tunnelmate 0.1.0 → 0.2.0

package/dist/src/firewall.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupWindowsFirewall = setupWindowsFirewall;
+const child_process_1 = require("child_process");
+const util_1 = require("./util");
+/**
+ * Adds Windows Firewall inbound allow rules for the given TCP ports.
+ * Requires an Administrator terminal; idempotent (safe to run repeatedly).
+ * No-ops with a message on non-Windows platforms.
+ */
+function setupWindowsFirewall(ports) {
+    if (process.platform !== 'win32') {
+        (0, util_1.log)('--setup-firewall is only implemented for Windows; configure your firewall manually on this platform');
+        return;
+    }
+    for (const port of ports) {
+        const ruleName = `tunnelme TCP ${port}`;
+        const script = `if (-not (Get-NetFirewallRule -DisplayName '${ruleName}' -ErrorAction SilentlyContinue)) { ` +
+            `New-NetFirewallRule -DisplayName '${ruleName}' -Direction Inbound -Protocol TCP -LocalPort ${port} -Action Allow -ErrorAction Stop | Out-Null; ` +
+            `Write-Output 'created' } else { Write-Output 'exists' }`;
+        try {
+            const output = (0, child_process_1.execFileSync)('powershell', ['-NoProfile', '-Command', script], { stdio: 'pipe' })
+                .toString()
+                .trim();
+            if (output === 'created') {
+                (0, util_1.log)(`firewall: added inbound rule for TCP ${port} ("${ruleName}")`);
+            }
+            else {
+                (0, util_1.log)(`firewall: inbound rule for TCP ${port} already exists ("${ruleName}")`);
+            }
+        }
+        catch (err) {
+            const e = err;
+            const msg = e.stderr ? e.stderr.toString().trim() : e.message;
+            (0, util_1.log)(`firewall: failed to add rule for TCP ${port}: ${msg}`);
+            if (/access is denied|requested operation requires elevation/i.test(msg)) {
+                (0, util_1.log)('firewall: this requires an Administrator terminal -- re-run as Administrator');
+            }
+        }
+    }
+}

package/dist/src/network.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectPublicIp = detectPublicIp;
+exports.quickDomain = quickDomain;
+exports.autoPortForward = autoPortForward;
+const os = __importStar(require("os"));
+const https = __importStar(require("https"));
+const util_1 = require("./util");
+const IP_ECHO_SERVICES = ['https://api.ipify.org', 'https://ifconfig.me/ip', 'https://icanhazip.com'];
+// @achingbrain/nat-port-mapper is ESM-only; this project is CommonJS, so it
+// must be loaded via dynamic import() rather than require(). (Type-only
+// imports above are erased at compile time and don't trigger this issue.)
+function loadUpnpNat() {
+    return Promise.resolve().then(() => __importStar(require('@achingbrain/nat-port-mapper'))).then((mod) => mod.upnpNat);
+}
+function fetchText(url, timeoutMs = 5000) {
+    return new Promise((resolve, reject) => {
+        const req = https.get(url, { timeout: timeoutMs }, (res) => {
+            if (res.statusCode !== 200) {
+                res.resume();
+                reject(new Error(`${url} returned HTTP ${res.statusCode}`));
+                return;
+            }
+            let body = '';
+            res.on('data', (c) => (body += c));
+            res.on('end', () => resolve(body.trim()));
+        });
+        req.on('timeout', () => req.destroy(new Error(`${url} timed out`)));
+        req.on('error', reject);
+    });
+}
+/** Picks this machine's primary LAN IPv4 address (non-internal). */
+function localIp() {
+    const ifaces = os.networkInterfaces();
+    for (const name of Object.keys(ifaces)) {
+        for (const iface of ifaces[name] || []) {
+            if (iface.family === 'IPv4' && !iface.internal)
+                return iface.address;
+        }
+    }
+    throw new Error('Could not determine a local LAN IPv4 address');
+}
+/**
+ * Best-effort public IP detection: tries asking the router directly via
+ * UPnP/NAT-PMP first (no third party involved), falls back to a plain HTTP
+ * echo service if the router doesn't support/allow that.
