docs: Windows zero-prereq via protocol: 'v2ray' (take Windows to 100/100)

Surface protocol: 'v2ray' as the recommended Windows connect path everywhere:
no admin, no manual install, auto-downloaded V2Ray binary (~70% of nodes).
WireGuard becomes an optional admin-once upgrade for the other ~30% (faster);
the SDK checks admin BEFORE payment, so a non-admin box never wastes USDC/P2P.

Verified against installed blue-js-sdk@2.8.0 ai-path source:
- setup.js setupV2Ray() + connect.js auto-install V2Ray with no admin
- setup.js checkWireGuard()/isAdmin() require admin for the WG MSI + tunnel
- connect.js maps opts.protocol -> serviceType; omitted searches both
- ADMIN-ELEVATION.md: V2Ray ~70% no admin, admin gate precedes payment

- server/src/index.ts /manifest: new connectWindows block; connect/tldr/
  platforms/setup/example default to protocol: 'v2ray' (tsc clean)
- docs/llms.txt + docs/index.html: JSON-LD + both code blocks use
  protocol: 'v2ray'; Autonomous connectDirect path left as WireGuard

Author: Sentinel-Bluebuilder

docs/index.html

@@ -55,9 +55,9 @@
       "lcdFallbacks": ["https://lcd.sentinel.co", "https://sentinel-api.polkachu.com", "https://api.sentinel.quokkastake.io", "https://sentinel-rest.publicnode.com", "https://api.sentinel.suchnode.net"],
       "platforms": "Payment is identical everywhere; only the connect step differs by OS.",
       "connectMacLinux": "Native CLI sentinel-dvpncli (go install github.com/sentinel-official/sentinel-dvpncli@latest, needs Go 1.24+). The CLI does NOT bundle a tunnel: it shells out to wg-quick (install wireguard-tools: apt/brew/pacman) for WireGuard nodes, or v2ray on PATH for V2Ray nodes. Most nodes are WireGuard, so install wireguard-tools at minimum; sudo is needed to bring the interface up. Then: (1) printf '%s\\n\\n' \"$MNEMONIC\" | sentinel-dvpncli keys add agent --keyring.backend test (keys add is interactive: line 1 = mnemonic, blank line 2 = default passphrase; there is no --recover flag); (2) sentinel-dvpncli tx session-start <nodeAddress> --subscription-id <subscriptionId> --tx.fee-granter-addr <feeGranter> --tx.from-name agent --keyring.backend test; (3) sessionId = sentinel-dvpncli query sessions --account-addr <sent1...> --subscription-id <subscriptionId> --output-format json (newest entry); (4) sentinel-dvpncli connect <sessionId>. Exception: Fedora (SELinux blocks VPNs).",
-      "connectWindows": "Heavier JS path. await setup() from blue-js-sdk/ai-path — run once on a fresh machine; auto-downloads V2Ray (no admin), checks/installs WireGuard (MSI needs admin); returns { ready, capabilities, recommended, issues }",
+      "connectWindows": "Zero-prereq path: pass protocol: 'v2ray' to connect() — no admin, no manual install. V2Ray is a userspace SOCKS5 proxy; connect() auto-downloads the v2ray binary to ~/.sentinel-sdk/bin on first use (no admin), covering ~70% of nodes. setup() is optional (it just pre-fetches V2Ray). WireGuard nodes (the other ~30%, faster) need admin ONCE for the MSI install + tunnel service; the SDK checks admin BEFORE payment and refuses a WireGuard node when not elevated, so no funds are wasted. If you cannot elevate, stay on protocol: 'v2ray'.",
       "walletCreate": "createWallet() from blue-js-sdk/ai-path → { address, mnemonic }",
-      "connect": "Windows JS tunnel: connect({ mnemonic, subscriptionId, feeGranter, nodeAddress }) → { connected, ip, protocol }. On macOS/Linux use connectMacLinux (native CLI) instead.",
+      "connect": "Windows JS tunnel: connect({ mnemonic, subscriptionId, feeGranter, nodeAddress, protocol: 'v2ray' }) → { connected, ip, protocol }. protocol: 'v2ray' = zero admin, zero manual install (auto-downloaded binary, ~70% of nodes) — the recommended Windows path. Omit protocol only if you have admin and want WireGuard nodes too. On macOS/Linux use connectMacLinux (native CLI) instead.",
       "disconnect": "JS: disconnect() ends session on-chain (fee-granted), tears down tunnel. CLI: sentinel-dvpncli tx session-cancel <sessionId>",
       "nodeFallback": "If provision.nodeAddress is empty, call rpcQueryNodesForPlan(rpc, provision.planId, { status: 1 }) and pick from items[]"
     },
@@ -1980,7 +1980,7 @@ <h3 style="font-size: 13px; color: var(--accent); margin-bottom: 18px; letter-sp
 <span class="kw">import</span> { <span class="fn">base</span> } <span class="kw">from</span> <span class="str">'viem/chains'</span><span class="op">;</span>
 <span class="kw">import</span> { <span class="fn">setup</span>, <span class="fn">createWallet</span>, <span class="fn">connect</span>, <span class="fn">disconnect</span>, <span class="fn">rpcQueryNodesForPlan</span>, <span class="fn">createRpcQueryClientWithFallback</span> } <span class="kw">from</span> <span class="str">'blue-js-sdk/ai-path'</span><span class="op">;</span>
 
