@serve.zone/dcrouter 13.17.0 → 13.17.2

package/dist_ts/sms/config/sms.schema.js

@@ -0,0 +1,121 @@
+/**
+ * SMS service configuration schema
+ */
+export const smsConfigSchema = {
+    apiGatewayApiToken: {
+        type: 'string',
+        required: true
+    },
+    defaultSender: {
+        type: 'string',
+        required: false
+    },
+    rateLimit: {
+        type: 'object',
+        required: false,
+        schema: {
+            enabled: {
+                type: 'boolean',
+                required: false,
+                default: true
+            },
+            maxPerPeriod: {
+                type: 'number',
+                required: false,
+                default: 100,
+                min: 1
+            },
+            periodMs: {
+                type: 'number',
+                required: false,
+                default: 60000, // 1 minute
+                min: 1000
+            },
+            perKey: {
+                type: 'boolean',
+                required: false,
+                default: true
+            },
+            burstTokens: {
+                type: 'number',
+                required: false,
+                default: 5,
+                min: 0
+            },
+            maxPerRecipientPerDay: {
+                type: 'number',
+                required: false,
+                default: 10,
+                min: 1
+            }
+        }
+    },
+    provider: {
+        type: 'object',
+        required: false,
+        schema: {
+            type: {
+                type: 'string',
+                required: false,
+                enum: ['gateway', 'twilio', 'other'],
+                default: 'gateway'
+            },
+            config: {
+                type: 'object',
+                required: false
+            },
+            fallback: {
+                type: 'object',
+                required: false,
+                schema: {
+                    enabled: {
+                        type: 'boolean',
+                        required: false,
+                        default: false
+                    },
+                    type: {
+                        type: 'string',
+                        required: false,
+                        enum: ['gateway', 'twilio', 'other']
+                    },
+                    config: {
+                        type: 'object',
+                        required: false
+                    }
+                }
+            }
+        }
+    },
+    verification: {
+        type: 'object',
+        required: false,
+        schema: {
+            codeLength: {
+                type: 'number',
+                required: false,
+                default: 6,
+                min: 4,
+                max: 10
+            },
+            expirationSeconds: {
+                type: 'number',
+                required: false,
+                default: 300, // 5 minutes
+                min: 60
+            },
+            maxAttempts: {
+                type: 'number',
+                required: false,
+                default: 3,
+                min: 1
