@push.rocks/smartproxy 27.12.8 → 27.13.0

package/dist_ts/proxies/smart-proxy/utils/rust-config.d.ts

@@ -1,6 +1,6 @@
 import type { IAcmeOptions, ISmartProxyOptions } from '../models/interfaces.js';
 import type { IRouteAction, IRouteConfig, IRouteMatch, IRouteTarget, ITargetMatch } from '../models/route-types.js';
-import type { IRustProxyOptions, IRustRouteAction, IRustRouteConfig, IRustRouteMatch, IRustRouteTarget, IRustTargetMatch, TRustHeaderMatchers } from '../models/rust-types.js';
+import type { IRustProxyOptions, IRustChallengeOptions, IRustRouteAction, IRustRouteConfig, IRustRouteMatch, IRustRouteTarget, IRustTargetMatch, TRustHeaderMatchers } from '../models/rust-types.js';
 export declare function serializeHeaderMatchValue(value: string | RegExp): string;
 export declare function serializeHeaderMatchers(headers?: Record<string, string | RegExp>): TRustHeaderMatchers | undefined;
 export declare function serializeTargetMatchForRust(match?: ITargetMatch): IRustTargetMatch | undefined;
@@ -8,4 +8,5 @@ export declare function serializeRouteMatchForRust(match: IRouteMatch): IRustRou
 export declare function serializeRouteTargetForRust(target: IRouteTarget): IRustRouteTarget;
 export declare function serializeRouteActionForRust(action: IRouteAction): IRustRouteAction;
 export declare function serializeRouteForRust(route: IRouteConfig): IRustRouteConfig;
-export declare function buildRustProxyOptions(settings: ISmartProxyOptions, routes: IRustRouteConfig[], acmeOverride?: IAcmeOptions): IRustProxyOptions;
+export declare function buildChallengeOptionsForRust(settings: ISmartProxyOptions): IRustChallengeOptions | undefined;
+export declare function buildRustProxyOptions(settings: ISmartProxyOptions, routes: IRustRouteConfig[], acmeOverride?: IAcmeOptions, challengeOverride?: IRustChallengeOptions): IRustProxyOptions;

