transport

type AuthOptions struct {
	Passphrase   func() (string, error)
	Password     func() (string, error)
	SecretPrompt SecretPrompt
	DisableAgent bool
	// contains filtered or unexported fields
}

type BackoffPolicy struct {
	Initial time.Duration // 0 => 1s
	Factor  float64       // 0 => 2
	Max     time.Duration // 0 => 60s
}

type Client struct {
	// contains filtered or unexported fields
}

type Clock interface {
	Now() time.Time
	After(d time.Duration) <-chan time.Time
}

type Dialer interface {
	DialContext(ctx context.Context, network, addr string) (net.Conn, error)
}

type EffectiveSSHConfig struct {
	HostName         string
	User             string
	Port             int
	IdentityFiles    []string
	IdentityFileNone bool
	ProxyJump        string
	IdentitiesOnly   bool
}

type ExecResult struct {
	Stdout   []byte
	Stderr   []byte
	ExitCode int
}

type HostEntry struct {
	Name          string
	Host          string
	Port          int // 0 => 22 (or ssh_config value)
	User          string
	IdentityFile  string
	PassphraseEnv string
	PasswordEnv   string
	ProxyJump     string // OpenSSH ProxyJump syntax, comma-separated chain
	UseSSHConfig  bool   // layer ~/.ssh/config values under unset fields
}

type HostKeyMismatchError struct {
	Host                 string
	PresentedFingerprint string
	Locations            []KnownHostLocation
}

type HostKeyPolicy struct {
	// SystemKnownHosts are OpenSSH known_hosts files consulted read-only.
	// Empty => [~/.ssh/known_hosts, ~/.ssh/known_hosts2] when they exist.
	SystemKnownHosts []string
	// ManagedPath is the netdev-managed known_hosts file that accepted TOFU
	// keys are appended to. Empty => defaultNetdevKnownHosts().
	ManagedPath string
	// Prompt decides unknown (first-seen) keys. Nil => strict reject.
	Prompt HostKeyPrompt
	// Verified observes a key only after the known_hosts check (and, for TOFU,
	// the user's acceptance and durable append) succeeded. It lets an assembly
	// layer bind higher-level capabilities to the peer actually authenticated by
	// this transport without weakening HostKeyCallback authority.
	Verified func(HostKeyQuestion)
	// Capture observes a FIRST-SEEN key together with its raw material the
	// moment TOFU would prompt — before any decision. The two-step UI trust
	// flow uses this: capture the key, reject, let the human confirm the
	// fingerprint, then TrustKey() the captured material.
	Capture func(hostname string, remote net.Addr, key ssh.PublicKey)
	// contains filtered or unexported fields
}

type HostKeyPrompt func(ctx context.Context, q HostKeyQuestion) (accept bool, err error)

type HostKeyQuestion struct {
	Host        string // display label (user@host:port or alias)
	Address     string // the network address that presented the key
	KeyType     string // e.g. "ssh-ed25519"
	Fingerprint string // ssh.FingerprintSHA256(key)
}

type ImportedHost struct {
	Alias        string
	HostName     string
	User         string
	Port         int
	IdentityFile string
	ProxyJump    string
}

type JumpHostOptions struct {
	Host ResolvedHost
	Auth AuthOptions
}

type KeepalivePolicy struct {
	Interval  time.Duration // 0 => 30s; <0 disables keepalive
	MaxMisses int           // consecutive failures before declaring the link dead; 0 => 3
	Timeout   time.Duration // per-probe reply timeout; 0 => 10s
}

type KnownHostLocation struct {
	Filename string
	Line     int
}

type LookupEntry func(name string) (HostEntry, bool)

type Options struct {
	Host        ResolvedHost
	Auth        AuthOptions
	JumpHosts   []JumpHostOptions // resolved ProxyJump hosts in chain order
	HostKeys    *HostKeyPolicy
	Dialer      Dialer        // first-hop transport; nil => direct
	DialTimeout time.Duration // default 15s
	Keepalive   KeepalivePolicy
	Backoff     BackoffPolicy
	Clock       Clock // nil => real clock
	Rand        *rand.Rand
}

type ResolvedHost struct {
	Name             string // entry name, or the raw target for ad-hoc dials
	HostName         string // network address to dial
	Port             int
	User             string
	IdentityFile     string   // explicit key path; empty => agent/default identities
	IdentityFiles    []string // ordered effective ssh_config identities
	IdentityFileNone bool     // ssh_config explicitly suppresses default identity files
	IdentitiesOnly   bool     // ssh_config IdentitiesOnly: never offer unrelated agent keys
	PassphraseEnv    string   // credential env var name for the key passphrase
	PasswordEnv      string   // credential env var name for password auth
	ProxyJump        []string // resolved jump chain, in dial order
}

type SSHConfigSource struct {
	// contains filtered or unexported fields
}

type SecretKind int

type SecretPrompt func(ctx context.Context, kind SecretKind, host, identityFile string) (string, error)

type Status int

type StatusEvent struct {
	Host    string // configured host name (or user@host target)
	Status  Status
	Attempt int   // reconnect attempt counter; 0 on the first connect
	Err     error // last error for Reconnecting/Stopped; nil otherwise
	At      time.Time
}