@push.rocks/smartproxy 27.9.0 → 27.10.1

package/.smartconfig.json

@@ -28,12 +28,17 @@
       ]
     },
     "release": {
-      "registries": [
-        "https://verdaccio.lossless.digital",
-        "https://registry.npmjs.org"
-      ],
-      "accessLevel": "public"
-    }
+      "targets": {
+        "npm": {
+          "registries": [
+            "https://verdaccio.lossless.digital",
+            "https://registry.npmjs.org"
+          ],
+          "accessLevel": "public"
+        }
+      }
+    },
+    "schemaVersion": 2
   },
   "@git.zone/tsdoc": {
     "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
@@ -42,6 +47,9 @@
     "npmGlobalTools": []
   },
   "@git.zone/tsrust": {
-    "targets": ["linux_amd64", "linux_arm64"]
+    "targets": [
+      "linux_amd64",
+      "linux_arm64"
+    ]
   }
 }

package/changelog.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## Pending
+
+
+## 2026-05-12 - 27.10.1
+
+### Fixes
+
+- handle HTTP/3 backend forwarding failures with protocol fallback and pool cleanup (proxy-service)
+  - Retry bodyless requests over HTTP/1.1 when HTTP/3 forwarding fails in auto backend protocol mode
+  - Remove broken HTTP/3 pooled connections and record protocol cache failures to avoid repeated H3 reuse
+  - Add regression coverage for backends that advertise an unavailable Alt-Svc HTTP/3 endpoint
+  - Refresh documentation examples and API notes to reflect target-level load balancing and certificate provisioning event hooks
+
+## 2026-04-30 - 27.10.0 - feat(exports)
+export datagram handler types and align tests with updated nftables and route security APIs
+
+- Exports TDatagramHandler and IDatagramInfo from the public index.
+- Updates nftables integration tests for the new grouped status shape and null result after shutdown.
+- Moves route IP allow list configuration to security and awaits the asynchronous listening ports API.
+- Enables stricter TypeScript checks with noImplicitAny and safer error handling in tests.
+
 ## 2026-04-26 - 27.9.0 - feat(smart-proxy)
 add hot-reloadable global ingress security policy across Rust and TypeScript proxy layers
 
@@ -1199,4 +1220,4 @@ Fix ACME certificate provisioning timing to ensure ports are listening first
 - Fixed race condition where certificate provisioning would start before ports were listening
 - Modified SmartCertManager.initialize() to defer certificate provisioning
 - Added SmartCertManager.provisionCertificatesAfterPortsReady() for delayed provisioning
-- Updated SmartProxy.start() to call certificate provisioning after ports are ready
+- Updated SmartProxy.start() to call certificate provisioning after ports are ready

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartproxy',
-    version: '27.9.0',
+    version: '27.10.1',
     description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHFQQUFxUDtDQUNuUSxDQUFBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHFQQUFxUDtDQUNuUSxDQUFBIn0=

package/dist_ts/index.d.ts

@@ -3,7 +3,7 @@
  */
 export { SmartProxy } from './proxies/smart-proxy/index.js';
 export { SharedRouteManager as RouteManager } from './core/routing/route-manager.js';
-export type { ISmartProxyOptions, ISmartProxySecurityPolicy, IConnectionRecord, IRouteConfig, IRouteMatch, IRouteAction, IRouteTls, IRouteContext } from './proxies/smart-proxy/models/index.js';
+export type { ISmartProxyOptions, ISmartProxySecurityPolicy, IConnectionRecord, IRouteConfig, IRouteMatch, IRouteAction, IRouteTls, IRouteContext, TDatagramHandler, IDatagramInfo } from './proxies/smart-proxy/models/index.js';
 export type { TSmartProxyCertProvisionObject, ICertProvisionEventComms, ICertificateIssuedEvent, ICertificateFailedEvent } from './proxies/smart-proxy/models/interfaces.js';
 export * from './proxies/smart-proxy/utils/index.js';
 export * from './core/models/common-types.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "27.9.0",
+  "version": "27.10.1",
   "private": false,
   "description": "A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",
@@ -8,32 +8,25 @@
   "type": "module",
   "author": "Lossless GmbH",
   "license": "MIT",
-  "scripts": {
-    "test:before": "(tsrust)",
-    "test": "(tstest test/**/test*.ts --verbose --timeout 60 --logfile)",
-    "build": "(tsbuild tsfolders --allowimplicitany) && (tsrust)",
-    "format": "(gitzone format)",
-    "buildDocs": "tsdoc"
-  },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.4.0",
-    "@git.zone/tsrun": "^2.0.2",
-    "@git.zone/tsrust": "^1.3.2",
-    "@git.zone/tstest": "^3.6.0",
-    "@push.rocks/smartserve": "^2.0.3",
-    "@types/node": "^25.5.0",
+    "@git.zone/tsbuild": "^4.4.1",
+    "@git.zone/tsrun": "^2.0.4",
+    "@git.zone/tsrust": "^1.3.4",
+    "@git.zone/tstest": "^3.6.6",
+    "@push.rocks/smartserve": "^2.0.4",
+    "@types/node": "^25.7.0",
     "@types/ws": "^8.18.1",
-    "typescript": "^6.0.2",
+    "typescript": "^6.0.3",
     "why-is-node-running": "^3.2.2",
-    "ws": "^8.20.0"
+    "ws": "^8.20.1"
   },
   "dependencies": {
     "@push.rocks/smartcrypto": "^2.0.4",
-    "@push.rocks/smartlog": "^3.2.1",
-    "@push.rocks/smartnftables": "^1.0.1",
-    "@push.rocks/smartrust": "^1.3.2",
-    "@tsclass/tsclass": "^9.5.0",
-    "minimatch": "^10.2.4"
+    "@push.rocks/smartlog": "^3.2.2",
+    "@push.rocks/smartnftables": "^1.2.0",
+    "@push.rocks/smartrust": "^1.4.0",
+    "@tsclass/tsclass": "^9.5.1",
+    "minimatch": "^10.2.5"
   },
   "files": [
     "ts/**/*",
@@ -45,6 +38,7 @@
     "assets/**/*",
     "cli.js",
     ".smartconfig.json",
+    "license",
     "readme.md",
     "changelog.md"
   ],
@@ -76,13 +70,11 @@
   "bugs": {
     "url": "https://code.foss.global/push.rocks/smartproxy/issues"
   },
-  "pnpm": {
-    "overrides": {},
-    "onlyBuiltDependencies": [
-      "esbuild",
-      "mongodb-memory-server",
-      "puppeteer"
-    ]
-  },
-  "packageManager": "pnpm@10.10.0+sha512.d615db246fe70f25dcfea6d8d73dee782ce23e2245e3c4f6f888249fb568149318637dca73c2c5c8ef2a4ca0d5657fb9567188bfab47f566d1ee6ce987815c39"
-}
+  "scripts": {
+    "test:before": "(tsrust)",
+    "test": "(tstest test/**/test*.ts --verbose --timeout 60 --logfile)",
+    "build": "(tsbuild tsfolders) && (tsrust)",
+    "format": "(gitzone format)",
+    "buildDocs": "tsdoc"
+  }
+}

package/readme.md

@@ -2,18 +2,16 @@
 
 **A high-performance, Rust-powered proxy toolkit for Node.js** — unified route-based configuration for SSL/TLS termination, HTTP/HTTPS reverse proxying, WebSocket support, UDP/QUIC/HTTP3, load balancing, custom protocol handlers, and kernel-level NFTables forwarding via [`@push.rocks/smartnftables`](https://code.foss.global/push.rocks/smartnftables).
 
+## Issue Reporting and Security
+
+For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
+
 ## 📦 Installation
 
 ```bash
-npm install @push.rocks/smartproxy
-# or
 pnpm add @push.rocks/smartproxy
 ```
 
-## Issue Reporting and Security
-
-For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
-
 ## 🎯 What is SmartProxy?
 
 SmartProxy is a production-ready proxy solution that takes the complexity out of traffic management. Under the hood, all networking — TCP, UDP, TLS, HTTP reverse proxy, QUIC/HTTP3, connection tracking, security enforcement, and NFTables — is handled by a **Rust engine** for maximum performance, while you configure everything through a clean TypeScript API with full type safety.
@@ -30,7 +28,7 @@ Whether you're building microservices, deploying edge infrastructure, proxying U
 | 🎯 **Flexible Matching** | Route by port, domain, path, protocol, client IP, TLS version, headers, or custom logic |
 | 🚄 **High-Performance** | Choose between user-space or kernel-level (NFTables) forwarding |
 | 📡 **UDP & QUIC/HTTP3** | First-class UDP transport, datagram handlers, QUIC tunneling, and HTTP/3 support |
-| ⚖️ **Load Balancing** | Round-robin, least-connections, IP-hash with health checks |
+| ⚖️ **Load Balancing** | Round-robin, least-connections, and IP-hash selection across host arrays |
 | 🛡️ **Enterprise Security** | IP filtering, rate limiting, basic auth, JWT auth, connection limits |
 | 🔌 **WebSocket Support** | First-class WebSocket proxying with ping/pong keep-alive |
 | 🎮 **Custom Protocols** | Socket and datagram handlers for implementing any protocol in TypeScript |
@@ -137,7 +135,9 @@ const proxy = new SmartProxy({
 });
 ```
 
-### ⚖️ Load Balancer with Health Checks
+### ⚖️ Load Balancer
+
+For equivalent backends, put the backend hosts into one target's `host` array and choose a target-level load-balancing algorithm. Multiple `targets` are for sub-routing with `target.match` and `priority`.
 
