v3.2.0

changelog.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 2026-02-18 - 3.2.0 - feat(remoteingress (edge/hub/protocol))
+add dynamic port configuration: handshake, FRAME_CONFIG frames, and hot-reloadable listeners
+
+- Introduce a JSON handshake from hub -> edge with initial listen ports and stun interval so edges can configure listeners at connect time.
+- Add FRAME_CONFIG (0x06) to the protocol and implement runtime config updates pushed from hub to connected edges.
+- Edge now applies initial ports and supports hot-reloading: spawn/abort listeners when ports change, and emit PortsAssigned / PortsUpdated events.
+- Hub now stores allowed edge metadata (listen_ports, stun_interval_secs), sends handshake responses on auth, and forwards config updates to connected edges.
+- TypeScript bridge/client updated to emit new port events and periodically log status; updateAllowedEdges API accepts listenPorts and stunIntervalSecs.
+- Stun interval handling moved to use handshake-provided/stored value instead of config.listen_ports being static.
+
+## 2026-02-18 - 3.1.1 - fix(readme)
+update README: add issue reporting/security section, document connection tokens and token utilities, clarify architecture/API and improve examples/formatting
+
+- Added an 'Issue Reporting and Security' section linking to community.foss.global for bug/security reports and contributor onboarding.
+- Documented connection tokens: encodeConnectionToken/decodeConnectionToken utilities, token format (base64url), and examples for hub and edge provisioning.
+- Clarified Hub/Edge usage and examples: condensed event handlers, added token-based start() example, and provided explicit config alternative.
+- Improved README formatting: added emojis, rephrased architecture descriptions, fixed wording and license path capitalization, and expanded example scenarios and interfaces.
+
+## 2026-02-17 - 3.1.0 - feat(edge)
+support connection tokens when starting an edge and add token encode/decode utilities
+
+- Add classes.token.ts with encodeConnectionToken/decodeConnectionToken using a base64url compact JSON format
+- Export token utilities from ts/index.ts
+- RemoteIngressEdge.start now accepts a { token } option and decodes it to an IEdgeConfig before starting
+- Add tests covering export availability, encode→decode roundtrip, malformed token, and missing fields
+- Non-breaking change — recommend a minor version bump
+
+## 2026-02-17 - 3.0.4 - fix(build)
+bump dev dependencies, update build script, and refresh README docs
+
+- Bumped devDependencies: @git.zone/tsbuild ^2.1.25 → ^4.1.2, @git.zone/tsbundle ^2.0.5 → ^2.8.3, @git.zone/tsrun ^1.2.46 → ^2.0.1, @git.zone/tstest ^1.0.44 → ^3.1.8, @push.rocks/tapbundle ^5.0.15 → ^6.0.3, @types/node ^20.8.7 → ^25.2.3
+- Bumped runtime dependency: @push.rocks/qenv ^6.0.5 → ^6.1.3
+- Changed build script: replaced "tsbuild --web --allowimplicitany" with "tsbuild tsfolders --allowimplicitany" (kept tsrust invocation)
+- README updates: added RustBridge notes (localPaths must be full file paths), production binary naming conventions, rust core uses ring as rustls provider; removed emoji from example console output; clarified stunIntervalSecs is optional; renamed example status variable to edgeStatus; minor wire-protocol formatting and wording/legal text tweaks
+
+## 2026-02-17 - 3.0.3 - fix(rust,ts)
+initialize rustls ring CryptoProvider at startup; add rustls dependency and features; make native binary lookup platform-aware
+
+- Install rustls::crypto::ring default_provider at startup to ensure ring-based crypto is available before any TLS usage.
+- Add rustls dependency to remoteingress-bin and update remoteingress-core rustls configuration (disable default-features; enable ring, logging, std, tls12).
+- Adjust TS classes to prefer platform-suffixed production binaries, add exact fallback names, and include explicit cargo output paths for release/debug.
+- Cargo.lock updated to include rustls entry.
+
+## 2026-02-16 - 3.0.2 - fix(readme)
+Document Hub/Edge architecture and new RemoteIngressHub/RemoteIngressEdge API; add Rust core binary, protocol and usage details; note removal of ConnectorPublic/ConnectorPrivate (breaking change)
+
+- Adds comprehensive README describing v3 Hub↔Edge topology and usage examples
+- Introduces Rust core binary (remoteingress-bin) and RustBridge IPC via @push.rocks/smartrust
+- Documents custom multiplexed binary frame protocol over TLS and PROXY protocol v1 for client IP preservation
+- Notes STUN-based public IP discovery and cross-compiled linux/amd64 and linux/arm64 binaries
+- Calls out removal/rename of ConnectorPublic/ConnectorPrivate to RemoteIngressHub/RemoteIngressEdge (breaking API change)
+- Updates install instruction to use pnpm and expands API reference, events, and examples
+
 ## 2026-02-16 - 3.0.1 - fix(remoteingress)
 no changes detected in diff; no code modifications to release
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/remoteingress",
-  "version": "3.0.1",
+  "version": "3.2.0",
   "private": false,
   "description": "Edge ingress tunnel for DcRouter - accepts incoming TCP connections at network edge and tunnels them to DcRouter SmartProxy preserving client IP via PROXY protocol v1.",
   "main": "dist_ts/index.js",
@@ -10,20 +10,20 @@
   "license": "MIT",
   "scripts": {
     "test": "(tstest test/ --web)",
-    "build": "(tsbuild --web --allowimplicitany && tsrust)",
+    "build": "(tsbuild tsfolders --allowimplicitany && tsrust)",
     "buildDocs": "(tsdoc)"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^2.1.25",
+    "@git.zone/tsbuild": "^4.1.2",
-    "@git.zone/tsbundle": "^2.0.5",
+    "@git.zone/tsbundle": "^2.8.3",
-    "@git.zone/tsrun": "^1.2.46",
+    "@git.zone/tsrun": "^2.0.1",
     "@git.zone/tsrust": "^1.3.0",
-    "@git.zone/tstest": "^1.0.44",
+    "@git.zone/tstest": "^3.1.8",
-    "@push.rocks/tapbundle": "^5.0.15",
+    "@push.rocks/tapbundle": "^6.0.3",
-    "@types/node": "^20.8.7"
+    "@types/node": "^25.2.3"
   },
   "dependencies": {
-    "@push.rocks/qenv": "^6.0.5",
+    "@push.rocks/qenv": "^6.1.3",
     "@push.rocks/smartrust": "^1.2.1"
   },
   "repository": {

pnpm-lock.yaml

@@ -9,33 +9,33 @@ importers:
   .:
     dependencies:
       '@push.rocks/qenv':
-        specifier: ^6.0.5
+        specifier: ^6.1.3
         version: 6.1.3
       '@push.rocks/smartrust':
         specifier: ^1.2.1
         version: 1.2.1
     devDependencies:
       '@git.zone/tsbuild':
-        specifier: ^2.1.25
+        specifier: ^4.1.2
-        version: 2.7.3
+        version: 4.1.2
       '@git.zone/tsbundle':
-        specifier: ^2.0.5
+        specifier: ^2.8.3
         version: 2.8.3
       '@git.zone/tsrun':
-        specifier: ^1.2.46
+        specifier: ^2.0.1
-        version: 1.6.2
+        version: 2.0.1
       '@git.zone/tsrust':
         specifier: ^1.3.0
         version: 1.3.0
       '@git.zone/tstest':
-        specifier: ^1.0.44
+        specifier: ^3.1.8
-        version: 1.11.5(socks@2.8.7)(typescript@5.9.3)
+        version: 3.1.8(socks@2.8.7)(typescript@5.9.3)
       '@push.rocks/tapbundle':
-        specifier: ^5.0.15
+        specifier: ^6.0.3
-        version: 5.6.3(socks@2.8.7)
+        version: 6.0.3(socks@2.8.7)
       '@types/node':
-        specifier: ^20.8.7
+        specifier: ^25.2.3
-        version: 20.19.33
+        version: 25.2.3
 
 packages:
 
@@ -427,8 +427,8 @@ packages:
   '@esm-bundle/chai@4.3.4-fix.0':
     resolution: {integrity: sha512-26SKdM4uvDWlY8/OOOxSB1AqQWeBosCX3wRYUZO7enTAj03CtVxIiCimYVG2WpULcyV51qapK4qTovwkUr5Mlw==}
 
-  '@git.zone/tsbuild@2.7.3':
+  '@git.zone/tsbuild@4.1.2':
-    resolution: {integrity: sha512-GMM6VU6TcVvYINfV6b1ZVGZXYhdtriYyAHifvrn8IdRar6thIN3ig3N2J/S1kmX2KLrBbx0JyF3tNChHdNR+wA==}
+    resolution: {integrity: sha512-S518ulKveO76pS6jrAELrnFaCw5nDAIZD9j6QzVmLYDiZuJmlRwPK3/2E8ugQ+b7ffpkwJ9MT685ooEGDcWQ4Q==}
     hasBin: true
 
   '@git.zone/tsbundle@2.8.3':
@@ -439,16 +439,16 @@ packages:
     resolution: {integrity: sha512-dkgaDBTzZJ53lAV72r7OW/W7l/KqpkncFuPojr11JO35OKAbjjDhZbAwPv4oGX9NplyXrhC5VJRPNX/orqNTHA==}
     hasBin: true
 
-  '@git.zone/tsrun@1.6.2':
+  '@git.zone/tsrun@2.0.1':
-    resolution: {integrity: sha512-SOHbQqBg3/769/jPQcdpPCmugdEtIJINiG0O6aWx+su91GvGhheha5dAhccsCutJYErr+aJcBqBYuUYfhOfkFQ==}
+    resolution: {integrity: sha512-NEcnsjvlC1o3Z6SS3VhKCf6Ev+Sh4EAinmggslrIR/ppMrvjDbXNFXoyr3PB+GLeSAR0JRZ1fGvVYjpEzjBdIg==}
     hasBin: true
 
