@push.rocks/smartnftables 4.0.1 → 4.2.0

package/changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2026-10-01 - 4.2.0
+
+### Features
+
+- `ManagedDockerForwarding` now admits every forwarded flow the non-exclusive `hostTransit` barrier admits, each with its replies: besides the leased ranges, each inbound publication (uplink to handoff after the barrier's DNAT, matched on its inside destination and its published `hostIp` and port(s) as the original destination) and each symmetric publication's flows from its target ports (handoff to uplink, before the barrier's SNAT). The barrier's forward chain and the contribution derive from one enumeration of the scope's forwarded flows (`HostScope::forwarding`), and the barrier's compiled bytes are unchanged. A router's own egress reaches the host as a leased flow and stays covered by the leased rules. Every flow kind is three rules (NEW with TCP SYN only, ESTABLISHED, ESTABLISHED reply); the native graph check verifies the conntrack original-destination tuple bytes. A scope without publications keeps its exact rules, comments and graphs. The 192-rule and 100,000-byte bound is unchanged, so beside one handoff with a TCP and a UDP range a scope with more than 62 publications, or 31 symmetric ones, is refused as `EXHAUSTED`.
+- `ManagedDockerForwarding.reconcile()` amends a running generation in place: a handoff link that `previous` and `target` both bind exactly may stay up, because the single `iptables-nft-restore` transaction swaps the owned block in one atomic commit. Links the transition adds or drops, and every link of a first apply, must still be down.
+- `ManagedDockerForwarding.release()` and `close()` count a handoff link whose index no link holds any more as down, so a process restarted in the same boot can release the previous contribution after its router namespace and veths are gone. An existing link must still be the exact bound link and down, and reconcile keeps requiring existing links.
+- Add `inspectForwardHooks({ binaryPath?, networkNamespaceFd? })`: a read-only, generation-consistent report of every nf_tables forward base chain of the `ip`, `ip6` and `inet` families with its table handle, priority and policy, of Docker's `DOCKER-USER`/`DOCKER-FORWARD` chains, and of registered legacy xtables tables, so a caller can refuse `exclusiveForwarding` while another forward owner exists. The native binary gains a `--forward-hooks` mode for it.
+
+## 2026-10-01 - 4.1.0
+
+### Features
+
+- Add optional exclusive forwarding to the schema-v2 `hostTransit` scope: `exclusiveForwarding: true` ends the scope's forward chain in one unconditional drop, so the host forwards exactly the scope's leased, published and symmetric handoff flows and their replies, and every other forwarded packet drops, IPv4 and IPv6, on every pair of links, including flows established before the member was applied. It is the host-wide forwarding default-deny that Docker's FORWARD policy DROP used to provide, for hosts where this table is the only forwarding owner: a drop in any table's forward chain is final, so it also denies forwarding other owners accept. With no `handoffs` the scope forwards nothing. The drop is created, verified, adopted, recovered, replaced and released with the table in one batch; this package sets no sysctl. Absent and `false` are the same canonical policy, digest and compiled bytes. `ManagedDockerForwarding.prepare()` refuses an exclusive barrier as `INVALID`, because its drop would deny Docker's own container forwarding.
+
+### Maintenance
+
+- Release tooling currency: `packageManager` `pnpm@12.6.0`, `@git.zone/cli` 8.1.0, `@git.zone/tsrust` 2.0.1 and `@git.zone/tsrun` `^3.0.2`; `@git.zone/tsbuild` 5.0.0 and `@git.zone/tstest` 6.3.2 are already current, and `@types/node` stays at 26.6.2 because 26.6.3 is younger than seven days. tsrust 2 builds only the host architecture in a plain `tsrust`, so the new `build:release` script builds both configured musl targets with `tsrust --configured-targets` and checks the set with `tsrust verify`, and `release.preflight.buildCommand` runs it, so a release still ships the amd64 and arm64 binaries. The 36 lock entries recorded with SHA-1 integrity are restored to the SHA-512 integrity registry.npmjs.org publishes, after each SHA-1 matched the npmjs shasum.
+
 ## 2026-09-28 - 4.0.1
 
 ### Fixes

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "e57ca68c62eeca26010cf3acf5159dd360205566ca1e96189faebffc2d49b0d7",
+  "binarySha256": "5c2f8a063c4d9b145882ca1782151a016adb44940a9a0c99e13cbd5eeea619bb",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.0.1",
-    "gitCommit": "16dff8eb2060592212ea695074d7b53f39be8192",
+    "projectVersion": "4.2.0",
+    "gitCommit": "8d4de9479b77ba7fd1297d895dc5038f65e2f99a",
     "gitDirty": false,
-    "builtAt": "2026-09-28T17:43:55.875Z",
-    "tsrustVersion": "1.15.1",
+    "builtAt": "2026-10-01T20:26:51.965Z",
+    "tsrustVersion": "2.0.1",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"
   }

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "35d2fab639a6bc81cbe8395dc8d2dded56ce16712995007b127018fe0ed5ad20",
+  "binarySha256": "acdccfdbc055aaea30aaf547020585cabfe0a07be6e590794372fbc8950c5f6b",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.0.1",
-    "gitCommit": "16dff8eb2060592212ea695074d7b53f39be8192",
+    "projectVersion": "4.2.0",
+    "gitCommit": "8d4de9479b77ba7fd1297d895dc5038f65e2f99a",
     "gitDirty": false,
-    "builtAt": "2026-09-28T17:44:06.408Z",
-    "tsrustVersion": "1.15.1",
+    "builtAt": "2026-10-01T20:27:00.986Z",
+    "tsrustVersion": "2.0.1",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '4.0.1',
+    version: '4.2.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/classes.manageddockerforwarding.d.ts

