@push.rocks/smartvpn 2.1.0 → 2.2.0

package/assets/third-party-licenses.md

@@ -1,6 +1,7 @@
 # Third-party notices: managed Linux routing
 
-The Linux daemon links the following unmodified registry dependencies. Their
+The Linux daemon links these routing dependencies. The original netlink-proto
+0.13.0 attribution is retained alongside its published 0.13.1 fork. Their
 exact upstream LICENSE-MIT texts are reproduced below. This file is distributed
 under package.json's assets/**/* inclusion.
 
@@ -92,7 +93,40 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## netlink-proto 0.13.0
+## netlink-proto 0.13.1 (published fork)
+
+Source: https://code.foss.global/push.rocks/netlink-proto/src/commit/bcbbfbba7485857c3b1f9fd5f6d99d597a334ab0
+
+```text
+Copyright (c) The netlink-proto Contributors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+```
+
+## netlink-proto 0.13.0 (upstream attribution retained)
 
 Source: https://crates.io/crates/netlink-proto/0.13.0
 

package/dist_rust/smartvpn_daemon_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "8fed8d22e6597530ad96882e4593b8022d3b903aef769814ff17c212cfd7c21a",
+  "binarySha256": "4f8072fe724ac6d140e4d76aaaa1820bbfae2d70eda8f5c93ffbe8717df56453",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.1.0",
-    "gitCommit": "5debd57a3aea77860e63e478a4eb3e0dcc5256d8",
+    "projectVersion": "2.2.0",
+    "gitCommit": "da37d5bcd88b9b2d2849d05fa7865a361ab7c313",
     "gitDirty": false,
-    "builtAt": "2026-09-13T12:10:30.143Z",
+    "builtAt": "2026-09-15T01:02:07.587Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_amd64_musl"

package/dist_rust/smartvpn_daemon_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "df65b1e62dfabe53dff69d62b6d9e9ad1ef6e5990d2a4032993244d6f9d779bb",
+  "binarySha256": "01e551c5becdaaec42fa18c0f49ea6aa2e2bf6fef225211606ce52a486c1c918",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.1.0",
-    "gitCommit": "5debd57a3aea77860e63e478a4eb3e0dcc5256d8",
+    "projectVersion": "2.2.0",
+    "gitCommit": "da37d5bcd88b9b2d2849d05fa7865a361ab7c313",
     "gitDirty": false,
-    "builtAt": "2026-09-13T12:10:37.839Z",
+    "builtAt": "2026-09-15T01:02:07.887Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartvpn',
-    version: '2.1.0',
+    version: '2.2.0',
     description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/smartvpn.classes.vpnbridge.js