 ```typescript
 import { SmartProxy } from '@push.rocks/smartproxy';
@@ -148,22 +148,12 @@ const proxy = new SmartProxy({
     match: { ports: 443, domains: 'app.example.com' },
     action: {
       type: 'forward',
-      targets: [
-        { host: 'server1.internal', port: 8080 },
-        { host: 'server2.internal', port: 8080 },
-        { host: 'server3.internal', port: 8080 }
-      ],
-      tls: { mode: 'terminate', certificate: 'auto' },
-      loadBalancing: {
-        algorithm: 'round-robin',
-        healthCheck: {
-          path: '/health',
-          interval: 30000,
-          timeout: 5000,
-          unhealthyThreshold: 3,
-          healthyThreshold: 2
-        }
-      }
+      targets: [{
+        host: ['server1.internal', 'server2.internal', 'server3.internal'],
+        port: 8080,
+        loadBalancing: { algorithm: 'round-robin' }
+      }],
+      tls: { mode: 'terminate', certificate: 'auto' }
     }
   }]
 });
@@ -649,7 +639,9 @@ Supply your own certificates or integrate with external certificate providers:
 
 ```typescript
 const proxy = new SmartProxy({
-  certProvisionFunction: async (domain: string) => {
+  certProvisionFunction: async (domain, eventComms) => {
+    eventComms.setSource('custom-acme-provider');
+
     // Return 'http01' to let the built-in ACME handle it
     if (domain.endsWith('.example.com')) return 'http01';
 
@@ -672,7 +664,11 @@ SmartProxy **never writes certificates to disk**. Instead, you own all persisten
 const proxy = new SmartProxy({
   routes: [...],
 
-  certProvisionFunction: async (domain) => myAcme.provision(domain),
+  certProvisionFunction: async (domain, eventComms) => {
+    const cert = await myAcme.provision(domain);
+    eventComms.setExpiryDate(new Date(cert.validUntil));
+    return cert;
+  },
 
   // Your persistence layer — SmartProxy calls these hooks
   certStore: {
@@ -776,6 +772,8 @@ type TPortRange = number | Array<number | { from: number; to: number }>;
 | `forward` | Proxy to one or more backend targets (with optional TLS, WebSocket, load balancing, UDP/QUIC) |
 | `socket-handler` | Custom socket/datagram handling function in TypeScript |
 
+`targets` are evaluated as route-internal sub-routes by `target.match` and `target.priority`. For load balancing across equivalent upstreams, use a single target with `host: ['a', 'b', 'c']` and target-level `loadBalancing`.
+
 ### Target Options
 
 ```typescript
@@ -847,6 +845,8 @@ interface IRouteLoadBalancing {
 }
 ```
 
+Use this on an `IRouteTarget` with `host` as a string array. The `healthCheck` shape is accepted by the type layer, but active backend health polling is not currently performed by the Rust selector.
+
 ### Backend Protocol Options
 
 ```typescript
@@ -924,6 +924,7 @@ class SmartProxy extends EventEmitter {
 
   // Route Management (atomic, mutex-locked)
   updateRoutes(routes: IRouteConfig[]): Promise<void>;
+  updateSecurityPolicy(policy: ISmartProxySecurityPolicy): Promise<void>;
 
   // Port Management
   addListeningPort(port: number): Promise<void>;
@@ -932,7 +933,7 @@ class SmartProxy extends EventEmitter {
 
   // Monitoring & Metrics
   getMetrics(): IMetrics;              // Sync — returns cached metrics adapter
-  getStatistics(): Promise<any>;       // Async — queries Rust engine
+  getStatistics(): Promise<IRustStatistics>; // Async — queries Rust engine
 
   // Certificate Management
   provisionCertificate(routeName: string): Promise<void>;
@@ -967,7 +968,10 @@ interface ISmartProxyOptions {
   };
 
