@push.rocks/smartnftables 1.7.0 → 1.9.0

package/changelog.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 2026-09-14 - 1.9.0
+
+### Features
+
+- Add terminal closeRetaining cleanup for ambiguous reconciliation without requiring an applied receipt; preserve cleanup mode across failures.
+
+## 2026-09-14 - 1.8.0
+
+### Features
+
+- Add terminal policy detachment with exact PERSIST verification, retained-intent recovery and failure-safe native process cleanup.
+
 ## 2026-09-14 - 1.7.0
 
 ### Features

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "d220f9e5399c394467c212c9c29a01d56395bde551a7a1af7bd233ae313bbf21",
+  "binarySha256": "e7f3f755b5f9579969e94d70442710a8b2ebde0aa8dda4c0b312094b8771caf6",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "1.7.0",
-    "gitCommit": "9f206a95e42e76d6a4a61ecce11cf5d02927fb41",
+    "projectVersion": "1.9.0",
+    "gitCommit": "fb3d6ad37496d2010fa77e8e6619565898519748",
     "gitDirty": false,
-    "builtAt": "2026-09-14T02:54:17.256Z",
+    "builtAt": "2026-09-14T04:36:00.044Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "a282a800a9782297af8e7862ef2b8abbbc1aefcc79d50b5d0f453feecc874e36",
+  "binarySha256": "f80787be41352d19daf0b3916cb285fe29aa3e88f637180109a07ab8ec609b14",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "1.7.0",
-    "gitCommit": "9f206a95e42e76d6a4a61ecce11cf5d02927fb41",
+    "projectVersion": "1.9.0",
+    "gitCommit": "fb3d6ad37496d2010fa77e8e6619565898519748",
     "gitDirty": false,
-    "builtAt": "2026-09-14T02:54:17.376Z",
+    "builtAt": "2026-09-14T04:36:00.187Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '1.7.0',
+    version: '1.9.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/classes.managednftables.d.ts

@@ -18,6 +18,19 @@ export declare class ManagedNftables<TPolicy extends TManagedNftPolicy = IManage
     release(expected: IAppliedManagedNftPolicy<TPolicy>): Promise<{
         released: true;
     }>;
-    /** Join policy operations and owned-table deletion, then native termination; packet/allocation fencing belongs to the caller. */
+    /** Permanently selects retention cleanup, verifies exact PERSIST retention, and
+     * joins the native process. Retain the full applied value before this call.
+     * After any failure close() only terminates; it never deletes the table. */
+    detach(expected: IAppliedManagedNftPolicy<TPolicy>): Promise<{
+        detached: true;
+    }>;
+    /** Terminal no-delete cleanup when the exact applied result is unavailable.
+     * Joins admitted operations and the child, without inspecting or acknowledging
+     * policy retention, enforcement or release. Persist the original transition
+     * before reconcile; a fresh owner must recover it after ambiguous application.
+     * The first admitted close choice persists across cleanup failures. */
+    closeRetaining(): Promise<void>;
+    /** Join policy operations, then delete and terminate unless retention was selected.
+     * Packet/allocation fencing belongs to the caller; already-admitted close cannot be undone. */
     close(): Promise<void>;
 }

