@serve.zone/dcrouter 13.24.0 → 13.26.0

package/dist_ts_web/elements/access/ops-view-apitokens.js

@@ -222,11 +222,24 @@ let OpsViewApiTokens = (() => {
         async showCreateTokenDialog() {
             const { DeesModal } = await import('@design.estate/dees-catalog');
             const allScopes = [
+                '*',
                 'routes:read',
                 'routes:write',
                 'config:read',
+                'certificates:read',
+                'certificates:write',
                 'tokens:read',
                 'tokens:manage',
+                'domains:read',
+                'domains:write',
+                'dns-records:read',
+                'dns-records:write',
+                'email-domains:read',
+                'email-domains:write',
+                'gateway-clients:read',
+                'gateway-clients:write',
+                'workhosters:read',
+                'workhosters:write',
             ];
             await DeesModal.createAndShow({
                 heading: 'Create API Token',
@@ -239,10 +252,15 @@ let OpsViewApiTokens = (() => {
           <dees-input-tags
             .key=${'scopes'}
             .label=${'Token Scopes'}
-            .value=${['routes:read', 'routes:write']}
+            .value=${['gateway-clients:read', 'gateway-clients:write']}
             .suggestions=${allScopes}
             .required=${true}
           ></dees-input-tags>
+          <dees-input-text .key=${'policyRole'} .label=${'Policy Role'} .description=${'admin, gatewayClient, or operator'}></dees-input-text>
+          <dees-input-text .key=${'gatewayClientType'} .label=${'Gateway Client Type'} .description=${'For gatewayClient tokens: onebox, cloudly, or custom'}></dees-input-text>
+          <dees-input-text .key=${'gatewayClientId'} .label=${'Gateway Client ID'} .description=${'Required for gatewayClient tokens'}></dees-input-text>
+          <dees-input-text .key=${'hostnamePatterns'} .label=${'Hostname Patterns'} .description=${'Comma separated, e.g. *.apps.example.com'}></dees-input-text>
+          <dees-input-text .key=${'allowedRouteTarget'} .label=${'Allowed Route Target'} .description=${'Optional host:ports, e.g. 203.0.113.10:80,443'}></dees-input-text>
           <dees-input-text .key=${'expiresInDays'} .label=${'Expires in'} .description=${'Number of days; leave blank for no expiration'}></dees-input-text>
         </dees-form>
       `,
@@ -269,12 +287,13 @@ let OpsViewApiTokens = (() => {
                             const rawScopes = tagsInput?.getValue?.() || tagsInput?.value || formData.scopes || [];
                             const scopes = rawScopes
                                 .filter((s) => allScopes.includes(s));
+                            const policy = this.buildPolicy(formData, scopes);
                             const expiresInDays = formData.expiresInDays
                                 ? parseInt(formData.expiresInDays, 10)
                                 : null;
                             await modalArg.destroy();
                             try {
-                                const response = await appstate.createApiToken(formData.name, scopes, expiresInDays);
+                                const response = await appstate.createApiToken(formData.name, scopes, expiresInDays, policy);
                                 if (response.success && response.tokenValue) {
                                     // Refresh the list first so it's ready when user dismisses the modal
                                     await appstate.routeManagementStatePart.dispatchAction(appstate.fetchApiTokensAction, null);
@@ -307,6 +326,42 @@ let OpsViewApiTokens = (() => {
                 ],
             });
         }
+        buildPolicy(formData, scopes) {
+            const role = String(formData.policyRole || '').trim();
+            if (!role)
+                return undefined;
+            const policy = {
+                role,
+                scopes,
+            };
+            if (role === 'gatewayClient') {
+                const type = String(formData.gatewayClientType || 'onebox').trim();
+                const id = String(formData.gatewayClientId || '').trim();
+                if (id) {
+                    policy.gatewayClient = { type, id };
+                }
+                policy.hostnamePatterns = String(formData.hostnamePatterns || '')
+                    .split(',')
+                    .map((pattern) => pattern.trim())
+                    .filter(Boolean);
+                const target = String(formData.allowedRouteTarget || '').trim();
+                if (target.includes(':')) {
+                    const [host, portsValue] = target.split(':');
+                    policy.allowedRouteTargets = [{
+                            host: host.trim(),
+                            ports: portsValue.split(',').map((port) => Number(port.trim())).filter((port) => Number.isInteger(port)),
+                        }];
+                }
+                policy.capabilities = {
+                    readDomains: true,
+                    readDnsRecords: true,
+                    syncRoutes: true,
+                    syncDnsRecords: false,
+                    requestCertificates: false,
+                };
+            }
+            return policy;
+        }
         async showRollTokenDialog(token) {
             const { DeesModal } = await import('@design.estate/dees-catalog');
             await DeesModal.createAndShow({
@@ -369,4 +424,4 @@ let OpsViewApiTokens = (() => {
     return OpsViewApiTokens = _classThis;
 })();
 export { OpsViewApiTokens };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3BzLXZpZXctYXBpdG9rZW5zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vdHNfd2ViL2VsZW1lbnRzL2FjY2Vzcy9vcHMtdmlldy1hcGl0b2tlbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLE9BQU8sS0FBSyxRQUFRLE1BQU0sbUJBQW1CLENBQUM7QUFDOUMsT0FBTyxLQUFLLFVBQVUsTUFBTSxzQ0FBc0MsQ0FBQztBQUNuRSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFL0MsT0FBTyxFQUNMLFdBQVcsRUFDWCxHQUFHLEVBQ0gsVUFBVSxFQUNWLGFBQWEsRUFDYixJQUFJLEVBQ0osS0FBSyxHQUVOLE1BQU0sNkJBQTZCLENBQUM7SUFLeEIsZ0JBQWdCOzRCQUQ1QixhQUFhLENBQUMsb0JBQW9CLENBQUM7Ozs7c0JBQ0UsV0FBVzs7OztnQ0FBbkIsU0FBUSxXQUFXOzs7O3NDQUM5QyxLQUFLLEVBQUU7WUFBQyxtTEFBUyxVQUFVLDZCQUFWLFVBQVUsK0ZBTzFCO1lBUkosNktBMlVDOzs7O1FBMVVVLGlGQUFzRDtZQUM3RCxZQUFZLEVBQUUsRUFBRTtZQUNoQixRQUFRLEVBQUUsRUFBRTtZQUNaLFNBQVMsRUFBRSxFQUFFO1lBQ2IsU0FBUyxFQUFFLEtBQUs7WUFDaEIsS0FBSyxFQUFFLElBQUk7WUFDWCxXQUFXLEVBQUUsQ0FBQztTQUNmLEVBQUM7UUFQTyxJQUFTLFVBQVUsZ0RBTzFCO1FBUE8sSUFBUyxVQUFVLHNEQU8xQjtRQUVGO1lBQ0UsS0FBSyxFQUFFLENBQUM7O1lBQ1IsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLHdCQUF3QjtpQkFDMUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUM7aUJBQ2hCLFNBQVMsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFO2dCQUN4QixJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztZQUMvQixDQUFDLENBQUMsQ0FBQztZQUNMLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBRS9CLGdFQUFnRTtZQUNoRSx1REFBdUQ7WUFDdkQsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLGNBQWM7aUJBQ3JDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQztpQkFDM0IsU0FBUyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUU7Z0JBQ3hCLElBQUksVUFBVSxFQUFFLENBQUM7b0JBQ2YsUUFBUSxDQUFDLHdCQUF3QixDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLENBQUM7Z0JBQ3hGLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztZQUNMLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1NBQ3JDO1FBRU0sTUFBTSxDQUFDLE1BQU0sR0FBRztZQUNyQixVQUFVLENBQUMsYUFBYTtZQUN4QixXQUFXO1lBQ1gsR0FBRyxDQUFBOzs7Ozs7Ozs7Ozs7O3NCQWFlLFVBQVUsQ0FBQyxPQUFPLENBQUMsd0JBQXdCLEVBQUUsd0JBQXdCLENBQUM7aUJBQzNFLFVBQVUsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQzs7Ozs7Ozs7Ozs7Ozs7Ozs7c0JBaUJoQyxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUM7aUJBQzdDLFVBQVUsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQzs7OztzQkFJbkMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDO2lCQUM3QyxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUM7Ozs7c0JBSW5DLFVBQVUsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQztpQkFDN0MsVUFBVSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDOztLQUVwRDtTQUNGLENBQUM7UUFFSyxNQUFNO1lBQ1gsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUM7WUFFdEMsT0FBTyxJQUFJLENBQUE7Ozs7O3NCQUtPLFlBQVk7c0JBQ1osbUNBQW1DO2tCQUN2QyxTQUFTO3NCQUNMLE9BQU87d0JBQ0wsSUFBSTsrQkFDRyxJQUFJOzZCQUNOLENBQUMsS0FBb0MsRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDNUQsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO2dCQUNoQixNQUFNLEVBQUUsSUFBSSxDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7Z0JBQzNDLE1BQU0sRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUMsS0FBSyxDQUFDO2dCQUNyQyxPQUFPLEVBQUUsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLGtCQUFrQixFQUFFO2dCQUN2RCxPQUFPLEVBQUUsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLGtCQUFrQixFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU87Z0JBQ25GLFFBQVEsRUFBRSxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTzthQUN2RixDQUFDO3lCQUNhO2dCQUNiO29CQUNFLElBQUksRUFBRSxjQUFjO29CQUNwQixRQUFRLEVBQUUsYUFBYTtvQkFDdkIsSUFBSSxFQUFFLENBQUMsUUFBUSxDQUFDO29CQUNoQixVQUFVLEVBQUUsS0FBSyxJQUFJLEVBQUU7d0JBQ3JCLE1BQU0sSUFBSSxDQUFDLHFCQUFxQixFQUFFLENBQUM7b0JBQ3JDLENBQUM7aUJBQ0Y7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLFFBQVE7b0JBQ2QsUUFBUSxFQUFFLGFBQWE7b0JBQ3ZCLElBQUksRUFBRSxDQUFDLE9BQU8sRUFBRSxhQUFhLENBQVE7b0JBQ3JDLHdCQUF3QixFQUFFLENBQUMsVUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTztvQkFDdkUsVUFBVSxFQUFFLEtBQUssRUFBRSxVQUFlLEVBQUUsRUFBRTt3QkFDcEMsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLElBQXFDLENBQUM7d0JBQy9ELE1BQU0sUUFBUSxDQUFDLHdCQUF3QixDQUFDLGNBQWMsQ0FDcEQsUUFBUSxDQUFDLG9CQUFvQixFQUM3QixFQUFFLEVBQUUsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FDaEMsQ0FBQztvQkFDSixDQUFDO2lCQUNGO2dCQUNEO29CQUNFLElBQUksRUFBRSxTQUFTO29CQUNmLFFBQVEsRUFBRSxjQUFjO29CQUN4QixJQUFJLEVBQUUsQ0FBQyxPQUFPLEVBQUUsYUFBYSxDQUFRO29CQUNyQyx3QkFBd0IsRUFBRSxDQUFDLFVBQWUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPO29CQUN0RSxVQUFVLEVBQUUsS0FBSyxFQUFFLFVBQWUsRUFBRSxFQUFFO3dCQUNwQyxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsSUFBcUMsQ0FBQzt3QkFDL0QsTUFBTSxRQUFRLENBQUMsd0JBQXdCLENBQUMsY0FBYyxDQUNwRCxRQUFRLENBQUMsb0JBQW9CLEVBQzdCLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUNqQyxDQUFDO29CQUNKLENBQUM7aUJBQ0Y7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLE1BQU07b0JBQ1osUUFBUSxFQUFFLGlCQUFpQjtvQkFDM0IsSUFBSSxFQUFFLENBQUMsT0FBTyxFQUFFLGFBQWEsQ0FBUTtvQkFDckMsVUFBVSxFQUFFLEtBQUssRUFBRSxVQUFlLEVBQUUsRUFBRTt3QkFDcEMsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLElBQXFDLENBQUM7d0JBQy9ELE1BQU0sSUFBSSxDQUFDLG1CQUFtQixDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUN4QyxDQUFDO2lCQUNGO2dCQUNEO29CQUNFLElBQUksRUFBRSxRQUFRO29CQUNkLFFBQVEsRUFBRSxlQUFlO29CQUN6QixJQUFJLEVBQUUsQ0FBQyxPQUFPLEVBQUUsYUFBYSxDQUFRO29CQUNyQyxVQUFVLEVBQUUsS0FBSyxFQUFFLFVBQWUsRUFBRSxFQUFFO3dCQUNwQyxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsSUFBcUMsQ0FBQzt3QkFDL0QsTUFBTSxRQUFRLENBQUMsd0JBQXdCLENBQUMsY0FBYyxDQUNwRCxRQUFRLENBQUMsb0JBQW9CLEVBQzdCLEtBQUssQ0FBQyxFQUFFLENBQ1QsQ0FBQztvQkFDSixDQUFDO2lCQUNGO2FBQ0Y7OztLQUdOLENBQUM7UUFDSixDQUFDO1FBRU8sZ0JBQWdCLENBQUMsTUFBd0I7WUFDL0MsT0FBTyxJQUFJLENBQUEsMERBQTBELE1BQU0sQ0FBQyxHQUFHLENBQzdFLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUEsMkJBQTJCLENBQUMsU0FBUyxDQUNqRCxRQUFRLENBQUM7UUFDWixDQUFDO1FBRU8saUJBQWlCLENBQUMsS0FBb0M7WUFDNUQsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDbkIsT0FBTyxJQUFJLENBQUEsb0RBQW9ELENBQUM7WUFDbEUsQ0FBQztZQUNELElBQUksS0FBSyxDQUFDLFNBQVMsSUFBSSxLQUFLLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDO2dCQUNwRCxPQUFPLElBQUksQ0FBQSxrREFBa0QsQ0FBQztZQUNoRSxDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUEsZ0RBQWdELENBQUM7UUFDOUQsQ0FBQztRQUVPLEtBQUssQ0FBQyxxQkFBcUI7WUFDakMsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sTUFBTSxDQUFDLDZCQUE2QixDQUFDLENBQUM7WUFFbEUsTUFBTSxTQUFTLEdBQXFCO2dCQUNsQyxhQUFhO2dCQUNiLGNBQWM7Z0JBQ2QsYUFBYTtnQkFDYixhQUFhO2dCQUNiLGVBQWU7YUFDaEIsQ0FBQztZQUVGLE1BQU0sU0FBUyxDQUFDLGFBQWEsQ0FBQztnQkFDNUIsT0FBTyxFQUFFLGtCQUFrQjtnQkFDM0IsT0FBTyxFQUFFLElBQUksQ0FBQTs7Ozs7a0NBS2UsTUFBTSxXQUFXLFlBQVksY0FBYyxJQUFJOzttQkFFOUQsUUFBUTtxQkFDTixjQUFjO3FCQUNkLENBQUMsYUFBYSxFQUFFLGNBQWMsQ0FBQzsyQkFDekIsU0FBUzt3QkFDWixJQUFJOztrQ0FFTSxlQUFlLFdBQVcsWUFBWSxpQkFBaUIsK0NBQStDOztPQUVqSTtnQkFDRCxXQUFXLEVBQUU7b0JBQ1g7d0JBQ0UsSUFBSSxFQUFFLFFBQVE7d0JBQ2QsUUFBUSxFQUFFLFVBQVU7d0JBQ3BCLE1BQU0sRUFBRSxLQUFLLEVBQUUsUUFBYSxFQUFFLEVBQUUsQ0FBQyxNQUFNLFFBQVEsQ0FBQyxPQUFPLEVBQUU7cUJBQzFEO29CQUNEO3dCQUNFLElBQUksRUFBRSxRQUFRO3dCQUNkLFFBQVEsRUFBRSxZQUFZO3dCQUN0QixNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQWEsRUFBRSxFQUFFOzRCQUM5QixNQUFNLFNBQVMsR0FBRyxRQUFRLENBQUMsVUFBVSxFQUFFLGFBQWEsQ0FBQyxVQUFVLENBQUMsQ0FBQzs0QkFDakUsTUFBTSxJQUFJLEdBQUcsU0FBUyxFQUFFLGFBQWEsQ0FBQyxXQUFXLENBQUMsQ0FBQzs0QkFDbkQsSUFBSSxDQUFDLElBQUk7Z0NBQUUsT0FBTzs0QkFDbEIsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7NEJBQzlDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSTtnQ0FBRSxPQUFPOzRCQUUzQixxRkFBcUY7NEJBQ3JGLGlFQUFpRTs0QkFDakUsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxpQkFBaUIsQ0FBUSxDQUFDOzRCQUMvRCxNQUFNLFNBQVMsR0FBYSxTQUFTLEVBQUUsUUFBUSxFQUFFLEVBQUUsSUFBSSxTQUFTLEVBQUUsS0FBSyxJQUFJLFFBQVEsQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDOzRCQUNqRyxNQUFNLE1BQU0sR0FBRyxTQUFTO2lDQUNyQixNQUFNLENBQUMsQ0FBQyxDQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBUSxDQUFDLENBQXFCLENBQUM7NEJBRTNFLE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxhQUFhO2dDQUMxQyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxhQUFhLEVBQUUsRUFBRSxDQUFDO2dDQUN0QyxDQUFDLENBQUMsSUFBSSxDQUFDOzRCQUVULE1BQU0sUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDOzRCQUV6QixJQUFJLENBQUM7Z0NBQ0gsTUFBTSxRQUFRLEdBQUcsTUFBTSxRQUFRLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLGFBQWEsQ0FBQyxDQUFDO2dDQUNyRixJQUFJLFFBQVEsQ0FBQyxPQUFPLElBQUksUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDO29DQUM1QyxxRUFBcUU7b0NBQ3JFLE1BQU0sUUFBUSxDQUFDLHdCQUF3QixDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLENBQUM7b0NBRTVGLHNDQUFzQztvQ0FDdEMsTUFBTSxTQUFTLENBQUMsYUFBYSxDQUFDO3dDQUM1QixPQUFPLEVBQUUsZUFBZTt3Q0FDeEIsT0FBTyxFQUFFLElBQUksQ0FBQTs7Ozs2RkFJOEQsUUFBUSxDQUFDLFVBQVU7OzttQkFHN0Y7d0NBQ0QsV0FBVyxFQUFFOzRDQUNYO2dEQUNFLElBQUksRUFBRSxNQUFNO2dEQUNaLFFBQVEsRUFBRSxjQUFjO2dEQUN4QixNQUFNLEVBQUUsS0FBSyxFQUFFLENBQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsT0FBTyxFQUFFOzZDQUM1Qzt5Q0FDRjtxQ0FDRixDQUFDLENBQUM7Z0NBQ0wsQ0FBQzs0QkFDSCxDQUFDOzRCQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0NBQ2YsT0FBTyxDQUFDLEtBQUssQ0FBQyx5QkFBeUIsRUFBRSxLQUFLLENBQUMsQ0FBQzs0QkFDbEQsQ0FBQzt3QkFDSCxDQUFDO3FCQUNGO2lCQUNGO2FBQ0YsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVPLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxLQUFvQztZQUNwRSxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxNQUFNLENBQUMsNkJBQTZCLENBQUMsQ0FBQztZQUVsRSxNQUFNLFNBQVMsQ0FBQyxhQUFhLENBQUM7Z0JBQzVCLE9BQU8sRUFBRSxtQkFBbUI7Z0JBQzVCLE9BQU8sRUFBRSxJQUFJLENBQUE7OzJEQUV3QyxLQUFLLENBQUMsSUFBSTs7T0FFOUQ7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYO3dCQUNFLElBQUksRUFBRSxRQUFRO3dCQUNkLFFBQVEsRUFBRSxVQUFVO3dCQUNwQixNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQWEsRUFBRSxFQUFFLENBQUMsTUFBTSxRQUFRLENBQUMsT0FBTyxFQUFFO3FCQUMxRDtvQkFDRDt3QkFDRSxJQUFJLEVBQUUsWUFBWTt3QkFDbEIsUUFBUSxFQUFFLGlCQUFpQjt3QkFDM0IsTUFBTSxFQUFFLEtBQUssRUFBRSxRQUFhLEVBQUUsRUFBRTs0QkFDOUIsTUFBTSxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7NEJBQ3pCLElBQUksQ0FBQztnQ0FDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLFFBQVEsQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO2dDQUN2RCxJQUFJLFFBQVEsQ0FBQyxPQUFPLElBQUksUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDO29DQUM1QyxNQUFNLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLG9CQUFvQixFQUFFLElBQUksQ0FBQyxDQUFDO29DQUU1RixNQUFNLFNBQVMsQ0FBQyxhQUFhLENBQUM7d0NBQzVCLE9BQU8sRUFBRSxjQUFjO3dDQUN2QixPQUFPLEVBQUUsSUFBSSxDQUFBOzs7OzZGQUk4RCxRQUFRLENBQUMsVUFBVTs7O21CQUc3Rjt3Q0FDRCxXQUFXLEVBQUU7NENBQ1g7Z0RBQ0UsSUFBSSxFQUFFLE1BQU07Z0RBQ1osUUFBUSxFQUFFLGNBQWM7Z0RBQ3hCLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQUU7NkNBQzVDO3lDQUNGO3FDQUNGLENBQUMsQ0FBQztnQ0FDTCxDQUFDOzRCQUNILENBQUM7NEJBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQ0FDZixPQUFPLENBQUMsS0FBSyxDQUFDLHVCQUF1QixFQUFFLEtBQUssQ0FBQyxDQUFDOzRCQUNoRCxDQUFDO3dCQUNILENBQUM7cUJBQ0Y7aUJBQ0Y7YUFDRixDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsS0FBSyxDQUFDLFlBQVk7WUFDaEIsTUFBTSxRQUFRLENBQUMsd0JBQXdCLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM5RixDQUFDOztZQTFVVSx1REFBZ0I7Ozs7O1NBQWhCLGdCQUFnQiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3BzLXZpZXctYXBpdG9rZW5zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vdHNfd2ViL2VsZW1lbnRzL2FjY2Vzcy9vcHMtdmlldy1hcGl0b2tlbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLE9BQU8sS0FBSyxRQUFRLE1BQU0sbUJBQW1CLENBQUM7QUFDOUMsT0FBTyxLQUFLLFVBQVUsTUFBTSxzQ0FBc0MsQ0FBQztBQUNuRSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFL0MsT0FBTyxFQUNMLFdBQVcsRUFDWCxHQUFHLEVBQ0gsVUFBVSxFQUNWLGFBQWEsRUFDYixJQUFJLEVBQ0osS0FBSyxHQUVOLE1BQU0sNkJBQTZCLENBQUM7SUFLeEIsZ0JBQWdCOzRCQUQ1QixhQUFhLENBQUMsb0JBQW9CLENBQUM7Ozs7c0JBQ0UsV0FBVzs7OztnQ0FBbkIsU0FBUSxXQUFXOzs7O3NDQUM5QyxLQUFLLEVBQUU7WUFBQyxtTEFBUyxVQUFVLDZCQUFWLFVBQVUsK0ZBTzFCO1lBUkosNktBa1lDOzs7O1FBallVLGlGQUFzRDtZQUM3RCxZQUFZLEVBQUUsRUFBRTtZQUNoQixRQUFRLEVBQUUsRUFBRTtZQUNaLFNBQVMsRUFBRSxFQUFFO1lBQ2IsU0FBUyxFQUFFLEtBQUs7WUFDaEIsS0FBSyxFQUFFLElBQUk7WUFDWCxXQUFXLEVBQUUsQ0FBQztTQUNmLEVBQUM7UUFQTyxJQUFTLFVBQVUsZ0RBTzFCO1FBUE8sSUFBUyxVQUFVLHNEQU8xQjtRQUVGO1lBQ0UsS0FBSyxFQUFFLENBQUM7O1lBQ1IsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLHdCQUF3QjtpQkFDMUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUM7aUJBQ2hCLFNBQVMsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFO2dCQUN4QixJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztZQUMvQixDQUFDLENBQUMsQ0FBQztZQUNMLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBRS9CLGdFQUFnRTtZQUNoRSx1REFBdUQ7WUFDdkQsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLGNBQWM7aUJBQ3JDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQztpQkFDM0IsU0FBUyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUU7Z0JBQ3hCLElBQUksVUFBVSxFQUFFLENBQUM7b0JBQ2YsUUFBUSxDQUFDLHdCQUF3QixDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLENBQUM7Z0JBQ3hGLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztZQUNMLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1NBQ3JDO1FBRU0sTUFBTSxDQUFDLE1BQU0sR0FBRztZQUNyQixVQUFVLENBQUMsYUFBYTtZQUN4QixXQUFXO1lBQ1gsR0FBRyxDQUFBOzs7Ozs7Ozs7Ozs7O3NCQWFlLFVBQVUsQ0FBQyxPQUFPLENBQUMsd0JBQXdCLEVBQUUsd0JBQXdCLENBQUM7aUJBQzNFLFVBQVUsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQzs7Ozs7Ozs7Ozs7Ozs7Ozs7c0JBaUJoQyxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUM7aUJBQzdDLFVBQVUsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQzs7OztzQkFJbkMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDO2lCQUM3QyxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUM7Ozs7c0JBSW5DLFVBQVUsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQztpQkFDN0MsVUFBVSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDOztLQUVwRDtTQUNGLENBQUM7UUFFSyxNQUFNO1lBQ1gsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUM7WUFFdEMsT0FBTyxJQUFJLENBQUE7Ozs7O3NCQUtPLFlBQVk7c0JBQ1osbUNBQW1DO2tCQUN2QyxTQUFTO3NCQUNMLE9BQU87d0JBQ0wsSUFBSTsrQkFDRyxJQUFJOzZCQUNOLENBQUMsS0FBb0MsRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDNUQsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO2dCQUNoQixNQUFNLEVBQUUsSUFBSSxDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7Z0JBQzNDLE1BQU0sRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUMsS0FBSyxDQUFDO2dCQUNyQyxPQUFPLEVBQUUsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLGtCQUFrQixFQUFFO2dCQUN2RCxPQUFPLEVBQUUsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLGtCQUFrQixFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU87Z0JBQ25GLFFBQVEsRUFBRSxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTzthQUN2RixDQUFDO3lCQUNhO2dCQUNiO29CQUNFLElBQUksRUFBRSxjQUFjO29CQUNwQixRQUFRLEVBQUUsYUFBYTtvQkFDdkIsSUFBSSxFQUFFLENBQUMsUUFBUSxDQUFDO29CQUNoQixVQUFVLEVBQUUsS0FBSyxJQUFJLEVBQUU7d0JBQ3JCLE1BQU0sSUFBSSxDQUFDLHFCQUFxQixFQUFFLENBQUM7b0JBQ3JDLENBQUM7aUJBQ0Y7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLFFBQVE7b0JBQ2QsUUFBUSxFQUFFLGFBQWE7b0JBQ3ZCLElBQUksRUFBRSxDQUFDLE9BQU8sRUFBRSxhQUFhLENBQVE7b0JBQ3JDLHdCQUF3QixFQUFFLENBQUMsVUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTztvQkFDdkUsVUFBVSxFQUFFLEtBQUssRUFBRSxVQUFlLEVBQUUsRUFBRTt3QkFDcEMsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLElBQXFDLENBQUM7d0JBQy9ELE1BQU0sUUFBUSxDQUFDLHdCQUF3QixDQUFDLGNBQWMsQ0FDcEQsUUFBUSxDQUFDLG9CQUFvQixFQUM3QixFQUFFLEVBQUUsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FDaEMsQ0FBQztvQkFDSixDQUFDO2lCQUNGO2dCQUNEO29CQUNFLElBQUksRUFBRSxTQUFTO29CQUNmLFFBQVEsRUFBRSxjQUFjO29CQUN4QixJQUFJLEVBQUUsQ0FBQyxPQUFPLEVBQUUsYUFBYSxDQUFRO29CQUNyQyx3QkFBd0IsRUFBRSxDQUFDLFVBQWUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPO29CQUN0RSxVQUFVLEVBQUUsS0FBSyxFQUFFLFVBQWUsRUFBRSxFQUFFO3dCQUNwQyxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsSUFBcUMsQ0FBQzt3QkFDL0QsTUFBTSxRQUFRLENBQUMsd0JBQXdCLENBQUMsY0FBYyxDQUNwRCxRQUFRLENBQUMsb0JBQW9CLEVBQzdCLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUNqQyxDQUFDO29CQUNKLENBQUM7aUJBQ0Y7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLE1BQU07b0JBQ1osUUFBUSxFQUFFLGlCQUFpQjtvQkFDM0IsSUFBSSxFQUFFLENBQUMsT0FBTyxFQUFFLGFBQWEsQ0FBUTtvQkFDckMsVUFBVSxFQUFFLEtBQUssRUFBRSxVQUFlLEVBQUUsRUFBRTt3QkFDcEMsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLElBQXFDLENBQUM7d0JBQy9ELE1BQU0sSUFBSSxDQUFDLG1CQUFtQixDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUN4QyxDQUFDO2lCQUNGO2dCQUNEO29CQUNFLElBQUksRUFBRSxRQUFRO29CQUNkLFFBQVEsRUFBRSxlQUFlO29CQUN6QixJQUFJLEVBQUUsQ0FBQyxPQUFPLEVBQUUsYUFBYSxDQUFRO29CQUNyQyxVQUFVLEVBQUUsS0FBSyxFQUFFLFVBQWUsRUFBRSxFQUFFO3dCQUNwQyxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsSUFBcUMsQ0FBQzt3QkFDL0QsTUFBTSxRQUFRLENBQUMsd0JBQXdCLENBQUMsY0FBYyxDQUNwRCxRQUFRLENBQUMsb0JBQW9CLEVBQzdCLEtBQUssQ0FBQyxFQUFFLENBQ1QsQ0FBQztvQkFDSixDQUFDO2lCQUNGO2FBQ0Y7OztLQUdOLENBQUM7UUFDSixDQUFDO1FBRU8sZ0JBQWdCLENBQUMsTUFBd0I7WUFDL0MsT0FBTyxJQUFJLENBQUEsMERBQTBELE1BQU0sQ0FBQyxHQUFHLENBQzdFLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUEsMkJBQTJCLENBQUMsU0FBUyxDQUNqRCxRQUFRLENBQUM7UUFDWixDQUFDO1FBRU8saUJBQWlCLENBQUMsS0FBb0M7WUFDNUQsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDbkIsT0FBTyxJQUFJLENBQUEsb0RBQW9ELENBQUM7WUFDbEUsQ0FBQztZQUNELElBQUksS0FBSyxDQUFDLFNBQVMsSUFBSSxLQUFLLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDO2dCQUNwRCxPQUFPLElBQUksQ0FBQSxrREFBa0QsQ0FBQztZQUNoRSxDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUEsZ0RBQWdELENBQUM7UUFDOUQsQ0FBQztRQUVPLEtBQUssQ0FBQyxxQkFBcUI7WUFDakMsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sTUFBTSxDQUFDLDZCQUE2QixDQUFDLENBQUM7WUFFbEUsTUFBTSxTQUFTLEdBQUc7Z0JBQ2hCLEdBQUc7Z0JBQ0gsYUFBYTtnQkFDYixjQUFjO2dCQUNkLGFBQWE7Z0JBQ2IsbUJBQW1CO2dCQUNuQixvQkFBb0I7Z0JBQ3BCLGFBQWE7Z0JBQ2IsZUFBZTtnQkFDZixjQUFjO2dCQUNkLGVBQWU7Z0JBQ2Ysa0JBQWtCO2dCQUNsQixtQkFBbUI7Z0JBQ25CLG9CQUFvQjtnQkFDcEIscUJBQXFCO2dCQUNyQixzQkFBc0I7Z0JBQ3RCLHVCQUF1QjtnQkFDdkIsa0JBQWtCO2dCQUNsQixtQkFBbUI7YUFDcEIsQ0FBQztZQUVGLE1BQU0sU0FBUyxDQUFDLGFBQWEsQ0FBQztnQkFDNUIsT0FBTyxFQUFFLGtCQUFrQjtnQkFDM0IsT0FBTyxFQUFFLElBQUksQ0FBQTs7Ozs7a0NBS2UsTUFBTSxXQUFXLFlBQVksY0FBYyxJQUFJOzttQkFFOUQsUUFBUTtxQkFDTixjQUFjO3FCQUNkLENBQUMsc0JBQXNCLEVBQUUsdUJBQXVCLENBQUM7MkJBQzNDLFNBQVM7d0JBQ1osSUFBSTs7a0NBRU0sWUFBWSxXQUFXLGFBQWEsaUJBQWlCLG1DQUFtQztrQ0FDeEYsbUJBQW1CLFdBQVcscUJBQXFCLGlCQUFpQixzREFBc0Q7a0NBQzFILGlCQUFpQixXQUFXLG1CQUFtQixpQkFBaUIsbUNBQW1DO2tDQUNuRyxrQkFBa0IsV0FBVyxtQkFBbUIsaUJBQWlCLDBDQUEwQztrQ0FDM0csb0JBQW9CLFdBQVcsc0JBQXNCLGlCQUFpQiwrQ0FBK0M7a0NBQ3JILGVBQWUsV0FBVyxZQUFZLGlCQUFpQiwrQ0FBK0M7O09BRWpJO2dCQUNELFdBQVcsRUFBRTtvQkFDWDt3QkFDRSxJQUFJLEVBQUUsUUFBUTt3QkFDZCxRQUFRLEVBQUUsVUFBVTt3QkFDcEIsTUFBTSxFQUFFLEtBQUssRUFBRSxRQUFhLEVBQUUsRUFBRSxDQUFDLE1BQU0sUUFBUSxDQUFDLE9BQU8sRUFBRTtxQkFDMUQ7b0JBQ0Q7d0JBQ0UsSUFBSSxFQUFFLFFBQVE7d0JBQ2QsUUFBUSxFQUFFLFlBQVk7d0JBQ3RCLE1BQU0sRUFBRSxLQUFLLEVBQUUsUUFBYSxFQUFFLEVBQUU7NEJBQzlCLE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxVQUFVLEVBQUUsYUFBYSxDQUFDLFVBQVUsQ0FBQyxDQUFDOzRCQUNqRSxNQUFNLElBQUksR0FBRyxTQUFTLEVBQUUsYUFBYSxDQUFDLFdBQVcsQ0FBQyxDQUFDOzRCQUNuRCxJQUFJLENBQUMsSUFBSTtnQ0FBRSxPQUFPOzRCQUNsQixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQzs0QkFDOUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJO2dDQUFFLE9BQU87NEJBRTNCLHFGQUFxRjs0QkFDckYsaUVBQWlFOzRCQUNqRSxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLGlCQUFpQixDQUFRLENBQUM7NEJBQy9ELE1BQU0sU0FBUyxHQUFhLFNBQVMsRUFBRSxRQUFRLEVBQUUsRUFBRSxJQUFJLFNBQVMsRUFBRSxLQUFLLElBQUksUUFBUSxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUM7NEJBQ2pHLE1BQU0sTUFBTSxHQUFHLFNBQVM7aUNBQ3JCLE1BQU0sQ0FBQyxDQUFDLENBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFRLENBQUMsQ0FBcUIsQ0FBQzs0QkFDM0UsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7NEJBRWxELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxhQUFhO2dDQUMxQyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxhQUFhLEVBQUUsRUFBRSxDQUFDO2dDQUN0QyxDQUFDLENBQUMsSUFBSSxDQUFDOzRCQUVULE1BQU0sUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDOzRCQUV6QixJQUFJLENBQUM7Z0NBQ0gsTUFBTSxRQUFRLEdBQUcsTUFBTSxRQUFRLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLGFBQWEsRUFBRSxNQUFNLENBQUMsQ0FBQztnQ0FDN0YsSUFBSSxRQUFRLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQztvQ0FDNUMscUVBQXFFO29DQUNyRSxNQUFNLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLG9CQUFvQixFQUFFLElBQUksQ0FBQyxDQUFDO29DQUU1RixzQ0FBc0M7b0NBQ3RDLE1BQU0sU0FBUyxDQUFDLGFBQWEsQ0FBQzt3Q0FDNUIsT0FBTyxFQUFFLGVBQWU7d0NBQ3hCLE9BQU8sRUFBRSxJQUFJLENBQUE7Ozs7NkZBSThELFFBQVEsQ0FBQyxVQUFVOzs7bUJBRzdGO3dDQUNELFdBQVcsRUFBRTs0Q0FDWDtnREFDRSxJQUFJLEVBQUUsTUFBTTtnREFDWixRQUFRLEVBQUUsY0FBYztnREFDeEIsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBRTs2Q0FDNUM7eUNBQ0Y7cUNBQ0YsQ0FBQyxDQUFDO2dDQUNMLENBQUM7NEJBQ0gsQ0FBQzs0QkFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dDQUNmLE9BQU8sQ0FBQyxLQUFLLENBQUMseUJBQXlCLEVBQUUsS0FBSyxDQUFDLENBQUM7NEJBQ2xELENBQUM7d0JBQ0gsQ0FBQztxQkFDRjtpQkFDRjthQUNGLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFTyxXQUFXLENBQUMsUUFBYSxFQUFFLE1BQXdCO1lBQ3pELE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ3RELElBQUksQ0FBQyxJQUFJO2dCQUFFLE9BQU8sU0FBUyxDQUFDO1lBQzVCLE1BQU0sTUFBTSxHQUFRO2dCQUNsQixJQUFJO2dCQUNKLE1BQU07YUFDUCxDQUFDO1lBQ0YsSUFBSSxJQUFJLEtBQUssZUFBZSxFQUFFLENBQUM7Z0JBQzdCLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsaUJBQWlCLElBQUksUUFBUSxDQUFDLENBQUMsSUFBSSxFQUFxQyxDQUFDO2dCQUN0RyxNQUFNLEVBQUUsR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLGVBQWUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDekQsSUFBSSxFQUFFLEVBQUUsQ0FBQztvQkFDUCxNQUFNLENBQUMsYUFBYSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUFDO2dCQUN0QyxDQUFDO2dCQUNELE1BQU0sQ0FBQyxnQkFBZ0IsR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLGdCQUFnQixJQUFJLEVBQUUsQ0FBQztxQkFDOUQsS0FBSyxDQUFDLEdBQUcsQ0FBQztxQkFDVixHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQztxQkFDaEMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUNuQixNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLGtCQUFrQixJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUNoRSxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztvQkFDekIsTUFBTSxDQUFDLElBQUksRUFBRSxVQUFVLENBQUMsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO29CQUM3QyxNQUFNLENBQUMsbUJBQW1CLEdBQUcsQ0FBQzs0QkFDNUIsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUU7NEJBQ2pCLEtBQUssRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO3lCQUN6RyxDQUFDLENBQUM7Z0JBQ0wsQ0FBQztnQkFDRCxNQUFNLENBQUMsWUFBWSxHQUFHO29CQUNwQixXQUFXLEVBQUUsSUFBSTtvQkFDakIsY0FBYyxFQUFFLElBQUk7b0JBQ3BCLFVBQVUsRUFBRSxJQUFJO29CQUNoQixjQUFjLEVBQUUsS0FBSztvQkFDckIsbUJBQW1CLEVBQUUsS0FBSztpQkFDM0IsQ0FBQztZQUNKLENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO1FBRU8sS0FBSyxDQUFDLG1CQUFtQixDQUFDLEtBQW9DO1lBQ3BFLE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLE1BQU0sQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO1lBRWxFLE1BQU0sU0FBUyxDQUFDLGFBQWEsQ0FBQztnQkFDNUIsT0FBTyxFQUFFLG1CQUFtQjtnQkFDNUIsT0FBTyxFQUFFLElBQUksQ0FBQTs7MkRBRXdDLEtBQUssQ0FBQyxJQUFJOztPQUU5RDtnQkFDRCxXQUFXLEVBQUU7b0JBQ1g7d0JBQ0UsSUFBSSxFQUFFLFFBQVE7d0JBQ2QsUUFBUSxFQUFFLFVBQVU7d0JBQ3BCLE1BQU0sRUFBRSxLQUFLLEVBQUUsUUFBYSxFQUFFLEVBQUUsQ0FBQyxNQUFNLFFBQVEsQ0FBQyxPQUFPLEVBQUU7cUJBQzFEO29CQUNEO3dCQUNFLElBQUksRUFBRSxZQUFZO3dCQUNsQixRQUFRLEVBQUUsaUJBQWlCO3dCQUMzQixNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQWEsRUFBRSxFQUFFOzRCQUM5QixNQUFNLFFBQVEsQ0FBQyxPQUFPLEVBQUUsQ0FBQzs0QkFDekIsSUFBSSxDQUFDO2dDQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sUUFBUSxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7Z0NBQ3ZELElBQUksUUFBUSxDQUFDLE9BQU8sSUFBSSxRQUFRLENBQUMsVUFBVSxFQUFFLENBQUM7b0NBQzVDLE1BQU0sUUFBUSxDQUFDLHdCQUF3QixDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLENBQUM7b0NBRTVGLE1BQU0sU0FBUyxDQUFDLGFBQWEsQ0FBQzt3Q0FDNUIsT0FBTyxFQUFFLGNBQWM7d0NBQ3ZCLE9BQU8sRUFBRSxJQUFJLENBQUE7Ozs7NkZBSThELFFBQVEsQ0FBQyxVQUFVOzs7bUJBRzdGO3dDQUNELFdBQVcsRUFBRTs0Q0FDWDtnREFDRSxJQUFJLEVBQUUsTUFBTTtnREFDWixRQUFRLEVBQUUsY0FBYztnREFDeEIsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBRTs2Q0FDNUM7eUNBQ0Y7cUNBQ0YsQ0FBQyxDQUFDO2dDQUNMLENBQUM7NEJBQ0gsQ0FBQzs0QkFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dDQUNmLE9BQU8sQ0FBQyxLQUFLLENBQUMsdUJBQXVCLEVBQUUsS0FBSyxDQUFDLENBQUM7NEJBQ2hELENBQUM7d0JBQ0gsQ0FBQztxQkFDRjtpQkFDRjthQUNGLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxLQUFLLENBQUMsWUFBWTtZQUNoQixNQUFNLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLG9CQUFvQixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzlGLENBQUM7O1lBallVLHVEQUFnQjs7Ozs7U0FBaEIsZ0JBQWdCIn0=

