@statewalker/httpeers-share 0.0.0-stage → 0.2.0

package/dist/socket-tunnel.js

@@ -0,0 +1,157 @@
+/**
+ * A WebSocket inside one request over the mesh (M9; rung 15 measured that a
+ * mesh request is full-duplex). The Guest's `openTunnel` sends frames in the
+ * request body and reads them from the response body; the Sharer's
+ * `sharerSocket` relays them to the Service's own socket.
+ */
+import { decodeFrames, encodeFrame, SOCKET_HEADER } from "./socket-frames.js";
+/** The Sharer's side: answer a tunnel request by relaying to `open()`'s socket. */
+export function sharerSocket(request, open) {
+    const ws = open();
+    ws.binaryType = "arraybuffer";
+    const held = [];
+    let out;
+    let done = false;
+    const emit = (frame) => {
+        if (!done)
+            out.enqueue(encodeFrame(frame));
+    };
+    const end = (code, reason) => {
+        emit({ type: "close", code, reason });
+        if (!done) {
+            done = true;
+            out.close();
+        }
+    };
+    const body = new ReadableStream({
+        start(controller) {
+            out = controller;
+            ws.onopen = () => {
+                emit({ type: "open", protocol: ws.protocol });
+                for (const data of held.splice(0))
+                    ws.send(data);
+            };
+            ws.onmessage = (e) => emit(typeof e.data === "string"
+                ? { type: "text", data: e.data }
+                : { type: "binary", data: new Uint8Array(e.data) });
+            ws.onclose = (e) => end(e.code, e.reason);
+            ws.onerror = () => end(1011, "the Service's socket failed");
+        },
+        cancel() {
+            done = true;
+            ws.close();
+        },
+    });
+    // The Guest's frames, as they arrive: the request is still open.
+    void (async () => {
+        if (request.body == null)
+            return;
+        for await (const frame of request.body.pipeThrough(decodeFrames())) {
+            if (frame.type === "close") {
+                ws.close(frame.code === 1000 || frame.code >= 3000 ? frame.code : 1000, frame.reason);
+            }
+            else if (frame.type === "text" || frame.type === "binary") {
+                const data = frame.type === "text" ? frame.data : frame.data.slice().buffer;
+                if (ws.readyState === WebSocket.OPEN)
+                    ws.send(data);
+                else
+                    held.push(data);
+            }
+        }
+        // A client may close only with 1000 or 3000–4999 (1011 throws `InvalidAccessError`).
+    })().catch(() => ws.close(1000, "the Guest's stream ended abnormally"));
+    return new Response(body, { headers: { "content-type": "application/octet-stream" } });
+}
+/** What a Guest holds: shaped like a browser WebSocket, carried over `fetch`. */
+export class TunnelSocket {
+    static CONNECTING = 0;
+    static OPEN = 1;
+    static CLOSING = 2;
+    static CLOSED = 3;
+    readyState = TunnelSocket.CONNECTING;
+    protocol = "";
+    onopen = null;
+    onmessage = null;
+    onclose = null;
+    onerror = null;
+    out;
+    sentClose = false;
+    constructor(fetch, path, protocols) {
+        const body = new ReadableStream({
+            start: (controller) => {
+                this.out = controller;
+            },
+        });
+        // `path` may be a full URL (`http://local/peers/<sharer>/s/<id>/live`), so
+        // the caller's `fetch` gets the Request as built, streaming body and all.
+        void fetch(new Request(/^https?:/.test(path) ? path : `http://tunnel${path}`, {
+            method: "POST",
+            headers: { [SOCKET_HEADER]: protocols.join(",") },
+            body,
+            duplex: "half",
+        }))
+            .then((res) => this.read(res))
+            .catch(() => this.closed(1006, "the tunnel failed"));
+    }
+    send(data) {
+        if (this.readyState !== TunnelSocket.OPEN)
+            throw new Error("the socket is not open");
+        const frame = typeof data === "string"
+            ? { type: "text", data }
+            : {
+                type: "binary",
+                data: data instanceof ArrayBuffer
+                    ? new Uint8Array(data)
+                    : new Uint8Array(data.buffer, data.byteOffset, data.byteLength),
+            };
+        this.out.enqueue(encodeFrame(frame));
+    }
+    close(code = 1000, reason = "") {
+        if (this.readyState >= TunnelSocket.CLOSING)
+            return;
+        this.readyState = TunnelSocket.CLOSING;
+        this.endRequest(code, reason);
+    }
+    endRequest(code, reason) {
+        if (this.sentClose)
+            return;
+        this.sentClose = true;
+        try {
+            this.out.enqueue(encodeFrame({ type: "close", code, reason }));
+            this.out.close();
+        }
+        catch {
+            /* already closed */
+        }
+    }
+    async read(res) {
+        if (!res.ok || res.body == null) {
+            this.onerror?.({ type: "error" });
+            return this.closed(1011, `refused: ${res.status}`);
+        }
+        for await (const frame of res.body.pipeThrough(decodeFrames())) {
+            if (frame.type === "open") {
+                this.protocol = frame.protocol;
+                this.readyState = TunnelSocket.OPEN;
+                this.onopen?.({ type: "open" });
+            }
+            else if (frame.type === "text")
+                this.onmessage?.({ type: "message", data: frame.data });
+            else if (frame.type === "binary")
+                this.onmessage?.({ type: "message", data: frame.data.slice().buffer });
+            else
+                return this.closed(frame.code, frame.reason);
+        }
+        this.closed(1006, "the tunnel ended");
+    }
+    closed(code, reason) {
+        if (this.readyState === TunnelSocket.CLOSED)
+            return;
+        this.readyState = TunnelSocket.CLOSED;
+        this.endRequest(1000, "");
+        this.onclose?.({ type: "close", code, reason, wasClean: code === 1000 });
+    }
+}
+export function openTunnel(fetch, path, protocols) {
+    return new TunnelSocket(fetch, path, protocols);
+}

