@push.rocks/smartdns 8.2.1 → 8.4.0

package/.smartconfig.json

@@ -1,10 +1,12 @@
 {
   "@git.zone/tsrust": {
     "targets": [
-      "linux_amd64",
-      "linux_arm64"
+      "linux_amd64_musl",
+      "linux_arm64_musl"
     ],
-    "static": true
+    "static": true,
+    "locked": true,
+    "remapLocalPaths": true
   },
   "@git.zone/cli": {
     "schemaVersion": 2,
@@ -54,11 +56,15 @@
           "accessLevel": "public",
           "alreadyPublished": "success"
         }
+      },
+      "preflight": {
+        "build": true,
+        "test": true
       }
     }
   },
   "@git.zone/tsdoc": {
-    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license.md) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
   },
   "@ship.zone/szci": {
     "npmGlobalTools": [],

package/dist_rust/rustdns-client_linux_amd64_musl.tsrust-build.json

@@ -0,0 +1,14 @@
+{
+  "format": "tsrust.build-provenance.v2",
+  "binarySha256": "458bba943f70bd1ab64f520d12a7a128980cb3a793880b72c3e72079f7566823",
+  "buildInfo": {
+    "projectName": "@push.rocks/smartdns",
+    "projectVersion": "8.4.0",
+    "gitCommit": "fbbda1bf36bf95d1648ec98bd701bfc2f284c66b",
+    "gitDirty": false,
+    "builtAt": "2026-09-13T11:11:41.278Z",
+    "tsrustVersion": "1.13.0",
+    "binary": "rustdns-client",
+    "target": "linux_amd64_musl"
+  }
+}

package/dist_rust/rustdns-client_linux_arm64_musl.tsrust-build.json

@@ -0,0 +1,14 @@
+{
+  "format": "tsrust.build-provenance.v2",
+  "binarySha256": "8c6530c2d3357f165e225ea911bc8479d18012f6ff5734cdfd7048a6a12366e5",
+  "buildInfo": {
+    "projectName": "@push.rocks/smartdns",
+    "projectVersion": "8.4.0",
+    "gitCommit": "fbbda1bf36bf95d1648ec98bd701bfc2f284c66b",
+    "gitDirty": false,
+    "builtAt": "2026-09-13T11:11:41.575Z",
+    "tsrustVersion": "1.13.0",
+    "binary": "rustdns-client",
+    "target": "linux_arm64_musl"
+  }
+}

package/dist_rust/rustdns_linux_amd64_musl.tsrust-build.json

@@ -0,0 +1,14 @@
+{
+  "format": "tsrust.build-provenance.v2",
+  "binarySha256": "423c14c067089e99b006617f8bf2939b08a75ba42aa986061d9f69790466b12c",
+  "buildInfo": {
+    "projectName": "@push.rocks/smartdns",
+    "projectVersion": "8.4.0",
+    "gitCommit": "fbbda1bf36bf95d1648ec98bd701bfc2f284c66b",
+    "gitDirty": false,
+    "builtAt": "2026-09-13T11:11:41.278Z",
+    "tsrustVersion": "1.13.0",
+    "binary": "rustdns",
+    "target": "linux_amd64_musl"
+  }
+}

package/dist_rust/rustdns_linux_arm64_musl.tsrust-build.json

@@ -0,0 +1,14 @@
+{
+  "format": "tsrust.build-provenance.v2",
+  "binarySha256": "6185f3673a8ac91da74455a25359d4e038b2308f45f02d8fdb71fee78b6dd18d",
+  "buildInfo": {
+    "projectName": "@push.rocks/smartdns",
+    "projectVersion": "8.4.0",
+    "gitCommit": "fbbda1bf36bf95d1648ec98bd701bfc2f284c66b",
+    "gitDirty": false,
+    "builtAt": "2026-09-13T11:11:41.575Z",
+    "tsrustVersion": "1.13.0",
+    "binary": "rustdns",
+    "target": "linux_arm64_musl"
+  }
+}

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartdns',
-    version: '8.2.1',
+    version: '8.4.0',
     description: 'A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlMQUF5TDtDQUN2TSxDQUFBIn0=

