@push.rocks/smartvpn 1.22.0 → 2.1.0

package/notices/valuable-license.txt

@@ -0,0 +1,25 @@
+Copyright (c) 2021 Valuable Contributors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "1.22.0",
+  "version": "2.1.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",
@@ -25,26 +25,34 @@
   "dependencies": {
     "@push.rocks/smartnftables": "1.2.0",
     "@push.rocks/smartpath": "^6.0.0",
-    "@push.rocks/smartrust": "^1.4.0"
+    "@push.rocks/smartrust": "^2.0.0"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.4.2",
-    "@git.zone/tsrun": "^2.0.4",
-    "@git.zone/tsrust": "^1.4.1",
-    "@git.zone/tstest": "^3.6.6",
-    "@types/node": "^25.9.1"
+    "@git.zone/tsbuild": "^4.4.3",
+    "@git.zone/tsrun": "^2.0.6",
+    "@git.zone/tsrust": "^1.13.0",
+    "@git.zone/tstest": "^6.0.0",
+    "@types/node": "^26.4.1"
   },
   "files": [
     "ts/**/*",
     "dist_ts/**/*",
     "dist_rust/**/*",
     "assets/**/*",
+    "notices/**/*",
+    "third-party-notices.md",
     "readme.md",
     "license.md"
   ],
   "browserslist": [
     "last 1 chrome versions"
   ],
+  "publishConfig": {
+    "executableFiles": [
+      "./dist_rust/smartvpn_daemon_linux_amd64_musl",
+      "./dist_rust/smartvpn_daemon_linux_arm64_musl"
+    ]
+  },
   "scripts": {
     "build": "(tsbuild tsfolders) && (tsrust)",
     "test:before": "(tsrust)",

package/readme.md

@@ -14,7 +14,7 @@ A high-performance VPN solution with a **TypeScript control plane** and a **Rust
 - 🔀 **Hybrid mode**: per-client routing — some clients bridge to the LAN, others use userspace NAT, all on the same server
 - 🏷️ **VLAN support**: assign individual clients to 802.1Q VLANs on the bridge
 - 🎯 **Destination routing policy**: force-target, block, or allow traffic per destination with nftables integration
-- ⚡ **Handshake-driven WireGuard state**: peers appear as "connected" only after a successful WireGuard handshake, and auto-disconnect on idle timeout
+- ⚡ **Authenticated WireGuard state**: peers appear as "connected" after their first authenticated, source-authorized tunnel packet, and auto-disconnect on idle timeout
 
 ## Issue Reporting and Security
 
@@ -124,6 +124,84 @@ console.log(`Connected! VPN IP: ${assignedIp}`);
 
 ## Features ✨
 
+### Caller-owned client network namespace
+
+A Linux stdio client accepts `networkNamespaceFd` in `IVpnClientOptions`. Pass an
+already open network namespace descriptor; the caller retains ownership and keeps
+it valid through each `start()`. The child validates its inherited duplicate,
+enters the namespace before creating runtime threads or sockets, then closes the
+duplicate. Invalid descriptors and failed entry cannot produce a ready client.
+Stopping the client waits for process termination before the caller releases its
+namespace owner. A running child remains in its namespace if the caller closes
+the original descriptor, but a later start still requires a valid descriptor.
+
+The caller must provide the hub endpoint's underlay route and any required DNS
+reachability inside that namespace before connecting. SmartVPN creates neither
+the namespace nor that underlay. Managed TUN setup still validates the authenticated
+assignment and rejects routes that capture the actual hub endpoint. Namespace
+placement does not grant workload access or replace packet policy.
+
+The option is process configuration, separate from VPN connection configuration.
+It is rejected for socket transport and server bridges. The native equivalent is
+`--management --mode client --network-namespace-fd 3`, with an inherited descriptor
+at FD 3. Server facade firewall setup runs in its parent process, so server
+namespace placement requires a separately coordinated policy owner.
+
+The Linux amd64 musl candidate passed offline Linux 6.18.35 qualification with
+all native threads in the target namespace, child descriptor closure, retained
+caller ownership and denied-entry rejection. The shared `serve.zone/testing`
+scenario also passed real WS/Noise traffic through inherited namespace entry,
+managed TUN creation, allow/deny, reconnect, revocation, route-conflict rollback
+and child-termination cleanup. Privileged ARM64 and Pallet integration remain
+separate qualification requirements.