   '@git.zone/tsrust@1.3.0':
     resolution: {integrity: sha512-dvmTAiM04Pkd7J1Gail3fu7aasmILQhC5vKL71/g6HYhpvl16/c+Dj3We5G4HsFr0jvAr+Xu570ZGEuZrtRcCg==}
     hasBin: true
 
-  '@git.zone/tstest@1.11.5':
+  '@git.zone/tstest@3.1.8':
-    resolution: {integrity: sha512-7YHFNGMjUd3WOFXi0DlUieQcdxzwYqxL7n2XDE7SOUd8XpMxVsGsY2SuwBKXlbT10By/H3thQTsy+Hjy9ahGWA==}
+    resolution: {integrity: sha512-nmiLGeOkKMkLDyIk5BUBLx5ExskFbKHKlPdrWCARPVFkU4cAAiuIyJWVfLwISoS0TO/zSInLqArPwIc76yvaNw==}
     hasBin: true
 
   '@hapi/bourne@3.0.0':
@@ -693,6 +693,9 @@ packages:
   '@push.rocks/smartbucket@3.3.10':
     resolution: {integrity: sha512-0H2MioALspC8Aj0Q1FPCs2w4k2u9oJg7Q5yM8+1TZo7aRfrdxgM5HQ7z3apUaqC3ZEDewW6vSlttjHFHhMEC3A==}
 
+  '@push.rocks/smartbucket@4.4.1':
+    resolution: {integrity: sha512-68GFLgJKW+LXvuN+yuV8O/FozGMecraoT+PkI5whdRPFe7N3u2iYIHWAUjvQvVU4ygpdJv0kih2JDf5k3PYycw==}
+
   '@push.rocks/smartbuffer@3.0.5':
     resolution: {integrity: sha512-pWYF08Mn8s/KF/9nHRk7pZPzuMjmYVQay2c5gGexdayxn1W4eCSYYhWH73vR2JBfGeGq/izbRNuUuEaIEeTIKA==}
 
@@ -733,9 +736,6 @@ packages:
   '@push.rocks/smartexit@1.1.0':
     resolution: {integrity: sha512-GD8VLIbxQuwvhPXwK4eH162XAYSj+M3wGKWGNO3i1iY4bj8P3BARcgsWx6/ntN3aCo5ygWtrevrfD5iecYY2Ng==}
 
-  '@push.rocks/smartexpect@1.6.1':
-    resolution: {integrity: sha512-NFQXEPkGiMNxyvFwKyzDWe3ADYdf8KNvIcV7TGNZZT3uPQtk65te4Q+a1cWErjP/61yE9XdYiQA66QQp+TV9IQ==}
-
   '@push.rocks/smartexpect@2.5.0':
     resolution: {integrity: sha512-yoyuCoQ3tTiAriuvF+/09fNbVfFnacudL2SwHSzPhX/ugaE7VTSWXQ9A34eKOWvil0MPyDcOY36fVZDxvrPd8A==}
 
@@ -850,6 +850,9 @@ packages:
   '@push.rocks/smarts3@2.2.7':
     resolution: {integrity: sha512-9ZXGMlmUL2Wd+YJO0xOB8KyqPf4V++fWJvTq4s76bnqEuaCr9OLfq6czhban+i4cD3ZdIjehfuHqctzjuLw8Jw==}
 
+  '@push.rocks/smarts3@3.0.3':
+    resolution: {integrity: sha512-Y9nXMwurthJ9Z7yi0RwjhPFUC58aY8Mhia8kFo6Xj1tBM4LE8Oxg/ydejF7otHqQGr3QyqV5C4YrDEG17rUuzg==}
+
   '@push.rocks/smartshell@3.3.0':
     resolution: {integrity: sha512-m0w618H6YBs+vXGz1CgS4nPi5CUAnqRtckcS9/koGwfcIx1IpjqmiP47BoCTbdgcv0IPUxQVBG1IXTHPuZ8Z5g==}
 
@@ -892,8 +895,8 @@ packages:
   '@push.rocks/smartyaml@3.0.4':
     resolution: {integrity: sha512-1JRt+hnoc2zHw3AW+vXKlCdSVwqOmY/01fu+2HBviS0UDjoZCa+/rp6E3GaQb5lEEafKi8ENbffAfjXXp3N2xQ==}
 
-  '@push.rocks/tapbundle@5.6.3':
+  '@push.rocks/tapbundle@6.0.3':
-    resolution: {integrity: sha512-hFzsf59rg1K70i45llj7PCyyCZp7JW19XRR+Q1gge1T0pBN8Wi53aYqP/2qtxdMiNVe2s3ESp6VJZv3sLOMYPQ==}
+    resolution: {integrity: sha512-SuP14V6TPdtd1y1CYTvwTKJdpHa7EzY55NfaaEMxW4oRKvHgJiOiPEiR/IrtL9tSiDMSfrx12waTMgZheYaBug==}
 
   '@push.rocks/taskbuffer@3.5.0':
     resolution: {integrity: sha512-Y9WwIEIyp6oVFdj06j84tfrZIvjhbMb3DF52rYxlTeYLk3W7RPhSg1bGPCbtkXWeKdBrSe37V90BkOG7Qq8Pqg==}
@@ -1495,12 +1498,12 @@ packages:
   '@types/node-forge@1.3.14':
     resolution: {integrity: sha512-mhVF2BnD4BO+jtOp7z1CdzaK4mbuK0LLQYAvdOLqHTavxFNq4zA1EmYkpnFjP8HOUzedfQkRnp0E2ulSAYSzAw==}
 
-  '@types/node@20.19.33':
-    resolution: {integrity: sha512-Rs1bVAIdBs5gbTIKza/tgpMuG1k3U/UMJLWecIMxNdJFDMzcM5LOiLVRYh3PilWEYDIeUDv7bpiHPLPsbydGcw==}
-
   '@types/node@22.19.11':
     resolution: {integrity: sha512-BH7YwL6rA93ReqeQS1c4bsPpcfOmJasG+Fkr6Y59q83f9M1WcBRHR2vM+P9eOisYRcN3ujQoiZY8uk5W+1WL8w==}
 
+  '@types/node@25.2.3':
+    resolution: {integrity: sha512-m0jEgYlYz+mDJZ2+F4v8D1AyQb+QzsNqRuI7xg1VQX/KlKS0qT9r1Mo16yo5F/MtifXFgaofIFsdFMox2SxIbQ==}
+
   '@types/parse5@6.0.3':
     resolution: {integrity: sha512-SuT16Q1K51EAVPz1K29DJ/sXjhSQ0zjvsypYJ6tlwVsRV9jwW5Adq2ch8Dq8kDBCkYnELS7N7VNCSB5nC56t/g==}
 
@@ -3983,6 +3986,9 @@ packages:
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
+  undici-types@7.16.0:
+    resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==}
+
   unified@11.0.5:
     resolution: {integrity: sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==}
 
@@ -4916,13 +4922,14 @@ snapshots:
     dependencies:
       '@types/chai': 4.3.20
 
-  '@git.zone/tsbuild@2.7.3':
+  '@git.zone/tsbuild@4.1.2':
     dependencies:
       '@git.zone/tspublish': 1.11.0
       '@push.rocks/early': 4.0.4
       '@push.rocks/smartcli': 4.0.20
       '@push.rocks/smartdelay': 3.0.5
-      '@push.rocks/smartfile': 11.2.7
+      '@push.rocks/smartfile': 13.1.2
+      '@push.rocks/smartfs': 1.3.1
       '@push.rocks/smartlog': 3.1.11
       '@push.rocks/smartpath': 6.0.0
       '@push.rocks/smartpromise': 4.2.3
@@ -4984,9 +4991,9 @@ snapshots:
       - supports-color
       - vue
 
-  '@git.zone/tsrun@1.6.2':
+  '@git.zone/tsrun@2.0.1':
     dependencies:
-      '@push.rocks/smartfile': 11.2.7
+      '@push.rocks/smartfile': 13.1.2
       '@push.rocks/smartshell': 3.3.0
       tsx: 4.21.0
 
@@ -5005,26 +5012,28 @@ snapshots:
       - supports-color
       - vue
 
-  '@git.zone/tstest@1.11.5(socks@2.8.7)(typescript@5.9.3)':
+  '@git.zone/tstest@3.1.8(socks@2.8.7)(typescript@5.9.3)':
     dependencies:
       '@api.global/typedserver': 3.0.80
       '@git.zone/tsbundle': 2.8.3
-      '@git.zone/tsrun': 1.6.2
+      '@git.zone/tsrun': 2.0.1
       '@push.rocks/consolecolor': 2.0.3
       '@push.rocks/qenv': 6.1.3
       '@push.rocks/smartbrowser': 2.0.8(typescript@5.9.3)
+      '@push.rocks/smartchok': 1.2.0
       '@push.rocks/smartcrypto': 2.0.4
       '@push.rocks/smartdelay': 3.0.5
-      '@push.rocks/smartenv': 5.0.13
+      '@push.rocks/smartenv': 6.0.0
       '@push.rocks/smartexpect': 2.5.0
       '@push.rocks/smartfile': 11.2.7
       '@push.rocks/smartjson': 5.2.0
       '@push.rocks/smartlog': 3.1.11
       '@push.rocks/smartmongo': 2.2.0(socks@2.8.7)
-      '@push.rocks/smartpath': 5.1.0
+      '@push.rocks/smartnetwork': 4.4.0
+      '@push.rocks/smartpath': 6.0.0
       '@push.rocks/smartpromise': 4.2.3
-      '@push.rocks/smartrequest': 2.1.0
+      '@push.rocks/smartrequest': 5.0.1
-      '@push.rocks/smarts3': 2.2.7
+      '@push.rocks/smarts3': 3.0.3
       '@push.rocks/smartshell': 3.3.0
       '@push.rocks/smarttime': 4.2.3
       '@types/ws': 8.18.1
@@ -5169,7 +5178,7 @@ snapshots:
       '@jest/schemas': 29.6.3
       '@types/istanbul-lib-coverage': 2.0.6
       '@types/istanbul-reports': 3.0.4
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
       '@types/yargs': 17.0.35
       chalk: 4.1.2
 