package/dist_ts/proxies/smart-proxy/utils/rust-config.js

@@ -96,7 +96,23 @@ function serializeDefaultsForRust(defaults) {
         preserveSourceIp: preserveSourceIP,
     };
 }
-export function buildRustProxyOptions(settings, routes, acmeOverride) {
+export function buildChallengeOptionsForRust(settings) {
+    const hasChallengeRoutes = settings.routes.some((route) => Boolean(route.security?.challenge));
+    if (!hasChallengeRoutes) {
+        return undefined;
+    }
+    const runtimeOptions = settings.challenge || {};
+    return {
+        cookieSigningKey: runtimeOptions.cookieSigningKey || '',
+        pendingCookieName: runtimeOptions.pendingCookieName || '__smartproxy_challenge_pending',
+        clearanceCookieName: runtimeOptions.clearanceCookieName || '__smartproxy_clearance',
+        reservedPathPrefix: runtimeOptions.reservedPathPrefix || '/.well-known/smartproxy-challenge',
+        relaySocketPath: runtimeOptions.relaySocketPath || '',
+        relayTimeoutMs: runtimeOptions.relayTimeoutMs ?? 5_000,
+        pendingTtlSeconds: runtimeOptions.pendingTtlSeconds ?? 300,
+    };
+}
+export function buildRustProxyOptions(settings, routes, acmeOverride, challengeOverride) {
     const acme = acmeOverride !== undefined ? acmeOverride : settings.acme;
     return {
         routes,
@@ -127,7 +143,8 @@ export function buildRustProxyOptions(settings, routes, acmeOverride) {
         extendedKeepAliveLifetime: settings.extendedKeepAliveLifetime,
         metrics: settings.metrics,
         securityPolicy: settings.securityPolicy,
+        challenge: challengeOverride || buildChallengeOptionsForRust(settings),
         acme: serializeAcmeForRust(acme),
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVzdC1jb25maWcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi90cy9wcm94aWVzL3NtYXJ0LXByb3h5L3V0aWxzL3J1c3QtY29uZmlnLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQWVBLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztBQUVqRSxNQUFNLFVBQVUseUJBQXlCLENBQUMsS0FBc0I7SUFDOUQsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUM5QixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFRCxNQUFNLGdCQUFnQixHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDLHFCQUFxQixDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQzdHLElBQUksZ0JBQWdCLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sSUFBSSxLQUFLLENBQ2IsZ0VBQWdFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUM5RixDQUFDO0lBQ0osQ0FBQztJQUVELE9BQU8sSUFBSSxLQUFLLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxLQUFLLEVBQUUsQ0FBQztBQUMzQyxDQUFDO0FBRUQsTUFBTSxVQUFVLHVCQUF1QixDQUFDLE9BQXlDO0lBQy9FLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNiLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFRCxPQUFPLE1BQU0sQ0FBQyxXQUFXLENBQ3ZCLE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsR0FBRyxFQUFFLHlCQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FDdkYsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFVBQVUsMkJBQTJCLENBQUMsS0FBb0I7SUFDOUQsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ1gsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztJQUVELE9BQU87UUFDTCxHQUFHLEtBQUs7UUFDUixPQUFPLEVBQUUsdUJBQXVCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztLQUNoRCxDQUFDO0FBQ0osQ0FBQztBQUVELE1BQU0sVUFBVSwwQkFBMEIsQ0FBQyxLQUFrQjtJQUMzRCxPQUFPO1FBQ0wsR0FBRyxLQUFLO1FBQ1IsT0FBTyxFQUFFLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7S0FDaEQsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFVBQVUsMkJBQTJCLENBQUMsTUFBb0I7SUFDOUQsSUFBSSxPQUFPLE1BQU0sQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNuRSxNQUFNLElBQUksS0FBSyxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUVELElBQUksT0FBTyxNQUFNLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ2xFLE1BQU0sSUFBSSxLQUFLLENBQUMsNkRBQTZELENBQUMsQ0FBQztJQUNqRixDQUFDO0lBRUQsT0FBTztRQUNMLEdBQUcsTUFBTTtRQUNULElBQUksRUFBRSxNQUFNLENBQUMsSUFBSTtRQUNqQixJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUk7UUFDakIsS0FBSyxFQUFFLDJCQUEyQixDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7S0FDakQsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLG1CQUFtQixDQUFDLEdBQXlCO0lBQ3BELElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNULE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFRCxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsR0FBRyxJQUFJLEVBQUUsR0FBRyxHQUFHLENBQUM7SUFFMUMsT0FBTztRQUNMLEdBQUcsSUFBSTtRQUNQLGdCQUFnQixFQUFFLGdCQUFnQjtLQUNuQyxDQUFDO0FBQ0osQ0FBQztBQUVELE1BQU0sVUFBVSwyQkFBMkIsQ0FBQyxNQUFvQjtJQUM5RCxNQUFNLEVBQ0osYUFBYSxFQUFFLGNBQWMsRUFDN0IsZUFBZSxFQUFFLGdCQUFnQixFQUNqQyxnQkFBZ0IsRUFBRSxpQkFBaUIsRUFDbkMsUUFBUSxFQUFFLFNBQVMsRUFDbkIsT0FBTyxFQUNQLEdBQUcsRUFDSCxHQUFHLElBQUksRUFDUixHQUFHLE1BQU0sQ0FBQztJQUVYLE9BQU87UUFDTCxHQUFHLElBQUk7UUFDUCxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsMkJBQTJCLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDdEUsR0FBRyxFQUFFLG1CQUFtQixDQUFDLEdBQUcsQ0FBQztLQUM5QixDQUFDO0FBQ0osQ0FBQztBQUVELE1BQU0sVUFBVSxxQkFBcUIsQ0FBQyxLQUFtQjtJQUN2RCxPQUFPO1FBQ0wsR0FBRyxLQUFLO1FBQ1IsS0FBSyxFQUFFLDBCQUEwQixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7UUFDOUMsTUFBTSxFQUFFLDJCQUEyQixDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7S0FDbEQsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLG9CQUFvQixDQUFDLElBQW1CO0lBQy9DLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNWLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFRCxPQUFPO1FBQ0wsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO1FBQ3JCLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztRQUNqQixXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7UUFDN0IsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1FBQy9CLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtRQUNmLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYTtRQUNqQyxrQkFBa0IsRUFBRSxJQUFJLENBQUMsa0JBQWtCO1FBQzNDLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztRQUN6QixtQkFBbUIsRUFBRSxJQUFJLENBQUMsbUJBQW1CO1FBQzdDLHVCQUF1QixFQUFFLElBQUksQ0FBQyx1QkFBdUI7S0FDdEQsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLHdCQUF3QixDQUFDLFFBQXlDO0lBQ3pFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNkLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFRCxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsR0FBRyxJQUFJLEVBQUUsR0FBRyxRQUFRLENBQUM7SUFFL0MsT0FBTztRQUNMLEdBQUcsSUFBSTtRQUNQLGdCQUFnQixFQUFFLGdCQUFnQjtLQUNuQyxDQUFDO0FBQ0osQ0FBQztBQUVELE1BQU0sVUFBVSxxQkFBcUIsQ0FDbkMsUUFBNEIsRUFDNUIsTUFBMEIsRUFDMUIsWUFBMkI7SUFFM0IsTUFBTSxJQUFJLEdBQUcsWUFBWSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO0lBRXZFLE9BQU87UUFDTCxNQUFNO1FBQ04sZ0JBQWdCLEVBQUUsUUFBUSxDQUFDLGdCQUFnQjtRQUMzQyxlQUFlLEVBQUUsUUFBUSxDQUFDLGVBQWU7UUFDekMsaUJBQWlCLEVBQUUsUUFBUSxDQUFDLGlCQUFpQjtRQUM3QyxRQUFRLEVBQUUsd0JBQXdCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztRQUNyRCxpQkFBaUIsRUFBRSxRQUFRLENBQUMsaUJBQWlCO1FBQzdDLGtCQUFrQixFQUFFLFFBQVEsQ0FBQyxrQkFBa0I7UUFDL0MsYUFBYSxFQUFFLFFBQVEsQ0FBQyxhQUFhO1FBQ3JDLHVCQUF1QixFQUFFLFFBQVEsQ0FBQyx1QkFBdUI7UUFDekQscUJBQXFCLEVBQUUsUUFBUSxDQUFDLHFCQUFxQjtRQUNyRCxpQkFBaUIsRUFBRSxRQUFRLENBQUMsaUJBQWlCO1FBQzdDLHVCQUF1QixFQUFFLFFBQVEsQ0FBQyx1QkFBdUI7UUFDekQsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO1FBQ3pCLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUztRQUM3QixxQkFBcUIsRUFBRSxRQUFRLENBQUMscUJBQXFCO1FBQ3JELGtCQUFrQixFQUFFLFFBQVEsQ0FBQyxrQkFBa0I7UUFDL0Msc0JBQXNCLEVBQUUsUUFBUSxDQUFDLHNCQUFzQjtRQUN2RCxxQkFBcUIsRUFBRSxRQUFRLENBQUMscUJBQXFCO1FBQ3JELHFCQUFxQixFQUFFLFFBQVEsQ0FBQyxxQkFBcUI7UUFDckQscUJBQXFCLEVBQUUsUUFBUSxDQUFDLHFCQUFxQjtRQUNyRCx3QkFBd0IsRUFBRSxRQUFRLENBQUMsd0JBQXdCO1FBQzNELG1CQUFtQixFQUFFLFFBQVEsQ0FBQyxtQkFBbUI7UUFDakQsNEJBQTRCLEVBQUUsUUFBUSxDQUFDLDRCQUE0QjtRQUNuRSxrQkFBa0IsRUFBRSxRQUFRLENBQUMsa0JBQWtCO1FBQy9DLDZCQUE2QixFQUFFLFFBQVEsQ0FBQyw2QkFBNkI7UUFDckUseUJBQXlCLEVBQUUsUUFBUSxDQUFDLHlCQUF5QjtRQUM3RCxPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU87UUFDekIsY0FBYyxFQUFFLFFBQVEsQ0FBQyxjQUFjO1FBQ3ZDLElBQUksRUFBRSxvQkFBb0IsQ0FBQyxJQUFJLENBQUM7S0FDakMsQ0FBQztBQUNKLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVzdC1jb25maWcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi90cy9wcm94aWVzL3NtYXJ0LXByb3h5L3V0aWxzL3J1c3QtY29uZmlnLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQWdCQSxNQUFNLHFCQUFxQixHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFFakUsTUFBTSxVQUFVLHlCQUF5QixDQUFDLEtBQXNCO0lBQzlELElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDOUIsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUM3RyxJQUFJLGdCQUFnQixDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNoQyxNQUFNLElBQUksS0FBSyxDQUNiLGdFQUFnRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDOUYsQ0FBQztJQUNKLENBQUM7SUFFRCxPQUFPLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7QUFDM0MsQ0FBQztBQUVELE1BQU0sVUFBVSx1QkFBdUIsQ0FBQyxPQUF5QztJQUMvRSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDYixPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUN2QixNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEdBQUcsRUFBRSx5QkFBeUIsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQ3ZGLENBQUM7QUFDSixDQUFDO0FBRUQsTUFBTSxVQUFVLDJCQUEyQixDQUFDLEtBQW9CO0lBQzlELElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNYLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFRCxPQUFPO1FBQ0wsR0FBRyxLQUFLO1FBQ1IsT0FBTyxFQUFFLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7S0FDaEQsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFVBQVUsMEJBQTBCLENBQUMsS0FBa0I7SUFDM0QsT0FBTztRQUNMLEdBQUcsS0FBSztRQUNSLE9BQU8sRUFBRSx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDO0tBQ2hELENBQUM7QUFDSixDQUFDO0FBRUQsTUFBTSxVQUFVLDJCQUEyQixDQUFDLE1BQW9CO0lBQzlELElBQUksT0FBTyxNQUFNLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDbkUsTUFBTSxJQUFJLEtBQUssQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFFRCxJQUFJLE9BQU8sTUFBTSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUNsRSxNQUFNLElBQUksS0FBSyxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUVELE9BQU87UUFDTCxHQUFHLE1BQU07UUFDVCxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUk7UUFDakIsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJO1FBQ2pCLEtBQUssRUFBRSwyQkFBMkIsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO0tBQ2pELENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyxtQkFBbUIsQ0FBQyxHQUF5QjtJQUNwRCxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDVCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsTUFBTSxFQUFFLGdCQUFnQixFQUFFLEdBQUcsSUFBSSxFQUFFLEdBQUcsR0FBRyxDQUFDO0lBRTFDLE9BQU87UUFDTCxHQUFHLElBQUk7UUFDUCxnQkFBZ0IsRUFBRSxnQkFBZ0I7S0FDbkMsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFVBQVUsMkJBQTJCLENBQUMsTUFBb0I7SUFDOUQsTUFBTSxFQUNKLGFBQWEsRUFBRSxjQUFjLEVBQzdCLGVBQWUsRUFBRSxnQkFBZ0IsRUFDakMsZ0JBQWdCLEVBQUUsaUJBQWlCLEVBQ25DLFFBQVEsRUFBRSxTQUFTLEVBQ25CLE9BQU8sRUFDUCxHQUFHLEVBQ0gsR0FBRyxJQUFJLEVBQ1IsR0FBRyxNQUFNLENBQUM7SUFFWCxPQUFPO1FBQ0wsR0FBRyxJQUFJO1FBQ1AsT0FBTyxFQUFFLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLDJCQUEyQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3RFLEdBQUcsRUFBRSxtQkFBbUIsQ0FBQyxHQUFHLENBQUM7S0FDOUIsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFVBQVUscUJBQXFCLENBQUMsS0FBbUI7SUFDdkQsT0FBTztRQUNMLEdBQUcsS0FBSztRQUNSLEtBQUssRUFBRSwwQkFBMEIsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDO1FBQzlDLE1BQU0sRUFBRSwyQkFBMkIsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO0tBQ2xELENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyxvQkFBb0IsQ0FBQyxJQUFtQjtJQUMvQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDVixPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsT0FBTztRQUNMLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztRQUNyQixLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUs7UUFDakIsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXO1FBQzdCLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtRQUMvQixJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7UUFDZixhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWE7UUFDakMsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLGtCQUFrQjtRQUMzQyxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7UUFDekIsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLG1CQUFtQjtRQUM3Qyx1QkFBdUIsRUFBRSxJQUFJLENBQUMsdUJBQXVCO0tBQ3RELENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyx3QkFBd0IsQ0FBQyxRQUF5QztJQUN6RSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDZCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsTUFBTSxFQUFFLGdCQUFnQixFQUFFLEdBQUcsSUFBSSxFQUFFLEdBQUcsUUFBUSxDQUFDO0lBRS9DLE9BQU87UUFDTCxHQUFHLElBQUk7UUFDUCxnQkFBZ0IsRUFBRSxnQkFBZ0I7S0FDbkMsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFVBQVUsNEJBQTRCLENBQUMsUUFBNEI7SUFDdkUsTUFBTSxrQkFBa0IsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUMvRixJQUFJLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUN4QixPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsTUFBTSxjQUFjLEdBQUcsUUFBUSxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUM7SUFDaEQsT0FBTztRQUNMLGdCQUFnQixFQUFFLGNBQWMsQ0FBQyxnQkFBZ0IsSUFBSSxFQUFFO1FBQ3ZELGlCQUFpQixFQUFFLGNBQWMsQ0FBQyxpQkFBaUIsSUFBSSxnQ0FBZ0M7UUFDdkYsbUJBQW1CLEVBQUUsY0FBYyxDQUFDLG1CQUFtQixJQUFJLHdCQUF3QjtRQUNuRixrQkFBa0IsRUFBRSxjQUFjLENBQUMsa0JBQWtCLElBQUksbUNBQW1DO1FBQzVGLGVBQWUsRUFBRSxjQUFjLENBQUMsZUFBZSxJQUFJLEVBQUU7UUFDckQsY0FBYyxFQUFFLGNBQWMsQ0FBQyxjQUFjLElBQUksS0FBSztRQUN0RCxpQkFBaUIsRUFBRSxjQUFjLENBQUMsaUJBQWlCLElBQUksR0FBRztLQUMzRCxDQUFDO0FBQ0osQ0FBQztBQUVELE1BQU0sVUFBVSxxQkFBcUIsQ0FDbkMsUUFBNEIsRUFDNUIsTUFBMEIsRUFDMUIsWUFBMkIsRUFDM0IsaUJBQXlDO0lBRXpDLE1BQU0sSUFBSSxHQUFHLFlBQVksS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztJQUV2RSxPQUFPO1FBQ0wsTUFBTTtRQUNOLGdCQUFnQixFQUFFLFFBQVEsQ0FBQyxnQkFBZ0I7UUFDM0MsZUFBZSxFQUFFLFFBQVEsQ0FBQyxlQUFlO1FBQ3pDLGlCQUFpQixFQUFFLFFBQVEsQ0FBQyxpQkFBaUI7UUFDN0MsUUFBUSxFQUFFLHdCQUF3QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7UUFDckQsaUJBQWlCLEVBQUUsUUFBUSxDQUFDLGlCQUFpQjtRQUM3QyxrQkFBa0IsRUFBRSxRQUFRLENBQUMsa0JBQWtCO1FBQy9DLGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYTtRQUNyQyx1QkFBdUIsRUFBRSxRQUFRLENBQUMsdUJBQXVCO1FBQ3pELHFCQUFxQixFQUFFLFFBQVEsQ0FBQyxxQkFBcUI7UUFDckQsaUJBQWlCLEVBQUUsUUFBUSxDQUFDLGlCQUFpQjtRQUM3Qyx1QkFBdUIsRUFBRSxRQUFRLENBQUMsdUJBQXVCO1FBQ3pELE9BQU8sRUFBRSxRQUFRLENBQUMsT0FBTztRQUN6QixTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVM7UUFDN0IscUJBQXFCLEVBQUUsUUFBUSxDQUFDLHFCQUFxQjtRQUNyRCxrQkFBa0IsRUFBRSxRQUFRLENBQUMsa0JBQWtCO1FBQy9DLHNCQUFzQixFQUFFLFFBQVEsQ0FBQyxzQkFBc0I7UUFDdkQscUJBQXFCLEVBQUUsUUFBUSxDQUFDLHFCQUFxQjtRQUNyRCxxQkFBcUIsRUFBRSxRQUFRLENBQUMscUJBQXFCO1FBQ3JELHFCQUFxQixFQUFFLFFBQVEsQ0FBQyxxQkFBcUI7UUFDckQsd0JBQXdCLEVBQUUsUUFBUSxDQUFDLHdCQUF3QjtRQUMzRCxtQkFBbUIsRUFBRSxRQUFRLENBQUMsbUJBQW1CO1FBQ2pELDRCQUE0QixFQUFFLFFBQVEsQ0FBQyw0QkFBNEI7UUFDbkUsa0JBQWtCLEVBQUUsUUFBUSxDQUFDLGtCQUFrQjtRQUMvQyw2QkFBNkIsRUFBRSxRQUFRLENBQUMsNkJBQTZCO1FBQ3JFLHlCQUF5QixFQUFFLFFBQVEsQ0FBQyx5QkFBeUI7UUFDN0QsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO1FBQ3pCLGNBQWMsRUFBRSxRQUFRLENBQUMsY0FBYztRQUN2QyxTQUFTLEVBQUUsaUJBQWlCLElBQUksNEJBQTRCLENBQUMsUUFBUSxDQUFDO1FBQ3RFLElBQUksRUFBRSxvQkFBb0IsQ0FBQyxJQUFJLENBQUM7S0FDakMsQ0FBQztBQUNKLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "27.12.8",
+  "version": "27.13.0",
   "private": false,
   "description": "A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",
@@ -21,6 +21,7 @@
     "ws": "^8.20.1"
   },
   "dependencies": {
+    "@push.rocks/smartchallenge": "^1.1.0",
     "@push.rocks/smartcrypto": "^2.0.4",
     "@push.rocks/smartlog": "^3.2.2",
     "@push.rocks/smartnftables": "^1.2.0",

