ssh_tunnel_proxy 2.1.3 → 3.0.1

package/build/connection.d.ts

@@ -0,0 +1,60 @@
+import type { Duplex } from 'node:stream';
+import type { Socket } from 'node:net';
+import type { ConnectionState, ConnectionStatus, Endpoint, ForwardDirection } from './model';
+export interface ProxiedConnectionOptions {
+    forwardId: string;
+    direction: ForwardDirection;
+    source: Endpoint;
+    destination: Endpoint;
+    connectionId?: string;
+    onStateChange?: (status: ConnectionStatus, previous: ConnectionState) => void;
+    /** Destroy the connection if it stays idle for this long. 0 disables. */
+    idleTimeoutMs?: number;
+}
+export declare class ProxiedConnection {
+    readonly connectionId: string;
+    readonly forwardId: string;
+    readonly direction: ForwardDirection;
+    readonly source: Endpoint;
+    readonly destination: Endpoint;
+    readonly openedAtUnixMs: number;
+    private state;
+    private closedAtUnixMs?;
+    private bytesToTarget;
+    private bytesFromTarget;
+    private lastError?;
+    private readonly onStateChange?;
+    private readonly idleTimeoutMs;
+    private inbound?;
+    private outbound?;
+    private tornDown;
+    constructor(options: ProxiedConnectionOptions);
+    getState(): ConnectionState;
+    isClosed(): boolean;
+    getStatus(): ConnectionStatus;
+    markOpening(): void;
+    /**
+     * Register the inbound stream before the outbound half exists.
+     *
+     * Channel open is asynchronous and can fail. Adopting the inbound stream first
+     * means `fail()` and `close()` always destroy it, instead of leaving the peer
+     * holding an open socket that will never carry data.
+     */
+    adoptInbound(inbound: Socket | Duplex): void;
+    /**
+     * Attach both halves and start bidirectional flow.
+     *
+     * `inbound` is the stream the peer connected to; `outbound` is the stream that
+     * reaches the destination. For a local forward that is (accepted TCP socket,
+     * SSH channel). For a remote forward it is (SSH channel, outgoing TCP socket).
+     */
+    attach(inbound: Socket | Duplex, outbound: Duplex): void;
+    /** Record a failure and tear down. Safe to call repeatedly. */
+    fail(error: Error, side?: 'inbound' | 'outbound' | 'channel'): void;
+    /** Close cleanly. Safe to call repeatedly and from either side's handlers. */
+    close(): void;
+    private teardown;
+    private destroyStream;
+    private transition;
+}
+//# sourceMappingURL=connection.d.ts.map

package/build/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,QAAQ,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9E,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAOD,qBAAa,iBAAiB;IAC5B,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,SAAS,EAAE,gBAAgB,CAAC;IAC5C,SAAgB,MAAM,EAAE,QAAQ,CAAC;IACjC,SAAgB,WAAW,EAAE,QAAQ,CAAC;IACtC,SAAgB,cAAc,EAAE,MAAM,CAAC;IAEvC,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,cAAc,CAAC,CAAS;IAChC,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,SAAS,CAAC,CAAS;IAE3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAA4C;IAC3E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,OAAO,CAAC,OAAO,CAAC,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,EAAE,wBAAwB;IAWtC,QAAQ,IAAI,eAAe;IAI3B,QAAQ,IAAI,OAAO;IAInB,SAAS,IAAI,gBAAgB;IAgB7B,WAAW,IAAI,IAAI;IAI1B;;;;;;OAMG;IACI,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQnD;;;;;;OAMG;IACI,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAgD/D,+DAA+D;IACxD,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,GAAE,SAAS,GAAG,UAAU,GAAG,SAAqB,GAAG,IAAI;IAOrF,8EAA8E;IACvE,KAAK,IAAI,IAAI;IAMpB,OAAO,CAAC,QAAQ;IAuBhB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,UAAU;CASnB"}

