Connections and servers

export default class Client extends EventEmitter<ClientEvents> {
    peerDisconnect?: Readonly<PeerDisconnectInfo>;
    constructor(options: ClientOptions);
    hooker: Hooker<ClientHooker>;
    readonly algorithmOffer: ResolvedAlgorithmOptions;
    serverProtocolVersion?: ProtocolVersionExchange;
    serverSignatureAlgorithms?: readonly string[];
    /** The most recent key exchange hash, returned as a defensive copy. */
    get exchangeHash(): Buffer | undefined;
    /** The negotiated key exchange algorithm name. */
    get keyExchangeAlgorithm(): string | undefined;
    /** The currently active transport algorithm names. */
    get negotiatedAlgorithms(): Readonly<NegotiatedAlgorithms> | undefined;
    get sessionID(): Buffer | undefined;
    hasReceivedNewKeys: boolean;
    hasSentNewKeys: boolean;
    hasAuthenticated: boolean;
    activeAuthenticationMethod?: SSHAuthenticationMethods;
    authenticationMethodsRemaining?: ReadonlySet<SSHAuthenticationMethods>;
    partialAuthenticationSuccess: boolean;
    localChannelIndex: number;
    channels: Map<number, ClientChannel>;
    agentForwardingEnabled: boolean;
    get serverHostKey(): Buffer | undefined;
    get hostboundPublicKeyAuthentication(): boolean;
    /** Whether the server advertised RFC 9987 agent forwarding version 0. */
    get rfc9987AgentForwarding(): boolean;
    /** Whether RFC 8308 no-flow-control is active for this connection. */
    get noFlowControl(): boolean;
    createGSSAPIKeyExchangeAuthenticationMIC(username: string, service: string): Promise<Buffer>;
    get serverExtensions(): readonly Readonly<SSHExtension>[];
    /** Whether the server advertises correct post-authentication global-request handling. */
    get serverSupportsGlobalRequests(): boolean;
    /** The server's RFC 8308 elevation result, once reported after authentication. */
    get elevated(): boolean | undefined;
    registerX11Forwarding(sessionId: number, single: boolean): void;
    unregisterX11Forwarding(sessionId: number): void;
    state: SocketState;
    get isConnected(): boolean;
    get canConnect(): boolean;
    debug(...message: unknown[]): void;
    setNoDelay(noDelay?: boolean): this;
    assertOpenSSHVendor(): void;
    rekey(): Promise<void>;
    ping(data?: Buffer): Promise<Buffer>;
    sendDebug(message: string, alwaysDisplay?: boolean, languageTag?: string): this;
    sendIgnore(data: Buffer): this;
    globalRequest(name: string, args?: Buffer): Promise<Buffer>;
    openSession(): Promise<ClientSessionChannel>;
    exec(command: string, options?: ClientSessionOptions): Promise<ClientSessionChannel>;
    shell(options?: ClientSessionOptions): Promise<ClientSessionChannel>;
    subsystem(name: string): Promise<ClientSessionChannel>;
    subsys(name: string): Promise<ClientSessionChannel>;
    openssh_noMoreSessions(): Promise<void>;
    opensshNoMoreSessions(): Promise<void>;
    sftp(environment?: ClientEnvironment, options?: SFTPClientOptions): Promise<SFTPClient>;
    publicKeySubsystem(options?: PublicKeySubsystemClientOptions): Promise<PublicKeySubsystemClient>;
    forwardOut(sourceHost: string, sourcePort: number, destinationHost: string, destinationPort: number): Promise<ClientTCPIPChannel>;
    forwardIn(bindAddress: string, bindPort: number): Promise<number>;
    unforwardIn(bindAddress: string, bindPort: number): Promise<void>;
    forwardOutStreamLocal(socketPath: string): Promise<ClientDirectStreamLocalChannel>;
    openssh_forwardOutStreamLocal(socketPath: string): Promise<ClientDirectStreamLocalChannel>;
    openTunnel(mode: TunnelMode, unit?: number): Promise<ClientTunnelChannel>;
    openssh_openTunnel(mode: TunnelMode, unit?: number): Promise<ClientTunnelChannel>;
    forwardInStreamLocal(socketPath: string): Promise<void>;
    openssh_forwardInStreamLocal(socketPath: string): Promise<void>;
    unforwardInStreamLocal(socketPath: string): Promise<void>;
    openssh_unforwardInStreamLocal(socketPath: string): Promise<void>;
    connect(): Promise<void>;
    end(): this;
    /**
     * Gracefully disconnect and settle after terminal transport cleanup.
     *
     * Concurrent calls for one connection share the same Promise. The client remains reusable
     * after the Promise resolves.
     */
    close(): Promise<void>;
    [Symbol.asyncDispose](): Promise<void>;
    disconnect(error?: DisconnectError): this;
    destroy(): this;
    sendPacket(packet: Packet): number;
    onMessage(message: Buffer): void;
}