+
+### Confirmed bridge shutdown
+
+Always await `client.stop()`, `server.stop()` or `bridge.stop()` before replacing
+an owned worker. These use Smartrust's confirmed termination API; a timeout is
+not treated as successful shutdown. In stdio mode they wait for child exit and
+stdio closure. In socket mode they confirm the local IPC connection has closed,
+not that the externally supervised daemon process has exited.
+
+`server.stop()` drains an in-flight start and firewall health check before
+cleaning up its policy resources. Cleanup errors reject and retain ownership
+for an explicit retry. If a socket-connected facade installed TUN policy, it
+first requires the managed server's `stop` acknowledgement before closing IPC
+and removing that policy. A socket connection without owned policy only closes
+IPC; use `stopServer()` explicitly to request remote listener shutdown.
+
+```typescript
+await client.stop();
+await server.stop();
+```
+
+This bridge lifecycle guarantee is separate from per-client packet/session
+revocation inside the running Rust daemon; see the managed-network qualification
+boundaries below.
+
+The Rust server now waits for configured listeners and initial WireGuard peers
+before acknowledging startup. A listener startup failure shuts down the owned
+runtime. `stopServer()` cancels and drains server-owned packet tasks, including
+pre-authentication connections, WireGuard return relays, and NAT socket readers;
+QUIC also closes its connections and waits for protocol shutdown. Per-client
+transport and queued forwarding teardown are described below. Transactional
+rollback of standalone kernel network setup remains outstanding; the isolated
+managed-client qualification below does not establish that guarantee for other modes.
+When a raw WireGuard declaration uses a registered client's key, its `allowedIps`
+must be exactly that client's assigned `/32`. Raw peers without a matching client
+registry entry retain their separately configured prefix lists.
+
+### Client runtime shutdown
+
+Always await `client.disconnect()`: it cancels and joins the native/WireGuard
+packet runtime before returning, including the native keepalive monitor. A blocked
+write cannot turn a timeout into a successful disconnect. Failed connection
+attempts clear their startup state; unexpected packet-task panics remain errors.
+Packet-loop exit clears connection and MTU metadata; native clients also retire
+their monitor before reconnect can reuse the client. Dropping the Rust client requests cancellation but
+cannot provide an awaited cleanup guarantee. Linux native managed-client TUN
+cleanup is qualified below; standalone native/WireGuard host-route cleanup is not.
+
 ### 🔐 Enterprise Authentication (Noise IK)
 
 Every client authenticates with a **Noise IK handshake** (`Noise_IK_25519_ChaChaPoly_BLAKE2s`). The server verifies the client's static public key against its registry — unauthorized clients are rejected before any data flows.
@@ -164,7 +242,7 @@ console.log(stats.totalConnectionsQuic);
 console.log(stats.totalConnectionsWireguard);
 ```
 
-**WireGuard connection state is handshake-driven** — registered WireGuard peers do NOT appear as "connected" until their first successful WireGuard handshake completes. They automatically disconnect after 180 seconds of inactivity or when boringtun reports `ConnectionExpired`. This matches how WebSocket/QUIC clients behave: they appear on connection and disappear on disconnect.
+**WireGuard connection state follows authenticated tunnel traffic** — a configured peer has no live return route until its first authenticated, source-authorized tunnel packet. Handshake or keepalive traffic alone does not admit a packet session. Peers disconnect after 180 seconds of inactivity, registry expiry, or when boringtun reports `ConnectionExpired`. Disconnect retains the configured peer but resets its cryptographic state, so subsequent traffic requires a fresh handshake. Raw peer connection IDs use `wg-` followed by the full public key.
 
 ### 🛡️ ACL Engine (SmartProxy-Aligned)
 
@@ -313,7 +391,61 @@ The **userspace NAT** mode extracts destination IP/port from IP packets, opens a
 
 The **bridge** mode assigns VPN clients IPs from a real LAN subnet instead of a virtual VPN subnet. Clients appear as if they're directly on the physical network — perfect for remote access to home labs, office networks, or IoT devices.
