@push.rocks/smartvpn 2.1.0 → 2.3.0

package/assets/third-party-licenses.md

@@ -1,6 +1,7 @@
 # Third-party notices: managed Linux routing
 
-The Linux daemon links the following unmodified registry dependencies. Their
+The Linux daemon links these routing dependencies. The original netlink-proto
+0.13.0 attribution is retained alongside its published 0.13.1 fork. Their
 exact upstream LICENSE-MIT texts are reproduced below. This file is distributed
 under package.json's assets/**/* inclusion.
 
@@ -92,7 +93,40 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## netlink-proto 0.13.0
+## netlink-proto 0.13.1 (published fork)
+
+Source: https://code.foss.global/push.rocks/netlink-proto/src/commit/bcbbfbba7485857c3b1f9fd5f6d99d597a334ab0
+
+```text
+Copyright (c) The netlink-proto Contributors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+```
+
+## netlink-proto 0.13.0 (upstream attribution retained)
 
 Source: https://crates.io/crates/netlink-proto/0.13.0
 

package/dist_rust/smartvpn_daemon_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "8fed8d22e6597530ad96882e4593b8022d3b903aef769814ff17c212cfd7c21a",
+  "binarySha256": "bb4eeb71f5b13b197999ea809e05876625df2c93b7600fdfbe56db10970e6589",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.1.0",
-    "gitCommit": "5debd57a3aea77860e63e478a4eb3e0dcc5256d8",
+    "projectVersion": "2.3.0",
+    "gitCommit": "4fd05874f4792ba89c6b0fa6cb168434e5c9ee25",
     "gitDirty": false,
-    "builtAt": "2026-09-13T12:10:30.143Z",
+    "builtAt": "2026-09-15T09:32:44.556Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_amd64_musl"

package/dist_rust/smartvpn_daemon_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "df65b1e62dfabe53dff69d62b6d9e9ad1ef6e5990d2a4032993244d6f9d779bb",
+  "binarySha256": "37bc9e0af746d3f799753b605fd6b025cfc3f83b3f225e6bece5ab8ec167f98d",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.1.0",
-    "gitCommit": "5debd57a3aea77860e63e478a4eb3e0dcc5256d8",
+    "projectVersion": "2.3.0",
+    "gitCommit": "4fd05874f4792ba89c6b0fa6cb168434e5c9ee25",
     "gitDirty": false,
-    "builtAt": "2026-09-13T12:10:37.839Z",
+    "builtAt": "2026-09-15T09:32:44.845Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartvpn',
-    version: '2.1.0',
+    version: '2.3.0',
     description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/smartvpn.classes.vpnbridge.js

@@ -17,13 +17,17 @@ export class VpnBridge extends plugins.events.EventEmitter {
             }
         }
         const binaryName = options.binaryName || 'smartvpn_daemon';
+        if (options.transport.transport === 'stdio' && options.transport.binaryPath !== undefined
+            && (typeof options.transport.binaryPath !== 'string' || !plugins.path.isAbsolute(options.transport.binaryPath))) {
+            throw new Error('VpnBridge binaryPath must be an absolute executable path');
+        }
         // Keep the validated process transport stable even if the caller edits its options.
         this.transportOptions = { ...options.transport };
         this.mode = options.mode;
         this.bridge = new plugins.smartrust.RustBridge({
             binaryName,
             binaryPath: options.transport.transport === 'stdio'
-                ? paths.getBinaryPath(binaryName)
+                ? options.transport.binaryPath ?? paths.getBinaryPath(binaryName)
                 : undefined,
             localPaths: [],
             searchSystemPath: false,
@@ -33,6 +37,9 @@ export class VpnBridge extends plugins.events.EventEmitter {
             maxPayloadSize: 10 * 1024 * 1024, // 10 MB
         });
         // Forward events from inner bridge
+        this.bridge.on('disconnected', (event) => {
+            this.emit('disconnected', event);
+        });
         this.bridge.on('exit', (code, signal) => {
             this.emit('exit', code, signal);
         });
@@ -44,6 +51,12 @@ export class VpnBridge extends plugins.events.EventEmitter {
         });
         // Forward management events from the daemon
         // smartrust emits 'management:<eventName>' for unsolicited events
+        this.bridge.on('management:managed-runtime-invalidated', (data) => {
+            this.emit('managed-runtime-invalidated', data);
+        });
+        this.bridge.on('management:managed-session-state', (data) => {
+            this.emit('managed-session-state', data);
+        });
         this.bridge.on('management:status', (data) => {
             this.emit('status', data);
         });
@@ -100,4 +113,4 @@ export class VpnBridge extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5icmlkZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sS0FBSyxLQUFLLE1BQU0scUJBQXFCLENBQUM7QUFPN0M7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQXlDLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBS3ZGLFlBQVksT0FLWDtRQUNDLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQy9DLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQzlHLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztZQUNoRixDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxHQUFHLENBQUMsSUFBSSxXQUFXLEdBQUcsV0FBVyxFQUFFLENBQUM7Z0JBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztZQUMzRixDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUksaUJBQWlCLENBQUM7UUFDM0Qsb0ZBQW9GO1FBQ3BGLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxFQUFFLEdBQUcsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2pELElBQUksQ0FBQyxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQztRQUV6QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQVk7WUFDeEQsVUFBVTtZQUNWLFVBQVUsRUFBRSxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxPQUFPO2dCQUNqRCxDQUFDLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUM7Z0JBQ2pDLENBQUMsQ0FBQyxTQUFTO1lBQ2IsVUFBVSxFQUFFLEVBQUU7WUFDZCxnQkFBZ0IsRUFBRSxLQUFLO1lBQ3ZCLE9BQU8sRUFBRSxDQUFDLGNBQWMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQzNDLEdBQUcsQ0FBQyxXQUFXLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsd0JBQXdCLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztZQUN4RSx3QkFBd0IsRUFBRSxXQUFXLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDO1lBQy9FLGNBQWMsRUFBRSxFQUFFLEdBQUcsSUFBSSxHQUFHLElBQUksRUFBRSxRQUFRO1NBQzNDLENBQUMsQ0FBQztRQUVILG1DQUFtQztRQUNuQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFtQixFQUFFLE1BQXFCLEVBQUUsRUFBRTtZQUNwRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDbEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxhQUFhLEVBQUUsR0FBRyxFQUFFO1lBQ2pDLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFZLEVBQUUsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUVILDRDQUE0QztRQUM1QyxrRUFBa0U7UUFDbEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsbUJBQW1CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNoRCxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGtCQUFrQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDL0MsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyw2QkFBNkIsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzFELElBQUksQ0FBQyxJQUFJLENBQUMsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxnQ0FBZ0MsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzdELElBQUksQ0FBQyxJQUFJLENBQUMscUJBQXFCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDekMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzdCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNqRCxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM3QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxLQUFLO1FBQ2hCLElBQUksSUFBSSxDQUFDLGdCQUFnQixDQUFDLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNqRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsZ0JBQXVDLENBQUM7WUFDaEUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFO2dCQUNoRCxhQUFhLEVBQUUsVUFBVSxDQUFDLGFBQWE7Z0JBQ3ZDLG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7Z0JBQ3JELG1CQUFtQixFQUFFLFVBQVUsQ0FBQyxtQkFBbUI7Z0JBQ25ELG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7YUFDdEQsQ0FBQyxDQUFDO1FBQ0wsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDN0IsQ0FBQztJQUNILENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUNoQyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVyxDQUN0QixNQUFTLEVBQ1QsTUFBOEI7UUFFOUIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5icmlkZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sS0FBSyxLQUFLLE1BQU0scUJBQXFCLENBQUM7QUFTN0M7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQXlDLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBS3ZGLFlBQVksT0FLWDtRQUNDLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQy9DLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQzlHLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztZQUNoRixDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxHQUFHLENBQUMsSUFBSSxXQUFXLEdBQUcsV0FBVyxFQUFFLENBQUM7Z0JBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztZQUMzRixDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUksaUJBQWlCLENBQUM7UUFDM0QsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssU0FBUztlQUNwRixDQUFDLE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEgsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxvRkFBb0Y7UUFDcEYsSUFBSSxDQUFDLGdCQUFnQixHQUFHLEVBQUUsR0FBRyxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDakQsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO1FBRXpCLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBWTtZQUN4RCxVQUFVO1lBQ1YsVUFBVSxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLE9BQU87Z0JBQ2pELENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsSUFBSSxLQUFLLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQztnQkFDakUsQ0FBQyxDQUFDLFNBQVM7WUFDYixVQUFVLEVBQUUsRUFBRTtZQUNkLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsT0FBTyxFQUFFLENBQUMsY0FBYyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSTtnQkFDM0MsR0FBRyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyx3QkFBd0IsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3hFLHdCQUF3QixFQUFFLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUM7WUFDL0UsY0FBYyxFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxFQUFFLFFBQVE7U0FDM0MsQ0FBQyxDQUFDO1FBRUgsbUNBQW1DO1FBQ25DLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGNBQWMsRUFBRSxDQUFDLEtBQW1DLEVBQUUsRUFBRTtZQUNyRSxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNuQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQW1CLEVBQUUsTUFBcUIsRUFBRSxFQUFFO1lBQ3BFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNsQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBRUgsNENBQTRDO1FBQzVDLGtFQUFrRTtRQUNsRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyx3Q0FBd0MsRUFBRSxDQUFDLElBQW9DLEVBQUUsRUFBRTtZQUNoRyxJQUFJLENBQUMsSUFBSSxDQUFDLDZCQUE2QixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2pELENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsa0NBQWtDLEVBQUUsQ0FBQyxJQUE2QixFQUFFLEVBQUU7WUFDbkYsSUFBSSxDQUFDLElBQUksQ0FBQyx1QkFBdUIsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUMzQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG1CQUFtQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDaEQsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQy9DLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzNCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsNkJBQTZCLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUMxRCxJQUFJLENBQUMsSUFBSSxDQUFDLGtCQUFrQixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ3RDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsZ0NBQWdDLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUM3RCxJQUFJLENBQUMsSUFBSSxDQUFDLHFCQUFxQixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ3pDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNqRCxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM3QixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG9CQUFvQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDakQsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDN0IsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixJQUFJLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDakQsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLGdCQUF1QyxDQUFDO1lBQ2hFLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFVBQVUsRUFBRTtnQkFDaEQsYUFBYSxFQUFFLFVBQVUsQ0FBQyxhQUFhO2dCQUN2QyxvQkFBb0IsRUFBRSxVQUFVLENBQUMsb0JBQW9CO2dCQUNyRCxtQkFBbUIsRUFBRSxVQUFVLENBQUMsbUJBQW1CO2dCQUNuRCxvQkFBb0IsRUFBRSxVQUFVLENBQUMsb0JBQW9CO2FBQ3RELENBQUMsQ0FBQztRQUNMLENBQUM7YUFBTSxDQUFDO1lBQ04sT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQzdCLENBQUM7SUFDSCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLElBQUk7UUFDZixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDaEMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FDdEIsTUFBUyxFQUNULE1BQThCO1FBRTlCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRiJ9

