@push.rocks/smartdns 8.2.0 → 8.3.0

package/notices/rustc-hash-2.1.1-license.txt

@@ -0,0 +1,23 @@
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/notices/thiserror-2.0.18-license.txt

@@ -0,0 +1,23 @@
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/notices/thiserror-impl-2.0.18-license.txt

@@ -0,0 +1,23 @@
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/notices/tinyvec-1.10.0-license.txt

@@ -0,0 +1,5 @@
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/notices/tinyvec_macros-0.1.1-license.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Soveu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/notices/utf8_iter-1.0.4-copyright.txt

@@ -0,0 +1,42 @@
+Copyright Mozilla Foundation
+
+Licensed under the Apache License (Version 2.0), or the MIT license,
+(the "Licenses") at your option. You may not use this file except in
+compliance with one of the Licenses. You may obtain copies of the
+Licenses at:
+
+   https://www.apache.org/licenses/LICENSE-2.0
+   https://opensource.org/licenses/MIT
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the Licenses is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the Licenses for the specific language governing permissions and
+limitations under the Licenses.
+
+--
+
+Test code is dedicated to the Public Domain when so designated (see
+the individual files for PD/CC0-dedicated sections).
+
+--
+
+The implementation for Utf8CharIndices was adapted from the
+CharIndices implementation of the Rust standard library at revision
+ab32548539ec38a939c1b58599249f3b54130026
+(https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/library/core/src/str/iter.rs).
+
+Excerpt from https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/COPYRIGHT ,
+which refers to
+https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-APACHE
+and
+https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-MIT
+:
+
+For full authorship information, see the version control history or
+https://thanks.rust-lang.org
+
+Except as otherwise noted (below and/or in individual files), Rust is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.

package/notices/valuable-0.1.1-license.txt

@@ -0,0 +1,25 @@
+Copyright (c) 2021 Valuable Contributors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/notices/web-time-1.1.0-license.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 dAxpeDDa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/notices/zerocopy-derive-0.8.39-license.txt

@@ -0,0 +1,26 @@
+Copyright 2023 The Fuchsia Authors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdns",
-  "version": "8.2.0",
+  "version": "8.3.0",
   "private": false,
   "description": "A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.",
   "exports": {
@@ -49,11 +49,11 @@
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tsrust": "^1.10.0",
-    "@git.zone/tstest": "^4.0.0",
+    "@git.zone/tsrust": "^1.13.0",
+    "@git.zone/tstest": "^4.1.1",
     "@types/dns-packet": "^5.6.5",
     "@types/lodash.clonedeep": "^4.5.9",
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.4.1",
     "dns-packet": "^5.6.1"
   },
   "files": [
@@ -66,13 +66,23 @@
     "assets/**/*",
     "cli.js",
     ".smartconfig.json",
-    "license",
-    "readme.md"
+    "license.md",
+    "readme.md",
+    "third-party-notices.md",
+    "notices/**/*"
   ],
   "browserslist": [
     "last 1 chrome versions"
   ],
   "type": "module",
+  "publishConfig": {
+    "executableFiles": [
+      "./dist_rust/rustdns_linux_amd64_musl",
+      "./dist_rust/rustdns_linux_arm64_musl",
+      "./dist_rust/rustdns-client_linux_amd64_musl",
+      "./dist_rust/rustdns-client_linux_arm64_musl"
+    ]
+  },
   "scripts": {
     "test": "(tstest test/ --verbose --timeout 60)",
     "test:rust": "(cd rust && cargo test)",

