socketduct 0.1.15

package/docs/socket-api.md

@@ -0,0 +1,448 @@
+# Node-Compatible Socket API Design
+
+Socketduct should be usable by code that already expects Node's socket-shaped APIs. The goal is not to subclass or perfectly emulate every `net.Socket` internal detail. The goal is a practical duck-typed client object that behaves like a normal `Duplex`/`net.Socket` for common consumers such as HTTP clients and Docker client libraries.
+
+## Goals
+
+- Expose a `SocketductSocket` that is `Duplex`-compatible and close enough to `net.Socket` for normal stream consumers.
+- Provide a `connect()` factory with an option shape that mirrors `net.connect()` where it makes sense.
+- Provide HTTP and HTTPS agent adapters so clients can route individual requests over Socketduct without opening a local listener.
+- Keep the existing relay security model: authenticate before session operations and authorize every requested target with deny-by-default policy.
+- Make Docker API clients a first-class target without baking Docker-specific behavior into the core socket.
+
+## Non-goals
+
+- Do not monkey-patch `node:net` globally.
+- Do not promise transparent recovery after the remote target has closed its own connection.
+- Do not expose an unauthenticated generic open proxy.
+- Do not require consumers to use TypeScript. Public docs and source stay JavaScript with JSDoc.
+
+## API shape
+
+### `MultiplexedSocketductConnection` (primary v3 API)
+
+```js
+import {MultiplexedSocketductConnection} from "socketduct/multiplexed"
+
+const transport = new MultiplexedSocketductConnection({
+  relay: {host: "relay.example.net", port: 3100, token: process.env.SOCKETDUCT_TOKEN},
+  tls: {caFile: "/certs/relay-ca.crt", servername: "relay.example.net"},
+  spoolDirectory: "/tmp/socketduct-v3",
+  maxAgeMs: 86_400_000,
+  connectionId: "runner_01_stable_identity"
+})
+
+// The method is pre-bound and has normal createConnection(options, callback)
+// semantics, so it can be passed directly to a generic TCP/HTTP client.
+const socket = transport.createConnection({
+  host: "api.internal",
+  port: 443,
+  sessionName: "api-1"
+}, (error, connectedSocket) => {
+  if (error) throw error
+  connectedSocket.write("...")
+})
+```
+
+The first call opens and authenticates one physical TCP/TLS connection. Every
+later call allocates only a `VirtualSocket`; it does not create another WAN
+transport. `VirtualSocket` extends `Duplex` and implements the ordinary socket
+events, half-close, timeout, destruction, pause/resume, address metadata,
+`ref`/`unref`, and compatible `setNoDelay`/`setKeepAlive` behavior. Standard
+Node HTTP can use `agent.createConnection = transport.createConnection`; no
+Socketduct-specific HTTP agent is required.
+
+Inner TLS remains supported:
+
+```js
+const raw = transport.createConnection({host: "api.internal", port: 443})
+const secure = tls.connect({socket: raw, servername: "api.internal", ca})
+```
+
+`SocketductStreamError` is stream-local. `SocketductSessionLostError` means a
+resumed stream's target/session could not be retained and callers must reconcile
+any uncertain higher-level operation. Closing one virtual socket never closes
+the shared transport; call `await transport.close()` to close the owner.
+
+Durable recovery across a client-object or process replacement is explicit.
+Supply the same caller-owned `connectionId`, `spoolDirectory`, stream
+`identifier`, target and name, register every recovered stream synchronously
+before the replacement transport starts, and set `recover: true`:
+
+```js
+await oldTransport.detach() // optional orderly handoff; a process crash also detaches
+const replacement = new MultiplexedSocketductConnection({
+  relay,
+  connectionId: "runner_01_stable_identity",
+  spoolDirectory: "/tmp/socketduct-v3"
+})
+const socket = replacement.createConnection({
+  host: "api.internal",
+  port: 443,
+  identifier: "build_stream_01",
+  sessionName: "build",
+  recover: true
+})
+```
+
+Fresh opens use exclusive spool creation and never truncate an existing stable
+identifier. Recovery validates bounded metadata, connection/stream identity,
+target, generation, sequence positions and contiguous replay chunks; missing,
+corrupt, expired or inconsistent state fails closed. V3 spools default to a
+24-hour `maxAgeMs`; callers may set a shorter positive bound. Constructing a
+spool owner removes well-formed abandoned entries older than that bound so
+expired stable identifiers and disk space are reclaimed. Client-to-target bytes are durable
+before transmission, so acknowledged bytes are not replayed and an existing
+relay target is not reopened. The directional acknowledgement positions are
+also durable. A replacement object resumes target-to-client delivery from its
+durable receive acknowledgement rather than from unread bytes buffered only by
+the old `VirtualSocket`; same-object reconnects retain that readable-buffer
+optimization. An opening stream whose `OPEN` may already have reached the relay
+is reconciled through the resume result and is never opened fresh speculatively.
