changelog.md for @push.rocks/smartvpn

2026-03-31 - 1.17.1 - fix(readme)

document per-transport metrics and handshake-driven WireGuard connection state

Add README examples for getStatistics() per-transport active client and total connection counters Clarify that WireGuard peers are marked connected only after a successful handshake and disconnect after idle timeout Refresh API and project structure documentation to reflect newly documented stats fields and source files

2026-03-31 - 1.17.0 - feat(wireguard)

track per-transport server statistics and make WireGuard clients active only after handshake

add websocket, quic, and wireguard active-client and total-connection counters to server statistics register WireGuard peers without marking them active until handshake/data is received, and remove them from active clients on expiration or idle timeout sync WireGuard byte counters into aggregate server stats independently of active client presence and expose new statistics fields in TypeScript interfaces

2026-03-31 - 1.16.5 - fix(rust-userspace-nat)

improve TCP session backpressure, buffering, and idle cleanup in userspace NAT

apply proper bridge-channel backpressure by reserving channel capacity before consuming smoltcp TCP data defer bridge sender initialization until the bridge task starts and track TCP session activity timestamps cap per-session pending TCP send buffers at 512KB and abort stalled sessions when clients cannot keep up add idle TCP session cleanup and switch NAT polling to a dynamic smoltcp-driven delay

2026-03-31 - 1.16.4 - fix(server)

Adds configured clients from the runtime registry to the WireGuard listener when the server starts. Ensures clients loaded from config can complete WireGuard handshakes without requiring separate peer registration. Logs a warning if automatic peer registration fails for an individual client.

2026-03-31 - 1.16.3 - fix(rust-nat)

defer TCP bridge startup until handshake completion and buffer partial NAT socket writes

Start TCP bridge tasks only after the smoltcp socket becomes active to prevent server data from arriving before the client handshake completes. Buffer pending TCP payloads and flush partial writes so bridge-to-socket data is not silently lost under backpressure. Keep closing TCP sessions alive until FIN processing completes and add logging for dropped packets when bridge or route channels are full.

2026-03-31 - 1.16.2 - fix(wireguard)

sync runtime peer management with client registration and derive the correct server public key from the WireGuard private key

Register, remove, and rotate WireGuard peers in the running listener when clients are added, deleted, or rekeyed. Generate client WireGuard configs with the public key derived from the configured WireGuard private key instead of reusing the generic server public key. Handle expired WireGuard sessions by re-initiating handshakes and mark client state as handshaking until the tunnel becomes active. Improve allowed IP matching and peer VPN IP extraction for runtime packet routing.

2026-03-30 - 1.16.1 - fix(rust/server)

add serde alias for clientAllowedIPs in server config

Accepts the camelCase clientAllowedIPs field when deserializing server configuration. Improves compatibility with existing or external configuration formats without changing runtime behavior.

2026-03-30 - 1.16.0 - feat(server)

add configurable client endpoint and allowed IPs for generated VPN configs

adds serverEndpoint to generated SmartVPN and WireGuard client configs so remote clients can use a public address instead of the listen address adds clientAllowedIPs to generated WireGuard configs to support full-tunnel or split-tunnel routing updates TypeScript interfaces to expose the new server configuration options

2026-03-30 - 1.15.0 - feat(vpnserver)

add nftables-backed destination policy enforcement for TUN mode

add @push.rocks/smartnftables dependency and export it through the plugin layer apply destination policy rules via nftables when starting the server in TUN mode add periodic nftables health checks and best-effort cleanup on server stop update documentation for destination routing policy, socket transport mode, trusted client tags, events, and service generation

2026-03-30 - 1.14.0 - feat(nat)

add destination routing policy support for socket-mode VPN traffic

introduce configurable destinationPolicy settings in server and TypeScript interfaces apply allow, block, and forceTarget routing decisions when creating TCP and UDP NAT sessions export ACL IP matching helper for destination policy evaluation

2026-03-30 - 1.13.0 - feat(client-registry)

separate trusted server-defined client tags from client-reported tags with legacy tag compatibility

Adds distinct serverDefinedClientTags and clientDefinedClientTags fields to client registry and TypeScript interfaces. Treats legacy tags values as serverDefinedClientTags during deserialization and server-side create/update flows for backward compatibility. Clarifies that only server-defined tags are trusted for access control while client-defined tags are informational only.

2026-03-30 - 1.12.0 - feat(server)

add optional PROXY protocol v2 headers for socket-based userspace NAT forwarding

introduce a socketForwardProxyProtocol server option in Rust and TypeScript interfaces pass the new setting into the userspace NAT engine and TCP bridge tasks prepend PROXY protocol v2 headers on outbound TCP connections when socket forwarding is enabled

2026-03-30 - 1.11.0 - feat(server)

unify WireGuard into the shared server transport pipeline

add integrated WireGuard server support to VpnServer with shared startup, shutdown, status, statistics, and peer management introduce transportMode 'all' as the default and add server config support for wgPrivateKey, wgListenPort, and preconfigured peers register WireGuard peers in the shared client registry and IP pool so they use the same forwarding engine, routing, and monitoring as WebSocket and QUIC clients expose transportType in server client info and update TypeScript interfaces and documentation to reflect unified multi-transport forwarding

2026-03-30 - 1.10.2 - fix(client)

wait for the connection task to shut down cleanly before disconnecting and increase test timeout

store the spawned client connection task handle and await it during disconnect with a 5 second timeout so the disconnect frame can be sent before closing increase the test script timeout from 60 seconds to 90 seconds to reduce flaky test runs

2026-03-29 - 1.10.1 - fix(test, docs, scripts)

correct test command verbosity, shorten load test timings, and document forwarding modes

Fixes the test script by removing the duplicated verbose flag in package.json. Reduces load test delays and burst sizes to keep keepalive and connection tests faster and more stable. Updates the README to describe forwardingMode options, userspace NAT support, and related configuration examples.

2026-03-29 - 1.10.0 - feat(rust-server, rust-client, ts-interfaces)

add configurable packet forwarding with TUN and userspace NAT modes

introduce forwardingMode options for client and server configuration interfaces add server-side forwarding engines for kernel TUN, userspace socket NAT, and testing mode add a smoltcp-based userspace NAT implementation for packet forwarding without root-only TUN routing enable client-side TUN forwarding support with route setup, packet I/O, and cleanup centralize raw packet destination IP extraction in tunnel utilities for shared routing logic update test command timeout and logging flags

2026-03-29 - 1.9.0 - feat(server)

add PROXY protocol v2 support for real client IP handling and connection ACLs

add PROXY protocol v2 parsing for WebSocket connections, including IPv4/IPv6 support, LOCAL command handling, and header read timeout protection
apply server-level connection IP block lists before the Noise handshake and enforce per-client source IP allow/block lists using the resolved remote address
expose proxy protocol configuration and remote client address fields in Rust and TypeScript interfaces, and document reverse-proxy usage in the README

2026-03-29 - 1.8.0 - feat(auth,client-registry)

add Noise IK client authentication with managed client registry and per-client ACL controls

switch the native tunnel handshake from Noise NK to Noise IK and require client keypairs in client configuration
add server-side client registry management APIs for creating, updating, disabling, rotating, listing, and exporting client configs
enforce client authorization from the registry during handshake and expose authenticated client metadata in server client info
introduce per-client security policies with source/destination ACLs and per-client rate limit settings
add Rust ACL matching support for exact IPs, CIDR ranges, wildcards, and IP ranges with test coverage

2026-03-29 - 1.7.0 - feat(rust-tests)

add end-to-end WireGuard UDP integration tests and align TypeScript build configuration

Add userspace Rust end-to-end tests that validate WireGuard handshake, encryption, peer isolation, and preshared-key data exchange over real UDP sockets.
Update the TypeScript build setup by removing the allowimplicitany build flag and explicitly including Node types in tsconfig.
Refresh development toolchain versions to support the updated test and build workflow.

2026-03-29 - 1.6.0 - feat(readme)

document WireGuard transport support, configuration, and usage examples

Expand the README from dual-transport to triple-transport support by adding WireGuard alongside WebSocket and QUIC
Add client and server WireGuard examples, including live peer management and .conf generation with WgConfigGenerator
Document new WireGuard-related API methods, config fields, transport modes, and security model details

2026-03-29 - 1.5.0 - feat(wireguard)

add WireGuard transport support with management APIs and config generation

add Rust WireGuard module integration using boringtun and route management through client/server management handlers
extend TypeScript client and server configuration schemas with WireGuard-specific options and validation
add server-side WireGuard peer management commands including keypair generation, peer add/remove, and peer listing
export a WireGuard config generator for producing client and server .conf files
add WireGuard-focused test coverage for config validation and config generation

2026-03-21 - 1.4.1 - fix(readme)

preserve markdown line breaks in feature list

Adds trailing spaces to the README feature list so each highlighted capability renders on its own line.

2026-03-19 - 1.4.0 - feat(vpn transport)

add QUIC transport support with auto fallback to WebSocket

introduces a transport abstraction in the Rust daemon so client and server can operate over WebSocket or QUIC
adds dual-mode server configuration with websocket, quic, and both transport modes plus QUIC idle timeout and listen address options
adds client transport selection with auto mode that attempts QUIC first and falls back to WebSocket
adds QUIC certificate hash pinning support and required Rust dependencies for QUIC and TLS
updates TypeScript interfaces, config validation, tests, and documentation to cover the new transport modes

2026-03-17 - 1.3.0 - feat(tests,client)

add flow control and load test coverage and honor configured keepalive intervals

Adds end-to-end node tests for client/server flow control, keepalive exchange, connection quality telemetry, rate limiting, concurrent clients, and disconnect tracking.
Adds load testing with throttled proxy scenarios to validate behavior under constrained bandwidth and repeated client churn.
Updates the Rust client to pass configured keepaliveIntervalSecs into the adaptive keepalive monitor instead of always using defaults.

2026-03-15 - 1.2.0 - feat(readme)

document QoS, telemetry, MTU, and rate limiting capabilities in the README

Expand the architecture and feature overview to cover adaptive keepalive, telemetry, QoS, rate limiting, and MTU handling
Update client and server examples to show new APIs such as getConnectionQuality(), getMtuInfo(), setClientRateLimit(), and getClientTelemetry()
Add TypeScript interface documentation for connection quality, MTU info, enriched client statistics, and per-client telemetry

2026-03-15 - 1.1.0 - feat(rust-core)

add adaptive keepalive telemetry, MTU handling, and per-client rate limiting APIs

adds adaptive keepalive monitoring with RTT, jitter, loss, and link health reporting to client statistics and management endpoints
introduces MTU overhead calculation and oversized-packet handling support, plus client MTU info APIs
adds token-bucket rate limiting with configurable default limits and server management commands to set, remove, and inspect per-client telemetry
extends TypeScript client and server interfaces with connection quality, MTU, and client telemetry methods

2026-02-27 - 1.0.3 - fix(build)

add aarch64 linker configuration for cross-compilation

Added rust/.cargo/config.toml to configure linker for target aarch64-unknown-linux-gnu
Sets linker to 'aarch64-linux-gnu-gcc' to enable cross-compilation to ARM64

2026-02-27 - 1.0.2 - fix()

no changes detected - no code or content modifications

2026-02-27 - 1.0.1 - fix(release)

bump patch version (no code changes)

No changes detected in the provided git diff
Current package.json version is 1.0.0
Recommend patch bump to 1.0.1 to create a release/trivial update

2026-02-27 - 1.0.0 - initial release

Initial commit creating the project repository and baseline files.

Initial project scaffold and configuration
Repository initialized with base files and metadata