package/dist/stamp-guest.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The Sharer's half of the cookie jars: name the Guest on every request to
+ * `/s`, from the peer id the mesh proved, never from what the Guest sent.
+ */
+import { type FetchHandler } from "@statewalker/httpeers-core";
+export declare function stampGuest(handler: FetchHandler): FetchHandler;
+//# sourceMappingURL=stamp-guest.d.ts.map

package/dist/stamp-guest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stamp-guest.d.ts","sourceRoot":"","sources":["../src/stamp-guest.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAa,KAAK,YAAY,EAAc,MAAM,4BAA4B,CAAC;AAGtF,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAS9D"}

package/dist/stamp-guest.js

@@ -0,0 +1,17 @@
+/**
+ * The Sharer's half of the cookie jars: name the Guest on every request to
+ * `/s`, from the peer id the mesh proved, never from what the Guest sent.
+ */
+import { ANONYMOUS, lookupPeer } from "@statewalker/httpeers-core";
+import { BRIDGE_GUEST_HEADER } from "./upstreams.js";
+export function stampGuest(handler) {
+    return (request) => {
+        const peer = lookupPeer(request) ?? ANONYMOUS;
+        const headers = new Headers(request.headers);
+        // Overwritten, not merged: a Guest's own value would let it pick a jar.
+        headers.delete(BRIDGE_GUEST_HEADER);
+        if (peer !== ANONYMOUS)
+            headers.set(BRIDGE_GUEST_HEADER, peer);
+        return handler(new Request(request, { headers }));
+    };
+}

package/dist/targets.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Where the Bridge may relay: the Sharer's own machine, LAN and tailnet,
+ * nothing else.
+ *
+ * Literal addresses are checked as they are. A DNS name is decided by whoever
+ * controls its zone at request time (DNS rebinding), so names are refused,
+ * with two exceptions: `localhost`, and mDNS `.local` names, which are
+ * resolved FIRST and allowed only if every address they resolve to is
+ * private. (Some company networks serve `.local` from ordinary DNS, so the
+ * name alone proves nothing.)
+ */
+export type TargetVerdict = "allowed" | "forbidden" | {
+    resolve: string;
+};
+export declare function checkTarget(target: string): TargetVerdict;
+/** Loopback, RFC 1918, carrier-grade NAT (Tailscale), IPv6 loopback and unique-local. */
+export declare function isPrivateAddress(address: string): boolean;
+//# sourceMappingURL=targets.d.ts.map

package/dist/targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"targets.d.ts","sourceRoot":"","sources":["../src/targets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAczD;AAMD,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAezD"}