package/dist_ts/smartvpn.classes.vpnclient.d.ts

@@ -1,12 +1,37 @@
 import * as plugins from './smartvpn.plugins.js';
-import type { IVpnClientOptions, IVpnClientConfig, IVpnStatus, IVpnStatistics, IVpnConnectionQuality, IVpnMtuInfo } from './smartvpn.interfaces.js';
+import type { IVpnClientOptions, IVpnClientConfig, IVpnStatus, IVpnStatistics, IVpnConnectionQuality, IVpnMtuInfo, IVpnConnectionResult, IVpnManagedRuntime, IVpnManagedSessionConfig, IVpnManagedSession } from './smartvpn.interfaces.js';
 /**
  * VPN Client — manages a smartvpn daemon in client mode.
  */
 export declare class VpnClient extends plugins.events.EventEmitter {
     private bridge;
     private options;
+    private bridgeEpoch;
+    private managedGeneration?;
+    private lastInvalidatedGeneration?;
+    private sessionGeneration?;
+    private stoppedSessionGeneration?;
+    private retiredSessionGeneration?;
+    private invalidatedSessionGeneration?;
     constructor(options: IVpnClientOptions);
+    private observeSessionEvent;
+    private invalidateGeneration;
+    private invalidateBridge;
+    private checkSession;
+    /** Authenticate and retain transport/keepalive without any TUN or route effect. */
+    authenticateManaged(config: IVpnManagedSessionConfig): Promise<IVpnManagedSession>;
+    /** Create the planned exclusive /32 TUN and split routes with forwarding disabled.
+     * Caller must authorize these exact native transitions before calling. */
+    prepareManagedTunnel(generation: string): Promise<IVpnManagedSession>;
+    /** Reinspect, discard ready pre-enable inputs, then start forwarding. Call only
+     * after caller-owned policy is installed and verified against the prepared TUN. */
+    enableManagedForwarding(generation: string): Promise<IVpnManagedSession>;
+    /** Terminally stop packet I/O and retain the TUN for caller-authorized teardown.
+     * This generation cannot forward again. Disconnect then closes its kernel owner. */
+    stopManagedForwarding(generation: string): Promise<IVpnManagedSession>;
+    inspectManagedSession(generation: string): Promise<IVpnManagedSession>;
+    private sessionCommand;
+    private checkObservation;
     /**
      * Start the daemon bridge (spawn or connect).
      */
@@ -14,9 +39,10 @@ export declare class VpnClient extends plugins.events.EventEmitter {
     /**
      * Connect to the VPN server using the provided config.
      */
-    connect(config?: IVpnClientConfig): Promise<{
-        assignedIp: string;
-    }>;
+    connect(config?: IVpnClientConfig): Promise<IVpnConnectionResult>;
+    /** Inspect the retained native TUN, its exact IPv4 /32 and split routes.
+     * Requires the connection's generation and fails after retirement/reconnect. */
+    inspectManagedRuntime(generation: string): Promise<IVpnManagedRuntime>;
     /**
      * Disconnect from the VPN server.
      */
@@ -39,7 +65,8 @@ export declare class VpnClient extends plugins.events.EventEmitter {
      */
     getMtuInfo(): Promise<IVpnMtuInfo | null>;
     /**
-     * Stop the daemon bridge and wait for confirmed ownership release.
+     * Stop and join an owned stdio daemon. Socket mode only closes the bridge;
+     * disconnect() must first join the independently owned native session.
      */
     stop(): Promise<void>;
     /**

