@push.rocks/smartvpn 2.2.0 → 2.3.1

package/dist_rust/smartvpn_daemon_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "4f8072fe724ac6d140e4d76aaaa1820bbfae2d70eda8f5c93ffbe8717df56453",
+  "binarySha256": "d4e6f89ac9278183338ea8a83fd112ef8b7516576057234f7bab8181291089a1",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.2.0",
-    "gitCommit": "da37d5bcd88b9b2d2849d05fa7865a361ab7c313",
+    "projectVersion": "2.3.1",
+    "gitCommit": "a96a22bd5ff5fe870e72c225b51f4715c1b25c40",
     "gitDirty": false,
-    "builtAt": "2026-09-15T01:02:07.587Z",
+    "builtAt": "2026-09-17T15:20:47.136Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_amd64_musl"

package/dist_rust/smartvpn_daemon_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "01e551c5becdaaec42fa18c0f49ea6aa2e2bf6fef225211606ce52a486c1c918",
+  "binarySha256": "9c8bdf211d7bbb9425e7dcf44ead8b39b584e6fd1b18cfdddff07b51133fb16d",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.2.0",
-    "gitCommit": "da37d5bcd88b9b2d2849d05fa7865a361ab7c313",
+    "projectVersion": "2.3.1",
+    "gitCommit": "a96a22bd5ff5fe870e72c225b51f4715c1b25c40",
     "gitDirty": false,
-    "builtAt": "2026-09-15T01:02:07.887Z",
+    "builtAt": "2026-09-17T15:20:47.476Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -2,8 +2,8 @@
  * autocreated commitinfo by @push.rocks/commitinfo
  */
 export const commitinfo = {
-    name: '@push.rocks/smartvpn',
-    version: '2.2.0',
-    description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
+    name: "@push.rocks/smartvpn",
+    version: "2.3.1",
+    description: "A VPN solution with TypeScript control plane and Rust data plane daemon"
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/smartvpn.classes.vpnbridge.js

@@ -54,6 +54,9 @@ export class VpnBridge extends plugins.events.EventEmitter {
         this.bridge.on('management:managed-runtime-invalidated', (data) => {
             this.emit('managed-runtime-invalidated', data);
         });
+        this.bridge.on('management:managed-session-state', (data) => {
+            this.emit('managed-session-state', data);
+        });
         this.bridge.on('management:status', (data) => {
             this.emit('status', data);
         });
@@ -110,4 +113,4 @@ export class VpnBridge extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5icmlkZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sS0FBSyxLQUFLLE1BQU0scUJBQXFCLENBQUM7QUFRN0M7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQXlDLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBS3ZGLFlBQVksT0FLWDtRQUNDLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQy9DLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQzlHLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztZQUNoRixDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxHQUFHLENBQUMsSUFBSSxXQUFXLEdBQUcsV0FBVyxFQUFFLENBQUM7Z0JBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztZQUMzRixDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUksaUJBQWlCLENBQUM7UUFDM0QsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssU0FBUztlQUNwRixDQUFDLE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEgsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxvRkFBb0Y7UUFDcEYsSUFBSSxDQUFDLGdCQUFnQixHQUFHLEVBQUUsR0FBRyxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDakQsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO1FBRXpCLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBWTtZQUN4RCxVQUFVO1lBQ1YsVUFBVSxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLE9BQU87Z0JBQ2pELENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsSUFBSSxLQUFLLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQztnQkFDakUsQ0FBQyxDQUFDLFNBQVM7WUFDYixVQUFVLEVBQUUsRUFBRTtZQUNkLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsT0FBTyxFQUFFLENBQUMsY0FBYyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSTtnQkFDM0MsR0FBRyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyx3QkFBd0IsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3hFLHdCQUF3QixFQUFFLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUM7WUFDL0UsY0FBYyxFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxFQUFFLFFBQVE7U0FDM0MsQ0FBQyxDQUFDO1FBRUgsbUNBQW1DO1FBQ25DLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGNBQWMsRUFBRSxDQUFDLEtBQW1DLEVBQUUsRUFBRTtZQUNyRSxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNuQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQW1CLEVBQUUsTUFBcUIsRUFBRSxFQUFFO1lBQ3BFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNsQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBRUgsNENBQTRDO1FBQzVDLGtFQUFrRTtRQUNsRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyx3Q0FBd0MsRUFBRSxDQUFDLElBQW9DLEVBQUUsRUFBRTtZQUNoRyxJQUFJLENBQUMsSUFBSSxDQUFDLDZCQUE2QixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2pELENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsbUJBQW1CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNoRCxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGtCQUFrQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDL0MsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyw2QkFBNkIsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzFELElBQUksQ0FBQyxJQUFJLENBQUMsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxnQ0FBZ0MsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQzdELElBQUksQ0FBQyxJQUFJLENBQUMscUJBQXFCLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDekMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzdCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNqRCxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM3QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxLQUFLO1FBQ2hCLElBQUksSUFBSSxDQUFDLGdCQUFnQixDQUFDLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNqRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsZ0JBQXVDLENBQUM7WUFDaEUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFO2dCQUNoRCxhQUFhLEVBQUUsVUFBVSxDQUFDLGFBQWE7Z0JBQ3ZDLG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7Z0JBQ3JELG1CQUFtQixFQUFFLFVBQVUsQ0FBQyxtQkFBbUI7Z0JBQ25ELG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7YUFDdEQsQ0FBQyxDQUFDO1FBQ0wsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDN0IsQ0FBQztJQUNILENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUNoQyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVyxDQUN0QixNQUFTLEVBQ1QsTUFBOEI7UUFFOUIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5icmlkZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmJyaWRnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sS0FBSyxLQUFLLE1BQU0scUJBQXFCLENBQUM7QUFTN0M7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQXlDLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBS3ZGLFlBQVksT0FLWDtRQUNDLEtBQUssRUFBRSxDQUFDO1FBRVIsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQy9DLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQzlHLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztZQUNoRixDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxHQUFHLENBQUMsSUFBSSxXQUFXLEdBQUcsV0FBVyxFQUFFLENBQUM7Z0JBQ25GLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztZQUMzRixDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUksaUJBQWlCLENBQUM7UUFDM0QsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssU0FBUztlQUNwRixDQUFDLE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEgsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxvRkFBb0Y7UUFDcEYsSUFBSSxDQUFDLGdCQUFnQixHQUFHLEVBQUUsR0FBRyxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDakQsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDO1FBRXpCLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBWTtZQUN4RCxVQUFVO1lBQ1YsVUFBVSxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLE9BQU87Z0JBQ2pELENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsSUFBSSxLQUFLLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQztnQkFDakUsQ0FBQyxDQUFDLFNBQVM7WUFDYixVQUFVLEVBQUUsRUFBRTtZQUNkLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsT0FBTyxFQUFFLENBQUMsY0FBYyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSTtnQkFDM0MsR0FBRyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyx3QkFBd0IsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3hFLHdCQUF3QixFQUFFLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUM7WUFDL0UsY0FBYyxFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxFQUFFLFFBQVE7U0FDM0MsQ0FBQyxDQUFDO1FBRUgsbUNBQW1DO1FBQ25DLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGNBQWMsRUFBRSxDQUFDLEtBQW1DLEVBQUUsRUFBRTtZQUNyRSxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNuQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQW1CLEVBQUUsTUFBcUIsRUFBRSxFQUFFO1lBQ3BFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNsQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBRUgsNENBQTRDO1FBQzVDLGtFQUFrRTtRQUNsRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyx3Q0FBd0MsRUFBRSxDQUFDLElBQW9DLEVBQUUsRUFBRTtZQUNoRyxJQUFJLENBQUMsSUFBSSxDQUFDLDZCQUE2QixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2pELENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsa0NBQWtDLEVBQUUsQ0FBQyxJQUE2QixFQUFFLEVBQUU7WUFDbkYsSUFBSSxDQUFDLElBQUksQ0FBQyx1QkFBdUIsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUMzQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG1CQUFtQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDaEQsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQy9DLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzNCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsNkJBQTZCLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUMxRCxJQUFJLENBQUMsSUFBSSxDQUFDLGtCQUFrQixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ3RDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsZ0NBQWdDLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUM3RCxJQUFJLENBQUMsSUFBSSxDQUFDLHFCQUFxQixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ3pDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxJQUFTLEVBQUUsRUFBRTtZQUNqRCxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM3QixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLG9CQUFvQixFQUFFLENBQUMsSUFBUyxFQUFFLEVBQUU7WUFDakQsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDN0IsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixJQUFJLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDakQsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLGdCQUF1QyxDQUFDO1lBQ2hFLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFVBQVUsRUFBRTtnQkFDaEQsYUFBYSxFQUFFLFVBQVUsQ0FBQyxhQUFhO2dCQUN2QyxvQkFBb0IsRUFBRSxVQUFVLENBQUMsb0JBQW9CO2dCQUNyRCxtQkFBbUIsRUFBRSxVQUFVLENBQUMsbUJBQW1CO2dCQUNuRCxvQkFBb0IsRUFBRSxVQUFVLENBQUMsb0JBQW9CO2FBQ3RELENBQUMsQ0FBQztRQUNMLENBQUM7YUFBTSxDQUFDO1lBQ04sT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQzdCLENBQUM7SUFDSCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLElBQUk7UUFDZixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDaEMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FDdEIsTUFBUyxFQUNULE1BQThCO1FBRTlCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRiJ9

