@push.rocks/smartvpn 2.0.0 → 2.2.0

package/assets/third-party-licenses.md

@@ -1,6 +1,7 @@
 # Third-party notices: managed Linux routing
 
-The Linux daemon links the following unmodified registry dependencies. Their
+The Linux daemon links these routing dependencies. The original netlink-proto
+0.13.0 attribution is retained alongside its published 0.13.1 fork. Their
 exact upstream LICENSE-MIT texts are reproduced below. This file is distributed
 under package.json's assets/**/* inclusion.
 
@@ -92,7 +93,40 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## netlink-proto 0.13.0
+## netlink-proto 0.13.1 (published fork)
+
+Source: https://code.foss.global/push.rocks/netlink-proto/src/commit/bcbbfbba7485857c3b1f9fd5f6d99d597a334ab0
+
+```text
+Copyright (c) The netlink-proto Contributors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+```
+
+## netlink-proto 0.13.0 (upstream attribution retained)
 
 Source: https://crates.io/crates/netlink-proto/0.13.0
 

package/dist_rust/smartvpn_daemon_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "9dae4722a783f8de4ce2c5066eff1bf5d6ebde48750aaf3e96ad4e0374e153a3",
+  "binarySha256": "4f8072fe724ac6d140e4d76aaaa1820bbfae2d70eda8f5c93ffbe8717df56453",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.0.0",
-    "gitCommit": "d6dbad135253e924e10c2dd0183377cd64e0c347",
+    "projectVersion": "2.2.0",
+    "gitCommit": "da37d5bcd88b9b2d2849d05fa7865a361ab7c313",
     "gitDirty": false,
-    "builtAt": "2026-09-07T08:10:39.362Z",
-    "tsrustVersion": "1.11.0",
+    "builtAt": "2026-09-15T01:02:07.587Z",
+    "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_amd64_musl"
   }

package/dist_rust/smartvpn_daemon_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "939472012c3378f6e1727b32f7ee8d167a5566a918dd188c5e850190e0f10282",
+  "binarySha256": "01e551c5becdaaec42fa18c0f49ea6aa2e2bf6fef225211606ce52a486c1c918",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.0.0",
-    "gitCommit": "d6dbad135253e924e10c2dd0183377cd64e0c347",
+    "projectVersion": "2.2.0",
+    "gitCommit": "da37d5bcd88b9b2d2849d05fa7865a361ab7c313",
     "gitDirty": false,
-    "builtAt": "2026-09-07T08:10:39.651Z",
-    "tsrustVersion": "1.11.0",
+    "builtAt": "2026-09-15T01:02:07.887Z",
+    "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartvpn',
-    version: '2.0.0',
+    version: '2.2.0',
     description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/smartvpn.classes.vpnbridge.d.ts

@@ -13,6 +13,7 @@ export declare class VpnBridge<TCommands extends TCommandMap> extends plugins.ev
         transport: TVpnTransportOptions;
         mode: 'client' | 'server';
         binaryName?: string;
+        networkNamespaceFd?: number;
     });
     /**
      * Start the bridge: spawn in stdio mode or connect in socket mode.