 
-The **hybrid** mode runs both engines simultaneously with a **per-client routing table**. Each client's `useHostIp` flag determines whether its packets go through the bridge (L2, LAN IP) or socket NAT (userspace, VPN IP). This is ideal when most clients need internet NAT but some need direct LAN access.
+The **hybrid** mode runs both engines simultaneously. Each authenticated session's `useHostIp` setting determines whether its packets go through the bridge or socket NAT; routing does not look up identity from the packet source.
+
+### Inner packet MTU
+
+`mtu` means inner IP bytes, not the outer network link MTU. It defaults to 1420
+and must be an integer from 576 through 65472, leaving room for the supported
+Noise and WireGuard framing. Larger previous values now reject before startup
+effects. The server uses this same ceiling for its TUN/TAP, userspace stack and
+native assignment; it does not subtract an estimated encapsulation overhead.
+
+Native clients now send their receive ceiling inside the authenticated Noise IK
+handshake. The server retains `min(server MTU, client MTU)` on that session,
+advertises it with the actual assignment subnet, and applies it to ingress,
+return encryption and the session's userspace TCP stack. Client configuration
+defaults to 1420; the client uses the negotiated ceiling unchanged for its TUN
+and both packet directions. Assignment fields must be valid before device setup;
+there is no guessed `/24`, gateway or MTU fallback. This changes the native wire
+contract: both ends must be upgraded together. Standard WireGuard framing is unchanged.
+
+Eligible oversized outbound client IPv4 packets receive feedback through the
+client TUN using its assigned address and subnet. An incomplete or failed device
+write is an error, never counted as successful feedback or retried as a second
+packet. Oversized inbound packets are discarded before TUN writes.
+
+WireGuard clients use the public flat `wgPrivateKey`, `serverPublicKey`,
+`wgAddress`, `wgAddressPrefix`, `wgEndpoint` and nonempty `wgAllowedIps` fields.
+The old Rust-only nested `peer` input is removed, with no translation fallback.
+Addresses, prefixes, keys, endpoint and MTU validate before TUN setup. The configured
+prefix supplies the device netmask; AllowedIPs route networks are canonicalized.
+`forwardingMode: 'testing'` creates no TUN or routes; the existing WireGuard default
+remains `'tun'` (native defaults to `'testing'`). Endpoint hostnames resolve in Rust.
+AllowedIPs authorizes decrypted source addresses and outbound destinations, after
+validating IP headers. The local configured MTU applies unchanged in both directions;
+standard WireGuard has no native SmartVPN MTU negotiation.
+
+`client.getMtuInfo()` now reports the live native or WireGuard runtime, or `null` when inactive.
+`tunMtu` is `null` in testing mode because no interface exists; unmeasured
+`linkMtu` and `overheadBytes` are also `null`. Counters belong to the current
+connection and `icmpTooBigSent` counts only complete TUN writes. These nullable
+results replace the previous hard-coded values.
+
+Authenticated native and integrated WireGuard packets are size-checked after
+source/ACL/rate admission and before forwarding. Return packets are checked before
+encryption. Oversized packets are dropped even when no safe error can be sent.
+Eligible IPv4 DF packets receive a bounded fragmentation-needed response from the
+owned tunnel gateway or bridge host address, through their exact session. Invalid
+headers, ICMP errors, noninitial fragments, multicast and known broadcasts do not
+generate errors. Feedback is limited to 10 packets/second with a burst of 10 per
+server; internal accounting distinguishes dropped packets from feedback queued.
+
+This is an inner admission ceiling, not IP fragmentation/reassembly or measured
+path-MTU discovery. Raw WG IPv6 remains kernel/testing-only and oversized IPv6 is
+dropped without fabricating an IPv6 router address. Standalone host-network
+cleanup and privileged WireGuard TUN qualification remain outstanding; the
+unprivileged packet fixtures do not establish host readiness for those modes.