package/build/connection.js

@@ -0,0 +1,198 @@
+"use strict";
+/*
+ * connection.ts — one proxied TCP connection, with explicit state.
+ *
+ * v1 piped a socket and a channel together and hoped for the best. The failure
+ * modes that produced were: half-open connections that never closed, `unpipe`
+ * called on an already-destroyed stream, errors on one side leaving the other
+ * side leaking, and no way to enumerate what was currently open.
+ *
+ * This class makes each connection a first-class, observable object:
+ *   - a single explicit state machine (accepted -> opening -> piped -> closed)
+ *   - byte counters in both directions
+ *   - idempotent teardown that always destroys both sides exactly once
+ *   - errors attributed to a connection id rather than logged anonymously
+ *
+ * License: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProxiedConnection = void 0;
+const node_crypto_1 = require("node:crypto");
+const TERMINAL_STATES = new Set([
+    'closed',
+    'failed',
+]);
+class ProxiedConnection {
+    connectionId;
+    forwardId;
+    direction;
+    source;
+    destination;
+    openedAtUnixMs;
+    state = 'accepted';
+    closedAtUnixMs;
+    bytesToTarget = 0;
+    bytesFromTarget = 0;
+    lastError;
+    onStateChange;
+    idleTimeoutMs;
+    inbound;
+    outbound;
+    tornDown = false;
+    constructor(options) {
+        this.connectionId = options.connectionId ?? (0, node_crypto_1.randomUUID)();
+        this.forwardId = options.forwardId;
+        this.direction = options.direction;
+        this.source = options.source;
+        this.destination = options.destination;
+        this.openedAtUnixMs = Date.now();
+        this.onStateChange = options.onStateChange;
+        this.idleTimeoutMs = options.idleTimeoutMs ?? 0;
+    }
+    getState() {
+        return this.state;
+    }
+    isClosed() {
+        return TERMINAL_STATES.has(this.state);
+    }
+    getStatus() {
+        return {
+            connectionId: this.connectionId,
+            forwardId: this.forwardId,
+            direction: this.direction,
+            state: this.state,
+            source: { ...this.source },
+            destination: { ...this.destination },
+            openedAtUnixMs: this.openedAtUnixMs,
+            closedAtUnixMs: this.closedAtUnixMs,
+            bytesToTarget: this.bytesToTarget,
+            bytesFromTarget: this.bytesFromTarget,
+            error: this.lastError,
+        };
+    }
+    markOpening() {
+        this.transition('opening');
+    }
+    /**
+     * Register the inbound stream before the outbound half exists.
+     *
+     * Channel open is asynchronous and can fail. Adopting the inbound stream first
+     * means `fail()` and `close()` always destroy it, instead of leaving the peer
+     * holding an open socket that will never carry data.
+     */
+    adoptInbound(inbound) {
+        if (this.tornDown) {
+            this.destroyStream(inbound);
+            return;
+        }
+        this.inbound = inbound;
+    }
+    /**
+     * Attach both halves and start bidirectional flow.
+     *
+     * `inbound` is the stream the peer connected to; `outbound` is the stream that
+     * reaches the destination. For a local forward that is (accepted TCP socket,
+     * SSH channel). For a remote forward it is (SSH channel, outgoing TCP socket).
+     */
+    attach(inbound, outbound) {
+        if (this.tornDown) {
+            // A close arrived before the channel opened. Do not leak either side.
+            this.destroyStream(inbound);
+            this.destroyStream(outbound);
+            return;
+        }
+        this.inbound = inbound;
+        this.outbound = outbound;
+        inbound.on('data', (chunk) => {
+            this.bytesToTarget += chunk.length;
+        });
+        outbound.on('data', (chunk) => {
+            this.bytesFromTarget += chunk.length;
+        });
+        // Client finished writing: half-close the target so a response can still
+        // come back. Target gone (crash, RST, FIN): destroy the client socket.
+        // A mere inbound.end() leaves allowHalfOpen listeners parked until the
+        // client also FINs, which is the "socket stayed open 5000ms" failure.
+        inbound.on('end', () => {
+            this.transition('half_closed');
+            if (this.outbound && !this.outbound.writableEnded)
+                this.outbound.end();
+        });
+        outbound.on('end', () => {
+            this.fail(new Error('target closed'), 'outbound');
+        });
+        inbound.on('error', (err) => this.fail(err, 'inbound'));
+        outbound.on('error', (err) => this.fail(err, 'outbound'));
+        inbound.on('close', () => this.close());
+        outbound.on('close', () => this.close());
+        if (this.idleTimeoutMs > 0 && typeof inbound.setTimeout === 'function') {
+            inbound.setTimeout(this.idleTimeoutMs, () => {
+                this.fail(new Error(`idle for ${this.idleTimeoutMs}ms`), 'inbound');
+            });
+        }
+        inbound.pipe(outbound);
+        outbound.pipe(inbound);
+        this.transition('piped');
+    }
+    /** Record a failure and tear down. Safe to call repeatedly. */
+    fail(error, side = 'channel') {
+        if (this.isClosed())
+            return;
+        this.lastError = `${side}: ${error.message}`;
+        this.teardown();
+        this.transition('failed');
+    }
+    /** Close cleanly. Safe to call repeatedly and from either side's handlers. */
+    close() {
+        if (this.isClosed())
+            return;
+        this.teardown();
+        this.transition('closed');
+    }
+    teardown() {
+        if (this.tornDown)
+            return;
+        this.tornDown = true;
+        this.closedAtUnixMs = Date.now();
+        const { inbound, outbound } = this;
+        if (inbound && outbound) {
+            try {
+                inbound.unpipe(outbound);
+                outbound.unpipe(inbound);
+            }
+            catch {
+                // unpipe on an already-destroyed stream is not actionable
+            }
+        }
+        this.destroyStream(inbound);
+        this.destroyStream(outbound);
+        this.inbound = undefined;
+        this.outbound = undefined;
+    }
+    destroyStream(stream) {
+        if (!stream)
+            return;
+        try {
+            stream.removeAllListeners('data');
+            if (!stream.destroyed)
+                stream.destroy();
+        }
+        catch {
+            // best effort
+        }
+    }
+    transition(next) {
+        if (this.state === next)
+            return;
+        if (TERMINAL_STATES.has(this.state))
+            return;
+        // half_closed must not overwrite a later terminal state
+        if (next === 'half_closed' && this.state === 'accepted')
+            return;
+        const previous = this.state;
+        this.state = next;
+        this.onStateChange?.(this.getStatus(), previous);
+    }
+}
+exports.ProxiedConnection = ProxiedConnection;
+//# sourceMappingURL=connection.js.map

