@serve.zone/dcrouter 18.7.1 → 18.8.0

package/dist_ts_web/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '18.7.1',
+    version: '18.8.0',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfd2ViLzAwX2NvbW1pdGluZm9fZGF0YS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixJQUFJLEVBQUUsc0JBQXNCO0lBQzVCLE9BQU8sRUFBRSxRQUFRO0lBQ2pCLFdBQVcsRUFBRSwwRUFBMEU7Q0FDeEYsQ0FBQSJ9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "18.7.1",
+  "version": "18.8.0",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "bin": {
@@ -16,59 +16,60 @@
   "license": "MIT",
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",
-    "@git.zone/tsbundle": "^2.11.3",
+    "@git.zone/tsbundle": "^2.11.4",
     "@git.zone/tsdeno": "^1.7.0",
-    "@git.zone/tsdocker": "^3.1.1",
+    "@git.zone/tsdocker": "^3.4.2",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^3.6.7",
+    "@git.zone/tstest": "^4.0.0",
     "@git.zone/tswatch": "^3.3.5",
-    "@types/node": "26.1.1",
+    "@push.rocks/smartdb-v2": "npm:@push.rocks/smartdb@2.14.6",
+    "@types/node": "26.2.0",
     "@types/web-push": "3.6.4"
   },
   "dependencies": {
-    "@api.global/typedrequest": "^3.3.2",
-    "@api.global/typedrequest-interfaces": "^3.0.19",
-    "@api.global/typedserver": "^8.6.4",
-    "@api.global/typedsocket": "^5.0.0",
+    "@api.global/typedrequest": "^3.8.0",
+    "@api.global/typedrequest-interfaces": "^4.0.0",
+    "@api.global/typedserver": "^8.12.0",
+    "@api.global/typedsocket": "^5.1.2",
     "@apiclient.xyz/cloudflare": "^8.0.0",
-    "@design.estate/dees-catalog": "^3.99.0",
+    "@design.estate/dees-catalog": "^3.104.0",
     "@design.estate/dees-element": "^2.4.0",
-    "@idp.global/sdk": "^14.3.0",
+    "@idp.global/sdk": "^15.0.1",
     "@push.rocks/lik": "^6.4.1",
     "@push.rocks/projectinfo": "^5.1.0",
     "@push.rocks/qenv": "^6.1.4",
     "@push.rocks/smartacme": "^9.5.0",
-    "@push.rocks/smartbucket": "^4.6.1",
+    "@push.rocks/smartbucket": "^4.13.0",
     "@push.rocks/smartchallenge": "^1.1.0",
     "@push.rocks/smartdata": "^7.4.0",
-    "@push.rocks/smartdb": "2.14.6",
-    "@push.rocks/smartdns": "^7.12.1",
-    "@push.rocks/smartfs": "^1.6.0",
+    "@push.rocks/smartdb": "5.2.2",
+    "@push.rocks/smartdns": "^8.2.1",
+    "@push.rocks/smartfs": "^1.7.0",
     "@push.rocks/smartguard": "^3.1.2",
     "@push.rocks/smartjwt": "^2.5.1",
     "@push.rocks/smartlog": "^3.2.2",
     "@push.rocks/smartmcp": "^0.3.0",
     "@push.rocks/smartmetrics": "^3.0.3",
-    "@push.rocks/smartmigration": "1.4.1",
-    "@push.rocks/smartmta": "^9.4.1",
-    "@push.rocks/smartnetwork": "^4.8.0",
+    "@push.rocks/smartmigration": "1.5.0",
+    "@push.rocks/smartmta": "^9.5.0",
+    "@push.rocks/smartnetwork": "^4.10.1",
     "@push.rocks/smartpath": "^6.0.0",
-    "@push.rocks/smartpromise": "^4.2.4",
+    "@push.rocks/smartpromise": "^4.2.5",
     "@push.rocks/smartproxy": "^27.20.0",
     "@push.rocks/smartradius": "^1.3.0",
     "@push.rocks/smartrequest": "^5.0.4",
     "@push.rocks/smartrx": "^3.0.12",
-    "@push.rocks/smartserve": "^2.3.0",
-    "@push.rocks/smartstate": "^2.3.1",
+    "@push.rocks/smartserve": "^3.0.0",
+    "@push.rocks/smartstate": "^2.3.3",
     "@push.rocks/smartunique": "^3.0.10",
     "@push.rocks/smartvpn": "1.22.0",
     "@push.rocks/taskbuffer": "^8.0.2",
     "@serve.zone/catalog": "^2.21.1",
-    "@serve.zone/interfaces": "^19.8.0",
-    "@serve.zone/remoteingress": "^5.1.0",
+    "@serve.zone/interfaces": "^27.3.1",
+    "@serve.zone/remoteingress": "^5.1.1",
     "@tsclass/tsclass": "^9.5.1",
     "@types/qrcode": "^1.5.6",
-    "ipaddr.js": "^2.4.0",
+    "ipaddr.js": "^2.5.0",
     "lru-cache": "^11.5.2",
     "qrcode": "^1.5.4",
     "uuid": "^14.0.1",

