@push.rocks/smartvpn 1.3.0 → 1.4.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartvpn',
-    version: '1.3.0',
+    version: '1.4.0',
     description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/smartvpn.classes.vpnconfig.js

@@ -10,8 +10,11 @@ export class VpnConfig {
         if (!config.serverUrl) {
             throw new Error('VpnConfig: serverUrl is required');
         }
-        if (!config.serverUrl.startsWith('wss://') && !config.serverUrl.startsWith('ws://')) {
-            throw new Error('VpnConfig: serverUrl must start with wss:// or ws://');
+        // For QUIC-only transport, serverUrl is a host:port address; for WebSocket/auto it must be ws:// or wss://
+        if (config.transport !== 'quic') {
+            if (!config.serverUrl.startsWith('wss://') && !config.serverUrl.startsWith('ws://')) {
+                throw new Error('VpnConfig: serverUrl must start with wss:// or ws:// (for WebSocket transport)');
+            }
         }
         if (!config.serverPublicKey) {
             throw new Error('VpnConfig: serverPublicKey is required');
@@ -95,4 +98,4 @@ export class VpnConfig {
         return !isNaN(prefixNum) && prefixNum >= 0 && prefixNum <= 32;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jb25maWcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBTWpEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFNBQVM7SUFDcEI7O09BRUc7SUFDSSxNQUFNLENBQUMsb0JBQW9CLENBQUMsTUFBd0I7UUFDekQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDcEYsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzVCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEdBQUcsR0FBRyxJQUFJLE1BQU0sQ0FBQyxHQUFHLEdBQUcsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6RSxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLHFCQUFxQixLQUFLLFNBQVMsSUFBSSxNQUFNLENBQUMscUJBQXFCLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbkYsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNmLEtBQUssTUFBTSxHQUFHLElBQUksTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO2dCQUM3QixJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUM5QixNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO2dCQUM1RCxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsb0JBQW9CLENBQUMsTUFBd0I7UUFDekQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQUMsa0NBQWtDLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuQixNQUFNLElBQUksS0FBSyxDQUFDLCtCQUErQixDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELElBQUksQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQzVDLE1BQU0sSUFBSSxLQUFLLENBQUMsOEJBQThCLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxHQUFHLEtBQUssU0FBUyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsR0FBRyxHQUFHLElBQUksTUFBTSxDQUFDLEdBQUcsR0FBRyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pFLE1BQU0sSUFBSSxLQUFLLENBQUMsOENBQThDLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMscUJBQXFCLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxxQkFBcUIsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNuRixNQUFNLElBQUksS0FBSyxDQUFDLCtDQUErQyxDQUFDLENBQUM7UUFDbkUsQ0FBQztJQUNILENBQUM7SUFFRDs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFJLFFBQWdCO1FBQ2xELE1BQU0sT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN0RSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFNLENBQUM7SUFDbEMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUksUUFBZ0IsRUFBRSxNQUFTO1FBQzNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNoRCxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFFRDs7T0FFRztJQUNLLE1BQU0sQ0FBQyxTQUFTLENBQUMsRUFBVTtRQUNqQyxNQUFNLEtBQUssR0FBRyxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzVCLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDckMsT0FBTyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUU7WUFDMUIsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztZQUMvQixPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDLElBQUksR0FBRyxJQUFJLEdBQUcsSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssSUFBSSxDQUFDO1FBQ3ZFLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ssTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFjO1FBQ3pDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsTUFBTSxDQUFDLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN2QyxJQUFJLENBQUMsRUFBRSxJQUFJLENBQUMsTUFBTTtZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ2pDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQzNDLE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDdkMsT0FBTyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBSSxTQUFTLElBQUksQ0FBQyxJQUFJLFNBQVMsSUFBSSxFQUFFLENBQUM7SUFDaEUsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jb25maWcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBTWpEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFNBQVM7SUFDcEI7O09BRUc7SUFDSSxNQUFNLENBQUMsb0JBQW9CLENBQUMsTUFBd0I7UUFDekQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUNELDJHQUEyRztRQUMzRyxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDaEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDcEYsTUFBTSxJQUFJLEtBQUssQ0FBQyxnRkFBZ0YsQ0FBQyxDQUFDO1lBQ3BHLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUM1QixNQUFNLElBQUksS0FBSyxDQUFDLHdDQUF3QyxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxHQUFHLEdBQUcsSUFBSSxNQUFNLENBQUMsR0FBRyxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDekUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxxQkFBcUIsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLHFCQUFxQixHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDZixLQUFLLE1BQU0sR0FBRyxJQUFJLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQztnQkFDN0IsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztvQkFDOUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsR0FBRyxFQUFFLENBQUMsQ0FBQztnQkFDNUQsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksTUFBTSxDQUFDLG9CQUFvQixDQUFDLE1BQXdCO1FBQ3pELElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbkIsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUM1QyxNQUFNLElBQUksS0FBSyxDQUFDLDhCQUE4QixNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEdBQUcsR0FBRyxJQUFJLE1BQU0sQ0FBQyxHQUFHLEdBQUcsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6RSxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLHFCQUFxQixLQUFLLFNBQVMsSUFBSSxNQUFNLENBQUMscUJBQXFCLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbkYsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO1FBQ25FLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBSSxRQUFnQjtRQUNsRCxNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDdEUsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBTSxDQUFDO0lBQ2xDLENBQUM7SUFFRDs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFJLFFBQWdCLEVBQUUsTUFBUztRQUMzRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDaEQsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRUQ7O09BRUc7SUFDSyxNQUFNLENBQUMsU0FBUyxDQUFDLEVBQVU7UUFDakMsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM1QixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ3JDLE9BQU8sS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFO1lBQzFCLE1BQU0sR0FBRyxHQUFHLFFBQVEsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDL0IsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLElBQUksQ0FBQztRQUN2RSxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNLLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBYztRQUN6QyxNQUFNLENBQUMsRUFBRSxFQUFFLE1BQU0sQ0FBQyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDdkMsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNqQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUMzQyxNQUFNLFNBQVMsR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZDLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksU0FBUyxJQUFJLENBQUMsSUFBSSxTQUFTLElBQUksRUFBRSxDQUFDO0lBQ2hFLENBQUM7Q0FDRiJ9