+ */
+async function detectPublicIp() {
+    try {
+        const upnpNat = await loadUpnpNat();
+        const client = upnpNat();
+        for await (const gateway of client.findGateways({ signal: AbortSignal.timeout(4000) })) {
+            try {
+                const ip = await gateway.externalIp();
+                await gateway.stop();
+                if (ip)
+                    return ip;
+            }
+            catch {
+                await gateway.stop().catch(() => { });
+            }
+            break;
+        }
+    }
+    catch {
+        // no UPnP/NAT-PMP gateway reachable -- fall through to HTTP echo
+    }
+    for (const url of IP_ECHO_SERVICES) {
+        try {
+            const ip = await fetchText(url);
+            if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(ip))
+                return ip;
+        }
+        catch {
+            // try next service
+        }
+    }
+    throw new Error('Could not determine public IP (tried UPnP/NAT-PMP and HTTP echo services)');
+}
+/** Builds a working public hostname for `port` using sslip.io's wildcard DNS -- no domain ownership needed, no traffic relay. */
+function quickDomain(port, ip) {
+    return `p${port}.${ip.split('.').join('-')}.sslip.io`;
+}
+/**
+ * Best-effort automatic port forwarding via UPnP/NAT-PMP for the given TCP
+ * ports. Returns a stop() function that removes the mappings, or null if no
+ * compatible router was found. Mappings auto-renew for as long as the
+ * process runs (handled by the underlying library).
+ */
+async function autoPortForward(ports) {
+    const host = localIp();
+    const upnpNat = await loadUpnpNat();
+    const client = upnpNat({ description: 'tunnelme' });
+    let gateway = null;
+    try {
+        for await (const gw of client.findGateways({ signal: AbortSignal.timeout(4000) })) {
+            gateway = gw;
+            break;
+        }
+    }
+    catch (err) {
+        (0, util_1.log)(`UPnP: gateway discovery failed: ${err.message}`);
+    }
+    if (!gateway) {
+        (0, util_1.log)('UPnP: no compatible router found (UPnP/NAT-PMP may be disabled) -- set up port forwarding manually');
+        return null;
+    }
+    for (const port of ports) {
+        try {
+            const mapping = await gateway.map(port, host, { externalPort: port, protocol: 'tcp' });
+            (0, util_1.log)(`UPnP: mapped external port ${mapping.externalPort} -> ${host}:${port}`);
+        }
+        catch (err) {
+            (0, util_1.log)(`UPnP: failed to map port ${port}: ${err.message}`);
+        }
+    }
+    const foundGateway = gateway;
+    return async () => {
+        await foundGateway.stop().catch(() => { });
+    };
+}

package/dist/src/server.js

@@ -0,0 +1,258 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startServer = startServer;
+const http = __importStar(require("http"));
+const tls = __importStar(require("tls"));
+const crypto = __importStar(require("crypto"));
+const ws_1 = require("ws");
+const certStore_1 = require("./certStore");
+const util_1 = require("./util");
+const CONN_WAIT_TIMEOUT_MS = 15000;
+const LIVE_CHECK_PATH = '/host/live';
+const LIVE_CHECK_LINE_RE = /^(GET|HEAD) \/host\/live(\?\S*)? HTTP\/\d\.\d\r?$/;
+function liveCheckBody(domain) {
+    return JSON.stringify({ live: true, domain, checkedAt: new Date().toISOString() });
+}
+function startServer(opts) {
+    const { httpPort = 80, httpsPort = 443, controlPort = 7000, certsDir, tlsMode = 'acme', acmeEmail, staging = false, token = null, } = opts;
+    const certStore = new certStore_1.CertStore({ certsDir, mode: tlsMode, acmeEmail, staging });
+    const domainClients = new Map();
+    const pendingConns = new Map();
+    // ---- Control + data WebSocket server (LAN/localhost only, not internet-exposed) ----
+    const controlHttp = http.createServer((_req, res) => {
+        res.writeHead(200, { 'content-type': 'text/plain' });
+        res.end('tunnelme control channel\n');
+    });
+    const wss = new ws_1.WebSocketServer({ noServer: true });
+    controlHttp.on('upgrade', (req, socket, head) => {
+        const url = new URL(req.url || '', 'http://internal');