package/build/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,6CAAyC;AAsBzC,MAAM,eAAe,GAAiC,IAAI,GAAG,CAAkB;IAC7E,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,MAAa,iBAAiB;IACZ,YAAY,CAAS;IACrB,SAAS,CAAS;IAClB,SAAS,CAAmB;IAC5B,MAAM,CAAW;IACjB,WAAW,CAAW;IACtB,cAAc,CAAS;IAE/B,KAAK,GAAoB,UAAU,CAAC;IACpC,cAAc,CAAU;IACxB,aAAa,GAAG,CAAC,CAAC;IAClB,eAAe,GAAG,CAAC,CAAC;IACpB,SAAS,CAAU;IAEV,aAAa,CAA6C;IAC1D,aAAa,CAAS;IAE/B,OAAO,CAAmB;IAC1B,QAAQ,CAAU;IAClB,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,OAAiC;QAC3C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAA,wBAAU,GAAE,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;IAClD,CAAC;IAEM,QAAQ;QACb,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEM,QAAQ;QACb,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEM,SAAS;QACd,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;YAC1B,WAAW,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE;YACpC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,KAAK,EAAE,IAAI,CAAC,SAAS;SACtB,CAAC;IACJ,CAAC;IAEM,WAAW;QAChB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACI,YAAY,CAAC,OAAwB;QAC1C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,OAAwB,EAAE,QAAgB;QACtD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sEAAsE;YACtE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACnC,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACpC,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAEjE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACxC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,OAAQ,OAAkB,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAClF,OAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE;gBACtD,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,+DAA+D;IACxD,IAAI,CAAC,KAAY,EAAE,OAA2C,SAAS;QAC5E,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO;QAC5B,IAAI,CAAC,SAAS,GAAG,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,8EAA8E;IACvE,KAAK;QACV,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO;QAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEO,QAAQ;QACd,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAEnC,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACzB,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE7B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC5B,CAAC;IAEO,aAAa,CAAC,MAAmC;QACvD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAqB;QACtC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO;QAChC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QAC5C,wDAAwD;QACxD,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;CACF;AA3LD,8CA2LC"}