@@ -17,13 +17,17 @@ export class VpnBridge extends plugins.events.EventEmitter {
             }
         }
         const binaryName = options.binaryName || 'smartvpn_daemon';
+        if (options.transport.transport === 'stdio' && options.transport.binaryPath !== undefined
+            && (typeof options.transport.binaryPath !== 'string' || !plugins.path.isAbsolute(options.transport.binaryPath))) {
+            throw new Error('VpnBridge binaryPath must be an absolute executable path');
+        }
         // Keep the validated process transport stable even if the caller edits its options.
         this.transportOptions = { ...options.transport };
         this.mode = options.mode;
         this.bridge = new plugins.smartrust.RustBridge({
             binaryName,
             binaryPath: options.transport.transport === 'stdio'
-                ? paths.getBinaryPath(binaryName)
+                ? options.transport.binaryPath ?? paths.getBinaryPath(binaryName)
                 : undefined,
             localPaths: [],
             searchSystemPath: false,
@@ -33,6 +37,9 @@ export class VpnBridge extends plugins.events.EventEmitter {
             maxPayloadSize: 10 * 1024 * 1024, // 10 MB
         });
         // Forward events from inner bridge
+        this.bridge.on('disconnected', (event) => {
+            this.emit('disconnected', event);
+        });
         this.bridge.on('exit', (code, signal) => {
             this.emit('exit', code, signal);
         });
@@ -44,6 +51,9 @@ export class VpnBridge extends plugins.events.EventEmitter {
         });
         // Forward management events from the daemon
         // smartrust emits 'management:<eventName>' for unsolicited events
+        this.bridge.on('management:managed-runtime-invalidated', (data) => {
+            this.emit('managed-runtime-invalidated', data);
+        });
         this.bridge.on('management:status', (data) => {
             this.emit('status', data);
         });
@@ -100,4 +110,4 @@ export class VpnBridge extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5icmlkZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sS0FBSyxLQUFLLE1BQU0scUJBQXFCLENBQUM7QUFPN0M7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQXlDLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBS3ZGLFlBQVksT0FLWDtRQUNDLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQy9DLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQzlHLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztZQUNoRixDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxHQUFHLENBQUMsSUFBSSxXQUFXLEdBQUcsV0FBVyxFQUFFLENBQUM7Z0JBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztZQUMzRixDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUksaUJBQWlCLENBQUM7UUFDM0Qsb0ZBQW9GO1FBQ3BGLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxFQUFFLEdBQUcsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2pELElBQUksQ0FBQyxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQztRQUV6QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQVk7WUFDeEQsVUFBVTtZQUNWLFVBQVUsRUFBRSxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxPQUFPO2dCQUNqRCxDQUFDLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUM7Z0JBQ2pDLENBQUMsQ0FBQyxTQUFTO1lBQ2IsVUFBVSxFQUFFLEVBQUU7WUFDZCxnQkFBZ0IsRUFBRSxLQUFLO1lBQ3ZCLE9BQU8sRUFBRSxDQUFDLGNBQWMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQzNDLEdBQUcsQ0FBQyxXQUFXLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsd0JBQXdCLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztZQUN4RSx3QkFBd0IsRUFBRSxXQUFXLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDO1lBQy9FLGNBQWMsRUFBRSxFQUFFLEdBQUcsSUFBSSxHQUFHLElBQUksRUFBRSxRQUFRO1NBQzNDLENBQUMsQ0FBQztRQUVILG1DQUFtQztRQUNuQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFtQixFQUFFLE1BQXFCLEVBQUUsRUFBRTtZQUNwRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDbEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxhQUFhLEVBQUUsR0FBRyxFQUFFO1lBQ2pDLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFZLEVBQUUsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUVILDRDQUE0QztRQUM1QyxrRUFBa0U7UUFDbEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsbUJBQW1CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNoRCxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGtCQUFrQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDL0MsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyw2QkFBNkIsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzFELElBQUksQ0FBQyxJQUFJLENBQUMsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxnQ0FBZ0MsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzdELElBQUksQ0FBQyxJQUFJLENBQUMscUJBQXFCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDekMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzdCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNqRCxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM3QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxLQUFLO1FBQ2hCLElBQUksSUFBSSxDQUFDLGdCQUFnQixDQUFDLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNqRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsZ0JBQXVDLENBQUM7WUFDaEUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFO2dCQUNoRCxhQUFhLEVBQUUsVUFBVSxDQUFDLGFBQWE7Z0JBQ3ZDLG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7Z0JBQ3JELG1CQUFtQixFQUFFLFVBQVUsQ0FBQyxtQkFBbUI7Z0JBQ25ELG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7YUFDdEQsQ0FBQyxDQUFDO1FBQ0wsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDN0IsQ0FBQztJQUNILENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUNoQyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVyxDQUN0QixNQUFTLEVBQ1QsTUFBOEI7UUFFOUIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5icmlkZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sS0FBSyxLQUFLLE1BQU0scUJBQXFCLENBQUM7QUFRN0M7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQXlDLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBS3ZGLFlBQVksT0FLWDtRQUNDLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQy9DLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQzlHLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztZQUNoRixDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxHQUFHLENBQUMsSUFBSSxXQUFXLEdBQUcsV0FBVyxFQUFFLENBQUM7Z0JBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztZQUMzRixDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUksaUJBQWlCLENBQUM7UUFDM0QsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssU0FBUztlQUNwRixDQUFDLE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEgsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxvRkFBb0Y7UUFDcEYsSUFBSSxDQUFDLGdCQUFnQixHQUFHLEVBQUUsR0FBRyxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDakQsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO1FBRXpCLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBWTtZQUN4RCxVQUFVO1lBQ1YsVUFBVSxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLE9BQU87Z0JBQ2pELENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsSUFBSSxLQUFLLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQztnQkFDakUsQ0FBQyxDQUFDLFNBQVM7WUFDYixVQUFVLEVBQUUsRUFBRTtZQUNkLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsT0FBTyxFQUFFLENBQUMsY0FBYyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSTtnQkFDM0MsR0FBRyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyx3QkFBd0IsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3hFLHdCQUF3QixFQUFFLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUM7WUFDL0UsY0FBYyxFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxFQUFFLFFBQVE7U0FDM0MsQ0FBQyxDQUFDO1FBRUgsbUNBQW1DO1FBQ25DLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGNBQWMsRUFBRSxDQUFDLEtBQW1DLEVBQUUsRUFBRTtZQUNyRSxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNuQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQW1CLEVBQUUsTUFBcUIsRUFBRSxFQUFFO1lBQ3BFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNsQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBRUgsNENBQTRDO1FBQzVDLGtFQUFrRTtRQUNsRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyx3Q0FBd0MsRUFBRSxDQUFDLElBQW9DLEVBQUUsRUFBRTtZQUNoRyxJQUFJLENBQUMsSUFBSSxDQUFDLDZCQUE2QixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2pELENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsbUJBQW1CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNoRCxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGtCQUFrQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDL0MsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyw2QkFBNkIsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzFELElBQUksQ0FBQyxJQUFJLENBQUMsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxnQ0FBZ0MsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzdELElBQUksQ0FBQyxJQUFJLENBQUMscUJBQXFCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDekMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzdCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNqRCxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM3QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxLQUFLO1FBQ2hCLElBQUksSUFBSSxDQUFDLGdCQUFnQixDQUFDLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNqRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsZ0JBQXVDLENBQUM7WUFDaEUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFO2dCQUNoRCxhQUFhLEVBQUUsVUFBVSxDQUFDLGFBQWE7Z0JBQ3ZDLG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7Z0JBQ3JELG1CQUFtQixFQUFFLFVBQVUsQ0FBQyxtQkFBbUI7Z0JBQ25ELG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7YUFDdEQsQ0FBQyxDQUFDO1FBQ0wsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDN0IsQ0FBQztJQUNILENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUNoQyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVyxDQUN0QixNQUFTLEVBQ1QsTUFBOEI7UUFFOUIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGIn0=