package/readme.md

@@ -9,9 +9,11 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 ## 📦 Installation
 
 ```bash
-pnpm add @push.rocks/smartproxy
+pnpm add @push.rocks/smartproxy @push.rocks/smartchallenge
 ```
 
+`@push.rocks/smartchallenge` is only required when you use the route challenge example below.
+
 ## 🎯 What is SmartProxy?
 
 SmartProxy is a production-ready proxy solution that takes the complexity out of traffic management. Under the hood, all networking — TCP, UDP, TLS, HTTP reverse proxy, QUIC/HTTP3, connection tracking, security enforcement, and NFTables — is handled by a **Rust engine** for maximum performance, while you configure everything through a clean TypeScript API with full type safety.
@@ -556,6 +558,55 @@ Comprehensive per-route security options:
 
 Security options are configured directly on each route's `security` property — no separate helpers needed.
 
+### 🛡️ Route Challenge Enforcement
+
+SmartProxy can enforce browser-facing challenges through providers from `@push.rocks/smartchallenge`. Route configs store challenge intent only: `providerId`, `challengeType`, `policyRef`, `settings`, `applyTo`, and `clearance`. Runtime wiring such as provider endpoints, socket paths, ports, deployment IDs, secrets, API tokens, and credentials must stay outside `security.challenge`.
+
+```typescript
+import { SmartProxy } from '@push.rocks/smartproxy';
+import { SmartChallengeProvider, WaitChallengeType } from '@push.rocks/smartchallenge';
+
+const provider = new SmartChallengeProvider({
+  challengeTypes: [new WaitChallengeType()],
+});
+
+const proxy = new SmartProxy({
+  routes: [{
+    name: 'wait-protected-app',
+    match: {
+      ports: 443,
+      domains: 'app.example.com',
+      protocol: 'http',
+    },
+    action: {
+      type: 'forward',
+      targets: [{ host: 'app-backend', port: 8080 }],
+      tls: { mode: 'terminate', certificate: 'auto' },
+    },
+    security: {
+      challenge: {
+        providerId: 'smartchallenge',
+        challengeType: 'wait',
+        settings: { waitSeconds: 5 },
+        applyTo: { methods: ['GET'], browserNavigationsOnly: true },
+        clearance: { ttlSeconds: 1800, bindToHost: true, bindToRoute: true },
+      },
+    },
+  }],
+  challenge: {
+    pendingTtlSeconds: 300,
+    relayTimeoutMs: 5000,
+  },
+});
+
+proxy.registerChallengeProvider('smartchallenge', provider);
+await proxy.start();
+```
+
+Challenge flow: the first matching protected request calls the provider `assess` operation, renders a provider response, and stores signed pending state in an HTTP-only cookie. Verification can happen by returning to the protected URL or by submitting to `/.well-known/smartproxy-challenge/*`; reserved verification requests pass query parameters plus JSON or `application/x-www-form-urlencoded` body fields as provider `payload`. Successful verification sets a signed clearance cookie and redirects to the original protected URL stored in the pending cookie.
+
+Current challenge routes must set a stable `name` or `id`, use `action.type: 'forward'`, use `match.protocol: 'http'`, and use TCP HTTP-visible traffic. TLS passthrough, UDP/HTTP3, `match.transport: 'all'`, socket-handler routes, dynamic forwarding targets, and nftables forwarding are rejected for challenged routes.
+
 ### 📊 Runtime Management
 
 Control your proxy without restarts:
@@ -943,6 +994,7 @@ class SmartProxy extends EventEmitter {
   // Route Management (atomic, mutex-locked)
   updateRoutes(routes: IRouteConfig[]): Promise<void>;
   updateSecurityPolicy(policy: ISmartProxySecurityPolicy): Promise<void>;
+  registerChallengeProvider(providerId: string, provider: IChallengeProvider): void;
 
   // Port Management
   addListeningPort(port: number): Promise<void>;
@@ -1029,6 +1081,17 @@ interface ISmartProxyOptions {
     blockedCidrs?: string[];
   };                                        // Global ingress block policy
 
+  // Runtime-only challenge enforcement settings
+  challenge?: {
+    cookieSigningKey?: string;              // Generated ephemerally when omitted
+    pendingCookieName?: string;             // Default: __smartproxy_challenge_pending
+    clearanceCookieName?: string;           // Default: __smartproxy_clearance
+    reservedPathPrefix?: string;            // Default: /.well-known/smartproxy-challenge
+    relaySocketPath?: string;               // Internal Unix socket path; normally generated by SmartProxy
+    relayTimeoutMs?: number;                // Provider relay timeout (default: 5000)
+    pendingTtlSeconds?: number;             // Pending challenge cookie TTL (default: 300)
+  };
+
   // Keep-alive
   keepAliveTreatment?: 'standard' | 'extended' | 'immortal';
   keepAliveInactivityMultiplier?: number;   // (default: 4)

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '27.12.8',
+  version: '27.13.0',
   description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 }

package/ts/index.ts

@@ -7,7 +7,7 @@ export { SmartProxy } from './proxies/smart-proxy/index.js';
 export { SharedRouteManager as RouteManager } from './core/routing/route-manager.js';
 
 // Export smart-proxy models
-export type { ISmartProxyOptions, ISmartProxySecurityPolicy, IConnectionRecord, IRouteConfig, IRouteMatch, IRouteAction, IRouteTls, IRouteContext, TDatagramHandler, IDatagramInfo, IActiveConnectionSnapshot, IActiveConnectionSnapshotOptions } from './proxies/smart-proxy/models/index.js';
+export type { ISmartProxyOptions, ISmartProxySecurityPolicy, ISmartProxyChallengeOptions, IConnectionRecord, IRouteConfig, IRouteMatch, IRouteAction, IRouteTls, IRouteContext, TDatagramHandler, IDatagramInfo, IActiveConnectionSnapshot, IActiveConnectionSnapshotOptions } from './proxies/smart-proxy/models/index.js';
 export type { TSmartProxyCertProvisionObject, ICertProvisionEventComms, ICertificateIssuedEvent, ICertificateFailedEvent } from './proxies/smart-proxy/models/interfaces.js';
 export * from './proxies/smart-proxy/utils/index.js';
 

package/ts/plugins.ts

@@ -1,5 +1,6 @@
 // node native scope
 import { EventEmitter } from 'node:events';
+import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as http from 'node:http';
 import * as net from 'node:net';
@@ -8,7 +9,7 @@ import * as tls from 'node:tls';
 import * as url from 'node:url';
 import * as http2 from 'node:http2';
 
-export { EventEmitter, fs, http, net, path, tls, url, http2 };
+export { EventEmitter, crypto, fs, http, net, path, tls, url, http2 };
 
