@stim-cli/transport-tailscale 0.0.0 → 1.21.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Janic Duplessis
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,7 @@
 # @stim-cli/transport-tailscale
 
-Placeholder. Install a version published with the other Stim packages.
+The Tailscale transport for stim-server. It serves stim-server on a tailnet-only `tailscale serve` HTTPS route, never
+on Funnel, identifies each peer with `tailscale whois`, and listens on the machine's Tailscale addresses while Tailscale
+runs. It implements the [`@stim-cli/transport`](../transport/README.md) contract.
+
+stim-server depends on it and loads it at start; it needs no configuration.

package/dist/index.d.mts

@@ -0,0 +1,92 @@
+import { TRANSPORT_API_VERSION, Transport, TransportInput } from "@stim-cli/transport";
+import { ServeRoute } from "@stim-cli/core/protocol";
+//#region src/tailscale.d.ts
+interface TailnetIdentity {
+  kind: "tailnet";
+  nodeId: string;
+  nodeName: string;
+  user: string;
+}
+type TailscaleState = {
+  state: "running";
+  ips: string[];
+  dnsName: string | null;
+  hostName: string | null;
+} | {
+  state: "not-running";
+  backendState: string;
+} | {
+  state: "unavailable";
+  reason: string;
+};
+declare function findTailscale(env: NodeJS.ProcessEnv, platform?: NodeJS.Platform, isExecutable?: (path: string) => boolean): string | null;
+type TailscaleInstall = "app" | "cli" | "none";
+declare function tailscaleInstall(env: NodeJS.ProcessEnv, isExecutable?: (path: string) => boolean): TailscaleInstall;
+declare function readRawTailscaleStatus(binary: string | null, env: NodeJS.ProcessEnv): Promise<unknown>;
+declare function readTailscaleStatus(binary: string | null, env: NodeJS.ProcessEnv, timeoutMs?: number): Promise<TailscaleState>;
+declare function serveRoute(binary: string | null, env: NodeJS.ProcessEnv, target: number, ips: string[], timeoutMs?: number): Promise<ServeRoute>;
+declare function tailnetEndpoint(dnsName: string, port: number): string;
+declare function serveCommand(port: number, target: number): string;
+//#endregion
+//#region src/tailscale-monitor.d.ts
+interface TailscaleSnapshot {
+  binary: string | null;
+  state: TailscaleState;
+}
+interface TailscaleMonitor {
+  current(): TailscaleSnapshot;
+  onChange(listener: (snapshot: TailscaleSnapshot, previous: TailscaleSnapshot) => void): () => void;
+  stop(): void;
+}
+interface TailscaleMonitorOptions {
+  env: NodeJS.ProcessEnv;
+  initial: TailscaleSnapshot;
+  find?: (env: NodeJS.ProcessEnv) => string | null;
+  read?: (binary: string | null, env: NodeJS.ProcessEnv) => Promise<TailscaleState>;
+  backoffMs?: number;
+  maxMs?: number;
+}
+declare function watchTailscale(options: TailscaleMonitorOptions): TailscaleMonitor;
+//#endregion
+//#region src/serve-plan.d.ts
+interface ServeRecord {
+  port: number;
+  /** Whether `service install` created the `tailscale serve` route, so `uninstall` removes it. */
+  created: boolean;
+}
+/**
+ * What `install --serve` does about the node's `tailscale serve` config: refuse a Funnel route or an unreadable
+ * config, keep a route that already reaches the port (remembering whether an earlier install created it), or
+ * create one.
+ */
+declare function planServe(route: ServeRoute, target: number, previous: ServeRecord | null): {
+  record: ServeRecord;
+  create: boolean;
+} | {
+  refusal: string;
+};
+//#endregion
+//#region index.d.ts
+declare const apiVersion: typeof TRANSPORT_API_VERSION;
+declare const id = "tailscale";
+/**
+ * The Tailscale transport, plus what stim-server still reads from Tailscale directly: the snapshot behind the
+ * `tailscale` and `route` fields of `/health`, the raw status that pins paired machines, and `route.setup`.
