@push.rocks/smartvpn 2.7.1 → 2.8.0

package/dist_rust/smartvpn_daemon_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "e06e9bec1206146c13370d105610c056dd3684cca29d1280e7befd5a08c34e99",
+  "binarySha256": "99bac3443522361425a0f038061de8764c0cdaa5aae7bc0a81ff978b7743e86a",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.7.1",
-    "gitCommit": "d1bbbeaec9ed99d89334375aa615471c3f2615ef",
+    "projectVersion": "2.8.0",
+    "gitCommit": "ea2b91234508f2befa1ee7da1187bc343700617f",
     "gitDirty": false,
-    "builtAt": "2026-10-26T21:48:04.722Z",
+    "builtAt": "2026-10-30T14:29:11.081Z",
     "tsrustVersion": "1.1.1",
     "binary": "smartvpn_daemon",
     "target": "linux_amd64_musl"

package/dist_rust/smartvpn_daemon_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "8ae1a19ef3b0b11251a3af628ef1caaf7ff81d0c66b8033c32fccf8da4271e77",
+  "binarySha256": "0f394f849bbb515b3e59dc3766884d28fdc401289cc90d8dcb423398863bcc12",
   "buildInfo": {
     "projectName": "@push.rocks/smartvpn",
-    "projectVersion": "2.7.1",
-    "gitCommit": "d1bbbeaec9ed99d89334375aa615471c3f2615ef",
+    "projectVersion": "2.8.0",
+    "gitCommit": "ea2b91234508f2befa1ee7da1187bc343700617f",
     "gitDirty": false,
-    "builtAt": "2026-10-26T21:50:58.538Z",
+    "builtAt": "2026-10-30T14:31:16.358Z",
     "tsrustVersion": "1.1.1",
     "binary": "smartvpn_daemon",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartvpn',
-    version: '2.7.1',
+    version: '2.8.0',
     description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlFQUF5RTtDQUN2RixDQUFBIn0=

package/dist_ts/index.d.ts

@@ -1,4 +1,5 @@
 export * from './smartvpn.interfaces.js';
+export { managedPreparationBoundMs } from './smartvpn.managedbounds.js';
 export { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export { VpnClient } from './smartvpn.classes.vpnclient.js';
 export { VpnServer } from './smartvpn.classes.vpnserver.js';

package/dist_ts/index.js

@@ -1,8 +1,9 @@
 export * from './smartvpn.interfaces.js';
+export { managedPreparationBoundMs } from './smartvpn.managedbounds.js';
 export { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export { VpnClient } from './smartvpn.classes.vpnclient.js';
 export { VpnServer } from './smartvpn.classes.vpnserver.js';
 export { VpnConfig } from './smartvpn.classes.vpnconfig.js';
 export { VpnInstaller } from './smartvpn.classes.vpninstaller.js';
 export { WgConfigGenerator } from './smartvpn.classes.wgconfig.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDNUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzVELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0NBQW9DLENBQUM7QUFDbEUsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sZ0NBQWdDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDNUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzVELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0NBQW9DLENBQUM7QUFDbEUsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sZ0NBQWdDLENBQUMifQ==

package/dist_ts/smartvpn.managedbounds.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The sum of a managed tunnel preparation's two timed steps, in milliseconds: adding the split
+ * routes, then auditing the device that holds them, each ended by its own bound and by name.
+ * Creating and configuring the device runs before them in blocking ioctls with no bound of its own,
+ * so a caller's window is the only limit on that part. A
+ * caller arming its own window around `prepareManagedTunnel` keeps that window longer than this, so
+ * SmartVPN names a failed step before the window fires. A hub assignment update that lands during
+ * the preparation is applied before the prepare answers and is not covered.
+ */
+export declare const managedPreparationBoundMs = 6000;