package/dist_ts_client/classes.rustdnsclientbridge.js

@@ -11,6 +11,9 @@ export class RustDnsClientBridge {
         const localPaths = [];
         // dist_rust/ candidates (tsrust cross-compiled output, platform-specific)
         if (platformSuffix) {
+            if (process.platform === 'linux') {
+                localPaths.push(plugins.path.join(packageDir, 'dist_rust', `rustdns-client_${platformSuffix}_musl`));
+            }
             localPaths.push(plugins.path.join(packageDir, 'dist_rust', `rustdns-client_${platformSuffix}`));
         }
         // dist_rust/ without suffix (native build)
@@ -132,4 +135,4 @@ function getPlatformSuffix() {
     }
     return null;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ydXN0ZG5zY2xpZW50YnJpZGdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfY2xpZW50L2NsYXNzZXMucnVzdGRuc2NsaWVudGJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQXFFeEM7O0dBRUc7QUFDSCxNQUFNLE9BQU8sbUJBQW1CO0lBSTlCO1FBRlEsaUJBQVksR0FBNEIsSUFBSSxDQUFDO1FBR25ELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUNyQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxFQUN2RCxJQUFJLENBQ0wsQ0FBQztRQUVGLDJFQUEyRTtRQUMzRSxNQUFNLGNBQWMsR0FBRyxpQkFBaUIsRUFBRSxDQUFDO1FBQzNDLE1BQU0sVUFBVSxHQUFhLEVBQUUsQ0FBQztRQUVoQywwRUFBMEU7UUFDMUUsSUFBSSxjQUFjLEVBQUUsQ0FBQztZQUNuQixVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLEVBQUUsa0JBQWtCLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNsRyxDQUFDO1FBQ0QsMkNBQTJDO1FBQzNDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFDOUUsd0JBQXdCO1FBQ3hCLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLGdCQUFnQixDQUFDLENBQUMsQ0FBQztRQUM5RixVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFFNUYsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFxQjtZQUNqRSxVQUFVLEVBQUUsZ0JBQWdCO1lBQzVCLE9BQU8sRUFBRSxDQUFDLGNBQWMsQ0FBQztZQUN6QixnQkFBZ0IsRUFBRSxNQUFNO1lBQ3hCLGNBQWMsRUFBRSxNQUFNO1lBQ3RCLFVBQVU7WUFDVixnQkFBZ0IsRUFBRSxLQUFLO1NBQ3hCLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7Z0JBQ2hCLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLElBQUksRUFBRSxDQUFDLENBQUM7WUFDMUMsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGFBQWE7UUFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN2QixJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDMUMsQ0FBQztRQUNELE1BQU0sRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQztRQUNuQyxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztJQUNILENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQ2xCLElBQVksRUFDWixVQUFrQixFQUNsQixRQUF1QixFQUN2QixVQUFtQixFQUNuQixNQUFlLEVBQ2YsU0FBa0I7UUFFbEIsTUFBTSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDM0IsTUFBTSxNQUFNLEdBQW1CO1lBQzdCLElBQUk7WUFDSixVQUFVO1lBQ1YsUUFBUTtTQUNULENBQUM7UUFDRixJQUFJLFVBQVU7WUFBRSxNQUFNLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztRQUMvQyxJQUFJLE1BQU07WUFBRSxNQUFNLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztRQUNuQyxJQUFJLFNBQVM7WUFBRSxNQUFNLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQztRQUM1QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsZUFBZSxDQUMxQixJQUFZLEVBQ1osVUFBa0IsRUFDbEIsUUFBdUIsRUFDdkIsVUFBbUIsRUFDbkIsTUFBZSxFQUNmLFNBQWtCO1FBRWxCLE1BQU0sSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sTUFBTSxHQUFtQjtZQUM3QixJQUFJO1lBQ0osVUFBVTtZQUNWLFFBQVE7U0FDVCxDQUFDO1FBQ0YsSUFBSSxVQUFVO1lBQUUsTUFBTSxDQUFDLFVBQVUsR0FBRyxVQUFVLENBQUM7UUFDL0MsSUFBSSxNQUFNO1lBQUUsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDbkMsSUFBSSxTQUFTO1lBQUUsTUFBTSxDQUFDLFNBQVMsR0FBRyxTQUFTLENBQUM7UUFDNUMsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxpQkFBaUIsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQTJCLENBQUMsQ0FBQztRQUNsRixPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUM7SUFDckIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksSUFBSTtRQUNULElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbkIsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUM7SUFDM0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVM7UUFDcEIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQzlCLElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDO0lBQzNCLENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRjtBQUVEOztHQUVHO0FBQ0gsU0FBUyxpQkFBaUI7SUFDeEIsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO0lBRTFCLE1BQU0sV0FBVyxHQUEyQjtRQUMxQyxPQUFPLEVBQUUsT0FBTztRQUNoQixRQUFRLEVBQUUsT0FBTztRQUNqQixPQUFPLEVBQUUsU0FBUztLQUNuQixDQUFDO0lBRUYsTUFBTSxPQUFPLEdBQTJCO1FBQ3RDLEtBQUssRUFBRSxPQUFPO1FBQ2QsT0FBTyxFQUFFLE9BQU87S0FDakIsQ0FBQztJQUVGLE1BQU0sQ0FBQyxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNoQyxNQUFNLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDWCxPQUFPLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ydXN0ZG5zY2xpZW50YnJpZGdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfY2xpZW50L2NsYXNzZXMucnVzdGRuc2NsaWVudGJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQXFFeEM7O0dBRUc7QUFDSCxNQUFNLE9BQU8sbUJBQW1CO0lBSTlCO1FBRlEsaUJBQVksR0FBNEIsSUFBSSxDQUFDO1FBR25ELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUNyQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxFQUN2RCxJQUFJLENBQ0wsQ0FBQztRQUVGLDJFQUEyRTtRQUMzRSxNQUFNLGNBQWMsR0FBRyxpQkFBaUIsRUFBRSxDQUFDO1FBQzNDLE1BQU0sVUFBVSxHQUFhLEVBQUUsQ0FBQztRQUVoQywwRUFBMEU7UUFDMUUsSUFBSSxjQUFjLEVBQUUsQ0FBQztZQUNuQixJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQ2pDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxrQkFBa0IsY0FBYyxPQUFPLENBQUMsQ0FBQyxDQUFDO1lBQ3ZHLENBQUM7WUFDRCxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLEVBQUUsa0JBQWtCLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNsRyxDQUFDO1FBQ0QsMkNBQTJDO1FBQzNDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFDOUUsd0JBQXdCO1FBQ3hCLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLGdCQUFnQixDQUFDLENBQUMsQ0FBQztRQUM5RixVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFFNUYsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFxQjtZQUNqRSxVQUFVLEVBQUUsZ0JBQWdCO1lBQzVCLE9BQU8sRUFBRSxDQUFDLGNBQWMsQ0FBQztZQUN6QixnQkFBZ0IsRUFBRSxNQUFNO1lBQ3hCLGNBQWMsRUFBRSxNQUFNO1lBQ3RCLFVBQVU7WUFDVixnQkFBZ0IsRUFBRSxLQUFLO1NBQ3hCLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7Z0JBQ2hCLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLElBQUksRUFBRSxDQUFDLENBQUM7WUFDMUMsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGFBQWE7UUFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN2QixJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDMUMsQ0FBQztRQUNELE1BQU0sRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQztRQUNuQyxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztJQUNILENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQ2xCLElBQVksRUFDWixVQUFrQixFQUNsQixRQUF1QixFQUN2QixVQUFtQixFQUNuQixNQUFlLEVBQ2YsU0FBa0I7UUFFbEIsTUFBTSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDM0IsTUFBTSxNQUFNLEdBQW1CO1lBQzdCLElBQUk7WUFDSixVQUFVO1lBQ1YsUUFBUTtTQUNULENBQUM7UUFDRixJQUFJLFVBQVU7WUFBRSxNQUFNLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztRQUMvQyxJQUFJLE1BQU07WUFBRSxNQUFNLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztRQUNuQyxJQUFJLFNBQVM7WUFBRSxNQUFNLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQztRQUM1QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsZUFBZSxDQUMxQixJQUFZLEVBQ1osVUFBa0IsRUFDbEIsUUFBdUIsRUFDdkIsVUFBbUIsRUFDbkIsTUFBZSxFQUNmLFNBQWtCO1FBRWxCLE1BQU0sSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sTUFBTSxHQUFtQjtZQUM3QixJQUFJO1lBQ0osVUFBVTtZQUNWLFFBQVE7U0FDVCxDQUFDO1FBQ0YsSUFBSSxVQUFVO1lBQUUsTUFBTSxDQUFDLFVBQVUsR0FBRyxVQUFVLENBQUM7UUFDL0MsSUFBSSxNQUFNO1lBQUUsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDbkMsSUFBSSxTQUFTO1lBQUUsTUFBTSxDQUFDLFNBQVMsR0FBRyxTQUFTLENBQUM7UUFDNUMsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxpQkFBaUIsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQTJCLENBQUMsQ0FBQztRQUNsRixPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUM7SUFDckIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksSUFBSTtRQUNULElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbkIsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUM7SUFDM0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVM7UUFDcEIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQzlCLElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDO0lBQzNCLENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRjtBQUVEOztHQUVHO0FBQ0gsU0FBUyxpQkFBaUI7SUFDeEIsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO0lBRTFCLE1BQU0sV0FBVyxHQUEyQjtRQUMxQyxPQUFPLEVBQUUsT0FBTztRQUNoQixRQUFRLEVBQUUsT0FBTztRQUNqQixPQUFPLEVBQUUsU0FBUztLQUNuQixDQUFDO0lBRUYsTUFBTSxPQUFPLEdBQTJCO1FBQ3RDLEtBQUssRUFBRSxPQUFPO1FBQ2QsT0FBTyxFQUFFLE9BQU87S0FDakIsQ0FBQztJQUVGLE1BQU0sQ0FBQyxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNoQyxNQUFNLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDWCxPQUFPLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMifQ==

