@amritk/nish-x86_64-linux 0.17.0 → 0.18.0

package/std/json.ts

@@ -1,5 +1,5 @@
 /**
- * `std/json` — the value of one field of one flat JSON object.
+ * `std/json` — the value of a field, or of several, of one flat JSON object.
  *
  * It exists because the compiler's own machine-readable surface is JSON: under
  * `--json` every diagnostic is one flat object on a line of stdout, whose `code`
@@ -26,10 +26,10 @@
  *     whether the whole line was well-formed is asking a question this does not
  *     answer.
  *
- * There is one exported function on purpose. A `std/` module is compiled into
- * the program that imports it and the symbol namespace is flat
+ * There are two exported functions, and few on purpose. A `std/` module is
+ * compiled into the program that imports it and the symbol namespace is flat
  * (`std/README.md`), so every name here is a name its importer cannot use: the
- * helpers are `json`-prefixed and the reader is the only export. Splitting a
+ * helpers are `json`-prefixed and the readers are the only exports. Splitting a
  * stream into lines and picking the ones that start with `{` is two calls the
  * caller already has — `splitLines` from `std/text` and `startsWith` — and
  * duplicating them here would cost more names than it saves.
@@ -46,6 +46,16 @@
  *       }
  *     }
  *
+ * `jsonField` scans from the start of the line on every call, so a caller that
+ * wants three fields of each line reads each line three times. `jsonFields`
+ * reads it once: `jsonFields(line, ["code", "line", "message"])` answers an
+ * array whose slot `k` is exactly what `jsonField(line, names[k])` answers —
+ * absent, first-of-a-duplicate and malformed input included — because the two
+ * share the step that reads one member (`jsonReadMember`) and stop at the same
+ * one. Its array goes back to the caller with the values in it, so a loop that
+ * calls it keeps its per-pass arena release, as one calling `jsonField` does;
+ * `jsonFields`' own comment says when that holds.
+ *
  * Every offset here is a **byte** offset and every width is spelled, with each
  * length and byte a builtin answers read through `toI32` — `.length` and
  * `charCodeAt` answer `number`, which is `f64` under `--number-mode f64`, so the
@@ -53,14 +63,17 @@
  * (`docs/wp26-stdlib.md` §4).
  */
 
+const JSON_BACKSPACE: i32 = 8
 const JSON_TAB: i32 = 9
 const JSON_NEWLINE: i32 = 10
+const JSON_FORM_FEED: i32 = 12
 const JSON_CARRIAGE_RETURN: i32 = 13
 const JSON_SPACE: i32 = 32
 const JSON_QUOTE: i32 = 34
 const JSON_COMMA: i32 = 44
 const JSON_COLON: i32 = 58
 const JSON_BACKSLASH: i32 = 92
+const JSON_LETTER_U: i32 = 117
 const JSON_OPEN_BRACKET: i32 = 91
 const JSON_CLOSE_BRACKET: i32 = 93
 const JSON_OPEN_BRACE: i32 = 123
@@ -261,6 +274,37 @@ const jsonUtf8 = (code: i32): string => {
   return `${lead}${middle}${String.fromCharCode(JSON_UTF8_CONTINUATION + (code & JSON_UTF8_LOW_SIX))}`
 }
 
+/** The number of bytes `jsonUtf8(code)` answers. */
+const jsonUtf8Width = (code: i32): i32 => {
+  if (code < JSON_UTF8_TWO_BYTE_FLOOR) {
+    return 1
+  }
+  if (code < JSON_UTF8_THREE_BYTE_FLOOR) {
+    return 2
+  }
+  return 3
+}
+
+/**
+ * Byte `k` of the `width` bytes `jsonUtf8(code)` answers: its arithmetic, one
+ * byte at a time, for a caller that compares the bytes rather than keeps them.
+ */
+const jsonUtf8Byte = (code: i32, width: i32, k: i32): i32 => {
+  if (width === 1) {
+    return code
+  }
+  if (k === 0) {
+    if (width === 2) {
+      return JSON_UTF8_TWO_BYTE_LEAD + (code >> 6)
+    }
+    return JSON_UTF8_THREE_BYTE_LEAD + (code >> 12)
+  }
+  if (k === width - 1) {
+    return JSON_UTF8_CONTINUATION + (code & JSON_UTF8_LOW_SIX)
+  }
+  return JSON_UTF8_CONTINUATION + ((code >> 6) & JSON_UTF8_LOW_SIX)
+}
+
 /**
  * The bytes of `text[at..end)` with the JSON escapes decoded — the body of a
  * string literal, without its quotes.
@@ -343,6 +387,190 @@ const jsonUnescape = (text: string, at: i32, end: i32): string => {
   return parts.join("")
 }
 
