@serve.zone/dcrouter 17.7.1 → 17.9.0

package/dist_ts/opsserver/handlers/webpush-control.handler.js

@@ -0,0 +1,163 @@
+import * as plugins from '../../plugins.js';
+import { requireGatewayMachineAuth, } from '../helpers/gateway-client-auth.js';
+export class WebPushControlHandler {
+    opsServerRef;
+    typedrouter = new plugins.typedrequest.TypedRouter();
+    constructor(opsServerRef) {
+        this.opsServerRef = opsServerRef;
+        this.opsServerRef.typedrouter.addTypedRouter(this.typedrouter);
+        this.registerHandlers();
+    }
+    registerHandlers() {
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('listWebPushBindings', async (dataArg) => {
+            const auth = await this.requireControlAuth(dataArg.auth, 'readWebPush');
+            const owner = this.scopeOwnerFilter(auth, dataArg.owner);
+            const manager = this.opsServerRef.dcRouterRef.webPushManager;
+            return {
+                bindings: await manager.listBindings(owner),
+            };
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('syncWebPushBinding', async (dataArg) => {
+            try {
+                const request = dataArg;
+                const auth = await this.requireControlAuth(dataArg.auth, 'manageWebPush');
+                this.assertExactOwner(auth, dataArg.binding.owner);
+                const result = await this.opsServerRef.dcRouterRef.webPushManager.syncBinding(dataArg.binding, request.controller, auth.userId);
+                return {
+                    success: true,
+                    binding: result.binding,
+                    credential: result.credential,
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    message: this.safeMessage(error),
+                };
+            }
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('deleteWebPushBinding', async (dataArg) => {
+            try {
+                const request = dataArg;
+                const auth = await this.requireControlAuth(dataArg.auth, 'manageWebPush');
+                this.assertExactOwner(auth, request.owner);
+                return {
+                    success: await this.opsServerRef.dcRouterRef.webPushManager.deleteBinding({
+                        ...(request.id !== undefined ? { id: request.id } : {}),
+                        owner: request.owner,
+                        controller: request.controller,
+                    }, auth.userId),
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    message: this.safeMessage(error),
+                };
+            }
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('rotateWebPushCredential', async (dataArg) => {
+            try {
+                const auth = await this.requireControlAuth(dataArg.auth, 'manageWebPush');
+                const manager = this.opsServerRef.dcRouterRef.webPushManager;
+                const binding = await manager.getBindingByCredentialId(dataArg.credentialId);
+                if (!binding) {
+                    throw new plugins.typedrequest.TypedResponseError('Web Push binding not found');
+                }
+                this.assertExactOwner(auth, this.bindingOwner(binding));
+                return {
+                    success: true,
+                    credential: await manager.rotateCredential(dataArg.credentialId),
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    message: this.safeMessage(error),
+                };
+            }
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('rotateWebPushVapidKey', async (dataArg) => {
+            try {
+                const auth = await this.requireControlAuth(dataArg.auth, 'manageWebPush');
+                const binding = await this.requireAuthorizedBinding(auth, dataArg.bindingId);
+                return {
+                    success: true,
+                    binding: await this.opsServerRef.dcRouterRef.webPushManager.rotateVapidKey(binding.id),
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    message: this.safeMessage(error),
+                };
+            }
+        }));
+    }
+    async requireControlAuth(authArg, capabilityArg) {
+        const auth = await requireGatewayMachineAuth(this.opsServerRef, authArg, capabilityArg === 'manageWebPush'
+            ? 'gateway-clients:write'
+            : 'gateway-clients:read');
+        if (auth.isAdmin)
+            return auth;
+        if (auth.policy?.role !== 'gatewayClient'
+            || auth.policy.capabilities?.[capabilityArg] !== true) {
+            throw new plugins.typedrequest.TypedResponseError(`token capability missing: ${capabilityArg}`);
+        }
+        return auth;
+    }
+    scopeOwnerFilter(authArg, requestedArg) {
+        if (authArg.isAdmin)
+            return requestedArg || {};
+        const gatewayClient = authArg.gatewayClient;
+        if (!gatewayClient) {
+            throw new plugins.typedrequest.TypedResponseError('gateway-client credential required');
+        }
+        if (requestedArg?.gatewayClientType !== undefined
+            && requestedArg.gatewayClientType !== gatewayClient.type) {
+            throw new plugins.typedrequest.TypedResponseError('gateway-client credential cannot access another Web Push owner');
+        }
+        if (requestedArg?.gatewayClientId !== undefined