package/dist_ts/smartvpn.classes.vpnclient.d.ts

@@ -1,5 +1,5 @@
 import * as plugins from './smartvpn.plugins.js';
-import type { IVpnClientOptions, IVpnClientConfig, IVpnStatus, IVpnStatistics, IVpnConnectionQuality, IVpnMtuInfo, IVpnConnectionResult, IVpnManagedRuntime } from './smartvpn.interfaces.js';
+import type { IVpnClientOptions, IVpnClientConfig, IVpnStatus, IVpnStatistics, IVpnConnectionQuality, IVpnMtuInfo, IVpnConnectionResult, IVpnManagedRuntime, IVpnManagedSessionConfig, IVpnManagedSession } from './smartvpn.interfaces.js';
 /**
  * VPN Client — manages a smartvpn daemon in client mode.
  */
@@ -9,9 +9,28 @@ export declare class VpnClient extends plugins.events.EventEmitter {
     private bridgeEpoch;
     private managedGeneration?;
     private lastInvalidatedGeneration?;
+    private sessionGeneration?;
+    private stoppedSessionGeneration?;
+    private retiredSessionGeneration?;
+    private invalidatedSessionGeneration?;
     constructor(options: IVpnClientOptions);
+    private observeSessionEvent;
     private invalidateGeneration;
     private invalidateBridge;
+    private checkSession;
+    /** Authenticate and retain transport/keepalive without any TUN or route effect. */
+    authenticateManaged(config: IVpnManagedSessionConfig): Promise<IVpnManagedSession>;
+    /** Create the planned exclusive /32 TUN and split routes with forwarding disabled.
+     * Caller must authorize these exact native transitions before calling. */
+    prepareManagedTunnel(generation: string): Promise<IVpnManagedSession>;
+    /** Reinspect, discard ready pre-enable inputs, then start forwarding. Call only
+     * after caller-owned policy is installed and verified against the prepared TUN. */
+    enableManagedForwarding(generation: string): Promise<IVpnManagedSession>;
+    /** Terminally stop packet I/O and retain the TUN for caller-authorized teardown.
+     * This generation cannot forward again. Disconnect then closes its kernel owner. */
+    stopManagedForwarding(generation: string): Promise<IVpnManagedSession>;
+    inspectManagedSession(generation: string): Promise<IVpnManagedSession>;
+    private sessionCommand;
     private checkObservation;
     /**
      * Start the daemon bridge (spawn or connect).
@@ -46,7 +65,8 @@ export declare class VpnClient extends plugins.events.EventEmitter {
      */
     getMtuInfo(): Promise<IVpnMtuInfo | null>;
     /**
-     * Stop the daemon bridge and wait for confirmed ownership release.
+     * Stop and join an owned stdio daemon. Socket mode only closes the bridge;
+     * disconnect() must first join the independently owned native session.
      */
     stop(): Promise<void>;
     /**

