@blamejs/core 0.18.39 → 0.18.41

package/lib/mail.js

@@ -248,10 +248,9 @@ async function reverseDns(ip) {
   // the original input. RFC 8601 §3 says the forward query must use
   // the same family as the source; mismatched families don't count
   // as confirmation.
-  var net = require("node:net");
   var forwardAddrs = [];
   try {
-    if (net.isIPv6(ip)) {
+    if (net().isIPv6(ip)) {
       forwardAddrs = await dns.resolveAaaa(ptrName);
     } else {
       forwardAddrs = await dns.resolve4(ptrName);

package/lib/middleware/csrf-protect.js

@@ -69,6 +69,7 @@
  *   }
  */
 var C = require("../constants");
+var cookies = require("../cookies");
 var lazyRequire = require("../lazy-require");
 var pick = require("../pick");
 var forms = require("../forms");
@@ -130,33 +131,6 @@ function _parseCookieHeader(header) {
   return Object.assign(Object.create(null), Object.fromEntries(pairs));
 }
 
-function _formatSetCookie(name, value, opts) {
-  var parts = [name + "=" + value];
-  parts.push("Path=" + (opts.path || "/"));
-  parts.push("SameSite=" + (opts.sameSite || "Lax"));
-  if (opts.httpOnly) parts.push("HttpOnly");
-  if (opts.secure)   parts.push("Secure");
-  if (opts.maxAge != null) parts.push("Max-Age=" + opts.maxAge);
-  return parts.join("; ");
-}
-
-function _appendSetCookie(res, value) {
-  // Don't clobber other Set-Cookie headers the route may have already
-  // queued (login session cookie, etc.). Use res.appendHeader when
-  // available; else array-merge manually.
-  if (typeof res.appendHeader === "function") {
-    res.appendHeader("Set-Cookie", value);
-    return;
-  }
-  var existing = typeof res.getHeader === "function" ? res.getHeader("Set-Cookie") : undefined;
-  if (existing == null) {
-    res.setHeader("Set-Cookie", value);
-  } else if (Array.isArray(existing)) {
-    res.setHeader("Set-Cookie", existing.concat(value));
-  } else {
-    res.setHeader("Set-Cookie", [existing, value]);
-  }
-}
 
