Add a pepper to a hash: as a string or a buffer, and should I calculate a hash of a peppered plain text?
To calculate a pepperedPassword I can either just concatenate two values:
  


Bcrypt limits the password. This means that if the password is too long (longer than 56 bytes), it will simply be truncated. If you just attach the pepper to the password, there is a high risk that this will happen. Then the pepper's security gain could even be lost without being noticed. 

Use HMAC or even a hash function to combine a password and a pepper. 


  
  Should I represent a PEPPER as a string or as a buffer?
  


That's up to you, but if you use HMAC or a hash function, it's obvious not to use a string.