@blamejs/pki 0.8.31 → 0.8.48

package/lib/acme.js

@@ -53,6 +53,14 @@ var retryAfter = require("./http-retry-after");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
+/** @internal The RECEIVER for that capture, captured too. `Promise.resolve` builds through its
+ *  receiver, so handing it the live `globalThis.Promise` put the capture back under a constructor a
+ *  replacement installed after load could take over, and what it decides is the value that gets
+ *  awaited. */
+var _Promise = intrinsic.Promise;
+/** @internal A refusal returned as a REJECTED promise is a verdict too: read from the global binding, a
+ *  replacement whose `reject` resolves instead turns the refusal into a pass. */
+var _reject = intrinsic.uncurry(intrinsic.promiseReject);
 var _hasOwn = intrinsic.hasOwn;
 var _isBuffer = intrinsic.isBuffer;
 var _isArrayI = intrinsic.isArray;
@@ -65,6 +73,8 @@ var _lower = intrinsic.toLowerCase;
 var _StringI = intrinsic.String;
 var _stringify = intrinsic.stringify;
 var _push = intrinsic.push;
+var _pop = intrinsic.pop;
+var _shift = intrinsic.shift;
 var _join = intrinsic.join;
 var _concat = intrinsic.concat;
 var _split = intrinsic.uncurry(String.prototype.split);
@@ -293,21 +303,75 @@ function _codeSlug(kind) {
   return _lower(out);
 }
 
-function _validate(kind, obj) {
+/** @internal The NAMED members of a caller's resource object, read ONCE each into a plain record. A
+ *  validator that reads the object again for a second check lets an accessor answer the two differently,
+ *  so the reading is taken here and every check works from it. A caller that runs two validators over
+ *  one object passes the same reading to both rather than reading it twice.
+ *
+ *  Only the named members are read. An ACME resource may carry extension members and this surface
+ *  ignores them, and ignoring a member means not reading it: an accessor on a name no specification
+ *  lists is caller code with nothing to decide here, and reading every own member ran it. A throwing
+ *  one then left by a path carrying no `acme/` code, and a side-effecting one ran before the listed
+ *  members had been captured, so it could change one the reading had not reached yet. */
+function _readOnce(obj, names) {
+  var read = intrinsic.create(null);
+  for (var k = 0; k < names.length; k++) {
+    var name = names[k];
+    if (_hasOwn(obj, name)) read[name] = obj[name];
+  }
+  return read;
+}
+
+/** @internal The members read from a prior `renewalWindow` result, and the bounds read from a window. */
+var PREVIOUS_WINDOW_NAMES = ["suggestedWindow", "selectedTime"];
+var WINDOW_BOUND_NAMES = ["start", "end"];
+
+/** @internal The field names of each resource specification, derived from SPECS once so a reading names
+ *  what it reads and a new field cannot be left out of one. */
+var SPEC_NAMES = intrinsic.create(null);
+(function () {
+  var kinds = _objectKeys(SPECS);
+  for (var i = 0; i < kinds.length; i++) {
+    var fields = SPECS[kinds[i]], names = [];
+    for (var j = 0; j < fields.length; j++) names[j] = fields[j].name;
+    SPEC_NAMES[kinds[i]] = names;
+  }
+})();
+
+function _validate(kind, obj, pre) {
   if (!_isObject(obj)) throw E("acme/bad-" + _codeSlug(kind), "an ACME " + kind + " must be a JSON object");
   var spec = SPECS[kind];
+  /** @internal Every own member is read ONCE, here, before any check runs, and every check below decides
+   *  from this reading. The walk used to read `obj[field.name]` three times per field, for the closed-enum
+   *  check, the message and the type check, and a `requiredWhen` predicate then read the object again:
+   *  `o.status === "pending" || o.status === "valid"` is two more reads on its own. An accessor answers
+   *  each read separately, so a `status` could pass the closed enum as "valid", answer a predicate
+   *  differently to make a required field optional, and be a third value by the time the type check
+   *  looked, while this reported the object as conforming. A closed status enum is what validating an
+   *  ACME state is for.
+   *
+   *  The ORIGINAL object is still returned, which the documented signature fixes; what this changes is
+   *  that the verdict is about one reading of it. A caller that has already taken the reading passes it
+   *  in, so two validators over one object do not read it twice between them. */
+  var read = pre || _readOnce(obj, SPEC_NAMES[kind]);
   for (var f = 0; f < spec.length; f++) {
     var field = spec[f];
-    var present = _hasOwn(obj, field.name);
-    var required = field.required || (field.requiredWhen && field.requiredWhen(obj));
+    var present = _hasOwn(read, field.name);
+    var required = field.required || (field.requiredWhen && field.requiredWhen(read));
     if (!present) {
       if (required) throw E("acme/missing-field", "an ACME " + kind + " is missing the required field " + JSON.stringify(field.name));
       continue;
     }
-    if (field.enum && field.enum.indexOf(obj[field.name]) === -1) {
-      throw E("acme/bad-status", "the " + kind + " " + field.name + " " + JSON.stringify(obj[field.name]) + " is not a recognized value");
+    /** @internal ONE read of the field, which the enum check, the message and the type check all read.