package/dist_ts_server/classes.dnsserver.d.ts

@@ -287,7 +287,7 @@ export declare class DnsServer extends plugins.events.EventEmitter {
      * name (its apex exists by configuration), or when a handler pattern is
      * anchored below it (literal `.name` suffix, or a wildcard that matches a
      * probe label). Mid-label wildcard patterns cannot be fully inverted by
-     * this check; see readme.hints.md.
+     * this check; see hints.md.
      */
     private nameHasCoveredDescendants;
     /** The SOA this server publishes at the apex of a zone it is authoritative for. */

package/dist_ts_server/classes.dnsserver.js

@@ -1012,7 +1012,7 @@ export class DnsServer extends plugins.events.EventEmitter {
                         name: answer.name,
                         type: answer.type,
                         class: typeof answer.class === 'number' ? 'IN' : (answer.class || 'IN'),
-                        ttl: answer.ttl || 300,
+                        ttl: answer.ttl ?? 300,
                         data: answer.data,
                     });
                     if (handlerEntry.authority === 'non-authoritative' || !questionZone) {
@@ -1124,7 +1124,7 @@ export class DnsServer extends plugins.events.EventEmitter {
      * name (its apex exists by configuration), or when a handler pattern is
      * anchored below it (literal `.name` suffix, or a wildcard that matches a
      * probe label). Mid-label wildcard patterns cannot be fully inverted by
-     * this check; see readme.hints.md.
+     * this check; see hints.md.
      */
     nameHasCoveredDescendants(name) {
         if (this.normalizedAuthoritativeZones().some((zone) => zone.endsWith(`.${name}`))) {

package/dist_ts_server/classes.manageddnsserver.d.ts

@@ -0,0 +1,34 @@
+import { type IRustDnsBridgeOptions } from './classes.rustdnsbridge.js';
+import type { IManagedDnsClockEvidence, IManagedDnsRevision, IManagedDnsServerOptions, IManagedDnsSnapshot, IManagedDnsStatus } from './interfaces.managed.js';
+/**
+ * Native private-view DNS owner. Each instance owns one joined child lifecycle.
+ * The caller authenticates and persists complete snapshots and revision receipts
+ * through its own persistence layer before acknowledging applied configuration.
+ * Workload source/interface anti-spoofing remains the caller's kernel-policy duty.
+ */
+export declare class ManagedDnsServer {
+    private readonly bridge;
+    private readonly options;
+    private queue;
+    private closing;
+    private spawned;
+    private started;
+    private failedOwned;
+    private stopPromise;
+    constructor(options: IManagedDnsServerOptions, processOptions?: IRustDnsBridgeOptions);
+    private enqueue;
+    private ensureSpawned;
+    /** Starts the child if needed; does not admit queries or create a listener. */
+    getClockEvidence(): Promise<IManagedDnsClockEvidence>;
+    /** Bind both transports. Until an accepted snapshot exists all queries refuse. */
+    start(): Promise<IManagedDnsStatus>;
+    /** Atomic complete replacement; older revisions and conflicting replay reject. */
+    applySnapshot(snapshot: IManagedDnsSnapshot): Promise<IManagedDnsRevision>;
+    getStatus(): Promise<IManagedDnsStatus>;
+    /**
+     * Stop admission immediately, join pending calls and native listener/query
+     * cleanup, then confirm child termination. Failed cleanup remains retryable.
+     * An instance is single-use; restart with the persisted snapshot revision floor.
+     */
+    stop(): Promise<void>;
+}

