v4.4.0

feat(remoteingress): add heartbeat PING/PONG and liveness timeouts; implement fast-reconnect/backoff reset and JS crash-recovery auto-restart
v4.3.0
2026-03-03 11:47:50 +00:00 · 2026-03-03 11:47:50 +00:00 · 2026-02-26 23:47:16 +00:00 · 2026-02-26 23:47:16 +00:00 · 2026-02-26 23:02:23 +00:00 · 2026-02-26 23:02:23 +00:00
30 changed files with 13824 additions and 3459 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -17,4 +17,5 @@ node_modules/
 dist/
 dist_*/

-# custom
+# custom
+rust/target/
--- a/changelog.md
+++ b/changelog.md
@@ -0,0 +1,164 @@
+# Changelog
+
+## 2026-03-03 - 4.4.0 - feat(remoteingress)
+add heartbeat PING/PONG and liveness timeouts; implement fast-reconnect/backoff reset and JS crash-recovery auto-restart
+
+- protocol: add FRAME_PING and FRAME_PONG and unit tests for ping/pong frames
+- edge (Rust): reset backoff after successful connection, respond to PING with PONG, track liveness via deadline and reconnect on timeout, use Duration/Instant helpers
+- hub (Rust): send periodic PING to edges, handle PONGs, enforce liveness timeout and disconnect inactive edges, use tokio interval and time utilities
+- ts: RemoteIngressEdge and RemoteIngressHub: add crash-recovery auto-restart with exponential backoff and max attempts, save/restore config and allowed edges, register/remove exit handlers, ensure stop() marks stopping and cleans up listeners
+- minor API/typing: introduce TAllowedEdge alias and persist allowed edges for restart recovery
+
+## 2026-02-26 - 4.3.0 - feat(hub)
+add optional TLS certificate/key support to hub start config and bridge
+
+- TypeScript: add tls.certPem and tls.keyPem to IHubConfig and include tlsCertPem/tlsKeyPem in startHub bridge command when both are provided
+- TypeScript: extend startHub params with tlsCertPem and tlsKeyPem and conditionally send them
+- Rust: change HubConfig serde attributes for tls_cert_pem and tls_key_pem from skip to default so absent PEM fields deserialize as None
+- Enables optional provisioning of TLS certificate and key to the hub when provided from the JS side
+
+## 2026-02-26 - 4.2.0 - feat(core)
+expose edge peer address in hub events and migrate writers to channel-based, non-blocking framing with stream limits and timeouts
+
+- Add peerAddr to ConnectedEdgeStatus and HubEvent::EdgeConnected and surface it to the TS frontend event (management:edgeConnected).
+- Replace Arc<Mutex<WriteHalf>> writers with dedicated mpsc channel writer tasks in both hub and edge crates to serialize writes off the main tasks.
+- Use non-blocking try_send for data frames to avoid head-of-line blocking and drop frames with warnings when channels are full.
+- Introduce MAX_STREAMS_PER_EDGE semaphore to limit concurrent streams per edge and reject excess opens with a CLOSE_BACK frame.
+- Add a 10s timeout when connecting to SmartProxy to avoid hanging connections.
+- Ensure writer tasks are aborted on shutdown/cleanup and propagate cancellation tokens appropriately.
+
+## 2026-02-26 - 4.1.0 - feat(remoteingress-bin)
+use mimalloc as the global allocator to reduce memory overhead and improve allocation performance
+
+- added mimalloc = "0.1" dependency to rust/crates/remoteingress-bin/Cargo.toml
+- registered mimalloc as the #[global_allocator] in rust/crates/remoteingress-bin/src/main.rs
+- updated Cargo.lock with libmimalloc-sys and mimalloc package entries
+
+## 2026-02-26 - 4.0.1 - fix(hub)
+cancel per-stream tokens on stream close and avoid duplicate StreamClosed events; bump @types/node devDependency to ^25.3.0
+
+- Add CancellationToken to per-stream entries so each stream can be cancelled independently.
+- Ensure StreamClosed event is only emitted when a stream was actually present (guards against duplicate events).
+- Cancel the stream-specific token on FRAME_CLOSE to stop associated tasks and free resources.
+- DevDependency bump: @types/node updated from ^25.2.3 to ^25.3.0.
+
+## 2026-02-19 - 4.0.0 - BREAKING CHANGE(remoteingress-core)
+add cancellation tokens and cooperative shutdown; switch event channels to bounded mpsc and improve cleanup
+
+- Introduce tokio-util::sync::CancellationToken for hub/edge and per-connection/stream cancellation, enabling cooperative shutdown of spawned tasks.
+- Replace unbounded mpsc channels with bounded mpsc::channel(1024) and switch from UnboundedSender/Receiver to Sender/Receiver; use try_send where non-blocking sends are appropriate.
+- Wire cancellation tokens through edge and hub codepaths: child tokens per connection, per-port, per-stream; cancel tokens in stop() and Drop impls to ensure deterministic task termination and cleanup.
+- Reset stream id counters and clear listener state on reconnect; improved error handling around accept/read loops using tokio::select! and cancellation checks.
+- Update Cargo.toml and Cargo.lock to add tokio-util (and related futures entries) as dependencies.
+- BREAKING: public API/types changed — take_event_rx return types and event_tx/event_rx fields now use bounded mpsc::Sender/mpsc::Receiver instead of the unbounded variants; callers must adapt to the new types and bounded behavior.
+
+## 2026-02-18 - 3.3.0 - feat(readme)
+document dynamic port assignment and runtime port updates; clarify TLS multiplexing, frame format, and handshake sequence
+
+- Adds documentation for dynamic port configuration: hub-assigned listen ports, hot-reloadable via FRAME_CONFIG frames
+- Introduces new FRAME type CONFIG (0x06) and describes payload as JSON; notes immediate push of port changes to connected edges
+- Clarifies that the tunnel is a single encrypted TLS multiplexed connection to the hub (preserves PROXY v1 behavior)
+- Specifies frame integer fields are big-endian and that stream IDs are 32-bit unsigned integers
+- Adds new events: portsAssigned and portsUpdated, and updates examples showing updateAllowedEdges usage and live port changes
+
+## 2026-02-18 - 3.2.1 - fix(tests)
+add comprehensive unit and async tests across Rust crates and TypeScript runtime
+
+- Added IPC serialization tests in remoteingress-bin (IPC request/response/event)
+- Added serde and async tests for Edge and Handshake configs and EdgeEvent/EdgeStatus in remoteingress-core (edge.rs)
+- Added extensive Hub tests: constant_time_eq, PROXY header port parsing, serde/camelCase checks, Hub events and async TunnelHub behavior (hub.rs)
+- Added STUN parser unit tests including XOR_MAPPED_ADDRESS, MAPPED_ADDRESS fallback, truncated attribute handling and other edge cases (stun.rs)
+- Added protocol frame encoding and FrameReader tests covering all frame types, payload limits and EOF conditions (remoteingress-protocol)
+- Added TypeScript Node tests for token encode/decode edge cases and RemoteIngressHub/RemoteIngressEdge class basics (test/*.node.ts)
+
+## 2026-02-18 - 3.2.0 - feat(remoteingress (edge/hub/protocol))
+add dynamic port configuration: handshake, FRAME_CONFIG frames, and hot-reloadable listeners
+
+- Introduce a JSON handshake from hub -> edge with initial listen ports and stun interval so edges can configure listeners at connect time.
+- Add FRAME_CONFIG (0x06) to the protocol and implement runtime config updates pushed from hub to connected edges.
+- Edge now applies initial ports and supports hot-reloading: spawn/abort listeners when ports change, and emit PortsAssigned / PortsUpdated events.
+- Hub now stores allowed edge metadata (listen_ports, stun_interval_secs), sends handshake responses on auth, and forwards config updates to connected edges.
+- TypeScript bridge/client updated to emit new port events and periodically log status; updateAllowedEdges API accepts listenPorts and stunIntervalSecs.
+- Stun interval handling moved to use handshake-provided/stored value instead of config.listen_ports being static.
+
+## 2026-02-18 - 3.1.1 - fix(readme)
+update README: add issue reporting/security section, document connection tokens and token utilities, clarify architecture/API and improve examples/formatting
+
+- Added an 'Issue Reporting and Security' section linking to community.foss.global for bug/security reports and contributor onboarding.
+- Documented connection tokens: encodeConnectionToken/decodeConnectionToken utilities, token format (base64url), and examples for hub and edge provisioning.
+- Clarified Hub/Edge usage and examples: condensed event handlers, added token-based start() example, and provided explicit config alternative.
+- Improved README formatting: added emojis, rephrased architecture descriptions, fixed wording and license path capitalization, and expanded example scenarios and interfaces.
+
+## 2026-02-17 - 3.1.0 - feat(edge)
+support connection tokens when starting an edge and add token encode/decode utilities
+
+- Add classes.token.ts with encodeConnectionToken/decodeConnectionToken using a base64url compact JSON format
+- Export token utilities from ts/index.ts
+- RemoteIngressEdge.start now accepts a { token } option and decodes it to an IEdgeConfig before starting
+- Add tests covering export availability, encode→decode roundtrip, malformed token, and missing fields
+- Non-breaking change — recommend a minor version bump
+
+## 2026-02-17 - 3.0.4 - fix(build)
+bump dev dependencies, update build script, and refresh README docs
+
+- Bumped devDependencies: @git.zone/tsbuild ^2.1.25 → ^4.1.2, @git.zone/tsbundle ^2.0.5 → ^2.8.3, @git.zone/tsrun ^1.2.46 → ^2.0.1, @git.zone/tstest ^1.0.44 → ^3.1.8, @push.rocks/tapbundle ^5.0.15 → ^6.0.3, @types/node ^20.8.7 → ^25.2.3
+- Bumped runtime dependency: @push.rocks/qenv ^6.0.5 → ^6.1.3
+- Changed build script: replaced "tsbuild --web --allowimplicitany" with "tsbuild tsfolders --allowimplicitany" (kept tsrust invocation)
+- README updates: added RustBridge notes (localPaths must be full file paths), production binary naming conventions, rust core uses ring as rustls provider; removed emoji from example console output; clarified stunIntervalSecs is optional; renamed example status variable to edgeStatus; minor wire-protocol formatting and wording/legal text tweaks
+
+## 2026-02-17 - 3.0.3 - fix(rust,ts)
+initialize rustls ring CryptoProvider at startup; add rustls dependency and features; make native binary lookup platform-aware
+
+- Install rustls::crypto::ring default_provider at startup to ensure ring-based crypto is available before any TLS usage.
+- Add rustls dependency to remoteingress-bin and update remoteingress-core rustls configuration (disable default-features; enable ring, logging, std, tls12).
+- Adjust TS classes to prefer platform-suffixed production binaries, add exact fallback names, and include explicit cargo output paths for release/debug.
+- Cargo.lock updated to include rustls entry.
+
+## 2026-02-16 - 3.0.2 - fix(readme)
+Document Hub/Edge architecture and new RemoteIngressHub/RemoteIngressEdge API; add Rust core binary, protocol and usage details; note removal of ConnectorPublic/ConnectorPrivate (breaking change)
+
+- Adds comprehensive README describing v3 Hub↔Edge topology and usage examples
+- Introduces Rust core binary (remoteingress-bin) and RustBridge IPC via @push.rocks/smartrust
+- Documents custom multiplexed binary frame protocol over TLS and PROXY protocol v1 for client IP preservation
+- Notes STUN-based public IP discovery and cross-compiled linux/amd64 and linux/arm64 binaries
+- Calls out removal/rename of ConnectorPublic/ConnectorPrivate to RemoteIngressHub/RemoteIngressEdge (breaking API change)
+- Updates install instruction to use pnpm and expands API reference, events, and examples
+
+## 2026-02-16 - 3.0.1 - fix(remoteingress)
+no changes detected in diff; no code modifications to release
+
+- No files changed in the provided diff.
+- No release or version bump required based on current changes.
+
+## 2026-02-16 - 3.0.0 - BREAKING CHANGE(remoteingress)
+migrate core to Rust, add RemoteIngressHub/RemoteIngressEdge JS bridge, and bump package to v2.0.0
+
+- Added Rust workspace and crates: remoteingress-protocol, remoteingress-core, remoteingress-bin (IPC management mode via JSON over stdin/stdout).
+- Implemented protocol framing, PROXY v1 header builder, and async FrameReader in remoteingress-protocol.
+- Implemented hub and edge tunnel logic in Rust including TLS handling, PROXY parsing, and STUN public IP discovery.
+- Added TypeScript runtime bridge classes RemoteIngressHub and RemoteIngressEdge that use @push.rocks/smartrust to spawn/manage the Rust binary.
+- Removed legacy connector public/private TS files and simplified ts/index exports to expose hub/edge classes.
+- Updated package.json: bumped version to 2.0.0, adjusted description, added tsrust build step, new dependency @push.rocks/smartrust and keywords, and included dist_rust in files/glob.
+- Added rust build config for cross-target linkers and new Cargo.toml manifests for the workspace.
+
+## 2024-04-14 - 1.0.2 - 1.0.4 - releases
+Version-only tag commits (no code changes) for recent releases.
+
+- 1.0.2 (2024-03-24) — release tag / version bump only
+- 1.0.3 (2024-04-14) — release tag / version bump only
+- 1.0.4 (2024-04-14) — release tag / version bump only
+
+## 2024-04-14 - 1.0.3 - core
+Core updates and fixes.
+
+- fix(core): update
+
+## 2024-04-14 - 1.0.2 - core
+Core updates and fixes.
+
+- fix(core): update
+
+## 2024-03-24 - 1.0.1 - core
+Core updates and fixes.
+
+- fix(core): update
--- a/npmextra.json
+++ b/npmextra.json
@@ -1,11 +1,17 @@
 {
-  "gitzone": {
+  "@git.zone/tsrust": {
+    "targets": [
+      "linux_amd64",
+      "linux_arm64"
+    ]
+  },
+  "@git.zone/cli": {
    "projectType": "npm",
    "module": {
      "githost": "code.foss.global",
      "gitscope": "serve.zone",
      "gitrepo": "remoteingress",
-      "description": "Provides a service for creating private tunnels and reaching private clusters from the outside as part of the @serve.zone stack.",
+      "description": "Provides a service for creating private tunnels and reaching private clusters from the outside, facilitating secure remote access as part of the @serve.zone stack.",
      "npmPackagename": "@serve.zone/remoteingress",
      "license": "MIT",
      "projectDomain": "serve.zone",
@@ -13,21 +19,32 @@
        "remote access",
        "private tunnels",
        "network security",
-        "TLS",
+        "TLS encryption",
        "connector",
-        "serve.zone",
-        "private clusters",
-        "public access",
-        "TypeScript",
-        "node.js"
+        "serve.zone stack",
+        "private clusters access",
+        "public access management",
+        "TypeScript application",
+        "node.js package",
+        "secure communications",
+        "TLS/SSL certificates",
+        "development tools",
+        "software development",
+        "private network integration"
      ]
+    },
+    "release": {
+      "registries": [
+        "https://verdaccio.lossless.digital",
+        "https://registry.npmjs.org"
+      ],
+      "accessLevel": "public"
    }
  },
-  "npmci": {
-    "npmGlobalTools": [],
-    "npmAccessLevel": "public"
-  },
-  "tsdoc": {
+  "@git.zone/tsdoc": {
    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+  },
+  "@ship.zone/szci": {
+    "npmGlobalTools": []
  }
 }
--- a/package.json
+++ b/package.json
@@ -1,28 +1,30 @@
 {
  "name": "@serve.zone/remoteingress",
-  "version": "1.0.3",
+  "version": "4.4.0",
  "private": false,
-  "description": "Provides a service for creating private tunnels and reaching private clusters from the outside as part of the @serve.zone stack.",
+  "description": "Edge ingress tunnel for DcRouter - accepts incoming TCP connections at network edge and tunnels them to DcRouter SmartProxy preserving client IP via PROXY protocol v1.",
  "main": "dist_ts/index.js",
  "typings": "dist_ts/index.d.ts",
  "type": "module",
  "author": "Task Venture Capital GmbH",
  "license": "MIT",
  "scripts": {
-    "test": "(tstest test/ --web)",
-    "build": "(tsbuild --web --allowimplicitany)",
+    "test": "(tstest test/ --verbose --logfile --timeout 60)",
+    "build": "(tsbuild tsfolders --allowimplicitany && tsrust)",
    "buildDocs": "(tsdoc)"
  },
  "devDependencies": {
-    "@git.zone/tsbuild": "^2.1.25",
-    "@git.zone/tsbundle": "^2.0.5",
-    "@git.zone/tsrun": "^1.2.46",
-    "@git.zone/tstest": "^1.0.44",
-    "@push.rocks/tapbundle": "^5.0.15",
-    "@types/node": "^20.8.7"
+    "@git.zone/tsbuild": "^4.1.2",
+    "@git.zone/tsbundle": "^2.8.3",
+    "@git.zone/tsrun": "^2.0.1",
+    "@git.zone/tsrust": "^1.3.0",
+    "@git.zone/tstest": "^3.1.8",
+    "@push.rocks/tapbundle": "^6.0.3",
+    "@types/node": "^25.3.0"
  },
  "dependencies": {
-    "@push.rocks/qenv": "^6.0.5"
+    "@push.rocks/qenv": "^6.1.3",
+    "@push.rocks/smartrust": "^1.2.1"
  },
  "repository": {
    "type": "git",
@@ -42,6 +44,7 @@
    "dist_*/**/*",
    "dist_ts/**/*",
    "dist_ts_web/**/*",
+    "dist_rust/**/*",
    "assets/**/*",
    "cli.js",
    "npmextra.json",
@@ -49,14 +52,15 @@
  ],
  "keywords": [
    "remote access",
-    "private tunnels",
-    "network security",
-    "TLS",
-    "connector",
-    "serve.zone",
-    "private clusters",
-    "public access",
+    "ingress tunnel",
+    "network edge",
+    "PROXY protocol",
+    "multiplexed tunnel",
+    "TCP proxy",
+    "TLS tunnel",
+    "serve.zone stack",
    "TypeScript",
-    "node.js"
+    "Rust",
+    "SmartProxy"
  ]
 }
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
--- a/readme.hints.md
+++ b/readme.hints.md
@@ -1,3 +1,12 @@
-* this module is part of the @serve.zone stack
-* it is used to reach private clusters from outside
-* it can be used to create private tunnels to private networks
+* This module is part of the @serve.zone stack
+* v3.0.0+ uses a Hub/Edge architecture with a Rust core binary (`remoteingress-bin`)
+* TypeScript classes `RemoteIngressHub` and `RemoteIngressEdge` bridge to Rust via `@push.rocks/smartrust` RustBridge IPC
+* Custom multiplexed binary frame protocol over TLS for tunneling TCP connections
+* PROXY protocol v1 preserves client IP when forwarding to SmartProxy/DcRouter
+* Edge authenticates to Hub via shared secret over TLS
+* STUN-based public IP discovery at the edge (Cloudflare STUN server)
+* Cross-compiled Rust binary for linux/amd64 and linux/arm64
+* Old `ConnectorPublic`/`ConnectorPrivate` classes no longer exist (removed in v2.0.0/v3.0.0)
+* `localPaths` in RustBridge config must be full file paths (not directories) — smartrust's `RustBinaryLocator` checks `isExecutable()` on each entry directly
+* Production binaries are named with platform suffixes: `remoteingress-bin_linux_amd64`, `remoteingress-bin_linux_arm64`
+* Rust core uses `ring` as the rustls CryptoProvider (explicitly installed in main.rs, aws-lc-rs disabled via default-features=false)
--- a/readme.md
+++ b/readme.md
@@ -1,88 +1,363 @@
 # @serve.zone/remoteingress
-a remoteingress service for serve.zone
+
+Edge ingress tunnel for DcRouter — accepts incoming TCP connections at the network edge and tunnels them over a single encrypted TLS connection to a DcRouter SmartProxy instance, preserving the original client IP via PROXY protocol v1.
+
+## Issue Reporting and Security
+
+For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.