package/dist_ts/smartvpn.interfaces.d.ts

@@ -21,6 +21,10 @@ export interface IVpnClientConfig {
     mtu?: number;
     /** Keepalive interval in seconds (default: 30) */
     keepaliveIntervalSecs?: number;
+    /** Transport protocol: 'auto' (default, tries QUIC then WS), 'websocket', or 'quic' */
+    transport?: 'auto' | 'websocket' | 'quic';
+    /** For QUIC: SHA-256 hash of server certificate (base64) for cert pinning */
+    serverCertHash?: string;
 }
 export interface IVpnClientOptions {
     transport: TVpnTransportOptions;
@@ -51,6 +55,12 @@ export interface IVpnServerConfig {
     defaultRateLimitBytesPerSec?: number;
     /** Default burst size for new clients (bytes). Omit for unlimited. */
     defaultBurstBytes?: number;
+    /** Transport mode: 'both' (default, WS+QUIC), 'websocket', or 'quic' */
+    transportMode?: 'websocket' | 'quic' | 'both';
+    /** QUIC listen address (host:port). Defaults to listenAddr. */
+    quicListenAddr?: string;
+    /** QUIC idle timeout in seconds (default: 30) */
+    quicIdleTimeoutSecs?: number;
 }
 export interface IVpnServerOptions {
     transport: TVpnTransportOptions;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",
@@ -11,6 +11,7 @@
   "typings": "dist_ts/index.d.ts",
   "scripts": {
     "build": "(tsbuild tsfolders --allowimplicitany) && (tsrust)",
+    "test:before": "(tsrust)",
     "test": "tstest test/ --verbose",
     "buildDocs": "tsdoc"
   },
@@ -28,15 +29,15 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@push.rocks/smartrust": "^1.3.0",
-    "@push.rocks/smartpath": "^5.0.18"
+    "@push.rocks/smartpath": "^6.0.0",
+    "@push.rocks/smartrust": "^1.3.2"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^2.2.12",
-    "@git.zone/tsrun": "^1.3.3",
-    "@git.zone/tstest": "^1.0.96",
-    "@git.zone/tsrust": "^1.0.29",
-    "@types/node": "^22.0.0"
+    "@git.zone/tsbuild": "^4.3.0",
+    "@git.zone/tsrun": "^2.0.1",
+    "@git.zone/tsrust": "^1.3.0",
+    "@git.zone/tstest": "^3.5.0",
+    "@types/node": "^25.5.0"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -2,6 +2,12 @@
 
 A high-performance VPN with a **TypeScript control plane** and a **Rust data plane daemon**. Manage VPN connections with clean, fully-typed APIs while all networking heavy lifting — encryption, tunneling, QoS, rate limiting — runs at native speed in Rust.
 