+Callers recovering higher-level request/response protocols remain
+responsible for durably reconciling application state after uncertain results.
+`detach()` requires an explicit `connectionId`, preserves active spools and
+does not send stream resets. `close()` remains terminal and removes spools.
+
+### `MultiplexedSocketductTransportSet` (multi-gateway v3 API)
+
+Use one transport set per Node process when the process has several genuinely
+distinct gateway paths:
+
+```js
+import {MultiplexedSocketductTransportSet} from "socketduct/multiplexed"
+
+const set = new MultiplexedSocketductTransportSet({
+  connectionId: "runner_01_stable_identity",
+  spoolDirectory: "/tmp/socketduct-v3-set",
+  minimumReadyMembers: 1,
+  maxTotalBufferBytes: 32 * 1024 * 1024,
+  maxTotalSpoolBytes: 32 * 1024 * 1024,
+  maxTotalQueuedBytes: 33 * 1024 * 1024,
+  maxPendingOpens: 1024,
+  memberOptions: {reconnectDelayMs: 100},
+  gateways: [
+    {gatewayId: "starlink", endpoint: {relay: {host: "192.0.2.10", port: 3100, token}}},
+    {gatewayId: "zyxel", endpoint: {relay: {host: "192.0.2.11", port: 3100, token}}},
+    {gatewayId: "o2gateway", endpoint: {relay: {host: "192.0.2.12", port: 3100, token}}}
+  ]
+})
+
+const starting = set.start()
+agent.createConnection = set.createConnection
+await starting
+```
+
+Every entry must have a stable 2-64 character `gatewayId` and an explicit
+`endpoint.relay`. An optional, gateway-specific `endpoint.createPhysicalSocket`
+can pin an interface, routing table or external transport. Repeating the same
+relay address without distinct pinned factories is rejected: assigning three
+names to one load-balanced endpoint is not path diversity. Socketduct cannot
+inspect arbitrary DNS or factory routing, so callers remain responsible for
+making each declared endpoint/factory genuinely gateway-pinned. Blank,
+duplicate and path-unsafe IDs and malformed endpoint entries fail synchronously.
+
+`start()` constructs no new members: the constructor creates exactly one
+`MultiplexedSocketductConnection` per gateway and `start()` warms all of them
+concurrently. Concurrent starts share one promise. It resolves when
+`minimumReadyMembers` (default 1) are authenticated; slower/unavailable members
+keep reconnecting and rejoin automatically. New virtual sockets are assigned in
+configured-order round-robin across members whose physical state is `ready`.
+Fairness is per open, and a stream remains absolutely pinned to its selected
+member, connection identity, spool namespace and reconnect/resume owner.
+
+`createConnection()` always returns an app-facing `VirtualSocket` immediately.
+Calling it before `start()` lazily starts the set; calling it while initial
+startup is pending or while every member is reconnecting leaves the socket in
+its normal `connecting`/`pending` state. Opens wait FIFO until initial
+`minimumReadyMembers` has been reached, and after that any one recovered ready
+member may resume the queue. New calls never wait behind a reconnecting route
+when a healthy sibling is ready.
+
+Waiting does not assign an anonymous or merely connecting member. `gatewayId`
+is `undefined` until one ready member accepts the open, then becomes the stable,
+immutable configured ID for that socket. Destroying the socket first removes
+the pending open, so later readiness cannot leak a member stream. A member
+selected immediately before its path drops retains the stream and performs
+member-local v3 recovery; the set never speculatively migrates it.