package/readme.md

@@ -540,6 +540,29 @@ const server = new DnsServer({
 await server.start(); // No UDP, TCP, or HTTPS listener binds automatically
 ```
 
+After `start()` resolves, an upstream proxy may terminate TLS and hand the
+resulting cleartext HTTP socket to SmartDNS. The handler detects HTTP/1.1 and
+prior-knowledge HTTP/2 (not h2c Upgrade) and accepts RFC 8484 requests on
+`/dns-query`. `/resolve` remains an alias for the already-shipped dcrouter route:
+
+```typescript
+const handleTlsTerminatedSocket = (socket: import('node:net').Socket) => {
+  server.handleHttpSocket(socket);
+};
+```
+
+GET requests require an unpadded base64url `dns` query parameter. POST requests
+require `Content-Type: application/dns-message`. DNS messages are limited to
+65,535 bytes, headers to 16 KiB, HTTP/2 sessions to 100 concurrent streams, and
+header/request/session lifetimes are bounded. Successful responses use
+`application/dns-message`; malformed or unsupported requests receive an explicit
+4xx response, internal handler failures receive 500, and unavailable DNS
+processing receives 503. Every error response uses `text/plain; charset=utf-8`.
+
+`handleHttpSocket()` must only receive a TLS-terminated cleartext stream. The
+legacy `handleHttpsSocket()` does not terminate encrypted TLS in Rust mode and
+closes the socket.
+
 Process individual DNS packets directly:
 
 ```typescript
@@ -589,9 +612,183 @@ await server.stop();
 `stop()` is serialized with `start()` and resolves only after the Rust process
 has closed and its bound sockets are released. If confirmed termination fails,
 the call rejects and retains ownership so a later `stop()` can retry cleanup.
+It also destroys every HTTP/1.1 socket and HTTP/2 replay stream handed to
+`handleHttpSocket()`; the upstream proxy/listener remains caller-owned and must
+be stopped separately.
 