+     *  It was read three times, and an accessor answers each separately: a `status` could pass the closed
+     *  enum as "valid" and be another value by the time the type check looked, while this reported the
+     *  object as conforming. A closed status enum is what validating an ACME state is for, so the check
+     *  passing for a value the object does not carry is the check not happening. */
+    var value = read[field.name];
+    if (field.enum && field.enum.indexOf(value) === -1) {
+      throw E("acme/bad-status", "the " + kind + " " + field.name + " " + JSON.stringify(value) + " is not a recognized value");
     }
-    var err = _checkType(kind, field, obj[field.name], obj);
+    var err = _checkType(kind, field, value, read);
     if (err) throw E("acme/bad-" + _codeSlug(kind), "the " + kind + " field " + JSON.stringify(field.name) + " " + err);
   }
   return obj;
@@ -413,12 +477,16 @@ var ERROR_NAMESPACE = "urn:ietf:params:acme:error:";
 function validateProblem(obj) {
   if (!_isObject(obj)) throw E("acme/bad-problem", "a problem document must be a JSON object");
   if (_hasOwn(obj, "identifier")) throw E("acme/bad-problem", "a top-level problem document must not carry an identifier (RFC 8555 sec. 6.7.1)");
-  if (!_isString(obj.type) || obj.type.indexOf(ERROR_NAMESPACE) !== 0) throw E("acme/bad-problem", "an ACME problem type must be in the " + ERROR_NAMESPACE + " namespace (RFC 8555 sec. 6.7)");
+  /** @internal ONE read of `type`, for both the string test and the namespace test. Read twice, a
+   *  non-string on the second reached `.indexOf` and raised a bare TypeError carrying no code. */
+  var problemType = obj.type;
+  if (!_isString(problemType) || problemType.indexOf(ERROR_NAMESPACE) !== 0) throw E("acme/bad-problem", "an ACME problem type must be in the " + ERROR_NAMESPACE + " namespace (RFC 8555 sec. 6.7)");
   if (_hasOwn(obj, "subproblems")) {
     if (!Array.isArray(obj.subproblems)) throw E("acme/bad-problem", "subproblems must be an array");
     for (var i = 0; i < obj.subproblems.length; i++) {
       var sub = obj.subproblems[i];
-      if (!_isObject(sub) || !_isString(sub.type) || sub.type.indexOf(ERROR_NAMESPACE) !== 0) throw E("acme/bad-problem", "each subproblem must be an ACME problem document in the error namespace");
+      var subType = _isObject(sub) ? sub.type : undefined;
+      if (!_isObject(sub) || !_isString(subType) || subType.indexOf(ERROR_NAMESPACE) !== 0) throw E("acme/bad-problem", "each subproblem must be an ACME problem document in the error namespace");
       if (_hasOwn(sub, "identifier")) _validateOrderIdentifier(sub.identifier);
     }
   }
@@ -478,8 +546,12 @@ function validate(kind, obj) {
 function identify(obj) {
   if (!_isObject(obj)) return "unknown";
   var has = function (k) { return _hasOwn(obj, k); };
+  /** @internal ONE read of `type`, for both tests below. This is a DISPATCHER: what it returns decides
+   *  which validator a caller reaches for, and read twice the kind it names could be chosen from one
+   *  value while the object carries another. */
+  var type = obj.type;
   if (has("protected") && has("signature") && _isString(obj.protected) && _isString(obj.signature)) return "jws";
-  if (_isString(obj.type) && obj.type.indexOf(ERROR_NAMESPACE) === 0) return "problem";
+  if (_isString(type) && type.indexOf(ERROR_NAMESPACE) === 0) return "problem";
   if (has("newNonce") && has("newAccount")) return "directory";
   if (has("suggestedWindow")) return "renewalInfo";
   if (has("finalize") && has("authorizations")) return "order";
@@ -650,6 +722,14 @@ function _readAcmeIdentifier(extnValue) {
  *   await pki.acme.verifyTlsAlpn01(certDer, token, accountJwk, { type: "dns", value: "example.org" });
  */
 async function verifyTlsAlpn01(certDer, token, accountJwk, identifier) {
+  /** @internal The identifier's type and value are read ONCE, at entry, and every check below runs on those
+   *  locals. Reading them after the key-authorization await let a caller answer the validity check with one
+   *  name and the comparison against the certificate with another, so a name nothing validated could be
+   *  matched against the SAN and the identifier would be reported as confirmed. */
+  if (!_isObject(identifier)) throw E("acme/bad-input", "an identifier { type, value } is required");
+  var idType = identifier.type;
+  var idValue = identifier.value;
+  if (!_isString(idType)) throw E("acme/bad-input", "an identifier { type, value } is required");
   var cert = x509.parse(certDer);
   var exts = cert.extensions || [];
   var acmeExt = exts.filter(function (e) { return e.oid === OID_ACME_IDENTIFIER; })[0];
@@ -664,18 +744,17 @@ async function verifyTlsAlpn01(certDer, token, accountJwk, identifier) {
   var san = _extDecoders.byOid[OID_SAN](sanExt.value);
   if (!san.names || san.names.length !== 1) throw E("acme/bad-tlsalpn", "the SubjectAltName must carry EXACTLY ONE entry (RFC 8737 sec. 3)");
   var entry = san.names[0];
-  if (!_isObject(identifier) || !_isString(identifier.type)) throw E("acme/bad-input", "an identifier { type, value } is required");