package/dist_ts/smartvpn.classes.vpnclient.d.ts

@@ -1,12 +1,18 @@
 import * as plugins from './smartvpn.plugins.js';
-import type { IVpnClientOptions, IVpnClientConfig, IVpnStatus, IVpnStatistics, IVpnConnectionQuality, IVpnMtuInfo } from './smartvpn.interfaces.js';
+import type { IVpnClientOptions, IVpnClientConfig, IVpnStatus, IVpnStatistics, IVpnConnectionQuality, IVpnMtuInfo, IVpnConnectionResult, IVpnManagedRuntime } from './smartvpn.interfaces.js';
 /**
  * VPN Client — manages a smartvpn daemon in client mode.
  */
 export declare class VpnClient extends plugins.events.EventEmitter {
     private bridge;
     private options;
+    private bridgeEpoch;
+    private managedGeneration?;
+    private lastInvalidatedGeneration?;
     constructor(options: IVpnClientOptions);
+    private invalidateGeneration;
+    private invalidateBridge;
+    private checkObservation;
     /**
      * Start the daemon bridge (spawn or connect).
      */
@@ -14,9 +20,10 @@ export declare class VpnClient extends plugins.events.EventEmitter {
     /**
      * Connect to the VPN server using the provided config.
      */
-    connect(config?: IVpnClientConfig): Promise<{
-        assignedIp: string;
-    }>;
+    connect(config?: IVpnClientConfig): Promise<IVpnConnectionResult>;
+    /** Inspect the retained native TUN, its exact IPv4 /32 and split routes.
+     * Requires the connection's generation and fails after retirement/reconnect. */
+    inspectManagedRuntime(generation: string): Promise<IVpnManagedRuntime>;
     /**
      * Disconnect from the VPN server.
      */