@@ -5549,6 +5558,21 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@push.rocks/smartbucket@4.4.1':
+    dependencies:
+      '@aws-sdk/client-s3': 3.990.0
+      '@push.rocks/smartmime': 2.0.4
+      '@push.rocks/smartpath': 6.0.0
+      '@push.rocks/smartpromise': 4.2.3
+      '@push.rocks/smartrx': 3.0.10
+      '@push.rocks/smartstream': 3.2.5
+      '@push.rocks/smartstring': 4.1.0
+      '@push.rocks/smartunique': 3.0.9
+      '@tsclass/tsclass': 9.3.0
+      minimatch: 10.2.0
+    transitivePeerDependencies:
+      - aws-crt
+
   '@push.rocks/smartbuffer@3.0.5':
     dependencies:
       uint8array-extras: 1.5.0
@@ -5658,12 +5682,6 @@ snapshots:
       '@push.rocks/smartpromise': 4.2.3
       tree-kill: 1.2.2
 
-  '@push.rocks/smartexpect@1.6.1':
-    dependencies:
-      '@push.rocks/smartdelay': 3.0.5
-      '@push.rocks/smartpromise': 4.2.3
-      fast-deep-equal: 3.1.3
-
   '@push.rocks/smartexpect@2.5.0':
     dependencies:
       '@push.rocks/smartdelay': 3.0.5
@@ -5986,6 +6004,16 @@ snapshots:
       - aws-crt
       - supports-color
 
+  '@push.rocks/smarts3@3.0.3':
+    dependencies:
+      '@push.rocks/smartbucket': 4.4.1
+      '@push.rocks/smartfs': 1.3.1
+      '@push.rocks/smartpath': 6.0.0
+      '@push.rocks/smartxml': 2.0.0
+      '@tsclass/tsclass': 9.3.0
+    transitivePeerDependencies:
+      - aws-crt
+
   '@push.rocks/smartshell@3.3.0':
     dependencies:
       '@push.rocks/smartdelay': 3.0.5
@@ -6095,7 +6123,7 @@ snapshots:
     dependencies:
       yaml: 2.8.2
 
-  '@push.rocks/tapbundle@5.6.3(socks@2.8.7)':
+  '@push.rocks/tapbundle@6.0.3(socks@2.8.7)':
     dependencies:
       '@open-wc/testing': 4.0.0
       '@push.rocks/consolecolor': 2.0.3
@@ -6103,7 +6131,7 @@ snapshots:
       '@push.rocks/smartcrypto': 2.0.4
       '@push.rocks/smartdelay': 3.0.5
       '@push.rocks/smartenv': 5.0.13
-      '@push.rocks/smartexpect': 1.6.1
+      '@push.rocks/smartexpect': 2.5.0
       '@push.rocks/smartfile': 11.2.7
       '@push.rocks/smartjson': 5.2.0
       '@push.rocks/smartmongo': 2.2.0(socks@2.8.7)
@@ -6708,14 +6736,14 @@ snapshots:
 
   '@types/accepts@1.3.7':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/babel__code-frame@7.27.0': {}
 
   '@types/body-parser@1.19.6':
     dependencies:
       '@types/connect': 3.4.38
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/buffer-json@2.0.3': {}
 
@@ -6732,17 +6760,17 @@ snapshots:
 
   '@types/clean-css@4.2.11':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
       source-map: 0.6.1
 
   '@types/co-body@6.1.3':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
       '@types/qs': 6.14.0
 
   '@types/connect@3.4.38':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/content-disposition@0.5.9': {}
 
@@ -6753,11 +6781,11 @@ snapshots:
       '@types/connect': 3.4.38
       '@types/express': 5.0.6
       '@types/keygrip': 1.0.6
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/cors@2.8.19':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/debounce@1.2.4': {}
 
@@ -6769,7 +6797,7 @@ snapshots:
 
   '@types/express-serve-static-core@5.1.1':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
       '@types/qs': 6.14.0
       '@types/range-parser': 1.2.7
       '@types/send': 1.2.1
@@ -6783,7 +6811,7 @@ snapshots:
   '@types/fs-extra@11.0.4':
     dependencies:
       '@types/jsonfile': 6.1.4
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/hast@3.0.4':
     dependencies:
@@ -6817,7 +6845,7 @@ snapshots:
 
   '@types/jsonfile@6.1.4':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/keygrip@1.0.6': {}
 
@@ -6834,7 +6862,7 @@ snapshots:
       '@types/http-errors': 2.0.5
       '@types/keygrip': 1.0.6
       '@types/koa-compose': 3.2.9
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/mdast@4.0.4':
     dependencies:
@@ -6848,20 +6876,20 @@ snapshots:
 
   '@types/mute-stream@0.0.4':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/node-forge@1.3.14':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
-
-  '@types/node@20.19.33':
-    dependencies:
-      undici-types: 6.21.0
 
   '@types/node@22.19.11':
     dependencies:
       undici-types: 6.21.0
 
+  '@types/node@25.2.3':
+    dependencies:
+      undici-types: 7.16.0
+
   '@types/parse5@6.0.3': {}
 
   '@types/ping@0.4.4': {}
@@ -6876,18 +6904,18 @@ snapshots:
 
   '@types/s3rver@3.7.4':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/semver@7.7.1': {}
 
   '@types/send@1.2.1':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/serve-static@2.2.0':
     dependencies:
       '@types/http-errors': 2.0.5
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/sinon-chai@3.2.12':
     dependencies:
@@ -6906,11 +6934,11 @@ snapshots:
 
   '@types/tar-stream@3.1.4':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/through2@2.0.41':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/triple-beam@1.3.5': {}
 
@@ -6938,11 +6966,11 @@ snapshots:
 
   '@types/ws@7.4.7':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/ws@8.18.1':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
 
   '@types/yargs-parser@21.0.3': {}
 
@@ -6952,7 +6980,7 @@ snapshots:
 
   '@types/yauzl@2.10.3':
     dependencies:
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
     optional: true
 
   '@ungap/structured-clone@1.3.0': {}
@@ -7557,7 +7585,7 @@ snapshots:
   engine.io@6.6.4:
     dependencies:
       '@types/cors': 2.8.19
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
       accepts: 1.3.8
       base64id: 2.0.0
       cookie: 0.7.2
@@ -8271,7 +8299,7 @@ snapshots:
   jest-util@29.7.0:
     dependencies:
       '@jest/types': 29.6.3
-      '@types/node': 20.19.33
+      '@types/node': 25.2.3
       chalk: 4.1.2
       ci-info: 3.9.0
       graceful-fs: 4.2.11
@@ -9779,6 +9807,8 @@ snapshots:
 
   undici-types@6.21.0: {}
 
+  undici-types@7.16.0: {}
+
   unified@11.0.5:
     dependencies:
       '@types/unist': 3.0.3

readme.hints.md

@@ -1,3 +1,12 @@
-* this module is part of the @serve.zone stack
+* This module is part of the @serve.zone stack
-* it is used to reach private clusters from outside
+* v3.0.0+ uses a Hub/Edge architecture with a Rust core binary (`remoteingress-bin`)
-* it can be used to create private tunnels to private networks
+* TypeScript classes `RemoteIngressHub` and `RemoteIngressEdge` bridge to Rust via `@push.rocks/smartrust` RustBridge IPC
+* Custom multiplexed binary frame protocol over TLS for tunneling TCP connections
+* PROXY protocol v1 preserves client IP when forwarding to SmartProxy/DcRouter
+* Edge authenticates to Hub via shared secret over TLS
+* STUN-based public IP discovery at the edge (Cloudflare STUN server)
+* Cross-compiled Rust binary for linux/amd64 and linux/arm64
+* Old `ConnectorPublic`/`ConnectorPrivate` classes no longer exist (removed in v2.0.0/v3.0.0)
+* `localPaths` in RustBridge config must be full file paths (not directories) — smartrust's `RustBinaryLocator` checks `isExecutable()` on each entry directly
+* Production binaries are named with platform suffixes: `remoteingress-bin_linux_amd64`, `remoteingress-bin_linux_arm64`
+* Rust core uses `ring` as the rustls CryptoProvider (explicitly installed in main.rs, aws-lc-rs disabled via default-features=false)

readme.md

@@ -1,107 +1,314 @@
 # @serve.zone/remoteingress
 
-Provides a service for creating private tunnels and reaching private clusters from the outside as part of the @serve.zone stack.
+Edge ingress tunnel for DcRouter — accepts incoming TCP connections at the network edge and tunnels them to a DcRouter SmartProxy instance, preserving the original client IP via PROXY protocol v1.
+
+## Issue Reporting and Security
+
+For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
 
 ## Install
 
-To install `@serve.zone/remoteingress`, run the following command in your terminal:
-
 ```sh
-npm install @serve.zone/remoteingress
+pnpm install @serve.zone/remoteingress
 ```
 
-This command will download and install the remoteingress package and its dependencies into your project.
+## 🏗️ Architecture
 
-## Usage
+`@serve.zone/remoteingress` uses a **Hub/Edge** topology with a high-performance Rust core and a TypeScript API surface:
 
-`@serve.zone/remoteingress` is designed to facilitate the creation of secure private tunnels and enable access to private clusters from external sources, offering an integral part of the @serve.zone stack infrastructure. Below, we illustrate how to employ this package within your project, leveraging TypeScript and ESM syntax for modern, type-safe, and modular code.
+```
+┌─────────────────────┐          TLS Tunnel           ┌─────────────────────┐
+│   Network Edge      │  ◄══════════════════════════►  │   Private Cluster   │
+│                     │   (multiplexed frames +        │                     │
+│  RemoteIngressEdge  │    shared-secret auth)         │  RemoteIngressHub   │
+│  Accepts client TCP │                                │  Forwards to        │
+│  connections        │                                │  SmartProxy on      │
+│                     │                                │  local ports        │
+└─────────────────────┘                                └─────────────────────┘
+        ▲                                                       │
+        │  TCP from end users                                   ▼
+   Internet                                             DcRouter / SmartProxy
+```
 