package/readme.hints.md

@@ -26,11 +26,10 @@ Corollaries, all of which are review-blocking:
 - A registration is torn down by the same operation that removes what it was
   derived from. Track what you actually registered; do not recompute "would I
   have registered this?" at teardown time. `DnsServer.unregisterHandler(pattern,
-  types)` removes **every** handler for that pattern/type pair, so a recomputed
-  guess can tear down another owner's records — or miss its own when the inputs
-  have drifted. `DnsManager.runtimeRegistrations` is the pattern: a per-domain
-  registry of `name|type` keys, each tagged `persisted` or `generated-default`,
-  torn down by `tearDownDomainRuntimeRegistrations(domainId)`.
+  types)` removes **every** handler for that pattern/type pair. `DnsManager`
+  retains every handle returned by `registerHandler()` under a per-domain
+  `name|type` key, tagged `persisted` or `generated-default`, and invokes only
+  those exact handles during teardown or server replacement.
 - A negative cache is invalidated by the event that **resolves its cause**, not
   only by elapsed time. Time-only expiry plus a skip-while-cooling-down rule is a
   deadlock: the sweep that would clear the entry is the sweep the entry blocks.
@@ -127,9 +126,10 @@ A timeout is not evidence that a zone is not ours. A mutation refuses on
 **The drift audit is advisory and never mutates.** It reports three directions —
 `delegated-but-unclaimed` (a live zone we could serve but do not),
 `claimed-but-not-delegated` (authority we still assert after delegation moved
-away), and `verified-but-unhosted` (authority with no `DomainDoc` behind it, so
-nothing is served for it at all). It must not revoke: a resolver blip at boot would otherwise take every
-zone off the air, which is the outage this path exists to avoid.
+away), and `verified-but-unhosted` (authority with no `DomainDoc`-backed records
+or generated apex NS). It must not revoke: a resolver blip at boot would
+otherwise take every zone off the air, which is the outage this path exists to
+avoid.
 
 ### Deploy sequence — seeding is mandatory, not advisable
 
@@ -144,29 +144,44 @@ restart itself introduces no reconciliation gap.
 floor left to fall back on: a zone that is not in `DnsAuthorityDoc` when the new
 build starts is REFUSED outright, and that now includes the zone that used to be
 declared in `dnsScopes` and was the only healthy one. Insert the singleton
-`DnsAuthorityDoc` (`settingsId: 'dns-authority-settings'`) with one
-`{ zone, origin: 'verified', verifiedAt, observedNameservers, verifiedBy }`
-entry per delegated zone *before* starting the new build. The first startup then
-has proof already, and the startup drift audit re-probes each entry and reports
-any that no longer hold, so a wrong seed is self-correcting rather than silently
-trusted.
+`DnsAuthorityDoc` with `settingsId: 'dns-authority-settings'`, a `verifiedZones`
+array containing one `{ zone, origin: 'verified', verifiedAt,
+observedNameservers, verifiedBy }` entry per delegated zone, plus `updatedAt` and
+`updatedBy`, *before* starting the new build. The first startup then has proof
+already. The advisory startup drift audit re-probes and reports evidence that no
+longer holds; it never corrects the seed automatically, so an operator must
+re-run the seed or use the authority mutation API.
 