+ */
+interface TailscaleTransport extends Transport {
+  id: typeof id;
+  snapshot(): TailscaleSnapshot;
+  monitor: TailscaleMonitor | null;
+  rawStatus(): Promise<unknown>;
+  serveRoute(target: number, timeoutMs?: number): Promise<ServeRoute>;
+  setupRoute(target: number): Promise<ServeRoute>;
+}
+declare function isTailscaleTransport(transport: Transport): transport is TailscaleTransport;
+declare function tailscaleTransport({ env, snapshot, monitor }: {
+  env: NodeJS.ProcessEnv;
+  snapshot: TailscaleSnapshot;
+  monitor?: TailscaleMonitor | null;
+}): TailscaleTransport;
+declare function createTransport({ env }: TransportInput): Promise<TailscaleTransport>;
+//#endregion
+export { type ServeRecord, type TailnetIdentity, type TailscaleInstall, type TailscaleMonitor, type TailscaleSnapshot, type TailscaleState, TailscaleTransport, apiVersion, createTransport, findTailscale, id, isTailscaleTransport, planServe, readRawTailscaleStatus, readTailscaleStatus, serveCommand, serveRoute, tailnetEndpoint, tailscaleInstall, tailscaleTransport, watchTailscale };

package/dist/index.mjs

@@ -0,0 +1,459 @@
+import { isIP } from "node:net";
+import { TRANSPORT_API_VERSION } from "@stim-cli/transport";
+import { execFile } from "node:child_process";
+import { accessSync, constants } from "node:fs";
+import { delimiter, join, win32 } from "node:path";
+import { isJsonObject } from "@stim-cli/core/state";
+//#region src/serve-plan.ts
+/**
+* What `install --serve` does about the node's `tailscale serve` config: refuse a Funnel route or an unreadable
+* config, keep a route that already reaches the port (remembering whether an earlier install created it), or
+* create one.
+*/
+function planServe(route, target, previous) {
+	if (route.state === "funneled") return { refusal: `refusing to serve. Tailscale Funnel is on for port ${route.ports.join(", ")}, which proxies to port ${target}, so it is reachable from the public internet. Remove that handler (see \`tailscale serve status\`), then run install again.` };
+	if (route.state === "unknown") return { refusal: `could not read \`tailscale serve status --json\` (${route.reason}); not changing the route.` };
+	if (route.state === "routed") return {
+		record: {
+			port: route.port,
+			created: previous?.port === route.port && previous.created
+		},
+		create: false
+	};
+	return {
+		record: {
+			port: route.port,
+			created: true
+		},
+		create: true
+	};
+}
+//#endregion
+//#region src/tailscale.ts
+const MAC_APP_BINARY = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
+const TIMEOUT_MS = 3e3;
+/** The tailnet-only HTTPS port the setup command serves stim-server on. */
+const SERVE_PORT = 7443;
+function executable(path) {
+	try {
+		accessSync(path, constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function findTailscale(env, platform = process.platform, isExecutable = executable) {
+	const name = platform === "win32" ? "tailscale.exe" : "tailscale";
+	for (const dir of (env.PATH ?? "").split(delimiter)) if (dir && isExecutable(join(dir, name))) return join(dir, name);
+	const installed = platform === "win32" ? win32.join(env.ProgramFiles ?? "C:\\Program Files", "Tailscale", "tailscale.exe") : MAC_APP_BINARY;