-### Prerequisites
+| Component | Role |
+|-----------|------|
+| **RemoteIngressEdge** | Deployed at the network edge (e.g. a VPS or cloud instance). Accepts raw TCP connections and multiplexes them over a single TLS tunnel to the hub. |
+| **RemoteIngressHub** | Deployed alongside DcRouter/SmartProxy in a private cluster. Accepts edge connections, demuxes streams, and forwards each to SmartProxy with a PROXY protocol v1 header so the real client IP is preserved. |
+| **Rust Binary** (`remoteingress-bin`) | The performance-critical networking core. Managed via `@push.rocks/smartrust` RustBridge IPC — you never interact with it directly. Cross-compiled for `linux/amd64` and `linux/arm64`. |
 
-Ensure that you have Node.js and TypeScript installed in your environment. Your project should be set up with TypeScript support, and you might want to familiarize yourself with basic networking concepts and TLS/SSL for secure communication.
+### ✨ Key Features
 
-### Importing and Initializing Connectors
+- 🔒 **TLS-encrypted tunnel** between edge and hub (auto-generated self-signed cert or bring your own)
+- 🔀 **Multiplexed streams** — thousands of client connections flow over a single tunnel
+- 🌐 **PROXY protocol v1** — SmartProxy sees the real client IP, not the tunnel IP
+- 🔑 **Shared-secret authentication** — edges must present valid credentials to connect
+- 🎫 **Connection tokens** — encode all connection details into a single opaque string
+- 📡 **STUN-based public IP discovery** — the edge automatically discovers its public IP via Cloudflare STUN
+- 🔄 **Auto-reconnect** with exponential backoff if the tunnel drops
+- 📣 **Event-driven** — both Hub and Edge extend `EventEmitter` for real-time monitoring
+- ⚡ **Rust core** — all frame encoding, TLS, and TCP proxying happen in native code for maximum throughput
 
-`@serve.zone/remoteingress` offers two primary components: `ConnectorPublic` and `ConnectorPrivate`. Here's how to use them:
+## 🚀 Usage
 
-#### Setup ConnectorPublic
+Both classes are imported from the package and communicate with the Rust binary under the hood. All you need to do is configure and start them.
 
-`ConnectorPublic` acts as a gateway, accepting incoming tunnel connections from `ConnectorPrivate` instances and facilitating secure communication between the internet and your private network.
+### Setting Up the Hub (Private Cluster Side)
 
 ```typescript
-import { ConnectorPublic } from '@serve.zone/remoteingress';
+import { RemoteIngressHub } from '@serve.zone/remoteingress';
 
-// Initialize ConnectorPublic
+const hub = new RemoteIngressHub();
-const publicConnector = new ConnectorPublic({
+
-  tlsOptions: {
+// Listen for events
-    key: fs.readFileSync("<path-to-your-tls/key.pem>"),
+hub.on('edgeConnected', ({ edgeId }) => {
-    cert: fs.readFileSync("<path-to-your-cert/cert.pem>"),
+  console.log(`Edge ${edgeId} connected`);
-    // Consider including 'ca' and 'passphrase' if required for your setup
+});
-  },
+hub.on('edgeDisconnected', ({ edgeId }) => {
-  listenPort: 443 // Example listen port; adjust based on your needs
+  console.log(`Edge ${edgeId} disconnected`);
+});
+hub.on('streamOpened', ({ edgeId, streamId }) => {
+  console.log(`Stream ${streamId} opened from edge ${edgeId}`);
+});
+hub.on('streamClosed', ({ edgeId, streamId }) => {
+  console.log(`Stream ${streamId} closed from edge ${edgeId}`);
+});
+
+// Start the hub — it will listen for incoming edge TLS connections
+await hub.start({
+  tunnelPort: 8443,        // port edges connect to (default: 8443)
+  targetHost: '127.0.0.1', // SmartProxy host to forward streams to (default: 127.0.0.1)
+});
+
+// Register which edges are allowed to connect
+await hub.updateAllowedEdges([
+  { id: 'edge-nyc-01', secret: 'supersecrettoken1' },
+  { id: 'edge-fra-02', secret: 'supersecrettoken2' },
+]);
+
+// Check status at any time
+const status = await hub.getStatus();
+console.log(status);
+// {
+//   running: true,
+//   tunnelPort: 8443,
+//   connectedEdges: [
+//     { edgeId: 'edge-nyc-01', connectedAt: 1700000000, activeStreams: 12 }
+//   ]
+// }
+
+// Graceful shutdown
+await hub.stop();
+```
+
+### Setting Up the Edge (Network Edge Side)
+
+The edge can be configured in two ways: with an **opaque connection token** (recommended) or with explicit config fields.
+
+#### Option A: Connection Token (Recommended)
+
+A single token encodes all connection details — ideal for provisioning edges at scale:
+
+```typescript
+import { RemoteIngressEdge } from '@serve.zone/remoteingress';
+
+const edge = new RemoteIngressEdge();
+
+edge.on('tunnelConnected', () => console.log('Tunnel established'));
+edge.on('tunnelDisconnected', () => console.log('Tunnel lost — will auto-reconnect'));
+edge.on('publicIpDiscovered', ({ ip }) => console.log(`Public IP: ${ip}`));
+
+// Single token contains hubHost, hubPort, edgeId, and secret
+await edge.start({
+  token: 'eyJoIjoiaHViLmV4YW1wbGUuY29tIiwicCI6ODQ0MywiZSI6ImVkZ2UtbnljLTAxIiwicyI6InN1cGVyc2VjcmV0dG9rZW4xIn0',
 });
 ```
 
-#### Setup ConnectorPrivate
+#### Option B: Explicit Config
-
-`ConnectorPrivate` establishes a secure tunnel to `ConnectorPublic`, effectively bridging your internal services with the external point of access.
 
 ```typescript
-import { ConnectorPrivate } from '@serve.zone/remoteingress';
+import { RemoteIngressEdge } from '@serve.zone/remoteingress';
 
-// Initialize ConnectorPrivate pointing to your ConnectorPublic instance
+const edge = new RemoteIngressEdge();
-const privateConnector = new ConnectorPrivate({
+
-  publicHost: 'your.public.domain.tld',
+edge.on('tunnelConnected', () => console.log('Tunnel established'));
-  publicPort: 443, // Ensure this matches the listening port of ConnectorPublic
+edge.on('tunnelDisconnected', () => console.log('Tunnel lost — will auto-reconnect'));
-  tlsOptions: {
+edge.on('publicIpDiscovered', ({ ip }) => console.log(`Public IP: ${ip}`));
-    // You might want to specify TLS options here, similar to ConnectorPublic
+
-  }
+await edge.start({
+  hubHost: 'hub.example.com',  // hostname or IP of the hub
+  hubPort: 8443,               // must match hub's tunnelPort (default: 8443)
+  edgeId: 'edge-nyc-01',       // unique edge identifier
+  secret: 'supersecrettoken1', // must match the hub's allowed edge secret
 });
+
+// Check status at any time
+const edgeStatus = await edge.getStatus();
+console.log(edgeStatus);
+// {
+//   running: true,
+//   connected: true,
+//   publicIp: '203.0.113.42',
+//   activeStreams: 5,
+//   listenPorts: [80, 443]
+// }
+
+// Graceful shutdown
+await edge.stop();
 ```
 
-### Secure Communication
+### 🎫 Connection Tokens
 
-It's imperative to ensure that the communication between `ConnectorPublic` and `ConnectorPrivate` is secure:
+Connection tokens let you distribute a single opaque string instead of four separate config values. The hub operator generates the token; the edge operator just pastes it in.
 
-- Always use valid TLS certificates.
+```typescript
-- Prefer using certificates issued by recognized Certificate Authorities (CA).
+import { encodeConnectionToken, decodeConnectionToken } from '@serve.zone/remoteingress';
-- Optionally, configure mutual TLS (mTLS) by requiring client certificates for an added layer of security.
 
-### Advanced Usage
+// Hub side: generate a token for a new edge
+const token = encodeConnectionToken({
+  hubHost: 'hub.example.com',
+  hubPort: 8443,
+  edgeId: 'edge-nyc-01',
+  secret: 'supersecrettoken1',
+});
+console.log(token);
+// => 'eyJoIjoiaHViLmV4YW1wbGUuY29tIiwi...'
 
-Both connectors can be finely tuned:
+// Edge side: inspect a token (optional — start() does this automatically)
+const data = decodeConnectionToken(token);
+console.log(data);
+// {
+//   hubHost: 'hub.example.com',
+//   hubPort: 8443,
+//   edgeId: 'edge-nyc-01',
+//   secret: 'supersecrettoken1'
+// }
+```
 
-- **Logging and Monitoring:** Integrate with your existing logging and monitoring systems to keep tabs on tunnel activity, performance metrics, and potential security anomalies.
+Tokens are base64url-encoded (URL-safe, no padding) — safe to pass as environment variables, CLI arguments, or store in config files.
 