 The production database is an embedded single-writer `LocalSmartDb` reached over
 a Unix socket in `os.tmpdir()`, so it is not reachable off-host and the seed must
-run on the dcrouter host with dcrouter stopped: stop → seed → start the new
-build. `.nogit/debug/seed-dns-authority.ts` does this; it probes every zone over
-DoH first and writes nothing on an unproven zone, and it is re-runnable (it
-replaces the verified set with what it just proved, so dropping a zone from the
-list drops it from authority).
+run on the dcrouter host while no dcrouter process owns it. The complete first
+18.8.0 sequence is:
+
+1. Stop 18.7.1, suppress automatic restart, and prove no dcrouter process remains.
+2. Take and verify an offline backup of the complete runtime tree and configured
+   data root (normally `~/.serve.zone/dcrouter`).
+3. Seed the authority singleton while dcrouter remains stopped.
+4. Start exactly one 18.8.0 runtime and verify its 18.8.0 migration ledger,
+   sparse DNS ownership index, authority drift, persisted data, and direct NS,
+   SOA, and AAAA answers.
+5. Restore automatic service management only after those checks pass.
+
+`.nogit/debug/seed-dns-authority.ts` is the deployment-local convenience tool:
+it probes every zone over DoH first and writes nothing on an unproven zone, and
+it is re-runnable (it replaces the verified set with what it just proved, so
+dropping a zone from the list drops it from authority).
+
+SmartDB 2 must never open a data root that SmartDB 5 has written. Rollback is
+therefore restore-only: stop 18.8.0, restore the exact pre-upgrade runtime tree
+and offline data backup, and only then start 18.7.1.
 
 That script lives under `.nogit/` and is therefore **not committed** — it is a
 one-off operational tool for this specific upgrade, not product code, and it is
 deliberately not a smartmigration step (see the next section for why). So it
-cannot be the only record of the step: the changelog spells out the document
-shape (`settingsId: 'dns-authority-settings'`, one
-`{ zone, origin: 'verified', verifiedAt, observedNameservers, verifiedBy }` per
-zone) inline, and the same result is reachable through `verifyDnsAuthorityZone`
-after startup with no restart. The script is a convenience, not a dependency.
+cannot be the only record of the step: the changelog spells out the complete
+document shape, including the `verifiedZones` array, and the same result is
+reachable through `verifyDnsAuthorityZone` after startup with no restart. The
+script is a convenience, not a dependency.
 
 **If a zone was missed** — claim it after startup, no restart needed. Order:
 
@@ -221,22 +236,18 @@ on it, so dual-stack clients see a degraded site. Registering handlers for a
 verified zone without moving this set would have reproduced the identical defect
 for every runtime-verified zone.
 
-**How it is reconciled without a restart.** `DnsServerRuntime` owns the array
-instance it passes as `authoritativeZones`. smartdns keeps the options object by
-reference and re-reads the array on every query, so `syncAuthorityZones()`
-mutates it in place and a live server changes its authority set. The alternative
-is re-creating the `DnsServer`, i.e. dropping UDP/TCP 53 — the outage this path
-exists to remove. `assertLiveAuthorityZones()` checks the reference is still
-shared right after construction and logs at `error` if it is not, so a future
-smartdns that copies the array fails loudly instead of silently freezing
-authority at boot; a test asserts the identity against the installed smartdns.
+**How it is reconciled without a restart.** SmartDNS 8.2 copies constructor
+options and exposes `setAuthoritativeZones()`. `DnsServerRuntime` calls that
+setter on every changed database authority set and updates its local snapshot
+only after the call succeeds. No listener is recreated, so UDP/TCP 53 stays up.
 
