@blamejs/pki 0.5.31 → 0.5.32

package/lib/acme.js

@@ -74,12 +74,143 @@ var _concat = intrinsic.concat;
 var _split = intrinsic.uncurry(String.prototype.split);
 var _parseIntI = intrinsic.parseInt;
 var _numToString = intrinsic.numberToString;
-var _reTest = intrinsic.uncurry(RegExp.prototype.test);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _charAt = intrinsic.uncurry(String.prototype.charAt);
 var pkgVersion = require("../package.json").version;
 
+// Charset tables + character-scan validators/trimmers replacing acme's rule-#11 regexes. The token / link-token
+// tables feed pkix.allCharsIn (a NON-EMPTY string of only these characters); the rest scan by character code.
+var _TOKEN_TABLE = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-");   // ^[A-Za-z0-9_-]
+var _LINK_TOKEN_TABLE = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&'*+.^_`|~-");   // RFC 7230 tchar
+function _isHex1to4(s) {   // /^[0-9a-f]{1,4}$/
+  var n = s.length;
+  if (n < 1 || n > 4) return false;
+  for (var i = 0; i < n; i++) { var c = _charCodeAt(s, i); if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 102))) return false; }
+  return true;
+}
+function _looksLikeIpv4(s) {   // /^\d{1,3}(\.\d{1,3}){3}$/ -- a loose dotted quad (octets are not range-checked)
+  var n = s.length, i = 0, octet, d;
+  for (octet = 0; octet < 4; octet++) {
+    if (octet > 0) { if (i >= n || _charCodeAt(s, i) !== 0x2e) return false; i++; }
+    for (d = 0; i < n && _charCodeAt(s, i) >= 48 && _charCodeAt(s, i) <= 57 && d < 3; d++) i++;
+    if (d < 1) return false;
+  }
+  return i === n;
+}
+function _countAtSigns(s) { var c = 0; for (var i = 0; i < s.length; i++) { if (_charCodeAt(s, i) === 0x40) c++; } return c; }   // (s.match(/@/g)||[]).length
+function _stripLeadingOWS(s, from) {   // s.slice(from).replace(/^[ \t]+/, "")
+  var i = from;
+  while (i < s.length && (_charCodeAt(s, i) === 0x20 || _charCodeAt(s, i) === 0x09)) i++;
+  return _strSlice(s, i);
+}
+function _stripTrailingSlash(s) {   // s.replace(/\/+$/, "")
+  var end = s.length;
+  while (end > 0 && _charCodeAt(s, end - 1) === 0x2f) end--;
+  return _strSlice(s, 0, end);
+}
+// /^(?:[^"\\]|\\.)*$/ : a valid quoted-string interior -- no unescaped '"', every '\' escapes a following
+// NON-line-terminator character (the regex '.' matches no line terminator), and no dangling final '\'.
+function _isValidQuotedInterior(s) {
+  var i = 0, n = s.length;
+  while (i < n) {
+    var c = _charCodeAt(s, i);
+    if (c === 0x22) return false;
+    if (c === 0x5c) {
+      if (i + 1 >= n) return false;
+      var nx = _charCodeAt(s, i + 1);
+      if (nx === 0x0a || nx === 0x0d || nx === 0x2028 || nx === 0x2029) return false;
+      i += 2;
+    } else i += 1;
+  }
+  return true;
+}
+// Shared character predicates for the scheme / label / URL scans below.
+function _isAlpha(c) { return (c >= 65 && c <= 90) || (c >= 97 && c <= 122); }
+function _isAlnumLower(c) { return (c >= 97 && c <= 122) || (c >= 48 && c <= 57); }
+function _isSchemeChar(c) { return _isAlpha(c) || (c >= 48 && c <= 57) || c === 0x2b || c === 0x2e || c === 0x2d; }   // [A-Za-z0-9+.-]
+// /^https?:\/\/[^\s]+$/ : lowercase http(s), "://", then >=1 non-whitespace character to the end.
+function _isHttpUrlShape(v) {
+  var n = v.length;
+  if (!(_charCodeAt(v, 0) === 0x68 && _charCodeAt(v, 1) === 0x74 && _charCodeAt(v, 2) === 0x74 && _charCodeAt(v, 3) === 0x70)) return false;
+  var i = 4;
+  if (_charCodeAt(v, i) === 0x73) i++;
+  if (_charCodeAt(v, i) !== 0x3a || _charCodeAt(v, i + 1) !== 0x2f || _charCodeAt(v, i + 2) !== 0x2f) return false;
+  i += 3;
+  if (i >= n) return false;
+  for (; i < n; i++) { if (pkix.isJsWhitespace(_charCodeAt(v, i))) return false; }
+  return true;
+}
+// /^[a-zA-Z][a-zA-Z0-9+.-]*:[^\s]+$/ : an RFC 3986 scheme, ":", then >=1 non-whitespace character to the end.
+function _isUriShape(v) {
+  var n = v.length;
+  if (n === 0 || !_isAlpha(_charCodeAt(v, 0))) return false;
+  var i = 1;
+  while (i < n && _isSchemeChar(_charCodeAt(v, i))) i++;
+  if (i >= n || _charCodeAt(v, i) !== 0x3a) return false;
+  i++;
+  if (i >= n) return false;
+  for (; i < n; i++) { if (pkix.isJsWhitespace(_charCodeAt(v, i))) return false; }
+  return true;
+}
+// /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/ : a DNS label -- first and last characters alphanumeric-lowercase, the
+// interior characters additionally allowing '-'.
+function _isLdhLabel(l) {
+  var n = l.length;
+  if (n === 0 || !_isAlnumLower(_charCodeAt(l, 0)) || !_isAlnumLower(_charCodeAt(l, n - 1))) return false;
+  for (var i = 1; i < n - 1; i++) { var c = _charCodeAt(l, i); if (!(_isAlnumLower(c) || c === 0x2d)) return false; }
+  return true;
+}
+// /^xn--[a-z0-9]+(-[a-z0-9]+)*$/ : an A-label -- "xn--" then hyphen-separated non-empty alphanumeric-lowercase runs.
+function _isXnLabel(l) {
+  var n = l.length;
+  if (!(n >= 4 && _charCodeAt(l, 0) === 0x78 && _charCodeAt(l, 1) === 0x6e && _charCodeAt(l, 2) === 0x2d && _charCodeAt(l, 3) === 0x2d)) return false;
+  var i = 4, g = 0;
+  while (i < n && _isAlnumLower(_charCodeAt(l, i))) { i++; g++; }
+  if (g < 1) return false;
+  while (i < n) {
+    if (_charCodeAt(l, i) !== 0x2d) return false;
+    i++; var g2 = 0;
+    while (i < n && _isAlnumLower(_charCodeAt(l, i))) { i++; g2++; }
+    if (g2 < 1) return false;
+  }
+  return true;
+}
+// /^(0|[1-9]\d{0,2})$/ : a canonical decimal octet -- a single digit, or 2-3 digits with no leading zero.
+function _isCanonicalOctet(s) {
+  var n = s.length;
+  if (n === 0 || n > 3) return false;
+  if (n === 1) { var c0 = _charCodeAt(s, 0); return c0 >= 48 && c0 <= 57; }
+  if (!(_charCodeAt(s, 0) >= 49 && _charCodeAt(s, 0) <= 57)) return false;
+  for (var i = 1; i < n; i++) { var c = _charCodeAt(s, i); if (!(c >= 48 && c <= 57)) return false; }
+  return true;
+}
+// /[\s\\]/ : contains a whitespace character or a backslash.
+function _hasWsOrBackslash(s) {
+  for (var i = 0; i < s.length; i++) { var c = _charCodeAt(s, i); if (c === 0x5c || pkix.isJsWhitespace(c)) return true; }
+  return false;
+}
+// /^[A-Za-z][A-Za-z0-9+.-]*:/ : begins with an RFC 3986 scheme followed by ':' (a prefix test, not anchored at end).
