@sdxc/zone-file 2026.10.10 → 2026.10.25

package/README.md

@@ -2,42 +2,71 @@
 
 Read and write RFC 1035 DNS zone files, with the record data codec for every typed record.
 
+A zone file (a BIND "master file") is how DNS operators export, import, review and version a
+zone. `parse` reads the whole grammar and returns the records it read beside every entry it could
+not use; `stringify` writes records back, so `parse(stringify(zone))` gives the same records.
+
 ## Installation
 
-```bash
+```sh
 npm add @sdxc/zone-file
 ```
 
-`parse` returns a [`@sdxc/result`](https://www.npmjs.com/package/@sdxc/result) value, which
-installs alongside this package.
-
-A zone file (a BIND "master file") is how DNS operators export, import, review and version a
-zone. `parse` reads the whole RFC 1035 grammar — `$ORIGIN`, `$TTL`, `$INCLUDE`, parentheses,
-blank owners, escapes, TTL units, any class and any type — and returns the records it read beside
-every entry it could not use, each with its line and a reason. `stringify` writes records back, so
-`parse(stringify(zone))` gives the same records.
+`parse` and `parseRecordData` return a `Result` from
+[`@sdxc/result`](https://www.npmjs.com/package/@sdxc/result), which installs alongside this
+package.
 
 ## Usage
 
-### Read A Zone File
+### Read a zone file
 
 ```typescript
-import * as ZoneFile from "@sdxc/zone-file";
-import { isSuccess } from "@sdxc/result";
+import { formatRecordData, parse } from "@sdxc/zone-file";
+import { isFailure } from "@sdxc/result";
+
+let text = `$TTL 1h
+@    IN SOA ns1 hostmaster ( 1 2h 1h 1w 5m )
+     IN NS  ns1 ; primary
+www  IN A   192.0.2.1
+`;
 
-let parsed = ZoneFile.parse(text, { origin: "example.com" });
-if (isSuccess(parsed)) {
-	for (let record of parsed.data.records) console.log(record.name, record.ttl, record.type);
-	for (let rejection of parsed.data.rejected) console.warn(rejection.line, rejection.message);
+let parsed = parse(text, { origin: "example.com" });
+if (isFailure(parsed)) throw parsed.error; // only for input over `maxBytes`
+
+for (let record of parsed.data.records) {
+	console.log(record.name, record.ttl, record.type, formatRecordData(record));
 }
+// example.com 3600 SOA ns1.example.com. hostmaster.example.com. 1 7200 3600 604800 300
+// example.com 3600 NS ns1.example.com.
+// www.example.com 3600 A 192.0.2.1
+```
+
+Every record comes back with an absolute, lowercased `name`, its `ttl`, `class`, `type`, the
+typed fields of its type (`address`, `host`, `serial`…) and where it was written (`file`, `line`,
+`endLine`, `comment`).
+
+### Check what it could not read
+
+An entry that does not parse becomes a rejection, and the rest of the file still reads.
+
+```typescript
+import { parse } from "@sdxc/zone-file";
+import { unwrap } from "@sdxc/result";
+
+let zone = unwrap(parse("bad IN A 999.1.1.1\nok IN A 192.0.2.1\n", { origin: "example.com" }));
+
+zone.records.length; // 1
+zone.rejected;
+// [{ file: null, line: 1, endLine: 1, input: "bad IN A 999.1.1.1",
+//    reason: "invalid-data", message: 'Invalid A record data: "999.1.1.1"' }]
 ```
 
-### Write One
+### Write a zone file
 
 ```typescript
-import * as ZoneFile from "@sdxc/zone-file";
+import { stringify } from "@sdxc/zone-file";
 
-let text = ZoneFile.stringify(
+let text = stringify(
 	{
 		origin: "example.com",
 		ttl: 3600,
@@ -54,169 +83,243 @@ let text = ZoneFile.stringify(
 // www	300	IN	CNAME	@
 ```
 
-### Read Record Data From Anywhere
+### Read and print record data on its own
 