package/dist_ts/smartvpn.classes.vpnbridge.js

@@ -7,20 +7,39 @@ import * as paths from './smartvpn.paths.js';
 export class VpnBridge extends plugins.events.EventEmitter {
     constructor(options) {
         super();
+        const namespaceFd = options.networkNamespaceFd;
+        if (namespaceFd !== undefined) {
+            if (plugins.os.platform() !== 'linux' || options.mode !== 'client' || options.transport.transport !== 'stdio') {
+                throw new Error('VpnBridge networkNamespaceFd requires a Linux stdio client');
+            }
+            if (!Number.isInteger(namespaceFd) || namespaceFd < 0 || namespaceFd > 0x7fff_ffff) {
+                throw new Error('VpnBridge networkNamespaceFd must be a non-negative native descriptor');
+            }
+        }
         const binaryName = options.binaryName || 'smartvpn_daemon';
-        this.transportOptions = options.transport;
+        if (options.transport.transport === 'stdio' && options.transport.binaryPath !== undefined
+            && (typeof options.transport.binaryPath !== 'string' || !plugins.path.isAbsolute(options.transport.binaryPath))) {
+            throw new Error('VpnBridge binaryPath must be an absolute executable path');
+        }
+        // Keep the validated process transport stable even if the caller edits its options.
+        this.transportOptions = { ...options.transport };
         this.mode = options.mode;
         this.bridge = new plugins.smartrust.RustBridge({
             binaryName,
             binaryPath: options.transport.transport === 'stdio'
-                ? paths.getBinaryPath(binaryName)
+                ? options.transport.binaryPath ?? paths.getBinaryPath(binaryName)
                 : undefined,
             localPaths: [],
             searchSystemPath: false,
-            cliArgs: ['--management', '--mode', this.mode],
+            cliArgs: ['--management', '--mode', this.mode,
+                ...(namespaceFd === undefined ? [] : ['--network-namespace-fd', '3'])],
+            inheritedFileDescriptors: namespaceFd === undefined ? undefined : [namespaceFd],
             maxPayloadSize: 10 * 1024 * 1024, // 10 MB
         });
         // Forward events from inner bridge
+        this.bridge.on('disconnected', (event) => {
+            this.emit('disconnected', event);
+        });
         this.bridge.on('exit', (code, signal) => {
             this.emit('exit', code, signal);
         });
@@ -32,6 +51,9 @@ export class VpnBridge extends plugins.events.EventEmitter {
         });
         // Forward management events from the daemon
         // smartrust emits 'management:<eventName>' for unsolicited events
+        this.bridge.on('management:managed-runtime-invalidated', (data) => {
+            this.emit('managed-runtime-invalidated', data);
+        });
         this.bridge.on('management:status', (data) => {
             this.emit('status', data);
         });
@@ -88,4 +110,4 @@ export class VpnBridge extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5icmlkZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sS0FBSyxLQUFLLE1BQU0scUJBQXFCLENBQUM7QUFPN0M7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQXlDLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBS3ZGLFlBQVksT0FJWDtRQUNDLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLFVBQVUsSUFBSSxpQkFBaUIsQ0FBQztRQUMzRCxJQUFJLENBQUMsZ0JBQWdCLEdBQUcsT0FBTyxDQUFDLFNBQVMsQ0FBQztRQUMxQyxJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUM7UUFFekIsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFZO1lBQ3hELFVBQVU7WUFDVixVQUFVLEVBQUUsT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEtBQUssT0FBTztnQkFDakQsQ0FBQyxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDO2dCQUNqQyxDQUFDLENBQUMsU0FBUztZQUNiLFVBQVUsRUFBRSxFQUFFO1lBQ2QsZ0JBQWdCLEVBQUUsS0FBSztZQUN2QixPQUFPLEVBQUUsQ0FBQyxjQUFjLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUM7WUFDOUMsY0FBYyxFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxFQUFFLFFBQVE7U0FDM0MsQ0FBQyxDQUFDO1FBRUgsbUNBQW1DO1FBQ25DLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQW1CLEVBQUUsTUFBcUIsRUFBRSxFQUFFO1lBQ3BFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNsQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBRUgsNENBQTRDO1FBQzVDLGtFQUFrRTtRQUNsRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxtQkFBbUIsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQ2hELElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsa0JBQWtCLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUMvQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLDZCQUE2QixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDMUQsSUFBSSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGdDQUFnQyxFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDN0QsSUFBSSxDQUFDLElBQUksQ0FBQyxxQkFBcUIsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUN6QyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG9CQUFvQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDakQsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDN0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzdCLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLEtBQUs7UUFDaEIsSUFBSSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsU0FBUyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ2pELE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxnQkFBdUMsQ0FBQztZQUNoRSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxVQUFVLEVBQUU7Z0JBQ2hELGFBQWEsRUFBRSxVQUFVLENBQUMsYUFBYTtnQkFDdkMsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjtnQkFDckQsbUJBQW1CLEVBQUUsVUFBVSxDQUFDLG1CQUFtQjtnQkFDbkQsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjthQUN0RCxDQUFDLENBQUM7UUFDTCxDQUFDO2FBQU0sQ0FBQztZQUNOLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUM3QixDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxJQUFJO1FBQ2YsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO0lBQ2hDLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxXQUFXLENBQ3RCLE1BQVMsRUFDVCxNQUE4QjtRQUU5QixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBRUQ7O09BRUc7SUFDSCxJQUFXLE9BQU87UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUM3QixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5icmlkZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sS0FBSyxLQUFLLE1BQU0scUJBQXFCLENBQUM7QUFRN0M7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQXlDLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBS3ZGLFlBQVksT0FLWDtRQUNDLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQy9DLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQzlHLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztZQUNoRixDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxHQUFHLENBQUMsSUFBSSxXQUFXLEdBQUcsV0FBVyxFQUFFLENBQUM7Z0JBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztZQUMzRixDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUksaUJBQWlCLENBQUM7UUFDM0QsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssU0FBUztlQUNwRixDQUFDLE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEgsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxvRkFBb0Y7UUFDcEYsSUFBSSxDQUFDLGdCQUFnQixHQUFHLEVBQUUsR0FBRyxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDakQsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO1FBRXpCLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBWTtZQUN4RCxVQUFVO1lBQ1YsVUFBVSxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLE9BQU87Z0JBQ2pELENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsSUFBSSxLQUFLLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQztnQkFDakUsQ0FBQyxDQUFDLFNBQVM7WUFDYixVQUFVLEVBQUUsRUFBRTtZQUNkLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsT0FBTyxFQUFFLENBQUMsY0FBYyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSTtnQkFDM0MsR0FBRyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyx3QkFBd0IsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3hFLHdCQUF3QixFQUFFLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUM7WUFDL0UsY0FBYyxFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxFQUFFLFFBQVE7U0FDM0MsQ0FBQyxDQUFDO1FBRUgsbUNBQW1DO1FBQ25DLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGNBQWMsRUFBRSxDQUFDLEtBQW1DLEVBQUUsRUFBRTtZQUNyRSxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNuQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQW1CLEVBQUUsTUFBcUIsRUFBRSxFQUFFO1lBQ3BFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNsQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBRUgsNENBQTRDO1FBQzVDLGtFQUFrRTtRQUNsRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyx3Q0FBd0MsRUFBRSxDQUFDLElBQW9DLEVBQUUsRUFBRTtZQUNoRyxJQUFJLENBQUMsSUFBSSxDQUFDLDZCQUE2QixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2pELENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsbUJBQW1CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNoRCxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGtCQUFrQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDL0MsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyw2QkFBNkIsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzFELElBQUksQ0FBQyxJQUFJLENBQUMsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxnQ0FBZ0MsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzdELElBQUksQ0FBQyxJQUFJLENBQUMscUJBQXFCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDekMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzdCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNqRCxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM3QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxLQUFLO1FBQ2hCLElBQUksSUFBSSxDQUFDLGdCQUFnQixDQUFDLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNqRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsZ0JBQXVDLENBQUM7WUFDaEUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFO2dCQUNoRCxhQUFhLEVBQUUsVUFBVSxDQUFDLGFBQWE7Z0JBQ3ZDLG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7Z0JBQ3JELG1CQUFtQixFQUFFLFVBQVUsQ0FBQyxtQkFBbUI7Z0JBQ25ELG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7YUFDdEQsQ0FBQyxDQUFDO1FBQ0wsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDN0IsQ0FBQztJQUNILENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUNoQyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVyxDQUN0QixNQUFTLEVBQ1QsTUFBOEI7UUFFOUIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGIn0=

