@push.rocks/smartvpn 2.7.0 → 2.8.0

package/dist_rust/smartvpn_daemon_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "9a5aed62511c9afb659443f5274fdf71fd168206722b3c474f17311e761f8683",
+  "binarySha256": "99bac3443522361425a0f038061de8764c0cdaa5aae7bc0a81ff978b7743e86a",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.7.0",
-    "gitCommit": "02b302a29e212742fa3e1a9e2160f3858e0d6ea7",
+    "projectVersion": "2.8.0",
+    "gitCommit": "ea2b91234508f2befa1ee7da1187bc343700617f",
     "gitDirty": false,
-    "builtAt": "2026-10-14T23:00:02.136Z",
-    "tsrustVersion": "4.5.1",
+    "builtAt": "2026-10-30T14:29:11.081Z",
+    "tsrustVersion": "1.1.1",
     "binary": "smartvpn_daemon",
     "target": "linux_amd64_musl"
   }

package/dist_rust/smartvpn_daemon_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "c09d9af20517c278fbcee6db74e24a44447ab3e173e88955a2b595cd796b3603",
+  "binarySha256": "0f394f849bbb515b3e59dc3766884d28fdc401289cc90d8dcb423398863bcc12",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.7.0",
-    "gitCommit": "02b302a29e212742fa3e1a9e2160f3858e0d6ea7",
+    "projectVersion": "2.8.0",
+    "gitCommit": "ea2b91234508f2befa1ee7da1187bc343700617f",
     "gitDirty": false,
-    "builtAt": "2026-10-14T23:02:32.733Z",
-    "tsrustVersion": "4.5.1",
+    "builtAt": "2026-10-30T14:31:16.358Z",
+    "tsrustVersion": "1.1.1",
     "binary": "smartvpn_daemon",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartvpn',
-    version: '2.7.0',
+    version: '2.8.0',
     description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/index.d.ts

@@ -1,4 +1,5 @@
 export * from './smartvpn.interfaces.js';
+export { managedPreparationBoundMs } from './smartvpn.managedbounds.js';
 export { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export { VpnClient } from './smartvpn.classes.vpnclient.js';
 export { VpnServer } from './smartvpn.classes.vpnserver.js';

package/dist_ts/index.js

@@ -1,8 +1,9 @@
 export * from './smartvpn.interfaces.js';
+export { managedPreparationBoundMs } from './smartvpn.managedbounds.js';
 export { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export { VpnClient } from './smartvpn.classes.vpnclient.js';
 export { VpnServer } from './smartvpn.classes.vpnserver.js';
 export { VpnConfig } from './smartvpn.classes.vpnconfig.js';
 export { VpnInstaller } from './smartvpn.classes.vpninstaller.js';
 export { WgConfigGenerator } from './smartvpn.classes.wgconfig.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDNUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzVELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0NBQW9DLENBQUM7QUFDbEUsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sZ0NBQWdDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDNUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzVELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0NBQW9DLENBQUM7QUFDbEUsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sZ0NBQWdDLENBQUMifQ==

package/dist_ts/smartvpn.managedbounds.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The sum of a managed tunnel preparation's two timed steps, in milliseconds: adding the split
+ * routes, then auditing the device that holds them, each ended by its own bound and by name.
+ * Creating and configuring the device runs before them in blocking ioctls with no bound of its own,
+ * so a caller's window is the only limit on that part. A
+ * caller arming its own window around `prepareManagedTunnel` keeps that window longer than this, so
+ * SmartVPN names a failed step before the window fires. A hub assignment update that lands during
+ * the preparation is applied before the prepare answers and is not covered.
+ */
+export declare const managedPreparationBoundMs = 6000;

package/dist_ts/smartvpn.managedbounds.js

@@ -0,0 +1,11 @@
+/**
+ * The sum of a managed tunnel preparation's two timed steps, in milliseconds: adding the split
+ * routes, then auditing the device that holds them, each ended by its own bound and by name.
+ * Creating and configuring the device runs before them in blocking ioctls with no bound of its own,
+ * so a caller's window is the only limit on that part. A
+ * caller arming its own window around `prepareManagedTunnel` keeps that window longer than this, so
+ * SmartVPN names a failed step before the window fires. A hub assignment update that lands during
+ * the preparation is applied before the prepare answers and is not covered.
+ */
+export const managedPreparationBoundMs = 6000;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4ubWFuYWdlZGJvdW5kcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0dnBuLm1hbmFnZWRib3VuZHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxJQUFJLENBQUMifQ==

package/notices/cargo-dependencies.html

@@ -1602,6 +1602,32 @@ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
 IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.</pre>
 </section>
+<section>
+  <h2>MIT License (MIT)</h2>
+  <ul>
+    <li>tikv-jemalloc-ctl 0.7.0</li>
+  </ul>
+  <pre>Copyright (c) 2017 Steven Fackler
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the &quot;Software&quot;), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+</pre>
+</section>
 <section>
   <h2>MIT License (MIT)</h2>
   <ul>
@@ -3534,6 +3560,7 @@ DEALINGS IN THE SOFTWARE.</pre>
     <li>itoa 1.0.17</li>
     <li>once_cell 1.21.3</li>
     <li>parking 2.2.1</li>
+    <li>paste 1.0.15</li>
     <li>pin-project-lite 0.2.16</li>
     <li>piper 0.2.4</li>
     <li>proc-macro2 1.0.106</li>

package/notices/inventory.json

@@ -5,7 +5,7 @@
   "files": {
     "assets/third-party-licenses.md": "6be2373e39312d90eb3571bef614c89df565f98c917795d7aea3497f52ef19f1",
     "notices/aho-corasick-license.txt": "0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f",
-    "notices/cargo-dependencies.html": "39c9877784b7b77bf2a9ba6f4d71fd0c791230ca79b10180b57c578408b3d291",
+    "notices/cargo-dependencies.html": "16aba7d84413a8e418b4a2bfb6c1e2ed97fd5df834380501630a5694d37dcc4a",
     "notices/compiler-builtins-license.txt": "ab6eec6caf0fa5775e411c7a8bc6a45c4ef2956b0980b157ab74fc5cd62a928b",
     "notices/defmt-license.txt": "0d17b75c1867fd568bcbb735f329d0d4253846c4b756a65e4d440c1e4bd59187",
     "notices/jemalloc-license.txt": "94aa2caa98c25d942f58b956c71dba6a99ff98fc3a31cbc669fe2a4cd0268b53",
@@ -17,11 +17,11 @@
     "notices/valuable-license.txt": "ed60d479b8fd1f64e9cbc3de449a16a53ac1b3d1b6aeb9bf9d190a8e93061b44",
     "rust-toolchain.toml": "19da9ff32e229a69ff5dde28ac23233256ff25e413a8c579155cf641f4f0634f",
     "rust/.cargo/config.toml": "eb6896791bd573f2cb099aa41c7d3668c6d368166945abd3553c8d8029ba8b7b",
-    "rust/Cargo.lock": "2e05b92f0002e6bcea69c94b900821bb4fa36bb4f22d3112f186cea1bc761e89",
-    "rust/Cargo.toml": "f65fa4e7ebaad6aed9fcf66011dd0f0a0f5253b26b656ad672300b99e3040704",
+    "rust/Cargo.lock": "1684d251ee05413f0305152879a2a1d993dfb51682a8e393e24cc8cab25bac51",
+    "rust/Cargo.toml": "6bf9e1f26e6f137f1a6af8f624e320dcdc14aa07612758d1c095cf8b09bbabb0",
     "rust/about.hbs": "a7c35d089563a08520a6e5f351aadae659e1f7bf24cabedbca3de8a89e966f86",
     "rust/about.toml": "a457e0cc7532020c0f87532919a754997213ccbec6211c9501b8c198d404ed72",
-    "third-party-notices.md": "be663adf30d43caa602953e6b98d91c1b0fe3d221041389fe616bf6fcdf40b00"
+    "third-party-notices.md": "97f0781c96dd6628f6a3488f1f1e7706012d7c8a8deace551009d06fad8e16a1"
   },
   "supplementalCargoNotices": {
     "aho-corasick@1.1.4": "notices/aho-corasick-license.txt",
@@ -664,6 +664,11 @@
       "version": "0.9.12",
       "license": "MIT OR Apache-2.0"
     },
+    {
+      "name": "paste",
+      "version": "1.0.15",
+      "license": "MIT OR Apache-2.0"
+    },
     {
       "name": "pem",
       "version": "3.0.6",
@@ -999,6 +1004,11 @@
       "version": "1.1.9",
       "license": "MIT OR Apache-2.0"
     },
+    {
+      "name": "tikv-jemalloc-ctl",
+      "version": "0.7.0",
+      "license": "MIT/Apache-2.0"
+    },
     {
       "name": "tikv-jemalloc-sys",
       "version": "0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",
@@ -29,11 +29,9 @@
     "@push.rocks/smartsea": "^1.0.1"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^6.0.2",
-    "@git.zone/tsrun": "^3.0.3",
-    "@git.zone/tsrust": "^4.5.1",
-    "@git.zone/tstest": "^8.0.0",
-    "@types/node": "^26.6.4"
+    "@git.zone/rsrepo": "^1.1.1",
+    "@git.zone/tsrepo": "^1.1.1",
+    "@types/node": "^26.6.5"
   },
   "files": [
     "ts/**/*",
@@ -55,11 +53,11 @@
     ]
   },
   "scripts": {
-    "build": "(tsbuild tsfolders) && (tsrust)",
-    "build:release": "(tsbuild tsfolders) && (tsrust --configured-targets) && (tsrust verify)",
-    "test:before": "(tsrust)",
-    "test": "tstest test/ --verbose  --logfile --timeout 90",
+    "build": "(tsrepo build tsfolders) && (rsrepo)",
+    "build:release": "(tsrepo build tsfolders) && (rsrepo --configured-targets) && (rsrepo verify)",
+    "test:before": "(rsrepo)",
+    "test": "tsrepo test test/ --verbose  --logfile --timeout 90",
     "test:rust": "cd rust && cargo test",
-    "buildDocs": "tsdoc"
+    "buildDocs": "tsrepo docs"
   }
 }

