@blamejs/core 0.18.8 → 0.18.10

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.10 (2026-08-03) — **Encrypted-at-rest boot fails closed on a truncated db.enc instead of silently starting fresh over it; broader SAML and database test coverage.** A database running encrypted at rest whose db.enc snapshot is truncated below a valid envelope (an interrupted external copy or backup restore, a full tmpfs, filesystem corruption) no longer boots onto a fresh empty database that the next flush would persist over the corrupt copy — it now fails closed so the operator can restore from backup. Alongside the fix, adversarial and edge branches of b.auth.saml and b.db come under explicit test, and the vendored @blamejs/pki toolkit is refreshed. **Changed:** *Verification- and edge-path tests for the SAML SP and database primitives* — b.auth.saml (the XML-signature Reference handling with no URI or no Transforms, a foreign-namespace Conditions element failing closed to no-audience-restriction, RSA-OAEP SHA-384/SHA-512 key transport with AES-128-GCM assertion decryption, ed25519 sign/verify dispatch, and the single-logout build/parse paths) and b.db (encrypted-boot key and envelope fallbacks, the truncated-snapshot refusal above, flush-to-disk after close, the audit-chain rollback check against a non-empty log, and the boot-time NTP check thresholds) now have explicit tests for their boundary branches. · *Vendored @blamejs/pki refreshed to 0.3.29* — The vendored @blamejs/pki toolkit that backs the mutual-TLS CA engine (X.509 / CRL / PKCS#12 signing) is refreshed from 0.3.28 to 0.3.29. The upstream change is in that toolkit's ACME client and Retry-After parser, which the CA engine does not call, so there is no behaviour change to the certificate-authority surface — this is a supply-chain currency refresh. **Fixed:** *Encrypted boot fails closed on a truncated db.enc rather than starting fresh over it* — When a database is encrypted at rest and its durable db.enc snapshot exists but is too short to be a valid AEAD envelope — a truncation from an interrupted external copy or backup restore, a full tmpfs, or filesystem corruption — boot silently opened a fresh empty database. The next flush or close then persisted that empty database over the corrupt-but-present snapshot, masking the corruption and destroying the operator's chance to recover. Boot now fails closed with db/enc-truncated; restore db.enc from backup, or remove it to intentionally start empty. A valid snapshot is always written atomically and is never this short, so no healthy deployment is affected. **Detectors:** *Truncated db.enc must fail closed, not start fresh* — A source guard keeps the encrypted-boot path throwing on an under-length db.enc rather than returning to open a fresh database — so a truncated durable snapshot can never again be silently overwritten by the next flush.
+
+- v0.18.9 (2026-08-02) — **Broader error- and edge-path test coverage for the CLI, mail, and HTTP-client primitives.** Error, edge, and fallback branches of b.cli, b.mail, and b.httpClient are now under explicit test. No behaviour changes: exercising every path confirmed each already behaves per its documented contract. One dead internal parameter on the HTTP-client cache path — never supplied by any caller — was removed. **Changed:** *Error- and edge-path tests for the CLI, mail, and HTTP-client primitives* — b.cli (the api-snapshot capture/compare load-error paths and the restore-apply round trip), b.mail (reverse-DNS forward-confirmation and failure fallbacks, SMTP UTF-8 and binary-MIME detection on edge inputs, AUTH LOGIN with an empty password, and audit-emit failures being swallowed without masking the delivery outcome), and b.httpClient (the HTTPS-connect failure classification and the HTTP/2 synchronous-request-throw path) now have explicit tests for their boundary branches. Behaviour is unchanged.
+
 - v0.18.8 (2026-08-02) — **SSRF-safe local-transport HTTP, timestamped-HMAC webhook verification, the OAuth client-credentials grant, trusted-proxy identity headers, and a public keyed-HMAC primitive; plus a fix for a filterless overflow update that could rewrite every row.** Five general-purpose primitives land: talking HTTP to a co-located daemon over a socket the SSRF gate cannot protect, verifying the single-header timestamped-HMAC webhook scheme, the machine-to-machine OAuth client_credentials grant with a cached auto-renewing token manager, and peer-gated trust of a reverse proxy's identity headers. b.crypto.hmac exposes the framework's keyed HMAC (SHA3-512 by default; weaker digests available explicitly for external-scheme interop) and replaces b.crypto.hmacSha3. Separately, an update() on a collection whose field lives in the overflow store, called with no filter, no longer slips past the unconditional-write guard and silently rewrites every row. **Added:** *b.localHttp — SSRF-safe HTTP over a local transport* — b.localHttp.create({ socketPath }) and b.localHttp.request() speak HTTP to a co-located daemon over a Unix domain socket, a Windows named pipe, or a loopback TCP peer with a bearer token — the transports an SSRF gate cannot protect, because there is no network host to steer. It deliberately does not route through b.httpClient (DNS + the SSRF gate): a socket-path request cannot be pointed at an arbitrary IP, so that surface is exactly what it exists to bypass safely. It refuses any non-loopback TCP host, never forwards Origin or Referer to the daemon, bounds the response body, and sets the caller's Host header verbatim. Use it for a local control-plane API — a sidecar's endpoint, a container-runtime socket, a metrics port. · *b.webhookHmac.verify — timestamped-HMAC webhook verification* — Verifies the single-header timestamped-HMAC webhook scheme — t=<unix-seconds>,v1=<hmac-hex> signed over <timestamp>.<raw-body> — used by Stripe, Tailscale, and others. It refuses a timestamp outside the tolerance window (replay defense), checks every v1 value so a rotated signing secret verifies with no downtime, compares in constant time, and ignores signature versions it does not recognize. Pass the exact bytes received, not a parsed-then-re-serialized JSON body, or the HMAC will not reproduce. This is distinct from b.standardWebhooks, which verifies the three-header StandardWebhooks scheme. · *b.auth.oauth.clientCredentials + clientCredentialsManager — the client_credentials grant* — The RFC 6749 §4.4 client_credentials grant for machine-to-machine authentication with no user present: clientCredentials() POSTs grant_type=client_credentials and returns the access token — never a refresh token, per the RFC. It authenticates with the client id/secret via client_secret_post (default) or client_secret_basic (tokenEndpointAuthMethod), sends no scope unless you supply one (the authorization-code scope default is not applied to a machine-to-machine request), and a client_credentials-only client needs no redirectUri at create. clientCredentialsManager() wraps it in an in-memory cache that fetches on first use, re-fetches a configurable window before expiry, collapses concurrent callers onto one in-flight request, and — throughout a 429 backoff window (honoring the server's Retry-After when present) — serves the still-valid cached token or fails fast without another network call, rather than hammering the authorization server. The client's tokenEndpointAuthMethod (client_secret_post / client_secret_basic) applies uniformly to every token-endpoint request, not just this grant. · *b.requestHelpers.trustedIdentityHeaders — peer-gated proxy identity headers* — Resolves an identity-injecting reverse proxy's header family — Cloudflare Access Cf-Access-*, oauth2-proxy X-Forwarded-User, Tailscale Serve Tailscale-User-*, or any custom mapping — under the same trusted-proxy peer-gate as b.requestHelpers.trustedClientIp. It is the identity-header mirror of the X-Forwarded-For discipline: the family is trusted only when the immediate socket peer is a configured trusted proxy; from any other peer the headers are stripped from req.headers so downstream code cannot read a forged identity. With no gate configured it fails closed and always strips. A naive trust of these headers is a full impersonation bypass; this closes it by construction rather than opening a second, looser trust path. · *b.crypto.hmac — a public keyed-HMAC primitive* — b.crypto.hmac(key, data, algorithm = "sha3-512") exposes the framework's keyed HMAC with a PQC-first SHA3-512 default. Weaker digests (sha256, sha384, sha512, sha3-256, sha3-384) are available by naming them explicitly, for interop with an external scheme that pins one — a provider's SHA-256 webhook signature, for example; SHA-1 and MD5 are refused. Key and data accept a Buffer or a string; the result is a lowercase hex digest. **Removed:** *b.crypto.hmacSha3 (folded into b.crypto.hmac)* — b.crypto.hmacSha3 is removed. b.crypto.hmac already defaults to SHA3-512, so replace b.crypto.hmacSha3(key, data) with b.crypto.hmac(key, data) — the same algorithm and the same output. **Fixed:** *A filterless update on an overflow-backed collection no longer rewrites every row* — An update() on a collection whose target field lives in the overflow (JSON) store, called with no filter conditions — an empty or absent query — slipped past the unconditional-write guard that protects real-column updates and silently rewrote every row: the internal per-row writes each carry a WHERE by row id, so the guard never saw a match-everything update. Such an update is now refused with the same "call where(...) first" error as a real-column update. Provide an explicit filter for the rows you intend to change. **Detectors:** *Overflow-store update re-asserts the unconditional-write refusal* — A source guard keeps the overflow-store update path re-checking, on its read query, that a filter is present — so a filterless overflow update cannot regress to silently rewriting every row.