 ## Install
-To install `@serve.zone/remoteingress`, use the following command in your terminal:

 ```sh
-npm install @serve.zone/remoteingress
+pnpm install @serve.zone/remoteingress
 ```

-This will download and install the remote ingress service and its dependencies in your project.
+## 🏗️ Architecture

-## Usage
-The `@serve.zone/remoteingress` package is designed to aid in creating secure and private tunnels to private networks, allowing external access to services within a private cluster as part of the @serve.zone stack. To utilize this package, you should have a basic understanding of network protocols and Node.js.
+`@serve.zone/remoteingress` uses a **Hub/Edge** topology with a high-performance Rust core and a TypeScript API surface:

-### Getting Started
-First, ensure you have [Node.js](https://nodejs.org/) installed on your system and that your project is set up to support TypeScript.
+```
+┌─────────────────────┐          TLS Tunnel           ┌─────────────────────┐
+│   Network Edge      │  ◄══════════════════════════►  │   Private Cluster   │
+│                     │   (multiplexed frames +        │                     │
+│  RemoteIngressEdge  │    shared-secret auth)         │  RemoteIngressHub   │
+│  Accepts client TCP │                                │  Forwards to        │
+│  connections on     │                                │  SmartProxy on      │
+│  hub-assigned ports │                                │  local ports        │
+└─────────────────────┘                                └─────────────────────┘
+        ▲                                                       │
+        │  TCP from end users                                   ▼
+   Internet                                             DcRouter / SmartProxy
+```

-You will need to import the main components of the package, which are `ConnectorPublic` and `ConnectorPrivate`, depending on the role your application is playing. Typically, `ConnectorPublic` would run on a public server accessible from the internet, while `ConnectorPrivate` runs inside a private network, creating a secure tunnel to the `ConnectorPublic` instance.
+| Component | Role |
+|-----------|------|
+| **RemoteIngressEdge** | Deployed at the network edge (e.g. a VPS or cloud instance). Listens on ports assigned by the hub, accepts raw TCP connections, and multiplexes them over a single TLS tunnel to the hub. Ports are hot-reloadable — the hub can change them at runtime. |
+| **RemoteIngressHub** | Deployed alongside DcRouter/SmartProxy in a private cluster. Accepts edge connections, demuxes streams, and forwards each to SmartProxy with a PROXY protocol v1 header so the real client IP is preserved. Controls which ports each edge listens on. |
+| **Rust Binary** (`remoteingress-bin`) | The performance-critical networking core. Managed via `@push.rocks/smartrust` RustBridge IPC — you never interact with it directly. Cross-compiled for `linux/amd64` and `linux/arm64`. |

-### Example Setup
+### ✨ Key Features

-#### Using `ConnectorPublic`
-The `ConnectorPublic` part of the module is responsible for listening for incoming tunnel connections and forwarding requests to and from the `ConnectorPrivate` instance.
+- 🔒 **TLS-encrypted tunnel** between edge and hub (auto-generated self-signed cert or bring your own)
+- 🔀 **Multiplexed streams** — thousands of client connections flow over a single tunnel
+- 🌐 **PROXY protocol v1** — SmartProxy sees the real client IP, not the tunnel IP
+- 🔑 **Shared-secret authentication** — edges must present valid credentials to connect
+- 🎫 **Connection tokens** — encode all connection details into a single opaque string
+- 📡 **STUN-based public IP discovery** — the edge automatically discovers its public IP via Cloudflare STUN
+- 🔄 **Auto-reconnect** with exponential backoff if the tunnel drops
+- 🎛️ **Dynamic port configuration** — the hub assigns listen ports per edge and can hot-reload them at runtime via `FRAME_CONFIG` frames
+- 📣 **Event-driven** — both Hub and Edge extend `EventEmitter` for real-time monitoring
+- ⚡ **Rust core** — all frame encoding, TLS, and TCP proxying happen in native code for maximum throughput

-**Example `ConnectorPublic` Usage:**
+## 🚀 Usage
+
+Both classes are imported from the package and communicate with the Rust binary under the hood. All you need to do is configure and start them.
+
+### Setting Up the Hub (Private Cluster Side)

 ```typescript
-import { ConnectorPublic } from '@serve.zone/remoteingress';
+import { RemoteIngressHub } from '@serve.zone/remoteingress';

-// Initialize ConnectorPublic
-const publicConnector = new ConnectorPublic();
+const hub = new RemoteIngressHub();
+
+// Listen for events
+hub.on('edgeConnected', ({ edgeId }) => {
+  console.log(`Edge ${edgeId} connected`);
+});
+hub.on('edgeDisconnected', ({ edgeId }) => {
+  console.log(`Edge ${edgeId} disconnected`);
+});
+hub.on('streamOpened', ({ edgeId, streamId }) => {
+  console.log(`Stream ${streamId} opened from edge ${edgeId}`);
+});
+hub.on('streamClosed', ({ edgeId, streamId }) => {
+  console.log(`Stream ${streamId} closed from edge ${edgeId}`);
+});
+
+// Start the hub — it will listen for incoming edge TLS connections
+await hub.start({
+  tunnelPort: 8443,        // port edges connect to (default: 8443)
+  targetHost: '127.0.0.1', // SmartProxy host to forward streams to (default: 127.0.0.1)
+});
+
+// Register which edges are allowed to connect, including their listen ports
+await hub.updateAllowedEdges([
+  {
+    id: 'edge-nyc-01',
+    secret: 'supersecrettoken1',
+    listenPorts: [80, 443],        // ports the edge should listen on
+    stunIntervalSecs: 300,         // STUN discovery interval (default: 300)
+  },
+  {
+    id: 'edge-fra-02',
+    secret: 'supersecrettoken2',
+    listenPorts: [443, 8080],
+  },
+]);
+
+// Dynamically update ports for a connected edge — changes are pushed instantly
+await hub.updateAllowedEdges([
+  {
+    id: 'edge-nyc-01',
+    secret: 'supersecrettoken1',
+    listenPorts: [80, 443, 8443],  // added port 8443 — edge picks it up in real time
+  },
+]);
+
+// Check status at any time
+const status = await hub.getStatus();
+console.log(status);
+// {
+//   running: true,
+//   tunnelPort: 8443,
+//   connectedEdges: [
+//     { edgeId: 'edge-nyc-01', connectedAt: 1700000000, activeStreams: 12 }
+//   ]
+// }
+
+// Graceful shutdown
+await hub.stop();
 ```

-The above code initializes the `ConnectorPublic`, making it listen for incoming tunnel connections. In practical use, you would need to provide configurations, such as SSL certificates, to secure the tunnel communication.
+### Setting Up the Edge (Network Edge Side)

-#### Using `ConnectorPrivate`
-The `ConnectorPrivate` component establishes a connection to the `ConnectorPublic` and routes traffic between the public interface and the private network.
+The edge can be configured in two ways: with an **opaque connection token** (recommended) or with explicit config fields.

-**Example `ConnectorPrivate` Usage:**
+#### Option A: Connection Token (Recommended)
+
+A single token encodes all connection details — ideal for provisioning edges at scale:

 ```typescript
-import { ConnectorPrivate } from '@serve.zone/remoteingress';
+import { RemoteIngressEdge } from '@serve.zone/remoteingress';

-// Initialize ConnectorPrivate with the host and port of the ConnectorPublic
-const privateConnector = new ConnectorPrivate('public.example.com', 4000);
+const edge = new RemoteIngressEdge();
+
+edge.on('tunnelConnected', () => console.log('Tunnel established'));
+edge.on('tunnelDisconnected', () => console.log('Tunnel lost — will auto-reconnect'));
+edge.on('publicIpDiscovered', ({ ip }) => console.log(`Public IP: ${ip}`));
+edge.on('portsAssigned', ({ listenPorts }) => console.log(`Listening on ports: ${listenPorts}`));
+edge.on('portsUpdated', ({ listenPorts }) => console.log(`Ports updated: ${listenPorts}`));
+
+// Single token contains hubHost, hubPort, edgeId, and secret
+await edge.start({
+  token: 'eyJoIjoiaHViLmV4YW1wbGUuY29tIiwicCI6ODQ0MywiZSI6ImVkZ2UtbnljLTAxIiwicyI6InN1cGVyc2VjcmV0dG9rZW4xIn0',
+});
 ```

-This example assumes your `ConnectorPublic` is accessible at `public.example.com` on port `4000`. The `ConnectorPrivate` will establish a secure tunnel to this public endpoint and begin routing traffic.
+#### Option B: Explicit Config

-### Securely Setting Up The Tunnel
-Security is paramount when creating tunnels that expose private networks. Ensure you use TLS encryption for your tunnels and validate certificates properly. 
+```typescript
+import { RemoteIngressEdge } from '@serve.zone/remoteingress';

-For both `ConnectorPublic` and `ConnectorPrivate`, you'll need to provide paths to your SSL certificate files or use a secure context set up with a recognized Certificate Authority (CA).
+const edge = new RemoteIngressEdge();

-**Security best practices:**
+edge.on('tunnelConnected', () => console.log('Tunnel established'));
+edge.on('tunnelDisconnected', () => console.log('Tunnel lost — will auto-reconnect'));
+edge.on('publicIpDiscovered', ({ ip }) => console.log(`Public IP: ${ip}`));
+edge.on('portsAssigned', ({ listenPorts }) => console.log(`Listening on ports: ${listenPorts}`));
+edge.on('portsUpdated', ({ listenPorts }) => console.log(`Ports updated: ${listenPorts}`));

- Always use TLS to encrypt tunnel traffic.
- Ensure your certificates are valid and up-to-date.
- Consider using client certificates for `ConnectorPrivate` to authenticate to `ConnectorPublic`.
- Monitor and possibly rate-limit connections to avoid abuse.
+await edge.start({
+  hubHost: 'hub.example.com',  // hostname or IP of the hub
+  hubPort: 8443,               // must match hub's tunnelPort (default: 8443)
+  edgeId: 'edge-nyc-01',       // unique edge identifier
+  secret: 'supersecrettoken1', // must match the hub's allowed edge secret
+});

-### Advanced Configuration
-Both `ConnectorPublic` and `ConnectorPrivate` allow for advanced configurations and handling to adjust to specific requirements, such as custom routing, handling different types of traffic (e.g., HTTP, HTTPS), and integrating with existing systems.
+// Check status at any time
+const edgeStatus = await edge.getStatus();
+console.log(edgeStatus);
+// {
+//   running: true,
+//   connected: true,
+//   publicIp: '203.0.113.42',
+//   activeStreams: 5,
+//   listenPorts: [80, 443]
+// }

-### Conclusion
-This module simplifies the process of setting up secure, remote ingress into private networks. By leveraging TLS and careful configuration, you can safely expose services within a private cluster to the outside world. Always prioritize security in your setup to protect your infrastructure and data.
+// Graceful shutdown
+await edge.stop();
+```

-For more detailed configuration options and advanced use cases, refer to the source code and additional documentation provided in the package.
+### 🎫 Connection Tokens
+
+Connection tokens let you distribute a single opaque string instead of four separate config values. The hub operator generates the token; the edge operator just pastes it in.
+
+```typescript
+import { encodeConnectionToken, decodeConnectionToken } from '@serve.zone/remoteingress';
+
+// Hub side: generate a token for a new edge
+const token = encodeConnectionToken({
+  hubHost: 'hub.example.com',
+  hubPort: 8443,
+  edgeId: 'edge-nyc-01',
+  secret: 'supersecrettoken1',
+});
+console.log(token);
+// => 'eyJoIjoiaHViLmV4YW1wbGUuY29tIiwi...'
+
+// Edge side: inspect a token (optional — start() does this automatically)
+const data = decodeConnectionToken(token);
+console.log(data);
+// {
+//   hubHost: 'hub.example.com',
+//   hubPort: 8443,
+//   edgeId: 'edge-nyc-01',
+//   secret: 'supersecrettoken1'
+// }
+```
+
+Tokens are base64url-encoded (URL-safe, no padding) — safe to pass as environment variables, CLI arguments, or store in config files.
+
+## 📖 API Reference
+
+### `RemoteIngressHub`
+
+| Method / Property | Description |
+|-------------------|-------------|
+| `start(config?)` | Spawns the Rust binary and starts the tunnel listener. Config: `{ tunnelPort?: number, targetHost?: string }` |
+| `stop()` | Gracefully shuts down the hub and kills the Rust process. |
+| `updateAllowedEdges(edges)` | Dynamically update which edges are authorized and what ports they listen on. Each edge: `{ id: string, secret: string, listenPorts?: number[], stunIntervalSecs?: number }`. If ports change for a connected edge, the update is pushed immediately via a `FRAME_CONFIG` frame. |
+| `getStatus()` | Returns current hub status including connected edges and active stream counts. |
+| `running` | `boolean` — whether the Rust binary is alive. |
+
+**Events:** `edgeConnected`, `edgeDisconnected`, `streamOpened`, `streamClosed`
+
+### `RemoteIngressEdge`
+
+| Method / Property | Description |
+|-------------------|-------------|
+| `start(config)` | Spawns the Rust binary and connects to the hub. Accepts `{ token: string }` or `IEdgeConfig`. Listen ports are received from the hub during handshake. |
+| `stop()` | Gracefully shuts down the edge and kills the Rust process. |
+| `getStatus()` | Returns current edge status including connection state, public IP, listen ports, and active streams. |
+| `running` | `boolean` — whether the Rust binary is alive. |
+
+**Events:** `tunnelConnected`, `tunnelDisconnected`, `publicIpDiscovered`, `portsAssigned`, `portsUpdated`
+
+### Token Utilities
+
+| Function | Description |
+|----------|-------------|
+| `encodeConnectionToken(data)` | Encodes `IConnectionTokenData` into a base64url token string. |
+| `decodeConnectionToken(token)` | Decodes a token back into `IConnectionTokenData`. Throws on malformed or incomplete tokens. |
+
+### Interfaces
+
+```typescript
+interface IHubConfig {
+  tunnelPort?: number;   // default: 8443
+  targetHost?: string;   // default: '127.0.0.1'
+}
+
+interface IEdgeConfig {
+  hubHost: string;
+  hubPort?: number;      // default: 8443
+  edgeId: string;
+  secret: string;
+}
+
+interface IConnectionTokenData {
+  hubHost: string;
+  hubPort: number;
+  edgeId: string;
+  secret: string;
+}
+```
+
+## 🔌 Wire Protocol
+
+The tunnel uses a custom binary frame protocol over TLS:
+
+```
+[stream_id: 4 bytes BE][type: 1 byte][length: 4 bytes BE][payload: N bytes]
+```
+
+| Frame Type | Value | Direction | Purpose |
+|------------|-------|-----------|---------|
+| `OPEN` | `0x01` | Edge → Hub | Open a new stream; payload is PROXY v1 header |
+| `DATA` | `0x02` | Edge → Hub | Client data flowing upstream |
+| `CLOSE` | `0x03` | Edge → Hub | Client closed the connection |
+| `DATA_BACK` | `0x04` | Hub → Edge | Response data flowing downstream |
+| `CLOSE_BACK` | `0x05` | Hub → Edge | Upstream (SmartProxy) closed the connection |
+| `CONFIG` | `0x06` | Hub → Edge | Runtime configuration update (e.g. port changes); payload is JSON |
+
+Max payload size per frame: **16 MB**. Stream IDs are 32-bit unsigned integers.
+
+### Handshake Sequence
+
+1. Edge opens a TLS connection to the hub
+2. Edge sends: `EDGE <edgeId> <secret>\n`
+3. Hub verifies credentials (constant-time comparison) and responds with JSON: `{"listenPorts":[...],"stunIntervalSecs":300}\n`
+4. Edge starts TCP listeners on the assigned ports
+5. Frame protocol begins — `OPEN`/`DATA`/`CLOSE` frames flow in both directions
+6. Hub can push `CONFIG` frames at any time to update the edge's listen ports
+
+## 💡 Example Scenarios
+
+### 1. Expose a Private Kubernetes Cluster to the Internet
+
+Deploy an Edge on a public VPS, point your DNS to the VPS IP. The Edge tunnels all traffic to the Hub running inside the cluster, which hands it off to SmartProxy/DcRouter. Your cluster stays fully private — no public-facing ports needed.
+
+### 2. Multi-Region Edge Ingress
+
+Run multiple Edges in different geographic regions (NYC, Frankfurt, Tokyo) all connecting to a single Hub. Use GeoDNS to route users to their nearest Edge. The Hub sees the real client IPs via PROXY protocol regardless of which edge they connected through.
+
+### 3. Secure API Exposure
+
+Your backend runs on a private network with no direct internet access. An Edge on a minimal cloud instance acts as the only public entry point. TLS tunnel + shared-secret auth ensure only your authorized Edge can forward traffic.
+
+### 4. Token-Based Edge Provisioning
+
+Generate connection tokens on the hub side and distribute them to edge operators. Each edge only needs a single token string to connect — no manual configuration of host, port, ID, and secret.
+
+```typescript
+// Hub operator generates token
+const token = encodeConnectionToken({
+  hubHost: 'hub.prod.example.com',
+  hubPort: 8443,
+  edgeId: 'edge-tokyo-01',
+  secret: 'generated-secret-abc123',
+});
+// Send `token` to the edge operator via secure channel
+
+// Edge operator starts with just the token
+const edge = new RemoteIngressEdge();
+await edge.start({ token });
+```
+
+### 5. Dynamic Port Management
+
+The hub controls which ports each edge listens on. Ports can be changed at runtime without restarting the edge — the hub pushes a `CONFIG` frame and the edge hot-reloads its TCP listeners.
+
+```typescript
+// Initially assign ports 80 and 443
+await hub.updateAllowedEdges([
+  { id: 'edge-nyc-01', secret: 'secret', listenPorts: [80, 443] },
+]);
+
+// Later, add port 8080 — the connected edge picks it up instantly
+await hub.updateAllowedEdges([
+  { id: 'edge-nyc-01', secret: 'secret', listenPorts: [80, 443, 8080] },
+]);
+```

 ## License and Legal Information

-This repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. 
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.

 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

 ### Trademarks

-This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.
+This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.
+
+Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

 ### Company Information

-Task Venture Capital GmbH  
-Registered at District court Bremen HRB 35230 HB, Germany
+Task Venture Capital GmbH
+Registered at District Court Bremen HRB 35230 HB, Germany

-For any legal inquiries or if you require further information, please contact us via email at hello@task.vc.
+For any legal inquiries or further information, please contact us via email at hello@task.vc.

