Argus � the BNS public gateway (navigate.st) and its library layer. Serves BCNR names over HTTPS, verifies signed records, mints TLDs.
23757e7a03
u/s3/ip/h/p for the apex of a BNS name no longer require a chain transaction to change. They live alongside the subdomain hosts and the apex DNS block in the owner-signed _records.json on Sia, verified by the gateway against the current NFT holder. The chain keeps the NFT identity and one `s3` pointer that anchors the manifest file; every other edit is a wallet signature with zero satoshis spent. The trust boundary is unchanged — a signature verified against the on-chain owner is cryptographically equivalent to a chain update, and the manifest's seq monotonicity + name-field binding keep replay out. Legacy names and v1/v2 manifests stay valid; the apex merge is a no-op when nothing declares it. Argus: - manifest.js: SUPPORTED_VERSIONS gains 3; new validateApex and effectiveRecords; verifyManifest validates apex and refuses it in v<3 - registrar.js: signRecordsManifest accepts v=3 - public-gateway.mjs: serve() loads manifestFor unconditionally and merges chain + apex before pickRecord; /api/dns/<name> response adds the verified apex block for clients to merge on their side; a successful /api/records POST busts the serve cache so a swap takes effect immediately rather than at the 60 s TTL - test/manifest-apex.test.mjs: 21 tests — validator shape rules, merge semantics, v3 round-trip, cross-version refusal, legacy still verifies, replay refused Ariadne daemon: - cache carries apex alongside the DNS block; mergedRecords(entry, key) is the one place the precedence lives. HTTP app and the DNS-answer bcnrAnswerFor both read merged records, so an apex ip swap changes what the OS gets without waiting on a chain update Ariadne mobile: - Entry and DnsCached carry apex; static Bns.mergedRecords(entry) is the Java mirror of effectiveRecords; BchFetcher.serve picks from the merged view Hermes.x is the first candidate: chain has `s3: bns/hermes/` + a redirect `u`, both can collapse to one signed-manifest edit once the owner publishes their first v3. |
||
|---|---|---|
| contracts | ||
| setup | ||
| src | ||
| test | ||
| .gitignore | ||
| ariadne.config.json | ||
| BROWSER-PROMPT.md | ||
| build-web.mjs | ||
| DESIGN-collision-modes.md | ||
| DESIGN-hosting-pact.md | ||
| DESIGN-root-tld-cert.md | ||
| ENGINE.md | ||
| LICENSE | ||
| namespaces.pdf | ||
| OPERATIONS-electrum.md | ||
| package-lock.json | ||
| package.json | ||
| PROTOCOL.md | ||
| README.md | ||
| ROADMAP.md | ||
| sia-test.html | ||
BNS — Namecoin-style decentralized names on Bitcoin Cash (chipnet)
A working prototype of "Option 3": names are CashTokens name certificates on the BCH chain (no fork, no sidechain), records ride in OP_RETURN, discovery via a beacon address, and the resolver is embedded in a wallet app with a built-in browser pane — the Brave/MetaMask-browser architecture in miniature.
See PROTOCOL.md for the on-chain design and its honest limitations.
Layout
src/lib/bns.js— protocol core: payload codec, chain indexer/resolver, tx builderssrc/wallet-app.js— wallet + embedded resolver + browser UI (npm run wallet→ http://localhost:4626)src/register.js/src/update.js/src/resolve.js— CLI equivalentswallets.json— chipnet seed phrases (TESTNET ONLY — never reuse for real funds)src/lib/gen-wallets.js— one-time wallet generation (already run)
Setup
npm install- Fund the wallet with free chipnet tBCH: go to https://tbch.googol.cash/,
paste the wallet address (shown in the app sidebar or by
node src/lib/gen-wallets.js), pick chipnet, solve the captcha. ~0.001 tBCH funds hundreds of registrations. npm run walletand open http://localhost:4626
Standalone resolver daemon (make EVERY browser resolve .bch)
src/daemon/bnsd.js— DNS server (answers*.bchfrom the chain, forwards everything else upstream) + HTTP gateway that serves on-chain sites by Host header. Test unprivileged:node src/daemon/bnsd.js --dns-port 5354 --http-port 8081, thennode src/daemon/dig.js hello.bch.setup/install.ps1— run from an elevated PowerShell. Installs the daemon as a boot-time scheduled task (SYSTEM, auto-restart) and wires the OS to it:- default (
-Mode nrpt): adds an NRPT rule so only.bchqueries reach the daemon; all other DNS is untouched. -Mode full: points every adapter's DNS at 127.0.0.1 (daemon forwards non-.bch upstream, ncdns-style); original servers are saved and restored on uninstall.
- default (
setup/uninstall.ps1— reverses everything (rule/adapters/task).
HTTPS for .bch: the "BNS Local Root CA" (created on demand in ca/, keep
root-ca.key private) signs per-name certs. The daemon's :443 gateway mints
them on the fly for locally-served names; node src/lib/issue-cert.js <name>
issues one for a real server (see the coinspectrum.bch nginx vhost). The
installer trusts the root machine-wide and enables Firefox's
enterprise-roots policy; cert fingerprints are published in "tls" chain
records for pinning.
Caveats: browsers with "secure DNS" (DoH) enabled bypass the OS resolver — disable it or add an exception; ports 53/80/443 must be free.
Try it
- Register
hellowith inline HTML (a website stored entirely on-chain), then typehello.bchin the address bar — the app resolves it from the blockchain (not DNS) and renders it. - Or CLI:
node src/register.js hello '{"h":"<h1>Served from the BCH chain</h1>"}'thennode src/resolve.js hello