@push.rocks/smartdns 7.12.1 → 8.0.1

package/dist_ts_server/classes.rustdnsbridge.js

@@ -83,11 +83,14 @@ export class RustDnsBridge extends plugins.events.EventEmitter {
     }
     /**
      * Process a raw DNS packet via IPC (for manual/passthrough mode).
-     * Returns the DNS response as a Buffer.
+     * Returns the DNS response as a Buffer. Pass `transport: 'udp'` when the
+     * response will be sent as a UDP datagram, so it is truncated (TC bit) to
+     * the client's advertised payload size instead of exceeding it.
      */
-    async processPacket(packet) {
+    async processPacket(packet, transport) {
         const result = await this.bridge.sendCommand('processPacket', {
             packet: packet.toString('base64'),
+            transport,
         });
         return Buffer.from(result.packet, 'base64');
     }
@@ -134,4 +137,4 @@ function getPlatformSuffix() {
     }
     return null;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ydXN0ZG5zYnJpZGdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2NsYXNzZXMucnVzdGRuc2JyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQStFeEM7O0dBRUc7QUFDSCxNQUFNLE9BQU8sYUFBYyxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQUc1RDtRQUNFLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQ3JDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQ3ZELElBQUksQ0FDTCxDQUFDO1FBRUYsMkVBQTJFO1FBQzNFLE1BQU0sY0FBYyxHQUFHLGlCQUFpQixFQUFFLENBQUM7UUFDM0MsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO1FBRWhDLDBFQUEwRTtRQUMxRSxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ25CLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxXQUFXLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsMkNBQTJDO1FBQzNDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLHdCQUF3QjtRQUN4QixVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZGLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFFckYsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFlO1lBQzNELFVBQVUsRUFBRSxTQUFTO1lBQ3JCLE9BQU8sRUFBRSxDQUFDLGNBQWMsQ0FBQztZQUN6QixnQkFBZ0IsRUFBRSxNQUFNO1lBQ3hCLGNBQWMsRUFBRSxNQUFNO1lBQ3RCLFVBQVU7WUFDVixnQkFBZ0IsRUFBRSxLQUFLO1NBQ3hCLENBQUMsQ0FBQztRQUVILG1DQUFtQztRQUNuQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDLElBQW9CLEVBQUUsRUFBRTtZQUM3RCxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM5QixDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG9CQUFvQixFQUFFLEdBQUcsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZCLENBQUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsR0FBRyxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkIsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLElBQXlCLEVBQUUsRUFBRTtZQUMvRCxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUM5QyxDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLDRDQUE0QztZQUM1QyxJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUNoQixPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNuQyxDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFzQjtRQUM3QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGVBQWUsQ0FDMUIsYUFBcUIsRUFDckIsT0FBd0IsRUFDeEIsWUFBbUMsRUFDbkMsYUFBc0I7UUFFdEIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxnQkFBZ0IsRUFBRTtZQUM5QyxhQUFhO1lBQ2IsT0FBTztZQUNQLFlBQVk7WUFDWixhQUFhO1NBQ2QsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxRQUFnQixFQUFFLFNBQWlCO1FBQzFELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxhQUFhLENBQUMsTUFBYztRQUN2QyxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGVBQWUsRUFBRTtZQUM1RCxNQUFNLEVBQUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7U0FDbEMsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLElBQUk7UUFDZixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN6RCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUM7SUFDckIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksSUFBSTtRQUNULElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDckIsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGO0FBRUQ7OztHQUdHO0FBQ0gsU0FBUyxpQkFBaUI7SUFDeEIsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO0lBRTFCLE1BQU0sV0FBVyxHQUEyQjtRQUMxQyxPQUFPLEVBQUUsT0FBTztRQUNoQixRQUFRLEVBQUUsT0FBTztRQUNqQixPQUFPLEVBQUUsU0FBUztLQUNuQixDQUFDO0lBRUYsTUFBTSxPQUFPLEdBQTJCO