@serve.zone/dcrouter 32.1.3 → 32.2.0

package/readme.md

@@ -342,6 +342,8 @@ Web Push is disabled by default and does not read its secret configuration while
 
 Each key ring has the form `{"currentKeyId":"key-2026-07","keys":{"key-2026-07":"<32-byte-unpadded-base64url>"}}`, supports at most eight distinct keys, and must name a configured current key. Encryption and HMAC rings must never reuse key material.
 
+All four values are resolved through `@push.rocks/qenv` from the process environment, a `.nogit/env.json` beside the working directory, or a Docker secret, in that order. dcrouter ships no `qenv.yml` and declares no `required:` list, because none of these names is mandatory while the feature is off: with the flag on, `WebPushManager.start()` refuses and names the missing key material, and the `webpush-encryption-context` migration refuses when sealed documents exist without `DCROUTER_WEB_PUSH_MASTER_KEY_RING`. A `qenv.yml` left in the working directory is not enforced at start; it only logs the names it finds missing.
+
 Operational behavior:
 
 - Control-plane callers need gateway-client `readWebPush` or `manageWebPush` capability. App calls use the one-time binding credential returned by `syncWebPushBinding`; the active credential record stores only its HMAC verifier. To recover a lost rotation response, dcrouter may return the same issuance again during its 15-minute overlap window; that recovery secret is AES-GCM encrypted at rest and is removed when the window expires.
@@ -676,7 +678,7 @@ const route = await client.routes.build()
 await route.toggle(true);
 ```
 
-Use `@serve.zone/dcrouter/interfaces` or `@serve.zone/dcrouter-interfaces` when you want dcrouter-local raw TypedRequest contracts instead of resource managers. Use `@serve.zone/interfaces` for the canonical machine-facing gateway client route, DNS, domain, and mail contracts shared with Onebox and Cloudly.
+Use `@serve.zone/dcrouter-apiclient/interfaces` (or `@serve.zone/dcrouter/interfaces` from the runtime package) when you want dcrouter-local raw TypedRequest contracts instead of resource managers. Use `@serve.zone/interfaces` for the canonical machine-facing gateway client route, DNS, domain, and mail contracts shared with Onebox and Cloudly.
 
 dcrouter 32.0.0 builds against `@serve.zone/interfaces` 32.0.0: the installed interfaces release is the contract version, there is no version field on the wire and no per-shape version suffix. dcrouter serves no session that carries the 32 protocol handshake and opens none — its gateway-client, mail, Web Push and CoreMail gateway contracts are unchanged in 32.0.0 and carry no protocol offer — so no caller has to send one.
 
@@ -888,17 +890,43 @@ Host networking is the simplest container mode for a gateway that owns HTTP/S, S
 
 ## Published Modules
 
-This repository intentionally publishes multiple module boundaries from one codebase.
-
-| Module | Purpose | Docs |
-| --- | --- | --- |
-| `@serve.zone/dcrouter` | Main runtime and orchestrator | `./readme.md` |
-| `@serve.zone/dcrouter/interfaces` | Shared contracts as a subpath export | `./ts_interfaces/readme.md` |
-| `@serve.zone/dcrouter/apiclient` | API client as a subpath export | `./ts_apiclient/readme.md` |
-| `@serve.zone/dcrouter-interfaces` | Standalone contracts package | `./ts_interfaces/readme.md` |
-| `@serve.zone/dcrouter-apiclient` | Standalone OO API client package | `./ts_apiclient/readme.md` |
-| `@serve.zone/dcrouter-migrations` | Standalone migration runner package | `./ts_migrations/readme.md` |
-| `@serve.zone/dcrouter-web` | Dashboard frontend module boundary | `./ts_web/readme.md` |
+This repository defines two npm packages from one codebase.
+
+| Package | Entry point | Purpose | Platform | Docs |
+| --- | --- | --- | --- | --- |
+| `@serve.zone/dcrouter` | `.` | Runtime and orchestrator | Linux x64/arm64 | `./readme.md` |
+| `@serve.zone/dcrouter` | `./interfaces` | Shared contracts as a subpath of the runtime | Linux x64/arm64 | `./ts_interfaces/readme.md` |
+| `@serve.zone/dcrouter` | `./apiclient` | API client as a subpath of the runtime | Linux x64/arm64 | `./ts_apiclient/readme.md` |
+| `@serve.zone/dcrouter-apiclient` | `.` | API client without the server | Linux x64/arm64 | `./ts_apiclient/readme.md` |
+| `@serve.zone/dcrouter-apiclient` | `./interfaces` | Shared contracts without the server | Linux x64/arm64 | `./ts_interfaces/readme.md` |
+
+Install `@serve.zone/dcrouter-apiclient` when you consume the API rather than
+operate the router: it declares 8 dependencies against the runtime package's 48
+and resolves a production closure of 184 packages instead of 579, dropping the
+native `argon2` build, `mongodb`, `@lossless.org/client`, the dashboard
+component library, `@push.rocks/smartdata` and `@push.rocks/smartbucket`.
+`@serve.zone/dcrouter` keeps both subpath exports, so existing consumers
+migrate whenever it suits them, and a consumer whose runtime version has no
+matching `@serve.zone/dcrouter-apiclient` release on the registry imports the
+same client from `@serve.zone/dcrouter/apiclient`.
+
+**Both packages install on Linux x64 and arm64 only.** Contract members are
+typed against `@push.rocks/smartmta`, `@push.rocks/smartproxy` and
+`@push.rocks/smartnetwork`, so the client package depends on them even though
+those imports are type-only, and `@push.rocks/smartmta` declares
+`os: ["linux"]` with `cpu: ["x64", "arm64"]`; installing elsewhere fails with
+`ERR_PNPM_UNSUPPORTED_PLATFORM`. The constraint is upstream: it goes away once
+`@push.rocks/smartproxy`, `@push.rocks/smartmta` and `@push.rocks/smartnetwork`
+move their Rust payloads into per-platform optional packages.
+
+`ts_migrations` and `ts_web` are internal module boundaries of the runtime
+package and are not published separately (`./ts_migrations/readme.md`,
+`./ts_web/readme.md`).
+
+`gitzone release` publishes `@serve.zone/dcrouter` and qualifies the Docker
+images. `@serve.zone/dcrouter-apiclient` is not part of that release:
+`pnpm run publish:packages` publishes it afterwards, at the version the release
+cut, so its registry versions can trail the runtime's.
 
 ## Development
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '32.1.3',
+  version: '32.2.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/classes.dcrouter.ts

@@ -419,8 +419,16 @@ export class DcRouter {
   // Live DoH routes used during SmartProxy bootstrap before RouteConfigManager re-applies stored routes.
   private runtimeDnsRoutes: plugins.smartproxy.IRouteConfig[] = [];
 
-  // Environment access
-  private qenv = new plugins.qenv.Qenv('./', '.nogit/');
+  // Environment access. dcrouter ships no qenv.yml and declares no `required:` list, because it has
+  // no unconditionally mandatory variable: every name it reads is conditional on a feature being
+  // switched on or on what is already stored (the Web Push key rings, and the master key ring the
+  // reseal migration below only demands when sealed documents exist), and every other name is read
+  // straight from `process.env` with a default of its own. The reader owns the refusal in each case
+  // and names the missing variable and the feature it blocks, so `failOnMissing` is false here and
+  // at the second construction site
+  // (`ts/webpush/classes.webpush-manager.ts`): a qenv.yml an operator leaves in the working
+  // directory must never take the DNS and mail gateway down for a disabled optional feature.
+  private qenv = new plugins.qenv.Qenv('./', '.nogit/', false);
   
   constructor(optionsArg: IDcRouterOptions) {
     const coreTrafficConfig = optionsArg.coreTrafficConfig || optionsArg.smartProxyConfig;

package/ts/readme.md

@@ -77,9 +77,9 @@ await router.start();
 | Need | Module |
 | --- | --- |
 | A higher-level client SDK for a running router | `@serve.zone/dcrouter-apiclient` or `@serve.zone/dcrouter/apiclient` |
-| Raw TypedRequest request/data contracts | `@serve.zone/dcrouter-interfaces` or `@serve.zone/dcrouter/interfaces` |
-| The standalone migration runner | `@serve.zone/dcrouter-migrations` |
-| The browser dashboard module boundary | `@serve.zone/dcrouter-web` |
+| Raw TypedRequest request/data contracts | `@serve.zone/dcrouter-apiclient/interfaces` or `@serve.zone/dcrouter/interfaces` |
+| The migration runner | `ts_migrations/` in this repository (`../ts_migrations/readme.md`) |
+| The browser dashboard module boundary | `ts_web/` in this repository (`../ts_web/readme.md`) |
 
 ## License and Legal Information
 

package/ts/webpush/classes.webpush-manager.ts

@@ -621,6 +621,9 @@ export class WebPushManager {
   private inactiveLifecycleCursor?: string;
 
   public constructor(optionsArg: IWebPushManagerOptions = {}) {
+    // Same arguments as the DcRouter-owned instance (`ts/classes.dcrouter.ts`), for the reason
+    // stated there: no qenv.yml declares these names as required, because they are only required
+    // once DCROUTER_WEB_PUSH_ENABLED is on — `start()` below is what refuses, naming all three.
     this.qenv = optionsArg.qenv ?? new plugins.qenv.Qenv('./', '.nogit/', false);
     this.transport = optionsArg.transport ?? new WebPushHttpTransport();
     this.startWorker = optionsArg.startWorker !== false;

package/ts_apiclient/readme.md

@@ -2,6 +2,8 @@
 
 `@serve.zone/dcrouter-apiclient` is the object-oriented TypeScript client for the dcrouter OpsServer API. It wraps `/typedrequest` calls in managers, builders, and resource classes for routes, certificates, API tokens, remote ingress, email, stats, config, logs, RADIUS, and gateway-client integrations.
 
+It is the client half of dcrouter without the server: installing it does not pull the runtime, the dashboard, the database client or a native password hasher. It ships the shared contracts alongside the client under the `./interfaces` subpath, so a consumer that only reads request and data types never needs `@serve.zone/dcrouter` either.
+
 ## Issue Reporting and Security
 
 For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
@@ -12,12 +14,26 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 pnpm add @serve.zone/dcrouter-apiclient
 ```
 