 // tsclass scope
 import * as tsclass from '@tsclass/tsclass';
@@ -19,11 +20,13 @@ export { tsclass };
 import * as smartcrypto from '@push.rocks/smartcrypto';
 import * as smartlog from '@push.rocks/smartlog';
 import * as smartlogDestinationLocal from '@push.rocks/smartlog/destination-local';
+import * as smartchallenge from '@push.rocks/smartchallenge';
 import * as smartnftables from '@push.rocks/smartnftables';
 import * as smartrust from '@push.rocks/smartrust';
 
 export {
   smartcrypto,
+  smartchallenge,
   smartlog,
   smartlogDestinationLocal,
   smartnftables,

package/ts/proxies/smart-proxy/challenge-provider-relay-server.ts

@@ -0,0 +1,338 @@
+import * as plugins from '../../plugins.js';
+import { logger } from '../../core/utils/logger.js';
+
+type TChallengeRelayOperation = 'assess' | 'render' | 'verify';
+
+interface IChallengeRelayRequest {
+  id?: string;
+  operation: TChallengeRelayOperation;
+  providerId: string;
+  request: unknown;
+}
+
+interface IChallengeRelayResponse {
+  id?: string;
+  success: boolean;
+  result?: unknown;
+  error?: string;
+}
+
+const maxChallengeRelayMessageBytes = 1024 * 1024;
+const maxChallengeRelayIdBytes = 256;
+
+export interface IChallengeProviderRelayServerOptions {
+  providerTimeoutMs?: number;
+  maxActiveProviderOperations?: number;
+  maxUnsettledProviderOperations?: number;
+}
+
+export class ChallengeProviderRelayServer {
+  private providerTimeoutMs: number;
+  private maxActiveProviderOperations: number;
+  private maxUnsettledProviderOperations: number;
+  private activeProviderOperations = 0;
+  private unsettledProviderOperations = 0;
+  private server: plugins.net.Server | null = null;
+  private socketPath: string;
+  private activeSockets = new Set<plugins.net.Socket>();
+  private startPromise?: Promise<void>;
+
+  constructor(
+    private providers: Map<string, plugins.smartchallenge.IChallengeProvider>,
+    optionsArg: IChallengeProviderRelayServerOptions = {},
+  ) {
+    this.socketPath = `/tmp/smartproxy-challenge-relay-${process.pid}-${plugins.crypto.randomBytes(8).toString('hex')}.sock`;
+    this.providerTimeoutMs = Math.max(1, optionsArg.providerTimeoutMs ?? 5_000);
+    this.maxActiveProviderOperations = Math.max(1, optionsArg.maxActiveProviderOperations ?? 1024);
+    this.maxUnsettledProviderOperations = Math.max(1, optionsArg.maxUnsettledProviderOperations ?? this.maxActiveProviderOperations);
+  }
+
+  public getSocketPath(): string {
+    return this.socketPath;
+  }
+
+  public async start(): Promise<void> {
+    if (this.server) return;
+    if (this.startPromise) return this.startPromise;
+    this.startPromise = this.startInternal();
+    try {
+      await this.startPromise;
+    } finally {
+      this.startPromise = undefined;
+    }
+  }
+
+  private async startInternal(): Promise<void> {
+    try {
+      await plugins.fs.promises.unlink(this.socketPath);
+    } catch {
+      // Ignore stale socket cleanup failures for missing files.
+    }
+
+    const server = plugins.net.createServer((socket) => {
+      this.activeSockets.add(socket);
+      socket.once('close', () => this.activeSockets.delete(socket));
+      this.handleConnection(socket);
+    });
+
+    server.on('error', (err) => {
+      logger.log('error', `ChallengeProviderRelayServer error: ${err.message}`, { component: 'challenge-provider-relay-server' });
+    });
+
+    await new Promise<void>((resolve, reject) => {
+      const handleError = (err: Error) => reject(err);
+      server.once('error', handleError);
+      server.listen(this.socketPath, () => {
+        server.off('error', handleError);
+        this.server = server;
+        logger.log('info', `ChallengeProviderRelayServer listening on ${this.socketPath}`, { component: 'challenge-provider-relay-server' });
+        resolve();
+      });
+    }).catch((err) => {
+      server.close();
+      throw err;
+    });
+  }
+
+  public async stop(): Promise<void> {
+    if (this.startPromise && !this.server) {
+      await this.startPromise.catch(() => undefined);
+    }
+
+    for (const socket of this.activeSockets) {
+      socket.destroy();
+    }
+    this.activeSockets.clear();
+
+    const server = this.server;
+    if (!server) return;
+    this.server = null;
+    await new Promise<void>((resolve) => {
+      server.close(() => {
+        plugins.fs.unlink(this.socketPath, () => resolve());
+      });
+    });
+  }
+
+  private handleConnection(socket: plugins.net.Socket): void {
+    let buffer: Buffer<ArrayBufferLike> = Buffer.alloc(0);
+    socket.setTimeout(Math.max(10_000, this.providerTimeoutMs + 1_000));
+    socket.on('timeout', () => socket.destroy());
+    socket.on('error', (err) => {
+      logger.log('warn', `Challenge relay socket error: ${err.message}`, { component: 'challenge-provider-relay-server' });
+    });
+
+    socket.on('data', (chunk: Buffer) => {
+      buffer = buffer.length === 0 ? chunk : Buffer.concat([buffer, chunk], buffer.length + chunk.length);
+      if (buffer.length > maxChallengeRelayMessageBytes) {
+        socket.removeAllListeners('data');
+        this.writeResponse(socket, { success: false, error: 'Challenge relay request exceeds maximum size' });
+        buffer = Buffer.alloc(0);
+        socket.end();
+        return;
+      }
+
+      const newlineIndex = buffer.indexOf(0x0a);
+      if (newlineIndex === -1) return;
+
+      const line = buffer.subarray(0, newlineIndex).toString('utf8');
+      socket.removeAllListeners('data');
+      this.dispatchLine(line)
+        .then((response) => this.writeResponse(socket, response))
+        .catch((err) => this.writeResponse(socket, { success: false, error: (err as Error).message }))
+        .finally(() => socket.end());
+    });
+  }
+
+  private async dispatchLine(lineArg: string): Promise<IChallengeRelayResponse> {
+    let request: IChallengeRelayRequest;
+    try {
+      request = JSON.parse(lineArg) as IChallengeRelayRequest;
+    } catch {
+      return { success: false, error: 'Invalid challenge relay JSON' };
+    }
+
+    const provider = this.providers.get(request.providerId);
+    if (!provider) {
+      return {
+        id: request.id,
+        success: false,
+        error: `Challenge provider '${request.providerId}' is not registered`,
+      };
+    }
+
+    switch (request.operation) {
+      case 'assess':
+        return { id: request.id, success: true, result: await this.withProviderTimeout(() => provider.assess(request.request as plugins.smartchallenge.IChallengeAssessRequest), 'assess') };
+      case 'render':
+        return { id: request.id, success: true, result: await this.withProviderTimeout(() => provider.render(request.request as plugins.smartchallenge.IChallengeRenderRequest), 'render') };