package/dist_ts_server/classes.manageddnsserver.js

@@ -0,0 +1,141 @@
+import { RustDnsBridge } from './classes.rustdnsbridge.js';
+import * as plugins from './plugins.js';
+/**
+ * Native private-view DNS owner. Each instance owns one joined child lifecycle.
+ * The caller authenticates and persists complete snapshots and revision receipts
+ * through its own persistence layer before acknowledging applied configuration.
+ * Workload source/interface anti-spoofing remains the caller's kernel-policy duty.
+ */
+export class ManagedDnsServer {
+    constructor(options, processOptions = {}) {
+        this.queue = Promise.resolve();
+        this.closing = false;
+        this.spawned = false;
+        this.started = false;
+        this.failedOwned = false;
+        this.stopPromise = null;
+        this.options = structuredClone(options);
+        this.bridge = new RustDnsBridge(processOptions);
+    }
+    enqueue(operation) {
+        if (this.closing || this.failedOwned) {
+            return Promise.reject(new Error('Managed DNS owner is closing or requires cleanup'));
+        }
+        const result = this.queue.then(async () => {
+            if (this.closing || this.failedOwned) {
+                throw new Error('Managed DNS owner is closing or requires cleanup');
+            }
+            return operation();
+        });
+        this.queue = result.catch(() => { });
+        return result;
+    }
+    async ensureSpawned() {
+        if (this.spawned) {
+            if (!this.bridge.running) {
+                this.failedOwned = true;
+                throw new Error('Managed DNS child exited; create a fresh owner after cleanup');
+            }
+            return;
+        }
+        try {
+            if (!(await this.bridge.spawn()))
+                throw new Error('Managed DNS native binary unavailable');
+            this.spawned = true;
+        }
+        catch (error) {
+            this.failedOwned = true;
+            throw error;
+        }
+    }
+    /** Starts the child if needed; does not admit queries or create a listener. */
+    getClockEvidence() {
+        return this.enqueue(async () => {
+            await this.ensureSpawned();
+            return this.bridge.managedClock();
+        });
+    }
+    /** Bind both transports. Until an accepted snapshot exists all queries refuse. */
+    start() {
+        return this.enqueue(async () => {
+            if (this.started)
+                throw new Error('Managed DNS server already started');
+            await this.ensureSpawned();
+            try {
+                const status = await this.bridge.managedStart(this.options);
+                this.started = true;
+                return status;
+            }
+            catch (error) {
+                this.failedOwned = true;
+                throw error;
+            }
+        });
+    }
+    /** Atomic complete replacement; older revisions and conflicting replay reject. */
+    applySnapshot(snapshot) {
+        // Clone before asynchronous queueing so caller mutation cannot change an intent.
+        const ownedSnapshot = structuredClone(snapshot);
+        return this.enqueue(async () => {
+            if (!this.started)
+                throw new Error('Managed DNS server is not started');
+            try {
+                return await this.bridge.managedApply(ownedSnapshot);
+            }
+            catch (error) {
+                // A native validation rejection leaves the prior snapshot intact. A
+                // missing/ambiguous transport acknowledgement owns unresolved effects;
+                // block further mutations until this child has been joined and replaced.
+                if (!(error instanceof plugins.smartrust.RustBridgeRequestError)
+                    || error.code !== 'ERR_RUST_BRIDGE_REQUEST_RUST_RESPONSE') {
+                    this.failedOwned = true;
+                }
+                throw error;
+            }
+        });
+    }
+    getStatus() {
+        return this.enqueue(async () => {
+            if (!this.started)
+                throw new Error('Managed DNS server is not started');
+            return this.bridge.managedStatus();
+        });
+    }
+    /**
+     * Stop admission immediately, join pending calls and native listener/query
+     * cleanup, then confirm child termination. Failed cleanup remains retryable.
+     * An instance is single-use; restart with the persisted snapshot revision floor.
+     */
+    stop() {
+        if (this.stopPromise)
+            return this.stopPromise;
+        this.closing = true;
+        const operation = this.queue.then(async () => {
+            const failures = [];
+            if (this.bridge.running) {
+                try {
+                    await this.bridge.managedStop();
+                }
+                catch (error) {
+                    failures.push(error);
+                }
+            }
+            try {
+                await this.bridge.terminate();
+            }
+            catch (error) {
+                failures.push(error);
+            }
+            if (failures.length) {
+                this.failedOwned = true;
+                throw new AggregateError(failures, 'Managed DNS cleanup failed');
+            }
+            this.spawned = false;
+            this.started = false;
+        });
+        this.stopPromise = operation;
+        operation.catch(() => { this.stopPromise = null; });
+        return operation;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5tYW5hZ2VkZG5zc2VydmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2NsYXNzZXMubWFuYWdlZGRuc3NlcnZlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsYUFBYSxFQUE4QixNQUFNLDRCQUE0QixDQUFDO0FBQ3ZGLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBU3hDOzs7OztHQUtHO0FBQ0gsTUFBTSxPQUFPLGdCQUFnQjtJQVUzQixZQUFZLE9BQWlDLEVBQUUsaUJBQXdDLEVBQUU7UUFQakYsVUFBSyxHQUFxQixPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDNUMsWUFBTyxHQUFHLEtBQUssQ0FBQztRQUNoQixZQUFPLEdBQUcsS0FBSyxDQUFDO1FBQ2hCLFlBQU8sR0FBRyxLQUFLLENBQUM7UUFDaEIsZ0JBQVcsR0FBRyxLQUFLLENBQUM7UUFDcEIsZ0JBQVcsR0FBeUIsSUFBSSxDQUFDO1FBRy9DLElBQUksQ0FBQyxPQUFPLEdBQUcsZUFBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3hDLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxhQUFhLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVPLE9BQU8sQ0FBSSxTQUEyQjtRQUM1QyxJQUFJLElBQUksQ0FBQyxPQUFPLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3JDLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEtBQUssQ0FBQyxrREFBa0QsQ0FBQyxDQUFDLENBQUM7UUFDdkYsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ3hDLElBQUksSUFBSSxDQUFDLE9BQU8sSUFBSSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQ3JDLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztZQUN0RSxDQUFDO1lBQ0QsT0FBTyxTQUFTLEVBQUUsQ0FBQztRQUNyQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsR0FBRSxDQUFDLENBQUMsQ0FBQztRQUNwQyxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRU8sS0FBSyxDQUFDLGFBQWE7UUFDekIsSUFBSSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDakIsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3pCLElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDO2dCQUN4QixNQUFNLElBQUksS0FBSyxDQUFDLDhEQUE4RCxDQUFDLENBQUM7WUFDbEYsQ0FBQztZQUNELE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsSUFBSSxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztZQUMzRixJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQztRQUN0QixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDO1lBQ3hCLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztJQUNILENBQUM7SUFFRCwrRUFBK0U7SUFDeEUsZ0JBQWdCO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLElBQUksRUFBRTtZQUM3QixNQUFNLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUMzQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDcEMsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsa0ZBQWtGO0lBQzNFLEtBQUs7UUFDVixPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDN0IsSUFBSSxJQUFJLENBQUMsT0FBTztnQkFBRSxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7WUFDeEUsTUFBTSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDM0IsSUFBSSxDQUFDO2dCQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUM1RCxJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQztnQkFDcEIsT0FBTyxNQUFNLENBQUM7WUFDaEIsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUM7Z0JBQ3hCLE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELGtGQUFrRjtJQUMzRSxhQUFhLENBQUMsUUFBNkI7UUFDaEQsaUZBQWlGO1FBQ2pGLE1BQU0sYUFBYSxHQUFHLGVBQWUsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNoRCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDN0IsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztZQUN4RSxJQUFJLENBQUM7Z0JBQ0gsT0FBTyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQ3ZELENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLG9FQUFvRTtnQkFDcEUsdUVBQXVFO2dCQUN2RSx5RUFBeUU7Z0JBQ3pFLElBQUksQ0FBQyxDQUFDLEtBQUssWUFBWSxPQUFPLENBQUMsU0FBUyxDQUFDLHNCQUFzQixDQUFDO3VCQUMzRCxLQUFLLENBQUMsSUFBSSxLQUFLLHVDQUF1QyxFQUFFLENBQUM7b0JBQzVELElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDO2dCQUMxQixDQUFDO2dCQUNELE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLFNBQVM7UUFDZCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDN0IsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztZQUN4RSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckMsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNJLElBQUk7UUFDVCxJQUFJLElBQUksQ0FBQyxXQUFXO1lBQUUsT0FBTyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQzlDLElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1FBQ3BCLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQzNDLE1BQU0sUUFBUSxHQUFjLEVBQUUsQ0FBQztZQUMvQixJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3hCLElBQUksQ0FBQztvQkFBQyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQUMsQ0FBQztnQkFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO29CQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQUMsQ0FBQztZQUNsRixDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUFDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxDQUFDO1lBQzlFLElBQUksUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNwQixJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksQ0FBQztnQkFDeEIsTUFBTSxJQUFJLGNBQWMsQ0FBQyxRQUFRLEVBQUUsNEJBQTRCLENBQUMsQ0FBQztZQUNuRSxDQUFDO1lBQ0QsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7WUFDckIsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7UUFDdkIsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsV0FBVyxHQUFHLFNBQVMsQ0FBQztRQUM3QixTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDcEQsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztDQUNGIn0=