package/dist_ts/smartvpn.classes.vpnclient.js

@@ -6,6 +6,7 @@ import { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export class VpnClient extends plugins.events.EventEmitter {
     constructor(options) {
         super();
+        this.bridgeEpoch = 0;
         this.options = options;
         this.bridge = new VpnBridge({
             transport: options.transport,
@@ -13,15 +14,42 @@ export class VpnClient extends plugins.events.EventEmitter {
             networkNamespaceFd: options.networkNamespaceFd,
         });
         // Forward bridge events
+        this.bridge.on('disconnected', () => {
+            this.invalidateBridge('Client transport disconnected');
+        });
         this.bridge.on('exit', (code, signal) => {
+            this.invalidateBridge('Client bridge exited');
             this.emit('exit', { code, signal });
         });
         this.bridge.on('reconnected', () => {
+            this.invalidateBridge('Client bridge reconnected');
             this.emit('reconnected');
         });
         this.bridge.on('stderr', (line) => {
             this.emit('stderr', line);
         });
+        this.bridge.on('managed-runtime-invalidated', (event) => {
+            this.invalidateGeneration(event);
+        });
+    }
+    invalidateGeneration(event) {
+        if (this.lastInvalidatedGeneration === event.generation)
+            return;
+        this.lastInvalidatedGeneration = event.generation;
+        if (this.managedGeneration === event.generation)
+            this.managedGeneration = undefined;
+        this.emit('managed-runtime-invalidated', event);
+    }
+    invalidateBridge(reason) {
+        this.bridgeEpoch++;
+        if (this.managedGeneration)
+            this.invalidateGeneration({ generation: this.managedGeneration, reason });
+    }
+    checkObservation(runtime, epoch, generation) {
+        if (epoch !== this.bridgeEpoch || runtime.generation === this.lastInvalidatedGeneration
+            || (generation !== undefined && runtime.generation !== generation)) {
+            throw new Error('Managed runtime retired during the operation');
+        }
     }
     /**
      * Start the daemon bridge (spawn or connect).
@@ -37,7 +65,24 @@ export class VpnClient extends plugins.events.EventEmitter {
         if (!cfg) {
             throw new Error('VpnClient.connect: no config provided');
         }
-        return this.bridge.sendCommand('connect', { config: cfg });
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand('connect', { config: cfg });
+        if (result.managedRuntime) {
+            this.checkObservation(result.managedRuntime, epoch);
+            this.managedGeneration = result.managedRuntime.generation;
+        }
+        return result;
+    }
+    /** Inspect the retained native TUN, its exact IPv4 /32 and split routes.
+     * Requires the connection's generation and fails after retirement/reconnect. */
+    async inspectManagedRuntime(generation) {
+        if (typeof generation !== 'string' || !/^[a-f0-9]{32}$/.test(generation)) {
+            throw new Error('Managed runtime generation must be a native 128-bit identifier');
+        }
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand('inspectManagedRuntime', { generation });
+        this.checkObservation(result, epoch, generation);
+        return result;
     }
     /**
      * Disconnect from the VPN server.
@@ -74,6 +119,7 @@ export class VpnClient extends plugins.events.EventEmitter {
      * Stop the daemon bridge and wait for confirmed ownership release.
      */
     async stop() {
+        this.invalidateBridge('Client stop requested');
         await this.bridge.stop();
     }
     /**
@@ -83,4 +129,4 @@ export class VpnClient extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQVc1RDs7R0FFRztBQUNILE1BQU0sT0FBTyxTQUFVLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBSXhELFlBQVksT0FBMEI7UUFDcEMsS0FBSyxFQUFFLENBQUM7UUFDUixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksU0FBUyxDQUFxQjtZQUM5QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsSUFBSSxFQUFFLFFBQVE7WUFDZCxrQkFBa0IsRUFBRSxPQUFPLENBQUMsa0JBQWtCO1NBQy9DLENBQUMsQ0FBQztRQUVILHdCQUF3QjtRQUN4QixJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFtQixFQUFFLE1BQXFCLEVBQUUsRUFBRTtZQUNwRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ3RDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsYUFBYSxFQUFFLEdBQUcsRUFBRTtZQUNqQyxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzNCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBWSxFQUFFLEVBQUU7WUFDeEMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUF5QjtRQUM1QyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7UUFDMUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ1QsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxVQUFVO1FBQ3JCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsWUFBWSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsU0FBUztRQUNwQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFdBQVcsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGFBQWE7UUFDeEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxvQkFBb0I7UUFDL0IsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxzQkFBc0IsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxVQUFVO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsWUFBWSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUMzQixDQUFDO0lBRUQ7O09BRUc7SUFDSCxJQUFXLE9BQU87UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUM3QixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQWM1RDs7R0FFRztBQUNILE1BQU0sT0FBTyxTQUFVLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBT3hELFlBQVksT0FBMEI7UUFDcEMsS0FBSyxFQUFFLENBQUM7UUFMRixnQkFBVyxHQUFHLENBQUMsQ0FBQztRQU10QixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksU0FBUyxDQUFxQjtZQUM5QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsSUFBSSxFQUFFLFFBQVE7WUFDZCxrQkFBa0IsRUFBRSxPQUFPLENBQUMsa0JBQWtCO1NBQy9DLENBQUMsQ0FBQztRQUVILHdCQUF3QjtRQUN4QixJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxjQUFjLEVBQUUsR0FBRyxFQUFFO1lBQ2xDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ3pELENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBbUIsRUFBRSxNQUFxQixFQUFFLEVBQUU7WUFDcEUsSUFBSSxDQUFDLGdCQUFnQixDQUFDLHNCQUFzQixDQUFDLENBQUM7WUFDOUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLDJCQUEyQixDQUFDLENBQUM7WUFDbkQsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsNkJBQTZCLEVBQUUsQ0FBQyxLQUFxQyxFQUFFLEVBQUU7WUFDdEYsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25DLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLG9CQUFvQixDQUFDLEtBQXFDO1FBQ2hFLElBQUksSUFBSSxDQUFDLHlCQUF5QixLQUFLLEtBQUssQ0FBQyxVQUFVO1lBQUUsT0FBTztRQUNoRSxJQUFJLENBQUMseUJBQXlCLEdBQUcsS0FBSyxDQUFDLFVBQVUsQ0FBQztRQUNsRCxJQUFJLElBQUksQ0FBQyxpQkFBaUIsS0FBSyxLQUFLLENBQUMsVUFBVTtZQUFFLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxTQUFTLENBQUM7UUFDcEYsSUFBSSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBRU8sZ0JBQWdCLENBQUMsTUFBYztRQUNyQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDbkIsSUFBSSxJQUFJLENBQUMsaUJBQWlCO1lBQUUsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3hHLENBQUM7SUFFTyxnQkFBZ0IsQ0FBQyxPQUEyQixFQUFFLEtBQWEsRUFBRSxVQUFtQjtRQUN0RixJQUFJLEtBQUssS0FBSyxJQUFJLENBQUMsV0FBVyxJQUFJLE9BQU8sQ0FBQyxVQUFVLEtBQUssSUFBSSxDQUFDLHlCQUF5QjtlQUNsRixDQUFDLFVBQVUsS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLFVBQVUsS0FBSyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3JFLE1BQU0sSUFBSSxLQUFLLENBQUMsOENBQThDLENBQUMsQ0FBQztRQUNsRSxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLEtBQUs7UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQzdCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBeUI7UUFDNUMsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQzFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQztRQUMvQixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ3pFLElBQUksTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzFCLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQ3BELElBQUksQ0FBQyxpQkFBaUIsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVEO29GQUNnRjtJQUN6RSxLQUFLLENBQUMscUJBQXFCLENBQUMsVUFBa0I7UUFDbkQsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN6RSxNQUFNLElBQUksS0FBSyxDQUFDLGdFQUFnRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUM7UUFDL0IsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyx1QkFBdUIsRUFBRSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDdEYsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDakQsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxZQUFZLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxTQUFTO1FBQ3BCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBVyxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsYUFBYTtRQUN4QixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGVBQWUsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLG9CQUFvQjtRQUMvQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLHNCQUFzQixFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxZQUFZLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxDQUFDLGdCQUFnQixDQUFDLHVCQUF1QixDQUFDLENBQUM7UUFDL0MsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzNCLENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRiJ9