 ---
 
+## Managed private DNS views
+
+`ManagedDnsServer` from `@push.rocks/smartdns/server` is a separate Linux-native
+DNS engine for a trusted workload/network controller. It has no public-zone
+handlers, localhost shortcut, DNSSEC signing, DoH listener, cache, image pull or
+system-resolver fallback. Existing `DnsServer` and `DnsClient` behavior remains
+available independently.
+
+```typescript
+import { ManagedDnsServer } from '@push.rocks/smartdns/server';
+
+const dns = new ManagedDnsServer({
+  ownerId: 'node:one',
+  bindAddress: '10.100.0.1',
+  port: 53,
+  revisionFloor: null, // Restore the persisted accepted receipt after a restart.
+  forbiddenUpstreamAddresses: ['10.100.0.2'],
+});
+const clock = await dns.getClockEvidence();
+const deadline = clock.boottimeMs + 60_000;
+await dns.start();
+const receipt = await dns.applySnapshot({
+  ownerId: 'node:one',
+  revision: 1,
+  sourceContentHash: 'a'.repeat(64), // Use the real authenticated projection hash.
+  configuration: {
+    bootId: clock.bootId,
+    validUntilBoottimeMs: deadline,
+    blockedSuffixes: [],
+    clients: [{ address: '10.100.1.2', viewId: 'network:one' }],
+    views: [{
+      id: 'network:one',
+      zones: ['network-one.internal'],
+      negativeTtl: 1,
+      forwarding: null,
+      names: [{
+        name: 'api.network-one.internal',
+        records: [{
+          type: 'A', data: '10.100.2.3', ttl: 5,
+          validUntilBoottimeMs: deadline,
+        }],
+      }],
+    }],
+  },
+});
+// Persist the complete accepted input and receipt using your persistence owner.
+// Verify getStatus().accepted and .active before acknowledging application.
+await dns.stop();
+```
+
+For an installed or compiled node bundle, pass a second, process-only option:
+`new ManagedDnsServer(configuration, { binaryPath: '/opt/node/bin/rustdns' })`.
+`binaryPath` must be absolute and is never serialized into a DNS snapshot or native
+listener configuration. It selects that exact executable with an empty fallback
+list and no system PATH search; a missing path fails even when package or local
+build binaries exist. The installer remains responsible for verifying the artifact
+and protecting its path. Without this option the existing npm package lookup is
+preserved, including static Linux musl binaries.
+
+The caller authenticates the configuration, enforces the kernel binding between
+each workload/interface and source IP, and persists complete snapshots plus the
+highest `revision`/`contentHash` receipt. The engine does not authenticate a claimed
+IP supplied in configuration, install firewall policy, allocate addresses, check
+workload readiness, persist application data or publish public DNS/ingress records.
+A DNS answer grants no packet access. TCP and UDP views use the kernel-observed
+peer address; untrusted EDNS Client Subnet and all client EDNS options are rejected.
+Unknown sources receive REFUSED before any lookup or forwarding. The raw IPC
+`processPacket` path is unavailable while a managed listener is running, so it
+cannot fabricate membership context.
+
+A snapshot replaces the complete set of views and client bindings atomically.
+Each client IP selects exactly one view; an owner can build a union view for a
+workload with several explicitly authorized networks. Names are case-insensitive
+FQDNs with optional trailing dots. Different views can declare the same name with
+different records. Duplicate names or client IPs in one snapshot, names outside
+that view's authority, duplicate records, malformed addresses and out-of-bound
+TTLs/collections reject the entire replacement. The caller defines search suffixes
+in workload configuration; the engine never guesses a default network or expands
+a bare name into several networks.
+
+Managed authoritative records are A, AAAA and PTR. Every declared name exists even
+with an empty RRset: missing query types and expired endpoint records produce
+NOERROR/NODATA with a negative SOA. Missing or unauthorized private names produce
+NXDOMAIN. PTR targets must belong to the same view's configured authority. Private
+CNAME/MX/SRV synthesis is intentionally absent. Multiple eligible addresses are
+returned as one RRset; oversized UDP answers set TC so the client can retry TCP.
+TTL zero is preserved. Every positive and negative TTL is clipped to native
+remaining authority; record deadlines can withdraw individual endpoints earlier.
+
+Revisions are nonnegative JavaScript safe integers, scoped to the exact immutable
+`ownerId`. Older revisions and same-revision different content reject. Exact replay
+is idempotent and never renews validity. `configuration: null` explicitly withdraws
+all views while retaining the revision fence. The receipt hash is SHA-256 over
+Rust's typed camel-case snapshot serialization in declared field order, preserving
+array order and input strings; it covers owner, revision, parent hash, complete
+configuration and deadline. It is an identity receipt, not a signature. Persist the
+exact submitted snapshot together with the receipt; do not reconstruct an