+            && requestedArg.gatewayClientId !== gatewayClient.id) {
+            throw new plugins.typedrequest.TypedResponseError('gateway-client credential cannot access another Web Push owner');
+        }
+        return {
+            gatewayClientType: gatewayClient.type,
+            gatewayClientId: gatewayClient.id,
+            ...(requestedArg?.appInstanceId !== undefined
+                ? { appInstanceId: requestedArg.appInstanceId }
+                : {}),
+        };
+    }
+    assertExactOwner(authArg, ownerArg) {
+        if (authArg.isAdmin)
+            return;
+        const gatewayClient = authArg.gatewayClient;
+        if (!gatewayClient
+            || ownerArg.gatewayClientType !== gatewayClient.type
+            || ownerArg.gatewayClientId !== gatewayClient.id) {
+            throw new plugins.typedrequest.TypedResponseError('gateway-client credential cannot access another Web Push owner');
+        }
+    }
+    async requireAuthorizedBinding(authArg, bindingIdArg) {
+        const binding = await this.opsServerRef.dcRouterRef.webPushManager.getBindingById(bindingIdArg);
+        if (!binding) {
+            throw new plugins.typedrequest.TypedResponseError('Web Push binding not found');
+        }
+        this.assertExactOwner(authArg, this.bindingOwner(binding));
+        return binding;
+    }
+    bindingOwner(bindingArg) {
+        return {
+            gatewayClientType: bindingArg.ownerGatewayClientType,
+            gatewayClientId: bindingArg.ownerGatewayClientId,
+            appInstanceId: bindingArg.ownerAppInstanceId,
+        };
+    }
+    safeMessage(errorArg) {
+        return errorArg instanceof plugins.typedrequest.TypedResponseError
+            ? errorArg.message
+            : 'Web Push control operation failed';
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid2VicHVzaC1jb250cm9sLmhhbmRsZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi90cy9vcHNzZXJ2ZXIvaGFuZGxlcnMvd2VicHVzaC1jb250cm9sLmhhbmRsZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUk1QyxPQUFPLEVBQ0wseUJBQXlCLEdBRTFCLE1BQU0sbUNBQW1DLENBQUM7QUFJM0MsTUFBTSxPQUFPLHFCQUFxQjtJQUdJO0lBRjdCLFdBQVcsR0FBRyxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLENBQUM7SUFFNUQsWUFBb0MsWUFBdUI7UUFBdkIsaUJBQVksR0FBWixZQUFZLENBQVc7UUFDekQsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUMvRCxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztJQUMxQixDQUFDO0lBRU8sZ0JBQWdCO1FBQ3RCLElBQUksQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUM5QixJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUduQyxxQkFBcUIsRUFDckIsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO1lBQ2hCLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDeEUsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDekQsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDO1lBQzdELE9BQU87Z0JBQ0wsUUFBUSxFQUFFLE1BQU0sT0FBTyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUM7YUFDNUMsQ0FBQztRQUNKLENBQUMsQ0FDRixDQUNGLENBQUM7UUFFRixJQUFJLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FDOUIsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FHbkMsb0JBQW9CLEVBQ3BCLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtZQUNoQixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxPQUFPLEdBQUcsT0FFZixDQUFDO2dCQUNGLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsZUFBZSxDQUFDLENBQUM7Z0JBQzFFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDbkQsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUMzRSxPQUFPLENBQUMsT0FBTyxFQUNmLE9BQU8sQ0FBQyxVQUFVLEVBQ2xCLElBQUksQ0FBQyxNQUFNLENBQ1osQ0FBQztnQkFDRixPQUFPO29CQUNMLE9BQU8sRUFBRSxJQUFJO29CQUNiLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTztvQkFDdkIsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO2lCQUM5QixDQUFDO1lBQ0osQ0FBQztZQUFDLE9BQU8sS0FBYyxFQUFFLENBQUM7Z0JBQ3hCLE9BQU87b0JBQ0wsT0FBTyxFQUFFLEtBQUs7b0JBQ2QsT0FBTyxFQUFFLElBQUksQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDO2lCQUNqQyxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUMsQ0FDRixDQUNGLENBQUM7UUFFRixJQUFJLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FDOUIsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FHbkMsc0JBQXNCLEVBQ3RCLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtZQUNoQixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxPQUFPLEdBQUcsT0FJZixDQUFDO2dCQUNGLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsZUFBZSxDQUFDLENBQUM7Z0JBQzFFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUMzQyxPQUFPO29CQUNMLE9BQU8sRUFBRSxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGNBQWMsQ0FBQyxhQUFhLENBQUM7d0JBQ3hFLEdBQUcsQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsT0FBTyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7d0JBQ3ZELEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSzt3QkFDcEIsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO3FCQUMvQixFQUFFLElBQUksQ0FBQyxNQUFNLENBQUM7aUJBQ2hCLENBQUM7WUFDSixDQUFDO1lBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztnQkFDeEIsT0FBTztvQkFDTCxPQUFPLEVBQUUsS0FBSztvQkFDZCxPQUFPLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUM7aUJBQ2pDLENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQyxDQUNGLENBQ0YsQ0FBQztRQUVGLElBQUksQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUM5QixJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUduQyx5QkFBeUIsRUFDekIsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO1lBQ2hCLElBQUksQ0FBQztnQkFDSCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLGVBQWUsQ0FBQyxDQUFDO2dCQUMxRSxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUM7Z0JBQzdELE1BQU0sT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQztnQkFDN0UsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO29CQUNiLE1BQU0sSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLDRCQUE0QixDQUFDLENBQUM7Z0JBQ2xGLENBQUM7Z0JBQ0QsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7Z0JBQ3hELE9BQU87b0JBQ0wsT0FBTyxFQUFFLElBQUk7b0JBQ2IsVUFBVSxFQUFFLE1BQU0sT0FBTyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7aUJBQ2pFLENBQUM7WUFDSixDQUFDO1lBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztnQkFDeEIsT0FBTztvQkFDTCxPQUFPLEVBQUUsS0FBSztvQkFDZCxPQUFPLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUM7aUJBQ2pDLENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQyxDQUNGLENBQ0YsQ0FBQztRQUVGLElBQUksQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUM5QixJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUduQyx1QkFBdUIsRUFDdkIsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO1lBQ2hCLElBQUksQ0FBQztnQkFDSCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLGVBQWUsQ0FBQyxDQUFDO2dCQUMxRSxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUM3RSxPQUFPO29CQUNMLE9BQU8sRUFBRSxJQUFJO29CQUNiLE9BQU8sRUFBRSxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGNBQWMsQ0FBQyxjQUFjLENBQ3hFLE9BQU8sQ0FBQyxFQUFFLENBQ1g7aUJBQ0YsQ0FBQztZQUNKLENBQUM7WUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO2dCQUN4QixPQUFPO29CQUNMLE9BQU8sRUFBRSxLQUFLO29CQUNkLE9BQU8sRUFBRSxJQUFJLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQztpQkFDakMsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDLENBQ0YsQ0FDRixDQUFDO0lBQ0osQ0FBQztJQUVPLEtBQUssQ0FBQyxrQkFBa0IsQ0FDOUIsT0FBZ0YsRUFDaEYsYUFBOEM7UUFFOUMsTUFBTSxJQUFJLEdBQUcsTUFBTSx5QkFBeUIsQ0FDMUMsSUFBSSxDQUFDLFlBQVksRUFDakIsT0FBTyxFQUNQLGFBQWEsS0FBSyxlQUFlO1lBQy9CLENBQUMsQ0FBQyx1QkFBdUI7WUFDekIsQ0FBQyxDQUFDLHNCQUFzQixDQUMzQixDQUFDO1FBQ0YsSUFBSSxJQUFJLENBQUMsT0FBTztZQUFFLE9BQU8sSUFBSSxDQUFDO1FBQzlCLElBQ0UsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEtBQUssZUFBZTtlQUNsQyxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDLGFBQWEsQ0FBQyxLQUFLLElBQUksRUFDckQsQ0FBQztZQUNELE1BQU0sSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUMvQyw2QkFBNkIsYUFBYSxFQUFFLENBQzdDLENBQUM7UUFDSixDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRU8sZ0JBQWdCLENBQ3RCLE9BQW1DLEVBQ25DLFlBQXdEO1FBRXhELElBQUksT0FBTyxDQUFDLE9BQU87WUFBRSxPQUFPLFlBQVksSUFBSSxFQUFFLENBQUM7UUFDL0MsTUFBTSxhQUFhLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQztRQUM1QyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDbkIsTUFBTSxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQy9DLG9DQUFvQyxDQUNyQyxDQUFDO1FBQ0osQ0FBQztRQUNELElBQ0UsWUFBWSxFQUFFLGlCQUFpQixLQUFLLFNBQVM7ZUFDMUMsWUFBWSxDQUFDLGlCQUFpQixLQUFLLGFBQWEsQ0FBQyxJQUFJLEVBQ3hELENBQUM7WUFDRCxNQUFNLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxrQkFBa0IsQ0FDL0MsZ0VBQWdFLENBQ2pFLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFDRSxZQUFZLEVBQUUsZUFBZSxLQUFLLFNBQVM7ZUFDeEMsWUFBWSxDQUFDLGVBQWUsS0FBSyxhQUFhLENBQUMsRUFBRSxFQUNwRCxDQUFDO1lBQ0QsTUFBTSxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQy9DLGdFQUFnRSxDQUNqRSxDQUFDO1FBQ0osQ0FBQztRQUNELE9BQU87WUFDTCxpQkFBaUIsRUFBRSxhQUFhLENBQUMsSUFBSTtZQUNyQyxlQUFlLEVBQUUsYUFBYSxDQUFDLEVBQUU7WUFDakMsR0FBRyxDQUFDLFlBQVksRUFBRSxhQUFhLEtBQUssU0FBUztnQkFDM0MsQ0FBQyxDQUFDLEVBQUUsYUFBYSxFQUFFLFlBQVksQ0FBQyxhQUFhLEVBQUU7Z0JBQy9DLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDUixDQUFDO0lBQ0osQ0FBQztJQUVPLGdCQUFnQixDQUN0QixPQUFtQyxFQUNuQyxRQUErQjtRQUUvQixJQUFJLE9BQU8sQ0FBQyxPQUFPO1lBQUUsT0FBTztRQUM1QixNQUFNLGFBQWEsR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDO1FBQzVDLElBQ0UsQ0FBQyxhQUFhO2VBQ1gsUUFBUSxDQUFDLGlCQUFpQixLQUFLLGFBQWEsQ0FBQyxJQUFJO2VBQ2pELFFBQVEsQ0FBQyxlQUFlLEtBQUssYUFBYSxDQUFDLEVBQUUsRUFDaEQsQ0FBQztZQUNELE1BQU0sSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUMvQyxnRUFBZ0UsQ0FDakUsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRU8sS0FBSyxDQUFDLHdCQUF3QixDQUNwQyxPQUFtQyxFQUNuQyxZQUFvQjtRQUVwQixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGNBQWMsQ0FBQyxjQUFjLENBQy9FLFlBQVksQ0FDYixDQUFDO1FBQ0YsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsTUFBTSxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsNEJBQTRCLENBQUMsQ0FBQztRQUNsRixDQUFDO1FBQ0QsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDM0QsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUVPLFlBQVksQ0FBQyxVQUE2QjtRQUNoRCxPQUFPO1lBQ0wsaUJBQWlCLEVBQUUsVUFBVSxDQUFDLHNCQUFzQjtZQUNwRCxlQUFlLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjtZQUNoRCxhQUFhLEVBQUUsVUFBVSxDQUFDLGtCQUFrQjtTQUM3QyxDQUFDO0lBQ0osQ0FBQztJQUVPLFdBQVcsQ0FBQyxRQUFpQjtRQUNuQyxPQUFPLFFBQVEsWUFBWSxPQUFPLENBQUMsWUFBWSxDQUFDLGtCQUFrQjtZQUNoRSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU87WUFDbEIsQ0FBQyxDQUFDLG1DQUFtQyxDQUFDO0lBQzFDLENBQUM7Q0FDRiJ9

package/dist_ts/plugins.d.ts

@@ -2,6 +2,7 @@ import * as dns from 'node:dns';
 import * as fs from 'node:fs';
 import * as crypto from 'node:crypto';
 import * as http from 'node:http';
+import * as https from 'node:https';
 import * as net from 'node:net';
 import * as buffer from 'node:buffer';