package/dist_ts/smartvpn.classes.vpnclient.js

@@ -6,6 +6,7 @@ import { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export class VpnClient extends plugins.events.EventEmitter {
     constructor(options) {
         super();
+        this.bridgeEpoch = 0;
         this.options = options;
         this.bridge = new VpnBridge({
             transport: options.transport,
@@ -13,15 +14,113 @@ export class VpnClient extends plugins.events.EventEmitter {
             networkNamespaceFd: options.networkNamespaceFd,
         });
         // Forward bridge events
+        this.bridge.on('disconnected', () => {
+            this.invalidateBridge('Client transport disconnected');
+        });
         this.bridge.on('exit', (code, signal) => {
+            this.invalidateBridge('Client bridge exited');
             this.emit('exit', { code, signal });
         });
         this.bridge.on('reconnected', () => {
+            this.invalidateBridge('Client bridge reconnected');
             this.emit('reconnected');
         });
         this.bridge.on('stderr', (line) => {
             this.emit('stderr', line);
         });
+        this.bridge.on('managed-runtime-invalidated', (event) => {
+            this.invalidateGeneration(event);
+        });
+        this.bridge.on('managed-session-state', (event) => {
+            this.observeSessionEvent(event);
+        });
+    }
+    observeSessionEvent(event) {
+        if (event.phase === 'retired') {
+            this.retiredSessionGeneration = event.generation;
+            if (this.sessionGeneration === event.generation)
+                this.sessionGeneration = undefined;
+        }
+        else {
+            this.stoppedSessionGeneration = event.generation;
+        }
+        this.emit('managed-session-state', event);
+    }
+    invalidateGeneration(event) {
+        if (this.lastInvalidatedGeneration === event.generation)
+            return;
+        this.lastInvalidatedGeneration = event.generation;
+        if (this.managedGeneration === event.generation)
+            this.managedGeneration = undefined;
+        this.emit('managed-runtime-invalidated', event);
+    }
+    invalidateBridge(reason) {
+        this.bridgeEpoch++;
+        if (this.managedGeneration)
+            this.invalidateGeneration({ generation: this.managedGeneration, reason });
+        if (this.sessionGeneration) {
+            const generation = this.sessionGeneration;
+            this.invalidatedSessionGeneration = generation;
+            this.sessionGeneration = undefined;
+            this.emit('managed-session-invalidated', { generation, reason });
+        }
+    }
+    checkSession(result, epoch, generation) {
+        const observed = result.plan.generation;
+        if (epoch !== this.bridgeEpoch || observed === this.retiredSessionGeneration
+            || observed === this.invalidatedSessionGeneration
+            || (generation !== undefined && observed !== generation)
+            || (observed === this.stoppedSessionGeneration && result.phase !== 'stopped')) {
+            throw new Error('Managed session stopped, retired, or lost observation during the operation');
+        }
+        if (result.runtime) {
+            this.checkObservation(result.runtime, epoch, observed);
+            this.managedGeneration = observed;
+        }
+    }
+    /** Authenticate and retain transport/keepalive without any TUN or route effect. */
+    async authenticateManaged(config) {
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand('authenticateManaged', { config });
+        this.checkSession(result, epoch);
+        this.sessionGeneration = result.plan.generation;
+        return result;
+    }
+    /** Create the planned exclusive /32 TUN and split routes with forwarding disabled.
+     * Caller must authorize these exact native transitions before calling. */
+    prepareManagedTunnel(generation) {
+        return this.sessionCommand('prepareManagedTunnel', generation);
+    }
+    /** Reinspect, discard ready pre-enable inputs, then start forwarding. Call only
+     * after caller-owned policy is installed and verified against the prepared TUN. */
+    enableManagedForwarding(generation) {
+        return this.sessionCommand('enableManagedForwarding', generation);
+    }
+    /** Terminally stop packet I/O and retain the TUN for caller-authorized teardown.
+     * This generation cannot forward again. Disconnect then closes its kernel owner. */
+    stopManagedForwarding(generation) {
+        return this.sessionCommand('stopManagedForwarding', generation);
+    }
+    inspectManagedSession(generation) {
+        return this.sessionCommand('inspectManagedSession', generation);
+    }
+    async sessionCommand(method, generation) {
+        if (typeof generation !== 'string' || !/^[a-f0-9]{32}$/.test(generation)) {
+            throw new Error('Managed session generation must be a native 128-bit identifier');
+        }
+        if (generation === this.invalidatedSessionGeneration || generation === this.retiredSessionGeneration) {
+            throw new Error('Managed session observation is unavailable');
+        }
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand(method, { generation });
+        this.checkSession(result, epoch, generation);
+        return result;
+    }
+    checkObservation(runtime, epoch, generation) {
+        if (epoch !== this.bridgeEpoch || runtime.generation === this.lastInvalidatedGeneration
+            || (generation !== undefined && runtime.generation !== generation)) {
+            throw new Error('Managed runtime retired during the operation');
+        }
     }
     /**
      * Start the daemon bridge (spawn or connect).
@@ -37,7 +136,24 @@ export class VpnClient extends plugins.events.EventEmitter {
         if (!cfg) {
             throw new Error('VpnClient.connect: no config provided');
         }
-        return this.bridge.sendCommand('connect', { config: cfg });
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand('connect', { config: cfg });
+        if (result.managedRuntime) {
+            this.checkObservation(result.managedRuntime, epoch);
+            this.managedGeneration = result.managedRuntime.generation;
+        }
+        return result;
+    }
+    /** Inspect the retained native TUN, its exact IPv4 /32 and split routes.
+     * Requires the connection's generation and fails after retirement/reconnect. */
+    async inspectManagedRuntime(generation) {
+        if (typeof generation !== 'string' || !/^[a-f0-9]{32}$/.test(generation)) {
+            throw new Error('Managed runtime generation must be a native 128-bit identifier');
+        }
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand('inspectManagedRuntime', { generation });
+        this.checkObservation(result, epoch, generation);
+        return result;
     }
     /**
      * Disconnect from the VPN server.
@@ -71,9 +187,11 @@ export class VpnClient extends plugins.events.EventEmitter {
         return this.bridge.sendCommand('getMtuInfo', {});
     }
     /**
-     * Stop the daemon bridge and wait for confirmed ownership release.
+     * Stop and join an owned stdio daemon. Socket mode only closes the bridge;
+     * disconnect() must first join the independently owned native session.
      */
     async stop() {
+        this.invalidateBridge('Client stop requested');
         await this.bridge.stop();
     }
     /**
@@ -83,4 +201,4 @@ export class VpnClient extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQVc1RDs7R0FFRztBQUNILE1BQU0sT0FBTyxTQUFVLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBSXhELFlBQVksT0FBMEI7UUFDcEMsS0FBSyxFQUFFLENBQUM7UUFDUixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksU0FBUyxDQUFxQjtZQUM5QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsSUFBSSxFQUFFLFFBQVE7WUFDZCxrQkFBa0IsRUFBRSxPQUFPLENBQUMsa0JBQWtCO1NBQy9DLENBQUMsQ0FBQztRQUVILHdCQUF3QjtRQUN4QixJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFtQixFQUFFLE1BQXFCLEVBQUUsRUFBRTtZQUNwRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ3RDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsYUFBYSxFQUFFLEdBQUcsRUFBRTtZQUNqQyxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzNCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBWSxFQUFFLEVBQUU7WUFDeEMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUF5QjtRQUM1QyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7UUFDMUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ1QsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxVQUFVO1FBQ3JCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsWUFBWSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsU0FBUztRQUNwQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFdBQVcsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGFBQWE7UUFDeEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxvQkFBb0I7UUFDL0IsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxzQkFBc0IsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxVQUFVO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsWUFBWSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUMzQixDQUFDO0lBRUQ7O09BRUc7SUFDSCxJQUFXLE9BQU87UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUM3QixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQWlCNUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sU0FBVSxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQVd4RCxZQUFZLE9BQTBCO1FBQ3BDLEtBQUssRUFBRSxDQUFDO1FBVEYsZ0JBQVcsR0FBRyxDQUFDLENBQUM7UUFVdEIsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDdkIsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLFNBQVMsQ0FBcUI7WUFDOUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1lBQzVCLElBQUksRUFBRSxRQUFRO1lBQ2Qsa0JBQWtCLEVBQUUsT0FBTyxDQUFDLGtCQUFrQjtTQUMvQyxDQUFDLENBQUM7UUFFSCx3QkFBd0I7UUFDeEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsY0FBYyxFQUFFLEdBQUcsRUFBRTtZQUNsQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUN6RCxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQW1CLEVBQUUsTUFBcUIsRUFBRSxFQUFFO1lBQ3BFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1lBQzlDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxhQUFhLEVBQUUsR0FBRyxFQUFFO1lBQ2pDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1lBQ25ELElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFZLEVBQUUsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLDZCQUE2QixFQUFFLENBQUMsS0FBcUMsRUFBRSxFQUFFO1lBQ3RGLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLHVCQUF1QixFQUFFLENBQUMsS0FBOEIsRUFBRSxFQUFFO1lBQ3pFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNsQyxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxtQkFBbUIsQ0FBQyxLQUE4QjtRQUN4RCxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLHdCQUF3QixHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUM7WUFDakQsSUFBSSxJQUFJLENBQUMsaUJBQWlCLEtBQUssS0FBSyxDQUFDLFVBQVU7Z0JBQUUsSUFBSSxDQUFDLGlCQUFpQixHQUFHLFNBQVMsQ0FBQztRQUN0RixDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksQ0FBQyx3QkFBd0IsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLHVCQUF1QixFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFTyxvQkFBb0IsQ0FBQyxLQUFxQztRQUNoRSxJQUFJLElBQUksQ0FBQyx5QkFBeUIsS0FBSyxLQUFLLENBQUMsVUFBVTtZQUFFLE9BQU87UUFDaEUsSUFBSSxDQUFDLHlCQUF5QixHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDbEQsSUFBSSxJQUFJLENBQUMsaUJBQWlCLEtBQUssS0FBSyxDQUFDLFVBQVU7WUFBRSxJQUFJLENBQUMsaUJBQWlCLEdBQUcsU0FBUyxDQUFDO1FBQ3BGLElBQUksQ0FBQyxJQUFJLENBQUMsNkJBQTZCLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVPLGdCQUFnQixDQUFDLE1BQWM7UUFDckMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ25CLElBQUksSUFBSSxDQUFDLGlCQUFpQjtZQUFFLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUN0RyxJQUFJLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQzNCLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztZQUMxQyxJQUFJLENBQUMsNEJBQTRCLEdBQUcsVUFBVSxDQUFDO1lBQy9DLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxTQUFTLENBQUM7WUFDbkMsSUFBSSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsRUFBRSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ25FLENBQUM7SUFDSCxDQUFDO0lBRU8sWUFBWSxDQUFDLE1BQTBCLEVBQUUsS0FBYSxFQUFFLFVBQW1CO1FBQ2pGLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDO1FBQ3hDLElBQUksS0FBSyxLQUFLLElBQUksQ0FBQyxXQUFXLElBQUksUUFBUSxLQUFLLElBQUksQ0FBQyx3QkFBd0I7ZUFDdkUsUUFBUSxLQUFLLElBQUksQ0FBQyw0QkFBNEI7ZUFDOUMsQ0FBQyxVQUFVLEtBQUssU0FBUyxJQUFJLFFBQVEsS0FBSyxVQUFVLENBQUM7ZUFDckQsQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLHdCQUF3QixJQUFJLE1BQU0sQ0FBQyxLQUFLLEtBQUssU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUNoRixNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7UUFDaEcsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ25CLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztZQUN2RCxJQUFJLENBQUMsaUJBQWlCLEdBQUcsUUFBUSxDQUFDO1FBQ3BDLENBQUM7SUFDSCxDQUFDO0lBRUQsbUZBQW1GO0lBQzVFLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxNQUFnQztRQUMvRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQy9CLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMscUJBQXFCLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2pDLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQztRQUNoRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQ7OEVBQzBFO0lBQ25FLG9CQUFvQixDQUFDLFVBQWtCO1FBQzVDLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQyxzQkFBc0IsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBRUQ7dUZBQ21GO0lBQzVFLHVCQUF1QixDQUFDLFVBQWtCO1FBQy9DLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQyx5QkFBeUIsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBRUQ7d0ZBQ29GO0lBQzdFLHFCQUFxQixDQUFDLFVBQWtCO1FBQzdDLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQyx1QkFBdUIsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRU0scUJBQXFCLENBQUMsVUFBa0I7UUFDN0MsT0FBTyxJQUFJLENBQUMsY0FBYyxDQUFDLHVCQUF1QixFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFFTyxLQUFLLENBQUMsY0FBYyxDQUFDLE1BQ3dCLEVBQUUsVUFBa0I7UUFDdkUsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN6RSxNQUFNLElBQUksS0FBSyxDQUFDLGdFQUFnRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELElBQUksVUFBVSxLQUFLLElBQUksQ0FBQyw0QkFBNEIsSUFBSSxVQUFVLEtBQUssSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7WUFDckcsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQy9CLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUNyRSxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDN0MsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVPLGdCQUFnQixDQUFDLE9BQTJCLEVBQUUsS0FBYSxFQUFFLFVBQW1CO1FBQ3RGLElBQUksS0FBSyxLQUFLLElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxDQUFDLFVBQVUsS0FBSyxJQUFJLENBQUMseUJBQXlCO2VBQ2xGLENBQUMsVUFBVSxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDckUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUF5QjtRQUM1QyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7UUFDMUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ1QsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQy9CLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsU0FBUyxFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDekUsSUFBSSxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDMUIsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFDcEQsSUFBSSxDQUFDLGlCQUFpQixHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDO1FBQzVELENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQ7b0ZBQ2dGO0lBQ3pFLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxVQUFrQjtRQUNuRCxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3pFLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztRQUNwRixDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQztRQUMvQixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLHVCQUF1QixFQUFFLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUN0RixJQUFJLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxVQUFVLENBQUMsQ0FBQztRQUNqRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVM7UUFDcEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxhQUFhO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsZUFBZSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsb0JBQW9CO1FBQy9CLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsc0JBQXNCLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxDQUFDLGdCQUFnQixDQUFDLHVCQUF1QixDQUFDLENBQUM7UUFDL0MsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzNCLENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRiJ9