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "13.24.0",
+  "version": "13.26.0",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "exports": {
@@ -23,11 +23,12 @@
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.0",
-    "@git.zone/tsbundle": "^2.10.0",
-    "@git.zone/tsrun": "^2.0.2",
+    "@git.zone/tsbundle": "^2.10.1",
+    "@git.zone/tsdocker": "^2.2.5",
+    "@git.zone/tsrun": "^2.0.3",
     "@git.zone/tstest": "^3.6.3",
-    "@git.zone/tswatch": "^3.3.2",
-    "@types/node": "^25.6.0"
+    "@git.zone/tswatch": "^3.3.3",
+    "@types/node": "^25.6.1"
   },
   "dependencies": {
     "@api.global/typedrequest": "^3.3.0",
@@ -35,41 +36,41 @@
     "@api.global/typedserver": "^8.4.6",
     "@api.global/typedsocket": "^4.1.2",
     "@apiclient.xyz/cloudflare": "^7.1.0",
-    "@design.estate/dees-catalog": "^3.78.2",
+    "@design.estate/dees-catalog": "^3.81.0",
     "@design.estate/dees-element": "^2.2.4",
-    "@push.rocks/lik": "^6.4.0",
+    "@push.rocks/lik": "^6.4.1",
     "@push.rocks/projectinfo": "^5.1.0",
-    "@push.rocks/qenv": "^6.1.3",
+    "@push.rocks/qenv": "^6.1.4",
     "@push.rocks/smartacme": "^9.5.0",
     "@push.rocks/smartdata": "^7.1.7",
-    "@push.rocks/smartdb": "^2.6.2",
-    "@push.rocks/smartdns": "^7.9.0",
-    "@push.rocks/smartfs": "^1.5.0",
+    "@push.rocks/smartdb": "^2.10.0",
+    "@push.rocks/smartdns": "^7.9.2",
+    "@push.rocks/smartfs": "^1.5.1",
     "@push.rocks/smartguard": "^3.1.0",
-    "@push.rocks/smartjwt": "^2.2.1",
+    "@push.rocks/smartjwt": "^2.2.2",
     "@push.rocks/smartlog": "^3.2.2",
     "@push.rocks/smartmetrics": "^3.0.3",
-    "@push.rocks/smartmigration": "1.2.0",
+    "@push.rocks/smartmigration": "1.3.1",
     "@push.rocks/smartmta": "^5.3.3",
-    "@push.rocks/smartnetwork": "^4.6.0",
+    "@push.rocks/smartnetwork": "^4.7.1",
     "@push.rocks/smartpath": "^6.0.0",
-    "@push.rocks/smartpromise": "^4.2.3",
-    "@push.rocks/smartproxy": "^27.9.0",
-    "@push.rocks/smartradius": "^1.1.1",
-    "@push.rocks/smartrequest": "^5.0.1",
+    "@push.rocks/smartpromise": "^4.2.4",
+    "@push.rocks/smartproxy": "^27.10.0",
+    "@push.rocks/smartradius": "^1.1.2",
+    "@push.rocks/smartrequest": "^5.0.3",
     "@push.rocks/smartrx": "^3.0.10",
-    "@push.rocks/smartstate": "^2.3.0",
+    "@push.rocks/smartstate": "^2.3.1",
     "@push.rocks/smartunique": "^3.0.9",
     "@push.rocks/smartvpn": "1.19.2",
     "@push.rocks/taskbuffer": "^8.0.2",
     "@serve.zone/catalog": "^2.12.4",
-    "@serve.zone/interfaces": "^5.4.3",
+    "@serve.zone/interfaces": "^5.5.0",
     "@serve.zone/remoteingress": "^4.17.1",
-    "@tsclass/tsclass": "^9.5.0",
+    "@tsclass/tsclass": "^9.5.1",
     "@types/qrcode": "^1.5.6",
-    "lru-cache": "^11.3.5",
+    "lru-cache": "^11.3.6",
     "qrcode": "^1.5.4",
-    "uuid": "^13.0.0"
+    "uuid": "^14.0.0"
   },
   "keywords": [
     "mail service",

