visaljs 0.0.10 → 0.0.11

package/node/prelude/internal/crypto_x509.js

@@ -0,0 +1,161 @@
+// crypto.X509Certificate (Node's lib/internal/crypto/x509.js): what it shows comes from our DER
+// reader (internal/tls/x509.js, OpenSSL's printing); the checks are BoringSSL's X509 functions.
+// A feature module (internal/features.js): linked into programs that name the class.
+// Ported from Node.js (Copyright Node.js contributors, MIT): node/third_party/nodejs/LICENSE.
+import { x509Check, x509CheckIssued, x509CheckKey } from "visaljs:host";
+import { X509Certificate as X509CertificateWrapper } from "../crypto.js";
+import { inspect } from "../util.js";
+import { codeError, invalidArgType, invalidArgValue, validateString } from "./errors.js";
+import { features, provideClass } from "./features.js";
+import { altNamesString, certificatesOf, fingerprint, legacyObject, nameString, opensslTime, parseCertificate, toPem } from "./tls/x509.js";
+import { createPublicKey, KeyObject } from "./crypto/keys.js";
+import { kHandle } from "./crypto/util.js";
+
+/* BoringSSL's X509_CHECK_FLAG_*: it has no multi-label wildcards or single-label subdomains, and
+ * always checks the subject when a certificate has no names of the kind */
+const NO_WILDCARDS = 0x2, NEVER_CHECK_SUBJECT = 0x20;
+
+/* OpenSSL's long names (OBJ_nid2ln) of the signature algorithms certificates use */
+const SIGNATURE_ALGORITHMS = {
+  "1.2.840.113549.1.1.4": "md5WithRSAEncryption", "1.2.840.113549.1.1.5": "sha1WithRSAEncryption",
+  "1.2.840.113549.1.1.10": "rsassaPss", "1.2.840.113549.1.1.11": "sha256WithRSAEncryption",
+  "1.2.840.113549.1.1.12": "sha384WithRSAEncryption", "1.2.840.113549.1.1.13": "sha512WithRSAEncryption",
+  "1.2.840.113549.1.1.14": "sha224WithRSAEncryption", "1.2.840.10045.4.1": "ecdsa-with-SHA1",
+  "1.2.840.10045.4.3.1": "ecdsa-with-SHA224", "1.2.840.10045.4.3.2": "ecdsa-with-SHA256",
+  "1.2.840.10045.4.3.3": "ecdsa-with-SHA384", "1.2.840.10045.4.3.4": "ecdsa-with-SHA512", "1.3.101.112": "ED25519",
+  "1.3.101.113": "ED448",
+};
+
+const kCert = Symbol("kCert");
+const kIssuer = Symbol("kIssuer");
+const kCache = Symbol("kCache");
+
+const noCertificate = () => codeError(Error, "ERR_OSSL_PEM_NO_START_LINE", "error:0480006C:PEM routines::no start line");
+
+function checkFlags(options = {}) {
+  if (typeof options !== "object" || options === null || Array.isArray(options)) throw invalidArgType("options", "of type object", options);
+  const { subject = "default", wildcards = true, partialWildcards = true, multiLabelWildcards = false, singleLabelSubdomains = false } = options;
+  validateString(subject, "options.subject");
+  for (const [name, value] of [["wildcards", wildcards], ["partialWildcards", partialWildcards], ["multiLabelWildcards", multiLabelWildcards],
+    ["singleLabelSubdomains", singleLabelSubdomains]]) {
+    if (typeof value !== "boolean") throw invalidArgType(`options.${name}`, "of type boolean", value);
+  }
+  let flags = 0;
+  switch (subject) {
+    case "default":
+    case "always":
+      break;
+    case "never":
+      flags |= NEVER_CHECK_SUBJECT;
+      break;
+    default:
+      throw invalidArgValue("options.subject", "is invalid", subject);
+  }
+  if (!wildcards) flags |= NO_WILDCARDS;
+  return flags;
+}
+
+export function isX509Certificate(value) {
+  return value?.[kCert] !== undefined;
+}
+
+class X509Certificate {
+  constructor(buffer) {
+    if (typeof buffer === "string") buffer = Buffer.from(buffer);
+    if (!ArrayBuffer.isView(buffer)) throw invalidArgType("buffer", "of type string or an instance of Buffer, TypedArray, or DataView", buffer);
+    const der = certificatesOf(buffer)[0];
+    if (der === undefined) throw noCertificate();
+    let cert;
+    try {
+      cert = parseCertificate(der);
+    } catch {
+      throw codeError(Error, "ERR_OSSL_ASN1_HEADER_TOO_LONG", "error:0680007B:asn1 encoding routines::header too long");
+    }
+    this[kCert] = cert;
+    this[kIssuer] = undefined;
+    this[kCache] = new Map();
+  }
+
+  #cached(name, compute) {
+    const cache = this[kCache];
+    if (!cache.has(name)) cache.set(name, compute(this[kCert]));
+    return cache.get(name);
+  }
+
+  [inspect.custom](depth, options) {
+    if (depth < 0) return this;
+    const opts = { ...options, depth: options.depth == null ? null : options.depth - 1 };
+    return `X509Certificate ${inspect({
+      subject: this.subject, subjectAltName: this.subjectAltName, issuer: this.issuer, infoAccess: this.infoAccess,
+      validFrom: this.validFrom, validTo: this.validTo, validFromDate: this.validFromDate, validToDate: this.validToDate,
+      fingerprint: this.fingerprint, fingerprint256: this.fingerprint256, fingerprint512: this.fingerprint512, keyUsage: this.keyUsage,
+      serialNumber: this.serialNumber, signatureAlgorithm: this.signatureAlgorithm, signatureAlgorithmOid: this.signatureAlgorithmOid,
+    }, opts)}`;
+  }
+
+  get subject() { return this.#cached("subject", (c) => nameString(c.subject)); }
+  get subjectAltName() { return this.#cached("subjectAltName", altNamesString); }
+  get issuer() { return this.#cached("issuer", (c) => nameString(c.issuer)); }
+  get issuerCertificate() { return this[kIssuer]; }
+  get infoAccess() { return this.#cached("infoAccess", (c) => c.infoAccess?.join("\n")); }
+  get validFrom() { return this.#cached("validFrom", (c) => opensslTime(c.validFrom)); }
+  get validTo() { return this.#cached("validTo", (c) => opensslTime(c.validTo)); }
+  get validFromDate() { return this.#cached("validFromDate", (c) => new Date(c.validFrom)); }
+  get validToDate() { return this.#cached("validToDate", (c) => new Date(c.validTo)); }
+  get fingerprint() { return this.#cached("fingerprint", (c) => fingerprint("sha1", c.der)); }
+  get fingerprint256() { return this.#cached("fingerprint256", (c) => fingerprint("sha256", c.der)); }
+  get fingerprint512() { return this.#cached("fingerprint512", (c) => fingerprint("sha512", c.der)); }
+  /* Node's keyUsage: the extended key usages' OIDs */
+  get keyUsage() { return this.#cached("keyUsage", (c) => c.extKeyUsage ?? undefined); }
+  get serialNumber() { return this.#cached("serialNumber", (c) => c.serialNumber); }
+  get signatureAlgorithm() { return this.#cached("signatureAlgorithm", (c) => SIGNATURE_ALGORITHMS[c.signatureAlgorithm]); }