+🔒 **Noise NK** handshake + **XChaCha20-Poly1305** encryption
+🚀 **Dual transport**: WebSocket (Cloudflare-friendly) and raw **QUIC** (with datagram support)
+📊 **Adaptive QoS**: packet classification, priority queues, per-client rate limiting
+🔄 **Auto-transport**: tries QUIC first, falls back to WebSocket seamlessly
+📡 **Real-time telemetry**: RTT, jitter, loss, link health — all exposed via typed APIs
+
 ## Issue Reporting and Security
 
 For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
@@ -17,11 +23,13 @@ pnpm install @push.rocks/smartvpn
 ```
 TypeScript (control plane)              Rust (data plane)
 ┌──────────────────────────┐            ┌────────────────────────────────────┐
-│ VpnClient / VpnServer    │            │ smartvpn_daemon                     │
+│ VpnClient / VpnServer    │            │ smartvpn_daemon                    │
 │   └─ VpnBridge           │──stdio/──▶ │  ├─ management (JSON IPC)          │
-│      └─ RustBridge       │  socket    │  ├─ transport (WebSocket/TLS)      │
-│         (smartrust)      │            │  ├─ crypto (Noise NK + XCha20)     │
-└──────────────────────────┘            │  ├─ codec (binary framing)         │
+│      └─ RustBridge       │  socket    │  ├─ transport_trait (abstraction)   │
+│         (smartrust)      │            │  │   ├─ transport (WebSocket/TLS)   │
+└──────────────────────────┘            │  │   └─ quic_transport (QUIC/UDP)   │
+                                        │  ├─ crypto (Noise NK + XCha20)     │
+                                        │  ├─ codec (binary framing)         │
                                         │  ├─ keepalive (adaptive state FSM) │
                                         │  ├─ telemetry (RTT/jitter/loss)    │
                                         │  ├─ qos (classify + priority Q)    │
@@ -37,8 +45,10 @@ TypeScript (control plane)              Rust (data plane)
 
 | Decision | Choice | Why |
 |----------|--------|-----|
-| Transport | WebSocket over HTTPS | Works through Cloudflare and other terminating proxies |
-| Encryption | Noise NK + XChaCha20-Poly1305 | Strong forward secrecy, large nonce space (no counter needed) |
+| Transport | WebSocket + QUIC (dual) | WS works through Cloudflare; QUIC gives lower latency + unreliable datagrams |
+| Auto-transport | QUIC first, WS fallback | Best performance when QUIC is available, graceful degradation when it's not |
+| Encryption | Noise NK + XChaCha20-Poly1305 | Strong forward secrecy, large nonce space (no counter sync needed) |
+| QUIC auth | Certificate hash pinning | WireGuard-style trust model — no CA needed, just pin the server cert hash |
 | Keepalive | Adaptive app-level pings | Cloudflare drops WS pings; interval adapts to link health (10–60s) |
 | QoS | Packet classification + priority queues | DNS/SSH/ICMP always drain first; bulk flows get deprioritized |
 | Rate limiting | Per-client token bucket | Byte-granular, dynamically reconfigurable via IPC |
@@ -89,6 +99,39 @@ await client.disconnect();
 client.stop();
 ```
 
+### VPN Client with QUIC
+
+```typescript
+import { VpnClient } from '@push.rocks/smartvpn';
+
+// Explicit QUIC — serverUrl is host:port, pinned by cert hash
+const quicClient = new VpnClient({
+  transport: { transport: 'stdio' },
+});
+
+await quicClient.start();
+
+const { assignedIp } = await quicClient.connect({
+  serverUrl: 'vpn.example.com:443',
+  serverPublicKey: 'BASE64_SERVER_PUBLIC_KEY',
+  transport: 'quic',
+  serverCertHash: 'BASE64_SHA256_CERT_HASH', // printed by server on startup
+});
+
+// Or use auto-transport: tries QUIC first (3s timeout), falls back to WS
+const autoClient = new VpnClient({
+  transport: { transport: 'stdio' },
+});
+
+await autoClient.start();
+
+await autoClient.connect({
+  serverUrl: 'wss://vpn.example.com/tunnel', // WS URL — host:port extracted for QUIC attempt
+  serverPublicKey: 'BASE64_SERVER_PUBLIC_KEY',
+  transport: 'auto', // default — QUIC first, then WS
+});
+```
+
 ### VPN Server
 
 ```typescript
@@ -100,10 +143,9 @@ const server = new VpnServer({
 
 // Generate a Noise keypair first
 await server.start();
-// If you don't have keys yet:
 const keypair = await server.generateKeypair();
 
-// Start the VPN listener (or pass config to start() directly)
+// Start the VPN listener
 await server.start({
   listenAddr: '0.0.0.0:443',
   privateKey: keypair.privateKey,
@@ -112,6 +154,12 @@ await server.start({
   dns: ['1.1.1.1'],
   mtu: 1420,
   enableNat: true,
+  // Transport mode: 'websocket', 'quic', or 'both' (default)
+  transportMode: 'both',
+  // Optional: separate QUIC listen address
+  quicListenAddr: '0.0.0.0:4433',
+  // Optional: QUIC idle timeout
+  quicIdleTimeoutSecs: 30,
   // Optional: default rate limit for all new clients
   defaultRateLimitBytesPerSec: 10_000_000, // 10 MB/s
   defaultBurstBytes: 20_000_000,           // 20 MB burst
@@ -247,11 +295,66 @@ Both `VpnClient` and `VpnServer` extend `EventEmitter`:
 ```typescript
 client.on('exit', ({ code, signal }) => { /* daemon exited */ });
 client.on('reconnected', () => { /* socket reconnected */ });
+client.on('status', (status) => { /* IVpnStatus update */ });
+client.on('error', (error) => { /* error from daemon */ });
 
