@push.rocks/smartvpn 1.22.0 → 2.1.0

package/dist_ts/smartvpn.classes.vpnserver.d.ts

@@ -1,5 +1,5 @@
 import * as plugins from './smartvpn.plugins.js';
-import type { IVpnServerOptions, IVpnServerConfig, IVpnStatus, IVpnServerStatistics, IVpnClientInfo, IVpnKeypair, IVpnClientTelemetry, IWgPeerConfig, IWgPeerInfo, IClientEntry, IClientConfigBundle } from './smartvpn.interfaces.js';
+import type { IVpnServerOptions, IVpnServerConfig, IVpnStatus, IVpnServerStatistics, IVpnClientInfo, IVpnKeypair, IVpnClientTelemetry, IWgPeerConfig, IWgPeerInfo, IClientEntry, IClientCreateOptions, TClientUpdateOptions, IClientConfigBundle, IManagedNetworkSnapshot, IManagedNetworkStatus, IManagedNodeProjection } from './smartvpn.interfaces.js';
 /**
  * VPN Server — manages a smartvpn daemon in server mode.
  */
@@ -10,11 +10,16 @@ export declare class VpnServer extends plugins.events.EventEmitter {
     private nftHealthInterval?;
     private nftSubnet?;
     private nftPolicy?;
+    private nftHealthCheck?;
+    private startOperation?;
+    private stopOperation?;
+    private remotePolicyStopAcknowledged;
     constructor(options: IVpnServerOptions);
     /**
      * Start the daemon bridge (spawn or connect).
      */
     start(config?: IVpnServerConfig): Promise<void>;
+    private startOwnedResources;
     /**
      * Stop the VPN server.
      */
@@ -23,6 +28,11 @@ export declare class VpnServer extends plugins.events.EventEmitter {
      * Get server status.
      */
     getStatus(): Promise<IVpnStatus>;
+    /** Apply a complete caller-owned snapshot. An IPC timeout does not cancel its owner.
+     * Inspect status and replay the exact target after uncertainty or a pending failure. */
+    reconcileManagedNetwork(snapshot: IManagedNetworkSnapshot): Promise<IManagedNetworkStatus>;
+    getManagedNetworkStatus(): Promise<IManagedNetworkStatus>;
+    getManagedNodeProjection(nodeId: string): Promise<IManagedNodeProjection>;
     /**
      * Get server statistics.
      */
@@ -71,7 +81,7 @@ export declare class VpnServer extends plugins.events.EventEmitter {
      * Create a new client. Generates keypairs, assigns IP, returns full config bundle.
      * The secrets (private keys) are only returned at creation time.
      */
-    createClient(opts: Partial<IClientEntry>): Promise<IClientConfigBundle>;
+    createClient(opts: IClientCreateOptions): Promise<IClientConfigBundle>;
     /**
      * Remove a registered client (also disconnects if connected).
      */
@@ -87,7 +97,7 @@ export declare class VpnServer extends plugins.events.EventEmitter {
     /**
      * Update a registered client's fields (ACLs, tags, description, etc.).
      */
-    updateClient(clientId: string, update: Partial<IClientEntry>): Promise<void>;
+    updateClient(clientId: string, update: TClientUpdateOptions): Promise<void>;
     /**
      * Enable a previously disabled client.
      */
@@ -113,15 +123,18 @@ export declare class VpnServer extends plugins.events.EventEmitter {
      * Also starts a 60-second health check interval to re-apply if rules are removed externally.
      */
     private setupTunDestinationPolicy;
+    private checkTunDestinationPolicy;
     /**
      * Apply destination policy as nftables rules.
      * Order: blockList (drop) → allowList (accept) → default action.
      */
     private applyDestinationPolicyRules;
     /**
-     * Stop the daemon bridge.
+     * Drain startup, confirm daemon closure, then drain policy work and clean up.
+     * Failure preserves ownership so callers can retry; no timeout implies success.
      */
     stop(): Promise<void>;
+    private stopOwnedResources;
     /**
      * Whether the bridge is running.
      */

package/dist_ts/smartvpn.classes.vpnserver.js

@@ -6,6 +6,7 @@ import { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export class VpnServer extends plugins.events.EventEmitter {
     constructor(options) {
         super();
+        this.remotePolicyStopAcknowledged = false;
         this.options = options;
         this.bridge = new VpnBridge({
             transport: options.transport,
@@ -18,11 +19,27 @@ export class VpnServer extends plugins.events.EventEmitter {
         this.bridge.on('reconnected', () => {
             this.emit('reconnected');
         });
+        this.bridge.on('stderr', (line) => {
+            this.emit('stderr', line);
+        });
     }
     /**
      * Start the daemon bridge (spawn or connect).
      */
     async start(config) {
+        if (this.startOperation || this.stopOperation || this.nft) {
+            throw new Error('VpnServer: finish the current lifecycle operation and cleanup before starting');
+        }
+        const operation = this.startOwnedResources(config);
+        this.startOperation = operation;
+        try {
+            await operation;
+        }
+        finally {
+            this.startOperation = undefined;
+        }
+    }
+    async startOwnedResources(config) {
         const started = await this.bridge.start();
         if (!started) {
             throw new Error('VpnServer: failed to start daemon bridge');
@@ -48,6 +65,17 @@ export class VpnServer extends plugins.events.EventEmitter {
     async getStatus() {
         return this.bridge.sendCommand('getStatus', {});
     }
+    /** Apply a complete caller-owned snapshot. An IPC timeout does not cancel its owner.
+     * Inspect status and replay the exact target after uncertainty or a pending failure. */
+    async reconcileManagedNetwork(snapshot) {
+        return this.bridge.sendCommand('reconcileManagedNetwork', { snapshot });
+    }
+    async getManagedNetworkStatus() {
+        return this.bridge.sendCommand('getManagedNetworkStatus', {});
+    }
+    async getManagedNodeProjection(nodeId) {
+        return this.bridge.sendCommand('getManagedNodeProjection', { nodeId });
+    }
     /**
      * Get server statistics.
