@push.rocks/smartvpn 1.4.0 → 1.5.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartvpn',
-    version: '1.4.0',
+    version: '1.5.0',
     description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/index.d.ts

@@ -4,3 +4,4 @@ export { VpnClient } from './smartvpn.classes.vpnclient.js';
 export { VpnServer } from './smartvpn.classes.vpnserver.js';
 export { VpnConfig } from './smartvpn.classes.vpnconfig.js';
 export { VpnInstaller } from './smartvpn.classes.vpninstaller.js';
+export { WgConfigGenerator } from './smartvpn.classes.wgconfig.js';

package/dist_ts/index.js

@@ -4,4 +4,5 @@ export { VpnClient } from './smartvpn.classes.vpnclient.js';
 export { VpnServer } from './smartvpn.classes.vpnserver.js';
 export { VpnConfig } from './smartvpn.classes.vpnconfig.js';
 export { VpnInstaller } from './smartvpn.classes.vpninstaller.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDNUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzVELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0NBQW9DLENBQUMifQ==
+export { WgConfigGenerator } from './smartvpn.classes.wgconfig.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDNUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzVELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0NBQW9DLENBQUM7QUFDbEUsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sZ0NBQWdDLENBQUMifQ==

package/dist_ts/smartvpn.classes.vpnconfig.d.ts

@@ -27,4 +27,12 @@ export declare class VpnConfig {
      * Basic subnet validation (CIDR notation).
      */
     private static isValidSubnet;
+    /**
+     * Validate a CIDR string (IPv4 or IPv6).
+     */
+    private static isValidCidr;
+    /**
+     * Validate a base64-encoded 32-byte key (WireGuard X25519 format).
+     */
+    private static validateBase64Key;
 }