1FBQ3RDLEtBQUssRUFBRSxPQUFPO1FBQ2QsT0FBTyxFQUFFLE9BQU87S0FDakIsQ0FBQztJQUVGLE1BQU0sQ0FBQyxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNoQyxNQUFNLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDWCxPQUFPLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ydXN0ZG5zYnJpZGdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2NsYXNzZXMucnVzdGRuc2JyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQTBGeEM7O0dBRUc7QUFDSCxNQUFNLE9BQU8sYUFBYyxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQUc1RDtRQUNFLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQ3JDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQ3ZELElBQUksQ0FDTCxDQUFDO1FBRUYsMkVBQTJFO1FBQzNFLE1BQU0sY0FBYyxHQUFHLGlCQUFpQixFQUFFLENBQUM7UUFDM0MsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO1FBRWhDLDBFQUEwRTtRQUMxRSxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ25CLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxXQUFXLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsMkNBQTJDO1FBQzNDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLHdCQUF3QjtRQUN4QixVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZGLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFFckYsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFlO1lBQzNELFVBQVUsRUFBRSxTQUFTO1lBQ3JCLE9BQU8sRUFBRSxDQUFDLGNBQWMsQ0FBQztZQUN6QixnQkFBZ0IsRUFBRSxNQUFNO1lBQ3hCLGNBQWMsRUFBRSxNQUFNO1lBQ3RCLFVBQVU7WUFDVixnQkFBZ0IsRUFBRSxLQUFLO1NBQ3hCLENBQUMsQ0FBQztRQUVILG1DQUFtQztRQUNuQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDLElBQW9CLEVBQUUsRUFBRTtZQUM3RCxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM5QixDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG9CQUFvQixFQUFFLEdBQUcsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZCLENBQUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsR0FBRyxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkIsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLElBQXlCLEVBQUUsRUFBRTtZQUMvRCxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUM5QyxDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLDRDQUE0QztZQUM1QyxJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUNoQixPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNuQyxDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFzQjtRQUM3QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGVBQWUsQ0FDMUIsYUFBcUIsRUFDckIsT0FBd0IsRUFDeEIsWUFBbUMsRUFDbkMsYUFBc0I7UUFFdEIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxnQkFBZ0IsRUFBRTtZQUM5QyxhQUFhO1lBQ2IsT0FBTztZQUNQLFlBQVk7WUFDWixhQUFhO1NBQ2QsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxRQUFnQixFQUFFLFNBQWlCO1FBQzFELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLGFBQWEsQ0FBQyxNQUFjLEVBQUUsU0FBeUI7UUFDbEUsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUU7WUFDNUQsTUFBTSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1lBQ2pDLFNBQVM7U0FDVixDQUFDLENBQUM7UUFDSCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQztJQUM5QyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3pELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQztJQUNyQixDQUFDO0lBRUQ7O09BRUc7SUFDSSxJQUFJO1FBQ1QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNyQixDQUFDO0lBRUQ7O09BRUc7SUFDSCxJQUFXLE9BQU87UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUM3QixDQUFDO0NBQ0Y7QUFFRDs7O0dBR0c7QUFDSCxTQUFTLGlCQUFpQjtJQUN4QixNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDO0lBQ2xDLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUM7SUFFMUIsTUFBTSxXQUFXLEdBQTJCO1FBQzFDLE9BQU8sRUFBRSxPQUFPO1FBQ2hCLFFBQVEsRUFBRSxPQUFPO1FBQ2pCLE9BQU8sRUFBRSxTQUFTO0tBQ25CLENBQUM7SUFFRixNQUFNLE9BQU8sR0FBMkI7UUFDdEMsS0FBSyxFQUFFLE9BQU87UUFDZCxPQUFPLEVBQUUsT0FBTztLQUNqQixDQUFDO0lBRUYsTUFBTSxDQUFDLEdBQUcsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2hDLE1BQU0sQ0FBQyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUV4QixJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNYLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7SUFDckIsQ0FBQztJQUVELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdns",
-  "version": "7.12.1",
+  "version": "8.0.1",
   "private": false,
   "description": "A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.",
   "exports": {