package/readme.md

@@ -130,7 +130,10 @@ A Linux stdio client accepts `networkNamespaceFd` in `IVpnClientOptions`. Pass a
 already open network namespace descriptor; the caller retains ownership and keeps
 it valid through each `start()`. The child validates its inherited duplicate,
 enters the namespace before creating runtime threads or sockets, then closes the
-duplicate. Invalid descriptors and failed entry cannot produce a ready client.
+duplicate. jemalloc's background purge threads start after entry too, so every
+thread of the daemon runs in the namespace. A child that already runs another
+thread at entry, for example under `_RJEM_MALLOC_CONF=background_thread:true`,
+refuses to start. Invalid descriptors and failed entry cannot produce a ready client.
 Stopping the client waits for process termination before the caller releases its
 namespace owner. A running child remains in its namespace if the caller closes
 the original descriptor, but a later start still requires a valid descriptor.
@@ -211,7 +214,13 @@ starting. Keep the live client owner and use the returned generation for each st
    `prepareManagedTunnel(generation)` then creates that fresh nonpersistent TUN
    with `IFF_TUN_EXCL`, the assigned IPv4 /32 and exact split routes. The interface
    is UP; packet forwarding remains disabled. An existing same-named interface
-   causes failure and is never adopted or deleted.
+   causes failure and is never adopted or deleted. Creating and configuring the device runs first, in blocking ioctls with no bound of its own, so a caller's window is the only limit on that part. The two timed steps after it take at most
+   `managedPreparationBoundMs` (6 seconds): adding the routes and auditing the device,
+   3 seconds each, one after the other, and a step that overruns fails the prepare by
+   name (`Managed route creation timed out`, `Managed kernel inventory timed out`)
+   with the device and its routes gone. A caller that arms its own window around the
+   prepare keeps it longer than that bound. A hub assignment update that lands during
+   the prepare is applied before the reply and adds its own route and audit steps.
 3. Install and verify caller-owned policy against the fresh returned `runtime`.
    `enableManagedForwarding(generation)` reinspects the native inventory, discards
    already-ready incoming encrypted frames and TUN packets, then starts forwarding.
@@ -241,6 +250,19 @@ policy removal, conntrack drainage, delivery of previously queued network packet
 or safe allocation reuse. IPv6, underlay, workload links, sysctls, global routes and
 firewall policy remain the caller's responsibility.
 