-  if (identifier.type === "dns") {
+  if (idType === "dns") {
     if (entry.tagNumber !== 2) throw E("acme/bad-tlsalpn", "a dns identifier requires a dNSName SAN");
-    _assertDnsName(identifier.value);
-    if (String(entry.value).toLowerCase() !== identifier.value) throw E("acme/bad-tlsalpn", "the SAN dNSName does not match the identifier");
-  } else if (identifier.type === "ip") {
+    _assertDnsName(idValue);
+    if (String(entry.value).toLowerCase() !== idValue) throw E("acme/bad-tlsalpn", "the SAN dNSName does not match the identifier");
+  } else if (idType === "ip") {
     if (entry.tagNumber !== 7) throw E("acme/bad-tlsalpn", "an ip identifier requires a single iPAddress SAN (RFC 8738 sec. 6)");
-    _assertIpAddress(identifier.value);
+    _assertIpAddress(idValue);
     var sanIp = _ipBytesToText(entry.value);
-    if (sanIp === null || sanIp !== identifier.value) throw E("acme/bad-tlsalpn", "the iPAddress SAN does not match the ip identifier (RFC 8738 sec. 6)");
+    if (sanIp === null || sanIp !== idValue) throw E("acme/bad-tlsalpn", "the iPAddress SAN does not match the ip identifier (RFC 8738 sec. 6)");
   } else {
-    throw E("acme/bad-tlsalpn", "unsupported tls-alpn-01 identifier type " + guard.text.showValue(identifier.type));
+    throw E("acme/bad-tlsalpn", "unsupported tls-alpn-01 identifier type " + guard.text.showValue(idType));
   }
 }
 
@@ -716,6 +795,7 @@ function _signOuter(o, payloadObj) {
 function postAsGet(o) {
   return _promised(function () {
     if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    o = _gateRequestOpts(o, "postAsGet");
     return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, undefined);
   });
 }
@@ -754,7 +834,9 @@ function _assertContacts(contacts) {
  */
 function newAccount(o) {
   return _promised(function () {
-  if (!_isObject(o) || !_isObject(o.jwk)) throw E("acme/bad-input", "newAccount must embed the account public jwk (RFC 8555 sec. 7.3)");
+  if (!_isObject(o)) throw E("acme/bad-input", "newAccount must embed the account public jwk (RFC 8555 sec. 7.3)");
+  o = _gateRequestOpts(o, "newAccount");
+  if (!_isObject(o.jwk)) throw E("acme/bad-input", "newAccount must embed the account public jwk (RFC 8555 sec. 7.3)");
   var payload = {};
   if (o.contact !== undefined) { _assertContacts(o.contact); payload.contact = o.contact; }
   if (o.termsOfServiceAgreed !== undefined) {
@@ -797,19 +879,23 @@ var _HMAC_HASH = intrinsic.assign(intrinsic.create(null), { HS256: "SHA-256", HS
  *   var eab = await pki.acme.externalAccountBinding({ macKey, kid: "abc123", url, accountJwk });
  */
 async function externalAccountBinding(o) {
-  if (!_isObject(o) || !_isObject(o.accountJwk)) throw E("acme/bad-input", "externalAccountBinding requires the account public jwk (sec. 7.3.4)");
-  jose.assertPublicJwk(o.accountJwk);
-  if (!_isString(o.kid)) throw E("acme/bad-input", "externalAccountBinding requires the CA-issued kid");
+  if (!_isObject(o)) throw E("acme/bad-input", "externalAccountBinding requires the account public jwk (sec. 7.3.4)");
+  /** @internal Every member is read ONCE, at entry, and the checks and the signature both run on those
+   *  locals. The MAC key import is an await, so reading a member again after it let a caller have one jwk
+   *  validated and a different one bound into the JWS. */
+  var accountJwk = o.accountJwk, kid = o.kid, url = o.url, key = o.macKey;
   var alg = o.alg || "HS256";
+  if (!_isObject(accountJwk)) throw E("acme/bad-input", "externalAccountBinding requires the account public jwk (sec. 7.3.4)");
+  jose.assertPublicJwk(accountJwk);
+  if (!_isString(kid)) throw E("acme/bad-input", "externalAccountBinding requires the CA-issued kid");
   if (!_HMAC_HASH[guard.text.keyOf(alg)]) throw E("acme/bad-input", "an EAB inner JWS must use an HS* MAC algorithm (sec. 7.3.4), not " + guard.text.showValue(alg));
-  var key = o.macKey;
   if (Buffer.isBuffer(key)) {
     try { key = await subtle.importKey("raw", key, { name: "HMAC", hash: _HMAC_HASH[alg] }, false, ["sign"]); }
     catch (e) { throw E("acme/bad-input", "the EAB macKey could not be imported as an HMAC key", e); }
   } else if (!key || typeof key !== "object" || key.type !== "secret") {
     throw E("acme/bad-input", "the EAB macKey must be a raw Buffer or an HMAC (secret) CryptoKey");
   }
-  return jose.sign({ protected: { alg: alg, kid: o.kid, url: o.url }, payload: _payloadBuf(o.accountJwk), key: key, profile: "eab-inner" });
+  return jose.sign({ protected: { alg: alg, kid: kid, url: url }, payload: _payloadBuf(accountJwk), key: key, profile: "eab-inner" });
 }
 
 function _validateOrderIdentifier(id) {
@@ -851,7 +937,9 @@ function _validateOrderIdentifier(id) {
  */
 function newOrder(o) {
   return _promised(function () {
-  if (!_isObject(o) || !Array.isArray(o.identifiers) || o.identifiers.length === 0) throw E("acme/bad-order", "newOrder requires a non-empty identifiers array (RFC 8555 sec. 7.4)");
+  if (!_isObject(o)) throw E("acme/bad-order", "newOrder requires a non-empty identifiers array (RFC 8555 sec. 7.4)");