package/readme.hints.md

@@ -143,9 +143,129 @@ The test suite demonstrates:
    - Properly serializes both components for DNSSEC signature generation
    - Enables mail exchange records to be authenticated with DNSSEC
 
+## Authority Model (server)
+
+Authority comes from **configuration**, never from the presence of a handler.
+
+- `authoritativeZones` (falling back to `[dnssecZone]`) is the single source of
+  truth for the `aa` bit. An answer only carries `aa` when the queried name
+  falls inside one of those zones.
+- `registerHandler(pattern, types, handler, options?)` takes
+  `options.authority`:
+  - `'authoritative'` (default) — the handler only contributes for names inside
+    a configured zone. A match outside every zone is **suppressed**, not
+    answered, and reported on the `refused` event. A registration that cannot
+    match any configured zone also logs a warning once, at registration time.
+  - `'non-authoritative'` — the handler may answer any matching name, but the
+    response never carries `aa` and is never DNSSEC-signed. This is the mode
+    for split-horizon / private-route overlays.
+- `aa` is a per-message flag, so a single non-authoritative contribution
+  downgrades the whole response.
+
+Why this matters: before v8, registering a handler *was* the public claim of
+authority. A private-route overlay registered for a domain delegated elsewhere
+made the public nameserver answer with `aa` and an RFC1918 address, while
+refusing every other query type for the same name. Both halves came from the
+same defect — two disagreeing sources of truth.
+
+### Response outcomes
+
+`TDnsQueryResponseKind` maps one-to-one onto the wire:
+
+| kind | rcode | `aa` | authority section |
+| --- | --- | --- | --- |
+| `answer` | 0 | yes | — |
+| `nonAuthoritativeAnswer` | 0 | no | — |
+| `authoritativeNegative` (NODATA) | 0 | yes | zone SOA |
+| `authoritativeNameError` (NXDOMAIN) | 3 | yes | zone SOA |
+| `refused` | 5 | no | — |
+| `servfail` | 2 | no | — |
+
+NXDOMAIN is only emitted when the name provably does not exist: no handler
+pattern matches it for any type, it is not the apex of a configured zone, no
+configured zone sits below it, and no handler pattern is anchored strictly
+below it (literal `.name` suffix, or a wildcard that matches a probe label —
+mid-label wildcards such as `x.*.example.com` are not fully inverted by this
+check and can still leave an ancestor at NXDOMAIN). The apex always exists
+(it answers its own SOA), and a name with covered descendants is an empty
+non-terminal — both get NODATA, because NXDOMAIN denies the entire subtree
+(RFC 8020) and a wrong one lets aggressive negative caching darken the zone.
+A catch-all pattern such as `'*'` therefore suppresses NXDOMAIN entirely —
+that is deliberate.
+
+The zone apex answers its own SOA even with no registered SOA handler; an
+authoritative server that cannot answer SOA for its own zone breaks negative
+caching and resolver heuristics.
+
+One deliberate exception to the table: RFC 6761 localhost handling (when
+`enableLocalhostHandling` is on) answers `localhost` A/AAAA with `aa` set even
+though `localhost` is outside every configured zone — special-use names are
+authoritative by definition, not by delegation.
+
+## Handler Lifecycle
+
+- `registerHandler` returns an `IDnsHandlerRegistration` with a unique `id` and
+  an `unregister()` that removes **only** that registration.
+- `unregisterHandlerById(id)` and `unregisterHandlersByOwner(owner)` are the
+  precise teardown primitives; `listHandlers()` exposes the current set for
+  leak checks.
+- `unregisterHandler(pattern, types)` is retained and unchanged: it still
+  removes *every* handler matching that pattern/type pair. It cannot distinguish
+  two consumers sharing a key — prefer the handle.
+- ACME authorization follows the same rule: `filterAuthorizedDomains` /
+  `retrieveSslCertificate` admit exactly the domains inside a configured
+  authoritative zone. Handler registrations play no part — a DNS-01 challenge
+  for an out-of-zone domain could never validate, because its challenge TXT
+  handler would be suppressed.
+
+## Transport And Protocol Notes
+
+- **EDNS0**: a request carrying an OPT record always gets an OPT back
+  (RFC 6891 6.1.1), advertising `DNS_ADVERTISED_UDP_PAYLOAD` (1232). Requests
+  without OPT get no OPT. Client-advertised payload sizes are clamped up to 512
+  so a hostile OPT cannot force pathological truncation.
+- **Truncation**: UDP responses are truncated to the client's advertised payload
+  size with the TC bit set, so resolvers retry over TCP. Without this, oversized
+  datagrams were emitted and silently dropped by real networks. Truncation is
+  size arithmetic, never a re-encode per dropped record — the encoder does not
+  compress names, so record sizes are additive (`DnsPacket::encoded_len`).
+  `processRawDnsPacketAsync(packet, 'udp')` declares the same UDP bound for the
+  manual path (`handleUdpMessage` passes it automatically); without the hint no
+  size bound is applied, which is correct for TCP and DoH framing. Note the
+  manual-path deadlock under Known Limitations before relying on this.
+- **RA** is cleared on every path — this server never recurses.
+- **RDATA validation** fails closed: a handler returning an unencodable value
+  (for example a non-IPv4 string for an A record) produces SERVFAIL and an error
+  log, rather than a malformed record on the wire.
+- **SOA serial** is fixed for the lifetime of the server process and passed to
+  Rust via `soaSerial`, so apex answers and negative authorities agree.
+
+## Observability
+
+- `query` events carry `responseKind`, `authorityZone` and `suppressedHandlers`.
+- `refused` events fire for every refusal and every suppressed handler match,
+  carrying the handler `id`, `domainPattern` and `owner`. Wire this up: the
+  original incident was invisible for weeks because nothing surfaced it.
+
 ## Known Limitations
 
 1. **Handler Deduplication**: If the same handler is registered multiple times, it will contribute duplicate records (this may be desired behavior for some use cases)
+2. **NXDOMAIN under catch-all patterns**: see the authority model above.
+3. **SOA serial does not track zone changes** — it is a process-lifetime
+   constant, not a change counter. Secondaries driven by AXFR/IXFR are not
+   supported.
+4. **Manual-path (`processPacket`) queries deadlock on handler resolution**
+   — pre-existing, not introduced by the v8 hardening. The IPC select loop in
+   `rust/crates/rustdns/src/management.rs` awaits `handle_request` inline, so
+   while `handle_process_packet` waits for the TypeScript `dnsQuery` callback
+   the loop can neither emit the query event nor read its result; every
+   handler-backed query through `processRawDnsPacketAsync` /
+   `handleUdpMessage` times out to SERVFAIL after 10 s. The built-in UDP, TCP
+   and DoH listeners are unaffected (they resolve outside the IPC request
+   loop). The `transport: 'udp'` truncation contract on this path is wired
+   and unit-tested but cannot be observed end-to-end until the loop spawns
+   `processPacket` handling instead of awaiting it inline. No test exercises
+   `processRawDnsPacketAsync`; fixing this needs its own release.
 ## Static Rust Binaries
 
 - The Rust binaries in `dist_rust/` are statically linked (static-pie) via `"static": true` in the `@git.zone/tsrust` block of `.smartconfig.json` (tsrust >= 1.4.1). They run on both glibc (Debian/Ubuntu) and musl (Alpine) systems.

package/readme.md

@@ -114,7 +114,7 @@ interface ISmartDnsConstructorOptions {
 
 | Strategy | Behavior |
 |---|---|
-| `prefer-system` | 🏠 Try the OS resolver first, fall back to Rust DoH. Honors `/etc/hosts`. |
+| `prefer-system` | 🏠 Try the Node DNS resolver first, then fall back to Rust DoH. |
 | `system` | 🏠 Use only the Node.js system resolver. No Rust binary needed. |
 | `doh` | 🌐 Use only DNS-over-HTTPS (RFC 8484 wire format via Cloudflare). Rust-powered. |
 | `udp` | ⚡ Use only raw UDP queries to upstream resolver (Cloudflare 1.1.1.1). Rust-powered. |
@@ -174,6 +174,11 @@ perform their preferred attempt first and, when enabled, at most one DoH fallbac
 a missing result or an error. The fallback result is authoritative and `attempts` retains both outcomes.
 Set `allowDohFallback: false` to prohibit that second attempt.
 
+When `timeoutMs` is set, every strict `system` attempt owns an isolated Node resolver. SmartDNS
+returns `DNS_QUERY_TIMEOUT` at the deadline and cancels the underlying native query, so timed-out
+lookups do not continue accumulating in the background. Isolated resolvers inherit servers selected
+through `makeNodeProcessUseDnsProvider()`.
+
 The strict `system` path uses Node's explicit DNS resolvers (`resolve4`, `resolve6`, `resolveTxt`,
 `resolveMx`, `resolveNs`, `resolveCname`, `resolvePtr`, `resolveSrv`, and `resolveSoa`). This makes
 DNS response semantics observable and intentionally differs from the legacy A/AAAA path.
@@ -263,6 +268,7 @@ interface IDnsServerOptions {
   httpsKey: string;              // PEM private key (path or content)
   httpsCert: string;             // PEM certificate (path or content)
   dnssecZone: string;            // Zone for DNSSEC signing
+  authoritativeZones?: string[]; // Zones this server is authoritative for (default: [dnssecZone])
   primaryNameserver?: string;    // SOA mname field (default: 'ns1.{dnssecZone}')
   udpBindInterface?: string;     // IP to bind UDP (default: '0.0.0.0')
   tcpBindInterface?: string;     // IP to bind TCP (defaults to udpBindInterface)
@@ -312,6 +318,8 @@ await server.start();
 
 Handlers use **glob patterns** (via `minimatch`) to match incoming query names. Multiple handlers can contribute records to the same response.
 