package/dist_ts/smartvpn.interfaces.d.ts

@@ -1,5 +1,8 @@
 export interface IVpnTransportStdio {
     transport: 'stdio';
+    /** Exact caller-verified executable. Overrides environment/package lookup;
+     * invalid paths fail without falling through to another executable. */
+    binaryPath?: string;
 }
 export interface IVpnTransportSocket {
     transport: 'socket';
@@ -408,9 +411,13 @@ export type TVpnClientCommands = {
         params: {
             config: IVpnClientConfig;
         };
-        result: {
-            assignedIp: string;
+        result: IVpnConnectionResult;
+    };
+    inspectManagedRuntime: {
+        params: {
+            generation: string;
         };
+        result: IVpnManagedRuntime;
     };
     disconnect: {
         params: Record<string, never>;
@@ -649,6 +656,39 @@ export interface IManagedNetworkBinding {
     authorityId: string;
     nodeId: string;
 }
+export interface IVpnConnectionResult {
+    assignedIp: string;
+    /** Present only for an authenticated native managed connection with a real TUN. */
+    managedRuntime?: IVpnManagedRuntime;
+}
+/** A fresh observation of a retained native lifetime, never a transferable or
+ * restorable capability. The caller retains VpnClient and listens for invalidation.
+ * IPv6, namespace-wide policy/rules, underlay and firewall remain caller-owned. */
+export interface IVpnManagedRuntime {
+    schemaVersion: 1;
+    generation: string;
+    namespace: {
+        device: string;
+        inode: string;
+    };
+    link: {
+        interfaceIndex: number;
+        interfaceName: string;
+        interfaceKind: 'tun';
+        linkIndex: number;
+        mtu: number;
+        address: string;
+        prefixLength: 32;
+    };
+    remoteIp: string;
+    assignment: IManagedNetworkAssignment;
+}
+/** Stop using this generation immediately. This event is not a joined cleanup,
+ * conntrack drain, or allocation-reuse acknowledgement. */
+export interface IVpnManagedRuntimeInvalidation {
+    generation: string;
+    reason: string;
+}
 export interface IManagedNodeConfig {
     /** Caller-owned control address with /32; local workload prefixes are not hub routes. */
     address: string;
@@ -674,6 +714,7 @@ export interface IVpnServiceUnit {
     installPath: string;
 }
 export interface IVpnEventMap {
+    'managed-runtime-invalidated': IVpnManagedRuntimeInvalidation;
     'status': IVpnStatus;
     'error': {
         message: string;

package/notices/cargo-dependencies.html

@@ -3004,6 +3004,38 @@ The above copyright notice and this permission notice
 shall be included in all copies or substantial portions
 of the Software.
 
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+</pre>
+</section>
+<section>
+  <h2>MIT License (MIT)</h2>
+  <ul>
+    <li>netlink-proto 0.13.1</li>
+  </ul>
+  <pre>Copyright (c) The netlink-proto Contributors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the &quot;Software&quot;), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
 THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF
 ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
 TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
@@ -3610,7 +3642,6 @@ DEALINGS IN THE SOFTWARE.
   <h2>MIT License (MIT)</h2>
   <ul>
     <li>netlink-packet-core 0.9.0</li>
-    <li>netlink-proto 0.13.0</li>
     <li>netlink-sys 0.9.0</li>
     <li>rtnetlink 0.23.0</li>
   </ul>

package/notices/inventory.json

@@ -3,9 +3,9 @@
   "rustVersion": "1.95.0",
   "cargoAboutVersion": "0.9.1",
   "files": {
-    "assets/third-party-licenses.md": "da4de43c4e7a7e530af740c58c45ea620f9da2bf1639251d1740344102317aed",
+    "assets/third-party-licenses.md": "6be2373e39312d90eb3571bef614c89df565f98c917795d7aea3497f52ef19f1",
     "notices/aho-corasick-license.txt": "0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f",
-    "notices/cargo-dependencies.html": "01f390d02b89be9fde6154ee05f3cb275e7baaf4ba15a29a3b4a385e4574a3ad",
+    "notices/cargo-dependencies.html": "bd8e78c6f49c0ee60ccf6e1449c9b52276940055b08aaf32c5ede1ec3b307b4c",
     "notices/compiler-builtins-license.txt": "ab6eec6caf0fa5775e411c7a8bc6a45c4ef2956b0980b157ab74fc5cd62a928b",
     "notices/defmt-license.txt": "0d17b75c1867fd568bcbb735f329d0d4253846c4b756a65e4d440c1e4bd59187",
     "notices/llvm-libunwind-license.txt": "b5efebcaca80879234098e52d1725e6d9eb8fb96a19fce625d39184b705f7b6d",
@@ -16,11 +16,11 @@
     "notices/valuable-license.txt": "ed60d479b8fd1f64e9cbc3de449a16a53ac1b3d1b6aeb9bf9d190a8e93061b44",
     "rust-toolchain.toml": "19da9ff32e229a69ff5dde28ac23233256ff25e413a8c579155cf641f4f0634f",
     "rust/.cargo/config.toml": "eb6896791bd573f2cb099aa41c7d3668c6d368166945abd3553c8d8029ba8b7b",
-    "rust/Cargo.lock": "fa059d9023e2b9b8f3c3e343f57fc273de00da825130d3cfce07ceb03cbe2032",
-    "rust/Cargo.toml": "77b42a0647d03870745119fdfbcf288399c72d8d399fea3b6168db9cb3cd07ca",
+    "rust/Cargo.lock": "93980ffcc3d2eca0083f524999b15f1674698d2aceff5922ed0aa5a09138d260",
+    "rust/Cargo.toml": "308d11b4bb6b8f290ca2d83f2c817e10798bad54510dd3a6fdb72c32d095ae3b",
     "rust/about.hbs": "a7c35d089563a08520a6e5f351aadae659e1f7bf24cabedbca3de8a89e966f86",
-    "rust/about.toml": "9eb1fb41fc435a370d0c2ce1a77e5f0897b785a023ab87fd6721979ded479e66",
-    "third-party-notices.md": "e935f4b27acaa567180b4b55ab472412b3c0ab7d528351b41863a1785074cd4b"
+    "rust/about.toml": "a457e0cc7532020c0f87532919a754997213ccbec6211c9501b8c198d404ed72",
+    "third-party-notices.md": "9b3adc6a4968ba5ef1eb666188ddb147933e2d90bafca040a59789b2f4b9389b"
   },
   "supplementalCargoNotices": {
     "aho-corasick@1.1.4": "notices/aho-corasick-license.txt",
@@ -605,7 +605,7 @@
     },
     {
       "name": "netlink-proto",
-      "version": "0.13.0",
+      "version": "0.13.1",
       "license": "MIT"
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",
@@ -25,14 +25,14 @@
   "dependencies": {
     "@push.rocks/smartnftables": "1.2.0",
     "@push.rocks/smartpath": "^6.0.0",
-    "@push.rocks/smartrust": "^2.0.0"
+    "@push.rocks/smartrust": "^2.1.0"
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tsrust": "^1.13.0",
     "@git.zone/tstest": "^6.0.0",
-    "@types/node": "^26.4.1"
+    "@types/node": "^26.5.0"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -155,6 +155,52 @@ managed TUN creation, allow/deny, reconnect, revocation, route-conflict rollback
 and child-termination cleanup. Privileged ARM64 and Pallet integration remain
 separate qualification requirements.
 