 By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.
--- a/rust/.cargo/config.toml
+++ b/rust/.cargo/config.toml
@@ -0,0 +1,5 @@
+[target.x86_64-unknown-linux-gnu]
+linker = "x86_64-linux-gnu-gcc"
+
+[target.aarch64-unknown-linux-gnu]
+linker = "aarch64-linux-gnu-gcc"
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -0,0 +1,7 @@
+[workspace]
+resolver = "2"
+members = [
+  "crates/remoteingress-protocol",
+  "crates/remoteingress-core",
+  "crates/remoteingress-bin",
+]
--- a/rust/crates/remoteingress-bin/Cargo.toml
+++ b/rust/crates/remoteingress-bin/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "remoteingress-bin"
+version = "2.0.0"
+edition = "2021"
+
+[[bin]]
+name = "remoteingress-bin"
+path = "src/main.rs"
+
+[dependencies]
+remoteingress-core = { path = "../remoteingress-core" }
+remoteingress-protocol = { path = "../remoteingress-protocol" }
+tokio = { version = "1", features = ["full"] }
+clap = { version = "4", features = ["derive"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+log = "0.4"
+env_logger = "0.11"
+rustls = { version = "0.23", default-features = false, features = ["ring"] }
+mimalloc = "0.1"
--- a/rust/crates/remoteingress-bin/src/main.rs
+++ b/rust/crates/remoteingress-bin/src/main.rs
@@ -0,0 +1,429 @@
+#[global_allocator]
+static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;
+
+use clap::Parser;
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+use tokio::io::{AsyncBufReadExt, BufReader};
+use tokio::sync::Mutex;
+
+use remoteingress_core::hub::{AllowedEdge, HubConfig, HubEvent, TunnelHub};
+use remoteingress_core::edge::{EdgeConfig, EdgeEvent, TunnelEdge};
+
+#[derive(Parser)]
+#[command(name = "remoteingress-bin", version = "2.0.0")]
+struct Cli {
+    /// Run in IPC management mode (JSON over stdin/stdout)
+    #[arg(long)]
+    management: bool,
+}
+
+// IPC message types
+#[derive(Deserialize)]
+struct IpcRequest {
+    id: String,
+    method: String,
+    params: serde_json::Value,
+}
+
+#[derive(Serialize)]
+struct IpcResponse {
+    id: String,
+    success: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    result: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    error: Option<String>,
+}
+
+#[derive(Serialize)]
+struct IpcEvent {
+    event: String,
+    data: serde_json::Value,
+}
+
+fn send_ipc_line(line: &str) {
+    // Write to stdout synchronously, since we're line-buffered
+    use std::io::Write;
+    let stdout = std::io::stdout();
+    let mut out = stdout.lock();
+    let _ = out.write_all(line.as_bytes());
+    let _ = out.write_all(b"\n");
+    let _ = out.flush();
+}
+
+fn send_event(event: &str, data: serde_json::Value) {
+    let evt = IpcEvent {
+        event: event.to_string(),
+        data,
+    };
+    if let Ok(json) = serde_json::to_string(&evt) {
+        send_ipc_line(&json);
+    }
+}
+
+fn send_response(id: &str, result: serde_json::Value) {
+    let resp = IpcResponse {
+        id: id.to_string(),
+        success: true,
+        result: Some(result),
+        error: None,
+    };
+    if let Ok(json) = serde_json::to_string(&resp) {
+        send_ipc_line(&json);
+    }
+}
+
+fn send_error(id: &str, error: &str) {
+    let resp = IpcResponse {
+        id: id.to_string(),
+        success: false,
+        result: None,
+        error: Some(error.to_string()),
+    };
+    if let Ok(json) = serde_json::to_string(&resp) {
+        send_ipc_line(&json);
+    }
+}
+
+#[tokio::main]
+async fn main() {
+    // Install the ring CryptoProvider before any TLS usage
+    rustls::crypto::ring::default_provider()
+        .install_default()
+        .expect("Failed to install rustls ring CryptoProvider");
+
+    let cli = Cli::parse();
+
+    if !cli.management {
+        eprintln!("remoteingress-bin: use --management for IPC mode");
+        std::process::exit(1);
+    }
+
+    // Initialize logging to stderr (stdout is for IPC)
+    env_logger::Builder::from_default_env()
+        .target(env_logger::Target::Stderr)
+        .filter_level(log::LevelFilter::Info)
+        .init();
+
+    // Send ready event
+    send_event("ready", serde_json::json!({ "version": "2.0.0" }));
+
+    // State
+    let hub: Arc<Mutex<Option<Arc<TunnelHub>>>> = Arc::new(Mutex::new(None));
+    let edge: Arc<Mutex<Option<Arc<TunnelEdge>>>> = Arc::new(Mutex::new(None));
+
+    // Read commands from stdin
+    let stdin = tokio::io::stdin();
+    let reader = BufReader::new(stdin);
+    let mut lines = reader.lines();
+
+    while let Ok(Some(line)) = lines.next_line().await {
+        let line = line.trim().to_string();
+        if line.is_empty() {
+            continue;
+        }
+
+        let request: IpcRequest = match serde_json::from_str(&line) {
+            Ok(r) => r,
+            Err(e) => {
+                log::error!("Invalid IPC request: {}", e);
+                continue;
+            }
+        };
+
+        let hub = hub.clone();
+        let edge = edge.clone();
+
+        tokio::spawn(async move {
+            handle_request(request, hub, edge).await;
+        });
+    }
+}
+
+async fn handle_request(
+    req: IpcRequest,
+    hub: Arc<Mutex<Option<Arc<TunnelHub>>>>,
+    edge: Arc<Mutex<Option<Arc<TunnelEdge>>>>,
+) {
+    match req.method.as_str() {
+        "ping" => {
+            send_response(&req.id, serde_json::json!({ "pong": true }));
+        }
+
+        "startHub" => {
+            let config: HubConfig = match serde_json::from_value(req.params.clone()) {
+                Ok(c) => c,
+                Err(e) => {
+                    send_error(&req.id, &format!("invalid hub config: {}", e));
+                    return;
+                }
+            };
+
+            let tunnel_hub = Arc::new(TunnelHub::new(config));
+
+            // Forward hub events to IPC
+            if let Some(mut event_rx) = tunnel_hub.take_event_rx().await {
+                tokio::spawn(async move {
+                    while let Some(event) = event_rx.recv().await {
+                        match &event {
+                            HubEvent::EdgeConnected { edge_id, peer_addr } => {
+                                send_event(
+                                    "edgeConnected",
+                                    serde_json::json!({ "edgeId": edge_id, "peerAddr": peer_addr }),
+                                );
+                            }
+                            HubEvent::EdgeDisconnected { edge_id } => {
+                                send_event(
+                                    "edgeDisconnected",
+                                    serde_json::json!({ "edgeId": edge_id }),
+                                );
+                            }
+                            HubEvent::StreamOpened {
+                                edge_id,
+                                stream_id,
+                            } => {
+                                send_event(
+                                    "streamOpened",
+                                    serde_json::json!({
+                                        "edgeId": edge_id,
+                                        "streamId": stream_id,
+                                    }),
+                                );
+                            }
+                            HubEvent::StreamClosed {
+                                edge_id,
+                                stream_id,
+                            } => {
+                                send_event(
+                                    "streamClosed",
+                                    serde_json::json!({
+                                        "edgeId": edge_id,
+                                        "streamId": stream_id,
+                                    }),
+                                );
+                            }
+                        }
+                    }
+                });
+            }
+
+            match tunnel_hub.start().await {
+                Ok(()) => {
+                    *hub.lock().await = Some(tunnel_hub);
+                    send_response(&req.id, serde_json::json!({ "started": true }));
+                }
+                Err(e) => {
+                    send_error(&req.id, &format!("failed to start hub: {}", e));
+                }
+            }
+        }
+
+        "stopHub" => {
+            let mut h = hub.lock().await;
+            if let Some(hub_instance) = h.take() {
+                hub_instance.stop().await;
+                send_response(&req.id, serde_json::json!({ "stopped": true }));
+            } else {
+                send_response(
+                    &req.id,
+                    serde_json::json!({ "stopped": true, "wasRunning": false }),
+                );
+            }
+        }
+
+        "updateAllowedEdges" => {
+            #[derive(Deserialize)]
+            #[serde(rename_all = "camelCase")]
+            struct UpdateEdgesParams {
+                edges: Vec<AllowedEdge>,
+            }
+
+            let params: UpdateEdgesParams = match serde_json::from_value(req.params.clone()) {
+                Ok(p) => p,
+                Err(e) => {
+                    send_error(&req.id, &format!("invalid params: {}", e));
+                    return;
+                }
+            };
+
+            let h = hub.lock().await;
+            if let Some(hub_instance) = h.as_ref() {
+                hub_instance.update_allowed_edges(params.edges).await;
+                send_response(&req.id, serde_json::json!({ "updated": true }));
+            } else {
+                send_error(&req.id, "hub not running");
+            }
+        }
+
+        "getHubStatus" => {
+            let h = hub.lock().await;
+            if let Some(hub_instance) = h.as_ref() {
+                let status = hub_instance.get_status().await;
+                send_response(
+                    &req.id,
+                    serde_json::to_value(&status).unwrap_or_default(),
+                );
+            } else {
+                send_response(
+                    &req.id,
+                    serde_json::json!({
+                        "running": false,
+                        "tunnelPort": 0,
+                        "connectedEdges": []
+                    }),
+                );
+            }
+        }
+
+        "startEdge" => {
+            let config: EdgeConfig = match serde_json::from_value(req.params.clone()) {
+                Ok(c) => c,
+                Err(e) => {
+                    send_error(&req.id, &format!("invalid edge config: {}", e));
+                    return;
+                }
+            };
+
+            let tunnel_edge = Arc::new(TunnelEdge::new(config));
+
+            // Forward edge events to IPC
+            if let Some(mut event_rx) = tunnel_edge.take_event_rx().await {
+                tokio::spawn(async move {
+                    while let Some(event) = event_rx.recv().await {
+                        match &event {
+                            EdgeEvent::TunnelConnected => {
+                                send_event("tunnelConnected", serde_json::json!({}));
+                            }
+                            EdgeEvent::TunnelDisconnected => {
+                                send_event("tunnelDisconnected", serde_json::json!({}));
+                            }
+                            EdgeEvent::PublicIpDiscovered { ip } => {
+                                send_event(
+                                    "publicIpDiscovered",
+                                    serde_json::json!({ "ip": ip }),
+                                );
+                            }
+                            EdgeEvent::PortsAssigned { listen_ports } => {
+                                send_event(
+                                    "portsAssigned",
+                                    serde_json::json!({ "listenPorts": listen_ports }),
+                                );
+                            }
+                            EdgeEvent::PortsUpdated { listen_ports } => {
+                                send_event(
+                                    "portsUpdated",
+                                    serde_json::json!({ "listenPorts": listen_ports }),
+                                );
+                            }
+                        }
+                    }
+                });
+            }
+
+            match tunnel_edge.start().await {
+                Ok(()) => {
+                    *edge.lock().await = Some(tunnel_edge);
+                    send_response(&req.id, serde_json::json!({ "started": true }));
+                }
+                Err(e) => {
+                    send_error(&req.id, &format!("failed to start edge: {}", e));
+                }
+            }
+        }
+
+        "stopEdge" => {
+            let mut e = edge.lock().await;
+            if let Some(edge_instance) = e.take() {
+                edge_instance.stop().await;
+                send_response(&req.id, serde_json::json!({ "stopped": true }));
+            } else {
+                send_response(
+                    &req.id,
+                    serde_json::json!({ "stopped": true, "wasRunning": false }),
+                );
+            }
+        }
+
+        "getEdgeStatus" => {
+            let e = edge.lock().await;
+            if let Some(edge_instance) = e.as_ref() {
+                let status = edge_instance.get_status().await;
+                send_response(
+                    &req.id,
+                    serde_json::to_value(&status).unwrap_or_default(),
+                );
+            } else {
+                send_response(
+                    &req.id,
+                    serde_json::json!({
+                        "running": false,
+                        "connected": false,
+                        "publicIp": null,
+                        "activeStreams": 0,
+                        "listenPorts": []
+                    }),
+                );
+            }
+        }
+
+        _ => {
+            send_error(&req.id, &format!("unknown method: {}", req.method));
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_ipc_request_deserialize() {
+        let json = r#"{"id": "1", "method": "ping", "params": {}}"#;
+        let req: IpcRequest = serde_json::from_str(json).unwrap();
+        assert_eq!(req.id, "1");
+        assert_eq!(req.method, "ping");
+        assert!(req.params.is_object());
+    }
+
+    #[test]
+    fn test_ipc_response_skip_error_when_none() {
+        let resp = IpcResponse {
+            id: "1".to_string(),
+            success: true,
+            result: Some(serde_json::json!({"pong": true})),
+            error: None,
+        };
+        let json = serde_json::to_value(&resp).unwrap();
+        assert_eq!(json["id"], "1");
+        assert_eq!(json["success"], true);
+        assert_eq!(json["result"]["pong"], true);
+        assert!(json.get("error").is_none());
+    }
+
+    #[test]
+    fn test_ipc_response_skip_result_when_none() {
+        let resp = IpcResponse {
+            id: "2".to_string(),
+            success: false,
+            result: None,
+            error: Some("something failed".to_string()),
+        };
+        let json = serde_json::to_value(&resp).unwrap();
+        assert_eq!(json["id"], "2");
+        assert_eq!(json["success"], false);
+        assert_eq!(json["error"], "something failed");
+        assert!(json.get("result").is_none());
+    }
+
+    #[test]
+    fn test_ipc_event_serialize() {
+        let evt = IpcEvent {
+            event: "ready".to_string(),
+            data: serde_json::json!({"version": "2.0.0"}),
+        };
+        let json = serde_json::to_value(&evt).unwrap();
+        assert_eq!(json["event"], "ready");
+        assert_eq!(json["data"]["version"], "2.0.0");
+    }
+}
--- a/rust/crates/remoteingress-core/Cargo.toml
+++ b/rust/crates/remoteingress-core/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "remoteingress-core"
+version = "2.0.0"
+edition = "2021"
+
+[dependencies]
+remoteingress-protocol = { path = "../remoteingress-protocol" }
+tokio = { version = "1", features = ["full"] }
+tokio-rustls = "0.26"
+rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
+rcgen = "0.13"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+log = "0.4"
+rustls-pemfile = "2"
+tokio-util = "0.7"
--- a/rust/crates/remoteingress-core/src/edge.rs
+++ b/rust/crates/remoteingress-core/src/edge.rs
@@ -0,0 +1,895 @@
+use std::collections::HashMap;
+use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
+use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
+use tokio::net::{TcpListener, TcpStream};
+use tokio::sync::{mpsc, Mutex, RwLock};
+use tokio::task::JoinHandle;
+use tokio::time::{Instant, sleep_until};
+use tokio_rustls::TlsConnector;
+use tokio_util::sync::CancellationToken;
+use serde::{Deserialize, Serialize};
+
+use remoteingress_protocol::*;
+
+/// Edge configuration (hub-host + credentials only; ports come from hub).
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EdgeConfig {
+    pub hub_host: String,
+    pub hub_port: u16,
+    pub edge_id: String,
+    pub secret: String,
+}
+
+/// Handshake config received from hub after authentication.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct HandshakeConfig {
+    listen_ports: Vec<u16>,
+    #[serde(default = "default_stun_interval")]
+    stun_interval_secs: u64,
+}
+
+fn default_stun_interval() -> u64 {
+    300
+}
+
+/// Runtime config update received from hub via FRAME_CONFIG.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ConfigUpdate {
+    listen_ports: Vec<u16>,
+}
+
+/// Events emitted by the edge.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[serde(tag = "type")]
+pub enum EdgeEvent {
+    TunnelConnected,
+    TunnelDisconnected,
+    #[serde(rename_all = "camelCase")]
+    PublicIpDiscovered { ip: String },
+    #[serde(rename_all = "camelCase")]
+    PortsAssigned { listen_ports: Vec<u16> },
+    #[serde(rename_all = "camelCase")]
+    PortsUpdated { listen_ports: Vec<u16> },
+}
+
+/// Edge status response.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EdgeStatus {
+    pub running: bool,
+    pub connected: bool,
+    pub public_ip: Option<String>,
+    pub active_streams: usize,
+    pub listen_ports: Vec<u16>,
+}
+
+/// The tunnel edge that listens for client connections and multiplexes them to the hub.
+pub struct TunnelEdge {
+    config: RwLock<EdgeConfig>,
+    event_tx: mpsc::Sender<EdgeEvent>,
+    event_rx: Mutex<Option<mpsc::Receiver<EdgeEvent>>>,
+    shutdown_tx: Mutex<Option<mpsc::Sender<()>>>,
+    running: RwLock<bool>,
+    connected: Arc<RwLock<bool>>,
+    public_ip: Arc<RwLock<Option<String>>>,
+    active_streams: Arc<AtomicU32>,
+    next_stream_id: Arc<AtomicU32>,
+    listen_ports: Arc<RwLock<Vec<u16>>>,
+    cancel_token: CancellationToken,
+}
+
+impl TunnelEdge {
+    pub fn new(config: EdgeConfig) -> Self {
+        let (event_tx, event_rx) = mpsc::channel(1024);
+        Self {
+            config: RwLock::new(config),
+            event_tx,
+            event_rx: Mutex::new(Some(event_rx)),
+            shutdown_tx: Mutex::new(None),
+            running: RwLock::new(false),
+            connected: Arc::new(RwLock::new(false)),
+            public_ip: Arc::new(RwLock::new(None)),
+            active_streams: Arc::new(AtomicU32::new(0)),
+            next_stream_id: Arc::new(AtomicU32::new(1)),
+            listen_ports: Arc::new(RwLock::new(Vec::new())),
+            cancel_token: CancellationToken::new(),
+        }
+    }
+
+    /// Take the event receiver (can only be called once).
+    pub async fn take_event_rx(&self) -> Option<mpsc::Receiver<EdgeEvent>> {
+        self.event_rx.lock().await.take()
+    }
+
+    /// Get the current edge status.
+    pub async fn get_status(&self) -> EdgeStatus {
+        EdgeStatus {
+            running: *self.running.read().await,
+            connected: *self.connected.read().await,
+            public_ip: self.public_ip.read().await.clone(),
+            active_streams: self.active_streams.load(Ordering::Relaxed) as usize,
+            listen_ports: self.listen_ports.read().await.clone(),
+        }
+    }
+
+    /// Start the edge: connect to hub, start listeners.
+    pub async fn start(&self) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        let config = self.config.read().await.clone();
+        let (shutdown_tx, shutdown_rx) = mpsc::channel::<()>(1);
+        *self.shutdown_tx.lock().await = Some(shutdown_tx);
+        *self.running.write().await = true;
+
+        let connected = self.connected.clone();
+        let public_ip = self.public_ip.clone();
+        let active_streams = self.active_streams.clone();
+        let next_stream_id = self.next_stream_id.clone();
+        let event_tx = self.event_tx.clone();
+        let listen_ports = self.listen_ports.clone();
+        let cancel_token = self.cancel_token.clone();
+
+        tokio::spawn(async move {
+            edge_main_loop(
+                config,
+                connected,
+                public_ip,
+                active_streams,
+                next_stream_id,
+                event_tx,
+                listen_ports,
+                shutdown_rx,
+                cancel_token,
+            )
+            .await;
+        });
+
+        Ok(())
+    }
+
+    /// Stop the edge.
+    pub async fn stop(&self) {
+        self.cancel_token.cancel();
+        if let Some(tx) = self.shutdown_tx.lock().await.take() {
+            let _ = tx.send(()).await;
+        }
+        *self.running.write().await = false;
+        *self.connected.write().await = false;
+        self.listen_ports.write().await.clear();
+    }
+}
+
+impl Drop for TunnelEdge {
+    fn drop(&mut self) {
+        self.cancel_token.cancel();
+    }
+}
+
+async fn edge_main_loop(
+    config: EdgeConfig,
+    connected: Arc<RwLock<bool>>,
+    public_ip: Arc<RwLock<Option<String>>>,
+    active_streams: Arc<AtomicU32>,
+    next_stream_id: Arc<AtomicU32>,
+    event_tx: mpsc::Sender<EdgeEvent>,
+    listen_ports: Arc<RwLock<Vec<u16>>>,
+    mut shutdown_rx: mpsc::Receiver<()>,
+    cancel_token: CancellationToken,
+) {
+    let mut backoff_ms: u64 = 1000;
+    let max_backoff_ms: u64 = 30000;
+
+    loop {
+        // Create a per-connection child token
+        let connection_token = cancel_token.child_token();
+
+        // Try to connect to hub
+        let result = connect_to_hub_and_run(
+            &config,
+            &connected,
+            &public_ip,
+            &active_streams,
+            &next_stream_id,
+            &event_tx,
+            &listen_ports,
+            &mut shutdown_rx,
+            &connection_token,
+        )
+        .await;
+
+        // Cancel connection token to kill all orphaned tasks from this cycle
+        connection_token.cancel();
+
+        // Reset backoff after a successful connection for fast reconnect
+        let was_connected = *connected.read().await;
+        if was_connected {
+            backoff_ms = 1000;
+            log::info!("Was connected; resetting backoff to {}ms for fast reconnect", backoff_ms);
+        }
+
+        *connected.write().await = false;
+        let _ = event_tx.try_send(EdgeEvent::TunnelDisconnected);
+        active_streams.store(0, Ordering::Relaxed);
+        // Reset stream ID counter for next connection cycle
+        next_stream_id.store(1, Ordering::Relaxed);
+        listen_ports.write().await.clear();
+
+        match result {
+            EdgeLoopResult::Shutdown => break,
+            EdgeLoopResult::Reconnect => {
+                log::info!("Reconnecting in {}ms...", backoff_ms);
+                tokio::select! {
+                    _ = tokio::time::sleep(Duration::from_millis(backoff_ms)) => {}
+                    _ = cancel_token.cancelled() => break,
+                    _ = shutdown_rx.recv() => break,
+                }
+                backoff_ms = (backoff_ms * 2).min(max_backoff_ms);
+            }
+        }
+    }
+}
+
+enum EdgeLoopResult {
+    Shutdown,
+    Reconnect,
+}
+
+async fn connect_to_hub_and_run(
+    config: &EdgeConfig,
+    connected: &Arc<RwLock<bool>>,
+    public_ip: &Arc<RwLock<Option<String>>>,
+    active_streams: &Arc<AtomicU32>,
+    next_stream_id: &Arc<AtomicU32>,
+    event_tx: &mpsc::Sender<EdgeEvent>,
+    listen_ports: &Arc<RwLock<Vec<u16>>>,
+    shutdown_rx: &mut mpsc::Receiver<()>,
+    connection_token: &CancellationToken,
+) -> EdgeLoopResult {
+    // Build TLS connector that skips cert verification (auth is via secret)
+    let tls_config = rustls::ClientConfig::builder()
+        .dangerous()
+        .with_custom_certificate_verifier(Arc::new(NoCertVerifier))
+        .with_no_client_auth();
+
+    let connector = TlsConnector::from(Arc::new(tls_config));
+
+    let addr = format!("{}:{}", config.hub_host, config.hub_port);
+    let tcp = match TcpStream::connect(&addr).await {
+        Ok(s) => s,
+        Err(e) => {
+            log::error!("Failed to connect to hub at {}: {}", addr, e);
+            return EdgeLoopResult::Reconnect;
+        }
+    };
+
+    let server_name = rustls::pki_types::ServerName::try_from(config.hub_host.clone())
+        .unwrap_or_else(|_| rustls::pki_types::ServerName::try_from("remoteingress-hub".to_string()).unwrap());
+
+    let tls_stream = match connector.connect(server_name, tcp).await {
+        Ok(s) => s,
+        Err(e) => {
+            log::error!("TLS handshake failed: {}", e);
+            return EdgeLoopResult::Reconnect;
+        }
+    };
+
+    let (read_half, mut write_half) = tokio::io::split(tls_stream);
+
+    // Send auth line
+    let auth_line = format!("EDGE {} {}\n", config.edge_id, config.secret);
+    if write_half.write_all(auth_line.as_bytes()).await.is_err() {
+        return EdgeLoopResult::Reconnect;
+    }
+
+    // Read handshake response line from hub (JSON with initial config)
+    let mut buf_reader = BufReader::new(read_half);
+    let mut handshake_line = String::new();
+    match buf_reader.read_line(&mut handshake_line).await {
+        Ok(0) => {
+            log::error!("Hub rejected connection (EOF before handshake)");
+            return EdgeLoopResult::Reconnect;
+        }
+        Ok(_) => {}
+        Err(e) => {
+            log::error!("Failed to read handshake response: {}", e);
+            return EdgeLoopResult::Reconnect;
+        }
+    }
+
+    let handshake: HandshakeConfig = match serde_json::from_str(handshake_line.trim()) {
+        Ok(h) => h,
+        Err(e) => {
+            log::error!("Invalid handshake response: {}", e);
+            return EdgeLoopResult::Reconnect;
+        }
+    };
+
+    log::info!(
+        "Handshake from hub: ports {:?}, stun_interval {}s",
+        handshake.listen_ports,
+        handshake.stun_interval_secs
+    );
+
+    *connected.write().await = true;
+    let _ = event_tx.try_send(EdgeEvent::TunnelConnected);
+    log::info!("Connected to hub at {}", addr);
+
+    // Store initial ports and emit event
+    *listen_ports.write().await = handshake.listen_ports.clone();
+    let _ = event_tx.try_send(EdgeEvent::PortsAssigned {
+        listen_ports: handshake.listen_ports.clone(),
+    });
+
+    // Start STUN discovery
+    let stun_interval = handshake.stun_interval_secs;
+    let public_ip_clone = public_ip.clone();
+    let event_tx_clone = event_tx.clone();
+    let stun_token = connection_token.clone();
+    let stun_handle = tokio::spawn(async move {
+        loop {
+            tokio::select! {
+                ip_result = crate::stun::discover_public_ip() => {
+                    if let Some(ip) = ip_result {
+                        let mut pip = public_ip_clone.write().await;
+                        let changed = pip.as_ref() != Some(&ip);
+                        *pip = Some(ip.clone());
+                        if changed {
+                            let _ = event_tx_clone.try_send(EdgeEvent::PublicIpDiscovered { ip });
+                        }
+                    }
+                }