-- **Custom Handlers:** Implement custom traffic handling logic for specialized routing, filtering, or protocol-specific processing.
+## 📖 API Reference
 
-- **Automation:** Automate the deployment and scaling of both `ConnectorPublic` and `ConnectorPrivate` instances using infrastructure-as-code (IAC) tools and practices, ensuring that your tunneling infrastructure can dynamically adapt to the ever-changing needs of your services.
+### `RemoteIngressHub`
 
-### Example Scenarios
+| Method / Property | Description |
+|-------------------|-------------|
+| `start(config?)` | Spawns the Rust binary and starts the tunnel listener. Config: `{ tunnelPort?: number, targetHost?: string }` |
+| `stop()` | Gracefully shuts down the hub and kills the Rust process. |
+| `updateAllowedEdges(edges)` | Dynamically update which edges are authorized. Each edge: `{ id: string, secret: string }` |
+| `getStatus()` | Returns current hub status including connected edges and active stream counts. |
+| `running` | `boolean` — whether the Rust binary is alive. |
 
-1. **Securing Application APIs:** Use `@serve.zone/remoteingress` to expose private APIs to your frontend deployed on a public cloud, ensuring that only your infrastructure can access these endpoints.
+**Events:** `edgeConnected`, `edgeDisconnected`, `streamOpened`, `streamClosed`
 
-2. **Remote Database Access:** Securely access databases within a private VPC from your local development machine without opening direct access to the internet.
+### `RemoteIngressEdge`
 
-3. **Service Mesh Integration:** Integrate `@serve.zone/remoteingress` as part of a service mesh setup to securely connect services across multiple clusters with robust identity and encryption at the tunnel level.
+| Method / Property | Description |
+|-------------------|-------------|
+| `start(config)` | Spawns the Rust binary and connects to the hub. Accepts `{ token: string }` or `IEdgeConfig`. |
+| `stop()` | Gracefully shuts down the edge and kills the Rust process. |
+| `getStatus()` | Returns current edge status including connection state, public IP, and active streams. |
+| `running` | `boolean` — whether the Rust binary is alive. |
 
-For detailed documentation, API references, and additional use cases, please refer to the inline documentation and source code within the package. Always prioritize security and robustness when dealing with network ingress to protect your infrastructure and data from unauthorized access and threats.
+**Events:** `tunnelConnected`, `tunnelDisconnected`, `publicIpDiscovered`
+
+### Token Utilities
+
+| Function | Description |
+|----------|-------------|
+| `encodeConnectionToken(data)` | Encodes `IConnectionTokenData` into a base64url token string. |
+| `decodeConnectionToken(token)` | Decodes a token back into `IConnectionTokenData`. Throws on malformed or incomplete tokens. |
+
+### Interfaces
+
+```typescript
+interface IHubConfig {
+  tunnelPort?: number;   // default: 8443
+  targetHost?: string;   // default: '127.0.0.1'
+}
+
+interface IEdgeConfig {
+  hubHost: string;
+  hubPort?: number;      // default: 8443
+  edgeId: string;
+  secret: string;
+}
+
+interface IConnectionTokenData {
+  hubHost: string;
+  hubPort: number;
+  edgeId: string;
+  secret: string;
+}
+```
+
+## 🔌 Wire Protocol
+
+The tunnel uses a custom binary frame protocol over TLS:
+
+```
+[stream_id: 4 bytes][type: 1 byte][length: 4 bytes][payload: N bytes]
+```
+
+| Frame Type | Value | Direction | Purpose |
+|------------|-------|-----------|---------|
+| `OPEN` | `0x01` | Edge → Hub | Open a new stream; payload is PROXY v1 header |
+| `DATA` | `0x02` | Edge → Hub | Client data flowing upstream |
+| `CLOSE` | `0x03` | Edge → Hub | Client closed the connection |
+| `DATA_BACK` | `0x04` | Hub → Edge | Response data flowing downstream |
+| `CLOSE_BACK` | `0x05` | Hub → Edge | Upstream (SmartProxy) closed the connection |
+
+Max payload size per frame: **16 MB**.
+
+## 💡 Example Scenarios
+
+### 1. Expose a Private Kubernetes Cluster to the Internet
+
+Deploy an Edge on a public VPS, point your DNS to the VPS IP. The Edge tunnels all traffic to the Hub running inside the cluster, which hands it off to SmartProxy/DcRouter. Your cluster stays fully private — no public-facing ports needed.
+
+### 2. Multi-Region Edge Ingress
+
+Run multiple Edges in different geographic regions (NYC, Frankfurt, Tokyo) all connecting to a single Hub. Use GeoDNS to route users to their nearest Edge. The Hub sees the real client IPs via PROXY protocol regardless of which edge they connected through.
+
+### 3. Secure API Exposure
+
+Your backend runs on a private network with no direct internet access. An Edge on a minimal cloud instance acts as the only public entry point. TLS tunnel + shared-secret auth ensure only your authorized Edge can forward traffic.
+
+### 4. Token-Based Edge Provisioning
+
+Generate connection tokens on the hub side and distribute them to edge operators. Each edge only needs a single token string to connect — no manual configuration of host, port, ID, and secret.
+
+```typescript
+// Hub operator generates token
+const token = encodeConnectionToken({
+  hubHost: 'hub.prod.example.com',
+  hubPort: 8443,
+  edgeId: 'edge-tokyo-01',
+  secret: 'generated-secret-abc123',
+});
+// Send `token` to the edge operator via secure channel
+
+// Edge operator starts with just the token
+const edge = new RemoteIngressEdge();
+await edge.start({ token });
+```
 
 ## License and Legal Information
 
-This repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. 
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 
 ### Trademarks
 
-This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.
+This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.
+
+Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.
 
 ### Company Information
 
-Task Venture Capital GmbH  
+Task Venture Capital GmbH
-Registered at District court Bremen HRB 35230 HB, Germany
+Registered at District Court Bremen HRB 35230 HB, Germany
 
-For any legal inquiries or if you require further information, please contact us via email at hello@task.vc.
+For any legal inquiries or further information, please contact us via email at hello@task.vc.
 
 By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.

rust/Cargo.lock

@@ -509,6 +509,7 @@ dependencies = [
  "log",
  "remoteingress-core",
  "remoteingress-protocol",
+ "rustls",
  "serde",
  "serde_json",
  "tokio",

rust/crates/remoteingress-bin/Cargo.toml

@@ -16,3 +16,4 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 log = "0.4"
 env_logger = "0.11"
+rustls = { version = "0.23", default-features = false, features = ["ring"] }

rust/crates/remoteingress-bin/src/main.rs

@@ -85,6 +85,11 @@ fn send_error(id: &str, error: &str) {
 
 #[tokio::main]
 async fn main() {
+    // Install the ring CryptoProvider before any TLS usage
+    rustls::crypto::ring::default_provider()
+        .install_default()
+        .expect("Failed to install rustls ring CryptoProvider");
+
     let cli = Cli::parse();
 
     if !cli.management {
@@ -296,6 +301,18 @@ async fn handle_request(
                                     serde_json::json!({ "ip": ip }),
                                 );
                             }
+                            EdgeEvent::PortsAssigned { listen_ports } => {
+                                send_event(
+                                    "portsAssigned",
+                                    serde_json::json!({ "listenPorts": listen_ports }),
+                                );
+                            }
+                            EdgeEvent::PortsUpdated { listen_ports } => {
+                                send_event(
+                                    "portsUpdated",
+                                    serde_json::json!({ "listenPorts": listen_ports }),
+                                );
+                            }
                         }
                     }
                 });

rust/crates/remoteingress-core/Cargo.toml

@@ -7,7 +7,7 @@ edition = "2021"
 remoteingress-protocol = { path = "../remoteingress-protocol" }
 tokio = { version = "1", features = ["full"] }
 tokio-rustls = "0.26"
-rustls = { version = "0.23", features = ["ring"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
 rcgen = "0.13"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

rust/crates/remoteingress-core/src/edge.rs

@@ -1,15 +1,16 @@
 use std::collections::HashMap;
 use std::sync::atomic::{AtomicU32, Ordering};
 use std::sync::Arc;
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
 use tokio::net::{TcpListener, TcpStream};
 use tokio::sync::{mpsc, Mutex, RwLock};
+use tokio::task::JoinHandle;
 use tokio_rustls::TlsConnector;
 use serde::{Deserialize, Serialize};
 
 use remoteingress_protocol::*;
 
-/// Edge configuration.
+/// Edge configuration (hub-host + credentials only; ports come from hub).
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct EdgeConfig {
@@ -17,8 +18,26 @@ pub struct EdgeConfig {
     pub hub_port: u16,
     pub edge_id: String,
     pub secret: String,
-    pub listen_ports: Vec<u16>,
+}
-    pub stun_interval_secs: Option<u64>,
+
+/// Handshake config received from hub after authentication.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct HandshakeConfig {
+    listen_ports: Vec<u16>,
+    #[serde(default = "default_stun_interval")]
+    stun_interval_secs: u64,
+}
+
+fn default_stun_interval() -> u64 {
+    300
+}
+
+/// Runtime config update received from hub via FRAME_CONFIG.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ConfigUpdate {
+    listen_ports: Vec<u16>,
 }
 
 /// Events emitted by the edge.
@@ -30,6 +49,10 @@ pub enum EdgeEvent {
     TunnelDisconnected,
     #[serde(rename_all = "camelCase")]
     PublicIpDiscovered { ip: String },
+    #[serde(rename_all = "camelCase")]
+    PortsAssigned { listen_ports: Vec<u16> },
+    #[serde(rename_all = "camelCase")]
+    PortsUpdated { listen_ports: Vec<u16> },
 }
 
 /// Edge status response.
@@ -54,6 +77,7 @@ pub struct TunnelEdge {
     public_ip: Arc<RwLock<Option<String>>>,
     active_streams: Arc<AtomicU32>,
     next_stream_id: Arc<AtomicU32>,
+    listen_ports: Arc<RwLock<Vec<u16>>>,
 }
 
 impl TunnelEdge {
@@ -69,6 +93,7 @@ impl TunnelEdge {
             public_ip: Arc::new(RwLock::new(None)),
             active_streams: Arc::new(AtomicU32::new(0)),
             next_stream_id: Arc::new(AtomicU32::new(1)),
+            listen_ports: Arc::new(RwLock::new(Vec::new())),
         }
     }
 
