@push.rocks/smartdns 8.1.0 → 8.2.1

package/dist_ts_server/classes.rustdnsbridge.d.ts

@@ -130,6 +130,10 @@ export declare class RustDnsBridge extends plugins.events.EventEmitter {
      * Kill the Rust process.
      */
     kill(): void;
+    /**
+     * Terminate the Rust process and resolve only after closure is confirmed.
+     */
+    terminate(): Promise<void>;
     /**
      * Whether the bridge is running.
      */

package/dist_ts_server/classes.rustdnsbridge.js

@@ -23,6 +23,9 @@ export class RustDnsBridge extends plugins.events.EventEmitter {
             cliArgs: ['--management'],
             requestTimeoutMs: 30_000,
             readyTimeoutMs: 10_000,
+            maxPendingRequestsByMethod: {
+                processPacket: 256,
+            },
             localPaths,
             searchSystemPath: false,
         });
@@ -107,6 +110,12 @@ export class RustDnsBridge extends plugins.events.EventEmitter {
     kill() {
         this.bridge.kill();
     }
+    /**
+     * Terminate the Rust process and resolve only after closure is confirmed.
+     */
+    async terminate() {
+        await this.bridge.terminate();
+    }
     /**
      * Whether the bridge is running.
      */
@@ -137,4 +146,4 @@ function getPlatformSuffix() {
     }
     return null;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ydXN0ZG5zYnJpZGdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2NsYXNzZXMucnVzdGRuc2JyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQTBGeEM7O0dBRUc7QUFDSCxNQUFNLE9BQU8sYUFBYyxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQUc1RDtRQUNFLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQ3JDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQ3ZELElBQUksQ0FDTCxDQUFDO1FBRUYsMkVBQTJFO1FBQzNFLE1BQU0sY0FBYyxHQUFHLGlCQUFpQixFQUFFLENBQUM7UUFDM0MsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO1FBRWhDLDBFQUEwRTtRQUMxRSxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ25CLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxXQUFXLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsMkNBQTJDO1FBQzNDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLHdCQUF3QjtRQUN4QixVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZGLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFFckYsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFlO1lBQzNELFVBQVUsRUFBRSxTQUFTO1lBQ3JCLE9BQU8sRUFBRSxDQUFDLGNBQWMsQ0FBQztZQUN6QixnQkFBZ0IsRUFBRSxNQUFNO1lBQ3hCLGNBQWMsRUFBRSxNQUFNO1lBQ3RCLFVBQVU7WUFDVixnQkFBZ0IsRUFBRSxLQUFLO1NBQ3hCLENBQUMsQ0FBQztRQUVILG1DQUFtQztRQUNuQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDLElBQW9CLEVBQUUsRUFBRTtZQUM3RCxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM5QixDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG9CQUFvQixFQUFFLEdBQUcsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZCLENBQUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsR0FBRyxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkIsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLElBQXlCLEVBQUUsRUFBRTtZQUMvRCxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUM5QyxDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLDRDQUE0QztZQUM1QyxJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUNoQixPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNuQyxDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFzQjtRQUM3QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGVBQWUsQ0FDMUIsYUFBcUIsRUFDckIsT0FBd0IsRUFDeEIsWUFBbUMsRUFDbkMsYUFBc0I7UUFFdEIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxnQkFBZ0IsRUFBRTtZQUM5QyxhQUFhO1lBQ2IsT0FBTztZQUNQLFlBQVk7WUFDWixhQUFhO1NBQ2QsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxRQUFnQixFQUFFLFNBQWlCO1FBQzFELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLGFBQWEsQ0FBQyxNQUFjLEVBQUUsU0FBeUI7UUFDbEUsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUU7WUFDNUQsTUFBTSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1lBQ2pDLFNBQVM7U0FDVixDQUFDLENBQUM7UUFDSCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQztJQUM5QyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3pELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQztJQUNyQixDQUFDO0lBRUQ7O09BRUc7SUFDSSxJQUFJO1FBQ1QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNyQixDQUFDO0lBRUQ7O09BRUc7SUFDSCxJQUFXLE9BQU87UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUM3QixDQUFDO0NBQ0Y7QUFFRDs7O0dBR0c7QUFDSCxTQUFTLGlCQUFpQjtJQUN4QixNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDO0lBQ2xDLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUM7SUFFMUIsTUFBTSxXQUFXLEdBQTJCO1FBQzFDLE9BQU8sRUFBRSxPQUFPO1FBQ2hCLFFBQVEsRUFBRSxPQUFPO1FBQ2pCLE9BQU8sRUFBRSxTQUFTO0tBQ25CLENBQUM7SUFFRixNQUFNLE9BQU8sR0FBMkI7UUFDdEMsS0FBSyxFQUFFLE9BQU87UUFDZCxPQUFPLEVBQUUsT0FBTztLQUNqQixDQUFDO0lBRUYsTUFBTSxDQUFDLEdBQUcsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2hDLE1BQU0sQ0FBQyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUV4QixJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNYLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7SUFDckIsQ0FBQztJQUVELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ydXN0ZG5zYnJpZGdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2NsYXNzZXMucnVzdGRuc2JyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQTBGeEM7O0dBRUc7QUFDSCxNQUFNLE9BQU8sYUFBYyxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQUc1RDtRQUNFLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQ3JDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQ3ZELElBQUksQ0FDTCxDQUFDO1FBRUYsMkVBQTJFO1FBQzNFLE1BQU0sY0FBYyxHQUFHLGlCQUFpQixFQUFFLENBQUM7UUFDM0MsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO1FBRWhDLDBFQUEwRTtRQUMxRSxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ25CLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxXQUFXLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsMkNBQTJDO1FBQzNDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLHdCQUF3QjtRQUN4QixVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZGLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFFckYsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFlO1lBQzNELFVBQVUsRUFBRSxTQUFTO1lBQ3JCLE9BQU8sRUFBRSxDQUFDLGNBQWMsQ0FBQztZQUN6QixnQkFBZ0IsRUFBRSxNQUFNO1lBQ3hCLGNBQWMsRUFBRSxNQUFNO1lBQ3RCLDBCQUEwQixFQUFFO2dCQUMxQixhQUFhLEVBQUUsR0FBRzthQUNuQjtZQUNELFVBQVU7WUFDVixnQkFBZ0IsRUFBRSxLQUFLO1NBQ3hCLENBQUMsQ0FBQztRQUVILG1DQUFtQztRQUNuQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDLElBQW9CLEVBQUUsRUFBRTtZQUM3RCxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM5QixDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG9CQUFvQixFQUFFLEdBQUcsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZCLENBQUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsR0FBRyxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkIsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLElBQXlCLEVBQUUsRUFBRTtZQUMvRCxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUM5QyxDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLDRDQUE0QztZQUM1QyxJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUNoQixPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNuQyxDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFzQjtRQUM3QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGVBQWUsQ0FDMUIsYUFBcUIsRUFDckIsT0FBd0IsRUFDeEIsWUFBbUMsRUFDbkMsYUFBc0I7UUFFdEIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxnQkFBZ0IsRUFBRTtZQUM5QyxhQUFhO1lBQ2IsT0FBTztZQUNQLFlBQVk7WUFDWixhQUFhO1NBQ2QsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxRQUFnQixFQUFFLFNBQWlCO1FBQzFELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLGFBQWEsQ0FBQyxNQUFjLEVBQUUsU0FBeUI7UUFDbEUsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUU7WUFDNUQsTUFBTSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1lBQ2pDLFNBQVM7U0FDVixDQUFDLENBQUM7UUFDSCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQztJQUM5QyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3pELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQztJQUNyQixDQUFDO0lBRUQ7O09BRUc7SUFDSSxJQUFJO1FBQ1QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNyQixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsU0FBUztRQUNwQixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDaEMsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGO0FBRUQ7OztHQUdHO0FBQ0gsU0FBUyxpQkFBaUI7SUFDeEIsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO0lBRTFCLE1BQU0sV0FBVyxHQUEyQjtRQUMxQyxPQUFPLEVBQUUsT0FBTztRQUNoQixRQUFRLEVBQUUsT0FBTztRQUNqQixPQUFPLEVBQUUsU0FBUztLQUNuQixDQUFDO0lBRUYsTUFBTSxPQUFPLEdBQTJCO1FBQ3RDLEtBQUssRUFBRSxPQUFPO1FBQ2QsT0FBTyxFQUFFLE9BQU87S0FDakIsQ0FBQztJQUVGLE1BQU0sQ0FBQyxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNoQyxNQUFNLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDWCxPQUFPLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMifQ==

