Agents and public-key management

export default abstract class Agent<Id = string> {
    abstract type: AgentType;
    getStream?(): Promise<Duplex>;
    abstract sign(id: Id, data: Buffer, algorithm?: string): Promise<EncodedSignature>;
    abstract getPublicKeys(): Promise<[
        Id,
        PublicKey
    ][]>;
    abstract getPublicKey(id: Id): Promise<PublicKey>;
}

export declare class AgentError extends Error {
    name: string;
}

export declare enum AgentType {
    Interactive = 0,
    NonInteractive = 1
}

/** Construct the socket-backed agent appropriate for the current platform and path. */
export declare function createSocketAgent(socketPath: string): Agent<string>;

/** A signing agent transported through Cygwin's legacy AF_UNIX socket-file protocol. */
export default class CygwinAgent extends Agent<string> {
    readonly type = AgentType.NonInteractive;
    readonly socketPath: string;
    readonly options: Readonly<Required<CygwinAgentOptions>>;
    constructor(socketPath: string, options?: CygwinAgentOptions);
    getPublicKeys(): Promise<[
        string,
        PublicKey
    ][]>;
    getPublicKey(id: string): Promise<PublicKey>;
    sign(id: string, data: Buffer, algorithm?: string): Promise<EncodedSignature>;
    getStream(): Promise<Socket>;
}

export declare class CygwinAgentError extends AgentError {
    name: string;
}

export interface CygwinAgentOptions {
    /** Maximum idle milliseconds for each TCP handshake. Zero disables the deadline. */
    handshakeTimeout?: number;
    /** Maximum bytes read from the Cygwin socket descriptor file. */
    maxSocketFileLength?: number;
}

export declare function decodePublicKeySubsystemPacket(frame: Buffer): PublicKeySubsystemPacket;

/** Discover the named pipe used by Pageant 0.75 and newer for the current Windows user. */
export declare function discoverPageantAgentSocket(): string;

export default class DiskAgent implements Agent<string> {
    type: AgentType;
    readonly directory: string;
    constructor(directory?: string, options?: DiskAgentOptions);
    sign(id: string, data: Buffer, algorithm?: string): Promise<EncodedSignature>;
    getPublicKeys(): Promise<[
        string,
        PublicKey
    ][]>;
    getPublicKey(id: string): Promise<PublicKey>;
}

export declare class DiskAgentError extends AgentError {
    name: string;
}

export interface DiskAgentOptions {
    readonly passphrase?: DiskAgentPassphrase | ((privateKeyPath: string) => DiskAgentPassphrase | Promise<DiskAgentPassphrase>);
    readonly onInvalidPublicKey?: (error: DiskAgentError, publicKeyPath: string) => void | Promise<void>;
}

export type DiskAgentPassphrase = string | Buffer;

export declare function encodePublicKeySubsystemPacket(packet: PublicKeySubsystemPacket): Buffer;

export declare const MAX_OPENSSH_AGENT_ASSOCIATED_CERTIFICATES = 1024;

export declare const MAX_OPENSSH_AGENT_DESTINATION_CONSTRAINTS = 1024;

export declare const MAX_OPENSSH_AGENT_SESSION_BINDINGS = 16;

export declare const MAX_OPENSSH_AGENT_SESSION_IDENTIFIER_LENGTH = 128;

export declare const MAX_PUBLIC_KEY_SUBSYSTEM_NAMESPACE_CHARACTERS = 300;

export declare const MAX_PUBLIC_KEY_SUBSYSTEM_PACKET_LENGTH: number;

export declare const MAX_PUBLIC_KEY_SUBSYSTEM_RESPONSE_BYTES: number;

export declare const MAX_PUBLIC_KEY_SUBSYSTEM_RESPONSES = 1024;

export declare const MAX_SSH_AGENT_MESSAGE_LENGTH: number;

export default class OnePasswordAgent extends SSHAgent {
    type: AgentType;
    constructor(agentSocketPath?: string);
}

export declare class OnePasswordAgentError extends SSHAgentError {
    name: string;
}

export declare const OPENSSH_AGENT_ASSOCIATED_CERTIFICATES = "associated-certs-v00@openssh.com";

export declare const OPENSSH_AGENT_RESTRICT_DESTINATION = "restrict-destination-v00@openssh.com";