      */
@@ -190,6 +218,7 @@ export class VpnServer extends plugins.events.EventEmitter {
      * Also starts a 60-second health check interval to re-apply if rules are removed externally.
      */
     async setupTunDestinationPolicy(subnet, policy) {
+        this.remotePolicyStopAcknowledged = false;
         this.nftSubnet = subnet;
         this.nftPolicy = policy;
         this.nft = new plugins.smartnftables.SmartNftables({
@@ -199,25 +228,33 @@ export class VpnServer extends plugins.events.EventEmitter {
         await this.nft.initialize();
         await this.applyDestinationPolicyRules();
         // Health check: re-apply rules if they disappear
-        this.nftHealthInterval = setInterval(async () => {
-            if (!this.nft)
+        this.nftHealthInterval = setInterval(() => {
+            if (this.nftHealthCheck || this.stopOperation)
                 return;
-            try {
-                const exists = await this.nft.tableExists();
-                if (!exists) {
-                    console.warn('[smartvpn] nftables rules missing, re-applying destination policy');
-                    this.nft = new plugins.smartnftables.SmartNftables({
-                        tableName: 'smartvpn_tun',
-                    });
-                    await this.nft.initialize();
-                    await this.applyDestinationPolicyRules();
-                }
-            }
-            catch (err) {
-                console.warn(`[smartvpn] nftables health check failed: ${err}`);
-            }
+            this.nftHealthCheck = this.checkTunDestinationPolicy().finally(() => {
+                this.nftHealthCheck = undefined;
+            });
         }, 60_000);
     }
+    async checkTunDestinationPolicy() {
+        if (!this.nft)
+            return;
+        try {
+            const exists = await this.nft.tableExists();
+            if (!exists) {
+                console.warn('[smartvpn] nftables rules missing, re-applying destination policy');
+                this.nft = new plugins.smartnftables.SmartNftables({
+                    tableName: 'smartvpn_tun',
+                    dryRun: process.getuid?.() !== 0,
+                });
+                await this.nft.initialize();
+                await this.applyDestinationPolicyRules();
+            }
+        }
+        catch (err) {
+            console.warn(`[smartvpn] nftables health check failed: ${err}`);
+        }
+    }
     /**
      * Apply destination policy as nftables rules.
      * Order: blockList (drop) → allowList (accept) → default action.
@@ -261,37 +298,40 @@ export class VpnServer extends plugins.events.EventEmitter {
         }
     }
     /**
-     * Stop the daemon bridge.
+     * Drain startup, confirm daemon closure, then drain policy work and clean up.
+     * Failure preserves ownership so callers can retry; no timeout implies success.
      */
-    async stop() {
-        // Clean up nftables rules
+    stop() {
+        if (this.stopOperation)
+            return this.stopOperation;
+        const operation = this.stopOwnedResources();
+        this.stopOperation = operation;
+        void operation.then(() => { this.stopOperation = undefined; }, () => { this.stopOperation = undefined; });
+        return operation;
+    }
+    async stopOwnedResources() {
+        // A failed start is still reported to its caller; stop must clean its partial resources.
+        await this.startOperation?.catch(() => undefined);
         if (this.nftHealthInterval) {
             clearInterval(this.nftHealthInterval);
             this.nftHealthInterval = undefined;
         }
+        // A socket disconnect cannot stop a remote packet worker. If this facade
+        // installed its host policy, stop that server before releasing enforcement.
+        if (this.nft && this.options.transport.transport === 'socket' && !this.remotePolicyStopAcknowledged) {
+            await this.stopServer();
+            this.remotePolicyStopAcknowledged = true;
+        }
+        // In stdio mode, keep policy enforced until the owned worker has exited.
+        await this.bridge.stop();
+        await this.nftHealthCheck;
         if (this.nft) {
-            try {
-                await this.nft.cleanup();
-            }
-            catch (e) {
-                console.warn(`[smartvpn] nftables cleanup failed: ${e}`);
-            }
+            await this.nft.cleanup();
             this.nft = undefined;
         }
-        // Wait for bridge process to exit (with timeout)
-        const exitPromise = new Promise((resolve) => {
-            if (!this.bridge.running) {
-                resolve();
-                return;
-            }
-            const timeout = setTimeout(() => resolve(), 5000);
-            this.bridge.once('exit', () => {
-                clearTimeout(timeout);
-                resolve();
-            });
-        });
-        this.bridge.stop();
-        await exitPromise;
+        this.nftSubnet = undefined;
+        this.nftPolicy = undefined;
+        this.remotePolicyStopAcknowledged = false;
     }
     /**
      * Whether the bridge is running.