 server.on('client-connected', (info) => { /* IVpnClientInfo */ });
 server.on('client-disconnected', ({ clientId, reason }) => { /* ... */ });
+server.on('started', () => { /* server listener started */ });
+server.on('stopped', () => { /* server listener stopped */ });
 ```
 
+## 🌐 Transport Modes
+
+smartvpn supports two transport protocols through a unified transport abstraction layer. Both use the same encryption, framing, and QoS pipeline — the transport is swappable without changing any application logic.
+
+### WebSocket (default)
+
+- Works through Cloudflare, reverse proxies, and HTTP load balancers
+- Reliable delivery only (no datagram support)
+- URL format: `wss://host/path` or `ws://host:port/path`
+
+### QUIC
+
+- Lower latency, built-in multiplexing, 0-RTT connection establishment
+- Supports **unreliable datagrams** for IP packets (with automatic fallback to reliable if oversized)
+- Certificate hash pinning — no CA chain needed, WireGuard-style trust
+- URL format: `host:port`
+- ALPN protocol: `smartvpn`
+
+### Auto-Transport (Recommended)
+
+The default `transport: 'auto'` mode gives you the best of both worlds:
+
+1. Extract `host:port` from the WebSocket URL
+2. Attempt QUIC connection (3-second timeout)
+3. If QUIC fails or times out → fall back to WebSocket
+4. Completely transparent to the application
+
+```typescript
+await client.connect({
+  serverUrl: 'wss://vpn.example.com/tunnel',
+  serverPublicKey: '...',
+  transport: 'auto', // default — QUIC first, WS fallback
+});
+```
+
+### Server Dual-Mode
+
+The server can listen on both transports simultaneously:
+
+```typescript
+await server.start({
+  listenAddr: '0.0.0.0:443',         // WebSocket listener
+  quicListenAddr: '0.0.0.0:4433',    // QUIC listener (optional, defaults to listenAddr)
+  transportMode: 'both',             // 'websocket' | 'quic' | 'both' (default)
+  quicIdleTimeoutSecs: 30,           // QUIC connection idle timeout
+  // ... other config
+});
+```
+
+When using `'both'` mode, the server logs the QUIC certificate hash on startup — share this with clients for cert pinning.
+
 ## 📊 QoS System
 
 The Rust daemon includes a full QoS stack that operates on decrypted IP packets:
@@ -337,9 +440,26 @@ Post-handshake, all IP packets are encrypted with **XChaCha20-Poly1305**:
 - 16-byte authentication tags
 - Wire format: `[nonce:24B][ciphertext:var][tag:16B]`
 
+### QUIC Certificate Pinning
+
+When using QUIC transport, the server generates a self-signed TLS certificate (or uses a configured PEM). Instead of relying on a CA chain, clients pin the server's certificate by its **SHA-256 hash** (base64-encoded) — a WireGuard-inspired trust model:
+
+```typescript
+// Server logs the cert hash on startup:
+// "QUIC cert hash: <BASE64_HASH>"
+
+// Client pins it:
+await client.connect({
+  serverUrl: 'vpn.example.com:443',
+  transport: 'quic',
+  serverCertHash: '<BASE64_HASH>',
+  serverPublicKey: '...',
+});
+```
+
 ## 📦 Binary Protocol
 
-Inside the WebSocket tunnel, packets use a simple binary framing:
+Inside the tunnel (both WebSocket and QUIC reliable channels), packets use a simple binary framing:
 
 ```
 ┌──────────┬──────────┬────────────────────┐
@@ -359,6 +479,8 @@ Inside the WebSocket tunnel, packets use a simple binary framing:
 | `SessionResumeErr` | `0x32` | Resume rejected |
 | `Disconnect` | `0x3F` | Graceful disconnect |
 
