@sdxc/doh 2026.10.6 → 2026.10.9

package/dist/caa/types.d.ts

@@ -0,0 +1,137 @@
+import type { ZoneFile } from "@sdxc/zone-file";
+/**
+ * The types of the CAA policy reading: what one record asks of a CA, the RRset RFC 8659
+ * applies to a name, the certificate request to decide, and the verdict, every one plain
+ * data but the lookup failure, so a verdict can be logged or stored as is.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { DoHError } from "../errors.js";
+import type { DoH } from "../types.js";
+/**
+ * Groups the CAA policy types under a single import surface.
+ */
+export declare namespace CAA {
+    /** One CAA record's data, from an answer or from `parseRecordData("CAA", …)` on a zone-file line. */
+    type Record = ZoneFile.CAAData;
+    /** One `key=value` from an `issue` or `issuewild` value, in published order. */
+    interface Parameter {
+        key: string;
+        value: string;
+    }
+    /** An `issue` or `issuewild` property. */
+    interface IssueProperty {
+        kind: "issue" | "issuewild";
+        critical: boolean;
+        /** The issuer domain, lowercased; `null` forbids issuance, as an empty or malformed value does. */
+        issuer: string | null;
+        /** The value failed RFC 8659's grammar, which forbids issuance the way an empty issuer does. */
+        malformed: boolean;
+        parameters: Parameter[];
+    }
+    /** Where a CA reports a refused or violating request. */
+    interface IodefProperty {
+        kind: "iodef";
+        critical: boolean;
+        /** The value when it parses as a `mailto:`, `http:` or `https:` URL, `null` otherwise. */
+        url: string | null;
+    }
+    /** A property this package does not interpret; with `critical` set it forbids issuance. */
+    interface UnknownProperty {
+        kind: "unknown";
+        critical: boolean;
+        tag: string;
+        value: string;
+    }
+    /** What one CAA record asks of a CA. */
+    type Property = IssueProperty | IodefProperty | UnknownProperty;
+    /** The RRset RFC 8659 §3 applies to a domain, and how it was found. */
+    interface RelevantSet {
+        /** The name whose query returned the records, the domain or an ancestor; `null` when none did. */
+        name: string | null;
+        records: DoH.CAARecord[];
+        /** Records of the set whose data did not parse; a CA cannot satisfy a set it cannot read. */
+        unparsed: DoH.UnknownRecord[];
+        /** Aliases the resolver followed for `name`; the records are owned by the chain's end. */
+        chain: DoH.CNAMERecord[];
+        /** Every name queried, nearest first. */
+        queried: string[];
+        /** Every answer in the climb carried the AD flag, denials of existence included. */
+        authenticated: boolean;
+    }
+    /** A certificate request to decide. */
+    interface Request {
+        /** The name on the certificate; `*.example.com` asks about a wildcard certificate. */
+        domain: string;
+        /** The CA's CAA identifiers, such as `letsencrypt.org`; any one matching authorizes. */
+        issuer: string | readonly string[];
+        /** RFC 8657 `accounturi` of the requesting account; omitted, the check is skipped. */
+        accountUri?: string;
+        /** RFC 8657 method label, such as `dns-01`; omitted, the check is skipped. */
+        validationMethod?: string;
+    }
+    /** The domain and its ancestors publish no CAA record, so any CA may issue. */
+    interface NoPolicy {
+        allowed: true;
+        reason: "no-policy";
+    }
+    /** The RRset holds no property that applies to the request, such as only `iodef`. */
+    interface Unrestricted {
+        allowed: true;
+        reason: "unrestricted";
+    }
+    /** `property` names one of the request's issuers and its parameters are satisfied. */
+    interface Authorized {
+        allowed: true;
+        reason: "authorized";
+        property: IssueProperty;
+    }
+    /** Every applicable property names no issuer: the policy forbids issuance outright. */
+    interface Forbidden {
+        allowed: false;
+        reason: "forbidden";
+    }
+    /** The applicable properties name issuers, none of them the request's. */
+    interface NotAuthorized {
+        allowed: false;
+        reason: "not-authorized";
+        /** The issuers the applicable properties do name, for a message the owner can act on. */
+        issuers: string[];
+    }
+    /** `property` names the request's issuer, and its RFC 8657 parameters exclude the request. */
+    interface ParameterMismatch {
+        allowed: false;
+        reason: "account-mismatch" | "validation-method-mismatch";
+        property: IssueProperty;
+    }
+    /** `property` is critical and of a kind no CA here is known to understand. */
+    interface CriticalTag {
+        allowed: false;
+        reason: "critical-tag";
+        property: UnknownProperty;
+    }
+    /** The relevant RRset holds a record whose data does not parse. */
+    interface Unreadable {
+        allowed: false;
+        reason: "unreadable";
+        record: DoH.UnknownRecord;
+    }
+    /** A query in the climb failed, which a CA reads as a refusal (RFC 8659 §6). */
+    interface LookupFailed {
+        allowed: false;
+        reason: "lookup-failed";
+        /** The name whose query failed. */
+        name: string;
+        queried: string[];
+        error: DoHError;
+    }
+    /** Where a verdict's policy came from. */
+    interface Located {
+        relevant: RelevantSet;
+    }
+    /** What one RRset says about one request. */
+    type Decision = NoPolicy | Unrestricted | Authorized | Forbidden | NotAuthorized | ParameterMismatch | CriticalTag;
+    /** What DNS says about one request; every failure reads `allowed: false`. */
+    type Verdict = ((Decision | Unreadable) & Located) | LookupFailed;
+}

package/dist/caa.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The WebPKI reading of CAA records (RFC 8659, RFC 8657): what a record asks of a CA, the
+ * RRset that applies to a name, and whether a CA may issue for it, kept apart from the DNS
+ * reading at the package root so every CAA answer stays as small as the record itself.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+export type { CAA } from "./caa/types.js";
+export { evaluateCaa } from "./caa/evaluate.js";
+export { mayIssue } from "./caa/may-issue.js";
+export { parseCaaProperty } from "./caa/property.js";
+export { findRelevantCaa } from "./caa/relevant-set.js";

package/dist/caa.js

@@ -0,0 +1,12 @@
+/**
+ * The WebPKI reading of CAA records (RFC 8659, RFC 8657): what a record asks of a CA, the
+ * RRset that applies to a name, and whether a CA may issue for it, kept apart from the DNS
+ * reading at the package root so every CAA answer stays as small as the record itself.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+export { evaluateCaa } from "./caa/evaluate.js";
+export { mayIssue } from "./caa/may-issue.js";
+export { parseCaaProperty } from "./caa/property.js";
+export { findRelevantCaa } from "./caa/relevant-set.js";

package/dist/errors.d.ts

@@ -17,11 +17,14 @@ export declare class NameNotFoundError extends DoHError {
      * (RFC 2308), or `null` when the answer carried no SOA.
      */
     readonly ttl: number | null;
+    /** The AD flag: the resolver validated the denial of existence with DNSSEC. */
+    readonly authenticated: boolean;
     /**
      * @param queried - The name that was looked up.
      * @param ttl - The negative-caching TTL, when known.
+     * @param authenticated - Whether the answer carried the AD flag.
      */
-    constructor(queried: string, ttl: number | null);
+    constructor(queried: string, ttl: number | null, authenticated?: boolean);
 }
 /** RCODE 2 (SERVFAIL): the resolver could not answer, a DNSSEC validation failure included. */
 export declare class ServerFailureError extends DoHError {
@@ -51,7 +54,3 @@ export declare class TransportError extends DoHError {
      */
     constructor(message: string, status: number | null, options?: ErrorOptions);
 }
-/** RDATA that does not parse for its type; `resolve` keeps such a record in `unparsed`. */
-export declare class RecordDataError extends Error {
-    name: string;
-}

package/dist/errors.js

@@ -17,13 +17,17 @@ export class NameNotFoundError extends DoHError {
      * (RFC 2308), or `null` when the answer carried no SOA.
      */
     ttl;
+    /** The AD flag: the resolver validated the denial of existence with DNSSEC. */
+    authenticated;
     /**
      * @param queried - The name that was looked up.
      * @param ttl - The negative-caching TTL, when known.
+     * @param authenticated - Whether the answer carried the AD flag.
      */
-    constructor(queried, ttl) {
+    constructor(queried, ttl, authenticated = false) {
         super(`${queried} does not exist (NXDOMAIN)`);
         this.ttl = ttl;
+        this.authenticated = authenticated;
     }
 }
 /** RCODE 2 (SERVFAIL): the resolver could not answer, a DNSSEC validation failure included. */
@@ -62,7 +66,3 @@ export class TransportError extends DoHError {
         this.status = status;
     }
 }
-/** RDATA that does not parse for its type; `resolve` keeps such a record in `unparsed`. */
-export class RecordDataError extends Error {
-    name = "RecordDataError";
-}

package/dist/index.d.ts

@@ -7,8 +7,7 @@
  * @copyright Sergio Xalambrí 2026
  */
 export type { DoH } from "./types.js";
-export { DoHError, NameNotFoundError, RecordDataError, ResponseCodeError, ServerFailureError, TransportError, } from "./errors.js";
-export { parseRecordData } from "./parse-record-data.js";
+export { DoHError, NameNotFoundError, ResponseCodeError, ServerFailureError, TransportError, } from "./errors.js";
 export { resolve } from "./resolve.js";
 export { CLOUDFLARE, GOOGLE } from "./resolvers.js";
 export { checkCname, verifyTxtRecord } from "./verify.js";

package/dist/index.js

@@ -6,8 +6,7 @@
  * @author [Sergio Xalambrí](https://sergiodxa.com)
  * @copyright Sergio Xalambrí 2026
  */
-export { DoHError, NameNotFoundError, RecordDataError, ResponseCodeError, ServerFailureError, TransportError, } from "./errors.js";
-export { parseRecordData } from "./parse-record-data.js";
+export { DoHError, NameNotFoundError, ResponseCodeError, ServerFailureError, TransportError, } from "./errors.js";
 export { resolve } from "./resolve.js";
 export { CLOUDFLARE, GOOGLE } from "./resolvers.js";
 export { checkCname, verifyTxtRecord } from "./verify.js";

package/dist/resolve.js

@@ -1,8 +1,7 @@
 import { failure, isSuccess, success } from "@sdxc/result";
+import { canonicalType, parseRecordData, typeName } from "@sdxc/zone-file";
 import * as s from "remix/data-schema";
 import { NameNotFoundError, ResponseCodeError, ServerFailureError, TransportError, } from "./errors.js";
-import { parseRecordData } from "./parse-record-data.js";
-import { canonicalType, typeName } from "./record-types.js";
 import { CLOUDFLARE } from "./resolvers.js";
 /** One resource record as the JSON API writes it. */
 const WIRE_RECORD_SCHEMA = s.object({
@@ -56,8 +55,10 @@ export async function resolve(name, type, options = {}) {
         return envelope;
     let durationMs = Math.round(performance.now() - started);
     let { Status: rcode } = envelope.data;
-    if (rcode === 3)
-        return failure(new NameNotFoundError(name, negativeTtl(envelope.data)));
+    if (rcode === 3) {
+        let authenticated = envelope.data.AD ?? false;
+        return failure(new NameNotFoundError(name, negativeTtl(envelope.data), authenticated));
+    }
     if (rcode === 2)
         return failure(new ServerFailureError(name));
     if (rcode !== 0)
@@ -70,15 +71,17 @@ export async function resolve(name, type, options = {}) {
         if (recordType !== asked && recordType !== "CNAME")
             continue;
         let base = { name: normalizeName(record.name), ttl: record.TTL };
-        let data = parseRecordData(recordType, record.data);
         if (recordType === asked) {
+            let data = parseRecordData(recordType, record.data);
             if (isSuccess(data))
                 records.push({ ...base, ...data.data });
             else
                 unparsed.push({ ...base, type: recordType, data: record.data });
         }
-        else if (isSuccess(data)) {
-            chain.push({ ...base, ...data.data });
+        else {
+            let data = parseRecordData("CNAME", record.data);
+            if (isSuccess(data))
+                chain.push({ ...base, ...data.data });
         }
     }
     let ttls = [...records, ...unparsed].map((record) => record.ttl);

package/dist/types.d.ts

@@ -6,12 +6,13 @@
  * @author [Sergio Xalambrí](https://sergiodxa.com)
  * @copyright Sergio Xalambrí 2026
  */
+import type { ZoneFile } from "@sdxc/zone-file";
 /**
  * Groups the DNS-over-HTTPS types under a single import surface.
  */
 export declare namespace DoH {
-    /** A record type by mnemonic; the nine typed ones autocomplete, any other name is accepted. */
-    type RecordType = "A" | "AAAA" | "CNAME" | "TXT" | "MX" | "NS" | "CAA" | "SOA" | "SRV" | (string & {});
+    /** A record type by mnemonic; the typed ones autocomplete, any other name is accepted. */
+    type RecordType = ZoneFile.RecordType;
     /**
      * A DoH endpoint and the encoding it answers in. `format` leaves room for an RFC 8484
      * `application/dns-message` resolver as a new value with no change to `resolve`.
@@ -27,80 +28,32 @@ export declare namespace DoH {
         /** Seconds the resolver allows the record to be cached. */
         ttl: number;
     }
-    /** An IPv4 address, in dotted-quad form. */
-    interface ARecord extends RecordBase {
-        type: "A";
-        address: string;
-    }
-    /** An IPv6 address. */
-    interface AAAARecord extends RecordBase {
-        type: "AAAA";
-        /** In RFC 5952 canonical form: lowercase, zero runs compressed. */
-        address: string;
-    }
+    /** The record a query for `Type` returns: its typed data, owner and TTL. */
+    type RecordFor<Type extends RecordType> = ZoneFile.RecordData<Type> & RecordBase;
+    /** An IPv4 address. */
+    type ARecord = RecordFor<"A">;
+    /** An IPv6 address, in RFC 5952 canonical form. */
+    type AAAARecord = RecordFor<"AAAA">;
     /** An alias: `name` resolves as `target` does. */
-    interface CNAMERecord extends RecordBase {
-        type: "CNAME";
-        target: string;
-    }
+    type CNAMERecord = RecordFor<"CNAME">;
     /** A name server authoritative for the zone at `name`. */
-    interface NSRecord extends RecordBase {
-        type: "NS";
-        host: string;
-    }
+    type NSRecord = RecordFor<"NS">;
+    /** A pointer to another name, the answer to a reverse lookup. */
+    type PTRRecord = RecordFor<"PTR">;
+    /** An alias for every name below `name`. */
+    type DNAMERecord = RecordFor<"DNAME">;
     /** A mail exchanger; lower `preference` values are tried first. */
-    interface MXRecord extends RecordBase {
-        type: "MX";
-        preference: number;
-        /** The mail host; `"."` is an RFC 7505 null MX, a domain that accepts no mail. */
-        exchange: string;
-    }
+    type MXRecord = RecordFor<"MX">;
     /** Free text, such as SPF policies, DKIM keys and verification tokens. */
-    interface TXTRecord extends RecordBase {
-        type: "TXT";
-        /** The character-strings concatenated with nothing between them, as SPF and DKIM read it. */
-        text: string;
-        /** The character-strings as published, for the rare record whose boundaries matter. */
-        strings: string[];
-    }
+    type TXTRecord = RecordFor<"TXT">;
     /** Which certificate authorities may issue for the name (RFC 8659). */
-    interface CAARecord extends RecordBase {
-        type: "CAA";
-        /** The issuer-critical flag: a CA that does not understand `tag` must refuse to issue. */
-        critical: boolean;
-        tag: string;
-        value: string;
-    }
-    /** Where a service runs; lower `priority` first, `weight` spreads load within one priority. */
-    interface SRVRecord extends RecordBase {
-        type: "SRV";
-        priority: number;
-        weight: number;
-        port: number;
-        target: string;
-    }
+    type CAARecord = RecordFor<"CAA">;
+    /** Where a service runs. */
+    type SRVRecord = RecordFor<"SRV">;
     /** The zone's start of authority, found at its apex and in negative answers. */
-    interface SOARecord extends RecordBase {
-        type: "SOA";
-        primary: string;
-        /** The responsible mailbox in DNS form: its first label is the local part. */
-        mailbox: string;
-        serial: number;
-        refresh: number;
-        retry: number;
-        expire: number;
-        /** Bounds how long a negative answer may be cached (RFC 2308). */
-        minimum: number;
-    }
+    type SOARecord = RecordFor<"SOA">;
     /** A record of a type without a typed reading, or one whose data failed to parse, with its raw RDATA. */
-    interface UnknownRecord extends RecordBase {
-        type: string;
-        data: string;
-    }
-    /** The record a query for `Type` returns. */
-    type RecordFor<Type extends RecordType> = Type extends "A" ? ARecord : Type extends "AAAA" ? AAAARecord : Type extends "CNAME" ? CNAMERecord : Type extends "TXT" ? TXTRecord : Type extends "MX" ? MXRecord : Type extends "NS" ? NSRecord : Type extends "CAA" ? CAARecord : Type extends "SOA" ? SOARecord : Type extends "SRV" ? SRVRecord : UnknownRecord;
-    /** A record's type-specific fields, what `parseRecordData` reads out of RDATA. */
-    type RecordData<Type extends RecordType> = Omit<RecordFor<Type>, "name" | "ttl">;
+    type UnknownRecord = ZoneFile.UnknownData & RecordBase;
     /** A successful (NOERROR) answer to one query. */
     interface Answer<Type extends RecordType> {
         /** The queried name, lowercased and without the trailing dot. */

package/dist/types.js

@@ -1,8 +0,0 @@
-/**
- * The types a DNS-over-HTTPS lookup reads and returns: the resolver it talks to, one
- * interface per typed record, and the answer that splits records of the asked type from
- * the CNAME chain that led to them.
- *
- * @author [Sergio Xalambrí](https://sergiodxa.com)
- * @copyright Sergio Xalambrí 2026
- */

package/package.json

@@ -1,17 +1,19 @@
 {
 	"name": "@sdxc/doh",
-	"version": "2026.10.6",
+	"version": "2026.10.9",
 	"description": "Typed DNS over HTTPS lookups",
 	"license": "MIT",
 	"type": "module",
 	"exports": {
-		".": "./dist/index.js"
+		".": "./dist/index.js",
+		"./caa": "./dist/caa.js"
 	},
 	"dependencies": {
 		"@sdxc/result": "2026.10.6",
+		"@sdxc/zone-file": "2026.10.9",
 		"remix": "3.0.0"
 	},
-	"gitHead": "b1067eb20fc47ec51ff8c4de47d07dc3f9c00466",
+	"gitHead": "64fa732ed0a8ca8693a35aeef6345ae5be2534ef",
 	"publishConfig": {
 		"access": "public"
 	},

package/dist/character-strings.d.ts

@@ -1,22 +0,0 @@
-/**
- * Reads the character-strings of TXT RDATA in presentation format (RFC 1035 section 5.1):
- * quoted strings keep their spaces, bare words split on whitespace, and `\"`, `\\` and
- * `\DDD` escapes are decoded, so a resolver's quoting never leaks into the text.
- *
- * @author [Sergio Xalambrí](https://sergiodxa.com)
- * @copyright Sergio Xalambrí 2026
- */
-import type { Result } from "@sdxc/result";
-import { RecordDataError } from "./errors.js";
-/**
- * Splits TXT presentation data into its character-strings. Escapes are decoded to octets
- * and each string is read as UTF-8, so text a resolver writes as `\195\169` comes back as
- * `é`. Fails on an unterminated quote or a decimal escape above 255.
- *
- * @param data - One or more quoted or bare character-strings.
- * @returns The strings in order, empty strings included.
- * @example readCharacterStrings('"v=DKIM1; p=AAA" "BBB"') // success(["v=DKIM1; p=AAA", "BBB"])
- */
-export declare function readCharacterStrings(data: string): Result<string[], RecordDataError>;
-/** Decodes octets as UTF-8, the reading applied to every character-string. */
-export declare function decodeOctets(octets: Uint8Array): string;