package/dist/targets.js

@@ -0,0 +1,48 @@
+/**
+ * Where the Bridge may relay: the Sharer's own machine, LAN and tailnet,
+ * nothing else.
+ *
+ * Literal addresses are checked as they are. A DNS name is decided by whoever
+ * controls its zone at request time (DNS rebinding), so names are refused,
+ * with two exceptions: `localhost`, and mDNS `.local` names, which are
+ * resolved FIRST and allowed only if every address they resolve to is
+ * private. (Some company networks serve `.local` from ordinary DNS, so the
+ * name alone proves nothing.)
+ */
+export function checkTarget(target) {
+    let url;
+    try {
+        url = new URL(target);
+    }
+    catch {
+        return "forbidden";
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return "forbidden";
+    const host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    if (host === "localhost")
+        return "allowed";
+    if (isAddress(host))
+        return isPrivateAddress(host) ? "allowed" : "forbidden";
+    if (/^[a-z0-9-]+(\.[a-z0-9-]+)*\.local$/.test(host))
+        return { resolve: host };
+    return "forbidden";
+}
+function isAddress(host) {
+    return /^\d+\.\d+\.\d+\.\d+$/.test(host) || host.includes(":");
+}
+/** Loopback, RFC 1918, carrier-grade NAT (Tailscale), IPv6 loopback and unique-local. */
+export function isPrivateAddress(address) {
+    const v4 = address.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+    if (v4 != null) {
+        const [a, b] = [Number(v4[1]), Number(v4[2])];
+        return (a === 127 ||
+            a === 10 ||
+            (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && b === 168) ||
+            (a === 100 && b >= 64 && b <= 127));
+    }
+    // Link-local (fe80::/10) and IPv4-mapped addresses are refused.
+    const v6 = address.toLowerCase();
+    return v6 === "::1" || /^f[cd][0-9a-f]{0,2}:/.test(v6);
+}

package/dist/upstreams.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Upstream kinds: how the Sharer's tab reaches a Service's local URL.
+ */
+import { type Upstream } from "@statewalker/webrun-http-proxy";
+/** Which local URL the Bridge relays to. Set by the Sharer, never by a Guest. */
+export declare const BRIDGE_TARGET_HEADER = "x-peershare-target";
+/** The Pairing token the Bridge printed at launch. */
+export declare const BRIDGE_TOKEN_HEADER = "x-peershare-bridge-token";
+/** Marks the Bridge's own responses, so they are never mistaken for the Service's. */
+export declare const BRIDGE_MARKER = "x-peershare-bridge";
+/**
+ * A Service's redirect, restated by the Bridge as a 200 with these two
+ * headers: a browser makes every `redirect: "manual"` 3xx opaque (status 0,
+ * no `Location`), so a real 3xx would reach the page with nothing in it.
+ */
+export declare const BRIDGE_REDIRECT_STATUS_HEADER = "x-peershare-redirect-status";
+export declare const BRIDGE_REDIRECT_LOCATION_HEADER = "x-peershare-redirect-location";
+/**
+ * How many cookies the Service tried to set. `Set-Cookie` is a forbidden
+ * response header: no page script can read it, so the Bridge says it instead.
+ */
+export declare const BRIDGE_SET_COOKIE_HEADER = "x-peershare-set-cookie";
+/**
+ * Which Guest a request is for, as the Sharer states it from the mesh-proven
+ * peer id (rung 16); a Guest's own copy is overwritten. The Bridge keeps one
+ * cookie jar per value.
+ */
+export declare const BRIDGE_GUEST_HEADER = "x-peershare-guest";
+/** Set by a Bridge with cookie jars when it kept the Service's cookies for that Guest. */
+export declare const BRIDGE_COOKIES_KEPT_HEADER = "x-peershare-cookies";
+/** The Guest id the Probe uses, so a Bridge with cookie jars treats it like any Guest. */
+export declare const PROBE_GUEST = "peershare-probe";
+export type UpstreamConfig = {
+    kind: "direct";
+    target: string;
+} | {
+    kind: "bridged";
+    target: string;
+    bridge: {
+        base: string;
+        token: string;
+    };
+};
+export declare function createUpstream(config: UpstreamConfig): Upstream;
+/** Which hop did not answer, read off an `Upstream`'s response; `undefined` when something did. */
+export declare function unreachable(response: Response): "service" | "bridge" | undefined;
+//# sourceMappingURL=upstreams.d.ts.map