package/dist_ts/smartvpn.classes.vpnclient.js

@@ -31,6 +31,20 @@ export class VpnClient extends plugins.events.EventEmitter {
         this.bridge.on('managed-runtime-invalidated', (event) => {
             this.invalidateGeneration(event);
         });
+        this.bridge.on('managed-session-state', (event) => {
+            this.observeSessionEvent(event);
+        });
+    }
+    observeSessionEvent(event) {
+        if (event.phase === 'retired') {
+            this.retiredSessionGeneration = event.generation;
+            if (this.sessionGeneration === event.generation)
+                this.sessionGeneration = undefined;
+        }
+        else {
+            this.stoppedSessionGeneration = event.generation;
+        }
+        this.emit('managed-session-state', event);
     }
     invalidateGeneration(event) {
         if (this.lastInvalidatedGeneration === event.generation)
@@ -44,6 +58,63 @@ export class VpnClient extends plugins.events.EventEmitter {
         this.bridgeEpoch++;
         if (this.managedGeneration)
             this.invalidateGeneration({ generation: this.managedGeneration, reason });
+        if (this.sessionGeneration) {
+            const generation = this.sessionGeneration;
+            this.invalidatedSessionGeneration = generation;
+            this.sessionGeneration = undefined;
+            this.emit('managed-session-invalidated', { generation, reason });
+        }
+    }
+    checkSession(result, epoch, generation) {
+        const observed = result.plan.generation;
+        if (epoch !== this.bridgeEpoch || observed === this.retiredSessionGeneration
+            || observed === this.invalidatedSessionGeneration
+            || (generation !== undefined && observed !== generation)
+            || (observed === this.stoppedSessionGeneration && result.phase !== 'stopped')) {
+            throw new Error('Managed session stopped, retired, or lost observation during the operation');
+        }
+        if (result.runtime) {
+            this.checkObservation(result.runtime, epoch, observed);
+            this.managedGeneration = observed;
+        }
+    }
+    /** Authenticate and retain transport/keepalive without any TUN or route effect. */
+    async authenticateManaged(config) {
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand('authenticateManaged', { config });
+        this.checkSession(result, epoch);
+        this.sessionGeneration = result.plan.generation;
+        return result;
+    }
+    /** Create the planned exclusive /32 TUN and split routes with forwarding disabled.
+     * Caller must authorize these exact native transitions before calling. */
+    prepareManagedTunnel(generation) {
+        return this.sessionCommand('prepareManagedTunnel', generation);
+    }
+    /** Reinspect, discard ready pre-enable inputs, then start forwarding. Call only
+     * after caller-owned policy is installed and verified against the prepared TUN. */
+    enableManagedForwarding(generation) {
+        return this.sessionCommand('enableManagedForwarding', generation);
+    }
+    /** Terminally stop packet I/O and retain the TUN for caller-authorized teardown.
+     * This generation cannot forward again. Disconnect then closes its kernel owner. */
+    stopManagedForwarding(generation) {
+        return this.sessionCommand('stopManagedForwarding', generation);
+    }
+    inspectManagedSession(generation) {
+        return this.sessionCommand('inspectManagedSession', generation);
+    }
+    async sessionCommand(method, generation) {
+        if (typeof generation !== 'string' || !/^[a-f0-9]{32}$/.test(generation)) {
+            throw new Error('Managed session generation must be a native 128-bit identifier');
+        }
+        if (generation === this.invalidatedSessionGeneration || generation === this.retiredSessionGeneration) {
+            throw new Error('Managed session observation is unavailable');
+        }
+        const epoch = this.bridgeEpoch;
+        const result = await this.bridge.sendCommand(method, { generation });
+        this.checkSession(result, epoch, generation);
+        return result;
     }
     checkObservation(runtime, epoch, generation) {
         if (epoch !== this.bridgeEpoch || runtime.generation === this.lastInvalidatedGeneration
@@ -116,7 +187,8 @@ export class VpnClient extends plugins.events.EventEmitter {
         return this.bridge.sendCommand('getMtuInfo', {});
     }
     /**
-     * Stop the daemon bridge and wait for confirmed ownership release.
+     * Stop and join an owned stdio daemon. Socket mode only closes the bridge;
+     * disconnect() must first join the independently owned native session.
      */
     async stop() {
         this.invalidateBridge('Client stop requested');
@@ -129,4 +201,4 @@ export class VpnClient extends plugins.events.EventEmitter {
         return this.bridge.running;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQWM1RDs7R0FFRztBQUNILE1BQU0sT0FBTyxTQUFVLFNBQVEsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZO0lBT3hELFlBQVksT0FBMEI7UUFDcEMsS0FBSyxFQUFFLENBQUM7UUFMRixnQkFBVyxHQUFHLENBQUMsQ0FBQztRQU10QixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksU0FBUyxDQUFxQjtZQUM5QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsSUFBSSxFQUFFLFFBQVE7WUFDZCxrQkFBa0IsRUFBRSxPQUFPLENBQUMsa0JBQWtCO1NBQy9DLENBQUMsQ0FBQztRQUVILHdCQUF3QjtRQUN4QixJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxjQUFjLEVBQUUsR0FBRyxFQUFFO1lBQ2xDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ3pELENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBbUIsRUFBRSxNQUFxQixFQUFFLEVBQUU7WUFDcEUsSUFBSSxDQUFDLGdCQUFnQixDQUFDLHNCQUFzQixDQUFDLENBQUM7WUFDOUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUU7WUFDakMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLDJCQUEyQixDQUFDLENBQUM7WUFDbkQsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQVksRUFBRSxFQUFFO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsNkJBQTZCLEVBQUUsQ0FBQyxLQUFxQyxFQUFFLEVBQUU7WUFDdEYsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25DLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLG9CQUFvQixDQUFDLEtBQXFDO1FBQ2hFLElBQUksSUFBSSxDQUFDLHlCQUF5QixLQUFLLEtBQUssQ0FBQyxVQUFVO1lBQUUsT0FBTztRQUNoRSxJQUFJLENBQUMseUJBQXlCLEdBQUcsS0FBSyxDQUFDLFVBQVUsQ0FBQztRQUNsRCxJQUFJLElBQUksQ0FBQyxpQkFBaUIsS0FBSyxLQUFLLENBQUMsVUFBVTtZQUFFLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxTQUFTLENBQUM7UUFDcEYsSUFBSSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBRU8sZ0JBQWdCLENBQUMsTUFBYztRQUNyQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDbkIsSUFBSSxJQUFJLENBQUMsaUJBQWlCO1lBQUUsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3hHLENBQUM7SUFFTyxnQkFBZ0IsQ0FBQyxPQUEyQixFQUFFLEtBQWEsRUFBRSxVQUFtQjtRQUN0RixJQUFJLEtBQUssS0FBSyxJQUFJLENBQUMsV0FBVyxJQUFJLE9BQU8sQ0FBQyxVQUFVLEtBQUssSUFBSSxDQUFDLHlCQUF5QjtlQUNsRixDQUFDLFVBQVUsS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLFVBQVUsS0FBSyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3JFLE1BQU0sSUFBSSxLQUFLLENBQUMsOENBQThDLENBQUMsQ0FBQztRQUNsRSxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLEtBQUs7UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQzdCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBeUI7UUFDNUMsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQzFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQztRQUMvQixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ3pFLElBQUksTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzFCLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQ3BELElBQUksQ0FBQyxpQkFBaUIsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVEO29GQUNnRjtJQUN6RSxLQUFLLENBQUMscUJBQXFCLENBQUMsVUFBa0I7UUFDbkQsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN6RSxNQUFNLElBQUksS0FBSyxDQUFDLGdFQUFnRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUM7UUFDL0IsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyx1QkFBdUIsRUFBRSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDdEYsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDakQsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxZQUFZLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxTQUFTO1FBQ3BCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBVyxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsYUFBYTtRQUN4QixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGVBQWUsRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLG9CQUFvQjtRQUMvQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLHNCQUFzQixFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFVBQVU7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxZQUFZLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxDQUFDLGdCQUFnQixDQUFDLHVCQUF1QixDQUFDLENBQUM7UUFDL0MsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzNCLENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4uY2xhc3Nlcy52cG5jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9zbWFydHZwbi5jbGFzc2VzLnZwbmNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQWlCNUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sU0FBVSxTQUFRLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWTtJQVd4RCxZQUFZLE9BQTBCO1FBQ3BDLEtBQUssRUFBRSxDQUFDO1FBVEYsZ0JBQVcsR0FBRyxDQUFDLENBQUM7UUFVdEIsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDdkIsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLFNBQVMsQ0FBcUI7WUFDOUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1lBQzVCLElBQUksRUFBRSxRQUFRO1lBQ2Qsa0JBQWtCLEVBQUUsT0FBTyxDQUFDLGtCQUFrQjtTQUMvQyxDQUFDLENBQUM7UUFFSCx3QkFBd0I7UUFDeEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsY0FBYyxFQUFFLEdBQUcsRUFBRTtZQUNsQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUN6RCxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQW1CLEVBQUUsTUFBcUIsRUFBRSxFQUFFO1lBQ3BFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1lBQzlDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxhQUFhLEVBQUUsR0FBRyxFQUFFO1lBQ2pDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1lBQ25ELElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFZLEVBQUUsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLDZCQUE2QixFQUFFLENBQUMsS0FBcUMsRUFBRSxFQUFFO1lBQ3RGLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLHVCQUF1QixFQUFFLENBQUMsS0FBOEIsRUFBRSxFQUFFO1lBQ3pFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNsQyxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxtQkFBbUIsQ0FBQyxLQUE4QjtRQUN4RCxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLHdCQUF3QixHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUM7WUFDakQsSUFBSSxJQUFJLENBQUMsaUJBQWlCLEtBQUssS0FBSyxDQUFDLFVBQVU7Z0JBQUUsSUFBSSxDQUFDLGlCQUFpQixHQUFHLFNBQVMsQ0FBQztRQUN0RixDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksQ0FBQyx3QkFBd0IsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLHVCQUF1QixFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFTyxvQkFBb0IsQ0FBQyxLQUFxQztRQUNoRSxJQUFJLElBQUksQ0FBQyx5QkFBeUIsS0FBSyxLQUFLLENBQUMsVUFBVTtZQUFFLE9BQU87UUFDaEUsSUFBSSxDQUFDLHlCQUF5QixHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDbEQsSUFBSSxJQUFJLENBQUMsaUJBQWlCLEtBQUssS0FBSyxDQUFDLFVBQVU7WUFBRSxJQUFJLENBQUMsaUJBQWlCLEdBQUcsU0FBUyxDQUFDO1FBQ3BGLElBQUksQ0FBQyxJQUFJLENBQUMsNkJBQTZCLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVPLGdCQUFnQixDQUFDLE1BQWM7UUFDckMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ25CLElBQUksSUFBSSxDQUFDLGlCQUFpQjtZQUFFLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUN0RyxJQUFJLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQzNCLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztZQUMxQyxJQUFJLENBQUMsNEJBQTRCLEdBQUcsVUFBVSxDQUFDO1lBQy9DLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxTQUFTLENBQUM7WUFDbkMsSUFBSSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsRUFBRSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ25FLENBQUM7SUFDSCxDQUFDO0lBRU8sWUFBWSxDQUFDLE1BQTBCLEVBQUUsS0FBYSxFQUFFLFVBQW1CO1FBQ2pGLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDO1FBQ3hDLElBQUksS0FBSyxLQUFLLElBQUksQ0FBQyxXQUFXLElBQUksUUFBUSxLQUFLLElBQUksQ0FBQyx3QkFBd0I7ZUFDdkUsUUFBUSxLQUFLLElBQUksQ0FBQyw0QkFBNEI7ZUFDOUMsQ0FBQyxVQUFVLEtBQUssU0FBUyxJQUFJLFFBQVEsS0FBSyxVQUFVLENBQUM7ZUFDckQsQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLHdCQUF3QixJQUFJLE1BQU0sQ0FBQyxLQUFLLEtBQUssU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUNoRixNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7UUFDaEcsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ25CLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztZQUN2RCxJQUFJLENBQUMsaUJBQWlCLEdBQUcsUUFBUSxDQUFDO1FBQ3BDLENBQUM7SUFDSCxDQUFDO0lBRUQsbUZBQW1GO0lBQzVFLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxNQUFnQztRQUMvRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQy9CLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMscUJBQXFCLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2pDLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQztRQUNoRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQ7OEVBQzBFO0lBQ25FLG9CQUFvQixDQUFDLFVBQWtCO1FBQzVDLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQyxzQkFBc0IsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBRUQ7dUZBQ21GO0lBQzVFLHVCQUF1QixDQUFDLFVBQWtCO1FBQy9DLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQyx5QkFBeUIsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBRUQ7d0ZBQ29GO0lBQzdFLHFCQUFxQixDQUFDLFVBQWtCO1FBQzdDLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQyx1QkFBdUIsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRU0scUJBQXFCLENBQUMsVUFBa0I7UUFDN0MsT0FBTyxJQUFJLENBQUMsY0FBYyxDQUFDLHVCQUF1QixFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFFTyxLQUFLLENBQUMsY0FBYyxDQUFDLE1BQ3dCLEVBQUUsVUFBa0I7UUFDdkUsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN6RSxNQUFNLElBQUksS0FBSyxDQUFDLGdFQUFnRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELElBQUksVUFBVSxLQUFLLElBQUksQ0FBQyw0QkFBNEIsSUFBSSxVQUFVLEtBQUssSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7WUFDckcsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQy9CLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUNyRSxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDN0MsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVPLGdCQUFnQixDQUFDLE9BQTJCLEVBQUUsS0FBYSxFQUFFLFVBQW1CO1FBQ3RGLElBQUksS0FBSyxLQUFLLElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxDQUFDLFVBQVUsS0FBSyxJQUFJLENBQUMseUJBQXlCO2VBQ2xGLENBQUMsVUFBVSxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDckUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsS0FBSztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUF5QjtRQUM1QyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7UUFDMUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ1QsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQy9CLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsU0FBUyxFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDekUsSUFBSSxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDMUIsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFDcEQsSUFBSSxDQUFDLGlCQUFpQixHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDO1FBQzVELENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQ7b0ZBQ2dGO0lBQ3pFLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxVQUFrQjtRQUNuRCxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3pFLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztRQUNwRixDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQztRQUMvQixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLHVCQUF1QixFQUFFLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUN0RixJQUFJLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxVQUFVLENBQUMsQ0FBQztRQUNqRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVM7UUFDcEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxhQUFhO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsZUFBZSxFQUFFLEVBQTJCLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsb0JBQW9CO1FBQy9CLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsc0JBQXNCLEVBQUUsRUFBMkIsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxFQUEyQixDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxDQUFDLGdCQUFnQixDQUFDLHVCQUF1QixDQUFDLENBQUM7UUFDL0MsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzNCLENBQUM7SUFFRDs7T0FFRztJQUNILElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQzdCLENBQUM7Q0FDRiJ9