export type ClientEnvironment = Readonly<Record<string, string>>;

export interface ClientEvents {
    debug: [
        ...message: unknown[]
    ];
    error: [
        error: Error
    ];
    /** The peer transport reached EOF; terminal close cleanup follows. */
    end: [
    ];
    close: [
    ];
    /** Authenticated or unauthenticated terminal disconnect received from the peer. */
    disconnect: [
        info: Readonly<PeerDisconnectInfo>
    ];
    /** Human-readable transport diagnostic sent by the peer. */
    protocolDebug: [
        info: Readonly<ProtocolDebugMessage>
    ];
    connect: [
    ];
    /** Authentication completed and connection-layer operations are available. */
    ready: [
    ];
    /** The direct TCP transport reached its configured inactivity timeout. */
    timeout: [
    ];
    /** Payload-free metadata for an inbound binary packet. */
    packet: [
        metadata: Readonly<ProtocolPacketMetadata>
    ];
    /** The peer rejected an outbound packet with this sequence number. */
    unimplemented: [
        sequenceNumber: number
    ];
    /** Host keys whose ownership was cryptographically proved for this connection. */
    hostKeys: [
        publicKeys: readonly PublicKey[]
    ];
    tcpWrapperLog: [
        message: string
    ];
    serverProtocolVersion: [
        protocolVersion: ProtocolVersionExchange
    ];
    serverKexInit: [
        serverKexInit: KexInit,
        payload: Buffer
    ];
    serverKexDHReply: [
        serverKexDHReply: KexDHReply
    ];
    serverKexDHGexGroup: [
        group: KexDHGexGroup
    ];
    serverKexDHGexReply: [
        reply: KexDHGexReply
    ];
    serverKexRSAPublicKey: [
        publicKey: KexRSAPublicKey
    ];
    serverKexRSADone: [
        done: KexRSADone
    ];
    clientNewKeys: [
    ];
    serverNewKeys: [
    ];
    handshake: [
        negotiated: Readonly<NegotiatedAlgorithms>
    ];
    rekey: [
    ];
    /** Complete server pre-identification greeting, including its line endings. */
    greeting: [
        greeting: string
    ];
    banner: [
        message: string,
        languageTag: string
    ];
    /** Diagnostic status sent by the server during RFC 4462 context establishment. */
    gssapiError: [
        error: Readonly<UserAuthGSSAPIErrorData>
    ];
    /** Diagnostic status sent by the server during GSS-API key exchange. */
    gssapiKeyExchangeError: [
        error: Readonly<KexGSSAPIErrorData>
    ];
    /** Complete replacement set from the latest valid server EXT_INFO message. */
    serverExtensions: [
        extensions: readonly Readonly<SSHExtension>[]
    ];
    /** RFC 8308 operating-system elevation result reported after authentication. */
    elevation: [
        elevated: boolean
    ];
    "tcp connection": [
        details: Readonly<TCPIPConnectionDetails>,
        channel: ClientForwardedTCPIPChannel
    ];
    "unix connection": [
        details: Readonly<StreamLocalConnectionDetails>,
        channel: ClientForwardedStreamLocalChannel
    ];
    x11: [
        details: Readonly<X11ConnectionDetails>,
        channel: ClientX11Channel
    ];
}

export type ClientHooker = {
    hostKey: [
        hostKeyController: ClientHookerHostKeyController,
        serverPublicKey: PublicKey
    ];
    passwordAuth: [
        passwordAuthContext: ClientHookerPasswordAuthContext,
        passwordAuthController: ClientHookerPasswordAuthController
    ];
    passwordChange: [
        passwordChangeContext: ClientHookerPasswordChangeContext,
        passwordChangeController: ClientHookerPasswordChangeController
    ];
    keyboardInteractive: [
        keyboardInteractiveContext: ClientHookerKeyboardInteractiveContext,
        keyboardInteractiveController: ClientHookerKeyboardInteractiveController
    ];
    authenticationMethod: [
        authenticationMethodContext: ClientHookerAuthenticationMethodContext,
        authenticationMethodController: ClientHookerAuthenticationMethodController
    ];
    globalRequest: [
        globalRequestContext: ClientHookerGlobalRequestContext,
        globalRequestController: ClientHookerGlobalRequestController
    ];
    tcpConnection: [
        channel: ClientForwardedTCPIPChannel,
        controller: ClientHookerIncomingChannelController
    ];
    streamLocalConnection: [
        channel: ClientForwardedStreamLocalChannel,
        controller: ClientHookerIncomingChannelController
    ];
    x11Connection: [
        channel: ClientX11Channel,
        controller: ClientHookerIncomingChannelController
    ];
};

