v5.3.0

feat(certificates): add certificate overview and reprovisioning in ops UI and API; track SmartProxy certificate events
v5.2.0
2026-02-13 17:05:33 +00:00 · 2026-02-13 17:05:33 +00:00 · 2026-02-13 14:19:19 +00:00 · 2026-02-13 14:19:19 +00:00 · 2026-02-13 12:12:01 +00:00 · 2026-02-13 12:12:01 +00:00
34 changed files with 1158 additions and 206 deletions
--- a/.playwright-mcp/dcrouter-scrollbar-issue.png
+++ b/.playwright-mcp/dcrouter-scrollbar-issue.png
--- a/.playwright-mcp/page-2026-02-01T23-10-23-737Z.png
+++ b/.playwright-mcp/page-2026-02-01T23-10-23-737Z.png
--- a/.playwright-mcp/page-2026-02-01T23-11-19-449Z.png
+++ b/.playwright-mcp/page-2026-02-01T23-11-19-449Z.png
--- a/.playwright-mcp/page-2026-02-01T23-12-03-126Z.png
+++ b/.playwright-mcp/page-2026-02-01T23-12-03-126Z.png
--- a/.playwright-mcp/page-2026-02-01T23-12-15-576Z.png
+++ b/.playwright-mcp/page-2026-02-01T23-12-15-576Z.png
--- a/changelog.md
+++ b/changelog.md
@@ -1,5 +1,83 @@
 # Changelog

+## 2026-02-13 - 5.3.0 - feat(certificates)
+add certificate overview and reprovisioning in ops UI and API; track SmartProxy certificate events
+
+- Add CertificateHandler with typedrequest endpoints: getCertificateOverview and reprovisionCertificate
+- Introduce ICertificateInfo and request/response interfaces for certificate operations
+- Frontend: add certificate state part, actions (fetchCertificateOverview, reprovisionCertificate), router view, and ops-view-certificates component
+- DcRouter: add certificateStatusMap, listen to SmartProxy certificate-issued/renewed/failed events, and add findRouteNameForDomain helper
+- Bump dependency @push.rocks/smartproxy to ^24.0.0
+
+## 2026-02-13 - 5.2.0 - feat(monitoring)
+add throughput metrics and expose them in ops UI
+
+- MetricsManager now reports bytesInPerSecond and bytesOutPerSecond as part of throughput
+- Extended IServerStats with requestsPerSecond and throughput {bytesIn, bytesOut, bytesInPerSecond, bytesOutPerSecond}
+- Stats handler updated to include requestsPerSecond and throughput; fallback stats initialize throughput fields to zero
+- Web UI ops overview displays Throughput In/Out (bits/s) and total bytes with new formatting helper
+- Bumped dependency @push.rocks/smartproxy to ^23.1.6
+
+## 2026-02-13 - 5.1.0 - feat(acme)
+Integrate SmartAcme DNS-01 handling and add certificate provisioning for SmartProxy
+
+- Add smartAcme property and lifecycle management (start/stop) in DcRouter
+- Create SmartAcme instance when DNS challenge handlers are present and wire certProvisionFunction to SmartProxy to return certificates for domains
+- Fall back to http-01 provisioning on SmartAcme errors for a domain
+- Stop SmartAcme during shutdown sequence to clean up resources
+- Bump dependency @push.rocks/smartproxy to ^23.1.5
+
+## 2026-02-13 - 5.0.7 - fix(deps)
+bump @push.rocks/smartdns to ^7.8.1 and @push.rocks/smartmta to ^5.2.2
+
+- package.json: updated @push.rocks/smartdns from ^7.8.0 to ^7.8.1 (patch)
+- package.json: updated @push.rocks/smartmta from ^5.2.1 to ^5.2.2 (patch)
+
+## 2026-02-12 - 5.0.6 - fix(deps)
+bump @push.rocks/smartproxy to ^23.1.4
+
+- package.json: @push.rocks/smartproxy ^23.1.2 → ^23.1.4
+- Dependency-only version bump, no source code changes
+
+## 2026-02-12 - 5.0.5 - fix(dcrouter)
+remove legacy handling of emailConfig.routes that added domain-based routes
+
+- Removed loop that added domain-based email routes from emailConfig.routes into emailRoutes
+- Previously created match.domains by extracting the recipient domain (split on '@') and defaulted forward target port to 25
+- Removed creation of TLS passthrough configuration for those forwarded routes
+- This prevents duplicate or incorrect domain-based routes being appended during email route construction
+
+## 2026-02-12 - 5.0.4 - fix(cache)
+use user-writable ~/.serve.zone/dcrouter for TsmDB and centralize data path logic
+
+- Default TsmDB storage changed from /etc/dcrouter/tsmdb to ~/.serve.zone/dcrouter/tsmdb
+- Introduced dcrouterHomeDir, dataDir, and defaultTsmDbPath in ts/paths.ts
+- CacheDb now defaults to defaultTsmDbPath when no storagePath is provided
+- DcRouter initialization updated to use paths.defaultTsmDbPath; README and readme.hints updated to document the new defaults
+- Avoids /etc permission issues and prevents starting a real MongoDB process in tests by using a user-writable default path
+
+## 2026-02-12 - 5.0.3 - fix(packaging)
+add files whitelist to package.json and remove Playwright-generated screenshots
+
+- Add a "files" array to package.json to control published package contents (includes ts/, ts_web/, dist/, dist_*/**, dist_ts/, dist_ts_web/, assets/, cli.js, npmextra.json, readme.md).
+- Remove multiple .playwright-mcp/*.png screenshot files (clean up Playwright test artifacts and reduce repository noise/size).
+
+## 2026-02-12 - 5.0.2 - fix(docs)
+update documentation and packaging configuration: document smartmta/smartdns integrations, adjust API method names, and add release registry info
+
+- README: document SmartDNS as Rust-powered DNS engine and smartmta as TypeScript+Rust MTA; add Rust-powered architecture section and component package table
+- README: update Node.js requirement from 18+ to 20+; replace embedded cache DB TsmDb with LocalTsmDb and reduce listed cached document types
+- README & ts_interfaces: rename typedrequest API adminLogin -> adminLoginWithUsernameAndPassword and add/clarify several API methods (logout, suppression management, RADIUS client/VLAN helpers)
+- README: update test instructions, change test file references and add a test coverage table
+- npmextra.json: re-key package configs (@git.zone/cli, @ship.zone/szci), tidy watch array formatting, and add release.registries and accessLevel for publishing
+
+## 2026-02-11 - 5.0.1 - fix(deps/tests)
+bump two dependencies and disable cache in tests
+
+- Bumped @api.global/typedrequest from ^3.2.5 to ^3.2.6
+- Bumped @push.rocks/smartradius from ^1.1.0 to ^1.1.1
+- Disabled cache in tests by adding cacheConfig: { enabled: false } to DcRouter instantiation in test/test.jwt-auth.ts, test/test.opsserver-api.ts, and test/test.protected-endpoint.ts
+
 ## 2026-02-11 - 5.0.0 - BREAKING CHANGE(mta)
 migrate internal MTA to @push.rocks/smartmta and remove legacy mail/deliverability implementation

--- a/npmextra.json
+++ b/npmextra.json
@@ -3,7 +3,11 @@
    "watchers": [
      {
        "name": "dcrouter-dev",
-        "watch": ["ts/**/*.ts", "ts_*/**/*.ts", "test_watch/devserver.ts"],
+        "watch": [
+          "ts/**/*.ts",
+          "ts_*/**/*.ts",
+          "test_watch/devserver.ts"
+        ],
        "command": "pnpm run build && tsrun test_watch/devserver.ts",
        "restart": true,
        "debounce": 500,
@@ -22,7 +26,7 @@
      }
    ]
  },
-  "gitzone": {
+  "@git.zone/cli": {
    "projectType": "service",
    "module": {
      "githost": "gitlab.com",
@@ -53,9 +57,16 @@
        "SMTP STARTTLS",
        "DNS management"
      ]
+    },
+    "release": {
+      "registries": [
+        "https://verdaccio.lossless.digital",
+        "https://registry.npmjs.org"
+      ],
+      "accessLevel": "public"
    }
  },
-  "npmci": {
+  "@ship.zone/szci": {
    "npmGlobalTools": [],
    "dockerRegistryRepoMap": {
      "registry.gitlab.com": "code.foss.global/serve.zone/dcrouter"
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
  "name": "@serve.zone/dcrouter",
  "private": false,
-  "version": "5.0.0",
+  "version": "5.3.0",
  "description": "A multifaceted routing service handling mail and SMS delivery functions.",
  "type": "module",
  "exports": {
@@ -27,7 +27,7 @@
    "@types/node": "^25.2.3"
  },
  "dependencies": {
-    "@api.global/typedrequest": "^3.2.5",
+    "@api.global/typedrequest": "^3.2.6",
    "@api.global/typedrequest-interfaces": "^3.0.19",
    "@api.global/typedserver": "^8.3.0",
    "@api.global/typedsocket": "^4.1.0",
@@ -38,19 +38,19 @@
    "@push.rocks/qenv": "^6.1.3",
    "@push.rocks/smartacme": "^8.0.0",
    "@push.rocks/smartdata": "^7.0.15",
-    "@push.rocks/smartdns": "^7.8.0",
+    "@push.rocks/smartdns": "^7.8.1",
    "@push.rocks/smartfile": "^13.1.2",
    "@push.rocks/smartguard": "^3.1.0",
    "@push.rocks/smartjwt": "^2.2.1",
    "@push.rocks/smartlog": "^3.1.10",
    "@push.rocks/smartmetrics": "^2.0.10",
    "@push.rocks/smartmongo": "^5.1.0",
-    "@push.rocks/smartmta": "^5.2.1",
+    "@push.rocks/smartmta": "^5.2.2",
    "@push.rocks/smartnetwork": "^4.4.0",
    "@push.rocks/smartpath": "^6.0.0",
    "@push.rocks/smartpromise": "^4.2.3",
-    "@push.rocks/smartproxy": "^23.1.2",
-    "@push.rocks/smartradius": "^1.1.0",
+    "@push.rocks/smartproxy": "^24.0.0",
+    "@push.rocks/smartradius": "^1.1.1",
    "@push.rocks/smartrequest": "^5.0.1",
    "@push.rocks/smartrx": "^3.0.10",
    "@push.rocks/smartstate": "^2.0.30",
@@ -93,5 +93,17 @@
      "puppeteer"
    ]
  },
-  "packageManager": "pnpm@10.11.0"
+  "packageManager": "pnpm@10.11.0",
+  "files": [
+    "ts/**/*",
+    "ts_web/**/*",
+    "dist/**/*",
+    "dist_*/**/*",
+    "dist_ts/**/*",
+    "dist_ts_web/**/*",
+    "assets/**/*",
+    "cli.js",
+    "npmextra.json",
+    "readme.md"
+  ]
 }
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,8 +9,8 @@ importers:
  .:
    dependencies:
      '@api.global/typedrequest':
-        specifier: ^3.2.5
-        version: 3.2.5
+        specifier: ^3.2.6
+        version: 3.2.6
      '@api.global/typedrequest-interfaces':
        specifier: ^3.0.19
        version: 3.0.19
@@ -37,13 +37,13 @@ importers:
        version: 6.1.3
      '@push.rocks/smartacme':
        specifier: ^8.0.0
-        version: 8.0.0(socks@2.8.7)
+        version: 8.0.0(@push.rocks/smartserve@2.0.1)(socks@2.8.7)
      '@push.rocks/smartdata':
        specifier: ^7.0.15
        version: 7.0.15(socks@2.8.7)
      '@push.rocks/smartdns':
-        specifier: ^7.8.0
-        version: 7.8.0
+        specifier: ^7.8.1
+        version: 7.8.1
      '@push.rocks/smartfile':
        specifier: ^13.1.2
        version: 13.1.2
@@ -63,8 +63,8 @@ importers:
        specifier: ^5.1.0
        version: 5.1.0(socks@2.8.7)
      '@push.rocks/smartmta':
-        specifier: ^5.2.1
-        version: 5.2.1
+        specifier: ^5.2.2
+        version: 5.2.2
      '@push.rocks/smartnetwork':
        specifier: ^4.4.0
        version: 4.4.0
@@ -75,11 +75,11 @@ importers:
        specifier: ^4.2.3
        version: 4.2.3
      '@push.rocks/smartproxy':
-        specifier: ^23.1.2
-        version: 23.1.2(socks@2.8.7)
+        specifier: ^24.0.0
+        version: 24.0.0(@push.rocks/smartserve@2.0.1)(socks@2.8.7)
      '@push.rocks/smartradius':
-        specifier: ^1.1.0
-        version: 1.1.0
+        specifier: ^1.1.1
+        version: 1.1.1
      '@push.rocks/smartrequest':
        specifier: ^5.0.1
        version: 5.0.1
@@ -116,7 +116,7 @@ importers:
        version: 2.0.1
      '@git.zone/tstest':
        specifier: ^3.1.8
-        version: 3.1.8(@push.rocks/smartserve@2.0.1)(socks@2.8.7)(typescript@5.9.3)
+        version: 3.1.8(socks@2.8.7)(typescript@5.9.3)
      '@git.zone/tswatch':
        specifier: ^3.1.0
        version: 3.1.0(@tiptap/pm@2.27.2)
@@ -132,8 +132,8 @@ packages:
  '@api.global/typedrequest-interfaces@3.0.19':
    resolution: {integrity: sha512-uuHUXJeOy/inWSDrwD0Cwax2rovpxYllDhM2RWh+6mVpQuNmZ3uw6IVg6dA2G1rOe24Ebs+Y9SzEogo+jYN7vw==}