 
 - v0.18.7 (2026-08-02) — **STARTTLS idle-timeout no longer injects plaintext into the encrypted channel; broader mail-server test coverage.** A STARTTLS upgrade on the POP3 / IMAP / ManageSieve / SMTP-submission / MX servers left the pre-upgrade plain-socket idle-timeout handler armed, so a post-handshake idle wrote a plaintext timeout reply into the now-encrypted stream (the peer saw a TLS decode error / reset). The shared socket-upgrade path now strips that handler so the idle timeout is delivered encrypted. Alongside the fix, error and edge branches of b.mail.server.pop3, b.mail.server.imap, and b.mail.auth are now under test. Except for the fix, behaviour is unchanged. **Changed:** *Error- and edge-path tests for the POP3, IMAP, and mail-authentication primitives* — b.mail.server.pop3 (the STLS upgrade and post-handshake idle timeout, pipelined-command draining, AUTH / APOP / USER-PASS branches, and store-fallback and tenant-refusal shapes), b.mail.server.imap (APPEND / CATENATE literal handling, command-dispatch and guard-error branches, and the LOGIN / NOTIFY paths), and b.mail.auth (SPF macro expansion and record parsing, iprev forward-confirm, and dual-CIDR a/mx parsing) now have explicit tests for their boundary paths. **Security:** *STARTTLS idle timeout is delivered over the encrypted channel, not injected as plaintext* — The POP3, IMAP, ManageSieve, SMTP-submission, and MX servers arm a plain-socket idle timer whose handler writes a plaintext idle-timeout reply and closes the connection. After a STARTTLS upgrade the shared socket-upgrade path stripped only the plain socket's data listeners, so that plaintext handler survived the wrap and, on a post-handshake idle, injected cleartext into the now-encrypted stream — the peer observed a TLS decode error or connection reset instead of a clean encrypted timeout reply. The upgrade path now strips the plain socket's timeout listeners and disarms its idle timer, so the upgraded TLS socket owns the idle timeout and replies over the encrypted channel. **Detectors:** *STARTTLS upgrade strips the plaintext idle-timeout handler* — A source guard keeps the shared socket-upgrade path stripping the plain socket's timeout listeners alongside its data listeners, so a plaintext idle-timeout reply cannot survive into the encrypted channel.

package/NOTICE

@@ -60,7 +60,7 @@ Used for:    WebAuthn / passkey registration + authentication response
              server.cjs).
 --------------------------------------------------------------------------------
 Component:   @blamejs/pki
-Version:     0.3.28
+Version:     0.3.29
 Source:      https://github.com/blamejs/pki
 License:     Apache-2.0
 Copyright:   Copyright (c) blamejs contributors

package/lib/db.js

@@ -817,7 +817,21 @@ function decryptToTmp() {
   // a symlink-mounted volume (k8s PVC). db.enc is AEAD-verified downstream, so
   // the cap is the OOM-before-cap defense (was an uncapped read).
   var packed = atomicFile.fdSafeReadSync(encPath, { maxBytes: C.BYTES.gib(2) });
-  if (packed.length < 26) return; // too short to be a valid envelope
+  // The minimum valid AEAD envelope is a 1-byte version + a 24-byte nonce +
+  // a 16-byte tag (41 bytes) — the same floor decryptPacked itself enforces.
+  // db.enc EXISTS here (guarded at entry) and a valid snapshot is written
+  // atomically (temp + rename), so anything shorter is a truncated / corrupt
+  // durable copy, never a clean state.
+  if (packed.length < 1 + C.BYTES.bytes(24) + C.BYTES.bytes(16)) {
+    // Fail loudly rather than open a fresh DB: starting fresh here lets the
+    // next flush/close persist an empty database over the corrupt-but-present
+    // snapshot, masking the corruption and destroying the operator's chance to
+    // restore from backup.
+    throw _dbErr("db/enc-truncated",
+      "FATAL: db.enc exists but is only " + packed.length + " byte(s) — too short to be " +
+      "a valid encrypted snapshot; refusing to start a fresh database over a corrupt durable " +
+      "copy (restore db.enc from backup, or remove it to intentionally start empty)");
+  }
   // AAD binds the envelope to this deployment's data dir so two
   // installs sharing the same operator passphrase can't swap each
   // other's db.enc files. Backwards-compat: if the AAD-bound decrypt

package/lib/http-client.js

@@ -1080,19 +1080,16 @@ function _runWithCache(opts, maxRedirects, runAfter) {
   try { got = cache._lookup(method, opts.url, requestHeaders); }
   catch (_e) { got = null; }
 
-  function _doNetwork(extraReqHeaders) {
-    var nextOpts = opts;
-    if (extraReqHeaders) {
-      nextOpts = Object.assign({}, opts, {
-        headers: Object.assign({}, opts.headers || {}, extraReqHeaders),
-      });
-    }
+  function _doNetwork() {
+    // Conditional revalidation headers (If-None-Match / If-Modified-Since)
+    // are built and applied on the separate _revalidate path, so a cache
+    // miss / malformed-entry refetch issues the request opts verbatim.
     if (maxRedirects === null || maxRedirects === 0) {
-      return _requestSingle(nextOpts).then(function (res) {
-        return { finalOpts: nextOpts, res: res };
+      return _requestSingle(opts).then(function (res) {
+        return { finalOpts: opts, res: res };
       });
     }
-    return _requestWithRedirects(nextOpts, maxRedirects);
+    return _requestWithRedirects(opts, maxRedirects);
   }
 
   // 2. Miss → network → maybe store.