package/readme.md

@@ -1,34 +1,38 @@
 # @serve.zone/dcrouter
 
-![dcrouter banner](https://code.foss.global/serve.zone/docs/raw/branch/main/dcrouter.png)
-
-`dcrouter` is a TypeScript control plane for running a serious multi-protocol edge or datacenter gateway from one process. It wires together SmartProxy for HTTP/HTTPS/TCP routing, smartmta for email, smartdns for authoritative DNS and DNS-over-HTTPS, smartradius, smartvpn, remote ingress tunnels, a TypedRequest API, and the Ops dashboard.
-
-Use it when you want one place to define routes, manage domains and certificates, protect internal services, automate changes over an API, and operate the whole stack from a browser.
+`dcrouter` is the serve.zone datacenter gateway runtime: a TypeScript control plane that brings HTTP/HTTPS/TCP routing, email ingress, authoritative DNS, RADIUS, VPN access control, remote ingress tunnels, certificate operations, metrics, and an Ops dashboard into one process.
 
 ## Issue Reporting and Security
 
 For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
 
-## Why It Works
+## Why It Exists
+
+Modern infrastructure often has too many tiny edge tools: a proxy here, a DNS daemon there, a separate cert worker, another dashboard, and a tunnel process bolted on later. `dcrouter` is designed as a cohesive gateway layer for operators who want one audited place to define public routes, domains, edge tunnels, access policy, and operational state.
+
+Highlights:
 
-- 🌐 One runtime for HTTP/HTTPS/TCP, SMTP, authoritative DNS + DoH, RADIUS, VPN, and remote ingress.
-- 🧠 Constructor config becomes system-managed routes, while API-created routes stay editable and clearly separated.
-- 🔐 Certificates, DNS providers, domains, records, API tokens, access profiles, and protected routes live in one management plane.
-- 🖥️ The OpsServer UI and TypedRequest API are first-class parts of the package, not an afterthought.
-- ⚡ Qualifying HTTPS forward routes on port `443` get HTTP/3 augmentation by default unless you opt out.
+- 🌐 SmartProxy-backed HTTP, HTTPS, TCP, TLS/SNI, and optional HTTP/3 route handling
+- 📬 SmartMTA-backed SMTP ingress and email-domain operations
+- 🧭 SmartDNS-backed authoritative DNS plus generated DNS-over-HTTPS routes
+- 🔐 ACME, certificate state, API tokens, users, source profiles, target profiles, and security policies
+- 🛡️ RADIUS, VLAN assignment, VPN-protected routes, and remote ingress firewall snapshots
+- 🖥️ Browser Ops dashboard and TypedRequest API served by the built-in OpsServer
 