+      case 'verify':
+        return { id: request.id, success: true, result: await this.withProviderTimeout(() => provider.verify(request.request as plugins.smartchallenge.IChallengeVerifyRequest), 'verify') };
+      default:
+        const operationValue = (request as { operation?: unknown }).operation;
+        return { id: request.id, success: false, error: `Unsupported challenge relay operation '${String(operationValue)}'` };
+    }
+  }
+
+  private async withProviderTimeout<T>(operationArg: () => Promise<T>, operationNameArg: TChallengeRelayOperation): Promise<T> {
+    if (this.activeProviderOperations >= this.maxActiveProviderOperations) {
+      throw new Error(`Challenge provider ${operationNameArg} rejected because too many operations are active`);
+    }
+    if (this.unsettledProviderOperations >= this.maxUnsettledProviderOperations) {
+      throw new Error(`Challenge provider ${operationNameArg} rejected because too many timed-out operations are still settling`);
+    }
+
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let activeReleased = false;
+    let unsettledReleased = false;
+    const releaseActive = () => {
+      if (!activeReleased) {
+        activeReleased = true;
+        this.activeProviderOperations -= 1;
+      }
+    };
+    const releaseUnsettled = () => {
+      if (!unsettledReleased) {
+        unsettledReleased = true;
+        this.unsettledProviderOperations -= 1;
+      }
+    };
+    this.activeProviderOperations += 1;
+    this.unsettledProviderOperations += 1;
+    const providerPromise = Promise.resolve().then(operationArg);
+    const trackedProviderPromise = providerPromise.then(
+      (result) => {
+        releaseActive();
+        releaseUnsettled();
+        return result;
+      },
+      (err) => {
+        releaseActive();
+        releaseUnsettled();
+        throw err;
+      },
+    );
+    trackedProviderPromise.catch(() => undefined);
+    try {
+      return await Promise.race([
+        trackedProviderPromise,
+        new Promise<T>((_resolve, reject) => {
+          timer = setTimeout(
+            () => {
+              releaseActive();
+              reject(new Error(`Challenge provider ${operationNameArg} timed out after ${this.providerTimeoutMs}ms`));
+            },
+            this.providerTimeoutMs,
+          );
+        }),
+      ]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
+  private writeResponse(socket: plugins.net.Socket, responseArg: IChallengeRelayResponse): void {
+    let response = responseArg;
+    if (this.estimateJsonByteLength(response, maxChallengeRelayMessageBytes) === undefined) {
+      response = this.createErrorResponse(responseArg.id, 'Challenge relay response exceeds maximum size');
+    }
+
+    let serializedResponse: string;
+    try {
+      serializedResponse = JSON.stringify(response);
+    } catch {
+      serializedResponse = JSON.stringify(this.createErrorResponse(responseArg.id, 'Challenge relay response is not serializable'));
+    }
+
+    if (Buffer.byteLength(serializedResponse, 'utf8') > maxChallengeRelayMessageBytes) {
+      serializedResponse = JSON.stringify({
+        success: false,
+        error: 'Challenge relay response exceeds maximum size',
+      });
+    }
+
+    socket.write(`${serializedResponse}\n`);
+  }
+
+  private createErrorResponse(idArg: string | undefined, errorArg: string): IChallengeRelayResponse {
+    const response: IChallengeRelayResponse = {
+      success: false,
+      error: errorArg,
+    };
+    if (idArg && Buffer.byteLength(idArg, 'utf8') <= maxChallengeRelayIdBytes) {
+      response.id = idArg;
+    }
+    return response;
+  }
+
+  private estimateJsonByteLength(
+    valueArg: unknown,
+    maxBytesArg: number,
+    seenArg = new Set<object>(),
+  ): number | undefined {
+    const bytes = this.estimateJsonByteLengthInternal(valueArg, maxBytesArg, seenArg);
+    return bytes !== undefined && bytes <= maxBytesArg ? bytes : undefined;
+  }
+
+  private estimateJsonByteLengthInternal(
+    valueArg: unknown,
+    maxBytesArg: number,
+    seenArg: Set<object>,
+  ): number | undefined {
+    if (valueArg === null) return 4;
+    if (typeof valueArg === 'string') return this.estimateJsonStringByteLength(valueArg, maxBytesArg);
+    if (typeof valueArg === 'number') return Number.isFinite(valueArg) ? String(valueArg).length : 4;
+    if (typeof valueArg === 'boolean') return valueArg ? 4 : 5;
+    if (typeof valueArg === 'undefined') return 4;
+    if (typeof valueArg === 'bigint' || typeof valueArg === 'symbol' || typeof valueArg === 'function') return undefined;
+    if (typeof valueArg !== 'object') return undefined;
+    if (seenArg.has(valueArg)) return undefined;
+
+    seenArg.add(valueArg);
+    try {
+      let totalBytes = 2;
+      if (Array.isArray(valueArg)) {
+        for (let i = 0; i < valueArg.length; i++) {
+          const childBytes = this.estimateJsonByteLengthInternal(valueArg[i], maxBytesArg, seenArg);
+          if (childBytes === undefined) return undefined;
+          totalBytes += childBytes + (i > 0 ? 1 : 0);
+          if (totalBytes > maxBytesArg) return undefined;
+        }
+        return totalBytes;
+      }
+
+      let propertyCount = 0;
+      for (const [key, value] of Object.entries(valueArg as Record<string, unknown>)) {
+        if (typeof value === 'undefined' || typeof value === 'function' || typeof value === 'symbol') continue;
+        const keyBytes = this.estimateJsonStringByteLength(key, maxBytesArg);
+        const valueBytes = this.estimateJsonByteLengthInternal(value, maxBytesArg, seenArg);
+        if (keyBytes === undefined || valueBytes === undefined) return undefined;
+        totalBytes += keyBytes + valueBytes + 1 + (propertyCount > 0 ? 1 : 0);
+        propertyCount += 1;
+        if (totalBytes > maxBytesArg) return undefined;
+      }
+      return totalBytes;
+    } finally {
+      seenArg.delete(valueArg);
+    }
+  }
+
+  private estimateJsonStringByteLength(valueArg: string, maxBytesArg: number): number | undefined {
+    let bytes = Buffer.byteLength(valueArg, 'utf8') + 2;
+    if (bytes > maxBytesArg) return undefined;
+
+    for (let i = 0; i < valueArg.length; i++) {
+      const code = valueArg.charCodeAt(i);
+      if (code === 0x22 || code === 0x5c) {
+        bytes += 1;
+      } else if (code === 0x08 || code === 0x09 || code === 0x0a || code === 0x0c || code === 0x0d) {
+        bytes += 1;
+      } else if (code < 0x20) {
+        bytes += 5;
+      }
+      if (bytes > maxBytesArg) return undefined;
+    }
+
+    return bytes;
+  }
+}