+  get signatureAlgorithmOid() { return this.#cached("signatureAlgorithmOid", (c) => c.signatureAlgorithm); }
+  get raw() { return this.#cached("raw", (c) => Buffer.from(c.der)); }
+  get publicKey() { return this.#cached("publicKey", (c) => createPublicKey({ key: Buffer.from(c.spki), format: "der", type: "spki" })); }
+  get ca() { return this.#cached("ca", (c) => c.ca); }
+
+  toString() { return this.#cached("pem", (c) => toPem(c.der)); }
+  toJSON() { return this.toString(); }
+  toLegacyObject() { return legacyObject(this[kCert]); }
+
+  checkHost(name, options) {
+    validateString(name, "name");
+    return x509Check(this[kCert].der, 0, name, checkFlags(options));
+  }
+
+  checkEmail(email, options) {
+    validateString(email, "email");
+    return x509Check(this[kCert].der, 1, email, checkFlags(options));
+  }
+
+  checkIP(ip, options) {
+    validateString(ip, "ip");
+    return x509Check(this[kCert].der, 2, ip, checkFlags(options));
+  }
+
+  checkIssued(otherCert) {
+    if (!isX509Certificate(otherCert)) throw invalidArgType("otherCert", "an instance of X509Certificate", otherCert);
+    return x509CheckIssued(this[kCert].der, otherCert[kCert].der);
+  }
+
+  checkPrivateKey(pkey) {
+    if (!(pkey instanceof KeyObject)) throw invalidArgType("pkey", "an instance of KeyObject", pkey);
+    if (pkey.type !== "private") throw invalidArgValue("pkey", "is invalid", pkey);
+    return x509CheckKey(this[kCert].der, pkey[kHandle]);
+  }
+
+  verify(pkey) {
+    if (!(pkey instanceof KeyObject)) throw invalidArgType("pkey", "an instance of KeyObject", pkey);
+    if (pkey.type !== "public") throw invalidArgValue("pkey", "is invalid", pkey);
+    return x509CheckKey(this[kCert].der, pkey[kHandle]);
+  }
+}
+
+provideClass(X509CertificateWrapper, X509Certificate);
+
+/* a chain's first certificate, each one's issuerCertificate the next (getPeerX509Certificate) */
+features.x509CertificateChain = (ders) => {
+  const certs = ders.map((der) => new X509Certificate(der));
+  for (let i = 0; i + 1 < certs.length; i++) certs[i][kIssuer] = certs[i + 1];
+  return certs[0];
+};

package/node/prelude/internal/dns_classes.js

@@ -0,0 +1,6 @@
+// dns.Resolver and dns.promises.Resolver as node:dns exports them: wrappers internal/dns_resolver.js
+// gives its classes (internal/features.js), so programs that don't name them don't link c-ares.
+import { lazyClass } from "./features.js";
+
+export const Resolver = /* @__PURE__ */ lazyClass("Resolver", "dnsResolver");
+export const PromisesResolver = /* @__PURE__ */ lazyClass("Resolver", "dnsPromisesResolver");

package/node/prelude/internal/dns_resolver.js

@@ -0,0 +1,371 @@
+// dns.Resolver, dns.promises.Resolver, and the resolve* functions of node:dns and dns/promises
+// (Node's lib/internal/dns/utils.js, callback_resolver.js and promises.js) over c-ares
+// (src/host_dns.c). A feature module (internal/features.js): linked into programs that name them.
+// The queries' answers are read by c-ares's parsers, and shaped here as Node's cares_wrap shapes them.
+// Ported from Node.js (Copyright Node.js contributors, MIT): node/third_party/nodejs/LICENSE.
