@blamejs/pki 0.6.13 → 0.6.15

package/lib/cmp-build.js

@@ -20,16 +20,6 @@
  * @spec RFC 9810
  * @card Build a CMP PKIMessage with signature or PBMAC1 protection.
  */
-//
-// RFC 9810 Appendix A is DEFINITIONS EXPLICIT TAGS: every context tag in the PKIMessage envelope
-// (each PKIHeader [0..8] optional, every PKIBody [n] arm, protection [0], extraCerts [1]) is an EXPLICIT
-// wrapper (asn1.build.explicit), the exact inverse of the RFC 4211 CRMF interior (IMPLICIT TAGS). The two
-// IMPLICIT islands are foreign imports produced wholesale by pki.crmf.build (the CertReqMessages /
-// CertTemplate interior) and embedded verbatim, never re-encoded here. Protection is computed over the
-// byte-exact DER of the virtual ProtectedPart ::= SEQUENCE { header, body }, built from the same header
-// and body TLVs placed in the envelope. The signature scheme resolves from the sender key through the
-// shared sign-scheme registry; the Name / GeneralName / SPKI encoders and the post-sign self-check are the
-// shared lib/pki-build primitives, bound to the cmp namespace.
 
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
@@ -38,11 +28,7 @@ var cmp = require("./schema-cmp");
 var crmf = require("./crmf-sign");
 var schemaCrmf = require("./schema-crmf");
 var intrinsic = require("./guard-intrinsic");
-// Own-key membership through an operation taken at load: it decides which proof-of-possession
-// methods couple the message to a protocol version, and an inherited name is one no RFC defined.
 var _hasOwn = intrinsic.hasOwn;
-// The same load-bound treatment for the operations that shape a revocation request and a support
-// message: each decides what reaches the wire, so a replaced built-in must not get a say.
 var _isArray = intrinsic.isArray;
 var _isBuffer = intrinsic.isBuffer;
 var _charAt = intrinsic.uncurry(String.prototype.charAt);
@@ -56,12 +42,10 @@ var _forEach = intrinsic.forEach;
 var _push = intrinsic.push;
 var _stringify = intrinsic.stringify;
 var _bigInt = intrinsic.BigInt;
-// The constructor taken at load: re-materializing an instant that is about to be encoded must not
-// go through a Date a caller could have replaced after this module was read.
 var _Date = intrinsic.Date;
 var csr = require("./schema-csr");
-require("./path-validate");   // side-effect: path-validate injects its signature engine into csr-verify at load
-var csrVerify = require("./csr-verify");   // verify an embedded p10cr request's proof-of-possession before sending it
+require("./path-validate");
+var csrVerify = require("./csr-verify");
 var crl = require("./schema-crl");
 var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
@@ -92,23 +76,17 @@ var KNOWN_HEADER_KEYS = {
   transactionID: 1, senderNonce: 1, recipNonce: 1, freeText: 1, generalInfo: 1,
 };
 var KNOWN_BODY_KEYS = {
-  ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1, p10cr: 1, certConf: 1, pollReq: 1, genm: 1, rr: 1,   // request-side
-  ip: 1, cp: 1, kup: 1, ccp: 1, krp: 1, rp: 1, genp: 1, error: 1, pollRep: 1, pkiconf: 1,   // CA/responder-side
-  nested: 1,   // an RA wrapper of complete, independently-protected PKIMessages (RFC 9810 sec. 5.1.3.5)
+  ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1, p10cr: 1, certConf: 1, pollReq: 1, genm: 1, rr: 1,
+  ip: 1, cp: 1, kup: 1, ccp: 1, krp: 1, rp: 1, genp: 1, error: 1, pollRep: 1, pkiconf: 1,
+  nested: 1,
 };
-// The PKIBody arm -> its EXPLICIT context tag number (schema-cmp.js BODY_ARMS). rr is [11], not [15].
 var BODY_TAG = {
   ir: 0, cr: 2, p10cr: 4, kur: 7, krr: 9, ccr: 13, rr: 11, genm: 21, certConf: 24, pollReq: 25,
   ip: 1, cp: 3, kup: 8, krp: 10, rp: 12, ccp: 14, pkiconf: 19, genp: 22, error: 23, pollRep: 26,
-  nested: 20,   // NestedMessageContent (schema-cmp.js BODY_ARMS [20])
+  nested: 20,
 };
-// arms whose content is a CertReqMessages via pki.crmf.build (RFC 9810 sec. 5.3.7 krr, sec. 5.3.11 ccr).
 var CRMF_BODY = { ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1 };
-var CERT_REP_ARM = { ip: 1, cp: 1, kup: 1, ccp: 1 };   // arms carrying a CertRepMessage
-// Protection has two mutually exclusive forms, and the signature parameters are read only by the
-// signature one: under PBMAC1 a requested pss or digestAlgorithm selects nothing and the message
-// goes out MAC'd under the default PRF, byte-identical to the call that never named them. The union
-// stays in force where the form is ambiguous, so _resolveProtection keeps its both/neither verdicts.
+var CERT_REP_ARM = { ip: 1, cp: 1, kup: 1, ccp: 1 };
 var KNOWN_OPTS_KEYS = { key: 1, cert: 1, mac: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 };
 var KNOWN_OPTS_SIG_KEYS = { key: 1, cert: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 };
 var KNOWN_OPTS_MAC_KEYS = { mac: 1, extraCerts: 1, pem: 1 };
@@ -117,16 +95,14 @@ var KNOWN_MAC_KEYS = { secret: 1, salt: 1, iterationCount: 1, prf: 1, keyLength:
 
 var PBMAC1_DEFAULT_ITER = 100000;
 var PBMAC1_DEFAULT_SALT_BYTES = 16;
-var PBMAC1_MIN_SALT = 8;          // octets -- RFC 8018 sec. 4.1 (64-bit) floor; matches the pki.cmp.verify verifier floor
-var PBMAC1_DEFAULT_KEYLEN = 32;   // bytes -- HMAC-SHA256 key
-var PBMAC1_MIN_KEYLEN = 20;       // bytes -- RFC 9579 sec. 9 floor (matches the pki.cmp.verify verifier floor)
-var PBMAC1_MAX_KEYLEN = 1024;     // bytes -- an HMAC key beyond a hash block is pointless; bound the work
-var PBMAC1_MIN_ITER = 1000;       // RFC 8018 sec. 4.2 recommended minimum -- reject a trivially weak count
+var PBMAC1_MIN_SALT = 8;
+var PBMAC1_DEFAULT_KEYLEN = 32;
+var PBMAC1_MIN_KEYLEN = 20;
+var PBMAC1_MAX_KEYLEN = 1024;
+var PBMAC1_MIN_ITER = 1000;
 var PBMAC1_PRF = { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" };
 var PBMAC1_MAC_OID = { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" };
-var PBMAC1_PRF_HLEN = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };   // PBKDF2 PRF output length (one derived block)
-// PKIFailureInfo named bits (RFC 9810 sec. 5.2.3), position = bit index, mirroring schema-cmp's decode list;
-// the build -> parse round-trip cross-checks the positions against the parser.
+var PBMAC1_PRF_HLEN = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
 var FAIL_INFO_NAMES = ["badAlg", "badMessageCheck", "badRequest", "badTime", "badCertId", "badDataFormat",
   "wrongAuthority", "incorrectData", "missingTimeStamp", "badPOP", "certRevoked", "certConfirmed",
   "wrongIntegrity", "badRecipientNonce", "timeNotAvailable", "unacceptedPolicy", "unacceptedExtension",
@@ -134,17 +110,14 @@ var FAIL_INFO_NAMES = ["badAlg", "badMessageCheck", "badRequest", "badTime", "ba
   "unsupportedVersion", "notAuthorized", "systemUnavail", "systemFailure", "duplicateCertReq"];
 var FAIL_INFO_INDEX = {};
 FAIL_INFO_NAMES.forEach(function (n, i) { FAIL_INFO_INDEX[n] = i; });
-// CertStatus.hashAlg names the hash used to compute certHash, restricted to hash algorithms and not any OID.
 var CERT_CONF_HASH_ALGS = { sha1: 1, sha256: 1, sha384: 1, sha512: 1, "sha3-256": 1, "sha3-512": 1 };
 
-// ---- small shared encoders (byte-exact inverses of schema-cmp.js readers) ----
 
 function _reqOctets(v, what) {
   var buf = _b.reqDer(v, what);
   return b.octetString(buf);
 }
 
-// PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String: non-empty, every element UTF8String.
 function _encodePkiFreeText(strings, code, what) {
   if (!Array.isArray(strings) || !strings.length) throw _err(code, what + " must be a non-empty array of strings");
   return b.sequence(strings.map(function (s) {
@@ -153,9 +126,6 @@ function _encodePkiFreeText(strings, code, what) {
   }));
 }
 
-// A recognized fixed-syntax id-it value (RFC 9810 sec. 5.1.1.1/.2/.4): implicitConfirm -> NULL,
-// confirmWaitTime -> GeneralizedTime, certProfile -> non-empty SEQUENCE OF UTF8String. An unknown id-it
-// carries a pre-encoded infoValue DER (or none).
 function _encodeInfoValue(itav) {
   var name = itav.infoType;
   if (name === "implicitConfirm") {
@@ -163,7 +133,7 @@ function _encodeInfoValue(itav) {
     return b.nullValue();
   }
   if (name === "confirmWaitTime") {
-    guard.time.assertValid(itav.infoValue, _err, "cmp/bad-info-value", "confirmWaitTime infoValue");   // reject a non-Date / Invalid Date
+    guard.time.assertValid(itav.infoValue, _err, "cmp/bad-info-value", "confirmWaitTime infoValue");
     return b.generalizedTime(itav.infoValue);
   }
   if (name === "certProfile") {
@@ -173,7 +143,6 @@ function _encodeInfoValue(itav) {
   return b.raw(_b.reqDer(itav.infoValue, "infoValue (a pre-encoded DER value)"));
 }
 
-// InfoTypeAndValue ::= SEQUENCE { infoType OID, infoValue ANY DEFINED BY infoType OPTIONAL }.
 function _encodeInfoTypeAndValue(itav) {
   if (!itav || typeof itav !== "object" || Buffer.isBuffer(itav)) throw _err("cmp/bad-info-value", "an InfoTypeAndValue must be an object { infoType, infoValue? }");
   if (typeof itav.infoType !== "string" || O(itav.infoType) == null) throw _err("cmp/bad-name", "unknown infoType " + JSON.stringify(itav.infoType));
@@ -183,20 +152,14 @@ function _encodeInfoTypeAndValue(itav) {
   return b.sequence(children);
 }
 
-// generalInfo [8] / genm content: SEQUENCE SIZE (1..MAX) OF InfoTypeAndValue.
 function _encodeGeneralInfo(itavs, code, what) {
   if (!Array.isArray(itavs) || !itavs.length) throw _err(code, what + " must be a non-empty array of InfoTypeAndValue");
   return b.sequence(itavs.map(_encodeInfoTypeAndValue));
 }
 
-// ---- PKIHeader ----
 
-// An AlgorithmIdentifier { algorithm OID, parameters ANY OPTIONAL } for a bare/absent-params digest.
 function _algIdNoParams(name) { return b.sequence([b.oid(O(name))]); }
 
-// PKIHeader ::= SEQUENCE { pvno INTEGER, sender GeneralName, recipient GeneralName, EXPLICIT [0..8] }.
-// protectionAlgDer is the DERIVED AlgorithmIdentifier ([1]), present iff the message is protected. Returns
-// the exact headerTLV, built ONCE and reused in both the envelope and the ProtectedPart (RFC 9810 5.1.3).
 function _encodeHeader(headerSpec, protectionAlgDer, pvno) {
   if (!headerSpec || typeof headerSpec !== "object" || Buffer.isBuffer(headerSpec)) throw _err("cmp/bad-input", "message.header must be an object");
   guard.identifier.assertKnownKeys(headerSpec, KNOWN_HEADER_KEYS, _err, "cmp/bad-input", "unknown header field ");
@@ -208,10 +171,9 @@ function _encodeHeader(headerSpec, protectionAlgDer, pvno) {
     _b.encodeGeneralName(headerSpec.sender),
     _b.encodeGeneralName(headerSpec.recipient),
   ];
-  // EXPLICIT [0..8] optionals, ascending, at most once each.
   if (headerSpec.messageTime != null) {
-    guard.time.assertValid(headerSpec.messageTime, _err, "cmp/bad-input", "header.messageTime");   // reject a non-Date / Invalid Date
-    children.push(b.explicit(0, b.generalizedTime(headerSpec.messageTime)));   // GeneralizedTime ONLY (never UTCTime)
+    guard.time.assertValid(headerSpec.messageTime, _err, "cmp/bad-input", "header.messageTime");
+    children.push(b.explicit(0, b.generalizedTime(headerSpec.messageTime)));
   }
   if (protectionAlgDer != null) children.push(b.explicit(1, b.raw(protectionAlgDer)));
   if (headerSpec.senderKID != null) children.push(b.explicit(2, _reqOctets(headerSpec.senderKID, "header.senderKID")));
@@ -224,13 +186,9 @@ function _encodeHeader(headerSpec, protectionAlgDer, pvno) {
   return b.sequence(children);
 }
 
-// ---- PKIBody arm content encoders ----
 
-// A certReqId is an UNBOUNDED INTEGER (RFC 9483 -1 sentinel, no upper bound): accept a safe-integer number
-// or a bigint (a large value beyond 2^53), reject a non-integer / other type. Returns a BigInt for b.integer.
 function _reqIdInt(v, code, what) { return guard.range.authoredInteger(v, _err, code, what); }
 
-// PKIFailureInfo ::= BIT STRING (named bits, RFC 9810 sec. 5.2.3): a minimal NamedBitList from bit names.
 function _encodeFailInfo(names, code) {
   if (!Array.isArray(names)) throw _err(code, "statusInfo.failInfo must be an array of PKIFailureInfo bit names");
   return b.namedBitString(names.map(function (n) {
@@ -239,25 +197,21 @@ function _encodeFailInfo(names, code) {
   }));
 }
 
-// PKIStatusInfo ::= SEQUENCE { status PKIStatus INTEGER, statusString PKIFreeText OPTIONAL, failInfo BIT STRING
-// OPTIONAL }. `code` is the caller's typed error (default cmp/bad-status-info; certConf passes cmp/bad-cert-status).
 function _encodePkiStatusInfo(si, code) {
   code = code || "cmp/bad-status-info";
   if (!si || typeof si !== "object" || Buffer.isBuffer(si)) throw _err(code, "a PKIStatusInfo must be an object { status, statusString?, failInfo? }");
   if (typeof si.status !== "number" || !Number.isInteger(si.status) || si.status < 0 || si.status > 6) throw _err(code, "statusInfo.status must be a PKIStatus 0..6 (RFC 9810 sec. 5.2.3)");
   var children = [b.integer(BigInt(si.status))];
   if (si.statusString != null) children.push(_encodePkiFreeText(si.statusString, code, "statusInfo.statusString"));
-  if (si.failInfo != null) children.push(_encodeFailInfo(si.failInfo, code));   // strict order: status -> statusString -> failInfo (both optionals untagged)
+  if (si.failInfo != null) children.push(_encodeFailInfo(si.failInfo, code));
   return b.sequence(children);
 }
 
-// CertStatus ::= SEQUENCE { certHash OCTET STRING, certReqId INTEGER, statusInfo PKIStatusInfo OPTIONAL,
-//   hashAlg [0] EXPLICIT AlgorithmIdentifier OPTIONAL }. hashAlg present => cmp2021 (pvno bump).
 function _encodeCertStatus(cs, state) {
   if (!cs || typeof cs !== "object" || Buffer.isBuffer(cs)) throw _err("cmp/bad-cert-status", "each CertStatus must be an object");
   var children = [
     _reqOctets(cs.certHash, "certConf certHash"),
-    b.integer(_reqIdInt(cs.certReqId, "cmp/bad-cert-status", "CertStatus certReqId")),   // signed, -1 legal, unbounded
+    b.integer(_reqIdInt(cs.certReqId, "cmp/bad-cert-status", "CertStatus certReqId")),
   ];
   if (cs.statusInfo != null) children.push(_encodePkiStatusInfo(cs.statusInfo, "cmp/bad-cert-status"));
   if (cs.hashAlg != null) {
@@ -268,13 +222,11 @@ function _encodeCertStatus(cs, state) {
   return b.sequence(children);
 }
 
-// CertConfirmContent ::= SEQUENCE OF CertStatus (empty legal, no SIZE floor).
 function _encodeCertConfirmContent(list, state) {
   if (!Array.isArray(list)) throw _err("cmp/bad-cert-status", "certConf must be an array of CertStatus");
   return b.sequence(list.map(function (cs) { return _encodeCertStatus(cs, state); }));
 }
 
-// PollReqContent ::= SEQUENCE OF SEQUENCE { certReqId INTEGER } (-1 legal).
 function _encodePollReqContent(list) {
   if (!Array.isArray(list)) throw _err("cmp/bad-poll-req", "pollReq must be an array of { certReqId }");
   return b.sequence(list.map(function (pr) {
@@ -283,26 +235,19 @@ function _encodePollReqContent(list) {
   }));
 }
 
-// GenMsgContent ::= SEQUENCE OF InfoTypeAndValue (empty legal).
 function _encodeGenMsgContent(list) {
   if (!Array.isArray(list)) throw _err("cmp/bad-info-type-and-value", "genm must be an array of InfoTypeAndValue");
   return b.sequence(list.map(_encodeInfoTypeAndValue));
 }
 
-// RevReqContent ::= SEQUENCE OF RevDetails { certDetails CertTemplate, crlEntryDetails Extensions OPTIONAL }.
 function _encodeRevDetails(rd) {
   if (!rd || typeof rd !== "object" || Buffer.isBuffer(rd)) throw _err("cmp/bad-rev-req", "each RevDetails must be an object { certDetails, crlEntryDetails? }");
   guard.identifier.assertKnownKeys(rd, KNOWN_REV_DETAILS_KEYS, _err, "cmp/bad-rev-req", "unknown RevDetails field ");
   if (rd.certDetails == null) throw _err("cmp/bad-rev-req", "RevDetails.certDetails (a CertTemplate) is required");
   var certDetails;
   if (guard.bytes.isByteSource(rd.certDetails)) {
-    // The pre-encoded escape hatch: normalized through the byte guard so every BufferSource the guard
-    // accepts (Buffer, any typed-array view, DataView, raw ArrayBuffer) is taken, not a narrowed subset
-    // that would drop a caller's container into the { issuer, serialNumber } branch below.
     certDetails = b.raw(guard.bytes.snapshotSource(rd.certDetails, CmpError, "cmp/bad-rev-req", "RevDetails.certDetails (a pre-encoded CertTemplate DER)"));
   } else {
-    // A revocation must identify the certificate to revoke by issuer + serialNumber (RFC 9810 App. D sec.
-    // 5.3.2); the pre-encoded-CertTemplate hatch above is the escape for an advanced identification.
     if (rd.certDetails.issuer == null || rd.certDetails.serialNumber == null) throw _err("cmp/bad-rev-req", "a revocation certDetails must identify the certificate by issuer and serialNumber");
     certDetails = b.raw(crmf.buildCertTemplate(rd.certDetails));
   }
@@ -311,39 +256,14 @@ function _encodeRevDetails(rd) {
   return b.sequence(children);
 }
 
-// crlEntryDetails ::= Extensions. A revocation request states WHY, so the structured form
-// { reason } encodes the single reasonCode extension RFC 9483 sec. 4.2 requires. A caller
-// needing another entry extension passes a pre-encoded Extensions DER instead.
-//
-// The reasonCode is emitted even at unspecified(0). RFC 5280 sec. 5.3.1 omits that value from a
-// CRL entry, where absence and unspecified carry the same meaning; sec. 4.2 governs a different
-// structure and says the field is REQUIRED and "MUST be 0 (unspecified)" when the reason is
-// unknown or is not to be published, so the omit-on-zero rule does not travel here.
 var KNOWN_REV_DETAILS_KEYS = { certDetails: 1, crlEntryDetails: 1 };
 var KNOWN_CRL_ENTRY_DETAIL_KEYS = { reason: 1 };
 var CRL_REASON_BY_NAME = intrinsic.create(null);
 _forEach(_keys(constants.NAMES.CRL_REASON), function (v) { CRL_REASON_BY_NAME[constants.NAMES.CRL_REASON[v]] = intrinsic.Number(v); });
 function _encodeCrlEntryDetails(spec) {
-  // A pre-encoded Extensions DER is classified through the byte guard and normalized through it, so
-  // every BufferSource form is taken as bytes. A narrowed check would drop a raw ArrayBuffer / DataView
-  // into the { reason } branch below, where an absent reason silently becomes a generated unspecified(0)
-  // reasonCode -- a different revocation reason than the caller encoded.
   if (guard.bytes.isByteSource(spec)) return guard.bytes.snapshotSource(spec, CmpError, "cmp/bad-rev-req", "RevDetails.crlEntryDetails (a pre-encoded Extensions DER)");
-  // After the byte guard, the only valid structured form is a plain { reason? } record. Anything else --
-  // an array, a Date/Map/Set or other exotic, a boxed primitive -- carries no `reason`, so the fallback
-  // below would read undefined and emit a generated unspecified(0) reasonCode: a real revocation reason
-  // the caller never wrote, from a value outside the documented { reason } | DER union. assertKnownKeys
-  // does not catch these (an empty array or a keyless exotic has no unknown key to reject), so the value
-  // is held to being a plain record through guard.identifier.assertPlainRecord rather than a bare
-  // typeof-object test.
   guard.identifier.assertPlainRecord(spec, _err, "cmp/bad-rev-req", "RevDetails.crlEntryDetails ({ reason } or a pre-encoded Extensions DER)");
   guard.identifier.assertKnownKeys(spec, KNOWN_CRL_ENTRY_DETAIL_KEYS, _err, "cmp/bad-rev-req", "unknown crlEntryDetails field ");
-  // Read `reason` ONCE: a caller getter or Proxy could otherwise answer the validation with one value
-  // (a known reason) and the encode with another (null -> a generated unspecified(0)), so the request
-  // would carry a different revocation reason than the one that was checked.
-  // Read `reason` ONCE, consistent with the module's read-once discipline: build() already deep-copies
-  // the caller's message at entry, so a getter or Proxy cannot vary between the reads here, but reading
-  // one local keeps validation and encode on the same value with no dependence on that upstream copy.
   var reason = spec.reason;
   if (reason != null && (typeof reason !== "string" || !_hasOwn(CRL_REASON_BY_NAME, reason))) {
     throw _err("cmp/bad-rev-req", "unknown CRLReason " + _stringify(reason) + " (RFC 5280 sec. 5.3.1)");
@@ -352,74 +272,32 @@ function _encodeCrlEntryDetails(spec) {
   return b.sequence([_b.ext(O("reasonCode"), false, b.enumerated(_bigInt(code)))]);
 }
 
-// ---- support-message request values (RFC 9480 sec. 2.17, profiled by RFC 9483 sec. 4.3.4) ----
-//
-// CRLSource ::= CHOICE { dpn [0] DistributionPointName, issuer [1] GeneralNames }
-// CRLStatus ::= SEQUENCE { source CRLSource, thisUpdate Time OPTIONAL }
-// CRLStatusListValue ::= SEQUENCE SIZE (1..MAX) OF CRLStatus
-//
-// The CMP module is EXPLICIT TAGS, so CRLSource's own [0] / [1] wrap their alternative. The
-// DistributionPointName inside the dpn arm keeps the IMPLICIT tagging of the module it is
-// imported from, which is why its fullName [0] is a bare context-constructed GeneralNames.
 var KNOWN_CRL_STATUS_KEYS = { dpn: 1, issuer: 1, thisUpdate: 1 };
 var KNOWN_DPN_KEYS = { fullName: 1 };
 function buildCrlStatusList(spec) {
   if (!spec || typeof spec !== "object" || _isBuffer(spec)) throw _err("cmp/bad-input", "a crlUpdate request must be an object { dpn | issuer, thisUpdate? }");
   guard.identifier.assertKnownKeys(spec, KNOWN_CRL_STATUS_KEYS, _err, "cmp/bad-input", "unknown crlUpdate field ");
-  // Each caller field is read ONCE, here, and every use below is of the value that was read. A
-  // second read of the same field can answer differently, and what is encoded then differs from
-  // what the answer is held to.
   var dpnSpec = spec.dpn, issuerSpec = spec.issuer;
   if (dpnSpec == null && issuerSpec == null) {
     throw _err("cmp/bad-input", "a crlUpdate identifies the requested CRL by a dpn (a distribution point name), an issuer (the CA that issues it), or both (RFC 9483 sec. 4.3.4)");
   }
-  // A distribution point name is a pointer the responder resolves internally, so on its own it
-  // leaves nothing to hold the answer to: a CRL claiming to be its issuer's complete list states no
-  // scope at all (RFC 5280 sec. 5.2.5 permits that), and the request named no issuer to compare it
-  // with, so any well-formed CRL from any CA would answer. The issuer is therefore required
-  // alongside a dpn, naming the CA whose CRL the caller will accept. sec. 4.3.4's own note says
-  // where a distribution point name comes from, and both sources -- a certificate's
-  // cRLDistributionPoints, a held CRL's issuingDistributionPoint -- carry the issuer with it.
   if (dpnSpec != null && issuerSpec == null) {
     throw _err("cmp/bad-input", "a crlUpdate naming a dpn must also name the issuer whose CRL is acceptable: a distribution point name alone leaves the response unbound, since a complete CRL states no scope to compare it against (RFC 9483 sec. 4.3.4, RFC 5280 sec. 5.2.5). Drive an unbound request with pki.cmp.build + pki.cmp.transfer.");
   }
   var source, issuerNameDer = null, dpnNames = null;
-  // The issuer, when given, is kept whether or not it goes on the wire: a caller who names one is
-  // saying which CA's CRL they will accept, and pki.cmp.session holds the answer to it. Taking the
-  // encoded Name from here means the comparison reads the name the caller gave rather than
-  // re-interpreting the spec at a later boundary.
   if (issuerSpec != null) issuerNameDer = _b.encodeName(issuerSpec);
   if (dpnSpec != null) {
-    // CRLSource is a CHOICE, so exactly one alternative goes on the wire, and sec. 4.3.4 settles
-    // which: the dpn "if the CRL distribution point name is available", otherwise the issuer. A
-    // caller giving both is answered by the dpn, the more specific pointer, with the issuer held
-    // back to bind the response.
     if (typeof dpnSpec !== "object" || _isBuffer(dpnSpec)) throw _err("cmp/bad-input", "crlUpdate.dpn must be { fullName: [<GeneralName>...] }");
     guard.identifier.assertKnownKeys(dpnSpec, KNOWN_DPN_KEYS, _err, "cmp/bad-input", "unknown crlUpdate.dpn field ");
-    // The nameRelativeToCRLIssuer arm of DistributionPointName is not built, matching the same
-    // decision in pki.crl.sign for issuingDistributionPoint and freshestCRL. Re-open it in all
-    // three together, since a partial relative-name surface would encode names one verb can
-    // produce and its sibling cannot.
     var fullName = dpnSpec.fullName;
     if (fullName == null) throw _err("cmp/bad-input", "crlUpdate.dpn requires fullName (the nameRelativeToCRLIssuer arm is not built; pki.crl.sign draws the same line for issuingDistributionPoint)");
     var entries = _isArray(fullName) ? fullName : [fullName];
     if (!entries.length) throw _err("cmp/bad-input", "crlUpdate.dpn.fullName must carry at least one GeneralName");
-    // The encoded GeneralNames are kept for the same reason as the issuer Name. RFC 5280 sec. 5.2.5
-    // pins the comparison to the identical encoding, so what is kept is the bytes that went on the
-    // wire rather than the spec they were built from.
     dpnNames = _map(entries, function (e) { return _b.encodeGeneralName(e); });
     source = b.explicit(0, b.contextConstructed(0, _bufferConcat(dpnNames)));
   } else {
-    // sec. 4.3.4: the issuer choice "MUST contain the issuer DN in the directoryName field of a
-    // GeneralName element". The directoryName [4] EXPLICIT wraps the SAME encoded Name saved above for
-    // the response binding (issuerNameDer), not a second read of issuerSpec: a caller's issuer can be an
-    // accessor, and re-encoding it here would put one name on the wire while the answer is held to
-    // another, so a CRL from the name that was validated could answer a request that named a different one.
     source = b.explicit(1, b.sequence([b.explicit(4, b.raw(issuerNameDer))]));
   }
-  // Read ONCE. A caller's thisUpdate can be an accessor, so encoding from one read and validating
-  // against a second could judge the answer against a cutoff the request never carried. The instant
-  // that went on the wire is returned with the bytes, and it is that value the response is held to.
   var status = [source], askedInstant = null, asked = spec.thisUpdate;
   if (asked != null) {
     askedInstant = guard.time.instantOf(asked, _err, "cmp/bad-input", "crlUpdate.thisUpdate");
@@ -433,20 +311,12 @@ function buildCrlStatusList(spec) {
   };
 }
 
-// The distributionPoint [0] of a CRL's issuingDistributionPoint extension (RFC 5280 sec. 5.2.5),
-// decoded to the DistributionPointName form guard.name.dpnCorresponds compares, or null when the
-// extension names no point -- a complete CRL, whose scope is its issuer's whole population rather
-// than one point of it. A structural fault THROWS instead of reading as "names no point": a session
-// binds a requested distribution point to this value, and an unreadable extension resolving to
-// "nothing to compare" would skip the binding it is read for.
 var IDP_SCHEMA = pkix.issuingDistributionPoint("cmp/bad-info-value");
 function decodeIdpDistributionPoint(valueBytes) {
   var m;
   try { m = schema.walk(IDP_SCHEMA, asn1.decode(valueBytes), NS); }
   catch (e) { throw _err("cmp/bad-info-value", "the returned CRL carries a malformed issuingDistributionPoint extension (RFC 5280 sec. 5.2.5)", e); }
   if (!m.fields.distributionPoint.present) return null;
-  // distributionPoint [0] EXPLICIT-wraps the DistributionPointName CHOICE (a context tag on a
-  // CHOICE-typed field is always EXPLICIT), so the name is its single child.
   var wrap = m.fields.distributionPoint.node;
   if (!wrap.children || wrap.children.length !== 1) {
     throw _err("cmp/bad-info-value", "an issuingDistributionPoint distributionPoint [0] must wrap exactly one DistributionPointName (RFC 5280 sec. 5.2.5)");
@@ -459,20 +329,16 @@ function _encodeRevReqContent(list) {
   return b.sequence(list.map(_encodeRevDetails));
 }
 
-// ---- response-side (CA/responder) PKIBody arm content encoders ----
 
-// CertOrEncCert ::= CHOICE { certificate [0] EXPLICIT CMPCertificate, encryptedCert [1] EXPLICIT EncryptedKey }.
 function _encodeCertOrEncCert(coec, state) {
   if (!coec || typeof coec !== "object" || Buffer.isBuffer(coec)) throw _err("cmp/bad-cert-response", "certifiedKeyPair must carry certificate or encryptedCert");
   if (coec.certificate != null && coec.encryptedCert != null) throw _err("cmp/bad-cert-response", "certOrEncCert is a CHOICE: supply exactly one of certificate or encryptedCert, not both");
   if (coec.certificate != null) {
     var certDer = _b.reqDerSequence(coec.certificate, "certifiedKeyPair.certificate (a Certificate DER)");
     try { x509.parse(certDer); } catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-cert-response", "certifiedKeyPair.certificate is not a valid X.509 certificate", e); }
-    return b.explicit(0, b.raw(certDer));   // certificate [0] EXPLICIT
+    return b.explicit(0, b.raw(certDer));
   }
   if (coec.encryptedCert != null) {
-    // encryptedCert [1] wraps an EncryptedKey (pre-encoded DER hatch in v1). Like the privateKey, only the
-    // EnvelopedData [0] form is cmp2021; the deprecated EncryptedValue (a universal SEQUENCE) is cmp2000.
     var ec = _b.reqDer(coec.encryptedCert, "certifiedKeyPair.encryptedCert (a pre-encoded EncryptedKey DER)");
     var ecNode;
     try { ecNode = asn1.decode(ec); } catch (e) { throw _err("cmp/bad-cert-response", "certifiedKeyPair.encryptedCert is not valid DER", e); }
@@ -482,15 +348,12 @@ function _encodeCertOrEncCert(coec, state) {
   throw _err("cmp/bad-cert-response", "certifiedKeyPair must carry certificate or encryptedCert");
 }
 
-// CertifiedKeyPair ::= SEQUENCE { certOrEncCert, privateKey [0] EXPLICIT OPTIONAL, publicationInfo [1] EXPLICIT OPTIONAL }.
 function _encodeCertifiedKeyPair(ckp, state) {
   if (!ckp || typeof ckp !== "object" || Buffer.isBuffer(ckp)) throw _err("cmp/bad-cert-response", "certifiedKeyPair must be an object");
-  var children = [_encodeCertOrEncCert(ckp, state)];   // certificate / encryptedCert are direct keys (the parse-result shape)
+  var children = [_encodeCertOrEncCert(ckp, state)];
   if (ckp.privateKey != null) {
     var pk = _b.reqDer(ckp.privateKey, "certifiedKeyPair.privateKey (a pre-encoded EncryptedKey DER)");
     children.push(b.explicit(0, b.raw(pk)));
-    // EncryptedKey ::= CHOICE { encryptedValue EncryptedValue (a universal SEQUENCE, the deprecated cmp2000
-    // form), envelopedData [0] (a cmp2021 feature). Only the envelopedData form bumps pvno to cmp2021(3).
     var pkNode;
     try { pkNode = asn1.decode(pk); } catch (e) { throw _err("cmp/bad-cert-response", "certifiedKeyPair.privateKey is not valid DER", e); }
     if (pkNode.tagClass === "context" && pkNode.tagNumber === 0) state.usesCmp2021 = true;
@@ -499,13 +362,10 @@ function _encodeCertifiedKeyPair(ckp, state) {
   return b.sequence(children);
 }
 
-// CertResponse ::= SEQUENCE { certReqId INTEGER, status PKIStatusInfo, certifiedKeyPair OPTIONAL, rspInfo OCTET STRING OPTIONAL }.
 function _encodeCertResponse(cr, state) {
   if (!cr || typeof cr !== "object" || Buffer.isBuffer(cr)) throw _err("cmp/bad-cert-response", "each CertResponse must be an object");
   if (cr.status == null) throw _err("cmp/bad-cert-response", "CertResponse.status (a PKIStatusInfo) is required");
   var hasCkp = cr.certifiedKeyPair != null;
-  // RFC 9810 sec. 5.3.4: failInfo XOR certifiedKeyPair; a certifiedKeyPair is allowed only under a granting
-  // status (accepted 0 / grantedWithMods 1).
   if (hasCkp && cr.status.failInfo != null) throw _err("cmp/bad-cert-response", "a CertResponse must not carry both failInfo and certifiedKeyPair");
   if (hasCkp && cr.status.status !== 0 && cr.status.status !== 1) throw _err("cmp/bad-cert-response", "a CertResponse certifiedKeyPair is allowed only under a granting status (accepted / grantedWithMods)");
   var children = [b.integer(_reqIdInt(cr.certReqId, "cmp/bad-cert-response", "CertResponse certReqId")), _encodePkiStatusInfo(cr.status, "cmp/bad-cert-response")];
@@ -514,12 +374,11 @@ function _encodeCertResponse(cr, state) {
   return b.sequence(children);
 }
 
-// CertRepMessage ::= SEQUENCE { caPubs [1] EXPLICIT SEQUENCE OF CMPCertificate OPTIONAL, response SEQUENCE OF CertResponse }.
 function _encodeCertRepMessage(spec, state, arm) {
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("cmp/bad-cert-rep", arm + " must be an object { caPubs?, response }");
   if (!Array.isArray(spec.response)) throw _err("cmp/bad-cert-rep", arm + ".response must be an array of CertResponse");
   var children = [];
-  if (spec.caPubs != null) {   // caPubs [1] PRECEDES response (the optional-first x509-version shape)
+  if (spec.caPubs != null) {
     if (!Array.isArray(spec.caPubs) || !spec.caPubs.length) throw _err("cmp/bad-cert-rep", arm + ".caPubs must be a non-empty array of certificate DERs");
     children.push(b.explicit(1, b.sequence(spec.caPubs.map(function (c) { return _certRaw(c, "cmp/bad-cert-rep", "a caPubs entry"); }))));
   }
@@ -527,14 +386,12 @@ function _encodeCertRepMessage(spec, state, arm) {
   return b.sequence(children);
 }
 
-// A raw Certificate DER, validated via the real parser before it is embedded.
 function _certRaw(c, code, what) {
   var der = _b.reqDerSequence(c, what + " (a Certificate DER)");
   try { x509.parse(der); } catch (e) { if (e instanceof CmpError) throw e; throw _err(code, what + " is not a valid X.509 certificate", e); }
   return b.raw(der);
 }
 
-// RevRepContent ::= SEQUENCE { status SEQ OF PKIStatusInfo (min 1), revCerts [0] EXPLICIT SEQ OF CertId OPTIONAL, crls [1] EXPLICIT SEQ OF CertificateList OPTIONAL }.
 function _encodeCertIdRr(cid) {
   if (!cid || typeof cid !== "object" || Buffer.isBuffer(cid) || cid.issuer == null || cid.serialNumber == null) throw _err("cmp/bad-rev-rep", "each revCerts CertId must be { issuer, serialNumber }");
   return b.sequence([_b.encodeGeneralName(cid.issuer), b.integer(_reqIdInt(cid.serialNumber, "cmp/bad-rev-rep", "CertId serialNumber"))]);
@@ -551,7 +408,7 @@ function _encodeRevRepContent(spec) {
     if (!Array.isArray(spec.crls) || !spec.crls.length) throw _err("cmp/bad-rev-rep", "rp.crls must be a non-empty array of CertificateList DERs");
     children.push(b.explicit(1, b.sequence(spec.crls.map(function (c) {
       var der = _b.reqDerSequence(c, "crls entry (a CertificateList DER)");
-      try { crl.parse(der); }   // each crls entry MUST be a valid X.509 CRL (CertificateList)
+      try { crl.parse(der); }
       catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-rev-rep", "a crls entry is not a valid CRL (CertificateList)", e); }
       return b.raw(der);
     }))));
@@ -559,7 +416,6 @@ function _encodeRevRepContent(spec) {
   return b.sequence(children);
 }
 
-// ErrorMsgContent ::= SEQUENCE { pKIStatusInfo, errorCode INTEGER OPTIONAL, errorDetails PKIFreeText OPTIONAL }.
 function _encodeErrorMsgContent(spec) {
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("cmp/bad-error", "error must be an object { pKIStatusInfo, errorCode?, errorDetails? }");
   if (spec.pKIStatusInfo == null) throw _err("cmp/bad-error", "error.pKIStatusInfo is required");
@@ -569,7 +425,6 @@ function _encodeErrorMsgContent(spec) {
   return b.sequence(children);
 }
 
-// PollRepContent ::= SEQUENCE OF SEQUENCE { certReqId INTEGER, checkAfter INTEGER (seconds, >= 0), reason PKIFreeText OPTIONAL }.
 function _encodePollRepContent(list) {
   if (!Array.isArray(list) || !list.length) throw _err("cmp/bad-poll-rep", "pollRep must be a non-empty array of { certReqId, checkAfter, reason? }");
   return b.sequence(list.map(function (pr) {
@@ -581,7 +436,6 @@ function _encodePollRepContent(list) {
   }));
 }
 
-// KeyRecRepContent ::= SEQUENCE { status PKIStatusInfo, newSigCert [0] EXPLICIT CMPCertificate OPTIONAL, caCerts [1] EXPLICIT SEQ OF CMPCertificate OPTIONAL, keyPairHist [2] EXPLICIT SEQ OF CertifiedKeyPair OPTIONAL }.
 function _encodeKeyRecRepContent(spec, state) {
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("cmp/bad-key-rec-rep", "krp must be an object { status, newSigCert?, caCerts?, keyPairHist? }");
   if (spec.status == null) throw _err("cmp/bad-key-rec-rep", "krp.status is required");
@@ -598,17 +452,9 @@ function _encodeKeyRecRepContent(spec, state) {
   return b.sequence(children);
 }
 
-// Does a built CertReqMessages carry a proof of possession that RFC 9810 sec. 5.2.8.3 couples to
-// cmp2021(3)? Stated over the RFC's pair rather than over the arms this toolkit happens to emit, so
-// the coupling still holds if agreeMAC is built later.
 var CMP2021_POP_METHODS = { agreeMAC: 1, encryptedKey: 1 };
 function _popNeedsCmp2021(crmfDer) {
   var messages;
-  // Re-reading a CertReqMessages this process just produced. A fault here is an internal
-  // inconsistency, not a caller error, so it is named in this module's namespace: a crmf/* parse code
-  // surfacing from cmp.build would send the operator looking at a request they wrote correctly. A
-  // CRMF fault raised while BUILDING that body still passes through untranslated, where it does name
-  // the caller's own input.
   try { messages = schemaCrmf.parse(crmfDer).messages; }
   catch (e) {
     throw _err("cmp/bad-body", "the certificate request body this message just built did not parse back: " +
@@ -621,37 +467,18 @@ function _popNeedsCmp2021(crmfDer) {
   return false;
 }
 
-// nested [20] NestedMessageContent ::= PKIMessages ::= SEQUENCE SIZE (1..MAX) OF PKIMessage (RFC 9810 sec.
-// 5.1.3.5 "Multiple Protection"): an RA forwards or batches complete, independently-protected PKIMessages,
-// wrapping them UNCHANGED under its OWN protection. Each entry is a full PKIMessage DER, checked by the real
-// parser so a non-PKIMessage fails closed here rather than wrapping as opaque bytes. The check is the toolkit's
-// PKIMessage parse: it validates the envelope and every arm the parser decodes and, exactly as a parse
-// anywhere else does, surfaces the raw arms (p10cr, the announcements, a further nested) without re-validating
-// their content -- which sec. 5.1.3.5 leaves to the recipient, since the RA forwards each message unchanged.
-// The wrapper's protection covers this SEQUENCE, not the inner messages, and the parser never auto-recurses a
-// nested body (the operator re-feeds each inner message).
 function _encodeNestedContent(list) {
   if (!intrinsic.isArray(list) || list.length === 0) {
     throw _err("cmp/bad-input", "nested must be a non-empty array of PKIMessage DER (RFC 9810 sec. 5.1.3.5 PKIMessages is SIZE (1..MAX))");
   }
-  // reqDenseArray rejects a sparse hole or a nullish entry up front: Array.prototype.map SKIPS a hole,
-  // which would otherwise reach Buffer.concat as a native ERR_INVALID_ARG_TYPE and, on a huge sparse
-  // length, traverse the empty slots. With the array proven dense, the map validates each entry in turn.
   return b.sequence(intrinsic.map(_b.reqDenseArray(list, "nested"), function (m, i) {
-    // reqDerSequence requires a DER SEQUENCE up front: cmp.parse also unwraps PEM from a byte source, so a
-    // PEM-armored entry (a Buffer straight from fs.readFileSync) would otherwise pass the parse yet be
-    // embedded by b.raw as ASCII armor and rejected as cmp/bad-der by the outer message's own parse, only
-    // after protection is computed. With DER assured, the bytes cmp.parse checks are the bytes embedded.
     var der = _b.reqDerSequence(m, "nested[" + i + "] (a PKIMessage DER)");
-    // A bad entry is a build-time authoring error, so any parse failure is one uniform cmp/bad-input naming
-    // the offending index (the underlying reason rides along as the cause), never the parser's internal code.
-    try { cmp.parse(der); }   // check each embedded message parses as a PKIMessage (fail-closed on a non-PKIMessage)
+    try { cmp.parse(der); }
     catch (e) { throw _err("cmp/bad-input", "nested[" + i + "] does not parse as a PKIMessage", e); }
     return b.raw(der);
   }));
 }
 
-// Dispatch the single-key body object to its EXPLICIT-tagged arm. Returns { bodyTLV, usesCmp2021 }.
 function _encodeBody(bodySpec, key, opts) {
   if (!bodySpec || typeof bodySpec !== "object" || Buffer.isBuffer(bodySpec)) throw _err("cmp/bad-input", "message.body must be a single-key object");
   var keys = Object.keys(bodySpec);
@@ -661,9 +488,6 @@ function _encodeBody(bodySpec, key, opts) {
   var tag = BODY_TAG[arm], state = { usesCmp2021: false };
 
   if (CRMF_BODY[arm]) {
-    // The CRMF proof of possession is signed with the REQUESTED key's private half, which is distinct from
-    // the message-protection key. Take it from a `key` field on the request spec; default to the protection
-    // key only for a self-request (the client certifying the very key it protects with).
     var reqSpec = bodySpec[arm], popKey = key;
     if (reqSpec && typeof reqSpec === "object" && !Buffer.isBuffer(reqSpec) && "key" in reqSpec) {
       popKey = reqSpec.key;
@@ -671,12 +495,6 @@ function _encodeBody(bodySpec, key, opts) {
       delete reqSpec.key;
     }
     return crmf.build(reqSpec, popKey, {}).then(function (crmfDer) {
-      // RFC 9810 sec. 5.2.8.3: "When using agreeMAC or encryptedKey choices, the pvno cmp2021(3)
-      // MUST be used." Read off the message that was actually emitted rather than off the spec that
-      // asked for it, so the announced version answers for the bytes on the wire. The parser
-      // enforces the same rule on the way in, and before this the two disagreed: a request carrying
-      // an encryptedKey proof went out announcing cmp2000(2), and this toolkit's own reader refused
-      // the message this toolkit had just built.
       return { bodyTLV: b.explicit(tag, b.raw(crmfDer)), usesCmp2021: _popNeedsCmp2021(crmfDer) };
     });
   }
@@ -684,13 +502,8 @@ function _encodeBody(bodySpec, key, opts) {
   if (arm === "p10cr") {
     var csrDer = _b.reqDerSequence(bodySpec.p10cr, "p10cr (a CertificationRequest DER)");
     var parsedCsr;
-    try { parsedCsr = csr.parse(csrDer); }   // validate structure via the real parser AND capture the parse for the PoP check
+    try { parsedCsr = csr.parse(csrDer); }
     catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-input", "p10cr is not a valid PKCS#10 CertificationRequest", e); }
-    // Verify the embedded request's proof-of-possession before it is protected and sent: a p10cr carries
-    // a PKCS#10 CertificationRequest (RFC 9810 sec. 5.3.3, whose structure is RFC 2986), and its
-    // self-signature under its own subject public key is that request's proof-of-possession. A CSR whose
-    // self-signature does not verify is one the CA will reject, so refuse it rather than send it -- through
-    // the shared inbound-PoP seam pki.csr.verify uses.
     return _p10crBody(csrDer, parsedCsr, tag, state);
   }
   if (arm === "certConf") {
@@ -701,11 +514,11 @@ function _encodeBody(bodySpec, key, opts) {
     inner = _encodeGenMsgContent(bodySpec.genm);
   } else if (arm === "rr") {
     inner = _encodeRevReqContent(bodySpec.rr);
-  } else if (CERT_REP_ARM[arm]) {   // ip / cp / kup / ccp -- CertRepMessage
+  } else if (CERT_REP_ARM[arm]) {
     inner = _encodeCertRepMessage(bodySpec[arm], state, arm);
   } else if (arm === "rp") {
     inner = _encodeRevRepContent(bodySpec.rp);
-  } else if (arm === "genp") {   // GenRepContent == GenMsgContent
+  } else if (arm === "genp") {
     inner = _encodeGenMsgContent(bodySpec.genp);
   } else if (arm === "error") {
     inner = _encodeErrorMsgContent(bodySpec.error);
@@ -715,16 +528,13 @@ function _encodeBody(bodySpec, key, opts) {
     inner = _encodeKeyRecRepContent(bodySpec.krp, state);
   } else if (arm === "nested") {
     inner = _encodeNestedContent(bodySpec.nested);
-  } else {   // pkiconf -- PKIConfirmContent ::= NULL
+  } else {
     if (bodySpec.pkiconf !== null && bodySpec.pkiconf !== true) throw _err("cmp/bad-input", "pkiconf takes null or true (PKIConfirmContent is NULL)");
     inner = b.nullValue();
   }
   return Promise.resolve({ bodyTLV: b.explicit(tag, inner), usesCmp2021: state.usesCmp2021 });
 }
 
-// `await`, not a `.then` chain: the PoP verdict is read through the native promise job, not the
-// replaceable Promise.prototype.then a co-resident could swap to force `ok` true and slip an
-// unverified request past. The caller has already validated csrDer's structure synchronously.
 async function _p10crBody(csrDer, parsedCsr, tag, state) {
   if (!(await csrVerify.verifyCsrSignature(parsedCsr))) {
     throw _err("cmp/bad-popo", "the p10cr CertificationRequest failed its proof-of-possession: its PKCS#10 signature does not verify under its own subject public key, so a CA would reject it");
@@ -732,11 +542,8 @@ async function _p10crBody(csrDer, parsedCsr, tag, state) {
   return { bodyTLV: b.explicit(tag, b.raw(csrDer)), usesCmp2021: state.usesCmp2021 };
 }
 
-// ---- protection ----
 
 
-// Resolve the protection selector to { protectionAlgDer, computeBits(protectedPartDer)->Promise<Buffer> },
-// senderSpki, senderScheme } before the header is built (protectionAlg is opts-derived, not header-derived).
 function _resolveProtection(opts) {
   var hasSig = opts.key != null || opts.cert != null;
   var hasMac = opts.mac != null;
@@ -764,7 +571,6 @@ function _resolveProtection(opts) {
     };
   }
 
-  // PBMAC1
   var m = opts.mac;
   if (!m || typeof m !== "object" || Buffer.isBuffer(m)) throw _err("cmp/bad-input", "opts.mac must be an object { secret, salt?, iterationCount?, prf?, keyLength? }");
   guard.identifier.assertKnownKeys(m, KNOWN_MAC_KEYS, _err, "cmp/bad-input", "unknown opts.mac field ");
@@ -774,28 +580,17 @@ function _resolveProtection(opts) {
     if (!Buffer.isBuffer(secret) || !secret.length) throw _err("cmp/bad-input", "opts.mac.secret must be a non-empty string or Buffer");
   }
   var secretBuf = Buffer.isBuffer(secret) ? secret : Buffer.from(secret, "utf8");
-  // Default only when prf is absent (null/undefined), the same test the iterationCount and keyLength
-  // siblings below use. `m.prf || "SHA-256"` would default on any falsy value, so a supplied "", false, or
-  // 0 -- none a valid PRF name -- would silently encode HMAC-SHA-256 instead of being refused.
   var prf = m.prf != null ? m.prf : "SHA-256";
   if (!PBMAC1_PRF[prf]) throw _err("cmp/bad-input", "opts.mac.prf must be SHA-256 / SHA-384 / SHA-512");
   var iterationCount = m.iterationCount != null ? m.iterationCount : PBMAC1_DEFAULT_ITER;
   if (typeof iterationCount !== "number" || !Number.isInteger(iterationCount) || iterationCount < PBMAC1_MIN_ITER) throw _err("cmp/bad-input", "opts.mac.iterationCount must be at least " + PBMAC1_MIN_ITER + " (RFC 8018 sec. 4.2)");
-  // Bound the PBKDF2 work factors before deriving: a huge iterationCount or keyLength is self-inflicted work.
   if (iterationCount > constants.LIMITS.PBKDF2_MAX_ITERATIONS) throw _err("cmp/bad-input", "opts.mac.iterationCount exceeds the PBKDF2 work-factor cap " + constants.LIMITS.PBKDF2_MAX_ITERATIONS);
   var keyLength = m.keyLength != null ? m.keyLength : PBMAC1_DEFAULT_KEYLEN;
-  // RFC 9579 sec. 9 floor (>= 20 bytes): produce only messages the verifier (pki.cmp.verify, same floor) can
-  // accept, so a shorter derived key is refused at production time and never emitted as an unverifiable message.
   if (typeof keyLength !== "number" || !Number.isInteger(keyLength) || keyLength < PBMAC1_MIN_KEYLEN) throw _err("cmp/bad-input", "opts.mac.keyLength must be an integer >= " + PBMAC1_MIN_KEYLEN + " bytes (RFC 9579 sec. 9)");
   if (keyLength > PBMAC1_MAX_KEYLEN) throw _err("cmp/bad-input", "opts.mac.keyLength exceeds the cap " + PBMAC1_MAX_KEYLEN + " bytes");
-  // Bound the COMBINED work: a keyLength spanning multiple PRF blocks costs iterationCount HMACs per block, so
-  // the product can exceed the per-block iteration cap. Cap it against the same ceiling pki.cmp.verify enforces,
-  // so build never emits a message its verify-inverse would refuse as over-budget (RFC 8018 sec. 5.2).
   var blocks = Math.ceil(keyLength / PBMAC1_PRF_HLEN[prf]);
   if (iterationCount * blocks > constants.LIMITS.PBKDF2_MAX_ITERATIONS) throw _err("cmp/bad-input", "opts.mac combined work (iterationCount " + iterationCount + " x " + blocks + " derived blocks) exceeds the PBKDF2 work-factor cap " + constants.LIMITS.PBKDF2_MAX_ITERATIONS);
   var salt = m.salt != null ? _b.reqDer(m.salt, "opts.mac.salt") : Buffer.from(webcrypto.webcrypto.getRandomValues(new Uint8Array(PBMAC1_DEFAULT_SALT_BYTES)));
-  // RFC 8018 sec. 4.1 (64-bit) floor: an empty or short salt loses precomputation resistance, so produce only
-  // messages pki.cmp.verify (same floor) accepts, refusing a below-minimum salt at construction time.
   if (salt.length < PBMAC1_MIN_SALT) throw _err("cmp/bad-input", "opts.mac.salt must be at least " + PBMAC1_MIN_SALT + " octets (RFC 8018 sec. 4.1)");
   if (salt.length > constants.LIMITS.PBKDF2_MAX_SALT) throw _err("cmp/bad-input", "opts.mac.salt exceeds " + constants.LIMITS.PBKDF2_MAX_SALT + " bytes");
   var macDesc = { salt: salt, iterationCount: iterationCount, keyLength: keyLength, prfName: PBMAC1_PRF[prf], macName: PBMAC1_MAC_OID[prf] };
@@ -811,12 +606,8 @@ function _resolveProtection(opts) {
   };
 }
 
-// ---- orchestrator ----
 
 function build(message, opts) {
-  // Every caller-owned argument copied at entry and released when the call settles; see the note
-  // on the same call in x509-sign. `opts.mac.secret` is why the copy has to be deep: it sits a
-  // level below the options object and is read by the PBMAC1 derivation after the first turn.
   return guard.bytes.fixedCall(CmpError, "cmp/bad-input", [
     [message, "the PKIMessage spec"], [opts, "pki.cmp.build options"],
   ], _build);
@@ -843,25 +634,22 @@ async function _build(message, opts) {
   var prot = _resolveProtection(opts);
   var senderKey = opts.key;
 
-  // `await`, not a `.then` chain: an embedded p10cr/crm proof-of-possession is enforced by _encodeBody
-  // REJECTING, so the verdict must reach here through the native promise job, not a Promise.prototype.then
-  // a co-resident could swap to fire this callback with a forged body and slip an unverified request past.
   var bodyResult = await _encodeBody(message.body, senderKey, opts);
   var bodyTLV = bodyResult.bodyTLV;
   var pvno = message.header.pvno != null ? message.header.pvno : 2;
   if (typeof pvno !== "number" || !Number.isInteger(pvno)) throw _err("cmp/bad-input", "header.pvno must be an integer");
-  if (bodyResult.usesCmp2021 && pvno < 3) pvno = 3;   // a certConf hashAlg forces cmp2021(3)
+  if (bodyResult.usesCmp2021 && pvno < 3) pvno = 3;
 
-  var headerTLV = _encodeHeader(message.header, prot.protectionAlgDer, pvno);   // built ONCE
-  var protectedPartDer = b.sequence([headerTLV, bodyTLV]);   // virtual ProtectedPart ::= SEQUENCE { header, body }
+  var headerTLV = _encodeHeader(message.header, prot.protectionAlgDer, pvno);
+  var protectedPartDer = b.sequence([headerTLV, bodyTLV]);
 
   var protectionBits = await prot.computeBits(protectedPartDer);
-  var msgChildren = [headerTLV, bodyTLV, b.explicit(0, protectionBits)];   // reuse the SAME header/body TLVs
+  var msgChildren = [headerTLV, bodyTLV, b.explicit(0, protectionBits)];
   var extraCertsDers = _collectExtraCerts(opts, prot.certDer);
   if (extraCertsDers.length) msgChildren.push(b.explicit(1, b.sequence(extraCertsDers)));
   var der = b.sequence(msgChildren);
 
-  cmp.parse(der);   // round-trip re-validation: the emitted message MUST parse (protection<=>protectionAlg, pvno, freeText, etc.)
+  cmp.parse(der);
   if (opts.pem != null) {
     if (opts.pem === true) return cmp.pemEncode(der, "CMP");
     if (typeof opts.pem !== "string" || !opts.pem) throw _err("cmp/bad-input", "opts.pem must be true or a non-empty PEM label string");
@@ -877,7 +665,7 @@ function _collectExtraCerts(opts, protCertDer) {
     if (!Array.isArray(opts.extraCerts)) throw _err("cmp/bad-extra-certs", "opts.extraCerts must be an array of certificate DERs");
     opts.extraCerts.forEach(function (c) {
       var der = _b.reqDerSequence(c, "extraCerts entry (a Certificate DER)");
-      try { x509.parse(der); }   // each extraCerts entry MUST be a valid X.509 certificate (RFC 9810 sec. 5.1)
+      try { x509.parse(der); }
       catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-extra-certs", "an extraCerts entry is not a valid X.509 certificate", e); }
       out.push(b.raw(der));
     });
@@ -941,66 +729,40 @@ function _collectExtraCerts(opts, protCertDer) {
  *   pki.schema.cmp.parse(der).body.arm;   // "p10cr"
  */
 
-// ---- the thin RFC 9811 HTTP transfer verb: POST a DER PKIMessage over the shared pki.transport ----
-//
-// RFC 9811 defines exactly ONE client operation -- POST a DER PKIMessage, receive a DER PKIMessage -- so
-// every CMP exchange (ir / p10cr / certConf / pollReq / rr / genm ...) rides this single stateless verb;
-// the caller builds+protects the message upstream with pki.cmp.build and hands the finished bytes here,
-// which are POSTed VERBATIM (the protection covers them). No socket is opened by this codec -- the verb
-// composes pki.schema.cmp.parse over pki.transport, exactly as pki.est / pki.acme wire their message layers.
 
 var DEFAULT_TRANSFER_TIMEOUT = constants.TIME.seconds(30);
 var MAX_TRANSFER_TIMEOUT = constants.TIME.seconds(600);
 var PKIXCMP = "application/pkixcmp";
-var PKIXCMP_POLL = "application/pkixcmp-poll";   // the legacy type handled "like application/pkixcmp" (RFC 9811 sec. 4)
+var PKIXCMP_POLL = "application/pkixcmp-poll";
 var KNOWN_TRANSFER_OPTS = { transport: 1, tls: 1, headers: 1, timeout: 1, maxResponseBytes: 1 };
 
-// The DER of a caller-supplied PKIMessage: a DER Buffer / Uint8Array re-viewed through guard.bytes.view
-// (sent VERBATIM -- protection covers these exact bytes), a PEM "CMP" string decoded, else a config-time
-// cmp/bad-input before the wire. The re-view fails a DETACHED backing buffer (a transferred / structuredClone'd
-// view reads as zero-length) as cmp/bad-input rather than silently POSTing an empty body in its place.
 function _cmpMessageDer(input) {
   var der;
   if (guard.bytes.isByteSource(input)) der = guard.bytes.source(input, CmpError, "cmp/bad-input", "the CMP message DER");
   else if (typeof input === "string") {
-    // Normalize a PEM decode failure (no block, wrong armor label, malformed base64) to the stable
-    // cmp/bad-input at this input boundary, rather than leaking the PEM layer's PemError to the caller.
     try { der = cmp.pemDecode(input); }
     catch (e) { throw _err("cmp/bad-input", "the CMP message is not a valid PEM CMP block", e); }
   } else throw _err("cmp/bad-input", "a CMP message must be a DER Buffer/Uint8Array or a PEM CMP string");
-  // Validate the bytes ARE a PKIMessage before the wire (transfer accepts a DER PKIMessage), so malformed
-  // input fails locally as cmp/bad-input rather than crossing the network seam. parse validates only -- the
-  // ORIGINAL der is returned for the verbatim POST (protection covers the exact bytes; nothing re-serialized).
   try { cmp.parse(der); }
   catch (e) { throw _err("cmp/bad-input", "the CMP message is not a valid PKIMessage", e); }
   return der;
 }
 
-// Map opts.tls (operator-facing) to the transport request.tls shape. rejectUnauthorized is NOT here --
-// the transport forces it on unconditionally; the verb never disables server verification.
 function _tlsForTransfer(opts) {
   var t = opts.tls || {};
   return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
 }
 
-// The response content-type token (before any ;-parameters), lowercased; is it a CMP media type?
 function _ctypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
 function _isPkixcmp(headers) { var t = _ctypeToken(headers); return t === PKIXCMP || t === PKIXCMP_POLL; }
 
-// Classify the CMP HTTP response (RFC 9811 sec. 3.1/3.2/4). 200 + a pkixcmp body -> parse + resolve;
-// another 2xx -> reject (a request response MUST be 200, sec. 3.1); 3xx -> not followed (sec. 3.1/5);
-// 4xx/5xx WITH a well-formed CMP body -> FORWARD the integrity-protected verdict (sec. 1.2/3.1), else
-// cmp/http-error. The HTTP status is surfaced as DATA, never used to set the transaction verdict (sec. 5).
-// `body` is always a Buffer (the verb normalizes it before the size cap).
 function _classifyCmpResponse(status, headers, body, tls) {
   var ctype = _ctypeToken(headers);
   if (status === 200) {
     if (!_isPkixcmp(headers)) throw _err("cmp/bad-content-type", "a 200 CMP response must be application/pkixcmp (RFC 9811 sec. 3.2), got " + JSON.stringify(ctype || null));
     if (body.length === 0) throw _err("cmp/empty-response", "a 200 CMP response carried an empty body (RFC 9811 sec. 3.3)");
-    return { response: cmp.parse(body), responseBytes: body, status: 200, contentType: ctype, tls: tls };   // a malformed body surfaces the parser's fail-closed cmp/* verdict
+    return { response: cmp.parse(body), responseBytes: body, status: 200, contentType: ctype, tls: tls };
   }
-  // Below 200, every branch requires a valid HTTP status INTEGER -- a missing / non-numeric / out-of-range
-  // status from an injected transport must not fall through to the forward branch as if it were a 4xx/5xx.
   var httpStatus = (typeof status === "number" && Number.isSafeInteger(status) && status >= 100 && status <= 599) ? status : null;
   if (httpStatus !== null && httpStatus >= 300 && httpStatus < 400) throw _err("cmp/redirect-not-followed", "a CMP " + httpStatus + " redirect is not followed (RFC 9811 sec. 3.1, sec. 5); reconfigure the endpoint URL");
   if (httpStatus !== null && httpStatus >= 400 && httpStatus <= 599) {
@@ -1008,15 +770,11 @@ function _classifyCmpResponse(status, headers, body, tls) {
       var forwarded;
       try { forwarded = cmp.parse(body); }
       catch (e) { throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with an undecodable body", e); }
-      // Only a CMP `error` message is a coherent verdict to forward on an HTTP failure. A 4xx/5xx carrying a
-      // non-error arm (a granting `ip`, a `pkiconf`) is contradictory -- the HTTP layer says failure while the
-      // CMP body says success -- so it is NOT accepted as a usable response; the HTTP failure stands.
       if (forwarded.body.arm !== "error") throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with a non-error '" + forwarded.body.arm + "' body; an HTTP failure forwards only a CMP error message (RFC 9811 sec. 1.2/3.1)");
       return { response: forwarded, responseBytes: body, status: httpStatus, contentType: ctype, tls: tls };
     }
     throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with no forwardable CMP error body");
   }
-  // Any other status -- a non-200 2xx, a 1xx informational, or a non-numeric / out-of-range value.
   throw _err("cmp/unexpected-status", "a CMP response must be HTTP 200 (or a 4xx/5xx carrying a CMP error), not " + JSON.stringify(status) + " (RFC 9811 sec. 3.1)");
 }
 