package/dist_ts/smartvpn.interfaces.d.ts

@@ -1,5 +1,8 @@
 export interface IVpnTransportStdio {
     transport: 'stdio';
+    /** Exact caller-verified executable. Overrides environment/package lookup;
+     * invalid paths fail without falling through to another executable. */
+    binaryPath?: string;
 }
 export interface IVpnTransportSocket {
     transport: 'socket';
@@ -404,13 +407,47 @@ export interface IWgPeerInfo {
     lastHandshakeTime?: string;
 }
 export type TVpnClientCommands = {
+    authenticateManaged: {
+        params: {
+            config: IVpnManagedSessionConfig;
+        };
+        result: IVpnManagedSession;
+    };
+    prepareManagedTunnel: {
+        params: {
+            generation: string;
+        };
+        result: IVpnManagedSession;
+    };
+    enableManagedForwarding: {
+        params: {
+            generation: string;
+        };
+        result: IVpnManagedSession;
+    };
+    stopManagedForwarding: {
+        params: {
+            generation: string;
+        };
+        result: IVpnManagedSession;
+    };
+    inspectManagedSession: {
+        params: {
+            generation: string;
+        };
+        result: IVpnManagedSession;
+    };
     connect: {
         params: {
             config: IVpnClientConfig;
         };
-        result: {
-            assignedIp: string;
+        result: IVpnConnectionResult;
+    };
+    inspectManagedRuntime: {
+        params: {
+            generation: string;
         };
+        result: IVpnManagedRuntime;
     };
     disconnect: {
         params: Record<string, never>;
@@ -649,6 +686,102 @@ export interface IManagedNetworkBinding {
     authorityId: string;
     nodeId: string;
 }
+export interface IVpnConnectionResult {
+    assignedIp: string;
+    /** Present only for an authenticated native managed connection with a real TUN. */
+    managedRuntime?: IVpnManagedRuntime;
+}
+/** Linux native client with explicit kernel-effect stages. The caller supplies
+ * a conservative deadline from its independently qualified clock authority. */
+export interface IVpnManagedSessionConfig {
+    serverUrl: string;
+    serverPublicKey: string;
+    clientPrivateKey: string;
+    clientPublicKey: string;
+    transport: 'quic' | 'websocket';
+    serverCertHash?: string;
+    mtu?: number;
+    managedNetwork: IManagedNetworkBinding;
+    /** Same native boot; deadline must be future and at most fifteen minutes away.
+     * Expiry stops packet I/O even across suspend. It does not delete a held TUN. */
+    lease: {
+        bootId: string;
+        deadlineBoottimeMs: number;
+    };
+}
+/** Authentication returns the full validated assignment and planned exclusive
+ * TUN name before creating a device or route. Kernel policy remains caller-owned. */
+export interface IVpnManagedSessionPlan {
+    schemaVersion: 1;
+    generation: string;
+    namespace: {
+        device: string;
+        inode: string;
+    };
+    interfaceName: string;
+    assignment: {
+        assignedIp: string;
+        gateway: string;
+        subnet: string;
+        mtu: number;
+        effectiveMtu: number;
+        managed: IManagedNetworkAssignment;
+    };
+    mtu: number;
+    remoteIp: string;
+    lease: IVpnManagedSessionConfig['lease'];
+}
+export interface IVpnManagedSession {
+    plan: IVpnManagedSessionPlan;
+    phase: 'authenticated' | 'prepared' | 'forwarding' | 'stopped';
+    /** Fresh native inspection when present. Prepared TUN is UP with forwarding
+     * disabled. A stopped TUN stays owned until disconnect() joins deletion, or an
+     * owned stdio process is joined by stop(). Socket stop() does not delete it. */
+    runtime: IVpnManagedRuntime | null;
+}
+/** Stopped means the complete packet I/O future ended; retired means the native
+ * session owner ended. Neither proves namespace-wide cleanup, conntrack drain,
+ * packets already queued on the network, or safe allocation reuse. */
+export interface IVpnManagedSessionEvent {
+    generation: string;
+    phase: 'stopped' | 'retired';
+    reason: string;
+}
+/** The facade lost observation of this generation. Native packet I/O and TUN
+ * ownership may remain alive, especially with an independent socket daemon.
+ * This is neither a stopped nor a retired native lifecycle acknowledgement. */
+export interface IVpnManagedSessionInvalidation {
+    generation: string;
+    reason: string;
+}
+/** A fresh observation of a retained native lifetime, never a transferable or
+ * restorable capability. The caller retains VpnClient and listens for invalidation.
+ * IPv6, namespace-wide policy/rules, underlay and firewall remain caller-owned. */
+export interface IVpnManagedRuntime {
+    schemaVersion: 1;
+    generation: string;
+    namespace: {
+        device: string;
+        inode: string;
+    };
+    link: {
+        interfaceIndex: number;
+        interfaceName: string;
+        interfaceKind: 'tun';
+        linkIndex: number;
+        mtu: number;
+        address: string;
+        prefixLength: 32;
+    };
+    remoteIp: string;
+    assignment: IManagedNetworkAssignment;
+}
+/** Stop using this generation immediately. This event is not a joined cleanup,
+ * conntrack drain, or allocation-reuse acknowledgement. */
+export interface IVpnManagedRuntimeInvalidation {
+    generation: string;
+    reason: string;
+}
 export interface IManagedNodeConfig {
     /** Caller-owned control address with /32; local workload prefixes are not hub routes. */
     address: string;
@@ -674,6 +807,9 @@ export interface IVpnServiceUnit {
     installPath: string;
 }
 export interface IVpnEventMap {
+    'managed-session-state': IVpnManagedSessionEvent;
+    'managed-session-invalidated': IVpnManagedSessionInvalidation;
+    'managed-runtime-invalidated': IVpnManagedRuntimeInvalidation;
     'status': IVpnStatus;
     'error': {
         message: string;