package/dist_ts_server/plugins.d.ts

@@ -2,9 +2,12 @@ import crypto from 'crypto';
 import dgram from 'dgram';
 import { EventEmitter } from 'events';
 import fs from 'fs';
+import * as http from 'node:http';
+import * as http2 from 'node:http2';
 import * as net from 'net';
 import * as path from 'path';
-export { crypto, dgram, fs, net, path, };
+import * as stream from 'node:stream';
+export { crypto, dgram, fs, http, http2, net, path, stream, };
 export declare const events: {
     EventEmitter: typeof EventEmitter;
 };

package/dist_ts_server/plugins.js

@@ -3,9 +3,12 @@ import crypto from 'crypto';
 import dgram from 'dgram';
 import { EventEmitter } from 'events';
 import fs from 'fs';
+import * as http from 'node:http';
+import * as http2 from 'node:http2';
 import * as net from 'net';
 import * as path from 'path';
-export { crypto, dgram, fs, net, path, };
+import * as stream from 'node:stream';
+export { crypto, dgram, fs, http, http2, net, path, stream, };
 export const events = { EventEmitter };
 // @push.rocks scope
 import * as smartrust from '@push.rocks/smartrust';
@@ -13,4 +16,4 @@ export { smartrust, };
 // third party
 import * as minimatch from 'minimatch';
 export { minimatch, };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NlcnZlci9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWM7QUFDZCxPQUFPLE1BQU0sTUFBTSxRQUFRLENBQUM7QUFDNUIsT0FBTyxLQUFLLE1BQU0sT0FBTyxDQUFDO0FBQzFCLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxRQUFRLENBQUM7QUFDdEMsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3BCLE9BQU8sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBQzNCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFDTCxNQUFNLEVBQ04sS0FBSyxFQUNMLEVBQUUsRUFDRixHQUFHLEVBQ0gsSUFBSSxHQUNMLENBQUE7QUFFRCxNQUFNLENBQUMsTUFBTSxNQUFNLEdBQUcsRUFBRSxZQUFZLEVBQUUsQ0FBQztBQUV2QyxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUVuRCxPQUFPLEVBQ0wsU0FBUyxHQUNWLENBQUE7QUFFRCxjQUFjO0FBQ2QsT0FBTyxLQUFLLFNBQVMsTUFBTSxXQUFXLENBQUM7QUFFdkMsT0FBTyxFQUNMLFNBQVMsR0FDVixDQUFBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NlcnZlci9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWM7QUFDZCxPQUFPLE1BQU0sTUFBTSxRQUFRLENBQUM7QUFDNUIsT0FBTyxLQUFLLE1BQU0sT0FBTyxDQUFDO0FBQzFCLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxRQUFRLENBQUM7QUFDdEMsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3BCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxLQUFLLE1BQU0sWUFBWSxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBQzNCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBRXRDLE9BQU8sRUFDTCxNQUFNLEVBQ04sS0FBSyxFQUNMLEVBQUUsRUFDRixJQUFJLEVBQ0osS0FBSyxFQUNMLEdBQUcsRUFDSCxJQUFJLEVBQ0osTUFBTSxHQUNQLENBQUE7QUFFRCxNQUFNLENBQUMsTUFBTSxNQUFNLEdBQUcsRUFBRSxZQUFZLEVBQUUsQ0FBQztBQUV2QyxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUVuRCxPQUFPLEVBQ0wsU0FBUyxHQUNWLENBQUE7QUFFRCxjQUFjO0FBQ2QsT0FBTyxLQUFLLFNBQVMsTUFBTSxXQUFXLENBQUM7QUFFdkMsT0FBTyxFQUNMLFNBQVMsR0FDVixDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdns",
-  "version": "8.1.0",
+  "version": "8.2.1",
   "private": false,
   "description": "A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.",
   "exports": {
@@ -40,20 +40,20 @@
   "dependencies": {
     "@push.rocks/smartdelay": "^3.0.1",
     "@push.rocks/smartenv": "^6.0.0",
-    "@push.rocks/smartpromise": "^4.2.3",
-    "@push.rocks/smartrust": "^1.6.1",
+    "@push.rocks/smartpromise": "^4.2.5",
+    "@push.rocks/smartrust": "^1.8.0",
     "@tsclass/tsclass": "^9.5.1",
     "acme-client": "^5.4.0",
-    "minimatch": "^10.2.5"
+    "minimatch": "^10.2.6"
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tsrust": "^1.7.0",
+    "@git.zone/tsrust": "^1.10.0",
     "@git.zone/tstest": "^4.0.0",
     "@types/dns-packet": "^5.6.5",
     "@types/lodash.clonedeep": "^4.5.9",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
     "dns-packet": "^5.6.1"
   },
   "files": [

package/readme.hints.md

@@ -11,8 +11,12 @@ The smartdns library is structured into three main modules:
 
 ## Rust Backend Architecture (v8.0+)
 
-The DNS server's network I/O, packet parsing/encoding, and DNSSEC signing run in Rust.
-TypeScript retains handler registration, ACME orchestration, and the public API.
+The DNS server's default UDP, TCP, and HTTPS network I/O, packet
+parsing/encoding, and DNSSEC signing run in Rust. TypeScript retains handler
+registration, ACME orchestration, and the public API. `handleHttpSocket()` is
+the deliberate manual-transport exception: after another component terminates
+TLS, TypeScript bounds and parses HTTP/1.1 or prior-knowledge HTTP/2, then sends
+the contained DNS packet to Rust for resolution and response construction.
 
 ### Rust Crate Structure
 - `rustdns` - Main binary with IPC management loop (`--management` flag)
@@ -23,9 +27,9 @@ TypeScript retains handler registration, ACME orchestration, and the public API.
 ### IPC Flow
 ```
 DNS Query -> Rust (UDP/HTTPS) -> Parse packet
-  -> Try local resolution (localhost, DNSKEY)
+  -> Try local resolution (localhost)
   -> If handler needed: emit "dnsQuery" event to TypeScript
-  -> TypeScript runs minimatch handlers, sends "dnsQueryResult" back
+  -> TypeScript runs minimatch handlers and authorizes DNSKEY, sends "dnsQueryResult" back
   -> Rust builds response, signs DNSSEC if requested, sends packet
 ```
 
@@ -147,9 +151,14 @@ The test suite demonstrates:
 
 Authority comes from **configuration**, never from the presence of a handler.
 
-- `authoritativeZones` (falling back to `[dnssecZone]`) is the single source of
-  truth for the `aa` bit. An answer only carries `aa` when the queried name
-  falls inside one of those zones.
+- `authoritativeZones` is the single source of truth for the `aa` bit. Omission
+  falls back to `[dnssecZone]`; an explicit empty array means no authority.
+  `setAuthoritativeZones()` validates and copies a replacement set synchronously,
+  so listeners stay up while subsequent queries see the new authority.
+- DNSKEY queries for `dnssecZone` cross the TypeScript query callback before
+  Rust synthesizes the signed RRset. This keeps built-in DNSSEC answers inside
+  the same live authority boundary; an empty set cannot leak an authoritative
+  DNSKEY answer from the fixed Rust configuration.
 - `registerHandler(pattern, types, handler, options?)` takes
   `options.authority`:
   - `'authoritative'` (default) — the handler only contributes for names inside
@@ -231,8 +240,12 @@ authoritative by definition, not by delegation.
   compress names, so record sizes are additive (`DnsPacket::encoded_len`).
   `processRawDnsPacketAsync(packet, 'udp')` declares the same UDP bound for the
   manual path (`handleUdpMessage` passes it automatically); without the hint no
-  size bound is applied, which is correct for TCP and DoH framing. Note the
-  manual-path deadlock under Known Limitations before relying on this.
+  size bound is applied, which is correct for TCP and DoH framing. Manual packet
+  work runs through a bounded task set so the management loop remains available
+  for handler callbacks and their results. The TypeScript bridge mirrors the
+  Rust task bound by admitting at most 256 pending `processPacket` requests;
+  excess requests fail before serialization with
+  `ERR_RUST_BRIDGE_REQUEST_LIMIT`, while control methods remain unbounded.
 - **RA** is cleared on every path — this server never recurses.
 - **RDATA validation** fails closed: a handler returning an unencodable value
   (for example a non-IPv4 string for an A record) produces SERVFAIL and an error
@@ -247,6 +260,25 @@ authoritative by definition, not by delegation.
   carrying the handler `id`, `domainPattern` and `owner`. Wire this up: the
   original incident was invisible for weeks because nothing surfaced it.
 
+## Server Lifecycle
+
+- `start()` and `stop()` share a serialized lifecycle queue. Each caller keeps
+  its own operation result, and a rejection does not poison later operations.
+- Repeated `start()` calls are idempotent at the `DnsServer` facade. Rust also
+  rejects duplicate active `start` commands, so low-level bridge callers cannot
+  replace listeners while detached HTTPS connection work still exists.
+- `stop()` awaits confirmed Rust child closure before clearing ownership and
+  legacy server markers. A failed termination retains them so cleanup can be
+  retried safely.
+- If an operation and confirmed cleanup both fail, both errors are preserved in
+  an `AggregateError`. A failed stop command is suppressed only after process
+  closure has been confirmed.
+- A server may be started again after a confirmed stop; smartrust activates a
+  fresh process generation on the same bridge.
+- Packet IPC is admitted only while no lifecycle operation is queued and the
+  facade state, ownership marker, and bridge liveness all agree. Certificate
+  updates use the same queue so they cannot race startup or shutdown.
+
 ## Known Limitations
 
 1. **Handler Deduplication**: If the same handler is registered multiple times, it will contribute duplicate records (this may be desired behavior for some use cases)
@@ -254,18 +286,6 @@ authoritative by definition, not by delegation.
 3. **SOA serial does not track zone changes** — it is a process-lifetime
    constant, not a change counter. Secondaries driven by AXFR/IXFR are not
    supported.
-4. **Manual-path (`processPacket`) queries deadlock on handler resolution**
-   — pre-existing, not introduced by the v8 hardening. The IPC select loop in
-   `rust/crates/rustdns/src/management.rs` awaits `handle_request` inline, so
-   while `handle_process_packet` waits for the TypeScript `dnsQuery` callback
-   the loop can neither emit the query event nor read its result; every
-   handler-backed query through `processRawDnsPacketAsync` /
-   `handleUdpMessage` times out to SERVFAIL after 10 s. The built-in UDP, TCP
-   and DoH listeners are unaffected (they resolve outside the IPC request
-   loop). The `transport: 'udp'` truncation contract on this path is wired
-   and unit-tested but cannot be observed end-to-end until the loop spawns
-   `processPacket` handling instead of awaiting it inline. No test exercises
-   `processRawDnsPacketAsync`; fixing this needs its own release.
 ## Static Rust Binaries
 
 - The Rust binaries in `dist_rust/` are statically linked (static-pie) via `"static": true` in the `@git.zone/tsrust` block of `.smartconfig.json` (tsrust >= 1.4.1). They run on both glibc (Debian/Ubuntu) and musl (Alpine) systems.

package/readme.md

@@ -270,7 +270,7 @@ interface IDnsServerOptions {
   httpsKey: string;              // PEM private key (path or content)
   httpsCert: string;             // PEM certificate (path or content)
   dnssecZone: string;            // Zone for DNSSEC signing
-  authoritativeZones?: string[]; // Zones this server is authoritative for (default: [dnssecZone])
+  authoritativeZones?: string[]; // Omitted defaults to [dnssecZone]; [] claims no zone
   primaryNameserver?: string;    // SOA mname field (default: 'ns1.{dnssecZone}')
   udpBindInterface?: string;     // IP to bind UDP (default: '0.0.0.0')
   tcpBindInterface?: string;     // IP to bind TCP (defaults to udpBindInterface)
@@ -316,12 +316,32 @@ await server.start();
 // DNS Server started (UDP: 0.0.0.0:5333, TCP: 0.0.0.0:5333, HTTPS: 0.0.0.0:8443)
 ```
 
+Calling `start()` again while this `DnsServer` is running is an idempotent
+no-op. After a confirmed `stop()`, the same instance can be started again with
+a fresh Rust process.
+
 ### Handler System 🎯
 
 Handlers use **glob patterns** (via `minimatch`) to match incoming query names. Multiple handlers can contribute records to the same response.
 
 Registering a handler does **not** make the server authoritative for the matched names. Authority comes solely from `authoritativeZones` (falling back to `dnssecZone`): list every zone you serve there, or queries for it are withheld. A default-authority handler whose match falls outside every configured zone is suppressed and reported on the `refused` event; register with `{ authority: 'non-authoritative' }` to deliberately serve out-of-zone names without the `aa` bit or DNSSEC signatures.
 
+Replace the live authority set without restarting UDP, TCP, or HTTPS listeners:
+
+```typescript
+server.setAuthoritativeZones(['example.com', 'example.net']);
+server.setAuthoritativeZones([]); // explicitly claim no zone
+```
+
+The constructor copies its supplied array, and `setAuthoritativeZones()` validates
+and copies replacements. Omitting `authoritativeZones` from the constructor
+retains the backward-compatible `[dnssecZone]` default; passing or setting an
+empty array does not fall back. DNSKEY answers for
+`dnssecZone` pass through the same live authority decision, so removing the last
+zone also removes the last DNSSEC authority claim. RFC 6761 `localhost` handling
+is the deliberate exception: while enabled, built-in localhost A/AAAA answers
+remain authoritative even when the configured zone set is empty.
+
 ```typescript
 // Exact domain
 server.registerHandler('example.com', ['A'], handler);
@@ -382,7 +402,7 @@ DNSSEC is enabled automatically when you set the `dnssecZone` option. The Rust b
 
 - **Key generation** — ECDSA P-256 (algorithm 13) by default
 - **DNSKEY / DS record** generation
-- **RRSIG signing** for all responses
+- **RRSIG signing** for authoritative answers when the query requests DNSSEC
 - **NSEC records** for authenticated denial of existence
 
 ```typescript
@@ -428,7 +448,7 @@ const server = new DnsServer({
 
 ### Let's Encrypt Integration 🔒
 
-Built-in ACME DNS-01 challenge support for automatic SSL certificates. Challenge TXT handlers are registered at default authority, so DNS-01 validation only completes for domains inside `authoritativeZones` (or `dnssecZone`):
+Built-in ACME DNS-01 challenge support for automatic SSL certificates. Challenge TXT handlers are registered at default authority, so DNS-01 validation only completes for domains inside `authoritativeZones`, or inside `dnssecZone` when `authoritativeZones` is omitted:
 
 ```typescript
 const server = new DnsServer({
@@ -520,6 +540,29 @@ const server = new DnsServer({
 await server.start(); // No UDP, TCP, or HTTPS listener binds automatically
 ```
 
+After `start()` resolves, an upstream proxy may terminate TLS and hand the
+resulting cleartext HTTP socket to SmartDNS. The handler detects HTTP/1.1 and
+prior-knowledge HTTP/2 (not h2c Upgrade) and accepts RFC 8484 requests on
+`/dns-query`. `/resolve` remains an alias for the already-shipped dcrouter route:
+
+```typescript
+const handleTlsTerminatedSocket = (socket: import('node:net').Socket) => {
+  server.handleHttpSocket(socket);
+};
+```
+
+GET requests require an unpadded base64url `dns` query parameter. POST requests
+require `Content-Type: application/dns-message`. DNS messages are limited to
+65,535 bytes, headers to 16 KiB, HTTP/2 sessions to 100 concurrent streams, and
+header/request/session lifetimes are bounded. Successful responses use
+`application/dns-message`; malformed or unsupported requests receive an explicit
+4xx response, internal handler failures receive 500, and unavailable DNS
+processing receives 503. Every error response uses `text/plain; charset=utf-8`.
+
+`handleHttpSocket()` must only receive a TLS-terminated cleartext stream. The
+legacy `handleHttpsSocket()` does not terminate encrypted TLS in Rust mode and
+closes the socket.
+
 Process individual DNS packets directly:
 
 ```typescript
@@ -533,6 +576,12 @@ const udpResponse = await server.processRawDnsPacketAsync(packetBuffer, 'udp');
 
 Manual TCP callers must handle DNS-over-TCP's two-byte length prefix themselves and pass only the raw DNS packet payload to `processRawDnsPacketAsync()`.
 
+At most 256 `processRawDnsPacketAsync()` calls may be pending at once. Additional
+calls reject before transport writes with a `RustBridgeRequestError` whose code
+is `ERR_RUST_BRIDGE_REQUEST_LIMIT`; control and callback commands remain
+available while packet work is saturated. New packet calls are also rejected
+while `start()`, `stop()`, or a certificate update is queued or running.
+
 #### Load Balancing Example
 
 ```typescript
@@ -560,7 +609,12 @@ for (let i = 0; i < numCPUs; i++) {
 await server.stop();
 ```
 
-This gracefully shuts down the Rust process and releases all bound sockets.
+`stop()` is serialized with `start()` and resolves only after the Rust process
+has closed and its bound sockets are released. If confirmed termination fails,
+the call rejects and retains ownership so a later `stop()` can retry cleanup.
+It also destroys every HTTP/1.1 socket and HTTP/2 replay stream handed to
+`handleHttpSocket()`; the upstream proxy/listener remains caller-owned and must
+be stopped separately.
 
 ---
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdns',
-  version: '8.1.0',
+  version: '8.2.1',
   description: 'A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.'
 }