@@ -1101,7 +1098,7 @@ function _runWithCache(opts, maxRedirects, runAfter) {
     catch (_e) { /* drop-silent */ }
     try { cache._obsEvent("httpclient.cache.miss", 1, { method: method }); }
     catch (_e) { /* drop-silent */ }
-    return _doNetwork(null).then(function (boxed) {
+    return _doNetwork().then(function (boxed) {
       _maybeStore(cache, method, opts.url, requestHeaders, boxed.res);
       return runAfter(boxed.finalOpts, _withCacheHeaders(boxed.res, "MISS", undefined, cache.statusHeader));
     });
@@ -1115,7 +1112,7 @@ function _runWithCache(opts, maxRedirects, runAfter) {
     // Malformed entry — drop it, treat as miss.
     try { cache.invalidate(method, opts.url, requestHeaders); }
     catch (_e2) { /* drop-silent */ }
-    return _doNetwork(null).then(function (boxed) {
+    return _doNetwork().then(function (boxed) {
       _maybeStore(cache, method, opts.url, requestHeaders, boxed.res);
       return runAfter(boxed.finalOpts, _withCacheHeaders(boxed.res, "MISS", undefined, cache.statusHeader));
     });

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-08-01T21:13:55.453Z"
+      "refreshedAt": "2026-08-03T19:33:52.595Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-08-01T21:13:55.453Z"
+      "refreshedAt": "2026-08-03T19:33:52.595Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-08-01T21:13:55.453Z"
+      "refreshedAt": "2026-08-03T19:33:52.595Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-08-01T21:13:55.453Z"
+      "refreshedAt": "2026-08-03T19:33:52.595Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-01T21:13:55.453Z"
+      "refreshedAt": "2026-08-03T19:33:52.595Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-01T21:13:55.453Z"
+      "refreshedAt": "2026-08-03T19:33:52.595Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -159,10 +159,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-01T21:13:55.453Z"
+      "refreshedAt": "2026-08-03T19:33:52.595Z"
     },
     "@blamejs/pki": {
-      "version": "0.3.28",
+      "version": "0.3.29",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -182,12 +182,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-01T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.3.28:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-03T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.3.29:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:5e6824b7a7b0a8f8cf191475c115aeba433b12dba790de6da1afb26ebf43a6ec"
+        "server": "sha256:8eb19192bcc9e9660b5fe72376d27de33a1c2c3b44ba18b1b3aeb9f0d95ed2bf"
       },
-      "refreshedAt": "2026-08-01T21:13:55.453Z"
+      "refreshedAt": "2026-08-03T19:33:52.595Z"
     }
   }
 }

package/lib/vendor/blamejs-pki.cjs

@@ -1,4 +1,4 @@
-// @blamejs/pki v0.3.28 — vendored (Apache-2.0). Zero-dep pure CJS.
+// @blamejs/pki v0.3.29 — vendored (Apache-2.0). Zero-dep pure CJS.
 // https://github.com/blamejs/pki  Exports: x509, crl, pkcs12, key, webcrypto, schema, csr, cms, ...
 // Backs lib/mtls-engine-default.js (PQC-capable CA + PKCS#12 engine).
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -137,7 +137,7 @@ var require_package = __commonJS({
   "node_modules/@blamejs/pki/package.json"(exports2, module2) {
     module2.exports = {
       name: "@blamejs/pki",
-      version: "0.3.28",
+      version: "0.3.29",
       description: "Pure-JavaScript PKI toolkit that owns its stack \u2014 X.509, ASN.1/DER, CMS, PQC-first.",
       license: "Apache-2.0",
       author: "blamejs contributors",
@@ -15762,16 +15762,33 @@ var require_http_retry_after = __commonJS({
       var out = { retryAfterSeconds: null, retryAfterDate: null };
       if (/^\d+$/.test(raStr)) {
         var n = parseInt(raStr, 10);
-        if (!Number.isSafeInteger(n) || n > MAX_RETRY_AFTER_SECONDS) throw _fail(opts, "the Retry-After delay is out of the supported range (0.." + MAX_RETRY_AFTER_SECONDS + " seconds)");
+        if (typeof opts.cap === "number" && n > opts.cap) {
+          out.retryAfterSeconds = opts.cap;
+          return out;
+        }
+        if (!Number.isSafeInteger(n) || n > MAX_RETRY_AFTER_SECONDS) {
+          if (opts.lenient) return out;
+          throw _fail(opts, "the Retry-After delay is out of the supported range (0.." + MAX_RETRY_AFTER_SECONDS + " seconds)");
+        }
         out.retryAfterSeconds = n;
         return out;
       }
       var when = httpDateMs(raStr, opts.now);
-      if (isNaN(when)) throw _fail(opts, "a Retry-After must be delay-seconds or a valid HTTP-date (RFC 7231 sec. 7.1.1.1/7.1.3), got " + JSON.stringify(raStr));
+      if (isNaN(when)) {
+        if (opts.lenient) return out;
+        throw _fail(opts, "a Retry-After must be delay-seconds or a valid HTTP-date (RFC 7231 sec. 7.1.1.1/7.1.3), got " + JSON.stringify(raStr));
+      }
       out.retryAfterDate = when;
       if (typeof opts.now === "number" && isFinite(opts.now)) {
         var d = Math.max(0, Math.ceil((when - opts.now) / constants.TIME.seconds(1)));
-        if (d > MAX_RETRY_AFTER_SECONDS) throw _fail(opts, "the Retry-After date is beyond the supported horizon (" + MAX_RETRY_AFTER_SECONDS + " seconds)");
+        if (typeof opts.cap === "number" && d > opts.cap) {
+          out.retryAfterSeconds = opts.cap;
+          return out;
+        }
+        if (d > MAX_RETRY_AFTER_SECONDS) {
+          if (opts.lenient) return out;
+          throw _fail(opts, "the Retry-After date is beyond the supported horizon (" + MAX_RETRY_AFTER_SECONDS + " seconds)");
+        }
         out.retryAfterSeconds = d;
       }
       return out;
@@ -26567,7 +26584,8 @@ var require_acme = __commonJS({
     var pkix = require_schema_pkix();
     var constants = require_constants();
     var rfc3339 = require_rfc3339();
-    var subtle = require_webcrypto().webcrypto.subtle;
+    var webcrypto = require_webcrypto().webcrypto;
+    var subtle = webcrypto.subtle;
     var frameworkError = require_framework_error();
     var httpTransport = require_http_transport();
     var retryAfter = require_http_retry_after();
@@ -26586,6 +26604,13 @@ var require_acme = __commonJS({
     function _isRfc3339(v) {
       return rfc3339.isValid(v);
     }
+    var _RANDOM_DENOM = Math.pow(2, 48);
+    function _defaultRandom() {
+      return Buffer.from(webcrypto.getRandomValues(new Uint8Array(6))).readUIntBE(0, 6) / _RANDOM_DENOM;
+    }
+    var RENEWAL_RETRY_MIN_SECONDS = 60;
+    var RENEWAL_RETRY_MAX_SECONDS = constants.TIME.days(1) / constants.TIME.seconds(1);
+    var RENEWAL_RETRY_DEFAULT_SECONDS = constants.TIME.hours(6) / constants.TIME.seconds(1);
     function _isUrl(v) {
       if (!_isString(v) || !/^https?:\/\/[^\s]+$/.test(v)) return false;
       var u;
@@ -26646,7 +26671,12 @@ var require_acme = __commonJS({
         { name: "expires", type: "rfc3339", requiredWhen: function(o) {
           return o.status === "valid";
         } },
-        { name: "challenges", type: "array", required: true, minItems: 1, elemType: "challenge" },
+        // challenges is required (the key is present) but MAY be empty for an already-"valid" authorization the CA
+        // granted out of band (RFC 8555 sec. 7.1.4 / 7.4.1 -- no challenge was validated); a pending/other authz still
+        // needs at least the one challenge the client fulfills.