-## What You Get
+## Runtime Areas
 
-| Area | What dcrouter does |
+| Area | What dcrouter manages |
 | --- | --- |
-| HTTP / HTTPS / TCP | SmartProxy-based reverse proxying, TLS termination or passthrough, path/domain/port matching, TCP/SNI forwarding |
-| Email | SMTP ingress and delivery via `UnifiedEmailServer`, route-based mail actions, email-domain management, queue and resend operations |
-| DNS | Authoritative zones, nameserver bootstrap records, DNS-over-HTTPS routes on `/dns-query` and `/resolve`, provider-backed domain management |
-| Access and Edge | VPN-gated routes, RADIUS auth/accounting, remote ingress edge registrations and tunnel hub support |
-| Operations | Browser dashboard, TypedRequest API, route management, tokens, certificates, logs, metrics, and health views |
+| Proxying | SmartProxy routes for HTTP, HTTPS, TCP, SNI, TLS termination, passthrough, and backend forwarding |
+| Route ownership | Constructor routes, generated email/DNS routes, and API-created routes with explicit origins |
+| DNS | Authoritative scopes, generated NS records, static DNS records, provider-backed domains, and DoH endpoints |
+| Email | UnifiedEmailServer startup, email-domain management, route-backed delivery actions, received mail operations |
+| Certificates | ACME config, stored certificate metadata, provisioning backoff, and certificate status reporting |
+| Edge access | Remote ingress hub, edge registrations, derived edge ports, pushed firewall rules, VPN-only route access |
+| Network auth | RADIUS clients, MAC Authentication Bypass, VLAN mapping, and accounting sessions |
+| Operations | Dashboard views, TypedRequest handlers, metrics, logs, health, API tokens, users, and configuration views |
 
-## Installation
+## Install
 
 ```bash
 pnpm add @serve.zone/dcrouter
@@ -36,7 +40,7 @@ pnpm add @serve.zone/dcrouter
 
 ## Quick Start
 
-This example stays on unprivileged ports so you can run it locally without root.
+This starts the gateway on unprivileged ports and stores data under the default `~/.serve.zone/dcrouter` base directory.
 
 ```typescript
 import { DcRouter } from '@serve.zone/dcrouter';
@@ -69,86 +73,77 @@ await router.start();
 After startup:
 
 - open the dashboard at `http://localhost:3000`
-- log in with the current built-in credentials `admin` / `admin`
+- log in with the current built-in development credentials `admin` / `admin`
 - send proxied traffic to `http://localhost:18080`
 - stop gracefully with `await router.stop()`
 
-## Route Ownership Model
+## Configuration Model
 
-dcrouter keeps route ownership explicit so automation does not accidentally stomp on system-generated traffic.
+`DcRouter` is configured with `IDcRouterOptions` from `@serve.zone/dcrouter`.
 
-| Route origin | Where it comes from | What you can do |
+| Option | Purpose |
+| --- | --- |
+| `baseDir` | Root directory for dcrouter runtime data. Defaults to `~/.serve.zone/dcrouter`. |
+| `smartProxyConfig` | Main SmartProxy route configuration for HTTP/HTTPS/TCP/SNI traffic. |
+| `emailConfig` | UnifiedEmailServer configuration: hostname, ports, domains, and mail routes. |
+| `emailPortConfig` | External-to-internal email port mapping and received-email storage path. |
+| `tls` | Legacy/static TLS and ACME contact settings used to seed certificate config. |
+| `dnsNsDomains` | Nameserver hostnames used for generated NS records and DoH routes. |
+| `dnsScopes` | Authoritative domains served by the embedded DNS server. |
+| `dnsRecords` | Constructor-defined DNS records. |
+| `publicIp` / `proxyIps` | IPs used for generated A records and proxy-aware DNS exposure. |
+| `dbConfig` | Smartdata persistence via embedded LocalSmartDb or external MongoDB. |
+| `radiusConfig` | RADIUS authentication, accounting, and VLAN assignment. |
+| `remoteIngressConfig` | Remote ingress hub configuration for edge tunnel nodes. |
+| `vpnConfig` | VPN server/client definitions and VPN-only routing behavior. |
+| `http3` | HTTP/3 augmentation settings for qualifying HTTPS routes. |
+| `opsServerPort` | Port for the Ops dashboard and `/typedrequest` API. Defaults to `3000`. |
+
+Important runtime behavior:
+
+- `dbConfig.enabled` defaults to enabled. Without `mongoDbUrl`, dcrouter uses embedded LocalSmartDb.
+- If the DB is disabled, constructor-defined proxy traffic can still run, but persistent API routes, tokens, managed domains, and stored certificate state are unavailable.
+- Qualifying HTTPS forward routes on port `443` are HTTP/3-augmented unless `http3.enabled === false` or the route opts out.
+- DNS-over-HTTPS routes are generated on the first `dnsNsDomains` entry at `/dns-query` and `/resolve`.
+- Email listener ports can be remapped internally, for example public `25`, `587`, and `465` to unprivileged internal ports.
+
+## Route Ownership
+
+dcrouter keeps generated and operator-created routes separate so automation can reconcile safely.
+
+| Origin | Source | Mutability |
 | --- | --- | --- |
-| `config` | Constructor `smartProxyConfig.routes` and related seed config | View and toggle |
-| `email` | Email listener and mail-routing derived routes | View and toggle |
-| `dns` | Generated DoH and DNS-related routes | View and toggle |
-| `api` | Created through the Ops UI or API client | Full CRUD |
-
-Important details:
-
-- system routes are persisted with stable `systemKey` values
-- DNS-over-HTTPS routes are persisted and then hydrated with live socket handlers at runtime
-- editing and deletion are reserved for `api` routes; system routes are toggle-only by design
+| `config` | Constructor `smartProxyConfig.routes` and seed data | Toggle only |
+| `email` | Email listener and email-domain generated routes | Toggle only |
+| `dns` | Generated DNS-over-HTTPS and DNS-related routes | Toggle only |
+| `api` | Ops UI or API client | Full CRUD |
 
-## Configuration Cheat Sheet
+System routes are persisted with stable `systemKey` values. API-created routes are the editable route layer intended for operators and automation.
 
-The main entrypoint is `IDcRouterOptions`.
-
-| Option | Purpose |
-| --- | --- |
-| `smartProxyConfig` | Main HTTP/HTTPS and TCP/SNI routing config |
-| `emailConfig` | Email hostname, ports, domains, and mail routing rules |
-| `emailPortConfig` | External-to-internal email port remapping and received-email storage path |
-| `tls` | ACME contact and static certificate paths |
-| `dnsNsDomains` | Nameserver hostnames used for NS bootstrap and DoH route generation |
-| `dnsScopes` | Domains served authoritatively by the embedded DNS server |
-| `dnsRecords` | Static constructor-defined DNS records |
-| `publicIp` / `proxyIps` | How A records are exposed for nameserver and service records |
-| `dbConfig` | Embedded LocalSmartDb or external MongoDB-backed persistence |
-| `radiusConfig` | RADIUS auth, VLAN assignment, and accounting |
-| `remoteIngressConfig` | Remote ingress hub and edge tunnel setup |
-| `vpnConfig` | VPN server and client definitions for protected route access |
-| `http3` | Global HTTP/3 behavior for qualifying HTTPS routes |
-| `opsServerPort` | Ops dashboard and TypedRequest API port |
-
-## Important Behavior
-
-- `dbConfig.enabled` defaults to `true`. If you do not provide `mongoDbUrl`, dcrouter starts an embedded local database automatically.
-- If you disable the DB, constructor-driven traffic can still run, but DB-backed features such as persistent routes, tokens, ACME config, and managed domains do not start.
-- Qualifying HTTPS forward routes on port `443` get HTTP/3 by default unless `http3.enabled === false` or the route opts out.
-- DNS-over-HTTPS endpoints are generated on the first entry of `dnsNsDomains` at `/dns-query` and `/resolve`.
-- Email listener ports are internally remapped by default, so common external ports such as `25`, `587`, and `465` end up on internal ports like `10025`, `10587`, and `10465`.
-- Provider-backed domains can be managed in the Ops plane without being served by the embedded authoritative DNS server.
-
-## Bigger Example
+## Production-Flavored Example
 
 ```typescript
 import { DcRouter } from '@serve.zone/dcrouter';
 
 const router = new DcRouter({
+  baseDir: '/var/lib/dcrouter',
   smartProxyConfig: {
     routes: [
       {
         name: 'web-app',
-        match: {
-          domains: ['app.example.com'],
-          ports: [443],
-        },
+        match: { domains: ['app.example.com'], ports: [443] },
         action: {
           type: 'forward',
-          targets: [{ host: '127.0.0.1', port: 8080 }],
+          targets: [{ host: '10.10.0.21', port: 8080 }],
           tls: { mode: 'terminate', certificate: 'auto' },
         },
       },
       {
         name: 'internal-admin',
-        match: {
-          domains: ['internal.example.com'],
-          ports: [443],
-        },
+        match: { domains: ['admin.example.com'], ports: [443] },
         action: {
           type: 'forward',
-          targets: [{ host: '127.0.0.1', port: 9090 }],
+          targets: [{ host: '10.10.0.30', port: 9000 }],
           tls: { mode: 'terminate', certificate: 'auto' },
         },
         vpnOnly: true,
@@ -158,15 +153,10 @@ const router = new DcRouter({
   emailConfig: {
     hostname: 'mail.example.com',
     ports: [25, 587, 465],
-    domains: [
-      {
-        domain: 'example.com',
-        dnsMode: 'internal-dns',
-      },
-    ],
+    domains: [{ domain: 'example.com', dnsMode: 'internal-dns' }],
     routes: [
       {
-        name: 'inbound-mail',
+        name: 'inbound-example',
         match: { recipients: '*@example.com' },
         action: {
           type: 'forward',
@@ -178,18 +168,15 @@ const router = new DcRouter({
   dnsNsDomains: ['ns1.example.com', 'ns2.example.com'],
   dnsScopes: ['example.com'],
   publicIp: '203.0.113.10',
-  vpnConfig: {
+  remoteIngressConfig: {
     enabled: true,
-    serverEndpoint: 'vpn.example.com',
-    clients: [
-      {
-        clientId: 'ops-laptop',
-        description: 'Operations laptop',
-      },
-    ],
+    tunnelPort: 8443,
+    hubDomain: 'ingress.example.com',
   },
-  dbConfig: {
+  vpnConfig: {
     enabled: true,
+    serverEndpoint: 'vpn.example.com',
+    clients: [{ clientId: 'ops-laptop', description: 'Operations laptop' }],
   },
   opsServerPort: 3000,
 });
@@ -197,15 +184,9 @@ const router = new DcRouter({
 await router.start();
 ```
 
