caa 11.0.0 → 11.0.2

package/README.md

@@ -1,7 +1,7 @@
 # caa
 [![](https://img.shields.io/npm/v/caa.svg?style=flat)](https://www.npmjs.org/package/caa) [![](https://img.shields.io/npm/dm/caa.svg)](https://www.npmjs.org/package/caa) [![](https://packagephobia.com/badge?p=caa)](https://packagephobia.com/result?p=caa)
 
-> [rfc6844](https://tools.ietf.org/html/rfc6844)-conform CAA record lookup and validation
+> [rfc8659](https://www.rfc-editor.org/rfc/rfc8659)-conform CAA record lookup and validation
 
 ## Usage
 

package/dist/index.d.ts

@@ -7,13 +7,12 @@ type CaaOpts = {
   servers?: Array<string>;
   dnsSocket?: any;
 };
-type CaaRecord = {
+export type CaaRecord = {
   flags: number;
   tag: string;
   value: string;
   issuerCritical: boolean;
 };
-declare function caa(name: string, opts?: CaaOpts): Promise<Array<CaaRecord>>;
-declare function caaMatches(name: string, ca: string, opts?: CaaOpts): Promise<boolean>;
-//#endregion
-export { CaaRecord, caa, caaMatches };
+export declare function caa(name: string, opts?: CaaOpts): Promise<Array<CaaRecord>>;
+export declare function caaMatches(name: string, ca: string, opts?: CaaOpts): Promise<boolean>;
+//#endregion

package/dist/index.js

@@ -1,5 +1,6 @@
 import { getServers } from "node:dns";
 import { promisify } from "node:util";
+import { domainToASCII } from "node:url";
 import dnsSocket from "dns-socket";
 
 //#region node_modules/.pnpm/tlds@1.261.0/node_modules/tlds/index.json
@@ -1451,130 +1452,78 @@ const defaults = {
 	recursions: 50,
 	retries: 12,
 	port: 53,
-	servers: ["8.8.8.8", "8.8.4.4"],
-	dnsSocket: void 0
+	servers: ["8.8.8.8", "8.8.4.4"]
 };
 const tldSet = new Set(tlds_default);
+const knownTags = /* @__PURE__ */ new Set([
+	"issue",
+	"issuewild",
+	"iodef",
+	"contactemail",
+	"contactphone",
+	"accounturi",
+	"validationmethods"
+]);
+const okRcodes = /* @__PURE__ */ new Set(["NXDOMAIN", "NOERROR"]);
 const isTLD = (name) => tldSet.has(name);
-const isWildcard = (name) => name.includes("*");
-const parent = (name) => name.split(".").splice(1).join(".");
-function selectServer(servers, retries, tries) {
-	return servers[(tries - retries) % servers.length];
-}
+const isWildcard = (name) => name.startsWith("*.");
+const parent = (name) => name.split(".").slice(1).join(".");
 function normalizeName(name = "") {
-	name = name.toLowerCase();
-	return name.endsWith(".") && name.length > 1 ? name.substring(0, name.length - 1) : name;
+	const wildcard = isWildcard(name);
+	const base = wildcard ? name.slice(2) : name;
+	let ascii = domainToASCII(base) || base.toLowerCase();
+	if (ascii.endsWith(".") && ascii.length > 1) ascii = ascii.slice(0, -1);
+	return wildcard ? `*.${ascii}` : ascii;
 }
-const resolve = async ({ name, query, servers, port, recursions, retries, tries, ignoreTLDs }) => {
-	name = normalizeName(name);
-	if (!name) return [];
-	if (ignoreTLDs && isTLD(name)) return [];
-	if (recursions <= 0 || retries <= 0) return [];
-	name = name.replace(/^\*\./, "");
-	let res;
-	try {
-		res = await query({ questions: [{
-			name,
-			type: "CAA"
-		}] }, port, selectServer(servers, retries, tries));
-	} catch {
-		if (retries <= 0) return [];
-		retries -= 1;
-		return await resolve({
-			name,
-			query,
-			servers,
-			port,
-			recursions,
-			retries,
-			tries,
-			ignoreTLDs
-		});
-	}
-	if (!res || !res.answers && !["NXDOMAIN", "NOERROR"].includes(res.rcode)) {
-		if (retries <= 0) return [];
-		retries -= 1;
-		return await resolve({
-			name,
-			query,
-			servers,
-			port,
-			recursions,
-			retries,
-			tries,
-			ignoreTLDs
-		});
-	}
-	const records = {};
-	if (res?.answers?.length) for (const { name, type, data } of res.answers || {}) {
-		if (!name || !type || !data) continue;
-		if (!records[type]) records[type] = [];
-		records[type].push({
-			name,
-			data
-		});
-	}
-	if (records.CAA?.length) {
-		const caas = records.CAA.filter((record) => record.name === name).map((record) => record.data);
-		if (caas.length) return caas;
-	}
-	let alias;
-	if (records.CNAME?.length) {
-		const dest = records.CNAME.find((record) => record.name === name);
-		if (dest) alias = dest.data;
-	} else if (records.DNAME?.length) {
-		const dest = records.DNAME.find((record) => record.name === name);
-		if (dest) alias = name.replace(dest.name, dest.data);
-	}
-	if (alias && records.CAA?.length) return records.CAA.filter((record) => record.name === alias && record.data).map((record) => record.data);
-	if (!isTLD(name)) {
-		recursions -= 1;
-		return await resolve({
-			name: parent(name),
-			query,
-			servers,
-			port,
-			recursions,
-			retries,
-			tries,
-			ignoreTLDs
-		});
-	} else return [];
-};
 async function caa(name, opts = {}) {
-	name = normalizeName(name);
-	if (!opts.servers) {
-		const systemServers = getServers();
-		opts.servers = systemServers?.length ? systemServers : defaults.servers;
+	const ignoreTLDs = opts.ignoreTLDs ?? defaults.ignoreTLDs;
+	const recursions = opts.recursions ?? defaults.recursions;
+	const retries = opts.retries ?? defaults.retries;
+	const port = opts.port ?? defaults.port;
+	let servers;
+	if (opts.servers?.length) servers = opts.servers;
+	else {
+		const sys = getServers();
+		servers = sys.length ? sys : defaults.servers;
 	}
-	opts = {
-		...defaults,
-		...opts
-	};
 	const socket = opts.dnsSocket || dnsSocket();
 	const query = promisify(socket.query.bind(socket));
-	const caa = await resolve({
-		name,
-		query,
-		servers: opts.servers,
-		port: opts.port,
-		recursions: opts.recursions,
-		retries: opts.retries,
-		tries: opts.retries,
-		ignoreTLDs: opts.ignoreTLDs
-	});
+	const climb = async (name, recursionsLeft, retriesLeft) => {
+		if (!name) return [];
+		if (ignoreTLDs && isTLD(name)) return [];
+		if (recursionsLeft <= 0 || retriesLeft <= 0) return [];
+		const server = servers[(retries - retriesLeft) % servers.length];
+		let res;
+		try {
+			res = await query({ questions: [{
+				name,
+				type: "CAA"
+			}] }, port, server);
+		} catch {
+			res = null;
+		}
+		if (!res || !res.answers && !okRcodes.has(res.rcode)) return climb(name, recursionsLeft, retriesLeft - 1);
+		const caas = [];
+		for (const ans of res.answers || []) if (ans?.type === "CAA" && ans.data) caas.push(ans.data);
+		if (caas.length) return caas;
+		if (isTLD(name)) return [];
+		return climb(parent(name), recursionsLeft - 1, retriesLeft);
+	};
+	const result = await climb(normalizeName(name).replace(/^\*\./, ""), recursions, retries);
 	if (!opts.dnsSocket) socket.destroy();
-	return caa || [];
+	return result;
 }
 async function caaMatches(name, ca, opts = {}) {
-	name = normalizeName(name);
+	const wildcard = isWildcard(name);
 	ca = normalizeName(ca);
-	const caas = await caa(name, opts);
-	if (!caas.length) return true;
-	const issueNames = caas.filter((caa) => caa?.tag === "issue").map((name) => normalizeName(name.value.split(";")[0].trim()));
-	const issueWildNames = caas.filter((caa) => caa?.tag === "issuewild").map((name) => normalizeName(name.value.split(";")[0].trim()));
-	const names = isWildcard(name) ? issueWildNames.length ? issueWildNames : issueNames : issueNames;
-	if (names.includes(";")) return false;
+	const records = await caa(name, opts);
+	if (!records.length) return true;
+	if (records.some((r) => r.issuerCritical && !knownTags.has(r.tag))) return false;
+	const issueNames = [];
+	const issueWildNames = [];
+	for (const r of records) if (r.tag === "issue") issueNames.push(normalizeName(r.value.split(";")[0].trim()));
+	else if (r.tag === "issuewild") issueWildNames.push(normalizeName(r.value.split(";")[0].trim()));
+	const names = wildcard && issueWildNames.length ? issueWildNames : issueNames;
 	return !names.length || names.includes(ca);
 }
 

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "caa",
-  "version": "11.0.0",
-  "description": "rfc6844-conform CAA record lookup and validation",
+  "version": "11.0.2",
+  "description": "rfc8659-conform CAA record lookup and validation",
   "author": "silverwind <me@silverwind.io>",
-  "repository": "silverwind/caa",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/silverwind/caa.git"
+  },
   "license": "BSD-2-Clause",
   "type": "module",
   "sideEffects": false,
@@ -20,20 +23,20 @@
     "dns-socket": "^4.2.2"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
-    "@typescript/native-preview": "7.0.0-dev.20260413.1",
-    "eslint": "9.39.4",
-    "eslint-config-silverwind": "131.0.4",
+    "@types/node": "26.6.2",
+    "@typescript/native-preview": "7.0.0-dev.20260707.2",
+    "eslint": "10.11.0",
+    "eslint-config-silverwind": "151.0.0",
     "jest-extended": "7.0.0",
     "tlds": "1.261.0",
-    "tsdown": "0.21.7",
-    "tsdown-config-silverwind": "3.0.0",
-    "typescript": "6.0.2",
-    "typescript-config-silverwind": "17.0.0",
-    "updates": "17.15.2",
-    "updates-config-silverwind": "3.0.0",
-    "versions": "15.0.0",
-    "vitest": "4.1.4",
-    "vitest-config-silverwind": "11.3.3"
+    "tsdown": "0.23.0",
+    "tsdown-config-silverwind": "4.1.1",
+    "typescript": "6.0.3",
+    "typescript-config-silverwind": "21.0.0",
+    "updates": "19.0.0",
+    "updates-config-silverwind": "4.0.6",
+    "versions": "15.5.0",
+    "vitest": "5.0.2",
+    "vitest-config-silverwind": "12.0.4"
   }
 }