package/dist_ts/smartvpn.classes.vpnconfig.js

@@ -7,17 +7,46 @@ export class VpnConfig {
      * Validate a client config object. Throws on invalid config.
      */
     static validateClientConfig(config) {
-        if (!config.serverUrl) {
-            throw new Error('VpnConfig: serverUrl is required');
-        }
-        // For QUIC-only transport, serverUrl is a host:port address; for WebSocket/auto it must be ws:// or wss://
-        if (config.transport !== 'quic') {
-            if (!config.serverUrl.startsWith('wss://') && !config.serverUrl.startsWith('ws://')) {
-                throw new Error('VpnConfig: serverUrl must start with wss:// or ws:// (for WebSocket transport)');
+        if (config.transport === 'wireguard') {
+            // WireGuard-specific validation
+            if (!config.wgPrivateKey) {
+                throw new Error('VpnConfig: wgPrivateKey is required for WireGuard transport');
+            }
+            VpnConfig.validateBase64Key(config.wgPrivateKey, 'wgPrivateKey');
+            if (!config.wgAddress) {
+                throw new Error('VpnConfig: wgAddress is required for WireGuard transport');
+            }
+            if (!config.serverPublicKey) {
+                throw new Error('VpnConfig: serverPublicKey is required for WireGuard transport');
+            }
+            VpnConfig.validateBase64Key(config.serverPublicKey, 'serverPublicKey');
+            if (!config.wgEndpoint) {
+                throw new Error('VpnConfig: wgEndpoint is required for WireGuard transport');
+            }
+            if (config.wgPresharedKey) {
+                VpnConfig.validateBase64Key(config.wgPresharedKey, 'wgPresharedKey');
+            }
+            if (config.wgAllowedIps) {
+                for (const cidr of config.wgAllowedIps) {
+                    if (!VpnConfig.isValidCidr(cidr)) {
+                        throw new Error(`VpnConfig: invalid allowedIp CIDR: ${cidr}`);
+                    }
+                }
             }
         }
-        if (!config.serverPublicKey) {
-            throw new Error('VpnConfig: serverPublicKey is required');
+        else {
+            if (!config.serverUrl) {
+                throw new Error('VpnConfig: serverUrl is required');
+            }
+            // For QUIC-only transport, serverUrl is a host:port address; for WebSocket/auto it must be ws:// or wss://
+            if (config.transport !== 'quic') {
+                if (!config.serverUrl.startsWith('wss://') && !config.serverUrl.startsWith('ws://')) {
+                    throw new Error('VpnConfig: serverUrl must start with wss:// or ws:// (for WebSocket transport)');
+                }
+            }
+            if (!config.serverPublicKey) {
+                throw new Error('VpnConfig: serverPublicKey is required');
+            }
         }
         if (config.mtu !== undefined && (config.mtu < 576 || config.mtu > 65535)) {
             throw new Error('VpnConfig: mtu must be between 576 and 65535');
@@ -37,20 +66,52 @@ export class VpnConfig {
      * Validate a server config object. Throws on invalid config.
      */
     static validateServerConfig(config) {
-        if (!config.listenAddr) {
-            throw new Error('VpnConfig: listenAddr is required');
-        }
-        if (!config.privateKey) {
-            throw new Error('VpnConfig: privateKey is required');
-        }
-        if (!config.publicKey) {
-            throw new Error('VpnConfig: publicKey is required');
-        }
-        if (!config.subnet) {
-            throw new Error('VpnConfig: subnet is required');
+        if (config.transportMode === 'wireguard') {
+            // WireGuard server validation
+            if (!config.privateKey) {
+                throw new Error('VpnConfig: privateKey is required');
+            }
+            VpnConfig.validateBase64Key(config.privateKey, 'privateKey');
+            if (!config.wgPeers || config.wgPeers.length === 0) {
+                throw new Error('VpnConfig: at least one wgPeers entry is required for WireGuard mode');
+            }
+            for (const peer of config.wgPeers) {
+                if (!peer.publicKey) {
+                    throw new Error('VpnConfig: peer publicKey is required');
+                }
+                VpnConfig.validateBase64Key(peer.publicKey, 'peer.publicKey');
+                if (!peer.allowedIps || peer.allowedIps.length === 0) {
+                    throw new Error('VpnConfig: peer allowedIps is required');
+                }
+                for (const cidr of peer.allowedIps) {
+                    if (!VpnConfig.isValidCidr(cidr)) {
+                        throw new Error(`VpnConfig: invalid peer allowedIp CIDR: ${cidr}`);
+                    }
+                }
+                if (peer.presharedKey) {
+                    VpnConfig.validateBase64Key(peer.presharedKey, 'peer.presharedKey');
+                }
+            }
+            if (config.wgListenPort !== undefined && (config.wgListenPort < 1 || config.wgListenPort > 65535)) {
+                throw new Error('VpnConfig: wgListenPort must be between 1 and 65535');
+            }
         }
-        if (!VpnConfig.isValidSubnet(config.subnet)) {
-            throw new Error(`VpnConfig: invalid subnet: ${config.subnet}`);
+        else {
+            if (!config.listenAddr) {
+                throw new Error('VpnConfig: listenAddr is required');
+            }
+            if (!config.privateKey) {
+                throw new Error('VpnConfig: privateKey is required');
+            }
+            if (!config.publicKey) {
+                throw new Error('VpnConfig: publicKey is required');
+            }
+            if (!config.subnet) {
+                throw new Error('VpnConfig: subnet is required');
+            }
+            if (!VpnConfig.isValidSubnet(config.subnet)) {
+                throw new Error(`VpnConfig: invalid subnet: ${config.subnet}`);
+            }
         }
         if (config.mtu !== undefined && (config.mtu < 576 || config.mtu > 65535)) {
             throw new Error('VpnConfig: mtu must be between 576 and 65535');
@@ -97,5 +158,44 @@ export class VpnConfig {
         const prefixNum = parseInt(prefix, 10);
         return !isNaN(prefixNum) && prefixNum >= 0 && prefixNum <= 32;
     }
+    /**
+     * Validate a CIDR string (IPv4 or IPv6).
+     */
+    static isValidCidr(cidr) {
+        const parts = cidr.split('/');
+        if (parts.length !== 2)
+            return false;
+        const prefixNum = parseInt(parts[1], 10);
+        if (isNaN(prefixNum) || prefixNum < 0)
+            return false;
+        // IPv4
+        if (VpnConfig.isValidIp(parts[0])) {
+            return prefixNum <= 32;
+        }
+        // IPv6 (basic check)
+        if (parts[0].includes(':')) {
+            return prefixNum <= 128;
+        }
+        return false;
+    }
+    /**
+     * Validate a base64-encoded 32-byte key (WireGuard X25519 format).
+     */
+    static validateBase64Key(key, fieldName) {
+        if (key.length !== 44) {
+            throw new Error(`VpnConfig: ${fieldName} must be 44 characters (base64 of 32 bytes), got ${key.length}`);
+        }
+        try {
+            const buf = Buffer.from(key, 'base64');
+            if (buf.length !== 32) {
+                throw new Error(`VpnConfig: ${fieldName} must decode to 32 bytes, got ${buf.length}`);
+            }
+        }
+        catch (e) {
+            if (e instanceof Error && e.message.startsWith('VpnConfig:'))
+                throw e;
+            throw new Error(`VpnConfig: ${fieldName} is not valid base64`);
+        }
+    }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jb25maWcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBTWpEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFNBQVM7SUFDcEI7O09BRUc7SUFDSSxNQUFNLENBQUMsb0JBQW9CLENBQUMsTUFBd0I7UUFDekQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUNELDJHQUEyRztRQUMzRyxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDaEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDcEYsTUFBTSxJQUFJLEtBQUssQ0FBQyxnRkFBZ0YsQ0FBQyxDQUFDO1lBQ3BHLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUM1QixNQUFNLElBQUksS0FBSyxDQUFDLHdDQUF3QyxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxHQUFHLEdBQUcsSUFBSSxNQUFNLENBQUMsR0FBRyxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDekUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxxQkFBcUIsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLHFCQUFxQixHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDZixLQUFLLE1BQU0sR0FBRyxJQUFJLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQztnQkFDN0IsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztvQkFDOUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsR0FBRyxFQUFFLENBQUMsQ0FBQztnQkFDNUQsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksTUFBTSxDQUFDLG9CQUFvQixDQUFDLE1BQXdCO1FBQ3pELElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbkIsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUM1QyxNQUFNLElBQUksS0FBSyxDQUFDLDhCQUE4QixNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEdBQUcsR0FBRyxJQUFJLE1BQU0sQ0FBQyxHQUFHLEdBQUcsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6RSxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLHFCQUFxQixLQUFLLFNBQVMsSUFBSSxNQUFNLENBQUMscUJBQXFCLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbkYsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO1FBQ25FLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBSSxRQUFnQjtRQUNsRCxNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDdEUsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBTSxDQUFDO0lBQ2xDLENBQUM7SUFFRDs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFJLFFBQWdCLEVBQUUsTUFBUztRQUMzRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDaEQsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRUQ7O09BRUc7SUFDSyxNQUFNLENBQUMsU0FBUyxDQUFDLEVBQVU7UUFDakMsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM1QixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ3JDLE9BQU8sS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFO1lBQzFCLE1BQU0sR0FBRyxHQUFHLFFBQVEsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDL0IsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLElBQUksQ0FBQztRQUN2RSxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNLLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBYztRQUN6QyxNQUFNLENBQUMsRUFBRSxFQUFFLE1BQU0sQ0FBQyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDdkMsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNqQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUMzQyxNQUFNLFNBQVMsR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZDLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksU0FBUyxJQUFJLENBQUMsSUFBSSxTQUFTLElBQUksRUFBRSxDQUFDO0lBQ2hFLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jb25maWcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBTWpEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFNBQVM7SUFDcEI7O09BRUc7SUFDSSxNQUFNLENBQUMsb0JBQW9CLENBQUMsTUFBd0I7UUFDekQsSUFBSSxNQUFNLENBQUMsU0FBUyxLQUFLLFdBQVcsRUFBRSxDQUFDO1lBQ3JDLGdDQUFnQztZQUNoQyxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO2dCQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDZEQUE2RCxDQUFDLENBQUM7WUFDakYsQ0FBQztZQUNELFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFFLGNBQWMsQ0FBQyxDQUFDO1lBQ2pFLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7Z0JBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQUMsMERBQTBELENBQUMsQ0FBQztZQUM5RSxDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLEVBQUUsQ0FBQztnQkFDNUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO1lBQ3BGLENBQUM7WUFDRCxTQUFTLENBQUMsaUJBQWlCLENBQUMsTUFBTSxDQUFDLGVBQWUsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1lBQ3ZFLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsMkRBQTJELENBQUMsQ0FBQztZQUMvRSxDQUFDO1lBQ0QsSUFBSSxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7Z0JBQzFCLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLGdCQUFnQixDQUFDLENBQUM7WUFDdkUsQ0FBQztZQUNELElBQUksTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO2dCQUN4QixLQUFLLE1BQU0sSUFBSSxJQUFJLE1BQU0sQ0FBQyxZQUFZLEVBQUUsQ0FBQztvQkFDdkMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQzt3QkFDakMsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsSUFBSSxFQUFFLENBQUMsQ0FBQztvQkFDaEUsQ0FBQztnQkFDSCxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDdEIsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDO1lBQ3RELENBQUM7WUFDRCwyR0FBMkc7WUFDM0csSUFBSSxNQUFNLENBQUMsU0FBUyxLQUFLLE1BQU0sRUFBRSxDQUFDO2dCQUNoQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO29CQUNwRixNQUFNLElBQUksS0FBSyxDQUFDLGdGQUFnRixDQUFDLENBQUM7Z0JBQ3BHLENBQUM7WUFDSCxDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLEVBQUUsQ0FBQztnQkFDNUIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO1lBQzVELENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEdBQUcsR0FBRyxJQUFJLE1BQU0sQ0FBQyxHQUFHLEdBQUcsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6RSxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLHFCQUFxQixLQUFLLFNBQVMsSUFBSSxNQUFNLENBQUMscUJBQXFCLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbkYsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNmLEtBQUssTUFBTSxHQUFHLElBQUksTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO2dCQUM3QixJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUM5QixNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO2dCQUM1RCxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsb0JBQW9CLENBQUMsTUFBd0I7UUFDekQsSUFBSSxNQUFNLENBQUMsYUFBYSxLQUFLLFdBQVcsRUFBRSxDQUFDO1lBQ3pDLDhCQUE4QjtZQUM5QixJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7WUFDdkQsQ0FBQztZQUNELFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQzdELElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUNuRCxNQUFNLElBQUksS0FBSyxDQUFDLHNFQUFzRSxDQUFDLENBQUM7WUFDMUYsQ0FBQztZQUNELEtBQUssTUFBTSxJQUFJLElBQUksTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNsQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO29CQUNwQixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7Z0JBQzNELENBQUM7Z0JBQ0QsU0FBUyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztnQkFDOUQsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7b0JBQ3JELE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztnQkFDNUQsQ0FBQztnQkFDRCxLQUFLLE1BQU0sSUFBSSxJQUFJLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztvQkFDbkMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQzt3QkFDakMsTUFBTSxJQUFJLEtBQUssQ0FBQywyQ0FBMkMsSUFBSSxFQUFFLENBQUMsQ0FBQztvQkFDckUsQ0FBQztnQkFDSCxDQUFDO2dCQUNELElBQUksSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO29CQUN0QixTQUFTLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO2dCQUN0RSxDQUFDO1lBQ0gsQ0FBQztZQUNELElBQUksTUFBTSxDQUFDLFlBQVksS0FBSyxTQUFTLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxHQUFHLENBQUMsSUFBSSxNQUFNLENBQUMsWUFBWSxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQ2xHLE1BQU0sSUFBSSxLQUFLLENBQUMscURBQXFELENBQUMsQ0FBQztZQUN6RSxDQUFDO1FBQ0gsQ0FBQzthQUFNLENBQUM7WUFDTixJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7WUFDdkQsQ0FBQztZQUNELElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztZQUN2RCxDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDdEIsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDO1lBQ3RELENBQUM7WUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNuQixNQUFNLElBQUksS0FBSyxDQUFDLCtCQUErQixDQUFDLENBQUM7WUFDbkQsQ0FBQztZQUNELElBQUksQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO2dCQUM1QyxNQUFNLElBQUksS0FBSyxDQUFDLDhCQUE4QixNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztZQUNqRSxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxHQUFHLEdBQUcsSUFBSSxNQUFNLENBQUMsR0FBRyxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDekUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxxQkFBcUIsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLHFCQUFxQixHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQztRQUNuRSxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUksUUFBZ0I7UUFDbEQsTUFBTSxPQUFPLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ3RFLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQU0sQ0FBQztJQUNsQyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBSSxRQUFnQixFQUFFLE1BQVM7UUFDM0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hELE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLFFBQVEsRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUVEOztPQUVHO0lBQ0ssTUFBTSxDQUFDLFNBQVMsQ0FBQyxFQUFVO1FBQ2pDLE1BQU0sS0FBSyxHQUFHLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDNUIsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNyQyxPQUFPLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRTtZQUMxQixNQUFNLEdBQUcsR0FBRyxRQUFRLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQy9CLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksR0FBRyxJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksR0FBRyxJQUFJLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxJQUFJLENBQUM7UUFDdkUsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSyxNQUFNLENBQUMsYUFBYSxDQUFDLE1BQWM7UUFDekMsTUFBTSxDQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxFQUFFLElBQUksQ0FBQyxNQUFNO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDakMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDM0MsTUFBTSxTQUFTLEdBQUcsUUFBUSxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN2QyxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLFNBQVMsSUFBSSxDQUFDLElBQUksU0FBUyxJQUFJLEVBQUUsQ0FBQztJQUNoRSxDQUFDO0lBRUQ7O09BRUc7SUFDSyxNQUFNLENBQUMsV0FBVyxDQUFDLElBQVk7UUFDckMsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM5QixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ3JDLE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDekMsSUFBSSxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksU0FBUyxHQUFHLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNwRCxPQUFPO1FBQ1AsSUFBSSxTQUFTLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEMsT0FBTyxTQUFTLElBQUksRUFBRSxDQUFDO1FBQ3pCLENBQUM7UUFDRCxxQkFBcUI7UUFDckIsSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDM0IsT0FBTyxTQUFTLElBQUksR0FBRyxDQUFDO1FBQzFCLENBQUM7UUFDRCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFRDs7T0FFRztJQUNLLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxHQUFXLEVBQUUsU0FBaUI7UUFDN0QsSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQUMsY0FBYyxTQUFTLG9EQUFvRCxHQUFHLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUMzRyxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDdkMsSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLEVBQUUsRUFBRSxDQUFDO2dCQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLGNBQWMsU0FBUyxpQ0FBaUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDeEYsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ1gsSUFBSSxDQUFDLFlBQVksS0FBSyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQztnQkFBRSxNQUFNLENBQUMsQ0FBQztZQUN0RSxNQUFNLElBQUksS0FBSyxDQUFDLGNBQWMsU0FBUyxzQkFBc0IsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7SUFDSCxDQUFDO0NBQ0YifQ==