+        { name: "challenges", type: "array", required: true, minItems: function(o) {
+          return o.status === "valid" ? 0 : 1;
+        }, elemType: "challenge" },
         { name: "wildcard", type: "boolean" }
       ],
       challenge: [
@@ -26666,7 +26696,7 @@ var require_acme = __commonJS({
         { name: "explanationURL", type: "url" }
       ]
     };
-    function _checkType(kind, field, value) {
+    function _checkType(kind, field, value, obj) {
       switch (field.type) {
         case "string":
           if (!_isString(value)) return "must be a string";
@@ -26692,7 +26722,8 @@ var require_acme = __commonJS({
           break;
         case "array":
           if (!Array.isArray(value)) return "must be an array";
-          if (field.minItems && value.length < field.minItems) return "must have at least " + field.minItems + " element(s)";
+          var minItems = typeof field.minItems === "function" ? field.minItems(obj) : field.minItems;
+          if (minItems && value.length < minItems) return "must have at least " + minItems + " element(s)";
           for (var i = 0; i < value.length; i++) {
             if (field.elemType === "url" && !_isUrl(value[i])) return "element " + i + " must be a URL string";
             if (field.elemType === "contact" && !_isUriString(value[i])) return "element " + i + " must be a URI string";
@@ -26724,20 +26755,22 @@ var require_acme = __commonJS({
         if (field.enum && field.enum.indexOf(obj[field.name]) === -1) {
           throw E("acme/bad-status", "the " + kind + " " + field.name + " " + JSON.stringify(obj[field.name]) + " is not a recognized value");
         }
-        var err = _checkType(kind, field, obj[field.name]);
+        var err = _checkType(kind, field, obj[field.name], obj);
         if (err) throw E("acme/bad-" + _codeSlug(kind), "the " + kind + " field " + JSON.stringify(field.name) + " " + err);
       }
       return obj;
     }
     function _validateIdentifier(id) {
-      if (!_isObject(id) || !_isString(id.type) || !_isString(id.value)) throw E("acme/bad-identifier", "an identifier must be { type, value } strings");
-      if (id.type === "dns") {
-        if (id.value.indexOf("*.") === 0) throw E("acme/bad-identifier", "a wildcard *. value is not permitted in an authorization identifier (RFC 8555 sec. 7.1.4)");
-        _assertDnsName(id.value);
-      } else if (id.type === "ip") {
-        _assertIpAddress(id.value);
+      if (!_isObject(id)) throw E("acme/bad-identifier", "an identifier must be { type, value } strings");
+      var type = id.type, value = id.value;
+      if (!_isString(type) || !_isString(value)) throw E("acme/bad-identifier", "an identifier must be { type, value } strings");
+      if (type === "dns") {
+        if (value.indexOf("*.") === 0) throw E("acme/bad-identifier", "a wildcard *. value is not permitted in an authorization identifier (RFC 8555 sec. 7.1.4)");
+        _assertDnsName(value);
+      } else if (type === "ip") {
+        _assertIpAddress(value);
       }
-      return id;
+      return { type, value };
     }
     function _assertDnsName(name) {
       if (!_isString(name)) throw E("acme/bad-identifier", "a dns identifier value must be a string");
@@ -27010,9 +27043,11 @@ var require_acme = __commonJS({
       return jose.sign({ protected: { alg, kid: o.kid, url: o.url }, payload: _payloadBuf(o.accountJwk), key, profile: "eab-inner" });
     }
     function _validateOrderIdentifier(id) {
-      if (!_isObject(id) || !_isString(id.type) || !_isString(id.value)) throw E("acme/bad-identifier", "an order identifier must be { type, value } strings");
-      if (id.type === "dns") {
-        var v = id.value;
+      if (!_isObject(id)) throw E("acme/bad-identifier", "an order identifier must be { type, value } strings");
+      var type = id.type, value = id.value;
+      if (!_isString(type) || !_isString(value)) throw E("acme/bad-identifier", "an order identifier must be { type, value } strings");
+      if (type === "dns") {
+        var v = value;
         if (v.indexOf("*.") === 0) {
           v = v.slice(2);
           if (v.indexOf("*") !== -1) throw E("acme/bad-identifier", "a wildcard order identifier permits exactly one leading *. label (RFC 8555 sec. 7.1.3)");
@@ -27020,16 +27055,15 @@ var require_acme = __commonJS({
           throw E("acme/bad-identifier", "a wildcard must be a single leading *. label (RFC 8555 sec. 7.1.3)");
         }
         _assertDnsName(v);
-      } else if (id.type === "ip") {
-        if (id.value.indexOf("*") !== -1) throw E("acme/bad-identifier", "an ip identifier has no wildcard form (RFC 8738)");
-        _assertIpAddress(id.value);
+      } else if (type === "ip") {
+        if (value.indexOf("*") !== -1) throw E("acme/bad-identifier", "an ip identifier has no wildcard form (RFC 8738)");
+        _assertIpAddress(value);
       }
-      return id;
+      return { type, value };
     }
     function newOrder(o) {
       if (!_isObject(o) || !Array.isArray(o.identifiers) || o.identifiers.length === 0) throw E("acme/bad-order", "newOrder requires a non-empty identifiers array (RFC 8555 sec. 7.4)");
-      o.identifiers.forEach(_validateOrderIdentifier);
-      var payload = { identifiers: o.identifiers };
+      var payload = { identifiers: o.identifiers.map(_validateOrderIdentifier) };
       if (o.notBefore !== void 0) {
         if (!_isRfc3339(o.notBefore)) throw E("acme/bad-order", "notBefore must be an RFC 3339 date-time");
         payload.notBefore = o.notBefore;
@@ -27044,6 +27078,10 @@ var require_acme = __commonJS({
       }
       return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
     }
+    function newAuthz(o) {
+      if (!_isObject(o) || !_isObject(o.identifier)) throw E("acme/bad-identifier", "newAuthz requires a single identifier object (RFC 8555 sec. 7.4.1)");
+      return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, { identifier: _validateIdentifier(o.identifier) });
+    }
     async function _jwkToSpki(jwk) {
       var importAlg;
       if (jwk.kty === "EC") importAlg = { name: "ECDSA", namedCurve: jwk.crv };
@@ -27227,10 +27265,21 @@ var require_acme = __commonJS({
         throw E("acme/bad-url", "the ACME URL did not parse: " + s, e);
       }
       if (url.protocol !== "https:") throw E("acme/insecure-url", "ACME requires https (RFC 8555 sec. 6.1), got " + url.protocol + " for " + s);
+      if (((/^[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/?#]*)/.exec(s) || [])[1] || "").indexOf("@") !== -1) throw E("acme/bad-url", "an ACME URL must not contain userinfo: " + JSON.stringify(s));
       if (/[\s\\]/.test(s)) throw E("acme/bad-url", "an ACME URL must not contain whitespace or a backslash: " + JSON.stringify(s));
+      if (_uriStructurallyInvalid(s)) throw E("acme/bad-url", "an ACME URL authority is not canonical (the transport would repair it): " + JSON.stringify(s));