 import * as os from 'node:os';
@@ -9,7 +10,7 @@ import * as path from 'node:path';
 import * as tls from 'node:tls';
 import * as util from 'node:util';
 import * as url from 'node:url';
-export { dns, fs, crypto, http, net, buffer, os, path, tls, util, url, };
+export { dns, fs, crypto, http, https, net, buffer, os, path, tls, util, url, };
 import * as servezoneInterfaces from '@serve.zone/interfaces';
 import * as remoteingress from '@serve.zone/remoteingress';
 export { servezoneInterfaces, remoteingress, };
@@ -50,5 +51,7 @@ import * as cloudflare from '@apiclient.xyz/cloudflare';
 export { cloudflare, };
 import * as tsclass from '@tsclass/tsclass';
 export { tsclass, };
+import ipaddr from 'ipaddr.js';
 import * as uuid from 'uuid';
-export { uuid, };
+import webpush from 'web-push';
+export { ipaddr, uuid, webpush, };

package/dist_ts/plugins.js

@@ -3,6 +3,7 @@ import * as dns from 'node:dns';
 import * as fs from 'node:fs';
 import * as crypto from 'node:crypto';
 import * as http from 'node:http';
+import * as https from 'node:https';
 import * as net from 'node:net';
 import * as buffer from 'node:buffer';
 import * as os from 'node:os';
@@ -10,7 +11,7 @@ import * as path from 'node:path';
 import * as tls from 'node:tls';
 import * as util from 'node:util';
 import * as url from 'node:url';
-export { dns, fs, crypto, http, net, buffer, os, path, tls, util, url, };
+export { dns, fs, crypto, http, https, net, buffer, os, path, tls, util, url, };
 // @serve.zone scope
 import * as servezoneInterfaces from '@serve.zone/interfaces';
 import * as remoteingress from '@serve.zone/remoteingress';
@@ -57,6 +58,8 @@ export { cloudflare, };
 import * as tsclass from '@tsclass/tsclass';
 export { tsclass, };
 // third party
+import ipaddr from 'ipaddr.js';
 import * as uuid from 'uuid';
-export { uuid, };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYztBQUNkLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBRWhDLE9BQU8sRUFDTCxHQUFHLEVBQ0gsRUFBRSxFQUNGLE1BQU0sRUFDTixJQUFJLEVBQ0osR0FBRyxFQUNILE1BQU0sRUFDTixFQUFFLEVBQ0YsSUFBSSxFQUNKLEdBQUcsRUFDSCxJQUFJLEVBQ0osR0FBRyxHQUNKLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLG1CQUFtQixNQUFNLHdCQUF3QixDQUFDO0FBQzlELE9BQU8sS0FBSyxhQUFhLE1BQU0sMkJBQTJCLENBQUM7QUFFM0QsT0FBTyxFQUNMLG1CQUFtQixFQUNuQixhQUFhLEdBQ2QsQ0FBQTtBQUVELG9CQUFvQjtBQUNwQixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUV2RCxPQUFPLEVBQ0wsWUFBWSxFQUNaLFdBQVcsRUFDWCxXQUFXLEdBQ1osQ0FBQTtBQUVELG9CQUFvQjtBQUNwQixPQUFPLEtBQUssWUFBWSxNQUFNLHdCQUF3QixDQUFDO0FBRXZELE9BQU8sRUFDTCxZQUFZLEdBQ2IsQ0FBQTtBQUVELG9CQUFvQjtBQUNwQixPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxJQUFJLE1BQU0sa0JBQWtCLENBQUM7QUFDekMsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxjQUFjLE1BQU0sNEJBQTRCLENBQUM7QUFDN0QsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUNyRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUMvQyxPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUNyRCxPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssVUFBVSxNQUFNLHdCQUF3QixDQUFDO0FBRXJELE9BQU8sRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFlBQVksRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQztBQUt4UyxzQkFBc0I7QUFDdEIsT0FBTyxLQUFLLFVBQVUsTUFBTSwyQkFBMkIsQ0FBQztBQUV4RCxPQUFPLEVBQ0wsVUFBVSxHQUNYLENBQUE7QUFFRCxnQkFBZ0I7QUFDaEIsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUU1QyxPQUFPLEVBQ0wsT0FBTyxHQUNSLENBQUE7QUFFRCxjQUFjO0FBQ2QsT0FBTyxLQUFLLElBQUksTUFBTSxNQUFNLENBQUM7QUFFN0IsT0FBTyxFQUNMLElBQUksR0FDTCxDQUFBIn0=
+import webpush from 'web-push';
+export { ipaddr, uuid, webpush, };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYztBQUNkLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxLQUFLLE1BQU0sWUFBWSxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBRWhDLE9BQU8sRUFDTCxHQUFHLEVBQ0gsRUFBRSxFQUNGLE1BQU0sRUFDTixJQUFJLEVBQ0osS0FBSyxFQUNMLEdBQUcsRUFDSCxNQUFNLEVBQ04sRUFBRSxFQUNGLElBQUksRUFDSixHQUFHLEVBQ0gsSUFBSSxFQUNKLEdBQUcsR0FDSixDQUFBO0FBRUQsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxtQkFBbUIsTUFBTSx3QkFBd0IsQ0FBQztBQUM5RCxPQUFPLEtBQUssYUFBYSxNQUFNLDJCQUEyQixDQUFDO0FBRTNELE9BQU8sRUFDTCxtQkFBbUIsRUFDbkIsYUFBYSxHQUNkLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUNMLFlBQVksRUFDWixXQUFXLEVBQ1gsV0FBVyxHQUNaLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFlBQVksTUFBTSx3QkFBd0IsQ0FBQztBQUV2RCxPQUFPLEVBQ0wsWUFBWSxHQUNiLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssSUFBSSxNQUFNLGtCQUFrQixDQUFDO0FBQ3pDLE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssY0FBYyxNQUFNLDRCQUE0QixDQUFDO0FBQzdELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUVyRCxPQUFPLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLENBQUM7QUFLeFMsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxVQUFVLE1BQU0sMkJBQTJCLENBQUM7QUFFeEQsT0FBTyxFQUNMLFVBQVUsR0FDWCxDQUFBO0FBRUQsZ0JBQWdCO0FBQ2hCLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFFNUMsT0FBTyxFQUNMLE9BQU8sR0FDUixDQUFBO0FBRUQsY0FBYztBQUNkLE9BQU8sTUFBTSxNQUFNLFdBQVcsQ0FBQztBQUMvQixPQUFPLEtBQUssSUFBSSxNQUFNLE1BQU0sQ0FBQztBQUM3QixPQUFPLE9BQU8sTUFBTSxVQUFVLENBQUM7QUFFL0IsT0FBTyxFQUNMLE1BQU0sRUFDTixJQUFJLEVBQ0osT0FBTyxHQUNSLENBQUEifQ==

package/dist_ts/remoteingress/edge-derivation-routes.js

@@ -19,10 +19,14 @@ export function buildEdgeOnlyDerivationRoutes(options) {