+/** Whether byte `j` of `name` is `code`; an index past either end is not. */
+const jsonNameHas = (name: string, j: i32, code: i32): boolean =>
+  j >= 0 && j < toI32(name.length) && toI32(name.charCodeAt(j)) === code
+
+/**
+ * Whether `jsonUnescape(text, at, end)` would answer `name`, decided without
+ * building it.
+ *
+ * `jsonField` and `jsonFields` ask this of every key they walk past, and almost
+ * every answer is no, so the question is answered the way it is asked: the literal and `name`
+ * are walked together, each escape decoded where it stands, and the first byte
+ * that differs ends the walk. Every escape reads as `jsonUnescape` reads it —
+ * the short forms, a `\u` as the bytes `jsonUtf8` would build, a broken `\u`
+ * as the two bytes `\u`, a backslash with no letter after it as itself, and
+ * any other escape as the byte it escapes — so a key matches here exactly when
+ * its decoded text would.
+ */
+const jsonKeyEquals = (text: string, at: i32, end: i32, name: string): boolean => {
+  // `jsonUnescape`'s guard, for the same reason: every caller passes the
+  // inside of a key `jsonReadMember` found with `jsonEndOfString`.
+  if (at < 0 || end > toI32(text.length)) {
+    return false
+  }
+  let i: i32 = at
+  let j: i32 = 0
+  while (i < end) {
+    const code: i32 = toI32(text.charCodeAt(i))
+    if (code !== JSON_BACKSLASH) {
+      if (!jsonNameHas(name, j, code)) {
+        return false
+      }
+      i += 1
+      j += 1
+      continue
+    }
+    const letter: i32 = i + 1 < end ? toI32(text.charCodeAt(i + 1)) : 0
+    if (letter === JSON_LETTER_U) {
+      const point: i32 = jsonHex4(text, i + 2, end)
+      if (point < 0) {
+        if (!jsonNameHas(name, j, JSON_BACKSLASH) || !jsonNameHas(name, j + 1, JSON_LETTER_U)) {
+          return false
+        }
+        i += 2
+        j += 2
+        continue
+      }
+      const width: i32 = jsonUtf8Width(point)
+      let k: i32 = 0
+      while (k < width) {
+        if (!jsonNameHas(name, j + k, jsonUtf8Byte(point, width, k))) {
+          return false
+        }
+        k += 1
+      }
+      i += 6
+      j += width
+      continue
+    }
+    // Every other escape decodes to one byte.
+    let decoded: i32 = letter
+    if (letter === 110) {
+      decoded = JSON_NEWLINE
+    } else if (letter === 116) {
+      decoded = JSON_TAB
+    } else if (letter === 114) {
+      decoded = JSON_CARRIAGE_RETURN
+    } else if (letter === 98) {
+      decoded = JSON_BACKSPACE
+    } else if (letter === 102) {
+      decoded = JSON_FORM_FEED
+    } else if (letter === 0) {
+      decoded = JSON_BACKSLASH
+    }
+    if (!jsonNameHas(name, j, decoded)) {
+      return false
+    }
+    // A backslash with no letter after it is one byte of the literal and every
+    // other escape two. The steps are constants rather than a variable because
+    // a cursor moved by a variable is one the bounds proof stops following.
+    if (letter === 0) {
+      i += 1
+    } else {
+      i += 2
+    }
+    j += 1
+  }
+  return j === toI32(name.length)
+}
+
+/**
+ * Where one member of an object lies, as `jsonReadMember` found it: the inside
+ * of its key literal, its value, and the opening quote of the key after it.
+ *
+ * It is a class so that one step can answer the four offsets together, and
+ * each reader allocates exactly one, which never leaves the reader: that is
+ * what keeps it a stack slot rather than an arena allocation.
+ */
+class JsonMember {
+  keyAt: i32 = 0
+  keyEnd: i32 = 0
+  valueAt: i32 = 0
+  valueEnd: i32 = 0
+  /** The opening quote of the next key, or `-1` when no comma follows the value. */
+  next: i32 = -1
+}
+
+/**
+ * The opening quote of the first key of `object`, or `-1` when `object` does
+ * not start, past any blanks, with a `{`.
+ */
+const jsonFirstKey = (object: string): i32 => {
+  const length: i32 = toI32(object.length)
+  const i: i32 = jsonSkipBlank(object, 0)
+  if (i >= length || toI32(object.charCodeAt(i)) !== JSON_OPEN_BRACE) {
+    return -1
+  }