export declare const OPENSSH_AGENT_SECURITY_KEY_PROVIDER = "sk-provider@openssh.com";

export declare const OPENSSH_AGENT_SESSION_BIND = "session-bind@openssh.com";

export type OpenSSHAgentAssociatedCertificatesConstraint = Readonly<{
    type: "openssh-associated-certificates";
    certificatesOnly?: boolean;
    certificates: readonly PublicKey[];
}>;

export type OpenSSHAgentDestinationConstraint = Readonly<{
    type: "openssh-restrict-destination";
    destinations: readonly OpenSSHAgentDestinationRule[];
}>;

export type OpenSSHAgentDestinationHop = Readonly<{
    hostname: string;
    hostKeys: readonly OpenSSHAgentDestinationKey[];
}>;

export type OpenSSHAgentDestinationKey = Readonly<{
    publicKey: PublicKey;
    certificateAuthority?: boolean;
}>;

export type OpenSSHAgentDestinationRule = Readonly<{
    /** Undefined identifies the initial hop from the machine running the agent. */
    from?: OpenSSHAgentDestinationHop;
    to: Readonly<{
        username?: string;
        hostname: string;
        hostKeys: readonly OpenSSHAgentDestinationKey[];
    }>;
}>;

export type OpenSSHAgentKeyConstraint = OpenSSHAgentDestinationConstraint | OpenSSHAgentAssociatedCertificatesConstraint;

export type OpenSSHAgentSecurityKeyProviderConstraint = Readonly<{
    type: "openssh-security-key-provider";
    provider: string;
}>;

export type OpenSSHAgentSessionBinding = Readonly<{
    hostKey: PublicKey;
    sessionIdentifier: Buffer;
    signature: EncodedSignature;
    forwarding: boolean;
}>;

/** An agent client for Pageant's standard agent-protocol transport. */
export default class PageantAgent extends SSHAgent {
    type: AgentType;
    constructor(socketPath?: string);
}

export declare class PageantAgentError extends SSHAgentError {
    name: string;
}

export default class PrivateKeyAgent extends Agent<string> {
    readonly type = AgentType.NonInteractive;
    constructor(keys: PrivateKey | readonly PrivateKey[]);
    getPublicKeys(): Promise<[
        string,
        PublicKey
    ][]>;
    getPublicKey(id: string): Promise<PublicKey>;
    sign(id: string, data: Buffer, algorithm?: string): Promise<EncodedSignature>;
}

export declare class PrivateKeyAgentError extends AgentError {
    name: string;
}

export declare const PUBLIC_KEY_SUBSYSTEM_VERSION = 3;

export interface PublicKeySubsystemAddAttribute {
    readonly name: string;
    readonly value: Buffer;
    readonly critical: boolean;
}

export interface PublicKeySubsystemAddCertificateOptions extends PublicKeySubsystemAddOptions {
    readonly namespace: string;
}

export interface PublicKeySubsystemAddCertificatePacket {
    readonly type: "add-certificate";
    readonly format: string;
    readonly certificateBlob: Buffer;
    readonly overwrite: boolean;
    readonly attributes: readonly PublicKeySubsystemAddAttribute[];
}

export interface PublicKeySubsystemAddOptions {
    readonly overwrite?: boolean;
    readonly namespace?: string;
    readonly attributes?: readonly PublicKeySubsystemAttributeInput[];
}

export interface PublicKeySubsystemAddPacket {
    readonly type: "add";
    readonly algorithm: string;
    readonly keyBlob: Buffer;
    readonly overwrite: boolean;
    readonly attributes: readonly PublicKeySubsystemAddAttribute[];
}

export interface PublicKeySubsystemAttributeInput {
    readonly name: string;
    readonly value: string | Buffer;
    readonly critical?: boolean;
}

export interface PublicKeySubsystemAttributePacket {
    readonly type: "attribute";
    readonly name: string;
    readonly compulsory: boolean;
}

export interface PublicKeySubsystemCertificate {
    readonly format: string;
    readonly certificate: Buffer;
    readonly namespace: string;
    readonly attributes: readonly PublicKeySubsystemListedAttribute[];
}