+	return isExecutable(installed) ? installed : null;
+}
+function tailscaleInstall(env, isExecutable = executable) {
+	if (isExecutable(MAC_APP_BINARY)) return "app";
+	return (env.PATH ?? "").split(delimiter).some((dir) => dir && isExecutable(join(dir, "tailscale"))) ? "cli" : "none";
+}
+function parseTailscaleStatus(value) {
+	if (!isJsonObject(value) || typeof value.BackendState !== "string") return {
+		state: "unavailable",
+		reason: "`tailscale status --json` printed no BackendState"
+	};
+	if (value.BackendState !== "Running") return {
+		state: "not-running",
+		backendState: value.BackendState
+	};
+	const self = isJsonObject(value.Self) ? value.Self : {};
+	return {
+		state: "running",
+		ips: Array.isArray(value.TailscaleIPs) ? value.TailscaleIPs.filter((ip) => typeof ip === "string") : [],
+		dnsName: typeof self.DNSName === "string" && self.DNSName ? self.DNSName.replace(/\.$/, "") : null,
+		hostName: typeof self.HostName === "string" && self.HostName ? self.HostName : null
+	};
+}
+function readRawTailscaleStatus(binary, env) {
+	if (!binary) return Promise.resolve(null);
+	return new Promise((resolve) => {
+		execFile(binary, ["status", "--json"], {
+			env,
+			timeout: TIMEOUT_MS,
+			killSignal: "SIGKILL",
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (error) return resolve(null);
+			try {
+				const status = JSON.parse(stdout);
+				return resolve(isJsonObject(status) && status.BackendState === "Running" ? status : null);
+			} catch {
+				resolve(null);
+			}
+		});
+	});
+}
+function readTailscaleStatus(binary, env, timeoutMs = TIMEOUT_MS) {
+	if (!binary) return Promise.resolve({
+		state: "unavailable",
+		reason: "the tailscale command was not found"
+	});
+	return new Promise((resolve) => {
+		execFile(binary, ["status", "--json"], {
+			env,
+			timeout: timeoutMs,
+			killSignal: "SIGKILL",
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (error) return resolve({
+				state: "unavailable",
+				reason: `\`tailscale status --json\` failed: ${error.killed ? "it timed out" : error.message.split("\n")[0]}`
+			});
+			try {
+				resolve(parseTailscaleStatus(JSON.parse(stdout)));
+			} catch {
+				resolve({
+					state: "unavailable",
+					reason: "`tailscale status --json` printed output that is not JSON"
+				});
+			}
+		});
+	});
+}
+function reaches(address, target, hosts) {
+	if (typeof address !== "string") return null;
+	let url;
+	try {
+		url = new URL(address.includes("://") ? address : `tcp://${address}`);
+	} catch {
+		return null;
+	}
+	return hosts.has(url.hostname) && url.port === String(target) ? url : null;
+}
+function portOf(hostPort) {
+	return Number(hostPort.slice(hostPort.lastIndexOf(":") + 1));
+}
+/**
+* Reads `tailscale serve status --json`, an ipn.ServeConfig: `TCP` maps a port to `{ HTTPS }` or
+* `{ TCPForward }`, `Web` maps `<host>:<port>` to `{ Handlers: { <mount>: { Proxy } } }`,
+* `AllowFunnel` maps `<host>:<port>` to true, and `Foreground` holds the same shape per
+* foreground session. Any handler or TCP forward that reaches the server on a Funnel port exposes
+* it; only a `/` HTTP proxy on an HTTPS port is a route a client can use.