+function _hasSchemePrefix(uri) {
+  var n = uri.length;
+  if (n === 0 || !_isAlpha(_charCodeAt(uri, 0))) return false;
+  var i = 1;
+  while (i < n && _isSchemeChar(_charCodeAt(uri, i))) i++;
+  return i < n && _charCodeAt(uri, i) === 0x3a;
+}
+// uri.split(/[/?#]/)[0] : the substring up to the first '/', '?', or '#' (the whole string if none).
+function _uriFirstSegment(uri) {
+  for (var i = 0; i < uri.length; i++) { var c = _charCodeAt(uri, i); if (c === 0x2f || c === 0x3f || c === 0x23) return _strSlice(uri, 0, i); }
+  return uri;
+}
+// Does `s` end with the literal `suffix`? (/suffix$/ for a fixed suffix.)
+function _endsWith(s, suffix) {
+  var n = s.length, m = suffix.length;
+  if (m > n) return false;
+  for (var i = 0; i < m; i++) { if (_charCodeAt(s, n - m + i) !== _charCodeAt(suffix, i)) return false; }
+  return true;
+}
+
 var AcmeError = frameworkError.AcmeError;
 function E(code, message, cause) { return new AcmeError(code, message, cause); }
 
@@ -112,7 +243,7 @@ function _isUrl(v) {
   // silently repairs " https://.." (trim) and "https:host/.." (insert //), and the
   // original string is what gets copied into a protected `url` field, so a repaired
   // value must be rejected here, never accepted and mismatched at transport time.
-  if (!_isString(v) || !/^https?:\/\/[^\s]+$/.test(v)) return false;
+  if (!_isString(v) || !_isHttpUrlShape(v)) return false;
   var u;
   // A parse failure is the "not a URL" verdict for this boolean predicate. There
   // is no PkiError here to thread a cause into, so the error is intentionally ignored.
@@ -123,7 +254,7 @@ function _isUrl(v) {
 // A URI string with any RFC 3986 scheme (mailto:, tel:, http(s):, ...). An account
 // `contact` is a URI, most commonly `mailto:` (RFC 8555 sec. 7.1.2 / RFC 6068), so
 // it must not be narrowed to http(s); the strict mailto hygiene lives in the builder.
-function _isUriString(v) { return _isString(v) && /^[a-zA-Z][a-zA-Z0-9+.-]*:[^\s]+$/.test(v); }
+function _isUriString(v) { return _isString(v) && _isUriShape(v); }
 
 // ---- resource object specs (RFC 8555 sec. 7.1.x) -------------------------
 
@@ -232,7 +363,11 @@ function _checkType(kind, field, value, obj) {
 // lowercase-kebab): a camelCase kind like "renewalInfo" must become
 // "renewal-info", never leak "acme/bad-renewalInfo" (which the PkiError code
 // validator rejects, turning a fault into a raw TypeError).
-function _codeSlug(kind) { return kind.replace(/([A-Z])/g, "-$1").toLowerCase(); }
+function _codeSlug(kind) {   // camelCase -> kebab-case: kind.replace(/([A-Z])/g, "-$1").toLowerCase()
+  var out = "";
+  for (var i = 0; i < kind.length; i++) { var c = _charCodeAt(kind, i); if (c >= 65 && c <= 90) out += "-"; out += _charAt(kind, i); }
+  return _lower(out);
+}
 
 // Validate an object against a spec table. Returns the object; throws acme/*.
 function _validate(kind, obj) {
@@ -288,8 +423,8 @@ function _assertDnsName(name) {
   for (var i = 0; i < labels.length; i++) {
     var l = labels[i];
     if (l.length > 63) throw E("acme/bad-identifier", "a dns label must be 1..63 characters (RFC 1035 sec. 2.3.4): " + JSON.stringify(l));
-    if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(l)) throw E("acme/bad-identifier", "a dns label must be lowercase LDH ASCII (A-label): " + JSON.stringify(l));
-    if (l.indexOf("xn--") === 0 && !/^xn--[a-z0-9]+(-[a-z0-9]+)*$/.test(l)) throw E("acme/bad-identifier", "a malformed xn-- A-label: " + JSON.stringify(l));
+    if (!_isLdhLabel(l)) throw E("acme/bad-identifier", "a dns label must be lowercase LDH ASCII (A-label): " + JSON.stringify(l));
+    if (l.indexOf("xn--") === 0 && !_isXnLabel(l)) throw E("acme/bad-identifier", "a malformed xn-- A-label: " + JSON.stringify(l));
   }
 }
 
@@ -300,10 +435,10 @@ function _assertDnsName(name) {
 // normalized-and-guessed.
 function _assertIpAddress(value) {
   if (!_isString(value)) throw E("acme/bad-identifier", "an ip identifier value must be a string");
-  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(value)) {
+  if (_looksLikeIpv4(value)) {
     var parts = value.split(".");
     for (var i = 0; i < 4; i++) {
-      if (!/^(0|[1-9]\d{0,2})$/.test(parts[i]) || parseInt(parts[i], 10) > 255) throw E("acme/bad-identifier", "an ip identifier IPv4 octet is out of range or non-canonical: " + JSON.stringify(value));
+      if (!_isCanonicalOctet(parts[i]) || parseInt(parts[i], 10) > 255) throw E("acme/bad-identifier", "an ip identifier IPv4 octet is out of range or non-canonical: " + JSON.stringify(value));
     }
     return;
   }
@@ -337,7 +472,7 @@ function _canonicalizeIpv6(value) {
   if (groups.length !== 8) return null;
   var nums = [];
   for (var i = 0; i < 8; i++) {
-    if (!_reTest(/^[0-9a-f]{1,4}$/, groups[i])) return null;
+    if (!_isHex1to4(groups[i])) return null;
     _push(nums, _parseIntI(groups[i], 16));
   }
   var hex = _mapI(nums, function (n) { return _numToString(n, 16); });
@@ -503,9 +638,8 @@ function identify(obj) {
 // A challenge token: >= 128 bits of entropy => >= 22 base64url chars, alphabet
 // only, no `=` (RFC 8555 sec. 8, errata 6950). Validated BEFORE any use (also the
 // http-01 reflection-XSS guard).
-var TOKEN_RE = new RegExp("^[A-Za-z0-9_-]{" + constants.LIMITS.ACME_TOKEN_MIN_CHARS + ",}$");
 function _assertToken(token) {
-  if (!_isString(token) || !TOKEN_RE.test(token)) throw E("acme/bad-token", "a challenge token must be >= " + constants.LIMITS.ACME_TOKEN_MIN_CHARS + " base64url characters with no padding (RFC 8555 sec. 8)");
+  if (!_isString(token) || token.length < constants.LIMITS.ACME_TOKEN_MIN_CHARS || !pkix.allCharsIn(token, _TOKEN_TABLE)) throw E("acme/bad-token", "a challenge token must be >= " + constants.LIMITS.ACME_TOKEN_MIN_CHARS + " base64url characters with no padding (RFC 8555 sec. 8)");
 }
 
 async function _sha256(bytes) { return Buffer.from(await subtle.digest("SHA-256", bytes)); }
@@ -769,7 +903,7 @@ function _assertContacts(contacts) {
       var addr = c.slice("mailto:".length);
       if (addr.indexOf("?") !== -1) throw E("acme/bad-contact", "a mailto contact must not carry header fields (RFC 8555 sec. 7.3 / RFC 6068)");
       if (addr.indexOf(",") !== -1) throw E("acme/bad-contact", "a mailto contact must be a single addr-spec, not a comma list (RFC 8555 sec. 7.3)");
-      if ((addr.match(/@/g) || []).length !== 1) throw E("acme/bad-contact", "a mailto contact must be exactly one addr-spec");
+      if (_countAtSigns(addr) !== 1) throw E("acme/bad-contact", "a mailto contact must be exactly one addr-spec");
     }
   });
 }
@@ -1024,7 +1158,7 @@ function _csrIdentifierSet(parsedCsr) {
 // RFC 5952 / RFC 8738 form is neither a usable dns name nor a canonical ip identifier, and it is
 // refused rather than normalized -- the same rule the ip identifier validator applies.