+        if (url.pathname === '/_tunnelme/control') {
+            wss.handleUpgrade(req, socket, head, (ws) => handleControlConnection(ws));
+        }
+        else if (url.pathname === '/_tunnelme/data') {
+            const id = url.searchParams.get('id') || '';
+            wss.handleUpgrade(req, socket, head, (ws) => handleDataConnection(ws, id));
+        }
+        else {
+            socket.destroy();
+        }
+    });
+    function handleControlConnection(ws) {
+        const ownedDomains = new Set();
+        ws.on('message', (raw) => {
+            let msg;
+            try {
+                msg = JSON.parse(raw.toString());
+            }
+            catch {
+                return;
+            }
+            if (msg.type === 'register') {
+                if (token && !(0, util_1.secureCompare)(msg.token || '', token)) {
+                    ws.send(JSON.stringify({ type: 'error', message: 'invalid token' }));
+                    ws.close();
+                    return;
+                }
+                if (!Array.isArray(msg.tunnels)) {
+                    ws.send(JSON.stringify({ type: 'error', message: '"tunnels" must be an array' }));
+                    return;
+                }
+                const registered = [];
+                for (const t of msg.tunnels) {
+                    if (!t || !t.domain || t.port === undefined || t.port === null)
+                        continue;
+                    domainClients.set(t.domain, ws);
+                    ownedDomains.add(t.domain);
+                    registered.push(t.domain);
+                    (0, util_1.log)(`registered ${t.domain} -> client's localhost:${t.port}`);
+                }
+                ws.send(JSON.stringify({ type: 'registered', domains: registered }));
+            }
+        });
+        ws.on('close', () => {
+            for (const domain of ownedDomains) {
+                if (domainClients.get(domain) === ws) {
+                    domainClients.delete(domain);
+                    (0, util_1.log)(`unregistered ${domain}`);
+                }
+            }
+        });
+        ws.on('error', () => { });
+    }
+    function handleDataConnection(ws, id) {
+        const pending = pendingConns.get(id);
+        if (!pending) {
+            ws.close();
+            return;
+        }
+        pendingConns.delete(id);
+        clearTimeout(pending.timer);
+        pending.resolve((0, ws_1.createWebSocketStream)(ws, { decodeStrings: false }));
+    }
+    /** Ask the owning client to open a data connection for `domain`; resolves to a duplex stream. */
+    function requestProxyConnection(domain) {
+        const ws = domainClients.get(domain);
+        if (!ws || ws.readyState !== ws_1.WebSocket.OPEN)
+            return Promise.reject(new Error('no client connected for domain'));
+        const id = crypto.randomUUID();
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                pendingConns.delete(id);
+                reject(new Error('timed out waiting for client data connection'));
+            }, CONN_WAIT_TIMEOUT_MS);
+            pendingConns.set(id, { resolve, reject, timer });
+            ws.send(JSON.stringify({ type: 'conn', id, domain }));
+        });
+    }
+    // ---- Plain :80 server: ACME http-01 challenges + redirect to https ----
+    const httpServer = http.createServer((req, res) => {
+        const remote = `${req.socket.remoteAddress}:${req.socket.remotePort}`;
+        (0, util_1.log)(`${remote} -> ${req.headers.host || '(no host)'} ${req.method} ${req.url}`);
+        const url = new URL(req.url || '', `http://${req.headers.host || 'localhost'}`);
+        if (url.pathname.startsWith('/.well-known/acme-challenge/')) {
+            const challengeToken = url.pathname.split('/').pop() || '';
+            const keyAuth = certStore.getChallengeResponse(challengeToken);
+            if (keyAuth) {
+                res.writeHead(200, { 'content-type': 'text/plain' });
+                res.end(keyAuth);
+                return;
+            }
+            res.writeHead(404);