 `dnssecZone` cannot be reconciled the same way — it is baked into the Rust config
 at start — so it is taken from the boot-time set, which is **sorted** and
 therefore stable across restarts rather than dependent on database insertion
-order. When the set is empty it becomes `no-authority.invalid`: smartdns falls
-back to `[dnssecZone]` when `authoritativeZones` is empty, and `.invalid` is
-reserved by RFC 2606, so an unseeded database provably cannot claim a real name.
+order. When the set is empty the required keying zone becomes
+`no-authority.invalid`. An explicit empty `authoritativeZones` array in SmartDNS
+8.2 claims no zone and does not fall back to `dnssecZone`; `.invalid` remains a
+safe DNSSEC keying sentinel.
 
 ### Why removing `dnsScopes` needs no smartmigration step
 
@@ -250,8 +261,8 @@ worth stating so its absence does not read as an oversight:
   carried `'bootstrap'` — `persist()` only ever wrote `verifiedZones`, and
   `verifyZone()` is the only thing that builds an entry. The bootstrap entries
   existed solely as a read-time projection inside `getSettings()`.
-  Stronger still: `DnsAuthorityDoc` was introduced in `0d82361`, after the newest
-  tag, so no released build has ever created the collection.
+  `DnsAuthorityDoc` already shipped in 18.7.1, and this change does not alter its
+  persisted shape.
 - **Seeding from `dnsScopes` would forge the proof.** A migration step *could*
   read it — `createMigrationRunner` runs in-process at startup and already takes
   deployment-derived seeds — but a `dnsScopes` entry carries no delegation
@@ -266,50 +277,35 @@ same upgrade would claim different zones on different runs, and a migration does
 not re-run to correct itself. Nondeterministic authority is worse than no
 automation.
 
-The upgrade path is instead **seed, then start** (above), backed by three
-independent loud signals if it is skipped: `DnsAuthorityManager.start()` logs at
-`error` on an empty set, `DnsServerRuntime.setup()` logs at `error`, and the
-startup drift audit enumerates precisely the zones to claim. Every one of them is
-remediable through `dns-authority:write` without a restart, which is the property
-that makes a missed seed recoverable rather than an outage.
+The upgrade path is instead **stop, back up, seed, start, verify** (above), backed
+by three independent loud signals if seeding is skipped:
+`DnsAuthorityManager.start()` logs at `error` on an empty set,
+`DnsServerRuntime.setup()` logs at `error`, and the startup drift audit enumerates
+precisely the zones to claim. Every one of them is remediable through
+`dns-authority:write` without a restart, which makes a missed seed recoverable
+without weakening the proof model.
 
-### Sequenced behind an unreleased smartdns
+### SmartDNS 8.2 integration
 
-Three items cannot be written against the installed smartdns (7.12.1) and must
-land in the same change that takes the bump. All are recorded at their code
-sites so they cannot be lost.
+The upstream authority and lifecycle APIs are consumed directly:
 