+When QUIC datagrams are available, IP packets can optionally be sent via the unreliable datagram channel for lower latency. Packets that exceed the max datagram size automatically fall back to the reliable stream.
+
 ## 🛠️ Rust Daemon CLI
 
 ```bash
@@ -385,12 +507,12 @@ pnpm build
 # Build Rust only (debug)
 cd rust && cargo build
 
-# Run all tests (71 Rust + 32 TypeScript)
+# Run all tests (77 Rust + 59 TypeScript)
 cd rust && cargo test
 pnpm test
 ```
 
-## TypeScript Interfaces
+## 📘 TypeScript Interfaces
 
 <details>
 <summary>Click to expand full type definitions</summary>
@@ -410,8 +532,10 @@ type TVpnTransportOptions =
 
 // Client config
 interface IVpnClientConfig {
-  serverUrl: string;
-  serverPublicKey: string;
+  serverUrl: string;                      // WS: 'wss://host/path' | QUIC: 'host:port'
+  serverPublicKey: string;                // Base64-encoded Noise static key
+  transport?: 'auto' | 'websocket' | 'quic'; // Default: 'auto'
+  serverCertHash?: string;                // SHA-256 cert hash (base64) for QUIC pinning
   dns?: string[];
   mtu?: number;
   keepaliveIntervalSecs?: number;
@@ -429,6 +553,9 @@ interface IVpnServerConfig {
   mtu?: number;
   keepaliveIntervalSecs?: number;
   enableNat?: boolean;
+  transportMode?: 'websocket' | 'quic' | 'both'; // Default: 'both'
+  quicListenAddr?: string;               // Separate QUIC bind address
+  quicIdleTimeoutSecs?: number;          // QUIC idle timeout (default: 30)
   defaultRateLimitBytesPerSec?: number;
   defaultBurstBytes?: number;
 }
@@ -537,7 +664,7 @@ Use of these trademarks must comply with Task Venture Capital GmbH's Trademark G
 
 ### Company Information
 
-Task Venture Capital GmbH
+Task Venture Capital GmbH  
 Registered at District Court Bremen HRB 35230 HB, Germany
 
 For any legal inquiries or further information, please contact us via email at hello@task.vc.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartvpn',
-  version: '1.3.0',
+  version: '1.4.0',
   description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 }

package/ts/smartvpn.classes.vpnconfig.ts

@@ -15,8 +15,11 @@ export class VpnConfig {
     if (!config.serverUrl) {
       throw new Error('VpnConfig: serverUrl is required');
     }
-    if (!config.serverUrl.startsWith('wss://') && !config.serverUrl.startsWith('ws://')) {
-      throw new Error('VpnConfig: serverUrl must start with wss:// or ws://');
+    // For QUIC-only transport, serverUrl is a host:port address; for WebSocket/auto it must be ws:// or wss://
+    if (config.transport !== 'quic') {
+      if (!config.serverUrl.startsWith('wss://') && !config.serverUrl.startsWith('ws://')) {
+        throw new Error('VpnConfig: serverUrl must start with wss:// or ws:// (for WebSocket transport)');
+      }
     }
     if (!config.serverPublicKey) {
       throw new Error('VpnConfig: serverPublicKey is required');

package/ts/smartvpn.interfaces.ts

@@ -32,6 +32,10 @@ export interface IVpnClientConfig {
   mtu?: number;
   /** Keepalive interval in seconds (default: 30) */
   keepaliveIntervalSecs?: number;
+  /** Transport protocol: 'auto' (default, tries QUIC then WS), 'websocket', or 'quic' */
+  transport?: 'auto' | 'websocket' | 'quic';
+  /** For QUIC: SHA-256 hash of server certificate (base64) for cert pinning */
+  serverCertHash?: string;
 }
 
 export interface IVpnClientOptions {
@@ -68,6 +72,12 @@ export interface IVpnServerConfig {
   defaultRateLimitBytesPerSec?: number;
   /** Default burst size for new clients (bytes). Omit for unlimited. */
   defaultBurstBytes?: number;
+  /** Transport mode: 'both' (default, WS+QUIC), 'websocket', or 'quic' */
+  transportMode?: 'websocket' | 'quic' | 'both';
+  /** QUIC listen address (host:port). Defaults to listenAddr. */
+  quicListenAddr?: string;
+  /** QUIC idle timeout in seconds (default: 30) */
+  quicIdleTimeoutSecs?: number;
 }
 
 export interface IVpnServerOptions {