package/dist_ts/smartvpn.classes.vpnserver.d.ts

@@ -1,5 +1,5 @@
 import * as plugins from './smartvpn.plugins.js';
-import type { IVpnServerOptions, IVpnServerConfig, IVpnStatus, IVpnServerStatistics, IVpnClientInfo, IVpnKeypair, IVpnClientTelemetry } from './smartvpn.interfaces.js';
+import type { IVpnServerOptions, IVpnServerConfig, IVpnStatus, IVpnServerStatistics, IVpnClientInfo, IVpnKeypair, IVpnClientTelemetry, IWgPeerConfig, IWgPeerInfo } from './smartvpn.interfaces.js';
 /**
  * VPN Server — manages a smartvpn daemon in server mode.
  */
@@ -47,6 +47,22 @@ export declare class VpnServer extends plugins.events.EventEmitter {
      * Get telemetry for a specific client.
      */
     getClientTelemetry(clientId: string): Promise<IVpnClientTelemetry>;
+    /**
+     * Generate a WireGuard-compatible X25519 keypair.
+     */
+    generateWgKeypair(): Promise<IVpnKeypair>;
+    /**
+     * Add a WireGuard peer (server must be running in wireguard mode).
+     */
+    addWgPeer(peer: IWgPeerConfig): Promise<void>;
+    /**
+     * Remove a WireGuard peer by public key.
+     */
+    removeWgPeer(publicKey: string): Promise<void>;
+    /**
+     * List WireGuard peers with stats.
+     */
+    listWgPeers(): Promise<IWgPeerInfo[]>;
     /**
      * Stop the daemon bridge.
      */