 1. **The private-route overlay must declare itself non-authoritative.** It
    registers `*` for `A` (`registerPrivateRouteHandler`). The hardened smartdns
    authority model *suppresses* a default-`authoritative` handler for any name
    outside every configured zone, so overlay hostnames proven by `provider-zone`
    — owned, but not delegation-verified, therefore not in `authoritativeZones` —
-   would silently stop being answered. It needs
-   `{ authority: 'non-authoritative', owner: 'private-route-overlay' }`, which
-   is a fourth `registerHandler` parameter that does not exist yet.
-
-2. **A supported way to re-zone a running server.** `DnsServerRuntime` currently
-   keeps the array it passed as `authoritativeZones` and mutates it in place,
-   then verifies through a cast that smartdns still holds the same reference.
-   That is a consumer-side shim on a dependency's storage behaviour, and it is
-   named as one: `authoritativeZones` is a public option, but "the array is kept
-   by reference and re-read per query" is not a documented contract. It is used
-   because the alternative — re-creating the `DnsServer` to change its zones —
-   drops UDP/TCP 53, which is the outage the whole path exists to remove, and
-   because a `setAuthoritativeZones()` cannot be added without releasing
-   smartdns first. Guarded two ways in the meantime:
-   `assertLiveAuthorityZones()` logs at `error` at startup if the reference is
-   no longer shared, and a test asserts the identity against the installed
-   smartdns so a copying release fails the suite rather than production. Replace
-   both with the supported setter when it ships.
-
-3. **Per-registration teardown.** `unregisterHandler(pattern, types)` is coarse:
-   two owners on the identical pattern and type cannot be separated. Nothing
-   does that today — `DnsManager` is the single owner of apex NS, and
-   `DnsServerRuntime`'s glue records use different patterns — but the registry
-   in `DnsManager` exists to work around exactly this. `unregisterHandlerById` /
-   `unregisterHandlersByOwner` and the handle returned by `registerHandler` are
-   the released fix.
+   would silently stop being answered. It registers with
+   `{ authority: 'non-authoritative', owner: 'private-route-overlay' }`.
+
+2. **A supported way to re-zone a running server.** `DnsServerRuntime` calls
+   `setAuthoritativeZones()` and never depends on constructor-array identity.
+   Setter failure leaves the prior local snapshot intact so authority rollback
+   can reconcile against the last successfully applied state.
+
+3. **Per-registration teardown.** `DnsManager` retains the handle returned by
+   every `registerHandler()` call. RRset refresh, authority revocation, domain
+   deletion, shutdown, and server replacement invoke those handles, so another
+   owner's identical pattern/type registration survives.
 
 ### Generated apex NS has exactly one owner
 
@@ -321,9 +317,10 @@ unrelated restart. `DnsManager.registerAuthoritativeZoneDefaults()` is now the
 only source, for every authoritative zone, reconciled in-process both ways.
 
 Consequence worth knowing: generated apex NS hangs off a dcrouter-hosted
-`DomainDoc`, so a verified zone without one serves nothing at all. That is
-reported as `verified-but-unhosted` drift, because it is otherwise invisible —
-such a zone neither REFUSES nor answers.
+`DomainDoc`. A verified zone without one still claims authority and returns its
+configured SOA plus authoritative NODATA/NXDOMAIN, but serves no persisted records
+or generated apex NS. That lame, effectively empty zone is reported as
+`verified-but-unhosted` drift.
 
 ## Domain ownership gates certificates and authoritative DNS (2026-07-25)
 
@@ -368,12 +365,11 @@ synthetic NS/SOA is installed only after activation, never on intent. That work
 needs a persisted status field, a release-version-matched `ts_migrations` step,
 new ops API methods, and UI — it is a feature program, not a defect fix.
 
-Why this matters: **smartdns marks any answer a registered handler produces as
-authoritative (`aa`) regardless of `authoritativeZones`.** See
-`classes.dnsserver.js`: a handler hit sends `'answer'`, a miss inside an
-authoritative zone sends `'authoritativeNegative'`, and a miss outside sends
-`'refused'`. So registering *any* handler for a zone is a public claim of
-authority over it, and dcrouter listens on a public UDP/TCP 53.
+Why this matters: SmartDNS now derives authority solely from
+`authoritativeZones`; default-authority handler matches outside that set are
+suppressed. dcrouter still gates handler registration on the same ownership
+proof so a future authority change cannot activate stale or self-asserted data,
+and the non-authoritative private overlay remains explicitly attributable.
 