package/notices/cargo-dependencies.html

@@ -3004,6 +3004,38 @@ The above copyright notice and this permission notice
 shall be included in all copies or substantial portions
 of the Software.
 
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+</pre>
+</section>
+<section>
+  <h2>MIT License (MIT)</h2>
+  <ul>
+    <li>netlink-proto 0.13.1</li>
+  </ul>
+  <pre>Copyright (c) The netlink-proto Contributors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the &quot;Software&quot;), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
 THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF
 ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
 TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
@@ -3610,7 +3642,6 @@ DEALINGS IN THE SOFTWARE.
   <h2>MIT License (MIT)</h2>
   <ul>
     <li>netlink-packet-core 0.9.0</li>
-    <li>netlink-proto 0.13.0</li>
     <li>netlink-sys 0.9.0</li>
     <li>rtnetlink 0.23.0</li>
   </ul>

package/notices/inventory.json

@@ -3,9 +3,9 @@
   "rustVersion": "1.95.0",
   "cargoAboutVersion": "0.9.1",
   "files": {
-    "assets/third-party-licenses.md": "da4de43c4e7a7e530af740c58c45ea620f9da2bf1639251d1740344102317aed",
+    "assets/third-party-licenses.md": "6be2373e39312d90eb3571bef614c89df565f98c917795d7aea3497f52ef19f1",
     "notices/aho-corasick-license.txt": "0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f",
-    "notices/cargo-dependencies.html": "01f390d02b89be9fde6154ee05f3cb275e7baaf4ba15a29a3b4a385e4574a3ad",
+    "notices/cargo-dependencies.html": "bd8e78c6f49c0ee60ccf6e1449c9b52276940055b08aaf32c5ede1ec3b307b4c",
     "notices/compiler-builtins-license.txt": "ab6eec6caf0fa5775e411c7a8bc6a45c4ef2956b0980b157ab74fc5cd62a928b",
     "notices/defmt-license.txt": "0d17b75c1867fd568bcbb735f329d0d4253846c4b756a65e4d440c1e4bd59187",
     "notices/llvm-libunwind-license.txt": "b5efebcaca80879234098e52d1725e6d9eb8fb96a19fce625d39184b705f7b6d",
@@ -16,11 +16,11 @@
     "notices/valuable-license.txt": "ed60d479b8fd1f64e9cbc3de449a16a53ac1b3d1b6aeb9bf9d190a8e93061b44",
     "rust-toolchain.toml": "19da9ff32e229a69ff5dde28ac23233256ff25e413a8c579155cf641f4f0634f",
     "rust/.cargo/config.toml": "eb6896791bd573f2cb099aa41c7d3668c6d368166945abd3553c8d8029ba8b7b",
-    "rust/Cargo.lock": "fa059d9023e2b9b8f3c3e343f57fc273de00da825130d3cfce07ceb03cbe2032",
-    "rust/Cargo.toml": "77b42a0647d03870745119fdfbcf288399c72d8d399fea3b6168db9cb3cd07ca",
+    "rust/Cargo.lock": "93980ffcc3d2eca0083f524999b15f1674698d2aceff5922ed0aa5a09138d260",
+    "rust/Cargo.toml": "308d11b4bb6b8f290ca2d83f2c817e10798bad54510dd3a6fdb72c32d095ae3b",
     "rust/about.hbs": "a7c35d089563a08520a6e5f351aadae659e1f7bf24cabedbca3de8a89e966f86",
-    "rust/about.toml": "9eb1fb41fc435a370d0c2ce1a77e5f0897b785a023ab87fd6721979ded479e66",
-    "third-party-notices.md": "e935f4b27acaa567180b4b55ab472412b3c0ab7d528351b41863a1785074cd4b"
+    "rust/about.toml": "a457e0cc7532020c0f87532919a754997213ccbec6211c9501b8c198d404ed72",
+    "third-party-notices.md": "9b3adc6a4968ba5ef1eb666188ddb147933e2d90bafca040a59789b2f4b9389b"
   },
   "supplementalCargoNotices": {
     "aho-corasick@1.1.4": "notices/aho-corasick-license.txt",
@@ -605,7 +605,7 @@
     },
     {
       "name": "netlink-proto",
-      "version": "0.13.0",
+      "version": "0.13.1",
       "license": "MIT"
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",
@@ -25,14 +25,14 @@
   "dependencies": {
     "@push.rocks/smartnftables": "1.2.0",
     "@push.rocks/smartpath": "^6.0.0",
-    "@push.rocks/smartrust": "^2.0.0"
+    "@push.rocks/smartrust": "^2.1.0"
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tsrust": "^1.13.0",
     "@git.zone/tstest": "^6.0.0",
-    "@types/node": "^26.4.1"
+    "@types/node": "^26.5.0"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -155,6 +155,109 @@ managed TUN creation, allow/deny, reconnect, revocation, route-conflict rollback
 and child-termination cleanup. Privileged ARM64 and Pallet integration remain
 separate qualification requirements.
 