+  o = _gateRequestOpts(o, "newOrder");
+  if (!Array.isArray(o.identifiers) || o.identifiers.length === 0) throw E("acme/bad-order", "newOrder requires a non-empty identifiers array (RFC 8555 sec. 7.4)");
   var payload = { identifiers: o.identifiers.map(_validateOrderIdentifier) };
   if (o.notBefore !== undefined) { if (!_isRfc3339(o.notBefore)) throw E("acme/bad-order", "notBefore must be an RFC 3339 date-time"); payload.notBefore = o.notBefore; }
   if (o.notAfter !== undefined) { if (!_isRfc3339(o.notAfter)) throw E("acme/bad-order", "notAfter must be an RFC 3339 date-time"); payload.notAfter = o.notAfter; }
@@ -879,7 +967,9 @@ function newOrder(o) {
  *   await pki.acme.newAuthz({ key, alg: "ES256", nonce, url, kid, identifier: { type: "dns", value: "example.org" } });
  */
 function newAuthz(o) {
-  if (!_isObject(o) || !_isObject(o.identifier)) throw E("acme/bad-identifier", "newAuthz requires a single identifier object (RFC 8555 sec. 7.4.1)");
+  if (!_isObject(o)) throw E("acme/bad-identifier", "newAuthz requires a single identifier object (RFC 8555 sec. 7.4.1)");
+  o = _gateRequestOpts(o, "newAuthz");
+  if (!_isObject(o.identifier)) throw E("acme/bad-identifier", "newAuthz requires a single identifier object (RFC 8555 sec. 7.4.1)");
   return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, { identifier: _validateIdentifier(o.identifier) });
 }
 
@@ -1026,26 +1116,37 @@ function _assertCsrIdentifiers(parsedCsr, identifiers) {
  *   await pki.acme.finalize({ key, alg: "ES256", nonce, url, kid, csr: csrDer, identifiers, accountJwk });
  */
 async function finalize(o) {
-  if (!_isObject(o) || !guard.bytes.isByteSource(o.csr)) throw E("acme/bad-input", "finalize requires a DER CSR BufferSource (opts.csr)");
+  if (!_isObject(o)) throw E("acme/bad-input", "finalize requires a DER CSR BufferSource (opts.csr)");
+  /** @internal Every member is read ONCE, at entry. The account-key comparison awaits, so reading
+   *  `identifiers` after it let a caller have one list validated and the CSR asserted against another,
+   *  which is the check that binds the request to the order. The identifier array is copied element by
+   *  element for the same reason: the elements are the caller's too. */
+  var accountJwk = o.accountJwk, identifiers = o.identifiers;
+  var outer = { key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid };
+  if (!guard.bytes.isByteSource(o.csr)) throw E("acme/bad-input", "finalize requires a DER CSR BufferSource (opts.csr)");
   var csrBuf = guard.bytes.snapshotSource(o.csr, E, "acme/bad-input", "the finalize CSR");
+  var ids = null;
+  if (identifiers !== undefined) {
+    if (!Array.isArray(identifiers) || identifiers.length === 0) throw E("acme/bad-input", "finalize identifiers must be the non-empty order identifier array");
+    ids = [];
+    for (var ii = 0; ii < identifiers.length; ii++) {
+      if (!_hasOwn(identifiers, ii)) throw E("acme/bad-input", "finalize identifiers[" + ii + "] is missing (a sparse array is not allowed)");
+      var one = identifiers[ii];
+      _validateOrderIdentifier(one);
+      guard.list.append(ids, { type: one.type, value: one.value });
+    }
+  }
   var parsed = csr.parse(csrBuf);
-  if (o.accountJwk !== undefined) {
-    var accountSpki = await _jwkToSpki(o.accountJwk);
+  if (accountJwk !== undefined) {
+    var accountSpki = await _jwkToSpki(accountJwk);
     if (parsed.subjectPublicKeyInfo && Buffer.isBuffer(parsed.subjectPublicKeyInfo.bytes) &&
         parsed.subjectPublicKeyInfo.bytes.equals(accountSpki)) {
       throw E("acme/key-reuse", "the finalize CSR public key must not be the account key (RFC 8555 sec. 11.1)");
     }
   }
-  if (o.identifiers !== undefined) {
-    if (!Array.isArray(o.identifiers) || o.identifiers.length === 0) throw E("acme/bad-input", "finalize identifiers must be the non-empty order identifier array");
-    for (var ii = 0; ii < o.identifiers.length; ii++) {
-      if (!_hasOwn(o.identifiers, ii)) throw E("acme/bad-input", "finalize identifiers[" + ii + "] is missing (a sparse array is not allowed)");
-      _validateOrderIdentifier(o.identifiers[ii]);
-    }
-    _assertCsrIdentifiers(parsed, o.identifiers);
-  }
+  if (ids !== null) _assertCsrIdentifiers(parsed, ids);
   var payload = { csr: jose.base64url.encode(csrBuf) };
-  return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
+  return _signOuter(outer, payload);
 }
 
 /**
@@ -1072,6 +1173,7 @@ async function finalize(o) {
 function challengeResponse(o) {
   return _promised(function () {
     if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    o = _gateRequestOpts(o, "challengeResponse");
     var payload = o.payload !== undefined ? o.payload : {};
     if (!_isObject(payload)) throw E("acme/bad-input", "a challenge response payload must be a JSON object (RFC 8555 sec. 7.5.1)");
     return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
@@ -1100,6 +1202,7 @@ function challengeResponse(o) {
 function deactivate(o) {
   return _promised(function () {