package/dist_ts/smartvpn.classes.vpnclient.d.ts

@@ -1,12 +1,18 @@
 import * as plugins from './smartvpn.plugins.js';
-import type { IVpnClientOptions, IVpnClientConfig, IVpnStatus, IVpnStatistics, IVpnConnectionQuality, IVpnMtuInfo } from './smartvpn.interfaces.js';
+import type { IVpnClientOptions, IVpnClientConfig, IVpnStatus, IVpnStatistics, IVpnConnectionQuality, IVpnMtuInfo, IVpnConnectionResult, IVpnManagedRuntime } from './smartvpn.interfaces.js';
 /**
  * VPN Client — manages a smartvpn daemon in client mode.
  */
 export declare class VpnClient extends plugins.events.EventEmitter {
     private bridge;
     private options;
+    private bridgeEpoch;
+    private managedGeneration?;
+    private lastInvalidatedGeneration?;
     constructor(options: IVpnClientOptions);
+    private invalidateGeneration;
+    private invalidateBridge;
+    private checkObservation;
     /**
      * Start the daemon bridge (spawn or connect).
      */
@@ -14,9 +20,10 @@ export declare class VpnClient extends plugins.events.EventEmitter {
     /**
      * Connect to the VPN server using the provided config.
      */
-    connect(config?: IVpnClientConfig): Promise<{
-        assignedIp: string;
-    }>;
+    connect(config?: IVpnClientConfig): Promise<IVpnConnectionResult>;
+    /** Inspect the retained native TUN, its exact IPv4 /32 and split routes.
+     * Requires the connection's generation and fails after retirement/reconnect. */
+    inspectManagedRuntime(generation: string): Promise<IVpnManagedRuntime>;
     /**
      * Disconnect from the VPN server.
      */

