@sdxc/zone-file 2026.10.13 → 2026.10.25

package/README.md

@@ -140,8 +140,9 @@ standalone comments and parentheses are not.
 ### `parseRecordData<Type extends RecordType>(type: Type, data: string): Result<RecordData<Type>, RecordDataError>`
 
 Reads RDATA in presentation format, or RFC 3597 generic form, into the typed fields of `A`,
-`AAAA`, `CNAME`, `NS`, `PTR`, `DNAME`, `MX`, `TXT`, `CAA`, `SRV` and `SOA` (SOA timers accept
-TTL units). Any other type returns `{ type, data }` as written. Names come back lowercased
+`AAAA`, `CNAME`, `NS`, `PTR`, `DNAME`, `MX`, `TXT`, `CAA`, `SRV`, `SOA` (SOA timers accept TTL
+units), `SVCB` and `HTTPS` (their SvcParams as `params`), `TLSA`, `DS`, `CDS`, `DNSKEY` and
+`CDNSKEY` (with the key's `keyTag`). Any other type returns `{ type, data }` as written. Names come back lowercased
 without the trailing dot, and a relative name stays relative.
 
 ```typescript
@@ -152,8 +153,8 @@ parseRecordData("TXT", '"v=DKIM1; p=AAA" "BBB"');
 ### `formatRecordData(data: RecordData<RecordType>): string`
 
 Prints record data in canonical presentation format, the inverse of `parseRecordData`: names
-absolute with the trailing dot, TXT strings and the CAA value quoted with non-printable octets as
-`\DDD`, untyped data as is. Two spellings of one record, such as `0 ISSUE "ca.example"` and its
+absolute with the trailing dot, TXT strings, the CAA value and SvcParam text quoted with
+non-printable octets as `\DDD`, hex lowercase, SvcParams in key order, untyped data as is. Two spellings of one record, such as `0 ISSUE "ca.example"` and its
 generic form, print to one string.
 
 ### `canonicalType(type: string): string`
@@ -165,6 +166,10 @@ is `"TXT"`.
 
 The mnemonic for a type code, or `TYPEnnn` without one: `typeName(16)` is `"TXT"`.
 
+### `typeCode(type: string): number | null`
+
+The code for a mnemonic or `TYPEnnn`, `null` for an unknown mnemonic: `typeCode("HTTPS")` is `65`.
+
 ### `ZoneFileError`
 
 The failure `parse` returns when the input, with its includes, passes `maxBytes`. `code` is
@@ -189,7 +194,9 @@ Every type is exported top-level and under the `ZoneFile` namespace (`ZoneFile.Z
   (no `include` option, a file it returned `null` for, or nesting past 8) or
   `"unsupported-directive"` (`$GENERATE` or any other `$` word).
 - `RecordData<Type>`: the typed fields of a type: `AData`, `AAAAData`, `CNAMEData`, `NSData`,
-  `PTRData`, `DNAMEData`, `MXData`, `TXTData`, `CAAData`, `SRVData`, `SOAData`, or `UnknownData`.
+  `PTRData`, `DNAMEData`, `MXData`, `TXTData`, `CAAData`, `SRVData`, `SOAData`, `SVCBData`,
+  `HTTPSData` (with `SvcParams`), `TLSAData`, `DSData`, `CDSData`, `DNSKEYData`, `CDNSKEYData`,
+  or `UnknownData`.
 - `RecordType`, `TypedRecordType`, `RecordClass`: type and class names.
 - `ParseOptions`, `StringifyOptions`: the options above.
 - `ZoneInput`, `RecordInput`, `RecordInputFields`: what `stringify` accepts; a record needs only

package/dist/addresses.d.ts

@@ -0,0 +1,17 @@
+/**
+ * IP address codecs for A and AAAA data and the SVCB address hints: the strict dotted-quad
+ * reading, RFC 5952 canonical IPv6, and the octets each spells on the wire.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** Whether text is an IPv4 address in the dotted-quad form A data takes. */
+export declare function isIpv4(value: string): boolean;
+/** An IPv6 literal in RFC 5952 canonical form, or `null` when the text is not one. */
+export declare function canonicalIpv6(value: string): string | null;
+/** The four octets of a dotted-quad IPv4 address, or `null` when the text is not one. */
+export declare function ipv4Octets(value: string): Uint8Array | null;
+/** The sixteen octets of an IPv6 address, or `null` when the text is not one. */
+export declare function ipv6Octets(value: string): Uint8Array | null;
+/** Prints sixteen octets as an RFC 5952 canonical IPv6 address. */
+export declare function printIpv6(octets: Uint8Array): string;

package/dist/addresses.js

@@ -0,0 +1,50 @@
+/**
+ * IP address codecs for A and AAAA data and the SVCB address hints: the strict dotted-quad
+ * reading, RFC 5952 canonical IPv6, and the octets each spells on the wire.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/**
+ * A dotted-quad IPv4 address without leading zeros, which `inet_aton` would read as octal
+ * and browsers as decimal, so an address carrying them has no single meaning.