     if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    o = _gateRequestOpts(o, "deactivate");
     return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, { status: "deactivated" });
   });
 }
@@ -1128,6 +1231,7 @@ function deactivate(o) {
 function updateAccount(o) {
   return _promised(function () {
     if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    o = _gateRequestOpts(o, "updateAccount");
     _assertContacts(o.contact);
     return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, { contact: o.contact });
   });
@@ -1160,7 +1264,9 @@ function updateAccount(o) {
  */
 function revokeCert(o) {
   return _promised(function () {
-  if (!_isObject(o) || !guard.bytes.isByteSource(o.certificate)) throw E("acme/bad-input", "revokeCert requires a DER certificate BufferSource (opts.certificate)");
+  if (!_isObject(o)) throw E("acme/bad-input", "revokeCert requires a DER certificate BufferSource (opts.certificate)");
+  o = _gateRequestOpts(o, "revokeCert");
+  if (!guard.bytes.isByteSource(o.certificate)) throw E("acme/bad-input", "revokeCert requires a DER certificate BufferSource (opts.certificate)");
   var certBuf = guard.bytes.snapshotSource(o.certificate, E, "acme/bad-input", "the revokeCert certificate");
   x509.parse(certBuf);
   var hasKid = _hasOwn(o, "kid");
@@ -1207,17 +1313,23 @@ function revokeCert(o) {
  */
 async function keyChange(o) {
   if (!_isObject(o)) throw E("acme/bad-input", "a keyChange options object is required");
-  if (!_isString(o.account)) throw E("acme/bad-input", "keyChange requires the account URL (payload account)");
-  if (!_isObject(o.oldKey)) throw E("acme/bad-input", "keyChange requires the old account public jwk (payload oldKey)");
-  if (!_isObject(o.newJwk)) throw E("acme/bad-input", "keyChange requires the new account public jwk (inner header jwk)");
-  jose.assertPublicJwk(o.oldKey);
-  jose.assertPublicJwk(o.newJwk);
+  /** @internal Every member is read ONCE, at entry, because the inner signature is an await and the outer
+   *  header is built after it. `url` in particular went into both headers from two reads, so a caller
+   *  could sign the inner JWS for one URL and the outer for another; RFC 8555 sec. 7.3.5 has the two name
+   *  the same key-change resource. */
+  var account = o.account, oldKey = o.oldKey, newJwk = o.newJwk, newAlg = o.newAlg, newKey = o.newKey;
+  var url = o.url, alg = o.alg, nonce = o.nonce, kid = o.kid, key = o.key;
+  if (!_isString(account)) throw E("acme/bad-input", "keyChange requires the account URL (payload account)");
+  if (!_isObject(oldKey)) throw E("acme/bad-input", "keyChange requires the old account public jwk (payload oldKey)");
+  if (!_isObject(newJwk)) throw E("acme/bad-input", "keyChange requires the new account public jwk (inner header jwk)");
+  jose.assertPublicJwk(oldKey);
+  jose.assertPublicJwk(newJwk);
   var inner = await jose.sign({
-    protected: { alg: o.newAlg, url: o.url, jwk: o.newJwk },
-    payload: _payloadBuf({ account: o.account, oldKey: o.oldKey }),
-    key: o.newKey, profile: "keychange-inner",
+    protected: { alg: newAlg, url: url, jwk: newJwk },
+    payload: _payloadBuf({ account: account, oldKey: oldKey }),
+    key: newKey, profile: "keychange-inner",
   });
-  return jose.sign({ protected: { alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload: _payloadBuf(inner), key: o.key, profile: "acme-outer" });
+  return jose.sign({ protected: { alg: alg, nonce: nonce, url: url, kid: kid }, payload: _payloadBuf(inner), key: key, profile: "acme-outer" });
 }
 
 
@@ -1303,11 +1415,20 @@ function parseAriCertId(certId) {
  *   pki.acme.validateRenewalInfo({ suggestedWindow: { start: "2026-01-01T00:00:00Z", end: "2026-01-08T00:00:00Z" } });
  */
 function validateRenewalInfo(obj) {
-  _validate("renewalInfo", obj);
-  var w = obj.suggestedWindow;
-  if (!_isObject(w) || !_isRfc3339(w.start) || !_isRfc3339(w.end)) throw E("acme/bad-renewal-window", "a renewalInfo suggestedWindow must carry RFC 3339 start and end (RFC 9773 sec. 4.2)");
+  /** @internal ONE reading of the object, shared with `_validate`, and one read of each bound inside the
+   *  window. The window was read twice, once by the field walk and once here, so an accessor could pass
+   *  the walk's type check and hand this a non-object, which reached `.start` and raised a bare
+   *  TypeError; and each bound was read twice more, for its RFC 3339 test and then for the comparison
+   *  that orders the two. */
+  if (!_isObject(obj)) throw E("acme/bad-renewal-info", "an ACME renewalInfo must be a JSON object");
+  var read = _readOnce(obj, SPEC_NAMES.renewalInfo);
+  _validate("renewalInfo", obj, read);
+  var w = read.suggestedWindow;
+  var wStart = _isObject(w) ? w.start : undefined;
+  var wEnd = _isObject(w) ? w.end : undefined;
+  if (!_isObject(w) || !_isRfc3339(wStart) || !_isRfc3339(wEnd)) throw E("acme/bad-renewal-window", "a renewalInfo suggestedWindow must carry RFC 3339 start and end (RFC 9773 sec. 4.2)");
   // allow:nan-date-comparison-unguarded -- source-validated by the rfc3339.isValid check above.