+
+`createConnection(options, callback)` is pre-bound and invokes its callback once
+on `connect` or the terminal pre-connect error; the socket emits `connect` before
+`ready`. A pending open snapshots its top-level virtual options and nested
+`target` when called, so later caller mutations cannot change the eventual
+member open. Pending writes accept every TypedArray and `DataView` supported by
+Node Writable, retain normal backpressure and timeouts, and reserve their exact
+bytes in the shared in-memory/queued budget. Pending opens are also capped by
+`maxPendingOpens` (default 1024), with
+`SOCKETDUCT_SET_PENDING_OPEN_LIMIT` reported synchronously when the count is
+full. Terminal inability to meet initial readiness and terminal loss of every
+member fail waiting sockets normally. Post-readiness loss of every member uses
+`SocketductTransportSetTerminalError` with code
+`SOCKETDUCT_TRANSPORT_SET_TERMINAL`; its `errors` array preserves one terminal
+cause per configured gateway in configured order. Privacy-safe
+`status().members[].terminalErrorCode` exposes only each stable cause code, not
+its message, stack, endpoint, credentials or payload. `close()` fails pending
+sockets and later opens reject synchronously as closed.
+
+`createTlsConnection(options, callback)` immediately wraps that raw virtual
+socket with ordinary `tls.connect` target options such as `servername`, `ca`,
+`cert` and `key`. Node TLS owns the handshake, `secureConnect`, TLS errors and
+the callback, which runs exactly once only after `secureConnect` or failure.
+Both methods count only completed member assignments and preserve stream
+stickiness. Every returned raw or TLS socket exposes enumerable `gatewayId`;
+persist its immutable value after connection so a replacement can recover the
+stream on its original member.
+
+Process-replacement recovery is deliberately separate from ordinary selection.
+First detach the old set when an orderly handoff is possible. Construct the
+replacement with the same base `connectionId`, spool directory, gateway IDs and
+pinned endpoints. Then register each durable stream with its original
+`gatewayId` before calling `start()`:
+
+```js
+await set.detach()
+
+const replacement = new MultiplexedSocketductTransportSet(sameSetOptions)
+const recovered = replacement.recoverConnection({
+  gatewayId: durableRecord.gatewayId, // captured from the original socket
+  host: "api.internal",
+  port: 443,
+  identifier: "build_stream_01",
+  sessionName: "build"
+})
+await replacement.start()
+```
+
+`recoverConnection()` implies durable recovery and rejects a missing or unknown
+gateway ID, an explicit `recover` option, or registration after `start()` has
+begun. It bypasses round-robin only to reach that configured member; it never
+migrates or replays the stream on a sibling. Ordinary `createConnection()` and
+`createTlsConnection()` reject `recover: true` and `gatewayId`, so new opens
+cannot force a path. `detach()` coalesces with concurrent shutdown calls,
+preserves active member spools, and retires empty warmed lanes; `close()` remains
+terminal and removes their spools.
+
+The caller-owned set `connectionId` is required. Socketduct derives a stable,
+opaque member connection identity and a separate safe spool subdirectory from
+each `{connectionId, gatewayId}` pair; gateway IDs are never interpolated into
+filesystem paths. The three set limits default to 32 MiB retained data, 32 MiB
+spool data and 33 MiB total queued data/control respectively. They are shared
+reservations across all members, in addition to each member's existing limits,
+so adding paths does not multiply the process budget. Invalid types and
+non-positive values fail rather than being coerced. Pending pre-assignment bytes
+use those same memory and queued-byte budgets but never consume spool capacity;
+they transfer into the selected member's normal accounting on assignment.
+Memory is released when its
+buffer is discarded, but shared spool capacity remains reserved until the
+corresponding durable truncate or remove succeeds. Failed cleanup keeps that
+capacity occupied and fails the affected member visibly.
+
+`status()` returns only safe aggregate counts/bytes, `pendingOpens`, its maximum,
+and an ordered member list:
+gateway ID, lifecycle state, assignments, physical connects/reconnects, virtual
+stream count and queued/spool bytes. It excludes relays, targets, tokens,
+credentials, names, payloads and spool contents. Concurrent `close()` calls
+share one promise. Every member is attempted once in configured order; multiple
+failures are returned as an `AggregateError` with its `errors` in that order.
+Per-member `spoolCleanupFailures` records durable cleanup failures without
+exposing spool identity or contents.
+
+The `socketduct/http` and `socketduct/https` adapters below remain supported for
+legacy v2 compatibility. They create one v2 WAN tunnel per pooled HTTP socket
+and are not the primary v3 API.
