@blamejs/core 0.15.12 → 0.15.14

package/lib/mtls-ca.js

@@ -58,6 +58,9 @@ var nodeCrypto = require("node:crypto");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+// Lazy — the SHA3-512 fingerprint surfaced from issuance must match the one
+// the require-mtls gate pins (b.crypto.sha3Hash(certPem)).
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 var { boot } = require("./log");
 var safeBuffer = require("./safe-buffer");
 var safeJson = require("./safe-json");
@@ -193,7 +196,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "dataDir", "paths", "vault",
-    "caKeySealedMode", "generation", "engine",
+    "caKeySealedMode", "generation", "engine", "revocationStore",
   ], "b.mtlsCa");
   validateOpts.requireNonEmptyString(opts.dataDir, "mtlsCa.create: opts.dataDir", MtlsCaError, "mtls-ca/no-datadir");
   // Auto-create the dataDir with restrictive perms (CA keys live here).
@@ -208,7 +211,7 @@ function create(opts) {
   var paths = _resolvePaths(opts.dataDir, opts.paths);
   var vault = opts.vault || null;
   var caKeySealedMode = (opts.caKeySealedMode || "required").toLowerCase();
-  if (!VALID_SEAL_MODES[caKeySealedMode]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_SEAL_MODES, caKeySealedMode)) {
     throw new MtlsCaError("mtls-ca/bad-mode",
       "caKeySealedMode must be 'required' or 'disabled' " +
       "(legacy 'auto' was removed — it defaulted to plaintext-on-disk)");
@@ -243,7 +246,7 @@ function create(opts) {
         current:    generation,
       };
     }
-    var pem = nodeFs.readFileSync(paths.caCert);
+    var pem = atomicFile.fdSafeReadSync(paths.caCert, { maxBytes: C.BYTES.mib(1) });
     var gen = parseGeneration(pem);
     return {
       exists:     true,
@@ -269,7 +272,9 @@ function create(opts) {
           "CA_KEY_SEALED='required' but " + paths.caKeySealed + " does not exist");
       }
       _requireVault("sealed CA key load");
-      var sealedBytes = nodeFs.readFileSync(paths.caKeySealed, "utf8").trim();
+      // Cap + fd-bound CA-private-key read. NO refuseSymlink: caKeySealed may be
+      // an operator-absolute path on a k8s/KMS secret volume that symlinks it.
+      var sealedBytes = atomicFile.fdSafeReadSync(paths.caKeySealed, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }).trim();
       var pem = vault.unseal(sealedBytes);
       if (!pem) {
         throw new MtlsCaError("mtls-ca/unseal-failed",
@@ -282,7 +287,9 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/plain-required",
         "caKeySealedMode='disabled' but " + paths.caKey + " does not exist");
     }
-    return nodeFs.readFileSync(paths.caKey);
+    // Cap + fd-bound plaintext CA-private-key read (disabled mode = dev opt-out).
+    // NO refuseSymlink (operator-absolute path may symlink).
+    return atomicFile.fdSafeReadSync(paths.caKey, { maxBytes: C.BYTES.kib(64) });
   }
 
   function loadCert() {
@@ -290,7 +297,7 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/missing-cert",
         "no CA cert on disk at " + paths.caCert);
     }
-    return nodeFs.readFileSync(paths.caCert);
+    return atomicFile.fdSafeReadSync(paths.caCert, { maxBytes: C.BYTES.mib(1) });
   }
 
   // Atomic commit: write .tmp + atomic rename for both key and cert.
@@ -370,6 +377,29 @@ function create(opts) {
     return fresh;
   }
 
+  // Recover the issued certificate's identity from its PEM so issuance and
+  // any later revocation/indexing share identifiers without a round-trip back
+  // through an X.509 parser. serialNumber is normalized to the same hex form
+  // revoke() stores; fingerprint is the SHA3-512 the require-mtls gate pins.
+  function _certIdentity(certPem) {
+    // serialNumber comes from an X.509 parse, which is best-effort: a custom
+    // engine (or a test double) may return a cert in a shape this Node build
+    // cannot parse as X.509. The fingerprint is a hash of the returned bytes,
+    // so it is always available and is what the require-mtls gate pins —
+    // revoke()/isRevoked() by fingerprint keep working even when the serial
+    // can't be recovered. Never let optional identity enrichment crash issuance.
+    var serialNumber = null;
+    try {
+      serialNumber = _normalizeSerial(new nodeCrypto.X509Certificate(certPem).serialNumber);
+    } catch (_e) {
+      serialNumber = null;
+    }
+    return {
+      serialNumber: serialNumber,
+      fingerprint:  bCrypto().sha3Hash(certPem),
+    };
+  }
+
   async function generateClientCert(opts2) {
     opts2 = opts2 || {};
     var ca = await initCA();
@@ -379,7 +409,10 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/bad-engine-output",
         "engine.signClientCert must return { cert, key, ca?, issuedAt?, expiresAt? }");
     }
-    return result;
+    // Surface the issued serial + fingerprint so the caller can track/revoke
+    // the cert by the same identifiers without re-parsing the PEM.
+    var id = _certIdentity(result.cert);
+    return Object.assign({}, result, { serialNumber: id.serialNumber, fingerprint: id.fingerprint });
   }
 
   async function generateClientP12(opts2) {
@@ -395,32 +428,63 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/bad-engine-output",
         "engine.packageP12 must return { p12: Buffer, certPem, issuedAt, expiresAt }");
     }
+    if (typeof result.certPem === "string") {
+      var id12 = _certIdentity(result.certPem);
+      return Object.assign({}, result, { serialNumber: id12.serialNumber, fingerprint: id12.fingerprint });
+    }
     return result;
   }
 
   // ---- Revocation registry + CRL ----
 
-  function _loadRevocations() {
-    if (!nodeFs.existsSync(paths.revocations)) return { revocations: [] };
-    try {
-      // safeJson.parse caps depth + size + protects against
-      // proto-pollution; the revocation file is under the operator's
-      // dataDir but a tampered or truncated file shouldn't be able to
-      // corrupt the rotator process.
-      var json = safeJson.parse(nodeFs.readFileSync(paths.revocations, "utf8"),
-        { maxBytes: C.BYTES.mib(16) });
-      if (!json || !Array.isArray(json.revocations)) return { revocations: [] };
-      return json;
-    } catch (e) {
-      throw new MtlsCaError("mtls-ca/revocation-corrupt",
-        "could not parse " + paths.revocations + ": " +
-        ((e && e.message) || String(e)));
+  // Revocation entries are read + written through a store so the registry can
+  // live somewhere other than the default plaintext revocations.json — e.g. an
+  // operator-supplied encrypted / clustered store (the bring-your-own-store
+  // precedent b.queue's config.db set). Contract (sync):
+  //   list()     -> array of revocation entries
+  //   add(entry) -> append one entry (the caller has already deduped)
+  function _defaultFileStore() {
+    function _list() {
+      if (!nodeFs.existsSync(paths.revocations)) return [];
+      try {
+        // safeJson.parse caps depth + size + protects against
+        // proto-pollution; a tampered or truncated file shouldn't be able to
+        // corrupt the rotator process.
+        var json = safeJson.parse(atomicFile.fdSafeReadSync(paths.revocations, { maxBytes: C.BYTES.mib(16), encoding: "utf8" }),
+          { maxBytes: C.BYTES.mib(16) });
+        return (json && Array.isArray(json.revocations)) ? json.revocations : [];
+      } catch (e) {
+        throw new MtlsCaError("mtls-ca/revocation-corrupt",
+          "could not parse " + paths.revocations + ": " + ((e && e.message) || String(e)));
+      }
     }
+    return {
+      list: _list,
+      add:  function (entry) {
+        var entries = _list();
+        entries.push(entry);
+        atomicFile.writeSync(paths.revocations,
+          JSON.stringify({ revocations: entries }, null, 2) + "\n", { mode: 0o600 });
+      },
+    };
   }
+  var revocationStore = opts.revocationStore || _defaultFileStore();
+  validateOpts.requireMethods(revocationStore, ["list", "add"],
+    "opts.revocationStore", MtlsCaError, "mtls-ca/bad-revocation-store");
 
-  function _saveRevocations(state) {
-    atomicFile.writeSync(paths.revocations,
-      JSON.stringify(state, null, 2) + "\n", { mode: 0o600 });
+  // A fingerprint is the SHA3-512 hex the require-mtls gate pins. Normalize it
+  // like a serial (strip 0x / separators / whitespace, lowercase, hex-validate)
+  // so a consumer can revoke by the same value the gate compares against.
+  function _normalizeFingerprint(fp) {
+    if (!fp || typeof fp !== "string") {
+      throw new MtlsCaError("mtls-ca/bad-fingerprint", "fingerprint must be a non-empty string");
+    }
+    var stripped = fp.replace(/^0x/i, "").replace(/[:\-\s]/g, "");
+    if (!safeBuffer.isHex(stripped)) {
+      throw new MtlsCaError("mtls-ca/bad-fingerprint",
+        "fingerprint contains non-hex characters: " + JSON.stringify(fp));
+    }
+    return stripped.toLowerCase();
   }
 
   function _normalizeSerial(s) {
@@ -466,46 +530,66 @@ function create(opts) {
     "aACompromise":         10,
   };
 
-  function revoke(serialNumber, opts3) {
-    var serial = _normalizeSerial(serialNumber);
+  function revoke(idOrOpts, opts3) {
+    // Accept either revoke(serialString, { reason, fingerprint }) — the
+    // backward-compatible serial-keyed form — or revoke({ serial?,
+    // fingerprint?, reason? }). The require-mtls gate denies by fingerprint,
+    // so a fingerprint-indexed consumer can revoke by the same value it pins
+    // on; serial-keyed behavior stays the default. At least one key required.
+    var spec = (idOrOpts && typeof idOrOpts === "object") ? idOrOpts : null;
     opts3 = opts3 || {};
-    var reasonName = opts3.reason || "unspecified";
+    var serialIn      = spec ? spec.serial      : idOrOpts;
+    var fingerprintIn = spec ? spec.fingerprint : opts3.fingerprint;
+    var reasonName    = (spec ? spec.reason : opts3.reason) || "unspecified";
+
+    var serial = (serialIn !== undefined && serialIn !== null) ? _normalizeSerial(serialIn) : null;
+    var fingerprint = (fingerprintIn !== undefined && fingerprintIn !== null)
+      ? _normalizeFingerprint(fingerprintIn) : null;
+    if (!serial && !fingerprint) {
+      throw new MtlsCaError("mtls-ca/no-revocation-key",
+        "revoke requires a serial number or a fingerprint " +
+        "(revoke(serial, opts) or revoke({ serial, fingerprint }))");
+    }
     var reasonCode = CRL_REASON_BY_NAME[reasonName];
     if (reasonCode === undefined) {
       throw new MtlsCaError("mtls-ca/bad-reason",
         "revoke: unknown reason '" + reasonName + "' (valid: " +
         Object.keys(CRL_REASON_BY_NAME).join(", ") + ")");
     }
-    var state = _loadRevocations();
-    var existing = state.revocations.find(function (r) {
-      return r.serialNumber === serial;
+    var existing = revocationStore.list().find(function (r) {
+      return (serial && r.serialNumber === serial) || (fingerprint && r.fingerprint === fingerprint);
     });
     if (existing) {
-      // Idempotent — repeated revoke() of the same serial doesn't
+      // Idempotent — repeated revoke() of the same serial/fingerprint doesn't
       // shift the revokedAt timestamp.
       return existing;
     }
     var entry = {
       serialNumber: serial,
+      fingerprint:  fingerprint,
       reason:       reasonName,
       reasonCode:   reasonCode,
       revokedAt:    Date.now(),
     };
-    state.revocations.push(entry);
-    _saveRevocations(state);
+    revocationStore.add(entry);
     return entry;
   }
 
-  function isRevoked(serialNumber) {
-    var serial = _normalizeSerial(serialNumber);
-    var state = _loadRevocations();
-    return state.revocations.some(function (r) {
-      return r.serialNumber === serial;
+  function isRevoked(serialOrFingerprint) {
+    // Accept a serial number OR a SHA3-512 fingerprint — both are hex, so one
+    // normalized form is matched against either key each entry carries.
+    if (!serialOrFingerprint || typeof serialOrFingerprint !== "string") {
+      throw new MtlsCaError("mtls-ca/bad-revocation-key",
+        "isRevoked requires a serial number or a fingerprint (hex string)");
+    }
+    var norm = _normalizeFingerprint(serialOrFingerprint);
+    return revocationStore.list().some(function (r) {
+      return r.serialNumber === norm || r.fingerprint === norm;
     });
   }
 
   function getRevocations() {
-    return _loadRevocations().revocations.slice();
+    return revocationStore.list().slice();
   }
 
   // Generate a signed X.509 CRL covering every entry in the registry.
@@ -521,7 +605,7 @@ function create(opts) {
         "framework's bundled CA engine, which supports it");
     }
     var ca = await initCA();
-    var revocations = _loadRevocations().revocations;
+    var revocations = revocationStore.list();
     var nowMs = Date.now();
     var thisUpdate = opts3.thisUpdate || new Date(nowMs);
     var nextUpdate = opts3.nextUpdate ||

package/lib/network-byte-quota.js

@@ -39,6 +39,7 @@
  */
 
 var C = require("./constants");
+var boundedMap = require("./bounded-map");
 var defineClass = require("./framework-error").defineClass;
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
@@ -79,9 +80,7 @@ function _slideAndSum(entry, nowHour) {
 function _memoryBackend() {
   var store = new Map();
   function _get(key) {
-    var entry = store.get(key);
-    if (!entry) { entry = _newEntry(); store.set(key, entry); }
-    return entry;
+    return boundedMap.getOrInsert(store, key, function () { return _newEntry(); });
   }
   return {
     async total(key, nowMs) {
@@ -172,27 +171,14 @@ function create(opts) {
   validateOpts(opts, ["bytesPerDay", "cache", "audit", "now"], "network.byteQuota");
   _requirePositiveBytes("bytesPerDay", opts.bytesPerDay);
   var bytesPerDay = opts.bytesPerDay;
-  var auditOn = opts.audit !== false;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
   var backend = opts.cache && typeof opts.cache.get === "function"
     ? _cacheBackend(opts.cache)
     : _memoryBackend();
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "network.byte_quota." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit is best-effort */ }
-  }
+  var _emitAudit = audit().namespaced("network.byte_quota", opts.audit);
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("network.byte_quota." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("network.byte_quota");
 
   // check(key, bytes) — preflight without mutation. Returns
   //   { allowed, total, remaining, quota, retryAfterSec, degraded }

package/lib/network-dane.js

@@ -31,6 +31,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -44,12 +45,13 @@ var SELECTORS = { 0: "Cert", 1: "SPKI" };
 // refused rather than guessed.
 var MATCHING = { 0: null, 1: "sha256", 2: "sha512" };
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  if (typeof x === "string") return Buffer.from(x, "hex");
-  throw new DaneError("dane/bad-bytes", "dane: " + what + " must be a Buffer / Uint8Array / hex string");
-}
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    DaneError,
+  typeCode:      "dane/bad-bytes",
+  messagePrefix: "dane: ",
+  messageSuffix: " must be a Buffer / Uint8Array / hex string",
+  encoding:      "hex",
+});
 
 function _selectedData(x509, selector) {
   if (selector === 0) return Buffer.from(x509.raw);                                   // full certificate DER

package/lib/network-dns-resolver.js

@@ -179,7 +179,7 @@ var QTYPE_BY_NAME = Object.freeze({
 function create(opts) {
   opts = opts || {};
   var profile     = opts.profile || (opts.posture && safeDns.compliancePosture(opts.posture)) || DEFAULT_PROFILE;
-  if (!safeDns.PROFILES[profile]) {
+  if (!Object.prototype.hasOwnProperty.call(safeDns.PROFILES, profile)) {
     throw new ResolverError("resolver/bad-profile",
       "create: unknown profile '" + profile + "'");
   }
@@ -188,7 +188,9 @@ function create(opts) {
   var serveStale  = opts.serveStale === false ? 0 :
                     typeof opts.serveStale === "number" ? opts.serveStale : DEFAULT_STALE_WINDOW;
   var transport   = opts.transport || _defaultTransport();
-  var auditImpl   = opts.audit || audit();
+  // Audit goes to the operator-supplied sink (opts.audit) when present, else the
+  // framework chain — b.audit.namespaced no-ops if the sink has no safeEmit.
+  var _baseAudit  = audit().namespaced("network.dns.resolver", { sink: opts.audit });
 
   if (typeof transport.lookup !== "function") {
     throw new ResolverError("resolver/bad-transport",
@@ -238,11 +240,7 @@ function create(opts) {
   }
 
   function _safeEmit(action, metadata) {
-    try {
-      if (auditImpl && typeof auditImpl.safeEmit === "function") {
-        auditImpl.safeEmit({ action: "network.dns.resolver." + action, outcome: "success", metadata: metadata });
-      }
-    } catch (_e) { /* audit drop-silent per validation tier policy */ }
+    _baseAudit(action, "success", metadata);
   }
 
   async function query(name, type, qopts) {
@@ -526,8 +524,101 @@ function _minTtl(rrs) {
   return min === Infinity ? 0 : min;
 }
 
+// _sharedTxtResolver — one process-wide validating resolver (with its TTL
+// cache) shared by every email-auth policy TXT lookup, instead of each module
+// constructing its own (or reaching for plaintext system DNS).
+var _sharedResolver = null;
+function _sharedTxtResolver() {
+  if (!_sharedResolver) _sharedResolver = create();
+  return _sharedResolver;
+}
+
+/**
+ * @primitive  b.network.dns.resolver.resolveTxt
+ * @signature  b.network.dns.resolver.resolveTxt(qname, dnsLookup?, resolver?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.network.dns.resolver.safeResolveTxt, b.network.dns.resolver.create
+ *
+ * Resolve TXT records for `qname` via the operator's `dnsLookup(qname, "TXT")`
+ * override when supplied, otherwise the framework's shared validating
+ * (DoH / DoT / system, DNSSEC-checked) resolver — normalized to the
+ * `string[][]` shape `dnsPromises.resolveTxt` returns. Throws an `ENODATA`
+ * Error when no TXT records exist.
+ *
+ * This is the secure DNS path for every email-auth policy lookup (DMARC / DKIM /
+ * ARC / BIMI / MTA-STS / TLS-RPT). Plaintext system DNS (`dnsPromises.resolveTxt`)
+ * is spoofable — DNS cache-poisoning / Kaminsky-class — and must NOT be used for
+ * records a downgrade or redirect would exploit.
+ *
+ * Pass `resolver` (a `b.network.dns.resolver.create()` instance) to reshape TXT
+ * records off a caller-owned resolver instead of the shared one — the mail-auth
+ * and mail-dkim modules use this so their TXT lookups share the same resolver
+ * (and cache) they use for A / MX / PTR, instead of each re-rolling the reshape.
+ *
+ * @example
+ *   var rrs = await b.network.dns.resolver.resolveTxt("_dmarc.example.com");
+ *   // → [ ["v=DMARC1; p=reject"] ]
+ */
+async function resolveTxt(qname, dnsLookup, resolver) {
+  if (dnsLookup) return dnsLookup(qname, "TXT");
+  var r = await (resolver || _sharedTxtResolver()).queryTxt(qname);
+  var out = [];
+  for (var i = 0; i < r.rrs.length; i += 1) {
+    var rr = r.rrs[i];
+    if (rr && rr.type === 16) {                                          // IANA DNS qtype TXT
+      out.push(Array.isArray(rr.decoded) ? rr.decoded : [String(rr.decoded)]);
+    }
+  }
+  if (out.length === 0) {
+    var err = new Error("no TXT records for " + qname);
+    err.code = "ENODATA";
+    throw err;
+  }
+  return out;
+}
+
+/**
+ * @primitive  b.network.dns.resolver.safeResolveTxt
+ * @signature  b.network.dns.resolver.safeResolveTxt(qname, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.network.dns.resolver.resolveTxt
+ *
+ * `resolveTxt` wrapped with the email-auth policy-fetch convention: a domain
+ * with no record (ENOTFOUND / ENODATA) returns `null` (absence is not an
+ * error); any other failure throws the caller's typed error via
+ * `errorFactory(code, message)` so each protocol keeps its own error class.
+ * The same secure resolver path as `resolveTxt` — never plaintext system DNS.
+ *
+ * @opts
+ *   dnsLookup:    function,   // operator override (qname, "TXT") => string[][]
+ *   errorFactory: function,   // (code, message) => Error, thrown on non-absence failures
+ *   code:         string,     // error code passed to errorFactory
+ *
+ * @example
+ *   var rrs = await b.network.dns.resolver.safeResolveTxt("_mta-sts.example.com", {
+ *     errorFactory: function (code, msg) { return new SmtpPolicyError(code, msg); },
+ *     code: "smtp/mta-sts-txt-lookup-failed",
+ *   });
+ *   if (rrs === null) return null;   // no MTA-STS record published
+ */
+async function safeResolveTxt(qname, opts) {
+  opts = opts || {};
+  try {
+    return await resolveTxt(qname, opts.dnsLookup);
+  } catch (e) {
+    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
+    var msg = "TXT lookup for " + qname + " failed: " + ((e && e.message) || String(e));
+    if (typeof opts.errorFactory === "function") throw opts.errorFactory(opts.code, msg);
+    throw e;
+  }
+}
+
 module.exports = {
   create:         create,
+  resolveTxt:     resolveTxt,
+  safeResolveTxt: safeResolveTxt,
   ResolverError:  ResolverError,
   QTYPE_BY_NAME:  QTYPE_BY_NAME,
 };

package/lib/network-dns.js

@@ -1,6 +1,7 @@
 "use strict";
 
 var dns = require("node:dns");
+var numericBounds = require("./numeric-bounds");
 var net = require("node:net");
 var https = require("node:https");
 var nodeTls = require("node:tls");
@@ -347,10 +348,16 @@ function _decodeDnsAnswer(buf, qtype) {
   for (var a = 0; a < ancount; a++) {
     _skipDnsName(buf, state);
     var off = state.off;
+    // Bound the RR fixed header (10 bytes: type+class+ttl+rdlen) and the rdata
+    // before indexing — ancount comes from the (untrusted upstream) header, so a
+    // truncated reply would otherwise over-read into a raw RangeError. Mirrors
+    // the hardened _decodeDnsAnswerRaw guards.
+    if (off + 10 > buf.length) throw new DnsError("dns/bad-reply", "answer record truncated");
     var rtype  = buf.readUInt16BE(off); off += 2;
     off += 2;
     off += 4;
     var rdlen  = buf.readUInt16BE(off); off += 2;
+    if (off + rdlen > buf.length) throw new DnsError("dns/bad-reply", "answer rdata truncated");
     if (rtype === qtype && qtype === 1 && rdlen === 4) {
       addrs.push(buf[off] + "." + buf[off + 1] + "." + buf[off + 2] + "." + buf[off + 3]);
     } else if (rtype === qtype && qtype === DNS_QTYPE_AAAA && rdlen === IPV6_ADDR_BYTES) {
@@ -1851,7 +1858,7 @@ var DS_DIGEST_TYPES = Object.freeze({
 });
 
 function classifyDnskeyAlgorithm(algorithm) {
-  if (typeof algorithm !== "number" || !isFinite(algorithm) || Math.floor(algorithm) !== algorithm) {
+  if (!numericBounds.isFiniteInt(algorithm)) {
     return null;
   }
   var row = DNSKEY_ALGORITHMS[algorithm];
@@ -1874,7 +1881,7 @@ function classifyDnskeyAlgorithm(algorithm) {
 }
 
 function classifyDsDigestType(digestType) {
-  if (typeof digestType !== "number" || !isFinite(digestType) || Math.floor(digestType) !== digestType) {
+  if (!numericBounds.isFiniteInt(digestType)) {
     return null;
   }
   var row = DS_DIGEST_TYPES[digestType];

package/lib/network-dnssec.js

@@ -45,7 +45,9 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -79,11 +81,14 @@ var TYPE_NUM = {
   SMIMEA: 53, CDS: 59, CDNSKEY: 60, OPENPGPKEY: 61, CAA: 257, HINFO: 13,
 };
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  throw new DnssecError("dnssec/bad-bytes", "dnssec: " + what + " must be a Buffer");
-}
+// DNSSEC wire data is bytes, never text (allowString:false).
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    DnssecError,
+  typeCode:      "dnssec/bad-bytes",
+  messagePrefix: "dnssec: ",
+  messageSuffix: " must be a Buffer",
+  allowString:   false,
+});
 
 // Canonical wire form of a domain name (RFC 4034 §6.2): each label
 // length-prefixed, ASCII lowercased, terminated by the root label.
@@ -157,8 +162,11 @@ function _dnskeyToKey(algId, publicKey) {
   return _jwkKey({ kty: "OKP", crv: "Ed25519", x: pk.toString("base64url") });
 }
 function _jwkKey(jwk) {
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) { throw new DnssecError("dnssec/bad-key", "dnssec: could not import DNSKEY: " + ((e && e.message) || e)); }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    DnssecError,
+    code:          "dnssec/bad-key",
+    messagePrefix: "dnssec: could not import DNSKEY: ",
+  });
 }
 
 /**
@@ -284,15 +292,8 @@ function verifyRrset(opts) {
   }
 
   // Validity window (fail closed on a bad opts.at).
-  var atMs;
-  if (opts.at !== undefined && opts.at !== null) {
-    if (!(opts.at instanceof Date) || !isFinite(opts.at.getTime())) {
-      throw new DnssecError("dnssec/bad-at", "dnssec.verifyRrset: opts.at must be a valid Date");
-    }
-    atMs = opts.at.getTime();
-  } else {
-    atMs = Date.now();
-  }
+  validateOpts.optionalDate(opts.at, "dnssec.verifyRrset: opts.at", DnssecError, "dnssec/bad-at");
+  var atMs = (opts.at !== undefined && opts.at !== null) ? opts.at.getTime() : Date.now();
   var nowSec = Math.floor(atMs / 1000);
   if (nowSec < (rrsig.inception >>> 0)) throw new DnssecError("dnssec/not-yet-valid", "dnssec.verifyRrset: RRSIG inception is in the future");
   if (nowSec > (rrsig.expiration >>> 0)) throw new DnssecError("dnssec/expired", "dnssec.verifyRrset: RRSIG has expired");
@@ -515,7 +516,7 @@ function nsec3Hash(name, opts) {
   validateOpts(opts, ["salt", "iterations"], "dnssec.nsec3Hash");
   var salt = _bytes(opts.salt, "salt");
   var iters = opts.iterations;
-  if (typeof iters !== "number" || !isFinite(iters) || iters < 0 || Math.floor(iters) !== iters) {
+  if (!numericBounds.isNonNegativeFiniteInt(iters)) {
     throw new DnssecError("dnssec/bad-iterations", "dnssec.nsec3Hash: iterations must be a non-negative integer");
   }
   return _nsec3HashWire(_canonicalName(name), salt, iters);

package/lib/network-heartbeat.js

@@ -5,6 +5,7 @@ var net = require("node:net");
 var C = require("./constants");
 var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var HeartbeatError = defineClass("HeartbeatError", { alwaysPermanent: true });
@@ -198,9 +199,9 @@ function start(opts) {
   var started = [];
   for (var j = 0; j < opts.targets.length; j++) {
     var t = opts.targets[j];
-    if (TARGETS.has(t.name)) {
+    boundedMap.requireAbsent(TARGETS, t.name, function () {
       throw new HeartbeatError("heartbeat/duplicate", "heartbeat target '" + t.name + "' already started");
-    }
+    });
     var entry = {
       target:              t,
       intervalMs:          t.intervalMs || DEFAULT_INTERVAL_MS,