ssh_tunnel_proxy 2.1.1 → 3.0.0

package/build/remote-forward.d.ts

@@ -0,0 +1,40 @@
+import type { ClientChannel } from 'ssh2';
+import type { TransportBridge } from './bridge';
+import type { ForwardState, ForwardStatus, RemoteForward } from './model';
+export declare class RemoteForwardHandle {
+    readonly forwardId: string;
+    readonly spec: RemoteForward;
+    private state;
+    private assignedPort?;
+    private lastError?;
+    private totalConnections;
+    private readonly connections;
+    private readonly bridge;
+    private readonly idleTimeoutMs;
+    private readonly connectTimeoutMs;
+    constructor(spec: RemoteForward, bridge: TransportBridge, idleTimeoutMs?: number, connectTimeoutMs?: number);
+    getState(): ForwardState;
+    /** The port the peer actually bound; differs from the request when 0 was asked. */
+    getBoundPort(): number;
+    getStatus(): ForwardStatus;
+    listConnections(): import("./model").ConnectionStatus[];
+    /** True when an inbound `tcp connection` event belongs to this forward. */
+    matches(destIP: string, destPort: number): boolean;
+    /** Ask the peer to bind the listener. Resolves with the bound port. */
+    open(): Promise<ForwardStatus>;
+    /**
+     * Handle an inbound channel from the peer by dialling the target with a fresh
+     * socket. Returns false if the channel was rejected.
+     */
+    acceptChannel(accept: () => ClientChannel, reject: () => void, source: {
+        host: string;
+        port: number;
+    }): boolean;
+    markDegraded(reason: string): void;
+    markActive(): void;
+    /** Unbind on the peer. Tolerates a transport that has already gone away. */
+    close(): Promise<ForwardStatus>;
+    private closeConnections;
+    private transition;
+}
+//# sourceMappingURL=remote-forward.d.ts.map

package/build/remote-forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-forward.d.ts","sourceRoot":"","sources":["../src/remote-forward.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAIhD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1E,qBAAa,mBAAmB;IAC9B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,IAAI,EAAE,aAAa,CAAC;IAEpC,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwC;IACpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAGxC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,eAAe,EACvB,aAAa,SAAI,EACjB,gBAAgB,SAAQ;IASnB,QAAQ,IAAI,YAAY;IAI/B,mFAAmF;IAC5E,YAAY,IAAI,MAAM;IAItB,SAAS,IAAI,aAAa;IAc1B,eAAe;IAItB,2EAA2E;IACpE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAYzD,uEAAuE;IAC1D,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IAoC3C;;;OAGG;IACI,aAAa,CAClB,MAAM,EAAE,MAAM,aAAa,EAC3B,MAAM,EAAE,MAAM,IAAI,EAClB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO;IAqGH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOlC,UAAU,IAAI,IAAI;IAOzB,4EAA4E;IAC/D,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC;IAqB5C,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,UAAU;CAMnB"}

package/build/remote-forward.js

@@ -0,0 +1,226 @@
+"use strict";
+/*
+ * remote-forward.ts — ssh -R, as a first-class object.
+ *
+ * The important correctness fix relative to v1: a fresh outbound TCP socket is
+ * created for every inbound channel. v1 created one socket per registration and
+ * reused it for every connection, so a second concurrent connection interleaved
+ * bytes into the same stream. All channels still share one SSH transport.
+ *
+ * License: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteForwardHandle = void 0;
+const node_net_1 = require("node:net");
+const connection_1 = require("./connection");
+const errors_1 = require("./errors");
+const forward_spec_1 = require("./forward-spec");
+class RemoteForwardHandle {
+    forwardId;
+    spec;
+    state = 'pending';
+    assignedPort;
+    lastError;
+    totalConnections = 0;
+    connections = new Map();
+    bridge;
+    idleTimeoutMs;
+    connectTimeoutMs;
+    constructor(spec, bridge, idleTimeoutMs = 0, connectTimeoutMs = 10000) {
+        this.spec = spec;
+        this.forwardId = spec.id ?? (0, forward_spec_1.describeRemoteForward)(spec);
+        this.bridge = bridge;
+        this.idleTimeoutMs = idleTimeoutMs;
+        this.connectTimeoutMs = connectTimeoutMs;
+    }
+    getState() {
+        return this.state;
+    }
+    /** The port the peer actually bound; differs from the request when 0 was asked. */
+    getBoundPort() {
+        return this.assignedPort ?? this.spec.bind.port;
+    }
+    getStatus() {
+        return {
+            forwardId: this.forwardId,
+            direction: 'remote',
+            state: this.state,
+            listen: { host: this.spec.bind.host, port: this.getBoundPort() },
+            target: { ...this.spec.target },
+            assignedPort: this.assignedPort,
+            activeConnections: this.connections.size,
+            totalConnections: this.totalConnections,
+            error: this.lastError,
+        };
+    }
+    listConnections() {
+        return [...this.connections.values()].map((connection) => connection.getStatus());
+    }
+    /** True when an inbound `tcp connection` event belongs to this forward. */
+    matches(destIP, destPort) {
+        if (destPort !== this.getBoundPort())
+            return false;
+        const bind = this.spec.bind.host;
+        if (bind === destIP)
+            return true;
+        // The peer reports the address it actually bound, which rarely matches the
+        // request verbatim: "localhost" vs "127.0.0.1", "" vs "0.0.0.0".
+        const loopback = new Set(['localhost', '127.0.0.1', '::1']);
+        if (loopback.has(bind) && loopback.has(destIP))
+            return true;
+        const wildcard = new Set(['', '*', '0.0.0.0', '::']);
+        return wildcard.has(bind) || wildcard.has(destIP);
+    }
+    /** Ask the peer to bind the listener. Resolves with the bound port. */
+    async open() {
+        if (this.state === 'active')
+            return this.getStatus();
+        this.transition('opening');
+        const client = this.bridge.requireClient(this.forwardId);
+        try {
+            this.assignedPort = await new Promise((resolve, reject) => {
+                client.forwardIn(this.spec.bind.host, this.spec.bind.port, (err, port) => {
+                    if (err) {
+                        reject((0, errors_1.asTunnelError)('REMOTE_BIND_FAILED', `Peer refused to bind ${this.spec.bind.host}:${this.spec.bind.port}`, err, { forwardId: this.forwardId }));
+                        return;
+                    }
+                    resolve(port ?? this.spec.bind.port);
+                });
+            });
+        }
+        catch (err) {
+            this.lastError = err instanceof Error ? err.message : String(err);
+            this.transition('failed');
+            throw err;
+        }
+        this.transition('active');
+        this.bridge.debug(`remote forward active peer ${this.spec.bind.host}:${this.getBoundPort()} -> ${this.spec.target.host}:${this.spec.target.port}`);
+        return this.getStatus();
+    }
+    /**
+     * Handle an inbound channel from the peer by dialling the target with a fresh
+     * socket. Returns false if the channel was rejected.
+     */
+    acceptChannel(accept, reject, source) {
+        if (this.state !== 'active') {
+            this.bridge.onError(new errors_1.TunnelError('TRANSPORT_NOT_READY', `Remote forward ${this.forwardId} is ${this.state}; rejecting channel`, { forwardId: this.forwardId }));
+            reject();
+            return false;
+        }
+        const limit = this.spec.maxConnections ?? 0;
+        if (limit > 0 && this.connections.size >= limit) {
+            this.bridge.onError(new errors_1.TunnelError('CONNECTION_LIMIT', `Forward ${this.forwardId} reached maxConnections=${limit}`, { forwardId: this.forwardId }));
+            reject();
+            return false;
+        }
+        const connection = new connection_1.ProxiedConnection({
+            forwardId: this.forwardId,
+            direction: 'remote',
+            source,
+            destination: { ...this.spec.target },
+            idleTimeoutMs: this.idleTimeoutMs,
+            onStateChange: (status, previous) => {
+                if (status.state === 'closed' || status.state === 'failed') {
+                    this.connections.delete(status.connectionId);
+                }
+                this.bridge.onConnectionChanged(status, previous);
+            },
+        });
+        this.connections.set(connection.connectionId, connection);
+        this.totalConnections += 1;
+        connection.markOpening();
+        const channel = accept();
+        channel.pause();
+        // Adopt the channel now so an unreachable target still closes it, instead of
+        // leaving whoever connected on the peer waiting forever.
+        connection.adoptInbound(channel);
+        // One socket per channel. This is the concurrency fix.
+        const socket = new node_net_1.Socket();
+        let settled = false;
+        const timer = this.connectTimeoutMs > 0
+            ? setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                const err = new errors_1.TunnelError('TARGET_UNREACHABLE', `Timed out connecting to ${this.spec.target.host}:${this.spec.target.port}`, { forwardId: this.forwardId, connectionId: connection.connectionId });
+                this.bridge.onError(err);
+                socket.destroy();
+                connection.fail(err, 'outbound');
+            }, this.connectTimeoutMs)
+            : undefined;
+        socket.once('error', (err) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            const wrapped = (0, errors_1.asTunnelError)('TARGET_UNREACHABLE', `Cannot reach ${this.spec.target.host}:${this.spec.target.port}`, err, { forwardId: this.forwardId, connectionId: connection.connectionId });
+            this.bridge.onError(wrapped);
+            connection.fail(wrapped, 'outbound');
+        });
+        socket.once('connect', () => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            connection.attach(channel, socket);
+            channel.resume();
+        });
+        socket.connect({
+            host: this.spec.target.host,
+            port: this.spec.target.port,
+            keepAlive: true,
+        });
+        return true;
+    }
+    markDegraded(reason) {
+        if (this.state === 'closed' || this.state === 'closing')
+            return;
+        this.lastError = reason;
+        this.closeConnections();
+        this.transition('degraded');
+    }
+    markActive() {
+        if (this.state === 'degraded') {
+            this.lastError = undefined;
+            this.transition('active');
+        }
+    }
+    /** Unbind on the peer. Tolerates a transport that has already gone away. */
+    async close() {
+        if (this.state === 'closed')
+            return this.getStatus();
+        const wasActive = this.state === 'active';
+        this.transition('closing');
+        this.closeConnections();
+        const client = this.bridge.peekClient();
+        if (client && wasActive) {
+            await new Promise((resolve) => {
+                try {
+                    client.unforwardIn(this.spec.bind.host, this.getBoundPort(), () => resolve());
+                }
+                catch {
+                    resolve();
+                }
+            });
+        }
+        this.transition('closed');
+        return this.getStatus();
+    }
+    closeConnections() {
+        for (const connection of [...this.connections.values()]) {
+            connection.close();
+        }
+        this.connections.clear();
+    }
+    transition(next) {
+        if (this.state === next)
+            return;
+        const previous = this.state;
+        this.state = next;
+        this.bridge.onForwardChanged(this.getStatus(), previous);
+    }
+}
+exports.RemoteForwardHandle = RemoteForwardHandle;
+//# sourceMappingURL=remote-forward.js.map