 function _addCommonName(set, cn, what) {
-  var looksIp = _reTest(/^\d{1,3}(\.\d{1,3}){3}$/, cn) || intrinsic.stringIndexOf(cn, ":") !== -1;
+  var looksIp = _looksLikeIpv4(cn) || intrinsic.stringIndexOf(cn, ":") !== -1;
   // An address in a common name adds no identity of its own. Address matching reads the iPAddress
   // subjectAltName and never falls back to the common name, so a subject naming the ordered address
   // only there cannot authenticate it. What the ordinary IP certificate does -- CABF TLS BR
@@ -1169,8 +1303,9 @@ function _assertCsrIdentifiers(parsedCsr, identifiers) {
  *   await pki.acme.finalize({ key, alg: "ES256", nonce, url, kid, csr: csrDer, identifiers, accountJwk });
  */
 async function finalize(o) {
-  if (!_isObject(o) || !Buffer.isBuffer(o.csr)) throw E("acme/bad-input", "finalize requires a DER CSR Buffer (opts.csr)");
-  var parsed = csr.parse(o.csr);                         // strict DER; rejects PEM/garbage
+  if (!_isObject(o) || !guard.bytes.isByteSource(o.csr)) throw E("acme/bad-input", "finalize requires a DER CSR BufferSource (opts.csr)");
+  var csrBuf = guard.bytes.snapshotSource(o.csr, E, "acme/bad-input", "the finalize CSR");
+  var parsed = csr.parse(csrBuf);                         // strict DER; rejects PEM/garbage
   if (o.accountJwk !== undefined) {
     var accountSpki = await _jwkToSpki(o.accountJwk);
     if (parsed.subjectPublicKeyInfo && Buffer.isBuffer(parsed.subjectPublicKeyInfo.bytes) &&
@@ -1183,7 +1318,7 @@ async function finalize(o) {
     o.identifiers.forEach(_validateOrderIdentifier);   // caller-supplied -> validate before comparing (no raw TypeError)
     _assertCsrIdentifiers(parsed, o.identifiers);
   }
-  var payload = { csr: jose.base64url.encode(o.csr) };
+  var payload = { csr: jose.base64url.encode(csrBuf) };
   return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
 }
 
@@ -1270,12 +1405,13 @@ function deactivate(o) {
  */
 function revokeCert(o) {
   return _promised(function () {
-  if (!_isObject(o) || !Buffer.isBuffer(o.certificate)) throw E("acme/bad-input", "revokeCert requires a DER certificate Buffer (opts.certificate)");
-  x509.parse(o.certificate);                              // structural validation of the target
+  if (!_isObject(o) || !guard.bytes.isByteSource(o.certificate)) throw E("acme/bad-input", "revokeCert requires a DER certificate BufferSource (opts.certificate)");
+  var certBuf = guard.bytes.snapshotSource(o.certificate, E, "acme/bad-input", "the revokeCert certificate");
+  x509.parse(certBuf);                                    // structural validation of the target
   var hasKid = _hasOwn(o, "kid");
   var hasJwk = _hasOwn(o, "jwk");
   if (hasKid === hasJwk) throw E("acme/bad-input", "revokeCert must be signed with EXACTLY ONE of the account kid or the certificate jwk (RFC 8555 sec. 7.6)");
-  var payload = { certificate: jose.base64url.encode(o.certificate) };
+  var payload = { certificate: jose.base64url.encode(certBuf) };
   if (o.reason !== undefined) {
     if (typeof o.reason !== "number" || !isFinite(o.reason) || Math.floor(o.reason) !== o.reason || CRL_REASONS.indexOf(o.reason) === -1) {
       throw E("acme/bad-revocation-reason", "reason must be an assigned RFC 5280 CRLReason (0-6, 8-10; value 7 is unassigned)");
@@ -1360,7 +1496,7 @@ async function keyChange(o) {
  *   pki.acme.ariCertId(certDer);   // -> "<b64u-aki>.<b64u-serial>"
  */
 function ariCertId(certDer) {
-  if (!Buffer.isBuffer(certDer)) throw E("acme/bad-input", "ariCertId requires a DER certificate Buffer");
+  if (!guard.bytes.isByteSource(certDer)) throw E("acme/bad-input", "ariCertId requires a DER certificate BufferSource");
   var cert = x509.parse(certDer);
   var akiExt = (cert.extensions || []).filter(function (e) { return e.oid === OID_AKI; })[0];
   if (!akiExt) throw E("acme/bad-certid", "the certificate has no authorityKeyIdentifier extension (RFC 9773 sec. 4.1)");
@@ -1451,11 +1587,12 @@ function _clientUrl(urlStr) {
   // (RFC 8555 sec. 6.4); refuse it rather than sign a credential-bearing URL that steers nothing. Test the RAW
   // authority for a literal "@", not url.username/password: an EMPTY userinfo ("https://@host", "https://:@host")
   // leaves both empty while the verbatim URL still carries the "@" the transport drops.
-  if (((/^[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/?#]*)/.exec(s) || [])[1] || "").indexOf("@") !== -1) throw E("acme/bad-url", "an ACME URL must not contain userinfo: " + JSON.stringify(s));
+  var _uAuth = _uriAuthority(s, true);
+  if (intrinsic.stringIndexOf(_uAuth ? _uAuth.authority : "", "@") !== -1) throw E("acme/bad-url", "an ACME URL must not contain userinfo: " + JSON.stringify(s));
   // Reject a spelling the transport would REPAIR into a different path -- whitespace (WHATWG percent-
   // encodes or trims it) or a backslash (rewritten to `/`). The transport re-parses the URL to the
   // normalized path while the JWS `url` keeps the original, so the signed and requested URLs would differ.
-  if (/[\s\\]/.test(s)) throw E("acme/bad-url", "an ACME URL must not contain whitespace or a backslash: " + JSON.stringify(s));
+  if (_hasWsOrBackslash(s)) throw E("acme/bad-url", "an ACME URL must not contain whitespace or a backslash: " + JSON.stringify(s));
   // The path/query round-trip checks below cover only pathname+search; apply the shared structural authority
   // guard too, so a repaired AUTHORITY (a bracket in userinfo -- "a[b@host" -> "a%5Bb@host", a double "@") is
   // rejected on THIS direct path (a directory / Location / caller URL) exactly as the Link-alternate path
@@ -1469,9 +1606,9 @@ function _clientUrl(urlStr) {
   // a different (often loopback / internal, an SSRF-adjacent) address. Compare the raw host (ASCII-lowercased, the
   // only tolerated normalization) to the parsed hostname: uppercase-host and a default :443 still match, an IPv4
   // coercion or a non-canonical IPv6 literal does not. (path/query/fragment are checked separately below.)
-  var _auth = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/?#]*)/.exec(s);
+  var _auth = _uriAuthority(s, true);
   if (_auth) {
-    var _hp = _auth[1].slice(_auth[1].lastIndexOf("@") + 1);   // strip any userinfo (does not route the request)
+    var _hp = _auth.authority.slice(_auth.authority.lastIndexOf("@") + 1);   // strip any userinfo (does not route the request)
     var _rawHost = _hp.charAt(0) === "[" ? _hp.slice(0, _hp.indexOf("]") + 1) : _hp.split(":")[0];   // strip the port
     if (_rawHost.toLowerCase() !== url.hostname) throw E("acme/bad-url", "an ACME URL host is not canonical (the transport would rewrite it): " + JSON.stringify(s));
   }
@@ -1483,7 +1620,8 @@ function _clientUrl(urlStr) {
   // whose verbatim `s` (no slash) differs from the `/` the transport requests. (The authority may still
   // normalize -- a default :443 port, an uppercase host -- as that does not change the path; an encoded char
   // like `%41` or a dot inside a segment name round-trips unchanged.)
-  var rawPath = s.replace(/^[a-z]+:\/\/[^/?#]*/i, "").split(/[?#]/)[0];
+  var _pathStart = _rawPathStart(s);
+  var rawPath = _strSlice(s, _pathStart, _firstDelim(s, _pathStart, 0x3f, 0x23, -1));
   if (rawPath !== url.pathname) throw E("acme/bad-url", "an ACME URL path is not canonical (the transport would normalize it): " + JSON.stringify(s));
   // The query round-trips too (the transport sends pathname+search): an EMPTY query ("...?") -- which WHATWG
   // drops (url.search === "") while the verbatim URL keeps the "?" -- or any query the parser would rewrite
@@ -1541,22 +1679,26 @@ function _clientTls(o) {
   return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
 }
 // Split a PEM certificate chain (RFC 8555 sec. 7.4.2 application/pem-certificate-chain) into its DER certs.
+var PEM_CERT_BEGIN = "-----BEGIN CERTIFICATE-----";
+var PEM_CERT_END = "-----END CERTIFICATE-----";
 function _splitPemChain(text) {
   var out = [];
-  var re = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
-  var m;
-  var lastEnd = 0;
-  while ((m = re.exec(text)) !== null) {
+  var lastEnd = 0, from = 0, begin, end;
+  // Each block is the shortest BEGIN..END span (the lazy /BEGIN[\s\S]*?END/g scan by literal index).
+  while ((begin = intrinsic.stringIndexOf(text, PEM_CERT_BEGIN, from)) !== -1 &&
+         (end = intrinsic.stringIndexOf(text, PEM_CERT_END, begin + PEM_CERT_BEGIN.length)) !== -1) {
+    var blockEnd = end + PEM_CERT_END.length;
     // application/pem-certificate-chain is ONLY PEM blocks separated by whitespace (RFC 8555 sec. 7.4.2) --
     // no explanatory text before, between, or after; reject any non-whitespace outside a block.
-    if (text.slice(lastEnd, m.index).trim() !== "") throw E("acme/bad-certificate-chain", "the certificate chain contained non-whitespace text outside a PEM block (RFC 8555 sec. 7.4.2)");
+    if (text.slice(lastEnd, begin).trim() !== "") throw E("acme/bad-certificate-chain", "the certificate chain contained non-whitespace text outside a PEM block (RFC 8555 sec. 7.4.2)");
     var der;
     // Decode the armor AND structurally parse it: valid PEM armor can wrap arbitrary base64, so without
     // the strict X.509 parse the download could return non-certificate bytes as the issued certificate.
-    try { der = x509.pemDecode(m[0], "CERTIFICATE"); x509.parse(der); }
+    try { der = x509.pemDecode(_strSlice(text, begin, blockEnd), "CERTIFICATE"); x509.parse(der); }
     catch (e) { throw E("acme/bad-certificate-chain", "a downloaded certificate did not decode as a valid X.509 certificate (RFC 8555 sec. 7.4.2)", e); }
     out.push(der);
-    lastEnd = re.lastIndex;
+    lastEnd = blockEnd;
+    from = blockEnd;
   }
   if (text.slice(lastEnd).trim() !== "") throw E("acme/bad-certificate-chain", "the certificate chain contained trailing non-whitespace text outside a PEM block (RFC 8555 sec. 7.4.2)");
   if (!out.length) throw E("acme/bad-certificate-chain", "the certificate download carried no PEM certificate (RFC 8555 sec. 7.4.2)");
@@ -1568,19 +1710,125 @@ function _splitPemChain(text) {
 // (CWE-770 fetch amplification), the same posture as maxRedirects.
 var LINK_HEADER_MAX_BYTES = constants.BYTES.kib(8);
 var DEFAULT_MAX_ALTERNATES = 8;
-// An RFC 7230 token (a Link parameter name, or an unquoted parameter value): 1*tchar, no whitespace/specials.
-var LINK_TOKEN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
 // Trim only HTTP OWS -- SP (0x20) and HTAB (0x09) -- NOT arbitrary Unicode whitespace. String.prototype.trim
 // would strip an NBSP (obs-text) and other Unicode spaces, letting them masquerade as field whitespace.
-function _trimOWS(s) { return s.replace(/^[ \t]+/, "").replace(/[ \t]+$/, ""); }
+function _trimOWS(s) {   // s.replace(/^[ \t]+/, "").replace(/[ \t]+$/, "")
+  var a = 0, b = s.length;
+  while (a < b && (_charCodeAt(s, a) === 0x20 || _charCodeAt(s, a) === 0x09)) a++;
+  while (b > a && (_charCodeAt(s, b - 1) === 0x20 || _charCodeAt(s, b - 1) === 0x09)) b--;
+  return _strSlice(s, a, b);
+}
+// ---- URI / percent / Link character-scan helpers (rule #11: no regex) ----
+var _URIREF_TBL = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._~:/?#[]@!$&'()*+,;=%-");   // RFC 3986 URI-Reference allowed set
+var _UNRES_TBL = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._~-");   // RFC 3986 unreserved
+var _IPVF_TBL = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._~!$&'()*+,;=:-");   // IPvFuture tail chars
+var _HEX_TBL = pkix.charTable("0123456789ABCDEFabcdef");   // hex digit, by table lookup (not an OR-chain)
+function _hexVal(c) { if (c >= 48 && c <= 57) return c - 48; if (c >= 65 && c <= 70) return c - 55; return c - 87; }
+function _upperHexChar(c) { return (c >= 97 && c <= 102) ? c - 32 : c; }
+// The RFC 3986 authority front-half shared by every authority check: an optional (or, when schemeRequired,
+// mandatory) scheme, "//", then the authority up to the first "/?#". Returns null when there is no "//".
+function _uriAuthority(uri, schemeRequired) {
+  var n = uri.length, i = 0, schemeEnd = -1, j;
+  if (n > 0 && _isAlpha(_charCodeAt(uri, 0))) {
+    j = 1;
+    while (j < n && _isSchemeChar(_charCodeAt(uri, j))) j++;
+    if (j < n && _charCodeAt(uri, j) === 0x3a) schemeEnd = j;
+  }
+  if (schemeEnd !== -1) {
+    if (_charCodeAt(uri, schemeEnd + 1) === 0x2f && _charCodeAt(uri, schemeEnd + 2) === 0x2f) i = schemeEnd + 1;
+    else if (schemeRequired) return null;
+    else { schemeEnd = -1; i = 0; }
+  }
+  if (schemeRequired && schemeEnd === -1) return null;
+  if (_charCodeAt(uri, i) !== 0x2f || _charCodeAt(uri, i + 1) !== 0x2f) return null;
+  var authStart = i + 2, authEnd = authStart;
+  while (authEnd < n) { var c = _charCodeAt(uri, authEnd); if (c === 0x2f || c === 0x3f || c === 0x23) break; authEnd++; }
+  return { scheme: schemeEnd === -1 ? "" : _strSlice(uri, 0, schemeEnd + 1), authorityStart: authStart, authorityEnd: authEnd, authority: _strSlice(uri, authStart, authEnd) };
+}
+// The first index at/after `from` whose code is one of the (up to three) delimiters, else the string length.