 
 ### 🏠 Per-Client Bridge & VLAN Settings
 
@@ -365,7 +497,7 @@ VLAN support uses Linux bridge VLAN filtering — each client's TAP port gets ta
 - **Adaptive keepalives**: Interval adjusts based on link health (60s → 30s → 10s)
 - **Per-client rate limiting**: Token bucket with configurable bytes/sec and burst
 - **Dead-peer detection**: 180s inactivity timeout (all transports)
-- **MTU management**: Automatic overhead calculation (IP+TCP+WS+Noise = 79 bytes)
+- **MTU management**: Enforced inner packet ceilings and live counters; unmeasured outer-path values remain null
 - **Per-transport stats**: Active client and total connection counts broken down by websocket, QUIC, and WireGuard
 
 ### 🏷️ Client Tags (Trusted vs Informational)
@@ -396,6 +528,83 @@ await client.connect({
 
 The server acts as a **hub** — one API to manage all clients:
 
+`createClient()` accepts `IClientCreateOptions` with a required `clientId`;
+`updateClient()` accepts `TClientUpdateOptions`. Both reject unknown fields,
+server-owned identity/key/address fields, malformed security, invalid IPv4 ACL
+patterns, out-of-range integers and invalid VLAN combinations. Rejected settings
+do not change the registry or consume a new address. `forceTarget` requires an
+explicit IPv4 target; malformed policies are also rejected at server startup.
+
+Omitting an update field preserves it; explicit `null` clears an optional setting.
+Responses omit absent optional fields (including nested security/policy fields),
+matching the TypeScript interfaces; `null` is a clearing input, not an output value.
+A supplied `security` object replaces the whole security object, not individual
+nested fields. Clear `forceVlan` together with `vlanId`; an enabled VLAN requires
+an ID from 1 to 4094. Use `serverDefinedClientTags`; the shipped deprecated `tags`
+input remains accepted, but supplying both names is rejected as ambiguous.
+Preloaded entries also reject both populated tag fields; accepted old tags are
+consumed into the canonical field and are not retained in registry output.
+Input validation is separate from transport ownership and queued forwarding
+revocation; the runtime ownership rules below apply after successful admission.
+
+Native WebSocket/QUIC handshakes also recheck the exact registry incarnation and
+revision after sending the Noise response, before local admission. A successful
+update, disable/re-enable or remove/recreate invalidates an in-flight handshake;
+a rejected update does not. Network response writes do not hold the registry
+lock.
+
+Native and integrated WireGuard transports share one live session owner per
+registered client. Authenticated reconnect cancels and joins the previous
+transport generation before admitting its replacement. Disconnect, successful
+settings changes, disable, expiry, removal and key rotation retire the old
+transport and its WireGuard return relay. Queued WireGuard returns carry their
+original session identity and cannot target a replacement. Failed key-rotation
+reconciliation does not restore old credentials; inspect the registry and retry
+the operation to obtain fresh credentials.
+
+Registry assignments are reserved before listeners start and reused unchanged
+across native/WireGuard connections. Disconnect retains that reservation; record
+removal releases it only after transport teardown. Explicit assignments, including
+raw WireGuard reservations, precede dynamic allocation. A failed create cannot
+release an address belonging to a concurrent registry revision or recreated record.
+Decrypted registered-client packets must have a valid IPv4 header and exactly the
+assigned source address. Connection ACLs use the outer transport endpoint;
+destination ACLs use the inner packet destination. Runtime rate-limit adjustments
+apply to the current session only; use registry security settings for reconnects.
+
+Socket and bridge forwarding queues retain authenticated session ownership until
+their packet work is destroyed. Socket mode gives each session its own smoltcp
+stack; policy and PROXY identity come from that captured session, never a mutable
+registry lookup by packet source. Its TCP/UDP flows and socket readers are joined
+on revocation, and replies return only to their original owner. Flow incarnations
+also fence late responses when a tuple is reused. UDP flows sharing a destination
+are selected by received source endpoint, and real UDP sockets accept replies only
+from their configured target.
+
+Return queues are also generation-owned: cancellation purges queued payloads
+without waiting for a consumer, including WireGuard's shared return queue.
+Dequeued packets retain their destination lifetime, and internal relay packets
+retain their source lifetime too, until I/O finishes or the payload is destroyed.
+An interrupted native ciphertext write retires that destination tunnel rather
+than continuing a partially written frame or an advanced Noise nonce sequence.