package/build/remote-forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-forward.js","sourceRoot":"","sources":["../src/remote-forward.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,uCAAkC;AAIlC,6CAAiD;AACjD,qCAAsD;AACtD,iDAAuD;AAGvD,MAAa,mBAAmB;IACd,SAAS,CAAS;IAClB,IAAI,CAAgB;IAE5B,KAAK,GAAiB,SAAS,CAAC;IAChC,YAAY,CAAU;IACtB,SAAS,CAAU;IACnB,gBAAgB,GAAG,CAAC,CAAC;IACZ,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnD,MAAM,CAAkB;IACxB,aAAa,CAAS;IACtB,gBAAgB,CAAS;IAE1C,YACE,IAAmB,EACnB,MAAuB,EACvB,aAAa,GAAG,CAAC,EACjB,gBAAgB,GAAG,KAAK;QAExB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,IAAI,IAAA,oCAAqB,EAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAEM,QAAQ;QACb,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,mFAAmF;IAC5E,YAAY;QACjB,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAClD,CAAC;IAEM,SAAS;QACd,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE;YAChE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YACxC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,KAAK,EAAE,IAAI,CAAC,SAAS;SACtB,CAAC;IACJ,CAAC;IAEM,eAAe;QACpB,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,2EAA2E;IACpE,OAAO,CAAC,MAAc,EAAE,QAAgB;QAC7C,IAAI,QAAQ,KAAK,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO,KAAK,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACjC,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACjC,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,uEAAuE;IAChE,KAAK,CAAC,IAAI;QACf,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEzD,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAChE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;oBACvE,IAAI,GAAG,EAAE,CAAC;wBACR,MAAM,CACJ,IAAA,sBAAa,EACX,oBAAoB,EACpB,wBAAwB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EACpE,GAAG,EACH,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAC9B,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8BAA8B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAChI,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACI,aAAa,CAClB,MAA2B,EAC3B,MAAkB,EAClB,MAAsC;QAEtC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,IAAI,oBAAW,CACb,qBAAqB,EACrB,kBAAkB,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,KAAK,qBAAqB,EACtE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAC9B,CACF,CAAC;YACF,MAAM,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,IAAI,oBAAW,CACb,kBAAkB,EAClB,WAAW,IAAI,CAAC,SAAS,2BAA2B,KAAK,EAAE,EAC3D,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAC9B,CACF,CAAC;YACF,MAAM,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,8BAAiB,CAAC;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,QAAQ;YACnB,MAAM;YACN,WAAW,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YACpC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;gBAClC,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC3D,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC/C,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC3B,UAAU,CAAC,WAAW,EAAE,CAAC;QAEzB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,6EAA6E;QAC7E,yDAAyD;QACzD,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEjC,uDAAuD;QACvD,MAAM,MAAM,GAAG,IAAI,iBAAM,EAAE,CAAC;QAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,KAAK,GACT,IAAI,CAAC,gBAAgB,GAAG,CAAC;YACvB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,GAAG,GAAG,IAAI,oBAAW,CACzB,oBAAoB,EACpB,2BAA2B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAC3E,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CACrE,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACzB,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACnC,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC3B,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAA,sBAAa,EAC3B,oBAAoB,EACpB,gBAAgB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAChE,GAAG,EACH,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CACrE,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC;YACb,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,YAAY,CAAC,MAAc;QAChC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QAChE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAEM,UAAU;QACf,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,4EAA4E;IACrE,KAAK,CAAC,KAAK;QAChB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,IAAI,CAAC;oBACH,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAEO,gBAAgB;QACtB,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YACxD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAEO,UAAU,CAAC,IAAkB;QACnC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;CACF;AArQD,kDAqQC"}