+
+### `connectSocketduct(options)`
+
+```js
+import {connectSocketduct} from "socketduct"
+
+const socket = connectSocketduct({
+  relay: {
+    host: "gateway.example.net",
+    port: 3100,
+    token: process.env.SOCKETDUCT_TOKEN
+  },
+  target: {
+    host: "127.0.0.1",
+    port: 2375
+  },
+  sessionName: "docker-api",
+  spoolDirectory: "/tmp/socketduct-docker",
+  maxBytes: 5_000_000,
+  maxAgeMs: 300_000,
+  reconnect: {
+    initialDelayMs: 250,
+    maxDelayMs: 5_000,
+    maxInterruptedMs: 60_000
+  }
+})
+
+socket.write(Buffer.from("GET /_ping HTTP/1.1\r\nHost: docker\r\n\r\n"))
+socket.on("data", (chunk) => process.stdout.write(chunk))
+```
+
+`connectSocketduct()` returns immediately like `net.connect()`. It emits `connect` only after the relay has connected the requested target, transitioned the session to active, and sent `session.created` (or after a successful resume). Writes made earlier remain queued locally and do not reach the target before readiness.
+
+### `new SocketductSocket(options)`
+
+`SocketductSocket` should extend `Duplex` and expose the common socket fields/methods that libraries usually probe:
+
+- events: `connect`, `ready`, `data`, `end`, `close`, `error`, `timeout`, `drain`
+- methods: `connect`, `write`, `end`, `destroy`, `pause`, `resume`, `setTimeout`, `setNoDelay`, `setKeepAlive`, `address`, `ref`, `unref`
+- properties: `connecting`, `destroyed`, `pending`, `remoteAddress`, `remotePort`, `localAddress`, `localPort`, `bytesRead`, `bytesWritten`
+
+The constructor should configure the socket without opening the relay connection. The public `.connect()` method starts relay connection/session create or resume and returns `this`, matching Node's chaining style. `connectSocketduct(options)` is the convenience wrapper that constructs `new SocketductSocket(options)`, schedules `.connect()`, and returns the socket immediately.
+
+No-op compatibility methods are acceptable only when the behavior is harmless and documented. For example, `setNoDelay()` can return `this` because Socketduct frames data over its own tunnel and does not expose the target TCP socket directly to the caller.
+
+### `createSocketductConnectionFactory(options)`
+
+```js
+const createConnection = createSocketductConnectionFactory({
+  relay: {host, port, token},
+  spoolDirectory: "/tmp/socketduct-docker"
+})
+
+const socket = createConnection({
+  host: "127.0.0.1",
+  port: 2375,
+  sessionName: "docker-api"
+})
+```
+
+The factory lets libraries accept a `createConnection` hook without needing to know about all Socketduct relay settings on every call. The relay token is required in `relay.token`; callers must treat it as a secret and Socketduct client APIs must not log it.
+
+### `SocketductHttpAgent`
+
+```js
+import {SocketductHttpAgent} from "socketduct/http"
+
+const agent = new SocketductHttpAgent({
+  relay: {host, port, token},
+  target: {host: "127.0.0.1", port: 2375},
+  sessionNamePrefix: "docker-http"
+})
+```
+
+The agent should override `createConnection(options, callback)` and return a `SocketductSocket`. It should support one session per HTTP connection so keep-alive pooling can reuse sockets normally.
+
+The callback is invoked exactly once with either the connected socket or the pre-connect error. Relay protocol failures are `SocketductRelayError` instances with stable `code` and `retryable` fields, so integrations should use those fields rather than matching human-readable messages.
+
+### `SocketductHttpsAgent`
+
+The HTTPS adapter is a dedicated package subpath and is intentionally not exported from the main barrel:
+
+```js
+import {readFileSync} from "node:fs"
+import {SocketductHttpsAgent} from "socketduct/https"
+
+const agent = new SocketductHttpsAgent({
+  relay: {host: "relay.example.net", port: 3100, token: process.env.SOCKETDUCT_TOKEN},
+  relayTls: {
+    caFile: "/certs/relay-ca.crt",
+    servername: "relay.example.net"
+  },
+  target: {host: "10.0.0.15", port: 2376},
+  targetTls: {
+    ca: readFileSync("/certs/docker-ca.crt"),
+    cert: readFileSync("/certs/docker-client.crt"),
+    key: readFileSync("/certs/docker-client.key"),
+    rejectUnauthorized: true,
+    servername: "docker.example.internal"
+  },
+  spoolDirectory: "/tmp/socketduct-docker"
+})
+```
+
+`relayTls` protects and authenticates the edge-to-relay connection. `targetTls` is independent and protects the logical Socketduct stream to the target HTTPS server. The agent creates a raw `SocketductSocket`, waits for real target readiness, then wraps it with `node:tls` and invokes Node's agent callback only after `secureConnect`.