 Enforcement points:
 
@@ -392,6 +388,24 @@ Enforcement points:
 - `certProvisionFunction` and `reprovisionCertificateDomain` — refuse before
   starting an ACME order that cannot succeed.
 
+## DoH path matching happens after TLS termination (2026-08-23)
+
+SmartProxy cannot match an HTTP path while the incoming stream is still TLS
+ciphertext. dcrouter therefore persists one nameserver-domain/port socket route
+with `tls.mode: 'terminate'` and no `match.path`, then hands the cleartext stream
+to SmartDNS `handleHttpSocket()`. SmartDNS performs the RFC 8484 dispatch for
+both canonical `/dns-query` and the already-shipped `/resolve` alias. Keeping two
+path-scoped socket routes would make the route decision before either path exists.
+
+## DNS source transitions commit before runtime state (2026-08-23)
+
+A provider-to-dcrouter migration is one SmartData session transaction: re-read
+the `DomainDoc` and all `DnsRecordDoc` rows in the session, convert every record,
+remove provider-only metadata, then convert the domain. Any record or domain save
+failure aborts the whole transition. Runtime RRset/default handlers are rebuilt
+only after commit, so a failed transaction cannot report success or expose a
+partially local zone.
+
 ## ACME retry budgets are three independent mechanisms (2026-07-25)
 
 Do not assume they share semantics, caps, or re-arm behaviour:
@@ -1182,4 +1196,4 @@ const dcRouter = new DcRouter({
 - `ts/cache/classes.cachedb.ts` - CacheDb singleton wrapper
 - `ts/cache/classes.cached.document.ts` - Base class with TTL support
 - `ts/cache/classes.cache.cleaner.ts` - Periodic cleanup service
-- `ts/cache/documents/*.ts` - Document class definitions
+- `ts/cache/documents/*.ts` - Document class definitions

package/readme.md

@@ -139,7 +139,7 @@ Important runtime behavior:
 - `dbConfig.enabled` defaults to enabled. Without `mongoDbUrl`, dcrouter uses embedded LocalSmartDb.
 - If the DB is disabled, constructor-defined proxy traffic can still run, but persistent API routes, tokens, managed domains, and stored certificate state are unavailable. The embedded DNS server is also skipped entirely, because DNS authority is delegation-verified database state — the DoH routes are still generated, but nothing answers behind them.
 - Qualifying HTTPS forward routes on port `443` are HTTP/3-augmented unless `http3.enabled === false` or the route opts out.
-- DNS-over-HTTPS routes are generated on the first `dnsNsDomains` entry at `/dns-query` and `/resolve`.
+- One TLS-terminating DNS-over-HTTPS socket route is generated on the first `dnsNsDomains` entry. SmartDNS accepts RFC 8484 requests on `/dns-query` and the compatibility `/resolve` alias after TLS termination.
 - Email listener ports can be remapped internally, for example public `25`, `587`, and `465` to unprivileged internal ports.
 - `emailOutboundMode: 'remoteIngress'` requires an enabled RemoteIngress hub and an eligible connected QUIC edge with SMTP egress enabled. If no eligible edge is available, outbound delivery fails or defers instead of silently falling back to direct SMTP from the hub.
 
@@ -214,11 +214,13 @@ the running DNS server's authoritative zone set, its generated apex NS records,
 route certificate warnings, and the private-route overlay together.
 