   // Custom certificate provisioning
-  certProvisionFunction?: (domain: string) => Promise<ICert | 'http01'>;
+  certProvisionFunction?: (
+    domain: string,
+    eventComms: ICertProvisionEventComms
+  ) => Promise<TSmartProxyCertProvisionObject>;
   certProvisionFallbackToAcme?: boolean;    // Fall back to ACME on failure (default: true)
   certProvisionTimeout?: number;            // Timeout per provision call (ms)
   certProvisionConcurrency?: number;        // Max concurrent provisions
@@ -1003,6 +1007,10 @@ interface ISmartProxyOptions {
   // Connection limits
   maxConnectionsPerIP?: number;             // Per-IP connection limit (default: 100)
   connectionRateLimitPerMinute?: number;    // Per-IP rate limit (default: 300/min)
+  securityPolicy?: {
+    blockedIps?: string[];
+    blockedCidrs?: string[];
+  };                                        // Global ingress block policy
 
   // Keep-alive
   keepAliveTreatment?: 'standard' | 'extended' | 'immortal';
@@ -1055,17 +1063,25 @@ metrics.connections.total();               // Total connections since start
 metrics.connections.byRoute();             // Map<routeName, activeCount>
 metrics.connections.byIP();                // Map<ip, activeCount>
 metrics.connections.topIPs(10);            // Top N IPs by connection count
+metrics.connections.domainRequestsByIP();  // Map<ip, Map<domain, requestCount>>
+metrics.connections.topDomainRequests(20); // Top IP/domain pairs by request count
+metrics.connections.frontendProtocols();   // H1/H2/H3/WS frontend distribution
+metrics.connections.backendProtocols();    // H1/H2/H3/WS backend distribution
 
 // Throughput (bytes/sec)
 metrics.throughput.instant();              // { in: number, out: number }
 metrics.throughput.recent();               // Recent average
 metrics.throughput.average();              // Overall average
+metrics.throughput.custom(30);             // Custom window, if provided by Rust cache
+metrics.throughput.history(60);            // Recent throughput samples
 metrics.throughput.byRoute();              // Map<routeName, { in, out }>
+metrics.throughput.byIP();                 // Map<ip, { in, out }>
 
 // Request rates
 metrics.requests.perSecond();              // Requests per second
 metrics.requests.perMinute();              // Requests per minute
 metrics.requests.total();                  // Total requests
+metrics.requests.byDomain();               // Map<domain, { perSecond, lastMinute }>
 
 // UDP metrics
 metrics.udp.activeSessions();              // Current active UDP sessions
@@ -1082,12 +1098,15 @@ metrics.totals.connections();              // Total connections
 metrics.backends.byBackend();              // Map<backend, IBackendMetrics>
 metrics.backends.protocols();              // Map<backend, protocol>
 metrics.backends.topByErrors(10);          // Top N error-prone backends
+metrics.backends.detectedProtocols();      // Backend protocol discovery cache
 
 // Percentiles
 metrics.percentiles.connectionDuration();  // { p50, p95, p99 }
 metrics.percentiles.bytesTransferred();    // { in: { p50, p95, p99 }, out: { p50, p95, p99 } }
 ```
 
+The percentile methods are part of the public metrics shape. In the current Rust adapter they return zeroed values until percentile collection is implemented in the Rust metrics snapshot.
+
 ## 🐛 Troubleshooting
 
 ### Certificate Issues

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '27.9.0',
+  version: '27.10.1',
   description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 }

package/ts/index.ts

@@ -7,7 +7,7 @@ export { SmartProxy } from './proxies/smart-proxy/index.js';
 export { SharedRouteManager as RouteManager } from './core/routing/route-manager.js';
 
 // Export smart-proxy models
-export type { ISmartProxyOptions, ISmartProxySecurityPolicy, IConnectionRecord, IRouteConfig, IRouteMatch, IRouteAction, IRouteTls, IRouteContext } from './proxies/smart-proxy/models/index.js';
+export type { ISmartProxyOptions, ISmartProxySecurityPolicy, IConnectionRecord, IRouteConfig, IRouteMatch, IRouteAction, IRouteTls, IRouteContext, TDatagramHandler, IDatagramInfo } from './proxies/smart-proxy/models/index.js';
 export type { TSmartProxyCertProvisionObject, ICertProvisionEventComms, ICertificateIssuedEvent, ICertificateFailedEvent } from './proxies/smart-proxy/models/interfaces.js';
 export * from './proxies/smart-proxy/utils/index.js';