@@ -12,6 +12,7 @@ export declare class ManagedDockerForwarding {
     release(expected: IAppliedManagedDockerForwardingPolicy): Promise<{
         released: true;
     }>;
-    /** Join operations and exact contributed-rule deletion, then native termination. Keep affected handoff links down through cleanup. */
+    /** Join operations and exact contributed-rule deletion, then native termination. Keep affected handoff links down
+     * through cleanup; a handoff link that no longer exists counts as down. */
     close(): Promise<void>;
 }

package/dist_ts/classes.manageddockerforwarding.js

@@ -65,7 +65,8 @@ export class ManagedDockerForwarding {
     release(expected) {
         return this.#invoke('releaseDockerForwarding', expected);
     }
-    /** Join operations and exact contributed-rule deletion, then native termination. Keep affected handoff links down through cleanup. */
+    /** Join operations and exact contributed-rule deletion, then native termination. Keep affected handoff links down
+     * through cleanup; a handoff link that no longer exists counts as down. */
     close() {
         if (this.#close)
             return this.#close;
@@ -124,4 +125,4 @@ export class ManagedDockerForwarding {
         return owned;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5tYW5hZ2VkZG9ja2VyZm9yd2FyZGluZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMubWFuYWdlZGRvY2tlcmZvcndhcmRpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFFBQVEsRUFBRSxlQUFlLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFHNUcseUdBQXlHO0FBQ3pHLE1BQU0sT0FBTyx1QkFBdUI7SUFDekIsUUFBUSxDQUE0QztJQUM3RCxPQUFPLEdBQTBFLElBQUksQ0FBQztJQUN0RixNQUFNLEdBQTBFLEtBQUssQ0FBQztJQUN0RixLQUFLLEdBQTRCLElBQUksQ0FBQztJQUN0QyxNQUFNLEdBQXlCLElBQUksQ0FBQztJQUNwQyxhQUFhLEdBQUcsS0FBSyxDQUFDO0lBRXRCLFlBQVksT0FBd0M7UUFDbEQsSUFBSSxDQUFDLFFBQVEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbEMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLEVBQUUsWUFBWSxFQUFFLFlBQVksRUFBRSxvQkFBb0IsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztlQUNySCxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7ZUFDckksSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLEVBQUU7ZUFDcEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLEtBQUssU0FBUyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDL0ksTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzVDLENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEtBQUssU0FBUyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsS0FBSyxPQUFPO2VBQzlFLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsR0FBRyxDQUFDO2VBQzNGLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEdBQUcsV0FBVyxDQUFDO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFFRCxJQUFXLEtBQUssS0FBYSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBRWxELHVGQUF1RjtJQUNoRixLQUFLO1FBQ1YsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLEtBQUs7WUFBRSxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQzFGLElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDdkIsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDO2dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1lBQ3JJLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLElBQUksR0FBRyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDeEUsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFtQztnQkFDaEYsVUFBVSxFQUFFLGVBQWUsRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVO3VCQUM1RCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLHVCQUF1QixPQUFPLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLE9BQU8sQ0FBQztnQkFDbkgsVUFBVSxFQUFFLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxLQUFLO2dCQUN2QyxPQUFPLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyx3QkFBd0IsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO2dCQUM1SCx3QkFBd0IsRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLENBQUM7Z0JBQ3pILGNBQWMsRUFBRSxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxlQUFlO2dCQUMvRSwwQkFBMEIsRUFBRSxFQUFFLHVCQUF1QixFQUFFLENBQUMsRUFBRSxvQkFBb0IsRUFBRSxDQUFDLEVBQUUseUJBQXlCLEVBQUUsQ0FBQyxFQUFFLHVCQUF1QixFQUFFLENBQUMsRUFBRSx1QkFBdUIsRUFBRSxDQUFDLEVBQUUscUJBQXFCLEVBQUUsQ0FBQyxFQUFFO2FBQ3BNLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxHQUFHLEVBQUU7Z0JBQzNCLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQztvQkFBRSxJQUFJLENBQUMsTUFBTSxHQUFHLGNBQWMsQ0FBQztZQUNsRixDQUFDLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFO2dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUMvRSxNQUFNLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUM7WUFDOUMsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsc0JBQXNCLEVBQUUsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3pHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxVQUFVO2dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUM5RSxJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQztZQUFDLE9BQU8sTUFBTSxDQUFDO1FBQ3ZDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDTCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDM0IsQ0FBQztJQUVNLE9BQU8sQ0FBQyxNQUFzQztRQUNuRCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMseUJBQXlCLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNNLFNBQVMsQ0FBQyxVQUE4QztRQUM3RCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsMkJBQTJCLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUNNLE9BQU8sS0FBOEMsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLHlCQUF5QixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMxRyxPQUFPLENBQUMsUUFBK0M7UUFDNUQsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLHlCQUF5QixFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFFRCxzSUFBc0k7SUFDL0gsS0FBSztRQUNWLElBQUksSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUM7UUFDcEMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVM7WUFBRSxPQUFPLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUN4RCxJQUFJLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztRQUN4QixJQUFJLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDeEIsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUN6QyxJQUFJLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDakIsSUFBSSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7b0JBQ3ZCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsdUJBQXVCLEVBQUUsRUFBRSxDQUFDLENBQUM7b0JBQzNFLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxJQUFJO3dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztnQkFDM0UsQ0FBQztnQkFDRCxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7WUFDeEQsQ0FBQztZQUNELElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUM7UUFDL0MsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFO1lBQ2QsSUFBSSxDQUFDLE1BQU0sR0FBRyxjQUFjLENBQUM7WUFBQyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQztZQUNqRCxNQUFNLElBQUksb0JBQW9CLENBQUMscUJBQXFCLENBQUMsQ0FBQztRQUN4RCxDQUFDLENBQUMsQ0FBQztRQUNILE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQztJQUNyQixDQUFDO0lBRUQsT0FBTyxDQUFtRCxNQUFTLEVBQUUsTUFBcUQ7UUFDeEgsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxJQUFJLElBQUksQ0FBQyxLQUFLO1lBQUUsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksb0JBQW9CLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztRQUNwSixJQUFJLFFBQXVELENBQUM7UUFDNUQsSUFBSSxDQUFDO1lBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUFDLENBQUM7UUFBQyxNQUFNLENBQUM7WUFBQyxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUMxRyxJQUFJLE1BQU0sS0FBSywyQkFBMkIsSUFBSSxNQUFNLEtBQUsseUJBQXlCO1lBQUUsSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJLENBQUM7UUFDOUcsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRTtZQUM1RSxNQUFNLGNBQWMsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDeEMsSUFBSSxNQUFNLEtBQUsseUJBQXlCO2dCQUFFLElBQUksQ0FBQyxhQUFhLEdBQUcsS0FBSyxDQUFDO1lBQ3JFLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksQ0FBQyxNQUFNLEtBQUssMkJBQTJCLElBQUksTUFBTSxLQUFLLHlCQUF5QjttQkFDM0csTUFBTSxLQUFLLHlCQUF5QixJQUFLLGNBQWlELENBQUMsS0FBSyxLQUFLLElBQUksQ0FBQztnQkFBRSxJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQztZQUN2SSxPQUFPLGNBQWMsQ0FBQztRQUN4QixDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUNELE1BQU0sQ0FBSSxJQUFnQjtRQUN4QixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDakMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVM7Z0JBQUUsSUFBSSxDQUFDLE1BQU0sR0FBRyxjQUFjLENBQUM7WUFDNUQsTUFBTSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNuQixLQUFLLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM1RSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5tYW5hZ2VkZG9ja2VyZm9yd2FyZGluZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMubWFuYWdlZGRvY2tlcmZvcndhcmRpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFFBQVEsRUFBRSxlQUFlLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFHNUcseUdBQXlHO0FBQ3pHLE1BQU0sT0FBTyx1QkFBdUI7SUFDekIsUUFBUSxDQUE0QztJQUM3RCxPQUFPLEdBQTBFLElBQUksQ0FBQztJQUN0RixNQUFNLEdBQTBFLEtBQUssQ0FBQztJQUN0RixLQUFLLEdBQTRCLElBQUksQ0FBQztJQUN0QyxNQUFNLEdBQXlCLElBQUksQ0FBQztJQUNwQyxhQUFhLEdBQUcsS0FBSyxDQUFDO0lBRXRCLFlBQVksT0FBd0M7UUFDbEQsSUFBSSxDQUFDLFFBQVEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbEMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLEVBQUUsWUFBWSxFQUFFLFlBQVksRUFBRSxvQkFBb0IsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztlQUNySCxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7ZUFDckksSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLEVBQUU7ZUFDcEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLEtBQUssU0FBUyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDL0ksTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzVDLENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEtBQUssU0FBUyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsS0FBSyxPQUFPO2VBQzlFLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsR0FBRyxDQUFDO2VBQzNGLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEdBQUcsV0FBVyxDQUFDO1lBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFFRCxJQUFXLEtBQUssS0FBYSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBRWxELHVGQUF1RjtJQUNoRixLQUFLO1FBQ1YsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLEtBQUs7WUFBRSxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQzFGLElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDdkIsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDO2dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1lBQ3JJLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLElBQUksR0FBRyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDeEUsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFtQztnQkFDaEYsVUFBVSxFQUFFLGVBQWUsRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVO3VCQUM1RCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLHVCQUF1QixPQUFPLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLE9BQU8sQ0FBQztnQkFDbkgsVUFBVSxFQUFFLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxLQUFLO2dCQUN2QyxPQUFPLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyx3QkFBd0IsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO2dCQUM1SCx3QkFBd0IsRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLENBQUM7Z0JBQ3pILGNBQWMsRUFBRSxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxlQUFlO2dCQUMvRSwwQkFBMEIsRUFBRSxFQUFFLHVCQUF1QixFQUFFLENBQUMsRUFBRSxvQkFBb0IsRUFBRSxDQUFDLEVBQUUseUJBQXlCLEVBQUUsQ0FBQyxFQUFFLHVCQUF1QixFQUFFLENBQUMsRUFBRSx1QkFBdUIsRUFBRSxDQUFDLEVBQUUscUJBQXFCLEVBQUUsQ0FBQyxFQUFFO2FBQ3BNLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxHQUFHLEVBQUU7Z0JBQzNCLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQztvQkFBRSxJQUFJLENBQUMsTUFBTSxHQUFHLGNBQWMsQ0FBQztZQUNsRixDQUFDLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFO2dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUMvRSxNQUFNLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUM7WUFDOUMsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsc0JBQXNCLEVBQUUsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3pHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxVQUFVO2dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUM5RSxJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQztZQUFDLE9BQU8sTUFBTSxDQUFDO1FBQ3ZDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDTCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDM0IsQ0FBQztJQUVNLE9BQU8sQ0FBQyxNQUFzQztRQUNuRCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMseUJBQXlCLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNNLFNBQVMsQ0FBQyxVQUE4QztRQUM3RCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsMkJBQTJCLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUNNLE9BQU8sS0FBOEMsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLHlCQUF5QixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMxRyxPQUFPLENBQUMsUUFBK0M7UUFDNUQsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLHlCQUF5QixFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFFRDsrRUFDMkU7SUFDcEUsS0FBSztRQUNWLElBQUksSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUM7UUFDcEMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVM7WUFBRSxPQUFPLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUN4RCxJQUFJLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztRQUN4QixJQUFJLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDeEIsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUN6QyxJQUFJLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDakIsSUFBSSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7b0JBQ3ZCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsdUJBQXVCLEVBQUUsRUFBRSxDQUFDLENBQUM7b0JBQzNFLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxJQUFJO3dCQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztnQkFDM0UsQ0FBQztnQkFDRCxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7WUFDeEQsQ0FBQztZQUNELElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUM7UUFDL0MsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFO1lBQ2QsSUFBSSxDQUFDLE1BQU0sR0FBRyxjQUFjLENBQUM7WUFBQyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQztZQUNqRCxNQUFNLElBQUksb0JBQW9CLENBQUMscUJBQXFCLENBQUMsQ0FBQztRQUN4RCxDQUFDLENBQUMsQ0FBQztRQUNILE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQztJQUNyQixDQUFDO0lBRUQsT0FBTyxDQUFtRCxNQUFTLEVBQUUsTUFBcUQ7UUFDeEgsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxJQUFJLElBQUksQ0FBQyxLQUFLO1lBQUUsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksb0JBQW9CLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztRQUNwSixJQUFJLFFBQXVELENBQUM7UUFDNUQsSUFBSSxDQUFDO1lBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUFDLENBQUM7UUFBQyxNQUFNLENBQUM7WUFBQyxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUMxRyxJQUFJLE1BQU0sS0FBSywyQkFBMkIsSUFBSSxNQUFNLEtBQUsseUJBQXlCO1lBQUUsSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJLENBQUM7UUFDOUcsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRTtZQUM1RSxNQUFNLGNBQWMsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDeEMsSUFBSSxNQUFNLEtBQUsseUJBQXlCO2dCQUFFLElBQUksQ0FBQyxhQUFhLEdBQUcsS0FBSyxDQUFDO1lBQ3JFLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksQ0FBQyxNQUFNLEtBQUssMkJBQTJCLElBQUksTUFBTSxLQUFLLHlCQUF5QjttQkFDM0csTUFBTSxLQUFLLHlCQUF5QixJQUFLLGNBQWlELENBQUMsS0FBSyxLQUFLLElBQUksQ0FBQztnQkFBRSxJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQztZQUN2SSxPQUFPLGNBQWMsQ0FBQztRQUN4QixDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUNELE1BQU0sQ0FBSSxJQUFnQjtRQUN4QixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDakMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVM7Z0JBQUUsSUFBSSxDQUFDLE1BQU0sR0FBRyxjQUFjLENBQUM7WUFDNUQsTUFBTSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNuQixLQUFLLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM1RSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7Q0FDRiJ9