+WireGuard returns require a current encryption session. While rekeying without
+one, application packets are dropped and counted; only a handshake is requested,
+so plaintext cannot escape owner cancellation through BoringTun's private queue.
+Queues are bounded (256 per session, 1024 for shared WG returns); full or closed
+queues reject admission. Managed relay uses these same two-owner lifetimes.
+
+Socket NAT is bounded to 256 active engines and 1,024 flow incarnations per server
+dispatcher. The per-client default is 128 TCP/UDP flows combined; a registered
+client's `security.maxConnections` overrides that local limit without bypassing
+the global cap. Late task/message references retain capacity until destroyed.
+Protocol and dispatch queues are bounded. This IPv4 userspace build does not
+reassemble fragments and rejects them before creating flows.
+
+These guarantees cover daemon-owned work, not traffic already handed to an
+external network or kernel. Managed relay is described below. Transactional cleanup
+and privileged qualification of standalone kernel modes remain outstanding;
+packet fixtures do not prove production network readiness.
+
 ```typescript
 // Create (generates keys, assigns IP, returns config bundle)
 const bundle = await server.createClient({ clientId: 'bob-phone' });
@@ -424,6 +633,108 @@ const wgConf = await server.exportClientConfig('bob-phone', 'wireguard');
 await server.removeClient('bob-phone');
 ```
 
+### Caller-owned managed networks
+
+`forwardingMode: 'managed'` is an exclusive IPv4 node relay. The hub creates no
+TUN, NAT, bridge or host routes. Start it with a fixed `subnet` and required
+`managedAuthorityId`, then call `reconcileManagedNetwork(snapshot)`. Cloudly (or
+another trusted controller) owns durable node IDs, keys, control addresses,
+workload prefixes and policy; SmartVPN owns volatile enforcement, not persistence.
+Protect the management IPC endpoint: the authority ID is a binding, not a credential.
+
+```typescript
+import type { IManagedNetworkSnapshot } from '@push.rocks/smartvpn';
+
+const snapshot: IManagedNetworkSnapshot = {
+  schemaVersion: 1,
+  authorityId: 'cloudly',
+  revision: 1,
+  nodes: [{
+    nodeId: 'worker-a',
+    publicKey: '<caller-owned-noise-public-key-base64>',
+    controlAddress: '10.88.0.2',
+    controlPolicyDomain: 'control',
+    enabled: true,
+    workloadPrefixes: [{ cidr: '10.90.0.0/24', policyDomain: 'task.vc' }],
+  }],
+  grants: [], // Absent grants deny, including within the same domain.
+};
+const applied = await server.reconcileManagedNetwork(snapshot);
+const status = await server.getManagedNetworkStatus();
+const projection = await server.getManagedNodeProjection('worker-a');
+```
+
+Snapshots are complete replacements. Canonical array order makes exact replay
+idempotent; stale revisions and conflicting equal revisions reject. Revisions
+are positive JSON-safe integers scoped to `lifetimeId`. Every daemon restart
+starts empty and requires the caller to reconcile its current durable state.
+Node keys must be unique canonical/contributory X25519 keys, including across
+Noise and WireGuard. Control addresses are exact usable hosts in the fixed subnet;
+workload prefixes cannot overlap that subnet or any other owned prefix.
+
+Grants are explicit `(sourceDomain, destinationDomain)` pairs. They neither imply
+same-domain permission nor reverse/reply permission. Different workload prefixes
+on one node may belong to different domains. Disabled, expired, missing, offline
+or denied destinations drop without host fallback. Traffic that never crosses
+the hub needs local enforcement by the node executor; local workload prefixes
+are never routed back to the hub merely because a grant involves them.
+
+Invalid preparation preserves active authority. A valid change quarantines and
+cancels only affected node generations, joins their packet work, prepares WG
+crypto and commits the whole snapshot atomically before acknowledging. Unchanged
+nodes keep their sessions. A post-drain failure leaves `state: 'failed'`, its
+`pendingRevision` and bounded `lastError`; old affected admission stays closed.