+*/
+function parseServeStatus(value, target, ips) {
+	if (!isJsonObject(value)) return {
+		state: "unknown",
+		reason: "it printed no serve config",
+		port: SERVE_PORT
+	};
+	if (Object.keys(value).length && ![
+		"TCP",
+		"Web",
+		"AllowFunnel",
+		"Foreground"
+	].some((field) => field in value)) return {
+		state: "unknown",
+		reason: "it printed an unrecognized serve config",
+		port: SERVE_PORT
+	};
+	if ([
+		"TCP",
+		"Web",
+		"AllowFunnel",
+		"Foreground"
+	].some((field) => value[field] !== void 0 && !isJsonObject(value[field]))) return {
+		state: "unknown",
+		reason: "it printed a malformed serve config",
+		port: SERVE_PORT
+	};
+	const hosts = /* @__PURE__ */ new Set([
+		"127.0.0.1",
+		"localhost",
+		"[::1]",
+		"0.0.0.0",
+		"[::]",
+		...ips.map((ip) => ip.includes(":") ? `[${ip}]` : ip)
+	]);
+	const configs = [value, ...isJsonObject(value.Foreground) ? Object.values(value.Foreground) : []].filter(isJsonObject);
+	if (isJsonObject(value.Foreground) && configs.length !== 1 + Object.keys(value.Foreground).length) return {
+		state: "unknown",
+		reason: "it printed a malformed foreground config",
+		port: SERVE_PORT
+	};
+	const used = /* @__PURE__ */ new Set();
+	const funneled = /* @__PURE__ */ new Set();
+	const reaching = /* @__PURE__ */ new Set();
+	const routes = /* @__PURE__ */ new Set();
+	for (const config of configs) {
+		if ([
+			"TCP",
+			"Web",
+			"AllowFunnel"
+		].some((field) => config[field] !== void 0 && !isJsonObject(config[field]))) return {
+			state: "unknown",
+			reason: "it printed a malformed serve config",
+			port: SERVE_PORT
+		};
+		const tcp = isJsonObject(config.TCP) ? config.TCP : {};
+		for (const [port, listener] of Object.entries(tcp)) {
+			used.add(Number(port));
+			if (isJsonObject(listener) && reaches(listener.TCPForward, target, hosts)) reaching.add(Number(port));
+		}
+		for (const [hostPort, allowed] of Object.entries(isJsonObject(config.AllowFunnel) ? config.AllowFunnel : {})) if (allowed === true) funneled.add(portOf(hostPort));
+		for (const [hostPort, web] of Object.entries(isJsonObject(config.Web) ? config.Web : {})) {
+			const port = portOf(hostPort);
+			const listener = tcp[String(port)];
+			const https = isJsonObject(listener) && listener.HTTPS === true;
+			const handlers = isJsonObject(web) && isJsonObject(web.Handlers) ? web.Handlers : {};
+			for (const [mount, handler] of Object.entries(handlers)) {
+				const url = isJsonObject(handler) ? reaches(handler.Proxy, target, hosts) : null;
+				if (!url) continue;
+				reaching.add(port);
+				if (https && mount === "/" && url.protocol === "http:" && url.pathname === "/") routes.add(port);
+			}
+		}
+	}
+	let free = SERVE_PORT;
+	while (used.has(free) || funneled.has(free)) free++;
+	const exposed = [...reaching].filter((port) => funneled.has(port)).toSorted((a, b) => a - b);
+	if (exposed.length) return {
+		state: "funneled",
+		ports: exposed,
+		port: free
+	};
+	const tailnet = [...routes].toSorted((a, b) => a - b);
+	if (tailnet.length) return {
+		state: "routed",
+		port: tailnet.includes(SERVE_PORT) ? SERVE_PORT : tailnet[0]
+	};
+	return {
+		state: "missing",
+		port: free
+	};
+}
+function serveRoute(binary, env, target, ips, timeoutMs = TIMEOUT_MS) {
+	if (!binary) return Promise.resolve({
+		state: "unknown",
+		reason: "the tailscale command was not found",
+		port: SERVE_PORT
+	});
+	return new Promise((resolve) => {
+		execFile(binary, [
+			"serve",
+			"status",
+			"--json"
+		], {
+			env,
+			timeout: timeoutMs,
+			killSignal: "SIGKILL",
+			encoding: "utf8"
+		}, (error, stdout) => {
+			let route;
+			try {
+				route = error ? {
+					state: "unknown",
+					reason: error.killed ? "it timed out" : error.message.split("\n")[0],
+					port: SERVE_PORT
+				} : parseServeStatus(stdout.trim() ? JSON.parse(stdout) : {}, target, ips);
+			} catch {
+				route = {