-  '@api.global/typedrequest@3.2.5':
-    resolution: {integrity: sha512-LM/sUTuYnU5xY4gNZrN6ERMiKr+SpDZuSxJkAZz1YazC7ymGfo6uQ8sCnN8eNNQNFqIOkC+BtfYRayfbGwYLLg==}
+  '@api.global/typedrequest@3.2.6':
+    resolution: {integrity: sha512-CnvbjYjnGGw3rwL+7bTHSgRHEpDujzhs3cv7l1xgCXMPQe3DcPg74+9ep1Y5cu21T/w0pxNnDCJpbb0SHqHzAw==}

  '@api.global/typedserver@3.0.80':
    resolution: {integrity: sha512-dcp0oXsjBL+XdFg1wUUP08uJQid5bQ0Yv3V3Y3lnI2QCbat0FU+Tsb0TZRnZ4+P150Vj/ITBqJUgDzFsF34grA==}
@@ -904,8 +904,8 @@ packages:
  '@push.rocks/smartdns@6.2.2':
    resolution: {integrity: sha512-MhJcHujbyIuwIIFdnXb2OScGtRjNsliLUS8GoAurFsKtcCOaA0ytfP+PNzkukyBufjb1nMiJF3rjhswXdHakAQ==}

-  '@push.rocks/smartdns@7.8.0':
-    resolution: {integrity: sha512-5FX74AAgQSqWPZkpTsI/BbUKBQpZKSvs+UdX9IZpwcuPldI+K7D1WeE02mMAGd1Ncd/sYAMor5CTlhnG6L+QhQ==}
+  '@push.rocks/smartdns@7.8.1':
+    resolution: {integrity: sha512-qEizM9dFzhq4XGICDC8Im7JLjwdokHdDZ6wLufBInaEOupq+8XOa9bC6EGlBQVsCXFUyrKzsFk6eBa9BSZMKPw==}

  '@push.rocks/smartenv@5.0.13':
    resolution: {integrity: sha512-ACXmUcHZHl2CF2jnVuRw9saRRrZvJblCRs2d+K5aLR1DfkYFX3eA21kcMlKeLisI3aGNbIj9vz/rowN5qkRkfA==}
@@ -1000,8 +1000,8 @@ packages:
  '@push.rocks/smartmongo@5.1.0':
    resolution: {integrity: sha512-2tpKf8K+SMdLHOEpafgKPIN+ypWTLwHc33hCUDNMQ1KaL7vokkavA44+fHxQydOGPMtDi22tSMFeVMCcUSzs4w==}

-  '@push.rocks/smartmta@5.2.1':
-    resolution: {integrity: sha512-ITgu1kIJxWgiU6q3YDxAp1HoMmC8ECJhEAFbDtUDRIBcg8Flvbmgasjnqew67nFcXq2fKYh3rGECloS62MBQgw==}
+  '@push.rocks/smartmta@5.2.2':
+    resolution: {integrity: sha512-0xKUi2BMM0HFYIPdNeNJZFitAiJ9CNbLlOJ8TenT+xInp7DKcSQ7ABER1rJKinPtvDjRDSiSqiF2iQR+O7299g==}
    engines: {node: '>=14.0.0'}
    cpu: [x64, arm64]
    os: [darwin, linux, win32]
@@ -1040,14 +1040,14 @@ packages:
  '@push.rocks/smartpromise@4.2.3':
    resolution: {integrity: sha512-Ycg/TJR+tMt+S3wSFurOpEoW6nXv12QBtKXgBcjMZ4RsdO28geN46U09osPn9N9WuwQy1PkmTV5J/V4F9U8qEw==}

-  '@push.rocks/smartproxy@23.1.2':
-    resolution: {integrity: sha512-4uOSPp4ymIBLhn0xocmY+6wPWlEBIB//vaOIPM9wTyoyhWdhMSV2J1V7NcXGNAGiZG9OO4zB1yW3pbs/4Wc2NA==}
+  '@push.rocks/smartproxy@24.0.0':
+    resolution: {integrity: sha512-xSz6mrV59xmuiuaBgej6Fq611r9+Ay0ad2XiZAP/XGrkWykgQNeDZqzAq8dadmaCqO/3bVfH/mXlEYaKrDyTYA==}

  '@push.rocks/smartpuppeteer@2.0.5':
    resolution: {integrity: sha512-yK/qSeWVHIGWRp3c8S5tfdGP6WCKllZC4DR8d8CQlEjszOSBmHtlTdyyqOMBZ/BA4kd+eU5f3A1r4K2tGYty1g==}

-  '@push.rocks/smartradius@1.1.0':
-    resolution: {integrity: sha512-eocddp/bDcB5a/JOt5lezz0uBWezOKpnDQgMx+I4bl8eJ20KIWh0B6PhYuKYjGuDwo/t01p+s+m0gG7IgyPmzQ==}
+  '@push.rocks/smartradius@1.1.1':
+    resolution: {integrity: sha512-WTKZAGhld8FtzqebgdHlbvZYLFwWM52j5Dt+U+sAWviRUhp5pgJ35DE4H0ePUFPjEa2Tr+HWxRN/PIckZYKRnQ==}

  '@push.rocks/smartrequest@2.1.0':
    resolution: {integrity: sha512-3eHLTRInHA+u+W98TqJwgTES7rRimBAsJC4JxVNQC3UUezmblAhM5/TIQsEBQTsbjAY8SeQKy6NHzW6iTiaD8w==}
@@ -1061,8 +1061,8 @@ packages:
  '@push.rocks/smartrouter@1.3.3':
    resolution: {integrity: sha512-1+xZEnWlhzqLWAaJ1zFNhQ0zgbfCWQl1DBT72LygLxTs+P0K8AwJKgqo/IX6CT55kGCFnPAZIYSbVJlGsgrB0w==}

-  '@push.rocks/smartrust@1.2.0':
-    resolution: {integrity: sha512-JlaALselIHoP6C3ceQbrvz424G21cND/QsH/KI3E/JrO4XphJiGZwM6f4yJWrijdPYR/YYMoaIiYN7ybZp0C4w==}
+  '@push.rocks/smartrust@1.2.1':
+    resolution: {integrity: sha512-ANwXXibUwoHNWF1hhXhXVVrfzYlhgHYRa2205Jkd/s/wXzcWHftYZthilJj+52B7nkzSB76umfxKfK5eBYY2Ug==}

  '@push.rocks/smartrx@3.0.10':
    resolution: {integrity: sha512-USjIYcsSfzn14cwOsxgq/bBmWDTTzy3ouWAnW5NdMyRRzEbmeNrvmy6TRqNeDlJ2PsYNTt1rr/zGUqvIy72ITg==}
@@ -1131,8 +1131,8 @@ packages:
  '@push.rocks/webrequest@3.0.37':
    resolution: {integrity: sha512-fLN7kP6GeHFxE4UH4r9C9pjcQb0QkJxHeAMwXvbOqB9hh0MFNKhtGU7GoaTn8SVRGRMPc9UqZVNwo6u5l8Wn0A==}

-  '@push.rocks/webrequest@4.0.1':
-    resolution: {integrity: sha512-I60XZZLVf8W5I7YdmUVVu4G92teE3rg3/aKaV00BRg8vJ3VXx3wc59Qj4em7zxQ5o0HvL8m1Aezw3RFMDPyVgA==}
+  '@push.rocks/webrequest@4.0.2':
+    resolution: {integrity: sha512-rowzty+Q2papFBcnNYPcy+8CQJukSn/FGfQG8ap0bUgQUsx882u8kEyLM0Q+GlGHS5OiZ+Z0z5TZqLKlk3XHxA==}

  '@push.rocks/websetup@3.0.19':
    resolution: {integrity: sha512-iKJDwXdMmQdu5siOIgziPRxM51lN1AU9HOr+yMteu1YMDkZT7HKCyisDAr4gC9WZ9a7FzsG8zgthm4dMeA8NTw==}
@@ -2041,6 +2041,10 @@ packages:
  balanced-match@1.0.2:
    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}

+  balanced-match@4.0.2:
+    resolution: {integrity: sha512-x0K50QvKQ97fdEz2kPehIerj+YTeptKF9hyYkKf6egnwmMWAkADiO0QCzSp0R5xN8FTZgYaBfSaue46Ej62nMg==}
+    engines: {node: 20 || >=22}
+
  bare-events@2.8.2:
    resolution: {integrity: sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==}
    peerDependencies:
@@ -2109,6 +2113,10 @@ packages:
  brace-expansion@2.0.2:
    resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}

+  brace-expansion@5.0.2:
+    resolution: {integrity: sha512-Pdk8c9poy+YhOgVWw1JNN22/HcivgKWwpxKq04M/jTmHyCZn12WPJebZxdjSa5TmBqISrUSgNYU3eRORljfCCw==}
+    engines: {node: 20 || >=22}
+
  broadcast-channel@7.3.0:
    resolution: {integrity: sha512-UHPhLBQKfQ8OmMFMpmPfO5dRakyA1vsfiDGWTYNvChYol65tbuhivPEGgZZiuetorvExdvxaWiBy/ym1Ty08yA==}

@@ -3282,6 +3290,10 @@ packages:
    resolution: {integrity: sha512-fu656aJ0n2kcXwsnwnv9g24tkU5uSmOlTjd6WyyaKm2Z+h1qmY6bAjrcaIxF/BslFqbZ8UBtbJi7KgQOZD2PTw==}
    engines: {node: 20 || >=22}

+  minimatch@10.2.0:
+    resolution: {integrity: sha512-ugkC31VaVg9cF0DFVoADH12k6061zNZkZON+aX8AWsR9GhPcErkcMBceb6znR8wLERM2AkkOxy2nWRLpT9Jq5w==}
+    engines: {node: 20 || >=22}
+
  minimatch@3.1.2:
    resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}

@@ -4232,7 +4244,7 @@ packages:
    hasBin: true

  wordwrap@1.0.0:
-    resolution: {integrity: sha1-J1hIEIkUVqQXHI0CJkQa3pDLyus=}
+    resolution: {integrity: sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==}

  wrap-ansi@6.2.0:
    resolution: {integrity: sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==}
@@ -4341,7 +4353,7 @@ snapshots:

  '@api.global/typedrequest-interfaces@3.0.19': {}

-  '@api.global/typedrequest@3.2.5':
+  '@api.global/typedrequest@3.2.6':
    dependencies:
      '@api.global/typedrequest-interfaces': 3.0.19
      '@push.rocks/isounique': 1.0.5
@@ -4350,12 +4362,12 @@ snapshots:
      '@push.rocks/smartdelay': 3.0.5
      '@push.rocks/smartguard': 3.1.0
      '@push.rocks/smartpromise': 4.2.3
-      '@push.rocks/webrequest': 3.0.37
+      '@push.rocks/webrequest': 4.0.2
      '@push.rocks/webstream': 1.0.10

  '@api.global/typedserver@3.0.80(@push.rocks/smartserve@2.0.1)':
    dependencies:
-      '@api.global/typedrequest': 3.2.5
+      '@api.global/typedrequest': 3.2.6
      '@api.global/typedrequest-interfaces': 3.0.19
      '@api.global/typedsocket': 3.1.1(@push.rocks/smartserve@2.0.1)
      '@cloudflare/workers-types': 4.20260210.0
@@ -4403,7 +4415,7 @@ snapshots:

  '@api.global/typedserver@8.3.0(@tiptap/pm@2.27.2)':
    dependencies:
-      '@api.global/typedrequest': 3.2.5
+      '@api.global/typedrequest': 3.2.6
      '@api.global/typedrequest-interfaces': 3.0.19
      '@api.global/typedsocket': 4.1.0(@push.rocks/smartserve@2.0.1)
      '@cloudflare/workers-types': 4.20260210.0
@@ -4434,7 +4446,7 @@ snapshots:
      '@push.rocks/smarttime': 4.1.1
      '@push.rocks/smartwatch': 6.3.0
      '@push.rocks/taskbuffer': 3.5.0
-      '@push.rocks/webrequest': 4.0.1
+      '@push.rocks/webrequest': 4.0.2
      '@push.rocks/webstore': 2.0.20
      '@tsclass/tsclass': 9.3.0
      lit: 3.3.2
@@ -4449,7 +4461,7 @@ snapshots:

  '@api.global/typedsocket@3.1.1(@push.rocks/smartserve@2.0.1)':
    dependencies:
-      '@api.global/typedrequest': 3.2.5
+      '@api.global/typedrequest': 3.2.6
      '@api.global/typedrequest-interfaces': 3.0.19
      '@push.rocks/isohash': 2.0.1
      '@push.rocks/smartjson': 5.2.0
@@ -4469,7 +4481,7 @@ snapshots:

  '@api.global/typedsocket@4.1.0(@push.rocks/smartserve@2.0.1)':
    dependencies:
-      '@api.global/typedrequest': 3.2.5
+      '@api.global/typedrequest': 3.2.6
      '@api.global/typedrequest-interfaces': 3.0.19
      '@push.rocks/isohash': 2.0.1
      '@push.rocks/smartdelay': 3.0.5
@@ -5054,14 +5066,14 @@ snapshots:

  '@design.estate/dees-comms@1.0.30':
    dependencies:
-      '@api.global/typedrequest': 3.2.5
+      '@api.global/typedrequest': 3.2.6
      '@api.global/typedrequest-interfaces': 3.0.19
      '@push.rocks/smartdelay': 3.0.5
      broadcast-channel: 7.3.0

  '@design.estate/dees-domtools@2.3.8':
    dependencies:
-      '@api.global/typedrequest': 3.2.5
+      '@api.global/typedrequest': 3.2.6
      '@design.estate/dees-comms': 1.0.30
      '@push.rocks/lik': 6.2.2
      '@push.rocks/smartdelay': 3.0.5
@@ -5296,7 +5308,7 @@ snapshots:
      '@push.rocks/smartshell': 3.3.0
      tsx: 4.21.0

-  '@git.zone/tstest@3.1.8(@push.rocks/smartserve@2.0.1)(socks@2.8.7)(typescript@5.9.3)':
+  '@git.zone/tstest@3.1.8(socks@2.8.7)(typescript@5.9.3)':
    dependencies:
      '@api.global/typedserver': 3.0.80(@push.rocks/smartserve@2.0.1)
      '@git.zone/tsbundle': 2.8.3
@@ -5327,7 +5339,6 @@ snapshots:
      - '@aws-sdk/credential-providers'
      - '@mongodb-js/zstd'
      - '@nuxt/kit'
-      - '@push.rocks/smartserve'
      - '@swc/helpers'
      - aws-crt
      - bare-abort-controller
@@ -5815,13 +5826,13 @@ snapshots:

  '@push.rocks/qenv@6.1.3':
    dependencies:
-      '@api.global/typedrequest': 3.2.5
+      '@api.global/typedrequest': 3.2.6
      '@configvault.io/interfaces': 1.0.17
      '@push.rocks/smartfile': 11.2.7
      '@push.rocks/smartlog': 3.1.10
      '@push.rocks/smartpath': 6.0.0

-  '@push.rocks/smartacme@8.0.0(socks@2.8.7)':
+  '@push.rocks/smartacme@8.0.0(@push.rocks/smartserve@2.0.1)(socks@2.8.7)':
    dependencies:
      '@api.global/typedserver': 3.0.80(@push.rocks/smartserve@2.0.1)
      '@apiclient.xyz/cloudflare': 6.4.3
@@ -5843,7 +5854,9 @@ snapshots:
      - '@aws-sdk/credential-providers'
      - '@mongodb-js/zstd'
      - '@nuxt/kit'
+      - '@push.rocks/smartserve'
      - bare-abort-controller
+      - bufferutil
      - encoding
      - gcp-metadata
      - kerberos
@@ -5853,6 +5866,7 @@ snapshots:
      - snappy
      - socks
      - supports-color
+      - utf-8-validate
      - vue

  '@push.rocks/smartarchive@4.2.4':
@@ -6041,18 +6055,15 @@ snapshots:
    transitivePeerDependencies:
      - supports-color

-  '@push.rocks/smartdns@7.8.0':
+  '@push.rocks/smartdns@7.8.1':
    dependencies:
      '@push.rocks/smartdelay': 3.0.5
-      '@push.rocks/smartenv': 5.0.13
+      '@push.rocks/smartenv': 6.0.0
      '@push.rocks/smartpromise': 4.2.3
-      '@push.rocks/smartrequest': 2.1.0
-      '@push.rocks/smartrust': 1.2.0
+      '@push.rocks/smartrust': 1.2.1
      '@tsclass/tsclass': 9.3.0
-      '@types/dns-packet': 5.6.5
      acme-client: 5.4.0
-      dns-packet: 5.6.1
-      minimatch: 10.1.2
+      minimatch: 10.2.0
    transitivePeerDependencies:
      - supports-color

@@ -6222,7 +6233,7 @@ snapshots:

  '@push.rocks/smartmail@2.2.0':
    dependencies:
-      '@push.rocks/smartdns': 7.8.0
+      '@push.rocks/smartdns': 7.8.1
      '@push.rocks/smartfile': 13.1.2
      '@push.rocks/smartmustache': 3.0.2
      '@push.rocks/smartpath': 6.0.0
@@ -6323,14 +6334,14 @@ snapshots:
      - supports-color
      - vue

-  '@push.rocks/smartmta@5.2.1':
+  '@push.rocks/smartmta@5.2.2':
    dependencies:
      '@push.rocks/smartfile': 13.1.2
      '@push.rocks/smartfs': 1.3.1
      '@push.rocks/smartlog': 3.1.10
      '@push.rocks/smartmail': 2.2.0
      '@push.rocks/smartpath': 6.0.0
-      '@push.rocks/smartrust': 1.2.0
+      '@push.rocks/smartrust': 1.2.1
      '@tsclass/tsclass': 9.3.0
      lru-cache: 11.2.6
      mailparser: 3.9.3
@@ -6344,7 +6355,7 @@ snapshots:

  '@push.rocks/smartnetwork@4.4.0':
    dependencies:
-      '@push.rocks/smartdns': 7.8.0
+      '@push.rocks/smartdns': 7.8.1
      '@push.rocks/smartping': 1.0.8
      '@push.rocks/smartpromise': 4.2.3
      '@push.rocks/smartstring': 4.1.0
@@ -6430,10 +6441,10 @@ snapshots:

  '@push.rocks/smartpromise@4.2.3': {}

-  '@push.rocks/smartproxy@23.1.2(socks@2.8.7)':
+  '@push.rocks/smartproxy@24.0.0(@push.rocks/smartserve@2.0.1)(socks@2.8.7)':
    dependencies:
      '@push.rocks/lik': 6.2.2
-      '@push.rocks/smartacme': 8.0.0(socks@2.8.7)
+      '@push.rocks/smartacme': 8.0.0(@push.rocks/smartserve@2.0.1)(socks@2.8.7)
      '@push.rocks/smartcrypto': 2.0.4
      '@push.rocks/smartdelay': 3.0.5
      '@push.rocks/smartfile': 13.1.2
@@ -6441,20 +6452,21 @@ snapshots:
      '@push.rocks/smartnetwork': 4.4.0
      '@push.rocks/smartpromise': 4.2.3
      '@push.rocks/smartrequest': 5.0.1
-      '@push.rocks/smartrust': 1.2.0
+      '@push.rocks/smartrust': 1.2.1
      '@push.rocks/smartrx': 3.0.10
      '@push.rocks/smartstring': 4.1.0
      '@push.rocks/taskbuffer': 4.2.0
      '@tsclass/tsclass': 9.3.0
      '@types/minimatch': 6.0.0
      '@types/ws': 8.18.1
-      minimatch: 10.1.2
+      minimatch: 10.2.0
      pretty-ms: 9.3.0
      ws: 8.19.0
    transitivePeerDependencies:
      - '@aws-sdk/credential-providers'
      - '@mongodb-js/zstd'
      - '@nuxt/kit'
+      - '@push.rocks/smartserve'
      - bare-abort-controller
      - bufferutil
      - encoding
@@ -6484,7 +6496,7 @@ snapshots:
      - typescript
      - utf-8-validate

-  '@push.rocks/smartradius@1.1.0':
+  '@push.rocks/smartradius@1.1.1':
    dependencies:
      '@push.rocks/smartdelay': 3.0.5
      '@push.rocks/smartpromise': 4.2.3
@@ -6520,7 +6532,7 @@ snapshots:
      '@push.rocks/smartrx': 3.0.10
      path-to-regexp: 8.3.0

-  '@push.rocks/smartrust@1.2.0':
+  '@push.rocks/smartrust@1.2.1':
    dependencies:
      '@push.rocks/smartpath': 6.0.0

@@ -6541,7 +6553,7 @@ snapshots:

  '@push.rocks/smartserve@2.0.1':
    dependencies:
-      '@api.global/typedrequest': 3.2.5
+      '@api.global/typedrequest': 3.2.6
      '@cfworker/json-schema': 4.1.1
      '@push.rocks/lik': 6.2.2
      '@push.rocks/smartenv': 6.0.0
@@ -6567,7 +6579,7 @@ snapshots:
      '@push.rocks/smartfeed': 1.4.0
      '@push.rocks/smartxml': 2.0.0
      '@push.rocks/smartyaml': 3.0.4
-      '@push.rocks/webrequest': 4.0.1
+      '@push.rocks/webrequest': 4.0.2
      '@tsclass/tsclass': 9.3.0

  '@push.rocks/smartsocket@2.1.0':
@@ -6719,7 +6731,7 @@ snapshots:
      '@push.rocks/smartpromise': 4.2.3
      '@push.rocks/webstore': 2.0.20

-  '@push.rocks/webrequest@4.0.1':
+  '@push.rocks/webrequest@4.0.2':
    dependencies:
      '@push.rocks/smartdelay': 3.0.5
      '@push.rocks/smartenv': 5.0.13
@@ -7560,7 +7572,7 @@ snapshots:

  '@types/minimatch@6.0.0':
    dependencies:
-      minimatch: 10.1.2
+      minimatch: 10.2.0

  '@types/ms@2.1.0': {}

@@ -7758,6 +7770,10 @@ snapshots:

  balanced-match@1.0.2: {}

+  balanced-match@4.0.2:
+    dependencies:
+      jackspeak: 4.2.3
+
  bare-events@2.8.2: {}

  bare-fs@4.5.3:
@@ -7830,6 +7846,10 @@ snapshots:
    dependencies:
      balanced-match: 1.0.2

+  brace-expansion@5.0.2:
+    dependencies:
+      balanced-match: 4.0.2
+
  broadcast-channel@7.3.0:
    dependencies:
      '@babel/runtime': 7.28.6
@@ -9299,6 +9319,10 @@ snapshots:
    dependencies:
      '@isaacs/brace-expansion': 5.0.1