package/dist_ts/forwardhooks.d.ts

@@ -0,0 +1,8 @@
+import type { IForwardHookInspection, IForwardHookInspectionOptions } from './managed.forwardhooks.types.js';
+/** Reads every packet-filter owner on the IPv4/IPv6 forward hook of one network
+ * namespace: nf_tables forward base chains of the `ip`, `ip6` and `inet`
+ * families, Docker's DOCKER-USER/DOCKER-FORWARD chains and registered legacy
+ * xtables tables. One native process takes one generation-consistent read and
+ * exits; it claims, adopts and changes nothing. The result is a point-in-time
+ * view: another owner can appear after it. */
+export declare function inspectForwardHooks(options?: IForwardHookInspectionOptions): Promise<IForwardHookInspection>;

package/dist_ts/forwardhooks.js

@@ -0,0 +1,42 @@
+import * as plugins from './plugins.js';
+import { snapshot, managedIpcBytes, ManagedNftablesError, nativeError } from './classes.managednftables.js';
+/** Reads every packet-filter owner on the IPv4/IPv6 forward hook of one network
+ * namespace: nf_tables forward base chains of the `ip`, `ip6` and `inet`
+ * families, Docker's DOCKER-USER/DOCKER-FORWARD chains and registered legacy
+ * xtables tables. One native process takes one generation-consistent read and
+ * exits; it claims, adopts and changes nothing. The result is a point-in-time
+ * view: another owner can appear after it. */
+export async function inspectForwardHooks(options = {}) {
+    const captured = snapshot(options);
+    if (Object.keys(captured).some((key) => !['binaryPath', 'networkNamespaceFd'].includes(key))
+        || captured.binaryPath !== undefined && (typeof captured.binaryPath !== 'string'
+            || !plugins.path.isAbsolute(captured.binaryPath) || captured.binaryPath.includes('\0'))
+        || captured.networkNamespaceFd !== undefined && (!Number.isInteger(captured.networkNamespaceFd)
+            || captured.networkNamespaceFd < 0 || captured.networkNamespaceFd > 0x7fff_ffff)) {
+        throw new ManagedNftablesError('INVALID');
+    }
+    if (process.platform !== 'linux' || !['x64', 'arm64'].includes(process.arch))
+        throw new ManagedNftablesError('UNSUPPORTED_PLATFORM');
+    const root = plugins.url.fileURLToPath(new URL('../', import.meta.url));
+    const bridge = new plugins.smartrust.RustBridge({
+        binaryName: 'smartnftables', binaryPath: captured.binaryPath
+            ?? plugins.path.join(root, 'dist_rust', `smartnftables_linux_${process.arch === 'x64' ? 'amd64' : 'arm64'}_musl`),
+        localPaths: [], searchSystemPath: false,
+        cliArgs: ['--forward-hooks', ...(captured.networkNamespaceFd === undefined ? [] : ['--network-namespace-fd', '3'])],
+        inheritedFileDescriptors: captured.networkNamespaceFd === undefined ? undefined : [captured.networkNamespaceFd],
+        readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: managedIpcBytes,
+        maxPendingRequestsByMethod: { inspectForwardHooks: 1 },
+    });
+    try {
+        if (!await bridge.spawn())
+            throw new ManagedNftablesError('UNAVAILABLE');
+        return snapshot(await bridge.sendCommand('inspectForwardHooks', {}));
+    }
+    catch (error) {
+        throw error instanceof ManagedNftablesError ? error : nativeError(error);
+    }
+    finally {
+        await bridge.terminate({ gracePeriodMs: 1000 });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZm9yd2FyZGhvb2tzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvZm9yd2FyZGhvb2tzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBQ3hDLE9BQU8sRUFBRSxRQUFRLEVBQUUsZUFBZSxFQUFFLG9CQUFvQixFQUFFLFdBQVcsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRzVHOzs7Ozs4Q0FLOEM7QUFDOUMsTUFBTSxDQUFDLEtBQUssVUFBVSxtQkFBbUIsQ0FBQyxVQUF5QyxFQUFFO0lBQ25GLE1BQU0sUUFBUSxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNuQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsWUFBWSxFQUFFLG9CQUFvQixDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1dBQ3ZGLFFBQVEsQ0FBQyxVQUFVLEtBQUssU0FBUyxJQUFJLENBQUMsT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVE7ZUFDM0UsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7V0FDdEYsUUFBUSxDQUFDLGtCQUFrQixLQUFLLFNBQVMsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsa0JBQWtCLENBQUM7ZUFDMUYsUUFBUSxDQUFDLGtCQUFrQixHQUFHLENBQUMsSUFBSSxRQUFRLENBQUMsa0JBQWtCLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNyRixNQUFNLElBQUksb0JBQW9CLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELElBQUksT0FBTyxDQUFDLFFBQVEsS0FBSyxPQUFPLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztRQUFFLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO0lBQ3JJLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLElBQUksR0FBRyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDeEUsTUFBTSxNQUFNLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBdUI7UUFDcEUsVUFBVSxFQUFFLGVBQWUsRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVU7ZUFDdkQsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFdBQVcsRUFBRSx1QkFBdUIsT0FBTyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsT0FBTyxPQUFPLENBQUM7UUFDbkgsVUFBVSxFQUFFLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxLQUFLO1FBQ3ZDLE9BQU8sRUFBRSxDQUFDLGlCQUFpQixFQUFFLEdBQUcsQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsd0JBQXdCLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNuSCx3QkFBd0IsRUFBRSxRQUFRLENBQUMsa0JBQWtCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLGtCQUFrQixDQUFDO1FBQy9HLGNBQWMsRUFBRSxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxlQUFlO1FBQy9FLDBCQUEwQixFQUFFLEVBQUUsbUJBQW1CLEVBQUUsQ0FBQyxFQUFFO0tBQ3ZELENBQUMsQ0FBQztJQUNILElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLE1BQU0sQ0FBQyxLQUFLLEVBQUU7WUFBRSxNQUFNLElBQUksb0JBQW9CLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDekUsT0FBTyxRQUFRLENBQUMsTUFBTSxNQUFNLENBQUMsV0FBVyxDQUFDLHFCQUFxQixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLEtBQUssWUFBWSxvQkFBb0IsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDM0UsQ0FBQztZQUFTLENBQUM7UUFDVCxNQUFNLE1BQU0sQ0FBQyxTQUFTLENBQUMsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNsRCxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist_ts/index.d.ts