@@ -84,7 +109,7 @@ impl TunnelEdge {
             connected: *self.connected.read().await,
             public_ip: self.public_ip.read().await.clone(),
             active_streams: self.active_streams.load(Ordering::Relaxed) as usize,
-            listen_ports: self.config.read().await.listen_ports.clone(),
+            listen_ports: self.listen_ports.read().await.clone(),
         }
     }
 
@@ -100,6 +125,7 @@ impl TunnelEdge {
         let active_streams = self.active_streams.clone();
         let next_stream_id = self.next_stream_id.clone();
         let event_tx = self.event_tx.clone();
+        let listen_ports = self.listen_ports.clone();
 
         tokio::spawn(async move {
             edge_main_loop(
@@ -109,6 +135,7 @@ impl TunnelEdge {
                 active_streams,
                 next_stream_id,
                 event_tx,
+                listen_ports,
                 shutdown_rx,
             )
             .await;
@@ -124,6 +151,7 @@ impl TunnelEdge {
         }
         *self.running.write().await = false;
         *self.connected.write().await = false;
+        self.listen_ports.write().await.clear();
     }
 }
 
@@ -134,6 +162,7 @@ async fn edge_main_loop(
     active_streams: Arc<AtomicU32>,
     next_stream_id: Arc<AtomicU32>,
     event_tx: mpsc::UnboundedSender<EdgeEvent>,
+    listen_ports: Arc<RwLock<Vec<u16>>>,
     mut shutdown_rx: mpsc::Receiver<()>,
 ) {
     let mut backoff_ms: u64 = 1000;
@@ -148,6 +177,7 @@ async fn edge_main_loop(
             &active_streams,
             &next_stream_id,
             &event_tx,
+            &listen_ports,
             &mut shutdown_rx,
         )
         .await;
@@ -155,6 +185,7 @@ async fn edge_main_loop(
         *connected.write().await = false;
         let _ = event_tx.send(EdgeEvent::TunnelDisconnected);
         active_streams.store(0, Ordering::Relaxed);
+        listen_ports.write().await.clear();
 
         match result {
             EdgeLoopResult::Shutdown => break,
@@ -182,6 +213,7 @@ async fn connect_to_hub_and_run(
     active_streams: &Arc<AtomicU32>,
     next_stream_id: &Arc<AtomicU32>,
     event_tx: &mpsc::UnboundedSender<EdgeEvent>,
+    listen_ports: &Arc<RwLock<Vec<u16>>>,
     shutdown_rx: &mut mpsc::Receiver<()>,
 ) -> EdgeLoopResult {
     // Build TLS connector that skips cert verification (auth is via secret)
@@ -220,12 +252,47 @@ async fn connect_to_hub_and_run(
         return EdgeLoopResult::Reconnect;
     }
 
+    // Read handshake response line from hub (JSON with initial config)
+    let mut buf_reader = BufReader::new(read_half);
+    let mut handshake_line = String::new();
+    match buf_reader.read_line(&mut handshake_line).await {
+        Ok(0) => {
+            log::error!("Hub rejected connection (EOF before handshake)");
+            return EdgeLoopResult::Reconnect;
+        }
+        Ok(_) => {}
+        Err(e) => {
+            log::error!("Failed to read handshake response: {}", e);
+            return EdgeLoopResult::Reconnect;
+        }
+    }
+
+    let handshake: HandshakeConfig = match serde_json::from_str(handshake_line.trim()) {
+        Ok(h) => h,
+        Err(e) => {
+            log::error!("Invalid handshake response: {}", e);
+            return EdgeLoopResult::Reconnect;
+        }
+    };
+
+    log::info!(
+        "Handshake from hub: ports {:?}, stun_interval {}s",
+        handshake.listen_ports,
+        handshake.stun_interval_secs
+    );
+
     *connected.write().await = true;
     let _ = event_tx.send(EdgeEvent::TunnelConnected);
     log::info!("Connected to hub at {}", addr);
 
+    // Store initial ports and emit event
+    *listen_ports.write().await = handshake.listen_ports.clone();
+    let _ = event_tx.send(EdgeEvent::PortsAssigned {
+        listen_ports: handshake.listen_ports.clone(),
+    });
+
     // Start STUN discovery
-    let stun_interval = config.stun_interval_secs.unwrap_or(300);
+    let stun_interval = handshake.stun_interval_secs;
     let public_ip_clone = public_ip.clone();
     let event_tx_clone = event_tx.clone();
     let stun_handle = tokio::spawn(async move {
@@ -249,14 +316,112 @@ async fn connect_to_hub_and_run(
     // Shared tunnel writer
     let tunnel_writer = Arc::new(Mutex::new(write_half));
 
-    // Start TCP listeners for each port
+    // Start TCP listeners for initial ports (hot-reloadable)
-    let mut listener_handles = Vec::new();
+    let mut port_listeners: HashMap<u16, JoinHandle<()>> = HashMap::new();
-    for &port in &config.listen_ports {
+    apply_port_config(
+        &handshake.listen_ports,
+        &mut port_listeners,
+        &tunnel_writer,
+        &client_writers,
+        active_streams,
+        next_stream_id,
+        &config.edge_id,
+    );
+
+    // Read frames from hub
+    let mut frame_reader = FrameReader::new(buf_reader);
+    let result = loop {
+        tokio::select! {
+            frame_result = frame_reader.next_frame() => {
+                match frame_result {
+                    Ok(Some(frame)) => {
+                        match frame.frame_type {
+                            FRAME_DATA_BACK => {
+                                let writers = client_writers.lock().await;
+                                if let Some(tx) = writers.get(&frame.stream_id) {
+                                    let _ = tx.send(frame.payload).await;
+                                }
+                            }
+                            FRAME_CLOSE_BACK => {
+                                let mut writers = client_writers.lock().await;
+                                writers.remove(&frame.stream_id);
+                            }
+                            FRAME_CONFIG => {
+                                if let Ok(update) = serde_json::from_slice::<ConfigUpdate>(&frame.payload) {
+                                    log::info!("Config update from hub: ports {:?}", update.listen_ports);
+                                    *listen_ports.write().await = update.listen_ports.clone();
+                                    let _ = event_tx.send(EdgeEvent::PortsUpdated {
+                                        listen_ports: update.listen_ports.clone(),
+                                    });
+                                    apply_port_config(
+                                        &update.listen_ports,
+                                        &mut port_listeners,
+                                        &tunnel_writer,
+                                        &client_writers,
+                                        active_streams,
+                                        next_stream_id,
+                                        &config.edge_id,
+                                    );
+                                }
+                            }
+                            _ => {
+                                log::warn!("Unexpected frame type {} from hub", frame.frame_type);
+                            }
+                        }
+                    }
+                    Ok(None) => {
+                        log::info!("Hub disconnected (EOF)");
+                        break EdgeLoopResult::Reconnect;
+                    }
+                    Err(e) => {
+                        log::error!("Hub frame error: {}", e);
+                        break EdgeLoopResult::Reconnect;
+                    }
+                }
+            }
+            _ = shutdown_rx.recv() => {
+                break EdgeLoopResult::Shutdown;
+            }
+        }
+    };
+
+    // Cleanup
+    stun_handle.abort();
+    for (_, h) in port_listeners.drain() {
+        h.abort();
+    }
+
+    result
+}
+
+/// Apply a new port configuration: spawn listeners for added ports, abort removed ports.
+fn apply_port_config(
+    new_ports: &[u16],
+    port_listeners: &mut HashMap<u16, JoinHandle<()>>,
+    tunnel_writer: &Arc<Mutex<tokio::io::WriteHalf<tokio_rustls::client::TlsStream<TcpStream>>>>,
+    client_writers: &Arc<Mutex<HashMap<u32, mpsc::Sender<Vec<u8>>>>>,
+    active_streams: &Arc<AtomicU32>,
+    next_stream_id: &Arc<AtomicU32>,
+    edge_id: &str,
+) {
+    let new_set: std::collections::HashSet<u16> = new_ports.iter().copied().collect();
+    let old_set: std::collections::HashSet<u16> = port_listeners.keys().copied().collect();
+
+    // Remove ports no longer needed
+    for &port in old_set.difference(&new_set) {
+        if let Some(handle) = port_listeners.remove(&port) {
+            log::info!("Stopping listener on port {}", port);
+            handle.abort();
+        }
+    }
+
+    // Add new ports
+    for &port in new_set.difference(&old_set) {
         let tunnel_writer = tunnel_writer.clone();
         let client_writers = client_writers.clone();
         let active_streams = active_streams.clone();
         let next_stream_id = next_stream_id.clone();
-        let edge_id = config.edge_id.clone();
+        let edge_id = edge_id.to_string();
 
         let handle = tokio::spawn(async move {
             let listener = match TcpListener::bind(("0.0.0.0", port)).await {
@@ -299,55 +464,8 @@ async fn connect_to_hub_and_run(
                 }
             }
         });
-        listener_handles.push(handle);
+        port_listeners.insert(port, handle);
     }
-
-    // Read frames from hub
-    let mut frame_reader = FrameReader::new(read_half);
-    let result = loop {
-        tokio::select! {
-            frame_result = frame_reader.next_frame() => {
-                match frame_result {
-                    Ok(Some(frame)) => {
-                        match frame.frame_type {
-                            FRAME_DATA_BACK => {
-                                let writers = client_writers.lock().await;
-                                if let Some(tx) = writers.get(&frame.stream_id) {
-                                    let _ = tx.send(frame.payload).await;
-                                }
-                            }
-                            FRAME_CLOSE_BACK => {
-                                let mut writers = client_writers.lock().await;
-                                writers.remove(&frame.stream_id);
-                            }
-                            _ => {
-                                log::warn!("Unexpected frame type {} from hub", frame.frame_type);
-                            }
-                        }
-                    }
-                    Ok(None) => {
-                        log::info!("Hub disconnected (EOF)");
-                        break EdgeLoopResult::Reconnect;
-                    }
-                    Err(e) => {
-                        log::error!("Hub frame error: {}", e);
-                        break EdgeLoopResult::Reconnect;
-                    }
-                }
-            }
-            _ = shutdown_rx.recv() => {
-                break EdgeLoopResult::Shutdown;
-            }
-        }
-    };
-
-    // Cleanup
-    stun_handle.abort();
-    for h in listener_handles {
-        h.abort();
-    }
-
-    result
 }
 
 async fn handle_client_connection(

rust/crates/remoteingress-core/src/hub.rs

@@ -37,6 +37,24 @@ impl Default for HubConfig {
 pub struct AllowedEdge {
     pub id: String,
     pub secret: String,
+    #[serde(default)]
+    pub listen_ports: Vec<u16>,
+    pub stun_interval_secs: Option<u64>,
+}
+
+/// Handshake response sent to edge after authentication.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct HandshakeResponse {
+    listen_ports: Vec<u16>,
+    stun_interval_secs: u64,
+}
+
+/// Configuration update pushed to a connected edge at runtime.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EdgeConfigUpdate {
+    pub listen_ports: Vec<u16>,
 }
 
