tangerine 2.0.1 → 2.0.2

package/README.md

@@ -550,7 +550,7 @@ We have written extensive benchmarks to show that :tangerine: Tangerine is as fa
 
 **lookup:**
 
-```
+```text
 Started: lookup
 tangerine.lookup POST with caching using Cloudflare x 757 ops/sec ±195.51% (88 runs sampled)
 tangerine.lookup POST without caching using Cloudflare x 120 ops/sec ±1.43% (81 runs sampled)
@@ -563,7 +563,7 @@ Fastest without caching is: dns.promises.lookup without caching using Cloudflare
 
 **resolve:**
 
-```
+```text
 Started: resolve
 tangerine.resolve POST with caching using Cloudflare x 953 ops/sec ±195.82% (88 runs sampled)
 tangerine.resolve POST without caching using Cloudflare x 116 ops/sec ±1.16% (80 runs sampled)
@@ -580,7 +580,7 @@ Fastest without caching is: tangerine.resolve POST without caching using Google
 
 **reverse:**
 
-```
+```text
 Started: reverse
 tangerine.reverse GET with caching x 628 ops/sec ±195.51% (84 runs sampled)
 tangerine.reverse GET without caching x 118 ops/sec ±1.12% (80 runs sampled)
@@ -595,7 +595,7 @@ Fastest without caching is: dns.promises.reverse without caching
 
 **lookup:**
 
-```
+```text
 Started: lookup
 tangerine.lookup POST with caching using Cloudflare x 795 ops/sec ±195.51% (87 runs sampled)
 tangerine.lookup POST without caching using Cloudflare x 306 ops/sec ±1.81% (83 runs sampled)
@@ -608,7 +608,7 @@ Fastest without caching is: dns.promises.lookup without caching using Cloudflare
 
 **resolve:**
 
-```
+```text
 Started: resolve
 tangerine.resolve POST with caching using Cloudflare x 1,016 ops/sec ±195.82% (89 runs sampled)
 tangerine.resolve POST without caching using Cloudflare x 303 ops/sec ±3.25% (79 runs sampled)
@@ -625,7 +625,7 @@ Fastest without caching is: tangerine.resolve GET without caching using Google
 
 **reverse:**
 
-```
+```text
 Started: reverse
 tangerine.reverse GET with caching x 1,002 ops/sec ±195.36% (87 runs sampled)
 tangerine.reverse GET without caching x 323 ops/sec ±1.36% (85 runs sampled)
@@ -640,7 +640,7 @@ Fastest without caching is: tangerine.reverse GET without caching
 
 **lookup:**
 
-```
+```text
 Started: lookup
 tangerine.lookup POST with caching using Cloudflare x 330,006 ops/sec ±7.57% (90 runs sampled)
 tangerine.lookup POST without caching using Cloudflare x 287 ops/sec ±1.96% (84 runs sampled)
@@ -653,7 +653,7 @@ Fastest without caching is: dns.promises.lookup without caching using Cloudflare
 
 **resolve:**
 
-```
+```text
 Started: resolve
 tangerine.resolve POST with caching using Cloudflare x 1,150,690 ops/sec ±0.43% (90 runs sampled)
 tangerine.resolve POST without caching using Cloudflare x 284 ops/sec ±1.36% (82 runs sampled)
@@ -670,7 +670,7 @@ Fastest without caching is: tangerine.resolve GET without caching using Google
 
 **reverse:**
 
-```
+```text
 spawnSync /bin/sh ETIMEDOUT
 ```
 
@@ -678,7 +678,7 @@ spawnSync /bin/sh ETIMEDOUT
 
 **lookup:**
 
-```
+```text
 Started: lookup
 tangerine.lookup POST with caching using Cloudflare x 1,775 ops/sec ±194.98% (90 runs sampled)
 tangerine.lookup POST without caching using Cloudflare x 295 ops/sec ±10.41% (81 runs sampled)
@@ -691,7 +691,7 @@ Fastest without caching is: dns.promises.lookup without caching using Cloudflare
 
 **resolve:**
 
-```
+```text
 Started: resolve
 tangerine.resolve POST with caching using Cloudflare x 1,164,729 ops/sec ±0.27% (90 runs sampled)
 tangerine.resolve POST without caching using Cloudflare x 316 ops/sec ±1.55% (82 runs sampled)
@@ -708,7 +708,7 @@ Fastest without caching is: tangerine.resolve GET without caching using Google
 
 **reverse:**
 
-```
+```text
 spawnSync /bin/sh ETIMEDOUT
 ```
 
@@ -716,7 +716,7 @@ spawnSync /bin/sh ETIMEDOUT
 
 **lookup:**
 
-```
+```text
 Started: lookup
 tangerine.lookup POST with caching using Cloudflare x 1,504 ops/sec ±195.19% (89 runs sampled)
 tangerine.lookup POST without caching using Cloudflare x 118 ops/sec ±2.46% (81 runs sampled)
@@ -729,7 +729,7 @@ Fastest without caching is: dns.promises.lookup without caching using Cloudflare
 
 **resolve:**
 
-```
+```text
 Started: resolve
 tangerine.resolve POST with caching using Cloudflare x 1,200,168 ops/sec ±1.70% (90 runs sampled)
 tangerine.resolve POST without caching using Cloudflare x 132 ops/sec ±0.46% (88 runs sampled)
@@ -746,7 +746,7 @@ Fastest without caching is: resolver.resolve without caching using Cloudflare
 
 **reverse:**
 
-```
+```text
 Started: reverse
 tangerine.reverse GET with caching x 342,190 ops/sec ±8.40% (90 runs sampled)
 tangerine.reverse GET without caching x 128 ops/sec ±0.83% (86 runs sampled)

package/index.d.ts

@@ -0,0 +1,653 @@
+// Type definitions for tangerine
+// Project: https://github.com/forwardemail/tangerine
+// Definitions by: Forward Email <https://forwardemail.net>
+
+/* eslint-disable @typescript-eslint/naming-convention */
+/* eslint-disable @typescript-eslint/member-ordering */
+
+import { Resolver } from 'node:dns/promises';
+import type { LookupAddress, LookupOptions } from 'node:dns';
+
+export type TangerineOptions = {
+  /**
+   * Timeout in milliseconds for DNS queries.
+   * @default 5000
+   */
+  timeout?: number;
+
+  /**
+   * Number of retry attempts for DNS queries.
+   * @default 4
+   */
+  tries?: number;
+
+  /**
+   * DNS-over-HTTPS servers to use.
+   * @default new Set(['1.1.1.1', '1.0.0.1'])
+   */
+  servers?: Set<string> | string[];
+
+  /**
+   * Request options passed to the HTTP client.
+   */
+  requestOptions?: {
+    method?: 'GET' | 'POST' | 'get' | 'post';
+    headers?: Record<string, string>;
+  };
+
+  /**
+   * Protocol to use for DNS-over-HTTPS requests.
+   * @default 'https'
+   */
+  protocol?: 'http' | 'https';
+
+  /**
+   * DNS result ordering.
+   * @default 'verbatim' for Node.js >= 17.0.0, 'ipv4first' otherwise
+   */
+  dnsOrder?: 'verbatim' | 'ipv4first';
+
+  /**
+   * Logger instance for debugging.
+   * Set to `false` to disable logging.
+   * @default false
+   */
+  logger?:
+    | false
+    | {
+        info: (...args: unknown[]) => void;
+        warn: (...args: unknown[]) => void;
+        error: (...args: unknown[]) => void;
+      };
+
+  /**
+   * ID generator for DNS packets.
+   * Can be a number or a function that returns a number (sync or async).
+   * @default 0
+   */
+  id?: number | (() => number) | (() => Promise<number>);
+
+  /**
+   * Concurrency limit for resolveAny queries.
+   * @default os.cpus().length
+   */
+  concurrency?: number;
+
+  /**
+   * Default IPv4 address for local binding.
+   * @default '0.0.0.0'
+   */
+  ipv4?: string;
+
+  /**
+   * Default IPv6 address for local binding.
+   * @default '::0'
+   */
+  ipv6?: string;
+
+  /**
+   * Port for IPv4 local binding.
+   */
+  ipv4Port?: number;
+
+  /**
+   * Port for IPv6 local binding.
+   */
+  ipv6Port?: number;
+
+  /**
+   * Cache instance for storing DNS results.
+   * Set to `false` to disable caching.
+   * @default new Map()
+   */
+  cache?: Map<string, unknown> | false;
+
+  /**
+   * Default TTL in seconds for cached DNS results.
+   * @default 300
+   */
+  defaultTTLSeconds?: number;
+
+  /**
+   * Maximum TTL in seconds for cached DNS results.
+   * @default 86400
+   */
+  maxTTLSeconds?: number;
+
+  /**
+   * Function to generate cache arguments.
+   */
+  setCacheArgs?: (
+    key: string,
+    result: { expires: number; ttl: number }
+  ) => unknown[];
+
+  /**
+   * Whether to return HTTP errors as DNS errors.
+   * @default false
+   */
+  returnHTTPErrors?: boolean;
+
+  /**
+   * Whether to rotate servers on errors.
+   * @default true
+   */
+  smartRotate?: boolean;
+
+  /**
+   * Default error message for unsuccessful HTTP responses.
+   * @default 'Unsuccessful HTTP response'
+   */
+  defaultHTTPErrorMessage?: string;
+};
+
+export type DnsRecordType =
+  | 'A'
+  | 'A6'
+  | 'AAAA'
+  | 'AFSDB'
+  | 'AMTRELAY'
+  | 'ANY'
+  | 'APL'
+  | 'ATMA'
+  | 'AVC'
+  | 'AXFR'
+  | 'CAA'
+  | 'CDNSKEY'
+  | 'CDS'
+  | 'CERT'
+  | 'CNAME'
+  | 'CSYNC'
+  | 'DHCID'
+  | 'DLV'
+  | 'DNAME'
+  | 'DNSKEY'
+  | 'DOA'
+  | 'DS'
+  | 'EID'
+  | 'EUI48'
+  | 'EUI64'
+  | 'GID'
+  | 'GPOS'
+  | 'HINFO'
+  | 'HIP'
+  | 'HTTPS'
+  | 'IPSECKEY'
+  | 'ISDN'
+  | 'IXFR'
+  | 'KEY'
+  | 'KX'
+  | 'L32'
+  | 'L64'
+  | 'LOC'
+  | 'LP'
+  | 'MAILA'
+  | 'MAILB'
+  | 'MB'
+  | 'MD'
+  | 'MF'
+  | 'MG'
+  | 'MINFO'
+  | 'MR'
+  | 'MX'
+  | 'NAPTR'
+  | 'NID'
+  | 'NIMLOC'
+  | 'NINFO'
+  | 'NS'
+  | 'NSAP'
+  | 'NSAP-PTR'
+  | 'NSEC'
+  | 'NSEC3'
+  | 'NSEC3PARAM'
+  | 'NULL'
+  | 'NXT'
+  | 'OPENPGPKEY'
+  | 'OPT'
+  | 'PTR'
+  | 'PX'
+  | 'RKEY'
+  | 'RP'
+  | 'RRSIG'
+  | 'RT'
+  | 'Reserved'
+  | 'SIG'
+  | 'SINK'
+  | 'SMIMEA'
+  | 'SOA'
+  | 'SPF'
+  | 'SRV'
+  | 'SSHFP'
+  | 'SVCB'
+  | 'TA'
+  | 'TALINK'
+  | 'TKEY'
+  | 'TLSA'
+  | 'TSIG'
+  | 'TXT'
+  | 'UID'
+  | 'UINFO'
+  | 'UNSPEC'
+  | 'URI'
+  | 'WKS'
+  | 'X25'
+  | 'ZONEMD';
+
+export type MxRecord = {
+  priority: number;
+  exchange: string;
+  type?: 'MX';
+};
+
+export type NaptrRecord = {
+  flags: string;
+  service: string;
+  regexp: string;
+  replacement: string;
+  order: number;
+  preference: number;
+  type?: 'NAPTR';
+};
+
+export type SoaRecord = {
+  nsname: string;
+  hostmaster: string;
+  serial: number;
+  refresh: number;
+  retry: number;
+  expire: number;
+  minttl: number;
+  type?: 'SOA';
+};
+
+export type SrvRecord = {
+  priority: number;
+  weight: number;
+  port: number;
+  name: string;
+  type?: 'SRV';
+};
+
+export type CaaRecord = {
+  critical: number;
+  issue?: string;
+  issuewild?: string;
+  iodef?: string;
+  contactemail?: string;
+  contactphone?: string;
+  type?: 'CAA';
+};
+
+export type CertRecord = {
+  certType: number | string;
+  keyTag: number;
+  algorithm: number;
+  certificate: Uint8Array | string;
+};
+
+export type TlsaRecord = {
+  usage: number;
+  selector: number;
+  mtype: number;
+  matchingType: number;
+  cert: Uint8Array;
+  certificate: Uint8Array;
+};
+
+export type HttpsRecord = {
+  name: string;
+  ttl: number;
+  type: 'HTTPS';
+  priority: number;
+  target: string;
+  params: Record<string, unknown>;
+};
+
+export type SvcbRecord = {
+  name: string;
+  ttl: number;
+  type: 'SVCB';
+  priority: number;
+  target: string;
+  params: Record<string, unknown>;
+};
+
+export type AnyRecord = {
+  type: string;
+  [key: string]: unknown;
+};
+
+export type ResolveOptions = {
+  ttl?: boolean;
+};
+
+export type RecordWithTtl = {
+  address: string;
+  ttl: number;
+};
+
+export type SpoofPacket = {
+  id: number;
+  type: 'response';
+  flags: number;
+  flag_qr: boolean;
+  opcode: string;
+  flag_aa: boolean;
+  flag_tc: boolean;
+  flag_rd: boolean;
+  flag_ra: boolean;
+  flag_z: boolean;
+  flag_ad: boolean;
+  flag_cd: boolean;
+  rcode: string;
+  questions: Array<{ name: string; type: string; class: string }>;
+  answers: Array<{
+    name: string;
+    type: string;
+    ttl: number;
+    class: string;
+    flush: boolean;
+    data: unknown;
+  }>;
+  authorities: unknown[];
+  additionals: unknown[];
+  ttl: number;
+  expires: number;
+};
+
+export type RequestFunction = (
+  url: string,
+  options: Record<string, unknown>
+) => Promise<{
+  statusCode: number;
+  headers: Record<string, string>;
+  body: {
+    arrayBuffer: () => Promise<ArrayBuffer>;
+  };
+}>;
+
+declare class Tangerine extends Resolver {
+  /**
+   * Path to the hosts file.
+   */
+  static HOSTFILE: string;
+
+  /**
+   * Parsed hosts from the hosts file.
+   */
+  static HOSTS: Array<{ ip: string; hosts: string[] }>;
+
+  /**
+   * Set of valid DNS record types.
+   */
+  static TYPES: Set<string>;
+
+  /**
+   * Set of DNS error codes.
+   */
+  static CODES: Set<string>;
+
+  /**
+   * Record types supported by resolveAny.
+   */
+  static ANY_TYPES: string[];
+
+  /**
+   * Record types supported by native DNS.
+   */
+  static NATIVE_TYPES: Set<string>;
+
+  /**
+   * Check if a port number is valid.
+   */
+  static isValidPort(port: number): boolean;
+
+  /**
+   * Get address configuration types based on network interfaces.
+   */
+  static getAddrConfigTypes(): 0 | 4 | 6;
+
+  /**
+   * Get a random integer between min and max (inclusive).
+   */
+  static getRandomInt(min: number, max: number): number;
+
+  /**
+   * Combine multiple errors into a single error.
+   */
+  static combineErrors(errors: Error[]): Error;
+
+  /**
+   * Create a DNS error with the specified code.
+   */
+  static createError(
+    name: string,
+    rrtype: string,
+    code: string,
+    errno?: number
+  ): Error;
+
+  /**
+   * Options passed to the constructor.
+   */
+  options: TangerineOptions;
+
+  /**
+   * Set of active abort controllers.
+   */
+  abortControllers: Set<AbortController>;
+
+  /**
+   * Create a new Tangerine DNS resolver instance.
+   * @param options - Configuration options
+   * @param request - HTTP request function (default: undici.request)
+   */
+  constructor(options?: TangerineOptions, request?: RequestFunction);
+
+  /**
+   * Set local addresses for DNS queries.
+   */
+  setLocalAddress(ipv4?: string, ipv6?: string): void;
+
+  /**
+   * Resolve a hostname to IP addresses.
+   */
+  lookup(
+    name: string,
+    options?: LookupOptions
+  ): Promise<LookupAddress | LookupAddress[]>;
+
+  /**
+   * Perform a reverse DNS lookup.
+   */
+  lookupService(
+    address: string,
+    port: number,
+    abortController?: AbortController,
+    purgeCache?: boolean
+  ): Promise<{ hostname: string; service: string }>;
+
+  /**
+   * Reverse DNS lookup for an IP address.
+   */
+  reverse(
+    ip: string,
+    abortController?: AbortController,
+    purgeCache?: boolean
+  ): Promise<string[]>;
+
+  /**
+   * Resolve IPv4 addresses.
+   */
+  resolve4(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<string[] | RecordWithTtl[]>;
+
+  /**
+   * Resolve IPv6 addresses.
+   */
+  resolve6(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<string[] | RecordWithTtl[]>;
+
+  /**
+   * Resolve CAA records.
+   */
+  resolveCaa(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<CaaRecord[]>;
+
+  /**
+   * Resolve CNAME records.
+   */
+  resolveCname(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<string[]>;
+
+  /**
+   * Resolve MX records.
+   */
+  resolveMx(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<MxRecord[]>;
+
+  /**
+   * Resolve NAPTR records.
+   */
+  resolveNaptr(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<NaptrRecord[]>;
+
+  /**
+   * Resolve NS records.
+   */
+  resolveNs(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<string[]>;
+
+  /**
+   * Resolve PTR records.
+   */
+  resolvePtr(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<string[]>;
+
+  /**
+   * Resolve SOA records.
+   */
+  resolveSoa(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<SoaRecord>;
+
+  /**
+   * Resolve SRV records.
+   */
+  resolveSrv(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<SrvRecord[]>;
+
+  /**
+   * Resolve TXT records.
+   */
+  resolveTxt(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<string[][]>;
+
+  /**
+   * Resolve CERT records.
+   */
+  resolveCert(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<CertRecord[]>;
+
+  /**
+   * Resolve TLSA records.
+   */
+  resolveTlsa(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<TlsaRecord[]>;
+
+  /**
+   * Get the list of DNS servers.
+   */
+  getServers(): string[];
+
+  /**
+   * Cancel all pending DNS queries.
+   */
+  cancel(): void;
+
+  /**
+   * Resolve any record type.
+   */
+  resolveAny(
+    name: string,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<AnyRecord[]>;
+
+  /**
+   * Set the default result order for DNS queries.
+   */
+  setDefaultResultOrder(dnsOrder: 'verbatim' | 'ipv4first'): void;
+
+  /**
+   * Set the DNS servers to use.
+   */
+  setServers(servers: string[]): void;
+
+  /**
+   * Create a spoofed DNS packet for testing.
+   * @param name - The hostname
+   * @param rrtype - The record type
+   * @param answers - Array of answers
+   * @param json - Whether to return JSON string (default: false)
+   * @param expires - Expiration time in milliseconds (default: 300000 = 5 minutes)
+   */
+  spoofPacket(
+    name: string,
+    rrtype: DnsRecordType,
+    answers?: unknown[],
+    json?: boolean,
+    expires?: number | Date
+  ): SpoofPacket | string;
+
+  /**
+   * Resolve DNS records of a specific type.
+   */
+  resolve(
+    name: string,
+    rrtype?: DnsRecordType,
+    options?: ResolveOptions,
+    abortController?: AbortController
+  ): Promise<unknown>;
+}
+
+export default Tangerine;
+export { Tangerine };

package/index.js

@@ -57,6 +57,13 @@ const NODE_MAJOR_VERSION = Number.parseInt(
   10
 );
 
+// HTTPS and SVCB record types are not yet supported by dns-packet
+// We map them to UNKNOWN_65 and UNKNOWN_64 respectively
+// See: https://github.com/mafintosh/dns-packet/pull/104
+const HTTPS_SVCB_TYPE_MAP = {
+  HTTPS: 'UNKNOWN_65',
+  SVCB: 'UNKNOWN_64'
+};
 // <https://github.com/szmarczak/cacheable-lookup/pull/76>
 class Tangerine extends dns.promises.Resolver {
   static HOSTFILE = HOSTFILE;
@@ -279,6 +286,8 @@ class Tangerine extends dns.promises.Resolver {
     'TXT',
     'UID',
     'UINFO',
+    'UNKNOWN_64',
+    'UNKNOWN_65',
     'UNSPEC',
     'URI',
     'WKS',
@@ -1542,7 +1551,7 @@ class Tangerine extends dns.promises.Resolver {
   }
 
   // eslint-disable-next-line max-params
-  spoofPacket(name, rrtype, answers = [], json = false, expires = 30000) {
+  spoofPacket(name, rrtype, answers = [], json = false, expires = 300000) {
     if (typeof name !== 'string') {
       const err = new TypeError('The "name" argument must be of type string.');
       err.code = 'ERR_INVALID_ARG_TYPE';
@@ -1635,6 +1644,13 @@ class Tangerine extends dns.promises.Resolver {
       throw err;
     }
 
+    // Map HTTPS/SVCB to UNKNOWN_65/UNKNOWN_64 for dns-packet compatibility
+    // Store original rrtype for later use
+    const originalRrtype = rrtype;
+    if (HTTPS_SVCB_TYPE_MAP[rrtype]) {
+      rrtype = HTTPS_SVCB_TYPE_MAP[rrtype];
+    }
+
     // edge case where c-ares detects "." as start of string or malformed hostnames
     // <https://github.com/c-ares/c-ares/blob/38b30bc922c21faa156939bde15ea35332c30e08/src/lib/ares_getaddrinfo.c#L829>
     if (
@@ -2189,6 +2205,159 @@ class Tangerine extends dns.promises.Resolver {
         });
       }
 
+      // HTTPS and SVCB records (types 65 and 64)
+      // These are mapped from HTTPS/SVCB to UNKNOWN_65/UNKNOWN_64 for dns-packet compatibility
+      // <https://datatracker.ietf.org/doc/html/rfc9460>
+      case 'UNKNOWN_65':
+      case 'UNKNOWN_64': {
+        return result.answers.map((answer) => {
+          // The data is in wire format, we need to parse it
+          // SVCB/HTTPS RDATA format:
+          // - SvcPriority (2 bytes)
+          // - TargetName (variable length, DNS name format)
+          // - SvcParams (variable length, key-value pairs)
+          const obj = {
+            name: answer.name,
+            ttl: answer.ttl,
+            type: originalRrtype // Use the original type (HTTPS or SVCB)
+          };
+
+          if (Buffer.isBuffer(answer.data)) {
+            // Parse the wire format
+            obj.priority = answer.data.subarray(0, 2).readUInt16BE();
+
+            // Parse the target name (DNS name format)
+            let offset = 2;
+            const labels = [];
+            while (offset < answer.data.length) {
+              const labelLen = answer.data[offset];
+              if (labelLen === 0) {
+                offset++;
+                break;
+              }
+
+              labels.push(
+                answer.data
+                  .subarray(offset + 1, offset + 1 + labelLen)
+                  .toString()
+              );
+              offset += 1 + labelLen;
+            }
+
+            obj.target = labels.length > 0 ? labels.join('.') : '.';
+
+            // Parse SvcParams if there's remaining data
+            obj.params = {};
+            while (offset + 4 <= answer.data.length) {
+              const paramKey = answer.data
+                .subarray(offset, offset + 2)
+                .readUInt16BE();
+              const paramLen = answer.data
+                .subarray(offset + 2, offset + 4)
+                .readUInt16BE();
+              offset += 4;
+
+              if (offset + paramLen > answer.data.length) break;
+
+              const paramValue = answer.data.subarray(
+                offset,
+                offset + paramLen
+              );
+              offset += paramLen;
+
+              // Map known SvcParam keys to names
+              // <https://www.iana.org/assignments/dns-svcb/dns-svcb.xhtml>
+              const paramNames = {
+                0: 'mandatory',
+                1: 'alpn',
+                2: 'no-default-alpn',
+                3: 'port',
+                4: 'ipv4hint',
+                5: 'ech',
+                6: 'ipv6hint',
+                7: 'dohpath'
+              };
+
+              const paramName = paramNames[paramKey] || `key${paramKey}`;
+
+              // Parse specific param types
+              switch (paramKey) {
+                case 1: {
+                  // alpn - list of ALPN protocol IDs
+                  const alpns = [];
+                  let alpnOffset = 0;
+                  while (alpnOffset < paramValue.length) {
+                    const alpnLen = paramValue[alpnOffset];
+                    alpns.push(
+                      paramValue
+                        .subarray(alpnOffset + 1, alpnOffset + 1 + alpnLen)
+                        .toString()
+                    );
+                    alpnOffset += 1 + alpnLen;
+                  }
+
+                  obj.params[paramName] = alpns;
+                  break;
+                }
+
+                case 3: {
+                  // port
+                  obj.params[paramName] = paramValue.readUInt16BE();
+                  break;
+                }
+
+                case 4: {
+                  // ipv4hint - list of IPv4 addresses
+                  const ips = [];
+                  for (let i = 0; i < paramValue.length; i += 4) {
+                    ips.push(
+                      `${paramValue[i]}.${paramValue[i + 1]}.${paramValue[i + 2]}.${paramValue[i + 3]}`
+                    );
+                  }
+
+                  obj.params[paramName] = ips;
+                  break;
+                }
+
+                case 6: {
+                  // ipv6hint - list of IPv6 addresses
+                  const ip6s = [];
+                  for (let i = 0; i < paramValue.length; i += 16) {
+                    const parts = [];
+                    for (let j = 0; j < 16; j += 2) {
+                      parts.push(
+                        paramValue.subarray(i + j, i + j + 2).toString('hex')
+                      );
+                    }
+
+                    ip6s.push(parts.join(':'));
+                  }
+
+                  obj.params[paramName] = ip6s;
+                  break;
+                }
+
+                case 7: {
+                  // dohpath
+                  obj.params[paramName] = paramValue.toString();
+                  break;
+                }
+
+                default: {
+                  // Store as hex for unknown params
+                  obj.params[paramName] = paramValue.toString('hex');
+                }
+              }
+            }
+          } else {
+            // Data is already parsed (from cache or JSON)
+            Object.assign(obj, answer.data);
+          }
+
+          return obj;
+        });
+      }
+
       default: {
         this.options.logger.error(
           new Error(

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tangerine",
   "description": "Tangerine is the best Node.js drop-in replacement for dns.promises.Resolver using DNS over HTTPS (\"DoH\") via undici with built-in retries, timeouts, smart server rotation, AbortControllers, and caching support for multiple backends (with TTL and purge support).",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "author": "Forward Email (https://forwardemail.net)",
   "bugs": {
     "url": "https://github.com/forwardemail/nodejs-dns-over-https-tangerine/issues"
@@ -59,7 +59,8 @@
     "node": ">=18"
   },
   "files": [
-    "index.js"
+    "index.js",
+    "index.d.ts"
   ],
   "homepage": "https://github.com/forwardemail/nodejs-dns-over-https-tangerine",
   "keywords": [
@@ -162,5 +163,6 @@
     "prepare": "husky install",
     "pretest": "npm run lint",
     "test": "npm run nyc"
-  }
+  },
+  "types": "index.d.ts"
 }