                 type: 'forward',
                 targets: [{ host: '127.0.0.1', port: 53 }],
             },
+            ingress: {
+                directHub: false,
+                smartVpn: false,
+            },
             remoteIngress: {
                 enabled: true,
                 edgeFilter: [REMOTE_INGRESS_DNS_TAG],
             },
         }];
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZWRnZS1kZXJpdmF0aW9uLXJvdXRlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL3JlbW90ZWluZ3Jlc3MvZWRnZS1kZXJpdmF0aW9uLXJvdXRlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSwyQ0FBMkMsQ0FBQztBQUVuRjs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSw2QkFBNkIsQ0FBQyxPQUFvQztJQUNoRixJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxNQUFNLEVBQUUsQ0FBQztRQUNsQyxPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFDRCxPQUFPLENBQUM7WUFDTixJQUFJLEVBQUUsd0JBQXdCO1lBQzlCLEtBQUssRUFBRTtnQkFDTCxLQUFLLEVBQUUsQ0FBQyxFQUFFLENBQUM7Z0JBQ1gsU0FBUyxFQUFFLEtBQUs7YUFDakI7WUFDRCxNQUFNLEVBQUU7Z0JBQ04sSUFBSSxFQUFFLFNBQVM7Z0JBQ2YsT0FBTyxFQUFFLENBQUMsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxFQUFFLEVBQUUsQ0FBQzthQUMzQztZQUNELGFBQWEsRUFBRTtnQkFDYixPQUFPLEVBQUUsSUFBSTtnQkFDYixVQUFVLEVBQUUsQ0FBQyxzQkFBc0IsQ0FBQzthQUNyQztTQUNzQixDQUFDLENBQUM7QUFDN0IsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZWRnZS1kZXJpdmF0aW9uLXJvdXRlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL3JlbW90ZWluZ3Jlc3MvZWRnZS1kZXJpdmF0aW9uLXJvdXRlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSwyQ0FBMkMsQ0FBQztBQUVuRjs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSw2QkFBNkIsQ0FBQyxPQUFvQztJQUNoRixJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxNQUFNLEVBQUUsQ0FBQztRQUNsQyxPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFDRCxPQUFPLENBQUM7WUFDTixJQUFJLEVBQUUsd0JBQXdCO1lBQzlCLEtBQUssRUFBRTtnQkFDTCxLQUFLLEVBQUUsQ0FBQyxFQUFFLENBQUM7Z0JBQ1gsU0FBUyxFQUFFLEtBQUs7YUFDakI7WUFDRCxNQUFNLEVBQUU7Z0JBQ04sSUFBSSxFQUFFLFNBQVM7Z0JBQ2YsT0FBTyxFQUFFLENBQUMsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxFQUFFLEVBQUUsQ0FBQzthQUMzQztZQUNELE9BQU8sRUFBRTtnQkFDUCxTQUFTLEVBQUUsS0FBSztnQkFDaEIsUUFBUSxFQUFFLEtBQUs7YUFDaEI7WUFDRCxhQUFhLEVBQUU7Z0JBQ2IsT0FBTyxFQUFFLElBQUk7Z0JBQ2IsVUFBVSxFQUFFLENBQUMsc0JBQXNCLENBQUM7YUFDckM7U0FDc0IsQ0FBQyxDQUFDO0FBQzdCLENBQUMifQ==

package/dist_ts/security/classes.route-policy-augmenter.d.ts

@@ -3,20 +3,24 @@ import type { ISecurityCompiledPolicy } from '../../dist_ts_interfaces/data/secu
 import type { DcRouter } from '../classes.dcrouter.js';
 /**
  * Pure route-policy transformations applied before routes reach SmartProxy:
- * per-listener inbound PROXY protocol policies (driven by RemoteIngress and
- * VPN) and merging of compiled security policies.
+ * route-level trusted ingress authorization, listener-level inbound PROXY
+ * protocol policy, and merging of compiled security policies.
  */
 export declare class RoutePolicyAugmenter {
     private dcRouterRef;
     constructor(dcRouterRef: DcRouter);
     /**
-     * Ensure every route on a shared listener carries a compatible
-     * inboundProxyProtocol policy, deriving defaults from RemoteIngress/VPN.
+     * Compile each dcrouter ingress policy into SmartProxy route security, then
+     * derive one compatible PROXY protocol mode for every shared listener.
+     *
+     * The listener mode only controls parsing. Route security remains the
+     * authorization boundary, so a direct request cannot fall through to a
+     * wildcard route that only permits RemoteIngress or SmartVPN.
      */
     applyInboundProxyProtocolPolicies(routes: plugins.smartproxy.IRouteConfig[]): plugins.smartproxy.IRouteConfig[];
     /** Union blocked IPs/CIDRs across configured and compiled security policies. */
     mergeSecurityPolicies(...policies: Array<Partial<ISecurityCompiledPolicy> | undefined>): ISecurityCompiledPolicy | undefined;
-    private getDesiredInboundProxyProtocolPolicy;
+    private getAllowedIngressOrigins;
+    private getListenerProxyProtocolPolicy;
     private getInboundProxyListenerKeys;
-    private mergeInboundProxyProtocolPolicies;
 }

package/dist_ts/security/classes.route-policy-augmenter.js

@@ -1,8 +1,8 @@
 import * as plugins from '../plugins.js';
 /**
  * Pure route-policy transformations applied before routes reach SmartProxy:
- * per-listener inbound PROXY protocol policies (driven by RemoteIngress and
- * VPN) and merging of compiled security policies.
+ * route-level trusted ingress authorization, listener-level inbound PROXY
+ * protocol policy, and merging of compiled security policies.
  */
 export class RoutePolicyAugmenter {
     dcRouterRef;
@@ -10,42 +10,53 @@ export class RoutePolicyAugmenter {
         this.dcRouterRef = dcRouterRef;
     }
     /**
-     * Ensure every route on a shared listener carries a compatible
-     * inboundProxyProtocol policy, deriving defaults from RemoteIngress/VPN.
+     * Compile each dcrouter ingress policy into SmartProxy route security, then
+     * derive one compatible PROXY protocol mode for every shared listener.
+     *
+     * The listener mode only controls parsing. Route security remains the
+     * authorization boundary, so a direct request cannot fall through to a
+     * wildcard route that only permits RemoteIngress or SmartVPN.