+Registering a handler does **not** make the server authoritative for the matched names. Authority comes solely from `authoritativeZones` (falling back to `dnssecZone`): list every zone you serve there, or queries for it are withheld. A default-authority handler whose match falls outside every configured zone is suppressed and reported on the `refused` event; register with `{ authority: 'non-authoritative' }` to deliberately serve out-of-zone names without the `aa` bit or DNSSEC signatures.
+
 ```typescript
 // Exact domain
 server.registerHandler('example.com', ['A'], handler);
@@ -331,14 +339,15 @@ server.registerHandler('db-*.internal.example.com', ['A'], (question) => {
   };
 });
 
-// Catch-all
+// Catch-all — '*' is anchored in no configured zone, so it must be
+// registered non-authoritative or its out-of-zone answers are suppressed
 server.registerHandler('*', ['A'], (question) => ({
   name: question.name,
   type: 'A',
   class: 'IN',
   ttl: 300,
   data: '127.0.0.1',
-}));
+}), { authority: 'non-authoritative' });
 
 // Multiple record types
 server.registerHandler('example.com', ['MX'], (question) => ({
@@ -349,11 +358,21 @@ server.registerHandler('example.com', ['MX'], (question) => ({
   data: { preference: 10, exchange: 'mail.example.com' },
 }));
 
-// Unregister a handler
+// Unregister a handler: registerHandler returns a handle identifying
+// exactly that registration
+const registration = server.registerHandler('example.com', ['A'], handler);
+registration.unregister();
+
+// Precise teardown also works by id or owner label, and listHandlers()
+// exposes the current set
+server.registerHandler('example.com', ['TXT'], handler, { owner: 'acme-module' });
+server.unregisterHandlersByOwner('acme-module');
+
+// The coarse form removes EVERY handler on the pattern/type pair
 server.unregisterHandler('example.com', ['A']);
 ```
 
-When no handler matches, the server automatically returns an **SOA record** for the zone.
+Negative answers are authoritative only inside configured zones: a name inside an authoritative zone that provably does not exist yields **NXDOMAIN** with the zone SOA in the AUTHORITY section; a name that exists — a covered name queried for a type no handler serves, the zone apex, or an empty non-terminal with covered names beneath it — yields **NODATA** with the SOA in AUTHORITY; names outside every configured zone are answered **REFUSED**.
 
 ### DNSSEC ✅
 
@@ -389,7 +408,7 @@ Supported algorithms: **ECDSAP256SHA256** (13), **ED25519** (15), **RSASHA256**
 
 ### SOA Records
 
-The server auto-generates SOA records for zones when no specific handler matches. Customize the primary nameserver:
+The server carries the zone SOA in the AUTHORITY section of negative answers (NXDOMAIN and NODATA), and the zone apex answers its own SOA even without a registered SOA handler. Customize the primary nameserver:
 
 ```typescript
 const server = new DnsServer({
@@ -401,13 +420,13 @@ const server = new DnsServer({
 // Generated SOA includes:
 // mname:   ns1.example.com
 // rname:   hostmaster.example.com
-// serial:  Unix timestamp
+// serial:  captured once at server construction, stable for the process lifetime
 // refresh: 3600, retry: 600, expire: 604800, minimum: 86400
 ```
 
 ### Let's Encrypt Integration 🔒
 
-Built-in ACME DNS-01 challenge support for automatic SSL certificates:
+Built-in ACME DNS-01 challenge support for automatic SSL certificates. Challenge TXT handlers are registered at default authority, so DNS-01 validation only completes for domains inside `authoritativeZones` (or `dnssecZone`):
 
 ```typescript
 const server = new DnsServer({
@@ -504,6 +523,10 @@ Process individual DNS packets directly:
 ```typescript
 // Asynchronous (via Rust bridge — includes DNSSEC signing)
 const response = await server.processRawDnsPacketAsync(packetBuffer);
+
+// When the response goes out as a UDP datagram, pass 'udp' so it is
+// truncated (TC bit) to the client's advertised EDNS0 payload size
+const udpResponse = await server.processRawDnsPacketAsync(packetBuffer, 'udp');
 ```
 
 Manual TCP callers must handle DNS-over-TCP's two-byte length prefix themselves and pass only the raw DNS packet payload to `processRawDnsPacketAsync()`.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdns',
-  version: '7.12.1',
+  version: '8.0.1',
   description: 'A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.'
 }