* This module is part of the @serve.zone stack
* v3.0.0+ uses a Hub/Edge architecture with a Rust core binary (`remoteingress-bin`)
* TypeScript classes `RemoteIngressHub` and `RemoteIngressEdge` bridge to Rust via `@push.rocks/smartrust` RustBridge IPC
* Custom multiplexed binary frame protocol over TLS for tunneling TCP connections
* PROXY protocol v1 preserves client IP when forwarding to SmartProxy/DcRouter
* Edge authenticates to Hub via shared secret over TLS
* STUN-based public IP discovery at the edge (Cloudflare STUN server)
* Cross-compiled Rust binary for linux/amd64 and linux/arm64
* Old `ConnectorPublic`/`ConnectorPrivate` classes no longer exist (removed in v2.0.0/v3.0.0)
* `localPaths` in RustBridge config must be full file paths (not directories) — smartrust's `RustBinaryLocator` checks `isExecutable()` on each entry directly
* Production binaries are named with platform suffixes: `remoteingress-bin_linux_amd64`, `remoteingress-bin_linux_arm64`
* Rust core uses `ring` as the rustls CryptoProvider (explicitly installed in main.rs, aws-lc-rs disabled via default-features=false)

## Static Rust Binaries

- The Rust binaries in `dist_rust/` are statically linked (static-pie) via `"static": true` in the `@git.zone/tsrust` block of `.smartconfig.json` (tsrust >= 1.4.1). They run on both glibc (Debian/Ubuntu) and musl (Alpine) systems and containers.
- tsrust injects `RUSTFLAGS="-C target-feature=+crt-static"` only into its own per-target cargo invocations and verifies the result (no `PT_INTERP` ELF header). Keep `rust/.cargo/config.toml` free of `rustflags` entries: the injected env variable would replace them, and a repo-wide `rustflags` would also break plain `cargo test`/`cargo check` (proc-macros cannot build with `+crt-static` on linux-gnu without an explicit `--target`).
- `pnpm run test:rust` runs the Rust unit tests; plain `cargo test` in `rust/` works as well.
- Verify linkage manually with `ldd dist_rust/<binary>_linux_amd64` → "statically linked".