+### Staged managed client activation
+
+`authenticateManaged(config)` is a Linux native client API for a caller that must
+install packet policy before forwarding. Its closed configuration accepts an
+explicit `quic` or `websocket` transport, a matching Noise keypair, server public
+key, `managedNetwork` binding, optional MTU/certificate pin and a native lease.
+Testing mode, automatic transport fallback and extra configuration fields reject.
+
+The lease is `{ bootId, deadlineBoottimeMs }`: the actual Linux boot ID and an
+absolute `CLOCK_BOOTTIME` deadline, future and no more than fifteen minutes away.
+The caller derives this conservative deadline from its independently qualified
+authority; SmartVPN does not turn wall-clock credentials into trusted time.
+Native expiry interrupts the whole packet I/O future, including blocked writes,
+and remains effective across suspend. Leases cannot be extended in place.
+
+Register `managed-session-state`, `managed-session-invalidated` and
+`managed-runtime-invalidated` listeners before
+starting. Keep the live client owner and use the returned generation for each step:
+
+1. `authenticateManaged(config)` authenticates Noise and validates the full server
+   assignment. It retains transport and keepalive without creating a TUN or route.
+   The returned `plan` includes the actual namespace, remote endpoint, authenticated
+   assignment, effective MTU and an exclusive planned TUN name.
+2. Authorize the planned native changes in the caller's namespace/policy owner.
+   `prepareManagedTunnel(generation)` then creates that fresh nonpersistent TUN
+   with `IFF_TUN_EXCL`, the assigned IPv4 /32 and exact split routes. The interface
+   is UP; packet forwarding remains disabled. An existing same-named interface
+   causes failure and is never adopted or deleted.
+3. Install and verify caller-owned policy against the fresh returned `runtime`.
+   `enableManagedForwarding(generation)` reinspects the native inventory, discards
+   already-ready incoming encrypted frames and TUN packets, then starts forwarding.
+   Incoming ciphertext is consumed while disabled so Noise nonces stay synchronized.
+   Continuous ready input can prevent enable from completing; it cannot enable early.
+4. `stopManagedForwarding(generation)` terminally ends packet I/O while retaining
+   the TUN and its monitor. A stopped generation cannot restart. Fence caller-owned
+   policy, authorize deletion, then `disconnect()` to close and join the kernel owner.
+   `stop()` additionally closes an owned stdio process; socket transport leaves the
+   independently owned daemon alive and requires `disconnect()` for native cleanup.
+
+`inspectManagedSession(generation)` returns the current phase and a fresh TUN audit
+when a device exists. Prepare/enable repeats inspect the same live generation;
+stale generations reject before effects. A lost reply or timeout does not prove
+that a native transition had no effect: inspect the retained owner and reconcile
+the caller's independent inventory before proceeding. Never use serialized receipts
+to recreate ownership or silently reconnect into an old policy epoch.
+
+Transport loss and lease expiry emit a `managed-session-state` event with phase
+`stopped` after packet I/O ends, retaining the kernel device for explicit teardown.
+Changed or restored kernel inventory instead retires the entire native owner and
+closes its TUN even while packet I/O is blocked. Phase `retired` follows native
+owner destruction. Bridge loss instead emits `managed-session-invalidated` and
+invalidates facade observations immediately; the native session may still be
+forwarding in an independently owned socket daemon. These events do not prove global
+policy removal, conntrack drainage, delivery of previously queued network packets,
+or safe allocation reuse. IPv6, underlay, workload links, sysctls, global routes and
+firewall policy remain the caller's responsibility.
+
+### Retained managed TUN runtime
+
+An authenticated native managed connection with `forwardingMode: 'tun'` returns
+`managedRuntime` alongside `assignedIp`. Its random `generation` identifies that
+one connection's retained TUN and netlink owner. The observation includes the
+actual namespace device/inode, TUN name/index/link index, MTU, IPv4 /32, actual hub
+peer IP and authenticated managed assignment. Testing and WireGuard connections
+do not provide this capability.
+
+`await client.inspectManagedRuntime(generation)` performs a new bounded kernel
+inspection of that retained owner. It requires complete, uninterrupted link,
+IPv4 address and route inventories, including successful netlink DONE messages.
+A missing, retired or different generation rejects; no serialized observation
+can reopen a namespace, adopt another interface or restore an old connection.
+
+Register `client.on('managed-runtime-invalidated', handler)` before connecting.
+Stop admitting work against that generation as soon as the event arrives or an
+inspection/IPC operation fails. The native owner subscribes before its first
+inspection and retires on any observed change to the owned link or IPv4 address,
+its routes, or an equal/more-specific IPv4 route to its managed destinations.
+A change followed by restoration still retires the generation. Protocol closure,
+malformed inventory, interruption and overflow fail closed. Reconnecting creates
+a new generation. This event is also emitted immediately when the facade loses
+its transport, including the gap before automatic socket reconnect, or starts
+stopping. Reattaching to a surviving daemon cannot revive an invalidated generation;
+establish a fresh managed connection. The event does not acknowledge joined cleanup
+or reusable allocations.
+
+The native monitor shares the joined packet-task lifetime. On retirement the
+packet future and its nonpersistent TUN close before the native event is emitted;
+the kernel removes the TUN's routes. There is no name-based route cleanup or
+detached monitor. `disconnect()` joins the native connection; `stop()` confirms
+the owned bridge's closure. Socket transport still leaves the separately owned
+daemon process alive, so use `disconnect()` for native connection teardown.
+
+These are IPv4 TUN facts, not namespace-wide routing or packet-policy authority.
+The caller owns underlay/DHCP changes, global routing rules, sysctls, IPv6 policy,
+firewall enforcement and workload admission. Normal `getStatus()` is an observed
+connection status and does not substitute for a fresh kernel inspection.
+
+For sealed distributions, pass an already verified executable as
+`transport: { transport: 'stdio', binaryPath: '/absolute/path/to/smartvpn_daemon' }`.
+This selects that exact file ahead of environment/package lookup. Invalid paths
+reject without another executable being selected. Namespace descriptors remain
+separate `IVpnClientOptions.networkNamespaceFd` configuration.
+
 ### Confirmed bridge shutdown
 
 Always await `client.stop()`, `server.stop()` or `bridge.stop()` before replacing
@@ -805,6 +908,7 @@ client.on('exit', ({ code, signal }) => { /* daemon process exited */ });
 | `exit` | Both | `{ code, signal }` — daemon process exited |
 | `reconnected` | Both | `void` — socket transport reconnected |
 | `stderr` | Both | `string` — daemon diagnostic line, forwarded without automatic logging |
+| `managed-runtime-invalidated` | Client | `IVpnManagedRuntimeInvalidation` — stop using this managed generation immediately |
 
 For connection state and telemetry, use `getStatus()`, `getStatistics()`, `listClients()`, and `getClientTelemetry()`.
 

package/third-party-notices.md

@@ -22,7 +22,7 @@ locked, feature-inactive packages are covered by these supplemental MIT notices:
 - [valuable 0.1.1](./notices/valuable-license.txt), from
   [its pinned upstream LICENSE](https://github.com/tokio-rs/valuable/blob/9efc29b6e58cef28f6566a47aa7e142a55fead77/LICENSE).
 
-Together these cover all 278 locked registry packages, conservatively including
+Together these cover all 278 locked external packages, conservatively including
 build-only and target-inactive dependencies. Listing a package does not mean it
 is linked into either Linux executable. MIT is preferred where offered as an
 alternative; other selected terms include Apache-2.0, BSD, ISC, Unicode-3.0,
@@ -30,6 +30,12 @@ CDLA-Permissive-2.0 and the existing tun 0.7.22 dependency's WTFPL.
 The exact package versions, declared license expressions and reviewed file hashes
 are recorded in [inventory.json](./notices/inventory.json).
 
+The managed kernel inventory uses the published `netlink-proto` 0.13.1 fork at
+`bcbbfbba7485857c3b1f9fd5f6d99d597a334ab0` from
+[push.rocks/netlink-proto](https://code.foss.global/push.rocks/netlink-proto).
+Its exact MIT notice is included in the generated inventory and supplemental
+route notices; the original 0.13.0 attribution is retained there as well.
+
 The [additional MIT source attributions](./notices/mit-source-attributions.txt)
 retain cesu8 1.1.0's Rust Project/Eric Kidd source headers and siphasher 1.0.2's
 Rust Project/Frank Denis `COPYING` attribution, together with the selected MIT terms.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartvpn',
-  version: '2.1.0',
+  version: '2.3.0',
   description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 }

package/ts/smartvpn.classes.vpnbridge.ts

@@ -3,8 +3,10 @@ import * as paths from './smartvpn.paths.js';
 import type {
   TVpnTransportOptions,
   IVpnTransportSocket,
+  IVpnManagedRuntimeInvalidation,
+  IVpnManagedSessionEvent,
 } from './smartvpn.interfaces.js';
-import type { TCommandMap } from '@push.rocks/smartrust';
+import type { TCommandMap, IRustBridgeDisconnectedEvent } from '@push.rocks/smartrust';
 