+ */
+const IPV4_PATTERN = /^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+/** Whether text is an IPv4 address in the dotted-quad form A data takes. */
+export function isIpv4(value) {
+    return IPV4_PATTERN.test(value);
+}
+/** An IPv6 literal in RFC 5952 canonical form, or `null` when the text is not one. */
+export function canonicalIpv6(value) {
+    if (!value.includes(":"))
+        return null;
+    let url = URL.parse(`http://[${value}]/`);
+    return url ? url.hostname.slice(1, -1) : null;
+}
+/** The four octets of a dotted-quad IPv4 address, or `null` when the text is not one. */
+export function ipv4Octets(value) {
+    return isIpv4(value) ? Uint8Array.from(value.split("."), Number) : null;
+}
+/** The sixteen octets of an IPv6 address, or `null` when the text is not one. */
+export function ipv6Octets(value) {
+    let canonical = canonicalIpv6(value);
+    if (canonical === null)
+        return null;
+    let [head = "", tail] = canonical.split("::");
+    let leading = head === "" ? [] : head.split(":");
+    let trailing = tail === undefined || tail === "" ? [] : tail.split(":");
+    let zeros = Array.from({ length: 8 - leading.length - trailing.length }, () => "0");
+    let groups = tail === undefined ? leading : [...leading, ...zeros, ...trailing];
+    let octets = new Uint8Array(16);
+    groups.forEach((group, index) => {
+        let word = Number.parseInt(group, 16);
+        octets[index * 2] = word >> 8;
+        octets[index * 2 + 1] = word & 0xff;
+    });
+    return octets;
+}
+/** Prints sixteen octets as an RFC 5952 canonical IPv6 address. */
+export function printIpv6(octets) {
+    let groups = Array.from({ length: 8 }, (_, index) => (((octets[index * 2] ?? 0) << 8) | (octets[index * 2 + 1] ?? 0)).toString(16));
+    return canonicalIpv6(groups.join(":")) ?? groups.join(":");
+}

package/dist/dnssec.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The DNSSEC pieces DS and DNSKEY data share: the algorithm mnemonics RFC 4034 lets a zone
+ * file write in place of a number, and the key tag a DS record names its DNSKEY by, so a
+ * delegation's DS set can be matched against the child's keys.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** An algorithm field as a number, read from its decimal or its mnemonic; `null` for neither. */
+export declare function readAlgorithm(field: string | undefined): number | null;
+/**
+ * The key tag of DNSKEY RDATA (RFC 4034 Appendix B): the octets summed as big-endian 16-bit
+ * words with the carry folded back in once, and for an RSA/MD5 (algorithm 1) key the
+ * modulus's second- and third-to-last octets, as that appendix specifies for it.
+ *
+ * @param rdata - The DNSKEY RDATA in wire form: flags, protocol, algorithm and key.
+ */
+export declare function keyTag(rdata: Uint8Array): number;

package/dist/dnssec.js

@@ -0,0 +1,53 @@
+/**
+ * The DNSSEC pieces DS and DNSKEY data share: the algorithm mnemonics RFC 4034 lets a zone
+ * file write in place of a number, and the key tag a DS record names its DNSKEY by, so a
+ * delegation's DS set can be matched against the child's keys.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** The DNSSEC algorithm numbers by IANA mnemonic; the uppercase mnemonic reads as its number. */
+const ALGORITHMS = {
+    RSAMD5: 1,
+    DH: 2,
+    DSA: 3,
+    RSASHA1: 5,
+    "DSA-NSEC3-SHA1": 6,
+    "RSASHA1-NSEC3-SHA1": 7,
+    RSASHA256: 8,
+    RSASHA512: 10,
+    "ECC-GOST": 12,
+    ECDSAP256SHA256: 13,
+    ECDSAP384SHA384: 14,
+    ED25519: 15,
+    ED448: 16,
+    INDIRECT: 252,
+    PRIVATEDNS: 253,
+    PRIVATEOID: 254,
+};
+/** An algorithm field as a number, read from its decimal or its mnemonic; `null` for neither. */
+export function readAlgorithm(field) {
+    if (field === undefined)
+        return null;
+    if (/^\d+$/.test(field)) {
+        let number = Number(field);
+        return number <= 0xff ? number : null;
+    }
+    return ALGORITHMS[field.toUpperCase()] ?? null;
+}
+/**
+ * The key tag of DNSKEY RDATA (RFC 4034 Appendix B): the octets summed as big-endian 16-bit
+ * words with the carry folded back in once, and for an RSA/MD5 (algorithm 1) key the
+ * modulus's second- and third-to-last octets, as that appendix specifies for it.
+ *
+ * @param rdata - The DNSKEY RDATA in wire form: flags, protocol, algorithm and key.
+ */
+export function keyTag(rdata) {
+    if (rdata[3] === 1 && rdata.length >= 7)
+        return ((rdata[rdata.length - 3] ?? 0) << 8) | (rdata[rdata.length - 2] ?? 0);
+    let sum = 0;
+    for (let index = 0; index < rdata.length; index++)
+        sum += index % 2 === 0 ? (rdata[index] ?? 0) << 8 : (rdata[index] ?? 0);
+    sum += (sum >> 16) & 0xffff;
+    return sum & 0xffff;
+}

package/dist/format-record-data.d.ts

@@ -8,10 +8,9 @@
  */
 import type * as ZoneFile from "./types.js";
 /**
- * Prints a record's data in canonical presentation format. Names print absolute with the
- * trailing dot (the root stays `"."`), TXT and CAA values print quoted with `"` and `\`
- * escaped and every octet outside printable ASCII as `\DDD`, and untyped data prints as is.
- * `parseRecordData(data.type, formatRecordData(data))` gives back `data`.
+ * Prints a record's data in canonical presentation format: names absolute, free text quoted
+ * with every octet outside printable ASCII as `\DDD`, hex lowercase, SvcParams in key order,
+ * untyped data as is. `parseRecordData(data.type, formatRecordData(data))` gives back `data`.
  *
  * @param data - Record data, as `parseRecordData` produces it.
  * @returns The RDATA in presentation format.

package/dist/format-record-data.js

@@ -1,11 +1,11 @@
 import { absoluteName } from "./names.js";
+import { printSvcParams } from "./svc-params.js";
 /** Encodes a character-string into the octets `\DDD` escapes stand for. */
 const ENCODER = new TextEncoder();
 /**
- * Prints a record's data in canonical presentation format. Names print absolute with the
- * trailing dot (the root stays `"."`), TXT and CAA values print quoted with `"` and `\`
- * escaped and every octet outside printable ASCII as `\DDD`, and untyped data prints as is.
- * `parseRecordData(data.type, formatRecordData(data))` gives back `data`.
+ * Prints a record's data in canonical presentation format: names absolute, free text quoted
+ * with every octet outside printable ASCII as `\DDD`, hex lowercase, SvcParams in key order,
+ * untyped data as is. `parseRecordData(data.type, formatRecordData(data))` gives back `data`.
  *
  * @param data - Record data, as `parseRecordData` produces it.
  * @returns The RDATA in presentation format.