package/build/credentials.d.ts

@@ -0,0 +1,24 @@
+import type { CredentialRef } from './model';
+/** Host-supplied resolver for `{ source: 'callback' }` refs. */
+export type CredentialResolver = (ref: CredentialRef) => string | Buffer | Promise<string | Buffer>;
+export declare function expandHome(path: string): string;
+export interface ResolveOptions {
+    resolver?: CredentialResolver;
+    label?: string;
+}
+/**
+ * Resolve a credential reference. Returns `undefined` when `ref` is undefined so
+ * callers can pass optional fields straight through.
+ */
+export declare function resolveCredential(ref: CredentialRef | undefined, options?: ResolveOptions): Promise<Buffer | string | undefined>;
+/** Convenience constructors so callers rarely write the object literal. */
+export declare const credential: {
+    file: (path: string) => CredentialRef;
+    env: (name: string) => CredentialRef;
+    inline: (value: string) => CredentialRef;
+    agent: (socketPath?: string) => CredentialRef;
+    callback: (name?: string) => CredentialRef;
+};
+/** Resolve the agent socket path for an `agent` credential ref. */
+export declare function resolveAgentSocket(ref: CredentialRef | undefined): string | undefined;
+//# sourceMappingURL=credentials.d.ts.map

package/build/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;AAEpG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,aAAa,GAAG,SAAS,EAC9B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAsEtC;AAED,2EAA2E;AAC3E,eAAO,MAAM,UAAU;iBACR,MAAM,KAAG,aAAa;gBACvB,MAAM,KAAG,aAAa;oBAClB,MAAM,KAAG,aAAa;yBACjB,MAAM,KAAG,aAAa;sBACzB,MAAM,KAAG,aAAa;CACzC,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGrF"}

package/build/credentials.js

@@ -0,0 +1,102 @@
+"use strict";
+/*
+ * credentials.ts — resolve a CredentialRef to bytes at connect time.
+ *
+ * This replaces the v1 keychain integration. The package no longer generates,
+ * stores, or derives key material: it reads a key the operator already manages
+ * with ssh-keygen, an agent, or a secret manager. `sshpk` and `keytar` are gone
+ * from the dependency list as a result.
+ *
+ * License: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.credential = void 0;
+exports.expandHome = expandHome;
+exports.resolveCredential = resolveCredential;
+exports.resolveAgentSocket = resolveAgentSocket;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const errors_1 = require("./errors");
+function expandHome(path) {
+    if (path === '~')
+        return (0, node_os_1.homedir)();
+    if (path.startsWith('~/'))
+        return (0, node_path_1.join)((0, node_os_1.homedir)(), path.slice(2));
+    return path;
+}
+/**
+ * Resolve a credential reference. Returns `undefined` when `ref` is undefined so
+ * callers can pass optional fields straight through.
+ */
+async function resolveCredential(ref, options = {}) {
+    if (!ref)
+        return undefined;
+    const label = options.label ?? 'credential';
+    switch (ref.source) {
+        case 'inline': {
+            if (!ref.value) {
+                throw new errors_1.TunnelError('CREDENTIAL_UNRESOLVED', `Inline ${label} has no value`);
+            }
+            return ref.value;
+        }
+        case 'env': {
+            if (!ref.value) {
+                throw new errors_1.TunnelError('CREDENTIAL_UNRESOLVED', `Env ${label} has no variable name`);
+            }
+            const value = process.env[ref.value];
+            if (value === undefined || value.length === 0) {
+                throw new errors_1.TunnelError('CREDENTIAL_UNRESOLVED', `Environment variable ${ref.value} for ${label} is unset or empty`);
+            }
+            return value;
+        }
+        case 'file': {
+            if (!ref.value) {
+                throw new errors_1.TunnelError('CREDENTIAL_UNRESOLVED', `File ${label} has no path`);
+            }
+            const path = expandHome(ref.value);
+            if (!(0, node_path_1.isAbsolute)(path)) {
+                throw new errors_1.TunnelError('CREDENTIAL_UNRESOLVED', `Path for ${label} must be absolute or start with "~": ${ref.value}`);
+            }
+            try {
+                return (0, node_fs_1.readFileSync)(path);
+            }
+            catch (cause) {
+                throw (0, errors_1.asTunnelError)('CREDENTIAL_UNRESOLVED', `Cannot read ${label} from ${path}`, cause);
+            }
+        }
+        case 'agent': {
+            // The agent path is handled by the transport, not read as bytes.
+            return undefined;
+        }
+        case 'callback': {
+            if (!options.resolver) {
+                throw new errors_1.TunnelError('CREDENTIAL_UNRESOLVED', `${label} uses source "callback" but no credentialResolver was supplied`);
+            }
+            try {
+                return await options.resolver(ref);
+            }
+            catch (cause) {
+                throw (0, errors_1.asTunnelError)('CREDENTIAL_UNRESOLVED', `Resolver failed for ${label}`, cause);
+            }
+        }
+        default: {
+            throw new errors_1.TunnelError('CREDENTIAL_UNRESOLVED', `Unsupported credential source ${JSON.stringify(ref.source)}`);
+        }
+    }
+}
+/** Convenience constructors so callers rarely write the object literal. */
+exports.credential = {
+    file: (path) => ({ source: 'file', value: path }),
+    env: (name) => ({ source: 'env', value: name }),
+    inline: (value) => ({ source: 'inline', value }),
+    agent: (socketPath) => ({ source: 'agent', value: socketPath }),
+    callback: (name) => ({ source: 'callback', value: name }),
+};
+/** Resolve the agent socket path for an `agent` credential ref. */
+function resolveAgentSocket(ref) {
+    if (!ref || ref.source !== 'agent')
+        return undefined;
+    return ref.value ?? process.env.SSH_AUTH_SOCK;
+}
+//# sourceMappingURL=credentials.js.map