export type ClientHookerAuthenticationMethodContext = Readonly<{
    /** Zero-based attempt number for this connection. */
    attempt: number;
    /** Configured methods that have already failed during the current authentication stage. */
    attemptedMethods: readonly SSHAuthenticationMethods[];
    /** Method the configured order would select when the hook does not override it. */
    defaultMethod: SSHAuthenticationMethods | undefined;
    /** The latest server continuation list, or undefined before the first failure. */
    methodsRemaining: readonly SSHAuthenticationMethods[] | undefined;
    /** Whether the server accepted a factor before entering the current stage. */
    partialSuccess: boolean;
    /** Username that will be used unless the controller replaces it. */
    username: string;
}>;

export interface ClientHookerAuthenticationMethodController {
    /** Select the next method, or set undefined to stop authentication. */
    method: SSHAuthenticationMethods | undefined;
    /** Replace the username for this attempt. It cannot change after partial success. */
    username?: string;
    /** Replace the signing agent for this attempt. */
    agent?: Agent | string;
    /** Replace the host-based identity for this attempt. */
    hostbased?: Readonly<ClientHostbasedOptions>;
}

export type ClientHookerGlobalRequestContext = Readonly<{
    name: string;
    args: Buffer;
    wantReply: boolean;
}>;

export interface ClientHookerGlobalRequestController {
    success: boolean;
    response?: Buffer;
}

export interface ClientHookerHostKeyController {
    allowHostKey: boolean;
    /** Failure returned by a completed policy denial. */
    rejection?: Error;
}

export interface ClientHookerIncomingChannelController {
    allowOpen: boolean;
    rejection?: ChannelOpenError;
}

export type ClientHookerKeyboardInteractiveContext = Readonly<{
    username: string;
    name: string;
    instruction: string;
    languageTag: string;
    prompts: readonly Readonly<UserAuthPrompt>[];
    round: number;
}>;

export interface ClientHookerKeyboardInteractiveController {
    responses: string[] | undefined;
}

export type ClientHookerPasswordAuthContext = Readonly<{
    username: string;
}>;

export interface ClientHookerPasswordAuthController {
    password: string | undefined;
}

export type ClientHookerPasswordChangeContext = Readonly<{
    username: string;
    prompt: string;
    languageTag: string;
}>;

export interface ClientHookerPasswordChangeController {
    newPassword: string | undefined;
}

export interface ClientHostbasedOptions {
    key: PrivateKey;
    localHostname: string;
    localUsername: string;
    /** Signature algorithm; defaults to the strongest algorithm supported by the key. */
    algorithm?: string;
}