+                _ = stun_token.cancelled() => break,
+            }
+            tokio::select! {
+                _ = tokio::time::sleep(Duration::from_secs(stun_interval)) => {}
+                _ = stun_token.cancelled() => break,
+            }
+        }
+    });
+
+    // Client socket map: stream_id -> sender for writing data back to client
+    let client_writers: Arc<Mutex<HashMap<u32, mpsc::Sender<Vec<u8>>>>> =
+        Arc::new(Mutex::new(HashMap::new()));
+
+    // A5: Channel-based tunnel writer replaces Arc<Mutex<WriteHalf>>
+    let (tunnel_writer_tx, mut tunnel_writer_rx) = mpsc::channel::<Vec<u8>>(4096);
+    let tw_token = connection_token.clone();
+    let tunnel_writer_handle = tokio::spawn(async move {
+        loop {
+            tokio::select! {
+                data = tunnel_writer_rx.recv() => {
+                    match data {
+                        Some(frame_data) => {
+                            if write_half.write_all(&frame_data).await.is_err() {
+                                break;
+                            }
+                        }
+                        None => break,
+                    }
+                }
+                _ = tw_token.cancelled() => break,
+            }
+        }
+    });
+
+    // Start TCP listeners for initial ports (hot-reloadable)
+    let mut port_listeners: HashMap<u16, JoinHandle<()>> = HashMap::new();
+    apply_port_config(
+        &handshake.listen_ports,
+        &mut port_listeners,
+        &tunnel_writer_tx,
+        &client_writers,
+        active_streams,
+        next_stream_id,
+        &config.edge_id,
+        connection_token,
+    );
+
+    // Heartbeat: liveness timeout detects silent hub failures
+    let liveness_timeout_dur = Duration::from_secs(45);
+    let mut last_activity = Instant::now();
+    let mut liveness_deadline = Box::pin(sleep_until(last_activity + liveness_timeout_dur));
+
+    // Read frames from hub
+    let mut frame_reader = FrameReader::new(buf_reader);
+    let result = loop {
+        tokio::select! {
+            frame_result = frame_reader.next_frame() => {
+                match frame_result {
+                    Ok(Some(frame)) => {
+                        // Reset liveness on any received frame
+                        last_activity = Instant::now();
+                        liveness_deadline.as_mut().reset(last_activity + liveness_timeout_dur);
+
+                        match frame.frame_type {
+                            FRAME_DATA_BACK => {
+                                // A1: Non-blocking send to prevent head-of-line blocking
+                                let writers = client_writers.lock().await;
+                                if let Some(tx) = writers.get(&frame.stream_id) {
+                                    if tx.try_send(frame.payload).is_err() {
+                                        log::warn!("Stream {} back-channel full, dropping frame", frame.stream_id);
+                                    }
+                                }
+                            }
+                            FRAME_CLOSE_BACK => {
+                                let mut writers = client_writers.lock().await;
+                                writers.remove(&frame.stream_id);
+                            }
+                            FRAME_CONFIG => {
+                                if let Ok(update) = serde_json::from_slice::<ConfigUpdate>(&frame.payload) {
+                                    log::info!("Config update from hub: ports {:?}", update.listen_ports);
+                                    *listen_ports.write().await = update.listen_ports.clone();
+                                    let _ = event_tx.try_send(EdgeEvent::PortsUpdated {
+                                        listen_ports: update.listen_ports.clone(),
+                                    });
+                                    apply_port_config(
+                                        &update.listen_ports,
+                                        &mut port_listeners,
+                                        &tunnel_writer_tx,
+                                        &client_writers,
+                                        active_streams,
+                                        next_stream_id,
+                                        &config.edge_id,
+                                        connection_token,
+                                    );
+                                }
+                            }
+                            FRAME_PING => {
+                                let pong_frame = encode_frame(0, FRAME_PONG, &[]);
+                                if tunnel_writer_tx.try_send(pong_frame).is_err() {
+                                    log::warn!("Failed to send PONG, writer channel full/closed");
+                                    break EdgeLoopResult::Reconnect;
+                                }
+                                log::trace!("Received PING from hub, sent PONG");
+                            }
+                            _ => {
+                                log::warn!("Unexpected frame type {} from hub", frame.frame_type);
+                            }
+                        }
+                    }
+                    Ok(None) => {
+                        log::info!("Hub disconnected (EOF)");
+                        break EdgeLoopResult::Reconnect;
+                    }
+                    Err(e) => {
+                        log::error!("Hub frame error: {}", e);
+                        break EdgeLoopResult::Reconnect;
+                    }
+                }
+            }
+            _ = &mut liveness_deadline => {
+                log::warn!("Hub liveness timeout (no frames for {}s), reconnecting",
+                    liveness_timeout_dur.as_secs());
+                break EdgeLoopResult::Reconnect;
+            }
+            _ = connection_token.cancelled() => {
+                log::info!("Connection cancelled");
+                break EdgeLoopResult::Shutdown;
+            }
+            _ = shutdown_rx.recv() => {
+                break EdgeLoopResult::Shutdown;
+            }
+        }
+    };
+
+    // Cancel connection token to propagate to all child tasks BEFORE aborting
+    connection_token.cancel();
+    stun_handle.abort();
+    tunnel_writer_handle.abort();
+    for (_, h) in port_listeners.drain() {
+        h.abort();
+    }
+
+    result
+}
+
+/// Apply a new port configuration: spawn listeners for added ports, abort removed ports.
+fn apply_port_config(
+    new_ports: &[u16],
+    port_listeners: &mut HashMap<u16, JoinHandle<()>>,
+    tunnel_writer_tx: &mpsc::Sender<Vec<u8>>,
+    client_writers: &Arc<Mutex<HashMap<u32, mpsc::Sender<Vec<u8>>>>>,
+    active_streams: &Arc<AtomicU32>,
+    next_stream_id: &Arc<AtomicU32>,
+    edge_id: &str,
+    connection_token: &CancellationToken,
+) {
+    let new_set: std::collections::HashSet<u16> = new_ports.iter().copied().collect();
+    let old_set: std::collections::HashSet<u16> = port_listeners.keys().copied().collect();
+
+    // Remove ports no longer needed
+    for &port in old_set.difference(&new_set) {
+        if let Some(handle) = port_listeners.remove(&port) {
+            log::info!("Stopping listener on port {}", port);
+            handle.abort();
+        }
+    }
+
+    // Add new ports
+    for &port in new_set.difference(&old_set) {
+        let tunnel_writer_tx = tunnel_writer_tx.clone();
+        let client_writers = client_writers.clone();
+        let active_streams = active_streams.clone();
+        let next_stream_id = next_stream_id.clone();
+        let edge_id = edge_id.to_string();
+        let port_token = connection_token.child_token();
+
+        let handle = tokio::spawn(async move {
+            let listener = match TcpListener::bind(("0.0.0.0", port)).await {
+                Ok(l) => l,
+                Err(e) => {
+                    log::error!("Failed to bind port {}: {}", port, e);
+                    return;
+                }
+            };
+            log::info!("Listening on port {}", port);
+
+            loop {
+                tokio::select! {
+                    accept_result = listener.accept() => {
+                        match accept_result {
+                            Ok((client_stream, client_addr)) => {
+                                let stream_id = next_stream_id.fetch_add(1, Ordering::Relaxed);
+                                let tunnel_writer_tx = tunnel_writer_tx.clone();
+                                let client_writers = client_writers.clone();
+                                let active_streams = active_streams.clone();
+                                let edge_id = edge_id.clone();
+                                let client_token = port_token.child_token();
+
+                                active_streams.fetch_add(1, Ordering::Relaxed);
+
+                                tokio::spawn(async move {
+                                    handle_client_connection(
+                                        client_stream,
+                                        client_addr,
+                                        stream_id,
+                                        port,
+                                        &edge_id,
+                                        tunnel_writer_tx,
+                                        client_writers,
+                                        client_token,
+                                    )
+                                    .await;
+                                    active_streams.fetch_sub(1, Ordering::Relaxed);
+                                });
+                            }
+                            Err(e) => {
+                                log::error!("Accept error on port {}: {}", port, e);
+                            }
+                        }
+                    }
+                    _ = port_token.cancelled() => {
+                        log::info!("Port {} listener cancelled", port);
+                        break;
+                    }
+                }
+            }
+        });
+        port_listeners.insert(port, handle);
+    }
+}
+
+async fn handle_client_connection(
+    client_stream: TcpStream,
+    client_addr: std::net::SocketAddr,
+    stream_id: u32,
+    dest_port: u16,
+    edge_id: &str,
+    tunnel_writer_tx: mpsc::Sender<Vec<u8>>,
+    client_writers: Arc<Mutex<HashMap<u32, mpsc::Sender<Vec<u8>>>>>,
+    client_token: CancellationToken,
+) {
+    let client_ip = client_addr.ip().to_string();
+    let client_port = client_addr.port();
+
+    // Determine edge IP (use 0.0.0.0 as placeholder — hub doesn't use it for routing)
+    let edge_ip = "0.0.0.0";
+
+    // Send OPEN frame with PROXY v1 header via writer channel
+    let proxy_header = build_proxy_v1_header(&client_ip, edge_ip, client_port, dest_port);
+    let open_frame = encode_frame(stream_id, FRAME_OPEN, proxy_header.as_bytes());
+    if tunnel_writer_tx.send(open_frame).await.is_err() {
+        return;
+    }
+
+    // Set up channel for data coming back from hub
+    let (back_tx, mut back_rx) = mpsc::channel::<Vec<u8>>(256);
+    {
+        let mut writers = client_writers.lock().await;
+        writers.insert(stream_id, back_tx);
+    }
+
+    let (mut client_read, mut client_write) = client_stream.into_split();
+
+    // Task: hub -> client
+    let hub_to_client_token = client_token.clone();
+    let hub_to_client = tokio::spawn(async move {
+        loop {
+            tokio::select! {
+                data = back_rx.recv() => {
+                    match data {
+                        Some(data) => {
+                            if client_write.write_all(&data).await.is_err() {
+                                break;
+                            }
+                        }
+                        None => break,
+                    }
+                }
+                _ = hub_to_client_token.cancelled() => break,
+            }
+        }
+        let _ = client_write.shutdown().await;
+    });
+
+    // Task: client -> hub (via writer channel)
+    let mut buf = vec![0u8; 32768];
+    loop {
+        tokio::select! {
+            read_result = client_read.read(&mut buf) => {
+                match read_result {
+                    Ok(0) => break,
+                    Ok(n) => {
+                        let data_frame = encode_frame(stream_id, FRAME_DATA, &buf[..n]);
+                        // A5: Use try_send to avoid blocking if writer channel is full
+                        if tunnel_writer_tx.try_send(data_frame).is_err() {
+                            log::warn!("Stream {} tunnel writer full, closing", stream_id);
+                            break;
+                        }
+                    }
+                    Err(_) => break,
+                }
+            }
+            _ = client_token.cancelled() => break,
+        }
+    }
+
+    // Send CLOSE frame (only if not cancelled)
+    if !client_token.is_cancelled() {
+        let close_frame = encode_frame(stream_id, FRAME_CLOSE, &[]);
+        let _ = tunnel_writer_tx.try_send(close_frame);
+    }
+
+    // Cleanup
+    {
+        let mut writers = client_writers.lock().await;
+        writers.remove(&stream_id);
+    }
+    hub_to_client.abort();
+    let _ = edge_id; // used for logging context
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // --- Serde tests ---
+
+    #[test]
+    fn test_edge_config_deserialize_camel_case() {
+        let json = r#"{
+            "hubHost": "hub.example.com",
+            "hubPort": 8443,
+            "edgeId": "edge-1",
+            "secret": "my-secret"
+        }"#;
+        let config: EdgeConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(config.hub_host, "hub.example.com");
+        assert_eq!(config.hub_port, 8443);
+        assert_eq!(config.edge_id, "edge-1");
+        assert_eq!(config.secret, "my-secret");
+    }
+
+    #[test]
+    fn test_edge_config_serialize_roundtrip() {
+        let config = EdgeConfig {
+            hub_host: "host.test".to_string(),
+            hub_port: 9999,
+            edge_id: "e1".to_string(),
+            secret: "sec".to_string(),
+        };
+        let json = serde_json::to_string(&config).unwrap();
+        let back: EdgeConfig = serde_json::from_str(&json).unwrap();
+        assert_eq!(back.hub_host, config.hub_host);
+        assert_eq!(back.hub_port, config.hub_port);
+        assert_eq!(back.edge_id, config.edge_id);
+        assert_eq!(back.secret, config.secret);
+    }
+
+    #[test]
+    fn test_handshake_config_deserialize_all_fields() {
+        let json = r#"{"listenPorts": [80, 443], "stunIntervalSecs": 120}"#;
+        let hc: HandshakeConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(hc.listen_ports, vec![80, 443]);
+        assert_eq!(hc.stun_interval_secs, 120);
+    }
+
+    #[test]
+    fn test_handshake_config_default_stun_interval() {
+        let json = r#"{"listenPorts": [443]}"#;
+        let hc: HandshakeConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(hc.listen_ports, vec![443]);
+        assert_eq!(hc.stun_interval_secs, 300);
+    }
+
+    #[test]
+    fn test_config_update_deserialize() {
+        let json = r#"{"listenPorts": [8080, 9090]}"#;
+        let update: ConfigUpdate = serde_json::from_str(json).unwrap();
+        assert_eq!(update.listen_ports, vec![8080, 9090]);
+    }
+
+    #[test]
+    fn test_edge_status_serialize() {
+        let status = EdgeStatus {
+            running: true,
+            connected: true,
+            public_ip: Some("1.2.3.4".to_string()),
+            active_streams: 5,
+            listen_ports: vec![443],
+        };
+        let json = serde_json::to_value(&status).unwrap();
+        assert_eq!(json["running"], true);
+        assert_eq!(json["connected"], true);
+        assert_eq!(json["publicIp"], "1.2.3.4");
+        assert_eq!(json["activeStreams"], 5);
+        assert_eq!(json["listenPorts"], serde_json::json!([443]));
+    }
+
+    #[test]
+    fn test_edge_status_serialize_none_ip() {
+        let status = EdgeStatus {
+            running: false,
+            connected: false,
+            public_ip: None,
+            active_streams: 0,
+            listen_ports: vec![],
+        };
+        let json = serde_json::to_value(&status).unwrap();
+        assert!(json["publicIp"].is_null());
+    }
+
+    #[test]
+    fn test_edge_event_tunnel_connected() {
+        let event = EdgeEvent::TunnelConnected;
+        let json = serde_json::to_value(&event).unwrap();
+        assert_eq!(json["type"], "tunnelConnected");
+    }
+
+    #[test]
+    fn test_edge_event_tunnel_disconnected() {
+        let event = EdgeEvent::TunnelDisconnected;
+        let json = serde_json::to_value(&event).unwrap();
+        assert_eq!(json["type"], "tunnelDisconnected");
+    }
+
+    #[test]
+    fn test_edge_event_public_ip_discovered() {
+        let event = EdgeEvent::PublicIpDiscovered {
+            ip: "203.0.113.1".to_string(),
+        };
+        let json = serde_json::to_value(&event).unwrap();
+        assert_eq!(json["type"], "publicIpDiscovered");
+        assert_eq!(json["ip"], "203.0.113.1");
+    }
+
+    #[test]
+    fn test_edge_event_ports_assigned() {
+        let event = EdgeEvent::PortsAssigned {
+            listen_ports: vec![443, 8080],
+        };
+        let json = serde_json::to_value(&event).unwrap();
+        assert_eq!(json["type"], "portsAssigned");
+        assert_eq!(json["listenPorts"], serde_json::json!([443, 8080]));
+    }
+
+    #[test]
+    fn test_edge_event_ports_updated() {
+        let event = EdgeEvent::PortsUpdated {
+            listen_ports: vec![9090],
+        };
+        let json = serde_json::to_value(&event).unwrap();
+        assert_eq!(json["type"], "portsUpdated");
+        assert_eq!(json["listenPorts"], serde_json::json!([9090]));
+    }
+
+    // --- Async tests ---
+
+    #[tokio::test]
+    async fn test_tunnel_edge_new_get_status() {
+        let edge = TunnelEdge::new(EdgeConfig {
+            hub_host: "localhost".to_string(),
+            hub_port: 8443,
+            edge_id: "test-edge".to_string(),
+            secret: "test-secret".to_string(),
+        });
+        let status = edge.get_status().await;
+        assert!(!status.running);
+        assert!(!status.connected);
+        assert!(status.public_ip.is_none());
+        assert_eq!(status.active_streams, 0);
+        assert!(status.listen_ports.is_empty());
+    }
+
+    #[tokio::test]
+    async fn test_tunnel_edge_take_event_rx() {
+        let edge = TunnelEdge::new(EdgeConfig {
+            hub_host: "localhost".to_string(),
+            hub_port: 8443,
+            edge_id: "e".to_string(),
+            secret: "s".to_string(),
+        });
+        let rx1 = edge.take_event_rx().await;
+        assert!(rx1.is_some());
+        let rx2 = edge.take_event_rx().await;
+        assert!(rx2.is_none());
+    }
+
+    #[tokio::test]
+    async fn test_tunnel_edge_stop_without_start() {
+        let edge = TunnelEdge::new(EdgeConfig {
+            hub_host: "localhost".to_string(),
+            hub_port: 8443,
+            edge_id: "e".to_string(),
+            secret: "s".to_string(),
+        });
+        edge.stop().await; // should not panic
+        let status = edge.get_status().await;
+        assert!(!status.running);
+    }
+}
+
+/// TLS certificate verifier that accepts any certificate (auth is via shared secret).
+#[derive(Debug)]
+struct NoCertVerifier;
+
+impl rustls::client::danger::ServerCertVerifier for NoCertVerifier {
+    fn verify_server_cert(
+        &self,
+        _end_entity: &rustls::pki_types::CertificateDer<'_>,
+        _intermediates: &[rustls::pki_types::CertificateDer<'_>],
+        _server_name: &rustls::pki_types::ServerName<'_>,
+        _ocsp_response: &[u8],
+        _now: rustls::pki_types::UnixTime,
+    ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
+        Ok(rustls::client::danger::ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        _message: &[u8],
+        _cert: &rustls::pki_types::CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        _message: &[u8],
+        _cert: &rustls::pki_types::CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
+        vec![
+            rustls::SignatureScheme::RSA_PKCS1_SHA256,
+            rustls::SignatureScheme::RSA_PKCS1_SHA384,
+            rustls::SignatureScheme::RSA_PKCS1_SHA512,
+            rustls::SignatureScheme::ECDSA_NISTP256_SHA256,
+            rustls::SignatureScheme::ECDSA_NISTP384_SHA384,
+            rustls::SignatureScheme::ECDSA_NISTP521_SHA512,
+            rustls::SignatureScheme::RSA_PSS_SHA256,
+            rustls::SignatureScheme::RSA_PSS_SHA384,
+            rustls::SignatureScheme::RSA_PSS_SHA512,
+            rustls::SignatureScheme::ED25519,
+            rustls::SignatureScheme::ED448,
+        ]
+    }
+}
--- a/rust/crates/remoteingress-core/src/hub.rs
+++ b/rust/crates/remoteingress-core/src/hub.rs
@@ -0,0 +1,915 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::Duration;
+use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
+use tokio::net::{TcpListener, TcpStream};
+use tokio::sync::{mpsc, Mutex, RwLock, Semaphore};
+use tokio::time::{interval, sleep_until, Instant};
+use tokio_rustls::TlsAcceptor;
+use tokio_util::sync::CancellationToken;
+use serde::{Deserialize, Serialize};
+
+use remoteingress_protocol::*;
+
+/// Hub configuration.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct HubConfig {
+    pub tunnel_port: u16,
+    pub target_host: Option<String>,
+    #[serde(default)]
+    pub tls_cert_pem: Option<String>,
+    #[serde(default)]
+    pub tls_key_pem: Option<String>,
+}
+
+impl Default for HubConfig {
+    fn default() -> Self {
+        Self {
+            tunnel_port: 8443,
+            target_host: Some("127.0.0.1".to_string()),
+            tls_cert_pem: None,
+            tls_key_pem: None,
+        }
+    }
+}
+
+/// An allowed edge identity.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AllowedEdge {
+    pub id: String,
+    pub secret: String,
+    #[serde(default)]
+    pub listen_ports: Vec<u16>,
+    pub stun_interval_secs: Option<u64>,
+}
+
+/// Handshake response sent to edge after authentication.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct HandshakeResponse {
+    listen_ports: Vec<u16>,
+    stun_interval_secs: u64,
+}
+
+/// Configuration update pushed to a connected edge at runtime.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EdgeConfigUpdate {
+    pub listen_ports: Vec<u16>,
+}
+
+/// Runtime status of a connected edge.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ConnectedEdgeStatus {
+    pub edge_id: String,
+    pub connected_at: u64,
+    pub active_streams: usize,
+    pub peer_addr: String,
+}
+
+/// Events emitted by the hub.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[serde(tag = "type")]
+pub enum HubEvent {
+    #[serde(rename_all = "camelCase")]
+    EdgeConnected { edge_id: String, peer_addr: String },
+    #[serde(rename_all = "camelCase")]
+    EdgeDisconnected { edge_id: String },
+    #[serde(rename_all = "camelCase")]
+    StreamOpened { edge_id: String, stream_id: u32 },
+    #[serde(rename_all = "camelCase")]
+    StreamClosed { edge_id: String, stream_id: u32 },
+}
+
+/// Hub status response.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct HubStatus {
+    pub running: bool,
+    pub tunnel_port: u16,
+    pub connected_edges: Vec<ConnectedEdgeStatus>,
+}
+
+/// The tunnel hub that accepts edge connections and demuxes streams to SmartProxy.
+pub struct TunnelHub {
+    config: RwLock<HubConfig>,
+    allowed_edges: Arc<RwLock<HashMap<String, AllowedEdge>>>,
+    connected_edges: Arc<Mutex<HashMap<String, ConnectedEdgeInfo>>>,
+    event_tx: mpsc::Sender<HubEvent>,
+    event_rx: Mutex<Option<mpsc::Receiver<HubEvent>>>,
+    shutdown_tx: Mutex<Option<mpsc::Sender<()>>>,
+    running: RwLock<bool>,
+    cancel_token: CancellationToken,
+}
+
+struct ConnectedEdgeInfo {
+    connected_at: u64,
+    peer_addr: String,
+    active_streams: Arc<Mutex<HashMap<u32, (mpsc::Sender<Vec<u8>>, CancellationToken)>>>,
+    config_tx: mpsc::Sender<EdgeConfigUpdate>,
+    #[allow(dead_code)] // kept alive for Drop — cancels child tokens when edge is removed
+    cancel_token: CancellationToken,
+}
+
+impl TunnelHub {
+    pub fn new(config: HubConfig) -> Self {
+        let (event_tx, event_rx) = mpsc::channel(1024);
+        Self {
+            config: RwLock::new(config),
+            allowed_edges: Arc::new(RwLock::new(HashMap::new())),
+            connected_edges: Arc::new(Mutex::new(HashMap::new())),
+            event_tx,
+            event_rx: Mutex::new(Some(event_rx)),
+            shutdown_tx: Mutex::new(None),
+            running: RwLock::new(false),
+            cancel_token: CancellationToken::new(),
+        }
+    }
+
+    /// Take the event receiver (can only be called once).
+    pub async fn take_event_rx(&self) -> Option<mpsc::Receiver<HubEvent>> {
+        self.event_rx.lock().await.take()
+    }
+
+    /// Update the list of allowed edges.
+    /// For any currently-connected edge whose ports changed, push a config update.
+    pub async fn update_allowed_edges(&self, edges: Vec<AllowedEdge>) {
+        let mut map = self.allowed_edges.write().await;
+
+        // Build new map
+        let mut new_map = HashMap::new();
+        for edge in &edges {
+            new_map.insert(edge.id.clone(), edge.clone());
+        }
+
+        // Push config updates to connected edges whose ports changed
+        let connected = self.connected_edges.lock().await;
+        for edge in &edges {
+            if let Some(info) = connected.get(&edge.id) {
+                // Check if ports changed compared to old config
+                let ports_changed = match map.get(&edge.id) {
+                    Some(old) => old.listen_ports != edge.listen_ports,
+                    None => true, // newly allowed edge that's already connected
+                };
+                if ports_changed {
+                    let update = EdgeConfigUpdate {
+                        listen_ports: edge.listen_ports.clone(),
+                    };
+                    let _ = info.config_tx.try_send(update);
+                }
+            }
+        }
+
+        *map = new_map;
+    }
+
+    /// Get the current hub status.
+    pub async fn get_status(&self) -> HubStatus {
+        let running = *self.running.read().await;
+        let config = self.config.read().await;
+        let edges = self.connected_edges.lock().await;
+
+        let mut connected = Vec::new();
+        for (id, info) in edges.iter() {
+            let streams = info.active_streams.lock().await;
+            connected.push(ConnectedEdgeStatus {
+                edge_id: id.clone(),
+                connected_at: info.connected_at,
+                active_streams: streams.len(),
+                peer_addr: info.peer_addr.clone(),
+            });
+        }
+
+        HubStatus {
+            running,
+            tunnel_port: config.tunnel_port,
+            connected_edges: connected,
+        }
+    }
+
+    /// Start the hub — listen for TLS connections from edges.
+    pub async fn start(&self) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        let config = self.config.read().await.clone();
+        let tls_config = build_tls_config(&config)?;
+        let acceptor = TlsAcceptor::from(Arc::new(tls_config));
+
+        let listener = TcpListener::bind(("0.0.0.0", config.tunnel_port)).await?;
+        log::info!("Hub listening on port {}", config.tunnel_port);
+
+        let (shutdown_tx, mut shutdown_rx) = mpsc::channel::<()>(1);
+        *self.shutdown_tx.lock().await = Some(shutdown_tx);
+        *self.running.write().await = true;
+
+        let allowed = self.allowed_edges.clone();
+        let connected = self.connected_edges.clone();
+        let event_tx = self.event_tx.clone();