+					state: "unknown",
+					reason: "it printed output that is not JSON",
+					port: SERVE_PORT
+				};
+			}
+			resolve(route);
+		});
+	});
+}
+function tailnetEndpoint(dnsName, port) {
+	return port === 443 ? `wss://${dnsName}` : `wss://${dnsName}:${port}`;
+}
+function serveCommand(port, target) {
+	return `tailscale serve --bg --https=${port} http://127.0.0.1:${target}`;
+}
+async function setupServeRoute(binary, env, target, state) {
+	if (!binary || state.state !== "running" || !state.dnsName) throw new Error("Start Tailscale on this machine before setting up the phone connection.");
+	const route = await serveRoute(binary, env, target, state.ips);
+	const plan = planServe(route, target, null);
+	if ("refusal" in plan) throw new Error(plan.refusal.replace("run install again", "retry setup"));
+	if (!plan.create) return route;
+	await new Promise((resolve, reject) => {
+		execFile(binary, [
+			"serve",
+			"--bg",
+			`--https=${plan.record.port}`,
+			`http://127.0.0.1:${target}`
+		], {
+			env,
+			timeout: 1e4,
+			killSignal: "SIGKILL",
+			encoding: "utf8"
+		}, (error, stdout, stderr) => {
+			if (!error) return resolve();
+			const detail = [stdout.trim(), stderr.trim()].filter(Boolean).join("\n");
+			reject(/* @__PURE__ */ new Error(`Phone connection setup ${error.killed ? "timed out" : "failed"}. ${detail || error.message}\nIf Tailscale asks to enable HTTPS, approve its browser setup and try again.`));
+		});
+	});
+	const verified = await serveRoute(binary, env, target, state.ips);
+	if (verified.state !== "routed") throw new Error(`Phone connection could not be verified (${verified.state === "unknown" ? verified.reason : verified.state}). Check Tailscale and try again.`);
+	return verified;
+}
+/** Reads `tailscale whois --json`: the peer's node (`Node.StableID`, `Node.Name`) and user (`UserProfile.LoginName`). */
+function parseWhois(value) {
+	if (!isJsonObject(value) || !isJsonObject(value.Node)) return null;
+	const { StableID, Name } = value.Node;
+	const login = isJsonObject(value.UserProfile) ? value.UserProfile.LoginName : void 0;
+	if (typeof StableID !== "string" || !StableID) return null;
+	return {
+		kind: "tailnet",
+		nodeId: StableID,
+		nodeName: typeof Name === "string" ? Name.replace(/\.$/, "") : "",
+		user: typeof login === "string" ? login : ""
+	};
+}
+function whois(binary, env, ip) {
+	if (!binary) return Promise.resolve(null);
+	return new Promise((resolve) => {
+		execFile(binary, [
+			"whois",
+			"--json",
+			ip
+		], {
+			env,
+			timeout: TIMEOUT_MS,
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (error) return resolve(null);
+			try {
+				resolve(parseWhois(JSON.parse(stdout)));
+			} catch {
+				resolve(null);
+			}
+		});
+	});
+}
+//#endregion
+//#region src/tailscale-monitor.ts
+const STATUS_TIMEOUT_MS = 1e4;
+const MISSES_BEFORE_DOWN = 3;
+function sameState(a, b) {
+	if (a.state !== b.state) return false;
+	if (a.state === "running" && b.state === "running") return a.dnsName === b.dnsName && a.hostName === b.hostName && a.ips.length === b.ips.length && a.ips.every((ip, i) => ip === b.ips[i]);
+	if (a.state === "not-running" && b.state === "not-running") return a.backendState === b.backendState;
+	return true;
+}
+function watchTailscale(options) {
+	const find = options.find ?? findTailscale;
+	const read = options.read ?? ((binary, env) => readTailscaleStatus(binary, env, STATUS_TIMEOUT_MS));
+	const backoffMs = options.backoffMs ?? 2e3;
+	const maxMs = options.maxMs ?? 3e4;
+	const listeners = /* @__PURE__ */ new Set();
+	let snapshot = options.initial;
+	let timer = null;
+	let stopped = false;
+	let misses = 0;
+	let silent = 0;
+	const schedule = () => {
+		if (stopped) return;
+		const wait = snapshot.state.state === "running" && silent === 0 ? maxMs : Math.min(backoffMs * 2 ** Math.max(misses, silent), maxMs);