-## Automation
-
-dcrouter gives you three good integration layers:
-
-- the browser dashboard served by `OpsServer`
-- raw TypedRequest contracts via `@serve.zone/dcrouter/interfaces`
-- a higher-level OO API client via `@serve.zone/dcrouter/apiclient` or `@serve.zone/dcrouter-apiclient`
+## Automation API
 
-### OO API Client Example
+The OpsServer exposes TypedRequest handlers at `/typedrequest`. You can use raw contracts or the object-oriented API client.
 
 ```bash
 pnpm add @serve.zone/dcrouter-apiclient
@@ -220,24 +201,20 @@ const client = new DcRouterApiClient({
 
 await client.login('admin', 'admin');
 
-const { routes } = await client.routes.list();
-
-await client.routes.build()
+const route = await client.routes.build()
   .setName('api-gateway')
   .setMatch({ ports: 443, domains: ['api.example.com'] })
   .setAction({ type: 'forward', targets: [{ host: '127.0.0.1', port: 8081 }] })
   .save();
 
-if (routes[0] && routes[0].origin !== 'api') {
-  await routes[0].toggle(false);
-}
+await route.toggle(true);
 ```
 
-See `./ts_apiclient/readme.md` for the dedicated client package and `./ts_interfaces/readme.md` for the raw contracts.
+Use `@serve.zone/dcrouter/interfaces` or `@serve.zone/dcrouter-interfaces` when you want the raw TypedRequest contracts instead of resource managers.
 
 ## OCI / Container Bootstrap
 
-The package also includes an environment-driven bootstrap used by `runCli()` when `DCROUTER_MODE=OCI_CONTAINER`.
+`runCli()` supports an environment-driven container mode when `DCROUTER_MODE=OCI_CONTAINER`.
 
 ```typescript
 import { runCli } from '@serve.zone/dcrouter';
@@ -245,49 +222,52 @@ import { runCli } from '@serve.zone/dcrouter';
 await runCli();
 ```
 
-Useful environment variables include:
+Supported environment overrides include:
 
-- `DCROUTER_CONFIG_PATH`
-- `DCROUTER_BASE_DIR`
-- `DCROUTER_TLS_EMAIL`
-- `DCROUTER_TLS_DOMAIN`
-- `DCROUTER_PUBLIC_IP`
-- `DCROUTER_PROXY_IPS`
-- `DCROUTER_DNS_NS_DOMAINS`
-- `DCROUTER_DNS_SCOPES`
-- `DCROUTER_EMAIL_HOSTNAME`
-- `DCROUTER_EMAIL_PORTS`
+| Variable | Purpose |
+| --- | --- |
+| `DCROUTER_CONFIG_PATH` | JSON file loaded as the base `IDcRouterOptions` object. |
+| `DCROUTER_BASE_DIR` | Runtime data root. |
+| `DCROUTER_TLS_EMAIL` / `DCROUTER_TLS_DOMAIN` | TLS/ACME seed settings. |
+| `DCROUTER_PUBLIC_IP` / `DCROUTER_PROXY_IPS` | Public/proxy IP exposure settings. |
+| `DCROUTER_DNS_NS_DOMAINS` / `DCROUTER_DNS_SCOPES` | DNS nameserver and authoritative scope settings. |
+| `DCROUTER_EMAIL_HOSTNAME` / `DCROUTER_EMAIL_PORTS` | Email server seed settings. |
+| `DCROUTER_CACHE_ENABLED` | Enables or disables DB-backed persistence. |
+| `DCROUTER_MAX_CONNECTIONS`, `DCROUTER_MAX_CONNECTIONS_PER_IP`, `DCROUTER_CONNECTION_RATE_LIMIT` | SmartProxy capacity and rate-limit overrides. |
 
 ## Published Modules
 
-This repository ships several module boundaries from one codebase.
+This repository intentionally publishes multiple module boundaries from one codebase.
 
 | Module | Purpose | Docs |
 | --- | --- | --- |
 | `@serve.zone/dcrouter` | Main runtime and orchestrator | `./readme.md` |
-| `@serve.zone/dcrouter/interfaces` | Shared request and data contracts as a subpath export | `./ts_interfaces/readme.md` |
-| `@serve.zone/dcrouter/apiclient` | OO API client as a subpath export | `./ts_apiclient/readme.md` |
-| `@serve.zone/dcrouter-interfaces` | Standalone interfaces package | `./ts_interfaces/readme.md` |
+| `@serve.zone/dcrouter/interfaces` | Shared contracts as a subpath export | `./ts_interfaces/readme.md` |
+| `@serve.zone/dcrouter/apiclient` | API client as a subpath export | `./ts_apiclient/readme.md` |
+| `@serve.zone/dcrouter-interfaces` | Standalone contracts package | `./ts_interfaces/readme.md` |
 | `@serve.zone/dcrouter-apiclient` | Standalone OO API client package | `./ts_apiclient/readme.md` |
 | `@serve.zone/dcrouter-migrations` | Standalone migration runner package | `./ts_migrations/readme.md` |
-| `@serve.zone/dcrouter-web` | Standalone web dashboard package boundary | `./ts_web/readme.md` |
+| `@serve.zone/dcrouter-web` | Dashboard frontend module boundary | `./ts_web/readme.md` |
 
 ## Development
 
 ```bash
 pnpm run build
 pnpm test
+pnpm run watch
 ```
 
-Target a single test while working on one area:
+Useful source entry points:
 
-```bash
-tstest test/test.apiclient.ts --verbose
-```
+- `ts/index.ts` exports `DcRouter`, `runCli()`, and public module surfaces.
+- `ts/classes.dcrouter.ts` owns service startup, dependency ordering, and `IDcRouterOptions`.
+- `ts/opsserver/classes.opsserver.ts` wires the dashboard server and TypedRequest handlers.
+- `ts/remoteingress/` integrates `@serve.zone/remoteingress` with stored edge registrations.
+- `ts_migrations/index.ts` contains all DB schema migration steps.
 
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./license) file.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file.
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 
@@ -299,7 +279,7 @@ Use of these trademarks must comply with Task Venture Capital GmbH's Trademark G
 
 ### Company Information
 
-Task Venture Capital GmbH  
+Task Venture Capital GmbH
 Registered at District Court Bremen HRB 35230 HB, Germany
 
 For any legal inquiries or further information, please contact us via email at hello@task.vc.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '13.24.0',
+  version: '13.26.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }