@blamejs/pki 0.8.57 → 0.8.59

package/CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.59 — 2026-10-07
+
+Render an object identifier, match a header name and read a media type through operations a replacement cannot answer.
+
+### Changed
+
+- The check that holds these modules to captured operations now counts a method reached through an index, not only one reached through a call. It is the same receiver one bracket over, and the earlier form could not see it: two live copies in the RFC 5280 policy-mapping walk, where the copy becomes a node's expected policy set, were found by other means.
+
+### Fixed
+
+- An object identifier is rendered to its dotted form through operations bound when the module loaded, and its arcs are collected by defining each index rather than by appending to the array. Three different replacements each decided that string, which is the value `pki.oid` resolves, which selects a signature algorithm and which names an extension: a replaced integer conversion made the content octets of `1.2.3` render as `1.3.4`, and an accessor inherited at the first index of every array took each arc as it was collected and made the same octets render as `0.1.3`. Appending stores at an index, and a store consults the prototype chain for a setter, so a list this build assembles is now built by defining its indexes.
+- A media type is read on the delimiter character and folded through a captured conversion, in `pki.acme`, `pki.cmp` and `pki.ct`. The token decides which parser a response body is handed to, and it was produced by splitting, trimming and folding through live operations. Splitting is now a character scan, which this toolkit requires in its libraries because a separator's own split hook is part of that operation.
+- `pki.est` reads a content-type parameter through captured operations, and collects the segments it searches by defining each index. That is where the RFC 7030 multipart boundary comes from, so the value decides where a multi-part response is divided: measured, a header declaring `boundary=wire` yielded `forged`, both through a replaced append and through an accessor inherited at an array index. The name comparison that selects a parameter, the slicing that extracts it and the quote stripping around it were each live, as were the name and value of every header on a part, which is where a part's own content type comes from: measured, a part declaring `application/pkcs8` was read as `application/pkcs7-mime` carrying `smime-type=certs-only`. Its two case-insensitive header lookups are folded through the capture on both sides of the comparison.
+- `pki.acme` parses a Link header through captured operations: the header is divided into links, each link into parameters, and the target cut out of its angle brackets, all through operations bound when the module loaded. The relation decides whether a header names a resource the client will follow and the target is the URL it would fetch, and both were produced by methods read off the live prototype: measured, a header stating one alternate chain resolved to a different URL.
+- `pki.cmc.build` selects which request arm a message carries through a selection that reads each candidate once and builds its own result, rather than through a method that is both read off the prototype and specified to construct its result through a replaceable protocol.
+- The algorithm, extension and criticality tables that `pki.path.validate`, `pki.cms`, `pki.crl`, `pki.key`, `pki.webcrypto`, `pki.x509` and the signature-scheme registry build when they load are built through captured walks, so a replacement installed before a module loads cannot decide which rows exist.
+
+## v0.8.58 — 2026-10-07
+
+Connect under the trust anchors, the address and the identity check the request named, not the ones a second read answers with.
+
+### Fixed
+
+- `pki.transport.https` applies the private-address refusal the request asked for. `blockPrivateAddresses` was read once to test for presence and again for the value, so a value that answered `true` and then `false` left the refusal unarmed: measured, a request to `127.0.0.1` completed with the block in force. The same split applied to `tls.servername`, which is the name the server's certificate is verified against, to `tls.checkServerIdentity`, where the caller's hook was found to be a function and then not installed, to `tls` and `tls.anchors` themselves, to the transport's own `defaults.tls`, to `proxy`, and to `timeout` and `maxResponseBytes`. Each is now read once.
+- `pki.transport.https` connects under the trust anchors the request named. The list is assembled by appending to an empty array and the appending operation was read off the live prototype, so one answering with an empty array left the connection with no trust list of its own and the platform's certificate store decided instead: a caller that passed `tls.anchors` to pin one issuer was pinned to none of them. Measured against a loopback endpoint whose certificate only the named anchor trusts, the request then failed on the platform store's verdict rather than succeeding on the caller's. The proxy CONNECT path assembled its own trust list the same way.
+- The address a private-address check cleared is the address the connection is made to. A resolver that returns a list had its own entries forwarded to the socket layer, so an entry whose address answered a public value to the check and a loopback one afterwards reached loopback with `blockPrivateAddresses` set. Each address is now read once, that read is what is classified, and the snapshot is what is handed on.
+- A sparse proxy trust-anchor list is refused rather than read. The eligibility check walks the array's own property descriptors, which cannot see a gap, so a list whose gap was answered from the array prototype was validated as holding one anchor and converted as holding another: reading an array by index is specified to consult the prototype at a hole. A list with a gap is now refused as `transport/bad-proxy`.
+- The platform trust store is read through the provider bound when the module loads, so a replacement installed afterwards cannot answer with its own certificate list for a `useSystemStore` connection.
+- Every connection is opened through the function bound when the module loaded, not a property read off `node:https`, `node:http` or `node:tls` at the moment of the call: the request itself, the proxy CONNECT, the TLS connection made over a tunnel, and the one `pki.transport.peerChain` opens. A replacement installed afterwards sent a request prepared for one destination to another and handed the caller that peer's answer.
+- The socket itself is opened by this module rather than by the agent node builds, on the request and on the proxy CONNECT alike. `agent: false` does not mean no agent, which is what it had been relied on for: node builds one from the default agent's constructor, and that agent's own connection builder opened the socket, so replacing it returned a connection to another destination and the request went out over it. Measured, an `https:` request with `blockPrivateAddresses` set and certificate verification on reached a local plaintext listener that presented no certificate, and its body reached the caller. On the CONNECT path the same replacement could answer with a plain socket in place of the proxy's TLS connection, which is the request that carries `Proxy-Authorization`. The request options node computed for the hop are forwarded unchanged, so every TLS setting still applies, and there is still no connection pooling.
+- A per-request `tls.checkServerIdentity` keeps the transport's default from being read at all. The default was read whether or not the request overrode it, so a default supplied as an accessor ran even for a request that replaced it, and one that throws refused the request before it connected.
+- A response is as long as the bytes that arrived, and holds those bytes. It is allocated at the counted length and written through operations bound at load, because three earlier spellings were each steerable: a copy read off the prototype, a slice whose result is built through the species constructor, and a conversion that reads the received view's own `valueOf` and `length`. The last of those decided the length as well as the content: measured, an eight-byte response came back as 64 bytes with a `maxResponseBytes` of 8, so the size cap was reported as enforced on a body that exceeded it.
+- Every remaining operation `pki.transport.https` reaches a socket through is bound when the module loads: the PEM armor and IPv6 bracket scanners, the peer-chain walk, the anchor conversion, the TLS error classifier that decides whether a failure is reported as a trust failure or a transport one, the header names a proxy credential is stripped from, and the CONNECT tunnel's own options. The trust lists are assembled by copying and appending index by index, because appending with the built-in consults a spreading hook each argument can inherit, which replaced a validated anchor with another one.
+- `guard.limits.cap` compares a value against the bound it validated. `min` and `max` were each read more than once, with the integer check reading one value and the comparison another, so a bound answering a small integer to the check and a large one to the comparison configured a cap that admitted a value above its own limit. Each bound is now read once. No shipped verb could reach this, because every caller in the toolkit passes a fixed bound; the guard is what has to hold for the next one.
+
 ## v0.8.57 — 2026-10-07
 