@@ -13,3 +13,5 @@ export { buildFirewallRule, buildIPSetCreate, buildIPSetAddElements, buildIPSetR
 export type { TNftProtocol, TNftFamily, TNftChainHook, TNftChainType, TNftPolicy, TFirewallAction, TCtState, INftDnatRule, INftSnatRule, INftMasqueradeRule, INftRateLimitRule, INftConnectionRateRule, INftFirewallRule, INftIPSetBlockOptions, INftIPSetConfig, INftCleanupOptions, INftRuleGroup, ISmartNftablesOptions, INftStatus, } from './nft.types.js';
 export * from './managed.docker.types.js';
 export * from './classes.manageddockerforwarding.js';
+export type * from './managed.forwardhooks.types.js';
+export { inspectForwardHooks } from './forwardhooks.js';

package/dist_ts/index.js

@@ -14,4 +14,5 @@ export { buildRateLimitRule, buildPerIpRateLimitRule, buildConnectionRateRule, }
 export { buildFirewallRule, buildIPSetCreate, buildIPSetAddElements, buildIPSetRemoveElements, buildIPSetDelete, buildIPSetMatchRule, } from './nft.rulebuilder.firewall.js';
 export * from './managed.docker.types.js';
 export * from './classes.manageddockerforwarding.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjO0FBQ2QsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ2pELE9BQU8sRUFBRSxlQUFlLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUlyRixlQUFlO0FBQ2YsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxlQUFlLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUM1RCxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUU5RCxXQUFXO0FBQ1gsT0FBTyxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFFbEYscUNBQXFDO0FBQ3JDLE9BQU8sRUFDTCxlQUFlLEVBQ2YsaUJBQWlCLEVBQ2pCLGlCQUFpQixHQUNsQixNQUFNLDRCQUE0QixDQUFDO0FBRXBDLE9BQU8sRUFDTCxjQUFjLEVBQ2QsYUFBYSxFQUNiLG1CQUFtQixHQUNwQixNQUFNLDBCQUEwQixDQUFDO0FBRWxDLE9BQU8sRUFDTCxrQkFBa0IsRUFDbEIsdUJBQXVCLEVBQ3ZCLHVCQUF1QixHQUN4QixNQUFNLGdDQUFnQyxDQUFDO0FBRXhDLE9BQU8sRUFDTCxpQkFBaUIsRUFDakIsZ0JBQWdCLEVBQ2hCLHFCQUFxQixFQUNyQix3QkFBd0IsRUFDeEIsZ0JBQWdCLEVBQ2hCLG1CQUFtQixHQUNwQixNQUFNLCtCQUErQixDQUFDO0FBd0J2QyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsc0NBQXNDLENBQUMifQ==
+export { inspectForwardHooks } from './forwardhooks.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjO0FBQ2QsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ2pELE9BQU8sRUFBRSxlQUFlLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUlyRixlQUFlO0FBQ2YsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxlQUFlLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUM1RCxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUU5RCxXQUFXO0FBQ1gsT0FBTyxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFFbEYscUNBQXFDO0FBQ3JDLE9BQU8sRUFDTCxlQUFlLEVBQ2YsaUJBQWlCLEVBQ2pCLGlCQUFpQixHQUNsQixNQUFNLDRCQUE0QixDQUFDO0FBRXBDLE9BQU8sRUFDTCxjQUFjLEVBQ2QsYUFBYSxFQUNiLG1CQUFtQixHQUNwQixNQUFNLDBCQUEwQixDQUFDO0FBRWxDLE9BQU8sRUFDTCxrQkFBa0IsRUFDbEIsdUJBQXVCLEVBQ3ZCLHVCQUF1QixHQUN4QixNQUFNLGdDQUFnQyxDQUFDO0FBRXhDLE9BQU8sRUFDTCxpQkFBaUIsRUFDakIsZ0JBQWdCLEVBQ2hCLHFCQUFxQixFQUNyQix3QkFBd0IsRUFDeEIsZ0JBQWdCLEVBQ2hCLG1CQUFtQixHQUNwQixNQUFNLCtCQUErQixDQUFDO0FBd0J2QyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsc0NBQXNDLENBQUM7QUFFckQsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sbUJBQW1CLENBQUMifQ==

package/dist_ts/managed.docker.types.d.ts

@@ -32,7 +32,8 @@ export interface IAppliedManagedDockerForwardingPolicy {
     };
     prepared: IPreparedManagedDockerForwardingPolicy;
 }
-/** Persist before mutation. Keep both generations' exact handoff links down until reconciliation is confirmed. */
+/** Persist before mutation. A handoff link both generations bind exactly may stay up: one atomic transaction swaps
+ * the contribution. Keep every link the transition adds or drops down until reconciliation is confirmed. */
 export interface IManagedDockerForwardingTransition {
     previous: IAppliedManagedDockerForwardingPolicy | null;
     target: IPreparedManagedDockerForwardingPolicy;