package/build/tunnel.d.ts

@@ -0,0 +1,121 @@
+import { EventEmitter } from 'node:events';
+import type { Writable } from 'node:stream';
+import { TunnelError } from './errors';
+import { type CredentialResolver } from './credentials';
+import { type ConnectionState, type ConnectionStatus, type Endpoint, type ForwardState, type ForwardStatus, type LocalForward, type RemoteForward, type TunnelConfig, type TunnelState, type TunnelStatus } from './model';
+export interface TunnelEvents {
+    state: (event: {
+        previous: TunnelState;
+        current: TunnelState;
+        reason?: string;
+    }) => void;
+    ready: (status: TunnelStatus) => void;
+    forward: (event: {
+        status: ForwardStatus;
+        previous: ForwardState;
+    }) => void;
+    connection: (event: {
+        status: ConnectionStatus;
+        previous: ConnectionState;
+    }) => void;
+    reconnect: (event: {
+        attempt: number;
+        delayMs: number;
+        cause?: string;
+    }) => void;
+    error: (error: TunnelError) => void;
+    close: (status: TunnelStatus) => void;
+    debug: (message: string, ...args: unknown[]) => void;
+}
+export interface SSHTunnelOptions {
+    /** Resolver for `{ source: 'callback' }` credential refs. */
+    credentialResolver?: CredentialResolver;
+    /** Destroy a proxied connection after this much inactivity. 0 disables. */
+    connectionIdleTimeoutMs?: number;
+    /** Timeout for dialling a remote-forward target. */
+    targetConnectTimeoutMs?: number;
+    /** Emit ssh2 protocol-level debug through the `debug` event. */
+    debugSsh?: boolean;
+}
+export declare class SSHTunnel extends EventEmitter {
+    readonly tunnelId: string;
+    private readonly config;
+    private readonly options;
+    private readonly bridge;
+    private client?;
+    private state;
+    private lastError?;
+    private connectedAtUnixMs?;
+    private reconnectAttempt;
+    private reconnectTimer?;
+    private connectPromise?;
+    private closing;
+    private readonly localForwards;
+    private readonly remoteForwards;
+    constructor(config: TunnelConfig, options?: SSHTunnelOptions);
+    on<E extends keyof TunnelEvents>(event: E, listener: TunnelEvents[E]): this;
+    once<E extends keyof TunnelEvents>(event: E, listener: TunnelEvents[E]): this;
+    off<E extends keyof TunnelEvents>(event: E, listener: TunnelEvents[E]): this;
+    emit<E extends keyof TunnelEvents>(event: E, ...args: Parameters<TunnelEvents[E]>): boolean;
+    getState(): TunnelState;
+    isReady(): boolean;
+    getStatus(): TunnelStatus;
+    listConnections(): ConnectionStatus[];
+    getForwardStatus(forwardId: string): ForwardStatus;
+    /**
+     * Resolve a semantic forward id to the endpoint a caller should connect to.
+     * This is the hook an agent-flow runtime uses instead of hard-coding ports.
+     */
+    resolveEndpoint(forwardId: string): {
+        endpoint: Endpoint;
+        state: ForwardState;
+    };
+    /**
+     * Establish the transport and open every forward declared in the config.
+     * Concurrent calls share one attempt. Resolves when all forwards are active.
+     */
+    connect(): Promise<TunnelStatus>;
+    private doConnect;
+    /** Close every forward and the transport. Idempotent. */
+    close(): Promise<TunnelStatus>;
+    /** Declare and open one local forward. Accepts a struct or a v1 spec string. */
+    addLocalForward(forward: LocalForward | string): Promise<ForwardStatus>;
+    /**
+     * Declare and open several local forwards atomically: either every listener is
+     * bound, or none are and the partial state is rolled back.
+     */
+    addLocalForwards(forwards: readonly (LocalForward | string)[]): Promise<ForwardStatus[]>;
+    /** Declare and open one remote forward. Accepts a struct or a v1 spec string. */
+    addRemoteForward(forward: RemoteForward | string): Promise<ForwardStatus>;
+    /** Declare and open several remote forwards atomically. */
+    addRemoteForwards(forwards: readonly (RemoteForward | string)[]): Promise<ForwardStatus[]>;
+    /** Close and forget one forward. */
+    removeForward(forwardId: string): Promise<ForwardStatus>;
+    private declareLocalForward;
+    private declareRemoteForward;
+    private declareConfiguredForwards;
+    /** Open, or re-open after a reconnect, every declared forward. */
+    private reopenForwards;
+    /**
+     * Run a single command on the peer. Provided because verifying a tunnel almost
+     * always involves one command; there is deliberately no pty or shell support.
+     */
+    exec(command: string, streams?: {
+        stdout?: Writable;
+        stderr?: Writable;
+    }): Promise<{
+        code: number | null;
+        stdout: string;
+        stderr: string;
+    }>;
+    private buildConnectConfig;
+    private attachClientHandlers;
+    private handleTransportLoss;
+    private shouldReconnect;
+    private scheduleReconnect;
+    private safeEndClient;
+    private transition;
+    /** Emit an error without the unhandled-'error' crash when nobody listens. */
+    private raise;
+}
+//# sourceMappingURL=tunnel.d.ts.map

