From c7c1e21267e4bac3f679b05e1f612742c7759790 Mon Sep 17 00:00:00 2001
From: m5r <mokhtar@mial.net>
Date: Fri, 14 Aug 2026 02:10:45 +0200
Subject: [PATCH] changelog: 0.0.2 releases today

---
 CHANGELOG.md  | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 build.zig.zon |  2 +-
 2 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d43b91..7a0df87 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,13 @@ subject rarely does.
 
 ## [Unreleased]
 
+## [0.0.2] - 2026-08-14
+
+Configuration can now be a file that every boot converges to, filtering gains
+regex rules and honors blocklist exception lines, and two refresh bugs that
+silently kept stale state are fixed. Note the three breaking changes below if
+you script against `nxdns import` or run with `--config`.
+
 ### Added
 
 - **Declarative configuration for IaC.** `nxdns run --config=<file>` makes the
@@ -24,6 +31,26 @@ subject rarely does.
   configuration rows, names the tables and counts, and applies it only with
   the new `--allow-delete` flag. Additive and edit-in-place imports need no
   flag.
+- **Regex rules.** Rules gain a third kind, `regex`, beside `exact` and
+  `wildcard`, for per-group allow and block patterns such as `^ad[0-9]+-`. The
+  engine is homegrown and linear-time by construction, so no pattern can make
+  matching blow up; backreferences and lookaround do not exist, and a bad
+  pattern is refused at insert time with the limit it hit. Matches appear in
+  `/api/lookup` and the query log as `rule_allow_regex` / `rule_block_regex`.
+  Regex still comes only from you: regex lines in downloaded lists stay
+  counted and skipped.
+- **Blocklist exception lines are honored.** An Adblock-Plus `@@||name^` line
+  in a downloaded list now lifts that name — and its subdomains — out of what
+  the attached lists block. Exceptions sit below every rule you wrote: a
+  downloaded list can reopen only a hole another downloaded list dug, never
+  override an operator decision. Each source reports how many it carried.
+- **Browser-only lines are counted where you can see them.** Every source now
+  reports how many of its lines nxdns skipped as syntax with no DNS meaning —
+  cosmetic filters, `$`-modifier rules — beside the existing skipped-regex
+  count. Both blocklist tables show the number and the UI explains the
+  difference: a list whose skipped-unsupported count dwarfs its domain count
+  is written for browser extensions, and its DNS or hosts variant will block
+  more. Previously such a list compiled to almost nothing and looked clean.
 
 ### Changed
 
@@ -49,6 +76,29 @@ subject rarely does.
 - `nxdns import --force` is renamed `--allow-delete`.
 - A fresh install no longer seeds from `/etc/nxdns/config.zon` by presence.
   Use `nxdns import` once, or run in file mode with `--config`.
+- The admin UI's internals moved to TypeScript 7 and replaced Tailwind with
+  StyleX and React Aria. The visible change is small: selects are real
+  widgets with working keyboard focus; everything else renders as before.
+- The `config.db` schema is a single baseline definition again; numbered
+  migration steps start accumulating at v0.1.
+
+### Fixed
+
+- **A list switching a name between its exact and wildcard forms never took
+  effect.** The compiled-list checksum hashed the exact and wildcard bodies as
+  one unseparated byte stream, so a list carrying `a.example` and the same
+  list carrying `*.a.example` produced the same digest, and the refresh kept
+  the old compiled files. The checksum now separates the bodies. Every source
+  recompiles once on its first refresh after the upgrade; no re-download of
+  unchanged content is forced beyond the refresh's normal fetch.
+- **A refresh could store stale skip counts.** When a refresh found the list
+  content unchanged, it wrote the previously stored skip counters back to the
+  database while showing the fresh ones in the UI, and the next restart
+  reverted the numbers to the stale copy. All counters now persist from the
+  fresh compile.
+- An Adblock-Plus entry with embedded whitespace
+  (`||good.example bad.example^`) compiled into an entry no query could ever
+  match. Such lines are now counted as unsupported instead.
 
 ## [0.0.1] - 2026-08-09
 
diff --git a/build.zig.zon b/build.zig.zon
index 59b3de7..0b76e6e 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -1,6 +1,6 @@
 .{
     .name = .nxdns,
-    .version = "0.0.1",
+    .version = "0.0.2",
     .minimum_zig_version = "0.16.0",
     .paths = .{""},
     .fingerprint = 0x3307b311dded1d91,