 ```typescript
-import { parseRecordData } from "@sdxc/zone-file";
+import { formatRecordData, parseRecordData } from "@sdxc/zone-file";
 
 parseRecordData("MX", "10 Mail.Example.com.");
 // success({ type: "MX", preference: 10, exchange: "mail.example.com" })
+
+formatRecordData({ type: "MX", preference: 10, exchange: "mail.example.com" });
+// "10 mail.example.com."
 ```
 
 ## API
 
-### `parse(text, options): Result<ZoneFile.Zone, ZoneFileError>`
+### `parse(text: string, options: ParseOptions): Result<Zone, ZoneFileError>`
 
-Reads a zone file into `{ origin, records, rejected }`. The only failure is a `ZoneFileError`
-for input past `maxBytes`; any other problem — a bad line, an unknown directive, RDATA that does
-not fit its type — is a `Rejection` beside the records that did parse, so a caller wanting
-all-or-nothing checks `rejected.length`.
+Reads a zone file into `{ origin, records, rejected }`. It fails only with a `ZoneFileError` for
+input over `maxBytes`; every other problem is a `Rejection` beside the records that did parse,
+and a caller that wants all-or-nothing checks `rejected.length`. Every record is returned —
+outside the origin, repeated, any class, any type — and the caller decides which to keep.
 
-| Option          | Default     | Meaning                                                                                                          |
-| --------------- | ----------- | ---------------------------------------------------------------------------------------------------------------- |
-| `origin`        | Required    | The initial `$ORIGIN`; `@` and relative names resolve against it until a `$ORIGIN` line changes it               |
-| `ttl`           | `null`      | The TTL a record gets when neither it, a `$TTL` nor an earlier record states one                                 |
-| `include`       | None        | `(fileName, origin) => string \| null`, the text of an `$INCLUDE`d file; without it every `$INCLUDE` is rejected |
-| `relativeNames` | `"rfc1035"` | `"origin-suffix"` also reads a dotless name that equals the origin or ends in it as absolute                     |
-| `maxBytes`      | 1 MiB       | The largest input in UTF-8 bytes, counted across included files                                                  |
+| Option          | Default     | Meaning                                                                                                            |
+| --------------- | ----------- | ------------------------------------------------------------------------------------------------------------------ |
+| `origin`        | Required    | The initial `$ORIGIN`; `@` and relative names resolve against it                                                   |
+| `ttl`           | `null`      | The TTL a record gets when neither it, a `$TTL` nor an earlier record states one                                   |
+| `include`       | None        | `(fileName, origin) => string \| null` returns an `$INCLUDE`d file's text; without it every `$INCLUDE` is rejected |
+| `relativeNames` | `"rfc1035"` | `"origin-suffix"` also reads a dotless name that equals the origin or ends in it as absolute                       |
+| `maxBytes`      | 1 MiB       | The largest input in UTF-8 bytes, counted across included files                                                    |
 
-The grammar:
+The grammar it reads:
 
 - `;` starts a comment outside quotes; a record's trailing comment is kept as `comment`.
-- `"…"` quotes a field, with `\"`, `\\` and `\DDD` escapes; a `;` or parenthesis inside is data.
-- `(` … `)` joins lines into one entry; `line` is where it starts and `endLine` where it ends.
-- `@` is the current origin, and a name without a trailing dot gets the origin appended, in owners
-  and in the name fields of typed RDATA.
-- Names come back absolute, lowercased, without the trailing dot, `\DDD` and `\.` escapes resolved
-  to one canonical spelling; the root is `"."`.
+- `"…"` quotes a field, with `\"`, `\\` and `\DDD` escapes.
+- `(` … `)` joins lines into one entry, from `line` to `endLine`.
+- `@` is the current origin, and a name without a trailing dot gets the origin appended, in
+  owners and in the name fields of typed data. Names come back absolute, lowercased, without the
+  trailing dot; the root is `"."`.
 - A line starting with whitespace takes the previous record's owner.
 - TTL and class are optional, in either order. A TTL is seconds or BIND units (`1h30m`, `2W`), up
-  to 2³¹−1. A record without one takes `$TTL`, else the previous record's TTL, else `options.ttl`.
-- `$ORIGIN`, `$TTL` and `$INCLUDE file [origin]` are read. An included file starts with the given
-  or current origin, and the origin, `$TTL` and owner revert after it; includes nest 8 deep.
-  `$GENERATE` is rejected.
+  to 2³¹−1; a record without one takes `$TTL`, else the previous record's TTL, else
+  `options.ttl`.
+- `$ORIGIN`, `$TTL` and `$INCLUDE file [origin]` are read. An included file starts at the given
+  or current origin, the origin, `$TTL` and owner revert after it, and includes nest 8 deep.
 - Classes are `IN`, `CH`, `HS`, `CS` and `CLASSnnn`; types are any mnemonic or `TYPEnnn`, and RFC
   3597 generic data (`\# 4 C0000201`) is read for every type.
 
-Records outside the origin, a record listed twice, classes other than `IN` and every type are all
-returned: which of them to keep is the caller's decision.
-
-### `stringify(zone, options?): string`
+### `stringify(zone: ZoneInput, options?: StringifyOptions): string`
 
-Writes `{ origin?, ttl?, records }` (a parsed `Zone` is one) as one tab-separated line per record.
-`$ORIGIN` and `$TTL` lead when the input names them, and a record's TTL is left out when it equals
-`$TTL`. `relative: true` writes names under the origin relative to it and the apex as `@`;
-otherwise every name is absolute. An untyped record read under another origin gets an `$ORIGIN`
-line first, so relative names in its verbatim data keep their meaning. Comments are written back
-after `;`; spacing, standalone comments and parentheses are not kept.
+Writes `{ origin?, ttl?, records }` (a parsed `Zone` is one) as one tab-separated line per record,
+ending in a newline. `$ORIGIN` and `$TTL` lead when the input names them, and a record's TTL is
+left out when it equals `$TTL`. `relative: true` writes names under the origin relative to it and
+the apex as `@`; otherwise every name is absolute. Comments are written back after `;`; spacing,
+standalone comments and parentheses are not.
 
-### `parseRecordData(type, data): Result<ZoneFile.RecordData<Type>, RecordDataError>`
+### `parseRecordData<Type extends RecordType>(type: Type, data: string): Result<RecordData<Type>, RecordDataError>`
 
-Reads RDATA in presentation format into typed fields. Typed types: `A` and `AAAA` (`address`, IPv6
-in RFC 5952 form), `CNAME`, `PTR` and `DNAME` (`target`), `NS` (`host`), `MX` (`preference`,
-`exchange`), `TXT` (`text`, `strings`), `CAA` (`flags`, `critical`, `tag`, `value`), `SRV`
-(`priority`, `weight`, `port`, `target`) and `SOA` (`primary`, `mailbox`, `serial`, `refresh`,
-`retry`, `expire`, `minimum`, the timers accepting TTL units). Any other type returns
-`{ type, data }`. RFC 3597 generic data is decoded for the typed types. Names are not qualified:
-relative names stay relative.
+Reads RDATA in presentation format, or RFC 3597 generic form, into the typed fields of `A`,
+`AAAA`, `CNAME`, `NS`, `PTR`, `DNAME`, `MX`, `TXT`, `CAA`, `SRV`, `SOA` (SOA timers accept TTL
+units), `SVCB` and `HTTPS` (their SvcParams as `params`), `TLSA`, `DS`, `CDS`, `DNSKEY` and
+`CDNSKEY` (with the key's `keyTag`). Any other type returns `{ type, data }` as written. Names come back lowercased
+without the trailing dot, and a relative name stays relative.
 
 ```typescript
 parseRecordData("TXT", '"v=DKIM1; p=AAA" "BBB"');
 // success({ type: "TXT", text: "v=DKIM1; p=AAABBB", strings: ["v=DKIM1; p=AAA", "BBB"] })
 ```
 
-### `formatRecordData(data): string`
+### `formatRecordData(data: RecordData<RecordType>): string`
 
 Prints record data in canonical presentation format, the inverse of `parseRecordData`: names
-absolute with the trailing dot, TXT strings and the CAA value quoted with every octet outside
-printable ASCII as `\DDD`, the CAA tag lowercased, untyped data as is. Two spellings of one record —
-`0 ISSUE "ca.example"` and its generic form — print to one string.
+absolute with the trailing dot, TXT strings, the CAA value and SvcParam text quoted with
+non-printable octets as `\DDD`, hex lowercase, SvcParams in key order, untyped data as is. Two spellings of one record, such as `0 ISSUE "ca.example"` and its
+generic form, print to one string.
 
-```typescript
-formatRecordData({ type: "MX", preference: 10, exchange: "mx.example.com" }); // "10 mx.example.com."
-```
+### `canonicalType(type: string): string`
+
+The uppercase mnemonic for a type, resolving `TYPEnnn` when it has one: `canonicalType("type16")`
+is `"TXT"`.
 
-### `canonicalType(type): string` / `typeName(code): string`
+### `typeName(code: number): string`
 
-`canonicalType("txt")` is `"TXT"` and `canonicalType("TYPE16")` is `"TXT"`; `typeName(16)` is
-`"TXT"`, and a code without a mnemonic is `"TYPEnnn"`.
+The mnemonic for a type code, or `TYPEnnn` without one: `typeName(16)` is `"TXT"`.
 
-### Errors
+### `typeCode(type: string): number | null`
 
-| Class             | When                                                                                   |
-| ----------------- | -------------------------------------------------------------------------------------- |
-| `ZoneFileError`   | `code: "too-large"`: the input, with its includes, passed `maxBytes`; `bytes` holds it |
-| `RecordDataError` | `parseRecordData` on data that does not fit the type                                   |
+The code for a mnemonic or `TYPEnnn`, `null` for an unknown mnemonic: `typeCode("HTTPS")` is `65`.
 
-### Rejection reasons
+### `ZoneFileError`
 
-| `reason`                | When                                                                                      |
-| ----------------------- | ----------------------------------------------------------------------------------------- |
-| `malformed`             | An unterminated quote, unbalanced parentheses, a bad owner or TTL, a missing type or data |
-| `invalid-data`          | RDATA that does not fit its type; `message` holds the codec's error                       |
-| `missing-owner`         | A blank owner with no earlier record to take it from                                      |
-| `include`               | `$INCLUDE` without the `include` option, a file it returned `null` for, or nesting past 8 |
-| `unsupported-directive` | `$GENERATE` or any other `$` word                                                         |
+The failure `parse` returns when the input, with its includes, passes `maxBytes`. `code` is
+`"too-large"` and `bytes` holds the size read.
 
-Each rejection carries `file` (`null` for the text passed to `parse`), `line`, `endLine`, `input`
-(the entry as written) and `message`.
+### `RecordDataError`
 
-### `ZoneFile` namespace
+The failure `parseRecordData` returns for data that does not fit its type.
 
-Types only: `Zone`, `Record`, `RecordFor<Type>`, `RecordFields`, `UntypedRecord`, `Rejection`,
-`RejectionReason`, `ParseOptions`, `ZoneInput`, `RecordInput`, `StringifyOptions`, `RecordType`,
-`TypedRecordType`, `RecordClass`, `RecordData<Type>`, and one data interface per typed type
-(`AData` through `SOAData`) plus `UnknownData`.
+### Types
 
-## Pattern: Import Only What You Track
+Every type is exported top-level and under the `ZoneFile` namespace (`ZoneFile.Zone`).
 
-`parse` returns everything; the policy is a filter.
+- `Zone`: `{ origin, records, rejected }`, where `origin` is the origin at the end of the file.
+- `Record`: any record read from a file; `RecordFor<Type>` narrows it to one type, and
+  `RecordFields` is what every record carries beside its data (`name`, `ttl`, `class`, `file`,
+  `line`, `endLine`, `comment`).
+- `UntypedRecord`: a record of a type without typed fields, with its `data` as written and the
+  `origin` its relative names need.
+- `Rejection`: `{ file, line, endLine, input, reason, message }` for an entry that did not become
+  a record. `RejectionReason` is `"malformed"`, `"invalid-data"`, `"missing-owner"`, `"include"`
+  (no `include` option, a file it returned `null` for, or nesting past 8) or
+  `"unsupported-directive"` (`$GENERATE` or any other `$` word).
+- `RecordData<Type>`: the typed fields of a type: `AData`, `AAAAData`, `CNAMEData`, `NSData`,
+  `PTRData`, `DNAMEData`, `MXData`, `TXTData`, `CAAData`, `SRVData`, `SOAData`, `SVCBData`,
+  `HTTPSData` (with `SvcParams`), `TLSAData`, `DSData`, `CDSData`, `DNSKEYData`, `CDNSKEYData`,
+  or `UnknownData`.
+- `RecordType`, `TypedRecordType`, `RecordClass`: type and class names.
+- `ParseOptions`, `StringifyOptions`: the options above.
+- `ZoneInput`, `RecordInput`, `RecordInputFields`: what `stringify` accepts; a record needs only
+  `name`, its type and fields, with optional `ttl`, `class` (default `"IN"`) and `comment`.
+
+## Pattern: Import Only The Records You Track
+
+`parse` returns everything, so an import policy is a filter. Exports from DNS providers often drop
+the trailing dot on fully-qualified names; `relativeNames: "origin-suffix"` reads those as
+absolute.
 
 ```typescript
-import * as ZoneFile from "@sdxc/zone-file";
+import { parse } from "@sdxc/zone-file";
 import { isFailure } from "@sdxc/result";
 
-let parsed = ZoneFile.parse(text, { origin: domain, relativeNames: "origin-suffix" });
-if (isFailure(parsed)) throw new Error(parsed.error.message);
-
-let tracked = parsed.data.records.filter(
-	(record) =>
-		record.class === "IN" &&
-		["A", "AAAA", "MX", "TXT"].includes(record.type) &&
-		(record.name === domain || record.name.endsWith(`.${domain}`)),
-);
+function importZone(text: string, domain: string) {
+	let parsed = parse(text, { origin: domain, relativeNames: "origin-suffix" });
+	if (isFailure(parsed)) return { records: [], errors: [parsed.error.message] };
+
+	let records = parsed.data.records.filter(
+		(record) =>
+			record.class === "IN" &&
+			["A", "AAAA", "MX", "TXT"].includes(record.type) &&
+			(record.name === domain || record.name.endsWith(`.${domain}`)),
+	);
+	let errors = parsed.data.rejected.map((entry) => `Line ${entry.line}: ${entry.message}`);
+	return { records, errors };
+}
 ```
 
 ## Pattern: Normalize A Zone File For Review
 
-Reading and printing gives every zone one spelling — absolute names, canonical addresses, quoted
+Reading and printing gives every zone one spelling — lowercased names, canonical addresses, quoted
 TXT — so two exports diff only where their records differ.
 
 ```typescript
-import * as ZoneFile from "@sdxc/zone-file";
+import { parse, stringify } from "@sdxc/zone-file";
 import { unwrap } from "@sdxc/result";
 
 function normalize(text: string, origin: string): string {
-	let zone = unwrap(ZoneFile.parse(text, { origin }));
-	let records = [...zone.records].sort((a, b) => a.name.localeCompare(b.name));
-	return ZoneFile.stringify({ origin, records }, { relative: true });
+	let zone = unwrap(parse(text, { origin }));
+	let records = [...zone.records].sort(
+		(a, b) => a.name.localeCompare(b.name) || a.type.localeCompare(b.type),
+	);
+	return stringify({ origin, records }, { relative: true });
+}
+```
+
+## Pattern: Refuse A File With Any Bad Line
+
+For an all-or-nothing import, treat any rejection as a failure and report each with its line.
+
+```typescript
+import type { Result } from "@sdxc/result";
+import type { Zone } from "@sdxc/zone-file";
+
+import { parse } from "@sdxc/zone-file";
+import { failure, isFailure, success } from "@sdxc/result";
+
+function parseStrict(text: string, origin: string): Result<Zone, Error> {
+	let parsed = parse(text, { origin, maxBytes: 256 * 1024 });
+	if (isFailure(parsed)) return parsed;
+
+	let { rejected } = parsed.data;
+	if (rejected.length === 0) return success(parsed.data);
+
+	let lines = rejected.map((entry) => `Line ${entry.line} (${entry.reason}): ${entry.input}`);
+	return failure(new Error(lines.join("\n")));
 }
 ```
 
 ## Pattern: Read A Zone With Includes
 
+The `include` callback supplies each `$INCLUDE`d file; records from it carry its name as `file`.
+
 ```typescript
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
-import * as ZoneFile from "@sdxc/zone-file";
+import { parse } from "@sdxc/zone-file";
 
-let parsed = ZoneFile.parse(readFileSync("zones/example.com.zone", "utf8"), {
+let parsed = parse(readFileSync("zones/example.com.zone", "utf8"), {
 	origin: "example.com",
+	ttl: 3600,
 	include: (fileName) => readFileSync(join("zones", fileName), "utf8"),
 });
 ```
 
+## Pattern: Compare A Zone File With Live DNS
+
+A resolver answers with a type code and RDATA that may be in generic form. Reading both sides with
+`parseRecordData` and printing with `formatRecordData` gives one key per record, whichever way it
+was spelled.
+
+```typescript
+import { formatRecordData, parse, parseRecordData, typeName } from "@sdxc/zone-file";
+import { isSuccess, unwrap } from "@sdxc/result";
+
+interface Answer {
+	name: string;
+	type: number;
+	data: string;
+}
+
+async function missingFromDns(text: string, origin: string, name: string, type: string) {
+	let url = new URL("https://cloudflare-dns.com/dns-query");
+	url.searchParams.set("name", name);
+	url.searchParams.set("type", type);
+	let response = await fetch(url, { headers: { Accept: "application/dns-json" } });
+	let body = (await response.json()) as { Answer?: Answer[] };
+
+	let live = new Set<string>();
+	for (let answer of body.Answer ?? []) {
+		let data = parseRecordData(typeName(answer.type), answer.data);
+		if (isSuccess(data)) live.add(formatRecordData(data.data));
+	}
+
+	return unwrap(parse(text, { origin }))
+		.records.filter((record) => record.name === name && record.type === type)
+		.filter((record) => !live.has(formatRecordData(record)));
+}
+```
+
 ## Versioning
 
 Releases are dated rather than semantic. A version is the UTC date it was published,

package/dist/addresses.d.ts

@@ -0,0 +1,17 @@
+/**
+ * IP address codecs for A and AAAA data and the SVCB address hints: the strict dotted-quad
+ * reading, RFC 5952 canonical IPv6, and the octets each spells on the wire.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** Whether text is an IPv4 address in the dotted-quad form A data takes. */
+export declare function isIpv4(value: string): boolean;
+/** An IPv6 literal in RFC 5952 canonical form, or `null` when the text is not one. */
+export declare function canonicalIpv6(value: string): string | null;
+/** The four octets of a dotted-quad IPv4 address, or `null` when the text is not one. */
+export declare function ipv4Octets(value: string): Uint8Array | null;
+/** The sixteen octets of an IPv6 address, or `null` when the text is not one. */
+export declare function ipv6Octets(value: string): Uint8Array | null;
+/** Prints sixteen octets as an RFC 5952 canonical IPv6 address. */
+export declare function printIpv6(octets: Uint8Array): string;

package/dist/addresses.js

@@ -0,0 +1,50 @@
+/**
+ * IP address codecs for A and AAAA data and the SVCB address hints: the strict dotted-quad
+ * reading, RFC 5952 canonical IPv6, and the octets each spells on the wire.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/**
+ * A dotted-quad IPv4 address without leading zeros, which `inet_aton` would read as octal
+ * and browsers as decimal, so an address carrying them has no single meaning.
+ */
+const IPV4_PATTERN = /^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+/** Whether text is an IPv4 address in the dotted-quad form A data takes. */
+export function isIpv4(value) {
+    return IPV4_PATTERN.test(value);
+}
+/** An IPv6 literal in RFC 5952 canonical form, or `null` when the text is not one. */
+export function canonicalIpv6(value) {
+    if (!value.includes(":"))
+        return null;
+    let url = URL.parse(`http://[${value}]/`);
+    return url ? url.hostname.slice(1, -1) : null;
+}
+/** The four octets of a dotted-quad IPv4 address, or `null` when the text is not one. */
+export function ipv4Octets(value) {
+    return isIpv4(value) ? Uint8Array.from(value.split("."), Number) : null;
+}
+/** The sixteen octets of an IPv6 address, or `null` when the text is not one. */
+export function ipv6Octets(value) {
+    let canonical = canonicalIpv6(value);
+    if (canonical === null)
+        return null;
+    let [head = "", tail] = canonical.split("::");
+    let leading = head === "" ? [] : head.split(":");
+    let trailing = tail === undefined || tail === "" ? [] : tail.split(":");
+    let zeros = Array.from({ length: 8 - leading.length - trailing.length }, () => "0");
+    let groups = tail === undefined ? leading : [...leading, ...zeros, ...trailing];
+    let octets = new Uint8Array(16);
+    groups.forEach((group, index) => {
+        let word = Number.parseInt(group, 16);
+        octets[index * 2] = word >> 8;
+        octets[index * 2 + 1] = word & 0xff;
+    });
+    return octets;
+}
+/** Prints sixteen octets as an RFC 5952 canonical IPv6 address. */
+export function printIpv6(octets) {
+    let groups = Array.from({ length: 8 }, (_, index) => (((octets[index * 2] ?? 0) << 8) | (octets[index * 2 + 1] ?? 0)).toString(16));
+    return canonicalIpv6(groups.join(":")) ?? groups.join(":");
+}

package/dist/dnssec.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The DNSSEC pieces DS and DNSKEY data share: the algorithm mnemonics RFC 4034 lets a zone
+ * file write in place of a number, and the key tag a DS record names its DNSKEY by, so a
+ * delegation's DS set can be matched against the child's keys.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** An algorithm field as a number, read from its decimal or its mnemonic; `null` for neither. */
+export declare function readAlgorithm(field: string | undefined): number | null;
+/**
+ * The key tag of DNSKEY RDATA (RFC 4034 Appendix B): the octets summed as big-endian 16-bit
+ * words with the carry folded back in once, and for an RSA/MD5 (algorithm 1) key the
+ * modulus's second- and third-to-last octets, as that appendix specifies for it.
+ *
+ * @param rdata - The DNSKEY RDATA in wire form: flags, protocol, algorithm and key.
+ */
+export declare function keyTag(rdata: Uint8Array): number;

package/dist/dnssec.js

@@ -0,0 +1,53 @@
+/**
+ * The DNSSEC pieces DS and DNSKEY data share: the algorithm mnemonics RFC 4034 lets a zone
+ * file write in place of a number, and the key tag a DS record names its DNSKEY by, so a
+ * delegation's DS set can be matched against the child's keys.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** The DNSSEC algorithm numbers by IANA mnemonic; the uppercase mnemonic reads as its number. */
+const ALGORITHMS = {
+    RSAMD5: 1,
+    DH: 2,
+    DSA: 3,
+    RSASHA1: 5,
+    "DSA-NSEC3-SHA1": 6,
+    "RSASHA1-NSEC3-SHA1": 7,
+    RSASHA256: 8,
+    RSASHA512: 10,
+    "ECC-GOST": 12,
+    ECDSAP256SHA256: 13,
+    ECDSAP384SHA384: 14,
+    ED25519: 15,
+    ED448: 16,
+    INDIRECT: 252,
+    PRIVATEDNS: 253,
+    PRIVATEOID: 254,
+};
+/** An algorithm field as a number, read from its decimal or its mnemonic; `null` for neither. */
+export function readAlgorithm(field) {
+    if (field === undefined)
+        return null;
+    if (/^\d+$/.test(field)) {
+        let number = Number(field);
+        return number <= 0xff ? number : null;
+    }
+    return ALGORITHMS[field.toUpperCase()] ?? null;
+}
+/**
+ * The key tag of DNSKEY RDATA (RFC 4034 Appendix B): the octets summed as big-endian 16-bit
+ * words with the carry folded back in once, and for an RSA/MD5 (algorithm 1) key the
+ * modulus's second- and third-to-last octets, as that appendix specifies for it.
+ *
+ * @param rdata - The DNSKEY RDATA in wire form: flags, protocol, algorithm and key.