export interface ClientOptions {
    hostname?: string;
    port?: number;
    /** Local address to bind for a new TCP connection. Ignored when `sock` is supplied. */
    localAddress?: string;
    /** Local port to bind for a new TCP connection. Ignored when `sock` is supplied. */
    localPort?: number;
    /** Resolve `hostname` to IPv4 only. Has no effect when `forceIPv6` is also true. */
    forceIPv4?: boolean;
    /** Resolve `hostname` to IPv6 only. Has no effect when `forceIPv4` is also true. */
    forceIPv6?: boolean;
    /** Custom SSH software identifier and optional comments, without the `SSH-2.0-` prefix. */
    ident?: string | Buffer;
    /** Reject OpenSSH-specific APIs for peers without a compatible OpenSSH identifier. */
    strictVendor?: boolean;
    algorithms?: ClientAlgorithmOptions;
    /** Remote SSH account name. */
    username: string;
    password?: string;
    /** Signing agent object, Unix socket, Windows named pipe, or Cygwin socket descriptor path. */
    agent?: Agent | string;
    /** Request agent forwarding by default for exec and shell sessions. */
    agentForward?: boolean;
    /** RFC 8308 infinite channel windows. Both peers must opt in and one must prefer it. */
    noFlowControl?: NoFlowControlPreference;
    /** RFC 8308 operating-system elevation preference. False disables the extension. */
    elevation?: ElevationPreference;
    /** RFC 8308 post-authentication compression renegotiation. */
    delayCompression?: DelayCompressionConfiguration;
    /** Private key object or encoded private-key container used for public-key authentication. */
    privateKey?: PrivateKey | string | Buffer;
    /** Certificate public key paired with `privateKey` for certificate authentication. */
    certificate?: PublicKey | string | Buffer;
    /** Passphrase for an encoded `privateKey`. */
    passphrase?: string | Buffer;
    /** RFC 4252 host-based authentication identity. */
    hostbased?: Readonly<ClientHostbasedOptions>;
    /** RFC 4462 GSS-API mechanisms, in preference order. */
    gssapi?: readonly GSSAPIClientMechanism[];
    /** Request credential delegation during RFC 4462 context establishment. */
    gssapiDelegateCredentials?: boolean;
    /** Retain an initial GSS-API key-exchange context for gssapi-keyex authentication. */
    gssapiKeyExchangeAuthentication?: boolean;
    protocolVersionExchange?: ProtocolVersionExchange;
    authenticationMethodsOrder?: readonly SSHAuthenticationMethods[];
    /** Public-key and host-based user-authentication signature algorithms the client may use. */
    authenticationSignatureAlgorithms?: readonly string[];
    /** Integer milliseconds between keepalive probes. Zero disables; maximum 2147483647. */
    keepaliveInterval?: number;
    keepaliveCountMax?: number;
    /** Protected wire bytes allowed per key in either direction. Zero disables this limit. */
    rekeyBytes?: number;
    /** Milliseconds a transport key may remain active. Zero disables this limit. */
    rekeyInterval?: number;
    /**
     * Maximum integer milliseconds for TCP connection, SSH handshake, and authentication.
     * Zero disables; maximum 2147483647.
     */
    readyTimeout?: number;
    /** Integer milliseconds of direct TCP inactivity. Zero disables; maximum 2147483647. */
    timeout?: number;
    /** Maximum integer milliseconds for an ordered peer reply. Range: 1 through 2147483647. */
    replyTimeout?: number;
    /** Maximum peer channel-open decisions allowed to remain pending. */
    maxPendingChannelOpens?: number;
    /** Maximum simultaneous active and pending SSH channels. */
    maxChannels?: number;
    /** Already-connected duplex transport, such as an SSH direct-tcpip channel. */
    sock?: Duplex;
}

export interface ClientSessionOptions {
    agentForward?: boolean;
    allowHalfOpen?: boolean;
    env?: ClientEnvironment;
    pty?: boolean | ClientPtyOptions;
    x11?: boolean | number | ClientX11Options;
}

export declare class GlobalRequestError extends Error {
    name: string;
}

/** Wire name used for the post-authentication host-key advertisement. */
export type HostKeyAdvertisementFormat = "standard" | "compatibility";

export declare class SSHHTTPAgent extends HTTPAgent {
    /** Persistent host-key policy applied to every underlying SSH connection. */
    get hooker(): Hooker<Pick<ClientHooker, "hostKey">>;
    constructor(clientOptions: Readonly<ClientOptions>, options?: SSHHTTPAgentOptions);
    createConnection(options: ConnectionRequest, callback: ConnectionCallback): undefined;
    destroy(): void;
}

export declare class SSHHTTPSAgent extends HTTPSAgent {
    /** Persistent host-key policy applied to every underlying SSH connection. */
    get hooker(): Hooker<Pick<ClientHooker, "hostKey">>;
    constructor(clientOptions: Readonly<ClientOptions>, options?: SSHHTTPSAgentOptions);
    createConnection(options: ConnectionRequest, callback: ConnectionCallback): undefined;
    destroy(): void;
}

export default class Server extends EventEmitter<ServerEvents> {
    constructor(options: ServerOptions, connectionListener?: ServerConnectionListener);
    hooker: Hooker<ServerHooker>;
    server: net.Server;
    clients: Set<ServerClient>;
    readonly algorithmOffer: ResolvedAlgorithmOptions;
    get maxConnections(): number;
    set maxConnections(value: number);
    /** Whether the owned TCP server is currently accepting connections. */
    get listening(): boolean;
    /** Synchronous snapshot of TCP and injected transports currently owned by the server. */
    get connections(): number;
    listen(port?: number, hostname?: string, backlog?: number): this;
    listen(port?: number, backlog?: number): this;
    listen(path: string, backlog?: number): this;
    listen(options: net.ListenOptions): this;
    listen(handle: unknown, backlog?: number): this;
    injectSocket(socket: ServerTransport): this;
    address(): ReturnType<net.Server["address"]>;
    getConnections(): Promise<number>;
    [Symbol.asyncDispose](): Promise<void>;
    /**
     * Stop accepting connections and settle when the TCP listener closes.
     *
     * Concurrent calls share the same Promise. Existing TCP connections retain the native
     * `net.Server.close()` behavior and must finish before it settles.
     */
    close(): Promise<void>;
    ref(): this;
    unref(): this;
    debug(...message: unknown[]): void;
}

