@sdxc/zone-file 2026.10.10 → 2026.10.25

package/dist/index.js

@@ -10,5 +10,5 @@ export { RecordDataError, ZoneFileError } from "./errors.js";
 export { formatRecordData } from "./format-record-data.js";
 export { parse } from "./parse.js";
 export { parseRecordData } from "./parse-record-data.js";
-export { canonicalType, typeName } from "./record-types.js";
+export { canonicalType, typeCode, typeName } from "./record-types.js";
 export { stringify } from "./stringify.js";

package/dist/octets.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Hex and base64 codecs for the binary fields of DNSSEC, DANE and SVCB records, which the
+ * presentation format writes as text a zone file may split across whitespace and lines.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** The octets a hex string spells, whitespace ignored; `null` for an odd or non-hex run, or none. */
+export declare function decodeHex(text: string): Uint8Array | null;
+/** Octets as lowercase hex, the spelling DS digests and TLSA data compare in. */
+export declare function encodeHex(octets: Uint8Array): string;
+/** The octets a base64 string spells, whitespace ignored; `null` for text that is not base64, or none. */
+export declare function decodeBase64(text: string): Uint8Array | null;
+/** Octets as padded base64, the spelling DNSKEY keys and SVCB `ech` print in. */
+export declare function encodeBase64(octets: Uint8Array): string;

package/dist/octets.js

@@ -0,0 +1,37 @@
+/**
+ * Hex and base64 codecs for the binary fields of DNSSEC, DANE and SVCB records, which the
+ * presentation format writes as text a zone file may split across whitespace and lines.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** Hex text in pairs, with any whitespace between digits already removed. */
+const HEX_PATTERN = /^(?:[0-9a-fA-F]{2})+$/;
+/** Canonical base64: complete quads, padding only at the end. */
+const BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+/** The octets a hex string spells, whitespace ignored; `null` for an odd or non-hex run, or none. */
+export function decodeHex(text) {
+    let hex = text.replace(/\s+/g, "");
+    if (!HEX_PATTERN.test(hex))
+        return null;
+    let octets = new Uint8Array(hex.length / 2);
+    for (let index = 0; index < octets.length; index++)
+        octets[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+    return octets;
+}
+/** Octets as lowercase hex, the spelling DS digests and TLSA data compare in. */
+export function encodeHex(octets) {
+    return Array.from(octets, (octet) => octet.toString(16).padStart(2, "0")).join("");
+}
+/** The octets a base64 string spells, whitespace ignored; `null` for text that is not base64, or none. */
+export function decodeBase64(text) {
+    let base64 = text.replace(/\s+/g, "");
+    if (base64.length === 0 || !BASE64_PATTERN.test(base64))
+        return null;
+    let binary = atob(base64);
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+/** Octets as padded base64, the spelling DNSKEY keys and SVCB `ech` print in. */
+export function encodeBase64(octets) {
+    return btoa(Array.from(octets, (octet) => String.fromCharCode(octet)).join(""));
+}

package/dist/parse-record-data.js

@@ -1,14 +1,13 @@
 import { failure, isFailure, success } from "@sdxc/result";
+import { canonicalIpv6, isIpv4, printIpv6 } from "./addresses.js";
 import { decodeOctets, readCharacterStrings } from "./character-strings.js";
+import { keyTag, readAlgorithm } from "./dnssec.js";
 import { RecordDataError } from "./errors.js";
 import { canonicalName, printLabels } from "./names.js";
+import { decodeBase64, decodeHex, encodeBase64, encodeHex } from "./octets.js";
 import { canonicalType } from "./record-types.js";
+import { readSvcParams, readWireSvcParams } from "./svc-params.js";
 import { readTtl } from "./ttl.js";
-/**
- * A dotted-quad IPv4 address without leading zeros, which `inet_aton` would read as octal
- * and browsers as decimal, so an address carrying them has no single meaning.
- */
-const IPV4_PATTERN = /^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
 /**
  * Reads a record's data into its typed fields; untyped types come back as `{ type, data }`.
  * Names come back canonical (lowercased, escapes resolved, no trailing dot, the root as
@@ -39,19 +38,41 @@ function readNumber(field, max) {
     let number = Number(field);
     return number <= max ? number : null;
 }
-/** An IPv6 literal in RFC 5952 canonical form, or `null` when the text is not one. */
-function canonicalIpv6(value) {
-    if (!value.includes(":"))
-        return null;
-    let url = URL.parse(`http://[${value}]/`);
-    return url ? url.hostname.slice(1, -1) : null;
+/**
+ * The fields of DNSKEY data from its wire octets, the key tag computed over them, so the
+ * presentation and generic spellings of one key agree on every field.
+ */
+function dnskeyFields(rdata) {
+    let flags = ((rdata[0] ?? 0) << 8) | (rdata[1] ?? 0);
+    return {
+        flags,
+        zoneKey: (flags & 0x0100) !== 0,
+        secureEntryPoint: (flags & 0x0001) !== 0,
+        protocol: rdata[2] ?? 0,
+        algorithm: rdata[3] ?? 0,
+        publicKey: encodeBase64(rdata.subarray(4)),
+        keyTag: keyTag(rdata),
+    };
+}
+/** Reads the leading `count` whitespace-separated fields and the rest of the text after them. */
+function splitLeading(value, count) {
+    let fields = [];
+    let rest = value;
+    for (let index = 0; index < count; index++) {
+        let match = /^(\S+)\s*/.exec(rest);
+        if (!match)
+            break;
+        fields.push(match[1] ?? "");
+        rest = rest.slice(match[0].length);
+    }
+    return [fields, rest];
 }
 /** Reads presentation-format data for the typed record types. */
 function parsePresentation(type, value) {
     let fields = value.split(/\s+/).filter((field) => field.length > 0);
     switch (type) {
         case "A":
-            return IPV4_PATTERN.test(value) ? success({ type, address: value }) : invalid(type, value);
+            return isIpv4(value) ? success({ type, address: value }) : invalid(type, value);
         case "AAAA": {
             let address = canonicalIpv6(value);
             return address ? success({ type, address }) : invalid(type, value);
@@ -133,6 +154,50 @@ function parsePresentation(type, value) {
                 minimum,
             });
         }
+        case "SVCB":
+        case "HTTPS": {
+            let [[priorityField, targetField], rest] = splitLeading(value, 2);
+            let priority = readNumber(priorityField, 0xffff);
+            let target = targetField === undefined ? null : canonicalName(targetField);
+            let params = readSvcParams(rest);
+            if (priority === null || target === null || params === null)
+                return invalid(type, value);
+            return success({ type, priority, target, params });
+        }
+        case "TLSA": {
+            let [leading, rest] = splitLeading(value, 3);
+            let [usage, selector, matchingType] = leading.map((field) => readNumber(field, 0xff));
+            let association = decodeHex(rest);
+            if (usage == null || selector == null || matchingType == null || !association)
+                return invalid(type, value);
+            let certificateAssociation = encodeHex(association);
+            return success({ type, usage, selector, matchingType, certificateAssociation });
+        }
+        case "DS":
+        case "CDS": {
+            let [[tagField, algorithmField, digestTypeField], rest] = splitLeading(value, 3);
+            let keyTag = readNumber(tagField, 0xffff);
+            let algorithm = readAlgorithm(algorithmField);
+            let digestType = readNumber(digestTypeField, 0xff);
+            let digest = decodeHex(rest);
+            if (keyTag === null || algorithm === null || digestType === null || !digest)
+                return invalid(type, value);
+            return success({ type, keyTag, algorithm, digestType, digest: encodeHex(digest) });
+        }
+        case "DNSKEY":
+        case "CDNSKEY": {
+            let [[flagsField, protocolField, algorithmField], rest] = splitLeading(value, 3);
+            let flags = readNumber(flagsField, 0xffff);
+            let protocol = readNumber(protocolField, 0xff);
+            let algorithm = readAlgorithm(algorithmField);
+            let key = decodeBase64(rest);
+            if (flags === null || protocol === null || algorithm === null || !key)
+                return invalid(type, value);
+            let rdata = new Uint8Array(4 + key.length);
+            rdata.set([flags >> 8, flags & 0xff, protocol, algorithm]);
+            rdata.set(key, 4);
+            return success({ type, ...dnskeyFields(rdata) });
+        }
         default:
             return success({ type, data: value });
     }
@@ -187,10 +252,7 @@ class WireReader {
             }
             case "AAAA": {
                 let bytes = this.#bytes(16);
-                if (!bytes)
-                    return null;
-                let groups = Array.from({ length: 8 }, (_, index) => (((bytes[index * 2] ?? 0) << 8) | (bytes[index * 2 + 1] ?? 0)).toString(16));
-                return { address: canonicalIpv6(groups.join(":")) ?? groups.join(":") };
+                return bytes ? { address: printIpv6(bytes) } : null;
             }
             case "CNAME":
             case "PTR":
@@ -250,6 +312,39 @@ class WireReader {
                 let [serial, refresh, retry, expire, minimum] = numbers;
                 return { primary, mailbox, serial, refresh, retry, expire, minimum };
             }
+            case "SVCB":
+            case "HTTPS": {
+                let priority = this.#uint(2);
+                let target = this.#name();
+                let params = readWireSvcParams(this.#rest());
+                if (priority === null || target === null || params === null)
+                    return null;
+                return { priority, target, params };
+            }
+            case "TLSA": {
+                let [usage, selector, matchingType] = [this.#uint(1), this.#uint(1), this.#uint(1)];
+                let association = this.#rest();
+                if (usage === null || selector === null || matchingType === null)
+                    return null;
+                if (association.length === 0)
+                    return null;
+                return { usage, selector, matchingType, certificateAssociation: encodeHex(association) };
+            }
+            case "DS":
+            case "CDS": {
+                let [keyTag, algorithm, digestType] = [this.#uint(2), this.#uint(1), this.#uint(1)];
+                let digest = this.#rest();
+                if (keyTag === null || algorithm === null || digestType === null)
+                    return null;
+                if (digest.length === 0)
+                    return null;
+                return { keyTag, algorithm, digestType, digest: encodeHex(digest) };
+            }
+            case "DNSKEY":
+            case "CDNSKEY": {
+                let rdata = this.#rest();
+                return rdata.length > 4 ? dnskeyFields(rdata) : null;
+            }
             default:
                 return "unknown";
         }
@@ -262,6 +357,10 @@ class WireReader {
         this.#offset += length;
         return bytes;
     }
+    /** Every octet left, which the types ending in a variable-length field read as that field. */
+    #rest() {
+        return this.#bytes(this.#octets.length - this.#offset) ?? new Uint8Array();
+    }
     /** A big-endian unsigned integer of `size` octets. */
     #uint(size) {
         let bytes = this.#bytes(size);

package/dist/parse.js

@@ -20,6 +20,8 @@ const NAME_FIELDS = {
     MX: [1],
     SRV: [3],
     SOA: [0, 1],
+    SVCB: [1],
+    HTTPS: [1],
 };
 /** The class numbers with a mnemonic, so `CLASS1` and `IN` read as one class. */
 const CLASS_NAMES = { "1": "IN", "2": "CS", "3": "CH", "4": "HS" };

package/dist/record-types.d.ts

@@ -8,6 +8,14 @@
 import type * as ZoneFile from "./types.js";
 /** The mnemonic for a type code, or `TYPEnnn` when it has none here. */
 export declare function typeName(code: number): string;
+/**
+ * The IANA code of a type, given as a mnemonic or `TYPEnnn`, so a caller building a query
+ * message can name the type the way a zone file does; `null` for a mnemonic it does not know.
+ *
+ * @example typeCode("HTTPS") // 65
+ * @example typeCode("TYPE65280") // 65280
+ */
+export declare function typeCode(type: string): number | null;
 /**
  * The spelling of a type as a record's `type`: the uppercase mnemonic, and a known
  * mnemonic for `TYPEnnn` when one exists.

package/dist/record-types.js

@@ -43,6 +43,13 @@ const TYPED_TYPES = new Set([
     "CAA",
     "SRV",
     "SOA",
+    "SVCB",
+    "HTTPS",
+    "TLSA",
+    "DS",
+    "CDS",
+    "DNSKEY",
+    "CDNSKEY",
 ]);
 /** The mnemonic for each code in {@link TYPE_CODES}. */
 const TYPE_NAMES = new Map(Object.entries(TYPE_CODES).map(([name, code]) => [code, name]));
@@ -50,6 +57,22 @@ const TYPE_NAMES = new Map(Object.entries(TYPE_CODES).map(([name, code]) => [cod
 export function typeName(code) {
     return TYPE_NAMES.get(code) ?? `TYPE${code}`;
 }
+/**
+ * The IANA code of a type, given as a mnemonic or `TYPEnnn`, so a caller building a query
+ * message can name the type the way a zone file does; `null` for a mnemonic it does not know.
+ *
+ * @example typeCode("HTTPS") // 65
+ * @example typeCode("TYPE65280") // 65280
+ */
+export function typeCode(type) {
+    let upper = type.trim().toUpperCase();
+    let generic = /^TYPE(\d{1,5})$/.exec(upper);
+    if (generic) {
+        let code = Number(generic[1]);
+        return code <= 0xffff ? code : null;
+    }
+    return TYPE_CODES[upper] ?? null;
+}
 /**
  * The spelling of a type as a record's `type`: the uppercase mnemonic, and a known
  * mnemonic for `TYPEnnn` when one exists.

package/dist/svc-params.d.ts

@@ -0,0 +1,24 @@
+import type * as ZoneFile from "./types.js";
+/**
+ * Reads the params of SVCB or HTTPS presentation data, the fields after the target.
+ * Fails on an unknown or repeated key and on a value its key does not accept.
+ *
+ * @param text - Zero or more `key[=value]` fields.
+ */
+export declare function readSvcParams(text: string): ZoneFile.SvcParams | null;
+/**
+ * Reads the params of SVCB or HTTPS wire data, the octets after the target. Keys must
+ * strictly increase, as RFC 9460 requires of the wire form.
+ *
+ * @param octets - The SvcParams octets, `key length value` repeated.
+ */
+export declare function readWireSvcParams(octets: Uint8Array): ZoneFile.SvcParams | null;
+/**
+ * Prints params in canonical presentation form, keys in ascending number order and values
+ * quoted wherever they are free text, so two spellings of one record print alike.
+ *
+ * @param params - The params to print.
+ * @param quote - Prints a character-string with its escapes.
+ * @returns The fields joined by spaces; empty for no params.
+ */
+export declare function printSvcParams(params: ZoneFile.SvcParams, quote: (text: string) => string): string;