+Apart from the retirement on changed or restored kernel inventory above, SmartVPN
+never deletes a device it made unless its owner releases it with `disconnect()` (or
+`stop()`). A prepare accepted before the session stops, whether by transport loss,
+the relay's `Disconnect`, `stopManagedForwarding` or lease expiry, still runs to its
+own end, which its route and audit steps bound (3 seconds each). A TUN it made
+stays, with the same interface index, in the stopped session's custody. Only then
+does the prepare reject, with the stopped session's refusal `Stopped managed session
+cannot restart`, and the `stopped` event follows.
+`inspectManagedSession(generation)` reports phase `stopped` with that device as
+`runtime`; it holds the split routes of the assignment it was prepared for
+(`runtime.assignment`). A rejected prepare therefore does not prove that no device
+exists: inspect, and lower a device that is still there, before disconnecting.
+
 ### Retained managed TUN runtime
 
 An authenticated native managed connection with `forwardingMode: 'tun'` returns
@@ -1157,7 +1179,7 @@ pnpm test
 cd rust && cargo test
 
 # Run a specific TS test
-tstest test/test.flowcontrol.node.ts --verbose
+pnpm exec tsrepo test test/test.flowcontrol.node.ts --verbose
 ```
 
 ### Project Structure
@@ -1169,6 +1191,7 @@ smartvpn/
 │   ├── smartvpn.interfaces.ts  # Interfaces, types, IPC command maps
 │   ├── smartvpn.plugins.ts     # Dependency imports
 │   ├── smartvpn.paths.ts       # Binary path resolution
+│   ├── smartvpn.managedbounds.ts # Managed preparation bound (`managedPreparationBoundMs`)
 │   ├── smartvpn.classes.vpnserver.ts
 │   ├── smartvpn.classes.vpnclient.ts
 │   ├── smartvpn.classes.vpnbridge.ts

package/third-party-notices.md

@@ -6,7 +6,7 @@ SmartVPN's own code is MIT-licensed under [license.md](./license.md).
 ## Cargo dependencies
 
 [Cargo dependency notices](./notices/cargo-dependencies.html) reproduce the selected
-upstream license and copyright texts for 270 third-party packages. Eight additional
+upstream license and copyright texts for 272 third-party packages. Eight additional
 locked, feature-inactive packages are covered by these supplemental MIT notices:
 
 - [aho-corasick 1.1.4](./notices/aho-corasick-license.txt), from the published crate's `LICENSE-MIT`.
@@ -22,7 +22,7 @@ locked, feature-inactive packages are covered by these supplemental MIT notices:
 - [valuable 0.1.1](./notices/valuable-license.txt), from
   [its pinned upstream LICENSE](https://github.com/tokio-rs/valuable/blob/9efc29b6e58cef28f6566a47aa7e142a55fead77/LICENSE).
 
-Together these cover all 278 locked external packages, conservatively including
+Together these cover all 280 locked external packages, conservatively including
 build-only and target-inactive dependencies. Listing a package does not mean it
 is linked into either Linux executable. MIT is preferred where offered as an
 alternative; other selected terms include Apache-2.0, BSD, ISC, Unicode-3.0,

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartvpn',
-  version: '2.7.0',
+  version: '2.8.0',
   description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 }

package/ts/index.ts

@@ -1,4 +1,5 @@
 export * from './smartvpn.interfaces.js';
+export { managedPreparationBoundMs } from './smartvpn.managedbounds.js';
 export { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export { VpnClient } from './smartvpn.classes.vpnclient.js';
 export { VpnServer } from './smartvpn.classes.vpnserver.js';

package/ts/smartvpn.managedbounds.ts

@@ -0,0 +1,10 @@
+/**
+ * The sum of a managed tunnel preparation's two timed steps, in milliseconds: adding the split
+ * routes, then auditing the device that holds them, each ended by its own bound and by name.
+ * Creating and configuring the device runs before them in blocking ioctls with no bound of its own,
+ * so a caller's window is the only limit on that part. A
+ * caller arming its own window around `prepareManagedTunnel` keeps that window longer than this, so
+ * SmartVPN names a failed step before the window fires. A hub assignment update that lands during
+ * the preparation is applied before the prepare answers and is not covered.
+ */
+export const managedPreparationBoundMs = 6000;