export interface ServerAuthenticationContinuation {
    partialSuccess?: boolean;
    authenticationMethods?: SSHAuthenticationMethods[];
}

export default class ServerClient extends EventEmitter<ServerClientEvents> {
    connectionId: string;
    peerDisconnect?: Readonly<PeerDisconnectInfo>;
    server: Server;
    queue: ActionQueue<string>;
    constructor(socket: ServerTransport, server: Server);
    clientProtocolVersion?: ProtocolVersionExchange;
    /** The most recent key exchange hash, returned as a defensive copy. */
    get exchangeHash(): Buffer | undefined;
    /** The negotiated key exchange algorithm name. */
    get keyExchangeAlgorithm(): string | undefined;
    /** The currently active transport algorithm names. */
    get negotiatedAlgorithms(): Readonly<NegotiatedAlgorithms> | undefined;
    get sessionID(): Buffer | undefined;
    hasReceivedNewKeys: boolean;
    hasSentNewKeys: boolean;
    hasAuthenticated: boolean;
    /** The successfully authenticated SSH username, or undefined before authentication. */
    get username(): string | undefined;
    /** The SSH method that completed authentication, or undefined before authentication. */
    get authenticationMethod(): string | undefined;
    localChannelIndex: number;
    channels: Map<number, Channel>;
    agentForwardingEnabled: boolean;
    get noMoreSessions(): boolean;
    get clientExtensions(): readonly Readonly<SSHExtension>[];
    /** Whether the client advertises correct post-authentication global-request handling. */
    get clientSupportsGlobalRequests(): boolean;
    /** Whether the client permits one EXT_INFO update after authentication starts. */
    get clientSupportsAuthenticationExtensionInfo(): boolean;
    /** The client's advertised RFC 8308 operating-system elevation preference. */
    get clientElevationPreference(): ElevationRequest | undefined;
    /** Whether RFC 8308 no-flow-control is active for this connection. */
    get noFlowControl(): boolean;
    [authorizeAgentForwarding](protocol: AgentForwardingProtocol): void;
    state: SocketState;
    get isConnected(): boolean;
    openssh_forwardAgent(): Promise<ForwardedAgentChannel>;
    /** Open an agent channel using the form authorized by the client request. */
    forwardAgent(): Promise<ForwardedAgentChannel>;
    forwardOut(boundAddress: string, boundPort: number, remoteAddress: string, remotePort: number): Promise<ForwardedTCPIPChannel>;
    forwardOutStreamLocal(socketPath: string): Promise<ForwardedStreamLocalChannel>;
    openssh_forwardOutStreamLocal(socketPath: string): Promise<ForwardedStreamLocalChannel>;
    registerX11Forwarding(sessionId: number, single: boolean): void;
    unregisterX11Forwarding(sessionId: number): void;
    x11(originatorAddress: string, originatorPort: number): Promise<ForwardedX11Channel>;
    get remoteAddress(): string | undefined;
    /** Gracefully close the connection with an application disconnect. */
    end(): this;
    /**
     * Gracefully disconnect and settle after terminal transport cleanup.
     *
     * Concurrent calls share the same Promise.
     */
    close(): Promise<void>;
    [Symbol.asyncDispose](): Promise<void>;
    disconnect(error?: DisconnectError): this;
    terminate(): this;
    setNoDelay(noDelay?: boolean): this;
    rekey(): Promise<void>;
    sendDebug(message: string, alwaysDisplay?: boolean, languageTag?: string): this;
    sendIgnore(data: Buffer): this;
    sendAuthenticationExtensions(extensions: readonly SSHExtension[]): this;
    globalRequest(name: string, args?: Buffer): Promise<Buffer>;
    connect(): Promise<void>;
    handleAuthentication(): Promise<void>;
    sendPacket(packet: Packet): number;
    debug(...message: unknown[]): void;
    onMessage(message: Buffer): void;
}