+### Retained managed TUN runtime
+
+An authenticated native managed connection with `forwardingMode: 'tun'` returns
+`managedRuntime` alongside `assignedIp`. Its random `generation` identifies that
+one connection's retained TUN and netlink owner. The observation includes the
+actual namespace device/inode, TUN name/index/link index, MTU, IPv4 /32, actual hub
+peer IP and authenticated managed assignment. Testing and WireGuard connections
+do not provide this capability.
+
+`await client.inspectManagedRuntime(generation)` performs a new bounded kernel
+inspection of that retained owner. It requires complete, uninterrupted link,
+IPv4 address and route inventories, including successful netlink DONE messages.
+A missing, retired or different generation rejects; no serialized observation
+can reopen a namespace, adopt another interface or restore an old connection.
+
+Register `client.on('managed-runtime-invalidated', handler)` before connecting.
+Stop admitting work against that generation as soon as the event arrives or an
+inspection/IPC operation fails. The native owner subscribes before its first
+inspection and retires on any observed change to the owned link or IPv4 address,
+its routes, or an equal/more-specific IPv4 route to its managed destinations.
+A change followed by restoration still retires the generation. Protocol closure,
+malformed inventory, interruption and overflow fail closed. Reconnecting creates
+a new generation. This event is also emitted immediately when the facade loses
+its transport, including the gap before automatic socket reconnect, or starts
+stopping. Reattaching to a surviving daemon cannot revive an invalidated generation;
+establish a fresh managed connection. The event does not acknowledge joined cleanup
+or reusable allocations.
+
+The native monitor shares the joined packet-task lifetime. On retirement the
+packet future and its nonpersistent TUN close before the native event is emitted;
+the kernel removes the TUN's routes. There is no name-based route cleanup or
+detached monitor. `disconnect()` joins the native connection; `stop()` confirms
+the owned bridge's closure. Socket transport still leaves the separately owned
+daemon process alive, so use `disconnect()` for native connection teardown.
+
+These are IPv4 TUN facts, not namespace-wide routing or packet-policy authority.
+The caller owns underlay/DHCP changes, global routing rules, sysctls, IPv6 policy,
+firewall enforcement and workload admission. Normal `getStatus()` is an observed
+connection status and does not substitute for a fresh kernel inspection.
+
+For sealed distributions, pass an already verified executable as
+`transport: { transport: 'stdio', binaryPath: '/absolute/path/to/smartvpn_daemon' }`.
+This selects that exact file ahead of environment/package lookup. Invalid paths
+reject without another executable being selected. Namespace descriptors remain
+separate `IVpnClientOptions.networkNamespaceFd` configuration.
+
 ### Confirmed bridge shutdown
 
 Always await `client.stop()`, `server.stop()` or `bridge.stop()` before replacing
@@ -805,6 +851,7 @@ client.on('exit', ({ code, signal }) => { /* daemon process exited */ });
 | `exit` | Both | `{ code, signal }` — daemon process exited |
 | `reconnected` | Both | `void` — socket transport reconnected |
 | `stderr` | Both | `string` — daemon diagnostic line, forwarded without automatic logging |
+| `managed-runtime-invalidated` | Client | `IVpnManagedRuntimeInvalidation` — stop using this managed generation immediately |
 
 For connection state and telemetry, use `getStatus()`, `getStatistics()`, `listClients()`, and `getClientTelemetry()`.
 

package/third-party-notices.md

@@ -22,7 +22,7 @@ locked, feature-inactive packages are covered by these supplemental MIT notices:
 - [valuable 0.1.1](./notices/valuable-license.txt), from
   [its pinned upstream LICENSE](https://github.com/tokio-rs/valuable/blob/9efc29b6e58cef28f6566a47aa7e142a55fead77/LICENSE).
 