+            },
+            cooldownSeconds: {
+                type: 'number',
+                required: false,
+                default: 60, // 1 minute
+                min: 0
+            }
+        }
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21zLnNjaGVtYS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3RzL3Ntcy9jb25maWcvc21zLnNjaGVtYS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBcUI7SUFDL0Msa0JBQWtCLEVBQUU7UUFDbEIsSUFBSSxFQUFFLFFBQVE7UUFDZCxRQUFRLEVBQUUsSUFBSTtLQUNmO0lBQ0QsYUFBYSxFQUFFO1FBQ2IsSUFBSSxFQUFFLFFBQVE7UUFDZCxRQUFRLEVBQUUsS0FBSztLQUNoQjtJQUNELFNBQVMsRUFBRTtRQUNULElBQUksRUFBRSxRQUFRO1FBQ2QsUUFBUSxFQUFFLEtBQUs7UUFDZixNQUFNLEVBQUU7WUFDTixPQUFPLEVBQUU7Z0JBQ1AsSUFBSSxFQUFFLFNBQVM7Z0JBQ2YsUUFBUSxFQUFFLEtBQUs7Z0JBQ2YsT0FBTyxFQUFFLElBQUk7YUFDZDtZQUNELFlBQVksRUFBRTtnQkFDWixJQUFJLEVBQUUsUUFBUTtnQkFDZCxRQUFRLEVBQUUsS0FBSztnQkFDZixPQUFPLEVBQUUsR0FBRztnQkFDWixHQUFHLEVBQUUsQ0FBQzthQUNQO1lBQ0QsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSxRQUFRO2dCQUNkLFFBQVEsRUFBRSxLQUFLO2dCQUNmLE9BQU8sRUFBRSxLQUFLLEVBQUUsV0FBVztnQkFDM0IsR0FBRyxFQUFFLElBQUk7YUFDVjtZQUNELE1BQU0sRUFBRTtnQkFDTixJQUFJLEVBQUUsU0FBUztnQkFDZixRQUFRLEVBQUUsS0FBSztnQkFDZixPQUFPLEVBQUUsSUFBSTthQUNkO1lBQ0QsV0FBVyxFQUFFO2dCQUNYLElBQUksRUFBRSxRQUFRO2dCQUNkLFFBQVEsRUFBRSxLQUFLO2dCQUNmLE9BQU8sRUFBRSxDQUFDO2dCQUNWLEdBQUcsRUFBRSxDQUFDO2FBQ1A7WUFDRCxxQkFBcUIsRUFBRTtnQkFDckIsSUFBSSxFQUFFLFFBQVE7Z0JBQ2QsUUFBUSxFQUFFLEtBQUs7Z0JBQ2YsT0FBTyxFQUFFLEVBQUU7Z0JBQ1gsR0FBRyxFQUFFLENBQUM7YUFDUDtTQUNGO0tBQ0Y7SUFDRCxRQUFRLEVBQUU7UUFDUixJQUFJLEVBQUUsUUFBUTtRQUNkLFFBQVEsRUFBRSxLQUFLO1FBQ2YsTUFBTSxFQUFFO1lBQ04sSUFBSSxFQUFFO2dCQUNKLElBQUksRUFBRSxRQUFRO2dCQUNkLFFBQVEsRUFBRSxLQUFLO2dCQUNmLElBQUksRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDO2dCQUNwQyxPQUFPLEVBQUUsU0FBUzthQUNuQjtZQUNELE1BQU0sRUFBRTtnQkFDTixJQUFJLEVBQUUsUUFBUTtnQkFDZCxRQUFRLEVBQUUsS0FBSzthQUNoQjtZQUNELFFBQVEsRUFBRTtnQkFDUixJQUFJLEVBQUUsUUFBUTtnQkFDZCxRQUFRLEVBQUUsS0FBSztnQkFDZixNQUFNLEVBQUU7b0JBQ04sT0FBTyxFQUFFO3dCQUNQLElBQUksRUFBRSxTQUFTO3dCQUNmLFFBQVEsRUFBRSxLQUFLO3dCQUNmLE9BQU8sRUFBRSxLQUFLO3FCQUNmO29CQUNELElBQUksRUFBRTt3QkFDSixJQUFJLEVBQUUsUUFBUTt3QkFDZCxRQUFRLEVBQUUsS0FBSzt3QkFDZixJQUFJLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQztxQkFDckM7b0JBQ0QsTUFBTSxFQUFFO3dCQUNOLElBQUksRUFBRSxRQUFRO3dCQUNkLFFBQVEsRUFBRSxLQUFLO3FCQUNoQjtpQkFDRjthQUNGO1NBQ0Y7S0FDRjtJQUNELFlBQVksRUFBRTtRQUNaLElBQUksRUFBRSxRQUFRO1FBQ2QsUUFBUSxFQUFFLEtBQUs7UUFDZixNQUFNLEVBQUU7WUFDTixVQUFVLEVBQUU7Z0JBQ1YsSUFBSSxFQUFFLFFBQVE7Z0JBQ2QsUUFBUSxFQUFFLEtBQUs7Z0JBQ2YsT0FBTyxFQUFFLENBQUM7Z0JBQ1YsR0FBRyxFQUFFLENBQUM7Z0JBQ04sR0FBRyxFQUFFLEVBQUU7YUFDUjtZQUNELGlCQUFpQixFQUFFO2dCQUNqQixJQUFJLEVBQUUsUUFBUTtnQkFDZCxRQUFRLEVBQUUsS0FBSztnQkFDZixPQUFPLEVBQUUsR0FBRyxFQUFFLFlBQVk7Z0JBQzFCLEdBQUcsRUFBRSxFQUFFO2FBQ1I7WUFDRCxXQUFXLEVBQUU7Z0JBQ1gsSUFBSSxFQUFFLFFBQVE7Z0JBQ2QsUUFBUSxFQUFFLEtBQUs7Z0JBQ2YsT0FBTyxFQUFFLENBQUM7Z0JBQ1YsR0FBRyxFQUFFLENBQUM7YUFDUDtZQUNELGVBQWUsRUFBRTtnQkFDZixJQUFJLEVBQUUsUUFBUTtnQkFDZCxRQUFRLEVBQUUsS0FBSztnQkFDZixPQUFPLEVBQUUsRUFBRSxFQUFFLFdBQVc7Z0JBQ3hCLEdBQUcsRUFBRSxDQUFDO2FBQ1A7U0FDRjtLQUNGO0NBQ0YsQ0FBQyJ9