+            res.end('not found');
+            return;
+        }
+        const host = (req.headers.host || '').split(':')[0];
+        if (!domainClients.has(host)) {
+            res.writeHead(404);
+            res.end('not found');
+            return;
+        }
+        if (url.pathname === LIVE_CHECK_PATH) {
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(liveCheckBody(host));
+            return;
+        }
+        const portSuffix = httpsPort === 443 ? '' : `:${httpsPort}`;
+        res.writeHead(301, { location: `https://${host}${portSuffix}${req.url}` });
+        res.end();
+    });
+    // ---- TLS :443 server: SNI-routed, only for registered domains. Raw byte
+    // forwarding only -- no HTTP parsing here, so HTTP/1.1, keep-alive and
+    // WebSocket upgrades all pass through transparently to the client's local app. ----
+    const httpsServer = tls.createServer({
+        SNICallback: (servername, cb) => {
+            if (!domainClients.has(servername)) {
+                cb(new Error(`unknown domain: ${servername}`));
+                return;
+            }
+            certStore
+                .getSecureContext(servername)
+                .then((ctx) => cb(null, ctx))
+                .catch((err) => {
+                (0, util_1.log)(`cert error for ${servername}:`, err.message);
+                cb(err);
+            });
+        },
+    }, (tlsSocket) => {
+        const domain = tlsSocket.servername;
+        if (!domain || !domainClients.has(domain)) {
+            tlsSocket.destroy();
+            return;
+        }
+        proxyRawConnection(tlsSocket, domain);
+    });
+    httpsServer.on('tlsClientError', () => { });
+    function proxyRawConnection(socket, domain) {
+        const remote = `${socket.remoteAddress}:${socket.remotePort}`;
+        (0, util_1.log)(`connection from ${remote} for ${domain}`);
+        socket.on('close', () => (0, util_1.log)(`connection closed from ${remote} for ${domain}`));
+        // Peek at the first chunk to catch the /host/live health check, which the
+        // server answers directly (proves the tunnel is reachable without needing
+        // the local app to be up). Anything else is pushed back with unshift()
+        // and proxied exactly as before. pause()+unshift() happen synchronously
+        // within this handler so no bytes are lost between the peek and the retry.
+        socket.once('data', (chunk) => {
+            const firstLine = chunk.toString('latin1').split('\r\n', 1)[0];
+            if (LIVE_CHECK_LINE_RE.test(firstLine)) {
+                (0, util_1.log)(`${remote} -> ${domain} GET ${LIVE_CHECK_PATH} (answered by tunnelme server)`);
+                const body = liveCheckBody(domain);
+                socket.end(`HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: ${Buffer.byteLength(body)}\r\nconnection: close\r\n\r\n${body}`);
+                return;
+            }
+            socket.pause();
+            socket.unshift(chunk);
+            forwardToClient(socket, domain, remote);
+        });
+    }
+    async function forwardToClient(socket, domain, remote) {
+        try {
+            // Wait for the client's data connection before attaching any 'data'
+            // consumer -- attaching one earlier would switch the socket into
+            // flowing mode and could drop bytes that arrive before pipe() is wired up.
+            const dataStream = await requestProxyConnection(domain);
+            (0, util_1.logRequestLines)(socket, `${remote} -> ${domain}`);
+            (0, util_1.pipeBidirectional)(socket, dataStream);
+        }
+        catch (err) {
+            (0, util_1.log)(`proxy failed for ${domain}:`, err.message);
+            socket.destroy();
+        }
+    }
+    function onListenError(label, port) {
+        return (err) => {
+            if (err.code === 'EACCES') {
+                (0, util_1.log)(`Failed to listen on :${port} (${label}): permission denied. ` +
+                    (process.platform === 'win32'
+                        ? 'Binding to ports below 1024 requires an Administrator terminal -- re-run as Administrator.'