package/dist_ts/smartvpn.managedbounds.js

@@ -0,0 +1,11 @@
+/**
+ * The sum of a managed tunnel preparation's two timed steps, in milliseconds: adding the split
+ * routes, then auditing the device that holds them, each ended by its own bound and by name.
+ * Creating and configuring the device runs before them in blocking ioctls with no bound of its own,
+ * so a caller's window is the only limit on that part. A
+ * caller arming its own window around `prepareManagedTunnel` keeps that window longer than this, so
+ * SmartVPN names a failed step before the window fires. A hub assignment update that lands during
+ * the preparation is applied before the prepare answers and is not covered.
+ */
+export const managedPreparationBoundMs = 6000;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnR2cG4ubWFuYWdlZGJvdW5kcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0dnBuLm1hbmFnZWRib3VuZHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxJQUFJLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartvpn",
-  "version": "2.7.1",
+  "version": "2.8.0",
   "private": false,
   "description": "A VPN solution with TypeScript control plane and Rust data plane daemon",
   "type": "module",

package/readme.md

@@ -214,7 +214,13 @@ starting. Keep the live client owner and use the returned generation for each st
    `prepareManagedTunnel(generation)` then creates that fresh nonpersistent TUN
    with `IFF_TUN_EXCL`, the assigned IPv4 /32 and exact split routes. The interface
    is UP; packet forwarding remains disabled. An existing same-named interface
-   causes failure and is never adopted or deleted.
+   causes failure and is never adopted or deleted. Creating and configuring the device runs first, in blocking ioctls with no bound of its own, so a caller's window is the only limit on that part. The two timed steps after it take at most
+   `managedPreparationBoundMs` (6 seconds): adding the routes and auditing the device,
+   3 seconds each, one after the other, and a step that overruns fails the prepare by
+   name (`Managed route creation timed out`, `Managed kernel inventory timed out`)
+   with the device and its routes gone. A caller that arms its own window around the
+   prepare keeps it longer than that bound. A hub assignment update that lands during
+   the prepare is applied before the reply and adds its own route and audit steps.
 3. Install and verify caller-owned policy against the fresh returned `runtime`.
    `enableManagedForwarding(generation)` reinspects the native inventory, discards
    already-ready incoming encrypted frames and TUN packets, then starts forwarding.
@@ -1185,6 +1191,7 @@ smartvpn/
 │   ├── smartvpn.interfaces.ts  # Interfaces, types, IPC command maps
 │   ├── smartvpn.plugins.ts     # Dependency imports
 │   ├── smartvpn.paths.ts       # Binary path resolution
+│   ├── smartvpn.managedbounds.ts # Managed preparation bound (`managedPreparationBoundMs`)
 │   ├── smartvpn.classes.vpnserver.ts
 │   ├── smartvpn.classes.vpnclient.ts
 │   ├── smartvpn.classes.vpnbridge.ts

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartvpn',
-  version: '2.7.1',
+  version: '2.8.0',
   description: 'A VPN solution with TypeScript control plane and Rust data plane daemon'
 }

package/ts/index.ts

@@ -1,4 +1,5 @@
 export * from './smartvpn.interfaces.js';
+export { managedPreparationBoundMs } from './smartvpn.managedbounds.js';
 export { VpnBridge } from './smartvpn.classes.vpnbridge.js';
 export { VpnClient } from './smartvpn.classes.vpnclient.js';
 export { VpnServer } from './smartvpn.classes.vpnserver.js';

package/ts/smartvpn.managedbounds.ts

@@ -0,0 +1,10 @@
+/**
+ * The sum of a managed tunnel preparation's two timed steps, in milliseconds: adding the split
+ * routes, then auditing the device that holds them, each ended by its own bound and by name.
+ * Creating and configuring the device runs before them in blocking ioctls with no bound of its own,
+ * so a caller's window is the only limit on that part. A
+ * caller arming its own window around `prepareManagedTunnel` keeps that window longer than this, so
+ * SmartVPN names a failed step before the window fires. A hub assignment update that lands during
+ * the preparation is applied before the prepare answers and is not covered.
+ */
+export const managedPreparationBoundMs = 6000;