export interface PublicKeySubsystemCertificatePacket {
    readonly type: "certificate";
    readonly format: string;
    readonly certificateBlob: Buffer;
    readonly attributes: readonly PublicKeySubsystemListedAttribute[];
}

export default class PublicKeySubsystemClient {
    readonly protocolVersion = 3;
    readonly channel: ClientSessionChannel;
    readonly requestTimeout: number;
    get negotiatedProtocolVersion(): number | undefined;
    static connect(channel: ClientSessionChannel, options?: PublicKeySubsystemClientOptions): Promise<PublicKeySubsystemClient>;
    add(key: PublicKey, options?: PublicKeySubsystemAddOptions): Promise<void>;
    remove(key: PublicKey, options?: PublicKeySubsystemRequestOptions): Promise<void>;
    list(options?: PublicKeySubsystemRequestOptions): Promise<readonly PublicKeySubsystemKey[]>;
    addCertificate(format: string, certificate: Buffer, options: PublicKeySubsystemAddCertificateOptions): Promise<void>;
    removeCertificate(format: string, certificate: Buffer, options: PublicKeySubsystemRemoveCertificateOptions): Promise<void>;
    listCertificates(): Promise<readonly PublicKeySubsystemCertificate[]>;
    listNamespaces(): Promise<readonly string[]>;
    listAttributes(): Promise<readonly PublicKeySubsystemSupportedAttribute[]>;
    end(): void;
    /** Close the subsystem and settle after its SSH channel closes. */
    close(): Promise<void>;
    [Symbol.asyncDispose](): Promise<void>;
    destroy(error?: Error): void;
}

export interface PublicKeySubsystemClientOptions {
    /** Maximum integer milliseconds for initialization or a reply. Range: 1 through 2147483647. */
    requestTimeout?: number;
}

export interface PublicKeySubsystemKey {
    readonly key: PublicKey;
    readonly namespace?: string;
    readonly attributes: readonly PublicKeySubsystemListedAttribute[];
}

export interface PublicKeySubsystemListAttributesPacket {
    readonly type: "listattributes";
}

export interface PublicKeySubsystemListCertificatesPacket {
    readonly type: "list-certificates";
}

export interface PublicKeySubsystemListedAttribute {
    readonly name: string;
    readonly value: Buffer;
}

export interface PublicKeySubsystemListNamespacesPacket {
    readonly type: "list-namespaces";
}

export interface PublicKeySubsystemListPacket {
    readonly type: "list";
    /** Present on RFC 7076 version-3 requests and absent on RFC 4819 version-2 requests. */
    readonly attributes?: readonly PublicKeySubsystemAddAttribute[];
}

export interface PublicKeySubsystemNamespacePacket {
    readonly type: "namespace";
    readonly name: string;
}

export type PublicKeySubsystemPacket = PublicKeySubsystemVersionPacket | PublicKeySubsystemAddPacket | PublicKeySubsystemStatusPacket | PublicKeySubsystemRemovePacket | PublicKeySubsystemListPacket | PublicKeySubsystemListAttributesPacket | PublicKeySubsystemPublicKeyPacket | PublicKeySubsystemAttributePacket | PublicKeySubsystemAddCertificatePacket | PublicKeySubsystemRemoveCertificatePacket | PublicKeySubsystemListCertificatesPacket | PublicKeySubsystemCertificatePacket | PublicKeySubsystemListNamespacesPacket | PublicKeySubsystemNamespacePacket | PublicKeySubsystemUnknownPacket;

export declare class PublicKeySubsystemPacketParser {
    push(chunk: Buffer): PublicKeySubsystemPacket[];
    end(): void;
}

export declare class PublicKeySubsystemProtocolError extends Error {
    constructor(message: string);
}

export interface PublicKeySubsystemPublicKeyPacket {
    readonly type: "publickey";
    readonly algorithm: string;
    readonly keyBlob: Buffer;
    readonly attributes: readonly PublicKeySubsystemListedAttribute[];
}

export interface PublicKeySubsystemRemoveCertificateOptions extends PublicKeySubsystemRequestOptions {
    readonly namespace: string;
}

export interface PublicKeySubsystemRemoveCertificatePacket {
    readonly type: "remove-certificate";
    readonly format: string;
    readonly certificateBlob: Buffer;
    readonly attributes: readonly PublicKeySubsystemListedAttribute[];
}