package/build/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAYH,gCAIC;AAWD,8CAyEC;AAYD,gDAGC;AAjHD,qCAAuC;AACvC,qCAAkC;AAClC,yCAA6C;AAE7C,qCAAsD;AAMtD,SAAgB,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAA,iBAAO,GAAE,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,GAA8B,EAC9B,UAA0B,EAAE;IAE5B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAE5C,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,oBAAW,CAAC,uBAAuB,EAAE,UAAU,KAAK,eAAe,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,GAAG,CAAC,KAAK,CAAC;QACnB,CAAC;QAED,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,oBAAW,CAAC,uBAAuB,EAAE,OAAO,KAAK,uBAAuB,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,oBAAW,CACnB,uBAAuB,EACvB,wBAAwB,GAAG,CAAC,KAAK,QAAQ,KAAK,oBAAoB,CACnE,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,oBAAW,CAAC,uBAAuB,EAAE,QAAQ,KAAK,cAAc,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,IAAA,sBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,oBAAW,CACnB,uBAAuB,EACvB,YAAY,KAAK,wCAAwC,GAAG,CAAC,KAAK,EAAE,CACrE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAA,sBAAa,EAAC,uBAAuB,EAAE,eAAe,KAAK,SAAS,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,iEAAiE;YACjE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,oBAAW,CACnB,uBAAuB,EACvB,GAAG,KAAK,gEAAgE,CACzE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAA,sBAAa,EAAC,uBAAuB,EAAE,uBAAuB,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,IAAI,oBAAW,CACnB,uBAAuB,EACvB,iCAAiC,IAAI,CAAC,SAAS,CAAE,GAAqB,CAAC,MAAM,CAAC,EAAE,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC9D,QAAA,UAAU,GAAG;IACxB,IAAI,EAAE,CAAC,IAAY,EAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxE,GAAG,EAAE,CAAC,IAAY,EAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACtE,MAAM,EAAE,CAAC,KAAa,EAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvE,KAAK,EAAE,CAAC,UAAmB,EAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACvF,QAAQ,EAAE,CAAC,IAAa,EAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;CAClF,CAAC;AAEF,mEAAmE;AACnE,SAAgB,kBAAkB,CAAC,GAA8B;IAC/D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;AAChD,CAAC"}