export interface ServerClientEvents {
    error: [
        error: Error
    ];
    /** The peer transport reached EOF; terminal close cleanup follows. */
    end: [
    ];
    close: [
    ];
    /** Terminal disconnect received from the peer. */
    disconnect: [
        info: Readonly<PeerDisconnectInfo>
    ];
    /** Human-readable transport diagnostic sent by the peer. */
    protocolDebug: [
        info: Readonly<ProtocolDebugMessage>
    ];
    connect: [
    ];
    /** Authentication completed and connection-layer operations are available. */
    ready: [
    ];
    debug: [
        ...message: unknown[]
    ];
    clientProtocolVersion: [
        version: ProtocolVersionExchange
    ];
    tcpWrapperLog: [
        message: string
    ];
    /** Payload-free metadata for an inbound binary packet. */
    packet: [
        metadata: Readonly<ProtocolPacketMetadata>
    ];
    /** The peer rejected an outbound packet with this sequence number. */
    unimplemented: [
        sequenceNumber: number
    ];
    clientKexInit: [
        kexInit: KexInit,
        payload: Buffer
    ];
    clientKexDHInit: [
        kexDHInit: KexDHInit
    ];
    clientKexDHGexRequest: [
        request: KexDHGexRequest | KexDHGexRequestOld
    ];
    clientKexDHGexInit: [
        init: KexDHGexInit
    ];
    clientKexRSASecret: [
        secret: KexRSASecret
    ];
    clientNewKeys: [
    ];
    serverNewKeys: [
    ];
    handshake: [
        negotiated: Readonly<NegotiatedAlgorithms>
    ];
    rekey: [
    ];
    /** Complete client extension set received at the RFC 8308 opportunity. */
    clientExtensions: [
        extensions: readonly Readonly<SSHExtension>[]
    ];
    channel: [
        channel: Channel
    ];
}

/** TCP endpoint metadata captured when a connection is admitted. */
export interface ServerConnectionInfo {
    readonly remoteAddress?: string;
    readonly remoteFamily?: string;
    readonly remotePort?: number;
    readonly localAddress?: string;
    readonly localFamily?: string;
    readonly localPort?: number;
}

export type ServerConnectionListener = (client: ServerClient, info: Readonly<ServerConnectionInfo>) => void;

export interface ServerEvents {
    debug: unknown[];
    close: [
    ];
    error: [
        error: Error
    ];
    listening: [
    ];
    drop: [
        info: Readonly<ServerConnectionInfo>
    ];
    connection: [
        client: ServerClient,
        info: Readonly<ServerConnectionInfo>
    ];
}

export declare class ServerGlobalRequestError extends Error {
    name: string;
}

export type ServerHooker = {
    preconnect: [
        preconnectController: ServerHookerPreconnectController,
        client: ServerClient
    ];
    noneAuthentication: [
        noneAuthenticationContext: Readonly<ServerHookerNoneAuthenticationContext>,
        noneAuthenticationController: ServerHookerNoneAuthenticationController,
        client: ServerClient
    ];
    publicKeyAuthentication: [
        publicKeyAuthenticationContext: Readonly<ServerHookerPublicKeyAuthenticationContext>,
        publicKeyAuthenticationController: ServerHookerPublicKeyAuthenticationController,
        client: ServerClient
    ];
    hostbasedAuthentication: [
        hostbasedAuthenticationContext: ServerHookerHostbasedAuthenticationContext,
        hostbasedAuthenticationController: ServerHookerHostbasedAuthenticationController,
        client: ServerClient
    ];
    passwordAuthentication: [
        passwordAuthenticationContext: Readonly<ServerHookerPasswordAuthenticationContext>,
        passwordAuthenticationController: ServerHookerPasswordAuthenticationController,
        client: ServerClient
    ];
    keyboardInteractiveAuthentication: [
        keyboardInteractiveAuthenticationContext: ServerHookerKeyboardInteractiveAuthenticationContext,
        keyboardInteractiveAuthenticationController: ServerHookerKeyboardInteractiveAuthenticationController,
        client: ServerClient
    ];
    gssapiAuthentication: [
        gssapiAuthenticationContext: ServerHookerGSSAPIAuthenticationContext,
        gssapiAuthenticationController: ServerHookerGSSAPIAuthenticationController,
        client: ServerClient
    ];
    elevation: [
        context: ServerHookerElevationContext,
        controller: ServerHookerElevationController,
        client: ServerClient
    ];
    channelOpenRequest: [
        channel: Channel,
        channelOpenRequestController: ServerHookerChannelOpenRequestController,
        client: ServerClient
    ];
    channelRequest: [
        channel: Channel,
        channelRequestController: ServerHookerChannelRequestController,
        client: ServerClient,
        request: ChannelRequest
    ];
    tcpipForward: [
        context: ServerHookerTCPIPForwardContext,
        controller: ServerHookerTCPIPForwardController,
        client: ServerClient
    ];
    streamLocalForward: [
        context: ServerHookerStreamLocalForwardContext,
        controller: ServerHookerStreamLocalForwardController,
        client: ServerClient
    ];
    globalRequest: [
        context: ServerHookerGlobalRequestContext,
        controller: ServerHookerGlobalRequestController,
        client: ServerClient
    ];
};