+Only the exact pending snapshot can retry. An IPC timeout or disconnected caller
+does not cancel the process-owned operation. Inspect status and replay that exact
+target; never assume a timed-out request did not commit. Separate Unix IPC
+connections can inspect status while apply drains; stdio remains sequential.
+
+Standalone create/update/remove/enable/disable/rotate/disconnect/rate-limit and
+raw WG-peer mutations reject in managed mode, including direct WG-loop commands.
+Standalone startup clients, raw peers, DNS, NAT, bridge and destination-routing
+configuration reject before effects. Managed WireGuard requires an explicit
+`serverEndpoint` and starts without peers until reconciliation.
+
+Native clients opt in with `managedNetwork: { authorityId: 'cloudly', nodeId: 'worker-a' }`.
+Missing, unexpected or differently bound managed assignments reject before host
+effects; a managed client cannot downgrade to a standalone subnet assignment.
+Native encrypted assignments carry schema, node/authority/lifetime/revision,
+local ownership and remote outgoing routes. Client `getStatus().managedNetwork`
+reports only the live validated assignment and clears on retirement. Native Linux
+TUN setup uses a fresh nonpersistent /32 device with strict exclusive route adds,
+not shell commands or route-conflict suppression. Preflight rejects malformed,
+overlapping, default, local-prefix and active-hub-endpoint capture. The netlink
+owner is polled inline; failure/cancellation drops the device and its owned routes.
+No DNS or default-route mutation is requested; native `forwardingMode: 'testing'`
+has no host effects. Managed TUN requires Linux.
+
+The Linux amd64 musl build passed the isolated `serve.zone/testing` VM scenario:
+real WS/Noise transport and TUN workload traffic between nodes connected only to
+the hub, directed allow/deny, reconnect, natural revocation, partial route-conflict
+rollback, empty-authority restart, and child termination. Cleanup removed owned
+namespaces and preserved DNS and IPv4/IPv6 default routes. This qualification
+does not cover WSS/private CAs, IPv6 workload traffic, privileged ARM64 networking,
+standalone kernel modes, or Pallet/Cloudly production integration.
+
+WireGuard has no assignment channel. `getManagedNodeProjection(nodeId)` returns
+the applied control `/32`, per-prefix domains, outgoing destinations, incoming
+sources, MTU and optional public WG configuration, never a private key. Client
+WG AllowedIPs is the union of remote outgoing/incoming prefixes plus the hub's
+MTU-feedback gateway `/32`; the hub independently enforces direction. Server WG
+AllowedIPs contains the node's owned source prefixes. Authenticated WG keepalive
+confirmation admits receive-only managed nodes without an inner probe. Projection
+`ready` means applied/admissible configuration, not connectivity, node installation
+or deployment readiness; disabled, absent and quarantined nodes return no config.
+The controller must apply WG projections through its owned node runtime.
+
+Bounds are 1,024 nodes, 128 workload prefixes per node, 16,384 owned prefixes,
+16,384 grants, 128-byte IDs, 1,024 routes per node per direction, and 262,144 total
+projected routes/grants. Managed relay enforces both live negotiated MTUs and
+returns eligible IPv4 fragmentation-needed feedback to the exact source owner.
+The complete [third-party notice index](./third-party-notices.md) covers the locked
+Cargo graph and statically linked compiler/runtime components. Keep its accompanying
+notice files with separately redistributed executables.
+
 ### 📝 WireGuard Config Generation
 
 Generate standard `.conf` files for any WireGuard client:
@@ -493,6 +804,7 @@ client.on('exit', ({ code, signal }) => { /* daemon process exited */ });
 |-------|-----------|---------|
 | `exit` | Both | `{ code, signal }` — daemon process exited |
 | `reconnected` | Both | `void` — socket transport reconnected |
+| `stderr` | Both | `string` — daemon diagnostic line, forwarded without automatic logging |
 
 For connection state and telemetry, use `getStatus()`, `getStatistics()`, `listClients()`, and `getClientTelemetry()`.