      */
     applyInboundProxyProtocolPolicies(routes) {
-        const policiesByListener = new Map();
-        for (const route of routes) {
-            const policy = route.match?.inboundProxyProtocol || this.getDesiredInboundProxyProtocolPolicy(route);
-            if (!policy) {
-                continue;
+        const routesWithIngressSecurity = routes.map((route) => {
+            const allowedOrigins = this.getAllowedIngressOrigins(route);
+            if (allowedOrigins.length === 0) {
+                throw new Error(`Route '${route.name}' has no enabled ingress path`);
             }
+            return {
+                ...route,
+                security: {
+                    ...route.security,
+                    ingress: {
+                        allowedOrigins,
+                    },
+                },
+            };
+        });
+        const originsByListener = new Map();
+        for (const route of routesWithIngressSecurity) {
+            const origins = route.security.ingress.allowedOrigins;
             for (const listenerKey of this.getInboundProxyListenerKeys(route)) {
-                const mergedPolicy = this.mergeInboundProxyProtocolPolicies(policiesByListener.get(listenerKey), policy);
-                if (mergedPolicy) {
-                    policiesByListener.set(listenerKey, mergedPolicy);
+                const listenerOrigins = originsByListener.get(listenerKey) || new Set();
+                for (const origin of origins) {
+                    listenerOrigins.add(origin);
                 }
+                originsByListener.set(listenerKey, listenerOrigins);
             }
         }
-        if (policiesByListener.size === 0) {
-            return routes;
-        }
-        return routes.map((route) => {
-            if (route.match?.inboundProxyProtocol) {
-                return route;
-            }
-            let listenerPolicy;
+        return routesWithIngressSecurity.map((route) => {
+            const listenerOrigins = new Set();
             for (const listenerKey of this.getInboundProxyListenerKeys(route)) {
-                listenerPolicy = this.mergeInboundProxyProtocolPolicies(listenerPolicy, policiesByListener.get(listenerKey));
-            }
-            if (!listenerPolicy) {
-                return route;
+                for (const origin of originsByListener.get(listenerKey) || []) {
+                    listenerOrigins.add(origin);
+                }
             }
+            const inboundProxyProtocol = this.getListenerProxyProtocolPolicy(listenerOrigins);
             return {
                 ...route,
                 match: {
                     ...route.match,
-                    inboundProxyProtocol: listenerPolicy,
+                    inboundProxyProtocol,
                 },
             };
         });
@@ -72,19 +83,37 @@ export class RoutePolicyAugmenter {
             blockedCidrs: [...blockedCidrs].sort(),
         };
     }
-    getDesiredInboundProxyProtocolPolicy(route) {
+    getAllowedIngressOrigins(route) {
         const dcRoute = route;
-        if (this.dcRouterRef.isRemoteIngressHubEnabled() && dcRoute.remoteIngress?.enabled) {
-            const ports = plugins.smartproxy.expandPortRange(route.match.ports);
-            if (ports.some((port) => port === 25 || port === 587)) {
-                return { mode: 'required' };
-            }
-            return { mode: 'optional' };
+        const origins = new Set();
+        if (dcRoute.ingress) {
+            if (dcRoute.ingress.directHub)
+                origins.add('direct');
+            if (dcRoute.ingress.smartVpn)
+                origins.add('smartVpn');
         }
-        if (this.dcRouterRef.options.vpnConfig?.enabled) {
-            return { mode: 'optional' };
+        else if (dcRoute.vpnOnly) {
+            origins.add('smartVpn');
+        }
+        else {
+            // Compatibility for runtime routes and producers predating the explicit
+            // contract. Persisted routes are backfilled by the versioned migration.
+            origins.add('direct');
+            origins.add('smartVpn');
         }
-        return undefined;
+        if (dcRoute.remoteIngress?.enabled) {
+            origins.add('trustedProxy');
+        }
+        return [...origins];
+    }
+    getListenerProxyProtocolPolicy(origins) {
+        const allowsDirect = origins.has('direct');
+        const allowsProxied = origins.has('trustedProxy') || origins.has('smartVpn');
+        if (allowsDirect && allowsProxied)
+            return { mode: 'optional' };
+        if (allowsProxied)
+            return { mode: 'required' };
+        return { mode: 'reject' };
     }
     getInboundProxyListenerKeys(route) {
         const ports = plugins.smartproxy.expandPortRange(route.match.ports);
@@ -101,20 +130,5 @@ export class RoutePolicyAugmenter {
         }
         return keys;
     }
-    mergeInboundProxyProtocolPolicies(current, next) {
-        if (!current)
-            return next;
-        if (!next)
-            return current;
-        if (current.mode === 'required')
-            return current;
-        if (next.mode === 'required')
-            return next;
-        if (current.mode === 'optional')
-            return current;
-        if (next.mode === 'optional')
-            return next;
-        return current;