+        let target_host = config.target_host.unwrap_or_else(|| "127.0.0.1".to_string());
+        let hub_token = self.cancel_token.clone();
+
+        tokio::spawn(async move {
+            loop {
+                tokio::select! {
+                    result = listener.accept() => {
+                        match result {
+                            Ok((stream, addr)) => {
+                                log::info!("Edge connection from {}", addr);
+                                let acceptor = acceptor.clone();
+                                let allowed = allowed.clone();
+                                let connected = connected.clone();
+                                let event_tx = event_tx.clone();
+                                let target = target_host.clone();
+                                let edge_token = hub_token.child_token();
+                                let peer_addr = addr.ip().to_string();
+                                tokio::spawn(async move {
+                                    if let Err(e) = handle_edge_connection(
+                                        stream, acceptor, allowed, connected, event_tx, target, edge_token, peer_addr,
+                                    ).await {
+                                        log::error!("Edge connection error: {}", e);
+                                    }
+                                });
+                            }
+                            Err(e) => {
+                                log::error!("Accept error: {}", e);
+                            }
+                        }
+                    }
+                    _ = hub_token.cancelled() => {
+                        log::info!("Hub shutting down (token cancelled)");
+                        break;
+                    }
+                    _ = shutdown_rx.recv() => {
+                        log::info!("Hub shutting down");
+                        break;
+                    }
+                }
+            }
+        });
+
+        Ok(())
+    }
+
+    /// Stop the hub.
+    pub async fn stop(&self) {
+        self.cancel_token.cancel();
+        if let Some(tx) = self.shutdown_tx.lock().await.take() {
+            let _ = tx.send(()).await;
+        }
+        *self.running.write().await = false;
+        // Clear connected edges
+        self.connected_edges.lock().await.clear();
+    }
+}
+
+impl Drop for TunnelHub {
+    fn drop(&mut self) {
+        self.cancel_token.cancel();
+    }
+}
+
+/// Maximum concurrent streams per edge connection.
+const MAX_STREAMS_PER_EDGE: usize = 1024;
+
+/// Handle a single edge connection: authenticate, then enter frame loop.
+async fn handle_edge_connection(
+    stream: TcpStream,
+    acceptor: TlsAcceptor,
+    allowed: Arc<RwLock<HashMap<String, AllowedEdge>>>,
+    connected: Arc<Mutex<HashMap<String, ConnectedEdgeInfo>>>,
+    event_tx: mpsc::Sender<HubEvent>,
+    target_host: String,
+    edge_token: CancellationToken,
+    peer_addr: String,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    let tls_stream = acceptor.accept(stream).await?;
+    let (read_half, mut write_half) = tokio::io::split(tls_stream);
+    let mut buf_reader = BufReader::new(read_half);
+
+    // Read auth line: "EDGE <edgeId> <secret>\n"
+    let mut auth_line = String::new();
+    buf_reader.read_line(&mut auth_line).await?;
+    let auth_line = auth_line.trim();
+
+    let parts: Vec<&str> = auth_line.splitn(3, ' ').collect();
+    if parts.len() != 3 || parts[0] != "EDGE" {
+        return Err("invalid auth line".into());
+    }
+
+    let edge_id = parts[1].to_string();
+    let secret = parts[2];
+
+    // Verify credentials and extract edge config
+    let (listen_ports, stun_interval_secs) = {
+        let edges = allowed.read().await;
+        match edges.get(&edge_id) {
+            Some(edge) => {
+                if !constant_time_eq(secret.as_bytes(), edge.secret.as_bytes()) {
+                    return Err(format!("invalid secret for edge {}", edge_id).into());
+                }
+                (edge.listen_ports.clone(), edge.stun_interval_secs.unwrap_or(300))
+            }
+            None => {
+                return Err(format!("unknown edge {}", edge_id).into());
+            }
+        }
+    };
+
+    log::info!("Edge {} authenticated from {}", edge_id, peer_addr);
+    let _ = event_tx.try_send(HubEvent::EdgeConnected {
+        edge_id: edge_id.clone(),
+        peer_addr: peer_addr.clone(),
+    });
+
+    // Send handshake response with initial config before frame protocol begins
+    let handshake = HandshakeResponse {
+        listen_ports: listen_ports.clone(),
+        stun_interval_secs,
+    };
+    let mut handshake_json = serde_json::to_string(&handshake)?;
+    handshake_json.push('\n');
+    write_half.write_all(handshake_json.as_bytes()).await?;
+
+    // Track this edge
+    let streams: Arc<Mutex<HashMap<u32, (mpsc::Sender<Vec<u8>>, CancellationToken)>>> =
+        Arc::new(Mutex::new(HashMap::new()));
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs();
+
+    // Create config update channel
+    let (config_tx, mut config_rx) = mpsc::channel::<EdgeConfigUpdate>(16);
+
+    {
+        let mut edges = connected.lock().await;
+        edges.insert(
+            edge_id.clone(),
+            ConnectedEdgeInfo {
+                connected_at: now,
+                peer_addr,
+                active_streams: streams.clone(),
+                config_tx,
+                cancel_token: edge_token.clone(),
+            },
+        );
+    }
+
+    // A5: Channel-based writer replaces Arc<Mutex<WriteHalf>>
+    // All frame writes go through this channel → dedicated writer task serializes them
+    let (frame_writer_tx, mut frame_writer_rx) = mpsc::channel::<Vec<u8>>(4096);
+    let writer_token = edge_token.clone();
+    let writer_handle = tokio::spawn(async move {
+        loop {
+            tokio::select! {
+                data = frame_writer_rx.recv() => {
+                    match data {
+                        Some(frame_data) => {
+                            if write_half.write_all(&frame_data).await.is_err() {
+                                break;
+                            }
+                        }
+                        None => break,
+                    }
+                }
+                _ = writer_token.cancelled() => break,
+            }
+        }
+    });
+
+    // Spawn task to forward config updates as FRAME_CONFIG frames
+    let config_writer_tx = frame_writer_tx.clone();
+    let config_edge_id = edge_id.clone();
+    let config_token = edge_token.clone();
+    let config_handle = tokio::spawn(async move {
+        loop {
+            tokio::select! {
+                update = config_rx.recv() => {
+                    match update {
+                        Some(update) => {
+                            if let Ok(payload) = serde_json::to_vec(&update) {
+                                let frame = encode_frame(0, FRAME_CONFIG, &payload);
+                                if config_writer_tx.send(frame).await.is_err() {
+                                    log::error!("Failed to send config update to edge {}", config_edge_id);
+                                    break;
+                                }
+                                log::info!("Sent config update to edge {}: ports {:?}", config_edge_id, update.listen_ports);
+                            }
+                        }
+                        None => break,
+                    }
+                }
+                _ = config_token.cancelled() => break,
+            }
+        }
+    });
+
+    // A4: Semaphore to limit concurrent streams per edge
+    let stream_semaphore = Arc::new(Semaphore::new(MAX_STREAMS_PER_EDGE));
+
+    // Heartbeat: periodic PING and liveness timeout
+    let ping_interval_dur = Duration::from_secs(15);
+    let liveness_timeout_dur = Duration::from_secs(45);
+    let mut ping_ticker = interval(ping_interval_dur);
+    ping_ticker.tick().await; // consume the immediate first tick
+    let mut last_activity = Instant::now();
+    let mut liveness_deadline = Box::pin(sleep_until(last_activity + liveness_timeout_dur));
+
+    // Frame reading loop
+    let mut frame_reader = FrameReader::new(buf_reader);
+
+    loop {
+        tokio::select! {
+            frame_result = frame_reader.next_frame() => {
+                match frame_result {
+                    Ok(Some(frame)) => {
+                        // Reset liveness on any received frame
+                        last_activity = Instant::now();
+                        liveness_deadline.as_mut().reset(last_activity + liveness_timeout_dur);
+
+                        match frame.frame_type {
+                            FRAME_OPEN => {
+                                // A4: Check stream limit before processing
+                                let permit = match stream_semaphore.clone().try_acquire_owned() {
+                                    Ok(p) => p,
+                                    Err(_) => {
+                                        log::warn!("Edge {} exceeded max streams ({}), rejecting stream {}",
+                                            edge_id, MAX_STREAMS_PER_EDGE, frame.stream_id);
+                                        let close_frame = encode_frame(frame.stream_id, FRAME_CLOSE_BACK, &[]);
+                                        let _ = frame_writer_tx.try_send(close_frame);
+                                        continue;
+                                    }
+                                };
+
+                                // Payload is PROXY v1 header line
+                                let proxy_header = String::from_utf8_lossy(&frame.payload).to_string();
+
+                                // Parse destination port from PROXY header
+                                let dest_port = parse_dest_port_from_proxy(&proxy_header).unwrap_or(443);
+
+                                let stream_id = frame.stream_id;
+                                let edge_id_clone = edge_id.clone();
+                                let event_tx_clone = event_tx.clone();
+                                let streams_clone = streams.clone();
+                                let writer_tx = frame_writer_tx.clone();
+                                let target = target_host.clone();
+                                let stream_token = edge_token.child_token();
+
+                                let _ = event_tx.try_send(HubEvent::StreamOpened {
+                                    edge_id: edge_id.clone(),
+                                    stream_id,
+                                });
+
+                                // Create channel for data from edge to this stream
+                                let (data_tx, mut data_rx) = mpsc::channel::<Vec<u8>>(256);
+                                {
+                                    let mut s = streams.lock().await;
+                                    s.insert(stream_id, (data_tx, stream_token.clone()));
+                                }
+
+                                // Spawn task: connect to SmartProxy, send PROXY header, pipe data
+                                tokio::spawn(async move {
+                                    let _permit = permit; // hold semaphore permit until stream completes
+
+                                    let result = async {
+                                        // A2: Connect to SmartProxy with timeout
+                                        let mut upstream = tokio::time::timeout(
+                                            Duration::from_secs(10),
+                                            TcpStream::connect((target.as_str(), dest_port)),
+                                        )
+                                        .await
+                                        .map_err(|_| -> Box<dyn std::error::Error + Send + Sync> {
+                                            format!("connect to SmartProxy {}:{} timed out (10s)", target, dest_port).into()
+                                        })??;
+
+                                        upstream.write_all(proxy_header.as_bytes()).await?;
+
+                                        let (mut up_read, mut up_write) =
+                                            upstream.into_split();
+
+                                        // Forward data from edge (via channel) to SmartProxy
+                                        let writer_token = stream_token.clone();
+                                        let writer_for_edge_data = tokio::spawn(async move {
+                                            loop {
+                                                tokio::select! {
+                                                    data = data_rx.recv() => {
+                                                        match data {
+                                                            Some(data) => {
+                                                                if up_write.write_all(&data).await.is_err() {
+                                                                    break;
+                                                                }
+                                                            }
+                                                            None => break,
+                                                        }
+                                                    }
+                                                    _ = writer_token.cancelled() => break,
+                                                }
+                                            }
+                                            let _ = up_write.shutdown().await;
+                                        });
+
+                                        // Forward data from SmartProxy back to edge via writer channel
+                                        let mut buf = vec![0u8; 32768];
+                                        loop {
+                                            tokio::select! {
+                                                read_result = up_read.read(&mut buf) => {
+                                                    match read_result {
+                                                        Ok(0) => break,
+                                                        Ok(n) => {
+                                                            let frame =
+                                                                encode_frame(stream_id, FRAME_DATA_BACK, &buf[..n]);
+                                                            // A5: Use try_send to avoid blocking if writer channel is full
+                                                            if writer_tx.try_send(frame).is_err() {
+                                                                log::warn!("Stream {} writer channel full, closing", stream_id);
+                                                                break;
+                                                            }
+                                                        }
+                                                        Err(_) => break,
+                                                    }
+                                                }
+                                                _ = stream_token.cancelled() => break,
+                                            }
+                                        }
+
+                                        // Send CLOSE_BACK to edge (only if not cancelled)
+                                        if !stream_token.is_cancelled() {
+                                            let close_frame = encode_frame(stream_id, FRAME_CLOSE_BACK, &[]);
+                                            let _ = writer_tx.try_send(close_frame);
+                                        }
+
+                                        writer_for_edge_data.abort();
+                                        Ok::<(), Box<dyn std::error::Error + Send + Sync>>(())
+                                    }
+                                    .await;
+
+                                    if let Err(e) = result {
+                                        log::error!("Stream {} error: {}", stream_id, e);
+                                        // Send CLOSE_BACK on error (only if not cancelled)
+                                        if !stream_token.is_cancelled() {
+                                            let close_frame = encode_frame(stream_id, FRAME_CLOSE_BACK, &[]);
+                                            let _ = writer_tx.try_send(close_frame);
+                                        }
+                                    }
+
+                                    // Clean up stream (guard against duplicate if FRAME_CLOSE already removed it)
+                                    let was_present = {
+                                        let mut s = streams_clone.lock().await;
+                                        s.remove(&stream_id).is_some()
+                                    };
+                                    if was_present {
+                                        let _ = event_tx_clone.try_send(HubEvent::StreamClosed {
+                                            edge_id: edge_id_clone,
+                                            stream_id,
+                                        });
+                                    }
+                                });
+                            }
+                            FRAME_DATA => {
+                                // A1: Non-blocking send to prevent head-of-line blocking
+                                let s = streams.lock().await;
+                                if let Some((tx, _)) = s.get(&frame.stream_id) {
+                                    if tx.try_send(frame.payload).is_err() {
+                                        log::warn!("Stream {} data channel full, dropping frame", frame.stream_id);
+                                    }
+                                }
+                            }
+                            FRAME_CLOSE => {
+                                let mut s = streams.lock().await;
+                                if let Some((_, token)) = s.remove(&frame.stream_id) {
+                                    token.cancel();
+                                    let _ = event_tx.try_send(HubEvent::StreamClosed {
+                                        edge_id: edge_id.clone(),
+                                        stream_id: frame.stream_id,
+                                    });
+                                }
+                            }
+                            FRAME_PONG => {
+                                log::debug!("Received PONG from edge {}", edge_id);
+                            }
+                            _ => {
+                                log::warn!("Unexpected frame type {} from edge", frame.frame_type);
+                            }
+                        }
+                    }
+                    Ok(None) => {
+                        log::info!("Edge {} disconnected (EOF)", edge_id);
+                        break;
+                    }
+                    Err(e) => {
+                        log::error!("Edge {} frame error: {}", edge_id, e);
+                        break;
+                    }
+                }
+            }
+            _ = ping_ticker.tick() => {
+                let ping_frame = encode_frame(0, FRAME_PING, &[]);
+                if frame_writer_tx.try_send(ping_frame).is_err() {
+                    log::warn!("Failed to send PING to edge {}, writer channel full/closed", edge_id);
+                    break;
+                }
+                log::trace!("Sent PING to edge {}", edge_id);
+            }
+            _ = &mut liveness_deadline => {
+                log::warn!("Edge {} liveness timeout (no frames for {}s), disconnecting",
+                    edge_id, liveness_timeout_dur.as_secs());
+                break;
+            }
+            _ = edge_token.cancelled() => {
+                log::info!("Edge {} cancelled by hub", edge_id);
+                break;
+            }
+        }
+    }
+
+    // Cleanup: cancel edge token to propagate to all child tasks
+    edge_token.cancel();
+    config_handle.abort();
+    writer_handle.abort();
+    {
+        let mut edges = connected.lock().await;
+        edges.remove(&edge_id);
+    }
+    let _ = event_tx.try_send(HubEvent::EdgeDisconnected {
+        edge_id: edge_id.clone(),
+    });
+
+    Ok(())
+}
+
+/// Parse destination port from PROXY v1 header.
+fn parse_dest_port_from_proxy(header: &str) -> Option<u16> {
+    let parts: Vec<&str> = header.trim().split_whitespace().collect();
+    if parts.len() >= 6 {
+        parts[5].parse().ok()
+    } else {
+        None
+    }
+}
+
+/// Build TLS server config from PEM strings, or auto-generate self-signed.
+fn build_tls_config(
+    config: &HubConfig,
+) -> Result<rustls::ServerConfig, Box<dyn std::error::Error + Send + Sync>> {
+    let (cert_pem, key_pem) = match (&config.tls_cert_pem, &config.tls_key_pem) {
+        (Some(cert), Some(key)) => (cert.clone(), key.clone()),
+        _ => {
+            // Generate self-signed certificate
+            let cert = rcgen::generate_simple_self_signed(vec!["remoteingress-hub".to_string()])?;
+            let cert_pem = cert.cert.pem();
+            let key_pem = cert.key_pair.serialize_pem();
+            (cert_pem, key_pem)
+        }
+    };
+
+    let certs = rustls_pemfile_parse_certs(&cert_pem)?;
+    let key = rustls_pemfile_parse_key(&key_pem)?;
+
+    let mut config = rustls::ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(certs, key)?;
+
+    config.alpn_protocols = vec![b"remoteingress".to_vec()];
+
+    Ok(config)
+}
+
+fn rustls_pemfile_parse_certs(
+    pem: &str,
+) -> Result<Vec<rustls::pki_types::CertificateDer<'static>>, Box<dyn std::error::Error + Send + Sync>>
+{
+    let mut reader = std::io::Cursor::new(pem.as_bytes());
+    let certs = rustls_pemfile::certs(&mut reader).collect::<Result<Vec<_>, _>>()?;
+    Ok(certs)
+}
+
+fn rustls_pemfile_parse_key(
+    pem: &str,
+) -> Result<rustls::pki_types::PrivateKeyDer<'static>, Box<dyn std::error::Error + Send + Sync>> {
+    let mut reader = std::io::Cursor::new(pem.as_bytes());
+    let key = rustls_pemfile::private_key(&mut reader)?
+        .ok_or("no private key found in PEM")?;
+    Ok(key)
+}
+
+/// Constant-time comparison of two byte slices.
+fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0u8;
+    for (x, y) in a.iter().zip(b.iter()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // --- constant_time_eq tests ---
+
+    #[test]
+    fn test_constant_time_eq_equal() {
+        assert!(constant_time_eq(b"hello", b"hello"));
+    }
+
+    #[test]
+    fn test_constant_time_eq_different_content() {
+        assert!(!constant_time_eq(b"hello", b"world"));
+    }
+
+    #[test]
+    fn test_constant_time_eq_different_lengths() {
+        assert!(!constant_time_eq(b"short", b"longer"));
+    }
+
+    #[test]
+    fn test_constant_time_eq_both_empty() {
+        assert!(constant_time_eq(b"", b""));
+    }
+
+    #[test]
+    fn test_constant_time_eq_one_empty() {
+        assert!(!constant_time_eq(b"", b"notempty"));
+    }
+
+    #[test]
+    fn test_constant_time_eq_single_bit_difference() {
+        // 'A' = 0x41, 'a' = 0x61 — differ by one bit
+        assert!(!constant_time_eq(b"A", b"a"));
+    }
+
+    // --- parse_dest_port_from_proxy tests ---
+
+    #[test]
+    fn test_parse_dest_port_443() {
+        let header = "PROXY TCP4 1.2.3.4 5.6.7.8 12345 443\r\n";
+        assert_eq!(parse_dest_port_from_proxy(header), Some(443));
+    }
+
+    #[test]
+    fn test_parse_dest_port_80() {
+        let header = "PROXY TCP4 10.0.0.1 10.0.0.2 54321 80\r\n";
+        assert_eq!(parse_dest_port_from_proxy(header), Some(80));
+    }
+
+    #[test]
+    fn test_parse_dest_port_65535() {
+        let header = "PROXY TCP4 10.0.0.1 10.0.0.2 1 65535\r\n";
+        assert_eq!(parse_dest_port_from_proxy(header), Some(65535));
+    }
+
+    #[test]
+    fn test_parse_dest_port_too_few_fields() {
+        let header = "PROXY TCP4 1.2.3.4";
+        assert_eq!(parse_dest_port_from_proxy(header), None);
+    }
+
+    #[test]
+    fn test_parse_dest_port_empty_string() {
+        assert_eq!(parse_dest_port_from_proxy(""), None);
+    }
+
+    #[test]
+    fn test_parse_dest_port_non_numeric() {
+        let header = "PROXY TCP4 1.2.3.4 5.6.7.8 12345 abc\r\n";
+        assert_eq!(parse_dest_port_from_proxy(header), None);
+    }
+
+    // --- Serde tests ---
+
+    #[test]
+    fn test_allowed_edge_deserialize_all_fields() {
+        let json = r#"{
+            "id": "edge-1",
+            "secret": "s3cret",
+            "listenPorts": [443, 8080],
+            "stunIntervalSecs": 120
+        }"#;
+        let edge: AllowedEdge = serde_json::from_str(json).unwrap();
+        assert_eq!(edge.id, "edge-1");
+        assert_eq!(edge.secret, "s3cret");
+        assert_eq!(edge.listen_ports, vec![443, 8080]);
+        assert_eq!(edge.stun_interval_secs, Some(120));
+    }
+
+    #[test]
+    fn test_allowed_edge_deserialize_with_defaults() {
+        let json = r#"{"id": "edge-2", "secret": "key"}"#;
+        let edge: AllowedEdge = serde_json::from_str(json).unwrap();
+        assert_eq!(edge.id, "edge-2");
+        assert_eq!(edge.secret, "key");
+        assert!(edge.listen_ports.is_empty());
+        assert_eq!(edge.stun_interval_secs, None);
+    }
+
+    #[test]
+    fn test_handshake_response_serializes_camel_case() {
+        let resp = HandshakeResponse {
+            listen_ports: vec![443, 8080],
+            stun_interval_secs: 300,
+        };
+        let json = serde_json::to_value(&resp).unwrap();
+        assert_eq!(json["listenPorts"], serde_json::json!([443, 8080]));
+        assert_eq!(json["stunIntervalSecs"], 300);
+        // Ensure snake_case keys are NOT present
+        assert!(json.get("listen_ports").is_none());
+        assert!(json.get("stun_interval_secs").is_none());
+    }
+
+    #[test]
+    fn test_edge_config_update_serializes_camel_case() {
+        let update = EdgeConfigUpdate {
+            listen_ports: vec![80, 443],
+        };
+        let json = serde_json::to_value(&update).unwrap();
+        assert_eq!(json["listenPorts"], serde_json::json!([80, 443]));
+        assert!(json.get("listen_ports").is_none());
+    }
+
+    #[test]
+    fn test_hub_config_default() {
+        let config = HubConfig::default();
+        assert_eq!(config.tunnel_port, 8443);
+        assert_eq!(config.target_host, Some("127.0.0.1".to_string()));
+        assert!(config.tls_cert_pem.is_none());
+        assert!(config.tls_key_pem.is_none());
+    }
+
+    #[test]
+    fn test_hub_event_edge_connected_serialize() {
+        let event = HubEvent::EdgeConnected {
+            edge_id: "edge-1".to_string(),
+            peer_addr: "203.0.113.5".to_string(),
+        };
+        let json = serde_json::to_value(&event).unwrap();
+        assert_eq!(json["type"], "edgeConnected");
+        assert_eq!(json["edgeId"], "edge-1");
+        assert_eq!(json["peerAddr"], "203.0.113.5");
+    }
+
+    #[test]
+    fn test_hub_event_edge_disconnected_serialize() {
+        let event = HubEvent::EdgeDisconnected {
+            edge_id: "edge-2".to_string(),
+        };
+        let json = serde_json::to_value(&event).unwrap();
+        assert_eq!(json["type"], "edgeDisconnected");
+        assert_eq!(json["edgeId"], "edge-2");
+    }
+
+    #[test]
+    fn test_hub_event_stream_opened_serialize() {
+        let event = HubEvent::StreamOpened {
+            edge_id: "e".to_string(),
+            stream_id: 42,
+        };
+        let json = serde_json::to_value(&event).unwrap();
+        assert_eq!(json["type"], "streamOpened");
+        assert_eq!(json["edgeId"], "e");
+        assert_eq!(json["streamId"], 42);
+    }
+
