diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7c1fbee..c86c910 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,12 +13,6 @@ jobs:
     permissions:
       contents: read
 
-  coverage:
-    uses: NicTool/.github/.github/workflows/coverage.yml@main
-    secrets: inherit
-    permissions:
-      contents: read
-
   test:
     uses: NicTool/.github/.github/workflows/test.yml@main
     secrets: inherit
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
new file mode 100644
index 0000000..3bb2ed5
--- /dev/null
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,14 @@
+name: Coverage
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main]
+
+jobs:
+  coverage:
+    uses: NicTool/.github/.github/workflows/coverage.yml@main
+    secrets: inherit
+    permissions:
+      contents: read
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4da20b3..6c044f3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 ### Unreleased
 
+### [1.2.2] - 2026-04-20
+
+- bind: constrain regex to limit backtracking
+- ci: separage coverage file, push to main
+
 ### [1.2.1] - 2026-04-20
 
 - fix(package.json): syntax
@@ -227,3 +232,4 @@
 [1.1.8]: https://github.com/NicTool/dns-zone/releases/tag/v1.1.8
 [1.2.0]: https://github.com/NicTool/dns-zone/releases/tag/v1.2.0
 [1.2.1]: https://github.com/NicTool/dns-zone/releases/tag/v1.2.1
+[1.2.2]: https://github.com/NicTool/dns-zone/releases/tag/v1.2.2
diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index fba4d2d..e0450b8 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -2,7 +2,7 @@
 
 This handcrafted artisanal software is brought to you by:
 
-| <img height="80" src="https://avatars.githubusercontent.com/u/261635?v=4"><br><a href="https://github.com/msimerson">msimerson</a> (<a href="https://github.com/NicTool/dns-zone/commits?author=msimerson">30</a>) |
+| <img height="80" src="https://avatars.githubusercontent.com/u/261635?v=4"><br><a href="https://github.com/msimerson">msimerson</a> (<a href="https://github.com/NicTool/dns-zone/commits?author=msimerson">31</a>) |
 | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: |
 
 <sub>this file is generated by [.release](https://github.com/msimerson/.release).
diff --git a/README.md b/README.md
index 8578bfb..cd7fd3d 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
-[![Module Tests](https://github.com/NicTool/dns-zone/actions/workflows/ci.yml/badge.svg)](https://github.com/NicTool/dns-zone/actions/workflows/ci.yml)
-[![Coverage Status](https://coveralls.io/repos/github/NicTool/dns-zone/badge.svg?branch=main)](https://coveralls.io/github/NicTool/dns-zone?branch=main)
+[![Tests][test-img]][test-uri]
+[![Coverage][cov-img]][cov-uri]
 
 # dns-zone
 
@@ -122,7 +122,7 @@ const rrs = await tinydns.parseData(dataText)
 const rrs = await maradns.parseZoneFile(csv2Text, { origin: 'example.com.' })
 ```
 
-Each RR is a [`@nictool/dns-resource-record`](https://github.com/NicTool/dns-resource-record) instance; use `rr.toBind()`, `rr.toTinydns()`, `rr.toMaraDNS()` to emit in other formats.
+Each RR is a [`@nictool/dns-resource-record`][dns-rr] instance; use `rr.toBind()`, `rr.toTinydns()`, `rr.toMaraDNS()` to emit in other formats.
 
 Zone-level validation:
 
@@ -148,9 +148,15 @@ Violations are collected on `zone.errors` and also printed by the CLI (with `-v`
 
 ## RELATED PACKAGES
 
-- [`@nictool/dns-resource-record`](https://github.com/NicTool/dns-resource-record) — record-level parsing, validation, and format conversion
+- [`@nictool/dns-resource-record`][dns-rr] — record-level parsing, validation, and format conversion
 - [`@nictool/dns-nameserver`](https://github.com/NicTool/dns-nameserver) — nameserver config parsers (BIND, Knot, MaraDNS, NSD, tinydns)
 
 ## LICENSE
 
 BSD-3-Clause — see [LICENSE](LICENSE).
+
+[dns-rr]: https://github.com/NicTool/dns-resource-record
+[test-img]: https://github.com/NicTool/dns-zone/actions/workflows/ci.yml/badge.svg
+[test-uri]: https://github.com/NicTool/dns-zone/actions/workflows/ci.yml
+[cov-img]: https://coveralls.io/repos/github/NicTool/dns-zone/badge.svg
+[cov-uri]: https://coveralls.io/github/NicTool/dns-zone
diff --git a/lib/bind.js b/lib/bind.js
index fe658c7..39960b3 100644
--- a/lib/bind.js
+++ b/lib/bind.js
@@ -20,7 +20,7 @@ const rrTypes = Object.entries(RR)
   .join('|')
 
 const re = {
-  directive: /^\$(\w+)\s+([^\s;]+)/,
+  directive: /^\$(\w{1,16})\s+([^\s;]{1,256})/,
   ttl: '([0-9]+)',
   classes: '(IN|CS|CH|HS|NONE|ANY)',
 }
diff --git a/package.json b/package.json
index 2089b11..ac1c150 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@nictool/dns-zone",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "DNS Zone",
   "main": "index.js",
   "type": "module",