 // csrf-protect does NOT buffer or parse the request body itself.
 // Operators who use form-urlencoded POSTs MUST register
@@ -431,30 +405,44 @@ function create(opts) {
     if (["Lax", "Strict", "None"].indexOf(cookieCfg.sameSite) === -1) {
       throw new Error("middleware.csrfProtect: opts.cookie.sameSite must be Lax|Strict|None");
     }
-    // Cookie name-prefix safety (RFC 6265bis §4.1.3). csrf-protect builds its
-    // own Set-Cookie header rather than routing through b.cookies.serialize, so
-    // this boot check is the only enforcement point. §5.4 requires user agents
-    // to apply the prefix test case-INSENSITIVELY (the server-side §4.1.3
-    // description reads "case-sensitive", but the UA is what drops the cookie),
-    // so `__host-`/`__SECURE-` get the same browser enforcement as
-    // `__Host-`/`__Secure-` -- case-sensitive matching was itself CVE-2024-5699.
-    // Compare a lowercased copy so a case-variant name can't dodge the invariant
-    // here and then be silently rejected by the browser. Catch typos at boot.
+    // Cookie name-prefix safety (RFC 6265bis §4.1.3). b.cookies.serialize
+    // enforces the same invariants when the header is built, but that is a
+    // per-request throw inside the middleware; catching the bad configuration
+    // at boot turns it into a startup error the operator can read. §5.4
+    // requires user agents to apply the prefix test case-INSENSITIVELY (the
+    // server-side §4.1.3 description reads "case-sensitive", but the UA is what
+    // drops the cookie), so `__host-`/`__SECURE-` get the same browser
+    // enforcement as `__Host-`/`__Secure-` -- case-sensitive matching was itself
+    // CVE-2024-5699. Compare a lowercased copy so a case-variant name can't
+    // dodge the invariant here and then be silently rejected by the browser.
     //   __Host-*   — Path must be "/", no Domain (we never set one), Secure.
     //   __Secure-* — Secure.
     if (cookieCfg.name) {
       var lowerCookieName = cookieCfg.name.toLowerCase();
-      if (lowerCookieName.indexOf("__host-") === 0) {
-        if (cookieCfg.path !== "/") {
-          throw new Error("middleware.csrfProtect: __Host-* cookie name requires path='/'");
-        }
-        if (cookieCfg.secure === false) {
-          throw new Error("middleware.csrfProtect: __Host-* cookie name requires secure (cannot be explicit false)");
-        }
-      } else if (lowerCookieName.indexOf("__secure-") === 0) {
-        if (cookieCfg.secure === false) {
-          throw new Error("middleware.csrfProtect: __Secure-* cookie name requires secure (cannot be explicit false)");
-        }
+      var isHostPrefix   = lowerCookieName.indexOf("__host-") === 0;
+      var isSecurePrefix = lowerCookieName.indexOf("__secure-") === 0;
+      if (isHostPrefix && cookieCfg.path !== "/") {
+        throw new Error("middleware.csrfProtect: __Host-* cookie name requires path='/'");
+      }
+      if (isHostPrefix && cookieCfg.secure === false) {
+        throw new Error("middleware.csrfProtect: __Host-* cookie name requires secure (cannot be explicit false)");
+      }
+      if (isSecurePrefix && cookieCfg.secure === false) {
+        throw new Error("middleware.csrfProtect: __Secure-* cookie name requires secure (cannot be explicit false)");
+      }
+      // A prefixed name is a promise to the browser that the cookie is always
+      // Secure. Leaving `secure` to per-request auto-detection breaks that
+      // promise on any cleartext request: the cookie goes out prefixed and
+      // WITHOUT Secure, the browser drops it, and the double-submit token
+      // silently never persists. The name and the auto-detect cannot both
+      // stand — the operator picking the prefix is the one asserting HTTPS,
+      // so make them say it.
+      if ((isHostPrefix || isSecurePrefix) && cookieCfg.secure == null) {
+        throw new Error("middleware.csrfProtect: " +
+          (isHostPrefix ? "__Host-*" : "__Secure-*") +
+          " cookie name requires an explicit cookie.secure: true — " +
+          "auto-detected secure emits the prefix without Secure on a plain-HTTP " +
+          "request, which browsers reject");
       }
     }
   }
@@ -485,8 +473,8 @@ function create(opts) {
   function _issueIfNeeded(req, res) {
     if (!cookieCfg) return null;
     var cookieName = _resolveCookieName(req);
-    var cookies = _parseCookieHeader(req.headers && req.headers.cookie);
-    var existing = cookies[cookieName];
+    var requestCookies = _parseCookieHeader(req.headers && req.headers.cookie);
+    var existing = requestCookies[cookieName];
     // Strict 64-hex-char check matches the byte-length of every token
     // forms.generateCsrfToken() produces (CSRF_TOKEN_BYTES = 32 bytes
     // → 64 hex chars). The previous {2,} floor accepted any 2-char
@@ -522,14 +510,20 @@ function create(opts) {
       } catch (_e) { /* drop-silent */ }
     }
     var fresh = forms.generateCsrfToken();
-    var setCookie = _formatSetCookie(cookieName, fresh, {
+    // b.cookies owns Set-Cookie: it validates the name as an RFC 6265 token,
+    // refuses CRLF / NUL in the value, scrubs the Path and Domain attributes
+    // before they reach a response header, and enforces the RFC 6265bis
+    // prefix invariants. The token is 64 hex characters, so the percent-
+    // encoding serialize applies to the value is a no-op on it and the cookie
+    // the browser echoes back still matches the double-submit compare.
+    var setCookie = cookies.serialize(cookieName, fresh, {
       path:     cookieCfg.path,
       sameSite: cookieCfg.sameSite,
       secure:   cookieCfg.secure == null ? _isHttps(req) : !!cookieCfg.secure,
       httpOnly: cookieCfg.httpOnly,
       maxAge:   cookieCfg.maxAge,
     });
-    _appendSetCookie(res, setCookie);
+    cookies.appendSetCookie(res, setCookie);
     req._csrfIssuedCookies[cookieName] = fresh;
     req.csrfToken = fresh;
     return fresh;