package/dist_ts/classes.managednftables.js

@@ -61,7 +61,12 @@ export class ManagedNftables {
     #state = 'new';
     #work = null;
     #close = null;
+    #closeMode = null;
+    #closeRetainingSelected = false;
     #nativeMayOwn = false;
+    #retaining = false;
+    #detachExpected = null;
+    #detach = null;
     constructor(options) {
         this.#options = snapshot(options);
         if (Object.keys(this.#options).some((key) => !['ownerId', 'instanceId', 'tableName', 'binaryPath', 'networkNamespaceFd'].includes(key))
@@ -78,7 +83,7 @@ export class ManagedNftables {
     get state() { return this.#state; }
     /** Starts only the compiler/IPC owner. The returned idle status is not enforcement. */
     start() {
-        if (this.#state !== 'new')
+        if (this.#state !== 'new' || this.#retaining)
             return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
         this.#state = 'starting';
         const work = (async () => {
@@ -92,7 +97,7 @@ export class ManagedNftables {
                 cliArgs: ['--management', ...(this.#options.networkNamespaceFd === undefined ? [] : ['--network-namespace-fd', '3'])],
                 inheritedFileDescriptors: this.#options.networkNamespaceFd === undefined ? undefined : [this.#options.networkNamespaceFd],
                 readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: 262_144,
-                maxPendingRequestsByMethod: { preparePolicy: 1, openOwner: 1, reconcilePolicy: 1, inspectPolicy: 1, releasePolicy: 1, closeOwner: 1 },
+                maxPendingRequestsByMethod: { preparePolicy: 1, openOwner: 1, reconcilePolicy: 1, inspectPolicy: 1, releasePolicy: 1, detachPolicy: 1, closeOwner: 1 },
             });
             this.#bridge.on('exit', () => {
                 if (!['closing', 'stopped'].includes(this.#state))
@@ -119,17 +124,65 @@ export class ManagedNftables {
     release(expected) {
         return this.#invoke('releasePolicy', expected);
     }
-    /** Join policy operations and owned-table deletion, then native termination; packet/allocation fencing belongs to the caller. */
+    /** Permanently selects retention cleanup, verifies exact PERSIST retention, and
+     * joins the native process. Retain the full applied value before this call.
+     * After any failure close() only terminates; it never deletes the table. */
+    detach(expected) {
+        if (this.#closeRetainingSelected || this.#closeMode === 'delete')
+            return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
+        this.#retaining = true;
+        let captured;
+        try {
+            captured = snapshot(expected);
+            if (this.#detachExpected && !plugins.util.isDeepStrictEqual(this.#detachExpected, captured))
+                throw new ManagedNftablesError('CONFLICT');
+            if (this.#detach)
+                return this.#detach;
+            if (!['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work || this.#close)
+                throw new ManagedNftablesError('UNAVAILABLE');
+            this.#detachExpected = captured;
+        }
+        catch (error) {
+            return Promise.reject(error instanceof ManagedNftablesError ? error : new ManagedNftablesError('INVALID'));
+        }
+        const work = this.#track(this.#bridge.sendCommand('detachPolicy', captured).then((value) => {
+            const result = snapshot(value);
+            if (result?.detached !== true || Object.keys(result).length !== 1)
+                throw new ManagedNftablesError('PROTOCOL');
+            this.#nativeMayOwn = false;
+            return result;
+        }));
+        const detached = (async () => { const result = await work; await this.close(); return result; })();
+        this.#detach = detached;
+        void detached.catch(() => { this.#detach = null; });
+        return detached;
+    }
+    /** Terminal no-delete cleanup when the exact applied result is unavailable.
+     * Joins admitted operations and the child, without inspecting or acknowledging
+     * policy retention, enforcement or release. Persist the original transition
+     * before reconcile; a fresh owner must recover it after ambiguous application.
+     * The first admitted close choice persists across cleanup failures. */
+    closeRetaining() {
+        if (this.#closeMode === 'delete')
+            return Promise.reject(new ManagedNftablesError('CONFLICT'));
+        this.#closeRetainingSelected = true;
+        this.#retaining = true;
+        return this.close();
+    }
+    /** Join policy operations, then delete and terminate unless retention was selected.
+     * Packet/allocation fencing belongs to the caller; already-admitted close cannot be undone. */
     close() {
         if (this.#close)
             return this.#close;
         if (this.#state === 'stopped')
             return Promise.resolve();
+        this.#closeMode ??= this.#retaining ? 'retain' : 'delete';
+        const retaining = this.#closeMode === 'retain';
         this.#state = 'closing';
         this.#close = (async () => {
             await this.#work?.catch(() => undefined);
             if (this.#bridge) {
-                if (this.#nativeMayOwn) {
+                if (this.#nativeMayOwn && !retaining) {
                     const result = await this.#bridge.sendCommand('closeOwner', {});
                     if (result.released !== true)
                         throw new ManagedNftablesError('PROTOCOL');
@@ -146,7 +199,7 @@ export class ManagedNftables {
         return this.#close;
     }
     #invoke(method, params) {
-        if (!['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work)
+        if (this.#retaining || !['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work)
             return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
         let captured;
         try {
@@ -179,4 +232,4 @@ export class ManagedNftables {
         return owned;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5tYW5hZ2VkbmZ0YWJsZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLm1hbmFnZWRuZnRhYmxlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUl4QyxNQUFNLE9BQU8sb0JBQXFCLFNBQVEsS0FBSztJQUM3QyxZQUE0QixJQUFZO1FBQUksS0FBSyxDQUFDLG9CQUFvQixJQUFJLEdBQUcsQ0FBQyxDQUFDO1FBQW5ELFNBQUksR0FBSixJQUFJLENBQVE7SUFBd0MsQ0FBQztDQUNsRjtBQUVELG9GQUFvRjtBQUNwRixNQUFNLFVBQVUsUUFBUSxDQUFJLEtBQVE7SUFDbEMsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsSUFBSSxXQUFXLEdBQUcsQ0FBQyxDQUFDO0lBQ3BCLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBYSxFQUFVLEVBQUU7UUFDdkMsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLE9BQU8sSUFBSSxDQUFDLFdBQVcsSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsT0FBTztZQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM3SCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBYyxFQUFFLEtBQWEsRUFBVyxFQUFFO1FBQ3RELElBQUksRUFBRSxLQUFLLEdBQUcsTUFBTSxJQUFJLEtBQUssR0FBRyxFQUFFO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzlFLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtZQUFFLE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3BELElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssS0FBSyxTQUFTO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDL0QsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUMzRSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzlHLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbkMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzdILE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDcEMsSUFBSSxJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sR0FBRyxLQUFLO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzVFLEtBQUssTUFBTSxHQUFHLElBQUksSUFBSTtZQUFFLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtnQkFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDakUsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUFDLHlCQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzVELE1BQU0sTUFBTSxHQUF3QyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3BFLElBQUksS0FBSyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQU0sS0FBbUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN4RyxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3ZCLElBQUksS0FBSyxJQUFJLEdBQUcsS0FBSyxRQUFRO2dCQUFFLFNBQVM7WUFDeEMsTUFBTSxVQUFVLEdBQUcsV0FBVyxDQUFDLEdBQWEsQ0FBQyxDQUFDO1lBQzlDLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsSUFBSSxDQUFDLENBQUMsT0FBTyxJQUFJLFVBQVUsQ0FBQzttQkFDNUUsS0FBSyxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztnQkFBRSxNQUFNLElBQUksb0JBQW9CLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDeEYsTUFBTSxDQUFDLGNBQWMsQ0FBQyxNQUFNLEVBQUUsR0FBRyxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDekksQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUMsQ0FBQztJQUNGLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFNLENBQUM7SUFDbkMsSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxPQUFPO1FBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRCxzR0FBc0c7QUFDdEcsTUFBTSxPQUFPLGVBQWU7SUFDakIsUUFBUSxDQUErQjtJQUNoRCxPQUFPLEdBQXNFLElBQUksQ0FBQztJQUNsRixNQUFNLEdBQTBFLEtBQUssQ0FBQztJQUN0RixLQUFLLEdBQTRCLElBQUksQ0FBQztJQUN0QyxNQUFNLEdBQXlCLElBQUksQ0FBQztJQUNwQyxhQUFhLEdBQUcsS0FBSyxDQUFDO0lBRXRCLFlBQVksT0FBMkI7UUFDckMsSUFBSSxDQUFDLFFBQVEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbEMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsb0JBQW9CLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7ZUFDbEksQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksdUJBQXVCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO2VBQzlKLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDO2VBQ3BGLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFLLFNBQVMsSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQy9JLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM1QyxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixLQUFLLFNBQVMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEtBQUssT0FBTztlQUM5RSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEdBQUcsQ0FBQztlQUMzRixJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixHQUFHLFdBQVcsQ0FBQztZQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBRUQsSUFBVyxLQUFLLEtBQWEsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUVsRCx1RkFBdUY7SUFDaEYsS0FBSztRQUNWLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxLQUFLO1lBQUUsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksb0JBQW9CLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztRQUMxRixJQUFJLENBQUMsTUFBTSxHQUFHLFVBQVUsQ0FBQztRQUN6QixNQUFNLElBQUksR0FBRyxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ3ZCLElBQUksT0FBTyxDQUFDLFFBQVEsS0FBSyxPQUFPLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztnQkFBRSxNQUFNLElBQUksb0JBQW9CLENBQUMsc0JBQXNCLENBQUMsQ0FBQztZQUNySSxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3hFLElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBK0I7Z0JBQzVFLFVBQVUsRUFBRSxlQUFlLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVTt1QkFDNUQsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFdBQVcsRUFBRSx1QkFBdUIsT0FBTyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsT0FBTyxPQUFPLENBQUM7Z0JBQ25ILFVBQVUsRUFBRSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsS0FBSztnQkFDdkMsT0FBTyxFQUFFLENBQUMsY0FBYyxFQUFFLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLHdCQUF3QixFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQ3JILHdCQUF3QixFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQztnQkFDekgsY0FBYyxFQUFFLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLEVBQUUsY0FBYyxFQUFFLE9BQU87Z0JBQ3ZFLDBCQUEwQixFQUFFLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxFQUFFLGVBQWUsRUFBRSxDQUFDLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLFVBQVUsRUFBRSxDQUFDLEVBQUU7YUFDdEksQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRTtnQkFDM0IsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO29CQUFFLElBQUksQ0FBQyxNQUFNLEdBQUcsY0FBYyxDQUFDO1lBQ2xGLENBQUMsQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUU7Z0JBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQy9FLE1BQU0sRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBRSxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUM7WUFDekQsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsV0FBVyxFQUFFLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDekcsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFVBQVU7Z0JBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQzlFLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDO1lBQUMsT0FBTyxNQUFNLENBQUM7UUFDdkMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNMLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUMzQixDQUFDO0lBRU0sT0FBTyxDQUFDLE1BQWU7UUFDNUIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQ00sU0FBUyxDQUFDLFVBQTBDO1FBQ3pELE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBQ00sT0FBTyxLQUEwQyxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsZUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1RixPQUFPLENBQUMsUUFBMkM7UUFDeEQsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLGVBQWUsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBRUQsaUlBQWlJO0lBQzFILEtBQUs7UUFDVixJQUFJLElBQUksQ0FBQyxNQUFNO1lBQUUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDO1FBQ3BDLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTO1lBQUUsT0FBTyxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDeEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUM7UUFDeEIsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ3hCLE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDekMsSUFBSSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2pCLElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO29CQUN2QixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsQ0FBQztvQkFDaEUsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLElBQUk7d0JBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFVBQVUsQ0FBQyxDQUFDO2dCQUMzRSxDQUFDO2dCQUNELE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUN4RCxDQUFDO1lBQ0QsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFBQyxJQUFJLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztRQUMvQyxDQUFDLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUU7WUFDZCxJQUFJLENBQUMsTUFBTSxHQUFHLGNBQWMsQ0FBQztZQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO1lBQ2pELE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQ3hELENBQUMsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxPQUFPLENBQStDLE1BQVMsRUFBRSxNQUFpRDtRQUNoSCxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLElBQUksSUFBSSxDQUFDLEtBQUs7WUFBRSxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3BKLElBQUksUUFBbUQsQ0FBQztRQUN4RCxJQUFJLENBQUM7WUFBQyxRQUFRLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUFDLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFBQyxDQUFDO1FBQzFHLElBQUksTUFBTSxLQUFLLGlCQUFpQixJQUFJLE1BQU0sS0FBSyxlQUFlO1lBQUUsSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJLENBQUM7UUFDMUYsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRTtZQUM1RSxNQUFNLGNBQWMsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDeEMsSUFBSSxNQUFNLEtBQUssZUFBZTtnQkFBRSxJQUFJLENBQUMsYUFBYSxHQUFHLEtBQUssQ0FBQztZQUMzRCxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLENBQUMsTUFBTSxLQUFLLGlCQUFpQixJQUFJLE1BQU0sS0FBSyxlQUFlO21CQUN2RixNQUFNLEtBQUssZUFBZSxJQUFLLGNBQTZDLENBQUMsS0FBSyxLQUFLLElBQUksQ0FBQztnQkFBRSxJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQztZQUN6SCxPQUFPLGNBQWMsQ0FBQztRQUN4QixDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUNELE1BQU0sQ0FBSSxJQUFnQjtRQUN4QixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDakMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVM7Z0JBQUUsSUFBSSxDQUFDLE1BQU0sR0FBRyxjQUFjLENBQUM7WUFDNUQsTUFBTSxJQUFJLEdBQUcsS0FBSyxZQUFZLE9BQU8sQ0FBQyxTQUFTLENBQUMsc0JBQXNCLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1lBQzdHLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksZ0JBQWdCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ2pILENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUM7UUFDbkIsS0FBSyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDNUUsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5tYW5hZ2VkbmZ0YWJsZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLm1hbmFnZWRuZnRhYmxlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUl4QyxNQUFNLE9BQU8sb0JBQXFCLFNBQVEsS0FBSztJQUM3QyxZQUE0QixJQUFZO1FBQUksS0FBSyxDQUFDLG9CQUFvQixJQUFJLEdBQUcsQ0FBQyxDQUFDO1FBQW5ELFNBQUksR0FBSixJQUFJLENBQVE7SUFBd0MsQ0FBQztDQUNsRjtBQUVELG9GQUFvRjtBQUNwRixNQUFNLFVBQVUsUUFBUSxDQUFJLEtBQVE7SUFDbEMsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsSUFBSSxXQUFXLEdBQUcsQ0FBQyxDQUFDO0lBQ3BCLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBYSxFQUFVLEVBQUU7UUFDdkMsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLE9BQU8sSUFBSSxDQUFDLFdBQVcsSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsT0FBTztZQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM3SCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBYyxFQUFFLEtBQWEsRUFBVyxFQUFFO1FBQ3RELElBQUksRUFBRSxLQUFLLEdBQUcsTUFBTSxJQUFJLEtBQUssR0FBRyxFQUFFO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzlFLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtZQUFFLE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3BELElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssS0FBSyxTQUFTO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDL0QsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUMzRSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzlHLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbkMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzdILE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDcEMsSUFBSSxJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sR0FBRyxLQUFLO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzVFLEtBQUssTUFBTSxHQUFHLElBQUksSUFBSTtZQUFFLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtnQkFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDakUsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUFDLHlCQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzVELE1BQU0sTUFBTSxHQUF3QyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3BFLElBQUksS0FBSyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQU0sS0FBbUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN4RyxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3ZCLElBQUksS0FBSyxJQUFJLEdBQUcsS0FBSyxRQUFRO2dCQUFFLFNBQVM7WUFDeEMsTUFBTSxVQUFVLEdBQUcsV0FBVyxDQUFDLEdBQWEsQ0FBQyxDQUFDO1lBQzlDLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsSUFBSSxDQUFDLENBQUMsT0FBTyxJQUFJLFVBQVUsQ0FBQzttQkFDNUUsS0FBSyxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztnQkFBRSxNQUFNLElBQUksb0JBQW9CLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDeEYsTUFBTSxDQUFDLGNBQWMsQ0FBQyxNQUFNLEVBQUUsR0FBRyxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDekksQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUMsQ0FBQztJQUNGLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFNLENBQUM7SUFDbkMsSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxPQUFPO1FBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRCxzR0FBc0c7QUFDdEcsTUFBTSxPQUFPLGVBQWU7SUFDakIsUUFBUSxDQUErQjtJQUNoRCxPQUFPLEdBQXNFLElBQUksQ0FBQztJQUNsRixNQUFNLEdBQTBFLEtBQUssQ0FBQztJQUN0RixLQUFLLEdBQTRCLElBQUksQ0FBQztJQUN0QyxNQUFNLEdBQXlCLElBQUksQ0FBQztJQUNwQyxVQUFVLEdBQStCLElBQUksQ0FBQztJQUM5Qyx1QkFBdUIsR0FBRyxLQUFLLENBQUM7SUFDaEMsYUFBYSxHQUFHLEtBQUssQ0FBQztJQUN0QixVQUFVLEdBQUcsS0FBSyxDQUFDO0lBQ25CLGVBQWUsR0FBNkMsSUFBSSxDQUFDO0lBQ2pFLE9BQU8sR0FBdUMsSUFBSSxDQUFDO0lBRW5ELFlBQVksT0FBMkI7UUFDckMsSUFBSSxDQUFDLFFBQVEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbEMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsb0JBQW9CLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7ZUFDbEksQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksdUJBQXVCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO2VBQzlKLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDO2VBQ3BGLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFLLFNBQVMsSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQy9JLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM1QyxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixLQUFLLFNBQVMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEtBQUssT0FBTztlQUM5RSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEdBQUcsQ0FBQztlQUMzRixJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixHQUFHLFdBQVcsQ0FBQztZQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBRUQsSUFBVyxLQUFLLEtBQWEsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUVsRCx1RkFBdUY7SUFDaEYsS0FBSztRQUNWLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLFVBQVU7WUFBRSxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQzdHLElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDdkIsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDO2dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1lBQ3JJLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLElBQUksR0FBRyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDeEUsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUErQjtnQkFDNUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVO3VCQUM1RCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLHVCQUF1QixPQUFPLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLE9BQU8sQ0FBQztnQkFDbkgsVUFBVSxFQUFFLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxLQUFLO2dCQUN2QyxPQUFPLEVBQUUsQ0FBQyxjQUFjLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsd0JBQXdCLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztnQkFDckgsd0JBQXdCLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixDQUFDO2dCQUN6SCxjQUFjLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLE1BQU0sRUFBRSxjQUFjLEVBQUUsT0FBTztnQkFDdkUsMEJBQTBCLEVBQUUsRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLFNBQVMsRUFBRSxDQUFDLEVBQUUsZUFBZSxFQUFFLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsWUFBWSxFQUFFLENBQUMsRUFBRSxVQUFVLEVBQUUsQ0FBQyxFQUFFO2FBQ3ZKLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxHQUFHLEVBQUU7Z0JBQzNCLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQztvQkFBRSxJQUFJLENBQUMsTUFBTSxHQUFHLGNBQWMsQ0FBQztZQUNsRixDQUFDLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFO2dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUMvRSxNQUFNLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDO1lBQ3pELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLFdBQVcsRUFBRSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3pHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxVQUFVO2dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUM5RSxJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQztZQUFDLE9BQU8sTUFBTSxDQUFDO1FBQ3ZDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDTCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDM0IsQ0FBQztJQUVNLE9BQU8sQ0FBQyxNQUFlO1FBQzVCLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxlQUFlLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUNNLFNBQVMsQ0FBQyxVQUEwQztRQUN6RCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNNLE9BQU8sS0FBMEMsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLGVBQWUsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUYsT0FBTyxDQUFDLFFBQTJDO1FBQ3hELE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxlQUFlLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUVEOztnRkFFNEU7SUFDckUsTUFBTSxDQUFDLFFBQTJDO1FBQ3ZELElBQUksSUFBSSxDQUFDLHVCQUF1QixJQUFJLElBQUksQ0FBQyxVQUFVLEtBQUssUUFBUTtZQUFFLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLG9CQUFvQixDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7UUFDakksSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUM7UUFDdkIsSUFBSSxRQUEyQyxDQUFDO1FBQ2hELElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDOUIsSUFBSSxJQUFJLENBQUMsZUFBZSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLFFBQVEsQ0FBQztnQkFBRSxNQUFNLElBQUksb0JBQW9CLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDeEksSUFBSSxJQUFJLENBQUMsT0FBTztnQkFBRSxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUM7WUFDdEMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxJQUFJLElBQUksQ0FBQyxLQUFLLElBQUksSUFBSSxDQUFDLE1BQU07Z0JBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQ2xKLElBQUksQ0FBQyxlQUFlLEdBQUcsUUFBUSxDQUFDO1FBQ2xDLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQUMsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssWUFBWSxvQkFBb0IsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFBQyxDQUFDO1FBQy9ILE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsY0FBYyxFQUFFLFFBQVEsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1lBQ3pGLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMvQixJQUFJLE1BQU0sRUFBRSxRQUFRLEtBQUssSUFBSSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7Z0JBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQzlHLElBQUksQ0FBQyxhQUFhLEdBQUcsS0FBSyxDQUFDO1lBQzNCLE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDSixNQUFNLFFBQVEsR0FBRyxDQUFDLEtBQUssSUFBSSxFQUFFLEdBQUcsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLE9BQU8sTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNuRyxJQUFJLENBQUMsT0FBTyxHQUFHLFFBQVEsQ0FBQztRQUN4QixLQUFLLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNwRCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRUQ7Ozs7MkVBSXVFO0lBQ2hFLGNBQWM7UUFDbkIsSUFBSSxJQUFJLENBQUMsVUFBVSxLQUFLLFFBQVE7WUFBRSxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQzlGLElBQUksQ0FBQyx1QkFBdUIsR0FBRyxJQUFJLENBQUM7UUFDcEMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUM7UUFDdkIsT0FBTyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDdEIsQ0FBQztJQUVEO21HQUMrRjtJQUN4RixLQUFLO1FBQ1YsSUFBSSxJQUFJLENBQUMsTUFBTTtZQUFFLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUNwQyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUztZQUFFLE9BQU8sT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3hELElBQUksQ0FBQyxVQUFVLEtBQUssSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUM7UUFDMUQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFVBQVUsS0FBSyxRQUFRLENBQUM7UUFDL0MsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUM7UUFDeEIsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ3hCLE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDekMsSUFBSSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2pCLElBQUksSUFBSSxDQUFDLGFBQWEsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO29CQUNyQyxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsQ0FBQztvQkFDaEUsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLElBQUk7d0JBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFVBQVUsQ0FBQyxDQUFDO2dCQUMzRSxDQUFDO2dCQUNELE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUN4RCxDQUFDO1lBQ0QsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFBQyxJQUFJLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztRQUMvQyxDQUFDLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUU7WUFDZCxJQUFJLENBQUMsTUFBTSxHQUFHLGNBQWMsQ0FBQztZQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO1lBQ2pELE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQ3hELENBQUMsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxPQUFPLENBQStDLE1BQVMsRUFBRSxNQUFpRDtRQUNoSCxJQUFJLElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxjQUFjLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxJQUFJLENBQUMsS0FBSztZQUFFLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLG9CQUFvQixDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7UUFDdkssSUFBSSxRQUFtRCxDQUFDO1FBQ3hELElBQUksQ0FBQztZQUFDLFFBQVEsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7UUFBQyxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQUMsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksb0JBQW9CLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUFDLENBQUM7UUFDMUcsSUFBSSxNQUFNLEtBQUssaUJBQWlCLElBQUksTUFBTSxLQUFLLGVBQWU7WUFBRSxJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQztRQUMxRixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFO1lBQzVFLE1BQU0sY0FBYyxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUN4QyxJQUFJLE1BQU0sS0FBSyxlQUFlO2dCQUFFLElBQUksQ0FBQyxhQUFhLEdBQUcsS0FBSyxDQUFDO1lBQzNELElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksQ0FBQyxNQUFNLEtBQUssaUJBQWlCLElBQUksTUFBTSxLQUFLLGVBQWU7bUJBQ3ZGLE1BQU0sS0FBSyxlQUFlLElBQUssY0FBNkMsQ0FBQyxLQUFLLEtBQUssSUFBSSxDQUFDO2dCQUFFLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDO1lBQ3pILE9BQU8sY0FBYyxDQUFDO1FBQ3hCLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBQ0QsTUFBTSxDQUFJLElBQWdCO1FBQ3hCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRTtZQUNqQyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUztnQkFBRSxJQUFJLENBQUMsTUFBTSxHQUFHLGNBQWMsQ0FBQztZQUM1RCxNQUFNLElBQUksR0FBRyxLQUFLLFlBQVksT0FBTyxDQUFDLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7WUFDN0csTUFBTSxJQUFJLG9CQUFvQixDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDakgsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNuQixLQUFLLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM1RSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7Q0FDRiJ9