package/dist_ts_server/classes.rustdnsbridge.d.ts

@@ -1,5 +1,26 @@
 import * as plugins from './plugins.js';
+import type { IManagedDnsClockEvidence, IManagedDnsRevision, IManagedDnsServerOptions, IManagedDnsSnapshot, IManagedDnsStatus } from './interfaces.managed.js';
 export type TDnsCommands = {
+    managedClock: {
+        params: Record<string, never>;
+        result: IManagedDnsClockEvidence;
+    };
+    managedStart: {
+        params: IManagedDnsServerOptions;
+        result: IManagedDnsStatus;
+    };
+    managedApply: {
+        params: IManagedDnsSnapshot;
+        result: IManagedDnsRevision;
+    };
+    managedStatus: {
+        params: Record<string, never>;
+        result: IManagedDnsStatus;
+    };
+    managedStop: {
+        params: Record<string, never>;
+        result: Record<string, never>;
+    };
     start: {
         params: {
             config: IRustDnsConfig;
@@ -89,16 +110,31 @@ export interface IDnsQueryEvent {
     questions: IIpcDnsQuestion[];
     dnssecRequested: boolean;
 }
+export interface IRustDnsBridgeOptions {
+    /** Installer-verified absolute native executable. Disables every lookup fallback. */
+    binaryPath?: string;
+    /**
+     * Linux network-namespace descriptor owned by the caller. Keep it open and bound
+     * to the intended namespace until spawn resolves. The child enters that namespace
+     * before creating threads or sockets; neither owner closes the caller's descriptor.
+     */
+    networkNamespaceFd?: number;
+}
 /**
  * Bridge to the Rust DNS binary via smartrust IPC.
  */
 export declare class RustDnsBridge extends plugins.events.EventEmitter {
     private bridge;
-    constructor();
+    constructor(options?: IRustDnsBridgeOptions);
     /**
      * Spawn the Rust binary and wait for readiness.
      */
     spawn(): Promise<boolean>;
+    managedClock(): Promise<IManagedDnsClockEvidence>;
+    managedStart(options: IManagedDnsServerOptions): Promise<IManagedDnsStatus>;
+    managedApply(snapshot: IManagedDnsSnapshot): Promise<IManagedDnsRevision>;
+    managedStatus(): Promise<IManagedDnsStatus>;
+    managedStop(): Promise<void>;
     /**
      * Start the DNS server with given config.
      */