export interface PublicKeySubsystemRemovePacket {
    readonly type: "remove";
    readonly algorithm: string;
    readonly keyBlob: Buffer;
    /** Present on RFC 7076 version-3 requests and absent on RFC 4819 version-2 requests. */
    readonly attributes?: readonly PublicKeySubsystemAddAttribute[];
}

export interface PublicKeySubsystemRequestOptions {
    readonly namespace?: string;
    readonly attributes?: readonly PublicKeySubsystemAttributeInput[];
}

export default class PublicKeySubsystemServer extends EventEmitter<PublicKeySubsystemServerEvents> {
    readonly protocolVersion = 3;
    readonly stream: Shell;
    readonly hooker: Hooker<PublicKeySubsystemServerHooker>;
    readonly attributes: readonly Readonly<Required<PublicKeySubsystemSupportedAttribute>>[];
    get negotiatedProtocolVersion(): number | undefined;
    constructor(stream: Shell, options?: PublicKeySubsystemServerOptions);
    destroy(error?: Error): void;
    /** Close the subsystem and settle after its SSH channel closes. */
    close(): Promise<void>;
    [Symbol.asyncDispose](): Promise<void>;
}

export interface PublicKeySubsystemServerAddCertificateContext {
    readonly format: string;
    readonly certificate: Buffer;
    readonly overwrite: boolean;
    readonly namespace: string;
    readonly attributes: readonly PublicKeySubsystemAddAttribute[];
}

export interface PublicKeySubsystemServerAddContext {
    readonly key: PublicKey;
    readonly overwrite: boolean;
    readonly attributes: readonly PublicKeySubsystemAddAttribute[];
    readonly namespace?: string;
}

export type PublicKeySubsystemServerEvents = {
    ready: [
        clientVersion: number
    ];
    close: [
    ];
    error: [
        error: Error
    ];
};

export type PublicKeySubsystemServerHooker = {
    add: [
        context: Readonly<PublicKeySubsystemServerAddContext>,
        controller: PublicKeySubsystemServerResponseController,
        operation: Readonly<PublicKeySubsystemServerOperationContext>
    ];
    remove: [
        context: Readonly<PublicKeySubsystemServerRemoveContext>,
        controller: PublicKeySubsystemServerResponseController,
        operation: Readonly<PublicKeySubsystemServerOperationContext>
    ];
    list: [
        controller: PublicKeySubsystemServerListController,
        context: Readonly<PublicKeySubsystemServerListContext>,
        operation: Readonly<PublicKeySubsystemServerOperationContext>
    ];
    addCertificate: [
        context: Readonly<PublicKeySubsystemServerAddCertificateContext>,
        controller: PublicKeySubsystemServerResponseController,
        operation: Readonly<PublicKeySubsystemServerOperationContext>
    ];
    removeCertificate: [
        context: Readonly<PublicKeySubsystemServerRemoveCertificateContext>,
        controller: PublicKeySubsystemServerResponseController,
        operation: Readonly<PublicKeySubsystemServerOperationContext>
    ];
    listCertificates: [
        controller: PublicKeySubsystemServerListCertificatesController,
        operation: Readonly<PublicKeySubsystemServerOperationContext>
    ];
    listNamespaces: [
        controller: PublicKeySubsystemServerListNamespacesController,
        operation: Readonly<PublicKeySubsystemServerOperationContext>
    ];
};

export interface PublicKeySubsystemServerListCertificatesController extends PublicKeySubsystemServerResponseController {
    certificates?: readonly PublicKeySubsystemServerListedCertificate[];
}

export interface PublicKeySubsystemServerListContext {
    readonly attributes: readonly PublicKeySubsystemAddAttribute[];
    readonly namespace?: string;
}

export interface PublicKeySubsystemServerListController extends PublicKeySubsystemServerResponseController {
    keys?: readonly PublicKeySubsystemServerListedKey[];
}

export interface PublicKeySubsystemServerListedAttribute {
    readonly name: string;
    readonly value: string | Buffer;
}

export interface PublicKeySubsystemServerListedCertificate {
    readonly format: string;
    readonly certificate: Buffer;
    readonly namespace: string;
    readonly attributes?: readonly PublicKeySubsystemServerListedAttribute[];
}

