changelog: 0.0.2 releases today

CHANGELOG.md

@@ -10,6 +10,13 @@ subject rarely does.
 
 ## [Unreleased]
 
+## [0.0.2] - 2026-08-14
+
+Configuration can now be a file that every boot converges to, filtering gains
+regex rules and honors blocklist exception lines, and two refresh bugs that
+silently kept stale state are fixed. Note the three breaking changes below if
+you script against `nxdns import` or run with `--config`.
+
 ### Added
 
 - **Declarative configuration for IaC.** `nxdns run --config=<file>` makes the
@@ -24,6 +31,26 @@ subject rarely does.
   configuration rows, names the tables and counts, and applies it only with
   the new `--allow-delete` flag. Additive and edit-in-place imports need no
   flag.
+- **Regex rules.** Rules gain a third kind, `regex`, beside `exact` and
+  `wildcard`, for per-group allow and block patterns such as `^ad[0-9]+-`. The
+  engine is homegrown and linear-time by construction, so no pattern can make
+  matching blow up; backreferences and lookaround do not exist, and a bad
+  pattern is refused at insert time with the limit it hit. Matches appear in
+  `/api/lookup` and the query log as `rule_allow_regex` / `rule_block_regex`.
+  Regex still comes only from you: regex lines in downloaded lists stay
+  counted and skipped.
+- **Blocklist exception lines are honored.** An Adblock-Plus `@@||name^` line
+  in a downloaded list now lifts that name — and its subdomains — out of what
+  the attached lists block. Exceptions sit below every rule you wrote: a
+  downloaded list can reopen only a hole another downloaded list dug, never
+  override an operator decision. Each source reports how many it carried.
+- **Browser-only lines are counted where you can see them.** Every source now
+  reports how many of its lines nxdns skipped as syntax with no DNS meaning —
+  cosmetic filters, `$`-modifier rules — beside the existing skipped-regex
+  count. Both blocklist tables show the number and the UI explains the
+  difference: a list whose skipped-unsupported count dwarfs its domain count
+  is written for browser extensions, and its DNS or hosts variant will block
+  more. Previously such a list compiled to almost nothing and looked clean.
 
 ### Changed
 
@@ -49,6 +76,29 @@ subject rarely does.
 - `nxdns import --force` is renamed `--allow-delete`.
 - A fresh install no longer seeds from `/etc/nxdns/config.zon` by presence.
   Use `nxdns import` once, or run in file mode with `--config`.
+- The admin UI's internals moved to TypeScript 7 and replaced Tailwind with
+  StyleX and React Aria. The visible change is small: selects are real
+  widgets with working keyboard focus; everything else renders as before.
+- The `config.db` schema is a single baseline definition again; numbered
+  migration steps start accumulating at v0.1.
+
+### Fixed
+
+- **A list switching a name between its exact and wildcard forms never took
+  effect.** The compiled-list checksum hashed the exact and wildcard bodies as
+  one unseparated byte stream, so a list carrying `a.example` and the same
+  list carrying `*.a.example` produced the same digest, and the refresh kept
+  the old compiled files. The checksum now separates the bodies. Every source
+  recompiles once on its first refresh after the upgrade; no re-download of
+  unchanged content is forced beyond the refresh's normal fetch.
+- **A refresh could store stale skip counts.** When a refresh found the list
+  content unchanged, it wrote the previously stored skip counters back to the
+  database while showing the fresh ones in the UI, and the next restart
+  reverted the numbers to the stale copy. All counters now persist from the
+  fresh compile.
+- An Adblock-Plus entry with embedded whitespace
+  (`||good.example bad.example^`) compiled into an entry no query could ever
+  match. Such lines are now counted as unsupported instead.
 
 ## [0.0.1] - 2026-08-09