export interface ServerHookerChannelOpenRequestController {
    allowOpen: boolean;
    /** Validated failure metadata sent when this policy denies the channel. */
    rejection?: ChannelOpenError;
}

export interface ServerHookerChannelRequestController {
    deny: boolean;
    /** Marks an otherwise unknown request as handled by this hook. */
    handled?: boolean;
    /** Success reply used when `handled` is true. */
    success?: boolean;
}

export type ServerHookerElevationContext = Readonly<{
    preference: ElevationRequest;
    username: string;
}>;

export interface ServerHookerElevationController {
    /** Actual operating-system elevation state after policy completes. */
    elevated?: boolean;
}

export type ServerHookerGlobalRequestContext = Readonly<{
    name: string;
    args: Buffer;
    wantReply: boolean;
}>;

export interface ServerHookerGlobalRequestController {
    success: boolean;
    response?: Buffer;
}

export type ServerHookerGSSAPIAuthenticationContext = Readonly<{
    username: string;
    service: string;
    mechanismOID: Buffer;
    integrity: boolean;
    peerIdentity?: unknown;
    delegatedCredentials?: unknown;
}>;

export interface ServerHookerGSSAPIAuthenticationController extends ServerAuthenticationContinuation {
    allowLogin: boolean;
}

export type ServerHookerHostbasedAuthenticationContext = Readonly<{
    username: string;
    publicKey: PublicKey;
    algorithm: string;
    clientHostname: string;
    clientUsername: string;
    signature: EncodedSignature;
    signatureMessage: Buffer;
    remoteAddress?: string;
    remotePort?: number;
}>;

export interface ServerHookerHostbasedAuthenticationController extends ServerAuthenticationContinuation {
    allowLogin: boolean;
}

export type ServerHookerKeyboardInteractiveAuthenticationContext = Readonly<{
    username: string;
    languageTag: string;
    submethods: string;
    responses?: readonly string[];
    round: number;
}>;

export interface ServerHookerKeyboardInteractiveAuthenticationController extends ServerAuthenticationContinuation {
    allowLogin: boolean;
    name?: string;
    instruction?: string;
    languageTag?: string;
    prompts?: ServerKeyboardInteractivePrompt[];
}

export type ServerHookerNoneAuthenticationContext = Readonly<{
    username: string;
}>;

export interface ServerHookerNoneAuthenticationController {
    allowLogin: boolean;
}

export type ServerHookerPasswordAuthenticationContext = Readonly<{
    username: string;
    password: string;
    newPassword?: string;
}>;

export interface ServerHookerPasswordAuthenticationController extends ServerAuthenticationContinuation {
    allowLogin: boolean;
    requestPasswordChange?: {
        prompt: string;
        languageTag?: string;
    };
}

export interface ServerHookerPreconnectController {
    allowConnection: boolean;
}

export type ServerHookerPublicKeyAuthenticationContext = Readonly<{
    username: string;
    publicKey: PublicKey;
    /** Parsed certificate metadata when `publicKey` is a certificate. */
    certificate?: SSHCertificatePublicKey;
    algorithm: string;
    signature?: EncodedSignature;
    signatureMessage: Buffer;
    /** Whether the signed request binds the identity to this server host key. */
    hostbound: boolean;
    serverHostKey?: PublicKey;
}>;

export interface ServerHookerPublicKeyAuthenticationController extends ServerAuthenticationContinuation {
    requestSignature: boolean;
    allowLogin: boolean;
    /** Vendor critical options which application policy fully enforced for this request. */
    handledCertificateCriticalOptions?: readonly string[];
}

export type ServerHookerStreamLocalForwardContext = Readonly<{
    socketPath: string;
}>;

export interface ServerHookerStreamLocalForwardController {
    allow: boolean;
}

export type ServerHookerTCPIPForwardContext = Readonly<{
    bindAddress: string;
    bindPort: number;
}>;

export interface ServerHookerTCPIPForwardController {
    allow: boolean;
}

export interface ServerHostKeyInput {
    key: PrivateKey | string | Buffer;
    passphrase?: string | Buffer;
}

export interface ServerKeyboardInteractivePrompt {
    prompt: string;
    echo: boolean;
}