package/dist_ts/smartvpn.interfaces.d.ts

@@ -407,6 +407,36 @@ export interface IWgPeerInfo {
     lastHandshakeTime?: string;
 }
 export type TVpnClientCommands = {
+    authenticateManaged: {
+        params: {
+            config: IVpnManagedSessionConfig;
+        };
+        result: IVpnManagedSession;
+    };
+    prepareManagedTunnel: {
+        params: {
+            generation: string;
+        };
+        result: IVpnManagedSession;
+    };
+    enableManagedForwarding: {
+        params: {
+            generation: string;
+        };
+        result: IVpnManagedSession;
+    };
+    stopManagedForwarding: {
+        params: {
+            generation: string;
+        };
+        result: IVpnManagedSession;
+    };
+    inspectManagedSession: {
+        params: {
+            generation: string;
+        };
+        result: IVpnManagedSession;
+    };
     connect: {
         params: {
             config: IVpnClientConfig;
@@ -612,6 +642,7 @@ export interface IManagedNetworkNode {
     controlAddress: string;
     controlPolicyDomain: string;
     enabled: boolean;
+    /** Credential expiry (ISO 8601); renewing only this keeps the node's live session. */
     expiresAt?: string;
     workloadPrefixes: IManagedNetworkPrefix[];
 }
@@ -661,6 +692,69 @@ export interface IVpnConnectionResult {
     /** Present only for an authenticated native managed connection with a real TUN. */
     managedRuntime?: IVpnManagedRuntime;
 }
+/** Linux native client with explicit kernel-effect stages. The caller supplies
+ * a conservative deadline from its independently qualified clock authority. */
+export interface IVpnManagedSessionConfig {
+    serverUrl: string;
+    serverPublicKey: string;
+    clientPrivateKey: string;
+    clientPublicKey: string;
+    transport: 'quic' | 'websocket';
+    serverCertHash?: string;
+    mtu?: number;
+    managedNetwork: IManagedNetworkBinding;
+    /** Same native boot; deadline must be future and at most fifteen minutes away.
+     * Expiry stops packet I/O even across suspend. It does not delete a held TUN. */
+    lease: {
+        bootId: string;
+        deadlineBoottimeMs: number;
+    };
+}
+/** Authentication returns the full validated assignment and planned exclusive
+ * TUN name before creating a device or route. Kernel policy remains caller-owned. */
+export interface IVpnManagedSessionPlan {
+    schemaVersion: 1;
+    generation: string;
+    namespace: {
+        device: string;
+        inode: string;
+    };
+    interfaceName: string;
+    assignment: {
+        assignedIp: string;
+        gateway: string;
+        subnet: string;
+        mtu: number;
+        effectiveMtu: number;
+        managed: IManagedNetworkAssignment;
+    };
+    mtu: number;
+    remoteIp: string;
+    lease: IVpnManagedSessionConfig['lease'];
+}
+export interface IVpnManagedSession {
+    plan: IVpnManagedSessionPlan;
+    phase: 'authenticated' | 'prepared' | 'forwarding' | 'stopped';
+    /** Fresh native inspection when present. Prepared TUN is UP with forwarding
+     * disabled. A stopped TUN stays owned until disconnect() joins deletion, or an
+     * owned stdio process is joined by stop(). Socket stop() does not delete it. */
+    runtime: IVpnManagedRuntime | null;
+}
+/** Stopped means the complete packet I/O future ended; retired means the native
+ * session owner ended. Neither proves namespace-wide cleanup, conntrack drain,
+ * packets already queued on the network, or safe allocation reuse. */
+export interface IVpnManagedSessionEvent {
+    generation: string;
+    phase: 'stopped' | 'retired';
+    reason: string;
+}
+/** The facade lost observation of this generation. Native packet I/O and TUN
+ * ownership may remain alive, especially with an independent socket daemon.
+ * This is neither a stopped nor a retired native lifecycle acknowledgement. */
+export interface IVpnManagedSessionInvalidation {
+    generation: string;
+    reason: string;
+}
 /** A fresh observation of a retained native lifetime, never a transferable or
  * restorable capability. The caller retains VpnClient and listens for invalidation.
  * IPv6, namespace-wide policy/rules, underlay and firewall remain caller-owned. */
@@ -714,6 +808,8 @@ export interface IVpnServiceUnit {
     installPath: string;
 }
 export interface IVpnEventMap {
+    'managed-session-state': IVpnManagedSessionEvent;
+    'managed-session-invalidated': IVpnManagedSessionInvalidation;
     'managed-runtime-invalidated': IVpnManagedRuntimeInvalidation;
     'status': IVpnStatus;
     'error': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "2.2.0",
+  "version": "2.3.1",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",
@@ -31,8 +31,8 @@
     "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tsrust": "^1.13.0",
-    "@git.zone/tstest": "^6.0.0",
-    "@types/node": "^26.5.0"
+    "@git.zone/tstest": "^6.1.1",
+    "@types/node": "^26.5.1"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -155,6 +155,63 @@ managed TUN creation, allow/deny, reconnect, revocation, route-conflict rollback
 and child-termination cleanup. Privileged ARM64 and Pallet integration remain
 separate qualification requirements.
 