+      var _auth = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/?#]*)/.exec(s);
+      if (_auth) {
+        var _hp = _auth[1].slice(_auth[1].lastIndexOf("@") + 1);
+        var _rawHost = _hp.charAt(0) === "[" ? _hp.slice(0, _hp.indexOf("]") + 1) : _hp.split(":")[0];
+        if (_rawHost.toLowerCase() !== url.hostname) throw E("acme/bad-url", "an ACME URL host is not canonical (the transport would rewrite it): " + JSON.stringify(s));
+      }
       var rawPath = s.replace(/^[a-z]+:\/\/[^/?#]*/i, "").split(/[?#]/)[0];
       if (rawPath !== url.pathname) throw E("acme/bad-url", "an ACME URL path is not canonical (the transport would normalize it): " + JSON.stringify(s));
-      if (url.hash) throw E("acme/bad-url", "an ACME URL must not contain a fragment: " + JSON.stringify(s));
+      var qi = s.indexOf("?");
+      var rawQuery = qi === -1 ? "" : s.slice(qi).split("#")[0];
+      if (rawQuery !== url.search) throw E("acme/bad-url", "an ACME URL query is not canonical (the transport would normalize it): " + JSON.stringify(s));
+      if (s.indexOf("#") !== -1) throw E("acme/bad-url", "an ACME URL must not contain a fragment: " + JSON.stringify(s));
       return s;
     }
     function _resolveLocation(loc, base) {
@@ -27241,13 +27290,18 @@ var require_acme = __commonJS({
         isAbsolute = false;
       }
       if (isAbsolute) return _clientUrl(loc);
-      var abs;
+      var u;
       try {
-        abs = new URL(loc, base).href;
+        u = new URL(loc, base);
       } catch (e) {
         throw E("acme/bad-url", "the Location header did not resolve to a valid URL: " + JSON.stringify(loc), e);
       }
-      return _clientUrl(abs);
+      if (_queryRepaired(loc, u)) throw E("acme/bad-url", "a relative Link/Location query is not canonical (resolution re-encoded it): " + JSON.stringify(loc));
+      return _clientUrl(u.href);
+    }
+    function _queryRepaired(rawRef, resolvedUrl) {
+      var qi = rawRef.indexOf("?");
+      return qi !== -1 && rawRef.slice(qi).split("#")[0] !== resolvedUrl.search;
     }
     var _defaultSleep = require_sleep().sleep;
     function _clientTls(o) {
@@ -27275,6 +27329,252 @@ var require_acme = __commonJS({
       if (!out.length) throw E("acme/bad-certificate-chain", "the certificate download carried no PEM certificate (RFC 8555 sec. 7.4.2)");
       return out;
     }
+    var LINK_HEADER_MAX_BYTES = constants.BYTES.kib(8);
+    var DEFAULT_MAX_ALTERNATES = 8;
+    var LINK_TOKEN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+    function _trimOWS(s) {
+      return s.replace(/^[ \t]+/, "").replace(/[ \t]+$/, "");
+    }
+    function _validRelType(t) {
+      if (/^[A-Za-z][A-Za-z0-9.-]*$/.test(t)) return true;
+      if (LINK_URI_BADCHAR.test(t)) return false;
+      return _validAbsoluteUri(t);
+    }
+    function _validAbsoluteUri(t) {
+      return /^[A-Za-z][A-Za-z0-9+.-]*:/.test(t) && !LINK_URI_BADPCT.test(t) && !_uriStructurallyInvalid(t);
+    }
+    function _multiFragment(uri) {
+      return uri.split("#").length > 2;
+    }
+    function _authorityMultiAt(uri) {
+      var m = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/([^/?#]*)/.exec(uri);
+      return !!m && m[1].split("@").length > 2;
+    }
+    function _hasEmptyAuthority(uri) {
+      var m = /^([A-Za-z][A-Za-z0-9+.-]*:)?\/\/([^/?#]*)/.exec(uri);
+      if (!m) return false;
+      var scheme = m[1] ? m[1].slice(0, -1).toLowerCase() : "";
+      if (scheme !== "" && scheme !== "http" && scheme !== "https" && scheme !== "ws" && scheme !== "wss" && scheme !== "ftp") return false;
+      var host = m[2].slice(m[2].lastIndexOf("@") + 1);
+      if (host.charAt(0) !== "[") {
+        var ci = host.indexOf(":");
+        if (ci !== -1) host = host.slice(0, ci);
+      }
+      return host === "";
+    }
+    function _bracketsOnlyInAuthority(uri) {
+      if (uri.indexOf("[") === -1 && uri.indexOf("]") === -1) return true;
+      var m = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/(?:[^/?#@[\]]*@)?\[[^[\]]*\]/.exec(uri);
+      if (!m) return false;
+      var rest = uri.slice(m[0].length);
+      if (rest.indexOf("[") !== -1 || rest.indexOf("]") !== -1) return false;
+      var afterHost = rest.split(/[/?#]/)[0];
+      return afterHost === "" || /^:[0-9]*$/.test(afterHost);
+    }
+    function _relFirstSegHasColon(uri) {
+      if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(uri) || uri.indexOf("//") === 0) return false;
+      return uri.split(/[/?#]/)[0].indexOf(":") !== -1;
+    }
+    function _badPort(uri) {
+      var m = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/(?:[^/?#@]*@)?(?:\[[^\]]*\]|[^/?#:]*)(:[^/?#]*)?/.exec(uri);
+      return !!(m && m[1] && !/^:[0-9]*$/.test(m[1]));
+    }
+    function _badIpLiteral(uri) {
+      var m = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/(?:[^/?#@]*@)?\[([^\]]*)\]/.exec(uri);
+      if (!m) return false;
+      if (/^[vV][0-9A-Fa-f]+\.[A-Za-z0-9._~!$&'()*+,;=:-]+$/.test(m[1])) return false;
+      return !URL.canParse("http://[" + m[1] + "]/");
+    }
+    function _uriStructurallyInvalid(uri) {
+      return !_bracketsOnlyInAuthority(uri) || _hasEmptyAuthority(uri) || _authorityMultiAt(uri) || _multiFragment(uri) || _relFirstSegHasColon(uri) || _badPort(uri) || _badIpLiteral(uri);
+    }
+    function _dedupKey(href) {
+      return href.replace(/%[0-9A-Fa-f]{2}/g, function(m) {
+        var c = String.fromCharCode(parseInt(m.slice(1), 16));
+        return /[A-Za-z0-9._~-]/.test(c) ? c : "%" + m.slice(1).toUpperCase();
+      });
+    }
+    var LINK_QUOTED_INTERIOR = /^(?:[^"\\]|\\.)*$/;
+    var LINK_URI_BADCHAR = /[^A-Za-z0-9._~:/?#[\]@!$&'()*+,;=%-]/;
+    var LINK_URI_BADPCT = /%(?![0-9A-Fa-f]{2})/;
+    function _hasEncodedDotSegment(uri) {
+      var segs = uri.split(/[?#]/)[0].split("/");
+      for (var _si = 0; _si < segs.length; _si++) {
+        if (!/%2e/i.test(segs[_si])) continue;
+        var dec = segs[_si].replace(/%2e/ig, ".");
+        if (dec === "." || dec === "..") return true;
+      }
+      return false;
+    }
+    function _linkUriInvalid(uri) {
+      return LINK_URI_BADCHAR.test(uri) || LINK_URI_BADPCT.test(uri) || _hasEncodedDotSegment(uri) || _uriStructurallyInvalid(uri);
+    }
+    function _hasCtlOctet(s) {
+      for (var _ci = 0; _ci < s.length; _ci++) {
+        var _cc = s.charCodeAt(_ci);
+        if (_cc === 127 || _cc < 32 && _cc !== 9) return true;
+      }
+      return false;
+    }
+    function _splitLinkValues(s) {
+      var out = [], start = 0, inAngle = false, inQuote = false;
+      for (var i = 0; i < s.length; i++) {
+        var ch = s.charAt(i);
+        if (inQuote) {
+          if (ch === "\\") {
+            i++;
+            continue;
+          }
+          if (ch === '"') inQuote = false;
+          continue;
+        }
+        if (ch === '"') {
+          inQuote = true;
+          continue;
+        }