-  if (Date.parse(w.end) <= Date.parse(w.start)) throw E("acme/bad-renewal-window", "the renewal window end must be strictly after start (RFC 9773 sec. 4.2)");
+  if (Date.parse(wEnd) <= Date.parse(wStart)) throw E("acme/bad-renewal-window", "the renewal window end must be strictly after start (RFC 9773 sec. 4.2)");
   return obj;
 }
 
@@ -1742,6 +1863,19 @@ function _gateOpts(bag, whitelist, name) {
   guard.identifier.assertKnownKeys(bag, whitelist, E, "acme/bad-input", "unknown " + name + " option ");
   return bag;
 }
+/** @internal The options gate for the module-level request builders, which take no option whitelist. It is
+ *  `optionsObject` alone, and what that buys is the REFUSAL of an accessor-backed field.
+ *
+ *  These verbs validate a member and then serialize it into the payload they SIGN, and each read of an
+ *  accessor answers separately: the RFC 5280 CRLReason whitelist in `revokeCert` ran on one reading while
+ *  the signed request carried another, so the single value the whitelist exists to exclude could reach the
+ *  CA; the same gap put unvalidated contacts, identifiers and dates into signed `newAccount`, `newOrder`
+ *  and `updateAccount` payloads. The client methods were never exposed, because they already pass their
+ *  options through `_gateOpts` and this same refusal. Routing these through it is the module keeping one
+ *  rule rather than two. */
+function _gateRequestOpts(bag, name) {
+  return guard.identifier.optionsObject(bag, E, "acme/bad-input", "pki.acme " + name + " options");
+}
 /** @internal Refused at the door and again where the value is used. The checked value is RETURNED
  * and it is that one the caller uses: reading the option again would ask a second time, and an
  * accessor can answer differently on each read. */
@@ -1845,8 +1979,8 @@ function client(directoryUrl, opts) {
     if (typeof v !== "string" || v === "") return;
     try { jose.base64url.decode(v); }
     catch (_e) { return; }
-    while (nonces.length >= CLIENT_MAX_NONCE_POOL) nonces.shift();
-    nonces.push(v);
+    while (nonces.length >= CLIENT_MAX_NONCE_POOL) _shift(nonces);
+    _push(nonces, v);
   }
   function _isProblem(res) { return intrinsic.stringIndexOf(_lower(String(res.headers["content-type"] || "")), "application/problem+json") !== -1; }
   function _serverProblem(res) {
@@ -1870,25 +2004,31 @@ function client(directoryUrl, opts) {
       return guard.async.invoked(transport, [{ method: method, url: url, headers: reqHeaders, body: body, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "acme/bad-input", "opts.transport");
     }).then(function (res) {
       res = res || {};
+      /** @internal The transport is a caller-supplied option, so its response is a caller object: the body
+       *  and the status are read ONCE here and every check and the returned value read those locals. Read
+       *  per use, the body whose length was capped need not be the body handed back, which is how a
+       *  response larger than maxResponseBytes would pass the cap. */
+      var rbody = res.body;
+      var status = res.status;
       var h = guard.header.lowerCased(res.headers);
-      var blen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8")
-        : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, E, "acme/bad-response", "the response body"))));
+      var blen = rbody == null ? 0 : (typeof rbody === "string" ? Buffer.byteLength(rbody, "utf8")
+        : (Buffer.isBuffer(rbody) ? guard.bytes.lengthOf(rbody) : guard.bytes.lengthOf(guard.bytes.source(rbody, E, "acme/bad-response", "the response body"))));
       if (blen > budgets.maxResponseBytes) throw E("acme/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");
-      if ((method === "GET" || method === "HEAD") && res.status >= 300 && res.status < 400) {
+      if ((method === "GET" || method === "HEAD") && status >= 300 && status < 400) {
         if (redirects >= budgets.maxRedirects) throw E("acme/too-many-redirects", "the redirect budget of " + budgets.maxRedirects + " was exceeded");
-        if (!_isString(h["location"])) throw E("acme/bad-redirect", "a " + res.status + " redirect carried no Location header (RFC 7231 sec. 6.4)");
+        if (!_isString(h["location"])) throw E("acme/bad-redirect", "a " + status + " redirect carried no Location header (RFC 7231 sec. 6.4)");
         var next;
         try { next = new URL(h["location"], url).href; }
         catch (e) { throw E("acme/bad-redirect", "the redirect Location did not resolve to a valid URL", e); }
         return _sendFollowing(method, _clientUrl(next), headers, body, redirects + 1);
       }
       _harvestNonce(h["replay-nonce"]);
-      return { status: res.status, headers: h, body: res.body == null ? "" : res.body };
+      return guard.verdict.of({ status: status, headers: h, body: rbody == null ? "" : rbody });
     });
   }
 
   function _getDirectory() {
-    if (dirCache) return Promise.resolve(dirCache);
+    if (dirCache) return _resolve(_Promise, dirCache);
     return _send("GET", dirUrl, { accept: "application/json" }, null).then(function (res) {
       if (res.status !== 200) throw E("acme/bad-directory", "the ACME directory request returned HTTP " + res.status);
       var obj = _json(res);
@@ -1904,12 +2044,12 @@ function client(directoryUrl, opts) {
     });
   }
   function _takeNonce() {
-    if (nonces.length) return Promise.resolve(nonces.pop());
+    if (nonces.length) return _resolve(_Promise, _pop(nonces));
     var before = nonces.length;
     return _resource("newNonce").then(function (nn) { return _send("HEAD", nn, {}, null); }).then(function (res) {
       if (res.status !== 200 && res.status !== 204) { nonces.length = before; throw _serverProblem(res); }
       if (!nonces.length) throw E("acme/no-nonce", "the server did not provide a usable Replay-Nonce (RFC 8555 sec. 7.2)");
-      return nonces.pop();
+      return _pop(nonces);
     });
   }
 
@@ -1976,7 +2116,7 @@ function client(directoryUrl, opts) {
     });
   }
   function _newAuthz(identifier) {
-    return Promise.resolve().then(function () {
+    return _resolve(_Promise, undefined).then(function () {
     var canon = _validateIdentifier(identifier);
     return _resource("newAuthz").then(function (url) {
       return _post(url, newAuthz, { identifier: canon }, "kid", undefined, [200, 201]).then(function (res) {
@@ -2010,7 +2150,7 @@ function client(directoryUrl, opts) {
       capPolls = budget.maxPolls != null ? guard.limits.cap(budget.maxPolls, "maxPolls", maxPolls, { E: E, code: "acme/bad-input", min: 1, max: 1000 }) : maxPolls;
       capWait = budget.maxTotalWait != null ? guard.limits.cap(budget.maxTotalWait, "maxTotalWait", maxTotalWait, { E: E, code: "acme/bad-input", min: 0, max: retryAfter.MAX_RETRY_AFTER_SECONDS }) : maxTotalWait;
       url = _clientUrl(url);
-    } catch (e) { return Promise.reject(e); }
+    } catch (e) { return _reject(_Promise, e); }
     var terminal = kind === "order" ? { ready: true, valid: true, invalid: true } : { valid: true, invalid: true, deactivated: true, expired: true, revoked: true };
     var last = null, count = 0, waited = 0;
     function step() {
@@ -2027,7 +2167,7 @@ function client(directoryUrl, opts) {
         waited += delaySec;
         if (waited > capWait) throw E("acme/poll-exhausted", "the " + kind + " poll exceeded the total wait budget of " + capWait + " seconds");
         if (typeof budget.onRetryAfter === "function") budget.onRetryAfter(delaySec);
-        return Promise.resolve(sleep(delaySec * constants.TIME.seconds(1))).then(step);
+        return _resolve(_Promise, sleep(delaySec * constants.TIME.seconds(1))).then(step);
       });
     }
     return step();
@@ -2092,7 +2232,7 @@ function client(directoryUrl, opts) {
   }
 
   function _downloadCertificate(url, opts) {
-    return Promise.resolve().then(function () {
+    return _resolve(_Promise, undefined).then(function () {
       opts = _gateOpts(opts, _METHOD_OPTS.download, "downloadCertificate");
       var select = opts.selectChain;
       if (select !== undefined && typeof select !== "function") throw E("acme/bad-input", "downloadCertificate opts.selectChain must be a function");
@@ -2111,7 +2251,7 @@ function client(directoryUrl, opts) {
             boundToKey: binding.spki !== undefined, boundToIdentifiers: binding.ids !== undefined };
         }
         if (!select) return result(primary);
-        return Promise.resolve(select(primary)).then(function (primaryMatch) {
+        return _resolve(_Promise, select(primary)).then(function (primaryMatch) {
           if (primaryMatch) return result(primary);
           if (linkError) throw linkError;
           var leaf = primary.certificate, toFetch = alternates.slice(0, maxAlt), overBudget = alternates.length > maxAlt, idx = 0;
@@ -2122,7 +2262,7 @@ function client(directoryUrl, opts) {
             }
             return _fetchCertChain(toFetch[idx++]).then(function (cand) {
               if (!cand.certificate.equals(leaf)) throw E("acme/bad-alternate", "an alternate chain did not start with the same end-entity certificate (RFC 8555 sec. 7.4.2)");
-              return Promise.resolve(select(cand)).then(function (m) { return m ? result(cand) : next(); });
+              return _resolve(_Promise, select(cand)).then(function (m) { return m ? result(cand) : next(); });
             });
           }
           return next();
@@ -2243,13 +2383,22 @@ function client(directoryUrl, opts) {
   }
 
   function _renewalWindow(certDer, o) {
-    return Promise.resolve().then(function () {
+    return _resolve(_Promise, undefined).then(function () {
       o = _gateOpts(o, _METHOD_OPTS.renewalWindow, "renewalWindow");
       if (!guard.bytes.isByteSource(certDer)) throw E("acme/bad-input", "renewalWindow requires a DER certificate BufferSource");
       if (o.random !== undefined && typeof o.random !== "function") throw E("acme/bad-input", "renewalWindow opts.random must be a function returning a number in [0, 1]");
       if (o.clock !== undefined && typeof o.clock !== "function") throw E("acme/bad-input", "renewalWindow opts.clock must be a function returning epoch milliseconds");
       if (o.replaced !== undefined && typeof o.replaced !== "boolean") throw E("acme/bad-input", "renewalWindow opts.replaced must be a boolean");
       if (o.previous !== undefined && !_isObject(o.previous)) throw E("acme/bad-input", "renewalWindow opts.previous must be a prior renewalWindow result object");
+      /** @internal `previous` is READ ONCE, here, before the await below, and the stickiness decision
+       *  reads this reading. It was validated as an object here and then read three more times after the
+       *  renewalInfo fetch: `o.previous.suggestedWindow` twice in one expression, and
+       *  `o.previous.selectedTime` once for its string test and again for the parse. An accessor answers
+       *  each read separately and the fetch is the window in which to change its answer, so the prior
+       *  window this compares against need not be the one the caller validated, and a non-object arriving
+       *  after the await reached `.start` and raised a bare TypeError. */
+      var prev = o.previous === undefined ? undefined : _readOnce(o.previous, PREVIOUS_WINDOW_NAMES);
+      var prevWindow = prev && _isObject(prev.suggestedWindow) ? _readOnce(prev.suggestedWindow, WINDOW_BOUND_NAMES) : null;
       var _clk = typeof o.clock === "function" ? o.clock : clock;
       function clk() { var t = _clk(); if (typeof t !== "number" || !isFinite(t)) throw E("acme/bad-input", "the renewalWindow clock returned a non-finite value"); return t; }
       var notAfter = x509.parse(certDer).validity.notAfter;
@@ -2262,10 +2411,10 @@ function client(directoryUrl, opts) {
         var startMs = Date.parse(w.start), endMs = Date.parse(w.end);
         var notAfterMs = guard.time.instantOf(notAfter);
         var effEnd = Math.min(endMs, notAfterMs), effStart = Math.min(startMs, effEnd);
-        var pw = o.previous && _isObject(o.previous.suggestedWindow) ? o.previous.suggestedWindow : null;
+        var pw = prevWindow;
         var selectedMs;
-        if (pw && pw.start === w.start && pw.end === w.end && _isString(o.previous.selectedTime)) {
-          var prevMs = Date.parse(o.previous.selectedTime);
+        if (pw && pw.start === w.start && pw.end === w.end && _isString(prev.selectedTime)) {
+          var prevMs = Date.parse(prev.selectedTime);
           if (!isFinite(prevMs)) throw E("acme/bad-input", "renewalWindow opts.previous.selectedTime must be an RFC 3339 date-time");
           selectedMs = Math.max(effStart, Math.min(effEnd, prevMs));
         } else {
@@ -2289,7 +2438,7 @@ function client(directoryUrl, opts) {
   }
 
   function _scheduleRenewal(certDer, o) {
-    return _resolve(Promise).then(function () {
+    return _resolve(_Promise).then(function () {
       o = _gateOpts(o, _METHOD_OPTS.scheduleRenewal, "scheduleRenewal");
       if (!guard.bytes.isByteSource(certDer)) throw E("acme/bad-input", "scheduleRenewal requires a DER certificate BufferSource");
       if (o.random !== undefined && typeof o.random !== "function") throw E("acme/bad-input", "scheduleRenewal opts.random must be a function returning a number in [0, 1]");
@@ -2308,7 +2457,7 @@ function client(directoryUrl, opts) {
       function _clk() { var t = clock(); if (typeof t !== "number" || !intrinsic.isFinite(t)) throw E("acme/bad-input", "the scheduleRenewal clock returned a non-finite value"); return t; }
       var startMs = _clk(), checks = 0, tempBackoffMs = tempBaseMs, previous = null;
       var cert = guard.bytes.snapshotSource(certDer, AcmeError, "acme/bad-input", "the scheduleRenewal certificate");
-      function _boundedSleep(ms) { if (maxWaitMs != null) { ms = intrinsic.min(ms, intrinsic.max(0, maxWaitMs - (_clk() - startMs))); } return _resolve(Promise, sleep(ms)); }
+      function _boundedSleep(ms) { if (maxWaitMs != null) { ms = intrinsic.min(ms, intrinsic.max(0, maxWaitMs - (_clk() - startMs))); } return _resolve(_Promise, sleep(ms)); }
       function _sleepThenLoop(ms) { return (maxChecks != null && checks >= maxChecks) ? { reason: "budget" } : _boundedSleep(ms).then(loop); }
       function _stop() {
         if (!o.shouldStop) return false;
@@ -2333,7 +2482,7 @@ function client(directoryUrl, opts) {
               var _rc;
               try { _rc = o.renew(decision); }
               catch (e) { throw E("acme/bad-input", "the scheduleRenewal renew callback threw", e); }
-              return _resolve(Promise, _rc).then(function (next) {
+              return _resolve(_Promise, _rc).then(function (next) {
                 if (next == null) return { reason: "renewed", decision: decision };
                 if (!guard.bytes.isByteSource(next)) throw E("acme/bad-input", "scheduleRenewal opts.renew must return a DER certificate BufferSource or a nullish value");
                 cert = guard.bytes.snapshotSource(next, AcmeError, "acme/bad-input", "the scheduleRenewal renewed certificate"); previous = null; return loop();