export interface PublicKeySubsystemServerListedKey {
    readonly key: PublicKey;
    readonly attributes?: readonly PublicKeySubsystemServerListedAttribute[];
}

export interface PublicKeySubsystemServerListNamespacesController extends PublicKeySubsystemServerResponseController {
    namespaces?: readonly string[];
}

export interface PublicKeySubsystemServerOperationContext {
    /** Aborted when this request expires or its subsystem channel closes. */
    readonly signal: AbortSignal;
}

export interface PublicKeySubsystemServerOptions {
    readonly attributes?: readonly PublicKeySubsystemSupportedAttribute[];
    /** Integer milliseconds to wait for close. Defaults to 30000; range: 1 through 2147483647. */
    readonly closeTimeout?: number;
    /**
     * Integer milliseconds for initialization, policy, and response writes.
     * Defaults to 30000; range: 1 through 2147483647.
     */
    readonly requestTimeout?: number;
}

export interface PublicKeySubsystemServerRemoveCertificateContext {
    readonly format: string;
    readonly certificate: Buffer;
    readonly namespace: string;
    readonly attributes: readonly PublicKeySubsystemListedAttribute[];
}

export interface PublicKeySubsystemServerRemoveContext {
    readonly key: PublicKey;
    readonly attributes: readonly PublicKeySubsystemAddAttribute[];
    readonly namespace?: string;
}

export interface PublicKeySubsystemServerResponseController {
    success: boolean;
    failureCode?: number;
    description?: string;
    languageTag?: string;
}

export declare enum PublicKeySubsystemStatusCode {
    Success = 0,
    AccessDenied = 1,
    StorageExceeded = 2,
    VersionNotSupported = 3,
    KeyNotFound = 4,
    KeyNotSupported = 5,
    KeyAlreadyPresent = 6,
    GeneralFailure = 7,
    RequestNotSupported = 8,
    AttributeNotSupported = 9,
    CertificateNotFound = 192,
    CertificateNotSupported = 193,
    CertificateAlreadyPresent = 194,
    ActionNotAuthorized = 195,
    CannotCreateNamespace = 196
}

export declare class PublicKeySubsystemStatusError extends Error {
    readonly code: number;
    readonly languageTag: string;
    constructor(code: number, description: string, languageTag: string);
}

export interface PublicKeySubsystemStatusPacket {
    readonly type: "status";
    readonly code: number;
    readonly description: string;
    readonly languageTag: string;
}

export interface PublicKeySubsystemSupportedAttribute {
    readonly name: string;
    readonly compulsory: boolean;
}

export interface PublicKeySubsystemUnknownPacket {
    readonly type: "unknown";
    readonly name: string;
    readonly data: Buffer;
}

export interface PublicKeySubsystemVersionPacket {
    readonly type: "version";
    readonly version: number;
}

export default class SSHAgent implements Agent<string> {
    type: AgentType;
    readonly socketPath: string;
    readonly options: Readonly<Required<SSHSocketAgentOptions>>;
    constructor(socketPath?: string | undefined, options?: SSHSocketAgentOptions);
    sign(id: string, data: Buffer, algorithm?: string): Promise<EncodedSignature>;
    getPublicKeys(): Promise<[
        string,
        PublicKey
    ][]>;
    getPublicKey(id: string): Promise<PublicKey>;
    getStream(): Promise<Socket>;
}

export interface SSHAgentAddIdentityOptions {
    comment?: string;
    constraints?: readonly SSHAgentConstraint[];
}

export interface SSHAgentAddTokenOptions {
    constraints?: readonly SSHAgentConstraint[];
}

export type SSHAgentConstraint = Readonly<{
    type: "lifetime";
    seconds: number;
}> | Readonly<{
    type: "confirm";
}> | Readonly<{
    type: "extension";
    name: string;
    data: Buffer;
}> | OpenSSHAgentSecurityKeyProviderConstraint | OpenSSHAgentKeyConstraint;

export declare enum SSHAgentConstraintType {
    Lifetime = 1,
    Confirm = 2,
    Extension = 255
}

export declare class SSHAgentError extends AgentError {
    name: string;
}

export declare class SSHAgentExtensionFailureError extends SSHAgentProtocolError {
    name: string;
}