@@ -300,4 +340,4 @@ export class VpnServer extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5zZXJ2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbnNlcnZlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQWlCNUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sU0FBVSxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQVF4RCxZQUFZLE9BQTBCO1FBQ3BDLEtBQUssRUFBRSxDQUFDO1FBQ1IsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDdkIsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLFNBQVMsQ0FBcUI7WUFDOUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1lBQzVCLElBQUksRUFBRSxRQUFRO1NBQ2YsQ0FBQyxDQUFDO1FBRUgsd0JBQXdCO1FBQ3hCLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQW1CLEVBQUUsTUFBcUIsRUFBRSxFQUFFO1lBQ3BFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxhQUFhLEVBQUUsR0FBRyxFQUFFO1lBQ2pDLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSyxDQUFDLE1BQXlCO1FBQzFDLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELE1BQU0sR0FBRyxHQUFHLE1BQU0sSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQztRQUMxQyxJQUFJLEdBQUcsRUFBRSxDQUFDO1lBQ1IsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztZQUV4RCxnRUFBZ0U7WUFDaEUsSUFBSSxHQUFHLENBQUMsY0FBYyxLQUFLLEtBQUssSUFBSSxHQUFHLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztnQkFDMUQsTUFBTSxJQUFJLENBQUMseUJBQXlCLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsaUJBQWlCLENBQUMsQ0FBQztZQUMxRSxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxVQUFVO1FBQ3JCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsU0FBUztRQUNwQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFdBQVcsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGFBQWE7UUFDeEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxXQUFXO1FBQ3RCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLEVBQTJCLENBQUMsQ0FBQztRQUN6RixPQUFPLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDeEIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGdCQUFnQixDQUFDLFFBQWdCO1FBQzVDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsa0JBQWtCLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxlQUFlO1FBQzFCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsaUJBQWlCLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxrQkFBa0IsQ0FDN0IsUUFBZ0IsRUFDaEIsZUFBdUIsRUFDdkIsVUFBa0I7UUFFbEIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRTtZQUNsRCxRQUFRO1lBQ1IsZUFBZTtZQUNmLFVBQVU7U0FDWCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMscUJBQXFCLENBQUMsUUFBZ0I7UUFDakQsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyx1QkFBdUIsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGtCQUFrQixDQUFDLFFBQWdCO1FBQzlDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxpQkFBaUI7UUFDNUIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxtQkFBbUIsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFtQjtRQUN4QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFdBQVcsRUFBRSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFlBQVksQ0FBQyxTQUFpQjtRQUN6QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGNBQWMsRUFBRSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVc7UUFDdEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO1FBQ3pGLE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQztJQUN0QixDQUFDO0lBRUQseUVBQXlFO0lBRXpFOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxZQUFZLENBQUMsSUFBMkI7UUFDbkQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxjQUFjLEVBQUUsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsWUFBWSxDQUFDLFFBQWdCO1FBQ3hDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsY0FBYyxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsU0FBUyxDQUFDLFFBQWdCO1FBQ3JDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBVyxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMscUJBQXFCO1FBQ2hDLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsdUJBQXVCLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO1FBQ25HLE9BQU8sTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUN4QixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsWUFBWSxDQUFDLFFBQWdCLEVBQUUsTUFBNkI7UUFDdkUsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxjQUFjLEVBQUUsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsWUFBWSxDQUFDLFFBQWdCO1FBQ3hDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsY0FBYyxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsYUFBYSxDQUFDLFFBQWdCO1FBQ3pDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsZUFBZSxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUMvRCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsZUFBZSxDQUFDLFFBQWdCO1FBQzNDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsaUJBQWlCLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxRQUFnQixFQUFFLE1BQWdDO1FBQ2hGLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUN6RixPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDdkIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLHFCQUFxQjtRQUNoQyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLHVCQUF1QixFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBRUQsd0VBQXdFO0lBRXhFOzs7T0FHRztJQUNLLEtBQUssQ0FBQyx5QkFBeUIsQ0FBQyxNQUFjLEVBQUUsTUFBMEI7UUFDaEYsSUFBSSxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDO1lBQ2pELFNBQVMsRUFBRSxjQUFjO1lBQ3pCLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsS0FBSyxDQUFDO1NBQ2pDLENBQUMsQ0FBQztRQUVILE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM1QixNQUFNLElBQUksQ0FBQywyQkFBMkIsRUFBRSxDQUFDO1FBRXpDLGlEQUFpRDtRQUNqRCxJQUFJLENBQUMsaUJBQWlCLEdBQUcsV0FBVyxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQzlDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRztnQkFBRSxPQUFPO1lBQ3RCLElBQUksQ0FBQztnQkFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQzVDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztvQkFDWixPQUFPLENBQUMsSUFBSSxDQUFDLG1FQUFtRSxDQUFDLENBQUM7b0JBQ2xGLElBQUksQ0FBQyxHQUFHLEdBQUcsSUFBSSxPQUFPLENBQUMsYUFBYSxDQUFDLGFBQWEsQ0FBQzt3QkFDakQsU0FBUyxFQUFFLGNBQWM7cUJBQzFCLENBQUMsQ0FBQztvQkFDSCxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsVUFBVSxFQUFFLENBQUM7b0JBQzVCLE1BQU0sSUFBSSxDQUFDLDJCQUEyQixFQUFFLENBQUM7Z0JBQzNDLENBQUM7WUFDSCxDQUFDO1lBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztnQkFDYixPQUFPLENBQUMsSUFBSSxDQUFDLDRDQUE0QyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ2xFLENBQUM7UUFDSCxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDYixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ssS0FBSyxDQUFDLDJCQUEyQjtRQUN2QyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUztZQUFFLE9BQU87UUFFNUQsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUM5QixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQzlCLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQztRQUNwQixNQUFNLEtBQUssR0FBRyxjQUFjLENBQUM7UUFDN0IsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO1FBRTlCLDhDQUE4QztRQUM5QyxJQUFJLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNyQixLQUFLLE1BQU0sSUFBSSxJQUFJLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDcEMsUUFBUSxDQUFDLElBQUksQ0FDWCxnQkFBZ0IsTUFBTSxJQUFJLEtBQUssd0JBQXdCLE1BQU0sYUFBYSxJQUFJLE9BQU8sQ0FDdEYsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO1FBRUQsb0RBQW9EO1FBQ3BELElBQUksTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ3JCLEtBQUssTUFBTSxJQUFJLElBQUksTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO2dCQUNwQyxRQUFRLENBQUMsSUFBSSxDQUNYLGdCQUFnQixNQUFNLElBQUksS0FBSyx3QkFBd0IsTUFBTSxhQUFhLElBQUksU0FBUyxDQUN4RixDQUFDO1lBQ0osQ0FBQztRQUNILENBQUM7UUFFRCxvQkFBb0I7UUFDcEIsUUFBUSxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdkIsS0FBSyxhQUFhLENBQUMsQ0FBQyxDQUFDO2dCQUNuQixNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxJQUFJLFdBQVcsQ0FBQztnQkFDNUMsUUFBUSxDQUFDLElBQUksQ0FDWCxnQkFBZ0IsTUFBTSxJQUFJLEtBQUssd0JBQXdCLE1BQU0sWUFBWSxNQUFNLEVBQUUsQ0FDbEYsQ0FBQztnQkFDRixNQUFNO1lBQ1IsQ0FBQztZQUNELEtBQUssT0FBTztnQkFDVixRQUFRLENBQUMsSUFBSSxDQUNYLGdCQUFnQixNQUFNLElBQUksS0FBSyx3QkFBd0IsTUFBTSxPQUFPLENBQ3JFLENBQUM7Z0JBQ0YsTUFBTTtZQUNSLEtBQUssT0FBTztnQkFDVix5Q0FBeUM7Z0JBQ3pDLE1BQU07UUFDVixDQUFDO1FBRUQsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3hCLE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsd0JBQXdCLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDcEUsQ0FBQztJQUNILENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxJQUFJO1FBQ2YsMEJBQTBCO1FBQzFCLElBQUksSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDM0IsYUFBYSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1lBQ3RDLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxTQUFTLENBQUM7UUFDckMsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ2IsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUMzQixDQUFDO1lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDWCxPQUFPLENBQUMsSUFBSSxDQUFDLHVDQUF1QyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQzNELENBQUM7WUFDRCxJQUFJLENBQUMsR0FBRyxHQUFHLFNBQVMsQ0FBQztRQUN2QixDQUFDO1FBRUQsaURBQWlEO1FBQ2pELE1BQU0sV0FBVyxHQUFHLElBQUksT0FBTyxDQUFPLENBQUMsT0FBTyxFQUFFLEVBQUU7WUFDaEQsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3pCLE9BQU8sRUFBRSxDQUFDO2dCQUNWLE9BQU87WUFDVCxDQUFDO1lBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQ2xELElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLEVBQUU7Z0JBQzVCLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFDdEIsT0FBTyxFQUFFLENBQUM7WUFDWixDQUFDLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNuQixNQUFNLFdBQVcsQ0FBQztJQUNwQixDQUFDO0lBRUQ7O09BRUc7SUFDSCxJQUFXLE9BQU87UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUM3QixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5zZXJ2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbnNlcnZlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQXNCNUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sU0FBVSxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQVl4RCxZQUFZLE9BQTBCO1FBQ3BDLEtBQUssRUFBRSxDQUFDO1FBSEYsaUNBQTRCLEdBQUcsS0FBSyxDQUFDO1FBSTNDLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxTQUFTLENBQXFCO1lBQzlDLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztZQUM1QixJQUFJLEVBQUUsUUFBUTtTQUNmLENBQUMsQ0FBQztRQUVILHdCQUF3QjtRQUN4QixJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFtQixFQUFFLE1BQXFCLEVBQUUsRUFBRTtZQUNwRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ3RDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsYUFBYSxFQUFFLEdBQUcsRUFBRTtZQUNqQyxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzNCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBWSxFQUFFLEVBQUU7WUFDeEMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSyxDQUFDLE1BQXlCO1FBQzFDLElBQUksSUFBSSxDQUFDLGNBQWMsSUFBSSxJQUFJLENBQUMsYUFBYSxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUMxRCxNQUFNLElBQUksS0FBSyxDQUFDLCtFQUErRSxDQUFDLENBQUM7UUFDbkcsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNuRCxJQUFJLENBQUMsY0FBYyxHQUFHLFNBQVMsQ0FBQztRQUNoQyxJQUFJLENBQUM7WUFDSCxNQUFNLFNBQVMsQ0FBQztRQUNsQixDQUFDO2dCQUFTLENBQUM7WUFDVCxJQUFJLENBQUMsY0FBYyxHQUFHLFNBQVMsQ0FBQztRQUNsQyxDQUFDO0lBQ0gsQ0FBQztJQUVPLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxNQUF5QjtRQUN6RCxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDMUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFDRCxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7UUFDMUMsSUFBSSxHQUFHLEVBQUUsQ0FBQztZQUNSLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7WUFFeEQsZ0VBQWdFO1lBQ2hFLElBQUksR0FBRyxDQUFDLGNBQWMsS0FBSyxLQUFLLElBQUksR0FBRyxDQUFDLGlCQUFpQixFQUFFLENBQUM7Z0JBQzFELE1BQU0sSUFBSSxDQUFDLHlCQUF5QixDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLGlCQUFpQixDQUFDLENBQUM7WUFDMUUsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDckUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVM7UUFDcEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRDs0RkFDd0Y7SUFDakYsS0FBSyxDQUFDLHVCQUF1QixDQUFDLFFBQWlDO1FBQ3BFLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMseUJBQXlCLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFFTSxLQUFLLENBQUMsdUJBQXVCO1FBQ2xDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMseUJBQXlCLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUVNLEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxNQUFjO1FBQ2xELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsMEJBQTBCLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxhQUFhO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsZUFBZSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVztRQUN0QixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGFBQWEsRUFBRSxFQUEyQixDQUFDLENBQUM7UUFDekYsT0FBTyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQ3hCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFnQjtRQUM1QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGtCQUFrQixFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsZUFBZTtRQUMxQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGlCQUFpQixFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUNqRixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsa0JBQWtCLENBQzdCLFFBQWdCLEVBQ2hCLGVBQXVCLEVBQ3ZCLFVBQWtCO1FBRWxCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEVBQUU7WUFDbEQsUUFBUTtZQUNSLGVBQWU7WUFDZixVQUFVO1NBQ1gsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLHFCQUFxQixDQUFDLFFBQWdCO1FBQ2pELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsdUJBQXVCLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxRQUFnQjtRQUM5QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLG9CQUFvQixFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsaUJBQWlCO1FBQzVCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBbUI7UUFDeEMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxZQUFZLENBQUMsU0FBaUI7UUFDekMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxjQUFjLEVBQUUsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxXQUFXO1FBQ3RCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLEVBQTJCLENBQUMsQ0FBQztRQUN6RixPQUFPLE1BQU0sQ0FBQyxLQUFLLENBQUM7SUFDdEIsQ0FBQztJQUVELHlFQUF5RTtJQUV6RTs7O09BR0c7SUFDSSxLQUFLLENBQUMsWUFBWSxDQUFDLElBQTBCO1FBQ2xELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsY0FBYyxFQUFFLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFlBQVksQ0FBQyxRQUFnQjtRQUN4QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGNBQWMsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVMsQ0FBQyxRQUFnQjtRQUNyQyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFdBQVcsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDNUQsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLHFCQUFxQjtRQUNoQyxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLHVCQUF1QixFQUFFLEVBQTJCLENBQUMsQ0FBQztRQUNuRyxPQUFPLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDeEIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFlBQVksQ0FBQyxRQUFnQixFQUFFLE1BQTRCO1FBQ3RFLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsY0FBYyxFQUFFLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFlBQVksQ0FBQyxRQUFnQjtRQUN4QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGNBQWMsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGFBQWEsQ0FBQyxRQUFnQjtRQUN6QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGVBQWUsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGVBQWUsQ0FBQyxRQUFnQjtRQUMzQyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGlCQUFpQixFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsa0JBQWtCLENBQUMsUUFBZ0IsRUFBRSxNQUFnQztRQUNoRixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLG9CQUFvQixFQUFFLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDekYsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3ZCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxxQkFBcUI7UUFDaEMsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyx1QkFBdUIsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUVELHdFQUF3RTtJQUV4RTs7O09BR0c7SUFDSyxLQUFLLENBQUMseUJBQXlCLENBQUMsTUFBYyxFQUFFLE1BQTBCO1FBQ2hGLElBQUksQ0FBQyw0QkFBNEIsR0FBRyxLQUFLLENBQUM7UUFDMUMsSUFBSSxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDO1lBQ2pELFNBQVMsRUFBRSxjQUFjO1lBQ3pCLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsS0FBSyxDQUFDO1NBQ2pDLENBQUMsQ0FBQztRQUVILE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM1QixNQUFNLElBQUksQ0FBQywyQkFBMkIsRUFBRSxDQUFDO1FBRXpDLGlEQUFpRDtRQUNqRCxJQUFJLENBQUMsaUJBQWlCLEdBQUcsV0FBVyxDQUFDLEdBQUcsRUFBRTtZQUN4QyxJQUFJLElBQUksQ0FBQyxjQUFjLElBQUksSUFBSSxDQUFDLGFBQWE7Z0JBQUUsT0FBTztZQUN0RCxJQUFJLENBQUMsY0FBYyxHQUFHLElBQUksQ0FBQyx5QkFBeUIsRUFBRSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7Z0JBQ2xFLElBQUksQ0FBQyxjQUFjLEdBQUcsU0FBUyxDQUFDO1lBQ2xDLENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ2IsQ0FBQztJQUVPLEtBQUssQ0FBQyx5QkFBeUI7UUFDckMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHO1lBQUUsT0FBTztRQUN0QixJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDNUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNaLE9BQU8sQ0FBQyxJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztnQkFDbEYsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDO29CQUNqRCxTQUFTLEVBQUUsY0FBYztvQkFDekIsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxLQUFLLENBQUM7aUJBQ2pDLENBQUMsQ0FBQztnQkFDSCxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sSUFBSSxDQUFDLDJCQUEyQixFQUFFLENBQUM7WUFDM0MsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1lBQ2IsT0FBTyxDQUFDLElBQUksQ0FBQyw0Q0FBNEMsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUNsRSxDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7T0FHRztJQUNLLEtBQUssQ0FBQywyQkFBMkI7UUFDdkMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVM7WUFBRSxPQUFPO1FBRTVELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDOUIsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUM5QixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUM7UUFDcEIsTUFBTSxLQUFLLEdBQUcsY0FBYyxDQUFDO1FBQzdCLE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQztRQUU5Qiw4Q0FBOEM7UUFDOUMsSUFBSSxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDckIsS0FBSyxNQUFNLElBQUksSUFBSSxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7Z0JBQ3BDLFFBQVEsQ0FBQyxJQUFJLENBQ1gsZ0JBQWdCLE1BQU0sSUFBSSxLQUFLLHdCQUF3QixNQUFNLGFBQWEsSUFBSSxPQUFPLENBQ3RGLENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQztRQUVELG9EQUFvRDtRQUNwRCxJQUFJLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNyQixLQUFLLE1BQU0sSUFBSSxJQUFJLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDcEMsUUFBUSxDQUFDLElBQUksQ0FDWCxnQkFBZ0IsTUFBTSxJQUFJLEtBQUssd0JBQXdCLE1BQU0sYUFBYSxJQUFJLFNBQVMsQ0FDeEYsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO1FBRUQsb0JBQW9CO1FBQ3BCLFFBQVEsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3ZCLEtBQUssYUFBYSxDQUFDLENBQUMsQ0FBQztnQkFDbkIsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sSUFBSSxXQUFXLENBQUM7Z0JBQzVDLFFBQVEsQ0FBQyxJQUFJLENBQ1gsZ0JBQWdCLE1BQU0sSUFBSSxLQUFLLHdCQUF3QixNQUFNLFlBQVksTUFBTSxFQUFFLENBQ2xGLENBQUM7Z0JBQ0YsTUFBTTtZQUNSLENBQUM7WUFDRCxLQUFLLE9BQU87Z0JBQ1YsUUFBUSxDQUFDLElBQUksQ0FDWCxnQkFBZ0IsTUFBTSxJQUFJLEtBQUssd0JBQXdCLE1BQU0sT0FBTyxDQUNyRSxDQUFDO2dCQUNGLE1BQU07WUFDUixLQUFLLE9BQU87Z0JBQ1YseUNBQXlDO2dCQUN6QyxNQUFNO1FBQ1YsQ0FBQztRQUVELElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN4QixNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLHdCQUF3QixFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7SUFDSCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksSUFBSTtRQUNULElBQUksSUFBSSxDQUFDLGFBQWE7WUFBRSxPQUFPLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDbEQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDNUMsSUFBSSxDQUFDLGFBQWEsR0FBRyxTQUFTLENBQUM7UUFDL0IsS0FBSyxTQUFTLENBQUMsSUFBSSxDQUNqQixHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsYUFBYSxHQUFHLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFDekMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLGFBQWEsR0FBRyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQzFDLENBQUM7UUFDRixPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRU8sS0FBSyxDQUFDLGtCQUFrQjtRQUM5Qix5RkFBeUY7UUFDekYsTUFBTSxJQUFJLENBQUMsY0FBYyxFQUFFLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNsRCxJQUFJLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQzNCLGFBQWEsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQztZQUN0QyxJQUFJLENBQUMsaUJBQWlCLEdBQUcsU0FBUyxDQUFDO1FBQ3JDLENBQUM7UUFDRCx5RUFBeUU7UUFDekUsNEVBQTRFO1FBQzVFLElBQUksSUFBSSxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLENBQUMsSUFBSSxDQUFDLDRCQUE0QixFQUFFLENBQUM7WUFDcEcsTUFBTSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDeEIsSUFBSSxDQUFDLDRCQUE0QixHQUFHLElBQUksQ0FBQztRQUMzQyxDQUFDO1FBQ0QseUVBQXlFO1FBQ3pFLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN6QixNQUFNLElBQUksQ0FBQyxjQUFjLENBQUM7UUFDMUIsSUFBSSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDLEdBQUcsR0FBRyxTQUFTLENBQUM7UUFDdkIsQ0FBQztRQUNELElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO1FBQzNCLElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO1FBQzNCLElBQUksQ0FBQyw0QkFBNEIsR0FBRyxLQUFLLENBQUM7SUFDNUMsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGIn0=

package/dist_ts/smartvpn.interfaces.d.ts

@@ -10,18 +10,18 @@ export interface IVpnTransportSocket {
     maxReconnectAttempts?: number;
 }
 export type TVpnTransportOptions = IVpnTransportStdio | IVpnTransportSocket;
-export interface IVpnClientConfig {
+interface IVpnClientConfigBase {
     /** Server WebSocket URL, e.g. wss://vpn.example.com/tunnel */
-    serverUrl: string;
+    serverUrl?: string;
     /** Server's static public key (base64) for Noise IK handshake */
     serverPublicKey: string;
     /** Client's Noise IK private key (base64) — required for SmartVPN native transport */
-    clientPrivateKey: string;
+    clientPrivateKey?: string;
     /** Client's Noise IK public key (base64) — for reference/display */
-    clientPublicKey: string;
+    clientPublicKey?: string;
     /** Optional DNS servers to use while connected */
     dns?: string[];
-    /** Optional MTU for the TUN device */
+    /** Inner TUN MTU in whole IP bytes, 576..65472 (default: 1420); not outer link MTU. */
     mtu?: number;
     /** Keepalive interval in seconds (default: 30) */
     keepaliveIntervalSecs?: number;
@@ -30,7 +30,7 @@ export interface IVpnClientConfig {
     /** For QUIC: SHA-256 hash of server certificate (base64) for cert pinning */
     serverCertHash?: string;
     /** Forwarding mode: 'tun' (TUN device, requires root) or 'testing' (no TUN).
-     *  Default: 'testing'. */
+     *  Default: native 'testing', WireGuard 'tun'. */
     forwardingMode?: 'tun' | 'testing';
     /** WireGuard: client private key (base64, X25519) */
     wgPrivateKey?: string;
@@ -49,9 +49,34 @@ export interface IVpnClientConfig {
     /** Client-defined tags reported to the server after connection (informational, not for access control) */
     clientDefinedClientTags?: string[];
 }
+/** Native transports authenticate with Noise IK, independently of WireGuard. */
+export interface IVpnNativeClientConfig extends IVpnClientConfigBase {
+    /** Explicit managed opt-in. Rejects a missing or differently bound server assignment. */
+    managedNetwork?: IManagedNetworkBinding;
+    transport?: 'auto' | 'websocket' | 'quic';
+    serverUrl: string;
+    clientPrivateKey: string;
+    clientPublicKey: string;
+}
+/** WireGuard uses its own key and address; Noise credentials are not required. */
+export interface IVpnWireguardClientConfig extends IVpnClientConfigBase {
+    transport: 'wireguard';
+    wgPrivateKey: string;
+    wgAddress: string;
+    wgEndpoint: string;
+    /** Explicit peer source/destination routing authority. Must not be empty. */
+    wgAllowedIps: string[];
+}
+export type TVpnClientConfig = IVpnNativeClientConfig | IVpnWireguardClientConfig;
+/** Retains the published config type name; both names enforce the transport union. */
+export type IVpnClientConfig = TVpnClientConfig;
 export interface IVpnClientOptions {
     transport: TVpnTransportOptions;
     config?: IVpnClientConfig;
+    /** Linux stdio only. Caller-owned network namespace FD, retained through every spawn.
+     * The complete native client enters before threads, sockets, TUN or readiness.