package/lib/migrations.js

@@ -297,12 +297,12 @@ function create(opts) {
   var dir = opts.dir;
 
   function _appliedRows() {
-    var db = _resolveDb(opts);
-    _ensureTable(db);
-    var q = sql.select(_migrationsTable(), _sqlOpts(db))
+    var conn = _resolveDb(opts);
+    _ensureTable(conn);
+    var q = sql.select(_migrationsTable(), _sqlOpts(conn))
       .columns(["name", "description", "appliedAt"])
       .orderBy("appliedAt", "asc").orderBy("name", "asc").toSql();
-    var stmt = db.prepare(q.sql);
+    var stmt = conn.prepare(q.sql);
     return stmt.all.apply(stmt, q.params);
   }
 
@@ -319,11 +319,11 @@ function create(opts) {
   }
 
   function up() {
-    var db = _resolveDb(opts);
-    _ensureTable(db);
-    return _withLock(db, opts, function () {
-      var namesQ = sql.select(_migrationsTable(), _sqlOpts(db)).columns(["name"]).toSql();
-      var namesStmt = db.prepare(namesQ.sql);
+    var conn = _resolveDb(opts);
+    _ensureTable(conn);
+    return _withLock(conn, opts, function () {
+      var namesQ = sql.select(_migrationsTable(), _sqlOpts(conn)).columns(["name"]).toSql();
+      var namesStmt = conn.prepare(namesQ.sql);
       var appliedSet = new Set(
         namesStmt.all.apply(namesStmt, namesQ.params)
           .map(function (r) { return r.name; })
@@ -336,12 +336,12 @@ function create(opts) {
         if (appliedSet.has(file)) { skipped.push(file); continue; }
         var mod = _loadMigration(file, dir);
         try {
-          _txn(db, function () {
-            mod.up(db);
-            var insQ = sql.insert(_migrationsTable(), _sqlOpts(db))
+          _txn(conn, function () {
+            mod.up(conn);
+            var insQ = sql.insert(_migrationsTable(), _sqlOpts(conn))
               .values({ name: file, description: mod.description || "",
                         appliedAt: new Date().toISOString() }).toSql();
-            var insStmt = db.prepare(insQ.sql);
+            var insStmt = conn.prepare(insQ.sql);
             insStmt.run.apply(insStmt, insQ.params);
           });
         } catch (e) {
@@ -363,16 +363,16 @@ function create(opts) {
         "down: steps must be a positive integer (got " + opts2.steps + ")",
         true);
     }
-    var db = _resolveDb(opts);
-    _ensureTable(db);
-    return _withLock(db, opts, function () {
+    var conn = _resolveDb(opts);
+    _ensureTable(conn);
+    return _withLock(conn, opts, function () {
       // Most-recent applied first (reverse chronological by appliedAt
       // then by name as a stable tiebreaker for fixtures with identical
       // timestamps). steps is a validated positive integer, so b.sql
       // inlines the LIMIT.
-      var downQ = sql.select(_migrationsTable(), _sqlOpts(db)).columns(["name"])
+      var downQ = sql.select(_migrationsTable(), _sqlOpts(conn)).columns(["name"])
         .orderBy("appliedAt", "desc").orderBy("name", "desc").limit(steps).toSql();
-      var downStmt = db.prepare(downQ.sql);
+      var downStmt = conn.prepare(downQ.sql);
       var rows = downStmt.all.apply(downStmt, downQ.params);
 
       var reverted = [];
@@ -386,10 +386,10 @@ function create(opts) {
             true);
         }
         try {
-          _txn(db, function () {
-            mod.down(db);
-            var delQ = sql.delete(_migrationsTable(), _sqlOpts(db)).where("name", file).toSql();
-            var delStmt = db.prepare(delQ.sql);
+          _txn(conn, function () {
+            mod.down(conn);
+            var delQ = sql.delete(_migrationsTable(), _sqlOpts(conn)).where("name", file).toSql();
+            var delStmt = conn.prepare(delQ.sql);
             delStmt.run.apply(delStmt, delQ.params);
           });
         } catch (e) {

package/lib/network-dns-resolver.js

@@ -278,6 +278,22 @@ function create(opts) {
       throw new ResolverError("resolver/bad-input",
         "query: unknown qtype '" + type + "'");
     }
+    // Canonicalize BEFORE keying. A U-label and its A-label are one DNS name,
+    // so keying on the raw string splits it across two cache entries and sends
+    // a U-label upstream that no zone answers for; the same pass refuses a name
+    // carrying an empty label rather than letting the wire encoder decide. The
+    // check lives in b.network.dns so this layer and the transport cannot
+    // disagree about what counts as a name.
+    // Translated, not propagated: b.network.dns raises DnsError/`dns/bad-host`,
+    // and every other input refusal on this API is a ResolverError with a
+    // `resolver/*` code. Letting the transport's error class out through the
+    // resolver's surface would leave a caller that classifies by code or class
+    // unable to recognize a bad name as bad input.
+    try { name = networkDns._validateHostShape(name, "resolver.query"); }
+    catch (e) {
+      throw new ResolverError("resolver/bad-input",
+        "query: " + ((e && e.message) || "name is not a valid DNS name"));
+    }
     var validate = qopts.validate === true;
     var key = _key(name, qtype);
 
@@ -588,30 +604,14 @@ async function _wireLookup(name, qtype, timeoutMs) {
 }
 
 // _encodeWireQuery — assemble a wire-format DNS query for (name, qtype).
-// Mirrors the encoder in network-dns.js but accepts an explicit qtype
-// (the existing function hardcodes A/AAAA based on family).
+//
+// The encoder itself lives in network-dns.js. This was a byte-for-byte copy of
+// it, which meant the label validation added there — the 1..63 cap that stops a
+// hostname putting a forged compression pointer in the question section, and
+// the refusal to drop an empty label and ask for a neighbouring domain — would
+// have had to be added twice to hold.
 function _encodeWireQuery(name, qtype) {
-  var parts = name.split(".").filter(Boolean);
-  var nameLen = 1;
-  for (var i = 0; i < parts.length; i += 1) nameLen += 1 + Buffer.byteLength(parts[i], "ascii");
-  var buf = Buffer.alloc(12 + nameLen + 4);                                                              // RFC 1035 §4.1.1 header (12) + question tail (4) + name
-  var id = bCrypto.randomInt(0, 0x10000);                                                              // RFC 1035 §4.1.1 16-bit query ID space
-  buf.writeUInt16BE(id, 0);
-  buf.writeUInt16BE(0x0100, 2);                                                                          // RFC 1035 §4.1.1 RD=1 flags
-  buf.writeUInt16BE(1, 4);                                                                               // RFC 1035 §4.1.1 qdcount
-  var off = 12;                                                                                          // RFC 1035 §4.1.1 header end / question start
-  for (var p = 0; p < parts.length; p += 1) {
-    var s = parts[p];
-    buf.writeUInt8(Buffer.byteLength(s, "ascii"), off);
-    off += 1;
-    off += buf.write(s, off, "ascii");
-  }
-  buf.writeUInt8(0, off);
-  off += 1;
-  buf.writeUInt16BE(qtype, off);
-  off += 2;                                                                                              // RFC 1035 §4.1.2 QTYPE width
-  buf.writeUInt16BE(1, off);                                                                             // RFC 1035 §4.1.2 QCLASS=IN
-  return buf;
+  return networkDns._encodeDnsQuery(name, qtype).buf;
 }
 
 function _minTtl(rrs) {

package/lib/network-dns.js

@@ -13,6 +13,7 @@ var C = require("./constants");
 var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var safeBuffer = require("./safe-buffer");
+var publicSuffix = require("./public-suffix");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -129,25 +130,82 @@ function _labelsOf(host) {
 // is one longer and encodes to identical wire bytes, so measuring the raw
 // string would refuse a maximum-length name written absolutely while accepting
 // it written relatively.
+// Which character marks the root is not fixed: UTS #46 maps U+3002, U+FF0E and
+// U+FF61 to ".", so `example。` is as absolute as `example.` and canonicalization
+// turns one into the other. Every place that asks "does this name end in the
+// root?" has to agree, or a spelling is accepted by one rule and refused by the
+// next — the length cap measured a mapped marker as an extra character and
+// refused a maximum-length name that its ASCII spelling passes.
+function _endsWithRootMarker(host) {
+  if (typeof host !== "string" || host.length < 2) return false;
+  // Ask the primitive that owns the set. A second copy of these four characters
+  // drifts from it, and this module already learned that lesson once — the
+  // whole point of routing name questions through b.publicSuffix.
+  return publicSuffix._isRootMarker(host.charAt(host.length - 1));
+}
+
 function _hostLengthWithoutRoot(host) {
   if (typeof host !== "string") return 0;
-  return (host.length > 1 && host.charAt(host.length - 1) === ".")
-    ? host.length - 1
-    : host.length;
+  return _endsWithRootMarker(host) ? host.length - 1 : host.length;
 }
 
 function _validateHostShape(host, primitive) {
   if (typeof host !== "string" || host.length === 0) return host;
   if (net.isIP(host)) return host;
-  var labels = _labelsOf(host);
-  for (var i = 0; i < labels.length; i += 1) {
-    if (labels[i].length === 0) {
-      throw new DnsError("dns/bad-host",
-        primitive + ": host " + JSON.stringify(host) + " has an empty label — a " +
-        "name may carry one trailing root dot and no other empty label");
-    }
-  }
-  return host;
+  // The root zone. `. NS` is how the root servers are asked for, and the name
+  // encodes as the empty label list, which the wire encoder already handles.
+  // It is the one name that is nothing BUT a root marker, so it must not reach
+  // `canonicalDomain` — that refuses a bare root, correctly, since for every
+  // other name a lone marker means the name went missing.
+  //
+  // Any of the four spellings, asked of the primitive that owns the set rather
+  // than compared against a copy of it: this module already treats U+3002 /
+  // U+FF0E / U+FF61 as equivalent to "." at the END of a name, so a root zone
+  // that depended on which one the caller typed would be the same name
+  // resolving through one spelling and not another. All four normalize to the
+  // ASCII form, as every other name here does.
+  if (host.length === 1 && publicSuffix._isRootMarker(host)) return ".";
+  // The same rules the wire encoder enforces, applied at the entry point so the
+  // caller is told which primitive refused the name. Checking only here would
+  // leave the encoder reachable from paths that do not pass through a public
+  // entry; checking only there would name no primitive.
+  _dnsQueryLabels(host, primitive);
+  // No short-circuit for ASCII. Returning such a name unchanged kept whatever
+  // case it was typed in, so `Example.COM` and `example.com` took separate
+  // resolver-cache entries and made separate upstream queries while putting
+  // byte-identical questions on the wire — the encoder lowercases either way.
+  // One canonical form for every alphabet is what makes the cache key the NAME
+  // rather than a spelling of it.
+  //
+  // An internationalized name is returned in its A-label form so that every
+  // reader downstream sees the same name the wire will carry. Converting only
+  // at the encoder would let `resolve4` reach the domain while `resolveSecure`
+  // and `querySvcb` refused it at their LDH pass, which has no reading of a
+  // U-label — the same domain resolving through one entry point and not
+  // another.
+  //
+  // The root marker is carried across rather than dropped: a resolver reads it
+  // as "already fully qualified, do not apply the search list", and under an
+  // elevated ndots losing it can resolve — and cache — a different name
+  // entirely.
+  //
+  // The marker is NOT removed here. canonicalDomain strips exactly one and
+  // refuses a doubled one, and a strip on this side is invisible to it — it
+  // would take the first marker, canonicalDomain would take the second, and a
+  // name with an empty final label would be quietly rewritten into a real,
+  // separately-owned one and then cached under it. `example.com。。` resolved as
+  // `example.com` that way, while the plain `example.com..` spelling of the
+  // same mistake was still refused.
+  //
+  // Absoluteness is settled by ASKING canonicalDomain rather than by reading
+  // the last character: UTS #46 DELETES 294 code points outright (U+00AD,
+  // U+200B, U+FEFF, U+2060, the variation selectors), so `example.com.` with
+  // one of them appended still ends in a root the raw character does not show.
+  // Appending one more marker makes a doubled one, which canonicalDomain
+  // refuses — so a refusal here means the name already carried its root.
+  var absolute = publicSuffix.canonicalDomain(host + ".") === "";
+  var ascii = _dnsToALabel(host, primitive);
+  return absolute ? ascii + "." : ascii;
 }
 
 // RFC 6761 special-form classification works on the label LIST, so the
@@ -427,8 +485,99 @@ function _armRequestTimeout(req, ms, host, reject) {
   });
 }
 
+// RFC 1035 §2.3.4 — a label is 1..63 octets and an encoded name is at most 255.
+var DNS_MAX_LABEL_OCTETS = 63;
+var DNS_MAX_NAME_OCTETS = 255;
+
+// Split a host into the labels the wire encoder will write, refusing anything
+// the wire format cannot express. Every rejection here is a name that WOULD
+// have been encoded as some other question:
+//
+//   - An empty label. Dropping it turns `evil..example.com` into the real,
+//     separately-owned `evil.example.com`, so the query asks for a name the
+//     caller never passed and the answer is cached under the one they did.
+//   - A label over 63 octets. Its length goes into a single octet whose top two
+//     bits RFC 1035 §4.1.4 reserves: `11` marks a compression POINTER and `01`
+//     an unassigned label type (RFC 6891 §3). Writing the real length lets a
+//     192-octet label put a forged pointer in the question section, aiming the
+//     upstream resolver's name parser at an offset the hostname chose.
+//   - A name over 255 octets encoded.
+// One trailing root dot is legal and is the only thing removed; the bare root
+// encodes as the empty label list it already was.
+//
+// An internationalized name is CONVERTED rather than refused. The wire carries
+// A-labels, and `Buffer.write(s, "ascii")` keeps only a character's low byte,
+// so writing a U-label directly would query a different name — but refusing one
+// would fail a name that resolves perfectly well in its `xn--` form, which is
+// how its owner published it.
+// `publicSuffix.canonicalDomain` owns this conversion: raw `domainToASCII`
+// TRUNCATES at a URL delimiter ("a.com/evil" -> "a.com"), which would turn a
+// string that is not a bare host into a name the caller never asked for, and
+// canonicalDomain refuses those instead. It also refuses a name carrying an
+// empty label, which is the same answer this function gives for an ASCII one.
+function _dnsToALabel(host, primitive) {
+  var ascii = publicSuffix.canonicalDomain(host);
+  if (!ascii) {
+    throw new DnsError("dns/bad-host",
+      primitive + ": internationalized host has no A-label (xn--) form");
+  }
+  return ascii;
+}
+
+function _dnsQueryLabels(host, primitive) {
+  var h = String(host);
+  if (h.length === 0 || h === ".") return [];
+  // EVERY name goes through the domain primitive, ASCII or not. This side used
+  // to keep its own, shorter idea of a valid name — empty label, non-ASCII,
+  // label 1..63, 255 total — and each character it did not think of was one it
+  // encoded into a query label while b.publicSuffix refused the same string
+  // outright: a NUL byte, every URL delimiter, and `%`, `^`, `|`, `<` besides.
+  // A delimiter is the one that bites, because `domainToASCII` TRUNCATES at
+  // one, so `example.com/evil` can masquerade as a trusted prefix of itself.
+  //
+  // Mirroring the rule was tried first, and the list of near-misses above is
+  // what that produced. Asking the owner is the version that cannot drift.
+  var canonical = publicSuffix.canonicalDomain(h);
+  if (!canonical) {
+    throw new DnsError("dns/bad-host",
+      primitive + ": host is not a valid domain name (empty label, control " +
+      "byte, URL delimiter, or over the RFC 1035 length ceiling)");
+  }
+  h = canonical;
+  // The label caps below still belong here: canonicalDomain bounds the whole
+  // NAME at 253 octets but says nothing about a single label, and 1..63 is what
+  // the wire format can express — a longer one writes a length octet the
+  // receiving parser reads as a compression pointer.
+  var labels = h.split(".");
+  var total = 1;
+  for (var i = 0; i < labels.length; i += 1) {
+    var len = Buffer.byteLength(labels[i], "utf8");
+    if (labels[i].length === 0) {
+      throw new DnsError("dns/bad-host",
+        primitive + ": host has an empty label — a name may carry one trailing " +
+        "root dot and no other empty label");
+    }
+    if (len !== labels[i].length) {
+      throw new DnsError("dns/bad-host",
+        primitive + ": host label is not ASCII and has no A-label (xn--) form");
+    }
+    if (len > DNS_MAX_LABEL_OCTETS) {
+      throw new DnsError("dns/bad-host",
+        primitive + ": host label is " + len + " octets (RFC 1035 allows 1.." +
+        DNS_MAX_LABEL_OCTETS + ")");
+    }
+    total += 1 + len;
+  }
+  if (total > DNS_MAX_NAME_OCTETS) {
+    throw new DnsError("dns/bad-host",
+      primitive + ": host encodes to " + total + " octets (RFC 1035 allows at most " +
+      DNS_MAX_NAME_OCTETS + ")");
+  }
+  return labels;
+}
+
 function _encodeDnsQuery(host, qtype) {
-  var parts = host.split(".").filter(Boolean);
+  var parts = _dnsQueryLabels(host, "dns");
   var nameLen = 1;
   for (var i = 0; i < parts.length; i++) nameLen += 1 + Buffer.byteLength(parts[i], "ascii");
   var buf = Buffer.alloc(12 + nameLen + 4);
@@ -676,29 +825,9 @@ async function resolveSecure(host, type) {
       "resolveSecure requires DoH transport (call useDnsOverHttps " +
       "or rely on the default-on DoH posture)");
   }
-  if (typeof host !== "string" || host.length === 0 ||
-      _hostLengthWithoutRoot(host) > 253) {                                    // RFC 1035 hostname octet ceiling
-    throw new DnsError("dns/bad-host",
-      "resolveSecure host is malformed");
-  }
-  // RFC 1035 §2.3.4 LDH validation — labels are letters / digits /
-  // hyphen, hyphens not at edges, label length 1..63, total length
-  // 253. Pre-v0.8.32 the framework only checked total length;
-  // operator-supplied hosts containing `_` / `:` / spaces flowed
-  // through to the DoH endpoint and surfaced as opaque server
-  // errors.
-  var labels = _labelsOf(host);
-  for (var li = 0; li < labels.length; li += 1) {
-    var label = labels[li];
-    if (label.length === 0 || label.length > 63) {                                            // RFC 1035 max label length
-      throw new DnsError("dns/bad-host",
-        "resolveSecure host has invalid label (length 1..63 required, got " + label.length + ")");
-    }
-    if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label)) {
-      throw new DnsError("dns/bad-host",
-        "resolveSecure host label '" + label + "' violates RFC 1035 LDH rule (letters/digits/hyphen, no leading/trailing hyphen)");
-    }
-  }
+  // An operator-supplied host containing `_` / `:` / a space would otherwise
+  // flow through to the DoH endpoint and surface as an opaque server error.
+  _validateLdh(host, "resolveSecure", false);
   var family;
   if (type === "A")    family = 4;
   else if (type === "AAAA") family = 6;
@@ -1316,14 +1445,27 @@ function _parseSvcbRdata(msg, rdataOff, rdlen) {
   return { priority: priority, target: target, params: params };
 }
 
-function _validateLdh(host, primitive) {
+// RFC 1035 §2.3.4 LDH validation — labels are letters / digits / hyphen, with
+// no hyphen at either edge. `allowUnderscore` additionally admits the leading
+// underscore that SVCB / HTTPS query targets carry ("_dns.resolver.arpa");
+// resolveSecure resolves ordinary hostnames and does not want it.
+//
+// This lives in one place because it did not: resolveSecure carried its own
+// copy of the loop, so the two drifted on which characters they accepted and a
+// rule added to either held for only half the primitives that need it.
+function _validateLdh(host, primitive, allowUnderscore) {
   if (typeof host !== "string" || host.length === 0 ||
       _hostLengthWithoutRoot(host) > 253) {                                    // RFC 1035 hostname octet ceiling
     throw new DnsError("dns/bad-host",
       primitive + ": host must be a non-empty RFC 1035 LDH name (length 1..253)");
   }
-  // Allow leading underscore on labels (SVCB / HTTPS query targets like
-  // "_dns.resolver.arpa" require it).
+  // The root zone has no labels at all — `_labelsOf(".")` yields one empty
+  // string, which the 1..63 rule below refuses. Without this, a name the shape
+  // check accepts is turned away here, so `. NS` works through the wire
+  // resolver and not through `querySvcb` / `queryHttps` / `resolveSecure`: the
+  // same name resolving through one entry point and not another, which is the
+  // defect this module already fixed once for internationalized names.
+  if (host === ".") return;
   var labels = _labelsOf(host);
   for (var li = 0; li < labels.length; li += 1) {
     var label = labels[li];
@@ -1331,9 +1473,13 @@ function _validateLdh(host, primitive) {
       throw new DnsError("dns/bad-host",
         primitive + ": host label length must be 1..63");
     }
-    if (!/^[A-Za-z0-9_](?:[A-Za-z0-9_-]*[A-Za-z0-9_])?$/.test(label)) {
+    var shaped = allowUnderscore
+      ? /^[A-Za-z0-9_](?:[A-Za-z0-9_-]*[A-Za-z0-9_])?$/.test(label)
+      : /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label);
+    if (!shaped) {
       throw new DnsError("dns/bad-host",
-        primitive + ": host label '" + label + "' violates LDH (allowed: letters/digits/underscore/hyphen, no leading/trailing hyphen)");
+        primitive + ": host label '" + label + "' violates LDH (allowed: letters/digits" +
+        (allowUnderscore ? "/underscore" : "") + "/hyphen, no leading/trailing hyphen)");
     }
   }
 }
@@ -1342,7 +1488,7 @@ async function _querySvcbLike(host, qtype, opts) {
   host = _validateHostShape(host, "dns.querySvcb");
   opts = opts || {};
   validateOpts(opts, ["transport"], "dns.querySvcb");
-  _validateLdh(host, "dns.querySvcb");
+  _validateLdh(host, "dns.querySvcb", true);                                   // SVCB targets carry a leading underscore
   if (opts.transport !== undefined && opts.transport !== "doh" &&
       opts.transport !== "dot" && opts.transport !== "system") {
     throw new DnsError("dns/bad-transport",
@@ -1488,7 +1634,16 @@ async function discoverEncrypted(opts) {
   }
   var insecureOnly = opts.insecureSystemResolverOnly !== false;
   var transport = insecureOnly ? "system" : undefined;
-  _validateLdh(name, "dns.discoverEncrypted");
+  // Canonicalize BEFORE the LDH pass. An LDH rule has no reading of a U-label,
+  // so running it on the raw name refuses an internationalized one here while
+  // the SVCB query underneath accepts it — the same name resolving through one
+  // entry point and not its own caller.
+  // Canonicalize BEFORE the LDH pass. An LDH rule has no reading of a U-label,
+  // so running it on the raw name refuses an internationalized one here while
+  // the SVCB query underneath accepts it — the same name resolving through one
+  // entry point and not its own caller.
+  name = _validateHostShape(name, "dns.discoverEncrypted");
+  _validateLdh(name, "dns.discoverEncrypted", true);                           // "_dns.resolver.arpa" per RFC 9462
   var startMs = _now();
   var records;
   try {
@@ -2107,6 +2262,13 @@ module.exports = {
   nodeLookup:                  nodeLookup,
   clearCache:                  _clearCache,
   DnsError:                    DnsError,
+  _encodeDnsQuery:             _encodeDnsQuery,
+  _validateHostShape:          _validateHostShape,
+  // Exported for the same reason as the shape check: it is the SECOND gate a
+  // public query passes, and a name that clears one and not the other resolves
+  // through some entry points and not others. Asserting it directly proves that
+  // without a test having to reach the network.
+  _validateLdh:                _validateLdh,
   _parseSvcbRdata:             _parseSvcbRdata,
   _decodeDnsAnswerRaw:         _decodeDnsAnswerRaw,
   _readDnsName:                _readDnsName,