+		timer = setTimeout(() => void check(), wait);
+		timer.unref();
+	};
+	async function check() {
+		try {
+			const binary = snapshot.binary ?? find(options.env);
+			const state = await read(binary, options.env);
+			if (stopped) return;
+			if (state.state === "unavailable" && snapshot.state.state === "running" && ++silent < MISSES_BEFORE_DOWN) return;
+			silent = 0;
+			misses = state.state === "running" ? 0 : misses + 1;
+			if (binary !== snapshot.binary || !sameState(state, snapshot.state)) {
+				const previous = snapshot;
+				snapshot = {
+					binary,
+					state
+				};
+				for (const listener of listeners) listener(snapshot, previous);
+			}
+		} catch (error) {
+			console.error(`stim-server: checking Tailscale failed: ${error.message}`);
+		} finally {
+			schedule();
+		}
+	}
+	schedule();
+	return {
+		current: () => snapshot,
+		onChange(listener) {
+			listeners.add(listener);
+			return () => listeners.delete(listener);
+		},
+		stop() {
+			stopped = true;
+			if (timer) clearTimeout(timer);
+		}
+	};
+}
+//#endregion
+//#region index.ts
+const apiVersion = TRANSPORT_API_VERSION;
+const id = "tailscale";
+function isTailscaleTransport(transport) {
+	return transport.id === "tailscale" && "snapshot" in transport && typeof transport.snapshot === "function";
+}
+function tailscaleTransport({ env, snapshot, monitor = null }) {
+	const now = () => monitor?.current() ?? snapshot;
+	return {
+		id,
+		traits: {
+			privateNetwork: true,
+			tls: "end-to-end",
+			peerIdentity: true
+		},
+		monitor,
+		snapshot: now,
+		...monitor && {
+			bindAddresses() {
+				const { state } = monitor.current();
+				return state.state === "running" ? state.ips : [];
+			},
+			watch: (listener) => monitor.onChange(() => listener())
+		},
+		async identify({ address }) {
+			if (!isIP(address)) return null;
+			const identity = await whois(now().binary, env, address);
+			return identity && {
+				id: identity.nodeId,
+				name: identity.nodeName,
+				user: identity.user
+			};
+		},
+		rawStatus: () => readRawTailscaleStatus(now().binary, env),
+		serveRoute(target, timeoutMs) {
+			const { binary, state } = now();
+			return serveRoute(binary, env, target, state.state === "running" ? state.ips : [], timeoutMs);
+		},
+		setupRoute(target) {
+			const { binary, state } = now();
+			return setupServeRoute(binary, env, target, state);
+		},
+		close: () => monitor?.stop()
+	};
+}
+async function createTransport({ env }) {
+	const binary = findTailscale(env);
+	const state = await readTailscaleStatus(binary, env);
+	const monitor = watchTailscale({
+		env,
+		initial: {
+			binary,
+			state
+		}
+	});
+	return tailscaleTransport({
+		env,
+		snapshot: {
+			binary,
+			state
+		},
+		monitor
+	});
+}
+//#endregion
+export { apiVersion, createTransport, findTailscale, id, isTailscaleTransport, planServe, readRawTailscaleStatus, readTailscaleStatus, serveCommand, serveRoute, tailnetEndpoint, tailscaleInstall, tailscaleTransport, watchTailscale };

package/package.json

@@ -1,11 +1,36 @@
 {
   "name": "@stim-cli/transport-tailscale",
-  "version": "0.0.0",
-  "description": "Placeholder. The first real version is published by the Stim release workflow.",
+  "version": "1.21.0",
+  "description": "Tailscale transport for stim-server: tailnet-only serve route, whois identity and peer pinning.",
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/appandflow/stim.git",
     "directory": "packages/transport-tailscale"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "main": "dist/index.mjs",
+  "types": "dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "module-sync": "./dist/index.mjs",
+      "default": "./dist/index.mjs"
+    }
+  },
+  "dependencies": {
+    "@stim-cli/core": "^1.21.0",
+    "@stim-cli/transport": "^1.21.0"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "scripts": {
+    "build": "tsdown"
   }
-}
+}