caa 11.0.2 → 11.0.3

package/README.md

@@ -5,6 +5,10 @@
 
 ## Usage
 
+```sh
+pnpm add caa
+```
+
 ```js
 import {caa, caaMatches} from "caa";
 
@@ -18,7 +22,7 @@ await caaMatches("example.com", "letsencrypt.org");
 ## API
 ### `caa(name, [options])`
 
-Retrieve the CAA records which apply to `name`. Returns a [`CAA` object](https://github.com/mafintosh/dns-packet/#caa).
+Retrieve the CAA records which apply to `name`. Returns an array of [`CAA` objects](https://github.com/mafintosh/dns-packet/#caa).
 
 ### `caaMatches(name, ca, [options])`
 
@@ -29,10 +33,8 @@ Test if the CAA record for `name` matches for certificate authority `ca`.
 - `servers`: The DNS servers to use. Defaults to the system resolvers or `['8.8.8.8', '8.8.4.4']` if none are configured.
 - `port`: The port on the DNS server to use. Default `53`.
 - `recursions`: How many recursions to follow. Default `50`.
-- `retries`: How many retries to attempt. Default `12`.
+- `retries`: How many failed queries the whole lookup may make, shared across all names it queries. Each failure retries on the next server, and once exhausted the lookup resolves to no records. Default `12`.
 - `ignoreTLDs`: Don't query top level domains like `com` in `example.com`. Default: `false`.
 - `dnsSocket`: A [dns-socket instance](https://github.com/mafintosh/dns-socket#var-socket--dnsoptions), useful when doing a large amount of queries to re-use a single socket. Default: `undefined`.
 
-## License
-
 © [silverwind](https://github.com/silverwind), distributed under BSD licence

package/dist/index.js

@@ -1,6 +1,6 @@
 import { getServers } from "node:dns";
 import { promisify } from "node:util";
-import { domainToASCII } from "node:url";
+import { domainToASCII, domainToUnicode } from "node:url";
 import dnsSocket from "dns-socket";
 
 //#region node_modules/.pnpm/tlds@1.261.0/node_modules/tlds/index.json
@@ -1465,7 +1465,7 @@ const knownTags = /* @__PURE__ */ new Set([
 	"validationmethods"
 ]);
 const okRcodes = /* @__PURE__ */ new Set(["NXDOMAIN", "NOERROR"]);
-const isTLD = (name) => tldSet.has(name);
+const isTLD = (name) => tldSet.has(name.startsWith("xn--") ? domainToUnicode(name) : name);
 const isWildcard = (name) => name.startsWith("*.");
 const parent = (name) => name.split(".").slice(1).join(".");
 function normalizeName(name = "") {
@@ -1480,12 +1480,8 @@ async function caa(name, opts = {}) {
 	const recursions = opts.recursions ?? defaults.recursions;
 	const retries = opts.retries ?? defaults.retries;
 	const port = opts.port ?? defaults.port;
-	let servers;
-	if (opts.servers?.length) servers = opts.servers;
-	else {
-		const sys = getServers();
-		servers = sys.length ? sys : defaults.servers;
-	}
+	let servers = opts.servers?.length ? opts.servers : getServers();
+	if (!servers.length) servers = defaults.servers;
 	const socket = opts.dnsSocket || dnsSocket();
 	const query = promisify(socket.query.bind(socket));
 	const climb = async (name, recursionsLeft, retriesLeft) => {
@@ -1502,7 +1498,7 @@ async function caa(name, opts = {}) {
 		} catch {
 			res = null;
 		}
-		if (!res || !res.answers && !okRcodes.has(res.rcode)) return climb(name, recursionsLeft, retriesLeft - 1);
+		if (!res || !res.answers?.length && !okRcodes.has(res.rcode)) return climb(name, recursionsLeft, retriesLeft - 1);
 		const caas = [];
 		for (const ans of res.answers || []) if (ans?.type === "CAA" && ans.data) caas.push(ans.data);
 		if (caas.length) return caas;
@@ -1518,11 +1514,14 @@ async function caaMatches(name, ca, opts = {}) {
 	ca = normalizeName(ca);
 	const records = await caa(name, opts);
 	if (!records.length) return true;
-	if (records.some((r) => r.issuerCritical && !knownTags.has(r.tag))) return false;
+	if (records.some((r) => r.issuerCritical && !knownTags.has(r.tag.toLowerCase()))) return false;
 	const issueNames = [];
 	const issueWildNames = [];
-	for (const r of records) if (r.tag === "issue") issueNames.push(normalizeName(r.value.split(";")[0].trim()));
-	else if (r.tag === "issuewild") issueWildNames.push(normalizeName(r.value.split(";")[0].trim()));
+	for (const r of records) {
+		const tag = r.tag.toLowerCase();
+		if (tag === "issue") issueNames.push(normalizeName(r.value.split(";")[0].trim()));
+		else if (tag === "issuewild") issueWildNames.push(normalizeName(r.value.split(";")[0].trim()));
+	}
 	const names = wildcard && issueWildNames.length ? issueWildNames : issueNames;
 	return !names.length || names.includes(ca);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "caa",
-  "version": "11.0.2",
+  "version": "11.0.3",
   "description": "rfc8659-conform CAA record lookup and validation",
   "author": "silverwind <me@silverwind.io>",
   "repository": {
@@ -23,20 +23,19 @@
     "dns-socket": "^4.2.2"
   },
   "devDependencies": {
-    "@types/node": "26.6.2",
+    "@types/node": "26.6.3",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "eslint": "10.11.0",
-    "eslint-config-silverwind": "151.0.0",
-    "jest-extended": "7.0.0",
+    "eslint-config-silverwind": "151.0.1",
     "tlds": "1.261.0",
     "tsdown": "0.23.0",
-    "tsdown-config-silverwind": "4.1.1",
+    "tsdown-config-silverwind": "4.1.2",
     "typescript": "6.0.3",
-    "typescript-config-silverwind": "21.0.0",
-    "updates": "19.0.0",
-    "updates-config-silverwind": "4.0.6",
-    "versions": "15.5.0",
+    "typescript-config-silverwind": "21.0.1",
+    "updates": "19.0.2",
+    "updates-config-silverwind": "4.0.7",
+    "versions": "15.5.1",
     "vitest": "5.0.2",
-    "vitest-config-silverwind": "12.0.4"
+    "vitest-config-silverwind": "12.0.5"
   }
 }