package/dist_ts/smartvpn.classes.vpnserver.js

@@ -91,6 +91,31 @@ export class VpnServer extends plugins.events.EventEmitter {
     async getClientTelemetry(clientId) {
         return this.bridge.sendCommand('getClientTelemetry', { clientId });
     }
+    /**
+     * Generate a WireGuard-compatible X25519 keypair.
+     */
+    async generateWgKeypair() {
+        return this.bridge.sendCommand('generateWgKeypair', {});
+    }
+    /**
+     * Add a WireGuard peer (server must be running in wireguard mode).
+     */
+    async addWgPeer(peer) {
+        await this.bridge.sendCommand('addWgPeer', { peer });
+    }
+    /**
+     * Remove a WireGuard peer by public key.
+     */
+    async removeWgPeer(publicKey) {
+        await this.bridge.sendCommand('removeWgPeer', { publicKey });
+    }
+    /**
+     * List WireGuard peers with stats.
+     */
+    async listWgPeers() {
+        const result = await this.bridge.sendCommand('listWgPeers', {});
+        return result.peers;
+    }
     /**
      * Stop the daemon bridge.
      */
@@ -104,4 +129,4 @@ export class VpnServer extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5zZXJ2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbnNlcnZlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQVk1RDs7R0FFRztBQUNILE1BQU0sT0FBTyxTQUFVLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBSXhELFlBQVksT0FBMEI7UUFDcEMsS0FBSyxFQUFFLENBQUM7UUFDUixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksU0FBUyxDQUFxQjtZQUM5QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsSUFBSSxFQUFFLFFBQVE7U0FDZixDQUFDLENBQUM7UUFFSCx3QkFBd0I7UUFDeEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBbUIsRUFBRSxNQUFxQixFQUFFLEVBQUU7WUFDcEUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxLQUFLLENBQUMsTUFBeUI7UUFDMUMsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQzFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLE1BQU0sSUFBSSxLQUFLLENBQUMsMENBQTBDLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBQ0QsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQzFDLElBQUksR0FBRyxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQzFELENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDckUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVM7UUFDcEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxhQUFhO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsZUFBZSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVztRQUN0QixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGFBQWEsRUFBRSxFQUEyQixDQUFDLENBQUM7UUFDekYsT0FBTyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQ3hCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFnQjtRQUM1QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGtCQUFrQixFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsZUFBZTtRQUMxQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGlCQUFpQixFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUNqRixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsa0JBQWtCLENBQzdCLFFBQWdCLEVBQ2hCLGVBQXVCLEVBQ3ZCLFVBQWtCO1FBRWxCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEVBQUU7WUFDbEQsUUFBUTtZQUNSLGVBQWU7WUFDZixVQUFVO1NBQ1gsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLHFCQUFxQixDQUFDLFFBQWdCO1FBQ2pELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsdUJBQXVCLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxRQUFnQjtRQUM5QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLG9CQUFvQixFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxJQUFJO1FBQ1QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNyQixDQUFDO0lBRUQ7O09BRUc7SUFDSCxJQUFXLE9BQU87UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUM3QixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5zZXJ2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbnNlcnZlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQWM1RDs7R0FFRztBQUNILE1BQU0sT0FBTyxTQUFVLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBSXhELFlBQVksT0FBMEI7UUFDcEMsS0FBSyxFQUFFLENBQUM7UUFDUixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksU0FBUyxDQUFxQjtZQUM5QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsSUFBSSxFQUFFLFFBQVE7U0FDZixDQUFDLENBQUM7UUFFSCx3QkFBd0I7UUFDeEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBbUIsRUFBRSxNQUFxQixFQUFFLEVBQUU7WUFDcEUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxLQUFLLENBQUMsTUFBeUI7UUFDMUMsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQzFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLE1BQU0sSUFBSSxLQUFLLENBQUMsMENBQTBDLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBQ0QsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQzFDLElBQUksR0FBRyxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQzFELENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDckUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVM7UUFDcEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxhQUFhO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsZUFBZSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVztRQUN0QixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGFBQWEsRUFBRSxFQUEyQixDQUFDLENBQUM7UUFDekYsT0FBTyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQ3hCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFnQjtRQUM1QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGtCQUFrQixFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsZUFBZTtRQUMxQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGlCQUFpQixFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUNqRixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsa0JBQWtCLENBQzdCLFFBQWdCLEVBQ2hCLGVBQXVCLEVBQ3ZCLFVBQWtCO1FBRWxCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEVBQUU7WUFDbEQsUUFBUTtZQUNSLGVBQWU7WUFDZixVQUFVO1NBQ1gsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLHFCQUFxQixDQUFDLFFBQWdCO1FBQ2pELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsdUJBQXVCLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxRQUFnQjtRQUM5QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLG9CQUFvQixFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsaUJBQWlCO1FBQzVCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBbUI7UUFDeEMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxZQUFZLENBQUMsU0FBaUI7UUFDekMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxjQUFjLEVBQUUsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxXQUFXO1FBQ3RCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLEVBQTJCLENBQUMsQ0FBQztRQUN6RixPQUFPLE1BQU0sQ0FBQyxLQUFLLENBQUM7SUFDdEIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksSUFBSTtRQUNULElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDckIsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGIn0=

package/dist_ts/smartvpn.classes.wgconfig.d.ts

@@ -0,0 +1,51 @@
+import type { IWgPeerConfig } from './smartvpn.interfaces.js';
+export interface IWgClientConfOptions {
+    /** Client private key (base64) */
+    privateKey: string;
+    /** Client TUN address with prefix (e.g. 10.8.0.2/24) */
+    address: string;
+    /** DNS servers */
+    dns?: string[];
+    /** TUN MTU */
+    mtu?: number;
+    /** Server peer config */
+    peer: {
+        publicKey: string;
+        presharedKey?: string;
+        endpoint: string;
+        allowedIps: string[];
+        persistentKeepalive?: number;
+    };
+}
+export interface IWgServerConfOptions {
+    /** Server private key (base64) */
+    privateKey: string;
+    /** Server TUN address with prefix (e.g. 10.8.0.1/24) */
+    address: string;
+    /** UDP listen port */
+    listenPort: number;
+    /** DNS servers */
+    dns?: string[];
+    /** TUN MTU */
+    mtu?: number;
+    /** Enable NAT — adds PostUp/PostDown iptables rules */
+    enableNat?: boolean;
+    /** Network interface for NAT (e.g. eth0). Auto-detected if omitted. */
+    natInterface?: string;
+    /** Configured peers */
+    peers: IWgPeerConfig[];
+}
+/**
+ * Generates standard WireGuard .conf files compatible with wg-quick,
+ * WireGuard iOS/Android apps, and other standard WireGuard clients.
+ */
+export declare class WgConfigGenerator {
+    /**
+     * Generate a client .conf file content.
+     */
+    static generateClientConfig(opts: IWgClientConfOptions): string;
+    /**
+     * Generate a server .conf file content.
+     */
+    static generateServerConfig(opts: IWgServerConfOptions): string;
+}