@@ -62,6 +62,26 @@ export function printRecordData(data, printName) {
                 soa.minimum,
             ].join(" ");
         }
+        case "SVCB":
+        case "HTTPS": {
+            let { priority, target, params } = data;
+            let printed = printSvcParams(params, quote);
+            return `${priority} ${printName(target)}${printed ? ` ${printed}` : ""}`;
+        }
+        case "TLSA": {
+            let tlsa = data;
+            return `${tlsa.usage} ${tlsa.selector} ${tlsa.matchingType} ${tlsa.certificateAssociation}`;
+        }
+        case "DS":
+        case "CDS": {
+            let ds = data;
+            return `${ds.keyTag} ${ds.algorithm} ${ds.digestType} ${ds.digest}`;
+        }
+        case "DNSKEY":
+        case "CDNSKEY": {
+            let key = data;
+            return `${key.flags} ${key.protocol} ${key.algorithm} ${key.publicKey}`;
+        }
         default:
             return String(data.data);
     }

package/dist/index.d.ts

@@ -12,5 +12,5 @@ export { RecordDataError, ZoneFileError } from "./errors.js";
 export { formatRecordData } from "./format-record-data.js";
 export { parse } from "./parse.js";
 export { parseRecordData } from "./parse-record-data.js";
-export { canonicalType, typeName } from "./record-types.js";
+export { canonicalType, typeCode, typeName } from "./record-types.js";
 export { stringify } from "./stringify.js";

package/dist/index.js

@@ -10,5 +10,5 @@ export { RecordDataError, ZoneFileError } from "./errors.js";
 export { formatRecordData } from "./format-record-data.js";
 export { parse } from "./parse.js";
 export { parseRecordData } from "./parse-record-data.js";
-export { canonicalType, typeName } from "./record-types.js";
+export { canonicalType, typeCode, typeName } from "./record-types.js";
 export { stringify } from "./stringify.js";

package/dist/octets.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Hex and base64 codecs for the binary fields of DNSSEC, DANE and SVCB records, which the
+ * presentation format writes as text a zone file may split across whitespace and lines.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** The octets a hex string spells, whitespace ignored; `null` for an odd or non-hex run, or none. */
+export declare function decodeHex(text: string): Uint8Array | null;
+/** Octets as lowercase hex, the spelling DS digests and TLSA data compare in. */
+export declare function encodeHex(octets: Uint8Array): string;
+/** The octets a base64 string spells, whitespace ignored; `null` for text that is not base64, or none. */
+export declare function decodeBase64(text: string): Uint8Array | null;
+/** Octets as padded base64, the spelling DNSKEY keys and SVCB `ech` print in. */
+export declare function encodeBase64(octets: Uint8Array): string;

package/dist/octets.js

@@ -0,0 +1,37 @@
+/**
+ * Hex and base64 codecs for the binary fields of DNSSEC, DANE and SVCB records, which the
+ * presentation format writes as text a zone file may split across whitespace and lines.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** Hex text in pairs, with any whitespace between digits already removed. */
+const HEX_PATTERN = /^(?:[0-9a-fA-F]{2})+$/;
+/** Canonical base64: complete quads, padding only at the end. */
+const BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+/** The octets a hex string spells, whitespace ignored; `null` for an odd or non-hex run, or none. */
+export function decodeHex(text) {
+    let hex = text.replace(/\s+/g, "");
+    if (!HEX_PATTERN.test(hex))
+        return null;
+    let octets = new Uint8Array(hex.length / 2);
+    for (let index = 0; index < octets.length; index++)
+        octets[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+    return octets;
+}
+/** Octets as lowercase hex, the spelling DS digests and TLSA data compare in. */
+export function encodeHex(octets) {
+    return Array.from(octets, (octet) => octet.toString(16).padStart(2, "0")).join("");
+}
+/** The octets a base64 string spells, whitespace ignored; `null` for text that is not base64, or none. */
+export function decodeBase64(text) {
+    let base64 = text.replace(/\s+/g, "");
+    if (base64.length === 0 || !BASE64_PATTERN.test(base64))
+        return null;
+    let binary = atob(base64);
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+/** Octets as padded base64, the spelling DNSKEY keys and SVCB `ech` print in. */
+export function encodeBase64(octets) {
+    return btoa(Array.from(octets, (octet) => String.fromCharCode(octet)).join(""));
+}

package/dist/parse-record-data.js

@@ -1,14 +1,13 @@
 import { failure, isFailure, success } from "@sdxc/result";
+import { canonicalIpv6, isIpv4, printIpv6 } from "./addresses.js";
 import { decodeOctets, readCharacterStrings } from "./character-strings.js";
+import { keyTag, readAlgorithm } from "./dnssec.js";
 import { RecordDataError } from "./errors.js";
 import { canonicalName, printLabels } from "./names.js";
+import { decodeBase64, decodeHex, encodeBase64, encodeHex } from "./octets.js";
 import { canonicalType } from "./record-types.js";
+import { readSvcParams, readWireSvcParams } from "./svc-params.js";
 import { readTtl } from "./ttl.js";
-/**
- * A dotted-quad IPv4 address without leading zeros, which `inet_aton` would read as octal
- * and browsers as decimal, so an address carrying them has no single meaning.
- */
-const IPV4_PATTERN = /^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
 /**
  * Reads a record's data into its typed fields; untyped types come back as `{ type, data }`.
  * Names come back canonical (lowercased, escapes resolved, no trailing dot, the root as
@@ -39,19 +38,41 @@ function readNumber(field, max) {
     let number = Number(field);
     return number <= max ? number : null;
 }
-/** An IPv6 literal in RFC 5952 canonical form, or `null` when the text is not one. */
-function canonicalIpv6(value) {
-    if (!value.includes(":"))
-        return null;
-    let url = URL.parse(`http://[${value}]/`);
-    return url ? url.hostname.slice(1, -1) : null;
+/**
+ * The fields of DNSKEY data from its wire octets, the key tag computed over them, so the
+ * presentation and generic spellings of one key agree on every field.