+
+`createConnection(options, callback)` is the asynchronous hook used by Node's `https.Agent` machinery and requires that callback ownership path. Calling it directly without a callback throws synchronously before allocating a tunnel or target connection; applications should pass the agent to `https.request()` instead.
+
+Target `ca`, `cert`, and `key` accept Node TLS certificate material. `cert` and `key` are an atomic pair. `rejectUnauthorized` defaults to `true`. When supplied, `servername` must be non-empty and selects the certificate identity and SNI hostname. Otherwise the identity comes from the request host/hostname, falling back to the agent's fixed target host. For an IP identity, Socketduct omits SNI but still verifies the certificate against that IP.
+
+`AbortSignal` cancellation, `ClientRequest.abort()`, connection timeout, TLS failure, and agent destruction close the logical session exactly once and preserve the original Socketduct or TLS error. A temporary edge-to-relay interruption resumes underneath the same target `TLSSocket`. A target TCP/TLS failure remains terminal.
+
+## Reverse gateway sockets
+
+`ReverseGatewayConnection` from `socketduct/reverse` exposes the same bound
+`createConnection(options, callback?)` shape and returns `VirtualSocket`.
+It selects exactly one registered gateway during `connect()`. The existing
+`MultiplexedSocketductTransportSet` accepts `endpoint.reverseHub`, allowing
+three ready members to retain deterministic health-aware round-robin behavior.
+Reverse established operations deliberately do not support
+`registerRecoveredConnection()` or durable replay; a transport loss is a typed
+terminal result requiring application reconciliation.
+
+Reverse virtual sockets accept individual writes larger than their configured
+retained-byte limit. The connection progresses those writes in slices bounded by
+the frame size and negotiated peer window as ACKs return flow-control capacity,
+rotating released connection capacity among streams with pending writes. It
+completes each Node Writable callback only after the full write has entered that
+bounded progression. Per-stream and per-connection limits remain hard ceilings
+for retained replay bytes.
+
+See [Native reverse gateway](reverse-gateway.md) for the full constructor and
+role contract.
+
+## Spool limits
+
+All public APIs (`connectSocketduct`, `createSocketductConnectionFactory`, `SocketductHttpAgent`, and `SocketductHttpsAgent`) accept optional `maxBytes` and `maxAgeMs` to bound per-session spool storage:
+
+- `maxBytes` — Maximum total bytes stored on disk for a session's unacknowledged chunks. When a new append would exceed the limit, a `SpoolQuotaError` with code `"SPOOL_QUOTA_EXCEEDED"` is thrown and the chunk is not written. The quota is enforced against durable queued payload bytes tracked via a per-session sidecar file (`usage.json`), so reopening a spool directory with a new `SessionSpool` instance continues to respect the limit.
+- `maxAgeMs` — Maximum age of a spool session since creation. When the session exceeds this age, appends throw a `SpoolQuotaError` with code `"SPOOL_AGE_EXCEEDED"`. Accepts an optional `now` function for deterministic testing.
+
+Both options default to unbounded (no limit). These limits apply independently: a session can be rejected by age even when under the byte limit, and vice versa.
+
+## State model
+
+```text
+idle -> connecting -> connected -> interrupted -> reconnecting -> connected
+                      |              |                    |
+                      v              v                    v
+                    ending         expired              failed
+```
+
+Important behavior:
+
+1. Before `connect`, writes are queued by the `Duplex` implementation and by the existing Socketduct spool path.
+2. During `interrupted`, the app-facing socket remains open while limits allow.
+3. If the relay resumes before `maxInterruptedMs`, queued/spooled data is replayed in sequence.
+4. If the remote target closes or the resume window expires, the socket emits `error` and then `close` like a normal broken TCP socket.
+5. Backpressure must be driven by Node stream return values and `drain`, not by unbounded in-memory arrays.
+
+Destroying an announced socket during relay interruption records a logical-close intent. Socketduct may reconnect only far enough to authenticate and resume before sending `session.close`, so the relay can promptly remove the target and session instead of retaining them for the resume window. That close-only path never replays application data.
+
+## Implementation mapping
+
+The current `startTcpEdge()` already contains the key session logic but wraps it behind a local TCP server. The socket API should extract that per-connection behavior into reusable client-side pieces:
+
+- `src/client/socketduct-socket.js` — `Duplex`-compatible socket facade.