package/dist_ts/smartvpn.classes.wgconfig.js

@@ -0,0 +1,73 @@
+/**
+ * Generates standard WireGuard .conf files compatible with wg-quick,
+ * WireGuard iOS/Android apps, and other standard WireGuard clients.
+ */
+export class WgConfigGenerator {
+    /**
+     * Generate a client .conf file content.
+     */
+    static generateClientConfig(opts) {
+        const lines = [];
+        lines.push('[Interface]');
+        lines.push(`PrivateKey = ${opts.privateKey}`);
+        lines.push(`Address = ${opts.address}`);
+        if (opts.dns && opts.dns.length > 0) {
+            lines.push(`DNS = ${opts.dns.join(', ')}`);
+        }
+        if (opts.mtu) {
+            lines.push(`MTU = ${opts.mtu}`);
+        }
+        lines.push('');
+        lines.push('[Peer]');
+        lines.push(`PublicKey = ${opts.peer.publicKey}`);
+        if (opts.peer.presharedKey) {
+            lines.push(`PresharedKey = ${opts.peer.presharedKey}`);
+        }
+        lines.push(`Endpoint = ${opts.peer.endpoint}`);
+        lines.push(`AllowedIPs = ${opts.peer.allowedIps.join(', ')}`);
+        if (opts.peer.persistentKeepalive) {
+            lines.push(`PersistentKeepalive = ${opts.peer.persistentKeepalive}`);
+        }
+        lines.push('');
+        return lines.join('\n');
+    }
+    /**
+     * Generate a server .conf file content.
+     */
+    static generateServerConfig(opts) {
+        const lines = [];
+        lines.push('[Interface]');
+        lines.push(`PrivateKey = ${opts.privateKey}`);
+        lines.push(`Address = ${opts.address}`);
+        lines.push(`ListenPort = ${opts.listenPort}`);
+        if (opts.dns && opts.dns.length > 0) {
+            lines.push(`DNS = ${opts.dns.join(', ')}`);
+        }
+        if (opts.mtu) {
+            lines.push(`MTU = ${opts.mtu}`);
+        }
+        if (opts.enableNat) {
+            const iface = opts.natInterface || 'eth0';
+            lines.push(`PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ${iface} -j MASQUERADE`);
+            lines.push(`PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ${iface} -j MASQUERADE`);
+        }
+        for (const peer of opts.peers) {
+            lines.push('');
+            lines.push('[Peer]');
+            lines.push(`PublicKey = ${peer.publicKey}`);
+            if (peer.presharedKey) {
+                lines.push(`PresharedKey = ${peer.presharedKey}`);
+            }
+            lines.push(`AllowedIPs = ${peer.allowedIps.join(', ')}`);
+            if (peer.endpoint) {
+                lines.push(`Endpoint = ${peer.endpoint}`);
+            }
+            if (peer.persistentKeepalive) {
+                lines.push(`PersistentKeepalive = ${peer.persistentKeepalive}`);
+            }
+        }
+        lines.push('');
+        return lines.join('\n');
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy53Z2NvbmZpZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0dnBuLmNsYXNzZXMud2djb25maWcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBNENBOzs7R0FHRztBQUNILE1BQU0sT0FBTyxpQkFBaUI7SUFDNUI7O09BRUc7SUFDSSxNQUFNLENBQUMsb0JBQW9CLENBQUMsSUFBMEI7UUFDM0QsTUFBTSxLQUFLLEdBQWEsRUFBRSxDQUFDO1FBRTNCLEtBQUssQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDMUIsS0FBSyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDOUMsS0FBSyxDQUFDLElBQUksQ0FBQyxhQUFhLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ3hDLElBQUksSUFBSSxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNwQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzdDLENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNiLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUNsQyxDQUFDO1FBRUQsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNmLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDckIsS0FBSyxDQUFDLElBQUksQ0FBQyxlQUFlLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztRQUNqRCxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDM0IsS0FBSyxDQUFDLElBQUksQ0FBQyxrQkFBa0IsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFDRCxLQUFLLENBQUMsSUFBSSxDQUFDLGNBQWMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLEtBQUssQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDOUQsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUM7WUFDbEMsS0FBSyxDQUFDLElBQUksQ0FBQyx5QkFBeUIsSUFBSSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDLENBQUM7UUFDdkUsQ0FBQztRQUVELEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDZixPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDMUIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksTUFBTSxDQUFDLG9CQUFvQixDQUFDLElBQTBCO1FBQzNELE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztRQUUzQixLQUFLLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzFCLEtBQUssQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzlDLEtBQUssQ0FBQyxJQUFJLENBQUMsYUFBYSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUN4QyxLQUFLLENBQUMsSUFBSSxDQUFDLGdCQUFnQixJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUM5QyxJQUFJLElBQUksQ0FBQyxHQUFHLElBQUksSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDcEMsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDYixLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDbEMsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ25CLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxZQUFZLElBQUksTUFBTSxDQUFDO1lBQzFDLEtBQUssQ0FBQyxJQUFJLENBQUMsbUZBQW1GLEtBQUssZ0JBQWdCLENBQUMsQ0FBQztZQUNySCxLQUFLLENBQUMsSUFBSSxDQUFDLHFGQUFxRixLQUFLLGdCQUFnQixDQUFDLENBQUM7UUFDekgsQ0FBQztRQUVELEtBQUssTUFBTSxJQUFJLElBQUksSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQzlCLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDZixLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3JCLEtBQUssQ0FBQyxJQUFJLENBQUMsZUFBZSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztZQUM1QyxJQUFJLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztnQkFDdEIsS0FBSyxDQUFDLElBQUksQ0FBQyxrQkFBa0IsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDLENBQUM7WUFDcEQsQ0FBQztZQUNELEtBQUssQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUN6RCxJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztnQkFDbEIsS0FBSyxDQUFDLElBQUksQ0FBQyxjQUFjLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQzVDLENBQUM7WUFDRCxJQUFJLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO2dCQUM3QixLQUFLLENBQUMsSUFBSSxDQUFDLHlCQUF5QixJQUFJLENBQUMsbUJBQW1CLEVBQUUsQ0FBQyxDQUFDO1lBQ2xFLENBQUM7UUFDSCxDQUFDO1FBRUQsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNmLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUMxQixDQUFDO0NBQ0YifQ==

package/dist_ts/smartvpn.interfaces.d.ts

@@ -21,10 +21,24 @@ export interface IVpnClientConfig {
     mtu?: number;
     /** Keepalive interval in seconds (default: 30) */
     keepaliveIntervalSecs?: number;
-    /** Transport protocol: 'auto' (default, tries QUIC then WS), 'websocket', or 'quic' */
-    transport?: 'auto' | 'websocket' | 'quic';
+    /** Transport protocol: 'auto' (default, tries QUIC then WS), 'websocket', 'quic', or 'wireguard' */
+    transport?: 'auto' | 'websocket' | 'quic' | 'wireguard';
     /** For QUIC: SHA-256 hash of server certificate (base64) for cert pinning */
     serverCertHash?: string;
+    /** WireGuard: client private key (base64, X25519) */
+    wgPrivateKey?: string;
+    /** WireGuard: client TUN address (e.g. 10.8.0.2) */
+    wgAddress?: string;
+    /** WireGuard: client TUN address prefix length (default: 24) */
+    wgAddressPrefix?: number;
+    /** WireGuard: preshared key (base64, optional) */
+    wgPresharedKey?: string;
+    /** WireGuard: persistent keepalive interval in seconds */
+    wgPersistentKeepalive?: number;
+    /** WireGuard: server endpoint (host:port, e.g. vpn.example.com:51820) */
+    wgEndpoint?: string;
+    /** WireGuard: allowed IPs (CIDR strings, e.g. ['0.0.0.0/0']) */
+    wgAllowedIps?: string[];
 }
 export interface IVpnClientOptions {
     transport: TVpnTransportOptions;
@@ -55,12 +69,16 @@ export interface IVpnServerConfig {
     defaultRateLimitBytesPerSec?: number;
     /** Default burst size for new clients (bytes). Omit for unlimited. */
     defaultBurstBytes?: number;
-    /** Transport mode: 'both' (default, WS+QUIC), 'websocket', or 'quic' */
-    transportMode?: 'websocket' | 'quic' | 'both';
+    /** Transport mode: 'both' (default, WS+QUIC), 'websocket', 'quic', or 'wireguard' */
+    transportMode?: 'websocket' | 'quic' | 'both' | 'wireguard';
     /** QUIC listen address (host:port). Defaults to listenAddr. */
     quicListenAddr?: string;
     /** QUIC idle timeout in seconds (default: 30) */
     quicIdleTimeoutSecs?: number;
+    /** WireGuard: UDP listen port (default: 51820) */
+    wgListenPort?: number;
+    /** WireGuard: configured peers */
+    wgPeers?: IWgPeerConfig[];
 }
 export interface IVpnServerOptions {
     transport: TVpnTransportOptions;
@@ -136,6 +154,29 @@ export interface IVpnClientTelemetry {
     rateLimitBytesPerSec?: number;
     burstBytes?: number;
 }
+export interface IWgPeerConfig {
+    /** Peer's public key (base64, X25519) */
+    publicKey: string;
+    /** Optional preshared key (base64) */
+    presharedKey?: string;
+    /** Allowed IP ranges (CIDR strings) */
+    allowedIps: string[];
+    /** Peer endpoint (host:port) — optional for server peers, required for client */
+    endpoint?: string;
+    /** Persistent keepalive interval in seconds */
+    persistentKeepalive?: number;
+}
+export interface IWgPeerInfo {
+    publicKey: string;
+    allowedIps: string[];
+    endpoint?: string;
+    persistentKeepalive?: number;
+    bytesSent: number;
+    bytesReceived: number;
+    packetsSent: number;
+    packetsReceived: number;
+    lastHandshakeTime?: string;
+}
 export type TVpnClientCommands = {
     connect: {
         params: {
@@ -221,6 +262,28 @@ export type TVpnServerCommands = {
         };
         result: IVpnClientTelemetry;
     };
+    generateWgKeypair: {
+        params: Record<string, never>;
+        result: IVpnKeypair;
+    };
+    addWgPeer: {
+        params: {
+            peer: IWgPeerConfig;
+        };
+        result: void;
+    };
+    removeWgPeer: {
+        params: {
+            publicKey: string;
+        };
+        result: void;
+    };
+    listWgPeers: {
+        params: Record<string, never>;
+        result: {
+            peers: IWgPeerInfo[];
+        };
+    };
 };
 export type TVpnPlatform = 'linux' | 'macos' | 'windows' | 'unknown';
 export interface IVpnServiceUnit {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",