-The same client is also exposed as a subpath of the main package:
+Two entry points:
+
+```typescript
+import { DcRouterApiClient } from '@serve.zone/dcrouter-apiclient';
+import { data, requests } from '@serve.zone/dcrouter-apiclient/interfaces';
+```
+
+The same client and contracts remain available as subpaths of the server package for consumers that already depend on it:
 
 ```typescript
 import { DcRouterApiClient } from '@serve.zone/dcrouter/apiclient';
+import { data, requests } from '@serve.zone/dcrouter/interfaces';
 ```
 
+### Platform support
+
+**This package installs on Linux x64 and arm64 only.** Several contract members are typed against `@push.rocks/smartmta`, `@push.rocks/smartproxy` and `@push.rocks/smartnetwork`, so those packages are dependencies even though the imports are type-only, and `@push.rocks/smartmta` declares `os: ["linux"]` with `cpu: ["x64", "arm64"]`. Installing anywhere else fails with `ERR_PNPM_UNSUPPORTED_PLATFORM`. `@serve.zone/dcrouter` carries the same constraint today, so this is not a new restriction — but it does mean the client cannot yet be installed on a macOS or Windows developer machine.
+
+The restriction is upstream and no change here lifts it. It goes away once `@push.rocks/smartproxy`, `@push.rocks/smartmta` and `@push.rocks/smartnetwork` move their Rust payloads into per-platform optional packages; today each of the three ships both the amd64 and the arm64 binary in one tarball and declares no macOS or Windows build.
+
 ## Quick Start
 
 ```typescript
@@ -165,13 +181,13 @@ RemoteIngress resources expose `performance` and `egress` fields. `create()` and
 
 - It does not start dcrouter.
 - It does not serve or bundle the Ops dashboard.
-- It does not replace `@serve.zone/dcrouter-interfaces` when you want dcrouter-local raw TypedRequest contracts.
+- It does not replace the raw dcrouter-local TypedRequest contracts under `@serve.zone/dcrouter-apiclient/interfaces` when you want to talk to `/typedrequest` yourself.
 
-Use `@serve.zone/dcrouter` for the server runtime and `@serve.zone/dcrouter-interfaces` for dcrouter-local request/data types. The canonical machine-facing gateway client route, DNS, and domain contracts used by `client.gatewayClients` come from `@serve.zone/interfaces`.
+Use `@serve.zone/dcrouter` for the server runtime. The canonical machine-facing gateway client route, DNS, and domain contracts used by `client.gatewayClients` come from `@serve.zone/interfaces`.
 
 ## Development
 
-This folder is published from the dcrouter monorepo via `tspublish.json` with order `5`.
+This folder is published from the dcrouter monorepo through its `tspublish.json`, which also owns `ts_interfaces` and exposes it as the `./interfaces` subpath. Both folders keep the build order they always had (`ts_interfaces` first, then `ts_apiclient`). See `../ts_interfaces/readme.md` for the contract surface. `pnpm run publish:packages` is the publisher: it runs after a `gitzone release` and pushes this package at the version that release cut.
 
 Useful source entry points:
 

package/ts_apiclient/tspublish.json

@@ -1,3 +1,27 @@
 {
-  "order": 5
+  "name": "@serve.zone/dcrouter-apiclient",
+  "order": 5,
+  "description": "Object-oriented TypeScript client and shared TypedRequest contracts for the dcrouter OpsServer API.",
+  "dependencies": [
+    "@api.global/typedrequest",
+    "@api.global/typedrequest-interfaces",
+    "@api.global/typedsocket",
+    "@push.rocks/smartchallenge",
+    "@push.rocks/smartmta",
+    "@push.rocks/smartnetwork",
+    "@push.rocks/smartproxy",
+    "@serve.zone/interfaces"
+  ],
+  "folders": ["ts_interfaces"],
+  "exports": {
+    ".": {
+      "types": "./dist_ts_apiclient/index.d.ts",
+      "import": "./dist_ts_apiclient/index.js"
+    },
+    "./interfaces": {
+      "types": "./dist_ts_interfaces/index.d.ts",
+      "import": "./dist_ts_interfaces/index.js"
+    }
+  },
+  "registries": ["useBase"]
 }

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '32.1.3',
+  version: '32.2.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts_web/readme.md

@@ -1,6 +1,6 @@
-# @serve.zone/dcrouter-web
+# dcrouter web
 
-`@serve.zone/dcrouter-web` is the browser-side Ops dashboard module for dcrouter. It provides the SPA entry point, route synchronization, app state, and web-component views that OpsServer serves from the main dcrouter runtime.
+This folder is the browser-side Ops dashboard module for dcrouter. It provides the SPA entry point, route synchronization, app state, and web-component views that OpsServer serves from the main dcrouter runtime. It is an internal module boundary of `@serve.zone/dcrouter` and is not published as a package of its own.
 
 ## Issue Reporting and Security
 
@@ -48,7 +48,7 @@ The owner selection filters every displayed route projection. **All** keeps Stan
 The dashboard talks to the dcrouter OpsServer through:
 
 - TypedRequest calls for normal API actions
-- shared contracts from `@serve.zone/dcrouter-interfaces`
+- shared contracts from `ts_interfaces`, published as `@serve.zone/dcrouter-apiclient/interfaces`
 - TypedSocket log streaming for live operational output
 - Dees web components and app-state subscriptions for UI updates
 - QR code rendering for VPN client UX
@@ -57,17 +57,11 @@ On a fresh DB-backed instance, the dashboard checks `getAdminBootstrapStatus` an
 
 ## Usage
 
-This package is primarily consumed by the main dcrouter build and served by OpsServer. Install it directly only when you intentionally need the dashboard module boundary.
-
-```bash
-pnpm add @serve.zone/dcrouter-web
-```
-
-For the full server and hosted dashboard, use `@serve.zone/dcrouter`.
+The dashboard is bundled by the main dcrouter build and served by OpsServer; `@serve.zone/dcrouter` is the only way to consume it. Inside this repository, import from `ts_web/` by relative path.
 
 ## Development
 
-This folder is published from the dcrouter monorepo via `tspublish.json` with order `4`.
+This folder builds from the dcrouter monorepo at `tspublish.json` order `4`; the descriptor is unnamed, so it orders the build and publishes nothing on its own.
 
 ```bash
 pnpm run build