package/dist/upstreams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstreams.d.ts","sourceRoot":"","sources":["../src/upstreams.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAU,KAAK,QAAQ,EAAe,MAAM,gCAAgC,CAAC;AAEpF,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AACzD,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAC9D,sFAAsF;AACtF,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAClD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAC3E,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAC/E;;;GAGG;AACH,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AACvD,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAChE,0FAA0F;AAC1F,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAE7C,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEjF,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAiD/D;AAuBD,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAMhF"}

package/dist/upstreams.js

@@ -0,0 +1,141 @@
+/**
+ * Upstream kinds: how the Sharer's tab reaches a Service's local URL.
+ */
+import { MESH_CREDENTIAL_HEADERS } from "@statewalker/httpeers-core";
+import { MARKER, urlUpstream } from "@statewalker/webrun-http-proxy";
+/** Which local URL the Bridge relays to. Set by the Sharer, never by a Guest. */
+export const BRIDGE_TARGET_HEADER = "x-peershare-target";
+/** The Pairing token the Bridge printed at launch. */
+export const BRIDGE_TOKEN_HEADER = "x-peershare-bridge-token";
+/** Marks the Bridge's own responses, so they are never mistaken for the Service's. */
+export const BRIDGE_MARKER = "x-peershare-bridge";
+/**
+ * A Service's redirect, restated by the Bridge as a 200 with these two
+ * headers: a browser makes every `redirect: "manual"` 3xx opaque (status 0,
+ * no `Location`), so a real 3xx would reach the page with nothing in it.
+ */
+export const BRIDGE_REDIRECT_STATUS_HEADER = "x-peershare-redirect-status";
+export const BRIDGE_REDIRECT_LOCATION_HEADER = "x-peershare-redirect-location";
+/**
+ * How many cookies the Service tried to set. `Set-Cookie` is a forbidden
+ * response header: no page script can read it, so the Bridge says it instead.
+ */
+export const BRIDGE_SET_COOKIE_HEADER = "x-peershare-set-cookie";
+/**
+ * Which Guest a request is for, as the Sharer states it from the mesh-proven
+ * peer id (rung 16); a Guest's own copy is overwritten. The Bridge keeps one
+ * cookie jar per value.
+ */
+export const BRIDGE_GUEST_HEADER = "x-peershare-guest";
+/** Set by a Bridge with cookie jars when it kept the Service's cookies for that Guest. */
+export const BRIDGE_COOKIES_KEPT_HEADER = "x-peershare-cookies";
+/** The Guest id the Probe uses, so a Bridge with cookie jars treats it like any Guest. */
+export const PROBE_GUEST = "peershare-probe";
+export function createUpstream(config) {
+    // A Guest's membership token and peer id are consumed by the mesh hop:
+    // Dirk's app has no business seeing them, whichever way it is reached.
+    // A Guest's copy of the Bridge headers goes too: the target and token are
+    // the Sharer's to set, and Direct would otherwise hand them to the app.
+    const stripRequestHeaders = [
+        ...MESH_CREDENTIAL_HEADERS,
+        BRIDGE_TARGET_HEADER,
+        BRIDGE_TOKEN_HEADER,
+    ];
+    if (config.kind === "direct") {
+        return inGuestOrigin(urlUpstream({
+            base: config.target,
+            stripRequestHeaders,
+            fetchImpl: directFetch(needsLocalAddressSpace(config.target)),
+        }), config.target);
+    }
+    // Bridged is a URL upstream too: re-issued at the Bridge instead of the
+    // Service, with the real target and the Pairing token as headers.
+    const viaBridge = urlUpstream({
+        base: config.bridge.base,
+        stripRequestHeaders,
+        headers: {
+            [BRIDGE_TARGET_HEADER]: config.target,
+            [BRIDGE_TOKEN_HEADER]: config.bridge.token,
+        },
+    });
+    return inGuestOrigin(async (request) => {
+        const response = await viaBridge(request);
+        const redirect = response.headers.get(BRIDGE_REDIRECT_STATUS_HEADER);
+        if (redirect != null) {
+            // Back to a real redirect for the Guest (see BRIDGE_REDIRECT_STATUS_HEADER).
+            const headers = new Headers(response.headers);
+            headers.set("location", headers.get(BRIDGE_REDIRECT_LOCATION_HEADER) ?? "/");
+            headers.delete(BRIDGE_REDIRECT_STATUS_HEADER);
+            headers.delete(BRIDGE_REDIRECT_LOCATION_HEADER);
+            return new Response(null, { status: Number(redirect), headers });
+        }
+        // To `urlUpstream` the Bridge IS the upstream, so its "unreachable" means
+        // the Bridge is not running, not that the Service is down.
+        if (response.headers.get(MARKER) !== "upstream-unreachable")
+            return response;
+        const headers = new Headers(response.headers);
+        headers.delete(MARKER);
+        headers.set(BRIDGE_MARKER, "bridge-unreachable");
+        return new Response(response.body, { status: response.status, headers });
+    }, config.target);
+}
+/**
+ * A Guest sees the Service at the root of their own isolated origin (rung
+ * 08), so a redirect the Service writes absolutely to ITSELF
+ * (`https://wiki.example.com/login`, `http://127.0.0.1:5173/login`) must
+ * become a path, or the Guest's frame leaves that origin. Redirects anywhere
+ * else stay absolute.
+ */
+function inGuestOrigin(upstream, target) {
+    const own = new URL(target).origin;
+    return async (request) => {
+        const response = await upstream(request);
+        const location = response.headers.get("location");
+        if (response.status < 300 || response.status >= 400 || location == null)
+            return response;
+        const resolved = new URL(location, target);
+        if (resolved.origin !== own)
+            return response;
+        const headers = new Headers(response.headers);
+        headers.set("location", `${resolved.pathname}${resolved.search}${resolved.hash}`);
+        return new Response(response.body, { status: response.status, headers });
+    };
+}
+/** Which hop did not answer, read off an `Upstream`'s response; `undefined` when something did. */
+export function unreachable(response) {
+    const bridge = response.headers.get(BRIDGE_MARKER);
+    if (bridge === "bridge-unreachable")
+        return "bridge";
+    if (bridge === "target-unreachable")
+        return "service";
+    if (response.headers.get(MARKER) === "upstream-unreachable")
+        return "service";
+    return undefined;
+}
+/**
+ * A plain-http Service on the LAN, called from the https PeerShare page, is
+ * mixed content and Chromium blocks it — unless the call says the target is
+ * on the local network, which also lets Local Network Access ask the Sharer
+ * (measured in rung 03). Loopback needs nothing: it is trusted already.
+ */
+function needsLocalAddressSpace(target) {
+    const url = new URL(target);
+    if (url.protocol !== "http:")
+        return false;
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    return !(host === "localhost" || host === "::1" || /^127\./.test(host));
+}
+/**
+ * How Direct calls the Service. Redirects are FOLLOWED: in the Sharer's
+ * browser tab a `redirect: "manual"` response is opaque (status 0, no
+ * `Location`), so following is the only way to serve a site that redirects
+ * (rung 04). Same everywhere, so Node and the browser agree.
+ * `targetAddressSpace` is Chromium's; other runtimes ignore it.
+ */
+function directFetch(local) {
+    return (input, init) => fetch(input, {
+        ...init,
+        redirect: "follow",
+        ...(local ? { targetAddressSpace: "local" } : {}),
+    });
+}

