From b94d01cb9a503530d5cd5dab824ef9103634af21 Mon Sep 17 00:00:00 2001
From: Local Dev <dev@localhost>
Date: Sat, 1 Aug 2026 02:06:48 +0200
Subject: [PATCH] Ariadne c5efae43: tlds.bch-driven install + BNS_POLICY,
 doc-aligned
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three doc-alignment changes shipping in AriadneResolver-Setup-0.1.0.exe
sha256 c5efae43af6cc163f468f1dc73d08939db32a9a6db52298ba18b2d9a2aee1292:

1. install.ps1 fetches the activated TLD list from the on-chain root
   TLD certificate (tlds.bch, per START-HERE §1) via
   resolver-web.js fetchBcnrTlds(), then:
   - regenerates the CA's nameConstraints extension from that list
     (rotates the CA when the on-chain set changes so leaves for the
     newly-activated TLDs actually validate)
   - adds one NRPT rule per activated TLD in surgical mode
   - falls back to bootstrap ["bch"] if the chain is unreachable
   Result: adding a TLD on-chain is picked up by re-running the
   installer, no code release needed.

2. bnsd.js honors --policy / BNS_POLICY (bcnr-first | icann-first,
   alias bns-first) per START-HERE §4b. bcnr-first is default and
   preserves prior behavior. icann-first forwards to upstream first
   and only substitutes a BCNR answer on NXDOMAIN. install.ps1
   accepts -Policy and passes it into the scheduled task action.

3. ca.js loadOrCreateRootCA() now accepts a runtime TLD list; the
   old callers still work (fall back to PERMITTED_TLDS from tlds.js).

Doc: RESOLVER-PACKAGING-PROMPT.md rewritten to reflect current
shipping reality; original 2026-07-26 packaging brief preserved
in the "Archival" section.

Deployed to dl.silentmode.st (nginx serves from /opt/silent-mode/dl/)
and mirrored to Sia bns/silentmode/. VPS bns-indexer.service reports
tlds.bch currently activates: bch p2p deviant nav sia dgb nt sm lm.
---
 releases-manifest.json | 2 +-
 releases/index.html    | 2 +-
 tools/index.html       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/releases-manifest.json b/releases-manifest.json
index a2c5753..317f20f 100644
--- a/releases-manifest.json
+++ b/releases-manifest.json
@@ -14,7 +14,7 @@
       "signed": false,
       "signingAuthority": null,
       "files": {
-        "AriadneResolver-Setup-0.1.0.exe": "3438d55871d1f7454df691767e6f4be61c6d3ac900606b86f369cc7da8741302"
+        "AriadneResolver-Setup-0.1.0.exe": "c5efae43af6cc163f468f1dc73d08939db32a9a6db52298ba18b2d9a2aee1292"
       }
     },
     {
diff --git a/releases/index.html b/releases/index.html
index d5970ac..6553aa1 100644
--- a/releases/index.html
+++ b/releases/index.html
@@ -66,7 +66,7 @@
 
     <div class="file">
       <div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.0.exe">AriadneResolver-Setup-0.1.0.exe</a> — ~24 MB</div>
-      <code>3438d55871d1f7454df691767e6f4be61c6d3ac900606b86f369cc7da8741302</code>
+      <code>c5efae43af6cc163f468f1dc73d08939db32a9a6db52298ba18b2d9a2aee1292</code>
     </div>
   </div>
 
diff --git a/tools/index.html b/tools/index.html
index f052e9f..70ed242 100644
--- a/tools/index.html
+++ b/tools/index.html
@@ -129,7 +129,7 @@
     </div>
     <div class="hashes">
       <div style="color:var(--mut);font-size:12.5px">SHA-256 — verify before elevating:</div>
-      <div class="h"><b>Installer</b><code>3438d55871d1f7454df691767e6f4be61c6d3ac900606b86f369cc7da8741302</code></div>
+      <div class="h"><b>Installer</b><code>c5efae43af6cc163f468f1dc73d08939db32a9a6db52298ba18b2d9a2aee1292</code></div>
     </div>
   </div>
 </section>