+### Staged managed client activation
+
+`authenticateManaged(config)` is a Linux native client API for a caller that must
+install packet policy before forwarding. Its closed configuration accepts an
+explicit `quic` or `websocket` transport, a matching Noise keypair, server public
+key, `managedNetwork` binding, optional MTU/certificate pin and a native lease.
+Testing mode, automatic transport fallback and extra configuration fields reject.
+
+The lease is `{ bootId, deadlineBoottimeMs }`: the actual Linux boot ID and an
+absolute `CLOCK_BOOTTIME` deadline, future and no more than fifteen minutes away.
+The caller derives this conservative deadline from its independently qualified
+authority; SmartVPN does not turn wall-clock credentials into trusted time.
+Native expiry interrupts the whole packet I/O future, including blocked writes,
+and remains effective across suspend. Leases cannot be extended in place.
+
+Register `managed-session-state`, `managed-session-invalidated` and
+`managed-runtime-invalidated` listeners before
+starting. Keep the live client owner and use the returned generation for each step:
+
+1. `authenticateManaged(config)` authenticates Noise and validates the full server
+   assignment. It retains transport and keepalive without creating a TUN or route.
+   The returned `plan` includes the actual namespace, remote endpoint, authenticated
+   assignment, effective MTU and an exclusive planned TUN name.
+2. Authorize the planned native changes in the caller's namespace/policy owner.
+   `prepareManagedTunnel(generation)` then creates that fresh nonpersistent TUN
+   with `IFF_TUN_EXCL`, the assigned IPv4 /32 and exact split routes. The interface
+   is UP; packet forwarding remains disabled. An existing same-named interface
+   causes failure and is never adopted or deleted.
+3. Install and verify caller-owned policy against the fresh returned `runtime`.
+   `enableManagedForwarding(generation)` reinspects the native inventory, discards
+   already-ready incoming encrypted frames and TUN packets, then starts forwarding.
+   Incoming ciphertext is consumed while disabled so Noise nonces stay synchronized.
+   Continuous ready input can prevent enable from completing; it cannot enable early.
+4. `stopManagedForwarding(generation)` terminally ends packet I/O while retaining
+   the TUN and its monitor. A stopped generation cannot restart. Fence caller-owned
+   policy, authorize deletion, then `disconnect()` to close and join the kernel owner.
+   `stop()` additionally closes an owned stdio process; socket transport leaves the
+   independently owned daemon alive and requires `disconnect()` for native cleanup.
+
+`inspectManagedSession(generation)` returns the current phase and a fresh TUN audit
+when a device exists. Prepare/enable repeats inspect the same live generation;
+stale generations reject before effects. A lost reply or timeout does not prove
+that a native transition had no effect: inspect the retained owner and reconcile
+the caller's independent inventory before proceeding. Never use serialized receipts
+to recreate ownership or silently reconnect into an old policy epoch.
+
+Transport loss and lease expiry emit a `managed-session-state` event with phase
+`stopped` after packet I/O ends, retaining the kernel device for explicit teardown.
+Changed or restored kernel inventory instead retires the entire native owner and
+closes its TUN even while packet I/O is blocked. Phase `retired` follows native
+owner destruction. Bridge loss instead emits `managed-session-invalidated` and
+invalidates facade observations immediately; the native session may still be
+forwarding in an independently owned socket daemon. These events do not prove global
+policy removal, conntrack drainage, delivery of previously queued network packets,
+or safe allocation reuse. IPv6, underlay, workload links, sysctls, global routes and
+firewall policy remain the caller's responsibility.
+
 ### Retained managed TUN runtime
 
 An authenticated native managed connection with `forwardingMode: 'tun'` returns
@@ -727,8 +784,16 @@ are never routed back to the hub merely because a grant involves them.
 