 /// Runtime status of a connected edge.
@@ -75,7 +93,7 @@ pub struct HubStatus {
 /// The tunnel hub that accepts edge connections and demuxes streams to SmartProxy.
 pub struct TunnelHub {
     config: RwLock<HubConfig>,
-    allowed_edges: Arc<RwLock<HashMap<String, String>>>, // id -> secret
+    allowed_edges: Arc<RwLock<HashMap<String, AllowedEdge>>>,
     connected_edges: Arc<Mutex<HashMap<String, ConnectedEdgeInfo>>>,
     event_tx: mpsc::UnboundedSender<HubEvent>,
     event_rx: Mutex<Option<mpsc::UnboundedReceiver<HubEvent>>>,
@@ -86,6 +104,7 @@ pub struct TunnelHub {
 struct ConnectedEdgeInfo {
     connected_at: u64,
     active_streams: Arc<Mutex<HashMap<u32, mpsc::Sender<Vec<u8>>>>>,
+    config_tx: mpsc::Sender<EdgeConfigUpdate>,
 }
 
 impl TunnelHub {
@@ -108,12 +127,35 @@ impl TunnelHub {
     }
 
     /// Update the list of allowed edges.
+    /// For any currently-connected edge whose ports changed, push a config update.
     pub async fn update_allowed_edges(&self, edges: Vec<AllowedEdge>) {
         let mut map = self.allowed_edges.write().await;
-        map.clear();
+
-        for edge in edges {
+        // Build new map
-            map.insert(edge.id, edge.secret);
+        let mut new_map = HashMap::new();
+        for edge in &edges {
+            new_map.insert(edge.id.clone(), edge.clone());
         }
+
+        // Push config updates to connected edges whose ports changed
+        let connected = self.connected_edges.lock().await;
+        for edge in &edges {
+            if let Some(info) = connected.get(&edge.id) {
+                // Check if ports changed compared to old config
+                let ports_changed = match map.get(&edge.id) {
+                    Some(old) => old.listen_ports != edge.listen_ports,
+                    None => true, // newly allowed edge that's already connected
+                };
+                if ports_changed {
+                    let update = EdgeConfigUpdate {
+                        listen_ports: edge.listen_ports.clone(),
+                    };
+                    let _ = info.config_tx.try_send(update);
+                }
+            }
+        }
+
+        *map = new_map;
     }
 
     /// Get the current hub status.
@@ -208,13 +250,13 @@ impl TunnelHub {
 async fn handle_edge_connection(
     stream: TcpStream,
     acceptor: TlsAcceptor,
-    allowed: Arc<RwLock<HashMap<String, String>>>,
+    allowed: Arc<RwLock<HashMap<String, AllowedEdge>>>,
     connected: Arc<Mutex<HashMap<String, ConnectedEdgeInfo>>>,
     event_tx: mpsc::UnboundedSender<HubEvent>,
     target_host: String,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     let tls_stream = acceptor.accept(stream).await?;
-    let (read_half, write_half) = tokio::io::split(tls_stream);
+    let (read_half, mut write_half) = tokio::io::split(tls_stream);
     let mut buf_reader = BufReader::new(read_half);
 
     // Read auth line: "EDGE <edgeId> <secret>\n"
@@ -230,26 +272,36 @@ async fn handle_edge_connection(
     let edge_id = parts[1].to_string();
     let secret = parts[2];
 
-    // Verify credentials
+    // Verify credentials and extract edge config
-    {
+    let (listen_ports, stun_interval_secs) = {
         let edges = allowed.read().await;
         match edges.get(&edge_id) {
-            Some(expected) => {
+            Some(edge) => {
-                if !constant_time_eq(secret.as_bytes(), expected.as_bytes()) {
+                if !constant_time_eq(secret.as_bytes(), edge.secret.as_bytes()) {
                     return Err(format!("invalid secret for edge {}", edge_id).into());
                 }
+                (edge.listen_ports.clone(), edge.stun_interval_secs.unwrap_or(300))
             }
             None => {
                 return Err(format!("unknown edge {}", edge_id).into());
             }
         }
-    }
+    };
 
     log::info!("Edge {} authenticated", edge_id);
     let _ = event_tx.send(HubEvent::EdgeConnected {
         edge_id: edge_id.clone(),
     });
 
+    // Send handshake response with initial config before frame protocol begins
+    let handshake = HandshakeResponse {
+        listen_ports: listen_ports.clone(),
+        stun_interval_secs,
+    };
+    let mut handshake_json = serde_json::to_string(&handshake)?;
+    handshake_json.push('\n');
+    write_half.write_all(handshake_json.as_bytes()).await?;
+
     // Track this edge
     let streams: Arc<Mutex<HashMap<u32, mpsc::Sender<Vec<u8>>>>> =
         Arc::new(Mutex::new(HashMap::new()));
@@ -258,6 +310,9 @@ async fn handle_edge_connection(
         .unwrap_or_default()
         .as_secs();
 
+    // Create config update channel
+    let (config_tx, mut config_rx) = mpsc::channel::<EdgeConfigUpdate>(16);
+
     {
         let mut edges = connected.lock().await;
         edges.insert(
@@ -265,6 +320,7 @@ async fn handle_edge_connection(
             ConnectedEdgeInfo {
                 connected_at: now,
                 active_streams: streams.clone(),
+                config_tx,
             },
         );
     }
@@ -272,6 +328,23 @@ async fn handle_edge_connection(
     // Shared writer for sending frames back to edge
     let write_half = Arc::new(Mutex::new(write_half));
 
+    // Spawn task to forward config updates as FRAME_CONFIG frames
+    let config_writer = write_half.clone();
+    let config_edge_id = edge_id.clone();
+    let config_handle = tokio::spawn(async move {
+        while let Some(update) = config_rx.recv().await {
+            if let Ok(payload) = serde_json::to_vec(&update) {
+                let frame = encode_frame(0, FRAME_CONFIG, &payload);
+                let mut w = config_writer.lock().await;
+                if w.write_all(&frame).await.is_err() {
+                    log::error!("Failed to send config update to edge {}", config_edge_id);
+                    break;
+                }
+                log::info!("Sent config update to edge {}: ports {:?}", config_edge_id, update.listen_ports);
+            }
+        }
+    });
+
     // Frame reading loop
     let mut frame_reader = FrameReader::new(buf_reader);
 
@@ -398,6 +471,7 @@ async fn handle_edge_connection(
     }
 
     // Cleanup
+    config_handle.abort();
     {
         let mut edges = connected.lock().await;
         edges.remove(&edge_id);

rust/crates/remoteingress-protocol/src/lib.rs

@@ -6,6 +6,7 @@ pub const FRAME_DATA: u8 = 0x02;
 pub const FRAME_CLOSE: u8 = 0x03;
 pub const FRAME_DATA_BACK: u8 = 0x04;
 pub const FRAME_CLOSE_BACK: u8 = 0x05;
+pub const FRAME_CONFIG: u8 = 0x06;     // Hub -> Edge: configuration update
 
 // Frame header size: 4 (stream_id) + 1 (type) + 4 (length) = 9 bytes
 pub const FRAME_HEADER_SIZE: usize = 9;

test/test.ts

@@ -9,4 +9,53 @@ tap.test('should export RemoteIngressEdge', async () => {
   expect(remoteingress.RemoteIngressEdge).toBeTypeOf('function');
 });
 
+tap.test('should export encodeConnectionToken and decodeConnectionToken', async () => {
+  expect(remoteingress.encodeConnectionToken).toBeTypeOf('function');
+  expect(remoteingress.decodeConnectionToken).toBeTypeOf('function');
+});
+
+tap.test('should roundtrip encode → decode a connection token', async () => {
+  const data: remoteingress.IConnectionTokenData = {
+    hubHost: 'hub.example.com',
+    hubPort: 8443,
+    edgeId: 'edge-001',
+    secret: 'super-secret-key',
+  };
+  const token = remoteingress.encodeConnectionToken(data);
+  const decoded = remoteingress.decodeConnectionToken(token);
+  expect(decoded.hubHost).toEqual(data.hubHost);
+  expect(decoded.hubPort).toEqual(data.hubPort);
+  expect(decoded.edgeId).toEqual(data.edgeId);
+  expect(decoded.secret).toEqual(data.secret);
+});
+
+tap.test('should throw on malformed token', async () => {
+  let error: Error | undefined;
+  try {
+    remoteingress.decodeConnectionToken('not-valid-json!!!');
+  } catch (e) {
+    error = e as Error;
+  }
+  expect(error).toBeInstanceOf(Error);
+  expect(error!.message).toInclude('Invalid connection token');
+});
+
+tap.test('should throw on token with missing fields', async () => {
+  // Encode a partial object (missing 'p' and 's')
+  const partial = Buffer.from(JSON.stringify({ h: 'host', e: 'edge' }), 'utf-8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+
+  let error: Error | undefined;
+  try {
+    remoteingress.decodeConnectionToken(partial);
+  } catch (e) {
+    error = e as Error;
+  }
+  expect(error).toBeInstanceOf(Error);
+  expect(error!.message).toInclude('missing required fields');
+});
+
 export default tap.start();

