@push.rocks/smartvpn 1.19.4 → 1.21.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartvpn',
-    version: '1.19.4',
+    version: '1.21.0',
     description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/smartvpn.interfaces.d.ts

@@ -105,10 +105,15 @@ export interface IVpnServerConfig {
      *  Supports exact IPs, CIDR, wildcards, ranges. */
     connectionIpBlockList?: string[];
     /** When true and forwardingMode is 'socket', the userspace NAT engine prepends
-     *  PROXY protocol v2 headers on outbound TCP connections, conveying the VPN client's
-     *  tunnel IP as the source address. This allows downstream services (e.g. SmartProxy)
-     *  to see the real VPN client identity instead of 127.0.0.1. */
+     *  PROXY protocol v2 headers on outbound TCP connections. */
     socketForwardProxyProtocol?: boolean;
+    /** Source address to place into outbound PROXY v2 headers.
+     *  'tunnelIp' preserves legacy behavior. 'remoteIp' exposes the VPN client's
+     *  real connecting IP when known, with tunnel IP fallback. */
+    socketForwardProxyProtocolSource?: 'tunnelIp' | 'remoteIp';
+    /** When true, outbound PROXY v2 headers include authenticated SmartVPN metadata
+     *  in a vendor TLV: clientId, assignedIp, transportType, and remoteAddr. */
+    socketForwardProxyProtocolVpnMetadata?: boolean;
     /** Destination routing policy for VPN client traffic (socket mode).
      *  Controls where decrypted traffic goes: allow through, block, or redirect to a target.
      *  Default: all traffic passes through (backward compatible). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "1.19.4",
+  "version": "1.21.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",
@@ -28,11 +28,11 @@
     "@push.rocks/smartrust": "^1.4.0"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.4.1",
+    "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsrun": "^2.0.4",
-    "@git.zone/tsrust": "^1.3.4",
+    "@git.zone/tsrust": "^1.4.1",
     "@git.zone/tstest": "^3.6.6",
-    "@types/node": "^25.7.0"
+    "@types/node": "^25.9.1"
   },
   "files": [
     "ts/**/*",
@@ -49,6 +49,7 @@
     "build": "(tsbuild tsfolders) && (tsrust)",
     "test:before": "(tsrust)",
     "test": "tstest test/ --verbose  --logfile --timeout 90",
+    "test:rust": "cd rust && cargo test",
     "buildDocs": "tsdoc"
   }
 }

package/readme.hints.md

@@ -0,0 +1,8 @@
+# smartvpn hints
+
+## Static Rust Binaries
+
+- The Rust binaries in `dist_rust/` are statically linked (static-pie) via `"static": true` in the `@git.zone/tsrust` block of `.smartconfig.json` (tsrust >= 1.4.1). They run on both glibc (Debian/Ubuntu) and musl (Alpine) systems.
+- tsrust injects `RUSTFLAGS="-C target-feature=+crt-static"` only into its own per-target cargo invocations and verifies the result (no `PT_INTERP` ELF header). Keep `rust/.cargo/config.toml` free of `rustflags` entries: the injected env variable would replace them, and a repo-wide `rustflags` would also break plain `cargo test`/`cargo check` (proc-macros cannot build with `+crt-static` on linux-gnu without an explicit `--target`).
+- `pnpm run test:rust` runs the Rust unit tests; plain `cargo test` in `rust/` works as well.
+- Verify linkage manually with `ldd dist_rust/<binary>_linux_amd64` → "statically linked".

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartvpn',
-  version: '1.19.4',
+  version: '1.21.0',
   description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 }

package/ts/smartvpn.interfaces.ts

@@ -122,10 +122,15 @@ export interface IVpnServerConfig {
    *  Supports exact IPs, CIDR, wildcards, ranges. */
   connectionIpBlockList?: string[];
   /** When true and forwardingMode is 'socket', the userspace NAT engine prepends
-   *  PROXY protocol v2 headers on outbound TCP connections, conveying the VPN client's
-   *  tunnel IP as the source address. This allows downstream services (e.g. SmartProxy)
-   *  to see the real VPN client identity instead of 127.0.0.1. */
+   *  PROXY protocol v2 headers on outbound TCP connections. */
   socketForwardProxyProtocol?: boolean;
+  /** Source address to place into outbound PROXY v2 headers.
+   *  'tunnelIp' preserves legacy behavior. 'remoteIp' exposes the VPN client's
+   *  real connecting IP when known, with tunnel IP fallback. */
+  socketForwardProxyProtocolSource?: 'tunnelIp' | 'remoteIp';
+  /** When true, outbound PROXY v2 headers include authenticated SmartVPN metadata
+   *  in a vendor TLV: clientId, assignedIp, transportType, and remoteAddr. */
+  socketForwardProxyProtocolVpnMetadata?: boolean;
   /** Destination routing policy for VPN client traffic (socket mode).
    *  Controls where decrypted traffic goes: allow through, block, or redirect to a target.
    *  Default: all traffic passes through (backward compatible). */