package/ts/proxies/smart-proxy/models/index.ts

@@ -2,6 +2,6 @@
  * SmartProxy models
  */
 // Export everything except IAcmeOptions from interfaces
-export type { ISmartProxyOptions, ISmartProxySecurityPolicy, ISmartProxyCertStore, IConnectionRecord, TSmartProxyCertProvisionObject, ICertProvisionEventComms, ICertificateIssuedEvent, ICertificateFailedEvent, IActiveConnectionSnapshot, IActiveConnectionSnapshotOptions } from './interfaces.js';
+export type { ISmartProxyOptions, ISmartProxySecurityPolicy, ISmartProxyChallengeOptions, ISmartProxyCertStore, IConnectionRecord, TChallengeProviderRegistry, TSmartProxyCertProvisionObject, ICertProvisionEventComms, ICertificateIssuedEvent, ICertificateFailedEvent, IActiveConnectionSnapshot, IActiveConnectionSnapshotOptions } from './interfaces.js';
 export * from './route-types.js';
 export * from './metrics-types.js';

package/ts/proxies/smart-proxy/models/interfaces.ts

@@ -34,6 +34,17 @@ export interface ISmartProxySecurityPolicy {
   blockedCidrs?: string[];
 }
 
+export interface ISmartProxyChallengeOptions {
+  /** Runtime-only cookie signing key. If omitted, SmartProxy generates an ephemeral key. */
+  cookieSigningKey?: string;
+  pendingCookieName?: string;
+  clearanceCookieName?: string;
+  reservedPathPrefix?: string;
+  relaySocketPath?: string;
+  relayTimeoutMs?: number;
+  pendingTtlSeconds?: number;
+}
+
 /**
  * Provision object for static or HTTP-01 certificate
  */
@@ -171,6 +182,9 @@ export interface ISmartProxyOptions {
   connectionRateLimitPerMinute?: number; // Max new connections per minute from a single IP
   securityPolicy?: ISmartProxySecurityPolicy; // Global ingress block policy, enforced before routing
 
+  /** Runtime-only challenge enforcement settings. Never store this in route configs. */
+  challenge?: ISmartProxyChallengeOptions;
+
   // Enhanced keep-alive settings
   keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections
   keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections
@@ -249,6 +263,8 @@ export interface ISmartProxyOptions {
   rustBinaryPath?: string;
 }
 
+export type TChallengeProviderRegistry = Map<string, plugins.smartchallenge.IChallengeProvider>;
+
 /**
  * Enhanced connection record
  */

package/ts/proxies/smart-proxy/models/route-types.ts

@@ -196,6 +196,9 @@ export interface IRouteSecurity {
     /** Allowed VPN tunnel IPs, kept for compatibility. Prefer allowedClients. */
     allowedAssignedIps?: string[];
   };
+
+  /** Browser-facing challenge policy. SmartProxy enforces this in the HTTP path. */
+  challenge?: plugins.smartchallenge.IRouteChallengeConfig;
 }
 
 /**

package/ts/proxies/smart-proxy/models/rust-types.ts

@@ -1,5 +1,5 @@
 import type { IProtocolCacheEntry, IProtocolDistribution } from './metrics-types.js';
-import type { IAcmeOptions, ISmartProxyOptions, ISmartProxySecurityPolicy } from './interfaces.js';
+import type { IAcmeOptions, ISmartProxyChallengeOptions, ISmartProxyOptions, ISmartProxySecurityPolicy } from './interfaces.js';
 import type {
   IRouteAction,
   IRouteConfig,
@@ -46,6 +46,11 @@ export interface IRustRouteConfig extends Omit<IRouteConfig, 'match' | 'action'>
 
 export interface IRustAcmeOptions extends Omit<IAcmeOptions, 'routeForwards'> {}
 
+export interface IRustChallengeOptions extends Required<Pick<
+  ISmartProxyChallengeOptions,
+  'cookieSigningKey' | 'pendingCookieName' | 'clearanceCookieName' | 'reservedPathPrefix' | 'relaySocketPath' | 'relayTimeoutMs' | 'pendingTtlSeconds'
+>> {}
+
 export interface IRustProxyOptions {
   routes: IRustRouteConfig[];
   preserveSourceIp?: boolean;
@@ -75,6 +80,7 @@ export interface IRustProxyOptions {
   extendedKeepAliveLifetime?: number;
   metrics?: ISmartProxyOptions['metrics'];
   securityPolicy?: ISmartProxySecurityPolicy;
+  challenge?: IRustChallengeOptions;
   acme?: IRustAcmeOptions;
 }