@sdxc/zone-file 2026.10.13 → 2026.11.3

package/README.md

@@ -95,6 +95,25 @@ formatRecordData({ type: "MX", preference: 10, exchange: "mail.example.com" });
 // "10 mail.example.com."
 ```
 
+## Command line
+
+```sh
+bunx @sdxc/zone-file --help
+```
+
+With [`@sdxc/kit`](https://www.npmjs.com/package/@sdxc/kit) installed, `sdxc pkg zone-file …` runs the same command line, using the version your project installs.
+
+Each command reads a path, or stdin when it is `-` or absent. `--origin` (default the root) and
+`--ttl` (seconds) set the defaults a file without `$ORIGIN` or `$TTL` reads with, and `$INCLUDE`
+paths resolve beside the zone file. Exit codes: `0` done, `1` the zone has entries that could
+not be read, `2` usage or unreadable input.
+
+```sh
+bunx @sdxc/zone-file validate example.com.zone --origin example.com          # file:line: message (reason)
+bunx @sdxc/zone-file parse example.com.zone --origin example.com --json      # { origin, records, rejected }
+bunx @sdxc/zone-file format records.json --relative > example.com.zone      # JSON records or a zone file in
+```
+
 ## API
 
 ### `parse(text: string, options: ParseOptions): Result<Zone, ZoneFileError>`
@@ -140,8 +159,9 @@ standalone comments and parentheses are not.
 ### `parseRecordData<Type extends RecordType>(type: Type, data: string): Result<RecordData<Type>, RecordDataError>`
 
 Reads RDATA in presentation format, or RFC 3597 generic form, into the typed fields of `A`,
-`AAAA`, `CNAME`, `NS`, `PTR`, `DNAME`, `MX`, `TXT`, `CAA`, `SRV` and `SOA` (SOA timers accept
-TTL units). Any other type returns `{ type, data }` as written. Names come back lowercased
+`AAAA`, `CNAME`, `NS`, `PTR`, `DNAME`, `MX`, `TXT`, `CAA`, `SRV`, `SOA` (SOA timers accept TTL
+units), `SVCB` and `HTTPS` (their SvcParams as `params`), `TLSA`, `DS`, `CDS`, `DNSKEY` and
+`CDNSKEY` (with the key's `keyTag`). Any other type returns `{ type, data }` as written. Names come back lowercased
 without the trailing dot, and a relative name stays relative.
 
 ```typescript
@@ -152,8 +172,8 @@ parseRecordData("TXT", '"v=DKIM1; p=AAA" "BBB"');
 ### `formatRecordData(data: RecordData<RecordType>): string`
 
 Prints record data in canonical presentation format, the inverse of `parseRecordData`: names
-absolute with the trailing dot, TXT strings and the CAA value quoted with non-printable octets as
-`\DDD`, untyped data as is. Two spellings of one record, such as `0 ISSUE "ca.example"` and its
+absolute with the trailing dot, TXT strings, the CAA value and SvcParam text quoted with
+non-printable octets as `\DDD`, hex lowercase, SvcParams in key order, untyped data as is. Two spellings of one record, such as `0 ISSUE "ca.example"` and its
 generic form, print to one string.
 
 ### `canonicalType(type: string): string`
@@ -165,6 +185,10 @@ is `"TXT"`.
 
 The mnemonic for a type code, or `TYPEnnn` without one: `typeName(16)` is `"TXT"`.
 
+### `typeCode(type: string): number | null`
+
+The code for a mnemonic or `TYPEnnn`, `null` for an unknown mnemonic: `typeCode("HTTPS")` is `65`.
+
 ### `ZoneFileError`
 
 The failure `parse` returns when the input, with its includes, passes `maxBytes`. `code` is
@@ -189,7 +213,9 @@ Every type is exported top-level and under the `ZoneFile` namespace (`ZoneFile.Z
   (no `include` option, a file it returned `null` for, or nesting past 8) or
   `"unsupported-directive"` (`$GENERATE` or any other `$` word).
 - `RecordData<Type>`: the typed fields of a type: `AData`, `AAAAData`, `CNAMEData`, `NSData`,
-  `PTRData`, `DNAMEData`, `MXData`, `TXTData`, `CAAData`, `SRVData`, `SOAData`, or `UnknownData`.
+  `PTRData`, `DNAMEData`, `MXData`, `TXTData`, `CAAData`, `SRVData`, `SOAData`, `SVCBData`,
+  `HTTPSData` (with `SvcParams`), `TLSAData`, `DSData`, `CDSData`, `DNSKEYData`, `CDNSKEYData`,
+  or `UnknownData`.
 - `RecordType`, `TypedRecordType`, `RecordClass`: type and class names.
 - `ParseOptions`, `StringifyOptions`: the options above.
 - `ZoneInput`, `RecordInput`, `RecordInputFields`: what `stringify` accepts; a record needs only

package/dist/addresses.d.ts

@@ -0,0 +1,17 @@
+/**
+ * IP address codecs for A and AAAA data and the SVCB address hints: the strict dotted-quad
+ * reading, RFC 5952 canonical IPv6, and the octets each spells on the wire.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** Whether text is an IPv4 address in the dotted-quad form A data takes. */
+export declare function isIpv4(value: string): boolean;
+/** An IPv6 literal in RFC 5952 canonical form, or `null` when the text is not one. */
+export declare function canonicalIpv6(value: string): string | null;
+/** The four octets of a dotted-quad IPv4 address, or `null` when the text is not one. */
+export declare function ipv4Octets(value: string): Uint8Array | null;
+/** The sixteen octets of an IPv6 address, or `null` when the text is not one. */
+export declare function ipv6Octets(value: string): Uint8Array | null;
+/** Prints sixteen octets as an RFC 5952 canonical IPv6 address. */
+export declare function printIpv6(octets: Uint8Array): string;

package/dist/addresses.js

@@ -0,0 +1,50 @@
+/**
+ * IP address codecs for A and AAAA data and the SVCB address hints: the strict dotted-quad
+ * reading, RFC 5952 canonical IPv6, and the octets each spells on the wire.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/**
+ * A dotted-quad IPv4 address without leading zeros, which `inet_aton` would read as octal
+ * and browsers as decimal, so an address carrying them has no single meaning.
+ */
+const IPV4_PATTERN = /^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+/** Whether text is an IPv4 address in the dotted-quad form A data takes. */
+export function isIpv4(value) {
+    return IPV4_PATTERN.test(value);
+}
+/** An IPv6 literal in RFC 5952 canonical form, or `null` when the text is not one. */
+export function canonicalIpv6(value) {
+    if (!value.includes(":"))
+        return null;
+    let url = URL.parse(`http://[${value}]/`);
+    return url ? url.hostname.slice(1, -1) : null;
+}
+/** The four octets of a dotted-quad IPv4 address, or `null` when the text is not one. */
+export function ipv4Octets(value) {
+    return isIpv4(value) ? Uint8Array.from(value.split("."), Number) : null;
+}
+/** The sixteen octets of an IPv6 address, or `null` when the text is not one. */
+export function ipv6Octets(value) {
+    let canonical = canonicalIpv6(value);
+    if (canonical === null)
+        return null;
+    let [head = "", tail] = canonical.split("::");
+    let leading = head === "" ? [] : head.split(":");
+    let trailing = tail === undefined || tail === "" ? [] : tail.split(":");
+    let zeros = Array.from({ length: 8 - leading.length - trailing.length }, () => "0");
+    let groups = tail === undefined ? leading : [...leading, ...zeros, ...trailing];
+    let octets = new Uint8Array(16);
+    groups.forEach((group, index) => {
+        let word = Number.parseInt(group, 16);
+        octets[index * 2] = word >> 8;
+        octets[index * 2 + 1] = word & 0xff;
+    });
+    return octets;
+}
+/** Prints sixteen octets as an RFC 5952 canonical IPv6 address. */
+export function printIpv6(octets) {
+    let groups = Array.from({ length: 8 }, (_, index) => (((octets[index * 2] ?? 0) << 8) | (octets[index * 2 + 1] ?? 0)).toString(16));
+    return canonicalIpv6(groups.join(":")) ?? groups.join(":");
+}

package/dist/cli-contract.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The `sdxc-zone-file` command line as a contract: `validate` reports every entry a zone file
+ * could not use, `parse` prints its records, and `format` writes records back as a normalized
+ * zone file. Help, usage errors and each handler's typed flags come from this one declaration.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** Every command `sdxc-zone-file` takes. */
+export declare const ZONE_FILE_COMMANDS: import("@sdxc/cli").Group<Omit<{
+    readonly description: "sdxc-zone-file — read, check and write RFC 1035 DNS zone files";
+    readonly validate: import("@sdxc/cli").Command<{
+        readonly zone: import("@sdxc/cli").Argument<string>;
+    }, {
+        readonly origin: import("@sdxc/cli").ValueFlag<string, true, false, false>;
+        readonly ttl: import("@sdxc/cli").ValueFlag<number, false, false, false>;
+        readonly json: import("@sdxc/cli").Flag<boolean>;
+    }>;
+    readonly parse: import("@sdxc/cli").Command<{
+        readonly zone: import("@sdxc/cli").Argument<string>;
+    }, {
+        readonly origin: import("@sdxc/cli").ValueFlag<string, true, false, false>;
+        readonly ttl: import("@sdxc/cli").ValueFlag<number, false, false, false>;
+        readonly json: import("@sdxc/cli").Flag<boolean>;
+    }>;
+    readonly format: import("@sdxc/cli").Command<{
+        readonly input: import("@sdxc/cli").Argument<string>;
+    }, {
+        readonly origin: import("@sdxc/cli").ValueFlag<string, true, false, false>;
+        readonly ttl: import("@sdxc/cli").ValueFlag<number, false, false, false>;
+        readonly relative: import("@sdxc/cli").Flag<boolean>;
+    }>;
+}, "description" | "hidden" | "arguments" | "flags" | "tasks">, Record<never, never>, Record<never, never>>;

package/dist/cli-contract.js

@@ -0,0 +1,81 @@
+/**
+ * The `sdxc-zone-file` command line as a contract: `validate` reports every entry a zone file
+ * could not use, `parse` prints its records, and `format` writes records back as a normalized
+ * zone file. Help, usage errors and each handler's typed flags come from this one declaration.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { argument, command, commands, flag } from "@sdxc/cli";
+import * as s from "remix/data-schema";
+/** A TTL in seconds, written as digits only, so `1h` and `-5` are usage errors. */
+function seconds() {
+    return s.createSchema(function validate(value, context) {
+        if (typeof value === "string" && /^\d+$/.test(value))
+            return { value: Number(value) };
+        return s.fail(`expects a TTL in seconds; got ${JSON.stringify(value)}`, context.path);
+    });
+}
+/** The input argument every command takes: a path, or stdin when it is `-` or absent. */
+function input(description) {
+    return argument(s.string(), { default: "-", description });
+}
+/** The `--origin` flag: the name `@` and relative names resolve against until a `$ORIGIN`. */
+function origin() {
+    return flag.string("origin", {
+        valueName: "name",
+        default: ".",
+        description: "The initial $ORIGIN; relative names resolve against it",
+    });
+}
+/** The `--ttl` flag: the TTL a record gets when neither it, a `$TTL` nor an earlier record states one. */
+function ttl() {
+    return flag.string("ttl", {
+        valueName: "seconds",
+        schema: seconds(),
+        description: "The TTL a record without one gets",
+    });
+}
+/** Every command `sdxc-zone-file` takes. */
+export const ZONE_FILE_COMMANDS = commands({
+    description: "sdxc-zone-file — read, check and write RFC 1035 DNS zone files",
+    validate: command({
+        description: "Read a zone file and report every entry it could not use, with its line. Exits 1 when there is any.",
+        arguments: { zone: input("The zone file; - or absent reads stdin") },
+        flags: {
+            origin: origin(),
+            ttl: ttl(),
+            json: flag.boolean("json", {
+                description: "Print the result as JSON: { valid, records, rejected }",
+            }),
+        },
+        examples: ["validate example.com.zone --origin example.com", "validate db.zone --json"],
+    }),
+    parse: command({
+        description: "Print the records a zone file declares, one per line. Exits 1 when an entry could not be read.",
+        arguments: { zone: input("The zone file; - or absent reads stdin") },
+        flags: {
+            origin: origin(),
+            ttl: ttl(),
+            json: flag.boolean("json", {
+                description: "Print the zone as JSON: { origin, records, rejected }",
+            }),
+        },
+        examples: ["parse example.com.zone --origin example.com --json"],
+    }),
+    format: command({
+        description: "Write records as a normalized zone file. Reads JSON ({ origin?, ttl?, records } or an array of records) or a zone file.",
+        arguments: { input: input("JSON records or a zone file; - or absent reads stdin") },
+        flags: {
+            origin: origin(),
+            ttl: ttl(),
+            relative: flag.boolean("relative", {
+                description: "Write names under the origin relative to it, the apex as @",
+            }),
+        },
+        examples: [
+            "format records.json --relative",
+            "format example.com.zone --origin example.com --ttl 3600",
+        ],
+    }),
+});

package/dist/cli-format.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The `sdxc-zone-file format` handler: writes records as a zone file with one spelling per
+ * record — canonical names, addresses and quoting — so two exports of one zone diff only where
+ * their records differ. It reads JSON records, `parse --json` output included, or a zone file.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/**
+ * Writes the zone to stdout. JSON that is not records exits 2; a zone file with entries it could
+ * not read, or a record whose fields do not fit its type, prints each problem on stderr, writes
+ * nothing and exits 1, so a normalized file never silently drops a record.
+ */
+declare const _default: import("@sdxc/cli").CommandAction<import("@sdxc/cli").Command<{
+    readonly input: import("@sdxc/cli").Argument<string>;
+}, {
+    readonly origin: import("@sdxc/cli").ValueFlag<string, true, false, false>;
+    readonly ttl: import("@sdxc/cli").ValueFlag<number, false, false, false>;
+    readonly relative: import("@sdxc/cli").Flag<boolean>;
+}>, []>;
+export default _default;

package/dist/cli-format.js

@@ -0,0 +1,138 @@
+/**
+ * The `sdxc-zone-file format` handler: writes records as a zone file with one spelling per
+ * record — canonical names, addresses and quoting — so two exports of one zone diff only where
+ * their records differ. It reads JSON records, `parse --json` output included, or a zone file.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { createCommand, exit, success } from "@sdxc/cli";
+import { failure, isFailure } from "@sdxc/result";
+import * as s from "remix/data-schema";
+import { ZONE_FILE_COMMANDS } from "./cli-contract.js";
+import { describeRejection, parseInput, readInput } from "./cli-input.js";
+import { parse } from "./parse.js";
+import { stringify } from "./stringify.js";
+/** What every record in JSON input needs; its type's fields pass through and are checked by writing it. */
+const RECORD = s.object({
+    name: s.string(),
+    type: s.string(),
+    ttl: s.optional(s.nullable(s.number())),
+    class: s.optional(s.string()),
+    comment: s.optional(s.nullable(s.string())),
+    origin: s.optional(s.string()),
+}, { unknownKeys: "passthrough" });
+/** JSON input: a bare array of records, or a zone with an optional origin and TTL. */
+const JSON_INPUT = s.union([
+    s.array(RECORD),
+    s.object({
+        origin: s.optional(s.string()),
+        ttl: s.optional(s.nullable(s.number())),
+        records: s.array(RECORD),
+    }),
+]);
+/**
+ * Writes the zone to stdout. JSON that is not records exits 2; a zone file with entries it could
+ * not read, or a record whose fields do not fit its type, prints each problem on stderr, writes
+ * nothing and exits 1, so a normalized file never silently drops a record.
+ */
+export default createCommand(ZONE_FILE_COMMANDS.format, async (ctx) => {
+    let input = await readInput(ctx, ctx.arguments.input);
+    if (isFailure(input))
+        return input;
+    let { name, text } = input.data;
+    let flagOrigin = ctx.flags.origin === "." ? undefined : ctx.flags.origin;
+    let trimmed = text.trimStart();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) {
+        let zone = parseInput(input.data, ctx.flags);
+        if (isFailure(zone))
+            return zone;
+        if (zone.data.rejected.length > 0) {
+            for (let rejection of zone.data.rejected) {
+                ctx.stderr(`${describeRejection(name, rejection)}\n`);
+            }
+            return exit(1, `${name} has entries that could not be read; nothing was written`);
+        }
+        let origin = zone.data.origin === "." ? undefined : zone.data.origin;
+        let zoneInput = { origin, ttl: ctx.flags.ttl, records: zone.data.records };
+        ctx.stdout(stringify(zoneInput, { relative: ctx.flags.relative }));
+        return success();
+    }
+    let zone = readJson(name, trimmed);
+    if (isFailure(zone))
+        return zone;
+    let problems = zone.data.records.flatMap((record, index) => {
+        let checked = checkRecord(record);
+        return isFailure(checked)
+            ? [`${name}: records[${index}] (${record.type}): ${checked.error.message}`]
+            : [];
+    });
+    if (problems.length > 0) {
+        for (let problem of problems)
+            ctx.stderr(`${problem}\n`);
+        return exit(1, `${name} has records that could not be written; nothing was written`);
+    }
+    let zoneInput = {
+        origin: zone.data.origin ?? flagOrigin,
+        ttl: ctx.flags.ttl ?? zone.data.ttl,
+        records: zone.data.records,
+    };
+    ctx.stdout(stringify(zoneInput, { relative: ctx.flags.relative }));
+    return success();
+});
+/**
+ * Reads JSON input into a zone, accepting a bare array of records.
+ *
+ * @param name - What the input is called, for the error
+ * @param text - The JSON text
+ * @returns The zone, or an exit 2 naming every field that does not fit
+ */
+function readJson(name, text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch (error) {
+        let reason = error instanceof Error ? error.message : String(error);
+        return exit(2, `${name} is not valid JSON: ${reason}`);
+    }
+    let parsed = s.parseSafe(JSON_INPUT, value);
+    if (!parsed.success) {
+        let issues = parsed.issues.map((issue) => `  ${issuePath(issue.path)}: ${issue.message}`);
+        return exit(2, `${name} is not a list of records:\n${issues.join("\n")}`);
+    }
+    return success(Array.isArray(parsed.value) ? { records: parsed.value } : parsed.value);
+}
+/** A Standard Schema issue path as `records[0].name`, or `(root)` for the value itself. */
+function issuePath(path) {
+    if (path === undefined || path.length === 0)
+        return "(root)";
+    return path
+        .map((segment) => (typeof segment === "object" ? segment.key : segment))
+        .map((key, index) => typeof key === "number" ? `[${key}]` : `${index === 0 ? "" : "."}${String(key)}`)
+        .join("");
+}
+/**
+ * Writes one record alone and reads it back, so a field missing or invalid for its type is
+ * reported against the record rather than printed into the zone.
+ *
+ * @param record - A record whose envelope already passed `RECORD`
+ * @returns Nothing, or the reason the record cannot be written
+ */
+function checkRecord(record) {
+    let line;
+    try {
+        line = stringify({ records: [record] });
+    }
+    catch (error) {
+        let reason = error instanceof Error ? error.message : String(error);
+        return failure(new Error(`missing fields for its type (${reason})`));
+    }
+    let read = parse(line, { origin: "." });
+    if (isFailure(read))
+        return read;
+    let [rejection] = read.data.rejected;
+    if (rejection !== undefined)
+        return failure(new Error(rejection.message));
+    return success();
+}

package/dist/cli-input.d.ts

@@ -0,0 +1,47 @@
+/**
+ * What the `sdxc-zone-file` commands share: reading a zone from a file or stdin, parsing it with
+ * `$INCLUDE` files read beside it, and printing a rejection with the file and lines it came from,
+ * so every command accepts input and reports problems the same way.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { ChainContext, ExitError } from "@sdxc/cli";
+import type { Result } from "@sdxc/result";
+import type * as ZoneFile from "./types.js";
+/** The text read and the name diagnostics call it by: the path as typed, or `<stdin>`. */
+export interface ZoneInputText {
+    name: string;
+    text: string;
+    /** Where `$INCLUDE` paths resolve: the file's directory, or the run's directory for stdin. */
+    directory: string;
+}
+/** The parse defaults the `--origin` and `--ttl` flags set. */
+export interface ZoneDefaults {
+    origin: string;
+    ttl?: number;
+}
+/**
+ * The text of `file`, resolved against the run's directory; `-` reads stdin to its end.
+ *
+ * @param ctx - The running command, for its directory and stdin
+ * @param file - The path argument as typed
+ * @returns The input, or an exit 2 naming the file that could not be read
+ */
+export declare function readInput(ctx: Pick<ChainContext, "cwd" | "stdin">, file: string): Promise<Result<ZoneInputText, ExitError>>;
+/**
+ * Parses the input with `$INCLUDE` paths read relative to it; an include that cannot be read
+ * becomes an `include` rejection on its line. A zone over the size limit exits 2.
+ *
+ * @param input - The text and where it came from
+ * @param defaults - The origin and TTL the flags set
+ */
+export declare function parseInput(input: ZoneInputText, defaults: ZoneDefaults): Result<ZoneFile.Zone, ExitError>;
+/**
+ * One problem as `file:line: message (reason)`, with `line-endLine` for a parenthesized entry
+ * and the included file's name for an entry read from one.
+ *
+ * @param name - What the input is called, for entries of the main file
+ * @param rejection - The entry the parser could not use
+ */
+export declare function describeRejection(name: string, rejection: ZoneFile.Rejection): string;

package/dist/cli-input.js

@@ -0,0 +1,73 @@
+/**
+ * What the `sdxc-zone-file` commands share: reading a zone from a file or stdin, parsing it with
+ * `$INCLUDE` files read beside it, and printing a rejection with the file and lines it came from,
+ * so every command accepts input and reports problems the same way.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { exit } from "@sdxc/cli";
+import { isFailure, success } from "@sdxc/result";
+import { parse } from "./parse.js";
+/**
+ * The text of `file`, resolved against the run's directory; `-` reads stdin to its end.
+ *
+ * @param ctx - The running command, for its directory and stdin
+ * @param file - The path argument as typed
+ * @returns The input, or an exit 2 naming the file that could not be read
+ */
+export async function readInput(ctx, file) {
+    if (file === "-") {
+        return success({ name: "<stdin>", text: await ctx.stdin.text(), directory: ctx.cwd });
+    }
+    let path = resolve(ctx.cwd, file);
+    try {
+        return success({ name: file, text: await readFile(path, "utf8"), directory: dirname(path) });
+    }
+    catch (error) {
+        let reason = error instanceof Error ? error.message : String(error);
+        return exit(2, `Cannot read ${file}: ${reason}`);
+    }
+}
+/**
+ * Parses the input with `$INCLUDE` paths read relative to it; an include that cannot be read
+ * becomes an `include` rejection on its line. A zone over the size limit exits 2.
+ *
+ * @param input - The text and where it came from
+ * @param defaults - The origin and TTL the flags set
+ */
+export function parseInput(input, defaults) {
+    let parsed = parse(input.text, {
+        origin: defaults.origin,
+        ttl: defaults.ttl ?? null,
+        include: (fileName) => readInclude(resolve(input.directory, fileName)),
+    });
+    if (isFailure(parsed))
+        return exit(2, `${input.name}: ${parsed.error.message}`);
+    return parsed;
+}
+/** An included file's text, or `null` so the parser rejects the `$INCLUDE` that named it. */
+function readInclude(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * One problem as `file:line: message (reason)`, with `line-endLine` for a parenthesized entry
+ * and the included file's name for an entry read from one.
+ *
+ * @param name - What the input is called, for entries of the main file
+ * @param rejection - The entry the parser could not use
+ */
+export function describeRejection(name, rejection) {
+    let lines = rejection.endLine === rejection.line
+        ? String(rejection.line)
+        : `${rejection.line}-${rejection.endLine}`;
+    return `${rejection.file ?? name}:${lines}: ${rejection.message} (${rejection.reason})`;
+}

package/dist/cli-parse.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The `sdxc-zone-file parse` handler: prints the records a zone file declares, one
+ * `name ttl class type data` line each with the data in canonical presentation format, or the
+ * whole zone as JSON for a script to read.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/**
+ * Prints every record it read, tab-separated, with `-` for a record without a TTL; `--json`
+ * prints `{ origin, records, rejected }`. Entries it could not read go to stderr and exit 1,
+ * after the records that did parse are printed.
+ */
+declare const _default: import("@sdxc/cli").CommandAction<import("@sdxc/cli").Command<{
+    readonly zone: import("@sdxc/cli").Argument<string>;
+}, {
+    readonly origin: import("@sdxc/cli").ValueFlag<string, true, false, false>;
+    readonly ttl: import("@sdxc/cli").ValueFlag<number, false, false, false>;
+    readonly json: import("@sdxc/cli").Flag<boolean>;
+}>, []>;
+export default _default;

package/dist/cli-parse.js

@@ -0,0 +1,43 @@
+/**
+ * The `sdxc-zone-file parse` handler: prints the records a zone file declares, one
+ * `name ttl class type data` line each with the data in canonical presentation format, or the
+ * whole zone as JSON for a script to read.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { createCommand, exit, success } from "@sdxc/cli";
+import { isFailure } from "@sdxc/result";
+import { ZONE_FILE_COMMANDS } from "./cli-contract.js";
+import { describeRejection, parseInput, readInput } from "./cli-input.js";
+import { formatRecordData } from "./format-record-data.js";
+/**
+ * Prints every record it read, tab-separated, with `-` for a record without a TTL; `--json`
+ * prints `{ origin, records, rejected }`. Entries it could not read go to stderr and exit 1,
+ * after the records that did parse are printed.
+ */
+export default createCommand(ZONE_FILE_COMMANDS.parse, async (ctx) => {
+    let input = await readInput(ctx, ctx.arguments.zone);
+    if (isFailure(input))
+        return input;
+    let zone = parseInput(input.data, ctx.flags);
+    if (isFailure(zone))
+        return zone;
+    let { records, rejected } = zone.data;
+    if (ctx.flags.json) {
+        ctx.stdout(`${JSON.stringify(zone.data, null, 2)}\n`);
+    }
+    else {
+        for (let record of records) {
+            let fields = [record.name, record.ttl ?? "-", record.class, record.type];
+            ctx.stdout(`${[...fields, formatRecordData(record)].join("\t")}\n`);
+        }
+        for (let rejection of rejected) {
+            ctx.stderr(`${describeRejection(input.data.name, rejection)}\n`);
+        }
+    }
+    if (rejected.length === 0)
+        return success();
+    let noun = rejected.length === 1 ? "entry" : "entries";
+    return exit(1, ctx.flags.json ? undefined : `${rejected.length} ${noun} could not be read`);
+});

package/dist/cli-validate.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The `sdxc-zone-file validate` handler: reads a zone file and reports every entry the parser
+ * could not use with its line. A rejected entry is the finding the check exists for, so it exits
+ * 1; only unreadable or oversized input exits 2.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/**
+ * Prints `file: N records, no problems`, or one `file:line: message (reason)` line per problem
+ * on stderr; `--json` prints `{ valid, records, rejected }` on stdout in both cases, `records`
+ * being the count read.
+ */
+declare const _default: import("@sdxc/cli").CommandAction<import("@sdxc/cli").Command<{
+    readonly zone: import("@sdxc/cli").Argument<string>;
+}, {
+    readonly origin: import("@sdxc/cli").ValueFlag<string, true, false, false>;
+    readonly ttl: import("@sdxc/cli").ValueFlag<number, false, false, false>;
+    readonly json: import("@sdxc/cli").Flag<boolean>;
+}>, []>;
+export default _default;

package/dist/cli-validate.js

@@ -0,0 +1,40 @@
+/**
+ * The `sdxc-zone-file validate` handler: reads a zone file and reports every entry the parser
+ * could not use with its line. A rejected entry is the finding the check exists for, so it exits
+ * 1; only unreadable or oversized input exits 2.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { createCommand, exit, success } from "@sdxc/cli";
+import { isFailure } from "@sdxc/result";
+import { ZONE_FILE_COMMANDS } from "./cli-contract.js";
+import { describeRejection, parseInput, readInput } from "./cli-input.js";
+/**
+ * Prints `file: N records, no problems`, or one `file:line: message (reason)` line per problem
+ * on stderr; `--json` prints `{ valid, records, rejected }` on stdout in both cases, `records`
+ * being the count read.
+ */
+export default createCommand(ZONE_FILE_COMMANDS.validate, async (ctx) => {
+    let input = await readInput(ctx, ctx.arguments.zone);
+    if (isFailure(input))
+        return input;
+    let zone = parseInput(input.data, ctx.flags);
+    if (isFailure(zone))
+        return zone;
+    let { records, rejected } = zone.data;
+    if (ctx.flags.json) {
+        let report = { valid: rejected.length === 0, records: records.length, rejected };
+        ctx.stdout(`${JSON.stringify(report, null, 2)}\n`);
+        return rejected.length === 0 ? success() : exit(1);
+    }
+    if (rejected.length === 0) {
+        let noun = records.length === 1 ? "record" : "records";
+        ctx.stdout(`${input.data.name}: ${records.length} ${noun}, no problems\n`);
+        return success();
+    }
+    for (let rejection of rejected)
+        ctx.stderr(`${describeRejection(input.data.name, rejection)}\n`);
+    let noun = rejected.length === 1 ? "problem" : "problems";
+    return exit(1, `${rejected.length} ${noun} in ${input.data.name}`);
+});