package/dist/svc-params.js

@@ -0,0 +1,338 @@
+/**
+ * The SvcParams codec SVCB and HTTPS share (RFC 9460): presentation `key=value` lists and
+ * their wire form both read into one wire-keyed map first, so the two spellings validate
+ * by the same rules and come out as the same `SvcParams`.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { isFailure } from "@sdxc/result";
+import { ipv4Octets, ipv6Octets, printIpv6 } from "./addresses.js";
+import { decodeOctets, readCharacterStrings } from "./character-strings.js";
+import { decodeBase64, encodeBase64 } from "./octets.js";
+/** The registered SvcParamKeys by number; any other key is spelled `keyNNNNN`. */
+const KEY_NAMES = {
+    0: "mandatory",
+    1: "alpn",
+    2: "no-default-alpn",
+    3: "port",
+    4: "ipv4hint",
+    5: "ech",
+    6: "ipv6hint",
+    7: "dohpath",
+    8: "ohttp",
+};
+/** The number of each registered key name. */
+const KEY_NUMBERS = new Map(Object.entries(KEY_NAMES).map(([number, name]) => [name, Number(number)]));
+/** Encodes the text of a value into the octets it is on the wire. */
+const ENCODER = new TextEncoder();
+/** The presentation name of a key number. */
+function keyName(key) {
+    return KEY_NAMES[key] ?? `key${key}`;
+}
+/** The number of a key name, registered or `keyNNNNN`; `null` for anything else and for the reserved 65535. */
+function keyNumber(name) {
+    let generic = /^key(0|[1-9]\d{0,4})$/.exec(name);
+    let number = generic ? Number(generic[1]) : (KEY_NUMBERS.get(name) ?? null);
+    return number !== null && number < 0xffff ? number : null;
+}
+/**
+ * Splits presentation params into `key[=value]` fields on whitespace outside quotes,
+ * stepping over escaped characters so `\"` and `\ ` stay inside their field.
+ */
+function splitFields(text) {
+    let fields = [];
+    let field = "";
+    let quoted = false;
+    for (let index = 0; index < text.length; index++) {
+        let char = text[index] ?? "";
+        if (char === "\\") {
+            field += text.slice(index, index + 2);
+            index += 1;
+        }
+        else if (char === '"') {
+            quoted = !quoted;
+            field += char;
+        }
+        else if (!quoted && /\s/.test(char)) {
+            if (field.length > 0)
+                fields.push(field);
+            field = "";
+        }
+        else {
+            field += char;
+        }
+    }
+    if (field.length > 0)
+        fields.push(field);
+    return fields;
+}
+/** A value's text with its quoting and escapes removed, `key=` as empty; `null` for more than one character-string. */
+function readValue(raw) {
+    if (raw.length === 0)
+        return "";
+    let strings = readCharacterStrings(raw);
+    if (isFailure(strings) || strings.data.length !== 1)
+        return null;
+    return strings.data[0] ?? null;
+}
+/**
+ * Splits a value-list (RFC 9460 Appendix A.1) on its unescaped commas, `\,` and `\\`
+ * standing for a literal comma and backslash; `null` when any item is empty.
+ */
+function splitValueList(value) {
+    let items = [];
+    let item = "";
+    for (let index = 0; index < value.length; index++) {
+        let char = value[index] ?? "";
+        if (char === "\\" && index + 1 < value.length) {
+            item += value[index + 1];
+            index += 1;
+        }
+        else if (char === ",") {
+            items.push(item);
+            item = "";
+        }
+        else {
+            item += char;
+        }
+    }
+    items.push(item);
+    return items.every((entry) => entry.length > 0) ? items : null;
+}
+/** Joins octet runs into one. */
+function concat(parts) {
+    let octets = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+    let offset = 0;
+    for (let part of parts) {
+        octets.set(part, offset);
+        offset += part.length;
+    }
+    return octets;
+}
+/** A 16-bit big-endian integer's two octets. */
+function uint16(value) {
+    return Uint8Array.of(value >> 8, value & 0xff);
+}
+/** Reads every item of a value-list through `read`, `null` when the list or any item is invalid. */
+function encodeList(value, read) {
+    let items = splitValueList(value);
+    if (!items)
+        return null;
+    let parts = items.map(read);