package/dist_ts/sms/index.d.ts

@@ -0,0 +1 @@
+export * from './classes.smsservice.js';

package/dist_ts/sms/index.js

@@ -0,0 +1,2 @@
+export * from './classes.smsservice.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9zbXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyx5QkFBeUIsQ0FBQyJ9

package/dist_ts/vpn/classes.vpn-manager.d.ts

@@ -0,0 +1,159 @@
+import * as plugins from '../plugins.js';
+import { VpnClientDoc } from '../db/index.js';
+export interface IVpnManagerConfig {
+    /** VPN subnet CIDR (default: '10.8.0.0/24') */
+    subnet?: string;
+    /** WireGuard UDP listen port (default: 51820) */
+    wgListenPort?: number;
+    /** DNS servers pushed to VPN clients */
+    dns?: string[];
+    /** Server endpoint hostname for client configs (e.g. 'vpn.example.com') */
+    serverEndpoint?: string;
+    /** Pre-defined VPN clients created on startup (idempotent — skips already-persisted clients) */
+    initialClients?: Array<{
+        clientId: string;
+        targetProfileIds?: string[];
+        description?: string;
+    }>;
+    /** Called when clients are created/deleted/toggled — triggers route re-application */
+    onClientChanged?: () => void;
+    /** Destination routing policy override. Default: forceTarget to 127.0.0.1 */
+    destinationPolicy?: {
+        default: 'forceTarget' | 'block' | 'allow';
+        target?: string;
+        allowList?: string[];
+        blockList?: string[];
+    };
+    /** Compute per-client AllowedIPs based on the client's target profile IDs.
+     *  Called at config generation time (create/export). Returns CIDRs for WireGuard AllowedIPs.
+     *  When not set, defaults to [subnet]. */
+    getClientAllowedIPs?: (targetProfileIds: string[]) => Promise<string[]>;
+    /** Resolve per-client destination allow-list IPs from target profile IDs.
+     *  Returns IP strings that should bypass forceTarget and go direct to the real destination. */
+    getClientDirectTargets?: (targetProfileIds: string[]) => string[];
+    /** Forwarding mode: 'socket' (default, userspace NAT), 'bridge' (L2 bridge to host LAN),
+     *  or 'hybrid' (socket default, bridge for clients with useHostIp=true) */
+    forwardingMode?: 'socket' | 'bridge' | 'hybrid';
+    /** LAN subnet CIDR for bridge mode (e.g., '192.168.1.0/24') */
+    bridgeLanSubnet?: string;
+    /** Physical network interface for bridge mode (auto-detected if omitted) */
+    bridgePhysicalInterface?: string;
+    /** Start of VPN client IP range in LAN subnet (host offset, default: 200) */
+    bridgeIpRangeStart?: number;
+    /** End of VPN client IP range in LAN subnet (host offset, default: 250) */
+    bridgeIpRangeEnd?: number;
+}
+/**
+ * Manages the SmartVPN server lifecycle and VPN client CRUD.
+ * Persists server keys and client registrations via smartdata document classes.
+ */
+export declare class VpnManager {
+    private config;
+    private vpnServer?;
+    private clients;
+    private serverKeys?;
+    constructor(config: IVpnManagerConfig);
+    /** The VPN subnet CIDR. */
+    getSubnet(): string;
+    /** Whether the VPN server is running. */
+    get running(): boolean;
+    /**
+     * Start the VPN server.