 
@@ -532,6 +844,8 @@ For connection state and telemetry, use `getStatus()`, `getStatistics()`, `listC
 | Command | Description |
 |---------|-------------|
 | `start` / `stop` | Start/stop the VPN listener |
+| `reconcileManagedNetwork` | Validate, drain and atomically apply a complete managed snapshot |
+| `getManagedNetworkStatus` / `getManagedNodeProjection` | Authority/lifetime/revision status and caller-applied node configuration |
 | `createClient` | Generate keys, assign IP, return config bundle |
 | `removeClient` / `getClient` / `listRegisteredClients` | Client registry CRUD |
 | `updateClient` / `enableClient` / `disableClient` | Modify client state |
@@ -615,6 +929,31 @@ All frames use `[type:1B][length:4B][payload:NB]` with a 64KB max payload:
 
 ## Development 🛠️
 
+### Native binary selection and build prerequisites
+
+The package builds `smartvpn_daemon_linux_amd64_musl` and
+`smartvpn_daemon_linux_arm64_musl` with the pinned Rust 1.95.0 toolchain and
+locked Cargo dependencies. Both targets require genuine musl C toolchains for
+the native `ring` and `mimalloc` dependencies. Put `x86_64-linux-musl-gcc` and
+`aarch64-linux-musl-gcc` on `PATH` before building or testing; GNU libc headers
+are not a substitute. The existing build and test commands remain unchanged.
+
+In stdio mode the bridge selects exactly the bundled executable for Linux x64
+or arm64. `SMARTVPN_RUST_BINARY` selects an explicit development executable on
+any supported native build platform. Missing, non-executable, and empty explicit
+selections fail: there is no fallback to old GNU artifacts, the current working
+directory's Rust builds, platform packages, or a daemon found on `PATH`.
+Other platforms must provide that explicit executable. Socket transport connects
+to an independently managed daemon and does not require a local binary.
+
+For an unprivileged build host, musl's upstream `musl-gcc` wrappers can provide
+the C toolchains using existing native and cross GCC compilers. Build musl 1.2.5
+in separate disposable prefixes for each architecture, with `--disable-shared`
+and an explicitly prefix-local `--syslibdir`. Use the two musl security patches
+from [Rust 1.95.0's build recipe](https://github.com/rust-lang/rust/blob/1.95.0/src/ci/docker/scripts/musl-toolchain.sh).
+Expose the generated wrappers under the target-specific names above; never
+install a replacement libc or dynamic linker into the host's system directories.
+
 ```bash
 # Install dependencies
 pnpm install
@@ -674,7 +1013,7 @@ smartvpn/
 │       └── reconnect.rs        # Exponential backoff + session tokens
 ├── test/                       # Test files
 ├── dist_ts/                    # Compiled TypeScript
-└── dist_rust/                  # Cross-compiled binaries (linux amd64 + arm64)
+└── dist_rust/                  # Static musl binaries (Linux amd64 + arm64)
 ```
 
 ## License and Legal Information

package/third-party-notices.md

@@ -0,0 +1,81 @@
+# Third-party notices
+
+These notices accompany SmartVPN's static Linux amd64 and arm64 musl executables.
+SmartVPN's own code is MIT-licensed under [license.md](./license.md).
+
+## Cargo dependencies
+
+[Cargo dependency notices](./notices/cargo-dependencies.html) reproduce the selected
+upstream license and copyright texts for 270 third-party packages. Eight additional
+locked, feature-inactive packages are covered by these supplemental MIT notices:
+
+- [aho-corasick 1.1.4](./notices/aho-corasick-license.txt), from the published crate's `LICENSE-MIT`.
+- [defmt 0.3.100 and 1.0.1, defmt-macros 1.0.1, defmt-parser 1.0.0](./notices/defmt-license.txt),
+  from their shared upstream `LICENSE-MIT`. The respective source commits are
+  `f6decae6e09d1216aff052aa0733a6b5e632a100`, `8459657ef6df5e6f3386512744110caef5f0612a`
+  (also macros), and `4a8cdb44891ed57b8ff5a023b6bec7137c48708f` in
+  [knurling-rs/defmt](https://github.com/knurling-rs/defmt).
+  All three source files have SHA-256 `2710a622a896bba67356913d4d0492cab5465f61b2ecce6d880aeb483834fb50`;
+  the copy adds only a final newline.
+- [proc-macro-error2 2.0.1 and proc-macro-error-attr2 2.0.0](./notices/proc-macro-error2-license.txt),
+  from their identical published `LICENSE-MIT` files.