 /**
  * Shared bridge wrapper around smartrust RustBridge.
@@ -33,6 +35,10 @@ export class VpnBridge<TCommands extends TCommandMap> extends plugins.events.Eve
       }
     }
     const binaryName = options.binaryName || 'smartvpn_daemon';
+    if (options.transport.transport === 'stdio' && options.transport.binaryPath !== undefined
+      && (typeof options.transport.binaryPath !== 'string' || !plugins.path.isAbsolute(options.transport.binaryPath))) {
+      throw new Error('VpnBridge binaryPath must be an absolute executable path');
+    }
     // Keep the validated process transport stable even if the caller edits its options.
     this.transportOptions = { ...options.transport };
     this.mode = options.mode;
@@ -40,7 +46,7 @@ export class VpnBridge<TCommands extends TCommandMap> extends plugins.events.Eve
     this.bridge = new plugins.smartrust.RustBridge<TCommands>({
       binaryName,
       binaryPath: options.transport.transport === 'stdio'
-        ? paths.getBinaryPath(binaryName)
+        ? options.transport.binaryPath ?? paths.getBinaryPath(binaryName)
         : undefined,
       localPaths: [],
       searchSystemPath: false,
@@ -51,6 +57,9 @@ export class VpnBridge<TCommands extends TCommandMap> extends plugins.events.Eve
     });
 
     // Forward events from inner bridge
+    this.bridge.on('disconnected', (event: IRustBridgeDisconnectedEvent) => {
+      this.emit('disconnected', event);
+    });
     this.bridge.on('exit', (code: number | null, signal: string | null) => {
       this.emit('exit', code, signal);
     });
@@ -63,6 +72,12 @@ export class VpnBridge<TCommands extends TCommandMap> extends plugins.events.Eve
 
     // Forward management events from the daemon
     // smartrust emits 'management:<eventName>' for unsolicited events
+    this.bridge.on('management:managed-runtime-invalidated', (data: IVpnManagedRuntimeInvalidation) => {
+      this.emit('managed-runtime-invalidated', data);
+    });
+    this.bridge.on('management:managed-session-state', (data: IVpnManagedSessionEvent) => {
+      this.emit('managed-session-state', data);
+    });
     this.bridge.on('management:status', (data: any) => {
       this.emit('status', data);
     });

package/ts/smartvpn.classes.vpnclient.ts

@@ -7,6 +7,12 @@ import type {
   IVpnStatistics,
   IVpnConnectionQuality,
   IVpnMtuInfo,
+  IVpnConnectionResult,
+  IVpnManagedRuntime,
+  IVpnManagedRuntimeInvalidation,
+  IVpnManagedSessionConfig,
+  IVpnManagedSession,
+  IVpnManagedSessionEvent,
   TVpnClientCommands,
 } from './smartvpn.interfaces.js';
 
@@ -16,6 +22,13 @@ import type {
 export class VpnClient extends plugins.events.EventEmitter {
   private bridge: VpnBridge<TVpnClientCommands>;
   private options: IVpnClientOptions;
+  private bridgeEpoch = 0;
+  private managedGeneration?: string;
+  private lastInvalidatedGeneration?: string;
+  private sessionGeneration?: string;
+  private stoppedSessionGeneration?: string;
+  private retiredSessionGeneration?: string;
+  private invalidatedSessionGeneration?: string;
 
   constructor(options: IVpnClientOptions) {
     super();
@@ -27,15 +40,120 @@ export class VpnClient extends plugins.events.EventEmitter {
     });
 
     // Forward bridge events
+    this.bridge.on('disconnected', () => {
+      this.invalidateBridge('Client transport disconnected');
+    });
     this.bridge.on('exit', (code: number | null, signal: string | null) => {
+      this.invalidateBridge('Client bridge exited');
       this.emit('exit', { code, signal });
     });
     this.bridge.on('reconnected', () => {
+      this.invalidateBridge('Client bridge reconnected');
       this.emit('reconnected');
     });
     this.bridge.on('stderr', (line: string) => {
       this.emit('stderr', line);
     });
+    this.bridge.on('managed-runtime-invalidated', (event: IVpnManagedRuntimeInvalidation) => {
+      this.invalidateGeneration(event);
+    });
+    this.bridge.on('managed-session-state', (event: IVpnManagedSessionEvent) => {
+      this.observeSessionEvent(event);
+    });
+  }
+
+  private observeSessionEvent(event: IVpnManagedSessionEvent): void {
+    if (event.phase === 'retired') {
+      this.retiredSessionGeneration = event.generation;
+      if (this.sessionGeneration === event.generation) this.sessionGeneration = undefined;
+    } else {
+      this.stoppedSessionGeneration = event.generation;
+    }
+    this.emit('managed-session-state', event);
+  }
+
+  private invalidateGeneration(event: IVpnManagedRuntimeInvalidation): void {
+    if (this.lastInvalidatedGeneration === event.generation) return;
+    this.lastInvalidatedGeneration = event.generation;
+    if (this.managedGeneration === event.generation) this.managedGeneration = undefined;
+    this.emit('managed-runtime-invalidated', event);
+  }
+
+  private invalidateBridge(reason: string): void {
+    this.bridgeEpoch++;
+    if (this.managedGeneration) this.invalidateGeneration({ generation: this.managedGeneration, reason });
+    if (this.sessionGeneration) {
+      const generation = this.sessionGeneration;
+      this.invalidatedSessionGeneration = generation;
+      this.sessionGeneration = undefined;
+      this.emit('managed-session-invalidated', { generation, reason });
+    }
+  }
+
+  private checkSession(result: IVpnManagedSession, epoch: number, generation?: string): void {
+    const observed = result.plan.generation;
+    if (epoch !== this.bridgeEpoch || observed === this.retiredSessionGeneration
+      || observed === this.invalidatedSessionGeneration
+      || (generation !== undefined && observed !== generation)
+      || (observed === this.stoppedSessionGeneration && result.phase !== 'stopped')) {
+      throw new Error('Managed session stopped, retired, or lost observation during the operation');
+    }
+    if (result.runtime) {
+      this.checkObservation(result.runtime, epoch, observed);
+      this.managedGeneration = observed;
+    }
+  }
+
+  /** Authenticate and retain transport/keepalive without any TUN or route effect. */
+  public async authenticateManaged(config: IVpnManagedSessionConfig): Promise<IVpnManagedSession> {
+    const epoch = this.bridgeEpoch;
+    const result = await this.bridge.sendCommand('authenticateManaged', { config });
+    this.checkSession(result, epoch);
+    this.sessionGeneration = result.plan.generation;
+    return result;
+  }
+
+  /** Create the planned exclusive /32 TUN and split routes with forwarding disabled.
+   * Caller must authorize these exact native transitions before calling. */
+  public prepareManagedTunnel(generation: string): Promise<IVpnManagedSession> {
+    return this.sessionCommand('prepareManagedTunnel', generation);
+  }
+
+  /** Reinspect, discard ready pre-enable inputs, then start forwarding. Call only
+   * after caller-owned policy is installed and verified against the prepared TUN. */
+  public enableManagedForwarding(generation: string): Promise<IVpnManagedSession> {
+    return this.sessionCommand('enableManagedForwarding', generation);
+  }
+
+  /** Terminally stop packet I/O and retain the TUN for caller-authorized teardown.
+   * This generation cannot forward again. Disconnect then closes its kernel owner. */
+  public stopManagedForwarding(generation: string): Promise<IVpnManagedSession> {
+    return this.sessionCommand('stopManagedForwarding', generation);
+  }
+
+  public inspectManagedSession(generation: string): Promise<IVpnManagedSession> {
+    return this.sessionCommand('inspectManagedSession', generation);
+  }
+
+  private async sessionCommand(method: 'prepareManagedTunnel' | 'enableManagedForwarding'
+    | 'stopManagedForwarding' | 'inspectManagedSession', generation: string): Promise<IVpnManagedSession> {
+    if (typeof generation !== 'string' || !/^[a-f0-9]{32}$/.test(generation)) {
+      throw new Error('Managed session generation must be a native 128-bit identifier');
+    }
+    if (generation === this.invalidatedSessionGeneration || generation === this.retiredSessionGeneration) {
+      throw new Error('Managed session observation is unavailable');
+    }
+    const epoch = this.bridgeEpoch;
+    const result = await this.bridge.sendCommand(method, { generation });
+    this.checkSession(result, epoch, generation);
+    return result;
+  }
+
+  private checkObservation(runtime: IVpnManagedRuntime, epoch: number, generation?: string): void {
+    if (epoch !== this.bridgeEpoch || runtime.generation === this.lastInvalidatedGeneration
+      || (generation !== undefined && runtime.generation !== generation)) {
+      throw new Error('Managed runtime retired during the operation');
+    }
   }
 