package/dist_ts/managed.egress.types.d.ts

@@ -196,6 +196,11 @@ export interface IManagedNftHostTransitScopeV2 {
      * leased source address and a source port of the allocation's range for the endpoint's protocol; its
      * ESTABLISHED replies return. Absent and empty are the same canonical policy, digest and compiled graph. */
     localPlatformEndpoints?: string[];
+    /** Optional: this table is the host's only forwarding owner. Every forwarded packet the scope does not
+     * admit (its leased, published and symmetric handoff flows) drops, IPv4 and IPv6, on every pair of
+     * interfaces, including forwarding that another table would accept. With no `handoffs` the host forwards
+     * nothing. It sets no sysctl. Absent and `false` are the same canonical policy, digest and compiled graph. */
+    exclusiveForwarding?: boolean;
 }
 /** One loopback TCP service that only one local user may dial. Every packet the host sends to the
  * exact address and port from a socket of any other user is rejected with a TCP reset, after ordinary

package/dist_ts/managed.forwardhooks.types.d.ts

@@ -0,0 +1,35 @@
+import type { IManagedNftOptions } from './managed.types.js';
+export interface IForwardHookInspectionOptions extends Pick<IManagedNftOptions, 'binaryPath' | 'networkNamespaceFd'> {
+}
+/** One nf_tables base chain on the forward hook of the `ip`, `ip6` or `inet` family. */
+export interface IForwardHookChain {
+    family: 'ip' | 'ip6' | 'inet';
+    table: string;
+    /** Kernel table handle, as a managed receipt's `tableHandle`. */
+    tableHandle: string;
+    chain: string;
+    type: string;
+    priority: number;
+    policy: 'accept' | 'drop';
+}
+/** One consistent read of every packet-filter owner on the routed forward path of a network namespace. */
+export interface IForwardHookInspection {
+    /** Every forward base chain, sorted by family, table and chain; managed tables included. */
+    chains: IForwardHookChain[];
+    /** Docker's iptables-nft dispatch chains in table `ip filter`. */
+    docker: {
+        dockerUser: boolean;
+        dockerForward: boolean;
+    };
+    /** Registered legacy xtables tables, whose hooks are not nf_tables chains. */
+    legacyTables: {
+        ipv4: string[];
+        ipv6: string[];
+    };
+}
+export type TForwardHookCommands = {
+    inspectForwardHooks: {
+        params: Record<string, never>;
+        result: IForwardHookInspection;
+    };
+};

package/dist_ts/managed.forwardhooks.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFuYWdlZC5mb3J3YXJkaG9va3MudHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9tYW5hZ2VkLmZvcndhcmRob29rcy50eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "4.0.1",
+  "version": "4.2.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -9,10 +9,10 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/cli": "7.3.0",
+    "@git.zone/cli": "8.1.0",
     "@git.zone/tsbuild": "^5.0.0",
-    "@git.zone/tsrun": "^3.0.1",
-    "@git.zone/tsrust": "1.15.1",
+    "@git.zone/tsrun": "^3.0.2",
+    "@git.zone/tsrust": "2.0.1",
     "@git.zone/tstest": "6.3.2",
     "@types/node": "26.6.2",
     "typescript": "^7.0.2"
@@ -66,6 +66,7 @@
   "scripts": {
     "test": "(tstest test/**/test*.ts --verbose --timeout 60)",
     "build": "(tsbuild tsfolders) && (tsrust)",
+    "build:release": "(tsbuild tsfolders) && (tsrust --configured-targets) && (tsrust verify)",
     "format": "(gitzone format)",
     "buildDocs": "tsdoc"
   }

package/readme.md

@@ -321,7 +321,7 @@ allocation-pool guard policy kinds.
 | V2 scope | Required authority and behavior |
 | --- | --- |
 | `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint, one port or a port range; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. A `symmetric` publication also lets the workload open flows from its published ports. Optional `hostGrants` forward exact host-origin flows from the handoff to a workload endpoint. Optional `workloadGrants` let one workload open one exact port of another, one way. |
-| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation, one port or a port range, and a `symmetric` publication also carries the workload's own flows from its published ports out through the uplink. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. Optional `localPlatformEndpoints` serve platform endpoints on the host's own addresses to leased flows. |
+| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation, one port or a port range, and a `symmetric` publication also carries the workload's own flows from its published ports out through the uplink. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. Optional `localPlatformEndpoints` serve platform endpoints on the host's own addresses to leased flows. Optional `exclusiveForwarding` makes the table the host's only forwarding owner: every other forwarded packet drops. |
 | `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` are its only exceptions. Optional `localTcpPortOwners` restrict loopback TCP ports to one local user each. |
 
 `allocationPoolGuard` accepts 1–64 canonical, disjoint RFC1918 prefixes. Supply
@@ -333,7 +333,9 @@ source, then return; all remaining packets check their current destination. This
 denies DNAT into or away from a pool and untracked current-destination traffic,
 while permitting reverse-SNAT replies to authorized transit sources. It grants no
 egress permissions; exact `hostTransit` and router policies remain separate owners.
-Unrelated host traffic and IPv6 retain their existing behavior.
+Unrelated host traffic and IPv6 retain their existing behavior; the guard never denies
+forwarding between other links. On a host that forwards only for the handoffs, see
+[Exclusive forwarding](#exclusive-forwarding).
 
 For example, a guard policy is `{ schemaVersion: 2, revision: 1, scope: {
 kind: 'allocationPoolGuard', authorityDigest, prefixes: ['10.240.0.0/16',
@@ -450,8 +452,8 @@ under host grants. 64 symmetric ranges take about 19,600 element bytes.
 The caller still owns the route to `targetAddress` through that handoff, the
 workload listener, and every other packet owner on the host. As with leased egress,
 an ACCEPT here cannot override Docker's independent FORWARD DROP; the
-`ManagedDockerForwarding` contribution below derives only leased handoff egress from
-the barrier and currently carries no inbound publication.
+`ManagedDockerForwarding` contribution below admits every inbound and symmetric
+publication of the barrier through it, with the leased flows.
 
 Each router generation binds an immutable lease reference, transit source address,
 leased TCP/UDP source-port ranges, a nonzero conntrack zone and a 16-byte label.
@@ -652,6 +654,62 @@ rules. Absent and empty are the same canonical policy, digest and compiled bytes
 caller keeps a declared endpoint's address outside every guarded allocation pool and
 owns the listener.
 