-<span class="cm">// Fresh machine? setup() auto-downloads V2Ray (no admin) + checks WireGuard</span>
+<span class="cm">// Optional: pre-fetch V2Ray (no admin). connect({ protocol: 'v2ray' }) auto-fetches it anyway.</span>
 <span class="kw">await</span> <span class="fn">setup</span>()<span class="op">;</span>
 
 <span class="cm">// Create a Sentinel wallet (one-time &mdash; save the mnemonic!)</span>
@@ -2048,11 +2048,12 @@ <h3 style="font-size: 13px; color: var(--accent); margin-bottom: 18px; letter-sp
   <span class="prop">nodeAddress</span><span class="op">,</span>                                  <span class="cm">// from provision or fallback query</span>
   <span class="prop">subscriptionId</span><span class="op">:</span> String(provision<span class="op">.</span>subscriptionId)<span class="op">,</span>  <span class="cm">// from Step 2</span>
   <span class="prop">feeGranter</span><span class="op">:</span> provision<span class="op">.</span>feeGranter<span class="op">,</span>          <span class="cm">// operator pays gas</span>
+  <span class="prop">protocol</span><span class="op">:</span> <span class="str">'v2ray'</span><span class="op">,</span>                          <span class="cm">// zero admin, zero manual install (Windows)</span>
 })<span class="op">;</span>
 
 <span class="cm">// All traffic now routes through encrypted P2P tunnel</span>
 console<span class="op">.</span><span class="fn">log</span>(<span class="str">`VPN active: ${vpn.ip} via ${vpn.protocol}`</span>)<span class="op">;</span>
-<span class="cm">// { connected: true, ip: '104.234.x.x', protocol: 'wireguard',</span>
+<span class="cm">// { connected: true, ip: '104.234.x.x', protocol: 'v2ray',</span>
 <span class="cm">//   sessionId: '39269345', nodeAddress: 'sentnode1...' }</span>
 
 <span class="cm">// Disconnect also uses fee grant &mdash; 0 tokens needed</span>
@@ -2379,7 +2380,7 @@ <h2>End-to-end: USDC to VPN tunnel</h2>
   <span class="fn">rpcQueryNodesForPlan</span><span class="op">,</span> <span class="fn">createRpcQueryClientWithFallback</span><span class="op">,</span>
 } <span class="kw">from</span> <span class="str">'blue-js-sdk/ai-path'</span><span class="op">;</span>
 