-Together these cover all 278 locked registry packages, conservatively including
+Together these cover all 278 locked external packages, conservatively including
 build-only and target-inactive dependencies. Listing a package does not mean it
 is linked into either Linux executable. MIT is preferred where offered as an
 alternative; other selected terms include Apache-2.0, BSD, ISC, Unicode-3.0,
@@ -30,6 +30,12 @@ CDLA-Permissive-2.0 and the existing tun 0.7.22 dependency's WTFPL.
 The exact package versions, declared license expressions and reviewed file hashes
 are recorded in [inventory.json](./notices/inventory.json).
 
+The managed kernel inventory uses the published `netlink-proto` 0.13.1 fork at
+`bcbbfbba7485857c3b1f9fd5f6d99d597a334ab0` from
+[push.rocks/netlink-proto](https://code.foss.global/push.rocks/netlink-proto).
+Its exact MIT notice is included in the generated inventory and supplemental
+route notices; the original 0.13.0 attribution is retained there as well.
+
 The [additional MIT source attributions](./notices/mit-source-attributions.txt)
 retain cesu8 1.1.0's Rust Project/Eric Kidd source headers and siphasher 1.0.2's
 Rust Project/Frank Denis `COPYING` attribution, together with the selected MIT terms.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartvpn',
-  version: '2.1.0',
+  version: '2.2.0',
   description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 }

package/ts/smartvpn.classes.vpnbridge.ts

@@ -3,8 +3,9 @@ import * as paths from './smartvpn.paths.js';
 import type {
   TVpnTransportOptions,
   IVpnTransportSocket,
+  IVpnManagedRuntimeInvalidation,
 } from './smartvpn.interfaces.js';
-import type { TCommandMap } from '@push.rocks/smartrust';
+import type { TCommandMap, IRustBridgeDisconnectedEvent } from '@push.rocks/smartrust';
 
 /**
  * Shared bridge wrapper around smartrust RustBridge.
@@ -33,6 +34,10 @@ export class VpnBridge<TCommands extends TCommandMap> extends plugins.events.Eve
       }
     }
     const binaryName = options.binaryName || 'smartvpn_daemon';
+    if (options.transport.transport === 'stdio' && options.transport.binaryPath !== undefined
+      && (typeof options.transport.binaryPath !== 'string' || !plugins.path.isAbsolute(options.transport.binaryPath))) {
+      throw new Error('VpnBridge binaryPath must be an absolute executable path');
+    }
     // Keep the validated process transport stable even if the caller edits its options.
     this.transportOptions = { ...options.transport };
     this.mode = options.mode;
@@ -40,7 +45,7 @@ export class VpnBridge<TCommands extends TCommandMap> extends plugins.events.Eve
     this.bridge = new plugins.smartrust.RustBridge<TCommands>({
       binaryName,
       binaryPath: options.transport.transport === 'stdio'
-        ? paths.getBinaryPath(binaryName)
+        ? options.transport.binaryPath ?? paths.getBinaryPath(binaryName)
         : undefined,
       localPaths: [],
       searchSystemPath: false,
@@ -51,6 +56,9 @@ export class VpnBridge<TCommands extends TCommandMap> extends plugins.events.Eve
     });
 
     // Forward events from inner bridge
+    this.bridge.on('disconnected', (event: IRustBridgeDisconnectedEvent) => {
+      this.emit('disconnected', event);
+    });
     this.bridge.on('exit', (code: number | null, signal: string | null) => {
       this.emit('exit', code, signal);
     });
@@ -63,6 +71,9 @@ export class VpnBridge<TCommands extends TCommandMap> extends plugins.events.Eve
 
     // Forward management events from the daemon
     // smartrust emits 'management:<eventName>' for unsolicited events
+    this.bridge.on('management:managed-runtime-invalidated', (data: IVpnManagedRuntimeInvalidation) => {
+      this.emit('managed-runtime-invalidated', data);
+    });
     this.bridge.on('management:status', (data: any) => {
       this.emit('status', data);
     });

package/ts/smartvpn.classes.vpnclient.ts

@@ -7,6 +7,9 @@ import type {
   IVpnStatistics,
   IVpnConnectionQuality,
   IVpnMtuInfo,
+  IVpnConnectionResult,
+  IVpnManagedRuntime,
+  IVpnManagedRuntimeInvalidation,
   TVpnClientCommands,
 } from './smartvpn.interfaces.js';
 
@@ -16,6 +19,9 @@ import type {
 export class VpnClient extends plugins.events.EventEmitter {
   private bridge: VpnBridge<TVpnClientCommands>;
   private options: IVpnClientOptions;
+  private bridgeEpoch = 0;
+  private managedGeneration?: string;
+  private lastInvalidatedGeneration?: string;
 
   constructor(options: IVpnClientOptions) {
     super();
@@ -27,15 +33,42 @@ export class VpnClient extends plugins.events.EventEmitter {
     });
 
