@push.rocks/smartvpn 1.12.0 → 1.14.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartvpn',
-    version: '1.12.0',
+    version: '1.14.0',
     description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/smartvpn.interfaces.d.ts

@@ -46,6 +46,8 @@ export interface IVpnClientConfig {
     wgEndpoint?: string;
     /** WireGuard: allowed IPs (CIDR strings, e.g. ['0.0.0.0/0']) */
     wgAllowedIps?: string[];
+    /** Client-defined tags reported to the server after connection (informational, not for access control) */
+    clientDefinedClientTags?: string[];
 }
 export interface IVpnClientOptions {
     transport: TVpnTransportOptions;
@@ -106,6 +108,26 @@ export interface IVpnServerConfig {
      *  tunnel IP as the source address. This allows downstream services (e.g. SmartProxy)
      *  to see the real VPN client identity instead of 127.0.0.1. */
     socketForwardProxyProtocol?: boolean;
+    /** Destination routing policy for VPN client traffic (socket mode).
+     *  Controls where decrypted traffic goes: allow through, block, or redirect to a target.
+     *  Default: all traffic passes through (backward compatible). */
+    destinationPolicy?: IDestinationPolicy;
+}
+/**
+ * Destination routing policy for VPN client traffic.
+ * Evaluated per-packet in the NAT engine before per-client ACLs.
+ */
+export interface IDestinationPolicy {
+    /** Default action for traffic not matching allow/block lists */
+    default: 'forceTarget' | 'block' | 'allow';
+    /** Target IP address for 'forceTarget' mode (e.g. '127.0.0.1'). Required when default is 'forceTarget'. */
+    target?: string;
+    /** Destinations that pass through directly — not rewritten, not blocked.
+     *  Supports: exact IP, CIDR, wildcards (192.168.190.*), ranges. */
+    allowList?: string[];
+    /** Destinations that are always blocked. Overrides allowList (deny wins).
+     *  Supports: exact IP, CIDR, wildcards, ranges. */
+    blockList?: string[];
 }
 export interface IVpnServerOptions {
     transport: TVpnTransportOptions;
@@ -233,7 +255,11 @@ export interface IClientEntry {
     priority?: number;
     /** Whether this client is enabled (default: true) */
     enabled?: boolean;
-    /** Tags for grouping (e.g. ["engineering", "office"]) */
+    /** Tags assigned by the server admin — trusted, used for access control (e.g. ["engineering", "office"]) */
+    serverDefinedClientTags?: string[];
+    /** Tags reported by the connecting client — informational only, never used for access control */
+    clientDefinedClientTags?: string[];
+    /** @deprecated Use serverDefinedClientTags instead. Legacy field kept for backward compatibility. */
     tags?: string[];
     /** Optional description */
     description?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartvpn',
-  version: '1.12.0',
+  version: '1.14.0',
   description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 }

package/ts/smartvpn.interfaces.ts

@@ -57,6 +57,8 @@ export interface IVpnClientConfig {
   wgEndpoint?: string;
   /** WireGuard: allowed IPs (CIDR strings, e.g. ['0.0.0.0/0']) */
   wgAllowedIps?: string[];
+  /** Client-defined tags reported to the server after connection (informational, not for access control) */
+  clientDefinedClientTags?: string[];
 }
 
 export interface IVpnClientOptions {
@@ -123,6 +125,27 @@ export interface IVpnServerConfig {
    *  tunnel IP as the source address. This allows downstream services (e.g. SmartProxy)
    *  to see the real VPN client identity instead of 127.0.0.1. */
   socketForwardProxyProtocol?: boolean;
+  /** Destination routing policy for VPN client traffic (socket mode).
+   *  Controls where decrypted traffic goes: allow through, block, or redirect to a target.
+   *  Default: all traffic passes through (backward compatible). */
+  destinationPolicy?: IDestinationPolicy;
+}
+
+/**
+ * Destination routing policy for VPN client traffic.
+ * Evaluated per-packet in the NAT engine before per-client ACLs.
+ */
+export interface IDestinationPolicy {
+  /** Default action for traffic not matching allow/block lists */
+  default: 'forceTarget' | 'block' | 'allow';
+  /** Target IP address for 'forceTarget' mode (e.g. '127.0.0.1'). Required when default is 'forceTarget'. */
+  target?: string;
+  /** Destinations that pass through directly — not rewritten, not blocked.
+   *  Supports: exact IP, CIDR, wildcards (192.168.190.*), ranges. */
+  allowList?: string[];
+  /** Destinations that are always blocked. Overrides allowList (deny wins).
+   *  Supports: exact IP, CIDR, wildcards, ranges. */
+  blockList?: string[];
 }
 
 export interface IVpnServerOptions {
@@ -290,7 +313,11 @@ export interface IClientEntry {
   priority?: number;
   /** Whether this client is enabled (default: true) */
   enabled?: boolean;
-  /** Tags for grouping (e.g. ["engineering", "office"]) */
+  /** Tags assigned by the server admin — trusted, used for access control (e.g. ["engineering", "office"]) */
+  serverDefinedClientTags?: string[];
+  /** Tags reported by the connecting client — informational only, never used for access control */
+  clientDefinedClientTags?: string[];
+  /** @deprecated Use serverDefinedClientTags instead. Legacy field kept for backward compatibility. */
   tags?: string[];
   /** Optional description */
   description?: string;