-<span class="cm">// ── Step 0: Fresh machine? Auto-install tunnel binaries (V2Ray needs no admin) ──</span>
+<span class="cm">// ── Step 0 (optional): pre-fetch V2Ray (no admin). connect({ protocol: 'v2ray' }) auto-fetches it anyway ──</span>
 <span class="kw">await</span> <span class="fn">setup</span>()<span class="op">;</span>
 
 <span class="cm">// ── Step 1: Create Sentinel wallet (one-time) ──</span>
@@ -2428,6 +2429,7 @@ <h2>End-to-end: USDC to VPN tunnel</h2>
   <span class="prop">nodeAddress</span><span class="op">,</span>
   <span class="prop">subscriptionId</span><span class="op">:</span> String(provision<span class="op">.</span>subscriptionId)<span class="op">,</span>
   <span class="prop">feeGranter</span><span class="op">:</span> provision<span class="op">.</span>feeGranter<span class="op">,</span>
+  <span class="prop">protocol</span><span class="op">:</span> <span class="str">'v2ray'</span><span class="op">,</span>                          <span class="cm">// zero admin, zero manual install (Windows)</span>
 })<span class="op">;</span>
 
 console<span class="op">.</span><span class="fn">log</span>(<span class="str">`VPN active: ${vpn.ip} via ${vpn.protocol}`</span>)<span class="op">;</span>
@@ -2457,7 +2459,7 @@ <h2>End-to-end: USDC to VPN tunnel</h2>
   <span class="str">"sentinelTxHash"</span>: <span class="str">"2C1CFE..."</span>,
   <span class="str">"expiresAt"</span>: <span class="str">"2026-05-14T..."</span>,
   <span class="str">"operatorAddress"</span>: <span class="str">"0xCC689D..."</span>,
-  <span class="str">"instructions"</span>: <span class="str">"import { setup, connect } from 'blue-js-sdk/ai-path'; await setup(); /* installs V2Ray automatically if no tunnel binary is present */ await connect({ mnemonic, nodeAddress, subscriptionId, feeGranter })"</span>
+  <span class="str">"instructions"</span>: <span class="str">"import { setup, connect } from 'blue-js-sdk/ai-path'; /* setup() is optional on Windows — connect({ protocol: 'v2ray' }) auto-fetches the V2Ray binary (no admin, ~70% of nodes) */ await connect({ mnemonic, nodeAddress, subscriptionId, feeGranter, protocol: 'v2ray' })"</span>
 }</code></pre>
     </div>
   </div>

docs/llms.txt

@@ -11,7 +11,7 @@ The agent needs exactly one thing before calling x402: an EVM private key with a
 **Payment is identical on every platform.** What differs is *connecting* the tunnel after the server returns 200. There are two equally-supported connect paths — pick by OS:
 