package/dist_ts/managed.types.d.ts

@@ -53,7 +53,7 @@ export interface IManagedNftTransition<TPolicy extends TManagedNftPolicy = IMana
 }
 export interface IManagedNftStatus<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
     identity: IManagedNftIdentity;
-    state: 'idle' | 'applied' | 'failed-owned' | 'released';
+    state: 'idle' | 'applied' | 'failed-owned' | 'released' | 'retained';
     enforced: boolean;
     applied: IAppliedManagedNftPolicy<TPolicy> | null;
     pending: IManagedNftTransition<TPolicy> | null;
@@ -96,6 +96,12 @@ export type TManagedNftCommands<TPolicy extends TManagedNftPolicy = IManagedNftP
             released: true;
         };
     };
+    detachPolicy: {
+        params: IAppliedManagedNftPolicy<TPolicy>;
+        result: {
+            detached: true;
+        };
+    };
     closeOwner: {
         params: Record<string, never>;
         result: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -113,7 +113,9 @@ grants remain outstanding.
 | `reconcile({ previous, target })` | Creates or replaces the entire policy in one kernel transaction. `previous` is null initially, otherwise the full prior applied result. |
 | `inspect()` | Reads the current owned graph and reports `enforced`, pending intent and a bounded error code. |
 | `release(applied)` | Verifies the exact retained graph and confirms deletion; repeats are idempotent. |
-| `close()` | Stops command admission, joins admitted policy operations, confirms owned-table deletion, then joins the native process. Failure retains the owner for explicit recovery. |
+| `detach(applied)` | Selects terminal retention, verifies the same graph with PERSIST-only flags after dropping socket ownership, then joins the native process. Returns `{ detached: true }`; retain the full applied result. |
+| `closeRetaining()` | Stops command admission, joins admitted operations and terminates the native process without requesting deletion or confirming retention. Use when the exact applied result is unavailable. |
+| `close()` | Stops command admission, joins admitted policy operations, confirms owned-table deletion unless retention was selected, then joins the native process. Failure retains the owner for explicit recovery. |
 
 Schema-v1 policies are directed. Return traffic requires its own grant; there is no broad
 connection-tracking bypass. A null endpoint denotes the actual local host, with an
@@ -154,6 +156,48 @@ invalidates the old boot receipt; the caller must fence its old link/workload
 lifecycle before starting a new owner instance. Cleanup failures and uncertain
 operations must not be reported as successful release or used to transfer authority.
 
+For an orderly restart that must preserve policy, persist the complete applied
+result and call `await owner.detach(applied)` before calling `close()`. The native
+operation validates the exact receipt, graph, interfaces, boot and namespace. It
+accepts this socket's OWNER/PERSIST table or an exact orphan; it never adopts a
+foreign owner. After closing the owner socket it reads the graph again and requires
+the same handle and compiled body with PERSIST-only flags. Native inspection then
+reports `state: 'retained'`. The facade returns success only after child termination.
+
+Calling `detach()` irreversibly selects retention cleanup, including invalid input,
+transport failure, timeout, native rejection or malformed acknowledgement. Subsequent
+`close()` only joins and terminates; it never sends a table-deletion command. It
+cannot undo a `close()` already admitted earlier. Other policy operations reject.
+Resolve any pending policy transition by exact replay before requesting detachment.
+If a detach ACK is lost while the process remains available, only the same captured
+body may be retried. After process loss, start a fresh owner with identical options
+and retry `detach(applied)` against the exact orphan. Absent graphs, foreign active
+owners, changed interfaces, handles, bodies or boot/namespace identities reject.
+Native release/reconcile/close commands reject after a valid detach intent, even
+when post-drop verification fails; explicit recovery requires the retained body.
+
+If reconciliation remains ambiguous and no complete applied result is available,
+call `await owner.closeRetaining()`. This permanently stops command admission,
+joins admitted work, and terminates and joins the native child without sending
+`detachPolicy` or `closeOwner`. It does not inspect the graph or acknowledge
+retention, enforcement, release, or namespace survival. An undelivered reconcile
+may have left no graph; a lost reply may have left the original or target graph.
+Keep the complete original transition durably and recover it through a fresh owner
+with identical options. Never fabricate an applied receipt to request detachment.
+
+After `closeRetaining()`, all policy commands, including `detach()`, reject.
+Concurrent cleanup calls share the same join. A failed join keeps the native
+owner and retention choice for retry through `closeRetaining()` or `close()`.
+An ordinary `close()` admitted first keeps its deletion choice across failures;
+a later `closeRetaining()` rejects instead of reversing that choice.
+
+Detachment confirms retention at observation time. A completed facade retry returns
+its existing acknowledgement; it is not a fresh kernel inspection. Retention does
+not guarantee future enforcement, namespace survival or reboot ordering, and does
+not withdraw external authority, drain packets, clear conntrack or release leases.
+A separately created owner can later recover the full policy and perform an
+explicit release after the caller has fenced that authority and packet lifecycle.
+
 Apply and release receipts describe this owner's table and policy operations.
 They do not certify that packets admitted under an earlier graph have drained:
 foreign NFQUEUE or other deferred packet owners may still hold such packets.
@@ -201,7 +245,8 @@ kernel reboot. It does not fence foreign packet queues, later packet rewrites,
 offloads or proxies, and supplies no quarantine release, conntrack drainage or
 allocation-reuse evidence. Historical leases remain the caller's durable ownership
 responsibility. PERSIST retains this table only while its network namespace exists;
-`close()` still deletes it, so revoke any external protection claim before release.
+`release()` and ordinary `close()` delete it, so revoke any external protection
+claim before release, or use the verified retention operation described above.
 
 Local bindings include name, index, kind, MAC (null for L3 TUN), interface-link
 index, and required IPv4 addresses. RTM_GETLINK/RTM_GETADDR verify those local

package/rust/src/main.rs

@@ -91,6 +91,10 @@ fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_
                 .release(decode(request.params)?)?;
             Ok(serde_json::json!({"released":true}))
         }
+        "detachPolicy" => {
+            owner.as_mut().ok_or(Error::Conflict)?.detach(decode(request.params)?)?;
+            Ok(serde_json::json!({"detached":true}))
+        }
         "closeOwner" => {
             if decode::<serde_json::Value>(request.params)? != serde_json::json!({}) {
                 return Err(Error::Invalid);

package/rust/src/owner.detach.rs

@@ -0,0 +1,73 @@
+use super::*;
+
+impl Owner {
+    /// Terminal retention, never adoption/deletion. Exact retry may observe an
+    /// orphan after an ACK was lost, including through a fresh native process.
+    pub fn detach(&mut self, expected: Applied) -> Result<()> {
+        self.validate_receipt(&expected)?;
+        if self.released || self.pending.is_some() {
+            return Err(Error::Conflict);
+        }
+        if let Some(retention) = &self.retention {
+            if retention.expected != expected {
+                return Err(Error::Conflict);
+            }
+        } else {
+            self.retention = Some(Retention {
+                expected: expected.clone(),
+                confirmed: false,
+            });
+        }
+        let result = (|| {
+            self.verify_retention(&expected, false)?;
+            // OWNER disappears with this socket; PERSIST must retain exactly
+            // the same table. The fresh verification socket never adopts it.
+            self.socket = None;
+            self.verify_retention(&expected, true)?;
+            self.socket = None;
+            Ok(())
+        })();
+        self.retention.as_mut().unwrap().confirmed = result.is_ok();
+        match result {
+            Ok(()) => {
+                self.applied = Some(expected);
+                self.error = None;
+                Ok(())
+            }
+            Err(error) => {
+                self.error = Some(error);
+                Err(error)
+            }
+        }
+    }
+
+    fn verify_retention(&mut self, expected: &Applied, orphan_only: bool) -> Result<()> {
+        let graph = self.graph()?.ok_or(Error::Conflict)?;
+        self.binding(&graph, Some(expected))?;
+        let flags = wire::number(&graph.table, 2)?;
+        if (orphan_only && flags != 4)
+            || (flags == 6 && wire::number(&graph.table, 7)? != self.socket()?.port)
+            || !self.matches(&graph, &expected.prepared)?
+        {
+            return Err(Error::Conflict);
+        }
+        expected.prepared.validate_interfaces()
+    }
+
+    pub(super) fn inspect_retained(&mut self) -> Status {
+        let expected = self.retention.as_ref().unwrap().expected.clone();
+        if let Err(error) = self.verify_retention(&expected, true) {
+            self.retention.as_mut().unwrap().confirmed = false;
+            self.error = Some(error);
+        }
+        let enforced = self.retention.as_ref().unwrap().confirmed && self.error.is_none();
+        Status {
+            identity: self.identity.clone(),
+            state: if enforced { "retained" } else { "failed-owned" }.into(),
+            enforced,
+            applied: self.applied.clone(),
+            pending: self.pending.clone(),
+            error: self.error.map(|error| error.code().into()),
+        }
+    }
+}