+approximately equivalent JSON document. `revisionFloor` allows the exact accepted
+snapshot to be reinstalled in a fresh process and rejects older/conflicting input
+before any query can see it. Durable fencing across process lifetimes is the
+persistence owner's responsibility.
+
+`getClockEvidence()` reads Linux boot identity and suspend-inclusive
+[`CLOCK_BOOTTIME`](https://man7.org/linux/man-pages/man3/clock_gettime.3.html). The complete snapshot must name this boot and an absolute native
+deadline, greater than the current native time and at most 24 hours ahead. Endpoint
+deadlines cannot exceed the snapshot. The caller should choose its own shorter
+policy lease. Query/send paths check native validity and accepted revision,
+including after forwarding completes; expiry produces SERVFAIL without a
+JavaScript timer. Same-boot process recovery can reinstall an unexpired persisted
+snapshot, including names never previously queried. Node reboot changes the boot
+ID: the caller must independently establish trusted time and authenticate a bounded
+new boot deadline. The engine never converts wall-clock time or grants a fresh
+lease merely because it restarted. An expired or wrong-boot snapshot cannot be
+installed into a fresh engine.
+
+Forwarding is opt-in per view, to explicit IP-literal upstream endpoints and
+allowed DNS suffixes (`'.'` explicitly permits all external names outside privacy
+barriers). The listener address and `forbiddenUpstreamAddresses` cannot be
+upstreams, including IPv4-mapped IPv6 aliases. The caller must supply every other
+local resolver address and prevent upstream forwarding cycles outside this
+process. No host resolver, public fallback or upstream hostname lookup is used.
+The engine keeps `.internal`, localhost/local/home.arpa, private reverse space,
+bare names, configured blocked suffixes and every configured authoritative zone
+out of forwarding, including zones visible only in another view. Response aliases
+are inspected before returning them; private targets, cycles, excessive depth,
+unrelated answers and mismatched question/transaction IDs are rejected. Client
+EDNS/ECS/DNSSEC options are never sent upstream. The recursive upstream receives
+only the permitted external question; this engine never follows a private alias.
+
+Forwarding supports A, AAAA, NS, CNAME, SOA, PTR, MX, TXT and SRV questions and their
+known wire record shapes. Unknown or DNSSEC-specific response records fail closed;
+there is no opaque RDATA pass-through. The reusable protocol parser expands
+compressed name-bearing RDATA before re-encoding. AXFR, IXFR and ANY are refused.
+Forwarded positive TTLs are capped by `maxTtl`; negative TTLs also use the view's
+`negativeTtl`; both are clipped to remaining snapshot validity. UDP truncation
+retries the same upstream over TCP. One overall deadline (maximum 10 seconds), at
+most four upstreams, 1,024 allowed suffixes per view, 512 response records, 256 UDP jobs and 128 TCP connections
+bound forwarding work. A response arriving after replacement or expiry cannot
+answer under its old authority.
+
+`start()` binds both transports before admission. `stop()` closes admission, joins
+pending facade calls and all native query/connection work, and confirms child
+termination. Failed cleanup remains owned and retryable. A transport-ambiguous
+snapshot update prevents further mutations until cleanup; callers must reconcile
+their persisted intent. Each facade instance is single-use: construct a new one
+with the persisted revision floor after a stop. Stdin closure stops the native
+listeners when their parent dies. IPC commands have a 16 MiB allocation ceiling;
+snapshots have an 8 MiB encoded ceiling.
+
+The managed engine tests qualify these local protocol, view, revision and lifecycle
+behaviors. A platform using it still owns persistent SmartData/SmartDB recovery,
+workload interface isolation, authenticated cross-node configuration, endpoint
+readiness, trusted reboot-time recovery, CRI settings and complete node packaging.
+
+## Native distribution
+
+The npm package ships `rustdns` and `rustdns-client` as static Linux amd64 and
+arm64 musl binaries. The default bridges select the matching musl asset first.
+Managed DNS requires Linux for its boot identity and suspend-inclusive clock.
+Installer-owned bundles can select an exact absolute server binary path as
+shown above; carry [third-party-notices.md](./third-party-notices.md) and the
+complete `notices/` directory beside separately distributed executables.
+
+Builds use the Rust 1.95.0 pin and locked Cargo graph. Linux cross-build hosts
+need `musl-gcc`, `clang` for ring's arm64 freestanding C objects, and
+`aarch64-linux-gnu-gcc` as the arm64 linker. Rust's musl target supplies its static
+runtime. TLS explicitly selects the same ring provider installed at process
+startup, retaining TLS 1.2/1.3, logging and certificate verification.
+`pnpm build` produces both architectures and rejects dynamic Linux executables;
+its SHA-256-bound `.tsrust-build.json` sidecars identify each artifact's source.
+
 ## 🦀 Rust Crate Structure
 
 The Rust workspace (`rust/crates/`) contains five crates:
@@ -646,7 +843,7 @@ export default tap.start();
 
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license.md) file.
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 

package/third-party-notices.md

@@ -0,0 +1,96 @@
+# Third-party notices
+
+This notice set covers the static Linux amd64 and arm64 musl distributions of
+`rustdns` and `rustdns-client`. SmartDNS's own code is licensed under
+[license.md](./license.md). Keep this index and the complete `notices/` directory
+beside any separately distributed executable.
+
+## Cargo dependencies
+
+[Cargo dependency notices](./notices/cargo-dependencies.html) contain the selected
+license texts and package attributions for 203 dependencies. The exact license
+files for 13 additional locked but feature-inactive packages are included as
+supplements listed in [inventory.json](./notices/inventory.json). Together they
+cover all 216 third-party packages in the locked graph, including build-only and
+target-inactive dependencies conservatively. MIT is selected when offered as an
+alternative; Apache-2.0, ISC, BSD-3-Clause, Unicode-3.0, Zlib and
+CDLA-Permissive-2.0 apply where required. Listing an inactive package does not
+claim it is linked into either Linux binary.
+
+The inventory records every package's name, version and upstream license
+expression, the reviewed input and output hashes, and the provenance of the
+supplemental licenses and separate COPYRIGHT/NOTICES files. Exact copyright
+supplements cover cfg_aliases, fiat-crypto, group, rand, rand_chacha, rand_core and
+utf8_iter. All crate-derived supplemental files were checked against their
+Cargo.lock checksum-pinned published archives.
+
+`ring` 0.17.14 includes code under multiple licenses. Its exact
+[license index](./notices/ring-0.17.14-license.txt),
+[BoringSSL license](./notices/ring-0.17.14-license-boringssl.txt),
+[ISC license](./notices/ring-0.17.14-license-other-bits.txt),
+[fiat-crypto notice](./notices/ring-0.17.14-fiat-license.txt), and bundled once_cell
+[MIT](./notices/ring-0.17.14-once-cell-license-mit.txt) and
+[Apache-2.0](./notices/ring-0.17.14-once-cell-license-apache.txt) licenses are
+included. Its [source attribution supplement](./notices/ring-0.17.14-source-attributions.txt)
+retains copyright and license comments, grouping identical comments by source
+path and including build-only and target-inactive files conservatively. All
+seven files were verified against the published crate archive with SHA-256
+`a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7`.
+The crate's own scope statements remain intact.
+
+The native TLS dependency features select ring, matching the provider explicitly
+installed by both binaries. The unused default AWS-LC provider is not compiled.
+No TypeScript dependency executable is embedded in these Rust binaries; the npm
+dependency graph remains separately installed from its package manifests.
+
+## Compiler and static runtime
+
+`rust-toolchain.toml` pins Rust 1.95.0 and both musl targets. These notices cover
+runtime components supplied outside Cargo.lock:
+
+- [Rust standard-library inventory](./notices/rust-standard-library.html), from
+  the official 1.95.0 toolchain's `share/doc/rust/COPYRIGHT-library.html`. Its
+  upstream SHA-256 is
+  `90567e2718bf7fd65a71a3a43c5596488e80e5f51ed02bfea6fec54458b5f3d1`;
+  the local copy adds only a final newline. This upstream inventory includes
+  other targets without claiming they are linked into Linux.
+- [musl copyright and license](./notices/musl-copyright.txt), from
+  [musl 1.2.5](https://git.musl-libc.org/cgit/musl/tree/COPYRIGHT?h=v1.2.5).
+  Rust's [1.95.0 build recipe](https://github.com/rust-lang/rust/blob/1.95.0/src/ci/docker/scripts/musl-toolchain.sh)
+  selects musl 1.2.5 with its two recorded security patches.
+- [Compiler-builtins license](./notices/compiler-builtins-license.txt), from
+  [Rust 1.95.0](https://github.com/rust-lang/rust/blob/1.95.0/library/compiler-builtins/LICENSE.txt),
+  retaining the MIT and Apache-2.0 WITH LLVM-exception terms.
+- [LLVM libunwind license](./notices/llvm-libunwind-license.txt), from
+  [Rust's pinned LLVM source](https://github.com/rust-lang/llvm-project/blob/1cb4e3833c1919c2e6fb579a23ac0e2b22587b7e/libunwind/LICENSE.TXT),
+  including its additional third-party terms.
+
+## Reproduction and review
+
+Use cargo-about 0.9.1 from the repository root:
+
+```sh
+cargo about generate --manifest-path rust/Cargo.toml --config rust/about.toml --locked --fail --output-file notices/cargo-dependencies.html rust/about.hbs
+```
+
+The configuration preserves the full active graph and selects exact upstream
+attribution files for crates with missing or unrecognized license files. Network
+access is required for pinned Git notices. Generic license text with placeholder
+copyright holders is not a substitute. Windows crates use their exact
+`license-mit` files; curve25519-dalek uses its complete license with both sets of
+attributions. wasip2's omitted MIT notice is retrieved from its exact source
+commit. The feature-inactive valuable package's MIT notice is likewise copied
+from its exact source commit, recorded in the inventory.
+
+For every locked package omitted by cargo-about, copy its exact selected license
+from the checksum-verified crate archive, or its pinned source commit when the
+archive omits the license. Also retain separate COPYRIGHT/NOTICES files. For the
+ring supplement, collect copyright-bearing comments from `.rs`, `.c`, `.h`, `.S`
+and `.pl` files, preserving comment bytes and each source path; group only
+identical comments.
+
+After changing Cargo.lock, Cargo manifests, the compiler pin or generation
+inputs, regenerate and review the notices, refresh the inventory's SHA-256
+hashes and package list, and rerun distribution qualification. The notice tests
+reject stale inputs, changed notice files, missing locked packages, placeholder
+attributions and missing npm notice paths.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdns',
-  version: '8.2.0',
+  version: '8.3.0',
   description: 'A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.'
 }

package/dist_rust/rustdns-client_linux_amd64.tsrust-build.json

@@ -1,14 +0,0 @@
-{
-  "format": "tsrust.build-provenance.v2",
-  "binarySha256": "b0419c40c34a6d5fa6d6687847f9e7cb2290348d1fc0930fe4e83c808760078a",
-  "buildInfo": {
-    "projectName": "@push.rocks/smartdns",
-    "projectVersion": "8.2.0",
-    "gitCommit": "f3f7861802c8b26d517dd454add13e1bb0909c7b",
-    "gitDirty": false,
-    "builtAt": "2026-08-22T20:55:24.742Z",
-    "tsrustVersion": "1.10.0",
-    "binary": "rustdns-client",
-    "target": "linux_amd64"
-  }
-}

package/dist_rust/rustdns-client_linux_arm64.tsrust-build.json

@@ -1,14 +0,0 @@
-{
-  "format": "tsrust.build-provenance.v2",
-  "binarySha256": "8b24aa046dbac269aa71e6b7b554565d5f50e5664f8f6a54c59d7fe05d232ab5",
-  "buildInfo": {
-    "projectName": "@push.rocks/smartdns",
-    "projectVersion": "8.2.0",
-    "gitCommit": "f3f7861802c8b26d517dd454add13e1bb0909c7b",
-    "gitDirty": false,
-    "builtAt": "2026-08-22T20:55:25.226Z",
-    "tsrustVersion": "1.10.0",
-    "binary": "rustdns-client",
-    "target": "linux_arm64"
-  }
-}

package/dist_rust/rustdns_linux_amd64.tsrust-build.json

@@ -1,14 +0,0 @@
-{
-  "format": "tsrust.build-provenance.v2",
-  "binarySha256": "562c4ff14d42e17d0fccd653729eea025dc4eba7be56cb4b49cd2aafe1203bb4",
-  "buildInfo": {
-    "projectName": "@push.rocks/smartdns",
-    "projectVersion": "8.2.0",
-    "gitCommit": "f3f7861802c8b26d517dd454add13e1bb0909c7b",
-    "gitDirty": false,
-    "builtAt": "2026-08-22T20:55:24.742Z",
-    "tsrustVersion": "1.10.0",
-    "binary": "rustdns",
-    "target": "linux_amd64"
-  }
-}