+     * The caller owns namespace creation, underlay routing, DNS and packet policy. */
+    networkNamespaceFd?: number;
 }
 export interface IVpnServerConfig {
     /** Listen address for WebSocket, e.g. 0.0.0.0:443 */
@@ -68,7 +93,7 @@ export interface IVpnServerConfig {
     subnet: string;
     /** DNS servers pushed to clients */
     dns?: string[];
-    /** MTU for TUN device */
+    /** Inner TUN/forwarding packet ceiling in whole IP bytes, 576..65472 (default: 1420). */
     mtu?: number;
     /** Keepalive interval in seconds (default: 30) */
     keepaliveIntervalSecs?: number;
@@ -76,8 +101,10 @@ export interface IVpnServerConfig {
     enableNat?: boolean;
     /** Forwarding mode: 'tun' (kernel TUN, requires root), 'socket' (userspace NAT),
      *  'bridge' (L2 bridge to host LAN), 'hybrid' (per-client socket+bridge),
-     *  or 'testing' (monitoring only). Default: 'testing'. */
-    forwardingMode?: 'tun' | 'socket' | 'bridge' | 'hybrid' | 'testing';
+     *  'managed' (caller-owned node relay without host networking), or 'testing'. Default: 'testing'. */
+    forwardingMode?: 'tun' | 'socket' | 'bridge' | 'hybrid' | 'testing' | 'managed';
+    /** Required in managed mode. Bound to this process lifetime; not an authentication credential. */
+    managedAuthorityId?: string;
     /** Default rate limit for new clients (bytes/sec). Omit for unlimited. */
     defaultRateLimitBytesPerSec?: number;
     /** Default burst size for new clients (bytes). Omit for unlimited. */
@@ -162,6 +189,8 @@ export interface IVpnServerOptions {
 }
 export type TVpnConnectionState = 'disconnected' | 'connecting' | 'handshaking' | 'connected' | 'reconnecting' | 'error';
 export interface IVpnStatus {
+    /** Authenticated native assignment for this connection, absent after retirement. */
+    managedNetwork?: IManagedNetworkAssignment;
     state: TVpnConnectionState;
     assignedIp?: string;
     serverAddr?: string;
@@ -227,11 +256,16 @@ export interface IVpnConnectionQuality {
     currentKeepaliveIntervalSecs: number;
 }
 export interface IVpnMtuInfo {
-    tunMtu: number;
+    /** Actual inner TUN ceiling; null in testing mode because no TUN exists. */
+    tunMtu: number | null;
+    /** Enforced inner packet ceiling, not an estimated outer path MTU. */
     effectiveMtu: number;
-    linkMtu: number;
-    overheadBytes: number;
+    /** Null when the transport has not measured the outer link. */
+    linkMtu: number | null;
+    /** Null when the transport has not measured encapsulation overhead. */
+    overheadBytes: number | null;
     oversizedPacketsDropped: number;
+    /** Feedback packets successfully written to the client TUN, not just generated. */
     icmpTooBigSent: number;
 }
 export interface IVpnClientTelemetry {
@@ -319,6 +353,16 @@ export interface IClientEntry {
     /** 802.1Q VLAN ID (1-4094). Required when forceVlan is true. */
     vlanId?: number;
 }
+/** Admin-writable settings. Omission preserves a setting; null clears it.
+ * Identity, keys, assignment and client-reported tags have separate owners.
+ * A supplied security object replaces the complete previous security object. */
+export type TClientUpdateOptions = {
+    [TField in keyof Omit<IClientEntry, 'clientId' | 'publicKey' | 'wgPublicKey' | 'assignedIp' | 'clientDefinedClientTags'>]?: IClientEntry[TField] | null;
+};
+/** Creation generates server-owned keys and assignment; clientId is required. */
+export interface IClientCreateOptions extends TClientUpdateOptions {
+    clientId: string;
+}
 /**
  * Complete client config bundle — returned by createClient() and rotateClientKey().
  * Contains everything the client needs to connect.
@@ -327,7 +371,7 @@ export interface IClientConfigBundle {
     /** The server-side client entry */
     entry: IClientEntry;
     /** Ready-to-use SmartVPN client config (typed object) */
-    smartvpnConfig: IVpnClientConfig;
+    smartvpnConfig: IVpnNativeClientConfig;
     /** Ready-to-use WireGuard .conf file content (string) */
     wireguardConfig: string;
     /** Client's private keys (ONLY returned at creation time, not stored server-side) */
@@ -386,10 +430,26 @@ export type TVpnClientCommands = {
     };
     getMtuInfo: {
         params: Record<string, never>;
-        result: IVpnMtuInfo;
+        result: IVpnMtuInfo | null;
     };
 };
 export type TVpnServerCommands = {
+    reconcileManagedNetwork: {
+        params: {
+            snapshot: IManagedNetworkSnapshot;
+        };
+        result: IManagedNetworkStatus;
+    };
+    getManagedNetworkStatus: {
+        params: Record<string, never>;
+        result: IManagedNetworkStatus;
+    };
+    getManagedNodeProjection: {
+        params: {
+            nodeId: string;
+        };
+        result: IManagedNodeProjection;
+    };
     start: {
         params: {
             config: IVpnServerConfig;
@@ -468,7 +528,7 @@ export type TVpnServerCommands = {
     };
     createClient: {
         params: {
-            client: Partial<IClientEntry>;
+            client: IClientCreateOptions;
         };
         result: IClientConfigBundle;
     };
@@ -493,7 +553,7 @@ export type TVpnServerCommands = {
     updateClient: {
         params: {
             clientId: string;
-            update: Partial<IClientEntry>;
+            update: TClientUpdateOptions;
         };
         result: void;
     };
@@ -529,6 +589,84 @@ export type TVpnServerCommands = {
         result: IVpnKeypair;
     };
 };
+/** Complete schema-v1 authority. No patch semantics or implicit/reverse grants. */
+export interface IManagedNetworkSnapshot {
+    schemaVersion: 1;
+    authorityId: string;
+    /** Positive JSON-safe integer, monotonically increasing within the server lifetime. */
