@serve.zone/dcrouter 15.11.0 → 16.0.1

package/ts/remoteingress/classes.tunnel-manager.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import { logger } from '../logger.js';
 import type { IRemoteIngressPerformanceConfig, IRemoteIngressStatus } from '../../ts_interfaces/data/remoteingress.js';
+import type { IEmailOutboundEgressStatus } from '../../ts_interfaces/data/email-settings.js';
 import type { RemoteIngressManager } from './classes.remoteingress-manager.js';
 
 export interface ITunnelManagerConfig {
@@ -15,8 +16,13 @@ export interface ITunnelManagerConfig {
 
 export type TRemoteIngressEgressProxyRequest = Omit<plugins.remoteingress.IEgressTcpProxyRequest, 'edgeId'> & {
   edgeId?: string;
+  /** Restrict selection to edges whose id or tags match any entry. */
+  edgeFilter?: string[];
 };
 
+/** Cooldown applied to an edge after a failed egress open before it is deprioritized. */
+const egressFailureCooldownMs = 30_000;
+
 /**
  * Manages the RemoteIngressHub instance and tracks connected edge statuses.
  */
@@ -29,6 +35,9 @@ export class TunnelManager {
   private syncChain: Promise<void> = Promise.resolve();
   private reconcileChain: Promise<void> = Promise.resolve();
   private stopped = true;
+  private egressProxyEdgeByProxyId: Map<string, string> = new Map();
+  private activeEgressProxiesByEdge: Map<string, number> = new Map();
+  private egressFailureCooldownUntil: Map<string, number> = new Map();
 
   constructor(manager: RemoteIngressManager, config: ITunnelManagerConfig = {}) {
     this.manager = manager;
@@ -80,6 +89,10 @@ export class TunnelManager {
       const message = `RemoteIngress egress ${data.outcome}: edge=${data.edgeId} proxy=${data.proxyId} target=${data.logicalHost}:${data.port}${data.resolvedIp ? ` resolvedIp=${data.resolvedIp}` : ''}${data.error ? ` error=${data.error}` : ''}`;
       const isExpectedLifecycleEvent = data.outcome === 'connected' || data.outcome === 'closed';
       logger.log(isExpectedLifecycleEvent ? 'info' : 'warn', message);
+      if (!isExpectedLifecycleEvent) {
+        // Connection-level failures steer subsequent selections to other edges.
+        this.egressFailureCooldownUntil.set(data.edgeId, Date.now() + egressFailureCooldownMs);
+      }
     });
   }
 
@@ -137,6 +150,9 @@ export class TunnelManager {
     this.hub.removeAllListeners();
     await this.hub.stop();
     this.edgeStatuses.clear();
+    this.egressProxyEdgeByProxyId.clear();
+    this.activeEgressProxiesByEdge.clear();
+    this.egressFailureCooldownUntil.clear();
   }
 
   /**
@@ -212,31 +228,130 @@ export class TunnelManager {
       throw new Error('RemoteIngress hub is not running');
     }
     const connectedEdges = Array.isArray(status?.connectedEdges) ? status.connectedEdges : [];
-    const eligibleEdges = connectedEdges.filter((edge: any) => {
+    const candidates = this.selectEgressCandidates(connectedEdges, request);
+
+    if (candidates.length === 0) {
+      throw new Error(`No eligible RemoteIngress QUIC egress edge is connected${this.describeEgressScope(request)}`);
+    }
+
+    const { edgeId: _ignored, edgeFilter: _alsoIgnored, ...proxyRequest } = request;
+    let lastError: Error | undefined;
+    for (const candidate of candidates) {
+      try {
+        const proxy = await this.hub.startEgressTcpProxy({
+          ...proxyRequest,
+          edgeId: candidate.edgeId,
+        });
+        this.egressProxyEdgeByProxyId.set(proxy.proxyId, candidate.edgeId);
+        this.activeEgressProxiesByEdge.set(
+          candidate.edgeId,
+          (this.activeEgressProxiesByEdge.get(candidate.edgeId) || 0) + 1,
+        );
+        return proxy;
+      } catch (error: unknown) {
+        lastError = error as Error;
+        this.egressFailureCooldownUntil.set(candidate.edgeId, Date.now() + egressFailureCooldownMs);
+        logger.log('warn', `RemoteIngress egress open failed on edge ${candidate.edgeId}, trying next candidate: ${lastError.message}`);
+      }
+    }
+
+    throw new Error(
+      `All eligible RemoteIngress egress edges failed${this.describeEgressScope(request)}: ${lastError?.message || 'unknown error'}`,
+    );
+  }
+
+  /**
+   * Eligibility (connected + egressEnabled + egressTcpV1 + native QUIC), scoped by
+   * edgeId/edgeFilter, capped by per-edge maxConcurrentStreams, ordered deterministically:
+   * not-in-cooldown first, then fewest active tunnels, then edgeId.
+   */
+  private selectEgressCandidates(
+    connectedEdges: any[],
+    request: TRemoteIngressEgressProxyRequest,
+  ): Array<{ edgeId: string; activeStreams: number }> {
+    const eligible = connectedEdges.filter((edge: any) => {
       const hasEgressCapability = Array.isArray(edge.capabilities) && edge.capabilities.includes('egressTcpV1');
       const usesQuic = edge.transportMode === 'quic'
         || (edge.transportMode === 'quicWithFallback' && edge.fallbackUsed === false);
       return edge.egressEnabled === true && hasEgressCapability && usesQuic;
     });
-    const selectedEdge = request.edgeId
-      ? eligibleEdges.find((edge: any) => edge.edgeId === request.edgeId)
-      : eligibleEdges[0];
 