+function _firstDelim(s, from, d0, d1, d2) { for (var i = from; i < s.length; i++) { var c = _charCodeAt(s, i); if (c === d0 || c === d1 || c === d2) return i; } return s.length; }
+// /^:[0-9]*$/ : ":" then zero or more digits (an empty port ":" passes).
+function _isNumericPort(s) { if (s.length === 0 || _charCodeAt(s, 0) !== 0x3a) return false; for (var i = 1; i < s.length; i++) { var c = _charCodeAt(s, i); if (c < 48 || c > 57) return false; } return true; }
+// /^[vV][0-9A-Fa-f]+\.[A-Za-z0-9._~!$&'()*+,;=:-]+$/ : a valid RFC 3986 IPvFuture literal interior.
+function _isIpvFuture(s) {
+  var n = s.length, i = 1, h = 0, g = 0;
+  if (n === 0 || (_charCodeAt(s, 0) !== 0x76 && _charCodeAt(s, 0) !== 0x56)) return false;
+  while (i < n) { if (_HEX_TBL[_charCodeAt(s, i)]) { i++; h++; } else break; }
+  if (h < 1 || i >= n || _charCodeAt(s, i) !== 0x2e) return false;
+  i++;
+  while (i < n) { if (_IPVF_TBL[_charCodeAt(s, i)]) { i++; g++; } else break; }
+  return g >= 1 && i === n;
+}
+// The prefix ^(?:scheme:)?//(?:[^/?#@[\]]*@)?\[[^[\]]*\] : optional scheme, "//", optional BRACKET-EXCLUDING
+// userinfo, then an IP-literal host. Returns the index past "]" (the match length from 0) or -1.
+function _matchBracketAuthPrefix(uri) {
+  var a = _uriAuthority(uri, false);
+  if (!a) return -1;
+  var n = uri.length, i = a.authorityStart, save = i, k = i, uiOk = true, c;
+  while (k < n) { c = _charCodeAt(uri, k); if (c === 0x40) break; if (c === 0x2f || c === 0x3f || c === 0x23 || c === 0x5b || c === 0x5d) { uiOk = false; break; } k++; }
+  if (uiOk && k < n && _charCodeAt(uri, k) === 0x40) i = k + 1; else i = save;
+  if (_charCodeAt(uri, i) !== 0x5b) return -1;
+  i++;
+  while (i < n) { c = _charCodeAt(uri, i); if (c === 0x5b || c === 0x5d) break; i++; }
+  if (i >= n || _charCodeAt(uri, i) !== 0x5d) return -1;
+  return i + 1;
+}
+// The prefix ^(?:scheme:)?//(?:[^/?#@]*@)?\[([^\]]*)\] : optional scheme, "//", optional BRACKET-PERMITTING
+// userinfo, then an IP-literal host. Returns the interior (between "[" and "]") or null.
+function _ipLiteralInterior(uri) {
+  var a = _uriAuthority(uri, false);
+  if (!a) return null;
+  var n = uri.length, save = a.authorityStart, k = save, c, bracketAt;
+  while (k < n) { c = _charCodeAt(uri, k); if (c === 0x2f || c === 0x3f || c === 0x23 || c === 0x40) break; k++; }
+  if (k < n && _charCodeAt(uri, k) === 0x40 && _charCodeAt(uri, k + 1) === 0x5b) bracketAt = k + 1;
+  else if (_charCodeAt(uri, save) === 0x5b) bracketAt = save;
+  else return null;
+  var start = bracketAt + 1, p = start;
+  while (p < n && _charCodeAt(uri, p) !== 0x5d) p++;
+  if (p >= n) return null;
+  return _strSlice(uri, start, p);
+}
+// s.replace(/^[a-z]+:\/\/[^/?#]*/i, "") -> the index where the path begins (0 if there is no scheme+"//").
+function _rawPathStart(s) {
+  var n = s.length, i = 0;
+  while (i < n && _isAlpha(_charCodeAt(s, i))) i++;
+  if (i === 0) return 0;
+  if (_charCodeAt(s, i) !== 0x3a || _charCodeAt(s, i + 1) !== 0x2f || _charCodeAt(s, i + 2) !== 0x2f) return 0;
+  i += 3;
+  while (i < n) { var c = _charCodeAt(s, i); if (c === 0x2f || c === 0x3f || c === 0x23) break; i++; }
+  return i;
+}
+// Does `s` contain a character NOT in `table`? (A bespoke false-on-empty scan: !pkix.allCharsIn would wrongly
+// report an empty string as carrying a bad character.)
+function _hasCharOutside(s, table) { for (var i = 0; i < s.length; i++) { if (!table[_charCodeAt(s, i)]) return true; } return false; }
+// /%(?![0-9A-Fa-f]{2})/ : a "%" NOT introducing a valid pct-escape (two hex digits).
+function _hasBadPct(s) { for (var i = 0; i < s.length; i++) { if (_charCodeAt(s, i) === 0x25 && !(_HEX_TBL[_charCodeAt(s, i + 1)] && _HEX_TBL[_charCodeAt(s, i + 2)])) return true; } return false; }
+// /^[A-Za-z][A-Za-z0-9.-]*$/ : an RFC 8288 reg-rel-type (a letter then letters / digits / "." / "-").
+function _isRegRelType(t) { var n = t.length; if (n === 0 || !_isAlpha(_charCodeAt(t, 0))) return false; for (var i = 1; i < n; i++) { var c = _charCodeAt(t, i); if (!(_isAlpha(c) || (c >= 48 && c <= 57) || c === 0x2e || c === 0x2d)) return false; } return true; }
+// Fold every "%2e"/"%2E" in a path segment to "." (that specific dot escape, NOT a general pct-decode); records
+// whether any fold occurred (the /%2e/i prefilter). Returns { decoded, folded }.
+function _foldPct2e(seg) { var out = "", i = 0, n = seg.length, folded = false; while (i < n) { if (_charCodeAt(seg, i) === 0x25 && _charCodeAt(seg, i + 1) === 0x32 && (_charCodeAt(seg, i + 2) === 0x65 || _charCodeAt(seg, i + 2) === 0x45)) { out += "."; folded = true; i += 3; } else { out += _charAt(seg, i); i += 1; } } return { decoded: out, folded: folded }; }
+// inner.replace(/\\(.)/g, "$1") : unescape RFC 7230 quoted-pairs ("\x" -> "x"). "\" + a line terminator is left
+// intact (the regex "." matches no line terminator), as is a dangling final "\".
+function _unescapeQuotedPair(inner) {
+  var out = "", i = 0, n = inner.length;
+  while (i < n) {
+    if (_charCodeAt(inner, i) === 0x5c && i + 1 < n) {
+      var nx = _charCodeAt(inner, i + 1);
+      if (nx === 0x0a || nx === 0x0d || nx === 0x2028 || nx === 0x2029) { out += _charAt(inner, i); i += 1; }
+      else { out += _charAt(inner, i + 1); i += 2; }
+    } else { out += _charAt(inner, i); i += 1; }
+  }
+  return out;
+}
 // Is `t` a valid RFC 8288 sec. 3.3 relation-type -- a reg-rel-type (a letter then LDH, compared case-
 // insensitively) OR an ext-rel-type (an absolute URI: a scheme then ':', AND a canonical RFC 3986 reference so
 // a scheme prefix alone is not enough, e.g. "http:%ZZ" is rejected for its malformed pct-escape)? "@" is neither.
 function _validRelType(t) {
-  if (/^[A-Za-z][A-Za-z0-9.-]*$/.test(t)) return true;   // reg-rel-type
+  if (_isRegRelType(t)) return true;   // reg-rel-type
   // ext-rel-type: a full absolute URI. A relation type is an identifier, never resolved, so a percent-encoded dot
   // (%2e) is a legal char (not a dot-segment); other than that its structure must be a valid absolute URI.
