diff --git a/package.json b/package.json
index d064f938..7e16ae22 100644
--- a/package.json
+++ b/package.json
@@ -15,16 +15,16 @@
   },
   "packageManager": "pnpm@8.14.1",
   "devDependencies": {
-    "@types/node": "^20.11.4",
+    "@types/node": "^20.11.5",
     "@types/wtfnode": "^0.7.3",
     "@typescript/lib-dom": "npm:@types/web@0.0.135",
-    "@vitest/coverage-v8": "^1.2.0",
-    "@yoursunny/xo-config": "0.56.1",
+    "@vitest/coverage-v8": "^1.2.1",
+    "@yoursunny/xo-config": "0.56.2",
     "codedown": "^3.1.0",
     "tslib": "^2.6.2",
     "typedoc": "^0.25.7",
     "typescript": "~5.3.3",
-    "vitest": "^1.2.0"
+    "vitest": "^1.2.1"
   },
   "engines": {
     "node": "^18.18.0 || ^20.0.0 || ^21.0.0"
diff --git a/packages/keychain/test-fixture/key-store.ts b/packages/keychain/test-fixture/key-store.ts
index 4bc9c706..7f3b58b5 100644
--- a/packages/keychain/test-fixture/key-store.ts
+++ b/packages/keychain/test-fixture/key-store.ts
@@ -42,7 +42,8 @@ export async function execute(keyChain: KeyChain, enabled: Enable = {}): Promise
   })()));
   const keys1 = gen.map(([pvt]) => pvt.name).map(String);
 
-  const keyNames2 = (await keyChain.listKeys()).sort((a, b) => a.compare(b));
+  const keyNames2 = await keyChain.listKeys();
+  keyNames2.sort((a, b) => a.compare(b));
   const keys2 = (await Promise.all(keyNames2.map((n) => keyChain.getKey(n, "signer"))))
     .map((pvt) => pvt.name.toString());
 
@@ -50,7 +51,8 @@ export async function execute(keyChain: KeyChain, enabled: Enable = {}): Promise
     keys2.filter((u, i) => i % 4 === 0)
       .map((u) => keyChain.deleteKey(new Name(u))),
   );
-  const keyNames3 = (await keyChain.listKeys()).sort((a, b) => a.compare(b));
+  const keyNames3 = await keyChain.listKeys();
+  keyNames3.sort((a, b) => a.compare(b));
   const keys3 = (await Promise.all(keyNames3.map((n) => keyChain.getKey(n, "verifier"))))
     .map((pub) => pub.name.toString());
 
diff --git a/packages/nfdmgmt/src/an-nfd-prefixreg.ts b/packages/nfdmgmt/src/an-nfd-prefixreg.ts
new file mode 100644
index 00000000..8c4e2f9f
--- /dev/null
+++ b/packages/nfdmgmt/src/an-nfd-prefixreg.ts
@@ -0,0 +1,4 @@
+export const RouteFlags = {
+  ChildInherit: 1 << 0,
+  Capture: 1 << 1,
+} as const;
diff --git a/packages/nfdmgmt/src/an-nfd.ts b/packages/nfdmgmt/src/an-nfd.ts
index 3880e27b..fc301106 100644
--- a/packages/nfdmgmt/src/an-nfd.ts
+++ b/packages/nfdmgmt/src/an-nfd.ts
@@ -1,57 +1,55 @@
-/* eslint-disable @typescript-eslint/no-duplicate-enum-values --
- * TLV-TYPE numbers can have duplicates
-**/
-export const enum TT {
-  BaseCongestionMarkingInterval = 0x87,
-  Capacity = 0x83,
-  ChannelStatus = 0x82,
-  ControlParameters = 0x68,
-  Cost = 0x6A,
-  Count = 0x84,
-  CsInfo = 0x80,
-  CurrentTimestamp = 0x82,
-  DefaultCongestionThreshold = 0x88,
-  ExpirationPeriod = 0x6D,
-  FaceEventKind = 0xC1,
-  FaceEventNotification = 0xC0,
-  FaceId = 0x69,
-  FacePersistency = 0x85,
-  FaceQueryFilter = 0x96,
-  FaceScope = 0x84,
-  FaceStatus = 0x80,
-  Flags = 0x6C,
-  LinkType = 0x86,
-  LocalUri = 0x81,
-  Mask = 0x70,
-  Mtu = 0x89,
-  NCsEntries = 0x87,
-  NfdVersion = 0x80,
-  NFibEntries = 0x84,
-  NHits = 0x81,
-  NInBytes = 0x94,
-  NInData = 0x91,
-  NInInterests = 0x90,
-  NInNacks = 0x97,
-  NMeasurementsEntries = 0x86,
-  NMisses = 0x82,
-  NNameTreeEntries = 0x83,
-  NOutBytes = 0x95,
-  NOutData = 0x93,
-  NOutInterests = 0x92,
-  NOutNacks = 0x98,
-  NPitEntries = 0x85,
-  NSatisfiedInterests = 0x99,
-  NUnsatisfiedInterests = 0x9A,
-  Origin = 0x6F,
-  RibEntry = 0x80,
-  Route = 0x81,
-  StartTimestamp = 0x81,
-  Strategy = 0x6B,
-  StrategyChoice = 0x80,
-  Uri = 0x72,
-  UriScheme = 0x83,
-}
-/* eslint-enable @typescript-eslint/no-duplicate-enum-values */
+export * from "./an-nfd-prefixreg";
+
+export const TT = {
+  BaseCongestionMarkingInterval: 0x87,
+  Capacity: 0x83,
+  ChannelStatus: 0x82,
+  ControlParameters: 0x68,
+  Cost: 0x6A,
+  Count: 0x84,
+  CsInfo: 0x80,
+  CurrentTimestamp: 0x82,
+  DefaultCongestionThreshold: 0x88,
+  ExpirationPeriod: 0x6D,
+  FaceEventKind: 0xC1,
+  FaceEventNotification: 0xC0,
+  FaceId: 0x69,
+  FacePersistency: 0x85,
+  FaceQueryFilter: 0x96,
+  FaceScope: 0x84,
+  FaceStatus: 0x80,
+  Flags: 0x6C,
+  LinkType: 0x86,
+  LocalUri: 0x81,
+  Mask: 0x70,
+  Mtu: 0x89,
+  NCsEntries: 0x87,
+  NfdVersion: 0x80,
+  NFibEntries: 0x84,
+  NHits: 0x81,
+  NInBytes: 0x94,
+  NInData: 0x91,
+  NInInterests: 0x90,
+  NInNacks: 0x97,
+  NMeasurementsEntries: 0x86,
+  NMisses: 0x82,
+  NNameTreeEntries: 0x83,
+  NOutBytes: 0x95,
+  NOutData: 0x93,
+  NOutInterests: 0x92,
+  NOutNacks: 0x98,
+  NPitEntries: 0x85,
+  NSatisfiedInterests: 0x99,
+  NUnsatisfiedInterests: 0x9A,
+  Origin: 0x6F,
+  RibEntry: 0x80,
+  Route: 0x81,
+  StartTimestamp: 0x81,
+  Strategy: 0x6B,
+  StrategyChoice: 0x80,
+  Uri: 0x72,
+  UriScheme: 0x83,
+} as const;
 
 export enum FaceScope {
   NonLocal = 0,
@@ -80,8 +78,3 @@ export const CsFlags = {
   EnableAdmit: 1 << 0,
   EnableServe: 1 << 1,
 } as const;
-
-export const RouteFlags = {
-  ChildInherit: 1 << 0,
-  Capture: 1 << 1,
-} as const;
diff --git a/packages/nfdmgmt/src/prefix-reg.ts b/packages/nfdmgmt/src/prefix-reg.ts
index c49d90f7..4b3a9618 100644
--- a/packages/nfdmgmt/src/prefix-reg.ts
+++ b/packages/nfdmgmt/src/prefix-reg.ts
@@ -7,12 +7,22 @@ import { Closers, randomJitter } from "@ndn/util";
 import map from "obliterator/map.js";
 import type { Except, Promisable } from "type-fest";
 
-import { RouteFlags, TT } from "./an-nfd";
+import { RouteFlags } from "./an-nfd-prefixreg";
 import { getPrefix } from "./common";
 import { type ControlCommandOptions, invokeGeneric } from "./control-command-generic";
 import type { ControlParameters } from "./control-command-nfd";
 import type { ControlResponse } from "./control-response";
 
+const enum TT {
+  ControlParameters = 0x68,
+  Cost = 0x6A,
+  ExpirationPeriod = 0x6D,
+  Flags = 0x6C,
+  Origin = 0x6F,
+  // don't import an-nfd.ts to reduce browser bundle size
+  // unit tests verify consistency of those TLV-TYPE numbers
+}
+
 type CommandOptions = Except<ControlCommandOptions, "endpoint" | "prefix">;
 type RouteOptions = Pick<ControlParameters.Fields, "origin" | "cost" | `flag${keyof typeof RouteFlags}`>;
 type Options = CommandOptions & RouteOptions & {
diff --git a/packages/repo-api/src/bulk-insert-initiator.ts b/packages/repo-api/src/bulk-insert-initiator.ts
index 8c3bb2f3..4f18dfd1 100644
--- a/packages/repo-api/src/bulk-insert-initiator.ts
+++ b/packages/repo-api/src/bulk-insert-initiator.ts
@@ -31,8 +31,10 @@ export class BulkInsertInitiator extends TypedEventTarget<EventMap> implements S
   constructor(face: L3Face) {
     super();
     consume(face.rx).catch(() => undefined);
-    this.faceTx = face.tx(this.tx()).catch((err) => {
-      this.dispatchTypedEvent("error", new CustomEvent("error", { detail: err }));
+    this.faceTx = face.tx(this.tx()).catch((err: unknown) => {
+      this.dispatchTypedEvent("error", new CustomEvent("error", {
+        detail: err instanceof Error ? err : new Error(`${err}`),
+      }));
     });
   }
 
diff --git a/packages/sync/src/syncps/pubsub.ts b/packages/sync/src/syncps/pubsub.ts
index ae027a34..43009fda 100644
--- a/packages/sync/src/syncps/pubsub.ts
+++ b/packages/sync/src/syncps/pubsub.ts
@@ -69,12 +69,13 @@ function defaultFilterPubs(items: SyncpsPubsub.FilterPubItem[]) {
   }
 
   const timestampMap = new DefaultWeakMap<Data, number>((pub) => safeExtractTimestamp(pub));
-  return items.sort((a, b) => {
+  items.sort((a, b) => {
     if (a.own !== b.own) {
       return a.own ? -1 : 1;
     }
     return timestampMap.get(b.pub) - timestampMap.get(a.pub);
   });
+  return items;
 }
 
 /** syncps - pubsub service. */
diff --git a/packages/trust-schema/tests/cert-source.t.ts b/packages/trust-schema/tests/cert-source.t.ts
index e4258a6e..fa32beae 100644
--- a/packages/trust-schema/tests/cert-source.t.ts
+++ b/packages/trust-schema/tests/cert-source.t.ts
@@ -6,7 +6,7 @@ import { Name, type NameLike } from "@ndn/packet";
 import { makeRepoProducer } from "@ndn/repo/test-fixture/data-store";
 import { delay } from "@ndn/util";
 import { collect } from "streaming-iterables";
-import { beforeAll, beforeEach, describe, expect, type SpyInstance, test, vi } from "vitest";
+import { beforeAll, beforeEach, describe, expect, type MockInstance, test, vi } from "vitest";
 
 import { CertFetcher, type CertSource, CertSources, KeyChainCertSource, TrustAnchorContainer } from "..";
 
@@ -83,7 +83,7 @@ test("KeyChainCertSource", async () => {
 
 describe("CertFetcher", () => {
   let endpoint: Endpoint;
-  let consumeFn: SpyInstance<Parameters<Endpoint["consume"]>, ReturnType<Endpoint["consume"]>>;
+  let consumeFn: MockInstance<Parameters<Endpoint["consume"]>, ReturnType<Endpoint["consume"]>>;
   let fetcher0: CertFetcher;
   let fetcher1: CertFetcher;
   beforeEach(async () => {
@@ -148,7 +148,7 @@ describe("CertFetcher", () => {
 });
 
 describe("CertSources", () => {
-  let keyChainGetCertFn: SpyInstance<Parameters<KeyChain["getCert"]>, ReturnType<KeyChain["getCert"]>>;
+  let keyChainGetCertFn: MockInstance<Parameters<KeyChain["getCert"]>, ReturnType<KeyChain["getCert"]>>;
   beforeEach(() => {
     keyChainGetCertFn = vi.spyOn(keyChain, "getCert");
     return () => {