package/package.json

@@ -1,6 +1,62 @@
 {
   "name": "@statewalker/httpeers-share",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "type": "module",
+  "description": "Share HTTP services with the members of a mesh: upstream kinds, sharing policy, probe, service table, invite links, WebSockets over the mesh, and the Bridge.",
+  "bugs": {
+    "url": "https://github.com/statewalker/httpeers/issues"
+  },
+  "homepage": "https://github.com/statewalker/httpeers/tree/main/packages/httpeers-share#readme",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/statewalker/httpeers.git",
+    "directory": "packages/httpeers-share"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./bridge": {
+      "source": "./src/bridge/index.ts",
+      "types": "./dist/bridge/index.d.ts",
+      "import": "./dist/bridge/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@hono/node-server": "^2.1.3",
+    "@statewalker/webrun-http-proxy": "^0.2.1",
+    "hono": "^4.13.12",
+    "ws": "^8.22.0",
+    "@statewalker/httpeers-hub": "^0.1.4",
+    "@statewalker/httpeers-core": "^0.1.3",
+    "@statewalker/httpeers-member": "^0.3.0"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.15",
+    "@types/node": "^26.6.4",
+    "@types/ws": "^8.18.2",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3",
+    "@statewalker/httpeers-qr": "^0.1.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "pnpm run build && pnpm run typecheck && vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check src tests",
+    "lint:check": "biome check src tests"
+  }
 }