package/readme.md

@@ -2,11 +2,11 @@
 
 A high-performance VPN with a **TypeScript control plane** and a **Rust data plane daemon**. Manage VPN connections with clean, fully-typed APIs while all networking heavy lifting — encryption, tunneling, QoS, rate limiting — runs at native speed in Rust.
 
-🔒 **Noise NK** handshake + **XChaCha20-Poly1305** encryption
-🚀 **Dual transport**: WebSocket (Cloudflare-friendly) and raw **QUIC** (with datagram support)
-📊 **Adaptive QoS**: packet classification, priority queues, per-client rate limiting
-🔄 **Auto-transport**: tries QUIC first, falls back to WebSocket seamlessly
-📡 **Real-time telemetry**: RTT, jitter, loss, link health — all exposed via typed APIs
+🔒 **Noise NK** handshake + **XChaCha20-Poly1305** encryption  
+🚀 **Dual transport**: WebSocket (Cloudflare-friendly) and raw **QUIC** (with datagram support)  
+📊 **Adaptive QoS**: packet classification, priority queues, per-client rate limiting  
+🔄 **Auto-transport**: tries QUIC first, falls back to WebSocket seamlessly  
+📡 **Real-time telemetry**: RTT, jitter, loss, link health — all exposed via typed APIs  
 
 ## Issue Reporting and Security
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartvpn',
-  version: '1.4.0',
+  version: '1.5.0',
   description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 }

package/ts/index.ts

@@ -4,3 +4,4 @@ export { VpnClient } from './smartvpn.classes.vpnclient.js';
 export { VpnServer } from './smartvpn.classes.vpnserver.js';
 export { VpnConfig } from './smartvpn.classes.vpnconfig.js';
 export { VpnInstaller } from './smartvpn.classes.vpninstaller.js';
+export { WgConfigGenerator } from './smartvpn.classes.wgconfig.js';