-  if (LINK_URI_BADCHAR.test(t)) return false;
+  if (_hasCharOutside(t, _URIREF_TBL)) return false;
   return _validAbsoluteUri(t);
 }
 // Is `t` a valid RFC 3986 ABSOLUTE URI (a relation-type identifier, never connected to)? A scheme, valid pct-
@@ -1591,7 +1839,7 @@ function _validRelType(t) {
 // numeric reg-name "1.2.3.4.5", a 16-bit port cap, IPvFuture, an empty reg-name "foo://user@/"); WHATWG is used
 // only inside _badIpLiteral to validate an IPv6 literal, the one place it is correct.
 function _validAbsoluteUri(t) {
-  return /^[A-Za-z][A-Za-z0-9+.-]*:/.test(t) && !LINK_URI_BADPCT.test(t) && !_uriStructurallyInvalid(t);
+  return _hasSchemePrefix(t) && !_hasBadPct(t) && !_uriStructurallyInvalid(t);
 }
 // A URI carries at most ONE "#" (the fragment delimiter); a fragment cannot itself contain "#" (RFC 3986 sec.
 // 3.5), so a second literal "#" is invalid, which WHATWG ACCEPTS by folding the rest into the fragment. A pct-
@@ -1600,8 +1848,11 @@ function _multiFragment(uri) { return uri.split("#").length > 2; }
 // The authority (after "//", optionally after a scheme, up to the next "/?#") carries at most one "@" (userinfo
 // "@" host); a second literal "@" is invalid RFC 3986, which WHATWG ACCEPTS while rewriting the first "@".
 function _authorityMultiAt(uri) {
-  var m = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/([^/?#]*)/.exec(uri);
-  return !!m && m[1].split("@").length > 2;
+  var a = _uriAuthority(uri, false);
+  if (!a) return false;
+  var cnt = 0;
+  for (var i = 0; i < a.authority.length; i++) { if (_charCodeAt(a.authority, i) === 0x40) cnt++; }
+  return cnt >= 2;
 }
 // A URI whose scheme REQUIRES an authority (or a scheme-relative reference, which inherits one -- always https
 // here) must have a NON-EMPTY authority. A "//" immediately followed by "/", "?", "#", or end is an empty
@@ -1609,14 +1860,14 @@ function _authorityMultiAt(uri) {
 // "////acme.example/p" -> host "acme.example"; "http:///relations" -> host "relations"). A scheme that legitimately
 // allows an empty authority (file:///path, or any non-authority scheme) is NOT flagged.
 function _hasEmptyAuthority(uri) {
-  var m = /^([A-Za-z][A-Za-z0-9+.-]*:)?\/\/([^/?#]*)/.exec(uri);
-  if (!m) return false;
-  var scheme = m[1] ? m[1].slice(0, -1).toLowerCase() : "";   // "" == scheme-relative (inherits the https base)
+  var a = _uriAuthority(uri, false);
+  if (!a) return false;
+  var scheme = a.scheme === "" ? "" : a.scheme.slice(0, -1).toLowerCase();   // "" == scheme-relative (inherits the https base)
   if (scheme !== "" && scheme !== "http" && scheme !== "https" && scheme !== "ws" && scheme !== "wss" && scheme !== "ftp") return false;
   // The HOST itself (the authority with any userinfo and port stripped) must be non-empty -- not only the char
   // right after "//": "https://user@/x" and "https://:443/x" have an empty host after the userinfo / before the
   // port, which WHATWG rejects (or repairs) for a special scheme.
-  var host = m[2].slice(m[2].lastIndexOf("@") + 1);
+  var host = a.authority.slice(a.authority.lastIndexOf("@") + 1);
   if (host.charAt(0) !== "[") { var ci = host.indexOf(":"); if (ci !== -1) host = host.slice(0, ci); }
   return host === "";
 }
@@ -1629,32 +1880,43 @@ function _bracketsOnlyInAuthority(uri) {
   // A raw "[" / "]" is NOT permitted in userinfo (RFC 3986 sec. 3.2.1/3.2.2 -- the IP-literal host is the ONLY place
   // square brackets are allowed), so the userinfo class excludes them; otherwise "a[b@[::1]" (which WHATWG repairs
   // to "a%5Bb@[::1]") would anchor on the real host and slip.
-  var m = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/(?:[^/?#@[\]]*@)?\[[^[\]]*\]/.exec(uri);
-  if (!m) return false;
-  var rest = uri.slice(m[0].length);
+  var mlen = _matchBracketAuthPrefix(uri);
+  if (mlen === -1) return false;
+  var rest = _strSlice(uri, mlen);
   if (rest.indexOf("[") !== -1 || rest.indexOf("]") !== -1) return false;   // no bracket past the authority
   // After the IP-literal HOST "]", the rest of the authority (up to the next "/?#") may be ONLY an optional numeric
   // ":port". Anything else -- an "@" ("[::1]:80@host" / "[::1]@host", where "[::1]" is a bracketed userinfo, invalid
   // RFC 3986), a non-numeric port, or trailing host text -- means the literal sits in an invalid position, which
   // WHATWG would re-parse to a DIFFERENT host.
-  var afterHost = rest.split(/[/?#]/)[0];
-  return afterHost === "" || /^:[0-9]*$/.test(afterHost);
+  var afterHost = _strSlice(rest, 0, _firstDelim(rest, 0, 0x2f, 0x3f, 0x23));
+  return afterHost === "" || _isNumericPort(afterHost);
 }
 // A relative-PATH reference (no scheme, no "//" authority) whose FIRST path segment contains a ":" is a
 // path-noscheme violation (RFC 3986 sec. 3.3 / 4.2: the first segment "cannot contain a colon (':') character",
 // as it would be mistaken for a scheme). ":foo" or "1x:y" is such a case, which WHATWG resolves against the base
 // (same-origin) rather than rejecting. A real scheme ("foo:bar") is handled by the scheme/https gates, not here.
 function _relFirstSegHasColon(uri) {
-  if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(uri) || uri.indexOf("//") === 0) return false;
-  return uri.split(/[/?#]/)[0].indexOf(":") !== -1;
+  if (_hasSchemePrefix(uri) || uri.indexOf("//") === 0) return false;
+  return _uriFirstSegment(uri).indexOf(":") !== -1;
 }
 // The authority port (":" after the host, before the next "/?#") must be *DIGIT (RFC 3986 sec. 3.2.3). A
 // non-numeric port ("host:bad") is malformed -- the character + structural checks otherwise miss it, and WHATWG
 // rejects it only on connect (so a fetched target would be skipped rather than failing closed). An empty port
 // (":") and a missing port are fine.
 function _badPort(uri) {
-  var m = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/(?:[^/?#@]*@)?(?:\[[^\]]*\]|[^/?#:]*)(:[^/?#]*)?/.exec(uri);
-  return !!(m && m[1] && !/^:[0-9]*$/.test(m[1]));
+  var a = _uriAuthority(uri, false);
+  if (!a) return false;
+  var auth = a.authority, n = auth.length, i = 0, at = -1, hostEnd, e;
+  for (var u = 0; u < n; u++) { if (_charCodeAt(auth, u) === 0x40) { at = u; break; } }   // userinfo up to first "@"
+  if (at !== -1) i = at + 1;
+  if (i < n && _charCodeAt(auth, i) === 0x5b) {   // IP-literal host "[...]"