+    #[test]
+    fn test_hub_event_stream_closed_serialize() {
+        let event = HubEvent::StreamClosed {
+            edge_id: "e".to_string(),
+            stream_id: 7,
+        };
+        let json = serde_json::to_value(&event).unwrap();
+        assert_eq!(json["type"], "streamClosed");
+        assert_eq!(json["edgeId"], "e");
+        assert_eq!(json["streamId"], 7);
+    }
+
+    // --- Async tests ---
+
+    #[tokio::test]
+    async fn test_tunnel_hub_new_get_status() {
+        let hub = TunnelHub::new(HubConfig::default());
+        let status = hub.get_status().await;
+        assert!(!status.running);
+        assert!(status.connected_edges.is_empty());
+        assert_eq!(status.tunnel_port, 8443);
+    }
+
+    #[tokio::test]
+    async fn test_tunnel_hub_take_event_rx() {
+        let hub = TunnelHub::new(HubConfig::default());
+        let rx1 = hub.take_event_rx().await;
+        assert!(rx1.is_some());
+        let rx2 = hub.take_event_rx().await;
+        assert!(rx2.is_none());
+    }
+
+    #[tokio::test]
+    async fn test_tunnel_hub_stop_without_start() {
+        let hub = TunnelHub::new(HubConfig::default());
+        hub.stop().await; // should not panic
+        let status = hub.get_status().await;
+        assert!(!status.running);
+    }
+}
--- a/rust/crates/remoteingress-core/src/lib.rs
+++ b/rust/crates/remoteingress-core/src/lib.rs
@@ -0,0 +1,5 @@
+pub mod hub;
+pub mod edge;
+pub mod stun;
+
+pub use remoteingress_protocol as protocol;
--- a/rust/crates/remoteingress-core/src/stun.rs
+++ b/rust/crates/remoteingress-core/src/stun.rs
@@ -0,0 +1,264 @@
+use std::net::Ipv4Addr;
+use tokio::net::UdpSocket;
+use tokio::time::{timeout, Duration};
+
+const STUN_SERVER: &str = "stun.cloudflare.com:3478";
+const STUN_TIMEOUT: Duration = Duration::from_secs(3);
+
+// STUN constants
+const STUN_BINDING_REQUEST: u16 = 0x0001;
+const STUN_MAGIC_COOKIE: u32 = 0x2112A442;
+const ATTR_XOR_MAPPED_ADDRESS: u16 = 0x0020;
+const ATTR_MAPPED_ADDRESS: u16 = 0x0001;
+
+/// Discover our public IP via STUN Binding Request (RFC 5389).
+/// Returns `None` on timeout or parse failure.
+pub async fn discover_public_ip() -> Option<String> {
+    discover_public_ip_from(STUN_SERVER).await
+}
+
+pub async fn discover_public_ip_from(server: &str) -> Option<String> {
+    let result = timeout(STUN_TIMEOUT, async {
+        let socket = UdpSocket::bind("0.0.0.0:0").await.ok()?;
+        socket.connect(server).await.ok()?;
+
+        // Build STUN Binding Request (20 bytes)
+        let mut request = [0u8; 20];
+        // Message Type: Binding Request (0x0001)
+        request[0..2].copy_from_slice(&STUN_BINDING_REQUEST.to_be_bytes());
+        // Message Length: 0 (no attributes)
+        request[2..4].copy_from_slice(&0u16.to_be_bytes());
+        // Magic Cookie
+        request[4..8].copy_from_slice(&STUN_MAGIC_COOKIE.to_be_bytes());
+        // Transaction ID: 12 random bytes
+        let txn_id: [u8; 12] = rand_bytes();
+        request[8..20].copy_from_slice(&txn_id);
+
+        socket.send(&request).await.ok()?;
+
+        let mut buf = [0u8; 512];
+        let n = socket.recv(&mut buf).await.ok()?;
+        if n < 20 {
+            return None;
+        }
+
+        parse_stun_response(&buf[..n], &txn_id)
+    })
+    .await;
+
+    match result {
+        Ok(ip) => ip,
+        Err(_) => None, // timeout
+    }
+}
+
+fn parse_stun_response(data: &[u8], _txn_id: &[u8; 12]) -> Option<String> {
+    if data.len() < 20 {
+        return None;
+    }
+
+    // Verify it's a Binding Response (0x0101)
+    let msg_type = u16::from_be_bytes([data[0], data[1]]);
+    if msg_type != 0x0101 {
+        return None;
+    }
+
+    let msg_len = u16::from_be_bytes([data[2], data[3]]) as usize;
+    let magic = u32::from_be_bytes([data[4], data[5], data[6], data[7]]);
+
+    // Parse attributes
+    let attrs = &data[20..std::cmp::min(20 + msg_len, data.len())];
+    let mut offset = 0;
+
+    while offset + 4 <= attrs.len() {
+        let attr_type = u16::from_be_bytes([attrs[offset], attrs[offset + 1]]);
+        let attr_len = u16::from_be_bytes([attrs[offset + 2], attrs[offset + 3]]) as usize;
+        offset += 4;
+
+        if offset + attr_len > attrs.len() {
+            break;
+        }
+
+        let attr_data = &attrs[offset..offset + attr_len];
+
+        match attr_type {
+            ATTR_XOR_MAPPED_ADDRESS if attr_data.len() >= 8 => {
+                let family = attr_data[1];
+                if family == 0x01 {
+                    // IPv4
+                    let port_xored = u16::from_be_bytes([attr_data[2], attr_data[3]]);
+                    let _port = port_xored ^ (STUN_MAGIC_COOKIE >> 16) as u16;
+                    let ip_xored = u32::from_be_bytes([
+                        attr_data[4],
+                        attr_data[5],
+                        attr_data[6],
+                        attr_data[7],
+                    ]);
+                    let ip = ip_xored ^ magic;
+                    return Some(Ipv4Addr::from(ip).to_string());
+                }
+            }
+            ATTR_MAPPED_ADDRESS if attr_data.len() >= 8 => {
+                let family = attr_data[1];
+                if family == 0x01 {
+                    // IPv4 (non-XOR fallback)
+                    let ip = u32::from_be_bytes([
+                        attr_data[4],
+                        attr_data[5],
+                        attr_data[6],
+                        attr_data[7],
+                    ]);
+                    return Some(Ipv4Addr::from(ip).to_string());
+                }
+            }
+            _ => {}
+        }
+
+        // Pad to 4-byte boundary
+        offset += (attr_len + 3) & !3;
+    }
+
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Build a synthetic STUN Binding Response with given attributes.
+    fn build_stun_response(attrs: &[(u16, &[u8])]) -> Vec<u8> {
+        let mut attrs_bytes = Vec::new();
+        for &(attr_type, attr_data) in attrs {
+            attrs_bytes.extend_from_slice(&attr_type.to_be_bytes());
+            attrs_bytes.extend_from_slice(&(attr_data.len() as u16).to_be_bytes());
+            attrs_bytes.extend_from_slice(attr_data);
+            // Pad to 4-byte boundary
+            let pad = (4 - (attr_data.len() % 4)) % 4;
+            attrs_bytes.extend(std::iter::repeat(0u8).take(pad));
+        }
+
+        let mut response = Vec::new();
+        // msg_type = 0x0101 (Binding Response)
+        response.extend_from_slice(&0x0101u16.to_be_bytes());
+        // message length
+        response.extend_from_slice(&(attrs_bytes.len() as u16).to_be_bytes());
+        // magic cookie
+        response.extend_from_slice(&STUN_MAGIC_COOKIE.to_be_bytes());
+        // transaction ID (12 bytes)
+        response.extend_from_slice(&[0u8; 12]);
+        // attributes
+        response.extend_from_slice(&attrs_bytes);
+        response
+    }
+
+    #[test]
+    fn test_xor_mapped_address_ipv4() {
+        // IP 203.0.113.1 = 0xCB007101, XOR'd with magic 0x2112A442 = 0xEA12D543
+        let attr_data: [u8; 8] = [
+            0x00, 0x01, // reserved + family (IPv4)
+            0x11, 0x2B, // port XOR'd with 0x2112 (port 0x3039 = 12345)
+            0xEA, 0x12, 0xD5, 0x43, // IP XOR'd
+        ];
+        let data = build_stun_response(&[(ATTR_XOR_MAPPED_ADDRESS, &attr_data)]);
+        let txn_id = [0u8; 12];
+        let result = parse_stun_response(&data, &txn_id);
+        assert_eq!(result, Some("203.0.113.1".to_string()));
+    }
+
+    #[test]
+    fn test_mapped_address_fallback_ipv4() {
+        // IP 192.168.1.1 = 0xC0A80101 (no XOR)
+        let attr_data: [u8; 8] = [
+            0x00, 0x01, // reserved + family (IPv4)
+            0x00, 0x50, // port 80
+            0xC0, 0xA8, 0x01, 0x01, // IP
+        ];
+        let data = build_stun_response(&[(ATTR_MAPPED_ADDRESS, &attr_data)]);
+        let txn_id = [0u8; 12];
+        let result = parse_stun_response(&data, &txn_id);
+        assert_eq!(result, Some("192.168.1.1".to_string()));
+    }
+
+    #[test]
+    fn test_response_too_short() {
+        let data = vec![0u8; 19]; // < 20 bytes
+        let txn_id = [0u8; 12];
+        assert_eq!(parse_stun_response(&data, &txn_id), None);
+    }
+
+    #[test]
+    fn test_wrong_msg_type() {
+        // Build with correct helper then overwrite msg_type to 0x0001 (Binding Request)
+        let mut data = build_stun_response(&[]);
+        data[0] = 0x00;
+        data[1] = 0x01;
+        let txn_id = [0u8; 12];
+        assert_eq!(parse_stun_response(&data, &txn_id), None);
+    }
+
+    #[test]
+    fn test_no_mapped_address_attributes() {
+        // Valid response with no attributes
+        let data = build_stun_response(&[]);
+        let txn_id = [0u8; 12];
+        assert_eq!(parse_stun_response(&data, &txn_id), None);
+    }
+
+    #[test]
+    fn test_xor_preferred_over_mapped() {
+        // XOR gives 203.0.113.1, MAPPED gives 192.168.1.1
+        let xor_data: [u8; 8] = [
+            0x00, 0x01,
+            0x11, 0x2B,
+            0xEA, 0x12, 0xD5, 0x43,
+        ];
+        let mapped_data: [u8; 8] = [
+            0x00, 0x01,
+            0x00, 0x50,
+            0xC0, 0xA8, 0x01, 0x01,
+        ];
+        // XOR listed first — should be preferred
+        let data = build_stun_response(&[
+            (ATTR_XOR_MAPPED_ADDRESS, &xor_data),
+            (ATTR_MAPPED_ADDRESS, &mapped_data),
+        ]);
+        let txn_id = [0u8; 12];
+        let result = parse_stun_response(&data, &txn_id);
+        assert_eq!(result, Some("203.0.113.1".to_string()));
+    }
+
+    #[test]
+    fn test_truncated_attribute_data() {
+        // Attribute claims 8 bytes but only 4 are present
+        let mut data = build_stun_response(&[]);
+        // Manually append a truncated XOR_MAPPED_ADDRESS attribute
+        let attr_type = ATTR_XOR_MAPPED_ADDRESS.to_be_bytes();
+        let attr_len = 8u16.to_be_bytes(); // claims 8 bytes
+        let truncated = [0x00, 0x01, 0x11, 0x2B]; // only 4 bytes
+        // Update message length
+        let new_msg_len = (attr_type.len() + attr_len.len() + truncated.len()) as u16;
+        data[2..4].copy_from_slice(&new_msg_len.to_be_bytes());
+        data.extend_from_slice(&attr_type);
+        data.extend_from_slice(&attr_len);
+        data.extend_from_slice(&truncated);
+
+        let txn_id = [0u8; 12];
+        // Should return None, not panic
+        assert_eq!(parse_stun_response(&data, &txn_id), None);
+    }
+}
+
+/// Generate 12 random bytes for transaction ID.
+fn rand_bytes() -> [u8; 12] {
+    let mut bytes = [0u8; 12];
+    // Use a simple approach: mix timestamp + counter
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap_or_default();
+    let nanos = now.as_nanos();
+    bytes[0..8].copy_from_slice(&(nanos as u64).to_le_bytes());
+    // Fill remaining with process-id based data
+    let pid = std::process::id();
+    bytes[8..12].copy_from_slice(&pid.to_le_bytes());
+    bytes
+}
--- a/rust/crates/remoteingress-protocol/Cargo.toml
+++ b/rust/crates/remoteingress-protocol/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "remoteingress-protocol"
+version = "2.0.0"
+edition = "2021"
+
+[dependencies]
+tokio = { version = "1", features = ["io-util"] }
--- a/rust/crates/remoteingress-protocol/src/lib.rs
+++ b/rust/crates/remoteingress-protocol/src/lib.rs
@@ -0,0 +1,315 @@
+use tokio::io::{AsyncRead, AsyncReadExt};
+
+// Frame type constants
+pub const FRAME_OPEN: u8 = 0x01;
+pub const FRAME_DATA: u8 = 0x02;
+pub const FRAME_CLOSE: u8 = 0x03;
+pub const FRAME_DATA_BACK: u8 = 0x04;
+pub const FRAME_CLOSE_BACK: u8 = 0x05;
+pub const FRAME_CONFIG: u8 = 0x06;     // Hub -> Edge: configuration update
+pub const FRAME_PING: u8 = 0x07;       // Hub -> Edge: heartbeat probe
+pub const FRAME_PONG: u8 = 0x08;       // Edge -> Hub: heartbeat response
+
+// Frame header size: 4 (stream_id) + 1 (type) + 4 (length) = 9 bytes
+pub const FRAME_HEADER_SIZE: usize = 9;
+
+// Maximum payload size (16 MB)
+pub const MAX_PAYLOAD_SIZE: u32 = 16 * 1024 * 1024;
+
+/// A single multiplexed frame.
+#[derive(Debug, Clone)]
+pub struct Frame {
+    pub stream_id: u32,
+    pub frame_type: u8,
+    pub payload: Vec<u8>,
+}
+
+/// Encode a frame into bytes: [stream_id:4][type:1][length:4][payload]
+pub fn encode_frame(stream_id: u32, frame_type: u8, payload: &[u8]) -> Vec<u8> {
+    let len = payload.len() as u32;
+    let mut buf = Vec::with_capacity(FRAME_HEADER_SIZE + payload.len());
+    buf.extend_from_slice(&stream_id.to_be_bytes());
+    buf.push(frame_type);
+    buf.extend_from_slice(&len.to_be_bytes());
+    buf.extend_from_slice(payload);
+    buf
+}
+
+/// Build a PROXY protocol v1 header line.
+/// Format: `PROXY TCP4 <client_ip> <edge_ip> <client_port> <dest_port>\r\n`
+pub fn build_proxy_v1_header(
+    client_ip: &str,
+    edge_ip: &str,
+    client_port: u16,
+    dest_port: u16,
+) -> String {
+    format!(
+        "PROXY TCP4 {} {} {} {}\r\n",
+        client_ip, edge_ip, client_port, dest_port
+    )
+}
+
+/// Stateful async frame reader that yields `Frame` values from an `AsyncRead`.
+pub struct FrameReader<R> {
+    reader: R,
+    header_buf: [u8; FRAME_HEADER_SIZE],
+}
+
+impl<R: AsyncRead + Unpin> FrameReader<R> {
+    pub fn new(reader: R) -> Self {
+        Self {
+            reader,
+            header_buf: [0u8; FRAME_HEADER_SIZE],
+        }
+    }
+
+    /// Read the next frame. Returns `None` on EOF, `Err` on protocol violation.
+    pub async fn next_frame(&mut self) -> Result<Option<Frame>, std::io::Error> {
+        // Read header
+        match self.reader.read_exact(&mut self.header_buf).await {
+            Ok(_) => {}
+            Err(e) if e.kind() == std::io::ErrorKind::UnexpectedEof => return Ok(None),
+            Err(e) => return Err(e),
+        }
+
+        let stream_id = u32::from_be_bytes([
+            self.header_buf[0],
+            self.header_buf[1],
+            self.header_buf[2],
+            self.header_buf[3],
+        ]);
+        let frame_type = self.header_buf[4];
+        let length = u32::from_be_bytes([
+            self.header_buf[5],
+            self.header_buf[6],
+            self.header_buf[7],
+            self.header_buf[8],
+        ]);
+
+        if length > MAX_PAYLOAD_SIZE {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                format!("frame payload too large: {} bytes", length),
+            ));
+        }
+
+        let mut payload = vec![0u8; length as usize];
+        if length > 0 {
+            self.reader.read_exact(&mut payload).await?;
+        }
+
+        Ok(Some(Frame {
+            stream_id,
+            frame_type,
+            payload,
+        }))
+    }
+
+    /// Consume the reader and return the inner stream.
+    pub fn into_inner(self) -> R {
+        self.reader
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_encode_frame() {
+        let data = b"hello";
+        let encoded = encode_frame(42, FRAME_DATA, data);
+        assert_eq!(encoded.len(), FRAME_HEADER_SIZE + data.len());
+        // stream_id = 42 in BE
+        assert_eq!(&encoded[0..4], &42u32.to_be_bytes());
+        // frame type
+        assert_eq!(encoded[4], FRAME_DATA);
+        // length
+        assert_eq!(&encoded[5..9], &5u32.to_be_bytes());
+        // payload
+        assert_eq!(&encoded[9..], b"hello");
+    }
+
+    #[test]
+    fn test_encode_empty_frame() {
+        let encoded = encode_frame(1, FRAME_CLOSE, &[]);
+        assert_eq!(encoded.len(), FRAME_HEADER_SIZE);
+        assert_eq!(&encoded[5..9], &0u32.to_be_bytes());
+    }
+
+    #[test]
+    fn test_proxy_v1_header() {
+        let header = build_proxy_v1_header("1.2.3.4", "5.6.7.8", 12345, 443);
+        assert_eq!(header, "PROXY TCP4 1.2.3.4 5.6.7.8 12345 443\r\n");
+    }
+
+    #[tokio::test]
+    async fn test_frame_reader() {
+        let frame1 = encode_frame(1, FRAME_OPEN, b"PROXY TCP4 1.2.3.4 5.6.7.8 1234 443\r\n");
+        let frame2 = encode_frame(1, FRAME_DATA, b"GET / HTTP/1.1\r\n");
+        let frame3 = encode_frame(1, FRAME_CLOSE, &[]);
+
+        let mut data = Vec::new();
+        data.extend_from_slice(&frame1);
+        data.extend_from_slice(&frame2);
+        data.extend_from_slice(&frame3);
+
+        let cursor = std::io::Cursor::new(data);
+        let mut reader = FrameReader::new(cursor);
+
+        let f1 = reader.next_frame().await.unwrap().unwrap();
+        assert_eq!(f1.stream_id, 1);
+        assert_eq!(f1.frame_type, FRAME_OPEN);
+        assert!(f1.payload.starts_with(b"PROXY"));
+
+        let f2 = reader.next_frame().await.unwrap().unwrap();
+        assert_eq!(f2.frame_type, FRAME_DATA);
+
+        let f3 = reader.next_frame().await.unwrap().unwrap();
+        assert_eq!(f3.frame_type, FRAME_CLOSE);
+        assert!(f3.payload.is_empty());
+
+        // EOF
+        assert!(reader.next_frame().await.unwrap().is_none());
+    }
+
+    #[test]
+    fn test_encode_frame_config_type() {
+        let payload = b"{\"listenPorts\":[443]}";
+        let encoded = encode_frame(0, FRAME_CONFIG, payload);
+        assert_eq!(encoded[4], FRAME_CONFIG);
+        assert_eq!(&encoded[0..4], &0u32.to_be_bytes());
+        assert_eq!(&encoded[9..], payload.as_slice());
+    }
+
+    #[test]
+    fn test_encode_frame_data_back_type() {
+        let payload = b"response data";
+        let encoded = encode_frame(7, FRAME_DATA_BACK, payload);
+        assert_eq!(encoded[4], FRAME_DATA_BACK);
+        assert_eq!(&encoded[0..4], &7u32.to_be_bytes());
+        assert_eq!(&encoded[5..9], &(payload.len() as u32).to_be_bytes());
+        assert_eq!(&encoded[9..], payload.as_slice());
+    }
+
+    #[test]
+    fn test_encode_frame_close_back_type() {
+        let encoded = encode_frame(99, FRAME_CLOSE_BACK, &[]);
+        assert_eq!(encoded[4], FRAME_CLOSE_BACK);
+        assert_eq!(&encoded[0..4], &99u32.to_be_bytes());
+        assert_eq!(&encoded[5..9], &0u32.to_be_bytes());
+        assert_eq!(encoded.len(), FRAME_HEADER_SIZE);
+    }
+
+    #[test]
+    fn test_encode_frame_large_stream_id() {
+        let encoded = encode_frame(u32::MAX, FRAME_DATA, b"x");
+        assert_eq!(&encoded[0..4], &u32::MAX.to_be_bytes());
+        assert_eq!(encoded[4], FRAME_DATA);
+        assert_eq!(&encoded[5..9], &1u32.to_be_bytes());
+        assert_eq!(encoded[9], b'x');
+    }
+
+    #[tokio::test]
+    async fn test_frame_reader_max_payload_rejection() {
+        let mut data = Vec::new();
+        data.extend_from_slice(&1u32.to_be_bytes());
+        data.push(FRAME_DATA);
+        data.extend_from_slice(&(MAX_PAYLOAD_SIZE + 1).to_be_bytes());
+
+        let cursor = std::io::Cursor::new(data);
+        let mut reader = FrameReader::new(cursor);
+
+        let result = reader.next_frame().await;
+        assert!(result.is_err());
+        let err = result.unwrap_err();
+        assert_eq!(err.kind(), std::io::ErrorKind::InvalidData);
+    }
+
+    #[tokio::test]
+    async fn test_frame_reader_eof_mid_header() {
+        // Only 5 bytes — not enough for a 9-byte header
+        let data = vec![0u8; 5];
+        let cursor = std::io::Cursor::new(data);
+        let mut reader = FrameReader::new(cursor);
+
+        // Should return Ok(None) on partial header EOF
+        let result = reader.next_frame().await;
+        assert!(result.unwrap().is_none());
+    }
+
+    #[tokio::test]
+    async fn test_frame_reader_eof_mid_payload() {
+        // Full header claiming 100 bytes of payload, but only 10 bytes present
+        let mut data = Vec::new();
+        data.extend_from_slice(&1u32.to_be_bytes());
+        data.push(FRAME_DATA);
+        data.extend_from_slice(&100u32.to_be_bytes());
+        data.extend_from_slice(&[0xAB; 10]);
+
+        let cursor = std::io::Cursor::new(data);
+        let mut reader = FrameReader::new(cursor);
+
+        let result = reader.next_frame().await;
+        assert!(result.is_err());
+    }
+
+    #[tokio::test]
+    async fn test_frame_reader_all_frame_types() {
+        let types = [
+            FRAME_OPEN,
+            FRAME_DATA,
+            FRAME_CLOSE,
+            FRAME_DATA_BACK,
+            FRAME_CLOSE_BACK,
+            FRAME_CONFIG,
+            FRAME_PING,
+            FRAME_PONG,
+        ];
+
+        let mut data = Vec::new();
+        for (i, &ft) in types.iter().enumerate() {
+            let payload = format!("payload_{}", i);
+            data.extend_from_slice(&encode_frame(i as u32, ft, payload.as_bytes()));
+        }
+
+        let cursor = std::io::Cursor::new(data);
+        let mut reader = FrameReader::new(cursor);
+
+        for (i, &ft) in types.iter().enumerate() {
+            let frame = reader.next_frame().await.unwrap().unwrap();
+            assert_eq!(frame.stream_id, i as u32);
+            assert_eq!(frame.frame_type, ft);
+            assert_eq!(frame.payload, format!("payload_{}", i).as_bytes());
+        }
+
+        assert!(reader.next_frame().await.unwrap().is_none());
+    }
+
+    #[tokio::test]
+    async fn test_frame_reader_zero_length_payload() {
+        let data = encode_frame(42, FRAME_CLOSE, &[]);
+        let cursor = std::io::Cursor::new(data);
+        let mut reader = FrameReader::new(cursor);
+
+        let frame = reader.next_frame().await.unwrap().unwrap();
+        assert_eq!(frame.stream_id, 42);
+        assert_eq!(frame.frame_type, FRAME_CLOSE);
+        assert!(frame.payload.is_empty());
+    }
+
+    #[test]
+    fn test_encode_frame_ping_pong() {
+        // PING: stream_id=0, empty payload (control frame)
+        let ping = encode_frame(0, FRAME_PING, &[]);
+        assert_eq!(ping[4], FRAME_PING);
+        assert_eq!(&ping[0..4], &0u32.to_be_bytes());
+        assert_eq!(ping.len(), FRAME_HEADER_SIZE);
+
+        // PONG: stream_id=0, empty payload (control frame)
+        let pong = encode_frame(0, FRAME_PONG, &[]);
+        assert_eq!(pong[4], FRAME_PONG);
+        assert_eq!(&pong[0..4], &0u32.to_be_bytes());
+        assert_eq!(pong.len(), FRAME_HEADER_SIZE);
+    }
+}
--- a/test/test.classes.node.ts
+++ b/test/test.classes.node.ts
@@ -0,0 +1,35 @@
+import { expect, tap } from '@push.rocks/tapbundle';
+import { EventEmitter } from 'events';
+import { RemoteIngressHub, RemoteIngressEdge } from '../ts/index.js';
+
+tap.test('RemoteIngressHub constructor does not throw', async () => {
+  const hub = new RemoteIngressHub();
+  expect(hub).toBeTruthy();
+});
+
+tap.test('RemoteIngressHub is instanceof EventEmitter', async () => {
+  const hub = new RemoteIngressHub();
+  expect(hub).toBeInstanceOf(EventEmitter);
+});
+
+tap.test('RemoteIngressHub.running is false before start', async () => {
+  const hub = new RemoteIngressHub();
+  expect(hub.running).toBeFalse();
+});
+
+tap.test('RemoteIngressEdge constructor does not throw', async () => {
+  const edge = new RemoteIngressEdge();
+  expect(edge).toBeTruthy();
+});
+
+tap.test('RemoteIngressEdge is instanceof EventEmitter', async () => {
+  const edge = new RemoteIngressEdge();
+  expect(edge).toBeInstanceOf(EventEmitter);
+});
+
+tap.test('RemoteIngressEdge.running is false before start', async () => {
+  const edge = new RemoteIngressEdge();
+  expect(edge.running).toBeFalse();
+});
+
+export default tap.start();
--- a/test/test.token.node.ts
+++ b/test/test.token.node.ts
@@ -0,0 +1,152 @@
+import { expect, tap } from '@push.rocks/tapbundle';
+import { encodeConnectionToken, decodeConnectionToken, type IConnectionTokenData } from '../ts/classes.token.js';
+
+tap.test('token roundtrip with unicode chars in secret', async () => {
+  const data: IConnectionTokenData = {
+    hubHost: 'hub.example.com',
+    hubPort: 8443,
+    edgeId: 'edge-1',
+    secret: 'sécret-with-ünïcödé-日本語',
+  };
+  const token = encodeConnectionToken(data);
+  const decoded = decodeConnectionToken(token);
+  expect(decoded.secret).toEqual(data.secret);
+});
+
+tap.test('token roundtrip with empty edgeId', async () => {
+  const data: IConnectionTokenData = {
+    hubHost: 'hub.test',
+    hubPort: 443,
+    edgeId: '',
+    secret: 'key',
+  };
+  const token = encodeConnectionToken(data);
+  const decoded = decodeConnectionToken(token);
+  expect(decoded.edgeId).toEqual('');
+});
+
+tap.test('token roundtrip with port 0', async () => {
+  const data: IConnectionTokenData = {
+    hubHost: 'h',
+    hubPort: 0,
+    edgeId: 'e',
+    secret: 's',
+  };
+  const token = encodeConnectionToken(data);
+  const decoded = decodeConnectionToken(token);
+  expect(decoded.hubPort).toEqual(0);
+});
+
+tap.test('token roundtrip with port 65535', async () => {
+  const data: IConnectionTokenData = {
+    hubHost: 'h',
+    hubPort: 65535,
+    edgeId: 'e',
+    secret: 's',
+  };
+  const token = encodeConnectionToken(data);
+  const decoded = decodeConnectionToken(token);
+  expect(decoded.hubPort).toEqual(65535);
+});
+
+tap.test('token roundtrip with very long secret (10k chars)', async () => {
+  const longSecret = 'x'.repeat(10000);
+  const data: IConnectionTokenData = {
+    hubHost: 'host',
+    hubPort: 1234,
+    edgeId: 'edge',
+    secret: longSecret,
+  };
+  const token = encodeConnectionToken(data);
+  const decoded = decodeConnectionToken(token);
+  expect(decoded.secret).toEqual(longSecret);
+  expect(decoded.secret.length).toEqual(10000);
+});
+
+tap.test('token string is URL-safe', async () => {
+  const data: IConnectionTokenData = {
+    hubHost: 'hub.example.com',
+    hubPort: 8443,
+    edgeId: 'edge-001',
+    secret: 'super+secret/key==with+special/chars',
+  };
+  const token = encodeConnectionToken(data);
+  expect(token).toMatch(/^[A-Za-z0-9_-]+$/);
+});
+
+tap.test('decode empty string throws', async () => {
+  let error: Error | undefined;
+  try {
+    decodeConnectionToken('');
+  } catch (e) {
+    error = e as Error;
+  }
+  expect(error).toBeInstanceOf(Error);
+});
+
+tap.test('decode valid base64 but wrong JSON shape throws missing required fields', async () => {
+  // Encode { "a": 1, "b": 2 } — valid JSON but wrong shape
+  const token = Buffer.from(JSON.stringify({ a: 1, b: 2 }), 'utf-8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+
+  let error: Error | undefined;
+  try {
+    decodeConnectionToken(token);
+  } catch (e) {
+    error = e as Error;
+  }
+  expect(error).toBeInstanceOf(Error);
+  expect(error!.message).toInclude('missing required fields');
+});
+
+tap.test('decode valid JSON but wrong field types throws missing required fields', async () => {
+  // h is number instead of string, p is string instead of number
+  const token = Buffer.from(JSON.stringify({ h: 123, p: 'notnum', e: 'e', s: 's' }), 'utf-8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+
+  let error: Error | undefined;
+  try {
+    decodeConnectionToken(token);
+  } catch (e) {
+    error = e as Error;
+  }
+  expect(error).toBeInstanceOf(Error);
+  expect(error!.message).toInclude('missing required fields');
+});
+
+tap.test('decode with extra fields succeeds', async () => {
+  const token = Buffer.from(
+    JSON.stringify({ h: 'host', p: 443, e: 'edge', s: 'secret', extra: 'ignored' }),
+    'utf-8',
+  )
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+
+  const decoded = decodeConnectionToken(token);
+  expect(decoded.hubHost).toEqual('host');
+  expect(decoded.hubPort).toEqual(443);
+  expect(decoded.edgeId).toEqual('edge');
+  expect(decoded.secret).toEqual('secret');
+});
+
+tap.test('encode is deterministic', async () => {
+  const data: IConnectionTokenData = {
+    hubHost: 'hub.test',
+    hubPort: 8443,
+    edgeId: 'edge-1',
+    secret: 'deterministic-key',
+  };
+  const token1 = encodeConnectionToken(data);
+  const token2 = encodeConnectionToken(data);
+  expect(token1).toEqual(token2);
+});
+
+export default tap.start();
--- a/test/test.ts
+++ b/test/test.ts
@@ -1,8 +1,61 @@
-import { expect, expectAsync, tap } from '@push.rocks/tapbundle';
-import * as remoteingress from '../ts/index.js'
+import { expect, tap } from '@push.rocks/tapbundle';
+import * as remoteingress from '../ts/index.js';

