@serve.zone/remoteingress

remoteingress allows a cluster to be on some computer behind a NAT, and have a RemotePublicConnector runing on a small VPS running somewhere in the cloud.

readme.md for @serve.zone/remoteingress

Edge ingress tunnel for DcRouter — tunnels TCP and UDP traffic from the network edge to a private DcRouter/SmartProxy cluster over encrypted TLS or QUIC connections, preserving the original client IP via PROXY protocol. Includes hub-controlled nftables firewall for IP blocking, rate limiting, and custom firewall rules applied directly at the edge.

Issue Reporting and Security

For reporting bugs, issues, or security vulnerabilities, please visit community.foss.global/. This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a code.foss.global/ account to submit Pull Requests directly.

Install

pnpm install @serve.zone/remoteingress

Architecture

@serve.zone/remoteingress uses a Hub/Edge topology with a high-performance Rust core and a TypeScript API surface:

                              TLS or QUIC Tunnel
┌─────────────────────┐  ◄══════════════════════════►  ┌─────────────────────┐
│   Network Edge      │   TCP+TLS: frame mux           │   Private Cluster   │
│                     │   QUIC:    native streams      │                     │
│  RemoteIngressEdge  │   UDP:     QUIC datagrams      │  RemoteIngressHub   │
│                     │                                │                     │
│  • TCP/UDP listeners│  ◄─── FRAME_CONFIG pushes ───  │  • Port assignments │
│  • nftables firewall│       ports + firewall rules   │  • Firewall config  │
│  • Rate limiting    │       at any time              │  • Rate limit rules │
└─────────────────────┘                                └─────────────────────┘
        ▲                                                       │
        │  TCP + UDP from end users                             ▼
   Internet                                             DcRouter / SmartProxy
Component Role
RemoteIngressEdge Deployed at the network edge (VPS, cloud instance). Runs as root. Listens on hub-assigned TCP/UDP ports, tunnels traffic to the hub, and applies hub-pushed nftables rules (IP blocking, rate limiting). All config is hot-reloadable at runtime.
RemoteIngressHub Deployed alongside DcRouter/SmartProxy in a private cluster. Accepts edge connections, demuxes streams/datagrams, and forwards each to SmartProxy with PROXY protocol headers so the real client IP is preserved. Pushes all edge config (ports, firewall) via a single API.
Rust Binary (remoteingress-bin) The performance-critical networking core. Managed via @push.rocks/smartrust RustBridge IPC — you never interact with it directly. Cross-compiled for linux/amd64 and linux/arm64.

⚡ Key Features

Usage

Both classes are imported from the package and communicate with the Rust binary under the hood.

Setting Up the Hub (Private Cluster Side)

import { RemoteIngressHub } from '@serve.zone/remoteingress';

const hub = new RemoteIngressHub();

// Listen for events
hub.on('edgeConnected', ({ edgeId }) => console.log(`Edge ${edgeId} connected`));
hub.on('edgeDisconnected', ({ edgeId }) => console.log(`Edge ${edgeId} disconnected`));
hub.on('streamOpened', ({ edgeId, streamId }) => console.log(`Stream ${streamId} from ${edgeId}`));
hub.on('streamClosed', ({ edgeId, streamId }) => console.log(`Stream ${streamId} closed`));

// Start the hub — listens for edge connections on both TCP and QUIC (same port)
await hub.start({
  tunnelPort: 8443,        // port edges connect to (default: 8443)
  targetHost: '127.0.0.1', // SmartProxy host to forward traffic to
});

// Register allowed edges with TCP and UDP listen ports + firewall config
await hub.updateAllowedEdges([
  {
    id: 'edge-nyc-01',
    secret: 'supersecrettoken1',
    listenPorts: [80, 443],        // TCP ports the edge should listen on
    listenPortsUdp: [53, 51820],   // UDP ports (e.g., DNS, WireGuard)
    stunIntervalSecs: 300,
    firewallConfig: {
      blockedIps: ['192.168.1.100', '10.0.0.0/8'],
      rateLimits: [
        { id: 'http-rate', port: 80, protocol: 'tcp', rate: '100/second', perSourceIP: true },
      ],
      rules: [
        { id: 'allow-ssh', direction: 'input', action: 'accept', sourceIP: '10.0.0.0/24', destPort: 22, protocol: 'tcp' },
      ],
    },
  },
  {
    id: 'edge-fra-02',
    secret: 'supersecrettoken2',
    listenPorts: [443, 8080],
  },
]);

// Dynamically update ports and firewall — changes are pushed instantly to connected edges
await hub.updateAllowedEdges([
  {
    id: 'edge-nyc-01',
    secret: 'supersecrettoken1',
    listenPorts: [80, 443, 8443],    // added TCP port 8443
    listenPortsUdp: [53],            // removed WireGuard UDP port
    firewallConfig: {
      blockedIps: ['192.168.1.100', '10.0.0.0/8', '203.0.113.50'],  // added new blocked IP
      rateLimits: [
        { id: 'http-rate', port: 80, protocol: 'tcp', rate: '200/second', perSourceIP: true },
      ],
    },
  },
]);

// Check status
const status = await hub.getStatus();
// { running: true, tunnelPort: 8443, connectedEdges: [...] }

await hub.stop();

Setting Up the Edge (Network Edge Side)

The edge can connect via TCP+TLS (default) or QUIC transport. Edges run as root so they can bind to privileged ports and apply nftables firewall rules.

Option A: Connection Token (Recommended)

import { RemoteIngressEdge } from '@serve.zone/remoteingress';

const edge = new RemoteIngressEdge();

edge.on('tunnelConnected', () => console.log('Tunnel established'));
edge.on('tunnelDisconnected', () => console.log('Tunnel lost — will auto-reconnect'));
edge.on('publicIpDiscovered', ({ ip }) => console.log(`Public IP: ${ip}`));
edge.on('portsAssigned', ({ listenPorts }) => console.log(`TCP ports: ${listenPorts}`));
edge.on('firewallConfigUpdated', () => console.log('Firewall rules applied'));

await edge.start({
  token: 'eyJoIjoiaHViLmV4YW1wbGUuY29tIiwi...',
});

Option B: Explicit Config with QUIC Transport

import { RemoteIngressEdge } from '@serve.zone/remoteingress';

const edge = new RemoteIngressEdge();

await edge.start({
  hubHost: 'hub.example.com',
  hubPort: 8443,
  edgeId: 'edge-nyc-01',
  secret: 'supersecrettoken1',
  transportMode: 'quic',  // 'tcpTls' (default) | 'quic' | 'quicWithFallback'
});

const edgeStatus = await edge.getStatus();
// { running: true, connected: true, publicIp: '203.0.113.42', activeStreams: 5, listenPorts: [80, 443] }

await edge.stop();

Transport Modes

Mode Description
'tcpTls' Default. Single TLS connection with frame-based multiplexing. Universal compatibility.
'quic' QUIC with native stream multiplexing. Eliminates head-of-line blocking. Uses QUIC datagrams for UDP traffic.
'quicWithFallback' Tries QUIC first (5s timeout), falls back to TCP+TLS if UDP is blocked by the network.

Connection Tokens

Encode all connection details into a single opaque string for easy distribution:

import { encodeConnectionToken, decodeConnectionToken } from '@serve.zone/remoteingress';

// Hub operator generates a token
const token = encodeConnectionToken({
  hubHost: 'hub.example.com',
  hubPort: 8443,
  edgeId: 'edge-nyc-01',
  secret: 'supersecrettoken1',
});
// => 'eyJoIjoiaHViLmV4YW1wbGUuY29tIiwi...'

// Edge operator decodes (optional — start() does this automatically)
const data = decodeConnectionToken(token);
// { hubHost: 'hub.example.com', hubPort: 8443, edgeId: 'edge-nyc-01', secret: '...' }

Tokens are base64url-encoded — safe for environment variables, CLI arguments, and config files.

🔥 Firewall Config

The firewallConfig field in updateAllowedEdges() works exactly like listenPorts — it travels in the same FRAME_CONFIG frame, is delivered on initial handshake and on every subsequent update, and is applied atomically at the edge using @push.rocks/smartnftables. Each update fully replaces the previous ruleset.

Since edges run as root, the rules are applied directly to the Linux kernel via nftables. If the edge isn't root or nftables is unavailable, it logs a warning and continues — the tunnel works fine, just without kernel-level firewall rules.

Config Structure

interface IFirewallConfig {
  blockedIps?: string[];           // IPs or CIDRs to block (e.g., '1.2.3.4', '10.0.0.0/8')
  rateLimits?: IFirewallRateLimit[];
  rules?: IFirewallRule[];
}

interface IFirewallRateLimit {
  id: string;                      // unique identifier for this rate limit
  port: number;                    // port to rate-limit
  protocol?: 'tcp' | 'udp';       // default: both
  rate: string;                    // e.g., '100/second', '1000/minute'
  burst?: number;                  // burst allowance
  perSourceIP?: boolean;           // per-client rate limiting (recommended)
}

interface IFirewallRule {
  id: string;                      // unique identifier for this rule
  direction: 'input' | 'output' | 'forward';
  action: 'accept' | 'drop' | 'reject';
  sourceIP?: string;               // source IP or CIDR
  destPort?: number;               // destination port
  protocol?: 'tcp' | 'udp';
  comment?: string;
}

Example: Rate Limiting + IP Blocking

await hub.updateAllowedEdges([
  {
    id: 'edge-nyc-01',
    secret: 'secret',
    listenPorts: [80, 443],
    firewallConfig: {
      // Block known bad actors
      blockedIps: ['198.51.100.0/24', '203.0.113.50'],

      // Rate limit HTTP traffic per source IP
      rateLimits: [
        { id: 'http', port: 80, protocol: 'tcp', rate: '100/second', burst: 50, perSourceIP: true },
        { id: 'https', port: 443, protocol: 'tcp', rate: '200/second', burst: 100, perSourceIP: true },
      ],

      // Allow monitoring from trusted subnet
      rules: [
        { id: 'monitoring', direction: 'input', action: 'accept', sourceIP: '10.0.0.0/24', destPort: 9090, protocol: 'tcp', comment: 'Prometheus scraping' },
      ],
    },
  },
]);

API Reference

RemoteIngressHub

Method / Property Description
start(config?) Start the hub. Config: { tunnelPort?, targetHost?, tls?: { certPem?, keyPem? } }. Listens on both TCP and UDP (QUIC) on the tunnel port.
stop() Graceful shutdown.
updateAllowedEdges(edges) Set authorized edges. Each: { id, secret, listenPorts?, listenPortsUdp?, stunIntervalSecs?, firewallConfig? }. Port and firewall changes are pushed to connected edges in real time.
getStatus() Returns { running, tunnelPort, connectedEdges: [...] }.
running boolean — whether the Rust binary is alive.

Events: edgeConnected, edgeDisconnected, streamOpened, streamClosed, crashRecovered, crashRecoveryFailed

RemoteIngressEdge

Method / Property Description
start(config) Connect to hub. Accepts { token } or { hubHost, hubPort, edgeId, secret, bindAddress?, transportMode? }.
stop() Graceful shutdown. Cleans up all nftables rules.
getStatus() Returns { running, connected, publicIp, activeStreams, listenPorts }.
running boolean — whether the Rust binary is alive.

Events: tunnelConnected, tunnelDisconnected, publicIpDiscovered, portsAssigned, portsUpdated, firewallConfigUpdated, crashRecovered, crashRecoveryFailed

Token Utilities

Function Description
encodeConnectionToken(data) Encodes connection info into a base64url token.
decodeConnectionToken(token) Decodes a token. Throws on malformed input.

Interfaces

interface IHubConfig {
  tunnelPort?: number;   // default: 8443
  targetHost?: string;   // default: '127.0.0.1'
  tls?: {
    certPem?: string;    // PEM-encoded TLS certificate
    keyPem?: string;     // PEM-encoded TLS private key
  };
}

interface IEdgeConfig {
  hubHost: string;
  hubPort?: number;      // default: 8443
  edgeId: string;
  secret: string;
  bindAddress?: string;
  transportMode?: 'tcpTls' | 'quic' | 'quicWithFallback';
}

interface IConnectionTokenData {
  hubHost: string;
  hubPort: number;
  edgeId: string;
  secret: string;
}

Wire Protocol

TCP+TLS Transport (Frame Protocol)

The tunnel uses a custom binary frame protocol over a single TLS connection:

[stream_id: 4 bytes BE][type: 1 byte][length: 4 bytes BE][payload: N bytes]
Frame Type Value Direction Purpose
OPEN 0x01 Edge → Hub Open TCP stream; payload is PROXY v1 header
DATA 0x02 Edge → Hub Client data (upload)
CLOSE 0x03 Edge → Hub Client closed connection
DATA_BACK 0x04 Hub → Edge Response data (download)
CLOSE_BACK 0x05 Hub → Edge Upstream closed connection
CONFIG 0x06 Hub → Edge Runtime config update (JSON: ports + firewall config)
PING 0x07 Hub → Edge Heartbeat probe (every 15s)
PONG 0x08 Edge → Hub Heartbeat response
WINDOW_UPDATE 0x09 Edge → Hub Flow control: edge consumed N bytes
WINDOW_UPDATE_BACK 0x0A Hub → Edge Flow control: hub consumed N bytes
UDP_OPEN 0x0B Edge → Hub Open UDP session; payload is PROXY v2 header
UDP_DATA 0x0C Edge → Hub UDP datagram (upload)
UDP_DATA_BACK 0x0D Hub → Edge UDP datagram (download)
UDP_CLOSE 0x0E Either Close UDP session

QUIC Transport

When using QUIC, the frame protocol is replaced by native QUIC primitives:

Handshake Sequence

  1. Edge opens a TLS or QUIC connection to the hub
  2. Edge sends: EDGE <edgeId> <secret>\n
  3. Hub verifies credentials (constant-time comparison) and responds with JSON: {"listenPorts":[...],"listenPortsUdp":[...],"stunIntervalSecs":300,"firewallConfig":{...}}\n
  4. Edge starts TCP and UDP listeners on the assigned ports
  5. Edge applies firewall config via nftables (if present and running as root)
  6. Data flows — TCP frames/QUIC streams for TCP traffic, UDP frames/QUIC datagrams for UDP traffic

QoS & Flow Control

Priority Tiers (TCP+TLS Transport)

Tier Frames Behavior
Control PING, PONG, WINDOW_UPDATE, OPEN, CLOSE, CONFIG Always drained first. Never delayed.
Data DATA/DATA_BACK from normal streams, UDP frames Drained when control queue is empty.
Sustained DATA/DATA_BACK from elephant flows Lowest priority with guaranteed 1 MB/s drain rate.

Sustained Stream Classification

A TCP stream is classified as sustained (elephant flow) when:

Once classified, its flow control window locks to 1 MB and data frames move to the lowest-priority queue.

Adaptive Per-Stream Windows

Each TCP stream has a send window from a shared 200 MB budget:

Active Streams Window per Stream
1–50 4 MB (maximum)
51–200 Scales down (4 MB → 1 MB)
200+ 1 MB (floor)

UDP traffic uses no flow control — datagrams are fire-and-forget, matching UDP semantics.

Example Scenarios

1. 🌐 Expose a Private Cluster to the Internet

Deploy an Edge on a public VPS, point DNS to its IP. The Edge tunnels all TCP and UDP traffic to the Hub running inside your private cluster. No public ports needed on the cluster.

2. 🗺️ Multi-Region Edge Ingress

Run Edges in NYC, Frankfurt, and Tokyo — all connecting to a single Hub. Use GeoDNS to route users to their nearest Edge. PROXY protocol ensures the Hub sees real client IPs regardless of which Edge they entered through.

3. 📡 UDP Forwarding (DNS, Gaming, VoIP)

Configure UDP listen ports alongside TCP ports. DNS queries, game server traffic, or VoIP packets are tunneled through the same edge/hub connection and forwarded to SmartProxy with a PROXY v2 binary header preserving the client's real IP.

await hub.updateAllowedEdges([
  {
    id: 'edge-nyc-01',
    secret: 'secret',
    listenPorts: [80, 443],       // TCP
    listenPortsUdp: [53, 27015],  // DNS + game server
  },
]);

4. 🚀 QUIC Transport for Low-Latency

Use QUIC transport to eliminate head-of-line blocking — a lost packet on one stream doesn't stall others. QUIC also enables 0-RTT reconnection and connection migration.

await edge.start({
  hubHost: 'hub.example.com',
  hubPort: 8443,
  edgeId: 'edge-01',
  secret: 'secret',
  transportMode: 'quicWithFallback', // try QUIC, fall back to TLS if UDP blocked
});

5. 🔑 Token-Based Edge Provisioning

Generate connection tokens on the hub side and distribute them to edge operators:

import { encodeConnectionToken, RemoteIngressEdge } from '@serve.zone/remoteingress';

const token = encodeConnectionToken({
  hubHost: 'hub.prod.example.com',
  hubPort: 8443,
  edgeId: 'edge-tokyo-01',
  secret: 'generated-secret-abc123',
});
// Send `token` to the edge operator — a single string is all they need

const edge = new RemoteIngressEdge();
await edge.start({ token });

6. 🛡️ Centralized Firewall Management

Push firewall rules from the hub to all your edge nodes. Block bad actors, rate-limit abusive traffic, and whitelist trusted subnets — all from a single control plane:

await hub.updateAllowedEdges([
  {
    id: 'edge-nyc-01',
    secret: 'secret',
    listenPorts: [80, 443],
    firewallConfig: {
      blockedIps: ['198.51.100.0/24'],
      rateLimits: [
        { id: 'https', port: 443, protocol: 'tcp', rate: '500/second', perSourceIP: true, burst: 100 },
      ],
      rules: [
        { id: 'allow-monitoring', direction: 'input', action: 'accept', sourceIP: '10.0.0.0/8', destPort: 9090, protocol: 'tcp' },
      ],
    },
  },
]);
// Firewall rules are applied at the edge via nftables within seconds

This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the LICENSE file.

Please note: The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.

Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

Company Information

Task Venture Capital GmbH Registered at District Court Bremen HRB 35230 HB, Germany

By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.

changelog.md for @serve.zone/remoteingress

2026-03-27 - 4.15.3 - fix(core)

harden UDP session handling, QUIC control message validation, and bridge process cleanup

2026-03-26 - 4.15.2 - fix(readme)

adjust tunnel diagram alignment in the README

2026-03-26 - 4.15.1 - fix(readme)

clarify unified runtime configuration and firewall update behavior

2026-03-26 - 4.15.0 - feat(edge,hub)

add hub-controlled nftables firewall configuration for remote ingress edges

2026-03-26 - 4.14.3 - fix(docs)

refresh project metadata and README to reflect current ingress tunnel capabilities

2026-03-26 - 4.14.2 - fix(hub-core)

improve stream shutdown handling and connection cleanup in hub and edge

2026-03-21 - 4.14.1 - fix(remoteingress edge/hub crash recovery)

prevent duplicate crash recovery listeners and reset saved runtime state on shutdown

2026-03-20 - 4.14.0 - feat(quic)

add QUIC stability test coverage and bridge logging for hub and edge

2026-03-20 - 4.13.2 - fix(remoteingress-core)

preserve reconnected edge entries during disconnect cleanup

2026-03-19 - 4.13.1 - fix(remoteingress-core)

default edge transport mode to QUIC with fallback

2026-03-19 - 4.13.0 - feat(docs)

document TCP and UDP tunneling over TLS and QUIC

2026-03-19 - 4.12.1 - fix(remoteingress-core)

send PROXY v2 headers for UDP upstream sessions and expire idle UDP sessions

2026-03-19 - 4.12.0 - feat(remoteingress-core)

add UDP tunneling over QUIC datagrams and expand transport-specific test coverage

2026-03-19 - 4.11.0 - feat(remoteingress-core)

add UDP tunneling support between edge and hub

2026-03-19 - 4.10.0 - feat(core,edge,hub,transport)

add QUIC tunnel transport support with optional edge transport selection

2026-03-18 - 4.9.1 - fix(readme)

document QoS tiers, heartbeat frames, and adaptive flow control in the protocol overview

2026-03-18 - 4.9.0 - feat(protocol)

add sustained-stream tunnel scheduling to isolate high-throughput traffic

2026-03-18 - 4.8.19 - fix(remoteingress-protocol)

reduce per-stream flow control windows and increase control channel buffering

2026-03-17 - 4.8.18 - fix(rust-protocol)

switch tunnel frame buffers from Vec to Bytes to reduce copying and memory overhead

2026-03-17 - 4.8.17 - fix(protocol)

increase per-stream flow control windows and remove adaptive read caps

2026-03-17 - 4.8.16 - fix(release)

bump package version to 4.8.15

2026-03-17 - 4.8.13 - fix(remoteingress-protocol)

require a flush after each written frame to bound TLS buffer growth

2026-03-17 - 4.8.12 - fix(tunnel)

prevent tunnel backpressure buffering from exhausting memory and cancel stream handlers before TLS shutdown

2026-03-17 - 4.8.11 - fix(remoteingress-core)

stop data frame send loops promptly when stream cancellation is triggered

2026-03-17 - 4.8.10 - fix(remoteingress-core)

guard tunnel frame sends with cancellation to prevent async send deadlocks

2026-03-17 - 4.8.9 - fix(repo)

no changes to commit

2026-03-17 - 4.8.8 - fix(remoteingress-core)

cancel stale edge connections when an edge reconnects

2026-03-17 - 4.8.7 - fix(remoteingress-core)

perform graceful TLS shutdown on edge and hub tunnel streams

2026-03-17 - 4.8.6 - fix(remoteingress-core)

initialize disconnect reason only when set in hub loop break paths

2026-03-17 - 4.8.5 - fix(repo)

no changes to commit

2026-03-17 - 4.8.4 - fix(remoteingress-core)

prevent stream stalls by guaranteeing flow-control updates and avoiding bounded per-stream channel overflows

2026-03-17 - 4.8.3 - fix(protocol,edge)

optimize tunnel frame handling and zero-copy uploads in edge I/O

2026-03-17 - 4.8.2 - fix(rust-edge)

refactor tunnel I/O to preserve TLS state and prioritize control frames

2026-03-17 - 4.8.1 - fix(remoteingress-core)

remove tunnel writer timeouts from edge and hub buffered writes

2026-03-17 - 4.8.0 - feat(events)

include disconnect reasons in edge and hub management events

2026-03-17 - 4.7.2 - fix(remoteingress-core)

add tunnel write timeouts and scale initial stream windows by active stream count

2026-03-17 - 4.7.1 - fix(remoteingress-core)

improve tunnel failure detection and reconnect handling

2026-03-16 - 4.7.0 - feat(edge,protocol,test)

add configurable edge bind address and expand flow-control test coverage

2026-03-16 - 4.6.1 - fix(remoteingress-core)

avoid spurious tunnel disconnect events and increase control channel capacity

2026-03-16 - 4.6.0 - feat(remoteingress-core)

add adaptive per-stream flow control based on active stream counts

2026-03-16 - 4.5.12 - fix(remoteingress-core)

improve tunnel liveness handling and enable TCP keepalive for accepted client sockets

2026-03-16 - 4.5.11 - fix(repo)

no changes to commit

2026-03-16 - 4.5.10 - fix(remoteingress-core)

guard zero-window reads to avoid false EOF handling on stalled streams

2026-03-16 - 4.5.9 - fix(remoteingress-core)

delay stream close until downstream response draining finishes to prevent truncated transfers

2026-03-16 - 4.5.8 - fix(remoteingress-core)

ensure upstream writes cancel promptly and reliably deliver CLOSE_BACK frames

2026-03-16 - 4.5.7 - fix(remoteingress-core)

improve tunnel reconnect and frame write efficiency

2026-03-16 - 4.5.6 - fix(remoteingress-core)

disable Nagle's algorithm on edge, hub, and upstream TCP sockets to reduce control-frame latency

2026-03-16 - 4.5.5 - fix(remoteingress-core)

wait for hub-to-client draining before cleanup and reliably send close frames

2026-03-15 - 4.5.4 - fix(remoteingress-core)

preserve stream close ordering and add flow-control stall timeouts

2026-03-15 - 4.5.3 - fix(remoteingress-core)

prioritize control frames over data in edge and hub tunnel writers

2026-03-15 - 4.5.2 - fix(remoteingress-core)

improve stream flow control retries and increase channel buffer capacity

2026-03-15 - 4.5.1 - fix(protocol)

increase per-stream flow control window and channel buffers to improve high-RTT throughput

2026-03-15 - 4.5.0 - feat(remoteingress-core)

add per-stream flow control for edge and hub tunnel data transfer

2026-03-15 - 4.4.1 - fix(remoteingress-core)

prevent stream data loss by applying backpressure and closing saturated channels

2026-03-03 - 4.4.0 - feat(remoteingress)

add heartbeat PING/PONG and liveness timeouts; implement fast-reconnect/backoff reset and JS crash-recovery auto-restart

2026-02-26 - 4.3.0 - feat(hub)

add optional TLS certificate/key support to hub start config and bridge

2026-02-26 - 4.2.0 - feat(core)

expose edge peer address in hub events and migrate writers to channel-based, non-blocking framing with stream limits and timeouts

2026-02-26 - 4.1.0 - feat(remoteingress-bin)

use mimalloc as the global allocator to reduce memory overhead and improve allocation performance

2026-02-26 - 4.0.1 - fix(hub)

cancel per-stream tokens on stream close and avoid duplicate StreamClosed events; bump @types/node devDependency to ^25.3.0

2026-02-19 - 4.0.0 - BREAKING CHANGE(remoteingress-core)

add cancellation tokens and cooperative shutdown; switch event channels to bounded mpsc and improve cleanup

2026-02-18 - 3.3.0 - feat(readme)

document dynamic port assignment and runtime port updates; clarify TLS multiplexing, frame format, and handshake sequence

2026-02-18 - 3.2.1 - fix(tests)

add comprehensive unit and async tests across Rust crates and TypeScript runtime

2026-02-18 - 3.2.0 - feat(remoteingress (edge/hub/protocol))

add dynamic port configuration: handshake, FRAME_CONFIG frames, and hot-reloadable listeners

2026-02-18 - 3.1.1 - fix(readme)

update README: add issue reporting/security section, document connection tokens and token utilities, clarify architecture/API and improve examples/formatting

2026-02-17 - 3.1.0 - feat(edge)

support connection tokens when starting an edge and add token encode/decode utilities

2026-02-17 - 3.0.4 - fix(build)

bump dev dependencies, update build script, and refresh README docs

2026-02-17 - 3.0.3 - fix(rust,ts)

initialize rustls ring CryptoProvider at startup; add rustls dependency and features; make native binary lookup platform-aware

2026-02-16 - 3.0.2 - fix(readme)

Document Hub/Edge architecture and new RemoteIngressHub/RemoteIngressEdge API; add Rust core binary, protocol and usage details; note removal of ConnectorPublic/ConnectorPrivate (breaking change)

2026-02-16 - 3.0.1 - fix(remoteingress)

no changes detected in diff; no code modifications to release

2026-02-16 - 3.0.0 - BREAKING CHANGE(remoteingress)

migrate core to Rust, add RemoteIngressHub/RemoteIngressEdge JS bridge, and bump package to v2.0.0

2024-04-14 - 1.0.2 - 1.0.4 - releases

Version-only tag commits (no code changes) for recent releases.

2024-04-14 - 1.0.3 - core

Core updates and fixes.

2024-04-14 - 1.0.2 - core

Core updates and fixes.

2024-03-24 - 1.0.1 - core

Core updates and fixes.