 Invalid preparation preserves active authority. A valid change quarantines and
 cancels only affected node generations, joins their packet work, prepares WG
-crypto and commits the whole snapshot atomically before acknowledging. Unchanged
-nodes keep their sessions. A post-drain failure leaves `state: 'failed'`, its
+crypto and commits the whole snapshot atomically before acknowledging. A node is
+affected when it is added or removed, or when its keys, control address or domain,
+`enabled`, workload prefixes, or the grants and routes involving it change.
+Unchanged nodes keep their sessions. A change to `expiresAt` alone does not affect
+a node: its live native or WireGuard session stays connected and follows the
+committed expiry in place. A later expiry keeps the session, an earlier future
+expiry re-arms its deadline, and an expiry that has already passed ends it when
+the snapshot commits. A session whose expiry passed is never revived, so renew
+before expiry; after a late renewal the node can reconnect with its unchanged keys.
+A post-drain failure leaves `state: 'failed'`, its
 `pendingRevision` and bounded `lastError`; old affected admission stays closed.
 Only the exact pending snapshot can retry. An IPC timeout or disconnected caller
 does not cancel the process-owned operation. Inspect status and replay that exact

package/ts/00_commitinfo_data.ts

@@ -2,7 +2,7 @@
  * autocreated commitinfo by @push.rocks/commitinfo
  */
 export const commitinfo = {
-  name: '@push.rocks/smartvpn',
-  version: '2.2.0',
-  description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
+  name: "@push.rocks/smartvpn",
+  version: "2.3.1",
+  description: "A VPN solution with TypeScript control plane and Rust data plane daemon"
 }

package/ts/smartvpn.classes.vpnbridge.ts

@@ -4,6 +4,7 @@ import type {
   TVpnTransportOptions,
   IVpnTransportSocket,
   IVpnManagedRuntimeInvalidation,
+  IVpnManagedSessionEvent,
 } from './smartvpn.interfaces.js';
 import type { TCommandMap, IRustBridgeDisconnectedEvent } from '@push.rocks/smartrust';
 
@@ -74,6 +75,9 @@ export class VpnBridge<TCommands extends TCommandMap> extends plugins.events.Eve
     this.bridge.on('management:managed-runtime-invalidated', (data: IVpnManagedRuntimeInvalidation) => {
       this.emit('managed-runtime-invalidated', data);
     });
+    this.bridge.on('management:managed-session-state', (data: IVpnManagedSessionEvent) => {
+      this.emit('managed-session-state', data);
+    });
     this.bridge.on('management:status', (data: any) => {
       this.emit('status', data);
     });

package/ts/smartvpn.classes.vpnclient.ts

@@ -10,6 +10,9 @@ import type {
   IVpnConnectionResult,
   IVpnManagedRuntime,
   IVpnManagedRuntimeInvalidation,
+  IVpnManagedSessionConfig,
+  IVpnManagedSession,
+  IVpnManagedSessionEvent,
   TVpnClientCommands,
 } from './smartvpn.interfaces.js';
 
@@ -22,6 +25,10 @@ export class VpnClient extends plugins.events.EventEmitter {
   private bridgeEpoch = 0;
   private managedGeneration?: string;
   private lastInvalidatedGeneration?: string;
+  private sessionGeneration?: string;
+  private stoppedSessionGeneration?: string;
+  private retiredSessionGeneration?: string;
+  private invalidatedSessionGeneration?: string;
 
   constructor(options: IVpnClientOptions) {
     super();
@@ -50,6 +57,19 @@ export class VpnClient extends plugins.events.EventEmitter {
     this.bridge.on('managed-runtime-invalidated', (event: IVpnManagedRuntimeInvalidation) => {
       this.invalidateGeneration(event);
     });
+    this.bridge.on('managed-session-state', (event: IVpnManagedSessionEvent) => {
+      this.observeSessionEvent(event);
+    });
+  }
+
+  private observeSessionEvent(event: IVpnManagedSessionEvent): void {
+    if (event.phase === 'retired') {
+      this.retiredSessionGeneration = event.generation;
+      if (this.sessionGeneration === event.generation) this.sessionGeneration = undefined;
+    } else {
+      this.stoppedSessionGeneration = event.generation;
+    }
+    this.emit('managed-session-state', event);
   }
 
   private invalidateGeneration(event: IVpnManagedRuntimeInvalidation): void {
@@ -62,6 +82,71 @@ export class VpnClient extends plugins.events.EventEmitter {
   private invalidateBridge(reason: string): void {
     this.bridgeEpoch++;
     if (this.managedGeneration) this.invalidateGeneration({ generation: this.managedGeneration, reason });
+    if (this.sessionGeneration) {
+      const generation = this.sessionGeneration;
+      this.invalidatedSessionGeneration = generation;
+      this.sessionGeneration = undefined;
+      this.emit('managed-session-invalidated', { generation, reason });
+    }
+  }
+
+  private checkSession(result: IVpnManagedSession, epoch: number, generation?: string): void {
+    const observed = result.plan.generation;
+    if (epoch !== this.bridgeEpoch || observed === this.retiredSessionGeneration
+      || observed === this.invalidatedSessionGeneration
+      || (generation !== undefined && observed !== generation)
+      || (observed === this.stoppedSessionGeneration && result.phase !== 'stopped')) {
+      throw new Error('Managed session stopped, retired, or lost observation during the operation');
+    }
+    if (result.runtime) {
+      this.checkObservation(result.runtime, epoch, observed);
+      this.managedGeneration = observed;
+    }
+  }
+
+  /** Authenticate and retain transport/keepalive without any TUN or route effect. */
+  public async authenticateManaged(config: IVpnManagedSessionConfig): Promise<IVpnManagedSession> {
+    const epoch = this.bridgeEpoch;
+    const result = await this.bridge.sendCommand('authenticateManaged', { config });
+    this.checkSession(result, epoch);
+    this.sessionGeneration = result.plan.generation;
+    return result;
+  }
+
+  /** Create the planned exclusive /32 TUN and split routes with forwarding disabled.
+   * Caller must authorize these exact native transitions before calling. */
+  public prepareManagedTunnel(generation: string): Promise<IVpnManagedSession> {
+    return this.sessionCommand('prepareManagedTunnel', generation);
+  }
+
+  /** Reinspect, discard ready pre-enable inputs, then start forwarding. Call only
+   * after caller-owned policy is installed and verified against the prepared TUN. */
+  public enableManagedForwarding(generation: string): Promise<IVpnManagedSession> {
+    return this.sessionCommand('enableManagedForwarding', generation);
+  }
+
+  /** Terminally stop packet I/O and retain the TUN for caller-authorized teardown.
+   * This generation cannot forward again. Disconnect then closes its kernel owner. */
+  public stopManagedForwarding(generation: string): Promise<IVpnManagedSession> {
+    return this.sessionCommand('stopManagedForwarding', generation);
+  }
+
+  public inspectManagedSession(generation: string): Promise<IVpnManagedSession> {
+    return this.sessionCommand('inspectManagedSession', generation);
+  }
+
+  private async sessionCommand(method: 'prepareManagedTunnel' | 'enableManagedForwarding'
+    | 'stopManagedForwarding' | 'inspectManagedSession', generation: string): Promise<IVpnManagedSession> {
+    if (typeof generation !== 'string' || !/^[a-f0-9]{32}$/.test(generation)) {
+      throw new Error('Managed session generation must be a native 128-bit identifier');
+    }
+    if (generation === this.invalidatedSessionGeneration || generation === this.retiredSessionGeneration) {
+      throw new Error('Managed session observation is unavailable');
+    }
+    const epoch = this.bridgeEpoch;
+    const result = await this.bridge.sendCommand(method, { generation });
+    this.checkSession(result, epoch, generation);
+    return result;
   }
 