package/dist/character-strings.js

@@ -1,72 +0,0 @@
-import { failure, success } from "@sdxc/result";
-import { RecordDataError } from "./errors.js";
-/** Decodes a character-string's octets as UTF-8, replacing invalid sequences with U+FFFD. */
-const DECODER = new TextDecoder();
-/** Encodes literal characters into the octets they stand for. */
-const ENCODER = new TextEncoder();
-/** Whether a character separates character-strings. */
-function isSpace(char) {
-    return char === " " || char === "\t" || char === "\n" || char === "\r";
-}
-/**
- * Splits TXT presentation data into its character-strings. Escapes are decoded to octets
- * and each string is read as UTF-8, so text a resolver writes as `\195\169` comes back as
- * `é`. Fails on an unterminated quote or a decimal escape above 255.
- *
- * @param data - One or more quoted or bare character-strings.
- * @returns The strings in order, empty strings included.
- * @example readCharacterStrings('"v=DKIM1; p=AAA" "BBB"') // success(["v=DKIM1; p=AAA", "BBB"])
- */
-export function readCharacterStrings(data) {
-    let chars = Array.from(data);
-    let strings = [];
-    let index = 0;
-    while (index < chars.length) {
-        if (isSpace(chars[index])) {
-            index += 1;
-            continue;
-        }
-        let quoted = chars[index] === '"';
-        if (quoted)
-            index += 1;
-        let octets = [];
-        let terminated = !quoted;
-        while (index < chars.length) {
-            let char = chars[index] ?? "";
-            if (quoted && char === '"') {
-                terminated = true;
-                index += 1;
-                break;
-            }
-            if (!quoted && isSpace(char))
-                break;
-            if (char === "\\") {
-                let digits = chars.slice(index + 1, index + 4).join("");
-                if (/^\d{3}$/.test(digits)) {
-                    let octet = Number(digits);
-                    if (octet > 255)
-                        return failure(new RecordDataError(`Invalid escape \\${digits} in TXT data`));
-                    octets.push(octet);
-                    index += 4;
-                    continue;
-                }
-                let next = chars[index + 1];
-                if (next === undefined)
-                    return failure(new RecordDataError("TXT data ends in a lone backslash"));
-                octets.push(...ENCODER.encode(next));
-                index += 2;
-                continue;
-            }
-            octets.push(...ENCODER.encode(char));
-            index += 1;
-        }
-        if (!terminated)
-            return failure(new RecordDataError("TXT data has an unterminated quoted string"));
-        strings.push(DECODER.decode(new Uint8Array(octets)));
-    }
-    return success(strings);
-}
-/** Decodes octets as UTF-8, the reading applied to every character-string. */
-export function decodeOctets(octets) {
-    return DECODER.decode(octets);
-}

package/dist/parse-record-data.d.ts

@@ -1,23 +0,0 @@
-/**
- * Reads record data in presentation format, as a DoH JSON answer or a zone file writes it,
- * into typed fields per record type. RFC 3597 generic data (`\# len hex`) is decoded from
- * its wire form, which is how some resolvers answer types such as CAA.
- *
- * @author [Sergio Xalambrí](https://sergiodxa.com)
- * @copyright Sergio Xalambrí 2026
- */
-import type { Result } from "@sdxc/result";
-import type { DoH } from "./types.js";
-import { RecordDataError } from "./errors.js";
-/**
- * Reads a record's data into its typed fields. Types without a typed reading come back
- * as `{ type, data }` with the data unchanged. Names are lowercased without the trailing
- * dot, except the root, which stays `"."`.
- *
- * @param type - The record type, as a mnemonic or RFC 3597 `TYPEnnn`.
- * @param data - The RDATA in presentation format.
- * @returns The record's fields, or why the data does not fit the type.
- * @template Type - The record type, which selects the fields returned.
- * @example parseRecordData("MX", "10 mx.example.com.") // success({ type: "MX", preference: 10, exchange: "mx.example.com" })
- */
-export declare function parseRecordData<Type extends DoH.RecordType>(type: Type, data: string): Result<DoH.RecordData<Type>, RecordDataError>;