@blamejs/pki 0.6.13 → 0.6.15

package/lib/est.js

@@ -63,9 +63,9 @@ var x509 = require("./schema-x509");
 var pkcs8 = require("./schema-pkcs8");
 var key = require("./key");
 var csr = require("./schema-csr");
-var csrattrsFmt = require("./schema-csrattrs");   // aliased: the `csrattrs` name is the verb + the public export
-var cmcVerify = require("./cmc-verify");          // /fullcmc interprets its response through the CMC layer
-var cmcFmt = require("./schema-cmc");             // to read back which keys the submitted request asked to certify
+var csrattrsFmt = require("./schema-csrattrs");
+var cmcVerify = require("./cmc-verify");
+var cmcFmt = require("./schema-cmc");
 var OID_CMC_TRANSACTION_ID = oid.byName("id-cmc-transactionId");
 var OID_CMC_SENDER_NONCE = oid.byName("id-cmc-senderNonce");
 var OID_CMC_DATA_RETURN = oid.byName("id-cmc-dataReturn");
@@ -76,9 +76,7 @@ var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _toLowerCase = intrinsic.uncurry(String.prototype.toLowerCase);
-var pkix = require("./schema-pkix");   // shared base64-whitespace strip + JS-\s predicate
-// Own-key membership through an operation taken at load: written out it reads two replaceable
-// properties to answer one question, and here it decides which fields of a response are copied.
+var pkix = require("./schema-pkix");
 var _hasOwn = intrinsic.hasOwn;
 var httpTransport = require("./http-transport");
 var httpDigest = require("./http-digest");
@@ -90,12 +88,9 @@ var ID_SIGNED_DATA = oid.byName("signedData");
 var OID_CHALLENGE_PASSWORD = oid.byName("challengePassword");
 var OID_DECRYPT_KEY_ID = oid.byName("decryptKeyID");
 
-// Charset tables built once from the shared pkix.charTable / pkix.allCharsIn char-scan home.
-var _DIGITS_TABLE = pkix.charTable("0123456789");                                                          // /^[0-9]+$/
-var _LABEL_TABLE = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._~-");   // /^[A-Za-z0-9._~-]+$/
+var _DIGITS_TABLE = pkix.charTable("0123456789");
+var _LABEL_TABLE = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._~-");
 
-// Trailing-slash strip (/\/+$/ -> ""): the length after dropping a run of trailing "/" (0x2f); the
-// caller slices to it, so the removed regex read is traded for the slice that replaces it.
 function _stripTrailingSlashEnd(s) { var end = s.length; while (end > 0 && _charCodeAt(s, end - 1) === 0x2f) end -= 1; return end; }
 var OID_ASYMM_DECRYPT_KEY_ID = oid.byName("asymmDecryptKeyID");
 var OID_SMIME_CAPABILITIES = oid.byName("smimeCapabilities");
@@ -103,19 +98,6 @@ var OID_TEMPLATE = oid.byName("certificationRequestInfoTemplate");
 
 var OPERATIONS = ["cacerts", "simpleenroll", "simplereenroll", "fullcmc", "serverkeygen", "csrattrs"];
 
-// ---- the option surface each verb accepts -----------------------------------
-//
-// A misspelled option reads as an omission, never as a value: nothing is out of range and
-// nothing fails to parse, so the caller who asked for something stricter gets the looser default
-// and is told nothing. That is worst here, where the options carry the security posture of a
-// network exchange -- a misspelled `tls` leaves the anchors unset (the no-anchors refusal names
-// the missing pin, so this one is caught), a misspelled `strict` accepts the extra certificates it
-// was set to reject, a misspelled `expectedRecipientKeyId` drops a recipient pin on a
-// server-generated private key, and a misspelled `oldCert` fails the re-enrollment outright.
-//
-// Every network verb shares the client surface, because every one of them goes through _client and
-// the redirect / authentication plumbing it drives. The per-verb tables extend it instead of
-// restating it, so a key added to the client reaches every verb at once and none of them drifts.
 var CLIENT_OPTS = {
   transport: 1, tls: 1, label: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, now: 1,
   auth: 1, username: 1, password: 1, allowCrossOriginRedirect: 1,
@@ -126,13 +108,9 @@ function _withClient(extra) {
   Object.keys(extra || {}).forEach(function (k) { out[k] = 1; });
   return out;
 }
-// `strict` is enroll-only: _certsResult reads it after the /cacerts branch has already returned, so
-// accepting it on cacerts would advertise a check that cannot run there.
 var CACERTS_OPTS = _withClient(null);
 var SIMPLEENROLL_OPTS = _withClient({ strict: 1 });
 var SIMPLEREENROLL_OPTS = _withClient({ strict: 1, oldCert: 1 });
-// expectedRecipientKind is deliberately absent: it is derived from the CSR's own advertised attribute, never
-// taken from the caller, so listing it would offer a pin that nothing reads.
 var SERVERKEYGEN_OPTS = _withClient({
   requestedEncryption: 1, expectedRecipientKeyId: 1, expectedRecipientIssuerSerial: 1,
 });
@@ -141,7 +119,6 @@ var FULLCMC_OPTS = _withClient({
   transactionId: 1, senderNonce: 1, dataReturn: 1,
   responderCerts: 1, responseRecipient: 1, allowUnverifiedResponse: 1, allowUnboundResponse: 1,
 });
-// The two verbs that take options without going near the network.
 var CLASSIFY_OPTS = { op: 1, now: 1 };
 var PATHS_OPTS = { label: 1 };
 var PARSE_SERVERKEYGEN_OPTS = {
@@ -156,7 +133,6 @@ function _knownOpts(opts, known, verb) {
   });
 }
 
-// ---- the RFC 8951 sec. 3/3.1 transfer codec (CTE-header-blind) -----------
 
 /**
  * @primitive  pki.est.transferDecode
@@ -177,29 +153,17 @@ function _knownOpts(opts, known, verb) {
  *   var roundTripped = pki.est.transferDecode(pki.est.transferEncode(der));
  */
 function transferDecode(body) {
-  // The pre-decode ceiling: the largest base64 that could yield a DER_MAX_BYTES
-  // document, plus a generous line-wrapping allowance (CRLF at 64/76-char lines is
-  // ~3%; 1/8 leaves ample margin) so a normally-wrapped near-limit body is not
-  // rejected before the real DER_MAX_BYTES limit is enforced on the decode below.
-  // guard.text.decode caps the raw byte length BEFORE the latin1 copy.
   var b64Len = Math.ceil(constants.LIMITS.DER_MAX_BYTES * 4 / 3);
   var cap = b64Len + Math.ceil(b64Len / 8) + constants.BYTES.kib(64);
   var s = guard.text.decode(body, cap, EstError, {
     charset: "latin1", tooLarge: "est/too-large", badInput: "est/bad-input", label: "the EST payload",
   });
   var stripped = pkix.stripBase64Whitespace(s);
-  // Strict canonical RFC 4648 base64 (RFC 8951 sec. 3.1) via the shared encoding
-  // guard: the alphabet + whole-4-group + canonical round-trip fail a malformed
-  // body closed instead of silently truncating to a shorter, different DER.
   var der = guard.encoding.base64(stripped, null, E, "est/bad-base64", "the EST payload");
   if (der.length > constants.LIMITS.DER_MAX_BYTES) throw E("est/too-large", "the decoded EST DER exceeds the size cap");
   return der;
 }
 
-// The byte length of a transport response body for the size-cap and empty-body checks: a null / absent body
-// is 0, a string its UTF-8 byte length, and any BufferSource (a Buffer / Uint8Array / ArrayBuffer / DataView
-// from an injected transport) its byte count through the byte guard -- never a String()-coerced comma list.
-// res.body is read ONCE so a lying getter on an injected response cannot change it between the arms.
 function _bodyLen(res) {
   var body = res.body;
   return body == null ? 0 : (typeof body === "string" ? Buffer.byteLength(body, "utf8")
@@ -223,25 +187,20 @@ function _bodyLen(res) {
  */
 function transferEncode(der) {
   if (!Buffer.isBuffer(der)) throw E("est/bad-input", "transferEncode requires a DER Buffer");
-  // Re-view: a detached-backed Buffer reads as zero-length and would encode "".
   der = guard.bytes.view(der, EstError, "est/bad-input", "transferEncode DER input");
   return der.toString("base64");
 }
 
-// ---- the multipart/mixed splitter (/serverkeygen) -----------------------
 
-// Case-insensitive ASCII prefix test: does `s` begin with the uppercase literal `litUpper`?
 function _ciStartsWith(s, litUpper) {
   if (s.length < litUpper.length) return false;
   for (var k = 0; k < litUpper.length; k++) {
     var c = _charCodeAt(s, k);
-    if (c >= 97 && c <= 122) c -= 32;   // fold lowercase -> uppercase
+    if (c >= 97 && c <= 122) c -= 32;
     if (c !== _charCodeAt(litUpper, k)) return false;
   }
   return true;
 }
-// /^multipart\/mixed\s*(;|$)/i by character scan: the media type "multipart/mixed" (case-insensitive),
-// then JS \s* whitespace, then a `;` parameter separator or end of the header value.
 var _MULTIPART_MIXED = "MULTIPART/MIXED";
 function _isMultipartMixedPrefix(ct) {
   if (!_ciStartsWith(ct, _MULTIPART_MIXED)) return false;
@@ -250,13 +209,9 @@ function _isMultipartMixedPrefix(ct) {
   return p === ct.length || _charCodeAt(ct, p) === 0x3b;
 }
 
-// Extract the boundary from a `multipart/mixed; boundary=...` content-type,
-// tolerating whitespace before the semicolon (erratum 5779 REJECTED the ban).
 function _multipartBoundary(contentType) {
   var ct = String(contentType || "");
   if (!_isMultipartMixedPrefix(ct)) return null;
-  // Two boundaries name two different splits of the same body; there is no reading
-  // of that header, so it is refused rather than resolved by taking the first.
   var bp = _ctParam(ct, "boundary");
   if (bp.duplicated) {
     throw E("est/bad-multipart",
@@ -265,10 +220,6 @@ function _multipartBoundary(contentType) {
   return bp.value;
 }
 
-// A boundary delimiter at a candidate line start `ls`: `--boundary`, an optional `--` close marker, optional
-// SP/HTAB transport-padding, then a CRLF/LF or end-of-text. Returns { end, close } (end = the index past the
-// trailing line terminator) or null. `(--)?` is taken greedily without backtracking loss: a `-` can be neither
-// padding nor a terminator, so if the close marker is present it is the only possible parse.
 function _matchDelimAt(text, ls, boundary) {
   var n = text.length, q = ls, blen = boundary.length, k;
   if (q + 2 > n || _charCodeAt(text, q) !== 0x2d || _charCodeAt(text, q + 1) !== 0x2d) return null;
@@ -284,11 +235,6 @@ function _matchDelimAt(text, ls, boundary) {
   if (_charCodeAt(text, q) === 0x0d && q + 1 < n && _charCodeAt(text, q + 1) === 0x0a) return { end: q + 2, close: close };
   return null;
 }
-// Every delimiter in `text`, replacing the global /(?:^|\r?\n)--boundary(--)?[ \t]*(?:\r?\n|$)/g scan: a
-// delimiter begins the text or follows a CRLF/LF (which the match CONSUMES), so `at` is the index of that
-// leading terminator (0 at the start) and `bodyStart` is the index past the trailing one. The leftmost match
-// at or after the previous `bodyStart` is taken, so two adjacent delimiters share one terminator and only the
-// first is found -- the same non-overlapping behavior the regex has.
 function _findMultipartMarks(text, boundary) {
   var marks = [], n = text.length, searchStart = 0, p;
   while (searchStart <= n) {
@@ -306,8 +252,6 @@ function _findMultipartMarks(text, boundary) {
   }
   return marks;
 }
-// Strip the part-body framing the regexes /^(\r?\n){2}/ and /\r?\n$/ removed: the two leading line terminators
-// (all-or-nothing) that follow the header/body separator, and one trailing terminator.
 function _stripTwoLeadingEol(seg, from) {
   var q = from;
   for (var t = 0; t < 2; t++) {
@@ -324,8 +268,6 @@ function _stripOneTrailingEol(seg, end) {
   }
   return end;
 }
-// Unfold folded MIME header lines (/\r?\n(?=[ \t])/g -> ""): a CRLF/LF immediately followed by SP/HTAB is a
-// FOLD, not a header break, so the terminator is dropped while the whitespace stays.
 function _unfoldHeaders(raw) {
   var out = "", last = 0, i = 0, n = raw.length;
   while (i < n) {
@@ -340,7 +282,6 @@ function _unfoldHeaders(raw) {
   }
   return out + _strSlice(raw, last, n);
 }
-// Split on CRLF/LF (.split(/\r?\n/)) by character scan, preserving JS split semantics (leading/trailing "").
 function _splitCrlf(s) {
   var out = [], last = 0, i = 0, n = s.length;
   while (i < n) {
@@ -353,11 +294,6 @@ function _splitCrlf(s) {
   return out;
 }
 
-// Split a multipart/mixed body into its parts, each { headers, contentType,
-// body }. A boundary delimiter is `--boundary` only at the START OF A LINE (body
-// start or after CRLF), optional transport-padding, then CRLF (a part) or `--`
-// (the close delimiter) -- matching the raw substring would treat `--boundaryX`,
-// which is NOT a delimiter (RFC 2046), as one. The preamble/epilogue are ignored.
 function splitMultipartMixed(body, contentType) {
   var boundary = _multipartBoundary(contentType);
   if (!boundary) throw E("est/bad-multipart", "a serverkeygen response must be multipart/mixed with a boundary (RFC 7030 sec. 4.4.2)");
@@ -370,16 +306,13 @@ function splitMultipartMixed(body, contentType) {
   if (closeAt === -1) throw E("est/bad-multipart", "the multipart body is missing its terminal boundary (RFC 2046)");
   var parts = [];
   for (var i = 0; i < closeAt; i++) {
-    var seg = _strSlice(text, marks[i].bodyStart, marks[i + 1].at);   // between this delimiter and the next
+    var seg = _strSlice(text, marks[i].bodyStart, marks[i + 1].at);
     var sep = seg.indexOf("\r\n\r\n");
     if (sep === -1) sep = seg.indexOf("\n\n");
     if (sep === -1) throw E("est/bad-multipart", "a multipart part is missing its header/body separator");
     var rawHeaders = _strSlice(seg, 0, sep);
     var partBody = _strSlice(seg, _stripTwoLeadingEol(seg, sep), _stripOneTrailingEol(seg, seg.length));
     var headers = {};
-    // Unfold MIME part headers (RFC 5322 sec. 2.2.3 / RFC 2046): a CRLF immediately followed by whitespace is a
-    // FOLD, not a header break, so it is removed before the split -- a Content-Type whose smime-type parameter
-    // continues on the next line must be read whole, not truncated.
     var lines = _splitCrlf(_unfoldHeaders(rawHeaders));
     for (var li = 0; li < lines.length; li++) {
       var line = lines[li];
@@ -393,7 +326,6 @@ function splitMultipartMixed(body, contentType) {
   return parts;
 }
 
-// ---- the certs-only Simple PKI Response validator -----------------------
 
 /**
  * @primitive  pki.est.parseCertsOnly
@@ -426,15 +358,9 @@ function splitMultipartMixed(body, contentType) {
  *   r.certificates;   // -> [Buffer, ...] raw, unordered
  */
 function parseCertsOnly(der) {
-  // The certs-only Simple PKI Response shape is a CMS concern shared with AIA path building; the reader lives
-  // in schema-cms. The "est" prefix keeps the exact est/* codes (est/not-certs-only, est/no-certificates, ...).
   return cms.parseCertsOnly(der, E, "est");
 }
 
-// Pick the issued certificate from a certs-only response by matching its public
-// key against the CSR / SPKI the client submitted -- the ONLY sanctioned
-// identification (positional guessing is forbidden, RFC 5272 sec. 4.1). `target`
-// is an SPKI object (with a `bytes` subjectPublicKey field) or a raw Buffer.
 function findIssuedCert(certs, target) {
   var want = Buffer.isBuffer(target) ? target : (target && target.bytes);
   if (!Buffer.isBuffer(want)) return null;
@@ -447,24 +373,14 @@ function findIssuedCert(certs, target) {
   return null;
 }
 
-// ---- /serverkeygen ------------------------------------------------------
 
-// Collect every key-identifier (subjectKeyIdentifier / KEKIdentifier) a set of
-// RecipientInfos names, across the ktri / kari / kekri / kemri arms -- the
-// byte identifiers a client's advertised decryptKeyID would match.
-// The key-identifier bytes each RecipientInfo arm names, filtered by MECHANISM (RFC 7030 sec. 4.4.1): an
-// ASYMMETRIC decryption key (AsymmetricDecryptKeyIdentifier) is named by a subjectKeyIdentifier on a
-// KeyTrans / KeyAgree / KEM arm, a SYMMETRIC key (DecryptKeyIdentifier) by the keyIdentifier of a KEK arm.
-// Filtering keeps a symmetric KEK arm from satisfying an advertised asymmetric key (and vice-versa) merely
-// because the identifier bytes coincide -- the returned key would be unusable with the mechanism requested.
-// kind: "asymmetric" | "symmetric" | undefined (any, for a direct caller that did not state the mechanism).
 function _recipientKeyIds(recipientInfos, kind) {
   var ids = [];
   function push(v) { if (Buffer.isBuffer(v)) ids.push(v); }
   (recipientInfos || []).forEach(function (r) {
     if (kind !== "symmetric") {
       if (r.rid) push(r.rid.subjectKeyIdentifier);
-      if (r.kemri && r.kemri.rid) push(r.kemri.rid.subjectKeyIdentifier);   // KEMRecipientInfo (RFC 9629, under the ori arm)
+      if (r.kemri && r.kemri.rid) push(r.kemri.rid.subjectKeyIdentifier);
       (r.recipientEncryptedKeys || []).forEach(function (rek) { if (rek.rid) push(rek.rid.subjectKeyIdentifier); });
     }
     if (kind !== "asymmetric") {
@@ -474,9 +390,6 @@ function _recipientKeyIds(recipientInfos, kind) {
   return ids;
 }
 
-// The { issuer (raw DN bytes), serialNumber } every issuerAndSerialNumber recipient
-// arm names -- the form a server MAY use after mapping an AsymmetricDecryptKeyIdentifier
-// to a certificate (RFC 7030 sec. 4.4.2), so a key-id-only match would miss it.
 function _recipientIssuerSerials(recipientInfos) {
   var out = [];
   function push(rid) { if (rid && rid.issuer && Buffer.isBuffer(rid.issuer.bytes) && rid.serialNumber != null) out.push({ issuer: rid.issuer.bytes, serialNumber: rid.serialNumber }); }
@@ -488,45 +401,22 @@ function _recipientIssuerSerials(recipientInfos) {
   return out;
 }
 
-// The advertised recipient (a decryptKeyID / asymmDecryptKeyID key identifier
-// and/or an issuer+serial) matches SOME RecipientInfo arm -- either identifier
-// form the server may have used to name the same requested key.
 function _recipientMatches(recipientInfos, opts) {
   if (Buffer.isBuffer(opts.expectedRecipientKeyId) &&
       _recipientKeyIds(recipientInfos, opts.expectedRecipientKind).some(function (id) { return id.equals(opts.expectedRecipientKeyId); })) return true;
   var ias = opts.expectedRecipientIssuerSerial;
   if (ias && Buffer.isBuffer(ias.issuer) && ias.serialNumber != null) {
-    // Validate the caller-supplied serial BEFORE BigInt() so a bad value is a typed est/bad-input, never a
-    // raw SyntaxError / RangeError leaking from the codec (the single choke point for both the serverkeygen
-    // verb and the public parseServerKeygenResponse).
     var sn = ias.serialNumber, want;
     if (typeof sn === "bigint" && sn >= 0n) want = sn;
     else if (typeof sn === "number" && Number.isSafeInteger(sn) && sn >= 0) want = BigInt(sn);
     else if (typeof sn === "string" && pkix.allCharsIn(sn, _DIGITS_TABLE)) want = BigInt(sn);
     else throw E("est/bad-input", "expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
-    // An issuerAndSerialNumber names an ASYMMETRIC recipient -- a certificate identity the server derived from
-    // an AsymmetricDecryptKeyIdentifier (RFC 7030 sec. 4.4.2); a symmetric KEK recipient has none. So a SYMMETRIC
-    // request must NOT be satisfied by an asymmetric arm's issuer+serial, or the client would accept ciphertext
-    // undecryptable with the symmetric key it requested. The key-id branch applies the same mechanism filter.
     if (opts.expectedRecipientKind !== "symmetric" &&
         _recipientIssuerSerials(recipientInfos).some(function (r) { return r.issuer.equals(ias.issuer) && r.serialNumber === want; })) return true;
   }
   return false;
 }
 
-// Parse a /serverkeygen response: exactly two parts -- a private-key part
-// (application/pkcs8 cleartext PrivateKeyInfo, or application/pkcs7-mime;
-// smime-type=server-generated-key EnvelopedData) and a certificate part (the
-// enroll-response shape). opts.requestedEncryption asserts the key part is
-// encrypted (a cleartext part -> est/expected-encrypted-key). The advertised
-// recipient may be given as opts.expectedRecipientKeyId (a Buffer, the
-// decryptKeyID / asymmDecryptKeyID) and/or opts.expectedRecipientIssuerSerial
-// ({ issuer: raw-DN Buffer, serialNumber }, the form a server MAY use after
-// mapping that identifier to a certificate); when either is given, a RecipientInfo
-// of the encrypted key must match one of them (else est/recipient-mismatch) -- so
-// a response encrypted to a DIFFERENT recipient fails closed rather than passing.
-// Split a content-type on `;` that are OUTSIDE a quoted-string (RFC 2045),
-// so a `;` inside a parameter value does not create a spurious parameter.
 function _splitContentTypeParams(s) {
   var segs = [], cur = "", inQuote = false;
   for (var i = 0; i < s.length; i++) {
@@ -539,19 +429,6 @@ function _splitContentTypeParams(s) {
   return segs;
 }
 
-// Split a part's content-type into its base media type (lowercased) and its
-// smime-type parameter. The media type must be the EXACT token (a look-alike
-// like application/pkcs8evil yields that literal, not application/pkcs8), and
-// parameters are read token-by-token honoring quoted-strings so a smime-type-like
-// substring inside another quoted parameter value is NOT taken as smime-type.
-// A named Content-Type parameter, plus whether the header declared it MORE THAN
-// ONCE. RFC 2045 sec. 5.1 gives a parameter at most one value, so a header stating
-// two is ambiguous -- and taking the first would let the position of a duplicate,
-// not the sender, decide how the body is read. `smime-type` selects which response
-// arm this is and `boundary` decides where the parts begin, so in both cases the
-// choice is the whole answer. Reported rather than thrown here: each boundary
-// refuses in its own terms, and the error path must not let a bad label displace
-// the HTTP fault it arrived with.
 function _ctParam(contentType, name) {
   var segs = _splitContentTypeParams(String(contentType || ""));
   var value = null, count = 0;
@@ -568,8 +445,6 @@ function _ctParam(contentType, name) {
   return { value: value, duplicated: count > 1 };
 }
 
-// A media type `type/subtype` by character scan (RFC 2045 sec. 5.1 restricted token): the first character
-// of each part is alphanumeric, the rest add !#$&^_.+- (case-insensitive), exactly one `/` separates them.
 var _MT_FIRST = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
 var _MT_REST = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$&^_.+-");
 function _isMediaToken(s, from, to) {
@@ -577,8 +452,6 @@ function _isMediaToken(s, from, to) {
   for (var i = from + 1; i < to; i++) { if (!_MT_REST[_charCodeAt(s, i)]) return false; }
   return true;
 }
-// /^\s*([a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*)\s*$/i -> the lowercased media type, or null:
-// trim JS whitespace, require a single `/` splitting two restricted tokens.
 function _mediaType(seg) {
   var a = 0, b = seg.length, slash = -1, i;
   while (a < b && pkix.isJsWhitespace(_charCodeAt(seg, a))) a += 1;
@@ -606,44 +479,23 @@ function parseServerKeygenResponse(body, contentType, opts) {
   var keyPart = null, certPart = null, encrypted = false;
   for (var i = 0; i < parts.length; i++) {
     var pt = _partMediaType(parts[i].contentType);
-    // Same rule on a PART header: smime-type tells the encrypted key part from the
-    // cleartext one and from the certificate part, so two of them leave which part
-    // this is undecided.
     if (pt.ambiguous) {
       throw E("est/bad-multipart",
         "a serverkeygen response part declares more than one smime-type, so which part it is cannot be told from it (RFC 2045 sec. 5.1)");
     }
     if (pt.media === "application/pkcs8") { keyPart = parts[i]; encrypted = false; }
     else if (pt.media === "application/pkcs7-mime" && pt.smimeType === "server-generated-key") { keyPart = parts[i]; encrypted = true; }
-    // The certificate part exactly matches the /simpleenroll response
-    // (RFC 7030 sec. 4.4.2), so it too MUST be smime-type=certs-only.
     else if (pt.media === "application/pkcs7-mime" && pt.smimeType === "certs-only") certPart = parts[i];
     else throw E("est/bad-multipart", "unrecognized serverkeygen part content-type " + JSON.stringify(parts[i].contentType));
   }
   if (!keyPart || !certPart) throw E("est/bad-multipart", "a serverkeygen response needs one key part and one certificate part");
   if (opts.requestedEncryption && !encrypted) throw E("est/expected-encrypted-key", "encryption was requested but the private-key part is cleartext (RFC 7030 sec. 4.4.2)");
-  // The reverse is also a mismatch: the CSR advertised NO key-encryption key (requestedEncryption explicitly
-  // false), yet the server returned an EnvelopedData. The client holds nothing to decrypt it, so an unsolicited
-  // encrypted key is an unusable credential, not a success (RFC 7030 sec. 4.4.2). (An undefined requestedEncryption
-  // -- a low-level caller not stating the mode -- stays permissive.)
   if (opts.requestedEncryption === false && encrypted) throw E("est/unexpected-encrypted-key", "the server returned an encrypted key but the CSR advertised no DecryptKeyIdentifier / AsymmetricDecryptKeyIdentifier to decrypt it (RFC 7030 sec. 4.4.2)");
   var out = { certificates: parseCertsOnly(transferDecode(certPart.body)).certificates };
   if (encrypted) {
-    // The server-generated key MUST be a CMS EnvelopedData (RFC 7030 sec. 4.4.2);
-    // a SignedData or any other CMS content type under the encrypted label is a
-    // structurally invalid key part, not a success. The EnvelopedData is surfaced
-    // structurally -- the ciphertext stays opaque and the RecipientInfo arms feed
-    // the coherence check the caller makes.
     var parsedKey = cms.parse(transferDecode(keyPart.body));
     if (parsedKey.contentTypeName !== "envelopedData") throw E("est/bad-key-part", "a server-generated encrypted key part must be a CMS EnvelopedData (RFC 7030 sec. 4.4.2), got " + JSON.stringify(parsedKey.contentTypeName));
-    // The EnvelopedData MUST encapsulate a CMS SignedData holding the private key
-    // (RFC 7030 sec. 4.4.2) -- validate the inner encryptedContentInfo content type,
-    // not just the outer ContentInfo, so a key wrapped around id-data or anything
-    // else fails closed before the caller decrypts it.
     if (!parsedKey.encryptedContentInfo || parsedKey.encryptedContentInfo.contentType !== ID_SIGNED_DATA) throw E("est/bad-key-part", "a server-generated encrypted key's EnvelopedData must encapsulate a CMS SignedData (RFC 7030 sec. 4.4.2)");
-    // A detached OR empty EnvelopedData carries no ciphertext to decrypt -- there is
-    // no key to recover, so it is not a valid key response (the shared CMS assert
-    // rejects both null and zero-length, matching the CRMF / PKCS#12 siblings).
     cms.assertAttachedCiphertext(parsedKey.encryptedContentInfo, E, "est/bad-key-part", "a server-generated encrypted key's EnvelopedData");
     if (Buffer.isBuffer(opts.expectedRecipientKeyId) || opts.expectedRecipientIssuerSerial) {
       if (!_recipientMatches(parsedKey.recipientInfos, opts)) throw E("est/recipient-mismatch", "the server-generated key is not encrypted to the advertised recipient (RFC 7030 sec. 4.4.2)");
@@ -652,53 +504,23 @@ function parseServerKeygenResponse(body, contentType, opts) {
   } else {
     var keyDer = transferDecode(keyPart.body);
     out.privateKey = pkcs8.parse(keyDer);
-    // The raw cleartext PrivateKeyInfo DER is surfaced so a semantic layer can bind the key to its
-    // certificate (the public-key coherence check the verb runs). Structural parsing itself never
-    // does the crypto derivation -- mirroring parseCertsOnly, which splits certs while the enroll
-    // verb picks the issued one by public-key match.
     out.privateKeyDer = keyDer;
   }
   return out;
 }
 
-// ---- the HTTP response classifier --------------------------------------
 
-// The required 200-response content-type per operation: the EXACT media-type
-// token plus, where the RFC mandates it, the smime-type parameter. simpleenroll /
-// simplereenroll require smime-type=certs-only (RFC 7030 sec. 4.2.3) so a different
-// PKI message type (CMC-response, ...) is not accepted; cacerts mandates only the
-// media type (sec. 4.1.3). Matched token-wise, not by prefix, so a look-alike like
-// "application/pkcs7-mimeevil" is rejected.
-// smimeTypes is a LIST for every row that constrains it, rather than a scalar on some
-// rows and a list on others: /fullcmc legitimately answers with either arm, and one
-// shape for the field keeps the comparison below single-branch.
 var CONTENT_TYPE_BY_OP = {
   cacerts: { media: "application/pkcs7-mime" },
   simpleenroll: { media: "application/pkcs7-mime", smimeTypes: ["certs-only"] },
   simplereenroll: { media: "application/pkcs7-mime", smimeTypes: ["certs-only"] },
-  // RFC 7030 sec. 4.3.2: a 200 /fullcmc response is application/pkcs7-mime whose
-  // smime-type is EITHER certs-only (the CA answered with a Simple PKI Response) or
-  // CMC-response (a Full PKI Response). Both are conforming and the CA chooses.
-  // Spelled lowercase here and compared case-insensitively: RFC 5273 sec. 3 prose
-  // writes "CMC-Request"/"CMC-Response" while its own Table 1 and RFC 7030 write
-  // "CMC-request"/"CMC-response", so a case-sensitive match would reject a
-  // conforming server depending on which sentence its author read.
   fullcmc: { media: "application/pkcs7-mime", smimeTypes: ["certs-only", "cmc-response"] },
   serverkeygen: { media: "multipart/mixed" },
   csrattrs: { media: "application/csrattrs" },
 };
 
-// The operations whose responses this client classifies.
 var CLASSIFIABLE_OPS = ["cacerts", "simpleenroll", "simplereenroll", "fullcmc", "serverkeygen", "csrattrs"];
 
-// RFC 7030 sec. 4.3.2: on /fullcmc a 404 OR a 501 means "this service is not
-// implemented" -- a distinct, non-error verdict the caller can act on.
-//
-// That makes THREE meanings for 404 across this classifier, so they are listed
-// together rather than as branches accumulated one release at a time:
-//   /csrattrs  404 -> none-available (sec. 4.5.2)
-//   /fullcmc   404 -> not-implemented (sec. 4.3.2), and 501 likewise
-//   every other op  -> est/http-error
 var NOT_IMPLEMENTED_OPS = { fullcmc: 1 };
 
 /**
@@ -730,22 +552,7 @@ function classifyResponse(status, headers, body, opts) {
   opts = opts || {};
   _knownOpts(opts, CLASSIFY_OPTS, "classifyResponse");
   var op = opts.op;
-  // Fail closed on an operation whose response this client cannot validate:
-  // A named op this client cannot validate is a typo, not a pass. An
-  // absent op is the caller opting out of the content-type gate (generic
-  // status handling) and stays permissive.
   if (op !== undefined && op !== null && CLASSIFIABLE_OPS.indexOf(op) === -1) throw E("est/unsupported-operation", "unrecognized EST operation " + JSON.stringify(op));
-  // Normalized ONCE, through the reader that refuses a field carried under two
-  // spellings. Folding the map with last-value-wins here while another stage reads
-  // the exact key is how the two could pick different values out of the same
-  // response -- and the whole point of this function is to decide what the body is.
-  // Content-Type, Retry-After and Location are SINGLETON fields: each carries one
-  // value that decides one thing -- how to read the body, how long to wait, where to
-  // go -- so two of them is an ambiguity, refused rather than resolved by order.
-  // WWW-Authenticate is a LIST field (RFC 9110 sec. 11.6.1: a challenge per element),
-  // where repetition is the field working as defined; its values are combined the way
-  // sec. 5.3 permits a recipient to combine list-field lines, so every challenge the
-  // server offered reaches the scheme scan.
   var h = {
     "content-type": _ciHeader(headers, "content-type"),
     "retry-after": _ciHeader(headers, "retry-after"),
@@ -757,11 +564,6 @@ function classifyResponse(status, headers, body, opts) {
     var ct = h["content-type"] || "";
     if (spec) {
       var pt = _partMediaType(ct);
-      // _partMediaType already lowercases smimeType, and the table's entries are
-      // lowercase, so this comparison is case-insensitive on both sides.
-      // A duplicated smime-type is not a value the whitelist can be applied to:
-      // one of the two might be on it while the other is not, and matching the
-      // first would pass a header that also declares something else.
       var smimeOk = !pt.ambiguous && (!spec.smimeTypes || spec.smimeTypes.indexOf(pt.smimeType) !== -1);
       if (pt.media !== spec.media || !smimeOk) {
         throw E("est/bad-content-type", "a 200 " + op + " response must carry content-type " + spec.media + (spec.smimeTypes ? "; smime-type=" + spec.smimeTypes.join(" or ") : "") + ", got " + JSON.stringify(ct));
@@ -773,14 +575,9 @@ function classifyResponse(status, headers, body, opts) {
     var ra = h["retry-after"];
     if (ra === undefined || ra === null || String(ra).trim() === "") throw E("est/missing-retry-after", "an HTTP 202 EST response must include Retry-After (RFC 7030 sec. 4.2.3)");
     var raStr = String(ra).trim();
-    // Retry-After is delay-seconds OR an HTTP-date (RFC 7231 sec. 7.1.3), surfaced (never slept on)
-    // as a bounded retryAfterSeconds and/or an absolute retryAfterDate via the shared parser; neither
-    // form -> fail closed rather than a retry verdict with no delay.
     var parsed = retryAfter.parse(raStr, { now: opts.now, E: E, code: "est/bad-retry-after" });
     return { status: "retry", retryAfter: raStr, retryAfterSeconds: parsed.retryAfterSeconds, retryAfterDate: parsed.retryAfterDate };
   }
-  // 501 is meaningful ONLY as the /fullcmc not-implemented signal; on every other
-  // operation it stays an ordinary 5xx and falls through to est/http-error below.
   if (status === 501 && NOT_IMPLEMENTED_OPS[op]) return { status: "not-implemented", httpStatus: status };
   if (status === 204 || status === 404) {
     if (op === "csrattrs") return { status: "none-available" };
@@ -789,17 +586,10 @@ function classifyResponse(status, headers, body, opts) {
   }
   if (status >= 300 && status < 400) return { status: "redirect", location: h["location"] || null };
   if (status >= 400) {
-    // Decode only a bounded prefix for the message -- a huge error body must not
-    // be materialized as a full string just to show its first 512 characters.
-    // toString(enc, start, end) bounds the decode WITHOUT constructing a subarray
-    // view, so a detached body reads as "" here rather than throwing a raw
-    // TypeError that would mask the est/http-error verdict.
     var text;
     if (Buffer.isBuffer(body)) {
       text = body.toString("utf8", 0, 512);
     } else if (guard.bytes.isByteSource(body)) {
-      // A byte source from an injected transport (a Uint8Array / ArrayBuffer): decode a bounded prefix through
-      // the byte guard rather than String()-coercing it to a "48,130,..." comma list.
       try { text = guard.bytes.source(body, EstError, "est/bad-input", "the EST error body").toString("utf8", 0, 512); }
       catch (_e) { /* allow:swallow-unverified a detached / unreadable error body reads as an empty snippet rather than masking the est/http-error verdict with a raw TypeError */ text = ""; }
     } else {
@@ -810,7 +600,6 @@ function classifyResponse(status, headers, body, opts) {
   return { status: "unexpected", httpStatus: status };
 }
 
-// ---- operation-path builder ---------------------------------------------
 
 /**
  * @primitive  pki.est.paths
@@ -838,10 +627,6 @@ function paths(baseUrl, opts) {
   var prefix = base.slice(0, _stripTrailingSlashEnd(base)) + "/.well-known/est";
   if (opts.label != null) {
     var label = String(opts.label);
-    // A label is ONE URL path segment: unreserved characters only (RFC 3986),
-    // never a dot-segment or an operation name. Rejecting rather than
-    // percent-encoding keeps a reserved char (`/` `?` `#` `%`) or `..` from
-    // silently retargeting the request to a different resource.
     if (label === "" || label === "." || label === ".." || !pkix.allCharsIn(label, _LABEL_TABLE) || OPERATIONS.indexOf(label) !== -1) {
       throw E("est/bad-label", "an EST CA label must be a single path segment of unreserved characters, not '.' / '..' or an operation name (RFC 7030 sec. 3.2.2)");
     }
@@ -852,17 +637,10 @@ function paths(baseUrl, opts) {
   return out;
 }
 
-// ---- builders: the CSR attributes EST adds ------------------------------
 
 function _attr(typeOid, valueNodes) { return asn1.build.sequence([asn1.build.oid(typeOid), asn1.build.set(valueNodes)]); }
 
-// the RFC 5929 tls-unique channel-binding bytes -> a challengePassword
-// attribute whose value is their RFC 4648 base64 (SIZE 1..255). The builder
-// takes caller-supplied binding bytes and never fakes one.
 function challengePasswordFromTlsUnique(channelBinding) {
-  // The count comes from the guard, so an own `length` on the caller's Buffer cannot report a
-  // full one as empty. `length` is shadowable on any instance, and `Object.defineProperty(buf,
-  // "length", { get: function () { return 0; } })` had this refuse bytes that were there.
   if (!guard.bytes.isByteSource(channelBinding)) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
   var _cb = guard.bytes.source(channelBinding, EstError, "est/bad-input", "the channel-binding bytes");
   if (_cb.length === 0) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
@@ -871,7 +649,6 @@ function challengePasswordFromTlsUnique(channelBinding) {
   return _attr(OID_CHALLENGE_PASSWORD, [asn1.build.printable(b64)]);
 }
 
-// the out-of-band key-encryption-key identifiers (OCTET STRING values).
 function decryptKeyIdentifierAttr(keyId) {
   if (!Buffer.isBuffer(keyId)) throw E("est/bad-input", "decryptKeyIdentifierAttr requires the key-identifier bytes");
   return _attr(OID_DECRYPT_KEY_ID, [asn1.build.octetString(keyId)]);
@@ -880,8 +657,6 @@ function asymmetricDecryptKeyIdentifierAttr(keyId) {
   if (!Buffer.isBuffer(keyId)) throw E("est/bad-input", "asymmetricDecryptKeyIdentifierAttr requires the key-identifier bytes");
   return _attr(OID_ASYMM_DECRYPT_KEY_ID, [asn1.build.octetString(keyId)]);
 }
-// SMIMECapabilities ::= SEQUENCE OF SMIMECapability { capabilityID OID,
-//   parameters ANY OPTIONAL }.
 function smimeCapabilitiesAttr(capabilities) {
   if (!Array.isArray(capabilities) || capabilities.length === 0) throw E("est/bad-input", "smimeCapabilitiesAttr requires a non-empty capability list");
   var caps = capabilities.map(function (c) {
@@ -892,15 +667,6 @@ function smimeCapabilitiesAttr(capabilities) {
   return _attr(OID_SMIME_CAPABILITIES, [asn1.build.sequence(caps)]);
 }
 
-// Derive the enroll-request attribute plan from a parsed CsrAttrs.
-// When a template is present the plan derives from the TEMPLATE ONLY and ignores
-// every other element (RFC 9908 sec. 4). The challengePassword OID is an
-// INSTRUCTION ("include tls-unique") -> a channelBindingRequired flag, never a
-// password value (the RFC 7030 example that echoed it is "NOT CORRECT",
-// RFC 9908 sec. 4). Every item the plan does not model into a specific field --
-// including a REGISTERED-but-unmodeled instruction like a bare signature-algorithm
-// OID (RFC 8951) -- is surfaced on `unhandled` ({ kind, oid, name }) so the client
-// never silently drops a server requirement.
 function buildEnrollAttributes(csrattrsParsed) {
   var items = (csrattrsParsed && csrattrsParsed.items) || [];
   var template = null;
@@ -914,14 +680,7 @@ function buildEnrollAttributes(csrattrsParsed) {
     if (it.oid === OID_CHALLENGE_PASSWORD) plan.channelBindingRequired = true;
     else if (it.kind === "attribute" && it.extensions) plan.extensions = it.extensions;
     else if (it.kind === "attribute" && it.isKeyType) {
-      // EVERY key type the parser accepts is a key-type constraint (RSA / EC /
-      // Ed25519 / ML-DSA / ...). The non-template form carries EXACTLY ONE key-type
-      // attribute (RFC 9908 sec. 3.2); a second is an ambiguous server instruction,
-      // not a last-one-wins override -- fail closed rather than pick one by order.
       if (plan.keyType) throw E("est/ambiguous-key-type", "a non-template CsrAttrs response must carry exactly one key-type attribute (RFC 9908 sec. 3.2)");
-      // Surface the raw values too: a key type this planner does not decode into
-      // curve / keySize (Ed25519, ML-DSA, ...) may still carry RFC 9908 parameters,
-      // so never silently drop them.
       plan.keyType = { type: it.name, curve: it.curve || null, keySize: it.keySize || null, values: it.values || [] };
     }
     else plan.unhandled.push({ kind: it.kind, oid: it.oid, name: it.name });
@@ -931,11 +690,6 @@ function buildEnrollAttributes(csrattrsParsed) {
 
 var SAN_OID = oid.byName("subjectAltName");
 
-// Pull the SubjectAltName extension's raw extnValue (the DER GeneralNames) off a
-// parsed extension list -- a certificate's `.extensions` or a CSR's
-// extensionRequest `.extensions` -- as { critical, value }, or null when no SAN
-// is present. Both fields matter: "identical" (RFC 7030 sec. 4.2.2) covers the
-// criticality flag, not just the GeneralNames bytes.
 function _san(extList) {
   if (!Array.isArray(extList)) return null;
   for (var i = 0; i < extList.length; i++) {
@@ -944,11 +698,6 @@ function _san(extList) {
   return null;
 }
 
-// The requested extensions a CSR carries in its extensionRequest attribute
-// (RFC 2985 sec. 5.4.2), decoded by the CSR parser, or null when absent. A CSR
-// carrying more than one extensionRequest is structurally legal (no SET-OF
-// uniqueness) but AMBIGUOUS for the re-enroll SAN comparison -- fail closed
-// rather than trusting the DER-first one while a later one requests a different SAN.
 function _csrRequestedExtensions(parsedCsr) {
   var attrs = (parsedCsr && parsedCsr.attributes) || [];
   var extReqOid = oid.byName("extensionRequest");
@@ -960,16 +709,9 @@ function _csrRequestedExtensions(parsedCsr) {
   return found;
 }
 
-// A re-enroll CSR MUST reuse the old certificate's Subject and SubjectAltName
-// extension byte-identically (RFC 7030 sec. 4.2.2). Returns the old cert's
-// subject + SAN for verbatim reuse in the new CSR; on a caller-supplied new CSR,
-// compares both by raw DER (a rendered DN two different string encodings can
-// share is NOT enough) and throws est/reenroll-subject-mismatch or
-// est/reenroll-san-mismatch on any divergence (a SAN present on one side and
-// absent on the other is a mismatch, not an accept).
 function reenrollGuard(oldCertDer, newCsrDer) {
   var oldCert = x509.parse(oldCertDer);
-  var oldSubject = oldCert.subject.rdns;   // the parsed subject; raw region surfaced below
+  var oldSubject = oldCert.subject.rdns;
   var oldSubjectDn = oldCert.subject.dn;
   var oldSubjectBytes = oldCert.subject.bytes;
   var oldSan = _san(oldCert.extensions);
@@ -984,22 +726,16 @@ function reenrollGuard(oldCertDer, newCsrDer) {
   return { subjectDn: oldSubjectDn, subjectAltName: oldSan };
 }
 
-// ---- the thin RFC 7030 client: network verbs over the shared pki.transport ----
 
 var DEFAULT_TIMEOUT = constants.TIME.seconds(30);
 var MAX_TIMEOUT = constants.TIME.seconds(600);
 
-// The DER of a caller-supplied CSR: a DER Buffer as-is, or a PEM "CERTIFICATE REQUEST"
-// decoded. Any other input is a config-time est/bad-input.
 function _csrDer(input) {
   if (guard.bytes.isByteSource(input)) return guard.bytes.snapshotSource(input, EstError, "est/bad-input", "a CSR");
   if (typeof input === "string") return csr.pemDecode(input);
   throw E("est/bad-input", "a CSR must be a DER BufferSource or a PEM CERTIFICATE REQUEST string");
 }
 
-// Parse + validate the request URL BEFORE any transport is called: a URL that will not
-// parse is est/bad-url, a non-https URL is est/insecure-url (RFC 7030 sec. 3.3). Runs
-// even when a transport is injected, so an insecure URL never reaches the wire.
 function _parseUrl(urlStr) {
   var url;
   try { url = new URL(String(urlStr)); }
@@ -1008,18 +744,11 @@ function _parseUrl(urlStr) {
   return url;
 }
 
-// Map opts.tls (operator-facing) to the transport request.tls shape (anchors -> ca).
-// rejectUnauthorized is NOT here -- the transport forces it on unconditionally.
 function _tlsForRequest(opts) {
   var t = opts.tls || {};
   return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
 }
 
-// Resolve a redirect target: reject a scheme downgrade (est/insecure-redirect) or a
-// cross-origin redirect on a non-GET/HEAD method without opt-in
-// (est/cross-origin-redirect); a Location that will not parse is est/bad-url. Same-origin
-// (and cross-origin GET/HEAD) are followed -- the transport re-runs every TLS check on the
-// new connection (RFC 7030 sec. 3.2.1).
 function _redirectTarget(current, location, method, opts) {
   if (location == null || String(location).trim() === "") throw E("est/http-error", "a redirect response carried no Location header");
   var resolved;
@@ -1033,14 +762,6 @@ function _redirectTarget(current, location, method, opts) {
   return resolved;
 }
 
-// Does WWW-Authenticate advertise the given auth-scheme as a TOKEN? The quoted-string contents are blanked
-// first (a quoted auth-param may contain a comma + the scheme name, e.g. `Digest realm="x, Basic required"`,
-// which must NOT be read as a Basic challenge), then the scheme is matched at the start or after a
-// comma-separated challenge, followed by whitespace / a comma / end -- never a substring, so `Digest
-// realm="basic"` is not taken as Basic. `scheme` is always our own literal ("Basic" / "Digest").
-// Blank the CONTENTS of every complete quoted-string (/"(?:[^"\\]|\\.)*"/g -> `""`) by character scan: a
-// `\` escapes the next character, so `\"` does not close; an unterminated final quote is left as written
-// (the regex only matches a closed quoted-string).
 function _blankQuotedStrings(s) {
   var out = "", last = 0, i = 0, n = s.length;
   while (i < n) {
@@ -1054,9 +775,6 @@ function _blankQuotedStrings(s) {
   }
   return out + _strSlice(s, last, n);
 }
-// Is `scheme` (our own literal, case-insensitive) offered as a challenge TOKEN in the blanked header?
-// (?:^|,)\s*SCHEME(?=[\s,]|$): at the start or after a comma, optional whitespace, the scheme, then a
-// whitespace / comma / end boundary -- never a substring, so `Digest realm="basic"` is not read as Basic.
 function _schemeOffered(s, scheme) {
   var n = s.length, slen = scheme.length, p, k;
   for (p = 0; p <= n; p++) {
@@ -1080,9 +798,6 @@ function _schemeOffered(s, scheme) {
 function _offersScheme(www, scheme) {
   return _schemeOffered(_blankQuotedStrings(String(www || "")), scheme);
 }
-// The chosen HTTP auth scheme: an explicit opts.auth.scheme wins; a legacy opts.username / opts.password
-// WITHOUT opts.auth means Basic (backwards compatible); otherwise none. There is NO scheme:"auto" -- a
-// Basic<->Digest downgrade is never silently chosen (a MITM stripping Digest to Basic must not succeed).
 function _authScheme(opts) {
   if (opts.auth && opts.auth.scheme != null) {
     var sc = String(opts.auth.scheme).toLowerCase();
@@ -1094,60 +809,34 @@ function _authScheme(opts) {
 }
 function _authUser(opts) { return opts.auth && opts.auth.username !== undefined ? opts.auth.username : opts.username; }
 function _authPass(opts) { return opts.auth && opts.auth.password !== undefined ? opts.auth.password : opts.password; }
-// Credentials present -- an EMPTY username is allowed (RFC 7030 sec. 3.2.3), so "defined" (not "truthy").
 function _hasCreds(opts) { return _authUser(opts) !== undefined || _authPass(opts) !== undefined; }
 var DIGEST_CODES = { unsupportedAlgorithm: "est/digest-unsupported-algorithm", weakAlgorithm: "est/digest-weak-algorithm", noQop: "est/digest-no-qop", badChallenge: "est/digest-bad-challenge" };
-// The Digest answer policy, from opts.auth. The SAME object drives challenge SELECTION (parseChallenge) and
-// the ANSWER (answer), so the client never selects a challenge under one policy then answers under another.
 function _digestPolicy(opts) { return { allowMD5: !!(opts.auth && opts.auth.allowMD5), allowLegacyQop: !!(opts.auth && opts.auth.allowLegacyQop), codes: DIGEST_CODES }; }
 
-// The redirect-follow + HTTP-auth-retry loop. Returns the terminal transport response
-// ({status, headers, body}) -- a 2xx, a 202, or a non-401 4xx/5xx. A 3xx is followed
-// (bounded by maxRedirects); a 401 is answered ONCE with Basic credentials, and ONLY when
-// the caller supplied them and the challenge is Basic (RFC 7030 sec. 3.2.3) -- the server
-// was authenticated by the transport's rejectUnauthorized TLS before any credential is
-// transmitted (no credential ever precedes server authorization).
 function _drive(method, url, body, headers, opts, transport, budgets) {
   var redirects = 0;
   var authTried = false;
-  var staleRetries = 0;   // bounded re-answers to a Digest stale=true re-challenge (a fresh nonce), never an open loop
-  var authSpaces = 0;     // distinct Digest protection spaces (realms) entered beyond the first -- bounded so a server cannot loop with an endless stream of new realms
-  var lastDigestNonce = null;   // the nonce just answered -- a stale=true retry MUST carry a DIFFERENT (fresh) nonce
-  var initialOrigin = url.origin;   // the origin the caller intended to authenticate to
-  // The per-hop TLS: the origin-specific identity (mTLS cert/key + pinned SNI) is sent ONLY to the caller's
-  // configured origin; a cross-origin hop gets a narrowed copy with those stripped (checkServerIdentity kept).
-  // Derived FRESH from budgets.tls each hop (the ACME _tlsFor model) so a redirect back to the original origin
-  // restores its identity rather than permanently losing the SNI at the first cross-origin boundary.
+  var staleRetries = 0;
+  var authSpaces = 0;
+  var lastDigestNonce = null;
+  var initialOrigin = url.origin;
   function _tlsFor(u) {
     var t = budgets.tls;
     if (t && u.origin !== initialOrigin) {
-      // Every cross-origin hop overrides the client identity with an explicit null, unconditionally: an
-      // omitted field falls back to the transport's own configured defaults (http-transport resolves
-      // reqTls.cert !== undefined ? reqTls.cert : tlsDefaults.cert), so the override must fire even when the
-      // request-level tls carries no credential, or a transport default would still reach the new origin.
       t = Object.assign({}, t);
       t.cert = null; t.key = null; t.servername = null;
     }
     return t;
   }
-  // The per-hop Authorization, sent ONLY to the caller's origin (a cross-origin hop travels unauthenticated; a
-  // redirect back to the origin restores it -- mirrors _tlsFor). A Basic credential is target-INDEPENDENT, so it
-  // is cached whole in authValue. A Digest response is bound to the request method + target, so the CHALLENGE is
-  // cached and the answer is (re)computed for the CURRENT method / uri on every hop -- a same-origin redirect (or
-  // a 303 POST->GET) then gets a target-correct answer instead of a stale one the server would reject.
   var authValue = null;
   var digestChallenge = null;
-  var digestNcByNonce = Object.create(null);   // nonce string -> count of requests answered under THAT nonce, tracked PER NONCE so a nonce reissued after others were used never repeats an nc (RFC 7616 sec. 3.4); bounded by the total answered 401s; a null-proto map so an attacker-chosen nonce (e.g. "__proto__") is an ordinary key
-  var digestSent = false;   // whether the LAST request actually carried a Digest Authorization -- the DIRECT signal that a following 401 rejects a credential, vs. is a fresh challenge for a request sent unauthenticated
+  var digestNcByNonce = Object.create(null);
+  var digestSent = false;
   function _headersFor(u) {
     digestSent = false;
     if (u.origin !== initialOrigin || (!authValue && !digestChallenge)) return headers;
     var hh = Object.assign({}, headers);
     if (digestChallenge) {
-      // Preemptively reuse the cached answer only WITHIN the challenge's protection space (RFC 7616 sec. 3.5):
-      // a same-origin redirect to a URI outside the challenge's `domain` is sent unauthenticated, so the target
-      // resource's own challenge drives a fresh authentication instead of receiving an Authorization computed
-      // for the wrong protection space.
       if (!httpDigest.inProtectionSpace(digestChallenge, u.origin, u.pathname + u.search)) return headers;
       var nkey = digestChallenge.nonce;
       digestNcByNonce[nkey] = (digestNcByNonce[nkey] || 0) + 1;
@@ -1159,21 +848,8 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   function step() {
     return transport({ method: method, url: url.href, headers: _headersFor(url), body: body, tls: _tlsFor(url), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
       res = res || {};
-      // Measure an injected string body as UTF-8 -- the byte width the body is decoded/transfer-decoded at,
-      // and what the real socket transport counts -- so a non-ASCII body (multi-byte chars are ~half the
-      // count under latin1) cannot undercount past the DoS cap and reach body handling.
       var blen = _bodyLen(res);
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
-      // The transport contract returns lowercased headers, but the injectable seam only promises
-      // { status, headers, body }; normalize here so a redirect Location / WWW-Authenticate from an
-      // injected transport using ordinary HTTP casing is read correctly (never missed as absent).
-      //
-      // Through the SAME accessors classifyResponse uses, not a fold of its own: a
-      // last-value-wins fold keeps one line of a field that arrived under two
-      // spellings, so a usable challenge sent before an unusable one would vanish
-      // and the exchange would be refused for offering nothing this client speaks.
-      // Location is a singleton, so a second one is an ambiguity and refused;
-      // WWW-Authenticate is a list, so every challenge is kept.
       var h = {
         location: _ciHeader(res.headers, "location"),
         "www-authenticate": _ciHeaderList(res.headers, "www-authenticate"),
@@ -1181,53 +857,32 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
       var status = res.status;
       if (status >= 300 && status < 400) {
         if (redirects >= budgets.maxRedirects) throw E("est/too-many-redirects", "the redirect chain exceeded maxRedirects=" + budgets.maxRedirects + " (RFC 7030 sec. 3.2.1)");
-        // 303 See Other directs a non-GET/HEAD request to retrieve the target with GET and no body
-        // (RFC 7231 sec. 6.4.4); drop the request body + its entity content-type before following, so
-        // the CSR is not re-POSTed to the redirect target as a duplicate enrollment.
         if (status === 303 && method !== "GET" && method !== "HEAD") {
           method = "GET";
           body = null;
           if (headers["content-type"]) { headers = Object.assign({}, headers); delete headers["content-type"]; }
         }
         url = _redirectTarget(url, h.location, method, opts);
-        // Credentials MUST NOT cross an origin boundary: the HTTP Basic Authorization header and the
-        // ORIGIN-SPECIFIC TLS identity (mTLS cert/key + pinned SNI) are BOTH scoped per hop (_headersFor /
-        // _tlsFor), so each is absent off-origin but restored on a hop back to the caller's configured origin.
         redirects += 1;
         return step();
       }
       if (status === 401) {
-        // Answer a challenge ONLY on the origin the caller targeted: a 401 arriving after a cross-origin
-        // redirect is a different server, and the client MUST NOT send its credentials there (RFC 7030 sec. 3.6).
         if (url.origin !== initialOrigin) throw E("est/auth-required", "refusing to send HTTP credentials to a redirected origin (RFC 7030 sec. 3.6)");
         var www = String(h["www-authenticate"] || "");
-        // Bound the attacker-controlled challenge header BEFORE any scheme scan / copy (_offersScheme, the parser):
-        // an injected transport without its own header limit must not cause unbounded allocation or work despite
-        // the parser's own cap being applied later (CWE-400). The cap matches the Digest parser's.
         if (www.length > constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES) throw E("est/auth-required", "the WWW-Authenticate header exceeds the " + constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES + "-byte cap (RFC 7030 sec. 3.2.3)");
         var scheme = _authScheme(opts);
         if (scheme === null) throw E("est/auth-required", "the server requires HTTP authentication but no credentials were supplied (RFC 7030 sec. 3.2.3)");
         if (scheme === "digest") {
           if (!_offersScheme(www, "Digest")) throw E("est/auth-required", "opts.auth.scheme is \"digest\" but the server offered no Digest challenge: " + www);
           if (!_hasCreds(opts)) throw E("est/auth-required", "Digest authentication requires opts.auth.username / password (RFC 7030 sec. 3.2.3)");
-          // In a credential-rejection context (this request carried a Digest answer), bias selection toward a
-          // RETRYABLE stale=true offer so a stronger stale=false offer does not shadow one that could re-answer.
           var selPol = _digestPolicy(opts);
           selPol.preferStale = digestSent;
-          selPol.priorNonce = lastDigestNonce;   // a retryable stale offer must carry a nonce DIFFERENT from the one just rejected
-          selPol.priorRealm = digestChallenge && digestChallenge.realm;   // ...and be for the SAME realm that was rejected (a different realm is a new space, not a retry)
-          selPol.requestOrigin = url.origin;                       // prefer an offer whose protection space actually covers THIS request --
-          selPol.requestTarget = url.pathname + url.search;        // one scoped elsewhere cannot authenticate it and must not shadow one that can
+          selPol.priorNonce = lastDigestNonce;
+          selPol.priorRealm = digestChallenge && digestChallenge.realm;
+          selPol.requestOrigin = url.origin;
+          selPol.requestTarget = url.pathname + url.search;
           var ch = httpDigest.parseChallenge(www, E, "est/digest-bad-challenge", selPol);
           if (!ch) throw E("est/auth-required", "the server offered no usable Digest challenge: " + www);
-          // Whether this 401 REJECTS a credential turns on the DIRECT signal (RFC 7616 sec. 3.3 / 3.5): did the
-          // request that received it actually CARRY a Digest answer for THIS protection space? A request sent
-          // unauthenticated -- the first attempt, or one whose target lay outside the cached challenge's domain --
-          // has not authenticated, so its 401 (even in the same realm) is a FRESH challenge to answer, never a
-          // rejection. A credentialed request refused in the SAME realm IS a rejection of that credential: only a
-          // stale=true re-challenge carrying a FRESH nonce may retry (a repeated nonce with stale=true is a
-          // self-contradictory / hostile server -> terminate). Any fresh authentication -- the first, a newly
-          // entered protection space, or an unauthenticated resource -- is bounded (maxRedirects) against a loop.
           if (digestSent && digestChallenge && ch.realm === digestChallenge.realm) {
             if (!(ch.stale && ch.nonce !== lastDigestNonce && staleRetries < budgets.maxStaleRetries)) throw E("est/auth-required", "the server rejected the credentialed Digest request (RFC 7030 sec. 3.2.3)");
             staleRetries += 1;
@@ -1235,26 +890,15 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
             if (authTried && authSpaces >= budgets.maxRedirects) throw E("est/auth-required", "the server demanded Digest authentication for too many distinct protection spaces (RFC 7616 sec. 3.3)");
             if (authTried) authSpaces += 1;
             authTried = true;
-            staleRetries = 0;   // a fresh authentication (new space / unauthenticated resource) restarts the stale budget
+            staleRetries = 0;
           }
           lastDigestNonce = ch.nonce;
-          // Cache the CHALLENGE, not a fixed answer: _headersFor computes the response for the CURRENT method /
-          // request-target on each hop, so a same-origin redirect (or a 303 POST->GET) gets a target-correct answer
-          // rather than a stale one. A policy fault (MD5 / no-qop / unsupported) surfaces from _headersFor on the
-          // immediate re-send (the transport is not reached, so a rejected leg still proves calls did not advance).
-          // The nonce-count is tracked PER NONCE (digestNcByNonce), so a nonce reissued after other nonces were
-          // used in between resumes its own count -- a (nonce, nc) pair is never replayed, without a reset here.
           digestChallenge = ch;
           return step();
         }
-        // Basic (default / explicit): the one-shot semantics unchanged.
         if (authTried) throw E("est/auth-required", "the server rejected the credentialed request (RFC 7030 sec. 3.2.3)");
         if (!_offersScheme(www, "Basic")) throw E("est/auth-required", "the server requires an unsupported HTTP authentication scheme (only Basic and Digest are supported): " + www);
-        // An explicit auth.scheme:"basic" with no credentials must fail closed too (an empty username stays legal),
-        // never transmit a "Basic Og==" (base64 of ":") the operator never supplied.
         if (!_hasCreds(opts)) throw E("est/auth-required", "the server requires HTTP authentication but no credentials were supplied (RFC 7030 sec. 3.2.3)");
-        // Establish the credential as origin-scoped state (_headersFor attaches it only on the initial origin),
-        // never a mutation of the shared headers that would leak across a cross-origin redirect.
         authValue = "Basic " + Buffer.from((_authUser(opts) || "") + ":" + (_authPass(opts) || ""), "utf8").toString("base64");
         authTried = true;
         return step();
@@ -1265,12 +909,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   return step();
 }
 
-// The shared client entry: build the op URL, validate it + the trust config + the budgets
-// (ALL before any transport call so a config fault proves the transport was never reached),
-// then drive the request through the redirect/auth loop.
 function _client(op, method, baseUrl, body, headers, opts) {
-  // paths() concatenates onto the base string, so a query / fragment on the base URL would capture
-  // the operation path (sending the request -- possibly an enrollment CSR -- to the wrong resource).
   var base;
   try { base = new URL(String(baseUrl)); }
   catch (e) { throw E("est/bad-url", "the EST base URL did not parse: " + String(baseUrl), e); }
@@ -1290,45 +929,29 @@ function _client(op, method, baseUrl, body, headers, opts) {
     maxRedirects: guard.limits.cap(opts.maxRedirects, "maxRedirects", 5, { E: E, code: "est/bad-input", min: 0, max: 32 }),
     maxStaleRetries: guard.limits.cap(opts.auth && opts.auth.maxStaleRetries, "maxStaleRetries", 1, { E: E, code: "est/bad-input", min: 0, max: 8 }),
   };
-  _authScheme(opts);   // config-time: a bad opts.auth.scheme throws est/bad-input here, never deferred to a 401
+  _authScheme(opts);
   return _drive(method, url, body, Object.assign({}, headers), opts, transport, budgets);
 }
 
-// Turn a terminal response into the verb result: classifyResponse gates status +
-// content-type (202 -> a surfaced retry, never slept; 4xx/5xx -> est/http-error), then an
-// empty 200 is rejected and the certs-only body is decoded + validated. For an enroll, the
-// issued certificate is the public-key match (findIssuedCert), never a positional guess;
-// the remaining certificates are the chain.
 function _certsResult(op, res, opts, csrSpki) {
   var verdict = classifyResponse(res.status, res.headers, res.body, { op: op, now: opts.now });
   if (verdict.status === "retry") {
-    // 202 Retry-After is an ENROLLMENT response (RFC 7030 sec. 4.2.3); a successful /cacerts is 200
-    // only (sec. 4.1.3), so a 202 there is a nonconforming server -> fail closed rather than "retry".
     if (op === "cacerts") throw E("est/http-error", "a /cacerts response must be HTTP 200, not 202 (RFC 7030 sec. 4.1.3)");
     return { retry: true, retryAfterSeconds: verdict.retryAfterSeconds, retryAfterDate: verdict.retryAfterDate };
   }
-  // Only the RFC-defined success statuses are accepted: a non-standard 2xx (201, 206, ...) that the
-  // classifier reports as "unexpected" must NOT have its body decoded and accepted as certificates.
   if (verdict.status !== "ok") throw E("est/http-error", "an EST " + op + " response must be HTTP 200 or 202 (RFC 7030 sec. 4.1.3 / 4.2.3), got " + res.status);
-  // Measure the body as UTF-8 for parity with the transport cap above (this check only distinguishes empty
-  // from non-empty, where the encoding is immaterial, but the shape is kept uniform so no site undercounts).
   var bodyLen = _bodyLen(res);
   if (bodyLen === 0) throw E("est/empty-body", "a 200 " + op + " response carried an empty body (RFC 7030 sec. 4.1.3 / 4.2.3)");
   var parsed = parseCertsOnly(transferDecode(res.body));
   if (op === "cacerts") return { certificates: parsed.certificates, crls: parsed.crls };
   var issued = findIssuedCert(parsed.certificates, csrSpki);
   if (!issued) throw E("est/issued-cert-not-found", "no returned certificate matched the submitted CSR public key (RFC 5272 sec. 4.1)");
-  // The chain is every OTHER response certificate (by reference, so a byte-identical duplicate is
-  // NOT silently collapsed into the issued cert). Exactly one certificate may match the submitted
-  // public key -- a second match (a renewed cert sharing the key, or a duplicate entry) makes the
-  // issued certificate ambiguous, since the certs-only set has no issuance ordering (RFC 5272 sec. 4.1).
   var chain = parsed.certificates.filter(function (c) { return c !== issued; });
   if (findIssuedCert(chain, csrSpki)) throw E("est/ambiguous-issued-cert", "the enroll response carried more than one certificate matching the submitted CSR public key; the issued certificate is ambiguous (RFC 5272 sec. 4.1)");
   if (opts.strict && chain.length > 0) throw E("est/unexpected-certs", "strict: the enroll response carried " + parsed.certificates.length + " certificates, expected exactly the issued one");
   return { certificate: issued, chain: chain, certificates: parsed.certificates };
 }
 
-// ---- /fullcmc (RFC 7030 sec. 4.3) ---------------------------------------
 
 /**
  * @primitive  pki.est.fullcmc
@@ -1422,83 +1045,30 @@ function _certsResult(op, res, opts, csrSpki) {
  */
 function fullcmc(baseUrl, request, opts) {
   opts = opts || {};
-  // Everything this exchange MEANS is captured synchronously, before a single
-  // deferred turn: the request bytes (copied), the keys they ask to have
-  // certified, and the state the response will be checked against. Doing it
-  // inside the promise body below would be a turn too late -- a caller that
-  // mutates the buffer or flips allowUnverifiedResponse on the line after this
-  // call has already changed them by then, which is the easiest version of the
-  // race to hit and the one that would skip the signature check.
   var der, wanted, sent;
   try {
     if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw E("est/bad-input", "pki.est.fullcmc options must be an object");
-    // Inside the try, so the refusal is a REJECTION like every other failure of this verb: it is
-    // documented as Promise-returning, and a synchronous throw escapes the `.catch(...)` a caller
-    // has already written. It stays in the synchronous capture rather than moving into a later turn,
-    // because that is what closes the race described above.
     _knownOpts(opts, FULLCMC_OPTS, "fullcmc");
     der = _cmcRequestDer(request);
-    // Confirm this IS a Full PKI Request before any of it goes over the wire. The
-    // bytes are about to be labeled `smime-type=CMC-request`, so a PKIResponse or
-    // an unparseable blob handed in by mistake would be POSTed to a CA under a
-    // label that does not describe it -- and, since only an `issued` outcome is
-    // correlated, could still come back as a pending or rejected verdict, making
-    // the mistake look like a protocol answer. A caller error belongs at the entry
-    // point, not on the network.
     wanted = _requestedPublicKeys(der);
-    // The exchange state is READ BACK OUT OF THE REQUEST, not taken on the caller's
-    // word. A value supplied here that the request does not actually carry would
-    // have the response checked against a binding this exchange never sent -- and a
-    // replayed response echoing that value would satisfy it. What the request says
-    // is the only thing that can bind the answer to it.
     sent = _cmcSent(opts, der);
-    // The TRANSPORT options are pinned here too, not only the binding state. They
-    // decide where this request goes and what trust it goes under -- transport,
-    // tls, credentials, redirect policy.
     opts = _shallowCopy(opts);
-    // And the request is STARTED here, synchronously, rather than in a deferred
-    // turn. That is what actually closes the window: a copy only reaches as deep
-    // as it is written, so nested config (opts.tls and its anchors) would still be
-    // the caller's to change while the request sat queued. Handing the options to
-    // _client before yielding leaves no turn in which any of them, at any depth,
-    // can differ from what this call was made with.
     var body = transferEncode(der);
     return _client("fullcmc", "POST", baseUrl, body,
       { accept: "application/pkcs7-mime", "content-type": "application/pkcs7-mime; smime-type=CMC-request" }, opts)
       .then(function (res) { return _fullcmcResult(res, opts, wanted, sent); });
   } catch (e) {
-    return Promise.reject(e);   // the surface stays promise-rejecting, never throwing
+    return Promise.reject(e);
   }
 }
 
-/**
- * Tie a returned certificate bag back to the requests it claims to answer, for
- * BOTH response arms -- the rule is one rule, so it lives in one place rather than
- * being restated per arm where one arm can quietly lose it.
- *
- * Every certification request the message submitted must be answered before the
- * exchange reads as an issuance: a bag holding a CA chain, someone else's
- * certificate, or only some of the requested keys is a partial or unrelated answer,
- * not a success. Matching is by public key, the only identification RFC 5272
- * sec. 4.1 sanctions ("the certificates are in any order" -- position means
- * nothing).
- *
- * Each certificate is CONSUMED as it is matched, so two requests that share a
- * public key -- CSRs for different subjects, say -- need two certificates rather
- * than matching the same one twice and reporting an unanswered request as answered.
- */
+
 function _correlateIssued(bag, wanted, arm) {
   if (!wanted.length) {
     throw E("est/no-issued-cert",
       "this /fullcmc request declared no certification request whose key a returned certificate could be " +
       "matched against, so a " + arm + " response cannot be read as an issuance (RFC 5272 sec. 4.1)");
   }
-  // Counted PER DISTINCT KEY, because "how many certificates should match this
-  // key?" is answered by how many requests asked for it. Two requests may share a
-  // public key deliberately -- different subjects for one key -- and a CA
-  // answering both returns two certificates for it. Rejecting the second as
-  // ambiguous would refuse the complete, correct response; requiring only one
-  // would let a half-answer pass. So the count must agree exactly.
   var byKey = {};
   wanted.forEach(function (k) {
     var hex = k.toString("hex");
@@ -1520,19 +1090,9 @@ function _correlateIssued(bag, wanted, arm) {
         "requests for it; the issued certificate is ambiguous (RFC 5272 sec. 4.1)");
     }
   });
-  // Each certificate handed out once. Where the requested keys are distinct this
-  // lands in request order; where several requests share ONE key it cannot, and
-  // does not pretend to -- the public key is the only identification RFC 5272
-  // sec. 4.1 sanctions, so when it is shared nothing in the response says which
-  // of those requests a given certificate answers. What is established either way
-  // is the set: every requested key is answered, and by exactly as many
-  // certificates as asked for it.
   return wanted.map(function (k) { return byKey[k.toString("hex")].have.shift(); });
 }
 
-// Every certificate in the bag whose subject public key is `key`, found through
-// the same public-key match the single-certificate case uses so the two cannot
-// disagree about what "matches" means.
 function _allMatching(bag, key) {
   var rest = bag.slice(), out = [], hit;
   while ((hit = findIssuedCert(rest, key)) !== null) {
@@ -1542,14 +1102,6 @@ function _allMatching(bag, key) {
   return out;
 }
 
-// The public keys the submitted Full PKI Request asked to have certified. A
-// certs-only answer carries no status and no request reference, so these are the
-// ONLY thing a returned certificate can be tied back to -- and RFC 5272 sec. 4.1
-// forbids identifying the issued certificate positionally ("the certificates are
-// in any order"). Both key-bearing request arms are read; an `orm` arm carries no
-// key and contributes none, and an arm that will not parse contributes none rather
-// than failing the exchange -- the caller still gets a refusal downstream, because
-// an empty set cannot match anything.
 function _requestedPublicKeys(der) {
   var out = [], body;
   try { body = cmcFmt.parse(der); }
@@ -1562,12 +1114,6 @@ function _requestedPublicKeys(der) {
       "pki.est.fullcmc sends a Full PKI Request (id-cct-PKIData); this input is a " + body.kind);
   }
   (body.requests || []).forEach(function (r) {
-    // A key-bearing arm whose key cannot be read must NOT quietly contribute
-    // nothing. The CMC parser validates these arms only far enough to find their
-    // identity, so a malformed one reaches here; dropping it would leave the
-    // correlation blind to a request that was still sent, and a response covering
-    // only the readable arms would then read as a complete issuance. Refused at
-    // the entry point, like any other request this verb cannot stand behind.
     var before = out.length;
     var keyBearing = !!(r.certificationRequestBytes || r.certReqMsgBytes);
     try {
@@ -1578,16 +1124,9 @@ function _requestedPublicKeys(der) {
         return;
       }
       if (r.certReqMsgBytes) {
-        // pki.schema.crmf reads CertReqMessages (SEQUENCE OF CertReqMsg); the CMC
-        // arm holds ONE CertReqMsg, so it is wrapped rather than decoded here --
-        // the CRMF rules stay in the CRMF parser instead of being restated.
         var msgs = crmfFmt.parse(asn1.build.sequence([r.certReqMsgBytes])).messages;
         var msg0 = msgs && msgs[0];
         var tmpl = msg0 && msg0.certReq && msg0.certReq.certTemplate;
-        // RFC 4211 sec. 4.1: the requested key may be absent from the CertTemplate
-        // and carried in the signature POP's POPOSigningKeyInput instead -- a form
-        // this toolkit's own CRMF parser accepts and surfaces. Reading only the
-        // template would refuse a conforming request before it was ever sent.
         var pk = (tmpl && tmpl.publicKey) ||
           (msg0 && msg0.popo && msg0.popo.poposkInput && msg0.popo.poposkInput.publicKey);
         var pkBytes = Buffer.isBuffer(pk) ? pk : (pk && pk.bytes);
@@ -1595,7 +1134,7 @@ function _requestedPublicKeys(der) {
         if (out.length === before) _unreadableArm();
       }
     } catch (e) {
-      if (!keyBearing) return;   // an orm arm carries no key and is not expected to
+      if (!keyBearing) return;
       throw (e && e.code === "est/bad-input") ? e : E("est/bad-input",
         "a certification request in this Full PKI Request could not be read, so a response could not be " +
         "tied back to it; pki.est.fullcmc will not send a request it cannot check the answer to", e);
@@ -1608,21 +1147,8 @@ function _unreadableArm() {
   throw E("est/bad-input", "a certification request in this Full PKI Request declares no readable public key");
 }
 
-// What the caller retained, threaded to pki.cmc.verify -- the exchange binding
-// AND the carrier-authentication inputs. Built in one place so the success and
-// rejection arms cannot drift apart about what this exchange is.
-// Captured SYNCHRONOUSLY, before the request goes out, and with the byte buffers
-// copied. Everything here is read again only after the transport resolves, so
-// reading the caller's live options at that point would let an object mutated
-// during the round trip decide the checks -- and flipping allowUnverifiedResponse
-// mid-flight would skip the signature check the default posture requires.
-// pki.cmc.verify freezes its own inputs too; this is the wrapper's half of the
-// same rule, because by the time it calls verify the damage would already be done.
 function _cmcSent(opts, der) {
   var carried = _requestBinding(der);
-  // A caller-supplied value must AGREE with the request. Silently preferring one
-  // over the other would leave the response checked against something the request
-  // may never have carried; refusing the disagreement keeps the two honest.
   _assertAgrees("transactionId", opts.transactionId, carried.transactionId);
   _assertAgrees("senderNonce", opts.senderNonce, carried.senderNonce);
   _assertAgrees("dataReturn", opts.dataReturn, carried.dataReturn);
@@ -1631,63 +1157,23 @@ function _cmcSent(opts, der) {
     senderNonce: _copyBytes(carried.senderNonce),
     dataReturn: _copyBytes(carried.dataReturn),
     bodyPartIDs: carried.bodyPartIDs,
-    // The nested paths travel with the flat identifiers: a status may name a body part inside a
-    // nested message this request carried, and forwarding only the flat set would leave every
-    // such reference unconfirmable and therefore refused.
     bodyPartPaths: carried.bodyPartPaths,
     certs: Array.isArray(opts.responderCerts) ? opts.responderCerts.map(_copyBytes) : opts.responderCerts,
-    // The AuthenticatedData carrier's key material. Without this the verb could
-    // reach that carrier only through the unauthenticated opt-out -- the capability
-    // would exist one layer down and be unreachable from the one operators call.
     recipient: _copyRecipient(opts.responseRecipient),
     allowUnverified: opts.allowUnverifiedResponse === true,
-    // The binding opt-out travels the same way. Without it the capability would
-    // exist one layer down and be unreachable from the verb operators call: a
-    // request built with no Transaction Identifier, Sender Nonce or Data Return
-    // carries nothing for the response to echo, so pki.cmc.verify would refuse
-    // every answer to it and no option here could say that was intended.
     allowUnbound: opts.allowUnboundResponse === true,
   };
 }
 
-// EVERY byte form the parsers and crypto routines downstream accept, not just the two most
-// common: a DataView or a bare ArrayBuffer arrives by the same door as a Buffer, and the values
-// this copies -- the nonce the response must echo, the certificates that authenticate it, the
-// recipient key material -- are all read after the transport resolves. Covering only Buffer and
-// Uint8Array would leave those forms aliased across the request's whole flight, which is the same
-// window this exists to close, open for exactly the inputs that came in by the wider door.
-// A DataView is copied over its OWN window, not the whole backing buffer it happens to sit in.
-// One call, because guard.bytes decides what a byte form is and where its bytes are. The three
-// hand-rolled branches this replaces read `v.buffer`, `v.byteOffset` and `v.byteLength` off the
-// value, and all three are accessors a caller's subclass can answer: one that lied copied a
-// different store than the array held, so the bytes checked here and the bytes sent later were
-// two different reads.
 function _copyBytes(v) {
   if (!guard.bytes.isByteSource(v)) return v;
   return guard.bytes.snapshotSource(v, EstError, "est/bad-input", "a byte field of the request");
 }
 
-// The exchange-binding controls the request ACTUALLY carries (RFC 5272 sec. 6.6
-// Transaction Identifier / Sender Nonce, sec. 6.4 Data Return). These are what the
-// response has to echo, so they are read from the bytes going out rather than from
-// a parallel claim that could disagree with them.
 function _requestBinding(der) {
   var out = { transactionId: undefined, senderNonce: undefined, dataReturn: undefined, bodyPartIDs: undefined,
     bodyPartPaths: undefined };
-  // Parsed WITHOUT a fallback. The caller reaches this only after the request has
-  // already been confirmed to be a Full PKI Request, so a parse failure here is
-  // impossible rather than expected -- and defaulting to "no binding" if it ever
-  // became possible is the wrong answer anyway: a request whose controls could not
-  // be read would face no echo requirement at all, which is a weaker exchange than
-  // the one being sent. Letting the typed decode error propagate keeps it closed.
   var body = cmcFmt.parse(der);
-  // Every identifier this request actually carries. A status in the response names
-  // the body parts it is ABOUT, and a status naming a body part that was never
-  // sent is not an answer to this request -- so the client keeps the set it can
-  // check that claim against, the same way it keeps the transaction and nonce.
-  // Collected from all four sequences because RFC 5272 sec. 3.2.1 draws every
-  // identifier from ONE space; a status may legitimately reference a control or a
-  // content info, not only a certification request.
   var ids = [];
   var paths = [];
   [body.requests, body.controls, body.cmsSequence, body.otherMsgs].forEach(function (list) {
@@ -1695,12 +1181,6 @@ function _requestBinding(der) {
       if (el && el.bodyPartID != null) { ids.push(el.bodyPartID); paths.push([el.bodyPartID]); }
     });
   });
-  // A cmsSequence element carries a NESTED CMS message, which may itself be a Full PKI
-  // Request (sec. 3.2.1), and a response identifies a body part inside one by the path
-  // [outer, inner...]. This client composed that nested message, so it can confirm such a
-  // path -- but only by reading the message back, which is what this does. A nested message
-  // this parser cannot read back yields no retained path, so a status naming a part inside
-  // it is still refused: what cannot be read cannot be confirmed.
   _collectNestedPaths(body.cmsSequence, [], paths, 0);
   out.bodyPartIDs = ids;
   out.bodyPartPaths = paths;
@@ -1708,22 +1188,12 @@ function _requestBinding(der) {
     var field = c.attrType === OID_CMC_TRANSACTION_ID ? "transactionId"
       : c.attrType === OID_CMC_SENDER_NONCE ? "senderNonce"
         : c.attrType === OID_CMC_DATA_RETURN ? "dataReturn" : null;
-    if (!field) return;                                   // not a binding control
-    // Duplicates are ambiguous, and ambiguity here decides what the response must
-    // echo: taking the last would bind the answer to one of two values the request
-    // sent, chosen arbitrarily. pki.cmc.verify already refuses duplicate binding
-    // controls on the response; the request side is held to the same rule rather
-    // than shipping a message whose own binding cannot be read one way.
+    if (!field) return;
     if (out[field] !== undefined) {
       throw E("est/bad-input",
         "the Full PKI Request carries more than one " + field + " control, so there is no single value " +
         "the response can be bound to (RFC 5272 sec. 6.6 / 6.4)");
     }
-    // A binding control that is PRESENT but unreadable must not decay into
-    // "absent". Doing so would drop the replay check for a request that carries
-    // the control -- the response would then face no echo requirement at all,
-    // which is a weaker exchange than the one being sent. An unreadable security
-    // control is a refusal, not a default.
     var v = c.values && c.values.length === 1 ? c.values[0] : null;
     if (!v) {
       throw E("est/bad-input",
@@ -1742,23 +1212,12 @@ function _requestBinding(der) {
   return out;
 }
 
-// Every body-part path reachable inside the nested messages this request carries, so a status
-// naming one can be confirmed rather than refused outright. Descends only into a nested message
-// this parser reads back as a PKIData: anything else yields no path, and a status naming a part
-// inside it stays a refusal, because a reference that cannot be checked is not one to accept.
-// The depth cap bounds the walk; a request nested deeper than this is composed by nobody in
-// practice, and stopping simply leaves those paths unretained -- which refuses, not accepts.
 var NESTED_PATH_DEPTH_CAP = 8;
 function _collectNestedPaths(list, prefix, out, depth) {
   if (depth >= NESTED_PATH_DEPTH_CAP) return;
   (list || []).forEach(function (el) {
     if (!el || el.bodyPartID == null || !el.contentInfoBytes) return;
     var inner;
-    // A nested element that cannot be read back as a Full PKI Request contributes no path, by
-    // either route: the read throws, or it succeeds and yields some other content type. Both land
-    // on the same refusal downstream -- a status naming a part inside it finds no retained path --
-    // so neither can widen what the response may report on. Nothing is absorbed here that a
-    // verdict then rests on; the absence of a path IS the fail-closed answer.
     try { inner = cmcFmt.parse(el.contentInfoBytes); }
     catch (_e) { /* allow:swallow-unverified the outer request must itself parse for this to run, which already rejects a malformed nested ContentInfo; a payload that survives that and still fails to read back lands on the same no-path refusal the non-pkiData route below takes, which the vectors drive */ return; }
     if (!inner || inner.kind !== "pkiData") return;
@@ -1776,11 +1235,6 @@ function _assertAgrees(name, supplied, carried) {
   if (guard.bytes.isByteSource(supplied)) {
     same = Buffer.isBuffer(carried) && guard.bytes.source(supplied, EstError, "est/bad-input", "opts.senderNonce").equals(carried);
   } else {
-    // Through the shared authoring guard, not a bare BigInt(): a `number` above
-    // Number.MAX_SAFE_INTEGER has already lost the digits that distinguish it from
-    // its neighbor, so converting it here would compare a value the caller never
-    // wrote. A transaction identifier is an unbounded INTEGER on the wire; large
-    // ones are passed as a bigint, and this says so rather than rounding.
     same = carried != null &&
       guard.range.authoredInteger(supplied, E, "est/bad-input", "opts." + name) === BigInt(carried);
   }
@@ -1791,8 +1245,6 @@ function _assertAgrees(name, supplied, carried) {
   }
 }
 
-// The recipient descriptor, one level deep with its byte values copied -- key
-// material is read after the round trip like everything else in this snapshot.
 function _copyRecipient(r) {
   if (!r || typeof r !== "object") return r;
   var out = {}, k;
@@ -1800,14 +1252,6 @@ function _copyRecipient(r) {
   return out;
 }
 
-// Own enumerable properties, one level, plus a copy of `auth`. The extra level is
-// not decoration: credentials are the one nested object read AFTER an await --
-// _drive reads the scheme, the username and password, and the Digest policy only
-// once a 401 comes back -- so leaving it shared would let an options object
-// mutated during the round trip change which credentials go out, or turn on a
-// digest algorithm the request did not start with. Everything else here is either
-// read before the request leaves or is a value the caller means to own (a
-// transport function, a tls config).
 function _shallowCopy(o) {
   var out = {}, k;
   for (k in o) { if (_hasOwn(o, k)) out[k] = o[k]; }
@@ -1819,11 +1263,7 @@ function _shallowCopy(o) {
   return out;
 }
 
-// The Full PKI Request bytes: a DER Buffer, or a PEM CMS block. Anything else is
-// a caller mistake caught before the transport is touched.
 function _cmcRequestDer(request) {
-  // COPIED, not aliased: these bytes are parsed now (for the requested keys) and
-  // transmitted later, so sharing the caller's buffer would let the two disagree.
   if (guard.bytes.isByteSource(request)) {
     return guard.bytes.snapshotSource(request, EstError, "est/bad-input", "the Full PKI Request");
   }
@@ -1831,40 +1271,16 @@ function _cmcRequestDer(request) {
   throw E("est/bad-input", "pki.est.fullcmc requires the Full PKI Request as DER bytes or a PEM CMS block");
 }
 
-// The result function for /fullcmc. Deliberately NOT _certsResult: the two differ
-// on the point RFC 7030 sec. 4.2.3 and sec. 4.3.2 disagree about. On the sibling
-// enroll verbs a Simple PKI Response on an error only MAY be present; on
-// /fullcmc "A CMC response with the content-type of application/pkcs7-mime MUST
-// be included in the response data for any CMC error response", so the CMC
-// verdict is decoded and surfaced. What must NOT happen is the decode failing and
-// taking the HTTP fault with it -- an unreadable error body leaves the fault
-// reported as itself.
 function _fullcmcResult(res, opts, wanted, sent) {
-  // classifyResponse is the single authority on what an HTTP status means here,
-  // and it THROWS est/http-error on a 4xx/5xx rather than returning a verdict.
-  // So the rejection path runs from its exception: the mandated CMC response is
-  // decoded and, if readable, REPLACES the fault with a richer typed one. If it
-  // cannot be read, the original fault is rethrown untouched -- an unreadable
-  // error body is a worse fault than the status, never a way to lose it.
   var verdict;
   try {
     verdict = classifyResponse(res.status, res.headers, res.body, { op: "fullcmc", now: opts.now });
   } catch (httpFault) {
-    // ONLY an actual rejection status earns the richer error. classifyResponse also
-    // throws when a NON-error response fails its own validation -- a 200 with a
-    // missing or unrecognized smime-type, a 202 with no Retry-After -- and those
-    // faults are about the response being malformed, not about the CA refusing.
-    // Letting a signed CMC body replace them would let a malformed 200 answer as
-    // though it were a clean rejection, and the validation it failed would never be
-    // reported. The status is read from the response, not from the fault, so a
-    // future fault type cannot quietly opt itself into the upgrade.
     if (!(res.status >= 400 && res.status <= 599)) throw httpFault;
     return _tryDecodeCmcFault(res, sent).then(function (cmcErr) { throw cmcErr || httpFault; });
   }
 
   if (verdict.status === "not-implemented") {
-    // Takes precedence over any body: the service is absent, so there is no CMC
-    // verdict to read (RFC 7030 sec. 4.3.2 -- 404 or 501).
     throw E("est/not-implemented",
       "the EST server does not implement /fullcmc (HTTP " + verdict.httpStatus + "; RFC 7030 sec. 4.3.2)");
   }
@@ -1880,18 +1296,7 @@ function _fullcmcResult(res, opts, wanted, sent) {
   if (bodyLen === 0) throw E("est/empty-body", "a 200 /fullcmc response carried an empty body (RFC 7030 sec. 4.3.2)");
   var der = transferDecode(res.body);
 
-  // FC5 admits two smime-types, and the LABEL must agree with the BYTES: a
-  // certs-only label over a Full PKI Response (or the reverse) is a server
-  // mislabeling its own body, and accepting either shape under either label
-  // would make the content-type check decorative.
-  // Through the shared case-insensitive accessor: HTTP header names are
-  // case-insensitive (RFC 9110 sec. 5.1), the classifier already reads them that
-  // way, and a second lookup that guessed at two spellings would disagree with it
-  // for a conformant server -- routing a certs-only body down the wrong arm.
   var pt200 = _partMediaType(_ciHeader(res.headers, "content-type"));
-  // A header declaring BOTH arms selects neither. Taking the first would let the
-  // order of two labels decide which shape the body is read as, on a header whose
-  // whole job here is to say which one it is.
   if (pt200.ambiguous) {
     throw E("est/bad-content-type",
       "the 200 /fullcmc Content-Type declares more than one smime-type, so which response arm this is " +
@@ -1899,13 +1304,6 @@ function _fullcmcResult(res, opts, wanted, sent) {
   }
   var smimeType = pt200.smimeType;
   if (smimeType === "certs-only") {
-    // A certs-only body is a degenerate certificates-only SignedData: it carries no
-    // CMC controls, so it CANNOT echo a Transaction Identifier, Sender Nonce or
-    // Data Return. A client that sent those asked for replay binding, and the
-    // public-key correlation below is not one -- an old response for the same key
-    // still matches. Accepting this arm would silently give none of what was asked
-    // for, so it is refused; a caller who does not need the binding simply does not
-    // send the controls.
     var unecho = ["transactionId", "senderNonce", "dataReturn"].filter(function (k) {
       return sent[k] != null;
     });
@@ -1914,12 +1312,6 @@ function _fullcmcResult(res, opts, wanted, sent) {
         "the request carried " + unecho.join(" / ") + ", which a certs-only response has no controls to " +
         "echo, so the replay binding it asked for cannot be checked (RFC 5272 sec. 6.6 / 6.4)");
     }
-    // Reaching here means the request asked for no binding, so nothing whatever
-    // ties this bag of certificates to this exchange. The public-key correlation
-    // below is explicitly not a binding, since an old response for the same key
-    // matches just as well. pki.cmc.verify takes this posture on the other arm,
-    // and it is taken here too: one arm quietly accepting what the other refuses
-    // would make which rule applied depend on the smime-type the server chose.
     if (sent.allowUnbound !== true) {
       throw E("est/unbound-response",
         "nothing ties this certs-only response to the request just sent: a certs-only body carries no " +
@@ -1927,30 +1319,9 @@ function _fullcmcResult(res, opts, wanted, sent) {
         "answers with a CMC-response, or pass `allowUnboundResponse: true` to accept a bag of certificates " +
         "that could answer any earlier request for the same key (RFC 5272 sec. 6.6)");
     }
-    var certs = parseCertsOnly(der);            // throws est/not-certs-only on a Full PKI Response
-    // A certs-only body says nothing about WHICH request it answers -- no status,
-    // no body-part reference. So the issued certificate is identified the one way
-    // RFC 5272 sec. 4.1 sanctions, by public-key match against what was submitted,
-    // exactly as /simpleenroll and /serverkeygen already do. Without this, a bag
-    // holding only a CA chain -- or a certificate for someone else's key -- reads
-    // as a successful issuance for this request.
+    var certs = parseCertsOnly(der);
     var issuedCerts = _correlateIssued(certs.certificates, wanted, "certs-only");
     var issued = issuedCerts[0];
-    // `signatureVerified: false` is stated, not omitted. A certs-only body is a
-    // DEGENERATE certificates-only SignedData -- RFC 5652 sec. 5.2 defines it with
-    // an empty signerInfos set -- so there is no signature here to check, and
-    // demanding one would reject every conformant server. What this arm must not
-    // do is leave the field undefined while the cmc-response arm sets it: a caller
-    // reading `verdict.signatureVerified` would then get a different KIND of answer
-    // depending on which arm the server happened to choose. RFC 7030 secures this
-    // arm through the authenticated TLS channel instead, and the certificates stay
-    // `trusted: false` for the caller to run through pki.path.validate.
-    // `bound` and `boundToRequest` are stated here for the same reason
-    // `signatureVerified` is: leaving them undefined while the CMC-response arm
-    // sets them would give a caller a different kind of answer depending on which
-    // arm the server chose. Every one is false and cannot be otherwise, because a
-    // certs-only body has no controls to echo. That is what the refusal above
-    // makes the caller acknowledge before reading this verdict at all.
     return { outcome: "issued", certificate: issued, issuedCertificates: issuedCerts,
       certificates: certs.certificates, crls: certs.crls,
       controls: [], statuses: [], publishTrustAnchors: null, trusted: false,
@@ -1958,28 +1329,8 @@ function _fullcmcResult(res, opts, wanted, sent) {
       bound: { transactionId: false, senderNonce: false, dataReturn: false, bodyPartIDs: false },
       boundToRequest: false };
   }
-  // smime-type=cmc-response: the Full PKI Response, interpreted into one verdict.
-  // pki.cmc.verify owns the transaction binding and the status reduction; this
-  // verb only supplies what the caller retained.
   return cmcVerify.verify(der, sent).then(function (verdict) {
-    // An `issued` verdict is a claim about THIS request, so it is held to the same
-    // correlation as the certs-only arm. A status control saying success while the
-    // bag holds a CA chain, someone else's certificate, or nothing at all does not
-    // make an issuance -- and the status is the server's word, whereas the key
-    // match is checkable. Only `issued` is correlated: pending / pop-required /
-    // confirm-required / rejected are not claims that a certificate was issued.
     if (verdict.outcome !== "issued") return verdict;
-    // A request that asked for no certificate cannot have one correlated to it. An
-    // orm-only Full PKI Request is exactly that: the other-message arm carries no
-    // certification request and no key, and RFC 5272 lets a server answer it
-    // successfully with its result in the cmsSequence or otherMsgSequence rather
-    // than as an issuance. Reading `issued` there as "a certificate must match"
-    // would make this verb unable to carry that exchange at all. The response's own
-    // certificate bag is still surfaced raw, untrusted, for pki.path.validate.
-    //
-    // The certs-only arm keeps the opposite rule, and deliberately: that body is
-    // nothing BUT a claim of certificate issuance, so with nothing to match it
-    // against there is no way to say it answers this request.
     if (!wanted.length) { verdict.issuedCertificates = []; return verdict; }
     var issuedCerts = _correlateIssued(verdict.certificates, wanted, "CMC-response");
     verdict.certificate = issuedCerts[0];
@@ -1988,38 +1339,13 @@ function _fullcmcResult(res, opts, wanted, sent) {
   });
 }
 
-// Decode the CMC response a rejection MUST carry, returning a typed est/cmc-failed
-// with the verdict attached -- or null when it cannot be read, so the caller
-// reports the HTTP fault instead of an asn1/* leak from a body that was never
-// going to parse.
 function _tryDecodeCmcFault(res, sent) {
   return Promise.resolve().then(function () {
     var pt = _partMediaType(_ciHeader(res.headers, "content-type"));
     if (pt.media !== "application/pkcs7-mime") return null;
-    // A header declaring two smime-types cannot vouch for the body either. This
-    // path returns NULL rather than throwing, so the caller reports the HTTP fault
-    // the response actually carried -- replacing a real server error with a
-    // content-type complaint would hide the thing the operator needs to see.
     if (pt.ambiguous) return null;
-    // The LABEL must agree with the bytes here too. The success path refuses a
-    // certs-only label over a Full PKI Response and the reverse; accepting any
-    // pkcs7-mime on the error path would make that agreement decorative, and would
-    // read a CMC verdict out of a body the server said was something else. RFC 7030
-    // sec. 4.3.2 makes the rejection body a CMC-response.
     if (String(pt.smimeType || "").toLowerCase() !== "cmc-response") return null;
-    // The SAME binding the success path applies. An error response that does not
-    // echo this exchange's transaction / nonce is not this request's answer, and
-    // attaching it would let a replayed or unrelated failure be reported as the
-    // verdict for the request just sent. A binding failure makes verify reject,
-    // which lands in the catch below and leaves the HTTP fault reported.
     return cmcVerify.verify(transferDecode(res.body), sent).then(function (verdict) {
-      // Only an actual REJECTION becomes the richer error. A CMC body inside an
-      // HTTP failure that says the request was issued is the server contradicting
-      // itself, and reporting it as "the server rejected the Full PKI Request:
-      // issued" would hand the caller a successful outcome wrapped in a rejection.
-      // Returning null there leaves the HTTP fault standing, which is the honest
-      // report of what happened. RFC 7030 sec. 4.3.2 makes the body a MUST for a
-      // rejection, which is the case this upgrade exists for.
       if (verdict.outcome !== "rejected") return null;
       var e = E("est/cmc-failed",
         "the EST server rejected the Full PKI Request: " + verdict.outcome +
@@ -2028,11 +1354,6 @@ function _tryDecodeCmcFault(res, sent) {
       e.httpStatus = res.status;
       return e;
     });
-  // EVERY way the attempt can fail lands here, not just the verify rejection:
-  // transferDecode throws synchronously on a non-base64 body, which is exactly
-  // the shape FC7a is about. Returning null makes the caller rethrow the ORIGINAL
-  // HTTP fault -- nothing is absorbed into a verdict, and the richer error is
-  // only ever an upgrade, never a substitute that loses the status.
   }).then(null, function () { return null; });
 }
 
@@ -2079,10 +1400,6 @@ function _enroll(op, baseUrl, csrInput, opts) {
 function cacerts(baseUrl, opts) {
   opts = opts || {};
   return Promise.resolve().then(function () {
-    // Inside the promise, like every other refusal these verbs make. They are documented as
-    // Promise-returning, so a caller writes `.catch(...)` -- and a check that throws synchronously
-    // escapes that catch entirely, turning a misspelled option into an uncaught exception rather
-    // than the rejection the caller is already handling.
     _knownOpts(opts, CACERTS_OPTS, "cacerts");
     return _client("cacerts", "GET", baseUrl, null, { accept: "application/pkcs7-mime" }, opts);
   }).then(function (res) { return _certsResult("cacerts", res, opts, null); });
@@ -2156,25 +1473,17 @@ function simplereenroll(baseUrl, csrInput, opts) {
   return Promise.resolve().then(function () {
     _knownOpts(opts, SIMPLEREENROLL_OPTS, "simplereenroll");
     if (!opts.oldCert) throw E("est/bad-input", "simplereenroll requires opts.oldCert (the certificate being renewed, RFC 7030 sec. 4.2.2)");
-    reenrollGuard(opts.oldCert, _csrDer(csrInput));   // est/reenroll-* on mismatch, BEFORE the POST
+    reenrollGuard(opts.oldCert, _csrDer(csrInput));
     return _enroll("simplereenroll", baseUrl, csrInput, opts);
   });
 }
 
-// ---- /serverkeygen (RFC 7030 sec. 4.4) ----------------------------------
 
-// Derive the server-generated-key ENCRYPTION coherence from the CSR the caller actually POSTs (RFC 7030
-// sec. 4.4.1): a DecryptKeyIdentifier / AsymmetricDecryptKeyIdentifier attribute names the key-encryption
-// key the server must encrypt the generated private key to. Binding the expected recipient to the CSR (not a
-// free-floating opts boolean) closes the drift where a cleartext key rides past a caller who forgot the flag.
 function _serverkeygenEncryptionFromCsr(csrDer) {
   var attrs = csr.parse(csrDer).attributes || [];
   var keyId = null, kind = null;
   for (var i = 0; i < attrs.length; i++) {
     if (attrs[i].type !== OID_DECRYPT_KEY_ID && attrs[i].type !== OID_ASYMM_DECRYPT_KEY_ID) continue;
-    // DecryptKeyIdentifier names a SYMMETRIC key-encryption key; AsymmetricDecryptKeyIdentifier an ASYMMETRIC
-    // one (RFC 7030 sec. 4.4.1). The mechanism is preserved so the returned key part is matched to a compatible
-    // RecipientInfo arm, not merely one whose identifier bytes coincide.
     var thisKind = attrs[i].type === OID_ASYMM_DECRYPT_KEY_ID ? "asymmetric" : "symmetric";
     var vals = attrs[i].values || [];
     if (vals.length !== 1) throw E("est/bad-input", "a serverkeygen key-identifier attribute must carry exactly one value (RFC 7030 sec. 4.4.1)");
@@ -2188,20 +1497,11 @@ function _serverkeygenEncryptionFromCsr(csrDer) {
   return { requestedEncryption: keyId !== null, expectedRecipientKeyId: keyId, expectedRecipientKind: kind };
 }
 
-// The delivered private key rides TLS confidentiality alone: a NULL / anonymous / EXPORT suite MUST NOT be
-// used to carry it (RFC 7030 sec. 4.4, sec. 6). Assert (never reconfigure) the negotiated cipher when the
-// transport surfaces it; an injected transport that reports no cipher is trusted (the test/loopback channel).
-// The weak-cipher token scan (RFC 3986/2119-free ASCII, by character code): a "word" character is
-// [A-Za-z0-9_] (regex \w), and a boundary (\b) sits where a word character meets a non-word one or a
-// string edge. `_subAt`/`_containsSub` test a literal token at / anywhere in an already-uppercased name.
 function _isWordChar(c) { return (c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 95; }
 function _subAt(s, sub, i) { var m = sub.length; if (i + m > s.length) return false; for (var k = 0; k < m; k++) { if (_charCodeAt(s, i + k) !== _charCodeAt(sub, k)) return false; } return true; }
 function _containsSub(s, sub) { for (var i = 0; i + sub.length <= s.length; i++) { if (_subAt(s, sub, i)) return true; } return false; }
 function _wbBefore(s, i) { return i === 0 || !_isWordChar(_charCodeAt(s, i - 1)); }
 function _wbAfter(s, j) { return j === s.length || !_isWordChar(_charCodeAt(s, j)); }
-// /NULL|ANON|EXPORT|\bEXP[-_0-9]|\bA(EC)?DH\b/ over the uppercased name: the three plain substrings, then
-// EXP at a word boundary followed by a separator OR a digit run (EXP-RC4-MD5, EXP1024-RC4-SHA -- a bare
-// \bEXP\b misses EXP1024), then ADH / AECDH each bounded on both sides.
 function _hasWeakCipherToken(name) {
   if (_containsSub(name, "NULL") || _containsSub(name, "ANON") || _containsSub(name, "EXPORT")) return true;
   var i, n = name.length;
@@ -2224,24 +1524,6 @@ function _assertConfidentialCipher(res) {
   if (_hasWeakCipherToken(name)) throw E("est/weak-cipher", "the serverkeygen channel negotiated a NULL / anonymous / EXPORT cipher (" + (c.standardName || c.name) + "), which cannot protect the delivered private key (RFC 7030 sec. 4.4)");
 }
 
-// A case-insensitive header lookup: the injectable transport seam only promises { status, headers, body }, so a
-// hostile / non-Node transport may deliver "Content-Type" in any casing -- read it case-insensitively (classifyResponse
-// normalizes internally, but the multipart boundary is read from the header directly here).
-// A header, read case-insensitively (RFC 9110 sec. 5.1) -- and refused when the map
-// carries the SAME field under more than one spelling. HTTP header names are
-// case-insensitive, so `content-type` and `Content-Type` are one field with two
-// values; a reader that prefers the exact key and a reader that lowercases into a
-// map keep different ones, and this verb has both. Two stages that disagree about
-// which response arm a body is can accept a response the header declares twice
-// over. That is the same ambiguity a repeated Content-Type PARAMETER raises, at the
-// level of the field itself, and it gets the same answer: refused, not resolved by
-// which spelling was reached first.
-// A LIST field, read case-insensitively and combined across every spelling it
-// arrived under. RFC 9110 sec. 5.3 lets a recipient join multiple lines of a
-// list-based field into one comma-separated value, and sec. 11.6.1 makes
-// WWW-Authenticate exactly that -- one challenge per element. Refusing repetition
-// here would reject a server offering both Digest and Basic, which is not an
-// ambiguity but the field doing its job.
 function _ciHeaderList(headers, name) {
   headers = headers || {};
   var lname = name.toLowerCase(), keys = Object.keys(headers), parts = [];
@@ -2272,27 +1554,17 @@ function _ciHeader(headers, name) {
 
 async function _serverkeygenResult(res, opts, derived) {
   var verdict = classifyResponse(res.status, res.headers, res.body, { op: "serverkeygen", now: opts.now });
-  // A 202 is an enrollment posture (RFC 7030 sec. 4.4 treats /serverkeygen as an enroll): surfaced, never slept.
   if (verdict.status === "retry") return { retry: true, retryAfterSeconds: verdict.retryAfterSeconds, retryAfterDate: verdict.retryAfterDate };
   if (verdict.status !== "ok") throw E("est/http-error", "an EST serverkeygen response must be HTTP 200 or 202 (RFC 7030 sec. 4.4.2), got " + res.status);
   var bodyLen = _bodyLen(res);
   if (bodyLen === 0) throw E("est/empty-body", "a 200 serverkeygen response carried an empty body (RFC 7030 sec. 4.4.2)");
   _assertConfidentialCipher(res);
-  // parseServerKeygenResponse does the per-part transfer-decode; the recipient coherence is bound to the CSR.
   var out = parseServerKeygenResponse(res.body, _ciHeader(res.headers, "content-type"), {
     requestedEncryption: derived.requestedEncryption,
     expectedRecipientKeyId: derived.expectedRecipientKeyId,
     expectedRecipientKind: derived.expectedRecipientKind,
     expectedRecipientIssuerSerial: opts.expectedRecipientIssuerSerial,
   });
-  // Bind a CLEARTEXT server-generated key to its certificate (RFC 7030 sec. 4.4.2): the CA generated
-  // this pair and issued a certificate over its PUBLIC half, so the delivered PrivateKeyInfo's public key
-  // MUST equal EXACTLY ONE returned certificate's SubjectPublicKeyInfo -- a key unrelated to every
-  // certificate is an unusable / mis-associated credential, and a key matching more than one leaves the
-  // issued certificate ambiguous. Mirrors simpleenroll's findIssuedCert public-key match; the encrypted
-  // key stays opaque, so its recipient coherence is bound in the parser instead. The public half is
-  // derived through the key engine (never re-serialized here); a key whose public half cannot be derived
-  // is not bindable and fails closed.
   if (out.privateKeyDer) {
     var spki;
     try { spki = await key.publicFromPrivate(out.privateKeyDer); }
@@ -2356,10 +1628,6 @@ function serverkeygen(baseUrl, csrInput, opts) {
       var s = eis.serialNumber;
       if (!((typeof s === "bigint" && s >= 0n) || (typeof s === "number" && Number.isSafeInteger(s) && s >= 0) || (typeof s === "string" && pkix.allCharsIn(s, _DIGITS_TABLE)))) throw E("est/bad-input", "opts.expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
     }
-    // A recipient expectation implies the key part MUST be encrypted to that recipient; if the CSR advertised no
-    // key-encryption attribute the coherence check below never runs, so a compromised CA could deliver the key
-    // to a recipient IT controls (or cleartext) while the caller believes its pin was enforced. Refuse the
-    // contradiction at config time (RFC 7030 sec. 4.4.1) -- the caller must advertise the KEK in the CSR.
     if ((opts.expectedRecipientKeyId !== undefined || opts.expectedRecipientIssuerSerial != null) && !derived.requestedEncryption) {
       throw E("est/bad-input", "a recipient expectation (expectedRecipientKeyId / expectedRecipientIssuerSerial) implies an encrypted key, but the CSR advertised no DecryptKeyIdentifier / AsymmetricDecryptKeyIdentifier attribute (RFC 7030 sec. 4.4.1)");
     }
@@ -2368,17 +1636,13 @@ function serverkeygen(baseUrl, csrInput, opts) {
   });
 }
 
-// ---- /csrattrs GET (RFC 7030 sec. 4.5, RFC 9908) ------------------------
 
 function _csrattrsResult(res, opts) {
   var verdict = classifyResponse(res.status, res.headers, res.body, { op: "csrattrs", now: opts.now });
-  // 204 / 404 = "CSR Attributes Response not available" -- a valid NONE outcome, not an error (RFC 7030 sec. 4.5.2).
   if (verdict.status === "none-available") return { available: false, attrs: null };
-  // A 202 is nonconforming for a policy GET (sec. 4.5.2 lists only 200 / 204 / 404).
   if (verdict.status === "retry") throw E("est/http-error", "a /csrattrs response must be HTTP 200, 204, or 404, not 202 (RFC 7030 sec. 4.5.2)");
   if (verdict.status !== "ok") throw E("est/http-error", "an EST csrattrs response must be HTTP 200 / 204 / 404 (RFC 7030 sec. 4.5.2), got " + res.status);
   var bodyLen = _bodyLen(res);
-  // An empty HTTP body is distinct from a valid EMPTY CsrAttrs (`30 00` / base64 `MAA=`), which parses as {items:[]}.
   if (bodyLen === 0) throw E("est/empty-body", "a 200 csrattrs response carried an empty body (RFC 7030 sec. 4.5.2)");
   var attrs = csrattrsFmt.parse(transferDecode(res.body));
   return { available: true, attrs: attrs, plan: buildEnrollAttributes(attrs) };