package/rust/src/owner.rs

@@ -68,8 +68,17 @@ pub struct Owner {
     pending: Option<Transition>,
     error: Option<Error>,
     released: bool,
+    retention: Option<Retention>,
 }
 
+struct Retention {
+    expected: Applied,
+    confirmed: bool,
+}
+
+#[path = "owner.detach.rs"]
+mod detach;
+
 pub(crate) fn context() -> Result<(String, String, String)> {
     let boot = std::fs::read_to_string("/proc/sys/kernel/random/boot_id")
         .map_err(|_| Error::Unavailable)?
@@ -154,6 +163,7 @@ impl Owner {
             pending: None,
             error: None,
             released: false,
+            retention: None,
         })
     }
     fn socket(&mut self) -> Result<&mut Socket> {
@@ -350,7 +360,7 @@ impl Owner {
         })
     }
     pub fn reconcile(&mut self, transition: Transition) -> Result<Applied> {
-        if self.released {
+        if self.released || self.retention.is_some() {
             return Err(Error::Conflict);
         }
         transition.target.validate()?;
@@ -453,6 +463,9 @@ impl Owner {
         self.applied(&graph, transition.target.clone())
     }
     pub fn inspect(&mut self) -> Status {
+        if self.retention.is_some() {
+            return self.inspect_retained();
+        }
         let mut enforced = false;
         if let Some(applied) = self.applied.clone().filter(|_| !self.released) {
             match self.graph().and_then(|graph| {
@@ -490,6 +503,9 @@ impl Owner {
         }
     }
     pub fn release(&mut self, expected: Applied) -> Result<()> {
+        if self.retention.is_some() {
+            return Err(Error::Conflict);
+        }
         self.validate_receipt(&expected)?;
         if self.pending.is_some() {
             return Err(Error::Conflict);
@@ -545,6 +561,9 @@ impl Owner {
         }
     }
     pub fn close(&mut self) -> Result<()> {
+        if self.retention.is_some() {
+            return Err(Error::Conflict);
+        }
         if self.released {
             return Ok(());
         }