+- `src/client/connect.js` — public `connectSocketduct()` and factory helpers.
+- `src/client/http-agent.js` — Node `http.Agent` adapter.
+- `src/client/https-agent.js` — Node `https.Agent` adapter with target TLS ownership.
+- `src/edge/tcp-edge.js` — keep as a small local-listener wrapper around `connectSocketduct()`.
+- `src/index.js` or package exports — export the client APIs without making CLI startup run on import.
+
+The extraction should keep protocol details private to the socket implementation. Callers should only think in terms of socket writes, reads, errors, and close semantics.
+
+## Compatibility checks
+
+Each implementation slice should include tests for:
+
+- duck typing: object is a `Duplex`, has common socket methods, and supports chaining for no-op methods;
+- connection lifecycle: `connect` emitted once after the initial `session.created`, and `ready` emitted after initial connect and each successful resume;
+- streaming: bidirectional bytes flow through relay to a fake target;
+- backpressure: large writes do not bypass stream pressure signals;
+- interruption: relay tunnel drops, target stays alive, stale control frames are ignored, pending writes are replayed through the resumed relay, and the socket resumes;
+- failure: unauthorized target and expired resume emit normal socket errors;
+- HTTP: `http.request({agent})` can call a fake Docker-style endpoint.
+
+## Docker-specific notes
+
+Docker clients need ordinary HTTP request/response traffic plus long-lived streaming endpoints. The socket API must not special-case Docker, but the tests should include Docker-shaped flows:
+
+- buffered JSON requests such as `GET /version`;
+- chunked or streaming responses such as logs/events;
+- HTTP connection upgrade/hijack-style streams used by Docker attach/exec.
+
+These flows drive the need for a real `Duplex` facade and an `http.Agent` adapter instead of only a local port-forwarding process.

package/eslint.config.js

@@ -0,0 +1,36 @@
+// @ts-check
+
+import js from "@eslint/js"
+import globals from "globals"
+import {defineConfig, globalIgnores} from "eslint/config"
+import {jsdoc} from "eslint-plugin-jsdoc"
+
+export default defineConfig([
+  globalIgnores(["dist/**", "node_modules/**"]),
+  {
+    files: ["**/*.{js,mjs,cjs}"],
+    plugins: {js},
+    extends: ["js/recommended"],
+    languageOptions: {
+      ecmaVersion: "latest",
+      globals: globals.node,
+      sourceType: "module"
+    },
+    rules: {
+      "brace-style": ["error", "1tbs", {allowSingleLine: true}],
+      "comma-dangle": ["error", "never"],
+      "indent": ["error", 2],
+      "no-multiple-empty-lines": ["error", {max: 1, maxBOF: 0, maxEOF: 0}],
+      "object-curly-spacing": ["error", "never"],
+      "quotes": ["error", "double", {avoidEscape: true}],
+      "semi": ["error", "never"]
+    }
+  },
+  jsdoc({
+    config: "flat/recommended",
+    rules: {
+      "jsdoc/reject-any-type": "error",
+      "jsdoc/require-param-description": "off"
+    }
+  })
+])

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "socketduct",
+  "version": "0.1.15",
+  "description": "Resilient authenticated tunnel/proxy for keeping socket streams alive across flaky links.",
+  "type": "module",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./http": "./src/client/http-agent.js",
+    "./https": "./src/client/https-agent.js",
+    "./multiplexed": "./src/client/multiplexed.js",
+    "./reverse": "./src/reverse/index.js",
+    "./relay": "./src/relay.js"
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "scripts": {
+    "gateway:deploy": "node scripts/deploy-gateway.js",
+    "check": "npm run lint && npm run typecheck && npm test",
+    "release:patch": "npm run check && release-patch",
+    "start": "node src/index.js",
+    "test": "node scripts/test.js",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings 0"
+  },
+  "keywords": [
+    "resilient",
+    "tunnel",
+    "proxy",
+    "sessions"
+  ],
+  "license": "UNLICENSED",
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^24.0.0",
+    "@velocious/testing": "0.0.10",
+    "eslint": "^10.0.3",
+    "eslint-plugin-jsdoc": "^62.7.1",
+    "globals": "^17.2.0",
+    "release-patch": "^1.0.8",
+    "typescript": "^5.7.2"
+  }
+}