package/dist_ts/smartvpn.classes.vpnclient.js

@@ -6,21 +6,50 @@ import { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export class VpnClient extends plugins.events.EventEmitter {
     constructor(options) {
         super();
+        this.bridgeEpoch = 0;
         this.options = options;
         this.bridge = new VpnBridge({
             transport: options.transport,
             mode: 'client',
+            networkNamespaceFd: options.networkNamespaceFd,
         });
         // Forward bridge events
+        this.bridge.on('disconnected', () => {
+            this.invalidateBridge('Client transport disconnected');
+        });
         this.bridge.on('exit', (code, signal) => {
+            this.invalidateBridge('Client bridge exited');
             this.emit('exit', { code, signal });
         });
         this.bridge.on('reconnected', () => {
+            this.invalidateBridge('Client bridge reconnected');
             this.emit('reconnected');
         });
         this.bridge.on('stderr', (line) => {
             this.emit('stderr', line);
         });
+        this.bridge.on('managed-runtime-invalidated', (event) => {
+            this.invalidateGeneration(event);
+        });
+    }
+    invalidateGeneration(event) {
+        if (this.lastInvalidatedGeneration === event.generation)
+            return;
+        this.lastInvalidatedGeneration = event.generation;
+        if (this.managedGeneration === event.generation)
+            this.managedGeneration = undefined;
+        this.emit('managed-runtime-invalidated', event);
+    }
+    invalidateBridge(reason) {
+        this.bridgeEpoch++;
+        if (this.managedGeneration)
+            this.invalidateGeneration({ generation: this.managedGeneration, reason });
+    }
+    checkObservation(runtime, epoch, generation) {
+        if (epoch !== this.bridgeEpoch || runtime.generation === this.lastInvalidatedGeneration
+            || (generation !== undefined && runtime.generation !== generation)) {
+            throw new Error('Managed runtime retired during the operation');
+        }
     }
     /**
      * Start the daemon bridge (spawn or connect).
@@ -36,7 +65,24 @@ export class VpnClient extends plugins.events.EventEmitter {
         if (!cfg) {
             throw new Error('VpnClient.connect: no config provided');
         }
-        return this.bridge.sendCommand('connect', { config: cfg });
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand('connect', { config: cfg });
+        if (result.managedRuntime) {
+            this.checkObservation(result.managedRuntime, epoch);
+            this.managedGeneration = result.managedRuntime.generation;
+        }
+        return result;
+    }
+    /** Inspect the retained native TUN, its exact IPv4 /32 and split routes.
+     * Requires the connection's generation and fails after retirement/reconnect. */
+    async inspectManagedRuntime(generation) {
+        if (typeof generation !== 'string' || !/^[a-f0-9]{32}$/.test(generation)) {
+            throw new Error('Managed runtime generation must be a native 128-bit identifier');
+        }
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand('inspectManagedRuntime', { generation });
+        this.checkObservation(result, epoch, generation);
+        return result;
     }
     /**
      * Disconnect from the VPN server.
@@ -73,6 +119,7 @@ export class VpnClient extends plugins.events.EventEmitter {
      * Stop the daemon bridge and wait for confirmed ownership release.
      */
     async stop() {
+        this.invalidateBridge('Client stop requested');
         await this.bridge.stop();
     }
     /**
@@ -82,4 +129,4 @@ export class VpnClient extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQVc1RDs7R0FFRztBQUNILE1BQU0sT0FBTyxTQUFVLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBSXhELFlBQVksT0FBMEI7UUFDcEMsS0FBSyxFQUFFLENBQUM7UUFDUixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksU0FBUyxDQUFxQjtZQUM5QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsSUFBSSxFQUFFLFFBQVE7U0FDZixDQUFDLENBQUM7UUFFSCx3QkFBd0I7UUFDeEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBbUIsRUFBRSxNQUFxQixFQUFFLEVBQUU7WUFDcEUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLEtBQUs7UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQzdCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBeUI7UUFDNUMsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQzFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVM7UUFDcEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxhQUFhO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsZUFBZSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsb0JBQW9CO1FBQy9CLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsc0JBQXNCLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLElBQUk7UUFDZixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDM0IsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQWM1RDs7R0FFRztBQUNILE1BQU0sT0FBTyxTQUFVLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBT3hELFlBQVksT0FBMEI7UUFDcEMsS0FBSyxFQUFFLENBQUM7UUFMRixnQkFBVyxHQUFHLENBQUMsQ0FBQztRQU10QixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksU0FBUyxDQUFxQjtZQUM5QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsSUFBSSxFQUFFLFFBQVE7WUFDZCxrQkFBa0IsRUFBRSxPQUFPLENBQUMsa0JBQWtCO1NBQy9DLENBQUMsQ0FBQztRQUVILHdCQUF3QjtRQUN4QixJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxjQUFjLEVBQUUsR0FBRyxFQUFFO1lBQ2xDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ3pELENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBbUIsRUFBRSxNQUFxQixFQUFFLEVBQUU7WUFDcEUsSUFBSSxDQUFDLGdCQUFnQixDQUFDLHNCQUFzQixDQUFDLENBQUM7WUFDOUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLDJCQUEyQixDQUFDLENBQUM7WUFDbkQsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsNkJBQTZCLEVBQUUsQ0FBQyxLQUFxQyxFQUFFLEVBQUU7WUFDdEYsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25DLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLG9CQUFvQixDQUFDLEtBQXFDO1FBQ2hFLElBQUksSUFBSSxDQUFDLHlCQUF5QixLQUFLLEtBQUssQ0FBQyxVQUFVO1lBQUUsT0FBTztRQUNoRSxJQUFJLENBQUMseUJBQXlCLEdBQUcsS0FBSyxDQUFDLFVBQVUsQ0FBQztRQUNsRCxJQUFJLElBQUksQ0FBQyxpQkFBaUIsS0FBSyxLQUFLLENBQUMsVUFBVTtZQUFFLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxTQUFTLENBQUM7UUFDcEYsSUFBSSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBRU8sZ0JBQWdCLENBQUMsTUFBYztRQUNyQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDbkIsSUFBSSxJQUFJLENBQUMsaUJBQWlCO1lBQUUsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3hHLENBQUM7SUFFTyxnQkFBZ0IsQ0FBQyxPQUEyQixFQUFFLEtBQWEsRUFBRSxVQUFtQjtRQUN0RixJQUFJLEtBQUssS0FBSyxJQUFJLENBQUMsV0FBVyxJQUFJLE9BQU8sQ0FBQyxVQUFVLEtBQUssSUFBSSxDQUFDLHlCQUF5QjtlQUNsRixDQUFDLFVBQVUsS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLFVBQVUsS0FBSyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3JFLE1BQU0sSUFBSSxLQUFLLENBQUMsOENBQThDLENBQUMsQ0FBQztRQUNsRSxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLEtBQUs7UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQzdCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBeUI7UUFDNUMsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQzFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQztRQUMvQixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ3pFLElBQUksTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzFCLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQ3BELElBQUksQ0FBQyxpQkFBaUIsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVEO29GQUNnRjtJQUN6RSxLQUFLLENBQUMscUJBQXFCLENBQUMsVUFBa0I7UUFDbkQsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN6RSxNQUFNLElBQUksS0FBSyxDQUFDLGdFQUFnRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUM7UUFDL0IsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyx1QkFBdUIsRUFBRSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDdEYsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDakQsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxZQUFZLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxTQUFTO1FBQ3BCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBVyxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsYUFBYTtRQUN4QixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGVBQWUsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLG9CQUFvQjtRQUMvQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLHNCQUFzQixFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxZQUFZLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxDQUFDLGdCQUFnQixDQUFDLHVCQUF1QixDQUFDLENBQUM7UUFDL0MsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzNCLENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRiJ9

package/dist_ts/smartvpn.interfaces.d.ts

@@ -1,5 +1,8 @@
 export interface IVpnTransportStdio {
     transport: 'stdio';
+    /** Exact caller-verified executable. Overrides environment/package lookup;
+     * invalid paths fail without falling through to another executable. */
+    binaryPath?: string;
 }
 export interface IVpnTransportSocket {
     transport: 'socket';
@@ -73,6 +76,10 @@ export type IVpnClientConfig = TVpnClientConfig;
 export interface IVpnClientOptions {
     transport: TVpnTransportOptions;
     config?: IVpnClientConfig;
+    /** Linux stdio only. Caller-owned network namespace FD, retained through every spawn.
+     * The complete native client enters before threads, sockets, TUN or readiness.
+     * The caller owns namespace creation, underlay routing, DNS and packet policy. */
+    networkNamespaceFd?: number;
 }
 export interface IVpnServerConfig {
     /** Listen address for WebSocket, e.g. 0.0.0.0:443 */
@@ -404,9 +411,13 @@ export type TVpnClientCommands = {
         params: {
             config: IVpnClientConfig;
         };
-        result: {
-            assignedIp: string;
+        result: IVpnConnectionResult;
+    };
+    inspectManagedRuntime: {
+        params: {
+            generation: string;
         };
+        result: IVpnManagedRuntime;
     };
     disconnect: {
         params: Record<string, never>;
@@ -645,6 +656,39 @@ export interface IManagedNetworkBinding {
     authorityId: string;
     nodeId: string;
 }
+export interface IVpnConnectionResult {
+    assignedIp: string;
+    /** Present only for an authenticated native managed connection with a real TUN. */
+    managedRuntime?: IVpnManagedRuntime;
+}
+/** A fresh observation of a retained native lifetime, never a transferable or
+ * restorable capability. The caller retains VpnClient and listens for invalidation.
+ * IPv6, namespace-wide policy/rules, underlay and firewall remain caller-owned. */
+export interface IVpnManagedRuntime {
+    schemaVersion: 1;
+    generation: string;
+    namespace: {
+        device: string;
+        inode: string;
+    };
+    link: {
+        interfaceIndex: number;
+        interfaceName: string;
+        interfaceKind: 'tun';
+        linkIndex: number;
+        mtu: number;
+        address: string;
+        prefixLength: 32;
+    };
+    remoteIp: string;
+    assignment: IManagedNetworkAssignment;
+}
+/** Stop using this generation immediately. This event is not a joined cleanup,
+ * conntrack drain, or allocation-reuse acknowledgement. */
+export interface IVpnManagedRuntimeInvalidation {
+    generation: string;
+    reason: string;
+}
 export interface IManagedNodeConfig {
     /** Caller-owned control address with /32; local workload prefixes are not hub routes. */
     address: string;
@@ -670,6 +714,7 @@ export interface IVpnServiceUnit {
     installPath: string;
 }
 export interface IVpnEventMap {
+    'managed-runtime-invalidated': IVpnManagedRuntimeInvalidation;
     'status': IVpnStatus;
     'error': {
         message: string;

package/notices/cargo-dependencies.html

@@ -3004,6 +3004,38 @@ The above copyright notice and this permission notice
 shall be included in all copies or substantial portions
 of the Software.
 
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+</pre>
+</section>
+<section>
+  <h2>MIT License (MIT)</h2>
+  <ul>
+    <li>netlink-proto 0.13.1</li>
+  </ul>
+  <pre>Copyright (c) The netlink-proto Contributors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the &quot;Software&quot;), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
 THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF
 ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
 TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
@@ -3610,7 +3642,6 @@ DEALINGS IN THE SOFTWARE.
   <h2>MIT License (MIT)</h2>
   <ul>
     <li>netlink-packet-core 0.9.0</li>
-    <li>netlink-proto 0.13.0</li>
     <li>netlink-sys 0.9.0</li>
     <li>rtnetlink 0.23.0</li>
   </ul>