 - **macOS & Linux:** Use the native `sentinel-dvpncli` (one `go install`, Go 1.24+), then drive it with three flag-only commands — see **"macOS & Linux — native CLI connect"** below. The CLI does NOT bundle a tunnel: it shells out to `wg-quick` for WireGuard nodes, so install **wireguard-tools** first (`apt install wireguard-tools` | `brew install wireguard-tools` | `pacman -S wireguard-tools`), or a `v2ray` binary on PATH for V2Ray nodes. Most nodes are WireGuard; bringing the interface up needs sudo. **Only exception: Fedora** — its SELinux blocks VPN interfaces and cannot be worked around programmatically; macOS, Ubuntu, Debian and Arch are fine once the tunnel binary is installed.
-- **Windows (heavier):** run `await setup()` from `blue-js-sdk/ai-path` once on a fresh machine before `connect()`. It auto-downloads V2Ray 5.2.1 to `~/.sentinel-sdk/bin` (no admin) and detects/auto-installs WireGuard (the MSI install needs admin). It returns `{ ready, capabilities, recommended, issues }` — if `capabilities` includes `v2ray`, you can connect with zero manual installs. See **"Windows — JS-SDK connect"** below.
+- **Windows (zero prerequisites):** pass `protocol: 'v2ray'` to `connect()` and you need **no admin and no manual install**. V2Ray is a userspace SOCKS5 proxy; `connect()` auto-downloads the `v2ray` binary to `~/.sentinel-sdk/bin` on first use (no admin) and covers ~70% of the network (~630 nodes). That is the complete Windows path: `npm install` → pay → `connect({ ..., protocol: 'v2ray' })`. WireGuard nodes (the other ~30%, faster) are an **optional admin-once upgrade** — the MSI install and tunnel service need elevation (`cscript run-admin.vbs setup.js` triggers one UAC prompt; a service running as SYSTEM/admin needs none). The SDK checks admin **before payment** and refuses a WireGuard node when not elevated, so no USDC or P2P is ever wasted. If you cannot elevate, stay on `protocol: 'v2ray'`. `await setup()` is optional (it pre-fetches V2Ray; `connect()` fetches it anyway). See **"Windows — JS-SDK connect"** below.
 
 Both paths consume the exact same 200 response (`subscriptionId`, `planId`, `feeGranter`, `nodeAddress`) and end in the same `MsgStartSession` + direct WireGuard/V2Ray handshake.
 
@@ -60,7 +60,7 @@ Free:
 7. Server returns 200 `{ provisioned, subscriptionId, planId, feeGranter, nodeAddress, nodeCountry, nodes[], sentinelTxHash, expiresAt }`.
 8. Agent connects, using the path for its OS (both consume the same 200 fields):
    - **macOS/Linux:** import the key (`printf '%s\n\n' "$MNEMONIC" | sentinel-dvpncli keys add agent --keyring.backend test`), `sentinel-dvpncli tx session-start <nodeAddress> --subscription-id <subscriptionId> --tx.fee-granter-addr <feeGranter> --tx.from-name agent --keyring.backend test`, resolve the new id with `sentinel-dvpncli query sessions --account-addr <sent1...> --subscription-id <subscriptionId> --output-format json` (newest entry), then `sentinel-dvpncli connect <sessionId>`. (See "macOS & Linux — native CLI connect".)
-   - **Windows:** `setup()` once on a fresh machine, then `connect({ mnemonic, subscriptionId, feeGranter, nodeAddress })`. (See "Windows — JS-SDK connect".)
+   - **Windows:** `connect({ mnemonic, subscriptionId, feeGranter, nodeAddress, protocol: 'v2ray' })` — zero admin, zero manual install (the v2ray binary auto-downloads). Omit `protocol` only if you have admin and want WireGuard nodes too. (See "Windows — JS-SDK connect".)
 9. `MsgStartSession` on Sentinel — gas paid by `feeGranter` (the fee grant the server created in step 6, so the agent's session start costs zero P2P).
 10. Direct WireGuard/V2Ray handshake — tunnel up. The operator never sees it.
 
@@ -78,7 +78,7 @@ import {
   rpcQueryNodesForPlan, createRpcQueryClientWithFallback,
 } from 'blue-js-sdk/ai-path';
 
-await setup(); // fresh machine: auto-downloads V2Ray, checks WireGuard
+await setup(); // optional: pre-fetch V2Ray (no admin). connect({ protocol: 'v2ray' }) auto-fetches it anyway.
 const wallet = await createWallet();
 const scheme = new ExactEvmScheme({ address, signTypedData });
 const client = new x402Client();
@@ -106,6 +106,8 @@ const vpn = await connect({
   subscriptionId: String(subscriptionId),
   feeGranter,
   nodeAddress,
+  protocol: 'v2ray', // zero admin, zero manual install — Windows zero-prereq path.
+                     // Omit only if you have admin and want WireGuard nodes (faster, ~30% of network).
 });
 // vpn.connected === true
 ```