+#### Exclusive forwarding
+
+A host that forwards IPv4 (`net.ipv4.conf.all.forwarding=1`) routes between all of its
+links. On a Docker host, Docker set that switch and also the iptables FORWARD policy
+DROP, and `ManagedDockerForwarding` admits the handoff flows through it. On a host
+without Docker nothing denies forwarding that does not touch a handoff: host transit
+governs only handoff traffic, and the allocation-pool guard only pool destinations,
+so a LAN peer could use the host as its gateway, the uplink could hairpin, and two
+other links could exchange traffic. `hostTransit.exclusiveForwarding: true` closes
+that path inside the barrier's own table:
+
+```typescript
+const transit: IManagedNftPolicyV2 = { schemaVersion: 2, revision, scope: {
+  kind: 'hostTransit', protection, handoffs, uplink, snatAddress, exclusiveForwarding: true } };
+```
+
+The forward chain ends in one unconditional drop, after every rule of the scope.
+The host then forwards exactly what the scope admits: the leased flows of each
+handoff to the uplink with their ESTABLISHED replies, the inbound publications and
+their replies, and the symmetric publications' flows. Everything else that reaches
+the forward hook drops, whatever its links: IPv4 between the uplink, a LAN or any
+other link, a hairpin through the uplink, flows that were established before the
+member was applied, and forwarded IPv6. There is no ESTABLISHED/RELATED bypass, as
+everywhere in this scope, so ICMP errors for leased flows stay denied as before.
+Allocation pools need no exception: pool addresses are routed inside the router
+namespace and leave it translated to the transit source, so on the host only
+transit addresses cross the forward hook, and the pool guard denies pool
+destinations there anyway. IPv6 is dropped because the scope's packet model is
+IPv4 only; a host whose IPv6 forwarding is off never presents IPv6 to the hook.
+Input, output and NAT are unchanged, and so are the host's own flows: host grants
+and host-local platform endpoints are INPUT and OUTPUT traffic. With no `handoffs`
+the scope forwards nothing at all.
+
+nftables runs the forward base chain of every table, and a drop in any one of them
+is final, while an accept only ends its own chain. The member therefore drops
+forwarding that another owner (Docker, a container or VM bridge, a VPN router, a
+second routing daemon) accepts, and accepting in this table still cannot override
+another owner's drop. Use it only on a host where this table is the sole forwarding
+owner; on a Docker host keep it absent and use the Docker contribution below, which
+refuses an exclusive barrier. `inspectForwardHooks()`, described below, reports
+the other forward owners of the namespace for that decision. The
+member does not fence flowtable offload, packet queues, proxies or anything outside
+the forward hook.
+
+The drop is part of the scope's graph: it is created, verified, adopted, recovered,
+replaced and released with the rest of the table in one batch, and a replacement
+without the member or `release()` removes it, so forwarding resumes for every link
+the moment the table goes. This package sets no sysctl. The denial holds only while
+an exclusive table is applied, so the caller enables host forwarding only after an
+exclusive scope is enforced and disables it before releasing that scope, or keeps
+an exclusive scope applied between generations (with no handoffs it is a pure
+host-wide forwarding denial) and replaces it in place. Persistent forwarding in
+`sysctl.d` would make the host forward unfiltered after every boot until the scope
+is applied again, so leave the boot default off. Absent and `false` are the same
+canonical policy, digest and compiled bytes; the member adds one rule.
+
 #### Workload grants
 
 `routerEgress.workloadGrants` is optional: a stateful one-way flow between two
@@ -823,7 +881,7 @@ drainage, conntrack cleanup, elapsed-time expiry, or safe address/port/zone reus
 
 ### Docker forwarding contribution
 
-`ManagedDockerForwarding` admits the leased handoff traffic from an exact applied
+`ManagedDockerForwarding` admits exactly the forwarded flows of an exact applied
 schema-v2 `hostTransit` receipt through Docker's existing IPv4 forwarding path.
 It reads and verifies that dedicated barrier's complete table and local links,
 without adopting its ownership. The contribution uses Docker's supported
@@ -855,34 +913,88 @@ an explicit `/32` has different hidden match bytes in these frontends. A
 semantically equal rewrite with a different exact representation rejects, as does
 an early ACCEPT that the frontend reconstructs as the same command.
 The contribution never creates, flushes, adopts or deletes a Docker table/chain,
-and never changes a host forwarding policy.
-
-Each contributed rule binds the handoff and uplink names, current and original
-transit source, exact leased TCP/UDP port range, packet direction and connection
-state. New TCP flows require SYN with FIN/RST/ACK clear; reverse traffic requires
-ESTABLISHED. The exact v2 host barrier independently checks interface indices,
-MAC/iflink facts, the default host conntrack zone, protected original/current
-destinations and explicit outer SNAT. A complete contribution is bounded to 192
-rules and 100,000 generated command bytes.
+and never changes a host forwarding policy. `prepare()` refuses a barrier with
+`exclusiveForwarding` as `INVALID`: its drop would also deny Docker's own container
+forwarding.
+
+The contribution and the barrier's forward chain derive from one enumeration of
+the scope's forwarded flows, so the contribution admits exactly the flow kinds the
+non-exclusive barrier admits, each with its replies:
+
+| Flow kind | Original direction | Live tuple | Conntrack original tuple |
+| --- | --- | --- | --- |
+| Leased range | handoff → uplink | transit source address and leased port range | same source |
+| Inbound publication | uplink → handoff, after the barrier's DNAT | inside target address and port(s) as destination | published `hostIp` and port(s) as destination |
+| Symmetric publication | handoff → uplink, before the barrier's SNAT | target address and port(s) as source | same source |
+
+Every flow kind has three rules: the NEW opening (TCP only with SYN and
+FIN/RST/ACK clear), the ESTABLISHED original direction and the ESTABLISHED reply
+with swapped interfaces and tuple sides. A router's own egress, such as a VPN client
+in the router namespace dialling its hub, reaches the host as a leased flow: the
+router translates it to the transit address and a leased port range, so it is
+admitted by the leased rules exactly when the barrier admits it. Host grants and
+host-local platform endpoints use INPUT/OUTPUT and never cross FORWARD. Each rule
+binds the handoff and uplink names. The exact v2 host barrier independently checks
+interface indices, MAC/iflink facts, the default host conntrack zone, protected
+original/current destinations and explicit outer SNAT; it governs every forwarded
+packet on its handoffs, so the host forwards the intersection, which is the
+barrier's admitted set. A scope without publications keeps its exact 4.1.0 rules,
+comments and graphs. A complete contribution is bounded to 192 rules and 100,000
+generated command bytes: three rules per leased range and per publication, and
+three more per symmetric publication. A larger scope is refused as `EXHAUSTED`
+(`restoreRules`/`restoreBytes`) before any subprocess.
 