package/notices/inventory.json

@@ -3,9 +3,9 @@
   "rustVersion": "1.95.0",
   "cargoAboutVersion": "0.9.1",
   "files": {
-    "assets/third-party-licenses.md": "da4de43c4e7a7e530af740c58c45ea620f9da2bf1639251d1740344102317aed",
+    "assets/third-party-licenses.md": "6be2373e39312d90eb3571bef614c89df565f98c917795d7aea3497f52ef19f1",
     "notices/aho-corasick-license.txt": "0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f",
-    "notices/cargo-dependencies.html": "01f390d02b89be9fde6154ee05f3cb275e7baaf4ba15a29a3b4a385e4574a3ad",
+    "notices/cargo-dependencies.html": "bd8e78c6f49c0ee60ccf6e1449c9b52276940055b08aaf32c5ede1ec3b307b4c",
     "notices/compiler-builtins-license.txt": "ab6eec6caf0fa5775e411c7a8bc6a45c4ef2956b0980b157ab74fc5cd62a928b",
     "notices/defmt-license.txt": "0d17b75c1867fd568bcbb735f329d0d4253846c4b756a65e4d440c1e4bd59187",
     "notices/llvm-libunwind-license.txt": "b5efebcaca80879234098e52d1725e6d9eb8fb96a19fce625d39184b705f7b6d",
@@ -16,11 +16,11 @@
     "notices/valuable-license.txt": "ed60d479b8fd1f64e9cbc3de449a16a53ac1b3d1b6aeb9bf9d190a8e93061b44",
     "rust-toolchain.toml": "19da9ff32e229a69ff5dde28ac23233256ff25e413a8c579155cf641f4f0634f",
     "rust/.cargo/config.toml": "eb6896791bd573f2cb099aa41c7d3668c6d368166945abd3553c8d8029ba8b7b",
-    "rust/Cargo.lock": "5e67e43571bdceaa39aa92783c485f3edd00cca975f3ffe44c010c527f6c9b38",
-    "rust/Cargo.toml": "419e4aeb2dd5b28ede23310d7d9fb2b0308c37393154578999859951b6c947ca",
+    "rust/Cargo.lock": "93980ffcc3d2eca0083f524999b15f1674698d2aceff5922ed0aa5a09138d260",
+    "rust/Cargo.toml": "308d11b4bb6b8f290ca2d83f2c817e10798bad54510dd3a6fdb72c32d095ae3b",
     "rust/about.hbs": "a7c35d089563a08520a6e5f351aadae659e1f7bf24cabedbca3de8a89e966f86",
-    "rust/about.toml": "9eb1fb41fc435a370d0c2ce1a77e5f0897b785a023ab87fd6721979ded479e66",
-    "third-party-notices.md": "e935f4b27acaa567180b4b55ab472412b3c0ab7d528351b41863a1785074cd4b"
+    "rust/about.toml": "a457e0cc7532020c0f87532919a754997213ccbec6211c9501b8c198d404ed72",
+    "third-party-notices.md": "9b3adc6a4968ba5ef1eb666188ddb147933e2d90bafca040a59789b2f4b9389b"
   },
   "supplementalCargoNotices": {
     "aho-corasick@1.1.4": "notices/aho-corasick-license.txt",
@@ -605,7 +605,7 @@
     },
     {
       "name": "netlink-proto",
-      "version": "0.13.0",
+      "version": "0.13.1",
       "license": "MIT"
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",
@@ -25,14 +25,14 @@
   "dependencies": {
     "@push.rocks/smartnftables": "1.2.0",
     "@push.rocks/smartpath": "^6.0.0",
-    "@push.rocks/smartrust": "^2.0.0"
+    "@push.rocks/smartrust": "^2.1.0"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.4.2",
+    "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tsrust": "^1.11.0",
-    "@git.zone/tstest": "^4.0.0",
-    "@types/node": "^26.4.1"
+    "@git.zone/tsrust": "^1.13.0",
+    "@git.zone/tstest": "^6.0.0",
+    "@types/node": "^26.5.0"
   },
   "files": [
     "ts/**/*",
@@ -47,6 +47,12 @@
   "browserslist": [
     "last 1 chrome versions"
   ],
+  "publishConfig": {
+    "executableFiles": [
+      "./dist_rust/smartvpn_daemon_linux_amd64_musl",
+      "./dist_rust/smartvpn_daemon_linux_arm64_musl"
+    ]
+  },
   "scripts": {
     "build": "(tsbuild tsfolders) && (tsrust)",
     "test:before": "(tsrust)",

package/readme.md

@@ -124,6 +124,83 @@ console.log(`Connected! VPN IP: ${assignedIp}`);
 