-tap.test('first test', async () => {
-  console.log(remoteingress)
-})
+tap.test('should export RemoteIngressHub', async () => {
+  expect(remoteingress.RemoteIngressHub).toBeTypeOf('function');
+});

-tap.start()
+tap.test('should export RemoteIngressEdge', async () => {
+  expect(remoteingress.RemoteIngressEdge).toBeTypeOf('function');
+});
+
+tap.test('should export encodeConnectionToken and decodeConnectionToken', async () => {
+  expect(remoteingress.encodeConnectionToken).toBeTypeOf('function');
+  expect(remoteingress.decodeConnectionToken).toBeTypeOf('function');
+});
+
+tap.test('should roundtrip encode → decode a connection token', async () => {
+  const data: remoteingress.IConnectionTokenData = {
+    hubHost: 'hub.example.com',
+    hubPort: 8443,
+    edgeId: 'edge-001',
+    secret: 'super-secret-key',
+  };
+  const token = remoteingress.encodeConnectionToken(data);
+  const decoded = remoteingress.decodeConnectionToken(token);
+  expect(decoded.hubHost).toEqual(data.hubHost);
+  expect(decoded.hubPort).toEqual(data.hubPort);
+  expect(decoded.edgeId).toEqual(data.edgeId);
+  expect(decoded.secret).toEqual(data.secret);
+});
+
+tap.test('should throw on malformed token', async () => {
+  let error: Error | undefined;
+  try {
+    remoteingress.decodeConnectionToken('not-valid-json!!!');
+  } catch (e) {
+    error = e as Error;
+  }
+  expect(error).toBeInstanceOf(Error);
+  expect(error!.message).toInclude('Invalid connection token');
+});
+
+tap.test('should throw on token with missing fields', async () => {
+  // Encode a partial object (missing 'p' and 's')
+  const partial = Buffer.from(JSON.stringify({ h: 'host', e: 'edge' }), 'utf-8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+
+  let error: Error | undefined;
+  try {
+    remoteingress.decodeConnectionToken(partial);
+  } catch (e) {
+    error = e as Error;
+  }
+  expect(error).toBeInstanceOf(Error);
+  expect(error!.message).toInclude('missing required fields');
+});
+
+export default tap.start();
--- a/ts/00_commitinfo_data.ts
+++ b/ts/00_commitinfo_data.ts
@@ -1,8 +1,8 @@
 /**
- * autocreated commitinfo by @pushrocks/commitinfo
+ * autocreated commitinfo by @push.rocks/commitinfo
 */
 export const commitinfo = {
  name: '@serve.zone/remoteingress',
-  version: '1.0.3',
-  description: 'Provides a service for creating private tunnels and reaching private clusters from the outside as part of the @serve.zone stack.'
+  version: '4.4.0',
+  description: 'Edge ingress tunnel for DcRouter - accepts incoming TCP connections at network edge and tunnels them to DcRouter SmartProxy preserving client IP via PROXY protocol v1.'
 }
--- a/ts/classes.remoteingressedge.ts
+++ b/ts/classes.remoteingressedge.ts
@@ -0,0 +1,241 @@
+import * as plugins from './plugins.js';
+import { EventEmitter } from 'events';
+import { decodeConnectionToken } from './classes.token.js';
+
+// Command map for the edge side of remoteingress-bin
+type TEdgeCommands = {
+  ping: {
+    params: Record<string, never>;
+    result: { pong: boolean };
+  };
+  startEdge: {
+    params: {
+      hubHost: string;
+      hubPort: number;
+      edgeId: string;
+      secret: string;
+    };
+    result: { started: boolean };
+  };
+  stopEdge: {
+    params: Record<string, never>;
+    result: { stopped: boolean; wasRunning?: boolean };
+  };
+  getEdgeStatus: {
+    params: Record<string, never>;
+    result: {
+      running: boolean;
+      connected: boolean;
+      publicIp: string | null;
+      activeStreams: number;
+      listenPorts: number[];
+    };
+  };
+};
+
+export interface IEdgeConfig {
+  hubHost: string;
+  hubPort?: number;
+  edgeId: string;
+  secret: string;
+}
+
+const MAX_RESTART_ATTEMPTS = 10;
+const MAX_RESTART_BACKOFF_MS = 30_000;
+
+export class RemoteIngressEdge extends EventEmitter {
+  private bridge: InstanceType<typeof plugins.smartrust.RustBridge<TEdgeCommands>>;
+  private started = false;
+  private stopping = false;
+  private savedConfig: IEdgeConfig | null = null;
+  private restartBackoffMs = 1000;
+  private restartAttempts = 0;
+  private statusInterval: ReturnType<typeof setInterval> | undefined;
+
+  constructor() {
+    super();
+
+    const packageDir = plugins.path.resolve(
+      plugins.path.dirname(new URL(import.meta.url).pathname),
+      '..',
+    );
+
+    this.bridge = new plugins.smartrust.RustBridge<TEdgeCommands>({
+      binaryName: 'remoteingress-bin',
+      cliArgs: ['--management'],
+      requestTimeoutMs: 30_000,
+      readyTimeoutMs: 10_000,
+      localPaths: [
+        // Platform-suffixed binary in dist_rust (production)
+        plugins.path.join(packageDir, 'dist_rust', `remoteingress-bin_${process.platform === 'win32' ? 'windows' : 'linux'}_${process.arch === 'x64' ? 'amd64' : process.arch}`),
+        // Exact binaryName fallback in dist_rust
+        plugins.path.join(packageDir, 'dist_rust', 'remoteingress-bin'),
+        // Development build paths (cargo output uses exact name)
+        plugins.path.join(packageDir, 'rust', 'target', 'release', 'remoteingress-bin'),
+        plugins.path.join(packageDir, 'rust', 'target', 'debug', 'remoteingress-bin'),
+      ],
+      searchSystemPath: false,
+    });
+
+    // Forward events from Rust binary
+    this.bridge.on('management:tunnelConnected', () => {
+      this.emit('tunnelConnected');
+    });
+    this.bridge.on('management:tunnelDisconnected', () => {
+      this.emit('tunnelDisconnected');
+    });
+    this.bridge.on('management:publicIpDiscovered', (data: { ip: string }) => {
+      this.emit('publicIpDiscovered', data);
+    });
+    this.bridge.on('management:portsAssigned', (data: { listenPorts: number[] }) => {
+      console.log(`[RemoteIngressEdge] Ports assigned by hub: ${data.listenPorts.join(', ')}`);
+      this.emit('portsAssigned', data);
+    });
+    this.bridge.on('management:portsUpdated', (data: { listenPorts: number[] }) => {
+      console.log(`[RemoteIngressEdge] Ports updated by hub: ${data.listenPorts.join(', ')}`);
+      this.emit('portsUpdated', data);
+    });
+  }
+
+  /**
+   * Start the edge — spawns the Rust binary and connects to the hub.
+   * Accepts either a connection token or an explicit IEdgeConfig.
+   */
+  public async start(config: { token: string } | IEdgeConfig): Promise<void> {
+    let edgeConfig: IEdgeConfig;
+
+    if ('token' in config) {
+      const decoded = decodeConnectionToken(config.token);
+      edgeConfig = {
+        hubHost: decoded.hubHost,
+        hubPort: decoded.hubPort,
+        edgeId: decoded.edgeId,
+        secret: decoded.secret,
+      };
+    } else {
+      edgeConfig = config;
+    }
+
+    this.savedConfig = edgeConfig;
+    this.stopping = false;
+
+    const spawned = await this.bridge.spawn();
+    if (!spawned) {
+      throw new Error('Failed to spawn remoteingress-bin');
+    }
+
+    // Register crash recovery handler
+    this.bridge.on('exit', this.handleCrashRecovery);
+
+    await this.bridge.sendCommand('startEdge', {
+      hubHost: edgeConfig.hubHost,
+      hubPort: edgeConfig.hubPort ?? 8443,
+      edgeId: edgeConfig.edgeId,
+      secret: edgeConfig.secret,
+    });
+
+    this.started = true;
+    this.restartAttempts = 0;
+    this.restartBackoffMs = 1000;
+
+    // Start periodic status logging
+    this.statusInterval = setInterval(async () => {
+      try {
+        const status = await this.getStatus();
+        console.log(
+          `[RemoteIngressEdge] Status: connected=${status.connected}, ` +
+          `streams=${status.activeStreams}, ports=[${status.listenPorts.join(',')}], ` +
+          `publicIp=${status.publicIp ?? 'unknown'}`
+        );
+      } catch {
+        // Bridge may be shutting down
+      }
+    }, 60_000);
+  }
+
+  /**
+   * Stop the edge and kill the Rust process.
+   */
+  public async stop(): Promise<void> {
+    this.stopping = true;
+    if (this.statusInterval) {
+      clearInterval(this.statusInterval);
+      this.statusInterval = undefined;
+    }
+    if (this.started) {
+      try {
+        await this.bridge.sendCommand('stopEdge', {} as Record<string, never>);
+      } catch {
+        // Process may already be dead
+      }
+      this.bridge.removeListener('exit', this.handleCrashRecovery);
+      this.bridge.kill();
+      this.started = false;
+    }
+  }
+
+  /**
+   * Get the current edge status.
+   */
+  public async getStatus() {
+    return this.bridge.sendCommand('getEdgeStatus', {} as Record<string, never>);
+  }
+
+  /**
+   * Check if the bridge is running.
+   */
+  public get running(): boolean {
+    return this.bridge.running;
+  }
+
+  /**
+   * Handle unexpected Rust binary crash — auto-restart with backoff.
+   */
+  private handleCrashRecovery = async (code: number | null, signal: string | null) => {
+    if (this.stopping || !this.started || !this.savedConfig) {
+      return;
+    }
+
+    console.error(
+      `[RemoteIngressEdge] Rust binary crashed (code=${code}, signal=${signal}), ` +
+      `attempt ${this.restartAttempts + 1}/${MAX_RESTART_ATTEMPTS}`
+    );
+
+    this.started = false;
+
+    if (this.restartAttempts >= MAX_RESTART_ATTEMPTS) {
+      console.error('[RemoteIngressEdge] Max restart attempts reached, giving up');
+      this.emit('crashRecoveryFailed');
+      return;
+    }
+
+    await new Promise(resolve => setTimeout(resolve, this.restartBackoffMs));
+    this.restartBackoffMs = Math.min(this.restartBackoffMs * 2, MAX_RESTART_BACKOFF_MS);
+    this.restartAttempts++;
+
+    try {
+      const spawned = await this.bridge.spawn();
+      if (!spawned) {
+        console.error('[RemoteIngressEdge] Failed to respawn binary');
+        return;
+      }
+
+      this.bridge.on('exit', this.handleCrashRecovery);
+
+      await this.bridge.sendCommand('startEdge', {
+        hubHost: this.savedConfig.hubHost,
+        hubPort: this.savedConfig.hubPort ?? 8443,
+        edgeId: this.savedConfig.edgeId,
+        secret: this.savedConfig.secret,
+      });
+
+      this.started = true;
+      this.restartAttempts = 0;
+      this.restartBackoffMs = 1000;
+      console.log('[RemoteIngressEdge] Successfully recovered from crash');
+      this.emit('crashRecovered');
+    } catch (err) {
+      console.error(`[RemoteIngressEdge] Crash recovery failed: ${err}`);
+    }
+  };
+}
--- a/ts/classes.remoteingresshub.ts
+++ b/ts/classes.remoteingresshub.ts
@@ -0,0 +1,231 @@
+import * as plugins from './plugins.js';
+import { EventEmitter } from 'events';
+
+// Command map for the hub side of remoteingress-bin
+type THubCommands = {
+  ping: {
+    params: Record<string, never>;
+    result: { pong: boolean };
+  };
+  startHub: {
+    params: {
+      tunnelPort: number;
+      targetHost?: string;
+      tlsCertPem?: string;
+      tlsKeyPem?: string;
+    };
+    result: { started: boolean };
+  };
+  stopHub: {
+    params: Record<string, never>;
+    result: { stopped: boolean; wasRunning?: boolean };
+  };
+  updateAllowedEdges: {
+    params: {
+      edges: Array<{ id: string; secret: string; listenPorts?: number[]; stunIntervalSecs?: number }>;
+    };
+    result: { updated: boolean };
+  };
+  getHubStatus: {
+    params: Record<string, never>;
+    result: {
+      running: boolean;
+      tunnelPort: number;
+      connectedEdges: Array<{
+        edgeId: string;
+        connectedAt: number;
+        activeStreams: number;
+        peerAddr: string;
+      }>;
+    };
+  };
+};
+
+export interface IHubConfig {
+  tunnelPort?: number;
+  targetHost?: string;
+  tls?: {
+    certPem?: string;
+    keyPem?: string;
+  };
+}
+
+type TAllowedEdge = { id: string; secret: string; listenPorts?: number[]; stunIntervalSecs?: number };
+
+const MAX_RESTART_ATTEMPTS = 10;
+const MAX_RESTART_BACKOFF_MS = 30_000;
+
+export class RemoteIngressHub extends EventEmitter {
+  private bridge: InstanceType<typeof plugins.smartrust.RustBridge<THubCommands>>;
+  private started = false;
+  private stopping = false;
+  private savedConfig: IHubConfig | null = null;
+  private savedEdges: TAllowedEdge[] = [];
+  private restartBackoffMs = 1000;
+  private restartAttempts = 0;
+
+  constructor() {
+    super();
+
+    const packageDir = plugins.path.resolve(
+      plugins.path.dirname(new URL(import.meta.url).pathname),
+      '..',
+    );
+
+    this.bridge = new plugins.smartrust.RustBridge<THubCommands>({
+      binaryName: 'remoteingress-bin',
+      cliArgs: ['--management'],
+      requestTimeoutMs: 30_000,
+      readyTimeoutMs: 10_000,
+      localPaths: [
+        // Platform-suffixed binary in dist_rust (production)
+        plugins.path.join(packageDir, 'dist_rust', `remoteingress-bin_${process.platform === 'win32' ? 'windows' : 'linux'}_${process.arch === 'x64' ? 'amd64' : process.arch}`),
+        // Exact binaryName fallback in dist_rust
+        plugins.path.join(packageDir, 'dist_rust', 'remoteingress-bin'),
+        // Development build paths (cargo output uses exact name)
+        plugins.path.join(packageDir, 'rust', 'target', 'release', 'remoteingress-bin'),
+        plugins.path.join(packageDir, 'rust', 'target', 'debug', 'remoteingress-bin'),
+      ],
+      searchSystemPath: false,
+    });
+
+    // Forward events from Rust binary
+    this.bridge.on('management:edgeConnected', (data: { edgeId: string; peerAddr: string }) => {
+      this.emit('edgeConnected', data);
+    });
+    this.bridge.on('management:edgeDisconnected', (data: { edgeId: string }) => {
+      this.emit('edgeDisconnected', data);
+    });
+    this.bridge.on('management:streamOpened', (data: { edgeId: string; streamId: number }) => {
+      this.emit('streamOpened', data);
+    });
+    this.bridge.on('management:streamClosed', (data: { edgeId: string; streamId: number }) => {
+      this.emit('streamClosed', data);
+    });
+  }
+
+  /**
+   * Start the hub — spawns the Rust binary and starts the tunnel server.
+   */
+  public async start(config: IHubConfig = {}): Promise<void> {
+    this.savedConfig = config;
+    this.stopping = false;
+
+    const spawned = await this.bridge.spawn();
+    if (!spawned) {
+      throw new Error('Failed to spawn remoteingress-bin');
+    }
+
+    // Register crash recovery handler
+    this.bridge.on('exit', this.handleCrashRecovery);
+
+    await this.bridge.sendCommand('startHub', {
+      tunnelPort: config.tunnelPort ?? 8443,
+      targetHost: config.targetHost ?? '127.0.0.1',
+      ...(config.tls?.certPem && config.tls?.keyPem
+        ? { tlsCertPem: config.tls.certPem, tlsKeyPem: config.tls.keyPem }
+        : {}),
+    });
+
+    this.started = true;
+    this.restartAttempts = 0;
+    this.restartBackoffMs = 1000;
+  }
+
+  /**
+   * Stop the hub and kill the Rust process.
+   */
+  public async stop(): Promise<void> {
+    this.stopping = true;
+    if (this.started) {
+      try {
+        await this.bridge.sendCommand('stopHub', {} as Record<string, never>);
+      } catch {
+        // Process may already be dead
+      }
+      this.bridge.removeListener('exit', this.handleCrashRecovery);
+      this.bridge.kill();
+      this.started = false;
+    }
+  }
+
+  /**
+   * Update the list of allowed edges that can connect to this hub.
+   */
+  public async updateAllowedEdges(edges: TAllowedEdge[]): Promise<void> {
+    this.savedEdges = edges;
+    await this.bridge.sendCommand('updateAllowedEdges', { edges });
+  }
+
+  /**
+   * Get the current hub status.
+   */
+  public async getStatus() {
+    return this.bridge.sendCommand('getHubStatus', {} as Record<string, never>);
+  }
+
+  /**
+   * Check if the bridge is running.
+   */
+  public get running(): boolean {
+    return this.bridge.running;
+  }
+
+  /**
+   * Handle unexpected Rust binary crash — auto-restart with backoff.
+   */
+  private handleCrashRecovery = async (code: number | null, signal: string | null) => {
+    if (this.stopping || !this.started || !this.savedConfig) {
+      return;
+    }
+
+    console.error(
+      `[RemoteIngressHub] Rust binary crashed (code=${code}, signal=${signal}), ` +
+      `attempt ${this.restartAttempts + 1}/${MAX_RESTART_ATTEMPTS}`
+    );
+
+    this.started = false;
+
+    if (this.restartAttempts >= MAX_RESTART_ATTEMPTS) {
+      console.error('[RemoteIngressHub] Max restart attempts reached, giving up');
+      this.emit('crashRecoveryFailed');
+      return;
+    }
+
+    await new Promise(resolve => setTimeout(resolve, this.restartBackoffMs));
+    this.restartBackoffMs = Math.min(this.restartBackoffMs * 2, MAX_RESTART_BACKOFF_MS);
+    this.restartAttempts++;
+
+    try {
+      const spawned = await this.bridge.spawn();
+      if (!spawned) {
+        console.error('[RemoteIngressHub] Failed to respawn binary');
+        return;
+      }
+
+      this.bridge.on('exit', this.handleCrashRecovery);
+
+      const config = this.savedConfig;
+      await this.bridge.sendCommand('startHub', {
+        tunnelPort: config.tunnelPort ?? 8443,
+        targetHost: config.targetHost ?? '127.0.0.1',
+        ...(config.tls?.certPem && config.tls?.keyPem
+          ? { tlsCertPem: config.tls.certPem, tlsKeyPem: config.tls.keyPem }
+          : {}),
+      });
+
+      // Restore allowed edges
+      if (this.savedEdges.length > 0) {
+        await this.bridge.sendCommand('updateAllowedEdges', { edges: this.savedEdges });
+      }
+
+      this.started = true;
+      this.restartAttempts = 0;
+      this.restartBackoffMs = 1000;
+      console.log('[RemoteIngressHub] Successfully recovered from crash');
+      this.emit('crashRecovered');
+    } catch (err) {
+      console.error(`[RemoteIngressHub] Crash recovery failed: ${err}`);
+    }
+  };
+}
--- a/ts/classes.token.ts
+++ b/ts/classes.token.ts
@@ -0,0 +1,66 @@
+/**
+ * Connection token utilities for RemoteIngress edge connections.
+ * A token is a base64url-encoded compact JSON object carrying hub connection details.
+ */
+
+export interface IConnectionTokenData {
+  hubHost: string;
+  hubPort: number;
+  edgeId: string;
+  secret: string;
+}
+
+/**
+ * Encode connection data into a single opaque token string (base64url).
+ */
+export function encodeConnectionToken(data: IConnectionTokenData): string {
+  const compact = JSON.stringify({
+    h: data.hubHost,
+    p: data.hubPort,
+    e: data.edgeId,
+    s: data.secret,
+  });
+  // base64url: standard base64 with + → -, / → _, trailing = stripped
+  return Buffer.from(compact, 'utf-8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+/**
+ * Decode a connection token back into its constituent fields.
+ * Throws on malformed or incomplete tokens.
+ */
+export function decodeConnectionToken(token: string): IConnectionTokenData {
+  let parsed: { h?: unknown; p?: unknown; e?: unknown; s?: unknown };
+  try {
+    // Restore standard base64 from base64url
+    let base64 = token.replace(/-/g, '+').replace(/_/g, '/');
+    // Re-add padding
+    const remainder = base64.length % 4;
+    if (remainder === 2) base64 += '==';
+    else if (remainder === 3) base64 += '=';
+
+    const json = Buffer.from(base64, 'base64').toString('utf-8');
+    parsed = JSON.parse(json);
+  } catch {
+    throw new Error('Invalid connection token');
+  }
+
+  if (
+    typeof parsed.h !== 'string' ||
+    typeof parsed.p !== 'number' ||
+    typeof parsed.e !== 'string' ||
+    typeof parsed.s !== 'string'
+  ) {
+    throw new Error('Invalid connection token: missing required fields');
+  }
+
+  return {
+    hubHost: parsed.h,
+    hubPort: parsed.p,
+    edgeId: parsed.e,
+    secret: parsed.s,
+  };
+}
--- a/ts/connector.private.ts
+++ b/ts/connector.private.ts
@@ -1,38 +0,0 @@
-import * as plugins from './plugins.js';
-
-export class ConnectorPrivate {
-  private targetHost: string;
-  private targetPort: number;
-
-  constructor(targetHost: string, targetPort: number = 4000) {
-    this.targetHost = targetHost;
-    this.targetPort = targetPort;
-    this.connectToPublicRemoteConnector();
-  }
-
-  private connectToPublicRemoteConnector(): void {
-    const options = {
-      // Include CA certificate if necessary, for example:
-      // ca: fs.readFileSync('path/to/ca.pem'),
-      rejectUnauthorized: true // Only set this to true if you are sure about the server's certificate
-    };
-
-    const tunnel = plugins.tls.connect(this.targetPort, options, () => {
-      console.log('Connected to PublicRemoteConnector on port 4000');
-    });
-
-    tunnel.on('data', (data: Buffer) => {
-      const targetConnection = plugins.tls.connect({
-        host: this.targetHost,
-        port: this.targetPort,
-        // Include necessary options for the target connection
-      }, () => {
-        targetConnection.write(data);
-      });
-
-      targetConnection.on('data', (backData: Buffer) => {
-        tunnel.write(backData); // Send data back through the tunnel
-      });
-    });
-  }
-}
--- a/ts/connector.public.ts
+++ b/ts/connector.public.ts
@@ -1,45 +0,0 @@
-import * as plugins from './plugins.js';
-
-class PublicRemoteConnector {
-  private tunnel: plugins.tls.TLSSocket | null = null;
-
-  constructor() {
-    this.createTunnel();
-    this.listenOnPorts();
-  }
-
-  private createTunnel(): void {
-    const options = {
-      key: plugins.fs.readFileSync('path/to/key.pem'),
-      cert: plugins.fs.readFileSync('path/to/cert.pem'),
-    };
-
-    const server = plugins.tls.createServer(options, (socket: plugins.tls.TLSSocket) => {
-      this.tunnel = socket;
-      console.log('Tunnel established with LocalConnector');
-    });
-
-    server.listen(4000, () => {
-      console.log('PublicRemoteConnector listening for tunnel on port 4000');
-    });
-  }
-
-  private listenOnPorts(): void {
-    // Example for port 80, adapt for port 443 similarly
-    // Note: TLS for the initial connection might not apply directly for HTTP/HTTPS traffic without additional setup
-    const options = {
-      key: plugins.fs.readFileSync('path/to/key.pem'),
-      cert: plugins.fs.readFileSync('path/to/cert.pem'),
-    };
-
-    plugins.tls.createServer(options, (socket: plugins.tls.TLSSocket) => {
-      console.log('Received connection, tunneling to LocalConnector');
-      if (this.tunnel) {
-        socket.pipe(this.tunnel).pipe(socket);
-      } else {
-        console.log('Tunnel to LocalConnector not established');
-        socket.end();
-      }
-    }).listen(80); // Repeat this block for any other ports you wish to listen on
-  }
-}
--- a/ts/index.ts
+++ b/ts/index.ts
@@ -1,14 +1,3 @@
-import * as plugins from './plugins.js';
-
-import { ConnectorPublic } from './connector.public.js';
-import { ConnectorPrivate } from './connector.private.js';
-
-export {
-  ConnectorPublic,
-  ConnectorPrivate
-}
-
-export const runCli = async () => {
-  const qenv = new plugins.qenv.Qenv();
-  const mode = await qenv.getEnvVarOnDemand('MODE');
-}
+export * from './classes.remoteingresshub.js';
+export * from './classes.remoteingressedge.js';
+export * from './classes.token.js';
--- a/ts/plugins.ts
+++ b/ts/plugins.ts
@@ -1,15 +1,7 @@
 // node native scope
-import * as tls from 'tls';
-import * as fs from 'fs';
-
-export {
-  tls,
-  fs,
-}
+import * as path from 'path';
+export { path };