package/ts/smartvpn.classes.vpnconfig.ts

@@ -12,17 +12,45 @@ export class VpnConfig {
    * Validate a client config object. Throws on invalid config.
    */
   public static validateClientConfig(config: IVpnClientConfig): void {
-    if (!config.serverUrl) {
-      throw new Error('VpnConfig: serverUrl is required');
-    }
-    // For QUIC-only transport, serverUrl is a host:port address; for WebSocket/auto it must be ws:// or wss://
-    if (config.transport !== 'quic') {
-      if (!config.serverUrl.startsWith('wss://') && !config.serverUrl.startsWith('ws://')) {
-        throw new Error('VpnConfig: serverUrl must start with wss:// or ws:// (for WebSocket transport)');
+    if (config.transport === 'wireguard') {
+      // WireGuard-specific validation
+      if (!config.wgPrivateKey) {
+        throw new Error('VpnConfig: wgPrivateKey is required for WireGuard transport');
+      }
+      VpnConfig.validateBase64Key(config.wgPrivateKey, 'wgPrivateKey');
+      if (!config.wgAddress) {
+        throw new Error('VpnConfig: wgAddress is required for WireGuard transport');
+      }
+      if (!config.serverPublicKey) {
+        throw new Error('VpnConfig: serverPublicKey is required for WireGuard transport');
+      }
+      VpnConfig.validateBase64Key(config.serverPublicKey, 'serverPublicKey');
+      if (!config.wgEndpoint) {
+        throw new Error('VpnConfig: wgEndpoint is required for WireGuard transport');
+      }
+      if (config.wgPresharedKey) {
+        VpnConfig.validateBase64Key(config.wgPresharedKey, 'wgPresharedKey');
+      }
+      if (config.wgAllowedIps) {
+        for (const cidr of config.wgAllowedIps) {
+          if (!VpnConfig.isValidCidr(cidr)) {
+            throw new Error(`VpnConfig: invalid allowedIp CIDR: ${cidr}`);
+          }
+        }
+      }
+    } else {
+      if (!config.serverUrl) {
+        throw new Error('VpnConfig: serverUrl is required');
+      }
+      // For QUIC-only transport, serverUrl is a host:port address; for WebSocket/auto it must be ws:// or wss://
+      if (config.transport !== 'quic') {
+        if (!config.serverUrl.startsWith('wss://') && !config.serverUrl.startsWith('ws://')) {
+          throw new Error('VpnConfig: serverUrl must start with wss:// or ws:// (for WebSocket transport)');
+        }
+      }
+      if (!config.serverPublicKey) {
+        throw new Error('VpnConfig: serverPublicKey is required');
       }
-    }
-    if (!config.serverPublicKey) {
-      throw new Error('VpnConfig: serverPublicKey is required');
     }
     if (config.mtu !== undefined && (config.mtu < 576 || config.mtu > 65535)) {
       throw new Error('VpnConfig: mtu must be between 576 and 65535');
@@ -43,20 +71,51 @@ export class VpnConfig {
    * Validate a server config object. Throws on invalid config.
    */
   public static validateServerConfig(config: IVpnServerConfig): void {
-    if (!config.listenAddr) {
-      throw new Error('VpnConfig: listenAddr is required');
-    }
-    if (!config.privateKey) {
-      throw new Error('VpnConfig: privateKey is required');
-    }
-    if (!config.publicKey) {
-      throw new Error('VpnConfig: publicKey is required');
-    }
-    if (!config.subnet) {
-      throw new Error('VpnConfig: subnet is required');
-    }
-    if (!VpnConfig.isValidSubnet(config.subnet)) {
-      throw new Error(`VpnConfig: invalid subnet: ${config.subnet}`);
+    if (config.transportMode === 'wireguard') {
+      // WireGuard server validation
+      if (!config.privateKey) {
+        throw new Error('VpnConfig: privateKey is required');
+      }
+      VpnConfig.validateBase64Key(config.privateKey, 'privateKey');
+      if (!config.wgPeers || config.wgPeers.length === 0) {
+        throw new Error('VpnConfig: at least one wgPeers entry is required for WireGuard mode');
+      }
+      for (const peer of config.wgPeers) {
+        if (!peer.publicKey) {
+          throw new Error('VpnConfig: peer publicKey is required');
+        }
+        VpnConfig.validateBase64Key(peer.publicKey, 'peer.publicKey');
+        if (!peer.allowedIps || peer.allowedIps.length === 0) {
+          throw new Error('VpnConfig: peer allowedIps is required');
+        }
+        for (const cidr of peer.allowedIps) {
+          if (!VpnConfig.isValidCidr(cidr)) {
+            throw new Error(`VpnConfig: invalid peer allowedIp CIDR: ${cidr}`);
+          }
+        }
+        if (peer.presharedKey) {
+          VpnConfig.validateBase64Key(peer.presharedKey, 'peer.presharedKey');
+        }
+      }
+      if (config.wgListenPort !== undefined && (config.wgListenPort < 1 || config.wgListenPort > 65535)) {
+        throw new Error('VpnConfig: wgListenPort must be between 1 and 65535');
+      }
+    } else {
+      if (!config.listenAddr) {
+        throw new Error('VpnConfig: listenAddr is required');
+      }
+      if (!config.privateKey) {
+        throw new Error('VpnConfig: privateKey is required');
+      }
+      if (!config.publicKey) {
+        throw new Error('VpnConfig: publicKey is required');
+      }
+      if (!config.subnet) {
+        throw new Error('VpnConfig: subnet is required');
+      }
+      if (!VpnConfig.isValidSubnet(config.subnet)) {
+        throw new Error(`VpnConfig: invalid subnet: ${config.subnet}`);
+      }
     }
     if (config.mtu !== undefined && (config.mtu < 576 || config.mtu > 65535)) {
       throw new Error('VpnConfig: mtu must be between 576 and 65535');
@@ -104,4 +163,41 @@ export class VpnConfig {
     const prefixNum = parseInt(prefix, 10);
     return !isNaN(prefixNum) && prefixNum >= 0 && prefixNum <= 32;
   }
+
+  /**
+   * Validate a CIDR string (IPv4 or IPv6).
+   */
+  private static isValidCidr(cidr: string): boolean {
+    const parts = cidr.split('/');
+    if (parts.length !== 2) return false;
+    const prefixNum = parseInt(parts[1], 10);
+    if (isNaN(prefixNum) || prefixNum < 0) return false;
+    // IPv4
+    if (VpnConfig.isValidIp(parts[0])) {
+      return prefixNum <= 32;
+    }
+    // IPv6 (basic check)
+    if (parts[0].includes(':')) {
+      return prefixNum <= 128;
+    }
+    return false;
+  }
+
+  /**
+   * Validate a base64-encoded 32-byte key (WireGuard X25519 format).
+   */
+  private static validateBase64Key(key: string, fieldName: string): void {
+    if (key.length !== 44) {
+      throw new Error(`VpnConfig: ${fieldName} must be 44 characters (base64 of 32 bytes), got ${key.length}`);
+    }
+    try {
+      const buf = Buffer.from(key, 'base64');
+      if (buf.length !== 32) {
+        throw new Error(`VpnConfig: ${fieldName} must decode to 32 bytes, got ${buf.length}`);
+      }
+    } catch (e) {
+      if (e instanceof Error && e.message.startsWith('VpnConfig:')) throw e;
+      throw new Error(`VpnConfig: ${fieldName} is not valid base64`);
+    }
+  }
 }

package/ts/smartvpn.classes.vpnserver.ts

@@ -8,6 +8,8 @@ import type {
   IVpnClientInfo,
   IVpnKeypair,
   IVpnClientTelemetry,
+  IWgPeerConfig,
+  IWgPeerInfo,
   TVpnServerCommands,
 } from './smartvpn.interfaces.js';
 
@@ -121,6 +123,35 @@ export class VpnServer extends plugins.events.EventEmitter {
     return this.bridge.sendCommand('getClientTelemetry', { clientId });
   }
 
+  /**
+   * Generate a WireGuard-compatible X25519 keypair.
+   */
+  public async generateWgKeypair(): Promise<IVpnKeypair> {
+    return this.bridge.sendCommand('generateWgKeypair', {} as Record<string, never>);
+  }
+
+  /**
+   * Add a WireGuard peer (server must be running in wireguard mode).
+   */
+  public async addWgPeer(peer: IWgPeerConfig): Promise<void> {
+    await this.bridge.sendCommand('addWgPeer', { peer });
+  }
+
+  /**
+   * Remove a WireGuard peer by public key.
+   */
+  public async removeWgPeer(publicKey: string): Promise<void> {
+    await this.bridge.sendCommand('removeWgPeer', { publicKey });
+  }
+
+  /**
+   * List WireGuard peers with stats.
+   */
+  public async listWgPeers(): Promise<IWgPeerInfo[]> {
+    const result = await this.bridge.sendCommand('listWgPeers', {} as Record<string, never>);
+    return result.peers;
+  }
+
   /**
    * Stop the daemon bridge.
    */