 ## Features ✨
 
+### Caller-owned client network namespace
+
+A Linux stdio client accepts `networkNamespaceFd` in `IVpnClientOptions`. Pass an
+already open network namespace descriptor; the caller retains ownership and keeps
+it valid through each `start()`. The child validates its inherited duplicate,
+enters the namespace before creating runtime threads or sockets, then closes the
+duplicate. Invalid descriptors and failed entry cannot produce a ready client.
+Stopping the client waits for process termination before the caller releases its
+namespace owner. A running child remains in its namespace if the caller closes
+the original descriptor, but a later start still requires a valid descriptor.
+
+The caller must provide the hub endpoint's underlay route and any required DNS
+reachability inside that namespace before connecting. SmartVPN creates neither
+the namespace nor that underlay. Managed TUN setup still validates the authenticated
+assignment and rejects routes that capture the actual hub endpoint. Namespace
+placement does not grant workload access or replace packet policy.
+
+The option is process configuration, separate from VPN connection configuration.
+It is rejected for socket transport and server bridges. The native equivalent is
+`--management --mode client --network-namespace-fd 3`, with an inherited descriptor
+at FD 3. Server facade firewall setup runs in its parent process, so server
+namespace placement requires a separately coordinated policy owner.
+
+The Linux amd64 musl candidate passed offline Linux 6.18.35 qualification with
+all native threads in the target namespace, child descriptor closure, retained
+caller ownership and denied-entry rejection. The shared `serve.zone/testing`
+scenario also passed real WS/Noise traffic through inherited namespace entry,
+managed TUN creation, allow/deny, reconnect, revocation, route-conflict rollback
+and child-termination cleanup. Privileged ARM64 and Pallet integration remain
+separate qualification requirements.
+
+### Retained managed TUN runtime
+
+An authenticated native managed connection with `forwardingMode: 'tun'` returns
+`managedRuntime` alongside `assignedIp`. Its random `generation` identifies that
+one connection's retained TUN and netlink owner. The observation includes the
+actual namespace device/inode, TUN name/index/link index, MTU, IPv4 /32, actual hub
+peer IP and authenticated managed assignment. Testing and WireGuard connections
+do not provide this capability.
+
+`await client.inspectManagedRuntime(generation)` performs a new bounded kernel
+inspection of that retained owner. It requires complete, uninterrupted link,
+IPv4 address and route inventories, including successful netlink DONE messages.
+A missing, retired or different generation rejects; no serialized observation
+can reopen a namespace, adopt another interface or restore an old connection.
+
+Register `client.on('managed-runtime-invalidated', handler)` before connecting.
+Stop admitting work against that generation as soon as the event arrives or an
+inspection/IPC operation fails. The native owner subscribes before its first
+inspection and retires on any observed change to the owned link or IPv4 address,
+its routes, or an equal/more-specific IPv4 route to its managed destinations.
+A change followed by restoration still retires the generation. Protocol closure,
+malformed inventory, interruption and overflow fail closed. Reconnecting creates
+a new generation. This event is also emitted immediately when the facade loses
+its transport, including the gap before automatic socket reconnect, or starts
+stopping. Reattaching to a surviving daemon cannot revive an invalidated generation;
+establish a fresh managed connection. The event does not acknowledge joined cleanup
+or reusable allocations.
+
+The native monitor shares the joined packet-task lifetime. On retirement the
+packet future and its nonpersistent TUN close before the native event is emitted;
+the kernel removes the TUN's routes. There is no name-based route cleanup or
+detached monitor. `disconnect()` joins the native connection; `stop()` confirms
+the owned bridge's closure. Socket transport still leaves the separately owned
+daemon process alive, so use `disconnect()` for native connection teardown.
+
+These are IPv4 TUN facts, not namespace-wide routing or packet-policy authority.
+The caller owns underlay/DHCP changes, global routing rules, sysctls, IPv6 policy,
+firewall enforcement and workload admission. Normal `getStatus()` is an observed
+connection status and does not substitute for a fresh kernel inspection.
+
+For sealed distributions, pass an already verified executable as
+`transport: { transport: 'stdio', binaryPath: '/absolute/path/to/smartvpn_daemon' }`.
+This selects that exact file ahead of environment/package lookup. Invalid paths
+reject without another executable being selected. Namespace descriptors remain
+separate `IVpnClientOptions.networkNamespaceFd` configuration.
+
 ### Confirmed bridge shutdown
 
 Always await `client.stop()`, `server.stop()` or `bridge.stop()` before replacing
@@ -145,8 +222,8 @@ await server.stop();
 ```
 
 This bridge lifecycle guarantee is separate from per-client packet/session
-revocation inside the running Rust daemon; see `readme.hints.md` for the current
-managed-network qualification boundaries.
+revocation inside the running Rust daemon; see the managed-network qualification
+boundaries below.
 
 The Rust server now waits for configured listeners and initial WireGuard peers
 before acknowledging startup. A listener startup failure shuts down the owned
@@ -774,6 +851,7 @@ client.on('exit', ({ code, signal }) => { /* daemon process exited */ });
 | `exit` | Both | `{ code, signal }` — daemon process exited |
 | `reconnected` | Both | `void` — socket transport reconnected |
 | `stderr` | Both | `string` — daemon diagnostic line, forwarded without automatic logging |
+| `managed-runtime-invalidated` | Client | `IVpnManagedRuntimeInvalidation` — stop using this managed generation immediately |
 
 For connection state and telemetry, use `getStatus()`, `getStatistics()`, `listClients()`, and `getClientTelemetry()`.