package/rust/src/owner_detach_tests.rs

@@ -0,0 +1,252 @@
+use super::namespace_tests::NativeOwner;
+use super::*;
+use crate::egress;
+use serde_json::json;
+use std::io::Write;
+use std::time::{Duration, Instant};
+
+fn pool_target(revision: u64) -> Prepared {
+    let mut policy = egress::tests::pool_guard();
+    policy["revision"] = json!(revision);
+    serde_json::from_value::<egress::Policy>(policy)
+        .unwrap()
+        .prepare()
+        .unwrap()
+        .into()
+}
+fn apply(name: &str) -> (Owner, Applied) {
+    let mut owner = Owner::new(options(name)).unwrap();
+    let applied = owner
+        .reconcile(Transition {
+            previous: None,
+            target: pool_target(1),
+        })
+        .unwrap();
+    (owner, applied)
+}
+fn retained(owner: &mut Owner, applied: &Applied) {
+    let status = owner.inspect();
+    assert_eq!(status.state, "retained");
+    assert!(status.enforced);
+    assert_eq!(status.applied, Some(applied.clone()));
+    let graph = owner.graph().unwrap().unwrap();
+    assert_eq!(wire::number(&graph.table, 2).unwrap(), 4);
+    assert_eq!(
+        wire::handle(&graph.table, 4).unwrap().to_string(),
+        applied.receipt.table_handle
+    );
+    assert!(owner.matches(&graph, &applied.prepared).unwrap());
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn detach_retains_exact_graph_is_terminal_and_replays_without_adoption() {
+    isolated();
+    let (mut owner, applied) = apply("detach_replay");
+    owner.detach(applied.clone()).unwrap();
+    retained(&mut owner, &applied);
+    owner.detach(applied.clone()).unwrap();
+    assert_eq!(owner.close(), Err(Error::Conflict));
+    assert_eq!(owner.release(applied.clone()), Err(Error::Conflict));
+    assert_eq!(
+        owner.reconcile(Transition {
+            previous: Some(applied.clone()),
+            target: pool_target(2)
+        }),
+        Err(Error::Conflict)
+    );
+    let mut different = applied.clone();
+    different.prepared = pool_target(2);
+    different.receipt.revision = 2;
+    different.receipt.digest = different.prepared.digest.clone();
+    assert_eq!(owner.detach(different), Err(Error::Conflict));
+    retained(&mut owner, &applied);
+    drop(owner);
+    let mut fresh = Owner::new(options("detach_replay")).unwrap();
+    fresh.detach(applied.clone()).unwrap();
+    retained(&mut fresh, &applied);
+    // A separate active owner invalidates retention inspection. It is never
+    // detached by this reader, even with the same full logical identity.
+    let mut active = Owner::new(options("detach_replay")).unwrap();
+    active
+        .reconcile(Transition {
+            previous: None,
+            target: applied.prepared.clone(),
+        })
+        .unwrap();
+    assert_eq!(fresh.detach(applied.clone()), Err(Error::Conflict));
+    assert!(!fresh.inspect().enforced);
+    assert!(active.inspect().enforced);
+    assert_eq!(fresh.close(), Err(Error::Conflict));
+    drop(active);
+    fresh.detach(applied.clone()).unwrap();
+    retained(&mut fresh, &applied);
+    drop(fresh);
+    Owner::new(options("detach_replay"))
+        .unwrap()
+        .release(applied)
+        .unwrap();
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn detach_rejects_pending_wrong_receipts_foreign_mutation_and_absence() {
+    isolated();
+    let (mut owner, applied) = apply("detach_faults");
+    let pending = Transition {
+        previous: Some(applied.clone()),
+        target: pool_target(2),
+    };
+    owner.pending = Some(pending.clone());
+    assert_eq!(owner.detach(applied.clone()), Err(Error::Conflict));
+    assert!(owner.retention.is_none());
+    let applied = owner.reconcile(pending).unwrap();
+    for field in ["boot", "namespace", "handle", "digest"] {
+        let mut invalid = applied.clone();
+        match field {
+            "boot" => {
+                invalid.receipt.identity.boot_id = "00000000-0000-0000-0000-000000000000".into()
+            }
+            "namespace" => invalid.receipt.identity.namespace_inode = "0".into(),
+            "handle" => invalid.receipt.table_handle = "18446744073709551615".into(),
+            _ => invalid.receipt.digest = format!("sha256:{}", "0".repeat(64)),
+        }
+        let mut reader = Owner::new(options("detach_faults")).unwrap();
+        assert_eq!(reader.detach(invalid), Err(Error::Conflict));
+        assert!(owner.inspect().enforced);
+    }
+    owner.detach(applied.clone()).unwrap();
+    // Mutation after detachment is observed on exact retry and permanently
+    // retains the failed owner. No failure cleanup adopts or deletes the graph.
+    let mut foreign = Socket::open().unwrap();
+    let generation = foreign.generation().unwrap();
+    foreign
+        .batch(
+            generation,
+            vec![(
+                3,
+                0x600,
+                vec![
+                    Attr::string(1, "snft_detach_faults"),
+                    Attr::string(3, "foreign"),
+                ],
+            )],
+        )
+        .unwrap();
+    assert_eq!(owner.detach(applied.clone()), Err(Error::Conflict));
+    assert!(!owner.inspect().enforced);
+    assert_eq!(owner.close(), Err(Error::Conflict));
+    assert_eq!(owner.release(applied.clone()), Err(Error::Conflict));
+    assert!(owner
+        .graph()
+        .unwrap()
+        .unwrap()
+        .chains
+        .iter()
+        .any(|chain| wire::text(chain, 3).unwrap() == "foreign"));
+    drop(owner);
+    // This disposable fixture's foreign owner deletes only its exact orphan.
+    let generation = foreign.generation().unwrap();
+    foreign
+        .batch(
+            generation,
+            vec![(2, 0, vec![Attr::string(1, "snft_detach_faults")])],
+        )
+        .unwrap();
+    let mut absent = Owner::new(options("detach_faults")).unwrap();
+    assert_eq!(absent.detach(applied), Err(Error::Conflict));
+    assert!(!absent.inspect().enforced);
+    assert_eq!(absent.close(), Err(Error::Conflict));
+    assert!(absent.graph().unwrap().is_none());
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn detach_rechecks_interface_bindings_without_releasing_on_drift() {
+    isolated();
+    let endpoint = endpoint("a", 71);
+    let policy = crate::policy::Policy {
+        schema_version: 1,
+        revision: 1,
+        endpoints: vec![endpoint],
+        rules: vec![],
+    };
+    let mut owner = Owner::new(options("detach_links")).unwrap();
+    let applied = owner
+        .reconcile(Transition {
+            previous: None,
+            target: policy.prepare().unwrap().into(),
+        })
+        .unwrap();
+    ip(&["link", "set", "worka", "name", "renameda"]);
+    assert_eq!(owner.detach(applied.clone()), Err(Error::Conflict));
+    assert_eq!(owner.close(), Err(Error::Conflict));
+    let graph = owner.graph().unwrap().unwrap();
+    assert_eq!(
+        wire::handle(&graph.table, 4).unwrap().to_string(),
+        applied.receipt.table_handle
+    );
+    ip(&["link", "set", "renameda", "name", "worka"]);
+    owner.detach(applied.clone()).unwrap();
+    retained(&mut owner, &applied);
+    drop(owner);
+    Owner::new(options("detach_links"))
+        .unwrap()
+        .release(applied)
+        .unwrap();
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn detach_recovers_lost_response_and_undelivered_request_across_real_native_processes() {
+    isolated();
+    let namespace = std::fs::File::open("/proc/thread-self/ns/net").unwrap();
+    for delivered in [true, false] {
+        let name = if delivered {
+            "detach_ack"
+        } else {
+            "detach_unsent"
+        };
+        let mut native = NativeOwner::start(&namespace);
+        native.call("openOwner", serde_json::to_value(options(name)).unwrap());
+        let applied: Applied = serde_json::from_value(native.call(
+            "reconcilePolicy",
+            json!({"previous":null,"target":pool_target(1)}),
+        ))
+        .unwrap();
+        let mut reader = Owner::new(options(name)).unwrap();
+        reader.validate_receipt(&applied).unwrap();
+        if delivered {
+            writeln!(
+                native.child.stdin.as_mut().unwrap(),
+                "{}",
+                json!({"id":"lost-detach","method":"detachPolicy","params":applied})
+            )
+            .unwrap();
+            let until = Instant::now() + Duration::from_secs(3);
+            loop {
+                let graph = reader.graph().unwrap().unwrap();
+                if wire::number(&graph.table, 2).unwrap() == 4 {
+                    break;
+                }
+                assert!(Instant::now() < until);
+                std::thread::sleep(Duration::from_millis(5));
+            }
+            // Do not read the detach response: terminate the actual process
+            // after observing its kernel effect but before recording an ACK.
+        }
+        drop(native);
+        let mut fresh = NativeOwner::start(&namespace);
+        fresh.call("openOwner", serde_json::to_value(options(name)).unwrap());
+        assert_eq!(
+            fresh.call("detachPolicy", serde_json::to_value(&applied).unwrap()),
+            json!({"detached":true})
+        );
+        assert_eq!(fresh.call("inspectPolicy", json!({}))["state"], "retained");
+        drop(fresh);
+        let graph = reader.graph().unwrap().unwrap();
+        assert_eq!(wire::number(&graph.table, 2).unwrap(), 4);
+        assert!(reader.matches(&graph, &applied.prepared).unwrap());
+        reader.release(applied).unwrap();
+    }
+}

package/rust/src/owner_namespace_tests.rs

@@ -30,13 +30,13 @@ fn command(namespace: &File) -> Command {
     command
 }
 
-struct NativeOwner {
-    child: Child,
+pub(super) struct NativeOwner {
+    pub(super) child: Child,
     messages: Receiver<Value>,
     reader: Option<JoinHandle<()>>,
 }
 impl NativeOwner {
-    fn start(namespace: &File) -> Self {
+    pub(super) fn start(namespace: &File) -> Self {
         let mut child = command(namespace).spawn().unwrap();
         let output = child.stdout.take().unwrap();
         let (send, messages) = mpsc::channel();
@@ -76,7 +76,7 @@ impl NativeOwner {
         assert_eq!(response["id"], method);
         response
     }
-    fn call(&mut self, method: &str, params: Value) -> Value {
+    pub(super) fn call(&mut self, method: &str, params: Value) -> Value {
         let response = self.response(method, params);
         assert_eq!(response["success"], true, "{response}");
         response["result"].clone()

package/rust/src/owner_poolguard_tests.rs

@@ -234,6 +234,8 @@ fn allocation_pool_guard_covers_all_host_hooks_dnat_untracked_and_reply_directio
             })
             .unwrap();
         assert!(owner.inspect().enforced);
+        owner.detach(applied.clone()).unwrap();
+        assert_eq!(owner.inspect().state, "retained");
         (owner, applied)
     });
     for ((destination, _, _), target) in cases.iter().zip(&targets) {
@@ -254,7 +256,8 @@ fn allocation_pool_guard_covers_all_host_hooks_dnat_untracked_and_reply_directio
     in_namespace(HOST, move || {
         let mut owner = owner;
         assert!(owner.inspect().enforced);
-        owner.release(applied).unwrap();
+        drop(owner);
+        Owner::new(options("pool_traffic")).unwrap().release(applied).unwrap();
     });
     // Positive control after release proves the denials were this guard.
     for ((destination, _, _), target) in cases.iter().zip(&targets) {

package/rust/src/owner_tests.rs

@@ -24,6 +24,9 @@ mod host_traffic_tests;
 #[path = "owner_poolguard_tests.rs"]
 mod poolguard_tests;
 