+  minimatch@10.2.0:
+    dependencies:
+      brace-expansion: 5.0.2
+
  minimatch@3.1.2:
    dependencies:
      brace-expansion: 1.1.12
--- a/readme.hints.md
+++ b/readme.hints.md
@@ -46,7 +46,7 @@ Source at `../../push.rocks/smartmta`, release with `gitzone commit -ypbrt`
 ### SmartProxy v23.1.2 Route Validation
 - SmartProxy 23.1.2 enforces stricter route validation
 - Forward actions MUST use `targets` (array) instead of `target` (singular)
- Test configurations that call `DcRouter.start()` need `cacheConfig: { enabled: false }` to avoid `/etc/dcrouter` permission errors
+- Test configurations that call `DcRouter.start()` need `cacheConfig: { enabled: false }` to avoid starting a real MongoDB process in tests

 ```typescript
 // WRONG - will fail validation
@@ -693,7 +693,7 @@ The configuration UI has been converted from an editable interface to a read-onl
 ## Smartdata Cache System (2026-02-03)

 ### Overview
-DcRouter now uses smartdata + LocalTsmDb for persistent caching. Data is stored at `/etc/dcrouter/tsmdb`.
+DcRouter now uses smartdata + LocalTsmDb for persistent caching. Data is stored at `~/.serve.zone/dcrouter/tsmdb`.

 ### Technology Stack
 | Layer | Package | Purpose |
@@ -747,7 +747,7 @@ await email.delete();
 const dcRouter = new DcRouter({
  cacheConfig: {
    enabled: true,
-    storagePath: '/etc/dcrouter/tsmdb',
+    storagePath: '~/.serve.zone/dcrouter/tsmdb',
    dbName: 'dcrouter',
    cleanupIntervalHours: 1,
    ttlConfig: {
--- a/readme.md
+++ b/readme.md
@@ -34,10 +34,10 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 ### 🌐 Universal Traffic Router
 - **HTTP/HTTPS routing** with domain matching, path-based forwarding, and automatic TLS
 - **TCP/SNI proxy** for any protocol with TLS termination or passthrough
- **DNS server** with authoritative zones, dynamic record management, and DNS-over-HTTPS
+- **DNS server** (Rust-powered via [SmartDNS](https://code.foss.global/push.rocks/smartdns)) with authoritative zones, dynamic record management, and DNS-over-HTTPS
 - **Multi-protocol support** on the same infrastructure via [SmartProxy](https://code.foss.global/push.rocks/smartproxy)

-### 📧 Complete Email Infrastructure
+### 📧 Complete Email Infrastructure (powered by [smartmta](https://code.foss.global/push.rocks/smartmta))
 - **Multi-domain SMTP server** on standard ports (25, 587, 465)
 - **Pattern-based email routing** with four action types: forward, process, deliver, reject
 - **DKIM signing & verification**, SPF, DMARC authentication stack
@@ -59,14 +59,16 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community

 ### ⚡ High Performance
 - **Rust-powered proxy engine** via SmartProxy for maximum throughput
+- **Rust-powered MTA engine** via smartmta (TypeScript + Rust hybrid) for reliable email delivery
+- **Rust-powered DNS engine** via SmartDNS for high-performance UDP and DNS-over-HTTPS
 - **Connection pooling** for outbound SMTP and backend services
 - **Socket-handler mode** — direct socket passing eliminates internal port hops
 - **Real-time metrics** via SmartMetrics (CPU, memory, connections, throughput)

 ### 💾 Persistent Storage & Caching
 - **Multiple storage backends**: filesystem, custom functions, or in-memory
- **Embedded cache database** via smartdata + TsmDb (MongoDB-compatible)
- **Automatic TTL-based cleanup** for cached emails, IP reputation, DKIM keys, and more
+- **Embedded cache database** via smartdata + LocalTsmDb (MongoDB-compatible)
+- **Automatic TTL-based cleanup** for cached emails and IP reputation data

 ### 🖥️ OpsServer Dashboard
 - **Web-based management interface** with real-time monitoring
@@ -84,7 +86,7 @@ npm install @serve.zone/dcrouter

 ### Prerequisites

- **Node.js 18+** with ES module support
+- **Node.js 20+** with ES module support
 - Valid domain with DNS control (for ACME certificate automation)
 - Cloudflare API token (for DNS-01 challenges) — optional

@@ -172,7 +174,7 @@ const router = new DcRouter({
    acme: { email: 'ssl@example.com', enabled: true, useProduction: true }
  },

-  // Email system
+  // Email system (powered by smartmta)
  emailConfig: {
    ports: [25, 587, 465],
    hostname: 'mail.example.com',
@@ -217,7 +219,7 @@ const router = new DcRouter({
  storage: { fsPath: '/var/lib/dcrouter/data' },

  // Cache database
-  cacheConfig: { enabled: true, storagePath: '/etc/dcrouter/tsmdb' },
+  cacheConfig: { enabled: true, storagePath: '~/.serve.zone/dcrouter/tsmdb' },

  // TLS & ACME
  tls: { contactEmail: 'admin@example.com' },
@@ -244,10 +246,10 @@ graph TB

    subgraph "DcRouter Core"
        DC[DcRouter Orchestrator]
-        SP[SmartProxy Engine]
-        ES[Unified Email Server]
-        DS[DNS Server]
-        RS[RADIUS Server]
+        SP[SmartProxy Engine<br/><i>Rust-powered</i>]
+        ES[smartmta Email Server<br/><i>TypeScript + Rust</i>]
+        DS[SmartDNS Server<br/><i>Rust-powered</i>]
+        RS[SmartRadius Server]
        CM[Certificate Manager]
        OS[OpsServer Dashboard]
        MM[Metrics Manager]
@@ -289,17 +291,36 @@ graph TB

 ### Core Components

-| Component | Description |
-|-----------|-------------|
-| **DcRouter** | Central orchestrator — starts, stops, and coordinates all services |
-| **SmartProxy** | High-performance HTTP/HTTPS and TCP/SNI proxy with route-based config |
-| **UnifiedEmailServer** | Full SMTP server with pattern-based routing, DKIM, queue management |
-| **DNS Server** | Authoritative DNS with dynamic records, DKIM TXT auto-generation |
-| **RADIUS Server** | Network authentication with MAB, VLAN assignment, and accounting |
-| **OpsServer** | Web dashboard + TypedRequest API for monitoring and management |
-| **MetricsManager** | Real-time metrics collection (CPU, memory, email, DNS, security) |
-| **StorageManager** | Pluggable key-value storage (filesystem, custom, or in-memory) |
-| **CacheDb** | Embedded MongoDB-compatible database for persistent caching |
+| Component | Package | Description |
+|-----------|---------|-------------|
+| **DcRouter** | `@serve.zone/dcrouter` | Central orchestrator — starts, stops, and coordinates all services |
+| **SmartProxy** | `@push.rocks/smartproxy` | High-performance HTTP/HTTPS and TCP/SNI proxy with route-based config (Rust engine) |
+| **UnifiedEmailServer** | `@push.rocks/smartmta` | Full SMTP server with pattern-based routing, DKIM, queue management (TypeScript + Rust) |
+| **DNS Server** | `@push.rocks/smartdns` | Authoritative DNS with dynamic records and DKIM TXT auto-generation (Rust engine) |
+| **RADIUS Server** | `@push.rocks/smartradius` | Network authentication with MAB, VLAN assignment, and accounting |
+| **OpsServer** | `@api.global/typedserver` | Web dashboard + TypedRequest API for monitoring and management |
+| **MetricsManager** | `@push.rocks/smartmetrics` | Real-time metrics collection (CPU, memory, email, DNS, security) |
+| **StorageManager** | built-in | Pluggable key-value storage (filesystem, custom, or in-memory) |
+| **CacheDb** | `@push.rocks/smartdata` | Embedded MongoDB-compatible database (LocalTsmDb) for persistent caching |
+
+### How It Works
+
+DcRouter acts purely as an **orchestrator** — it doesn't implement protocols itself. Instead, it wires together best-in-class packages for each protocol:
+
+1. **On `start()`**: DcRouter initializes OpsServer (port 3000), then spins up SmartProxy, smartmta, SmartDNS, and SmartRadius based on which configs are provided.
+2. **During operation**: Each service handles its own protocol independently. SmartProxy uses a Rust-powered engine for maximum throughput. smartmta uses a hybrid TypeScript + Rust architecture for reliable email delivery.
+3. **On `stop()`**: All services are gracefully shut down in reverse order.
+
+### Rust-Powered Architecture
+
+DcRouter itself is a pure TypeScript orchestrator, but three of its core sub-components ship with **compiled Rust binaries** for performance-critical paths. At runtime each package detects the platform, unpacks the correct binary, and communicates with TypeScript over IPC/FFI — so you get the ergonomics of TypeScript with the throughput of native code.
+
+| Component | Rust Binary | What It Handles |
+|-----------|-------------|-----------------|
+| **SmartProxy** | `smartproxy-bin` | All TCP/TLS/HTTP proxy networking, NFTables integration, connection metrics |
+| **smartmta** | `mailer-bin` | SMTP server + client, DKIM/SPF/DMARC, content scanning, IP reputation |
+| **SmartDNS** | `smartdns-bin` | DNS server (UDP + DNS-over-HTTPS), DNSSEC, DNS client resolution |
+| **SmartRadius** | — | Pure TypeScript (no Rust component) |

 ## Configuration Reference

@@ -312,22 +333,8 @@ interface IDcRouterOptions {
  smartProxyConfig?: ISmartProxyOptions;

  // ── Email ──────────────────────────────────────────────────────
-  /** Unified email server configuration */
-  emailConfig?: {
-    ports: number[];                     // e.g. [25, 587, 465]
-    hostname: string;                    // e.g. 'mail.example.com'
-    domains: IEmailDomainConfig[];       // Domain infrastructure
-    routes: IEmailRoute[];               // Routing rules
-    useSocketHandler?: boolean;          // Direct socket passing (no port binding)
-    auth?: { required?: boolean; methods?: ('PLAIN'|'LOGIN'|'OAUTH2')[]; users?: Array<{username: string; password: string}> };
-    tls?: { certPath?: string; keyPath?: string; caPath?: string };
-    maxMessageSize?: number;
-    defaults?: {
-      dnsMode?: 'forward' | 'internal-dns' | 'external-dns';
-      dkim?: IEmailDomainConfig['dkim'];
-      rateLimits?: IEmailDomainConfig['rateLimits'];
-    };
-  };
+  /** Unified email server configuration (smartmta) */
+  emailConfig?: IUnifiedEmailServerOptions;

  /** Custom email port mapping overrides */
  emailPortConfig?: {
@@ -338,9 +345,9 @@ interface IDcRouterOptions {

  // ── DNS ────────────────────────────────────────────────────────
  /** Nameserver domains — get A records automatically */
-  dnsNsDomains?: string[];               // e.g. ['ns1.example.com', 'ns2.example.com']
+  dnsNsDomains?: string[];
  /** Domains this server is authoritative for */
-  dnsScopes?: string[];                  // e.g. ['example.com']
+  dnsScopes?: string[];
  /** Public IP for NS A records */
  publicIp?: string;
  /** Ingress proxy IPs (hides real server IP) */
@@ -381,7 +388,7 @@ interface IDcRouterOptions {
  };
  cacheConfig?: {
    enabled?: boolean;                   // default: true
-    storagePath?: string;                // default: '/etc/dcrouter/tsmdb'
+    storagePath?: string;                // default: '~/.serve.zone/dcrouter/tsmdb'
    dbName?: string;                     // default: 'dcrouter'
    cleanupIntervalHours?: number;       // default: 1
    ttlConfig?: {
@@ -453,7 +460,7 @@ DcRouter uses [SmartProxy](https://code.foss.global/push.rocks/smartproxy) for a

 ## Email System

-The email system is built around the **UnifiedEmailServer**, which handles SMTP sessions, route matching, delivery queuing, DKIM signing, and all email processing in a single unified component.
+The email system is powered by [`@push.rocks/smartmta`](https://code.foss.global/push.rocks/smartmta), a TypeScript + Rust hybrid MTA. DcRouter configures and orchestrates smartmta's **UnifiedEmailServer**, which handles SMTP sessions, route matching, delivery queuing, DKIM signing, and all email processing.

 ### Email Domain Configuration

@@ -722,12 +729,12 @@ Used for: DKIM keys, email routes, bounce/suppression lists, IP reputation data,

 ### Cache Database

-An embedded MongoDB-compatible database (via smartdata + TsmDb) for persistent caching with automatic TTL cleanup:
+An embedded MongoDB-compatible database (via smartdata + LocalTsmDb) for persistent caching with automatic TTL cleanup:

 ```typescript
 cacheConfig: {
  enabled: true,
-  storagePath: '/etc/dcrouter/tsmdb',
+  storagePath: '~/.serve.zone/dcrouter/tsmdb',
  dbName: 'dcrouter',
  cleanupIntervalHours: 1,
  ttlConfig: {
@@ -740,7 +747,7 @@ cacheConfig: {
 }
 ```

-Cached document types: `CachedEmail`, `CachedIPReputation`, `CachedBounce`, `CachedSuppression`, `CachedDKIMKey`.
+Cached document types: `CachedEmail`, `CachedIPReputation`.

 ## Security Features

@@ -814,31 +821,39 @@ All management is done via TypedRequest over HTTP POST to `/typedrequest`:

 ```typescript
 // Authentication
-{ method: 'adminLogin', data: { username, password } }
-{ method: 'verifyIdentity', data: { identity } }
+'adminLoginWithUsernameAndPassword'   // Login with credentials → returns JWT identity
+'verifyIdentity'                       // Verify JWT token validity
+'adminLogout'                          // End admin session

-// Statistics
-{ method: 'getServerStatistics', data: { identity } }
-{ method: 'getCombinedMetrics', data: { identity } }
-{ method: 'getHealthStatus', data: { identity } }
+// Statistics & Health
+'getServerStatistics'                  // Uptime, CPU, memory, connections
+'getHealthStatus'                      // System health check
+'getCombinedMetrics'                   // All metrics in one call

 // Email Operations
-{ method: 'getQueuedEmails', data: { identity } }
-{ method: 'getSentEmails', data: { identity } }
-{ method: 'getFailedEmails', data: { identity } }
-{ method: 'resendEmail', data: { identity, emailId } }
-{ method: 'getBounceRecords', data: { identity } }
+'getQueuedEmails'                      // Emails pending delivery
+'getSentEmails'                        // Successfully delivered emails
+'getFailedEmails'                      // Failed emails
+'resendEmail'                          // Re-queue a failed email
+'getBounceRecords'                     // Bounce records
+'removeFromSuppressionList'            // Unsuppress an address

 // Configuration (read-only)
-{ method: 'getConfiguration', data: { identity } }
+'getConfiguration'                     // Current system config

 // Logs
-{ method: 'getLogs', data: { identity, level, limit } }
+'getLogs'                              // Retrieve system logs