package/dist_ts_server/classes.rustdnsbridge.js

@@ -3,24 +3,42 @@ import * as plugins from './plugins.js';
  * Bridge to the Rust DNS binary via smartrust IPC.
  */
 export class RustDnsBridge extends plugins.events.EventEmitter {
-    constructor() {
+    constructor(options = {}) {
         super();
-        const packageDir = plugins.path.resolve(plugins.path.dirname(new URL(import.meta.url).pathname), '..');
-        // Determine platform suffix for dist_rust binaries (matches tsrust naming)
-        const platformSuffix = getPlatformSuffix();
+        if (options.binaryPath !== undefined
+            && (typeof options.binaryPath !== 'string' || !plugins.path.isAbsolute(options.binaryPath))) {
+            throw new TypeError('DNS binaryPath must be an absolute executable path');
+        }
+        if (options.networkNamespaceFd !== undefined) {
+            if (process.platform !== 'linux') {
+                throw new Error('DNS networkNamespaceFd requires Linux');
+            }
+            if (!Number.isInteger(options.networkNamespaceFd)
+                || options.networkNamespaceFd < 0 || options.networkNamespaceFd > 0x7fff_ffff) {
+                throw new RangeError('DNS networkNamespaceFd must be a non-negative native file descriptor');
+            }
+        }
         const localPaths = [];
-        // dist_rust/ candidates (tsrust cross-compiled output, platform-specific)
-        if (platformSuffix) {
-            localPaths.push(plugins.path.join(packageDir, 'dist_rust', `rustdns_${platformSuffix}`));
+        if (options.binaryPath === undefined) {
+            const packageDir = plugins.path.resolve(plugins.path.dirname(new URL(import.meta.url).pathname), '..');
+            const platformSuffix = getPlatformSuffix();
+            if (platformSuffix) {
+                if (process.platform === 'linux') {
+                    localPaths.push(plugins.path.join(packageDir, 'dist_rust', `rustdns_${platformSuffix}_musl`));
+                }
+                localPaths.push(plugins.path.join(packageDir, 'dist_rust', `rustdns_${platformSuffix}`));
+            }
+            localPaths.push(plugins.path.join(packageDir, 'dist_rust', 'rustdns'));
+            localPaths.push(plugins.path.join(packageDir, 'rust', 'target', 'release', 'rustdns'));
+            localPaths.push(plugins.path.join(packageDir, 'rust', 'target', 'debug', 'rustdns'));
         }
-        // dist_rust/ without suffix (native build)
-        localPaths.push(plugins.path.join(packageDir, 'dist_rust', 'rustdns'));
-        // Local dev build paths
-        localPaths.push(plugins.path.join(packageDir, 'rust', 'target', 'release', 'rustdns'));
-        localPaths.push(plugins.path.join(packageDir, 'rust', 'target', 'debug', 'rustdns'));
         this.bridge = new plugins.smartrust.RustBridge({
             binaryName: 'rustdns',
-            cliArgs: ['--management'],
+            binaryPath: options.binaryPath,
+            cliArgs: options.networkNamespaceFd === undefined
+                ? ['--management'] : ['--management', '--network-namespace-fd', '3'],
+            inheritedFileDescriptors: options.networkNamespaceFd === undefined
+                ? undefined : [options.networkNamespaceFd],
             requestTimeoutMs: 30_000,
             readyTimeoutMs: 10_000,
             maxPendingRequestsByMethod: {
@@ -55,6 +73,21 @@ export class RustDnsBridge extends plugins.events.EventEmitter {
     async spawn() {
         return this.bridge.spawn();
     }
+    managedClock() {
+        return this.bridge.sendCommand('managedClock', {});
+    }
+    managedStart(options) {
+        return this.bridge.sendCommand('managedStart', options);
+    }
+    managedApply(snapshot) {
+        return this.bridge.sendCommand('managedApply', snapshot);
+    }
+    managedStatus() {
+        return this.bridge.sendCommand('managedStatus', {});
+    }
+    async managedStop() {
+        await this.bridge.sendCommand('managedStop', {});
+    }
     /**
      * Start the DNS server with given config.
      */
@@ -146,4 +179,4 @@ function getPlatformSuffix() {
     }
     return null;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ydXN0ZG5zYnJpZGdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2NsYXNzZXMucnVzdGRuc2JyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQTBGeEM7O0dBRUc7QUFDSCxNQUFNLE9BQU8sYUFBYyxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQUc1RDtRQUNFLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQ3JDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQ3ZELElBQUksQ0FDTCxDQUFDO1FBRUYsMkVBQTJFO1FBQzNFLE1BQU0sY0FBYyxHQUFHLGlCQUFpQixFQUFFLENBQUM7UUFDM0MsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO1FBRWhDLDBFQUEwRTtRQUMxRSxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ25CLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxXQUFXLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsMkNBQTJDO1FBQzNDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLHdCQUF3QjtRQUN4QixVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZGLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFFckYsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFlO1lBQzNELFVBQVUsRUFBRSxTQUFTO1lBQ3JCLE9BQU8sRUFBRSxDQUFDLGNBQWMsQ0FBQztZQUN6QixnQkFBZ0IsRUFBRSxNQUFNO1lBQ3hCLGNBQWMsRUFBRSxNQUFNO1lBQ3RCLDBCQUEwQixFQUFFO2dCQUMxQixhQUFhLEVBQUUsR0FBRzthQUNuQjtZQUNELFVBQVU7WUFDVixnQkFBZ0IsRUFBRSxLQUFLO1NBQ3hCLENBQUMsQ0FBQztRQUVILG1DQUFtQztRQUNuQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDLElBQW9CLEVBQUUsRUFBRTtZQUM3RCxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM5QixDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG9CQUFvQixFQUFFLEdBQUcsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZCLENBQUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsR0FBRyxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkIsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLElBQXlCLEVBQUUsRUFBRTtZQUMvRCxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUM5QyxDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLDRDQUE0QztZQUM1QyxJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUNoQixPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNuQyxDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFzQjtRQUM3QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGVBQWUsQ0FDMUIsYUFBcUIsRUFDckIsT0FBd0IsRUFDeEIsWUFBbUMsRUFDbkMsYUFBc0I7UUFFdEIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxnQkFBZ0IsRUFBRTtZQUM5QyxhQUFhO1lBQ2IsT0FBTztZQUNQLFlBQVk7WUFDWixhQUFhO1NBQ2QsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxRQUFnQixFQUFFLFNBQWlCO1FBQzFELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLGFBQWEsQ0FBQyxNQUFjLEVBQUUsU0FBeUI7UUFDbEUsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUU7WUFDNUQsTUFBTSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1lBQ2pDLFNBQVM7U0FDVixDQUFDLENBQUM7UUFDSCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQztJQUM5QyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3pELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQztJQUNyQixDQUFDO0lBRUQ7O09BRUc7SUFDSSxJQUFJO1FBQ1QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNyQixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsU0FBUztRQUNwQixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDaEMsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGO0FBRUQ7OztHQUdHO0FBQ0gsU0FBUyxpQkFBaUI7SUFDeEIsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO0lBRTFCLE1BQU0sV0FBVyxHQUEyQjtRQUMxQyxPQUFPLEVBQUUsT0FBTztRQUNoQixRQUFRLEVBQUUsT0FBTztRQUNqQixPQUFPLEVBQUUsU0FBUztLQUNuQixDQUFDO0lBRUYsTUFBTSxPQUFPLEdBQTJCO1FBQ3RDLEtBQUssRUFBRSxPQUFPO1FBQ2QsT0FBTyxFQUFFLE9BQU87S0FDakIsQ0FBQztJQUVGLE1BQU0sQ0FBQyxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNoQyxNQUFNLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDWCxPQUFPLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ydXN0ZG5zYnJpZGdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2NsYXNzZXMucnVzdGRuc2JyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQTJHeEM7O0dBRUc7QUFDSCxNQUFNLE9BQU8sYUFBYyxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQUc1RCxZQUFZLFVBQWlDLEVBQUU7UUFDN0MsS0FBSyxFQUFFLENBQUM7UUFFUixJQUFJLE9BQU8sQ0FBQyxVQUFVLEtBQUssU0FBUztlQUMvQixDQUFDLE9BQU8sT0FBTyxDQUFDLFVBQVUsS0FBSyxRQUFRLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzlGLE1BQU0sSUFBSSxTQUFTLENBQUMsb0RBQW9ELENBQUMsQ0FBQztRQUM1RSxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsa0JBQWtCLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDN0MsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sRUFBRSxDQUFDO2dCQUNqQyxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7WUFDM0QsQ0FBQztZQUNELElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQzttQkFDNUMsT0FBTyxDQUFDLGtCQUFrQixHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsa0JBQWtCLEdBQUcsV0FBVyxFQUFFLENBQUM7Z0JBQ2hGLE1BQU0sSUFBSSxVQUFVLENBQUMsc0VBQXNFLENBQUMsQ0FBQztZQUMvRixDQUFDO1FBQ0gsQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFhLEVBQUUsQ0FBQztRQUNoQyxJQUFJLE9BQU8sQ0FBQyxVQUFVLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDckMsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQ3JDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQ3ZELElBQUksQ0FDTCxDQUFDO1lBQ0YsTUFBTSxjQUFjLEdBQUcsaUJBQWlCLEVBQUUsQ0FBQztZQUMzQyxJQUFJLGNBQWMsRUFBRSxDQUFDO2dCQUNuQixJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssT0FBTyxFQUFFLENBQUM7b0JBQ2pDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxXQUFXLGNBQWMsT0FBTyxDQUFDLENBQUMsQ0FBQztnQkFDaEcsQ0FBQztnQkFDRCxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLEVBQUUsV0FBVyxjQUFjLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDM0YsQ0FBQztZQUNELFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQ3ZFLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDdkYsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUN2RixDQUFDO1FBRUQsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFlO1lBQzNELFVBQVUsRUFBRSxTQUFTO1lBQ3JCLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVTtZQUM5QixPQUFPLEVBQUUsT0FBTyxDQUFDLGtCQUFrQixLQUFLLFNBQVM7Z0JBQy9DLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLGNBQWMsRUFBRSx3QkFBd0IsRUFBRSxHQUFHLENBQUM7WUFDdEUsd0JBQXdCLEVBQUUsT0FBTyxDQUFDLGtCQUFrQixLQUFLLFNBQVM7Z0JBQ2hFLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1lBQzVDLGdCQUFnQixFQUFFLE1BQU07WUFDeEIsY0FBYyxFQUFFLE1BQU07WUFDdEIsMEJBQTBCLEVBQUU7Z0JBQzFCLGFBQWEsRUFBRSxHQUFHO2FBQ25CO1lBQ0QsVUFBVTtZQUNWLGdCQUFnQixFQUFFLEtBQUs7U0FDeEIsQ0FBQyxDQUFDO1FBRUgsbUNBQW1DO1FBQ25DLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLHFCQUFxQixFQUFFLENBQUMsSUFBb0IsRUFBRSxFQUFFO1lBQzdELElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzlCLENBQUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsR0FBRyxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkIsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxvQkFBb0IsRUFBRSxHQUFHLEVBQUU7WUFDeEMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN2QixDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGtCQUFrQixFQUFFLENBQUMsSUFBeUIsRUFBRSxFQUFFO1lBQy9ELElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQzlDLENBQUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBWSxFQUFFLEVBQUU7WUFDeEMsNENBQTRDO1lBQzVDLElBQUksSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7Z0JBQ2hCLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBQ25DLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxLQUFLO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUM3QixDQUFDO0lBRU0sWUFBWTtRQUNqQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGNBQWMsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBRU0sWUFBWSxDQUFDLE9BQWlDO1FBQ25ELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsY0FBYyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFFTSxZQUFZLENBQUMsUUFBNkI7UUFDL0MsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxjQUFjLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUVNLGFBQWE7UUFDbEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDdEQsQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXO1FBQ3RCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxXQUFXLENBQUMsTUFBc0I7UUFDN0MsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxVQUFVO1FBQ3JCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxlQUFlLENBQzFCLGFBQXFCLEVBQ3JCLE9BQXdCLEVBQ3hCLFlBQW1DLEVBQ25DLGFBQXNCO1FBRXRCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLEVBQUU7WUFDOUMsYUFBYTtZQUNiLE9BQU87WUFDUCxZQUFZO1lBQ1osYUFBYTtTQUNkLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxXQUFXLENBQUMsUUFBZ0IsRUFBRSxTQUFpQjtRQUMxRCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGFBQWEsRUFBRSxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNJLEtBQUssQ0FBQyxhQUFhLENBQUMsTUFBYyxFQUFFLFNBQXlCO1FBQ2xFLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsZUFBZSxFQUFFO1lBQzVELE1BQU0sRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztZQUNqQyxTQUFTO1NBQ1YsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLElBQUk7UUFDZixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN6RCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUM7SUFDckIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksSUFBSTtRQUNULElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDckIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVM7UUFDcEIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO0lBQ2hDLENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRjtBQUVEOzs7R0FHRztBQUNILFNBQVMsaUJBQWlCO0lBQ3hCLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUM7SUFDbEMsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQztJQUUxQixNQUFNLFdBQVcsR0FBMkI7UUFDMUMsT0FBTyxFQUFFLE9BQU87UUFDaEIsUUFBUSxFQUFFLE9BQU87UUFDakIsT0FBTyxFQUFFLFNBQVM7S0FDbkIsQ0FBQztJQUVGLE1BQU0sT0FBTyxHQUEyQjtRQUN0QyxLQUFLLEVBQUUsT0FBTztRQUNkLE9BQU8sRUFBRSxPQUFPO0tBQ2pCLENBQUM7SUFFRixNQUFNLENBQUMsR0FBRyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDaEMsTUFBTSxDQUFDLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRXhCLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ1gsT0FBTyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztJQUNyQixDQUFDO0lBRUQsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDIn0=