package/build/errors.d.ts

@@ -0,0 +1,19 @@
+export declare const TUNNEL_ERROR_CODES: readonly ["INVALID_FORWARD_SPEC", "PORT_NOT_PERMITTED", "HOST_NOT_PERMITTED", "TRANSPORT_NOT_READY", "AUTH_FAILED", "LISTEN_FAILED", "REMOTE_BIND_FAILED", "CHANNEL_OPEN_FAILED", "TARGET_UNREACHABLE", "DUPLICATE_FORWARD_ID", "UNKNOWN_FORWARD", "CONNECTION_LIMIT", "RECONNECT_EXHAUSTED", "CREDENTIAL_UNRESOLVED"];
+export type TunnelErrorCode = (typeof TUNNEL_ERROR_CODES)[number];
+export interface TunnelErrorDetails {
+    forwardId?: string;
+    connectionId?: string;
+    cause?: unknown;
+}
+export declare class TunnelError extends Error {
+    readonly code: TunnelErrorCode;
+    readonly forwardId?: string;
+    readonly connectionId?: string;
+    readonly cause?: unknown;
+    constructor(code: TunnelErrorCode, message: string, details?: TunnelErrorDetails);
+    toJSON(): Record<string, unknown>;
+}
+export declare function isTunnelError(value: unknown): value is TunnelError;
+/** Wrap an unknown thrown value in a TunnelError without losing the original. */
+export declare function asTunnelError(code: TunnelErrorCode, message: string, cause: unknown, details?: Omit<TunnelErrorDetails, 'cause'>): TunnelError;
+//# sourceMappingURL=errors.d.ts.map

package/build/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,kBAAkB,wTAerB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,SAAgB,IAAI,EAAE,eAAe,CAAC;IACtC,SAAgB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnC,SAAgB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtC,SAAyB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAE7B,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB;IAU7E,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CASzC;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAC3B,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAM,GAC9C,WAAW,CAGb"}

package/build/errors.js

@@ -0,0 +1,64 @@
+"use strict";
+/*
+ * errors.ts — stable error taxonomy.
+ *
+ * Every failure surfaced by this package carries a machine-readable `code` that
+ * mirrors sshtunnel.v1.TunnelEvent.ErrorRaised.Code. Callers branch on the code,
+ * never on the message text.
+ *
+ * License: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TunnelError = exports.TUNNEL_ERROR_CODES = void 0;
+exports.isTunnelError = isTunnelError;
+exports.asTunnelError = asTunnelError;
+exports.TUNNEL_ERROR_CODES = [
+    'INVALID_FORWARD_SPEC',
+    'PORT_NOT_PERMITTED',
+    'HOST_NOT_PERMITTED',
+    'TRANSPORT_NOT_READY',
+    'AUTH_FAILED',
+    'LISTEN_FAILED',
+    'REMOTE_BIND_FAILED',
+    'CHANNEL_OPEN_FAILED',
+    'TARGET_UNREACHABLE',
+    'DUPLICATE_FORWARD_ID',
+    'UNKNOWN_FORWARD',
+    'CONNECTION_LIMIT',
+    'RECONNECT_EXHAUSTED',
+    'CREDENTIAL_UNRESOLVED',
+];
+class TunnelError extends Error {
+    code;
+    forwardId;
+    connectionId;
+    cause;
+    constructor(code, message, details = {}) {
+        super(message);
+        this.name = 'TunnelError';
+        this.code = code;
+        this.forwardId = details.forwardId;
+        this.connectionId = details.connectionId;
+        this.cause = details.cause;
+        Object.setPrototypeOf(this, TunnelError.prototype);
+    }
+    toJSON() {
+        return {
+            name: this.name,
+            code: this.code,
+            message: this.message,
+            forwardId: this.forwardId,
+            connectionId: this.connectionId,
+        };
+    }
+}
+exports.TunnelError = TunnelError;
+function isTunnelError(value) {
+    return value instanceof TunnelError;
+}
+/** Wrap an unknown thrown value in a TunnelError without losing the original. */
+function asTunnelError(code, message, cause, details = {}) {
+    const suffix = cause instanceof Error ? `: ${cause.message}` : cause ? `: ${String(cause)}` : '';
+    return new TunnelError(code, `${message}${suffix}`, { ...details, cause });
+}
+//# sourceMappingURL=errors.js.map