 // RADIUS
-{ method: 'getRadiusSessions', data: { identity } }
-{ method: 'getRadiusClients', data: { identity } }
-{ method: 'getRadiusStatistics', data: { identity } }
+'getRadiusSessions'                    // Active RADIUS sessions
+'getRadiusClients'                     // List NAS clients
+'getRadiusStatistics'                  // RADIUS stats
+'setRadiusClient'                      // Add/update NAS client
+'removeRadiusClient'                   // Remove NAS client
+'getVlanMappings'                      // List VLAN mappings
+'setVlanMapping'                       // Add/update VLAN mapping
+'removeVlanMapping'                    // Remove VLAN mapping
+'testVlanAssignment'                   // Test what VLAN a MAC gets
 ```

 ## API Reference
@@ -869,7 +884,7 @@ const router = new DcRouter(options: IDcRouterOptions);
 |----------|------|-------------|
 | `options` | `IDcRouterOptions` | Current configuration |
 | `smartProxy` | `SmartProxy` | SmartProxy instance |
-| `emailServer` | `UnifiedEmailServer` | Email server instance |
+| `emailServer` | `UnifiedEmailServer` | Email server instance (from smartmta) |
 | `dnsServer` | `DnsServer` | DNS server instance |
 | `radiusServer` | `RadiusServer` | RADIUS server instance |
 | `storageManager` | `StorageManager` | Storage backend |
@@ -877,6 +892,21 @@ const router = new DcRouter(options: IDcRouterOptions);
 | `metricsManager` | `MetricsManager` | Metrics collector |
 | `cacheDb` | `CacheDb` | Cache database instance |

+### Re-exported Types
+
+DcRouter re-exports key types from smartmta for convenience:
+
+```typescript
+import {
+  DcRouter,
+  IDcRouterOptions,
+  UnifiedEmailServer,
+  type IUnifiedEmailServerOptions,
+  type IEmailRoute,
+  type IEmailDomainConfig,
+} from '@serve.zone/dcrouter';
+```
+
 ## Sub-Modules

 DcRouter is published as a monorepo with separately-installable interface and web packages:
@@ -895,31 +925,34 @@ import { data, requests } from '@serve.zone/dcrouter/interfaces';

 ## Testing

-DcRouter includes a comprehensive test suite with **198 test files** covering all system components:
-
- **SMTP Protocol** — EHLO, MAIL FROM, RCPT TO, DATA, STARTTLS, AUTH, pipelining
- **Email Routing** — Pattern matching, route priorities, all action types
- **Email Security** — DKIM, SPF, DMARC, content scanning, rate limiting
- **DNS** — Record management, socket handler, validation, mode switching
- **RADIUS** — Authentication, VLAN assignment, accounting
- **Deliverability** — IP warmup, reputation monitoring, bounce management
- **Storage & Cache** — All backends, TTL cleanup, persistence
- **OpsServer** — API authentication, protected endpoints, statistics
- **Integration** — Full end-to-end workflows
-
-### Running Tests
+DcRouter includes a comprehensive test suite covering all system components:

 ```bash
-# Run all tests
+# Run all tests (10 files, 73 tests)
 pnpm test

 # Run a specific test file
-tstest test/test.email.router.ts --verbose
+tstest test/test.jwt-auth.ts --verbose

-# Run SMTP protocol suite
-tstest test/suite/smtpserver_commands/test.cmd-01.ehlo-command.ts --verbose
+# Run with extended timeout
+tstest test/test.opsserver-api.ts --verbose --timeout 60
 ```

+### Test Coverage
+
+| Test File | Area | Tests |
+|-----------|------|-------|
+| `test.contentscanner.ts` | Content scanning (spam, phishing, malware, attachments) | 13 |
+| `test.dcrouter.email.ts` | Email config, domain and route setup | 4 |
+| `test.dns-server-config.ts` | DNS record parsing, grouping, extraction | 5 |
+| `test.dns-socket-handler.ts` | DNS socket handler and route generation | 6 |
+| `test.errors.ts` | Error classes, handler, retry utilities | 5 |
+| `test.ipreputationchecker.ts` | IP reputation, DNSBL, caching, risk classification | 10 |
+| `test.jwt-auth.ts` | JWT login, verification, logout, invalid credentials | 8 |
+| `test.opsserver-api.ts` | Health, statistics, configuration, log APIs | 6 |
+| `test.protected-endpoint.ts` | Admin auth, identity verification, public endpoints | 8 |
+| `test.storagemanager.ts` | Memory, filesystem, custom backends, concurrency | 8 |
+
 ## License and Legal Information

 This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.
--- a/test/test.jwt-auth.ts
+++ b/test/test.jwt-auth.ts
@@ -9,6 +9,7 @@ let identity: interfaces.data.IIdentity;
 tap.test('should start DCRouter with OpsServer', async () => {
  testDcRouter = new DcRouter({
    // Minimal config for testing
+    cacheConfig: { enabled: false },
  });
  
  await testDcRouter.start();
--- a/test/test.opsserver-api.ts
+++ b/test/test.opsserver-api.ts
@@ -8,6 +8,7 @@ let testDcRouter: DcRouter;
 tap.test('should start DCRouter with OpsServer', async () => {
  testDcRouter = new DcRouter({
    // Minimal config for testing
+    cacheConfig: { enabled: false },
  });
  
  await testDcRouter.start();
--- a/test/test.protected-endpoint.ts
+++ b/test/test.protected-endpoint.ts
@@ -9,6 +9,7 @@ let adminIdentity: interfaces.data.IIdentity;
 tap.test('should start DCRouter with OpsServer', async () => {
  testDcRouter = new DcRouter({
    // Minimal config for testing
+    cacheConfig: { enabled: false },
  });

  await testDcRouter.start();
--- a/ts/00_commitinfo_data.ts
+++ b/ts/00_commitinfo_data.ts
@@ -3,6 +3,6 @@
 */
 export const commitinfo = {
  name: '@serve.zone/dcrouter',
-  version: '5.0.0',
+  version: '5.3.0',
  description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }
--- a/ts/cache/classes.cachedb.ts
+++ b/ts/cache/classes.cachedb.ts
@@ -1,11 +1,12 @@
 import * as plugins from '../plugins.js';
 import { logger } from '../logger.js';
+import { defaultTsmDbPath } from '../paths.js';

 /**
 * Configuration options for CacheDb
 */
 export interface ICacheDbOptions {
-  /** Base storage path for TsmDB data (default: /etc/dcrouter/tsmdb) */
+  /** Base storage path for TsmDB data (default: ~/.serve.zone/dcrouter/tsmdb) */
  storagePath?: string;
  /** Database name (default: dcrouter) */
  dbName?: string;
@@ -29,7 +30,7 @@ export class CacheDb {

  constructor(options: ICacheDbOptions = {}) {
    this.options = {
-      storagePath: options.storagePath || '/etc/dcrouter/tsmdb',
+      storagePath: options.storagePath || defaultTsmDbPath,
      dbName: options.dbName || 'dcrouter',
      debug: options.debug || false,
    };
--- a/ts/classes.dcrouter.ts
+++ b/ts/classes.dcrouter.ts
@@ -122,7 +122,7 @@ export interface IDcRouterOptions {
  cacheConfig?: {
    /** Enable cache database (default: true) */
    enabled?: boolean;
-    /** Storage path for TsmDB data (default: /etc/dcrouter/tsmdb) */
+    /** Storage path for TsmDB data (default: ~/.serve.zone/dcrouter/tsmdb) */
    storagePath?: string;
    /** Database name (default: dcrouter) */
    dbName?: string;
@@ -171,6 +171,7 @@ export class DcRouter {

  // Core services
  public smartProxy?: plugins.smartproxy.SmartProxy;
+  public smartAcme?: plugins.smartacme.SmartAcme;
  public dnsServer?: plugins.smartdns.dnsServerMod.DnsServer;
  public emailServer?: UnifiedEmailServer;
  public radiusServer?: RadiusServer;
@@ -182,6 +183,15 @@ export class DcRouter {
  public cacheDb?: CacheDb;
  public cacheCleaner?: CacheCleaner;

+  // Certificate status tracking from SmartProxy events
+  public certificateStatusMap = new Map<string, {
+    status: 'valid' | 'failed';
+    domain: string;
+    expiryDate?: string;
+    issuedAt?: string;
+    error?: string;
+  }>();
+
  // TypedRouter for API endpoints
  public typedrouter = new plugins.typedrequest.TypedRouter();

@@ -349,7 +359,7 @@ export class DcRouter {

    // Initialize CacheDb singleton
    this.cacheDb = CacheDb.getInstance({
-      storagePath: cacheConfig.storagePath || '/etc/dcrouter/tsmdb',
+      storagePath: cacheConfig.storagePath || paths.defaultTsmDbPath,
      dbName: cacheConfig.dbName || 'dcrouter',
      debug: false,
    });
@@ -429,12 +439,34 @@ export class DcRouter {
        acme: acmeConfig
      };
      
-      // If we have DNS challenge handlers, enhance the config
+      // If we have DNS challenge handlers, create SmartAcme and wire to certProvisionFunction
      if (challengeHandlers.length > 0) {
-        // We'll need to pass this to SmartProxy somehow
-        // For now, we'll set it as a property
-        (smartProxyConfig as any).acmeChallengeHandlers = challengeHandlers;
-        (smartProxyConfig as any).acmeChallengePriority = ['dns-01', 'http-01'];
+        this.smartAcme = new plugins.smartacme.SmartAcme({
+          accountEmail: acmeConfig?.accountEmail || this.options.tls?.contactEmail || 'admin@example.com',
+          certManager: new plugins.smartacme.certmanagers.MemoryCertManager(),
+          environment: 'production',
+          challengeHandlers: challengeHandlers,
+          challengePriority: ['dns-01'],
+        });
+        await this.smartAcme.start();
+
+        smartProxyConfig.certProvisionFunction = async (domain: string) => {
+          try {
+            const cert = await this.smartAcme.getCertificateForDomain(domain);
+            return {
+              id: cert.id,
+              domainName: cert.domainName,
+              created: cert.created,
+              validUntil: cert.validUntil,
+              privateKey: cert.privateKey,
+              publicKey: cert.publicKey,
+              csr: cert.csr,
+            };
+          } catch (err) {
+            console.error(`[DcRouter] SmartAcme DNS-01 failed for ${domain}, falling back to http-01:`, err.message);
+            return 'http01';
+          }
+        };
      }
      
      // Create SmartProxy instance
@@ -456,14 +488,34 @@ export class DcRouter {
      if (acmeConfig) {
        this.smartProxy.on('certificate-issued', (event) => {
          console.log(`[DcRouter] Certificate issued for ${event.domain}, expires ${event.expiryDate}`);
+          const routeName = this.findRouteNameForDomain(event.domain);
+          if (routeName) {
+            this.certificateStatusMap.set(routeName, {
+              status: 'valid', domain: event.domain,
+              expiryDate: event.expiryDate, issuedAt: new Date().toISOString(),
+            });
+          }
        });
-        
+
        this.smartProxy.on('certificate-renewed', (event) => {
          console.log(`[DcRouter] Certificate renewed for ${event.domain}, expires ${event.expiryDate}`);
+          const routeName = this.findRouteNameForDomain(event.domain);
+          if (routeName) {
+            this.certificateStatusMap.set(routeName, {
+              status: 'valid', domain: event.domain,
+              expiryDate: event.expiryDate, issuedAt: new Date().toISOString(),
+            });
+          }
        });
-        
+
        this.smartProxy.on('certificate-failed', (event) => {
          console.error(`[DcRouter] Certificate failed for ${event.domain}:`, event.error);
+          const routeName = this.findRouteNameForDomain(event.domain);
+          if (routeName) {
+            this.certificateStatusMap.set(routeName, {
+              status: 'failed', domain: event.domain, error: event.error,
+            });
+          }
        });
      }
      
@@ -568,29 +620,6 @@ export class DcRouter {
      emailRoutes.push(routeConfig);
    }
    
-    // Add email domain-based routes if configured
-    if (emailConfig.routes) {
-      for (const route of emailConfig.routes) {
-        emailRoutes.push({
-          name: route.name,
-          match: {
-            ports: emailConfig.ports,
-            domains: route.match.recipients ? [route.match.recipients.toString().split('@')[1]] : []
-          },
-          action: {
-            type: 'forward',
-            targets: route.action.type === 'forward' && route.action.forward ? [{
-              host: route.action.forward.host,
-              port: route.action.forward.port || 25
-            }] : undefined,
-            tls: {
-              mode: 'passthrough'
-            }
-          }
-        });
-      }
-    }
-    
    return emailRoutes;
  }
  
@@ -658,6 +687,21 @@ export class DcRouter {
    return false;
  }

+  /**
+   * Find the route name that matches a given domain
+   */
+  private findRouteNameForDomain(domain: string): string | undefined {
+    if (!this.smartProxy) return undefined;
+    for (const route of this.smartProxy.routeManager.getRoutes()) {
+      if (!route.match.domains || !route.name) continue;
+      const routeDomains = Array.isArray(route.match.domains)
+        ? route.match.domains
+        : [route.match.domains];
+      if (routeDomains.includes(domain)) return route.name;
+    }
+    return undefined;
+  }
+
  public async stop() {
    console.log('Stopping DcRouter services...');

@@ -675,6 +719,9 @@ export class DcRouter {
        // Stop unified email server if running
        this.emailServer ? this.emailServer.stop().catch(err => console.error('Error stopping email server:', err)) : Promise.resolve(),

+        // Stop SmartAcme if running
+        this.smartAcme ? this.smartAcme.stop().catch(err => console.error('Error stopping SmartAcme:', err)) : Promise.resolve(),
+
        // Stop HTTP SmartProxy if running
        this.smartProxy ? this.smartProxy.stop().catch(err => console.error('Error stopping SmartProxy:', err)) : Promise.resolve(),

--- a/ts/monitoring/classes.metricsmanager.ts
+++ b/ts/monitoring/classes.metricsmanager.ts
@@ -147,8 +147,10 @@ export class MetricsManager {
        requestsPerSecond: proxyMetrics ? proxyMetrics.requests.perSecond() : 0,
        throughput: proxyMetrics ? {
          bytesIn: proxyMetrics.totals.bytesIn(),
-          bytesOut: proxyMetrics.totals.bytesOut()
-        } : { bytesIn: 0, bytesOut: 0 },
+          bytesOut: proxyMetrics.totals.bytesOut(),
+          bytesInPerSecond: proxyMetrics.throughput.instant().in,
+          bytesOutPerSecond: proxyMetrics.throughput.instant().out,
+        } : { bytesIn: 0, bytesOut: 0, bytesInPerSecond: 0, bytesOutPerSecond: 0 },
      };
    });
  }
--- a/ts/opsserver/classes.opsserver.ts
+++ b/ts/opsserver/classes.opsserver.ts
@@ -18,6 +18,7 @@ export class OpsServer {
  private statsHandler: handlers.StatsHandler;
  private radiusHandler: handlers.RadiusHandler;
  private emailOpsHandler: handlers.EmailOpsHandler;
+  private certificateHandler: handlers.CertificateHandler;

  constructor(dcRouterRefArg: DcRouter) {
    this.dcRouterRef = dcRouterRefArg;
@@ -57,6 +58,7 @@ export class OpsServer {
    this.statsHandler = new handlers.StatsHandler(this);
    this.radiusHandler = new handlers.RadiusHandler(this);
    this.emailOpsHandler = new handlers.EmailOpsHandler(this);
+    this.certificateHandler = new handlers.CertificateHandler(this);

    console.log('✅ OpsServer TypedRequest handlers initialized');
  }
--- a/ts/opsserver/handlers/certificate.handler.ts
+++ b/ts/opsserver/handlers/certificate.handler.ts
@@ -0,0 +1,174 @@
+import * as plugins from '../../plugins.js';
+import type { OpsServer } from '../classes.opsserver.js';
+import * as interfaces from '../../../ts_interfaces/index.js';
+
+export class CertificateHandler {
+  public typedrouter = new plugins.typedrequest.TypedRouter();
+
+  constructor(private opsServerRef: OpsServer) {
+    this.opsServerRef.typedrouter.addTypedRouter(this.typedrouter);
+    this.registerHandlers();
+  }
+
+  private registerHandlers(): void {
+    // Get Certificate Overview
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetCertificateOverview>(
+        'getCertificateOverview',
+        async (dataArg) => {
+          const certificates = this.buildCertificateOverview();
+          const summary = this.buildSummary(certificates);
+          return { certificates, summary };
+        }
+      )
+    );
+
+    // Reprovision Certificate
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_ReprovisionCertificate>(
+        'reprovisionCertificate',
+        async (dataArg) => {
+          return this.reprovisionCertificate(dataArg.routeName);
+        }
+      )
+    );
+  }
+
+  private buildCertificateOverview(): interfaces.requests.ICertificateInfo[] {
+    const dcRouter = this.opsServerRef.dcRouterRef;
+    const smartProxy = dcRouter.smartProxy;
+    if (!smartProxy) return [];
+
+    const routes = smartProxy.routeManager.getRoutes();
+    const certificates: interfaces.requests.ICertificateInfo[] = [];
+
+    for (const route of routes) {
+      if (!route.name) continue;
+
+      const tls = route.action?.tls;
+      if (!tls) continue;
+
+      // Skip passthrough routes - they don't manage certificates
+      if (tls.mode === 'passthrough') continue;
+
+      const routeDomains = route.match.domains
+        ? (Array.isArray(route.match.domains) ? route.match.domains : [route.match.domains])
+        : [];
+
+      // Determine source
+      let source: interfaces.requests.TCertificateSource = 'none';
+      if (tls.certificate === 'auto') {
+        // Check if a certProvisionFunction is configured
+        if ((smartProxy.settings as any).certProvisionFunction) {
+          source = 'provision-function';
+        } else {
+          source = 'acme';
+        }
+      } else if (tls.certificate && typeof tls.certificate === 'object') {
+        source = 'static';
+      }
+
+      // Start with unknown status
+      let status: interfaces.requests.TCertificateStatus = 'unknown';
+      let expiryDate: string | undefined;
+      let issuedAt: string | undefined;
+      let issuer: string | undefined;
+      let error: string | undefined;
+
+      // Check event-based status from DcRouter's certificateStatusMap
+      const eventStatus = dcRouter.certificateStatusMap.get(route.name);
+      if (eventStatus) {
+        status = eventStatus.status;
+        expiryDate = eventStatus.expiryDate;
+        issuedAt = eventStatus.issuedAt;
+        error = eventStatus.error;
+      }
+
+      // Try to get Rust-side certificate data
+      try {
+        // getCertificateStatus is async but we're in a sync context
+        // We'll rely on event-based data primarily
+      } catch {
+        // Ignore errors from Rust bridge
+      }
+
+      // Compute status from expiry date if we have one and status is still valid/unknown
+      if (expiryDate && (status === 'valid' || status === 'unknown')) {
+        const expiry = new Date(expiryDate);
+        const now = new Date();
+        const daysUntilExpiry = (expiry.getTime() - now.getTime()) / (1000 * 60 * 60 * 24);
+
+        if (daysUntilExpiry < 0) {
+          status = 'expired';
+        } else if (daysUntilExpiry < 30) {
+          status = 'expiring';
+        } else {
+          status = 'valid';
+        }
+      }
+
+      // Static certs with no other info default to 'valid'
+      if (source === 'static' && status === 'unknown') {
+        status = 'valid';
+      }
+
+      const canReprovision = source === 'acme' || source === 'provision-function';
+
+      certificates.push({
+        routeName: route.name,
+        domains: routeDomains,
+        status,
+        source,
+        tlsMode: tls.mode as 'terminate' | 'terminate-and-reencrypt' | 'passthrough',
+        expiryDate,
+        issuer,
+        issuedAt,
+        error,
+        canReprovision,
+      });
+    }
+
+    return certificates;
+  }
+
+  private buildSummary(certificates: interfaces.requests.ICertificateInfo[]): {
+    total: number;
+    valid: number;
+    expiring: number;
+    expired: number;
+    failed: number;
+    unknown: number;
+  } {
+    const summary = { total: 0, valid: 0, expiring: 0, expired: 0, failed: 0, unknown: 0 };
+    summary.total = certificates.length;
+    for (const cert of certificates) {
+      switch (cert.status) {
+        case 'valid': summary.valid++; break;
+        case 'expiring': summary.expiring++; break;
+        case 'expired': summary.expired++; break;
+        case 'failed': summary.failed++; break;
+        case 'provisioning': // count as unknown
+        case 'unknown': summary.unknown++; break;
+      }
+    }
+    return summary;
+  }
+
+  private async reprovisionCertificate(routeName: string): Promise<{ success: boolean; message?: string }> {
+    const dcRouter = this.opsServerRef.dcRouterRef;
+    const smartProxy = dcRouter.smartProxy;
+
+    if (!smartProxy) {
+      return { success: false, message: 'SmartProxy is not running' };
+    }
+
+    try {
+      await smartProxy.provisionCertificate(routeName);
+      // Clear event-based status so it gets refreshed
+      dcRouter.certificateStatusMap.delete(routeName);
+      return { success: true, message: `Certificate reprovisioning triggered for route '${routeName}'` };
+    } catch (err) {
+      return { success: false, message: err.message || 'Failed to reprovision certificate' };
+    }
+  }
+}
--- a/ts/opsserver/handlers/index.ts
+++ b/ts/opsserver/handlers/index.ts
@@ -4,4 +4,5 @@ export * from './logs.handler.js';
 export * from './security.handler.js';
 export * from './stats.handler.js';
 export * from './radius.handler.js';
-export * from './email-ops.handler.js';
+export * from './email-ops.handler.js';
+export * from './certificate.handler.js';
--- a/ts/opsserver/handlers/stats.handler.ts
+++ b/ts/opsserver/handlers/stats.handler.ts
@@ -27,6 +27,8 @@ export class StatsHandler {
              cpuUsage: stats.cpuUsage,
              activeConnections: stats.activeConnections,
              totalConnections: stats.totalConnections,
+              requestsPerSecond: stats.requestsPerSecond,
+              throughput: stats.throughput,
            },
            history: dataArg.includeHistory ? stats.history : undefined,
          };
@@ -191,6 +193,8 @@ export class StatsHandler {
                  cpuUsage: stats.cpuUsage,
                  activeConnections: stats.activeConnections,
                  totalConnections: stats.totalConnections,
+                  requestsPerSecond: stats.requestsPerSecond,
+                  throughput: stats.throughput,
                };
              })
            );
@@ -301,6 +305,7 @@ export class StatsHandler {
    requestsPerSecond: number;
    activeConnections: number;
    totalConnections: number;
+    throughput: interfaces.data.IServerStats['throughput'];
    history: Array<{
      timestamp: number;
      value: number;
@@ -316,15 +321,16 @@ export class StatsHandler {
        requestsPerSecond: serverStats.requestsPerSecond,
        activeConnections: serverStats.activeConnections,
        totalConnections: serverStats.totalConnections,
+        throughput: serverStats.throughput,
        history: [], // TODO: Implement history tracking
      };
    }
-    
+
    // Fallback to basic stats if MetricsManager not available
    const uptime = process.uptime();
    const memUsage = process.memoryUsage();
    const cpuUsage = plugins.os.loadavg()[0] * 100 / plugins.os.cpus().length;
-    
+
    return {
      uptime,
      cpuUsage: {
@@ -340,6 +346,7 @@ export class StatsHandler {
      requestsPerSecond: 0,
      activeConnections: 0,
      totalConnections: 0,
+      throughput: { bytesIn: 0, bytesOut: 0, bytesInPerSecond: 0, bytesOutPerSecond: 0 },
      history: [],
    };
  }
--- a/ts/paths.ts
+++ b/ts/paths.ts
@@ -8,11 +8,17 @@ export const packageDir = plugins.path.join(
 );
 export const distServe = plugins.path.join(packageDir, './dist_serve');

-// Configure data directory with environment variable or default to .nogit/data
-const DEFAULT_DATA_PATH = '.nogit/data';
-export const dataDir = process.env.DATA_DIR 
-  ? process.env.DATA_DIR 
-  : plugins.path.join(baseDir, DEFAULT_DATA_PATH);
+// Default base for all dcrouter data (always user-writable)
+export const dcrouterHomeDir = plugins.path.join(plugins.os.homedir(), '.serve.zone', 'dcrouter');
+
+// Configure data directory with environment variable or default to ~/.serve.zone/dcrouter/data
+const DEFAULT_DATA_PATH = plugins.path.join(dcrouterHomeDir, 'data');
+export const dataDir = process.env.DATA_DIR
+  ? process.env.DATA_DIR
+  : DEFAULT_DATA_PATH;
+
+// Default TsmDB path for CacheDb
+export const defaultTsmDbPath = plugins.path.join(dcrouterHomeDir, 'tsmdb');

 // MTA directories 
 export const keysDir = plugins.path.join(dataDir, 'keys');
--- a/ts_interfaces/data/stats.ts
+++ b/ts_interfaces/data/stats.ts
@@ -17,6 +17,13 @@ export interface IServerStats {
  };
  activeConnections: number;
  totalConnections: number;
+  requestsPerSecond: number;
+  throughput: {
+    bytesIn: number;
+    bytesOut: number;
+    bytesInPerSecond: number;
+    bytesOutPerSecond: number;
+  };
 }

 export interface IEmailStats {
--- a/ts_interfaces/readme.md
+++ b/ts_interfaces/readme.md
@@ -89,7 +89,7 @@ TypedRequest interfaces for the OpsServer API, organized by domain:
 #### 🔐 Authentication
 | Interface | Method | Description |
 |-----------|--------|-------------|
-| `IReq_AdminLoginWithUsernameAndPassword` | `adminLogin` | Authenticate as admin |
+| `IReq_AdminLoginWithUsernameAndPassword` | `adminLoginWithUsernameAndPassword` | Authenticate as admin |
 | `IReq_AdminLogout` | `adminLogout` | End admin session |
 | `IReq_VerifyIdentity` | `verifyIdentity` | Verify JWT token validity |

--- a/ts_interfaces/requests/certificate.ts
+++ b/ts_interfaces/requests/certificate.ts
@@ -0,0 +1,54 @@
+import * as plugins from '../plugins.js';
+import * as authInterfaces from '../data/auth.js';
+
+export type TCertificateStatus = 'valid' | 'expiring' | 'expired' | 'provisioning' | 'failed' | 'unknown';
+export type TCertificateSource = 'acme' | 'provision-function' | 'static' | 'none';
+
+export interface ICertificateInfo {
+  routeName: string;
+  domains: string[];
+  status: TCertificateStatus;
+  source: TCertificateSource;
+  tlsMode: 'terminate' | 'terminate-and-reencrypt' | 'passthrough';
+  expiryDate?: string;     // ISO string
+  issuer?: string;
+  issuedAt?: string;       // ISO string
+  error?: string;          // if status === 'failed'
+  canReprovision: boolean; // true for acme/provision-function routes
+}
+
+export interface IReq_GetCertificateOverview extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_GetCertificateOverview
+> {
+  method: 'getCertificateOverview';
+  request: {
+    identity?: authInterfaces.IIdentity;
+  };
+  response: {
+    certificates: ICertificateInfo[];
+    summary: {
+      total: number;
+      valid: number;
+      expiring: number;
+      expired: number;
+      failed: number;
+      unknown: number;
+    };
+  };
+}
+
+export interface IReq_ReprovisionCertificate extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_ReprovisionCertificate
+> {
+  method: 'reprovisionCertificate';
+  request: {
+    identity?: authInterfaces.IIdentity;
+    routeName: string;
+  };
+  response: {
+    success: boolean;
+    message?: string;
+  };
+}
--- a/ts_interfaces/requests/index.ts
+++ b/ts_interfaces/requests/index.ts
@@ -4,4 +4,5 @@ export * from './logs.js';
 export * from './stats.js';
 export * from './combined.stats.js';
 export * from './radius.js';
-export * from './email-ops.js';
+export * from './email-ops.js';
+export * from './certificate.js';
--- a/ts_web/00_commitinfo_data.ts
+++ b/ts_web/00_commitinfo_data.ts
@@ -3,6 +3,6 @@
 */
 export const commitinfo = {
  name: '@serve.zone/dcrouter',
-  version: '5.0.0',
+  version: '5.3.0',
  description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }
--- a/ts_web/appstate.ts
+++ b/ts_web/appstate.ts
@@ -53,6 +53,14 @@ export interface INetworkState {
  error: string | null;
 }

+export interface ICertificateState {
+  certificates: interfaces.requests.ICertificateInfo[];
+  summary: { total: number; valid: number; expiring: number; expired: number; failed: number; unknown: number };
+  isLoading: boolean;
+  error: string | null;
+  lastUpdated: number;
+}
+
 export interface IEmailOpsState {
  currentView: 'queued' | 'sent' | 'failed' | 'received' | 'security';
  queuedEmails: interfaces.requests.IEmailQueueItem[];
@@ -103,7 +111,7 @@ export const configStatePart = await appState.getStatePart<IConfigState>(
 // Determine initial view from URL path
 const getInitialView = (): string => {
  const path = typeof window !== 'undefined' ? window.location.pathname : '/';
-  const validViews = ['overview', 'network', 'emails', 'logs', 'configuration', 'security'];
+  const validViews = ['overview', 'network', 'emails', 'logs', 'configuration', 'security', 'certificates'];
  const segments = path.split('/').filter(Boolean);
  const view = segments[0];
  return validViews.includes(view) ? view : 'overview';
@@ -162,6 +170,18 @@ export const emailOpsStatePart = await appState.getStatePart<IEmailOpsState>(
  'soft'
 );

+export const certificateStatePart = await appState.getStatePart<ICertificateState>(
+  'certificates',
+  {
+    certificates: [],
+    summary: { total: 0, valid: 0, expiring: 0, expired: 0, failed: 0, unknown: 0 },
+    isLoading: false,
+    error: null,
+    lastUpdated: 0,
+  },
+  'soft'
+);
+
 // Actions for state management
 interface IActionContext {
  identity: interfaces.data.IIdentity | null;
@@ -340,7 +360,14 @@ export const setActiveViewAction = uiStatePart.createAction<string>(async (state
      networkStatePart.dispatchAction(fetchNetworkStatsAction, null);
    }, 100);
  }
-  
+
+  // If switching to certificates view, ensure we fetch certificate data
+  if (viewName === 'certificates' && currentState.activeView !== 'certificates') {
+    setTimeout(() => {
+      certificateStatePart.dispatchAction(fetchCertificateOverviewAction, null);
+    }, 100);
+  }
+
  return {
    ...currentState,
    activeView: viewName,
@@ -641,6 +668,66 @@ export const removeFromSuppressionListAction = emailOpsStatePart.createAction<st
  }
 );

+// ============================================================================
+// Certificate Actions
+// ============================================================================
+
+export const fetchCertificateOverviewAction = certificateStatePart.createAction(async (statePartArg) => {
+  const context = getActionContext();
+  const currentState = statePartArg.getState();
+
+  try {
+    const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
+      interfaces.requests.IReq_GetCertificateOverview
+    >('/typedrequest', 'getCertificateOverview');
+
+    const response = await request.fire({
+      identity: context.identity,
+    });
+
+    return {
+      certificates: response.certificates,
+      summary: response.summary,
+      isLoading: false,
+      error: null,
+      lastUpdated: Date.now(),
+    };
+  } catch (error) {
+    return {
+      ...currentState,
+      isLoading: false,
+      error: error instanceof Error ? error.message : 'Failed to fetch certificate overview',
+    };
+  }
+});
+
+export const reprovisionCertificateAction = certificateStatePart.createAction<string>(
+  async (statePartArg, routeName) => {
+    const context = getActionContext();
+    const currentState = statePartArg.getState();
+
+    try {
+      const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
+        interfaces.requests.IReq_ReprovisionCertificate
+      >('/typedrequest', 'reprovisionCertificate');
+
+      await request.fire({
+        identity: context.identity,
+        routeName,
+      });
+
+      // Re-fetch overview after reprovisioning
+      await certificateStatePart.dispatchAction(fetchCertificateOverviewAction, null);
+      return statePartArg.getState();
+    } catch (error) {
+      return {
+        ...currentState,
+        error: error instanceof Error ? error.message : 'Failed to reprovision certificate',
+      };
+    }
+  }
+);
+
 // Combined refresh action for efficient polling
 async function dispatchCombinedRefreshAction() {
  const context = getActionContext();
@@ -725,6 +812,15 @@ async function dispatchCombinedRefreshAction() {
        });
      }
    }
+
+    // Refresh certificate data if on certificates view
+    if (currentView === 'certificates') {
+      try {
+        await certificateStatePart.dispatchAction(fetchCertificateOverviewAction, null);
+      } catch (error) {
+        console.error('Certificate refresh failed:', error);
+      }
+    }
  } catch (error) {
    console.error('Combined refresh failed:', error);
  }
--- a/ts_web/elements/index.ts
+++ b/ts_web/elements/index.ts
@@ -5,4 +5,5 @@ export * from './ops-view-emails.js';
 export * from './ops-view-logs.js';
 export * from './ops-view-config.js';
 export * from './ops-view-security.js';
+export * from './ops-view-certificates.js';
 export * from './shared/index.js';
--- a/ts_web/elements/ops-dashboard.ts
+++ b/ts_web/elements/ops-dashboard.ts
@@ -19,6 +19,7 @@ import { OpsViewEmails } from './ops-view-emails.js';
 import { OpsViewLogs } from './ops-view-logs.js';
 import { OpsViewConfig } from './ops-view-config.js';
 import { OpsViewSecurity } from './ops-view-security.js';
+import { OpsViewCertificates } from './ops-view-certificates.js';

@customElement('ops-dashboard')
 export class OpsDashboard extends DeesElement {
@@ -61,6 +62,10 @@ export class OpsDashboard extends DeesElement {
      name: 'Security',
      element: OpsViewSecurity,
    },
+    {
+      name: 'Certificates',
+      element: OpsViewCertificates,
+    },
  ];

  /**
--- a/ts_web/elements/ops-view-certificates.ts
+++ b/ts_web/elements/ops-view-certificates.ts
@@ -0,0 +1,355 @@
+import {
+  DeesElement,
+  html,
+  customElement,
+  type TemplateResult,
+  css,
+  state,
+  cssManager,
+} from '@design.estate/dees-element';
+import * as appstate from '../appstate.js';
+import * as interfaces from '../../dist_ts_interfaces/index.js';
+import { viewHostCss } from './shared/css.js';
+import { type IStatsTile } from '@design.estate/dees-catalog';
+
+declare global {
+  interface HTMLElementTagNameMap {
+    'ops-view-certificates': OpsViewCertificates;
+  }
+}
+
+@customElement('ops-view-certificates')
+export class OpsViewCertificates extends DeesElement {
+  @state()
+  accessor certState: appstate.ICertificateState = appstate.certificateStatePart.getState();
+
+  constructor() {
+    super();
+    const sub = appstate.certificateStatePart.state.subscribe((newState) => {
+      this.certState = newState;
+    });
+    this.rxSubscriptions.push(sub);
+  }
+
+  async connectedCallback() {
+    await super.connectedCallback();
+    await appstate.certificateStatePart.dispatchAction(appstate.fetchCertificateOverviewAction, null);
+  }
+
+  public static styles = [
+    cssManager.defaultStyles,
+    viewHostCss,
+    css`
+      .certificatesContainer {
+        display: flex;
+        flex-direction: column;
+        gap: 24px;
+      }
+
+      .statusBadge {
+        display: inline-flex;
+        align-items: center;
+        padding: 3px 10px;
+        border-radius: 12px;
+        font-size: 12px;
+        font-weight: 600;
+        letter-spacing: 0.02em;
+        text-transform: uppercase;
+      }
+