+ */
+function dnskeyFields(rdata) {
+    let flags = ((rdata[0] ?? 0) << 8) | (rdata[1] ?? 0);
+    return {
+        flags,
+        zoneKey: (flags & 0x0100) !== 0,
+        secureEntryPoint: (flags & 0x0001) !== 0,
+        protocol: rdata[2] ?? 0,
+        algorithm: rdata[3] ?? 0,
+        publicKey: encodeBase64(rdata.subarray(4)),
+        keyTag: keyTag(rdata),
+    };
+}
+/** Reads the leading `count` whitespace-separated fields and the rest of the text after them. */
+function splitLeading(value, count) {
+    let fields = [];
+    let rest = value;
+    for (let index = 0; index < count; index++) {
+        let match = /^(\S+)\s*/.exec(rest);
+        if (!match)
+            break;
+        fields.push(match[1] ?? "");
+        rest = rest.slice(match[0].length);
+    }
+    return [fields, rest];
 }
 /** Reads presentation-format data for the typed record types. */
 function parsePresentation(type, value) {
     let fields = value.split(/\s+/).filter((field) => field.length > 0);
     switch (type) {
         case "A":
-            return IPV4_PATTERN.test(value) ? success({ type, address: value }) : invalid(type, value);
+            return isIpv4(value) ? success({ type, address: value }) : invalid(type, value);
         case "AAAA": {
             let address = canonicalIpv6(value);
             return address ? success({ type, address }) : invalid(type, value);
@@ -133,6 +154,50 @@ function parsePresentation(type, value) {
                 minimum,
             });
         }
+        case "SVCB":
+        case "HTTPS": {
+            let [[priorityField, targetField], rest] = splitLeading(value, 2);
+            let priority = readNumber(priorityField, 0xffff);
+            let target = targetField === undefined ? null : canonicalName(targetField);
+            let params = readSvcParams(rest);
+            if (priority === null || target === null || params === null)
+                return invalid(type, value);
+            return success({ type, priority, target, params });
+        }
+        case "TLSA": {
+            let [leading, rest] = splitLeading(value, 3);
+            let [usage, selector, matchingType] = leading.map((field) => readNumber(field, 0xff));
+            let association = decodeHex(rest);
+            if (usage == null || selector == null || matchingType == null || !association)
+                return invalid(type, value);
+            let certificateAssociation = encodeHex(association);
+            return success({ type, usage, selector, matchingType, certificateAssociation });
+        }
+        case "DS":
+        case "CDS": {
+            let [[tagField, algorithmField, digestTypeField], rest] = splitLeading(value, 3);
+            let keyTag = readNumber(tagField, 0xffff);
+            let algorithm = readAlgorithm(algorithmField);
+            let digestType = readNumber(digestTypeField, 0xff);
+            let digest = decodeHex(rest);
+            if (keyTag === null || algorithm === null || digestType === null || !digest)
+                return invalid(type, value);
+            return success({ type, keyTag, algorithm, digestType, digest: encodeHex(digest) });
+        }
+        case "DNSKEY":
+        case "CDNSKEY": {
+            let [[flagsField, protocolField, algorithmField], rest] = splitLeading(value, 3);
+            let flags = readNumber(flagsField, 0xffff);
+            let protocol = readNumber(protocolField, 0xff);
+            let algorithm = readAlgorithm(algorithmField);
+            let key = decodeBase64(rest);
+            if (flags === null || protocol === null || algorithm === null || !key)
+                return invalid(type, value);
+            let rdata = new Uint8Array(4 + key.length);
+            rdata.set([flags >> 8, flags & 0xff, protocol, algorithm]);
+            rdata.set(key, 4);
+            return success({ type, ...dnskeyFields(rdata) });
+        }
         default:
             return success({ type, data: value });
     }
@@ -187,10 +252,7 @@ class WireReader {
             }
             case "AAAA": {
                 let bytes = this.#bytes(16);
-                if (!bytes)
-                    return null;
-                let groups = Array.from({ length: 8 }, (_, index) => (((bytes[index * 2] ?? 0) << 8) | (bytes[index * 2 + 1] ?? 0)).toString(16));
-                return { address: canonicalIpv6(groups.join(":")) ?? groups.join(":") };
+                return bytes ? { address: printIpv6(bytes) } : null;
             }
             case "CNAME":
             case "PTR":
@@ -250,6 +312,39 @@ class WireReader {
                 let [serial, refresh, retry, expire, minimum] = numbers;
                 return { primary, mailbox, serial, refresh, retry, expire, minimum };
             }
+            case "SVCB":
+            case "HTTPS": {
+                let priority = this.#uint(2);
+                let target = this.#name();
+                let params = readWireSvcParams(this.#rest());
+                if (priority === null || target === null || params === null)
+                    return null;
+                return { priority, target, params };
+            }
+            case "TLSA": {
+                let [usage, selector, matchingType] = [this.#uint(1), this.#uint(1), this.#uint(1)];
+                let association = this.#rest();
+                if (usage === null || selector === null || matchingType === null)
+                    return null;
+                if (association.length === 0)
+                    return null;
+                return { usage, selector, matchingType, certificateAssociation: encodeHex(association) };
+            }
+            case "DS":
+            case "CDS": {
+                let [keyTag, algorithm, digestType] = [this.#uint(2), this.#uint(1), this.#uint(1)];
+                let digest = this.#rest();
+                if (keyTag === null || algorithm === null || digestType === null)
+                    return null;
+                if (digest.length === 0)
+                    return null;
+                return { keyTag, algorithm, digestType, digest: encodeHex(digest) };
+            }
+            case "DNSKEY":
+            case "CDNSKEY": {
+                let rdata = this.#rest();
+                return rdata.length > 4 ? dnskeyFields(rdata) : null;
+            }
             default:
                 return "unknown";
         }
@@ -262,6 +357,10 @@ class WireReader {
         this.#offset += length;
         return bytes;
     }
+    /** Every octet left, which the types ending in a variable-length field read as that field. */
+    #rest() {
+        return this.#bytes(this.#octets.length - this.#offset) ?? new Uint8Array();
+    }
     /** A big-endian unsigned integer of `size` octets. */
     #uint(size) {
         let bytes = this.#bytes(size);

package/dist/parse.js

@@ -20,6 +20,8 @@ const NAME_FIELDS = {
     MX: [1],
     SRV: [3],
     SOA: [0, 1],
+    SVCB: [1],
+    HTTPS: [1],
 };
 /** The class numbers with a mnemonic, so `CLASS1` and `IN` read as one class. */
 const CLASS_NAMES = { "1": "IN", "2": "CS", "3": "CH", "4": "HS" };

package/dist/record-types.d.ts

@@ -8,6 +8,14 @@
 import type * as ZoneFile from "./types.js";
 /** The mnemonic for a type code, or `TYPEnnn` when it has none here. */
 export declare function typeName(code: number): string;
+/**
+ * The IANA code of a type, given as a mnemonic or `TYPEnnn`, so a caller building a query
+ * message can name the type the way a zone file does; `null` for a mnemonic it does not know.