+    e = i + 1;
+    while (e < n && _charCodeAt(auth, e) !== 0x5d) e++;
+    if (e < n) hostEnd = e + 1;
+    else { hostEnd = i; while (hostEnd < n && _charCodeAt(auth, hostEnd) !== 0x3a) hostEnd++; }
+  } else { hostEnd = i; while (hostEnd < n && _charCodeAt(auth, hostEnd) !== 0x3a) hostEnd++; }   // reg-name up to ":"
+  if (hostEnd >= n || _charCodeAt(auth, hostEnd) !== 0x3a) return false;   // no port
+  return !_isNumericPort(_strSlice(auth, hostEnd));
 }
 // An IP-literal host "[...]" must CONTAIN a valid IPv6 address or IPvFuture (RFC 3986 sec. 3.2.2) -- "[not-ip]",
 // "[]", "[garbage]" are malformed, which the bracket-placement check alone accepts (it only confirms the brackets
@@ -1662,10 +1924,10 @@ function _badPort(uri) {
 // failing closed). IPvFuture is checked by grammar; an IPv6 by WHATWG (which parses it correctly). `URL.canParse`
 // never throws, so no swallow.
 function _badIpLiteral(uri) {
-  var m = /^(?:[A-Za-z][A-Za-z0-9+.-]*:)?\/\/(?:[^/?#@]*@)?\[([^\]]*)\]/.exec(uri);
-  if (!m) return false;
-  if (/^[vV][0-9A-Fa-f]+\.[A-Za-z0-9._~!$&'()*+,;=:-]+$/.test(m[1])) return false;   // valid IPvFuture
-  return !URL.canParse("http://[" + m[1] + "]/");
+  var interior = _ipLiteralInterior(uri);
+  if (interior === null) return false;
+  if (_isIpvFuture(interior)) return false;   // valid IPvFuture
+  return !URL.canParse("http://[" + interior + "]/");
 }
 // The RFC 3986 STRUCTURAL rules a URI-reference must satisfy that WHATWG would otherwise silently REPAIR (accept
 // while rewriting) or reject only on connect: brackets only in an authority IP-literal, a non-empty authority, at
@@ -1681,32 +1943,27 @@ function _uriStructurallyInvalid(uri) {
 // "%61" == "a") and UPPERCASE the hex of any other escape (sec. 6.2.2.1), so equivalent spellings collapse to one
 // signed fetch (CWE-770). fromCharCode keeps the source pure-ASCII while matching a runtime byte.
 function _dedupKey(href) {
-  return href.replace(/%[0-9A-Fa-f]{2}/g, function (m) {
-    var c = String.fromCharCode(parseInt(m.slice(1), 16));
-    return /[A-Za-z0-9._~-]/.test(c) ? c : "%" + m.slice(1).toUpperCase();
-  });
+  var out = "", i = 0, n = href.length;
+  while (i < n) {
+    if (_charCodeAt(href, i) === 0x25 && _HEX_TBL[_charCodeAt(href, i + 1)] && _HEX_TBL[_charCodeAt(href, i + 2)]) {
+      var h1 = _charCodeAt(href, i + 1), h2 = _charCodeAt(href, i + 2), v = (_hexVal(h1) << 4) | _hexVal(h2);
+      if (_UNRES_TBL[v]) out += String.fromCharCode(v);                                          // decode an unreserved escape
+      else out += "%" + String.fromCharCode(_upperHexChar(h1)) + String.fromCharCode(_upperHexChar(h2));   // else uppercase the hex
+      i += 3;
+    } else { out += _charAt(href, i); i += 1; }
+  }
+  return out;
 }
-// The INTERIOR of a well-formed RFC 7230 quoted-string (between the DQUOTEs): a sequence of qdtext (any char
-// but `"`/`\`) and quoted-pair (`\` + a char). Rejects an unescaped interior quote (a""b) or a dangling `\`,
-// which first/last-char-is-a-quote alone would miss. Disjoint alternation -> linear, no ReDoS.
-var LINK_QUOTED_INTERIOR = /^(?:[^"\\]|\\.)*$/;
-// A character NOT permitted raw in an RFC 3986 URI-Reference (unreserved / reserved / pct-encode marker). A
-// Link target containing one -- a space, brace, backslash, control char -- is one WHATWG URL parsing would
-// silently repair (trim / percent-encode) on resolution, masking a malformed or off-path value; reject it.
-var LINK_URI_BADCHAR = /[^A-Za-z0-9._~:/?#[\]@!$&'()*+,;=%-]/;
-// A `%` that does NOT introduce a valid RFC 3986 pct-encoded triplet (%HEXDIG HEXDIG): the char allowlist
-// permits `%` for percent-encoding, but `%ZZ` / a trailing `%` is malformed and URL parsing would repair it.
-var LINK_URI_BADPCT = /%(?![0-9A-Fa-f]{2})/;
 // A path SEGMENT that decodes to "." or ".." via a percent-encoded dot (`%2e`): URL resolution decodes `%2e`
 // to `.` for dot-segment removal, so an encoded `..` silently becomes a path traversal that changes the
 // resolved target. Reject only such an encoded dot-SEGMENT -- an encoded dot elsewhere (a filename `0%2ex` ->
 // `0.x`) is a valid target, and a LITERAL `.`/`..` segment resolves transparently. Path only (before ?/#).
 function _hasEncodedDotSegment(uri) {
-  var segs = uri.split(/[?#]/)[0].split("/");
+  var segs = _split(_strSlice(uri, 0, _firstDelim(uri, 0, 0x3f, 0x23, -1)), "/");
   for (var _si = 0; _si < segs.length; _si++) {
-    if (!/%2e/i.test(segs[_si])) continue;
-    var dec = segs[_si].replace(/%2e/ig, ".");
-    if (dec === "." || dec === "..") return true;
+    var r = _foldPct2e(segs[_si]);
+    if (!r.folded) continue;
+    if (r.decoded === "." || r.decoded === "..") return true;
   }
   return false;
 }
@@ -1715,7 +1972,7 @@ function _hasEncodedDotSegment(uri) {
 function _linkUriInvalid(uri) {
   // A bracket in a resolved target/anchor is valid only in an authority IP-literal (a same-origin IPv6/IPvFuture
   // cert URL is legal); in a path it is invalid and WHATWG would repair it by percent-encoding.
-  return LINK_URI_BADCHAR.test(uri) || LINK_URI_BADPCT.test(uri) || _hasEncodedDotSegment(uri) || _uriStructurallyInvalid(uri);
+  return _hasCharOutside(uri, _URIREF_TBL) || _hasBadPct(uri) || _hasEncodedDotSegment(uri) || _uriStructurallyInvalid(uri);
 }
 // A control octet forbidden in an HTTP field-value (RFC 9110): any C0 control except HTAB, plus DEL. Checked
 // by code point (not a control-char regex) to keep the source pure ASCII and clear of eslint no-control-regex.
@@ -1761,7 +2018,7 @@ function _splitLinkParams(rest) {
     var name = (eq === -1 ? p : _trimOWS(p.slice(0, eq))).toLowerCase();
     // A parameter NAME is a token (RFC 8288 / RFC 7230): reject whitespace / specials rather than accept a
     // malformed "bad name=x" as a silently-ignored parameter that masks the value grammar below.
-    if (!LINK_TOKEN.test(name)) throw E("acme/bad-link", "a Link parameter name must be a token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
+    if (!pkix.allCharsIn(name, _LINK_TOKEN_TABLE)) throw E("acme/bad-link", "a Link parameter name must be a token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
     // A valueless token parameter is VALID: RFC 8288 link-param = token BWS [ "=" BWS ( token / quoted-string ) ]
     // -- the value is OPTIONAL. Keep it as an empty-valued extension param (it is never `rel`, so it is ignored).
     // (An EMPTY part -- a `;` with no token at all, e.g. `;;` -- was already rejected above.)