+- [valuable 0.1.1](./notices/valuable-license.txt), from
+  [its pinned upstream LICENSE](https://github.com/tokio-rs/valuable/blob/9efc29b6e58cef28f6566a47aa7e142a55fead77/LICENSE).
+
+Together these cover all 278 locked registry packages, conservatively including
+build-only and target-inactive dependencies. Listing a package does not mean it
+is linked into either Linux executable. MIT is preferred where offered as an
+alternative; other selected terms include Apache-2.0, BSD, ISC, Unicode-3.0,
+CDLA-Permissive-2.0 and the existing tun 0.7.22 dependency's WTFPL.
+The exact package versions, declared license expressions and reviewed file hashes
+are recorded in [inventory.json](./notices/inventory.json).
+
+The [additional MIT source attributions](./notices/mit-source-attributions.txt)
+retain cesu8 1.1.0's Rust Project/Eric Kidd source headers and siphasher 1.0.2's
+Rust Project/Frank Denis `COPYING` attribution, together with the selected MIT terms.
+cesu8's historical Rust copyright inventory is also retained conservatively in
+the generated notices. Combined upstream license files remain intact; additional
+terms concerning unlinked components are not a claim that those components ship.
+The earlier [Linux route backend notices](./assets/third-party-licenses.md) remain
+as supplementary exact upstream attribution, not the complete distribution index.
+
+## Compiler and static runtime
+
+`rust-toolchain.toml` pins Rust 1.95.0 and both musl targets. Components supplied
+by that compiler are outside Cargo.lock and have separate notices:
+
+- [Rust standard-library inventory](./notices/rust-standard-library.html), from the
+  official toolchain's `share/doc/rust/COPYRIGHT-library.html`. Its source SHA-256
+  is `90567e2718bf7fd65a71a3a43c5596488e80e5f51ed02bfea6fec54458b5f3d1`;
+  the copy adds only a final newline. This upstream inventory covers other targets too.
+- [musl copyright](./notices/musl-copyright.txt), from
+  [musl 1.2.5](https://git.musl-libc.org/cgit/musl/tree/COPYRIGHT?h=v1.2.5).
+  The C build toolchains use musl commit `0784374d561435f7c787a555aeab8ede699ed298`
+  with the two security patches selected by
+  [Rust 1.95.0's build recipe](https://github.com/rust-lang/rust/blob/1.95.0/src/ci/docker/scripts/musl-toolchain.sh).
+  The final executables link Rust's self-contained musl CRT/libraries.
+- [Compiler-builtins license](./notices/compiler-builtins-license.txt), from
+  [Rust 1.95.0](https://github.com/rust-lang/rust/blob/1.95.0/library/compiler-builtins/LICENSE.txt),
+  retaining MIT and Apache-2.0 WITH LLVM-exception terms.
+- [LLVM libunwind license](./notices/llvm-libunwind-license.txt), from
+  [Rust's pinned LLVM revision](https://github.com/rust-lang/llvm-project/blob/1cb4e3833c1919c2e6fb579a23ac0e2b22587b7e/libunwind/LICENSE.TXT),
+  including its additional third-party terms.
+
+The TypeScript dependency graph is installed independently through the npm
+manifest; its packages are not bundled into these Rust executables.
+
+## Reproduction and review
+
+From the repository root, with cargo-about 0.9.1:
+
+```sh
+cargo about generate --manifest-path rust/Cargo.toml --config rust/about.toml --locked --fail --output-file notices/cargo-dependencies.html rust/about.hbs
+```
+
+The configuration selects checksum-verified upstream notices when published
+crates omit or misname them. Network access is required for pinned Git sources.
+After a Cargo graph, compiler, or notice-input change, regenerate and review the
+notices, refresh the inventory, and rerun distribution review. Tests reject stale
+hashes, incomplete graph coverage, generic copyright placeholders and missing npm
+notice paths. Keep this index, `license.md`, `assets/third-party-licenses.md` and
+the entire `notices/` directory beside any separately distributed executable.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartvpn',
-  version: '1.22.0',
+  version: '2.1.0',
   description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 }