package/build/tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../src/tunnel.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,OAAO,EAAE,WAAW,EAAiB,MAAM,UAAU,CAAC;AAWtD,OAAO,EAAyC,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/F,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACzF,KAAK,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IACtC,OAAO,EAAE,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5E,UAAU,EAAE,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAA;KAAE,KAAK,IAAI,CAAC;IACrF,SAAS,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACjF,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACpC,KAAK,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IACtC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oDAAoD;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAID,qBAAa,SAAU,SAAQ,YAAY;IACzC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IAEzC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,iBAAiB,CAAC,CAAS;IACnC,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,cAAc,CAAC,CAAwB;IAC/C,OAAO,CAAC,OAAO,CAAS;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyC;IACvE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0C;gBAE7D,MAAM,EAAE,YAAY,EAAE,OAAO,GAAE,gBAAqB;IAiChD,EAAE,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI;IAI3E,IAAI,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI;IAI7E,GAAG,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI;IAI5E,IAAI,CAAC,CAAC,SAAS,MAAM,YAAY,EAC/C,KAAK,EAAE,CAAC,EACR,GAAG,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GACnC,OAAO;IAQH,QAAQ,IAAI,WAAW;IAIvB,OAAO,IAAI,OAAO;IAIlB,SAAS,IAAI,YAAY;IAezB,eAAe,IAAI,gBAAgB,EAAE;IAOrC,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa;IAQzD;;;OAGG;IACI,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,KAAK,EAAE,YAAY,CAAA;KAAE;IAmBtF;;;OAGG;IACU,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;YAW/B,SAAS;IA8FvB,yDAAyD;IAC5C,KAAK,IAAI,OAAO,CAAC,YAAY,CAAC;IA2C3C,gFAAgF;IACnE,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAKpF;;;OAGG;IACU,gBAAgB,CAC3B,QAAQ,EAAE,SAAS,CAAC,YAAY,GAAG,MAAM,CAAC,EAAE,GAC3C,OAAO,CAAC,aAAa,EAAE,CAAC;IAqB3B,iFAAiF;IACpE,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAKtF,2DAA2D;IAC9C,iBAAiB,CAC5B,QAAQ,EAAE,SAAS,CAAC,aAAa,GAAG,MAAM,CAAC,EAAE,GAC5C,OAAO,CAAC,aAAa,EAAE,CAAC;IAqB3B,oCAAoC;IACvB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgBrE,OAAO,CAAC,mBAAmB;IA0B3B,OAAO,CAAC,oBAAoB;YAoBd,yBAAyB;IASvC,kEAAkE;YACpD,cAAc;IAuB5B;;;OAGG;IACI,IAAI,CACT,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,QAAQ,CAAA;KAAO,GACrD,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;YA+BrD,kBAAkB;IAuDhC,OAAO,CAAC,oBAAoB;IAwC5B,OAAO,CAAC,mBAAmB;IAkB3B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAqCzB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,UAAU;IAOlB,6EAA6E;IAC7E,OAAO,CAAC,KAAK;CAQd"}