export type SSHAgentExtensionResult = Readonly<{
    kind: "success";
}> | Readonly<{
    kind: "response";
    contents: Buffer;
}>;

export interface SSHAgentIdentity {
    publicKey: PublicKey;
    comment?: string;
}

export declare enum SSHAgentMessageType {
    Failure = 5,
    Success = 6,
    RequestIdentities = 11,
    IdentitiesAnswer = 12,
    SignRequest = 13,
    SignResponse = 14,
    AddIdentity = 17,
    RemoveIdentity = 18,
    RemoveAllIdentities = 19,
    AddToken = 20,
    RemoveToken = 21,
    Lock = 22,
    Unlock = 23,
    AddConstrainedIdentity = 25,
    AddConstrainedToken = 26,
    Extension = 27,
    ExtensionFailure = 28,
    ExtensionResponse = 29
}

/** A Promise-based client for one already-connected agent protocol stream. */
export declare class SSHAgentProtocolClient extends Agent<string> {
    readonly type = AgentType.NonInteractive;
    readonly stream: Duplex;
    readonly options: Readonly<Required<SSHAgentProtocolOptions>>;
    constructor(stream: Duplex, options?: SSHAgentProtocolOptions);
    getPublicKeys(): Promise<[
        string,
        PublicKey
    ][]>;
    getPublicKey(id: string): Promise<PublicKey>;
    sign(id: string, data: Buffer, algorithm?: string): Promise<EncodedSignature>;
    addIdentity(privateKey: PrivateKey, options?: SSHAgentAddIdentityOptions): Promise<void>;
    addToken(tokenId: string | Buffer, pin?: string | Buffer, options?: SSHAgentAddTokenOptions): Promise<void>;
    removeIdentity(publicKey: PublicKey): Promise<void>;
    removeAllIdentities(): Promise<void>;
    removeToken(tokenId: string, pin?: string | Buffer): Promise<void>;
    lock(passphrase: string | Buffer): Promise<void>;
    unlock(passphrase: string | Buffer): Promise<void>;
    extension(type: string, contents?: Buffer): Promise<SSHAgentExtensionResult>;
    queryExtensions(): Promise<readonly string[]>;
    opensshSessionBind(binding: OpenSSHAgentSessionBinding): Promise<void>;
    /**
     * Drain operations already queued, stop accepting requests, and await stream closure.
     */
    close(): Promise<void>;
    [Symbol.asyncDispose](): Promise<void>;
    destroy(error?: Error): void;
}

export interface SSHAgentProtocolConnectionContext {
    /** The stream supplied to serve(); use object identity to associate application state. */
    readonly stream: Duplex;
    /** True after any session-bind request, including a malformed or refused one. */
    readonly sessionBindAttempted: boolean;
    /** Accepted bindings in forwarding-path order. */
    readonly sessionBindings: readonly OpenSSHAgentSessionBinding[];
    /** Aborted when this served stream closes or its request deadline expires. */
    readonly signal: AbortSignal;
}

export declare class SSHAgentProtocolError extends AgentError {
    name: string;
}

export interface SSHAgentProtocolOptions {
    /** Maximum payload length accepted from the peer. */
    maxMessageLength?: number;
    /** Maximum milliseconds for a client request. Zero disables the deadline. */
    requestTimeout?: number;
}

/** An awaited, deny-by-default agent protocol endpoint for a Duplex stream. */
export declare class SSHAgentProtocolServer {
    readonly hooker: Hooker<SSHAgentServerHooker>;
    readonly options: Readonly<Required<SSHAgentProtocolServerOptions>>;
    constructor(options?: SSHAgentProtocolServerOptions);
    get locked(): boolean;
    serve(stream: Duplex): Promise<void>;
}

export interface SSHAgentProtocolServerOptions {
    /** Maximum payload length accepted from the peer or returned by policy. */
    maxMessageLength?: number;
    /** Maximum milliseconds for queueing, awaited policy, and response writes. */
    requestTimeout?: number;
}

export type SSHAgentServerAddIdentityContext = Readonly<{
    privateKey: PrivateKey;
    comment: string;
    constraints: readonly SSHAgentConstraint[];
}>;

export type SSHAgentServerAddTokenContext = Readonly<{
    /** Opaque token identifier copied from the request. */
    tokenId: Buffer;
    /** Ephemeral PIN bytes. Do not retain this buffer after the hook returns. */
    pin: Buffer;
    constraints: readonly SSHAgentConstraint[];
}>;