-    if (!selectedEdge) {
-      const edgeHint = request.edgeId ? ` for edge ${request.edgeId}` : '';
-      throw new Error(`No eligible RemoteIngress QUIC egress edge is connected${edgeHint}`);
+    let scoped = eligible;
+    if (request.edgeId) {
+      scoped = eligible.filter((edge: any) => edge.edgeId === request.edgeId);
+    } else if (request.edgeFilter && request.edgeFilter.length > 0) {
+      const allowedIds = new Set(
+        this.manager.resolveEdgesByFilter(request.edgeFilter).map((edge) => edge.id),
+      );
+      scoped = eligible.filter((edge: any) => allowedIds.has(edge.edgeId));
     }
 
-    return await this.hub.startEgressTcpProxy({
-      ...request,
-      edgeId: selectedEdge.edgeId,
+    const underCap = scoped.filter((edge: any) => {
+      const cap = this.manager.getEdge(edge.edgeId)?.egress?.maxConcurrentStreams;
+      if (!cap) return true;
+      return (this.activeEgressProxiesByEdge.get(edge.edgeId) || 0) < cap;
     });
+
+    const now = Date.now();
+    const inCooldown = (edgeId: string) => (this.egressFailureCooldownUntil.get(edgeId) || 0) > now;
+    return underCap
+      .map((edge: any) => ({ edgeId: edge.edgeId as string, activeStreams: Number(edge.activeStreams) || 0 }))
+      .sort((a, b) => {
+        const cooldownDelta = Number(inCooldown(a.edgeId)) - Number(inCooldown(b.edgeId));
+        if (cooldownDelta !== 0) return cooldownDelta;
+        if (a.activeStreams !== b.activeStreams) return a.activeStreams - b.activeStreams;
+        return a.edgeId.localeCompare(b.edgeId);
+      });
+  }
+
+  private describeEgressScope(request: TRemoteIngressEgressProxyRequest): string {
+    if (request.edgeId) return ` (pinned edge: ${request.edgeId})`;
+    if (request.edgeFilter && request.edgeFilter.length > 0) return ` (filter: ${request.edgeFilter.join(', ')})`;
+    return '';
+  }
+
+  /**
+   * Readiness of the outbound egress path for a given edge scope —
+   * consumed by the ops API and the email-setup preflight.
+   */
+  public getEgressReadiness(edgeFilter: string[]): IEmailOutboundEgressStatus {
+    const allowedIds = new Set(
+      this.manager.resolveEdgesByFilter(edgeFilter).map((edge) => edge.id),
+    );
+    let eligibleEdgeCount = 0;
+    for (const status of this.edgeStatuses.values()) {
+      if (!status.connected) continue;
+      if (!allowedIds.has(status.edgeId)) continue;
+      const hasEgressCapability = status.capabilities?.includes('egressTcpV1') ?? false;
+      const usesQuic = status.transportMode === 'quic'
+        || (status.transportMode === 'quicWithFallback' && status.fallbackUsed === false);
+      if (status.egressEnabled === true && hasEgressCapability && usesQuic) {
+        eligibleEdgeCount++;
+      }
+    }
+    if (eligibleEdgeCount > 0) {
+      return { ready: true, eligibleEdgeCount };
+    }
+    const reason = allowedIds.size === 0
+      ? `no enabled edge matches filter [${edgeFilter.join(', ')}]`
+      : 'no connected matching edge with native QUIC egress capability';
+    return { ready: false, eligibleEdgeCount: 0, reason };
   }
 
   public async stopEgressTcpProxy(proxyId: string): Promise<boolean> {
     if (this.stopped) {
       return false;
     }
+    const edgeId = this.egressProxyEdgeByProxyId.get(proxyId);
+    if (edgeId) {
+      this.egressProxyEdgeByProxyId.delete(proxyId);
+      const current = this.activeEgressProxiesByEdge.get(edgeId) || 0;
+      if (current <= 1) {
+        this.activeEgressProxiesByEdge.delete(edgeId);
+      } else {
+        this.activeEgressProxiesByEdge.set(edgeId, current - 1);
+      }
+    }
     return await this.hub.stopEgressTcpProxy(proxyId);
   }
 

package/ts/remoteingress/edge-derivation-routes.ts

@@ -0,0 +1,29 @@
+import type { IDcRouterRouteConfig } from '../../ts_interfaces/data/remoteingress.js';
+import { REMOTE_INGRESS_DNS_TAG } from '../../ts_interfaces/data/remoteingress.js';
+
+/**
+ * Synthetic routes that exist ONLY for RemoteIngress edge port derivation and
+ * must never reach SmartProxy (smartdns owns host-side 53; a SmartProxy listener
+ * on 53 would collide). Forwards public TCP+UDP 53 on dns-tagged edges to the
+ * hub's authoritative DNS server.
+ */
+export function buildEdgeOnlyDerivationRoutes(options: { dnsNsDomains?: string[] }): IDcRouterRouteConfig[] {
+  if (!options.dnsNsDomains?.length) {
+    return [];
+  }
+  return [{
+    name: 'dns-53-edge-forwarding',
+    match: {
+      ports: [53],
+      transport: 'all',
+    },
+    action: {
+      type: 'forward',
+      targets: [{ host: '127.0.0.1', port: 53 }],
+    },
+    remoteIngress: {
+      enabled: true,
+      edgeFilter: [REMOTE_INGRESS_DNS_TAG],
+    },
+  } as IDcRouterRouteConfig];
+}

package/ts/remoteingress/index.ts

@@ -1,3 +1,4 @@
 export * from './classes.remoteingress-manager.js';
 export * from './classes.tunnel-manager.js';
 export * from './classes.hub-lifecycle.js';
+export * from './edge-derivation-routes.js';

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '15.11.0',
+  version: '16.0.1',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }