOnline() { }
+    onNetworkOffline() { }
+    requireTunnel() {
+        if (!this.tunnel) {
+            throw new errors_1.TunnelError('TRANSPORT_NOT_READY', 'Call connectSSH before using the tunnel');
+        }
+        return this.tunnel;
+    }
+}
+exports.SSHTunnelProxy = SSHTunnelProxy;
+//# sourceMappingURL=legacy.js.map

package/build/legacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy.js","sourceRoot":"","sources":["../src/legacy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AA4CH,sDAMC;AAGD,gEA+CC;AAlGD,6CAA2C;AAI3C,+CAA2C;AAC3C,qCAAuC;AACvC,iDAA8D;AAE9D,+CAA0C;AAC1C,qCAAqC;AA2BrC,MAAM,eAAe,GAA2C;IAC9D,CAAC,WAAW,EAAE,oFAAoF,CAAC;IACnG,CAAC,cAAc,EAAE,gGAAgG,CAAC;IAClH,CAAC,OAAO,EAAE,8DAA8D,CAAC;CAC1E,CAAC;AAEF,SAAgB,qBAAqB,CAAC,SAA0C;IAC9E,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;SACjC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,4DAA4D;AAC5D,SAAgB,0BAA0B,CACxC,IAAqB,EACrB,SAA0C;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YACzE,MAAM,IAAI,oBAAW,CACnB,sBAAsB,EACtB,WAAW,MAAM,CAAC,GAAG,CAAC,oDAAoD,MAAM,qBAAqB,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,oBAAW,CAAC,sBAAsB,EAAE,kCAAkC,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAW,CAAC,sBAAsB,EAAE,qBAAqB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,MAAM,GAAiB;QAC3B,EAAE,EAAE,IAAI,CAAC,WAAW,IAAI,GAAG,IAAI,IAAI,IAAI,EAAE;QACzC,SAAS,EAAE;YACT,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;SAC5C;QACD,UAAU,EAAE,qBAAqB,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;KAC/D,CAAC;IAEF,oEAAoE;IACpE,0EAA0E;IAC1E,wCAAwC;IAExC,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,MAAM,CAAC,SAAS,CAAC,UAAU,GAAG,wBAAU,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC3E,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,UAAU,GAAG,wBAAU,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,QAAQ,GAAG,wBAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAa,cAAe,SAAQ,0BAAY;IACvC,QAAQ,GAAG,KAAK,CAAC;IACjB,SAAS,GAAG,KAAK,CAAC;IAEjB,MAAM,CAAa;IAE3B,kEAAkE;IAC3D,oBAAoB,CAAC,IAAY,EAAE,SAA0C;QAClF,OAAO,IAAA,uBAAS,EAAC,IAAI,EAAE,eAAe,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACpF,CAAC;IAED,iFAAiF;IAC1E,sBAAsB,CAC3B,WAA6B,EAC7B,SAA0C;QAE1C,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAA,2CAA4B,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,GAAG,KAAK,CAAC;IAExB,KAAK,CAAC,UAAU,CACrB,IAAqB,EACrB,SAA0C;QAE1C,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YACtC,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAoB,EAAE,EAAE;YAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACpF,6EAA6E;YAC7E,8EAA8E;YAC9E,2DAA2D;YAC3D,IAAI,IAAI,CAAC,cAAc;gBAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAEhE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAEvB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAElC,sDAAsD;QACtD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,eAAe,CAAC,WAAqB;QAChD,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,YAAsB;QAClD,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,UAAqB,EAAE,SAAoB;QAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,UAAU,IAAI,OAAO,CAAC,MAAM;YACpC,MAAM,EAAE,SAAS,IAAI,OAAO,CAAC,MAAM;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,CAAC;IAC1C,CAAC;IAED,wEAAwE;IACjE,SAAS;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,8DAA8D;QAC9D,MAAM,MAAM,GAAI,MAAc,CAAC,MAA4B,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,oBAAW,CAAC,qBAAqB,EAAE,sCAAsC,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iEAAiE;IAC1D,SAAS;QACd,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,sEAAsE;IAC/D,eAAe,KAAU,CAAC;IAC1B,gBAAgB,KAAU,CAAC;IAE1B,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,oBAAW,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AA7HD,wCA6HC"}

package/build/local-forward.d.ts

@@ -0,0 +1,31 @@
+import type { TransportBridge } from './bridge';
+import type { ForwardState, ForwardStatus, LocalForward } from './model';
+export declare class LocalForwardHandle {
+    readonly forwardId: string;
+    readonly spec: LocalForward;
+    private state;
+    private server?;
+    private lastError?;
+    private totalConnections;
+    private readonly connections;
+    private readonly bridge;
+    private readonly idleTimeoutMs;
+    constructor(spec: LocalForward, bridge: TransportBridge, idleTimeoutMs?: number);
+    getState(): ForwardState;
+    getStatus(): ForwardStatus;
+    listConnections(): import("./model").ConnectionStatus[];
+    /** Bind the local listener. Resolves once the port is actually listening. */
+    open(): Promise<ForwardStatus>;
+    /**
+     * Mark the forward as degraded: the listener stays bound so callers do not see
+     * connection-refused during a reconnect, but new connections fail fast until
+     * the transport returns.
+     */
+    markDegraded(reason: string): void;
+    markActive(): void;
+    close(): Promise<ForwardStatus>;
+    private closeConnections;
+    private handleSocket;
+    private transition;
+}
+//# sourceMappingURL=local-forward.d.ts.map

package/build/local-forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-forward.d.ts","sourceRoot":"","sources":["../src/local-forward.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAIhD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzE,qBAAa,kBAAkB;IAC7B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,IAAI,EAAE,YAAY,CAAC;IAEnC,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwC;IACpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,SAAI;IAOnE,QAAQ,IAAI,YAAY;IAIxB,SAAS,IAAI,aAAa;IAc1B,eAAe;IAItB,6EAA6E;IAChE,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IAkE3C;;;;OAIG;IACI,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOlC,UAAU,IAAI,IAAI;IAOZ,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC;IAmB5C,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,YAAY;IA+GpB,OAAO,CAAC,UAAU;CAMnB"}