@@ -1027,9 +785,9 @@ function transfer(url, message, opts) {
 function _transfer(url, message, opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, KNOWN_TRANSFER_OPTS, _err, "cmp/bad-input", "unknown opts field ");
-  var der = _cmpMessageDer(message);   // config gate: before any transport call
+  var der = _cmpMessageDer(message);
   var parsedUrl;
-  try { parsedUrl = new URL(String(url)); }   // parse only -- NO client scheme gate (the transport owns socket security)
+  try { parsedUrl = new URL(String(url)); }
   catch (e) { throw _err("cmp/bad-url", "the CMP URL did not parse: " + String(url), e); }
   var transport = opts.transport;
   if (!transport) {
@@ -1040,11 +798,6 @@ function _transfer(url, message, opts) {
   }
   var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_TRANSFER_TIMEOUT, { E: _err, code: "cmp/bad-input", min: 1, max: MAX_TRANSFER_TIMEOUT });
   var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E: _err, code: "cmp/bad-input", min: 1, max: constants.LIMITS.HTTP_MAX_RESPONSE_BYTES });
-  // Build the request headers: forward custom opts.headers but STRIP the request-framing headers
-  // (content-length, transfer-encoding) and ANY content-type case variant -- the verb sets the content-type
-  // and the transport computes Content-Length from the exact body, so a caller cannot desync the request
-  // framing (HTTP request smuggling via a short/long content-length) or override the media type through
-  // header-name casing (a "Content-Type" that Object.assign would keep alongside the lowercase one).
   var headers = {};
   Object.keys(opts.headers || {}).forEach(function (k) {
     var lk = k.toLowerCase();
@@ -1056,10 +809,6 @@ function _transfer(url, message, opts) {
     res = res || {};
     var h = {};
     Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
-    // Normalize the response body to a Buffer preserving its exact bytes: a binary view (Buffer / Uint8Array
-    // from an injected transport) is re-viewed through the byte guard, as the request path does; only a
-    // genuine string body falls back to a UTF-8 encode (the width a real socket already counts) so the size
-    // cap and the parser see the same bytes -- a typed array is not stringified to "48,130,..." garbage.
     var body = guard.bytes.isByteSource(res.body)
       ? guard.bytes.source(res.body, CmpError, "cmp/bad-response", "the CMP response body")
       : Buffer.from(String(res.body == null ? "" : res.body), "utf8");
@@ -1068,9 +817,6 @@ function _transfer(url, message, opts) {
   });
 }
 
-// A single safe path segment for a well-known URI: no separator, dot-segment, or reserved/space char that
-// would retarget the resource; percent-encoded on the way out. Fails closed (guards never guess a value).
-// /[/?#\s\\]/ : does `s` contain a path separator, query/fragment marker, whitespace, or a backslash?
 function _hasUnsafeSegChar(s) {
   for (var i = 0; i < s.length; i++) {
     var c = _charCodeAt(s, i);
@@ -1081,18 +827,13 @@ function _hasUnsafeSegChar(s) {
 function _wellKnownSeg(v, name) {
   var s = String(v);
   if (s === "" || s === "." || s === ".." || _hasUnsafeSegChar(s)) throw _err("cmp/bad-url", "the CMP " + name + " must be a single safe path segment (no '/', dot-segment, or reserved char): " + JSON.stringify(s));
-  // encodeURIComponent throws a raw URIError (no .code) on an unpaired UTF-16 surrogate; normalize it to the
-  // helper's cmp/bad-url contract so a malformed-config segment never escapes as an untyped error.
   try { return encodeURIComponent(s); }
   catch (e) { throw _err("cmp/bad-url", "the CMP " + name + " is not encodable (e.g. an unpaired surrogate): " + JSON.stringify(s), e); }
 }
 
 var KNOWN_WELLKNOWN_OPTS = { label: 1, operation: 1 };
 
-// ---- URL raw-path helpers by character scan (no regex) --------------------------------------------
 function _isAsciiLetter(ch) { return (ch >= "A" && ch <= "Z") || (ch >= "a" && ch <= "z"); }
-// The "scheme://authority" prefix removed (matching /^[a-z]+:\/\/[^/?#]*/i: a leading letter run,
-// "://", then a run of characters other than "/", "?" or "#"), else the string unchanged.
 function _stripSchemeAuthority(s) {
   var p = 0, n = s.length;
   while (p < n && _isAsciiLetter(_charAt(s, p))) p += 1;
@@ -1101,7 +842,6 @@ function _stripSchemeAuthority(s) {
   while (p < n) { var ch = _charAt(s, p); if (ch === "/" || ch === "?" || ch === "#") break; p += 1; }
   return _strSlice(s, p);
 }
-// Everything before the first "?" or "#" (matching split(/[?#]/)[0]).
 function _beforeQueryOrFragment(s) {
   for (var i = 0; i < s.length; i++) { var ch = _charAt(s, i); if (ch === "?" || ch === "#") return _strSlice(s, 0, i); }
   return s;
@@ -1109,28 +849,15 @@ function _beforeQueryOrFragment(s) {
 
 function wellKnownUrl(base, opts) {
   opts = opts || {};
-  // Reject an unknown option key (a typo like { lable } / { operaton }), as build/transfer do -- a silently
-  // ignored option would build the DEFAULT endpoint and send the request to a different CA/profile.
   guard.identifier.assertKnownKeys(opts, KNOWN_WELLKNOWN_OPTS, _err, "cmp/bad-input", function (k) {
     return "unknown wellKnownUrl option " + JSON.stringify(k) + " (expected label / operation)";
   });
   var u;
   try { u = new URL(String(base)); }
   catch (e) { throw _err("cmp/bad-url", "the CMP base URL did not parse: " + String(base), e); }
-  // Require an http(s) authority: a non-HTTP scheme (file:, data:, a custom scheme) has an opaque origin
-  // ("null"), which would build a nonsensical "null/.well-known/cmp". A well-known URI is an HTTP concept
-  // (RFC 8615); https vs http is left to the transport (Build decision 6), but the scheme must be one of them.
   if (u.protocol !== "https:" && u.protocol !== "http:") throw _err("cmp/bad-url", "the CMP base URL must be http or https (a well-known URI is authority-rooted over HTTP), got " + u.protocol + ": " + JSON.stringify(String(base)));
   if (u.search || u.hash) throw _err("cmp/bad-url", "the CMP base URL must not carry a query or fragment component (RFC 9811 sec. 3.4)");
-  // A backslash has no place in an http(s) authority: WHATWG rewrites it to a path separator (so
-  // `https://ca.example\tenant` is really the path `/tenant`), but the raw-path regex below excludes only
-  // `/?#` and would swallow it as authority, slipping a supplied path past the check. Reject it outright.
   if (_strIndexOf(String(base), "\\") !== -1) throw _err("cmp/bad-url", "the CMP base URL must not contain a backslash (WHATWG rewrites it to a path separator): " + JSON.stringify(String(base)));
-  // An RFC 8615 well-known URI is AUTHORITY-ROOTED (/.well-known/...), so a base carrying ANY path is
-  // rejected fail-closed -- an operator whose CMP endpoint sits under a path passes that full operation URL
-  // to transfer() directly. Inspect the RAW path in the source string, NOT url.pathname: WHATWG normalizes
-  // dot-segments (`/tenant/..`, `/%2e`) to "/" before the parse, which would slip a supplied path past a
-  // pathname check and silently target the authority-root profile instead of reporting the misconfiguration.
   var rawBasePath = _beforeQueryOrFragment(_stripSchemeAuthority(String(base)));
   if (rawBasePath !== "" && rawBasePath !== "/") throw _err("cmp/bad-url", "an RFC 8615 well-known URI is authority-rooted; the CMP base URL must have no path component (pass a full operation URL to transfer instead): " + JSON.stringify(String(base)));
   var segs = [".well-known", "cmp"];
@@ -1210,17 +937,14 @@ function wellKnownUrl(base, opts) {
  */
 module.exports = {
   build: build, transfer: transfer, wellKnownUrl: wellKnownUrl,
-  buildCrlStatusList: buildCrlStatusList,   // @internal -- pki.cmp.session composes it for a crlUpdate support message
-  // @internal -- one key, several legal SPKI encodings (a compressed EC point among them), so the
-  // session compares root-rollover keys through the same definition the builders already use.
+  buildCrlStatusList: buildCrlStatusList,   // @internal
+  // @internal
   samePublicKey: function (a, b) { return _b.samePublicKey(a, b); },
-  // @internal -- the shared certificate-extension decoders, so a consumer reads basicConstraints or
-  // keyUsage through the same definition every format uses instead of walking the bytes again.
+  // @internal
   decodeCertExtension: function (dottedOid, valueBytes) {
     var dec = EXT_DECODERS[dottedOid];
     return dec ? dec(valueBytes) : null;
   },
-  // @internal -- the CRL-side companion: schema-crl leaves issuingDistributionPoint raw, and the
-  // session needs the point it names to bind a crlUpdate answer to the point that was requested.
+  // @internal
   decodeIdpDistributionPoint: decodeIdpDistributionPoint,
 };