+    return parts.every((part) => part !== null) ? concat(parts) : null;
+}
+/** The wire octets of one key's presentation value; `value` is `null` when the field has no `=`. */
+function encodeValue(key, value) {
+    switch (key) {
+        case 0: {
+            if (value === null)
+                return null;
+            let items = splitValueList(value);
+            let keys = items?.map(keyNumber);
+            if (!keys || keys.some((number) => number === null))
+                return null;
+            return concat(keys.sort((a, b) => a - b).map(uint16));
+        }
+        case 1:
+            return value === null
+                ? null
+                : encodeList(value, (item) => {
+                    let octets = ENCODER.encode(item);
+                    return octets.length <= 0xff ? concat([Uint8Array.of(octets.length), octets]) : null;
+                });
+        case 2:
+        case 8:
+            return value === null || value === "" ? new Uint8Array() : null;
+        case 3:
+            return value !== null && /^\d{1,5}$/.test(value) && Number(value) <= 0xffff
+                ? uint16(Number(value))
+                : null;
+        case 4:
+            return value === null ? null : encodeList(value, ipv4Octets);
+        case 5:
+            return value === null ? null : decodeBase64(value);
+        case 6:
+            return value === null ? null : encodeList(value, ipv6Octets);
+        default:
+            return ENCODER.encode(value ?? "");
+    }
+}
+/**
+ * Reads the params of SVCB or HTTPS presentation data, the fields after the target.
+ * Fails on an unknown or repeated key and on a value its key does not accept.
+ *
+ * @param text - Zero or more `key[=value]` fields.
+ */
+export function readSvcParams(text) {
+    let values = new Map();
+    for (let field of splitFields(text)) {
+        let separator = field.indexOf("=");
+        let key = keyNumber(separator === -1 ? field : field.slice(0, separator));
+        if (key === null || values.has(key))
+            return null;
+        let value = separator === -1 ? null : readValue(field.slice(separator + 1));
+        if (separator !== -1 && value === null)
+            return null;
+        let octets = encodeValue(key, value);
+        if (!octets)
+            return null;
+        values.set(key, octets);
+    }
+    return decodeSvcParams(new Map([...values].sort(([a], [b]) => a - b)));
+}
+/**
+ * Reads the params of SVCB or HTTPS wire data, the octets after the target. Keys must
+ * strictly increase, as RFC 9460 requires of the wire form.
+ *
+ * @param octets - The SvcParams octets, `key length value` repeated.
+ */
+export function readWireSvcParams(octets) {
+    let values = new Map();
+    let offset = 0;
+    let previous = -1;
+    while (offset < octets.length) {
+        if (offset + 4 > octets.length)
+            return null;
+        let key = ((octets[offset] ?? 0) << 8) | (octets[offset + 1] ?? 0);
+        let length = ((octets[offset + 2] ?? 0) << 8) | (octets[offset + 3] ?? 0);
+        offset += 4;
+        if (key <= previous || key === 0xffff || offset + length > octets.length)
+            return null;
+        values.set(key, octets.subarray(offset, offset + length));
+        offset += length;
+        previous = key;
+    }
+    return decodeSvcParams(values);
+}
+/** Splits octets into runs of `size`, `null` when they do not divide evenly or are empty. */
+function chunks(octets, size) {
+    if (octets.length === 0 || octets.length % size !== 0)
+        return null;
+    return Array.from({ length: octets.length / size }, (_, index) => octets.subarray(index * size, index * size + size));
+}
+/** Reads length-prefixed ALPN ids, `null` when one is empty or overruns the value. */
+function readAlpn(octets) {
+    let ids = [];
+    let offset = 0;
+    while (offset < octets.length) {
+        let length = octets[offset] ?? 0;
+        if (length === 0 || offset + 1 + length > octets.length)
+            return null;
+        ids.push(decodeOctets(octets.subarray(offset + 1, offset + 1 + length)));
+        offset += 1 + length;
+    }
+    return ids.length > 0 ? ids : null;
+}
+/**
+ * Turns wire values into `SvcParams`, enforcing what RFC 9460 asks of every key: values of