   private checkObservation(runtime: IVpnManagedRuntime, epoch: number, generation?: string): void {
@@ -144,7 +229,8 @@ export class VpnClient extends plugins.events.EventEmitter {
   }
 
   /**
-   * Stop the daemon bridge and wait for confirmed ownership release.
+   * Stop and join an owned stdio daemon. Socket mode only closes the bridge;
+   * disconnect() must first join the independently owned native session.
    */
   public async stop(): Promise<void> {
     this.invalidateBridge('Client stop requested');

package/ts/smartvpn.interfaces.ts

@@ -491,6 +491,11 @@ export interface IWgPeerInfo {
 // ============================================================================
 
 export type TVpnClientCommands = {
+  authenticateManaged: { params: { config: IVpnManagedSessionConfig }; result: IVpnManagedSession };
+  prepareManagedTunnel: { params: { generation: string }; result: IVpnManagedSession };
+  enableManagedForwarding: { params: { generation: string }; result: IVpnManagedSession };
+  stopManagedForwarding: { params: { generation: string }; result: IVpnManagedSession };
+  inspectManagedSession: { params: { generation: string }; result: IVpnManagedSession };
   connect: { params: { config: IVpnClientConfig }; result: IVpnConnectionResult };
   inspectManagedRuntime: { params: { generation: string }; result: IVpnManagedRuntime };
   disconnect: { params: Record<string, never>; result: void };
@@ -548,6 +553,7 @@ export interface IManagedNetworkNode {
   controlAddress: string;
   controlPolicyDomain: string;
   enabled: boolean;
+  /** Credential expiry (ISO 8601); renewing only this keeps the node's live session. */
   expiresAt?: string;
   workloadPrefixes: IManagedNetworkPrefix[];
 }
@@ -605,6 +611,68 @@ export interface IVpnConnectionResult {
   managedRuntime?: IVpnManagedRuntime;
 }
 
+/** Linux native client with explicit kernel-effect stages. The caller supplies
+ * a conservative deadline from its independently qualified clock authority. */
+export interface IVpnManagedSessionConfig {
+  serverUrl: string;
+  serverPublicKey: string;
+  clientPrivateKey: string;
+  clientPublicKey: string;
+  transport: 'quic' | 'websocket';
+  serverCertHash?: string;
+  mtu?: number;
+  managedNetwork: IManagedNetworkBinding;
+  /** Same native boot; deadline must be future and at most fifteen minutes away.
+   * Expiry stops packet I/O even across suspend. It does not delete a held TUN. */
+  lease: { bootId: string; deadlineBoottimeMs: number };
+}
+
+/** Authentication returns the full validated assignment and planned exclusive
+ * TUN name before creating a device or route. Kernel policy remains caller-owned. */
+export interface IVpnManagedSessionPlan {
+  schemaVersion: 1;
+  generation: string;
+  namespace: { device: string; inode: string };
+  interfaceName: string;
+  assignment: {
+    assignedIp: string;
+    gateway: string;
+    subnet: string;
+    mtu: number;
+    effectiveMtu: number;
+    managed: IManagedNetworkAssignment;
+  };
+  mtu: number;
+  remoteIp: string;
+  lease: IVpnManagedSessionConfig['lease'];
+}
+
+export interface IVpnManagedSession {
+  plan: IVpnManagedSessionPlan;
+  phase: 'authenticated' | 'prepared' | 'forwarding' | 'stopped';
+  /** Fresh native inspection when present. Prepared TUN is UP with forwarding
+   * disabled. A stopped TUN stays owned until disconnect() joins deletion, or an
+   * owned stdio process is joined by stop(). Socket stop() does not delete it. */
+  runtime: IVpnManagedRuntime | null;
+}
+
+/** Stopped means the complete packet I/O future ended; retired means the native
+ * session owner ended. Neither proves namespace-wide cleanup, conntrack drain,
+ * packets already queued on the network, or safe allocation reuse. */
+export interface IVpnManagedSessionEvent {
+  generation: string;
+  phase: 'stopped' | 'retired';
+  reason: string;
+}
+
+/** The facade lost observation of this generation. Native packet I/O and TUN
+ * ownership may remain alive, especially with an independent socket daemon.
+ * This is neither a stopped nor a retired native lifecycle acknowledgement. */
+export interface IVpnManagedSessionInvalidation {
+  generation: string;
+  reason: string;
+}
+
 /** A fresh observation of a retained native lifetime, never a transferable or
  * restorable capability. The caller retains VpnClient and listens for invalidation.
  * IPv6, namespace-wide policy/rules, underlay and firewall remain caller-owned. */
@@ -669,6 +737,8 @@ export interface IVpnServiceUnit {
 // ============================================================================
 
 export interface IVpnEventMap {
+  'managed-session-state': IVpnManagedSessionEvent;
+  'managed-session-invalidated': IVpnManagedSessionInvalidation;
   'managed-runtime-invalidated': IVpnManagedRuntimeInvalidation;
   'status': IVpnStatus;
   'error': { message: string; code?: string };