+  return jsonSkipBlank(object, i + 1)
+}
+
+/**
+ * Reads the member whose key's opening quote is at `at` into `member`, and
+ * answers whether there was one.
+ *
+ * This is the per-key step `jsonField` and `jsonFields` share, so they cannot
+ * disagree about where a member ends: `false` for anything that is not a key,
+ * a colon and a whole value in that order, which is the point at which both
+ * stop. A value need not be followed by a comma — a truncated object still
+ * answers the fields before the cut — so a missing one only sets `next` to
+ * `-1`, and the read that follows answers `false`.
+ */
+const jsonReadMember = (object: string, at: i32, member: JsonMember): boolean => {
+  const length: i32 = toI32(object.length)
+  // `jsonSkipBlank` never answers a negative index for a non-negative one, but
+  // the bounds proof does not look inside a callee, so every cursor it answers
+  // is tested for `i < 0` beside `i >= length`: the pair is what lets each read
+  // below go without a check.
+  if (at < 0 || at >= length || toI32(object.charCodeAt(at)) !== JSON_QUOTE) {
+    return false
+  }
+  const keyEnd: i32 = jsonEndOfString(object, at)
+  if (keyEnd < 0) {
+    return false
+  }
+  const colon: i32 = jsonSkipBlank(object, keyEnd)
+  if (colon < 0 || colon >= length || toI32(object.charCodeAt(colon)) !== JSON_COLON) {
+    return false
+  }
+  const valueAt: i32 = jsonSkipBlank(object, colon + 1)
+  const valueEnd: i32 = jsonEndOfValue(object, valueAt)
+  if (valueEnd < 0) {
+    return false
+  }
+  member.keyAt = at + 1
+  member.keyEnd = keyEnd - 1
+  member.valueAt = valueAt
+  member.valueEnd = valueEnd
+  const comma: i32 = jsonSkipBlank(object, valueEnd)
+  if (comma < 0 || comma >= length || toI32(object.charCodeAt(comma)) !== JSON_COMMA) {
+    member.next = -1
+  } else {
+    member.next = jsonSkipBlank(object, comma + 1)
+  }
+  return true
+}
+
+/**
+ * The text a member's value answers: a string unquoted and unescaped, anything
+ * else as the bytes it was written with.
+ */
+const jsonValueText = (object: string, member: JsonMember): string => {
+  const valueAt: i32 = member.valueAt
+  const valueEnd: i32 = member.valueEnd
+  // `jsonReadMember` only fills in a value `jsonEndOfValue` ended, which starts
+  // inside the object and never ends past it, so this changes no answer: it is
+  // the range the value's first byte and its `substring` are proved in.
+  if (valueAt < 0 || valueAt >= valueEnd || valueEnd > toI32(object.length)) {
+    return ""
+  }
+  if (toI32(object.charCodeAt(valueAt)) === JSON_QUOTE) {
+    return jsonUnescape(object, valueAt + 1, valueEnd - 1)
+  }
+  return object.substring(valueAt, valueEnd)
+}
+
 /**
  * The value of `name` in `object`, or `null` when the object does not have that
  * field.
@@ -358,45 +586,73 @@ const jsonUnescape = (text: string, at: i32, end: i32): string => {
  * and it is the shape the compiler's `--json` line has.
  */
 export const jsonField = (object: string, name: string): string | null => {
-  const length: i32 = toI32(object.length)
-  let i: i32 = jsonSkipBlank(object, 0)
-  if (i >= length || toI32(object.charCodeAt(i)) !== JSON_OPEN_BRACE) {
-    return null
-  }
-  i = jsonSkipBlank(object, i + 1)
-  // `jsonSkipBlank` never answers a negative index for a non-negative one, but
-  // the bounds proof does not look inside a callee, so every cursor it answers
-  // is tested for `i < 0` beside `i >= length`: the pair is what lets each read
-  // below go without a check.
-  while (i >= 0 && i < length && toI32(object.charCodeAt(i)) === JSON_QUOTE) {
-    const keyEnd: i32 = jsonEndOfString(object, i)
-    if (keyEnd < 0) {
-      return null
-    }
-    const key: string = jsonUnescape(object, i + 1, keyEnd - 1)
-    i = jsonSkipBlank(object, keyEnd)
-    if (i < 0 || i >= length || toI32(object.charCodeAt(i)) !== JSON_COLON) {
-      return null
+  const member: JsonMember = new JsonMember()
+  let at: i32 = jsonFirstKey(object)
+  while (jsonReadMember(object, at, member)) {
+    // The key is compared where it stands rather than unescaped into a string
+    // first: every key before the one asked for is a no, and a no should not
+    // cost an allocation.
+    if (jsonKeyEquals(object, member.keyAt, member.keyEnd, name)) {
+      return jsonValueText(object, member)
     }
-    const valueAt: i32 = jsonSkipBlank(object, i + 1)
-    const valueEnd: i32 = jsonEndOfValue(object, valueAt)
-    // `jsonEndOfValue` answers `-1` for a `valueAt` outside the object and never
-    // answers past its end, so the last three tests change no answer: they are
-    // the range the value's first byte and its `substring` are proved in.
-    if (valueEnd < 0 || valueAt < 0 || valueAt >= length || valueEnd > toI32(object.length)) {
-      return null
-    }
-    if (key === name) {
-      if (toI32(object.charCodeAt(valueAt)) === JSON_QUOTE) {
-        return jsonUnescape(object, valueAt + 1, valueEnd - 1)
+    at = member.next
+  }
+  return null
+}
+
+/**
+ * The value of every one of `names` in `object`, in the order of `names`: slot
+ * `k` is exactly what `jsonField(object, names[k])` answers.
+ *
+ * It is for a caller that wants several fields of one line — a diagnostic's
+ * `code`, `line` and `message` — and would otherwise scan the line once per
+ * field. This scans it once, left to right, and stops as soon as every name has
+ * answered: a speed path and nothing more, since a slot is filled only once
+ * and reading on could change no answer. Each slot keeps the **first** field of its name, as `jsonField`
+ * does; a name asked for twice answers in both slots; and a malformed object
+ * answers in each slot what `jsonField` answers for that name, because both
+ * stop at the same member.
+ *
+ * The answer is a fresh array and the only allocation besides the values. Each
+ * value is stored into it by a plain `values[k] = text` statement, and the
+ * array is only stored into, tested and returned, so the values travel with
+ * the array: the call lets nothing else out (LANGUAGE.md, "Memory model", a
+ * value stored into an array that is returned with it). A loop calling this
+ * keeps its per-pass release on a line older than the pass, as `jsonField`'s
+ * does, and a `using a = arena()` block may hold the call. On a line built in
+ * the pass neither reader keeps the release (LANGUAGE.md, "Memory model").
+ * Reading `values` back, passing it to a function, or storing it anywhere
+ * before the return would undo this; `tests/link/std_json` pins the flat
+ * arena and the `using` block.
+ */
+export const jsonFields = (object: string, names: string[]): (string | null)[] => {
+  const count: i32 = toI32(names.length)
+  const values: (string | null)[] = new Array<string | null>(count)
+  const member: JsonMember = new JsonMember()
+  let missing: i32 = count
+  let at: i32 = jsonFirstKey(object)
+  while (missing > 0 && jsonReadMember(object, at, member)) {
+    // A value is built once per member however many names it answers, and
+    // only when one of them does.
+    let text: string | null = null
+    let k: i32 = 0
+    // Bounded by both lengths, which are the same, because the bounds proof
+    // follows each array by its own length and not by `count`.
+    while (k < toI32(values.length) && k < toI32(names.length)) {
+      if (values[k] === null && jsonKeyEquals(object, member.keyAt, member.keyEnd, names[k])) {
+        if (text === null) {
+          text = jsonValueText(object, member)
+        }
+        // Always true: the loop's own test. A call stands between it and the
+        // store, and a call is where the bounds proof forgets a length.
+        if (k < toI32(values.length)) {
+          values[k] = text
+        }
+        missing -= 1
       }
-      return object.substring(valueAt, valueEnd)
-    }
-    i = jsonSkipBlank(object, valueEnd)
-    if (i < 0 || i >= length || toI32(object.charCodeAt(i)) !== JSON_COMMA) {
-      return null
+      k += 1
     }
-    i = jsonSkipBlank(object, i + 1)
+    at = member.next
   }
-  return null
+  return values
 }

package/std/net/http3-server.ts

@@ -53,9 +53,9 @@
  * configuration's streams and buffers and the `Http3Config`'s field section,
  * body chunk and DATA frame. The constructor makes every slot's connections;
  * a datagram an established connection reads, and every datagram it sends,
- * allocates nothing. What does allocate is a new connection's — the listener's
- * work on a datagram no slot owns, and the QUIC handshake (TLS-3) —
- * `docs/security/http3.md` lists it.
+ * allocates nothing; nor does a datagram no slot owns, which the listener
+ * reads where it lies and answers into scratch made once, nor a handshake,
+ * whose state is the slot's — `docs/security/http3.md` (H3-1, H3-3).
  *
  * Written from RFC 9114 §3 and RFC 9000 §5.2, not ported from another
  * implementation. Private names carry the `http3Server` prefix
@@ -76,6 +76,7 @@ import {
 import { QUIC_MAX_CID_LENGTH } from "nish/net/quic-packet"
 import {
   QUIC_LISTEN_ACCEPT,
+  QUIC_LISTENER_ANSWER_SIZE,
   QUIC_LISTENER_FLIGHT_MAX,
   QUIC_LISTENER_MIN_RESET,
   QuicFlight,
@@ -84,7 +85,7 @@ import {
   quicListenerPaceTime,
   quicListenerTakeFlight,
 } from "nish/net/quic-listener"
-import { tlsSignEcdsaP256 } from "nish/net/tls"
+import { TlsP256Signer } from "nish/net/tls"
 
 /** The timer wheel's buckets, one millisecond each: its horizon. */
 export const H3_SERVER_WHEEL: i32 = 2048
@@ -397,6 +398,8 @@ export class Http3Wheel {
 export class Http3Server {
   quicConfig: QuicServerConfig
   listener: QuicListener
+  /** What the listener answers into, made once: its reply and IDs are refilled in their own room. */
+  answer: QuicListenerAnswer
   quics: QuicConnection[]
   conns: Http3Connection[]
   index: Http3CidIndex
@@ -410,6 +413,8 @@ export class Http3Server {
   meta: i32[]
   entropy: u8[]
   flight: QuicFlight
+  /** Signs every slot's CertificateVerify in `serve`, one for the server, keeping nothing per signature. */
+  signer: TlsP256Signer
   /** Each slot's connection-ID index signature, so it is refiled only when its IDs changed. */
   signatures: i64[]
   state: i32[]
@@ -450,6 +455,7 @@ export class Http3Server {
     this.fd = fd
     this.index = new Http3CidIndex(size, listenerEntropy)
     this.listener = new QuicListener(quicConfig, listenerEntropy)
+    this.answer = new QuicListenerAnswer(QUIC_LISTENER_ANSWER_SIZE)
     this.wheel = new Http3Wheel(size)
     this.quics = []
     this.conns = []
@@ -467,6 +473,7 @@ export class Http3Server {
     this.from = new Array<u8>(H3_SERVER_ADDRESS)
     this.meta = [H3_SERVER_ZERO, H3_SERVER_ZERO]
     this.flight = new QuicFlight()
+    this.signer = new TlsP256Signer()
     this.signatures = new Array<i64>(size)
     this.state = new Array<i32>(size)
     this.readyRing = new Array<i32>(size)
@@ -605,17 +612,17 @@ export class Http3Server {
     this.unowned(buf, at, len, address, now, key)
   }
 
-  /** A datagram no slot owns: the listener decides, and may make a connection in a free slot. */
+  /**
+   * A datagram no slot owns: the listener decides, reading it where it lies
+   * in `buf` and answering into `answer`, and may make a connection in a
+   * free slot, which reads the same window. Nothing is copied (H3-3).
+   */
   unowned(buf: u8[], at: i32, len: i32, address: u8[], now: i64, key: Secret<u8[]>): void {
     if (!this.worthListening(buf, at, len, now)) {
       return
     }
-    const datagram: u8[] = new Array<u8>(len)
-    for (let k: i32 = 0; k < len && k < toI32(datagram.length) && at + k < toI32(buf.length); k++) {
-      datagram[k] = buf[at + k]
-    }
-    const answer: QuicListenerAnswer = this.listener.handle(datagram, address, now)
-    if (answer.kind !== QUIC_LISTEN_ACCEPT) {
+    const answer: QuicListenerAnswer = this.answer
+    if (this.listener.handleWindow(buf, at, len, address, now, answer) !== QUIC_LISTEN_ACCEPT) {
       const reply: i32 = toI32(answer.reply.length)
       if (reply > 0) {
         this.send(answer.reply, H3_SERVER_ZERO, reply, address, H3_SERVER_ZERO)
@@ -646,9 +653,8 @@ export class Http3Server {
 
   /**
    * Whether the listener could answer `buf[at .. at + len)` at all, read
-   * from its first bytes: what it would drop without a word, it costs
-   * nothing to drop here, before the copy and the parse the listener makes
-   * (H3-3). That is a short header too short for a stateless reset; a long
+   * from its first bytes: what it would drop without a word is dropped
+   * here, before the listener parses it. That is a short header too short for a stateless reset; a long
    * one shorter than a full Initial, which neither Version Negotiation nor a
    * new connection answers (RFC 9000 §14.1, §6.1); version 0; a version 1
    * packet that is not an Initial, or whose DCID is under 8 bytes (§7.2);
@@ -686,7 +692,7 @@ export class Http3Server {
    * `H3_SERVER_ANSWER_BURST` at once, then one per
    * `H3_SERVER_ANSWER_INTERVAL` milliseconds — topping it up first. Past it
    * the datagram is dropped before the listener sees it, so a flood of
-   * garbage costs nothing (H3-3); counted in `limited`.
+   * garbage costs no answer and no MAC past the budget (H3-3); counted in `limited`.
    */
   takeAnswer(now: i64): boolean {
     if (this.answerRefilled < 0 || now < this.answerRefilled) {
@@ -713,7 +719,7 @@ export class Http3Server {
     quic.receiveWindow(buf, at, len, now)
     const input: u8[] | null = quic.signatureInput()
     if (input !== null) {
-      const signature: u8[] | null = tlsSignEcdsaP256(key, input)
+      const signature: u8[] | null = this.signer.sign(key, input)
       if (signature !== null) {
         quic.sign(signature)
       }

package/std/net/quic-conn-params.ts

@@ -126,6 +126,42 @@ export class QuicTransportParameters {
   }
 }
 
+/** Empties `to`, keeping its room. */
+const quicParamsEmpty = (to: u8[]): void => {
+  while (to.length > 0) {
+    to.pop()
+  }
+}
+
+/** Sets `p` back to what a new `QuicTransportParameters` holds, keeping its arrays, emptied. */
+const quicParamsDefaults = (p: QuicTransportParameters): void => {
+  p.error = 0
+  p.maxIdleTimeout = 0
+  p.maxUdpPayloadSize = 65527
+  p.initialMaxData = 0
+  p.initialMaxStreamDataBidiLocal = 0
+  p.initialMaxStreamDataBidiRemote = 0
+  p.initialMaxStreamDataUni = 0
+  p.initialMaxStreamsBidi = 0
+  p.initialMaxStreamsUni = 0
+  p.ackDelayExponent = 3
+  p.maxAckDelay = 25
+  p.activeConnectionIdLimit = 2
+  p.maxDatagramFrameSize = 0
+  p.errorParameter = 0
+  quicParamsEmpty(p.originalDcid)
+  quicParamsEmpty(p.statelessResetToken)
+  quicParamsEmpty(p.preferredAddress)
+  quicParamsEmpty(p.initialScid)
+  quicParamsEmpty(p.retryScid)
+  p.hasOriginalDcid = false
+  p.hasStatelessResetToken = false
+  p.hasPreferredAddress = false
+  p.hasInitialScid = false
+  p.hasRetryScid = false
+  p.disableActiveMigration = false
+}
+
 /** Appends one parameter whose value is a varint, when it differs from `fallback`, its default. */
 const quicParamsPushVarint = (out: u8[], id: i32, value: i64, fallback: i64): void => {
   if (value === fallback || quicVarintSize(value) === 0) {
@@ -158,6 +194,18 @@ const quicParamsPushBytes = (out: u8[], id: i32, bytes: u8[], present: boolean):
  */
 export const quicEncodeTransportParameters = (p: QuicTransportParameters): u8[] => {
   const out: u8[] = []
+  quicEncodeTransportParametersInto(p, out)
+  return out
+}
+
+/**
+ * `quicEncodeTransportParameters` into `out`, which is emptied first: the
+ * encoding is pushed into the room the array already has, so a connection
+ * slot that keeps one array for its parameters grows it only when they
+ * outgrow every earlier connection's.
+ */
+export const quicEncodeTransportParametersInto = (p: QuicTransportParameters, out: u8[]): void => {
+  quicParamsEmpty(out)
   quicParamsPushBytes(out, QUIC_TP_ORIGINAL_DCID, p.originalDcid, p.hasOriginalDcid)
   quicParamsPushVarint(out, QUIC_TP_MAX_IDLE_TIMEOUT, p.maxIdleTimeout, 0)
   quicParamsPushBytes(out, QUIC_TP_STATELESS_RESET_TOKEN, p.statelessResetToken, p.hasStatelessResetToken)
@@ -177,19 +225,20 @@ export const quicEncodeTransportParameters = (p: QuicTransportParameters): u8[]
   quicParamsPushBytes(out, QUIC_TP_INITIAL_SCID, p.initialScid, p.hasInitialScid)
   quicParamsPushBytes(out, QUIC_TP_RETRY_SCID, p.retryScid, p.hasRetryScid)
   quicParamsPushVarint(out, QUIC_TP_MAX_DATAGRAM_FRAME_SIZE, p.maxDatagramFrameSize, 0)
-  return out
 }
 
-/** The bytes `data[from .. from + length)`, copied; the caller has checked the window. */
-const quicParamsCopy = (data: u8[], from: i32, length: i32): u8[] => {
-  const out: u8[] = new Array<u8>(length)
-  const n: i32 = toI32(out.length)
-  for (let k: i32 = 0; k < n; k += 1) {
+/**
+ * `bytes[from .. from + length)` into `to`, which is emptied first and
+ * refilled in the room it has: a parameters object reused for connection
+ * after connection keeps its arrays. The caller has checked the window.
+ */
+const quicParamsCopyInto = (to: u8[], data: u8[], from: i32, length: i32): void => {
+  quicParamsEmpty(to)
+  for (let k: i32 = 0; k < length; k += 1) {
     if (from + k >= 0 && from + k < toI32(data.length)) {
-      out[k] = data[from + k]
+      to.push(data[from + k])
     }
   }
-  return out
 }
 
 /** Fails `p` over parameter `id` and answers it. */
@@ -293,30 +342,35 @@ const quicParamsStoreBytes = (
   at: i32,
   length: i32
 ): boolean => {
+  // A connection ID or reset token is copied only once its length is one the
+  // parameter allows, so a reused object's arrays never grow past it whatever
+  // a peer sends. `preferred_address` is server-only and so never read from a
+  // client into a server's slot; its length is the server's own.
+  const cidFits: boolean = length <= QUIC_MAX_CID_LENGTH
   switch (id) {
     case QUIC_TP_ORIGINAL_DCID:
-      p.originalDcid = quicParamsCopy(bytes, at, length)
+      quicParamsCopyInto(p.originalDcid, bytes, at, cidFits ? length : 0)
       p.hasOriginalDcid = true
-      return length <= QUIC_MAX_CID_LENGTH
+      return cidFits
     case QUIC_TP_STATELESS_RESET_TOKEN:
-      p.statelessResetToken = quicParamsCopy(bytes, at, length)
+      quicParamsCopyInto(p.statelessResetToken, bytes, at, length === QUIC_RESET_TOKEN_SIZE ? length : 0)
       p.hasStatelessResetToken = true
       return length === QUIC_RESET_TOKEN_SIZE
     case QUIC_TP_DISABLE_ACTIVE_MIGRATION:
       p.disableActiveMigration = true
       return length === 0
     case QUIC_TP_PREFERRED_ADDRESS:
-      p.preferredAddress = quicParamsCopy(bytes, at, length)
+      quicParamsCopyInto(p.preferredAddress, bytes, at, length)
       p.hasPreferredAddress = true
       return true
     case QUIC_TP_INITIAL_SCID:
-      p.initialScid = quicParamsCopy(bytes, at, length)
+      quicParamsCopyInto(p.initialScid, bytes, at, cidFits ? length : 0)
       p.hasInitialScid = true
-      return length <= QUIC_MAX_CID_LENGTH
+      return cidFits
     default:
-      p.retryScid = quicParamsCopy(bytes, at, length)
+      quicParamsCopyInto(p.retryScid, bytes, at, cidFits ? length : 0)
       p.hasRetryScid = true
-      return length <= QUIC_MAX_CID_LENGTH
+      return cidFits
   }
 }
 
@@ -336,6 +390,22 @@ const quicParamsIsVarint = (id: i32): boolean =>
  */
 export const quicParseTransportParameters = (bytes: u8[], fromServer: boolean): QuicTransportParameters => {
   const p: QuicTransportParameters = new QuicTransportParameters()
+  quicParseTransportParametersInto(p, bytes, fromServer)
+  return p
+}
+
+/**
+ * `quicParseTransportParameters` into `p`, which is set back to every
+ * default first, its byte-valued fields emptied and refilled in the room
+ * their arrays have: a connection slot parses each client's parameters into
+ * one object of its own. Answers `p`.
+ */
+export const quicParseTransportParametersInto = (
+  p: QuicTransportParameters,
+  bytes: u8[],
+  fromServer: boolean
+): QuicTransportParameters => {
+  quicParamsDefaults(p)
   const end: i32 = toI32(bytes.length)
   // The known IDs are 0 to 16, so one bit each of an i32 records which were
   // seen; RFC 9221's 0x20 has a flag of its own.