     // Forward bridge events
+    this.bridge.on('disconnected', () => {
+      this.invalidateBridge('Client transport disconnected');
+    });
     this.bridge.on('exit', (code: number | null, signal: string | null) => {
+      this.invalidateBridge('Client bridge exited');
       this.emit('exit', { code, signal });
     });
     this.bridge.on('reconnected', () => {
+      this.invalidateBridge('Client bridge reconnected');
       this.emit('reconnected');
     });
     this.bridge.on('stderr', (line: string) => {
       this.emit('stderr', line);
     });
+    this.bridge.on('managed-runtime-invalidated', (event: IVpnManagedRuntimeInvalidation) => {
+      this.invalidateGeneration(event);
+    });
+  }
+
+  private invalidateGeneration(event: IVpnManagedRuntimeInvalidation): void {
+    if (this.lastInvalidatedGeneration === event.generation) return;
+    this.lastInvalidatedGeneration = event.generation;
+    if (this.managedGeneration === event.generation) this.managedGeneration = undefined;
+    this.emit('managed-runtime-invalidated', event);
+  }
+
+  private invalidateBridge(reason: string): void {
+    this.bridgeEpoch++;
+    if (this.managedGeneration) this.invalidateGeneration({ generation: this.managedGeneration, reason });
+  }
+
+  private checkObservation(runtime: IVpnManagedRuntime, epoch: number, generation?: string): void {
+    if (epoch !== this.bridgeEpoch || runtime.generation === this.lastInvalidatedGeneration
+      || (generation !== undefined && runtime.generation !== generation)) {
+      throw new Error('Managed runtime retired during the operation');
+    }
   }
 
   /**
@@ -48,12 +81,30 @@ export class VpnClient extends plugins.events.EventEmitter {
   /**
    * Connect to the VPN server using the provided config.
    */
-  public async connect(config?: IVpnClientConfig): Promise<{ assignedIp: string }> {
+  public async connect(config?: IVpnClientConfig): Promise<IVpnConnectionResult> {
     const cfg = config || this.options.config;
     if (!cfg) {
       throw new Error('VpnClient.connect: no config provided');
     }
-    return this.bridge.sendCommand('connect', { config: cfg });
+    const epoch = this.bridgeEpoch;
+    const result = await this.bridge.sendCommand('connect', { config: cfg });
+    if (result.managedRuntime) {
+      this.checkObservation(result.managedRuntime, epoch);
+      this.managedGeneration = result.managedRuntime.generation;
+    }
+    return result;
+  }
+
+  /** Inspect the retained native TUN, its exact IPv4 /32 and split routes.
+   * Requires the connection's generation and fails after retirement/reconnect. */
+  public async inspectManagedRuntime(generation: string): Promise<IVpnManagedRuntime> {
+    if (typeof generation !== 'string' || !/^[a-f0-9]{32}$/.test(generation)) {
+      throw new Error('Managed runtime generation must be a native 128-bit identifier');
+    }
+    const epoch = this.bridgeEpoch;
+    const result = await this.bridge.sendCommand('inspectManagedRuntime', { generation });
+    this.checkObservation(result, epoch, generation);
+    return result;
   }
 
   /**
@@ -96,6 +147,7 @@ export class VpnClient extends plugins.events.EventEmitter {
    * Stop the daemon bridge and wait for confirmed ownership release.
    */
   public async stop(): Promise<void> {
+    this.invalidateBridge('Client stop requested');
     await this.bridge.stop();
   }
 

package/ts/smartvpn.interfaces.ts

@@ -4,6 +4,9 @@
 
 export interface IVpnTransportStdio {
   transport: 'stdio';
+  /** Exact caller-verified executable. Overrides environment/package lookup;
+   * invalid paths fail without falling through to another executable. */
+  binaryPath?: string;
 }
 
 export interface IVpnTransportSocket {
@@ -488,7 +491,8 @@ export interface IWgPeerInfo {
 // ============================================================================
 
 export type TVpnClientCommands = {
-  connect: { params: { config: IVpnClientConfig }; result: { assignedIp: string } };
+  connect: { params: { config: IVpnClientConfig }; result: IVpnConnectionResult };
+  inspectManagedRuntime: { params: { generation: string }; result: IVpnManagedRuntime };
   disconnect: { params: Record<string, never>; result: void };
   getStatus: { params: Record<string, never>; result: IVpnStatus };
   getStatistics: { params: Record<string, never>; result: IVpnStatistics };
@@ -595,6 +599,39 @@ export interface IManagedNetworkBinding {
   nodeId: string;
 }
 
+export interface IVpnConnectionResult {
+  assignedIp: string;
+  /** Present only for an authenticated native managed connection with a real TUN. */
+  managedRuntime?: IVpnManagedRuntime;
+}
+
+/** A fresh observation of a retained native lifetime, never a transferable or
+ * restorable capability. The caller retains VpnClient and listens for invalidation.
+ * IPv6, namespace-wide policy/rules, underlay and firewall remain caller-owned. */
+export interface IVpnManagedRuntime {
+  schemaVersion: 1;
+  generation: string;
+  namespace: { device: string; inode: string };
+  link: {
+    interfaceIndex: number;
+    interfaceName: string;
+    interfaceKind: 'tun';
+    linkIndex: number;
+    mtu: number;
+    address: string;
+    prefixLength: 32;
+  };
+  remoteIp: string;
+  assignment: IManagedNetworkAssignment;
+}
+
+/** Stop using this generation immediately. This event is not a joined cleanup,
+ * conntrack drain, or allocation-reuse acknowledgement. */
+export interface IVpnManagedRuntimeInvalidation {
+  generation: string;
+  reason: string;
+}
+
 export interface IManagedNodeConfig {
   /** Caller-owned control address with /32; local workload prefixes are not hub routes. */
   address: string;
@@ -632,6 +669,7 @@ export interface IVpnServiceUnit {
 // ============================================================================
 
 export interface IVpnEventMap {
+  'managed-runtime-invalidated': IVpnManagedRuntimeInvalidation;
   'status': IVpnStatus;
   'error': { message: string; code?: string };
   'client-connected': IVpnClientInfo;