 **Cold start.** A database with no authority document is a legitimate state, and
-it means dcrouter is authoritative for nothing and REFUSES every query. The DNS
-server still starts — so DoH keeps serving and a zone verified a moment later
-takes effect immediately — and the condition is logged at `error` alongside a
-startup drift audit listing every dcrouter-hosted zone delegated to us that is
-not being served.
+it means dcrouter claims no configured zone and REFUSES ordinary unhandled
+queries. RFC 6761 `localhost` answers and the explicitly non-authoritative
+private-route overlay remain deliberate exceptions. The DNS server still starts
+— so DoH keeps serving and a zone verified a moment later takes effect
+immediately — and the condition is logged at `error` alongside a startup drift
+audit listing every dcrouter-hosted zone delegated to us that is not being
+served.
 An authority document that cannot be *read* is treated differently: the set is
 unknown rather than empty, so the DNS services fail and retry instead of quietly
 revoking every zone. dcrouter itself still comes up — both services are optional

package/third-party-notices.md

@@ -12,6 +12,19 @@ obtain one at <https://mozilla.org/MPL/2.0/>.
 
 Source: <https://github.com/web-push-libs/web-push>
 
+## mediabunny
+
+`mediabunny` 1.54.0 is used transitively through
+`@design.estate/dees-wcctools` under the Mozilla Public License 2.0.
+
+Author: Vanilagy
+
+This Source Code Form is subject to the terms of the Mozilla Public License,
+v. 2.0. If a copy of the MPL was not distributed with this file, you can
+obtain one at <https://mozilla.org/MPL/2.0/>.
+
+Source: <https://github.com/Vanilagy/mediabunny/tree/v1.54.0>
+
 ## http_ece
 
 `http_ece` is used transitively through `web-push`.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '18.7.1',
+  version: '18.8.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/classes.dcrouter.ts

@@ -966,11 +966,6 @@ export class DcRouter {
             await this.dnsServerRuntime.setup();
           })
           .withStop(async () => {
-            if (this.dnsServer) {
-              this.dnsServer.removeAllListeners();
-              await this.dnsServer.stop();
-              this.dnsServer = undefined;
-            }
             await this.dnsServerRuntime.stop();
           })
           .withRetry({ maxRetries: 3, baseDelayMs: 2000, maxDelayMs: 30_000 }),
@@ -1785,36 +1780,21 @@ export class DcRouter {
     }
 
     const includeSocketHandler = options?.includeSocketHandler !== false;
-    const dnsRoutes: plugins.smartproxy.IRouteConfig[] = [];
-
-    // Create routes for DNS-over-HTTPS paths
-    const dohPaths = ['/dns-query', '/resolve'];
-
-    // Use the first nameserver domain for DoH routes
     const primaryNameserver = this.options.dnsNsDomains[0];
-
-    for (const path of dohPaths) {
-      const dohRoute: plugins.smartproxy.IRouteConfig = {
-        name: `dns-over-https-${path.replace('/', '')}`,
-        match: {
-          ports: [443], // HTTPS port for DoH
-          domains: [primaryNameserver],
-          path: path
-        },
-        action: includeSocketHandler
-          ? {
-              type: 'socket-handler' as any,
-              socketHandler: this.dnsServerRuntime.createSocketHandler()
-            } as any
-          : {
-              type: 'socket-handler' as any,
-            } as any
-      };
-
-      dnsRoutes.push(dohRoute);
-    }
-
-    return dnsRoutes;
+    return [{
+      name: 'dns-over-https-dns-query',
+      match: {
+        ports: [443],
+        domains: [primaryNameserver],
+      },
+      action: {
+        type: 'socket-handler',
+        tls: { mode: 'terminate', certificate: 'auto' },
+        ...(includeSocketHandler
+          ? { socketHandler: this.dnsServerRuntime.createSocketHandler() }
+          : {}),
+      },
+    }];
   }
 
   /**
@@ -1895,6 +1875,10 @@ export class DcRouter {
     // non-cancelling per-service timeout. Drain it before dependency teardown.
     await this.mailDnsSync.stop();
 
+    // DNS process termination must be confirmed before ServiceManager's
+    // non-cancelling timeout can return control to the CLI's process exit.
+    await this.dnsServerRuntime.stop();
+
     // ServiceManager handles reverse-dependency-ordered shutdown
     await this.serviceManager.stop();