@push.rocks/smartvpn 2.3.0 → 2.3.1

package/dist_rust/smartvpn_daemon_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "bb4eeb71f5b13b197999ea809e05876625df2c93b7600fdfbe56db10970e6589",
+  "binarySha256": "d4e6f89ac9278183338ea8a83fd112ef8b7516576057234f7bab8181291089a1",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.3.0",
-    "gitCommit": "4fd05874f4792ba89c6b0fa6cb168434e5c9ee25",
+    "projectVersion": "2.3.1",
+    "gitCommit": "a96a22bd5ff5fe870e72c225b51f4715c1b25c40",
     "gitDirty": false,
-    "builtAt": "2026-09-15T09:32:44.556Z",
+    "builtAt": "2026-09-17T15:20:47.136Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_amd64_musl"

package/dist_rust/smartvpn_daemon_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "37bc9e0af746d3f799753b605fd6b025cfc3f83b3f225e6bece5ab8ec167f98d",
+  "binarySha256": "9c8bdf211d7bbb9425e7dcf44ead8b39b584e6fd1b18cfdddff07b51133fb16d",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.3.0",
-    "gitCommit": "4fd05874f4792ba89c6b0fa6cb168434e5c9ee25",
+    "projectVersion": "2.3.1",
+    "gitCommit": "a96a22bd5ff5fe870e72c225b51f4715c1b25c40",
     "gitDirty": false,
-    "builtAt": "2026-09-15T09:32:44.845Z",
+    "builtAt": "2026-09-17T15:20:47.476Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartvpn_daemon",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -2,8 +2,8 @@
  * autocreated commitinfo by @push.rocks/commitinfo
  */
 export const commitinfo = {
-    name: '@push.rocks/smartvpn',
-    version: '2.3.0',
-    description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
+    name: "@push.rocks/smartvpn",
+    version: "2.3.1",
+    description: "A VPN solution with TypeScript control plane and Rust data plane daemon"
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/smartvpn.interfaces.d.ts

@@ -642,6 +642,7 @@ export interface IManagedNetworkNode {
     controlAddress: string;
     controlPolicyDomain: string;
     enabled: boolean;
+    /** Credential expiry (ISO 8601); renewing only this keeps the node's live session. */
     expiresAt?: string;
     workloadPrefixes: IManagedNetworkPrefix[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",
@@ -31,8 +31,8 @@
     "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tsrust": "^1.13.0",
-    "@git.zone/tstest": "^6.0.0",
-    "@types/node": "^26.5.0"
+    "@git.zone/tstest": "^6.1.1",
+    "@types/node": "^26.5.1"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -784,8 +784,16 @@ are never routed back to the hub merely because a grant involves them.
 
 Invalid preparation preserves active authority. A valid change quarantines and
 cancels only affected node generations, joins their packet work, prepares WG
-crypto and commits the whole snapshot atomically before acknowledging. Unchanged
-nodes keep their sessions. A post-drain failure leaves `state: 'failed'`, its
+crypto and commits the whole snapshot atomically before acknowledging. A node is
+affected when it is added or removed, or when its keys, control address or domain,
+`enabled`, workload prefixes, or the grants and routes involving it change.
+Unchanged nodes keep their sessions. A change to `expiresAt` alone does not affect
+a node: its live native or WireGuard session stays connected and follows the
+committed expiry in place. A later expiry keeps the session, an earlier future
+expiry re-arms its deadline, and an expiry that has already passed ends it when
+the snapshot commits. A session whose expiry passed is never revived, so renew
+before expiry; after a late renewal the node can reconnect with its unchanged keys.
+A post-drain failure leaves `state: 'failed'`, its
 `pendingRevision` and bounded `lastError`; old affected admission stays closed.
 Only the exact pending snapshot can retry. An IPC timeout or disconnected caller
 does not cancel the process-owned operation. Inspect status and replay that exact

package/ts/00_commitinfo_data.ts

@@ -2,7 +2,7 @@
  * autocreated commitinfo by @push.rocks/commitinfo
  */
 export const commitinfo = {
-  name: '@push.rocks/smartvpn',
-  version: '2.3.0',
-  description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
+  name: "@push.rocks/smartvpn",
+  version: "2.3.1",
+  description: "A VPN solution with TypeScript control plane and Rust data plane daemon"
 }

package/ts/smartvpn.interfaces.ts

@@ -553,6 +553,7 @@ export interface IManagedNetworkNode {
   controlAddress: string;
   controlPolicyDomain: string;
   enabled: boolean;
+  /** Credential expiry (ISO 8601); renewing only this keeps the node's live session. */
   expiresAt?: string;
   workloadPrefixes: IManagedNetworkPrefix[];
 }