+      .statusBadge.valid {
+        background: ${cssManager.bdTheme('#dcfce7', '#14532d')};
+        color: ${cssManager.bdTheme('#166534', '#4ade80')};
+      }
+
+      .statusBadge.expiring {
+        background: ${cssManager.bdTheme('#fff7ed', '#431407')};
+        color: ${cssManager.bdTheme('#9a3412', '#fb923c')};
+      }
+
+      .statusBadge.expired,
+      .statusBadge.failed {
+        background: ${cssManager.bdTheme('#fef2f2', '#450a0a')};
+        color: ${cssManager.bdTheme('#991b1b', '#f87171')};
+      }
+
+      .statusBadge.provisioning {
+        background: ${cssManager.bdTheme('#eff6ff', '#172554')};
+        color: ${cssManager.bdTheme('#1e40af', '#60a5fa')};
+      }
+
+      .statusBadge.unknown {
+        background: ${cssManager.bdTheme('#f3f4f6', '#1f2937')};
+        color: ${cssManager.bdTheme('#4b5563', '#9ca3af')};
+      }
+
+      .sourceBadge {
+        display: inline-flex;
+        align-items: center;
+        padding: 3px 8px;
+        border-radius: 4px;
+        font-size: 11px;
+        font-weight: 500;
+        background: ${cssManager.bdTheme('#f3f4f6', '#1f2937')};
+        color: ${cssManager.bdTheme('#374151', '#d1d5db')};
+      }
+
+      .domainPills {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 4px;
+      }
+
+      .domainPill {
+        display: inline-flex;
+        align-items: center;
+        padding: 2px 8px;
+        border-radius: 4px;
+        font-size: 12px;
+        background: ${cssManager.bdTheme('#e0e7ff', '#1e1b4b')};
+        color: ${cssManager.bdTheme('#3730a3', '#a5b4fc')};
+      }
+
+      .moreCount {
+        font-size: 11px;
+        color: ${cssManager.bdTheme('#6b7280', '#9ca3af')};
+        padding: 2px 6px;
+      }
+
+      .errorText {
+        font-size: 12px;
+        color: ${cssManager.bdTheme('#991b1b', '#f87171')};
+        max-width: 200px;
+        overflow: hidden;
+        text-overflow: ellipsis;
+        white-space: nowrap;
+      }
+
+      .expiryInfo {
+        font-size: 12px;
+      }
+
+      .expiryInfo .daysLeft {
+        font-size: 11px;
+        color: ${cssManager.bdTheme('#6b7280', '#9ca3af')};
+      }
+
+      .expiryInfo .daysLeft.warn {
+        color: ${cssManager.bdTheme('#9a3412', '#fb923c')};
+      }
+
+      .expiryInfo .daysLeft.danger {
+        color: ${cssManager.bdTheme('#991b1b', '#f87171')};
+      }
+    `,
+  ];
+
+  public render(): TemplateResult {
+    const { summary } = this.certState;
+
+    return html`
+      <ops-sectionheading>Certificates</ops-sectionheading>
+
+      <div class="certificatesContainer">
+        ${this.renderStatsTiles(summary)}
+        ${this.renderCertificateTable()}
+      </div>
+    `;
+  }
+
+  private renderStatsTiles(summary: appstate.ICertificateState['summary']): TemplateResult {
+    const tiles: IStatsTile[] = [
+      {
+        id: 'total',
+        title: 'Total Certificates',
+        value: summary.total,
+        type: 'number',
+        icon: 'shieldHalved',
+        color: '#3b82f6',
+      },
+      {
+        id: 'valid',
+        title: 'Valid',
+        value: summary.valid,
+        type: 'number',
+        icon: 'check',
+        color: '#22c55e',
+      },
+      {
+        id: 'expiring',
+        title: 'Expiring Soon',
+        value: summary.expiring,
+        type: 'number',
+        icon: 'clock',
+        color: '#f59e0b',
+      },
+      {
+        id: 'problems',
+        title: 'Failed / Expired',
+        value: summary.failed + summary.expired,
+        type: 'number',
+        icon: 'triangleExclamation',
+        color: '#ef4444',
+      },
+    ];
+
+    return html`
+      <dees-statsgrid
+        .tiles=${tiles}
+        .minTileWidth=${200}
+        .gridActions=${[
+          {
+            name: 'Refresh',
+            iconName: 'arrowsRotate',
+            action: async () => {
+              await appstate.certificateStatePart.dispatchAction(
+                appstate.fetchCertificateOverviewAction,
+                null
+              );
+            },
+          },
+        ]}
+      ></dees-statsgrid>
+    `;
+  }
+
+  private renderCertificateTable(): TemplateResult {
+    return html`
+      <dees-table
+        .data=${this.certState.certificates}
+        .displayFunction=${(cert: interfaces.requests.ICertificateInfo) => ({
+          Route: cert.routeName,
+          Domains: this.renderDomainPills(cert.domains),
+          Status: this.renderStatusBadge(cert.status),
+          Source: this.renderSourceBadge(cert.source),
+          Expires: this.renderExpiry(cert.expiryDate),
+          Error: cert.error
+            ? html`<span class="errorText" title="${cert.error}">${cert.error}</span>`
+            : '',
+        })}
+        .dataActions=${[
+          {
+            name: 'Reprovision',
+            iconName: 'arrowsRotate',
+            type: ['inRow'],
+            actionFunc: async (actionData: { item: interfaces.requests.ICertificateInfo }) => {
+              const cert = actionData.item;
+              if (!cert.canReprovision) {
+                const { DeesToast } = await import('@design.estate/dees-catalog');
+                DeesToast.show({
+                  message: 'This certificate source does not support reprovisioning.',
+                  type: 'warning',
+                  duration: 3000,
+                });
+                return;
+              }
+              await appstate.certificateStatePart.dispatchAction(
+                appstate.reprovisionCertificateAction,
+                cert.routeName,
+              );
+              const { DeesToast } = await import('@design.estate/dees-catalog');
+              DeesToast.show({
+                message: `Reprovisioning triggered for ${cert.routeName}`,
+                type: 'success',
+                duration: 3000,
+              });
+            },
+          },
+          {
+            name: 'View Details',
+            iconName: 'magnifyingGlass',
+            type: ['doubleClick', 'contextmenu'],
+            actionFunc: async (actionData: { item: interfaces.requests.ICertificateInfo }) => {
+              const cert = actionData.item;
+              const { DeesModal } = await import('@design.estate/dees-catalog');
+              await DeesModal.createAndShow({
+                heading: `Certificate: ${cert.routeName}`,
+                content: html`
+                  <div style="padding: 20px;">
+                    <dees-dataview-codebox
+                      .heading=${'Certificate Details'}
+                      progLang="json"
+                      .codeToDisplay=${JSON.stringify(cert, null, 2)}
+                    ></dees-dataview-codebox>
+                  </div>
+                `,
+                menuOptions: [
+                  {
+                    name: 'Copy Route Name',
+                    iconName: 'copy',
+                    action: async () => {
+                      await navigator.clipboard.writeText(cert.routeName);
+                    },
+                  },
+                ],
+              });
+            },
+          },
+        ]}
+        heading1="Certificate Status"
+        heading2="TLS certificates across all routes"
+        searchable
+        .pagination=${true}
+        .paginationSize=${50}
+        dataName="certificate"
+      ></dees-table>
+    `;
+  }
+
+  private renderDomainPills(domains: string[]): TemplateResult {
+    const maxShow = 3;
+    const visible = domains.slice(0, maxShow);
+    const remaining = domains.length - maxShow;
+
+    return html`
+      <span class="domainPills">
+        ${visible.map((d) => html`<span class="domainPill">${d}</span>`)}
+        ${remaining > 0 ? html`<span class="moreCount">+${remaining} more</span>` : ''}
+      </span>
+    `;
+  }
+
+  private renderStatusBadge(status: interfaces.requests.TCertificateStatus): TemplateResult {
+    return html`<span class="statusBadge ${status}">${status}</span>`;
+  }
+
+  private renderSourceBadge(source: interfaces.requests.TCertificateSource): TemplateResult {
+    const labels: Record<string, string> = {
+      acme: 'ACME',
+      'provision-function': 'Custom',
+      static: 'Static',
+      none: 'None',
+    };
+    return html`<span class="sourceBadge">${labels[source] || source}</span>`;
+  }
+
+  private renderExpiry(expiryDate?: string): TemplateResult {
+    if (!expiryDate) {
+      return html`<span style="color: ${cssManager.bdTheme('#9ca3af', '#4b5563')}">--</span>`;
+    }
+
+    const expiry = new Date(expiryDate);
+    const now = new Date();
+    const daysLeft = Math.ceil((expiry.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+
+    const dateStr = expiry.toLocaleDateString();
+    let daysClass = '';
+    let daysText = '';
+
+    if (daysLeft < 0) {
+      daysClass = 'danger';
+      daysText = `(expired)`;
+    } else if (daysLeft < 30) {
+      daysClass = 'warn';
+      daysText = `(${daysLeft}d left)`;
+    } else {
+      daysText = `(${daysLeft}d left)`;
+    }
+
+    return html`
+      <span class="expiryInfo">
+        ${dateStr} <span class="daysLeft ${daysClass}">${daysText}</span>
+      </span>
+    `;
+  }
+}
--- a/ts_web/elements/ops-view-overview.ts
+++ b/ts_web/elements/ops-view-overview.ts
@@ -126,12 +126,26 @@ export class OpsViewOverview extends DeesElement {
    const units = ['B', 'KB', 'MB', 'GB', 'TB'];
    let size = bytes;
    let unitIndex = 0;
-    
+
    while (size >= 1024 && unitIndex < units.length - 1) {
      size /= 1024;
      unitIndex++;
    }
-    
+
+    return `${size.toFixed(1)} ${units[unitIndex]}`;
+  }
+
+  private formatBitsPerSecond(bytesPerSecond: number): string {
+    const bitsPerSecond = bytesPerSecond * 8;
+    const units = ['bit/s', 'kbit/s', 'Mbit/s', 'Gbit/s'];
+    let size = bitsPerSecond;
+    let unitIndex = 0;
+
+    while (size >= 1000 && unitIndex < units.length - 1) {
+      size /= 1000;
+      unitIndex++;
+    }
+
    return `${size.toFixed(1)} ${units[unitIndex]}`;
  }

@@ -162,6 +176,24 @@ export class OpsViewOverview extends DeesElement {
        color: '#3b82f6',
        description: `Total: ${this.statsState.serverStats.totalConnections}`,
      },
+      {
+        id: 'throughputIn',
+        title: 'Throughput In',
+        value: this.formatBitsPerSecond(this.statsState.serverStats.throughput?.bytesInPerSecond || 0),
+        type: 'text',
+        icon: 'download',
+        color: '#22c55e',
+        description: `Total: ${this.formatBytes(this.statsState.serverStats.throughput?.bytesIn || 0)}`,
+      },
+      {
+        id: 'throughputOut',
+        title: 'Throughput Out',
+        value: this.formatBitsPerSecond(this.statsState.serverStats.throughput?.bytesOutPerSecond || 0),
+        type: 'text',
+        icon: 'upload',
+        color: '#8b5cf6',
+        description: `Total: ${this.formatBytes(this.statsState.serverStats.throughput?.bytesOut || 0)}`,
+      },
      {
        id: 'cpu',
        title: 'CPU Usage',
--- a/ts_web/router.ts
+++ b/ts_web/router.ts
@@ -3,7 +3,7 @@ import * as appstate from './appstate.js';

 const SmartRouter = plugins.domtools.plugins.smartrouter.SmartRouter;

-export const validViews = ['overview', 'network', 'emails', 'logs', 'configuration', 'security'] as const;
+export const validViews = ['overview', 'network', 'emails', 'logs', 'configuration', 'security', 'certificates'] as const;
 export const validEmailFolders = ['queued', 'sent', 'failed', 'security'] as const;

 export type TValidView = typeof validViews[number];
Author	SHA1	Message	Date
Juergen Kunz	2b75709161	v5.3.0 Some checks failed Docker (tags) / security (push) Has been cancelled Details Docker (tags) / test (push) Has been cancelled Details Docker (tags) / release (push) Has been cancelled Details Docker (tags) / metadata (push) Has been cancelled Details	2026-02-13 17:05:33 +00:00
Juergen Kunz	c5e2c262b7	feat(certificates): add certificate overview and reprovisioning in ops UI and API; track SmartProxy certificate events	2026-02-13 17:05:33 +00:00
Juergen Kunz	d10896196d	v5.2.0 Some checks failed Docker (tags) / security (push) Has been cancelled Details Docker (tags) / test (push) Has been cancelled Details Docker (tags) / release (push) Has been cancelled Details Docker (tags) / metadata (push) Has been cancelled Details	2026-02-13 14:19:19 +00:00
Juergen Kunz	8be1e87bdc	feat(monitoring): add throughput metrics and expose them in ops UI	2026-02-13 14:19:19 +00:00
Juergen Kunz	96cefe984a	v5.1.0 Some checks failed Docker (tags) / security (push) Failing after 1s Details Docker (tags) / test (push) Has been skipped Details Docker (tags) / release (push) Has been skipped Details Docker (tags) / metadata (push) Has been skipped Details	2026-02-13 12:12:01 +00:00
Juergen Kunz	ca112c3e42	feat(acme): Integrate SmartAcme DNS-01 handling and add certificate provisioning for SmartProxy	2026-02-13 12:12:01 +00:00
Juergen Kunz	85b6c4fa51	v5.0.7 Some checks failed Docker (tags) / security (push) Failing after 1s Details Docker (tags) / test (push) Has been skipped Details Docker (tags) / release (push) Has been skipped Details Docker (tags) / metadata (push) Has been skipped Details	2026-02-13 00:02:09 +00:00
Juergen Kunz	ee550e6f25	fix(deps): bump @push.rocks/smartdns to ^7.8.1 and @push.rocks/smartmta to ^5.2.2	2026-02-13 00:02:09 +00:00
Juergen Kunz	108a8bb51d	v5.0.6 Some checks failed Docker (tags) / security (push) Failing after 1s Details Docker (tags) / test (push) Has been skipped Details Docker (tags) / release (push) Has been skipped Details Docker (tags) / metadata (push) Has been skipped Details	2026-02-12 22:51:55 +00:00
Juergen Kunz	3c5b26d1c1	fix(deps): bump @push.rocks/smartproxy to ^23.1.4	2026-02-12 22:51:55 +00:00
Juergen Kunz	01fbc3db95	v5.0.5 Some checks failed Docker (tags) / security (push) Failing after 1s Details Docker (tags) / test (push) Has been skipped Details Docker (tags) / release (push) Has been skipped Details Docker (tags) / metadata (push) Has been skipped Details	2026-02-12 16:27:28 +00:00
Juergen Kunz	8dd9770339	fix(dcrouter): remove legacy handling of emailConfig.routes that added domain-based routes	2026-02-12 16:27:28 +00:00
Juergen Kunz	77842647fd	v5.0.4 Some checks failed Docker (tags) / security (push) Failing after 1s Details Docker (tags) / test (push) Has been skipped Details Docker (tags) / release (push) Has been skipped Details Docker (tags) / metadata (push) Has been skipped Details	2026-02-12 14:20:42 +00:00
Juergen Kunz	a309145829	fix(cache): use user-writable ~/.serve.zone/dcrouter for TsmDB and centralize data path logic	2026-02-12 14:20:42 +00:00
Juergen Kunz	5de8d38b78	v5.0.3 Some checks failed Docker (tags) / security (push) Failing after 1s Details Docker (tags) / test (push) Has been skipped Details Docker (tags) / release (push) Has been skipped Details Docker (tags) / metadata (push) Has been skipped Details	2026-02-12 13:41:32 +00:00
Juergen Kunz	2d6dbc552e	fix(packaging): add files whitelist to package.json and remove Playwright-generated screenshots	2026-02-12 13:41:32 +00:00
Juergen Kunz	f0fae866dc	v5.0.2 Some checks failed Docker (tags) / security (push) Failing after 1s Details Docker (tags) / test (push) Has been skipped Details Docker (tags) / release (push) Has been skipped Details Docker (tags) / metadata (push) Has been skipped Details	2026-02-12 10:15:26 +00:00
Juergen Kunz	87c039a63f	fix(docs): update documentation and packaging configuration: document smartmta/smartdns integrations, adjust API method names, and add release registry info	2026-02-12 10:15:26 +00:00
Juergen Kunz	2c875cbb18	v5.0.1 Some checks failed Docker (tags) / security (push) Failing after 1s Details Docker (tags) / test (push) Has been skipped Details Docker (tags) / release (push) Has been skipped Details Docker (tags) / metadata (push) Has been skipped Details	2026-02-11 17:24:17 +00:00
Juergen Kunz	735464e8e6	fix(deps/tests): bump two dependencies and disable cache in tests	2026-02-11 17:24:17 +00:00