package/ts/smartvpn.classes.wgconfig.ts

@@ -0,0 +1,123 @@
+import type { IWgPeerConfig } from './smartvpn.interfaces.js';
+
+// ============================================================================
+// WireGuard .conf file generator
+// ============================================================================
+
+export interface IWgClientConfOptions {
+  /** Client private key (base64) */
+  privateKey: string;
+  /** Client TUN address with prefix (e.g. 10.8.0.2/24) */
+  address: string;
+  /** DNS servers */
+  dns?: string[];
+  /** TUN MTU */
+  mtu?: number;
+  /** Server peer config */
+  peer: {
+    publicKey: string;
+    presharedKey?: string;
+    endpoint: string;
+    allowedIps: string[];
+    persistentKeepalive?: number;
+  };
+}
+
+export interface IWgServerConfOptions {
+  /** Server private key (base64) */
+  privateKey: string;
+  /** Server TUN address with prefix (e.g. 10.8.0.1/24) */
+  address: string;
+  /** UDP listen port */
+  listenPort: number;
+  /** DNS servers */
+  dns?: string[];
+  /** TUN MTU */
+  mtu?: number;
+  /** Enable NAT — adds PostUp/PostDown iptables rules */
+  enableNat?: boolean;
+  /** Network interface for NAT (e.g. eth0). Auto-detected if omitted. */
+  natInterface?: string;
+  /** Configured peers */
+  peers: IWgPeerConfig[];
+}
+
+/**
+ * Generates standard WireGuard .conf files compatible with wg-quick,
+ * WireGuard iOS/Android apps, and other standard WireGuard clients.
+ */
+export class WgConfigGenerator {
+  /**
+   * Generate a client .conf file content.
+   */
+  public static generateClientConfig(opts: IWgClientConfOptions): string {
+    const lines: string[] = [];
+
+    lines.push('[Interface]');
+    lines.push(`PrivateKey = ${opts.privateKey}`);
+    lines.push(`Address = ${opts.address}`);
+    if (opts.dns && opts.dns.length > 0) {
+      lines.push(`DNS = ${opts.dns.join(', ')}`);
+    }
+    if (opts.mtu) {
+      lines.push(`MTU = ${opts.mtu}`);
+    }
+
+    lines.push('');
+    lines.push('[Peer]');
+    lines.push(`PublicKey = ${opts.peer.publicKey}`);
+    if (opts.peer.presharedKey) {
+      lines.push(`PresharedKey = ${opts.peer.presharedKey}`);
+    }
+    lines.push(`Endpoint = ${opts.peer.endpoint}`);
+    lines.push(`AllowedIPs = ${opts.peer.allowedIps.join(', ')}`);
+    if (opts.peer.persistentKeepalive) {
+      lines.push(`PersistentKeepalive = ${opts.peer.persistentKeepalive}`);
+    }
+
+    lines.push('');
+    return lines.join('\n');
+  }
+
+  /**
+   * Generate a server .conf file content.
+   */
+  public static generateServerConfig(opts: IWgServerConfOptions): string {
+    const lines: string[] = [];
+
+    lines.push('[Interface]');
+    lines.push(`PrivateKey = ${opts.privateKey}`);
+    lines.push(`Address = ${opts.address}`);
+    lines.push(`ListenPort = ${opts.listenPort}`);
+    if (opts.dns && opts.dns.length > 0) {
+      lines.push(`DNS = ${opts.dns.join(', ')}`);
+    }
+    if (opts.mtu) {
+      lines.push(`MTU = ${opts.mtu}`);
+    }
+    if (opts.enableNat) {
+      const iface = opts.natInterface || 'eth0';
+      lines.push(`PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ${iface} -j MASQUERADE`);
+      lines.push(`PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ${iface} -j MASQUERADE`);
+    }
+
+    for (const peer of opts.peers) {
+      lines.push('');
+      lines.push('[Peer]');
+      lines.push(`PublicKey = ${peer.publicKey}`);
+      if (peer.presharedKey) {
+        lines.push(`PresharedKey = ${peer.presharedKey}`);
+      }
+      lines.push(`AllowedIPs = ${peer.allowedIps.join(', ')}`);
+      if (peer.endpoint) {
+        lines.push(`Endpoint = ${peer.endpoint}`);
+      }
+      if (peer.persistentKeepalive) {
+        lines.push(`PersistentKeepalive = ${peer.persistentKeepalive}`);
+      }
+    }
+
+    lines.push('');
+    return lines.join('\n');
+  }
+}

package/ts/smartvpn.interfaces.ts

@@ -32,10 +32,24 @@ export interface IVpnClientConfig {
   mtu?: number;
   /** Keepalive interval in seconds (default: 30) */
   keepaliveIntervalSecs?: number;
-  /** Transport protocol: 'auto' (default, tries QUIC then WS), 'websocket', or 'quic' */
-  transport?: 'auto' | 'websocket' | 'quic';
+  /** Transport protocol: 'auto' (default, tries QUIC then WS), 'websocket', 'quic', or 'wireguard' */
+  transport?: 'auto' | 'websocket' | 'quic' | 'wireguard';
   /** For QUIC: SHA-256 hash of server certificate (base64) for cert pinning */
   serverCertHash?: string;
+  /** WireGuard: client private key (base64, X25519) */
+  wgPrivateKey?: string;
+  /** WireGuard: client TUN address (e.g. 10.8.0.2) */
+  wgAddress?: string;
+  /** WireGuard: client TUN address prefix length (default: 24) */
+  wgAddressPrefix?: number;
+  /** WireGuard: preshared key (base64, optional) */
+  wgPresharedKey?: string;
+  /** WireGuard: persistent keepalive interval in seconds */
+  wgPersistentKeepalive?: number;
+  /** WireGuard: server endpoint (host:port, e.g. vpn.example.com:51820) */
+  wgEndpoint?: string;
+  /** WireGuard: allowed IPs (CIDR strings, e.g. ['0.0.0.0/0']) */
+  wgAllowedIps?: string[];
 }
 
 export interface IVpnClientOptions {
@@ -72,12 +86,16 @@ export interface IVpnServerConfig {
   defaultRateLimitBytesPerSec?: number;
   /** Default burst size for new clients (bytes). Omit for unlimited. */
   defaultBurstBytes?: number;
-  /** Transport mode: 'both' (default, WS+QUIC), 'websocket', or 'quic' */
-  transportMode?: 'websocket' | 'quic' | 'both';
+  /** Transport mode: 'both' (default, WS+QUIC), 'websocket', 'quic', or 'wireguard' */
+  transportMode?: 'websocket' | 'quic' | 'both' | 'wireguard';
   /** QUIC listen address (host:port). Defaults to listenAddr. */
   quicListenAddr?: string;
   /** QUIC idle timeout in seconds (default: 30) */
   quicIdleTimeoutSecs?: number;
+  /** WireGuard: UDP listen port (default: 51820) */
+  wgListenPort?: number;
+  /** WireGuard: configured peers */
+  wgPeers?: IWgPeerConfig[];
 }
 
 export interface IVpnServerOptions {
@@ -187,6 +205,35 @@ export interface IVpnClientTelemetry {
   burstBytes?: number;
 }
 
+// ============================================================================
+// WireGuard-specific types
+// ============================================================================
+
+export interface IWgPeerConfig {
+  /** Peer's public key (base64, X25519) */
+  publicKey: string;
+  /** Optional preshared key (base64) */
+  presharedKey?: string;
+  /** Allowed IP ranges (CIDR strings) */
+  allowedIps: string[];
+  /** Peer endpoint (host:port) — optional for server peers, required for client */
+  endpoint?: string;
+  /** Persistent keepalive interval in seconds */
+  persistentKeepalive?: number;
+}
+
+export interface IWgPeerInfo {
+  publicKey: string;
+  allowedIps: string[];
+  endpoint?: string;
+  persistentKeepalive?: number;
+  bytesSent: number;
+  bytesReceived: number;
+  packetsSent: number;
+  packetsReceived: number;
+  lastHandshakeTime?: string;
+}
+
 // ============================================================================
 // IPC Command maps (used by smartrust RustBridge<TCommands>)
 // ============================================================================
@@ -211,6 +258,10 @@ export type TVpnServerCommands = {
   setClientRateLimit: { params: { clientId: string; rateBytesPerSec: number; burstBytes: number }; result: void };
   removeClientRateLimit: { params: { clientId: string }; result: void };
   getClientTelemetry: { params: { clientId: string }; result: IVpnClientTelemetry };
+  generateWgKeypair: { params: Record<string, never>; result: IVpnKeypair };
+  addWgPeer: { params: { peer: IWgPeerConfig }; result: void };
+  removeWgPeer: { params: { publicKey: string }; result: void };
+  listWgPeers: { params: Record<string, never>; result: { peers: IWgPeerInfo[] } };
 };
 
 // ============================================================================