 // @push.rocks scope
-import * as qenv from '@push.rocks/qenv';
-
-export {
-  qenv,
-}
+import * as smartrust from '@push.rocks/smartrust';
+export { smartrust };
Author	SHA1	Message	Date
Juergen Kunz	86d4e9889a	v4.4.0	2026-03-03 11:47:50 +00:00
Juergen Kunz	45a2811f3e	feat(remoteingress): add heartbeat PING/PONG and liveness timeouts; implement fast-reconnect/backoff reset and JS crash-recovery auto-restart	2026-03-03 11:47:50 +00:00
Juergen Kunz	d6a07c28a0	v4.3.0	2026-02-26 23:47:16 +00:00
Juergen Kunz	56a14aa7c5	feat(hub): add optional TLS certificate/key support to hub start config and bridge	2026-02-26 23:47:16 +00:00
Juergen Kunz	417f62e646	v4.2.0	2026-02-26 23:02:23 +00:00
Juergen Kunz	bda82f32ca	feat(core): expose edge peer address in hub events and migrate writers to channel-based, non-blocking framing with stream limits and timeouts	2026-02-26 23:02:23 +00:00
Juergen Kunz	4b06cb1b24	v4.1.0	2026-02-26 17:39:40 +00:00
Juergen Kunz	1aae4b8c8e	feat(remoteingress-bin): use mimalloc as the global allocator to reduce memory overhead and improve allocation performance	2026-02-26 17:39:40 +00:00
Juergen Kunz	3474e8c310	v4.0.1	2026-02-26 12:37:40 +00:00
Juergen Kunz	3df20df2a1	fix(hub): cancel per-stream tokens on stream close and avoid duplicate StreamClosed events; bump @types/node devDependency to ^25.3.0	2026-02-26 12:37:39 +00:00
Juergen Kunz	929eec9825	v4.0.0	2026-02-19 08:45:32 +00:00
Juergen Kunz	4e511b3350	BREAKING CHANGE(remoteingress-core): add cancellation tokens and cooperative shutdown; switch event channels to bounded mpsc and improve cleanup	2026-02-19 08:45:32 +00:00
Juergen Kunz	a3af2487b7	v3.3.0	2026-02-18 18:41:25 +00:00
Juergen Kunz	51de25d767	feat(readme): document dynamic port assignment and runtime port updates; clarify TLS multiplexing, frame format, and handshake sequence	2026-02-18 18:41:25 +00:00
Juergen Kunz	7b8c4e1af5	v3.2.1	2026-02-18 18:35:53 +00:00
Juergen Kunz	0459cd2af6	fix(tests): add comprehensive unit and async tests across Rust crates and TypeScript runtime	2026-02-18 18:35:53 +00:00
Juergen Kunz	6fdc9ea918	v3.2.0	2026-02-18 18:20:53 +00:00
Juergen Kunz	d869589663	feat(remoteingress (edge/hub/protocol)): add dynamic port configuration: handshake, FRAME_CONFIG frames, and hot-reloadable listeners	2026-02-18 18:20:53 +00:00
Juergen Kunz	072362a8e6	v3.1.1	2026-02-18 06:01:33 +00:00
Juergen Kunz	b628a5f964	fix(readme): update README: add issue reporting/security section, document connection tokens and token utilities, clarify architecture/API and improve examples/formatting	2026-02-18 06:01:33 +00:00
Juergen Kunz	19e8003c77	v3.1.0	2026-02-17 19:36:40 +00:00
Juergen Kunz	93592bf909	feat(edge): support connection tokens when starting an edge and add token encode/decode utilities	2026-02-17 19:36:40 +00:00
Juergen Kunz	73fc4ea28e	v3.0.4	2026-02-17 10:04:54 +00:00
Juergen Kunz	5321e5f0e0	fix(build): bump dev dependencies, update build script, and refresh README docs	2026-02-17 10:04:54 +00:00
Juergen Kunz	1f90b91252	v3.0.3	2026-02-17 09:56:23 +00:00
Juergen Kunz	e25b193f59	fix(rust,ts): initialize rustls ring CryptoProvider at startup; add rustls dependency and features; make native binary lookup platform-aware	2026-02-17 09:56:23 +00:00
Juergen Kunz	ad67f2e265	v3.0.2	2026-02-16 13:15:12 +00:00
Juergen Kunz	ce5074c57d	fix(readme): Document Hub/Edge architecture and new RemoteIngressHub/RemoteIngressEdge API; add Rust core binary, protocol and usage details; note removal of ConnectorPublic/ConnectorPrivate (breaking change)	2026-02-16 13:15:12 +00:00
Juergen Kunz	f79b5cf541	v3.0.1	2026-02-16 11:23:08 +00:00
Juergen Kunz	601a13de1a	fix(remoteingress): no changes detected in diff; no code modifications to release	2026-02-16 11:23:08 +00:00
Juergen Kunz	1d1fbaed80	v3.0.0	2026-02-16 11:22:23 +00:00
Juergen Kunz	a144f5a798	BREAKING CHANGE(remoteingress): migrate core to Rust, add RemoteIngressHub/RemoteIngressEdge JS bridge, and bump package to v2.0.0	2026-02-16 11:22:23 +00:00
Philipp Kunz	a3970edf23	1.0.4	2024-04-14 03:40:56 +02:00
Philipp Kunz	c8fe27143c	fix(core): update	2024-04-14 03:40:55 +02:00