+ *
+ * @example typeCode("HTTPS") // 65
+ * @example typeCode("TYPE65280") // 65280
+ */
+export declare function typeCode(type: string): number | null;
 /**
  * The spelling of a type as a record's `type`: the uppercase mnemonic, and a known
  * mnemonic for `TYPEnnn` when one exists.

package/dist/record-types.js

@@ -43,6 +43,13 @@ const TYPED_TYPES = new Set([
     "CAA",
     "SRV",
     "SOA",
+    "SVCB",
+    "HTTPS",
+    "TLSA",
+    "DS",
+    "CDS",
+    "DNSKEY",
+    "CDNSKEY",
 ]);
 /** The mnemonic for each code in {@link TYPE_CODES}. */
 const TYPE_NAMES = new Map(Object.entries(TYPE_CODES).map(([name, code]) => [code, name]));
@@ -50,6 +57,22 @@ const TYPE_NAMES = new Map(Object.entries(TYPE_CODES).map(([name, code]) => [cod
 export function typeName(code) {
     return TYPE_NAMES.get(code) ?? `TYPE${code}`;
 }
+/**
+ * The IANA code of a type, given as a mnemonic or `TYPEnnn`, so a caller building a query
+ * message can name the type the way a zone file does; `null` for a mnemonic it does not know.
+ *
+ * @example typeCode("HTTPS") // 65
+ * @example typeCode("TYPE65280") // 65280
+ */
+export function typeCode(type) {
+    let upper = type.trim().toUpperCase();
+    let generic = /^TYPE(\d{1,5})$/.exec(upper);
+    if (generic) {
+        let code = Number(generic[1]);
+        return code <= 0xffff ? code : null;
+    }
+    return TYPE_CODES[upper] ?? null;
+}
 /**
  * The spelling of a type as a record's `type`: the uppercase mnemonic, and a known
  * mnemonic for `TYPEnnn` when one exists.

package/dist/svc-params.d.ts

@@ -0,0 +1,24 @@
+import type * as ZoneFile from "./types.js";
+/**
+ * Reads the params of SVCB or HTTPS presentation data, the fields after the target.
+ * Fails on an unknown or repeated key and on a value its key does not accept.
+ *
+ * @param text - Zero or more `key[=value]` fields.
+ */
+export declare function readSvcParams(text: string): ZoneFile.SvcParams | null;
+/**
+ * Reads the params of SVCB or HTTPS wire data, the octets after the target. Keys must
+ * strictly increase, as RFC 9460 requires of the wire form.
+ *
+ * @param octets - The SvcParams octets, `key length value` repeated.
+ */
+export declare function readWireSvcParams(octets: Uint8Array): ZoneFile.SvcParams | null;
+/**
+ * Prints params in canonical presentation form, keys in ascending number order and values
+ * quoted wherever they are free text, so two spellings of one record print alike.
+ *
+ * @param params - The params to print.
+ * @param quote - Prints a character-string with its escapes.
+ * @returns The fields joined by spaces; empty for no params.
+ */
+export declare function printSvcParams(params: ZoneFile.SvcParams, quote: (text: string) => string): string;

package/dist/svc-params.js

@@ -0,0 +1,338 @@
+/**
+ * The SvcParams codec SVCB and HTTPS share (RFC 9460): presentation `key=value` lists and
+ * their wire form both read into one wire-keyed map first, so the two spellings validate
+ * by the same rules and come out as the same `SvcParams`.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { isFailure } from "@sdxc/result";
+import { ipv4Octets, ipv6Octets, printIpv6 } from "./addresses.js";
+import { decodeOctets, readCharacterStrings } from "./character-strings.js";
+import { decodeBase64, encodeBase64 } from "./octets.js";
+/** The registered SvcParamKeys by number; any other key is spelled `keyNNNNN`. */
+const KEY_NAMES = {
+    0: "mandatory",
+    1: "alpn",
+    2: "no-default-alpn",
+    3: "port",
+    4: "ipv4hint",
+    5: "ech",
+    6: "ipv6hint",
+    7: "dohpath",
+    8: "ohttp",
+};
+/** The number of each registered key name. */
+const KEY_NUMBERS = new Map(Object.entries(KEY_NAMES).map(([number, name]) => [name, Number(number)]));
+/** Encodes the text of a value into the octets it is on the wire. */
+const ENCODER = new TextEncoder();
+/** The presentation name of a key number. */
+function keyName(key) {
+    return KEY_NAMES[key] ?? `key${key}`;
+}
+/** The number of a key name, registered or `keyNNNNN`; `null` for anything else and for the reserved 65535. */
+function keyNumber(name) {
+    let generic = /^key(0|[1-9]\d{0,4})$/.exec(name);
+    let number = generic ? Number(generic[1]) : (KEY_NUMBERS.get(name) ?? null);
+    return number !== null && number < 0xffff ? number : null;
+}
+/**
+ * Splits presentation params into `key[=value]` fields on whitespace outside quotes,
+ * stepping over escaped characters so `\"` and `\ ` stay inside their field.
+ */
+function splitFields(text) {
+    let fields = [];
+    let field = "";
+    let quoted = false;
+    for (let index = 0; index < text.length; index++) {
+        let char = text[index] ?? "";
+        if (char === "\\") {
+            field += text.slice(index, index + 2);
+            index += 1;
+        }
+        else if (char === '"') {
+            quoted = !quoted;
+            field += char;
+        }
+        else if (!quoted && /\s/.test(char)) {
+            if (field.length > 0)
+                fields.push(field);
+            field = "";
+        }
+        else {
+            field += char;
+        }
+    }
+    if (field.length > 0)
+        fields.push(field);
+    return fields;
+}
+/** A value's text with its quoting and escapes removed, `key=` as empty; `null` for more than one character-string. */
+function readValue(raw) {
+    if (raw.length === 0)
+        return "";
+    let strings = readCharacterStrings(raw);
+    if (isFailure(strings) || strings.data.length !== 1)
+        return null;
+    return strings.data[0] ?? null;
+}
+/**
+ * Splits a value-list (RFC 9460 Appendix A.1) on its unescaped commas, `\,` and `\\`
+ * standing for a literal comma and backslash; `null` when any item is empty.
+ */
+function splitValueList(value) {
+    let items = [];
+    let item = "";
+    for (let index = 0; index < value.length; index++) {
+        let char = value[index] ?? "";
+        if (char === "\\" && index + 1 < value.length) {
+            item += value[index + 1];
+            index += 1;
+        }
+        else if (char === ",") {
+            items.push(item);
+            item = "";
+        }
+        else {
+            item += char;
+        }
+    }
+    items.push(item);
+    return items.every((entry) => entry.length > 0) ? items : null;
+}
+/** Joins octet runs into one. */
+function concat(parts) {
+    let octets = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+    let offset = 0;
+    for (let part of parts) {
+        octets.set(part, offset);
+        offset += part.length;
+    }
+    return octets;
+}
+/** A 16-bit big-endian integer's two octets. */
+function uint16(value) {
+    return Uint8Array.of(value >> 8, value & 0xff);
+}
+/** Reads every item of a value-list through `read`, `null` when the list or any item is invalid. */
+function encodeList(value, read) {
+    let items = splitValueList(value);
+    if (!items)
+        return null;
+    let parts = items.map(read);
+    return parts.every((part) => part !== null) ? concat(parts) : null;
+}
+/** The wire octets of one key's presentation value; `value` is `null` when the field has no `=`. */
+function encodeValue(key, value) {
+    switch (key) {
+        case 0: {
+            if (value === null)
+                return null;
+            let items = splitValueList(value);
+            let keys = items?.map(keyNumber);
+            if (!keys || keys.some((number) => number === null))
+                return null;
+            return concat(keys.sort((a, b) => a - b).map(uint16));
+        }
+        case 1:
+            return value === null
+                ? null
+                : encodeList(value, (item) => {
+                    let octets = ENCODER.encode(item);
+                    return octets.length <= 0xff ? concat([Uint8Array.of(octets.length), octets]) : null;
+                });
+        case 2:
+        case 8:
+            return value === null || value === "" ? new Uint8Array() : null;
+        case 3:
+            return value !== null && /^\d{1,5}$/.test(value) && Number(value) <= 0xffff
+                ? uint16(Number(value))
+                : null;
+        case 4:
+            return value === null ? null : encodeList(value, ipv4Octets);
+        case 5:
+            return value === null ? null : decodeBase64(value);
+        case 6:
+            return value === null ? null : encodeList(value, ipv6Octets);
+        default:
+            return ENCODER.encode(value ?? "");
+    }
+}
+/**
+ * Reads the params of SVCB or HTTPS presentation data, the fields after the target.
+ * Fails on an unknown or repeated key and on a value its key does not accept.
+ *
+ * @param text - Zero or more `key[=value]` fields.
+ */
+export function readSvcParams(text) {
+    let values = new Map();
+    for (let field of splitFields(text)) {
+        let separator = field.indexOf("=");
+        let key = keyNumber(separator === -1 ? field : field.slice(0, separator));
+        if (key === null || values.has(key))
+            return null;
+        let value = separator === -1 ? null : readValue(field.slice(separator + 1));
+        if (separator !== -1 && value === null)
+            return null;
+        let octets = encodeValue(key, value);
+        if (!octets)
+            return null;
+        values.set(key, octets);
+    }
+    return decodeSvcParams(new Map([...values].sort(([a], [b]) => a - b)));
+}
+/**
+ * Reads the params of SVCB or HTTPS wire data, the octets after the target. Keys must
+ * strictly increase, as RFC 9460 requires of the wire form.
+ *
+ * @param octets - The SvcParams octets, `key length value` repeated.
+ */
+export function readWireSvcParams(octets) {
+    let values = new Map();
+    let offset = 0;
+    let previous = -1;
+    while (offset < octets.length) {
+        if (offset + 4 > octets.length)
+            return null;
+        let key = ((octets[offset] ?? 0) << 8) | (octets[offset + 1] ?? 0);
+        let length = ((octets[offset + 2] ?? 0) << 8) | (octets[offset + 3] ?? 0);
+        offset += 4;
+        if (key <= previous || key === 0xffff || offset + length > octets.length)
+            return null;
+        values.set(key, octets.subarray(offset, offset + length));
+        offset += length;
+        previous = key;
+    }
+    return decodeSvcParams(values);
+}
+/** Splits octets into runs of `size`, `null` when they do not divide evenly or are empty. */
+function chunks(octets, size) {
+    if (octets.length === 0 || octets.length % size !== 0)
+        return null;
+    return Array.from({ length: octets.length / size }, (_, index) => octets.subarray(index * size, index * size + size));
+}
+/** Reads length-prefixed ALPN ids, `null` when one is empty or overruns the value. */
+function readAlpn(octets) {
+    let ids = [];
+    let offset = 0;
+    while (offset < octets.length) {
+        let length = octets[offset] ?? 0;
+        if (length === 0 || offset + 1 + length > octets.length)
+            return null;
+        ids.push(decodeOctets(octets.subarray(offset + 1, offset + 1 + length)));
+        offset += 1 + length;
+    }
+    return ids.length > 0 ? ids : null;
+}
+/**
+ * Turns wire values into `SvcParams`, enforcing what RFC 9460 asks of every key: values of
+ * the right shape, and a `mandatory` list of distinct keys that are all present and exclude
+ * `mandatory` itself.