@@ -1769,9 +2026,9 @@ function _splitLinkParams(rest) {
     var v = _trimOWS(p.slice(eq + 1));
     if (v.length >= 2 && v.charAt(0) === "\"" && v.charAt(v.length - 1) === "\"") {
       var inner = v.slice(1, -1);   // a quoted-string may hold a space-separated list (RFC 8288)
-      if (!LINK_QUOTED_INTERIOR.test(inner)) throw E("acme/bad-link", "a quoted Link parameter value is malformed (an unescaped quote or dangling backslash, RFC 7230): " + JSON.stringify(p));
-      v = inner.replace(/\\(.)/g, "$1");
-    } else if (!LINK_TOKEN.test(v)) {
+      if (!_isValidQuotedInterior(inner)) throw E("acme/bad-link", "a quoted Link parameter value is malformed (an unescaped quote or dangling backslash, RFC 7230): " + JSON.stringify(p));
+      v = _unescapeQuotedPair(inner);
+    } else if (!pkix.allCharsIn(v, _LINK_TOKEN_TABLE)) {
       // An UNQUOTED value is a single NON-EMPTY RFC 7230 token -- no whitespace/specials, and an empty value
       // (`foo=`) is not a token (an empty value must be quoted, `foo=""`). Reject a malformed one rather than
       // split-and-match it as if it were a quoted relation list.
@@ -1800,7 +2057,7 @@ function _parseLinkValue(raw) {
   // After the "<URI>" the remainder is *( OWS ";" OWS link-param ) -- so, past any leading whitespace, it is
   // empty or begins with ';'. Any other trailing text (a param not introduced by ';', e.g. "<uri>rel=...") is
   // malformed and MUST NOT be leniently read as a parameter.
-  var rest = s.slice(gt + 1).replace(/^[ \t]+/, "");
+  var rest = _stripLeadingOWS(s, gt + 1);
   if (rest !== "" && rest.charAt(0) !== ";") throw E("acme/bad-link", "a Link value's parameters must be introduced by ';' (RFC 8288): " + JSON.stringify(raw));
   var uri = s.slice(1, gt);
   // A URI-Reference carries only RFC 3986 characters; WHATWG URL parsing would silently REPAIR anything else
@@ -2044,7 +2301,7 @@ function client(directoryUrl, opts) {
     while (nonces.length >= CLIENT_MAX_NONCE_POOL) nonces.shift();   // evict the oldest, bound the pool (CWE-770)
     nonces.push(v);
   }
-  function _isProblem(res) { return /application\/problem\+json/i.test(String(res.headers["content-type"] || "")); }
+  function _isProblem(res) { return intrinsic.stringIndexOf(_lower(String(res.headers["content-type"] || "")), "application/problem+json") !== -1; }   // ci substring (ASCII content-type)
   function _serverProblem(res) {
     var prob = null;
     try { prob = jose.parseJson(_jsonInput(res)); if (_isObject(prob)) validateProblem(prob); }
@@ -2143,7 +2400,7 @@ function client(directoryUrl, opts) {
             var prob = null;
             try { prob = jose.parseJson(_jsonInput(res)); }
             catch (_e) { /* allow:swallow-unverified a non-JSON problem body is not a badNonce; prob stays null, falling through to the typed acme/server-problem throw */ }
-            if (prob && typeof prob.type === "string" && /:badNonce$/.test(prob.type) && attempt < maxNonceRetries) { attempt++; return once(); }
+            if (prob && typeof prob.type === "string" && _endsWith(prob.type, ":badNonce") && attempt < maxNonceRetries) { attempt++; return once(); }
           }
           throw _serverProblem(res);
         }
@@ -2308,11 +2565,11 @@ function client(directoryUrl, opts) {
   function _bindingSpec(opts) {
     var spki = opts.expectedSpki, ids = opts.identifiers, req = opts.requireBinding;
     if (spki !== undefined) {
-      if (!_isBuffer(spki)) throw E("acme/bad-input", "downloadCertificate opts.expectedSpki must be a DER SubjectPublicKeyInfo Buffer");
+      if (!guard.bytes.isByteSource(spki)) throw E("acme/bad-input", "downloadCertificate opts.expectedSpki must be a DER SubjectPublicKeyInfo BufferSource");
       // SNAPSHOT: the comparison happens after a network round trip, so a retained reference would let
       // the caller rewrite the key the certificate is checked against once the request had gone out --
       // rejecting the right certificate, or accepting one minted for the replacement bytes.
-      spki = guard.bytes.snapshot(spki, AcmeError, "acme/bad-input", "downloadCertificate expectedSpki");
+      spki = guard.bytes.snapshotSource(spki, AcmeError, "acme/bad-input", "downloadCertificate expectedSpki");
     }
     if (ids !== undefined) {
       if (!_isArrayI(ids) || ids.length === 0) throw E("acme/bad-input", "downloadCertificate opts.identifiers must be the non-empty order identifier array");
@@ -2431,7 +2688,7 @@ function client(directoryUrl, opts) {
     // uniform for a .catch caller rather than throwing synchronously.
     return _promised(function () {
       o = _gateOpts(o, _METHOD_OPTS.revoke, "revokeCert");
-      if (!Buffer.isBuffer(o.certificate)) throw E("acme/bad-input", "revokeCert requires a DER certificate Buffer (opts.certificate)");
+      if (!guard.bytes.isByteSource(o.certificate)) throw E("acme/bad-input", "revokeCert requires a DER certificate BufferSource (opts.certificate)");
       // Certificate-key mode (RFC 8555 sec. 7.6) needs the COMPLETE triple certKey + certJwk + certAlg: an
       // incomplete set must NOT fall through to the account-key path (wrong credential), and certAlg must be
       // explicit -- inheriting the account alg would sign a different-family certificate key under the wrong
@@ -2483,7 +2740,7 @@ function client(directoryUrl, opts) {
     return _promised(function () { return _renewalInfoBody(certDer, clockFn, retryAfterCapSeconds); });
   }
   function _renewalInfoBody(certDer, clockFn, retryAfterCapSeconds) {
-    if (!Buffer.isBuffer(certDer)) throw E("acme/bad-input", "renewalInfo requires a DER certificate Buffer");
+    if (!guard.bytes.isByteSource(certDer)) throw E("acme/bad-input", "renewalInfo requires a DER certificate BufferSource");
     var _rawClk = typeof clockFn === "function" ? clockFn : clock;   // renewalWindow may pass a per-call clock
     // The clock MUST return finite epoch ms: a NaN / Infinity would make the expiry comparison below silently
     // false and bypass the RFC 9773 sec. 4.3 gate, so the validating wrapper fails closed on a non-finite value.
@@ -2502,7 +2759,7 @@ function client(directoryUrl, opts) {
       // Append the certID to the PATH, before any query string (RFC 9773): a directory renewalInfo URL may
       // carry a query, so string concatenation would push the certID into the query rather than the path.
       var u = new URL(base);
-      u.pathname = u.pathname.replace(/\/+$/, "") + "/" + certId;
+      u.pathname = _stripTrailingSlash(u.pathname) + "/" + certId;
       var url = _clientUrl(u.href);
       return _send("GET", url, { accept: "application/json" }, null).then(function (res) {
         if (res.status !== 200) throw _serverProblem(res);
@@ -2529,7 +2786,7 @@ function client(directoryUrl, opts) {
   function _renewalWindow(certDer, o) {
     return Promise.resolve().then(function () {
       o = _gateOpts(o, _METHOD_OPTS.renewalWindow, "renewalWindow");
-      if (!Buffer.isBuffer(certDer)) throw E("acme/bad-input", "renewalWindow requires a DER certificate Buffer");
+      if (!guard.bytes.isByteSource(certDer)) throw E("acme/bad-input", "renewalWindow requires a DER certificate BufferSource");
       if (o.random !== undefined && typeof o.random !== "function") throw E("acme/bad-input", "renewalWindow opts.random must be a function returning a number in [0, 1]");
       if (o.clock !== undefined && typeof o.clock !== "function") throw E("acme/bad-input", "renewalWindow opts.clock must be a function returning epoch milliseconds");
       // replaced is the sec. 4.3 "MUST NOT act on a replaced certificate" signal: require a real boolean so a