+    revision: number;
+    nodes: IManagedNetworkNode[];
+    grants: IManagedNetworkGrant[];
+}
+export interface IManagedNetworkNode {
+    nodeId: string;
+    publicKey: string;
+    wgPublicKey?: string;
+    controlAddress: string;
+    controlPolicyDomain: string;
+    enabled: boolean;
+    expiresAt?: string;
+    workloadPrefixes: IManagedNetworkPrefix[];
+}
+export interface IManagedNetworkPrefix {
+    cidr: string;
+    policyDomain: string;
+}
+export interface IManagedNetworkGrant {
+    sourceDomain: string;
+    destinationDomain: string;
+}
+export interface IManagedNetworkStatus {
+    authorityId: string;
+    lifetimeId: string;
+    state: 'idle' | 'applying' | 'failed';
+    appliedRevision: number | null;
+    pendingRevision: number | null;
+    stage: 'draining' | 'preparingTransport' | null;
+    lastError: string | null;
+}
+export interface IManagedNodeProjection {
+    schemaVersion: 1;
+    authorityId: string;
+    lifetimeId: string;
+    appliedRevision: number | null;
+    nodeId: string;
+    /** Configuration is applied/admissible, not proof of connectivity or host readiness. */
+    ready: boolean;
+    config: IManagedNodeConfig | null;
+}
+export interface IManagedNetworkAssignment {
+    schemaVersion: 1;
+    authorityId: string;
+    lifetimeId: string;
+    appliedRevision: number;
+    nodeId: string;
+    ownedPrefixes: string[];
+    /** Remote destinations only; never local workload prefixes or a default route. */
+    routes: string[];
+}
+export interface IManagedNetworkBinding {
+    authorityId: string;
+    nodeId: string;
+}
+export interface IManagedNodeConfig {
+    /** Caller-owned control address with /32; local workload prefixes are not hub routes. */
+    address: string;
+    gateway: string;
+    ownedPrefixes: IManagedNetworkPrefix[];
+    outgoingRoutes: string[];
+    incomingSources: string[];
+    mtu: number;
+    wireguard: IManagedWireGuardProjection | null;
+}
+export interface IManagedWireGuardProjection {
+    publicKey: string;
+    serverPublicKey: string;
+    endpoint: string;
+    /** Union of remote outgoing/incoming prefixes plus hub MTU-feedback gateway /32.
+     *  The hub still enforces directed grants. Never includes local workload prefixes. */
+    allowedIps: string[];
+}
 export type TVpnPlatform = 'linux' | 'macos' | 'windows' | 'unknown';
 export interface IVpnServiceUnit {
     platform: TVpnPlatform;
@@ -552,3 +690,4 @@ export interface IVpnEventMap {
     };
     'reconnected': void;
 }
+export {};

package/dist_ts/smartvpn.paths.d.ts

@@ -1 +1,3 @@
 export declare const packageDir: string;
+/** Select only an explicitly requested binary or this package's Linux musl artifact. */
+export declare function getBinaryPath(binaryName: string, platform?: NodeJS.Platform, arch?: string, override?: string | undefined): string;

package/dist_ts/smartvpn.paths.js

@@ -1,3 +1,16 @@
 import * as plugins from './smartvpn.plugins.js';
 export const packageDir = plugins.path.join(plugins.smartpath.get.dirnameFromImportMetaUrl(import.meta.url), '../');
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4ucGF0aHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5wYXRocy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBRWpELE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FDekMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsd0JBQXdCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFDL0QsS0FBSyxDQUNOLENBQUMifQ==
+/** Select only an explicitly requested binary or this package's Linux musl artifact. */
+export function getBinaryPath(binaryName, platform = process.platform, arch = process.arch, override = process.env.SMARTVPN_RUST_BINARY) {
+    // Smartrust validates explicit paths, including empty/invalid overrides, without
+    // repairing their permissions or falling through to an unrelated executable.
+    if (override !== undefined) {
+        return override;
+    }
+    if (platform !== 'linux' || (arch !== 'x64' && arch !== 'arm64')) {
+        throw new Error(`SmartVPN does not bundle a daemon for ${platform}/${arch}; set SMARTVPN_RUST_BINARY to an explicitly built executable or use socket transport.`);
+    }
+    const suffix = arch === 'x64' ? 'linux_amd64_musl' : 'linux_arm64_musl';
+    return plugins.path.join(packageDir, 'dist_rust', `${binaryName}_${suffix}`);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4ucGF0aHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5wYXRocy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBRWpELE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FDekMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsd0JBQXdCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFDL0QsS0FBSyxDQUNOLENBQUM7QUFFRix3RkFBd0Y7QUFDeEYsTUFBTSxVQUFVLGFBQWEsQ0FDM0IsVUFBa0IsRUFDbEIsV0FBNEIsT0FBTyxDQUFDLFFBQVEsRUFDNUMsT0FBZSxPQUFPLENBQUMsSUFBSSxFQUMzQixXQUErQixPQUFPLENBQUMsR0FBRyxDQUFDLG9CQUFvQjtJQUUvRCxpRkFBaUY7SUFDakYsNkVBQTZFO0lBQzdFLElBQUksUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzNCLE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxJQUFJLFFBQVEsS0FBSyxPQUFPLElBQUksQ0FBQyxJQUFJLEtBQUssS0FBSyxJQUFJLElBQUksS0FBSyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sSUFBSSxLQUFLLENBQUMseUNBQXlDLFFBQVEsSUFBSSxJQUFJLHVGQUF1RixDQUFDLENBQUM7SUFDcEssQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLElBQUksS0FBSyxLQUFLLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQztJQUN4RSxPQUFPLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLEVBQUUsR0FBRyxVQUFVLElBQUksTUFBTSxFQUFFLENBQUMsQ0FBQztBQUMvRSxDQUFDIn0=

package/notices/aho-corasick-license.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Andrew Gallant
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.