+ */
+function decodeSvcParams(values) {
+    let params = {};
+    for (let [key, value] of values) {
+        switch (key) {
+            case 0: {
+                let keys = chunks(value, 2)?.map((pair) => ((pair[0] ?? 0) << 8) | (pair[1] ?? 0));
+                if (!keys)
+                    return null;
+                let increasing = keys.every((number, index) => index === 0 || number > (keys[index - 1] ?? 0));
+                if (!increasing || keys.some((number) => number === 0 || !values.has(number)))
+                    return null;
+                params.mandatory = keys.map(keyName);
+                break;
+            }
+            case 1: {
+                let alpn = readAlpn(value);
+                if (!alpn)
+                    return null;
+                params.alpn = alpn;
+                break;
+            }
+            case 2:
+            case 8:
+                if (value.length !== 0)
+                    return null;
+                if (key === 2)
+                    params.noDefaultAlpn = true;
+                else
+                    params.ohttp = true;
+                break;
+            case 3:
+                if (value.length !== 2)
+                    return null;
+                params.port = ((value[0] ?? 0) << 8) | (value[1] ?? 0);
+                break;
+            case 4: {
+                let addresses = chunks(value, 4);
+                if (!addresses)
+                    return null;
+                params.ipv4Hint = addresses.map((address) => Array.from(address).join("."));
+                break;
+            }
+            case 5:
+                if (value.length === 0)
+                    return null;
+                params.ech = encodeBase64(value);
+                break;
+            case 6: {
+                let addresses = chunks(value, 16);
+                if (!addresses)
+                    return null;
+                params.ipv6Hint = addresses.map(printIpv6);
+                break;
+            }
+            case 7:
+                if (value.length === 0)
+                    return null;
+                params.dohPath = decodeOctets(value);
+                break;
+            default:
+                params.other = { ...params.other, [key]: decodeOctets(value) };
+        }
+    }
+    return params;
+}
+/** Escapes a value-list item so its commas and backslashes read back as part of it. */
+function escapeItem(item) {
+    return item.replace(/[\\,]/g, "\\$&");
+}
+/**
+ * Prints params in canonical presentation form, keys in ascending number order and values
+ * quoted wherever they are free text, so two spellings of one record print alike.
+ *
+ * @param params - The params to print.
+ * @param quote - Prints a character-string with its escapes.
+ * @returns The fields joined by spaces; empty for no params.
+ */
+export function printSvcParams(params, quote) {
+    let fields = [];
+    if (params.mandatory) {
+        let keys = params.mandatory.map((name) => [keyNumber(name) ?? 0xffff, name]);
+        let sorted = keys.sort(([a], [b]) => a - b).map(([, name]) => name);
+        fields.push([0, `mandatory=${sorted.join(",")}`]);
+    }
+    if (params.alpn)
+        fields.push([1, `alpn=${quote(params.alpn.map(escapeItem).join(","))}`]);
+    if (params.noDefaultAlpn)
+        fields.push([2, "no-default-alpn"]);
+    if (params.port !== undefined)
+        fields.push([3, `port=${params.port}`]);
+    if (params.ipv4Hint)
+        fields.push([4, `ipv4hint=${params.ipv4Hint.join(",")}`]);
+    if (params.ech !== undefined)
+        fields.push([5, `ech=${params.ech}`]);
+    if (params.ipv6Hint)
+        fields.push([6, `ipv6hint=${params.ipv6Hint.join(",")}`]);
+    if (params.dohPath !== undefined)
+        fields.push([7, `dohpath=${quote(params.dohPath)}`]);
+    if (params.ohttp)
+        fields.push([8, "ohttp"]);
+    for (let [key, value] of Object.entries(params.other ?? {}))
+        fields.push([Number(key), `key${key}=${quote(value)}`]);
+    return fields
+        .sort(([a], [b]) => a - b)
+        .map(([, field]) => field)
+        .join(" ");
+}

package/dist/types.d.ts

@@ -7,7 +7,7 @@
  * @copyright Sergio Xalambrí 2026
  */
 /** The record types whose data is read into typed fields. */
-export type TypedRecordType = "A" | "AAAA" | "CNAME" | "NS" | "PTR" | "DNAME" | "MX" | "TXT" | "CAA" | "SRV" | "SOA";
+export type TypedRecordType = "A" | "AAAA" | "CNAME" | "NS" | "PTR" | "DNAME" | "MX" | "TXT" | "CAA" | "SRV" | "SOA" | "SVCB" | "HTTPS" | "TLSA" | "DS" | "CDS" | "DNSKEY" | "CDNSKEY";
 /** A record type by mnemonic; the typed ones autocomplete, any other name is accepted. */
 export type RecordType = TypedRecordType | (string & {});
 /** A record class; `IN` is the internet, `CLASSnnn` spells one without a mnemonic. */
@@ -90,13 +90,102 @@ export interface SOAData {
     /** Bounds how long a negative answer may be cached (RFC 2308). */
     minimum: number;
 }
+/**
+ * The parameters of an SVCB or HTTPS record (RFC 9460), one optional field per key. A key
+ * that is absent was not published; `true` marks a key published without a value.
+ */
+export interface SvcParams {
+    /** Keys a client must understand to use the record, by presentation name (`alpn`, `key65000`). */
+    mandatory?: string[];
+    /** Protocol ids (`h2`, `h3`) in the publisher's order of preference. */
+    alpn?: string[];
+    /** The default ALPN (`http/1.1` for HTTPS) is unsupported; only `alpn` applies. */
+    noDefaultAlpn?: true;
+    port?: number;
+    /** IPv4 addresses a client may use before the target's A records resolve. */
+    ipv4Hint?: string[];
+    /** The ECHConfigList, base64-encoded as the presentation format writes it. */
+    ech?: string;
+    /** IPv6 addresses in RFC 5952 canonical form, as hints like `ipv4Hint`. */
+    ipv6Hint?: string[];
+    /** The DoH URI template's path (RFC 9461), relative to the target. */
+    dohPath?: string;
+    /** The service accepts Oblivious HTTP requests (RFC 9540). */
+    ohttp?: true;
+    /** Keys without a reading here, by key number, each value's octets read as UTF-8. */
+    other?: {
+        [key: number]: string;
+    };
+}
+/** A service binding (RFC 9460): where and how to reach the service at the owner. */
+export interface SVCBData {
+    type: "SVCB";
+    /** `0` is AliasMode, which only names `target`; any other value orders ServiceMode records, lowest first. */
+    priority: number;
+    /** The service's host; `"."` means the owner itself in ServiceMode and no service in AliasMode. */
+    target: string;
+    params: SvcParams;
+}
+/** The SVCB record for HTTPS origins (RFC 9460), published at the origin's own name. */
+export interface HTTPSData extends Omit<SVCBData, "type"> {
+    type: "HTTPS";
+}
+/** Binds a TLS certificate or public key to a service, DANE (RFC 6698, RFC 7671). */
+export interface TLSAData {
+    type: "TLSA";
+    /** `0` PKIX-TA, `1` PKIX-EE, `2` DANE-TA, `3` DANE-EE. */
+    usage: number;
+    /** `0` matches the whole certificate, `1` its SubjectPublicKeyInfo. */
+    selector: number;
+    /** `0` the exact bytes, `1` their SHA-256, `2` their SHA-512. */
+    matchingType: number;
+    /** Lowercase hex. */
+    certificateAssociation: string;
+}
+/** A digest of the child zone's key-signing key, published in the parent (RFC 4034). */
+export interface DSData {
+    type: "DS";
+    /** The key tag of the DNSKEY the digest is of, for picking it out of the child's key set. */
+    keyTag: number;
+    /** The DNSSEC algorithm number; `13` is ECDSA P-256 with SHA-256. */
+    algorithm: number;
+    /** `1` SHA-1, `2` SHA-256, `4` SHA-384. */
+    digestType: number;
+    /** Lowercase hex. */
+    digest: string;
+}
+/** The child's DS record as it asks the parent to publish it (RFC 7344); `0 0 0 00` asks for removal. */
+export interface CDSData extends Omit<DSData, "type"> {
+    type: "CDS";
+}
+/** A zone's public signing key (RFC 4034). */
+export interface DNSKEYData {
+    type: "DNSKEY";
+    /** The flags as published, so the record prints back unchanged. */
+    flags: number;
+    /** Bit 7 of `flags`: the key signs the zone's records; DNSSEC ignores a key without it. */
+    zoneKey: boolean;
+    /** Bit 15 of `flags`: the key is a key-signing key, the one a DS record points at. */
+    secureEntryPoint: boolean;
+    /** Always `3` in a valid key. */
+    protocol: number;
+    algorithm: number;
+    /** Base64, as the presentation format writes it. */
+    publicKey: string;
+    /** The RFC 4034 Appendix B tag a DS or RRSIG names this key by. */
+    keyTag: number;
+}
+/** The child's DNSKEY as it asks the parent to derive a DS from it (RFC 7344). */
+export interface CDNSKEYData extends Omit<DNSKEYData, "type"> {
+    type: "CDNSKEY";
+}
 /** Data of a type without a typed reading, kept as written. */
 export interface UnknownData {
     type: string;
     data: string;
 }
 /** A record's type-specific fields, what `parseRecordData` reads out of RDATA. */
-export type RecordData<Type extends RecordType> = Type extends "A" ? AData : Type extends "AAAA" ? AAAAData : Type extends "CNAME" ? CNAMEData : Type extends "NS" ? NSData : Type extends "PTR" ? PTRData : Type extends "DNAME" ? DNAMEData : Type extends "MX" ? MXData : Type extends "TXT" ? TXTData : Type extends "CAA" ? CAAData : Type extends "SRV" ? SRVData : Type extends "SOA" ? SOAData : UnknownData;
+export type RecordData<Type extends RecordType> = Type extends "A" ? AData : Type extends "AAAA" ? AAAAData : Type extends "CNAME" ? CNAMEData : Type extends "NS" ? NSData : Type extends "PTR" ? PTRData : Type extends "DNAME" ? DNAMEData : Type extends "MX" ? MXData : Type extends "TXT" ? TXTData : Type extends "CAA" ? CAAData : Type extends "SRV" ? SRVData : Type extends "SOA" ? SOAData : Type extends "SVCB" ? SVCBData : Type extends "HTTPS" ? HTTPSData : Type extends "TLSA" ? TLSAData : Type extends "DS" ? DSData : Type extends "CDS" ? CDSData : Type extends "DNSKEY" ? DNSKEYData : Type extends "CDNSKEY" ? CDNSKEYData : UnknownData;
 /** What every record read from a file carries beside its data. */
 export interface RecordFields {
     /** Absolute, lowercased, no trailing dot; the root is `"."`. */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sdxc/zone-file",
-	"version": "2026.10.13",
+	"version": "2026.10.25",
 	"description": "Read and write RFC 1035 DNS zone files, with the record data codec for every typed record",
 	"license": "MIT",
 	"type": "module",
@@ -10,7 +10,7 @@
 	"dependencies": {
 		"@sdxc/result": "2026.10.13"
 	},
-	"gitHead": "5ff758a57e35480a8db7abd24f1d9527b81bfb51",
+	"gitHead": "1440b969c0a3e3808dfcee3f17d2ef43915f32a8",
 	"publishConfig": {
 		"access": "public"
 	},
@@ -19,7 +19,7 @@
 		"url": "git+https://github.com/sergiodxa/monorepo.git",
 		"directory": "packages/zone-file"
 	},
-	"homepage": "https://sdxc.sergiodxa.com/api/zone-file",
+	"homepage": "https://sdxc.dev/api/zone-file",
 	"author": {
 		"name": "Sergio Xalambrí",
 		"url": "https://sergiodxa.com"