-    }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5yb3V0ZS1wb2xpY3ktYXVnbWVudGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvc2VjdXJpdHkvY2xhc3Nlcy5yb3V0ZS1wb2xpY3ktYXVnbWVudGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBT3pDOzs7O0dBSUc7QUFDSCxNQUFNLE9BQU8sb0JBQW9CO0lBQ1g7SUFBcEIsWUFBb0IsV0FBcUI7UUFBckIsZ0JBQVcsR0FBWCxXQUFXLENBQVU7SUFBRyxDQUFDO0lBRTdDOzs7T0FHRztJQUNJLGlDQUFpQyxDQUN0QyxNQUF5QztRQUV6QyxNQUFNLGtCQUFrQixHQUFHLElBQUksR0FBRyxFQUF1QyxDQUFDO1FBRTFFLEtBQUssTUFBTSxLQUFLLElBQUksTUFBTSxFQUFFLENBQUM7WUFDM0IsTUFBTSxNQUFNLEdBQUcsS0FBSyxDQUFDLEtBQUssRUFBRSxvQkFBb0IsSUFBSSxJQUFJLENBQUMsb0NBQW9DLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDckcsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNaLFNBQVM7WUFDWCxDQUFDO1lBQ0QsS0FBSyxNQUFNLFdBQVcsSUFBSSxJQUFJLENBQUMsMkJBQTJCLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDbEUsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLGlDQUFpQyxDQUN6RCxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLEVBQ25DLE1BQU0sQ0FDUCxDQUFDO2dCQUNGLElBQUksWUFBWSxFQUFFLENBQUM7b0JBQ2pCLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsWUFBWSxDQUFDLENBQUM7Z0JBQ3BELENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztRQUVELElBQUksa0JBQWtCLENBQUMsSUFBSSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2xDLE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUM7UUFFRCxPQUFPLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRTtZQUMxQixJQUFJLEtBQUssQ0FBQyxLQUFLLEVBQUUsb0JBQW9CLEVBQUUsQ0FBQztnQkFDdEMsT0FBTyxLQUFLLENBQUM7WUFDZixDQUFDO1lBQ0QsSUFBSSxjQUF1RCxDQUFDO1lBQzVELEtBQUssTUFBTSxXQUFXLElBQUksSUFBSSxDQUFDLDJCQUEyQixDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQ2xFLGNBQWMsR0FBRyxJQUFJLENBQUMsaUNBQWlDLENBQ3JELGNBQWMsRUFDZCxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLENBQ3BDLENBQUM7WUFDSixDQUFDO1lBQ0QsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO2dCQUNwQixPQUFPLEtBQUssQ0FBQztZQUNmLENBQUM7WUFDRCxPQUFPO2dCQUNMLEdBQUcsS0FBSztnQkFDUixLQUFLLEVBQUU7b0JBQ0wsR0FBRyxLQUFLLENBQUMsS0FBSztvQkFDZCxvQkFBb0IsRUFBRSxjQUFjO2lCQUNyQzthQUNGLENBQUM7UUFDSixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxnRkFBZ0Y7SUFDekUscUJBQXFCLENBQzFCLEdBQUcsUUFBNkQ7UUFFaEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUNyQyxNQUFNLFlBQVksR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBRXZDLEtBQUssTUFBTSxNQUFNLElBQUksUUFBUSxFQUFFLENBQUM7WUFDOUIsS0FBSyxNQUFNLEVBQUUsSUFBSSxNQUFNLEVBQUUsVUFBVSxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUMxQyxJQUFJLEVBQUU7b0JBQUUsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUM3QixDQUFDO1lBQ0QsS0FBSyxNQUFNLElBQUksSUFBSSxNQUFNLEVBQUUsWUFBWSxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUM5QyxJQUFJLElBQUk7b0JBQUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUNuQyxDQUFDO1FBQ0gsQ0FBQztRQUVELElBQUksVUFBVSxDQUFDLElBQUksS0FBSyxDQUFDLElBQUksWUFBWSxDQUFDLElBQUksS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNyRCxPQUFPLFNBQVMsQ0FBQztRQUNuQixDQUFDO1FBRUQsT0FBTztZQUNMLFVBQVUsRUFBRSxDQUFDLEdBQUcsVUFBVSxDQUFDLENBQUMsSUFBSSxFQUFFO1lBQ2xDLFlBQVksRUFBRSxDQUFDLEdBQUcsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFO1NBQ3ZDLENBQUM7SUFDSixDQUFDO0lBRU8sb0NBQW9DLENBQzFDLEtBQXNDO1FBRXRDLE1BQU0sT0FBTyxHQUFHLEtBQTZCLENBQUM7UUFDOUMsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLHlCQUF5QixFQUFFLElBQUksT0FBTyxDQUFDLGFBQWEsRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUNuRixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsVUFBVSxDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQVksQ0FBYSxDQUFDO1lBQ3ZGLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxLQUFLLEVBQUUsSUFBSSxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDdEQsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsQ0FBQztZQUM5QixDQUFDO1lBQ0QsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsQ0FBQztRQUM5QixDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsT0FBTyxFQUFFLENBQUM7WUFDaEQsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsQ0FBQztRQUM5QixDQUFDO1FBQ0QsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztJQUVPLDJCQUEyQixDQUFDLEtBQXNDO1FBQ3hFLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUMsZUFBZSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBWSxDQUFhLENBQUM7UUFDdkYsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssS0FBSztZQUNoRCxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7WUFDVCxDQUFDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssS0FBSztnQkFDL0IsQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQztnQkFDaEIsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDZCxNQUFNLElBQUksR0FBYSxFQUFFLENBQUM7UUFDMUIsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUN6QixLQUFLLE1BQU0sU0FBUyxJQUFJLFVBQVUsRUFBRSxDQUFDO2dCQUNuQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsU0FBUyxJQUFJLElBQUksRUFBRSxDQUFDLENBQUM7WUFDcEMsQ0FBQztRQUNILENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFTyxpQ0FBaUMsQ0FDdkMsT0FBcUMsRUFDckMsSUFBa0M7UUFFbEMsSUFBSSxDQUFDLE9BQU87WUFBRSxPQUFPLElBQUksQ0FBQztRQUMxQixJQUFJLENBQUMsSUFBSTtZQUFFLE9BQU8sT0FBTyxDQUFDO1FBQzFCLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxVQUFVO1lBQUUsT0FBTyxPQUFPLENBQUM7UUFDaEQsSUFBSSxJQUFJLENBQUMsSUFBSSxLQUFLLFVBQVU7WUFBRSxPQUFPLElBQUksQ0FBQztRQUMxQyxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssVUFBVTtZQUFFLE9BQU8sT0FBTyxDQUFDO1FBQ2hELElBQUksSUFBSSxDQUFDLElBQUksS0FBSyxVQUFVO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFDMUMsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5yb3V0ZS1wb2xpY3ktYXVnbWVudGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvc2VjdXJpdHkvY2xhc3Nlcy5yb3V0ZS1wb2xpY3ktYXVnbWVudGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBVXpDOzs7O0dBSUc7QUFDSCxNQUFNLE9BQU8sb0JBQW9CO0lBQ1g7SUFBcEIsWUFBb0IsV0FBcUI7UUFBckIsZ0JBQVcsR0FBWCxXQUFXLENBQVU7SUFBRyxDQUFDO0lBRTdDOzs7Ozs7O09BT0c7SUFDSSxpQ0FBaUMsQ0FDdEMsTUFBeUM7UUFFekMsTUFBTSx5QkFBeUIsR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDckQsTUFBTSxjQUFjLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzVELElBQUksY0FBYyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDaEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxVQUFVLEtBQUssQ0FBQyxJQUFJLCtCQUErQixDQUFDLENBQUM7WUFDdkUsQ0FBQztZQUNELE9BQU87Z0JBQ0wsR0FBRyxLQUFLO2dCQUNSLFFBQVEsRUFBRTtvQkFDUixHQUFHLEtBQUssQ0FBQyxRQUFRO29CQUNqQixPQUFPLEVBQUU7d0JBQ1AsY0FBYztxQkFDZjtpQkFDRjthQUNGLENBQUM7UUFDSixDQUFDLENBQUMsQ0FBQztRQUVILE1BQU0saUJBQWlCLEdBQUcsSUFBSSxHQUFHLEVBQStCLENBQUM7UUFDakUsS0FBSyxNQUFNLEtBQUssSUFBSSx5QkFBeUIsRUFBRSxDQUFDO1lBQzlDLE1BQU0sT0FBTyxHQUFHLEtBQUssQ0FBQyxRQUFTLENBQUMsT0FBUSxDQUFDLGNBQWMsQ0FBQztZQUN4RCxLQUFLLE1BQU0sV0FBVyxJQUFJLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUNsRSxNQUFNLGVBQWUsR0FBRyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLElBQUksSUFBSSxHQUFHLEVBQWtCLENBQUM7Z0JBQ3hGLEtBQUssTUFBTSxNQUFNLElBQUksT0FBTyxFQUFFLENBQUM7b0JBQzdCLGVBQWUsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7Z0JBQzlCLENBQUM7Z0JBQ0QsaUJBQWlCLENBQUMsR0FBRyxDQUFDLFdBQVcsRUFBRSxlQUFlLENBQUMsQ0FBQztZQUN0RCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8seUJBQXlCLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDN0MsTUFBTSxlQUFlLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7WUFDbEQsS0FBSyxNQUFNLFdBQVcsSUFBSSxJQUFJLENBQUMsMkJBQTJCLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDbEUsS0FBSyxNQUFNLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7b0JBQzlELGVBQWUsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7Z0JBQzlCLENBQUM7WUFDSCxDQUFDO1lBQ0QsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsOEJBQThCLENBQUMsZUFBZSxDQUFDLENBQUM7WUFDbEYsT0FBTztnQkFDTCxHQUFHLEtBQUs7Z0JBQ1IsS0FBSyxFQUFFO29CQUNMLEdBQUcsS0FBSyxDQUFDLEtBQUs7b0JBQ2Qsb0JBQW9CO2lCQUNyQjthQUNGLENBQUM7UUFDSixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxnRkFBZ0Y7SUFDekUscUJBQXFCLENBQzFCLEdBQUcsUUFBNkQ7UUFFaEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUNyQyxNQUFNLFlBQVksR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBRXZDLEtBQUssTUFBTSxNQUFNLElBQUksUUFBUSxFQUFFLENBQUM7WUFDOUIsS0FBSyxNQUFNLEVBQUUsSUFBSSxNQUFNLEVBQUUsVUFBVSxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUMxQyxJQUFJLEVBQUU7b0JBQUUsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUM3QixDQUFDO1lBQ0QsS0FBSyxNQUFNLElBQUksSUFBSSxNQUFNLEVBQUUsWUFBWSxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUM5QyxJQUFJLElBQUk7b0JBQUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUNuQyxDQUFDO1FBQ0gsQ0FBQztRQUVELElBQUksVUFBVSxDQUFDLElBQUksS0FBSyxDQUFDLElBQUksWUFBWSxDQUFDLElBQUksS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNyRCxPQUFPLFNBQVMsQ0FBQztRQUNuQixDQUFDO1FBRUQsT0FBTztZQUNMLFVBQVUsRUFBRSxDQUFDLEdBQUcsVUFBVSxDQUFDLENBQUMsSUFBSSxFQUFFO1lBQ2xDLFlBQVksRUFBRSxDQUFDLEdBQUcsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFO1NBQ3ZDLENBQUM7SUFDSixDQUFDO0lBRU8sd0JBQXdCLENBQzlCLEtBQXNDO1FBRXRDLE1BQU0sT0FBTyxHQUFHLEtBQTZCLENBQUM7UUFDOUMsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7UUFFMUMsSUFBSSxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDcEIsSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLFNBQVM7Z0JBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNyRCxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUTtnQkFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ3hELENBQUM7YUFBTSxJQUFJLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUMzQixPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzFCLENBQUM7YUFBTSxDQUFDO1lBQ04sd0VBQXdFO1lBQ3hFLHdFQUF3RTtZQUN4RSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3RCLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDMUIsQ0FBQztRQUVELElBQUksT0FBTyxDQUFDLGFBQWEsRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUNuQyxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQzlCLENBQUM7UUFFRCxPQUFPLENBQUMsR0FBRyxPQUFPLENBQUMsQ0FBQztJQUN0QixDQUFDO0lBRU8sOEJBQThCLENBQ3BDLE9BQTRCO1FBRTVCLE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDM0MsTUFBTSxhQUFhLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBRTdFLElBQUksWUFBWSxJQUFJLGFBQWE7WUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxDQUFDO1FBQy9ELElBQUksYUFBYTtZQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDL0MsT0FBTyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsQ0FBQztJQUM1QixDQUFDO0lBRU8sMkJBQTJCLENBQUMsS0FBc0M7UUFDeEUsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFZLENBQWEsQ0FBQztRQUN2RixNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLFNBQVMsS0FBSyxLQUFLO1lBQ2hELENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQztZQUNULENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFNBQVMsS0FBSyxLQUFLO2dCQUMvQixDQUFDLENBQUMsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDO2dCQUNoQixDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNkLE1BQU0sSUFBSSxHQUFhLEVBQUUsQ0FBQztRQUMxQixLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ3pCLEtBQUssTUFBTSxTQUFTLElBQUksVUFBVSxFQUFFLENBQUM7Z0JBQ25DLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxTQUFTLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNwQyxDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztDQUNGIn0=

package/dist_ts/webpush/classes.webpush-crypto.d.ts

@@ -0,0 +1,38 @@
+export interface IWebPushKeyRing {
+    currentKeyId: string;
+    keys: ReadonlyMap<string, Buffer>;
+}
+export interface IWebPushEncryptedEnvelope {
+    version: 1;
+    algorithm: 'aes-256-gcm';
+    keyId: string;
+    nonce: string;
+    ciphertext: string;
+    tag: string;
+}
+export interface IWebPushAadContext {
+    gatewayClientId: string;
+    appInstanceId: string;
+    bindingId: string;
+    documentType: string;
+    documentId: string;
+}
+export type TWebPushHmacDomain = 'credential' | 'idempotency-key' | 'request' | 'endpoint' | 'topic';
+export declare function parseWebPushKeyRing(rawValueArg: unknown, labelArg: string): IWebPushKeyRing;
+export declare function assertDistinctWebPushKeyRings(encryptionRingArg: IWebPushKeyRing, hmacRingArg: IWebPushKeyRing): void;
+export declare function buildWebPushAad(contextArg: IWebPushAadContext): Buffer;
+export declare function canonicalJson(valueArg: unknown): string;
+export declare class WebPushCrypto {
+    private readonly encryptionRing;
+    private readonly hmacRing;
+    constructor(encryptionRing: IWebPushKeyRing, hmacRing: IWebPushKeyRing);
+    get currentEncryptionKeyId(): string;
+    get currentHmacKeyId(): string;
+    encryptJson(valueArg: unknown, aadContextArg: IWebPushAadContext): IWebPushEncryptedEnvelope;
+    decryptJson<T>(envelopeArg: IWebPushEncryptedEnvelope, aadContextArg: IWebPushAadContext): T;
+    hmac(domainArg: TWebPushHmacDomain, valueArg: string, keyIdArg?: string): {
+        keyId: string;
+        digest: string;
+    };
+    verifyHmac(domainArg: TWebPushHmacDomain, valueArg: string, keyIdArg: string, expectedDigestArg: string): boolean;
+}