+import {
+  dnsCancel, dnsChannel, dnsGetServers, dnsParse, dnsQuery, dnsReverse, dnsSetLocalAddress, dnsSetServers, dnsStrerror, errnoName,
+} from "visaljs:host";
+import { PromisesResolver as PromisesResolverWrapper, Resolver as ResolverWrapper } from "./dns_classes.js";
+import { domainToASCII } from "../url.js";
+import { bindContext } from "./async_context.js";
+import { codeError, invalidArgType, invalidArgValue, outOfRange, validateFunction, validatePort, validateString } from "./errors.js";
+import { features, provideClass } from "./features.js";
+import { isIP } from "./net.js";
+
+const IANA_DNS_PORT = 53;
+const IPv6RE = /^\[([^[\]]*)\]/;
+const addrSplitRE = /(^.+?)(?::(\d+))?$/;
+
+/* ARES_* statuses, by number (ares.h), as Node's ToErrorCodeString names them */
+const ARES_CODES = [undefined, "ENODATA", "EFORMERR", "ESERVFAIL", "ENOTFOUND", "ENOTIMP", "EREFUSED", "EBADQUERY", "EBADNAME", "EBADFAMILY",
+  "EBADRESP", "ECONNREFUSED", "ETIMEOUT", "EOF", "EFILE", "ENOMEM", "EDESTRUCTION", "EBADSTR", "EBADFLAGS", "ENONAME", "EBADHINTS",
+  "ENOTINITIALIZED", "ELOADIPHLPAPI", "EADDRGETNETWORKPARAMS", "ECANCELLED"];
+const ARES_SUCCESS = 0, ARES_ENODATA = 1;
+const aresCode = (status) => ARES_CODES[status] ?? "UNKNOWN_ARES_ERROR";
+
+/** Node's DNSException: a libuv errno, or a c-ares code */
+function dnsException(code, syscall, hostname) {
+  let errno;
+  if (typeof code === "number") {
+    errno = code;
+    code = errnoName(code);
+    if (code === "EAI_NODATA" || code === "EAI_NONAME") code = "ENOTFOUND";
+  }
+  const error = new Error(`${syscall} ${code}${hostname ? ` ${hostname}` : ""}`);
+  error.errno = errno;
+  error.code = code;
+  error.syscall = syscall;
+  if (hostname) error.hostname = hostname;
+  return error;
+}
+
+/* ---- the binding: Node's ChannelWrap queries, as cares_wrap shapes their answers ------------- */
+
+/* the DNS types (ares_dns_rec_type_t) */
+const T = { A: 1, NS: 2, CNAME: 5, SOA: 6, PTR: 12, MX: 15, TXT: 16, AAAA: 28, SRV: 33, NAPTR: 35, TLSA: 52, ANY: 255, CAA: 257 };
+/* dnsParse's kinds for a CNAME or A records (Node's ns_t_cname_or_a), and for ANY's SOA */
+const CNAME_OR_A = 0x10000;
+const SOA_IN_ANY = 0x10006;
+
+const TYPES = {
+  queryA: T.A, queryAaaa: T.AAAA, queryCname: T.CNAME, queryMx: T.MX, queryNs: T.NS, queryTxt: T.TXT, querySrv: T.SRV, queryPtr: T.PTR,
+  queryNaptr: T.NAPTR, querySoa: T.SOA, queryCaa: T.CAA, queryTlsa: T.TLSA, queryAny: T.ANY,
+};
+
+const mxRecord = ([priority, exchange]) => ({ exchange, priority, type: "MX" });
+const srvRecord = ([name, port, priority, weight]) => ({ name, port, priority, weight, type: "SRV" });
+const naptrRecord = ([flags, service, regexp, replacement, order, preference]) => ({ flags, service, regexp, replacement, order, preference, type: "NAPTR" });
+const soaRecord = ([nsname, hostmaster, serial, refresh, retry, expire, minttl]) => ({ nsname, hostmaster, serial, refresh, retry, expire, minttl });
+function caaRecord([critical, property, value]) {
+  const record = { critical, type: "CAA" };
+  record[property] = value;
+  return record;
+}
+const tlsaRecord = ([certUsage, selector, match, data]) =>
+  ({ certUsage, selector, match, data: data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength) });
+
+/* a query's answer → [status, result, ttls] (Node's Traits::Parse) */
+function shape(bindingName, answer) {
+  const kind = TYPES[bindingName];
+  if (kind === T.ANY) return parseAny(answer);
+  const [status, records, ttls] = dnsParse(answer, kind);
+  if (status !== ARES_SUCCESS) return [status];
+  switch (kind) {
+    case T.A:
+    case T.AAAA: return [status, records, ttls];
+    case T.MX: return [status, records.map(mxRecord)];
+    case T.SRV: return [status, records.map(srvRecord)];
+    case T.NAPTR: return [status, records.map(naptrRecord)];
+    case T.SOA: return records.length ? [status, soaRecord(records[0])] : [ARES_ENODATA];
+    case T.CAA: return [status, records.map(caaRecord)];
+    case T.TLSA: return [status, records.map(tlsaRecord)];
+    default: return [status, records];
+  }
+}
+
+/* ANY: every kind's records, each with its type, in Node's order; a kind without any is skipped */
+function parseAny(answer) {
+  const out = [];
+  const parse = (kind, add) => {
+    const [status, records, ttls, cname] = dnsParse(answer, kind);
+    if (status === ARES_SUCCESS) add(records, ttls, cname);
+    return status === ARES_SUCCESS || status === ARES_ENODATA ? 0 : status;
+  };
+  const steps = [
+    [CNAME_OR_A, (records, ttls, cname) => {
+      for (const [i, value] of records.entries()) out.push(cname ? { value, type: "CNAME" } : { address: value, ttl: ttls[i], type: "A" });
+    }],
+    [T.AAAA, (records, ttls) => records.forEach((address, i) => out.push({ address, ttl: ttls[i], type: "AAAA" }))],
+    [T.MX, (records) => records.forEach((r) => out.push(mxRecord(r)))],
+    [T.NS, (records) => records.forEach((value) => out.push({ value, type: "NS" }))],
+    [T.TXT, (records) => records.forEach((entries) => out.push({ entries, type: "TXT" }))],
+    [T.SRV, (records) => records.forEach((r) => out.push(srvRecord(r)))],
+    [T.PTR, (records) => records.forEach((value) => out.push({ value, type: "PTR" }))],
+    [T.NAPTR, (records) => records.forEach((r) => out.push(naptrRecord(r)))],
+    [SOA_IN_ANY, (records) => records.forEach((r) => out.push({ ...soaRecord(r), type: "SOA" }))],
+    [T.TLSA, (records) => records.forEach((r) => out.push({ ...tlsaRecord(r), type: "TLSA" }))],
+    [T.CAA, (records) => records.forEach((r) => out.push(caaRecord(r)))],
+  ];
+  for (const [kind, add] of steps) {
+    const status = parse(kind, add);
+    if (status !== 0) return [status];
+  }
+  return [ARES_SUCCESS, out];
+}
+
+/* Node's QueryWrap::Send: 0, or what went wrong at once; req.oncomplete(code | null, result, ttls) later */
+function send(channel, bindingName, req, name) {
+  const done = bindContext((status, answer) => {
+    let result, ttls;
+    if (status === ARES_SUCCESS) {
+      if (bindingName === "getHostByAddr") result = answer;
+      else [status, result, ttls] = shape(bindingName, answer);
+    }
+    if (status !== ARES_SUCCESS) req.oncomplete(aresCode(status));
+    else req.oncomplete(null, result, ttls);
+  });
+  if (bindingName === "getHostByAddr") return dnsReverse(channel, name, done);
+  return dnsQuery(channel, domainToASCII(name) || name, TYPES[bindingName], done);
+}
+
+/* ---- ResolverBase (Node's internal/dns/utils.js) -------------------------------------------- */
+
+function validateInt32(value, name, min) {
+  if (typeof value !== "number") throw invalidArgType(name, "of type number", value);
+  if (!Number.isInteger(value)) throw outOfRange(name, "an integer", value);
+  if (value < min || value > 2 ** 31 - 1) throw outOfRange(name, `>= ${min} && <= ${2 ** 31 - 1}`, value);
+}
+
+function validateOptions(options) {
+  let { timeout = -1, tries = 4, maxTimeout = 0 } = { ...options };
+  validateInt32(timeout, "options.timeout", -1);
+  validateInt32(tries, "options.tries", 1);
+  if (typeof maxTimeout !== "number") throw invalidArgType("options.maxTimeout", "of type number", maxTimeout);
+  if (!Number.isInteger(maxTimeout)) throw outOfRange("options.maxTimeout", "an integer", maxTimeout);
+  if (maxTimeout < 0 || maxTimeout > 2 ** 32 - 1) throw outOfRange("options.maxTimeout", `>= 0 && <= ${2 ** 32 - 1}`, maxTimeout);
+  /* -0 as +0 */
+  timeout += 0;
+  maxTimeout += 0;
+  return [timeout, tries, maxTimeout];
+}
+
+
+const invalidIP = (ip) => codeError(TypeError, "ERR_INVALID_IP_ADDRESS", `Invalid IP address: ${ip}`);
+
+/* The channel's handle, as Node's ChannelWrap: queries by binding name */
+class ChannelWrap {
+  constructor(timeout, tries, maxTimeout) {
+    this.channel = dnsChannel(timeout, tries, maxTimeout);
+  }
+  getServers() { return dnsGetServers(this.channel); }
+  setServers(servers) { return dnsSetServers(this.channel, servers); }
+  setLocalAddress(ipv4, ipv6) {
+    const ips = [ipv4, ipv6];
+    if (isIP(ipv4) === 0 || (ipv6 !== undefined && isIP(ipv6) === 0)) {
+      throw codeError(TypeError, "ERR_INVALID_ARG_VALUE", "Invalid IP address.");
+    }
+    if (ipv6 !== undefined && isIP(ipv4) === isIP(ipv6)) {
+      throw codeError(TypeError, "ERR_INVALID_ARG_VALUE", `Cannot specify two IPv${isIP(ipv4)} addresses.`);
+    }
+    dnsSetLocalAddress(this.channel, ips.find((ip) => isIP(ip) === 4) ?? null, ips.find((ip) => ip !== undefined && isIP(ip) === 6) ?? null);
+  }
+  cancel() { dnsCancel(this.channel); }
+}
+for (const bindingName of [...Object.keys(TYPES), "getHostByAddr"]) {
+  ChannelWrap.prototype[bindingName] = function (req, name) {
+    return send(this.channel, bindingName, req, name);
+  };
+}
+
+class ResolverBase {
+  constructor(options = undefined) {
+    const [timeout, tries, maxTimeout] = validateOptions(options);
+    this._handle = new ChannelWrap(timeout, tries, maxTimeout);
+  }
+
+  cancel() {
+    this._handle.cancel();
+  }
+
+  getServers() {
+    return (this._handle.getServers() || []).map((val) => {
+      if (!val[1] || val[1] === IANA_DNS_PORT) return val[0];
+      const host = isIP(val[0]) === 6 ? `[${val[0]}]` : val[0];
+      return `${host}:${val[1]}`;
+    });
+  }
+
+  setServers(servers) {
+    if (!Array.isArray(servers)) throw invalidArgType("servers", "an instance of Array", servers);
+    const newSet = [];
+    servers.forEach((serv, index) => {
+      validateString(serv, `servers[${index}]`);
+      let ipVersion = isIP(serv);
+      if (ipVersion !== 0) return newSet.push([ipVersion, serv, IANA_DNS_PORT]);
+      const match = IPv6RE.exec(serv);
+      if (match) {
+        ipVersion = isIP(match[1]);
+        if (ipVersion !== 0) {
+          const port = Number.parseInt(serv.replace(addrSplitRE, "$2")) || IANA_DNS_PORT;
+          validatePort(port);
+          return newSet.push([ipVersion, match[1], port]);
+        }
+      }
+      const addrSplitMatch = addrSplitRE.exec(serv);
+      if (addrSplitMatch) {
+        const hostIP = addrSplitMatch[1];
+        const port = Number.parseInt(addrSplitMatch[2]) || IANA_DNS_PORT;
+        ipVersion = isIP(hostIP);
+        if (ipVersion !== 0) {
+          validatePort(port);
+          return newSet.push([ipVersion, hostIP, port]);
+        }
+      }
+      throw invalidIP(serv);
+    });
+    const orig = (this._handle.getServers() || []).map((val) => [isIP(val[0]), ...val]);
+    const errorNumber = this._handle.setServers(newSet);
+    if (errorNumber !== 0) {
+      this._handle.setServers(orig);
+      throw codeError(Error, "ERR_DNS_SET_SERVERS_FAILED", `c-ares failed to set servers: "${dnsStrerror(errorNumber)}" [${servers}]`);
+    }
+  }
+
+  setLocalAddress(ipv4, ipv6) {
+    validateString(ipv4, "ipv4");
+    if (ipv6 !== undefined) validateString(ipv6, "ipv6");
+    this._handle.setLocalAddress(ipv4, ipv6);
+  }
+}
+
+function createResolverClass(resolver) {
+  const resolveMap = { __proto__: null };
+  class Resolver extends ResolverBase {}
+  Resolver.prototype.resolveAny = resolveMap.ANY = resolver("queryAny");
+  Resolver.prototype.resolve4 = resolveMap.A = resolver("queryA");
+  Resolver.prototype.resolve6 = resolveMap.AAAA = resolver("queryAaaa");
+  Resolver.prototype.resolveCaa = resolveMap.CAA = resolver("queryCaa");
+  Resolver.prototype.resolveCname = resolveMap.CNAME = resolver("queryCname");
+  Resolver.prototype.resolveMx = resolveMap.MX = resolver("queryMx");
+  Resolver.prototype.resolveNs = resolveMap.NS = resolver("queryNs");
+  Resolver.prototype.resolveTlsa = resolveMap.TLSA = resolver("queryTlsa");
+  Resolver.prototype.resolveTxt = resolveMap.TXT = resolver("queryTxt");
+  Resolver.prototype.resolveSrv = resolveMap.SRV = resolver("querySrv");
+  Resolver.prototype.resolvePtr = resolveMap.PTR = resolver("queryPtr");
+  Resolver.prototype.resolveNaptr = resolveMap.NAPTR = resolver("queryNaptr");
+  Resolver.prototype.resolveSoa = resolveMap.SOA = resolver("querySoa");
+  Resolver.prototype.reverse = resolver("getHostByAddr");
+  return { resolveMap, Resolver };
+}
+
+/* ---- the callback Resolver (Node's callback_resolver.js) ------------------------------------- */
+
+function onresolve(err, result, ttls) {
+  if (ttls && this.ttl) result = result.map((address, index) => ({ address, ttl: ttls[index] }));
+  if (err) this.callback(dnsException(err, this.bindingName, this.hostname));
+  else this.callback(null, result);
+}
+
+function callbackResolver(bindingName) {
+  function query(name, /* options, */ callback) {
+    let options;
+    if (arguments.length > 2) {
+      options = callback;
+      callback = arguments[2];
+    }
+    validateString(name, "name");
+    validateFunction(callback, "callback");
+    const req = { bindingName, callback, hostname: name, oncomplete: onresolve, ttl: !!options?.ttl };
+    const err = this._handle[bindingName](req, name);
+    if (err) throw dnsException(err, bindingName, name);
+    return req;
+  }
+  Object.defineProperty(query, "name", { value: bindingName });
+  return query;
+}
+
+const callbacks = createResolverClass(callbackResolver);
+const Resolver = callbacks.Resolver;
+Resolver.prototype.resolve = function resolve(hostname, rrtype, callback) {
+  let resolver;
+  if (typeof rrtype === "string") {
+    resolver = callbacks.resolveMap[rrtype];
+  } else if (typeof rrtype === "function") {
+    resolver = callbacks.resolveMap.A;
+    callback = rrtype;
+  } else {
+    throw invalidArgType("rrtype", "of type string", rrtype);
+  }
+  if (typeof resolver === "function") return resolver.call(this, hostname, callback);
+  throw invalidArgValue("rrtype", "is invalid", rrtype);
+};
+
+/* ---- the promises Resolver (Node's promises.js) -------------------------------------------- */
+
+function onresolvePromise(err, result, ttls) {
+  if (err) {
+    this.reject(dnsException(err, this.bindingName, this.hostname));
+    return;
+  }
+  if (ttls && this.ttl) result = result.map((address, index) => ({ address, ttl: ttls[index] }));
+  this.resolve(result);
+}
+
+function promiseResolver(bindingName) {
+  function query(name, options) {
+    validateString(name, "name");
+    const ttl = !!options?.ttl;
+    return new Promise((resolve, reject) => {
+      const req = { bindingName, hostname: name, oncomplete: onresolvePromise, resolve, reject, ttl };
+      const err = this._handle[bindingName](req, name);
+      if (err) reject(dnsException(err, bindingName, name));
+    });
+  }
+  Object.defineProperty(query, "name", { value: bindingName });
+  return query;
+}
+
+const promises = createResolverClass(promiseResolver);
+const PromisesResolver = promises.Resolver;
+PromisesResolver.prototype.resolve = function resolve(hostname, rrtype) {
+  let resolver;
+  if (rrtype !== undefined) {
+    validateString(rrtype, "rrtype");
+    resolver = promises.resolveMap[rrtype];
+    if (typeof resolver !== "function") throw invalidArgValue("rrtype", "is invalid", rrtype);
+  } else {
+    resolver = promises.resolveMap.A;
+  }
+  return resolver.call(this, hostname);
+};
+
+/* ---- the default resolver, whose methods node:dns and dns/promises export ------------------- */
+
+const resolverKeys = ["getServers", "resolve", "resolve4", "resolve6", "resolveAny", "resolveCaa", "resolveCname", "resolveMx", "resolveNaptr",
+  "resolveNs", "resolvePtr", "resolveSoa", "resolveSrv", "resolveTlsa", "resolveTxt", "reverse"];
+
+let defaultResolver;
+const getDefaultResolver = () => (defaultResolver ??= new ResolverBase());
+
+/* each module's exported functions, bound to the default resolver (features["dns.resolve4"], …) */
+function bindDefaultResolver() {
+  const resolver = getDefaultResolver();
+  for (const key of resolverKeys) {
+    features[`dns.${key}`] = Resolver.prototype[key].bind(resolver);
+    features[`dns.promises.${key}`] = PromisesResolver.prototype[key].bind(resolver);
+  }
+}
+bindDefaultResolver();
+
+/* dns.setServers and dns.promises.setServers: a new default resolver */
+function defaultResolverSetServers(servers) {
+  const resolver = new Resolver();
+  resolver.setServers(servers);
+  defaultResolver = resolver;
+  bindDefaultResolver();
+}
+features["dns.setServers"] = defaultResolverSetServers;
+features["dns.promises.setServers"] = defaultResolverSetServers;
+provideClass(ResolverWrapper, Resolver);
+provideClass(PromisesResolverWrapper, PromisesResolver);

package/node/prelude/internal/errors.js

@@ -83,6 +83,15 @@ export function errnoException(errno, syscall) {
   return error;
 }
 
+/** Node's validatePort: a port as a number or numeric string, 0 to 65535 (1 to 65535 without allowZero) */
+export function validatePort(port, name = "Port", allowZero = true) {
+  if ((typeof port !== "number" && typeof port !== "string") || (typeof port === "string" && port.trim().length === 0) ||
+      +port !== (+port >>> 0) || port > 0xFFFF || (port === 0 && !allowZero)) {
+    throw withCode(new RangeError(`${name} should be ${allowZero ? ">=" : ">"} 0 and < 65536.${received(port)}.`), "ERR_SOCKET_BAD_PORT");
+  }
+  return +port;
+}
+
 export function validateString(value, name) {
   if (typeof value !== "string") throw invalidArgType(name, "of type string", value);
 }