package/build/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAsDH,sCAEC;AAGD,sCAQC;AAjEY,QAAA,kBAAkB,GAAG;IAChC,sBAAsB;IACtB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,iBAAiB;IACjB,kBAAkB;IAClB,qBAAqB;IACrB,uBAAuB;CACf,CAAC;AAUX,MAAa,WAAY,SAAQ,KAAK;IACpB,IAAI,CAAkB;IACtB,SAAS,CAAU;IACnB,YAAY,CAAU;IACb,KAAK,CAAW;IAEzC,YAAY,IAAqB,EAAE,OAAe,EAAE,UAA8B,EAAE;QAClF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAEM,MAAM;QACX,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;IACJ,CAAC;CACF;AAzBD,kCAyBC;AAED,SAAgB,aAAa,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,WAAW,CAAC;AACtC,CAAC;AAED,iFAAiF;AACjF,SAAgB,aAAa,CAC3B,IAAqB,EACrB,OAAe,EACf,KAAc,EACd,UAA6C,EAAE;IAE/C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,OAAO,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/build/forward-spec.d.ts

@@ -0,0 +1,34 @@
+import type { LocalForward, PortPolicy, RemoteForward } from './model';
+export declare const DEFAULT_LISTEN_ADDRESS = "127.0.0.1";
+export declare const DEFAULT_REMOTE_BIND_ADDRESS = "localhost";
+/**
+ * Parse a local-forward string into a structured {@link LocalForward}.
+ * Syntax only — call {@link validateLocalForward} to apply a {@link PortPolicy}.
+ */
+export declare function parseLocalForwardSpec(spec: string): LocalForward;
+/**
+ * Parse a remote-forward string into a structured {@link RemoteForward}.
+ *
+ * Field mapping, matching v1 behaviour:
+ *   3 fields: bindPort : targetHost : targetPort, bind address defaults to
+ *             "localhost" on the peer.
+ *   4 fields: bindAddress : bindPort : targetHost : targetPort.
+ *
+ * A bind port of 0 asks the SSH peer to assign one; the assigned value is
+ * reported in ForwardStatus.assignedPort.
+ */
+export declare function parseRemoteForwardSpec(spec: string): RemoteForward;
+/**
+ * Apply a {@link PortPolicy} to a structured local forward and return a
+ * normalized copy. Throws a {@link TunnelError} on the first violation.
+ */
+export declare function validateLocalForward(forward: LocalForward, policy?: PortPolicy): Required<Pick<LocalForward, 'id' | 'listen' | 'target'>> & LocalForward;
+/** Apply a {@link PortPolicy} to a structured remote forward. */
+export declare function validateRemoteForward(forward: RemoteForward, policy?: PortPolicy): Required<Pick<RemoteForward, 'id' | 'bind' | 'target'>> & RemoteForward;
+/** Parse and validate in one step. */
+export declare function parseAndValidateLocalForward(spec: string, policy?: PortPolicy): LocalForward;
+/** Parse and validate in one step. */
+export declare function parseAndValidateRemoteForward(spec: string, policy?: PortPolicy): RemoteForward;
+export declare function describeLocalForward(forward: LocalForward): string;
+export declare function describeRemoteForward(forward: RemoteForward): string;
+//# sourceMappingURL=forward-spec.d.ts.map

package/build/forward-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-spec.d.ts","sourceRoot":"","sources":["../src/forward-spec.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAGvE,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAClD,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAmCvD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CA+BhE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAiClE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,YAAY,EACrB,MAAM,GAAE,UAAe,GACtB,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC,GAAG,YAAY,CAuBzE;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,aAAa,EACtB,MAAM,GAAE,UAAe,GACtB,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC,GAAG,aAAa,CAezE;AAED,sCAAsC;AACtC,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,UAAe,GAAG,YAAY,CAEhG;AAED,sCAAsC;AACtC,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,UAAe,GAAG,aAAa,CAElG;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAGlE;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAGpE"}