+     * Loads or generates server keys, loads persisted clients, starts VpnServer.
+     */
+    start(): Promise<void>;
+    /**
+     * Stop the VPN server.
+     */
+    stop(): Promise<void>;
+    /**
+     * Create a new VPN client. Returns the config bundle (secrets only shown once).
+     */
+    createClient(opts: {
+        clientId: string;
+        targetProfileIds?: string[];
+        description?: string;
+        destinationAllowList?: string[];
+        destinationBlockList?: string[];
+        useHostIp?: boolean;
+        useDhcp?: boolean;
+        staticIp?: string;
+        forceVlan?: boolean;
+        vlanId?: number;
+    }): Promise<plugins.smartvpn.IClientConfigBundle>;
+    /**
+     * Remove a VPN client.
+     */
+    removeClient(clientId: string): Promise<void>;
+    /**
+     * List all registered clients (without secrets).
+     */
+    listClients(): VpnClientDoc[];
+    /**
+     * Enable a client.
+     */
+    enableClient(clientId: string): Promise<void>;
+    /**
+     * Disable a client.
+     */
+    disableClient(clientId: string): Promise<void>;
+    /**
+     * Update a client's metadata (description, target profiles) without rotating keys.
+     */
+    updateClient(clientId: string, update: {
+        description?: string;
+        targetProfileIds?: string[];
+        destinationAllowList?: string[];
+        destinationBlockList?: string[];
+        useHostIp?: boolean;
+        useDhcp?: boolean;
+        staticIp?: string;
+        forceVlan?: boolean;
+        vlanId?: number;
+    }): Promise<void>;
+    /**
+     * Rotate a client's keys. Returns the new config bundle.
+     */
+    rotateClientKey(clientId: string): Promise<plugins.smartvpn.IClientConfigBundle>;
+    /**
+     * Export a client config. Injects stored WG private key and per-client AllowedIPs.
+     */
+    exportClientConfig(clientId: string, format: 'smartvpn' | 'wireguard'): Promise<string>;
+    /**
+     * Get server status.
+     */
+    getStatus(): Promise<plugins.smartvpn.IVpnStatus | null>;
+    /**
+     * Get server statistics.
+     */
+    getStatistics(): Promise<plugins.smartvpn.IVpnServerStatistics | null>;
+    /**
+     * List currently connected clients.
+     */
+    getConnectedClients(): Promise<plugins.smartvpn.IVpnClientInfo[]>;
+    /**
+     * Get telemetry for a specific client.
+     */
+    getClientTelemetry(clientId: string): Promise<plugins.smartvpn.IVpnClientTelemetry | null>;
+    /**
+     * Get server public keys (for display/info).
+     */
+    getServerPublicKeys(): {
+        noisePublicKey: string;
+        wgPublicKey: string;
+    } | null;
+    /**
+     * Build per-client security settings for the smartvpn daemon.
+     * All VPN traffic is forced through SmartProxy (forceTarget to 127.0.0.1).
+     * TargetProfile direct IP:port targets bypass SmartProxy via allowList.
+     */
+    private buildClientSecurity;
+    /**
+     * Refresh all client security policies against the running daemon.
+     * Call this when TargetProfiles change so destination allow-lists stay in sync.
+     */
+    refreshAllClientSecurity(): Promise<void>;
+    private loadOrGenerateServerKeys;
+    private loadPersistedClients;
+    private persistClient;
+}