+ * the right shape, and a `mandatory` list of distinct keys that are all present and exclude
+ * `mandatory` itself.
+ */
+function decodeSvcParams(values) {
+    let params = {};
+    for (let [key, value] of values) {
+        switch (key) {
+            case 0: {
+                let keys = chunks(value, 2)?.map((pair) => ((pair[0] ?? 0) << 8) | (pair[1] ?? 0));
+                if (!keys)
+                    return null;
+                let increasing = keys.every((number, index) => index === 0 || number > (keys[index - 1] ?? 0));
+                if (!increasing || keys.some((number) => number === 0 || !values.has(number)))
+                    return null;
+                params.mandatory = keys.map(keyName);
+                break;
+            }
+            case 1: {
+                let alpn = readAlpn(value);
+                if (!alpn)
+                    return null;
+                params.alpn = alpn;
+                break;
+            }
+            case 2:
+            case 8:
+                if (value.length !== 0)
+                    return null;
+                if (key === 2)
+                    params.noDefaultAlpn = true;
+                else
+                    params.ohttp = true;
+                break;
+            case 3:
+                if (value.length !== 2)
+                    return null;
+                params.port = ((value[0] ?? 0) << 8) | (value[1] ?? 0);
+                break;
+            case 4: {
+                let addresses = chunks(value, 4);
+                if (!addresses)
+                    return null;
+                params.ipv4Hint = addresses.map((address) => Array.from(address).join("."));
+                break;
+            }
+            case 5:
+                if (value.length === 0)
+                    return null;
+                params.ech = encodeBase64(value);
+                break;
+            case 6: {
+                let addresses = chunks(value, 16);
+                if (!addresses)
+                    return null;
+                params.ipv6Hint = addresses.map(printIpv6);
+                break;
+            }
+            case 7:
+                if (value.length === 0)
+                    return null;
+                params.dohPath = decodeOctets(value);
+                break;
+            default:
+                params.other = { ...params.other, [key]: decodeOctets(value) };
+        }
+    }
+    return params;
+}
+/** Escapes a value-list item so its commas and backslashes read back as part of it. */
+function escapeItem(item) {
+    return item.replace(/[\\,]/g, "\\$&");
+}
+/**
+ * Prints params in canonical presentation form, keys in ascending number order and values
+ * quoted wherever they are free text, so two spellings of one record print alike.
+ *
+ * @param params - The params to print.
+ * @param quote - Prints a character-string with its escapes.
+ * @returns The fields joined by spaces; empty for no params.
+ */
+export function printSvcParams(params, quote) {
+    let fields = [];
+    if (params.mandatory) {
+        let keys = params.mandatory.map((name) => [keyNumber(name) ?? 0xffff, name]);
+        let sorted = keys.sort(([a], [b]) => a - b).map(([, name]) => name);
+        fields.push([0, `mandatory=${sorted.join(",")}`]);
+    }
+    if (params.alpn)
+        fields.push([1, `alpn=${quote(params.alpn.map(escapeItem).join(","))}`]);
+    if (params.noDefaultAlpn)
+        fields.push([2, "no-default-alpn"]);
+    if (params.port !== undefined)
+        fields.push([3, `port=${params.port}`]);
+    if (params.ipv4Hint)
+        fields.push([4, `ipv4hint=${params.ipv4Hint.join(",")}`]);
+    if (params.ech !== undefined)
+        fields.push([5, `ech=${params.ech}`]);
+    if (params.ipv6Hint)
+        fields.push([6, `ipv6hint=${params.ipv6Hint.join(",")}`]);
+    if (params.dohPath !== undefined)
+        fields.push([7, `dohpath=${quote(params.dohPath)}`]);
+    if (params.ohttp)
+        fields.push([8, "ohttp"]);
+    for (let [key, value] of Object.entries(params.other ?? {}))
+        fields.push([Number(key), `key${key}=${quote(value)}`]);
+    return fields
+        .sort(([a], [b]) => a - b)
+        .map(([, field]) => field)
+        .join(" ");
+}