 Create the class with `ownerId`, a caller-retained `instanceId` of at least 16
 identifier characters, and optional `binaryPath`/`networkNamespaceFd`. After
 `start()`, call `prepare({ schemaVersion: 1, revision, barrier })`, where `barrier`
 is the exact applied host policy. Persist the complete `{ previous, target }`
-transition before `reconcile()`. Keep every affected handoff link down through
-mutations; retain those exact links until cleanup finishes. The native owner
-verifies this down state before and after its single no-flush restore transaction.
-Exact target replay can recover a lost response without rewriting live rules.
+transition before `reconcile()`. The native owner fences the handoff links before
+and after its single no-flush restore transaction, which deletes the previous block
+and inserts the target block in one atomic nf_tables commit. A handoff link that
+`previous` and `target` both bind exactly may stay up, so a publication or lease
+amendment of a running generation applies in place: every flow both contributions
+admit passes throughout, a flow only the target admits passes from the commit, and
+the referenced barrier must already be the target. Every handoff link the
+transition adds or drops, and every link of a first apply, must be down; retain
+those exact links until cleanup finishes. Exact target replay can recover a lost
+response without rewriting live rules.
 
 `inspect().present` confirms the contribution and its referenced barrier, not
 the complete host packet path or durable controller authority. Errors retain
 failed-owned state and pending intent. `release(applied)` and `close()` delete
-only exact contributed rules under the same link fence. A cold boot needs a new
+only exact contributed rules. Their fence requires every handoff link down or gone:
+a link whose index no link holds any more, such as a veth that left with its router
+namespace when the node process ended, counts as down, so a restarted process in
+the same boot can release the previous contribution before applying the next one.
+A different link at a bound index still rejects. A cold boot needs a new
 barrier receipt and caller-authorized replay; old boot receipts cannot authorize
 native operations. The caller owns restart ordering, disjoint retained leases,
 exclusive privileged mutation authority and activation. The frontend transaction
 does not provide compare-and-swap against other privileged processes.
 
+### Forward hook owners
+
+`inspectForwardHooks({ binaryPath?, networkNamespaceFd? })` reads every
+packet-filter owner on the routed forward path of one network namespace and
+changes nothing. One native process takes the read and exits:
+
+- `chains`: every nf_tables base chain on the forward hook of the `ip`, `ip6` and
+  `inet` families, with `family`, `table`, `tableHandle`, `chain`, `type`,
+  `priority` and `policy`, sorted by family, table and chain. Managed tables are
+  included; compare `table` and `tableHandle` with a receipt's
+  `identity.tableName` and `tableHandle` to find your own.
+- `docker`: whether Docker's iptables-nft `DOCKER-USER` and `DOCKER-FORWARD`
+  chains exist in table `ip filter`.
+- `legacyTables`: the registered legacy xtables `ipv4` and `ipv6` tables. Their
+  hooks, including FORWARD, are not nf_tables objects and never appear in `chains`.
+
+The table and chain dumps share one ruleset generation, or the read is
+`CONFLICT`. Without `CAP_NET_ADMIN` in the namespace it is `PERMISSION`. Bridge
+and netdev hooks do not see routed packets and are not reported. Guard
+`exclusiveForwarding` with it: refuse while any chain other than your own barrier's,
+either Docker chain or any legacy table is present. The read is a point in time;
+the caller still owns exclusive authority over who may add a forward owner later.
+
 ### Native qualification
 
 The separate [Docker fixture](test/native/readme.docker.md) exercises the native
@@ -970,6 +1082,14 @@ another destination workload, the destination's TCP and UDP openings toward the
 source stay dark; withdrawal stops new flows and the established one; release reopens
 the path. A set of 1024 grants persists across owner loss, is re-verified element by
 element and survives lost-ACK replay.
+Exclusive forwarding is qualified on a host namespace with a handoff, an uplink and
+a LAN link: against positive controls with no policy and with the scope without the
+member, the member denies the LAN's IPv4 to the uplink peer, the peer's way back into
+the LAN, the LAN's IPv6 and a LAN flow established before it, while leased egress
+still leaves translated and an unleased port stays denied; without handoffs leased
+egress drops too; replacing it with a scope without the member and releasing an
+exclusive scope both reopen the LAN path. The same probe fails against a compiler
+without the drop.
 Loopback TCP port owners are qualified against pre-policy positive controls on the
 same listeners: the owning uid (root, and uid 1000 for a second port) connects, every
 other uid is reset with `ECONNREFUSED`, an unowned port and another loopback address

package/rust/src/docker.frontend.rs

@@ -113,10 +113,10 @@ fn normalized(args: &[String]) -> Result<Vec<(String, Vec<String>)>> {
     let mut values=BTreeMap::new();let mut modules=BTreeSet::new();let mut index=0;
     while index<args.len() {
         let key=&args[index];let count=if key=="--tcp-flags" {2} else {1};
-        if !["-i","-o","-s","-d","-p","-m","--sport","--dport","--tcp-flags","--ctstate","--ctproto","--ctorigsrc","--ctorigsrcport","--ctdir","--comment","-j"].contains(&key.as_str()) {return Err(Error::Conflict);}
+        if !["-i","-o","-s","-d","-p","-m","--sport","--dport","--tcp-flags","--ctstate","--ctproto","--ctorigsrc","--ctorigsrcport","--ctorigdst","--ctorigdstport","--ctdir","--comment","-j"].contains(&key.as_str()) {return Err(Error::Conflict);}
         let mut value=args.get(index+1..index+1+count).ok_or(Error::Conflict)?.to_vec();index+=1+count;
         if key=="-m" {if !modules.insert(value[0].clone()) {return Err(Error::Conflict);}continue;}
-        if key=="--ctorigsrc" && !value[0].contains('/') {value[0].push_str("/32");}
+        if (key=="--ctorigsrc" || key=="--ctorigdst") && !value[0].contains('/') {value[0].push_str("/32");}
         if key=="--ctproto" {value[0]=match value[0].as_str() {"tcp"=>"6".into(),"udp"=>"17".into(),_=>value[0].clone()};}
         if values.insert(key.clone(),value).is_some() {return Err(Error::Conflict);}
     }