package/dist_ts_server/index.d.ts

@@ -1,2 +1,4 @@
 export * from './classes.dnsserver.js';
 export * from './classes.rustdnsbridge.js';
+export * from './classes.manageddnsserver.js';
+export * from './interfaces.managed.js';

package/dist_ts_server/index.js

@@ -1,3 +1,5 @@
 export * from './classes.dnsserver.js';
 export * from './classes.rustdnsbridge.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDIn0=
+export * from './classes.manageddnsserver.js';
+export * from './interfaces.managed.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyx5QkFBeUIsQ0FBQyJ9

package/dist_ts_server/interfaces.managed.d.ts

@@ -0,0 +1,79 @@
+/** Kernel boot identity and suspend-inclusive Linux CLOCK_BOOTTIME evidence. */
+export interface IManagedDnsClockEvidence {
+    bootId: string;
+    boottimeMs: number;
+}
+export interface IManagedDnsRevision {
+    revision: number;
+    /** SHA-256 of the native typed snapshot encoding, returned by applySnapshot. */
+    contentHash: string;
+}
+export interface IManagedDnsServerOptions {
+    ownerId: string;
+    /** Exact IP literal; wildcard listeners are forbidden. */
+    bindAddress: string;
+    /** UDP and TCP use the same port. Zero allocates one available port. */
+    port: number;
+    /** Persist this fence alongside the complete accepted snapshot. */
+    revisionFloor: IManagedDnsRevision | null;
+    /** Other node-local resolver addresses, forbidden as forwarding destinations. */
+    forbiddenUpstreamAddresses: string[];
+}
+export interface IManagedDnsSnapshot {
+    ownerId: string;
+    revision: number;
+    /** Authenticated parent projection's SHA-256; not a signature substitute. */
+    sourceContentHash: string;
+    /** Explicit withdrawal. A null configuration retains the revision fence. */
+    configuration: IManagedDnsConfiguration | null;
+}
+export interface IManagedDnsConfiguration {
+    bootId: string;
+    /** Absolute CLOCK_BOOTTIME milliseconds, never wall clock or JS performance.now. */
+    validUntilBoottimeMs: number;
+    blockedSuffixes: string[];
+    views: IManagedDnsView[];
+    clients: IManagedDnsClient[];
+}
+export interface IManagedDnsClient {
+    /** Kernel-observed source IP, whose workload/interface binding the owner enforces. */
+    address: string;
+    viewId: string;
+}
+export interface IManagedDnsView {
+    id: string;
+    zones: string[];
+    /** Declared names with no eligible records return authoritative NODATA. */
+    names: IManagedDnsDeclaredName[];
+    negativeTtl: number;
+    forwarding: IManagedDnsForwarding | null;
+}
+export interface IManagedDnsDeclaredName {
+    name: string;
+    records: IManagedDnsRecord[];
+}
+export interface IManagedDnsRecord {
+    type: 'A' | 'AAAA' | 'PTR';
+    data: string;
+    ttl: number;
+    validUntilBoottimeMs: number;
+}
+export interface IManagedDnsForwarding {
+    upstreams: Array<{
+        address: string;
+        port: number;
+    }>;
+    /** A single '.' explicitly permits external names outside privacy barriers. */
+    /** At most 1,024 suffixes, including unions produced by policy intersection. */
+    allowedSuffixes: string[];
+    timeoutMs: number;
+    maxTtl: number;
+}
+export interface IManagedDnsStatus {
+    ownerId: string;
+    address: string;
+    port: number;
+    accepted: IManagedDnsRevision | null;
+    active: boolean;
+    clock: IManagedDnsClockEvidence;
+}

package/dist_ts_server/interfaces.managed.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJmYWNlcy5tYW5hZ2VkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2ludGVyZmFjZXMubWFuYWdlZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=