+#[path = "owner_detach_tests.rs"]
+mod detach_tests;
+
 #[path = "owner_coexistence_tests.rs"]
 mod coexistence_tests;
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '1.7.0',
+  version: '1.9.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/classes.managednftables.ts

@@ -49,7 +49,12 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
   #state: 'new' | 'starting' | 'ready' | 'closing' | 'failed-owned' | 'stopped' = 'new';
   #work: Promise<unknown> | null = null;
   #close: Promise<void> | null = null;
+  #closeMode: 'delete' | 'retain' | null = null;
+  #closeRetainingSelected = false;
   #nativeMayOwn = false;
+  #retaining = false;
+  #detachExpected: IAppliedManagedNftPolicy<TPolicy> | null = null;
+  #detach: Promise<{ detached: true }> | null = null;
 
   constructor(options: IManagedNftOptions) {
     this.#options = snapshot(options);
@@ -68,7 +73,7 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
 
   /** Starts only the compiler/IPC owner. The returned idle status is not enforcement. */
   public start(): Promise<IManagedNftStatus<TPolicy>> {
-    if (this.#state !== 'new') return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
+    if (this.#state !== 'new' || this.#retaining) return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
     this.#state = 'starting';
     const work = (async () => {
       if (process.platform !== 'linux' || !['x64', 'arm64'].includes(process.arch)) throw new ManagedNftablesError('UNSUPPORTED_PLATFORM');
@@ -80,7 +85,7 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
         cliArgs: ['--management', ...(this.#options.networkNamespaceFd === undefined ? [] : ['--network-namespace-fd', '3'])],
         inheritedFileDescriptors: this.#options.networkNamespaceFd === undefined ? undefined : [this.#options.networkNamespaceFd],
         readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: 262_144,
-        maxPendingRequestsByMethod: { preparePolicy: 1, openOwner: 1, reconcilePolicy: 1, inspectPolicy: 1, releasePolicy: 1, closeOwner: 1 },
+        maxPendingRequestsByMethod: { preparePolicy: 1, openOwner: 1, reconcilePolicy: 1, inspectPolicy: 1, releasePolicy: 1, detachPolicy: 1, closeOwner: 1 },
       });
       this.#bridge.on('exit', () => {
         if (!['closing', 'stopped'].includes(this.#state)) this.#state = 'failed-owned';
@@ -105,15 +110,56 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
     return this.#invoke('releasePolicy', expected);
   }
 
-  /** Join policy operations and owned-table deletion, then native termination; packet/allocation fencing belongs to the caller. */
+  /** Permanently selects retention cleanup, verifies exact PERSIST retention, and
+   * joins the native process. Retain the full applied value before this call.
+   * After any failure close() only terminates; it never deletes the table. */
+  public detach(expected: IAppliedManagedNftPolicy<TPolicy>): Promise<{ detached: true }> {
+    if (this.#closeRetainingSelected || this.#closeMode === 'delete') return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
+    this.#retaining = true;
+    let captured: IAppliedManagedNftPolicy<TPolicy>;
+    try {
+      captured = snapshot(expected);
+      if (this.#detachExpected && !plugins.util.isDeepStrictEqual(this.#detachExpected, captured)) throw new ManagedNftablesError('CONFLICT');
+      if (this.#detach) return this.#detach;
+      if (!['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work || this.#close) throw new ManagedNftablesError('UNAVAILABLE');
+      this.#detachExpected = captured;
+    } catch (error) { return Promise.reject(error instanceof ManagedNftablesError ? error : new ManagedNftablesError('INVALID')); }
+    const work = this.#track(this.#bridge.sendCommand('detachPolicy', captured).then((value) => {
+      const result = snapshot(value);
+      if (result?.detached !== true || Object.keys(result).length !== 1) throw new ManagedNftablesError('PROTOCOL');
+      this.#nativeMayOwn = false;
+      return result;
+    }));
+    const detached = (async () => { const result = await work; await this.close(); return result; })();
+    this.#detach = detached;
+    void detached.catch(() => { this.#detach = null; });
+    return detached;
+  }
+
+  /** Terminal no-delete cleanup when the exact applied result is unavailable.
+   * Joins admitted operations and the child, without inspecting or acknowledging
+   * policy retention, enforcement or release. Persist the original transition
+   * before reconcile; a fresh owner must recover it after ambiguous application.
+   * The first admitted close choice persists across cleanup failures. */
+  public closeRetaining(): Promise<void> {
+    if (this.#closeMode === 'delete') return Promise.reject(new ManagedNftablesError('CONFLICT'));
+    this.#closeRetainingSelected = true;
+    this.#retaining = true;
+    return this.close();
+  }
+
+  /** Join policy operations, then delete and terminate unless retention was selected.
+   * Packet/allocation fencing belongs to the caller; already-admitted close cannot be undone. */
   public close(): Promise<void> {
     if (this.#close) return this.#close;
     if (this.#state === 'stopped') return Promise.resolve();
+    this.#closeMode ??= this.#retaining ? 'retain' : 'delete';
+    const retaining = this.#closeMode === 'retain';
     this.#state = 'closing';
     this.#close = (async () => {
       await this.#work?.catch(() => undefined);
       if (this.#bridge) {
-        if (this.#nativeMayOwn) {
+        if (this.#nativeMayOwn && !retaining) {
           const result = await this.#bridge.sendCommand('closeOwner', {});
           if (result.released !== true) throw new ManagedNftablesError('PROTOCOL');
         }
@@ -128,7 +174,7 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
   }
 
   #invoke<K extends keyof TManagedNftCommands<TPolicy>>(method: K, params: TManagedNftCommands<TPolicy>[K]['params']): Promise<TManagedNftCommands<TPolicy>[K]['result']> {
-    if (!['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work) return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
+    if (this.#retaining || !['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work) return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
     let captured: TManagedNftCommands<TPolicy>[K]['params'];
     try { captured = snapshot(params); } catch { return Promise.reject(new ManagedNftablesError('INVALID')); }
     if (method === 'reconcilePolicy' || method === 'releasePolicy') this.#nativeMayOwn = true;

package/ts/managed.types.ts

@@ -62,7 +62,7 @@ export interface IManagedNftTransition<TPolicy extends TManagedNftPolicy = IMana
 
 export interface IManagedNftStatus<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
   identity: IManagedNftIdentity;
-  state: 'idle' | 'applied' | 'failed-owned' | 'released';
+  state: 'idle' | 'applied' | 'failed-owned' | 'released' | 'retained';
   enforced: boolean;
   applied: IAppliedManagedNftPolicy<TPolicy> | null;
   pending: IManagedNftTransition<TPolicy> | null;
@@ -91,5 +91,6 @@ export type TManagedNftCommands<TPolicy extends TManagedNftPolicy = IManagedNftP
   reconcilePolicy: { params: IManagedNftTransition<TPolicy>; result: IAppliedManagedNftPolicy<TPolicy> };
   inspectPolicy: { params: Record<string, never>; result: IManagedNftStatus<TPolicy> };
   releasePolicy: { params: IAppliedManagedNftPolicy<TPolicy>; result: { released: true } };
+  detachPolicy: { params: IAppliedManagedNftPolicy<TPolicy>; result: { detached: true } };
   closeOwner: { params: Record<string, never>; result: { released: true } };
 };