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/remoteingress',
-  version: '3.0.1',
+  version: '3.2.0',
   description: 'Edge ingress tunnel for DcRouter - accepts incoming TCP connections at network edge and tunnels them to DcRouter SmartProxy preserving client IP via PROXY protocol v1.'
 }

ts/classes.remoteingressedge.ts

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.js';
 import { EventEmitter } from 'events';
+import { decodeConnectionToken } from './classes.token.js';
 
 // Command map for the edge side of remoteingress-bin
 type TEdgeCommands = {
@@ -13,8 +14,6 @@ type TEdgeCommands = {
       hubPort: number;
       edgeId: string;
       secret: string;
-      listenPorts: number[];
-      stunIntervalSecs?: number;
     };
     result: { started: boolean };
   };
@@ -39,13 +38,12 @@ export interface IEdgeConfig {
   hubPort?: number;
   edgeId: string;
   secret: string;
-  listenPorts: number[];
-  stunIntervalSecs?: number;
 }
 
 export class RemoteIngressEdge extends EventEmitter {
   private bridge: InstanceType<typeof plugins.smartrust.RustBridge<TEdgeCommands>>;
   private started = false;
+  private statusInterval: ReturnType<typeof setInterval> | undefined;
 
   constructor() {
     super();
@@ -61,9 +59,13 @@ export class RemoteIngressEdge extends EventEmitter {
       requestTimeoutMs: 30_000,
       readyTimeoutMs: 10_000,
       localPaths: [
-        plugins.path.join(packageDir, 'dist_rust'),
+        // Platform-suffixed binary in dist_rust (production)
-        plugins.path.join(packageDir, 'rust', 'target', 'release'),
+        plugins.path.join(packageDir, 'dist_rust', `remoteingress-bin_${process.platform === 'win32' ? 'windows' : 'linux'}_${process.arch === 'x64' ? 'amd64' : process.arch}`),
-        plugins.path.join(packageDir, 'rust', 'target', 'debug'),
+        // Exact binaryName fallback in dist_rust
+        plugins.path.join(packageDir, 'dist_rust', 'remoteingress-bin'),
+        // Development build paths (cargo output uses exact name)
+        plugins.path.join(packageDir, 'rust', 'target', 'release', 'remoteingress-bin'),
+        plugins.path.join(packageDir, 'rust', 'target', 'debug', 'remoteingress-bin'),
       ],
       searchSystemPath: false,
     });
@@ -78,33 +80,72 @@ export class RemoteIngressEdge extends EventEmitter {
     this.bridge.on('management:publicIpDiscovered', (data: { ip: string }) => {
       this.emit('publicIpDiscovered', data);
     });
+    this.bridge.on('management:portsAssigned', (data: { listenPorts: number[] }) => {
+      console.log(`[RemoteIngressEdge] Ports assigned by hub: ${data.listenPorts.join(', ')}`);
+      this.emit('portsAssigned', data);
+    });
+    this.bridge.on('management:portsUpdated', (data: { listenPorts: number[] }) => {
+      console.log(`[RemoteIngressEdge] Ports updated by hub: ${data.listenPorts.join(', ')}`);
+      this.emit('portsUpdated', data);
+    });
   }
 
   /**
    * Start the edge — spawns the Rust binary and connects to the hub.
+   * Accepts either a connection token or an explicit IEdgeConfig.
    */
-  public async start(config: IEdgeConfig): Promise<void> {
+  public async start(config: { token: string } | IEdgeConfig): Promise<void> {
+    let edgeConfig: IEdgeConfig;
+
+    if ('token' in config) {
+      const decoded = decodeConnectionToken(config.token);
+      edgeConfig = {
+        hubHost: decoded.hubHost,
+        hubPort: decoded.hubPort,
+        edgeId: decoded.edgeId,
+        secret: decoded.secret,
+      };
+    } else {
+      edgeConfig = config;
+    }
+
     const spawned = await this.bridge.spawn();
     if (!spawned) {
       throw new Error('Failed to spawn remoteingress-bin');
     }
 
     await this.bridge.sendCommand('startEdge', {
-      hubHost: config.hubHost,
+      hubHost: edgeConfig.hubHost,
-      hubPort: config.hubPort ?? 8443,
+      hubPort: edgeConfig.hubPort ?? 8443,
-      edgeId: config.edgeId,
+      edgeId: edgeConfig.edgeId,
-      secret: config.secret,
+      secret: edgeConfig.secret,
-      listenPorts: config.listenPorts,
-      stunIntervalSecs: config.stunIntervalSecs,
     });
 
     this.started = true;
+
+    // Start periodic status logging
+    this.statusInterval = setInterval(async () => {
+      try {
+        const status = await this.getStatus();
+        console.log(
+          `[RemoteIngressEdge] Status: connected=${status.connected}, ` +
+          `streams=${status.activeStreams}, ports=[${status.listenPorts.join(',')}], ` +
+          `publicIp=${status.publicIp ?? 'unknown'}`
+        );
+      } catch {
+        // Bridge may be shutting down
+      }
+    }, 60_000);
   }
 
   /**
    * Stop the edge and kill the Rust process.
    */
   public async stop(): Promise<void> {
+    if (this.statusInterval) {
+      clearInterval(this.statusInterval);
+      this.statusInterval = undefined;
+    }
     if (this.started) {
       try {
         await this.bridge.sendCommand('stopEdge', {} as Record<string, never>);

ts/classes.remoteingresshub.ts

@@ -20,7 +20,7 @@ type THubCommands = {
   };
   updateAllowedEdges: {
     params: {
-      edges: Array<{ id: string; secret: string }>;
+      edges: Array<{ id: string; secret: string; listenPorts?: number[]; stunIntervalSecs?: number }>;
     };
     result: { updated: boolean };
   };
@@ -61,9 +61,13 @@ export class RemoteIngressHub extends EventEmitter {
       requestTimeoutMs: 30_000,
       readyTimeoutMs: 10_000,
       localPaths: [
-        plugins.path.join(packageDir, 'dist_rust'),
+        // Platform-suffixed binary in dist_rust (production)
-        plugins.path.join(packageDir, 'rust', 'target', 'release'),
+        plugins.path.join(packageDir, 'dist_rust', `remoteingress-bin_${process.platform === 'win32' ? 'windows' : 'linux'}_${process.arch === 'x64' ? 'amd64' : process.arch}`),
-        plugins.path.join(packageDir, 'rust', 'target', 'debug'),
+        // Exact binaryName fallback in dist_rust
+        plugins.path.join(packageDir, 'dist_rust', 'remoteingress-bin'),
+        // Development build paths (cargo output uses exact name)
+        plugins.path.join(packageDir, 'rust', 'target', 'release', 'remoteingress-bin'),
+        plugins.path.join(packageDir, 'rust', 'target', 'debug', 'remoteingress-bin'),
       ],
       searchSystemPath: false,
     });
@@ -118,7 +122,7 @@ export class RemoteIngressHub extends EventEmitter {
   /**
    * Update the list of allowed edges that can connect to this hub.
    */
-  public async updateAllowedEdges(edges: Array<{ id: string; secret: string }>): Promise<void> {
+  public async updateAllowedEdges(edges: Array<{ id: string; secret: string; listenPorts?: number[]; stunIntervalSecs?: number }>): Promise<void> {
     await this.bridge.sendCommand('updateAllowedEdges', { edges });
   }
 

ts/classes.token.ts

@@ -0,0 +1,66 @@
+/**
+ * Connection token utilities for RemoteIngress edge connections.
+ * A token is a base64url-encoded compact JSON object carrying hub connection details.
+ */
+
+export interface IConnectionTokenData {
+  hubHost: string;
+  hubPort: number;
+  edgeId: string;
+  secret: string;
+}
+
+/**
+ * Encode connection data into a single opaque token string (base64url).
+ */
+export function encodeConnectionToken(data: IConnectionTokenData): string {
+  const compact = JSON.stringify({
+    h: data.hubHost,
+    p: data.hubPort,
+    e: data.edgeId,
+    s: data.secret,
+  });
+  // base64url: standard base64 with + → -, / → _, trailing = stripped
+  return Buffer.from(compact, 'utf-8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+/**
+ * Decode a connection token back into its constituent fields.
+ * Throws on malformed or incomplete tokens.
+ */
+export function decodeConnectionToken(token: string): IConnectionTokenData {
+  let parsed: { h?: unknown; p?: unknown; e?: unknown; s?: unknown };
+  try {
+    // Restore standard base64 from base64url
+    let base64 = token.replace(/-/g, '+').replace(/_/g, '/');
+    // Re-add padding
+    const remainder = base64.length % 4;
+    if (remainder === 2) base64 += '==';
+    else if (remainder === 3) base64 += '=';
+
+    const json = Buffer.from(base64, 'base64').toString('utf-8');
+    parsed = JSON.parse(json);
+  } catch {
+    throw new Error('Invalid connection token');
+  }
+
+  if (
+    typeof parsed.h !== 'string' ||
+    typeof parsed.p !== 'number' ||
+    typeof parsed.e !== 'string' ||
+    typeof parsed.s !== 'string'
+  ) {
+    throw new Error('Invalid connection token: missing required fields');
+  }
+
+  return {
+    hubHost: parsed.h,
+    hubPort: parsed.p,
+    edgeId: parsed.e,
+    secret: parsed.s,
+  };
+}

ts/index.ts

@@ -1,2 +1,3 @@
 export * from './classes.remoteingresshub.js';
 export * from './classes.remoteingressedge.js';
+export * from './classes.token.js';