+                        : 'Binding to ports below 1024 requires root -- re-run with sudo, or use a port above 1024.'));
+            }
+            else if (err.code === 'EADDRINUSE') {
+                (0, util_1.log)(`Failed to listen on :${port} (${label}): another process is already using this port.`);
+            }
+            else {
+                (0, util_1.log)(`Failed to listen on :${port} (${label}):`, err.message);
+            }
+            process.exit(1);
+        };
+    }
+    controlHttp.on('error', onListenError('control channel', controlPort));
+    httpServer.on('error', onListenError('http', httpPort));
+    httpsServer.on('error', onListenError('https', httpsPort));
+    controlHttp.listen(controlPort, () => (0, util_1.log)(`control channel listening on ws://0.0.0.0:${controlPort}`));
+    httpServer.listen(httpPort, () => (0, util_1.log)(`http (acme + redirect) listening on :${httpPort}`));
+    httpsServer.listen(httpsPort, () => (0, util_1.log)(`https tunnel entrypoint listening on :${httpsPort}`));
+    return { controlHttp, httpServer, httpsServer };
+}

package/dist/src/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/util.js

@@ -0,0 +1,103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.log = log;
+exports.describeError = describeError;
+exports.secureCompare = secureCompare;
+exports.pipeBidirectional = pipeBidirectional;
+exports.logRequestLines = logRequestLines;
+const crypto = __importStar(require("crypto"));
+function log(...args) {
+    console.log(new Date().toISOString(), ...args);
+}
+/** Formats an Error for logging, unwrapping AggregateError (whose own .message is often empty). */
+function describeError(err) {
+    if (!err)
+        return String(err);
+    const e = err;
+    if (Array.isArray(e.errors) && e.errors.length > 0) {
+        return e.errors.map((sub) => sub.message || String(sub)).join('; ');
+    }
+    return e.message || e.code || String(err);
+}
+/** Constant-time string comparison, safe for comparing against a network-supplied secret. */
+function secureCompare(a, b) {
+    const ha = crypto.createHash('sha256').update(String(a)).digest();
+    const hb = crypto.createHash('sha256').update(String(b)).digest();
+    return crypto.timingSafeEqual(ha, hb);
+}
+/** Bidirectionally pipes two duplex streams and destroys both if either errors or closes. */
+function pipeBidirectional(a, b) {
+    a.pipe(b);
+    b.pipe(a);
+    let cleaned = false;
+    const cleanup = () => {
+        if (cleaned)
+            return;
+        cleaned = true;
+        a.destroy();
+        b.destroy();
+    };
+    a.on('error', cleanup);
+    b.on('error', cleanup);
+    a.on('close', cleanup);
+    b.on('close', cleanup);
+}
+const REQUEST_LINE_RE = /^([A-Z]+) (\S+) HTTP\/\d\.\d$/;
+const MAX_LEFTOVER_BYTES = 8192;
+/**
+ * Passively taps a socket carrying raw HTTP bytes and logs each request line
+ * it spots (method + path), without consuming or altering the stream --
+ * safe to use alongside a .pipe() of the same socket. Best-effort: after a
+ * protocol upgrade (e.g. WebSocket) traffic is no longer HTTP and simply
+ * won't match, so logging naturally goes quiet for that connection.
+ */
+function logRequestLines(socket, label) {
+    let leftover = '';
+    socket.on('data', (chunk) => {
+        leftover += chunk.toString('latin1');
+        let idx;
+        while ((idx = leftover.indexOf('\r\n')) !== -1) {
+            const line = leftover.slice(0, idx);
+            leftover = leftover.slice(idx + 2);
+            const match = REQUEST_LINE_RE.exec(line);
+            if (match)
+                log(`${label} ${match[1]} ${match[2]}`);
+        }
+        if (leftover.length > MAX_LEFTOVER_BYTES) {
+            leftover = leftover.slice(-1024);
+        }
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tunnelmate",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Reverse-proxy a public domain to a localhost port, for dev/testing.",
   "license": "MIT",
   "type": "commonjs",
@@ -13,20 +13,34 @@
     "self-hosted"
   ],
   "bin": {
-    "tunnelme": "bin/tunnelme.js"
+    "tunnelme": "dist/bin/tunnelme.js"
   },
   "engines": {
     "node": ">=18"
   },
   "files": [
-    "bin",
-    "src"
+    "dist"
   ],
   "dependencies": {
+    "@achingbrain/nat-port-mapper": "^4.0.5",
     "acme-client": "^5.4.0",
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
     "selfsigned": "^2.4.1",
     "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^21.2.3",
+    "@commitlint/config-conventional": "^21.2.3",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^26.6.2",
+    "@types/ws": "^8.18.1",
+    "husky": "^9.1.7",
+    "typescript": "^7.0.2"
+  },
+  "scripts": {
+    "prepare": "husky",
+    "build": "tsc",
+    "prepublishOnly": "npm run build"
   }
 }