   /**
@@ -48,12 +166,30 @@ export class VpnClient extends plugins.events.EventEmitter {
   /**
    * Connect to the VPN server using the provided config.
    */
-  public async connect(config?: IVpnClientConfig): Promise<{ assignedIp: string }> {
+  public async connect(config?: IVpnClientConfig): Promise<IVpnConnectionResult> {
     const cfg = config || this.options.config;
     if (!cfg) {
       throw new Error('VpnClient.connect: no config provided');
     }
-    return this.bridge.sendCommand('connect', { config: cfg });
+    const epoch = this.bridgeEpoch;
+    const result = await this.bridge.sendCommand('connect', { config: cfg });
+    if (result.managedRuntime) {
+      this.checkObservation(result.managedRuntime, epoch);
+      this.managedGeneration = result.managedRuntime.generation;
+    }
+    return result;
+  }
+
+  /** Inspect the retained native TUN, its exact IPv4 /32 and split routes.
+   * Requires the connection's generation and fails after retirement/reconnect. */
+  public async inspectManagedRuntime(generation: string): Promise<IVpnManagedRuntime> {
+    if (typeof generation !== 'string' || !/^[a-f0-9]{32}$/.test(generation)) {
+      throw new Error('Managed runtime generation must be a native 128-bit identifier');
+    }
+    const epoch = this.bridgeEpoch;
+    const result = await this.bridge.sendCommand('inspectManagedRuntime', { generation });
+    this.checkObservation(result, epoch, generation);
+    return result;
   }
 
   /**
@@ -93,9 +229,11 @@ export class VpnClient extends plugins.events.EventEmitter {
   }
 
   /**
-   * Stop the daemon bridge and wait for confirmed ownership release.
+   * Stop and join an owned stdio daemon. Socket mode only closes the bridge;
+   * disconnect() must first join the independently owned native session.
    */
   public async stop(): Promise<void> {
+    this.invalidateBridge('Client stop requested');
     await this.bridge.stop();
   }
 

package/ts/smartvpn.interfaces.ts

@@ -4,6 +4,9 @@
 
 export interface IVpnTransportStdio {
   transport: 'stdio';
+  /** Exact caller-verified executable. Overrides environment/package lookup;
+   * invalid paths fail without falling through to another executable. */
+  binaryPath?: string;
 }
 
 export interface IVpnTransportSocket {
@@ -488,7 +491,13 @@ export interface IWgPeerInfo {
 // ============================================================================
 
 export type TVpnClientCommands = {
-  connect: { params: { config: IVpnClientConfig }; result: { assignedIp: string } };
+  authenticateManaged: { params: { config: IVpnManagedSessionConfig }; result: IVpnManagedSession };
+  prepareManagedTunnel: { params: { generation: string }; result: IVpnManagedSession };
+  enableManagedForwarding: { params: { generation: string }; result: IVpnManagedSession };
+  stopManagedForwarding: { params: { generation: string }; result: IVpnManagedSession };
+  inspectManagedSession: { params: { generation: string }; result: IVpnManagedSession };
+  connect: { params: { config: IVpnClientConfig }; result: IVpnConnectionResult };
+  inspectManagedRuntime: { params: { generation: string }; result: IVpnManagedRuntime };
   disconnect: { params: Record<string, never>; result: void };
   getStatus: { params: Record<string, never>; result: IVpnStatus };
   getStatistics: { params: Record<string, never>; result: IVpnStatistics };
@@ -595,6 +604,101 @@ export interface IManagedNetworkBinding {
   nodeId: string;
 }
 
+export interface IVpnConnectionResult {
+  assignedIp: string;
+  /** Present only for an authenticated native managed connection with a real TUN. */
+  managedRuntime?: IVpnManagedRuntime;
+}
+
+/** Linux native client with explicit kernel-effect stages. The caller supplies
+ * a conservative deadline from its independently qualified clock authority. */
+export interface IVpnManagedSessionConfig {
+  serverUrl: string;
+  serverPublicKey: string;
+  clientPrivateKey: string;
+  clientPublicKey: string;
+  transport: 'quic' | 'websocket';
+  serverCertHash?: string;
+  mtu?: number;
+  managedNetwork: IManagedNetworkBinding;
+  /** Same native boot; deadline must be future and at most fifteen minutes away.
+   * Expiry stops packet I/O even across suspend. It does not delete a held TUN. */
+  lease: { bootId: string; deadlineBoottimeMs: number };
+}
+
+/** Authentication returns the full validated assignment and planned exclusive
+ * TUN name before creating a device or route. Kernel policy remains caller-owned. */
+export interface IVpnManagedSessionPlan {
+  schemaVersion: 1;
+  generation: string;
+  namespace: { device: string; inode: string };
+  interfaceName: string;
+  assignment: {
+    assignedIp: string;
+    gateway: string;
+    subnet: string;
+    mtu: number;
+    effectiveMtu: number;
+    managed: IManagedNetworkAssignment;
+  };
+  mtu: number;
+  remoteIp: string;
+  lease: IVpnManagedSessionConfig['lease'];
+}
+
+export interface IVpnManagedSession {
+  plan: IVpnManagedSessionPlan;
+  phase: 'authenticated' | 'prepared' | 'forwarding' | 'stopped';
+  /** Fresh native inspection when present. Prepared TUN is UP with forwarding
+   * disabled. A stopped TUN stays owned until disconnect() joins deletion, or an
+   * owned stdio process is joined by stop(). Socket stop() does not delete it. */
+  runtime: IVpnManagedRuntime | null;
+}
+
+/** Stopped means the complete packet I/O future ended; retired means the native
+ * session owner ended. Neither proves namespace-wide cleanup, conntrack drain,
+ * packets already queued on the network, or safe allocation reuse. */
+export interface IVpnManagedSessionEvent {
+  generation: string;
+  phase: 'stopped' | 'retired';
+  reason: string;
+}
+
+/** The facade lost observation of this generation. Native packet I/O and TUN
+ * ownership may remain alive, especially with an independent socket daemon.
+ * This is neither a stopped nor a retired native lifecycle acknowledgement. */
+export interface IVpnManagedSessionInvalidation {
+  generation: string;
+  reason: string;
+}
+
+/** A fresh observation of a retained native lifetime, never a transferable or
+ * restorable capability. The caller retains VpnClient and listens for invalidation.
+ * IPv6, namespace-wide policy/rules, underlay and firewall remain caller-owned. */
+export interface IVpnManagedRuntime {
+  schemaVersion: 1;
+  generation: string;
+  namespace: { device: string; inode: string };
+  link: {
+    interfaceIndex: number;
+    interfaceName: string;
+    interfaceKind: 'tun';
+    linkIndex: number;
+    mtu: number;
+    address: string;
+    prefixLength: 32;
+  };
+  remoteIp: string;
+  assignment: IManagedNetworkAssignment;
+}
+
+/** Stop using this generation immediately. This event is not a joined cleanup,
+ * conntrack drain, or allocation-reuse acknowledgement. */
+export interface IVpnManagedRuntimeInvalidation {
+  generation: string;
+  reason: string;
+}
+
 export interface IManagedNodeConfig {
   /** Caller-owned control address with /32; local workload prefixes are not hub routes. */
   address: string;
@@ -632,6 +736,9 @@ export interface IVpnServiceUnit {
 // ============================================================================
 
 export interface IVpnEventMap {
+  'managed-session-state': IVpnManagedSessionEvent;
+  'managed-session-invalidated': IVpnManagedSessionInvalidation;
+  'managed-runtime-invalidated': IVpnManagedRuntimeInvalidation;
   'status': IVpnStatus;
   'error': { message: string; code?: string };
   'client-connected': IVpnClientInfo;