export interface ServerOptions {
    protocolVersionExchange?: ProtocolVersionExchange;
    /** Custom SSH software identifier and optional comments, without the `SSH-2.0-` prefix. */
    ident?: string | Buffer;
    /** Informational text sent before the SSH identification. */
    greeting?: string;
    algorithms?: ServerAlgorithmOptions;
    /** Persistent server identities. Use an empty array only with RFC 4462 null host-key KEX. */
    hostKeys: (PrivateKey | string | Buffer | ServerHostKeyInput)[];
    /** Public host certificates paired with matching entries in `hostKeys`. */
    hostCertificates?: (PublicKey | string | Buffer)[];
    /** Send the complete host-key set after authentication. */
    sendAllHostKeys?: boolean;
    /** Use the standardized or deployed compatibility advertisement name. */
    hostKeyAdvertisementFormat?: HostKeyAdvertisementFormat;
    /** RFC 4252 banner sent once before authentication begins. */
    banner?: string;
    /** RFC 3066 language tag sent with `banner`; empty means unspecified. */
    bannerLanguageTag?: string;
    /** Public-key and host-based user-authentication signature algorithms accepted by the server. */
    authenticationSignatureAlgorithms?: readonly string[];
    /**
     * Integer milliseconds through key exchange and user-auth service acceptance.
     * Zero disables; maximum 2147483647.
     */
    handshakeTimeout?: number;
    /**
     * Integer milliseconds after accepting the user-authentication service.
     * Zero disables; maximum 2147483647.
     */
    authenticationTimeout?: number;
    /** Maximum integer milliseconds for an ordered peer reply. Range: 1 through 2147483647. */
    replyTimeout?: number;
    /** Maximum peer channel-open decisions allowed to remain pending per connection. */
    maxPendingChannelOpens?: number;
    /** Maximum simultaneous active and pending SSH channels per connection. */
    maxChannels?: number;
    /** Readable and writable stream buffer threshold for server-owned accepted TCP sockets. */
    highWaterMark?: number;
    /** Maximum active TCP and stream-local remote forwarding listeners per connection. */
    maxRemoteForwardings?: number;
    /** Maximum environment variables retained by one server session channel. */
    maxSessionEnvironmentVariables?: number;
    /** Maximum UTF-8 bytes retained in one server session channel's environment. */
    maxSessionEnvironmentBytes?: number;
    /** Maximum rejected non-`none` authentication requests per connection. */
    maxAuthenticationAttempts?: number;
    /**
     * Integer milliseconds between authenticated keepalive probes.
     * Zero disables; maximum 2147483647.
     */
    keepaliveInterval?: number;
    /** Consecutive unanswered probes allowed before terminating a connection. */
    keepaliveCountMax?: number;
    /** Protected wire bytes allowed per key in either direction. Zero disables this limit. */
    rekeyBytes?: number;
    /** Milliseconds a transport key may remain active. Zero disables this limit. */
    rekeyInterval?: number;
    /** RFC 4462 GSS-API mechanisms accepted by this server. */
    gssapi?: readonly GSSAPIServerMechanism[];
    /** RFC 8308 infinite channel windows. Both peers must opt in and one must prefer it. */
    noFlowControl?: NoFlowControlPreference;
    /** RFC 8308 post-authentication compression renegotiation. */
    delayCompression?: DelayCompressionConfiguration;
}

/** Connected duplex transport accepted by an SSH server. */
export interface ServerTransport extends Duplex {
    readonly remoteAddress?: string;
    readonly remoteFamily?: string;
    readonly remotePort?: number;
    readonly localAddress?: string;
    readonly localFamily?: string;
    readonly localPort?: number;
    setNoDelay?(noDelay?: boolean): unknown;
}

export interface SSHAgentOptions {
    /** Originator address reported in the RFC 4254 direct-tcpip request. */
    sourceHost?: string;
    /** Originator port reported in the RFC 4254 direct-tcpip request. */
    sourcePort?: number;
}

export declare class SSHHTTPAgent extends HTTPAgent {
    /** Persistent host-key policy applied to every underlying SSH connection. */
    get hooker(): Hooker<Pick<ClientHooker, "hostKey">>;
    constructor(clientOptions: Readonly<ClientOptions>, options?: SSHHTTPAgentOptions);
    createConnection(options: ConnectionRequest, callback: ConnectionCallback): undefined;
    destroy(): void;
}

export type SSHHTTPAgentOptions = HTTPAgentOptions & SSHAgentOptions;

export declare class SSHHTTPSAgent extends HTTPSAgent {
    /** Persistent host-key policy applied to every underlying SSH connection. */
    get hooker(): Hooker<Pick<ClientHooker, "hostKey">>;
    constructor(clientOptions: Readonly<ClientOptions>, options?: SSHHTTPSAgentOptions);
    createConnection(options: ConnectionRequest, callback: ConnectionCallback): undefined;
    destroy(): void;
}

export type SSHHTTPSAgentOptions = HTTPSAgentOptions & SSHAgentOptions;