+        if (ch === "<") inAngle = true;
+        else if (ch === ">") inAngle = false;
+        else if (ch === "," && !inAngle) {
+          out.push(s.slice(start, i));
+          start = i + 1;
+        }
+      }
+      if (inQuote || inAngle) throw E("acme/bad-link", "the Link header has an unterminated quote or angle bracket (RFC 8288)");
+      out.push(s.slice(start));
+      return out;
+    }
+    function _splitLinkParams(rest) {
+      var parts = [], start = 0, inQuote = false;
+      for (var i = 0; i < rest.length; i++) {
+        var ch = rest.charAt(i);
+        if (inQuote) {
+          if (ch === "\\") {
+            i++;
+            continue;
+          }
+          if (ch === '"') inQuote = false;
+          continue;
+        }
+        if (ch === '"') inQuote = true;
+        else if (ch === ";") {
+          parts.push(rest.slice(start, i));
+          start = i + 1;
+        }
+      }
+      parts.push(rest.slice(start));
+      var out = [];
+      for (var j = 0; j < parts.length; j++) {
+        var p = _trimOWS(parts[j]);
+        if (p === "") {
+          if (j === 0) continue;
+          throw E("acme/bad-link", "an empty Link parameter (a ';' with no parameter) is malformed (RFC 8288): " + JSON.stringify(rest));
+        }
+        var eq = p.indexOf("=");
+        var name = (eq === -1 ? p : _trimOWS(p.slice(0, eq))).toLowerCase();
+        if (!LINK_TOKEN.test(name)) throw E("acme/bad-link", "a Link parameter name must be a token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
+        if (eq === -1) {
+          out.push({ name, value: "", hasValue: false });
+          continue;
+        }
+        var v = _trimOWS(p.slice(eq + 1));
+        if (v.length >= 2 && v.charAt(0) === '"' && v.charAt(v.length - 1) === '"') {
+          var inner = v.slice(1, -1);
+          if (!LINK_QUOTED_INTERIOR.test(inner)) throw E("acme/bad-link", "a quoted Link parameter value is malformed (an unescaped quote or dangling backslash, RFC 7230): " + JSON.stringify(p));
+          v = inner.replace(/\\(.)/g, "$1");
+        } else if (!LINK_TOKEN.test(v)) {
+          throw E("acme/bad-link", "an unquoted Link parameter value must be a non-empty token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
+        }
+        out.push({ name, value: v, hasValue: true });
+      }
+      return out;
+    }
+    function _relHasAlternate(rel) {
+      var toks = String(rel).split(" ");
+      for (var i = 0; i < toks.length; i++) {
+        if (toks[i].toLowerCase() === "alternate") return true;
+      }
+      return false;
+    }
+    function _parseLinkValue(raw) {
+      var s = _trimOWS(raw);
+      if (s === "") return null;
+      var gt = s.indexOf(">");
+      if (s.charAt(0) !== "<" || gt === -1) throw E("acme/bad-link", "a Link value must be <URI-Reference> with parameters (RFC 8288): " + JSON.stringify(raw));
+      var rest = s.slice(gt + 1).replace(/^[ \t]+/, "");
+      if (rest !== "" && rest.charAt(0) !== ";") throw E("acme/bad-link", "a Link value's parameters must be introduced by ';' (RFC 8288): " + JSON.stringify(raw));
+      var uri = s.slice(1, gt);
+      if (_linkUriInvalid(uri)) throw E("acme/bad-link", "a Link URI-Reference contains a character, percent-escape, or encoded dot-segment not permitted by RFC 3986: " + JSON.stringify(raw));
+      var params = _splitLinkParams(rest), rel = "", relSeen = false, anchor = null, anchorSeen = false;
+      for (var i = 0; i < params.length; i++) {
+        if (params[i].name === "rel" && !relSeen) {
+          rel = params[i].value;
+          relSeen = true;
+        } else if (params[i].name === "anchor") {
+          if (anchorSeen) throw E("acme/bad-link", "a Link value must not carry more than one anchor parameter (RFC 8288 sec. 3.2, ambiguous context): " + JSON.stringify(raw));
+          anchorSeen = true;
+          if (!params[i].hasValue) throw E("acme/bad-link", "a Link anchor parameter requires a URI value (RFC 8288 sec. 3.2): " + JSON.stringify(raw));
+          anchor = params[i].value;
+        }
+      }
+      return { uri, rel, anchor, relSeen };
+    }
+    function _parseLinkAlternates(headers, base) {
+      var raw = null;
+      for (var k in headers) {
+        if (Object.prototype.hasOwnProperty.call(headers, k) && k.toLowerCase() === "link") {
+          raw = headers[k];
+          break;
+        }
+      }
+      if (raw == null) return [];
+      var baseUrl = new URL(base), baseOrigin = baseUrl.origin, baseHref = baseUrl.href;
+      var fields = Array.isArray(raw) ? raw : [raw], out = [], seen = /* @__PURE__ */ Object.create(null), totalBytes = 0;
+      seen[_dedupKey(baseHref)] = true;
+      for (var fi = 0; fi < fields.length; fi++) {
+        var field = String(fields[fi]);
+        totalBytes += field.length + 1;
+        if (totalBytes > LINK_HEADER_MAX_BYTES) throw E("acme/bad-link", "the Link header(s) exceed the " + LINK_HEADER_MAX_BYTES + "-byte aggregate cap (RFC 8288, CWE-770)");
+        if (_hasCtlOctet(field)) throw E("acme/bad-link", "a Link header must not contain control octets (RFC 9110 field-value)");
+        var values = _splitLinkValues(field);
+        for (var vi = 0; vi < values.length; vi++) {
+          var lv = _parseLinkValue(values[vi]);
+          if (lv === null) continue;
+          if (lv.relSeen && lv.rel === "") throw E("acme/bad-link", "a Link rel parameter must name at least one relation-type (RFC 8288 sec. 3.3)");
+          if (lv.rel !== "" && (lv.rel.charAt(0) === " " || lv.rel.charAt(lv.rel.length - 1) === " ")) throw E("acme/bad-link", "a Link rel value has a leading or trailing space (RFC 8288 sec. 3.3): " + JSON.stringify(lv.rel));
+          var relToks = lv.rel === "" ? [] : lv.rel.split(" ");
+          for (var ri = 0; ri < relToks.length; ri++) {
+            if (relToks[ri] !== "" && !_validRelType(relToks[ri])) throw E("acme/bad-link", "a Link rel value contains a token that is not a valid relation-type (RFC 8288 sec. 3.3): " + JSON.stringify(lv.rel));
+          }
+          if (!_relHasAlternate(lv.rel)) continue;
+          if (lv.anchor != null) {
+            if (_linkUriInvalid(lv.anchor)) continue;
+            var au;
+            try {
+              au = new URL(lv.anchor, base);
+            } catch (_ae) {
+              continue;
+            }
+            if (_queryRepaired(lv.anchor, au)) continue;
+            if (au.href !== baseHref) continue;
+          }
+          var resolved;
+          try {
+            resolved = _resolveLocation(lv.uri, base);
+          } catch (e) {
+            if (e && e.code === "acme/insecure-url") throw E("acme/bad-link", 'a rel="alternate" Link target is not an https URL: ' + JSON.stringify(lv.uri), e);
+            continue;
+          }
+          var parsed = new URL(resolved);
+          if (parsed.origin !== baseOrigin) throw E("acme/bad-link", `a rel="alternate" Link target is not on the certificate download's origin (SSRF guard): ` + JSON.stringify(lv.uri));
+          var key = _dedupKey(parsed.href);
+          if (!seen[key]) {
+            seen[key] = true;
+            out.push(resolved);
+          }
+        }
+      }
+      return out;
+    }
     function client(directoryUrl, opts) {
       opts = opts || {};
       if (!opts.accountKey) throw E("acme/bad-input", "client requires opts.accountKey (the account private key)");
@@ -27479,6 +27779,21 @@ var require_acme = __commonJS({
           });
         });
       }
+      function _newAuthz(identifier) {
+        return Promise.resolve().then(function() {
+          var canon = _validateIdentifier(identifier);
+          return _resource("newAuthz").then(function(url) {
+            return _post(url, newAuthz, { identifier: canon }, "kid", void 0, [200, 201]).then(function(res) {
+              var loc = res.headers["location"];
+              if (!_isString(loc)) throw E("acme/no-authorization-url", "newAuthz did not return an authorization URL in a Location header (RFC 8555 sec. 7.4.1)");
+              var authz = validate("authorization", _json(res));
+              if (!authz.identifier || authz.identifier.type !== canon.type || authz.identifier.value !== canon.value || authz.wildcard === true) throw E("acme/identifier-mismatch", "the returned authorization does not match the requested identifier (RFC 8555 sec. 7.4.1)");
+              if (authz.status !== "pending" && authz.status !== "valid") throw E("acme/unexpected-authorization-status", "newAuthz returned an authorization that is neither pending nor already valid (status " + JSON.stringify(authz.status) + "); RFC 8555 sec. 7.4.1");
+              return { authorization: authz, url: _resolveLocation(loc, url) };
+            });
+          });
+        });
+      }
       function _getOrder(url) {
         return _postAsGet(_clientUrl(url)).then(function(res) {
           return validate("order", _json(res));
@@ -27547,13 +27862,53 @@ var require_acme = __commonJS({
       function _pollAuthorization(url, budget) {
         return _poll("authorization", url, budget);
       }
-      function _downloadCertificate(url) {
-        return _post(_clientUrl(url), postAsGet, null, "kid", "application/pem-certificate-chain").then(function(res) {
-          if (res.status !== 200) throw _serverProblem(res);
-          var ctToken = String(res.headers["content-type"] || "").split(";")[0].trim().toLowerCase();
-          if (ctToken !== "application/pem-certificate-chain") throw E("acme/bad-certificate-chain", "the certificate download returned an unexpected media type " + JSON.stringify(ctToken) + " (expected application/pem-certificate-chain, RFC 8555 sec. 7.4.2)");
-          var chain = _splitPemChain(_bodyText(res));
-          return { certificate: chain[0], chain: chain.slice(1), certificates: chain, alternates: [] };
+      function _readCertChain(res) {
+        var ctToken = String(res.headers["content-type"] || "").split(";")[0].trim().toLowerCase();
+        if (ctToken !== "application/pem-certificate-chain") throw E("acme/bad-certificate-chain", "the certificate download returned an unexpected media type " + JSON.stringify(ctToken) + " (expected application/pem-certificate-chain, RFC 8555 sec. 7.4.2)");
+        var chain = _splitPemChain(_bodyText(res));
+        return { certificate: chain[0], chain: chain.slice(1), certificates: chain };
+      }
+      function _fetchCertChain(url) {
+        return _post(url, postAsGet, null, "kid", "application/pem-certificate-chain").then(_readCertChain);
+      }
+      function _downloadCertificate(url, opts2) {
+        opts2 = opts2 || {};
+        return Promise.resolve().then(function() {
+          var select = opts2.selectChain;
+          if (select !== void 0 && typeof select !== "function") throw E("acme/bad-input", "downloadCertificate opts.selectChain must be a function");
+          var maxAlt = guard.limits.cap(opts2.maxAlternates, "maxAlternates", DEFAULT_MAX_ALTERNATES, { E, code: "acme/bad-input", min: 0, max: 64 });
+          var dlUrl = _clientUrl(url);
+          return _post(dlUrl, postAsGet, null, "kid", "application/pem-certificate-chain").then(function(res) {
+            var primary = _readCertChain(res);
+            var alternates = [], linkError = null;
+            try {
+              alternates = _parseLinkAlternates(res.headers, dlUrl);
+            } catch (e) {
+              linkError = e;
+            }
+            function result(cand) {
+              return { certificate: cand.certificate, chain: cand.chain, certificates: cand.certificates, alternates };
+            }
+            if (!select) return result(primary);
+            return Promise.resolve(select(primary)).then(function(primaryMatch) {
+              if (primaryMatch) return result(primary);
+              if (linkError) throw linkError;
+              var leaf = primary.certificate, toFetch = alternates.slice(0, maxAlt), overBudget = alternates.length > maxAlt, idx = 0;
+              function next() {
+                if (idx >= toFetch.length) {
+                  if (overBudget) throw E("acme/too-many-alternates", "no acceptable chain within the maxAlternates=" + maxAlt + " fetch budget (RFC 8555 sec. 7.4.2, CWE-770)");
+                  throw E("acme/no-matching-chain", "no downloaded chain satisfied selectChain (RFC 8555 sec. 7.4.2)");
+                }
+                return _fetchCertChain(toFetch[idx++]).then(function(cand) {
+                  if (!cand.certificate.equals(leaf)) throw E("acme/bad-alternate", "an alternate chain did not start with the same end-entity certificate (RFC 8555 sec. 7.4.2)");
+                  return Promise.resolve(select(cand)).then(function(m) {
+                    return m ? result(cand) : next();
+                  });
+                });
+              }
+              return next();
+            });
+          });
         });
       }
       function _revokeCert(o) {
@@ -27607,10 +27962,19 @@ var require_acme = __commonJS({
           });
         });
       }
-      function _renewalInfo(certDer) {
+      function _renewalInfo(certDer, clockFn, retryAfterCapSeconds) {
         if (!Buffer.isBuffer(certDer)) throw E("acme/bad-input", "renewalInfo requires a DER certificate Buffer");
+        var _rawClk = typeof clockFn === "function" ? clockFn : clock;
+        function clk() {
+          var t = _rawClk();
+          if (typeof t !== "number" || !isFinite(t)) throw E("acme/bad-input", "the renewalInfo clock returned a non-finite value");
+          return t;
+        }
+        var notAfterMs = x509.parse(certDer).validity.notAfter.getTime();
+        if (clk() > notAfterMs) throw E("acme/certificate-expired", "the certificate is already past its notAfter; a client MUST NOT check RenewalInfo after it has expired (RFC 9773 sec. 4.3)");
         var certId = ariCertId(certDer);
         return _resource("renewalInfo").then(function(base) {
+          if (clk() > notAfterMs) throw E("acme/certificate-expired", "the certificate expired before the RenewalInfo request could be issued; a client MUST NOT check RenewalInfo after expiry (RFC 9773 sec. 4.3)");
           var u = new URL(base);
           u.pathname = u.pathname.replace(/\/+$/, "") + "/" + certId;
           var url = _clientUrl(u.href);
@@ -27619,15 +27983,73 @@ var require_acme = __commonJS({
             var obj = validateRenewalInfo(_json(res));
             var ra = res.headers["retry-after"];
             var retryAfterSeconds = null;
-            if (typeof ra === "string" && ra.trim() !== "") retryAfterSeconds = retryAfter.parse(ra, { now: clock(), E, code: "acme/bad-retry-after" }).retryAfterSeconds;
+            if (typeof ra === "string" && ra.trim() !== "") {
+              var raOpts = { now: clk(), E, code: "acme/bad-retry-after" };
+              if (typeof retryAfterCapSeconds === "number") {
+                raOpts.cap = retryAfterCapSeconds;
+                raOpts.lenient = true;
+              }
+              retryAfterSeconds = retryAfter.parse(ra, raOpts).retryAfterSeconds;
+            }
             return { renewalInfo: obj, retryAfterSeconds };
           });
         });
       }
+      function _renewalWindow(certDer, o) {
+        o = o || {};
+        return Promise.resolve().then(function() {
+          if (!Buffer.isBuffer(certDer)) throw E("acme/bad-input", "renewalWindow requires a DER certificate Buffer");
+          if (o.random !== void 0 && typeof o.random !== "function") throw E("acme/bad-input", "renewalWindow opts.random must be a function returning a number in [0, 1]");
+          if (o.clock !== void 0 && typeof o.clock !== "function") throw E("acme/bad-input", "renewalWindow opts.clock must be a function returning epoch milliseconds");
+          if (o.replaced !== void 0 && typeof o.replaced !== "boolean") throw E("acme/bad-input", "renewalWindow opts.replaced must be a boolean");
+          if (o.previous !== void 0 && !_isObject(o.previous)) throw E("acme/bad-input", "renewalWindow opts.previous must be a prior renewalWindow result object");
+          var _clk = typeof o.clock === "function" ? o.clock : clock;
+          function clk() {
+            var t = _clk();
+            if (typeof t !== "number" || !isFinite(t)) throw E("acme/bad-input", "the renewalWindow clock returned a non-finite value");
+            return t;
+          }
+          var notAfter = x509.parse(certDer).validity.notAfter;
+          var now = clk();
+          if (now > notAfter.getTime()) throw E("acme/certificate-expired", "the certificate is already past its notAfter; there is nothing to renew (RFC 9773 sec. 4.3)");
+          if (o.replaced === true) throw E("acme/certificate-replaced", "the caller asserts this certificate has already been replaced (RFC 9773 sec. 4.3)");
+          return _renewalInfo(certDer, clk, RENEWAL_RETRY_MAX_SECONDS).then(function(ri) {
+            var w = ri.renewalInfo.suggestedWindow;
+            var startMs = Date.parse(w.start), endMs = Date.parse(w.end);
+            var notAfterMs = notAfter.getTime();
+            var effEnd = Math.min(endMs, notAfterMs), effStart = Math.min(startMs, effEnd);
+            var pw = o.previous && _isObject(o.previous.suggestedWindow) ? o.previous.suggestedWindow : null;
+            var selectedMs;
+            if (pw && pw.start === w.start && pw.end === w.end && _isString(o.previous.selectedTime)) {
+              var prevMs = Date.parse(o.previous.selectedTime);
+              if (!isFinite(prevMs)) throw E("acme/bad-input", "renewalWindow opts.previous.selectedTime must be an RFC 3339 date-time");
+              selectedMs = Math.max(effStart, Math.min(effEnd, prevMs));
+            } else {
+              var draw = o.random ? o.random() : _defaultRandom();
+              if (typeof draw !== "number" || !(draw >= 0 && draw <= 1)) throw E("acme/bad-input", "renewalWindow opts.random must return a number in [0, 1]");
+              selectedMs = Math.round(effStart + draw * (effEnd - effStart));
+            }
+            var retryAfterSeconds = ri.retryAfterSeconds == null ? RENEWAL_RETRY_DEFAULT_SECONDS : Math.max(RENEWAL_RETRY_MIN_SECONDS, Math.min(RENEWAL_RETRY_MAX_SECONDS, ri.retryAfterSeconds));
+            return {
+              suggestedWindow: w,
+              selectedTime: new Date(selectedMs).toISOString(),
+              // Decide renew-now against a FRESH clock read: the RenewalInfo GET may itself span the selected
+              // instant, so the pre-fetch `now` (used above only for the expiry gate) could be stale here. Also
+              // renew now when the SELECTED instant lands at or past notAfter -- whether the whole window opened
+              // after expiry or a straddling window's draw hit the clamp endpoint, there is no margin left, so
+              // waiting for the (clamped) time would leave the cert to expire unrenewed.
+              renewNow: selectedMs <= clk() || selectedMs >= notAfterMs,
+              retryAfterSeconds,
+              explanationURL: _isString(ri.renewalInfo.explanationURL) ? ri.renewalInfo.explanationURL : null
+            };
+          });
+        });
+      }
       return {
         directory: _directory,
         newAccount: _newAccount,
         newOrder: _newOrder,
+        newAuthz: _newAuthz,
         getOrder: _getOrder,
         getAuthorization: _getAuthorization,
         getChallenge: _getChallenge,
@@ -27640,7 +28062,8 @@ var require_acme = __commonJS({
         deactivateAccount: _deactivateAccount,
         deactivateAuthorization: _deactivateAuthorization,
         keyChange: _keyChange,
-        renewalInfo: _renewalInfo
+        renewalInfo: _renewalInfo,
+        renewalWindow: _renewalWindow
       };
     }
     module2.exports = {
@@ -27660,6 +28083,7 @@ var require_acme = __commonJS({
       newAccount,
       externalAccountBinding,
       newOrder,
+      newAuthz,
       finalize,
       challengeResponse,
       deactivate,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.8",
+  "version": "0.18.10",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:58122d84-2312-4802-ade5-95a30059fda2",
+  "serialNumber": "urn:uuid:52e564cd-e4bc-440f-bd6c-a12a68c4102e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-02T12:19:34.917Z",
+    "timestamp": "2026-08-03T20:26:23.786Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.8",
+      "bom-ref": "@blamejs/core@0.18.10",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.8",
+      "version": "0.18.10",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.8",
+      "purl": "pkg:npm/%40blamejs/core@0.18.10",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.8",
+      "ref": "@blamejs/core@0.18.10",
       "dependsOn": []
     }
   ]