export type SSHAgentServerExtensionContext = Readonly<{
    type: string;
    contents: Buffer;
}>;

export interface SSHAgentServerExtensionController {
    /** Undefined means the extension is unsupported and returns SSH_AGENT_FAILURE. */
    result: SSHAgentServerExtensionResult | undefined;
}

export type SSHAgentServerExtensionResult = SSHAgentExtensionResult | Readonly<{
    kind: "failure";
}>;

export type SSHAgentServerHooker = {
    identities: [
        controller: SSHAgentServerIdentitiesController,
        connection: SSHAgentProtocolConnectionContext
    ];
    sign: [
        context: SSHAgentServerSignContext,
        controller: SSHAgentServerSignController,
        connection: SSHAgentProtocolConnectionContext
    ];
    addIdentity: [
        context: SSHAgentServerAddIdentityContext,
        controller: SSHAgentServerSuccessController,
        connection: SSHAgentProtocolConnectionContext
    ];
    addToken: [
        context: SSHAgentServerAddTokenContext,
        controller: SSHAgentServerSuccessController,
        connection: SSHAgentProtocolConnectionContext
    ];
    removeIdentity: [
        context: SSHAgentServerRemoveIdentityContext,
        controller: SSHAgentServerSuccessController,
        connection: SSHAgentProtocolConnectionContext
    ];
    removeAllIdentities: [
        controller: SSHAgentServerSuccessController,
        connection: SSHAgentProtocolConnectionContext
    ];
    removeToken: [
        context: SSHAgentServerRemoveTokenContext,
        controller: SSHAgentServerSuccessController,
        connection: SSHAgentProtocolConnectionContext
    ];
    lock: [
        context: SSHAgentServerPassphraseContext,
        controller: SSHAgentServerSuccessController,
        connection: SSHAgentProtocolConnectionContext
    ];
    unlock: [
        context: SSHAgentServerPassphraseContext,
        controller: SSHAgentServerSuccessController,
        connection: SSHAgentProtocolConnectionContext
    ];
    extension: [
        context: SSHAgentServerExtensionContext,
        controller: SSHAgentServerExtensionController,
        connection: SSHAgentProtocolConnectionContext
    ];
    queryExtensions: [
        controller: SSHAgentServerQueryExtensionsController,
        connection: SSHAgentProtocolConnectionContext
    ];
    sessionBind: [
        binding: OpenSSHAgentSessionBinding,
        controller: SSHAgentServerSuccessController,
        connection: SSHAgentProtocolConnectionContext
    ];
};

export interface SSHAgentServerIdentitiesController {
    /** Leave undefined to deny the request with SSH_AGENT_FAILURE. */
    identities: readonly Readonly<SSHAgentIdentity>[] | undefined;
}

export type SSHAgentServerPassphraseContext = Readonly<{
    /** Ephemeral passphrase bytes. Do not retain this buffer after the hook returns. */
    passphrase: Buffer;
}>;

export interface SSHAgentServerQueryExtensionsController {
    /** Undefined means the query extension is unsupported. */
    extensions: readonly string[] | undefined;
}

export type SSHAgentServerRemoveIdentityContext = Readonly<{
    publicKey: PublicKey;
}>;

export type SSHAgentServerRemoveTokenContext = Readonly<{
    tokenId: string;
    /** Ephemeral UTF-8 PIN bytes. Do not retain this buffer after the hook returns. */
    pin: Buffer;
}>;

export type SSHAgentServerSignContext = Readonly<{
    publicKey: PublicKey;
    data: Buffer;
    /** Exact signature algorithm requested by the agent protocol flags. */
    algorithm: string;
    flags: number;
}>;

export interface SSHAgentServerSignController {
    /** Leave undefined to deny the request with SSH_AGENT_FAILURE. */
    signature: EncodedSignature | undefined;
}

export interface SSHAgentServerSuccessController {
    /** Set to true to accept the request. Undefined and false deny it. */
    success: boolean | undefined;
}

export interface SSHSocketAgentOptions {
    /** Maximum socket inactivity in milliseconds while connecting or exchanging a request. */
    timeout?: number;
}