+ */
+export function keyTag(rdata) {
+    if (rdata[3] === 1 && rdata.length >= 7)
+        return ((rdata[rdata.length - 3] ?? 0) << 8) | (rdata[rdata.length - 2] ?? 0);
+    let sum = 0;
+    for (let index = 0; index < rdata.length; index++)
+        sum += index % 2 === 0 ? (rdata[index] ?? 0) << 8 : (rdata[index] ?? 0);
+    sum += (sum >> 16) & 0xffff;
+    return sum & 0xffff;
+}

package/dist/format-record-data.d.ts

@@ -8,10 +8,9 @@
  */
 import type * as ZoneFile from "./types.js";
 /**
- * Prints a record's data in canonical presentation format. Names print absolute with the
- * trailing dot (the root stays `"."`), TXT and CAA values print quoted with `"` and `\`
- * escaped and every octet outside printable ASCII as `\DDD`, and untyped data prints as is.
- * `parseRecordData(data.type, formatRecordData(data))` gives back `data`.
+ * Prints a record's data in canonical presentation format: names absolute, free text quoted
+ * with every octet outside printable ASCII as `\DDD`, hex lowercase, SvcParams in key order,
+ * untyped data as is. `parseRecordData(data.type, formatRecordData(data))` gives back `data`.
  *
  * @param data - Record data, as `parseRecordData` produces it.
  * @returns The RDATA in presentation format.

package/dist/format-record-data.js

@@ -1,11 +1,11 @@
 import { absoluteName } from "./names.js";
+import { printSvcParams } from "./svc-params.js";
 /** Encodes a character-string into the octets `\DDD` escapes stand for. */
 const ENCODER = new TextEncoder();
 /**
- * Prints a record's data in canonical presentation format. Names print absolute with the
- * trailing dot (the root stays `"."`), TXT and CAA values print quoted with `"` and `\`
- * escaped and every octet outside printable ASCII as `\DDD`, and untyped data prints as is.
- * `parseRecordData(data.type, formatRecordData(data))` gives back `data`.
+ * Prints a record's data in canonical presentation format: names absolute, free text quoted
+ * with every octet outside printable ASCII as `\DDD`, hex lowercase, SvcParams in key order,
+ * untyped data as is. `parseRecordData(data.type, formatRecordData(data))` gives back `data`.
  *
  * @param data - Record data, as `parseRecordData` produces it.
  * @returns The RDATA in presentation format.
@@ -62,6 +62,26 @@ export function printRecordData(data, printName) {
                 soa.minimum,
             ].join(" ");
         }
+        case "SVCB":
+        case "HTTPS": {
+            let { priority, target, params } = data;
+            let printed = printSvcParams(params, quote);
+            return `${priority} ${printName(target)}${printed ? ` ${printed}` : ""}`;
+        }
+        case "TLSA": {
+            let tlsa = data;
+            return `${tlsa.usage} ${tlsa.selector} ${tlsa.matchingType} ${tlsa.certificateAssociation}`;
+        }
+        case "DS":
+        case "CDS": {
+            let ds = data;
+            return `${ds.keyTag} ${ds.algorithm} ${ds.digestType} ${ds.digest}`;
+        }
+        case "DNSKEY":
+        case "CDNSKEY": {
+            let key = data;
+            return `${key.flags} ${key.protocol} ${key.algorithm} ${key.publicKey}`;
+        }
         default:
             return String(data.data);
     }

package/dist/index.d.ts

@@ -12,5 +12,5 @@ export { RecordDataError, ZoneFileError } from "./errors.js";
 export { formatRecordData } from "./format-record-data.js";
 export { parse } from "./parse.js";
 export { parseRecordData } from "./parse-record-data.js";
-export { canonicalType, typeName } from "./record-types.js";
+export { canonicalType, typeCode, typeName } from "./record-types.js";
 export { stringify } from "./stringify.js";