 Read the OCSP response a CMS message carries in its crls field, instead of accepting it unread.

package/lib/acme.js

@@ -88,6 +88,7 @@ var _sortI = intrinsic.sort;
 var _objectKeys = intrinsic.keys;
 var _lower = intrinsic.toLowerCase;
 var _StringI = intrinsic.String;
+var _acmeTrim = intrinsic.uncurry(String.prototype.trim);
 var _stringify = intrinsic.stringify;
 var _push = intrinsic.push;
 var _pop = intrinsic.pop;
@@ -98,6 +99,7 @@ var _split = intrinsic.uncurry(String.prototype.split);
 var _parseIntI = intrinsic.parseInt;
 var _numToString = intrinsic.numberToString;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _charAtA = intrinsic.uncurry(String.prototype.charAt);
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _charAt = intrinsic.uncurry(String.prototype.charAt);
 var pkgVersion = require("../package.json").version;
@@ -1707,61 +1709,71 @@ function _hasCtlOctet(s) {
 }
 
 function _splitLinkValues(s) {
+  /** @internal The header is cut through the captured operations, the same as the parameters below:
+   *  each piece becomes a link whose relation decides whether this client follows it. */
   var out = [], start = 0, inAngle = false, inQuote = false;
   for (var i = 0; i < s.length; i++) {
-    var ch = s.charAt(i);
+    var ch = _charAtA(s, i);
     if (inQuote) { if (ch === "\\") { i++; continue; } if (ch === "\"") inQuote = false; continue; }
     if (ch === "\"") { inQuote = true; continue; }
     if (ch === "<") inAngle = true;
     else if (ch === ">") inAngle = false;
-    else if (ch === "," && !inAngle) { out.push(s.slice(start, i)); start = i + 1; }
+    else if (ch === "," && !inAngle) { intrinsic.append(out, _strSlice(s, start, i)); start = i + 1; }
   }
   if (inQuote || inAngle) throw E("acme/bad-link", "the Link header has an unterminated quote or angle bracket (RFC 8288)");
-  out.push(s.slice(start));
+  intrinsic.append(out, _strSlice(s, start));
   return out;
 }
 function _splitLinkParams(rest) {
   var parts = [], start = 0, inQuote = false;
   for (var i = 0; i < rest.length; i++) {
-    var ch = rest.charAt(i);
+    var ch = _charAtA(rest, i);
     if (inQuote) { if (ch === "\\") { i++; continue; } if (ch === "\"") inQuote = false; continue; }
     if (ch === "\"") inQuote = true;
-    else if (ch === ";") { parts.push(rest.slice(start, i)); start = i + 1; }
+    else if (ch === ";") { intrinsic.append(parts, _strSlice(rest, start, i)); start = i + 1; }
   }
-  parts.push(rest.slice(start));
+  intrinsic.append(parts, _strSlice(rest, start));
   var out = [];
   for (var j = 0; j < parts.length; j++) {
     var p = _trimOWS(parts[j]);
     if (p === "") { if (j === 0) continue; throw E("acme/bad-link", "an empty Link parameter (a ';' with no parameter) is malformed (RFC 8288): " + JSON.stringify(rest)); }
-    var eq = p.indexOf("=");
-    var name = (eq === -1 ? p : _trimOWS(p.slice(0, eq))).toLowerCase();
+    /** @internal The parameter name and value are cut and folded through the captured operations.
+     *  A Link parameter is what names the relation this client follows, and read off the prototype a
+     *  replacement chose it: measured, a header stating `rel=next` parsed as `alternate`. */
+    var eq = intrinsic.stringIndexOf(p, "=");
+    var name = _lower(eq === -1 ? p : _trimOWS(_strSlice(p, 0, eq)));
     if (!pkix.allCharsIn(name, _LINK_TOKEN_TABLE)) throw E("acme/bad-link", "a Link parameter name must be a token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
-    if (eq === -1) { out.push({ name: name, value: "", hasValue: false }); continue; }
-    var v = _trimOWS(p.slice(eq + 1));
-    if (v.length >= 2 && v.charAt(0) === "\"" && v.charAt(v.length - 1) === "\"") {
-      var inner = v.slice(1, -1);
+    if (eq === -1) { intrinsic.append(out, { name: name, value: "", hasValue: false }); continue; }
+    var v = _trimOWS(_strSlice(p, eq + 1));
+    if (v.length >= 2 && _charAtA(v, 0) === "\"" && _charAtA(v, v.length - 1) === "\"") {
+      var inner = _strSlice(v, 1, -1);
       if (!_isValidQuotedInterior(inner)) throw E("acme/bad-link", "a quoted Link parameter value is malformed (an unescaped quote or dangling backslash, RFC 7230): " + JSON.stringify(p));
       v = _unescapeQuotedPair(inner);
     } else if (!pkix.allCharsIn(v, _LINK_TOKEN_TABLE)) {
       throw E("acme/bad-link", "an unquoted Link parameter value must be a non-empty token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
     }
-    out.push({ name: name, value: v, hasValue: true });
+    intrinsic.append(out, { name: name, value: v, hasValue: true });
   }
   return out;
 }
 function _relHas(rel, relName) {
-  var toks = String(rel).split(" ");
-  for (var i = 0; i < toks.length; i++) { if (toks[i].toLowerCase() === relName) return true; }
+  /** @internal The relation names are scanned on the delimiter CHARACTER, which hard rule 11 requires
+   *  in lib/, and each token is folded through the captured conversion: the match decides whether a
+   *  Link header names the resource this client then follows. */
+  var toks = intrinsic.splitChar(_StringI(rel), 32);
+  for (var i = 0; i < toks.length; i++) { if (_lower(toks[i]) === relName) return true; }
   return false;
 }
 function _parseLinkValue(raw) {
   var s = _trimOWS(raw);
   if (s === "") return null;
-  var gt = s.indexOf(">");
-  if (s.charAt(0) !== "<" || gt === -1) throw E("acme/bad-link", "a Link value must be <URI-Reference> with parameters (RFC 8288): " + JSON.stringify(raw));
+  var gt = intrinsic.stringIndexOf(s, ">");
+  if (_charAtA(s, 0) !== "<" || gt === -1) throw E("acme/bad-link", "a Link value must be <URI-Reference> with parameters (RFC 8288): " + JSON.stringify(raw));
   var rest = _stripLeadingOWS(s, gt + 1);
-  if (rest !== "" && rest.charAt(0) !== ";") throw E("acme/bad-link", "a Link value's parameters must be introduced by ';' (RFC 8288): " + JSON.stringify(raw));
-  var uri = s.slice(1, gt);
+  if (rest !== "" && _charAtA(rest, 0) !== ";") throw E("acme/bad-link", "a Link value's parameters must be introduced by ';' (RFC 8288): " + JSON.stringify(raw));
+  /** @internal The target this client may follow is cut through the captured operation: read off the
+   *  prototype, a replacement decided the URL a Link header resolves to. */
+  var uri = _strSlice(s, 1, gt);
   if (_linkUriInvalid(uri)) throw E("acme/bad-link", "a Link URI-Reference contains a character, percent-escape, or encoded dot-segment not permitted by RFC 3986: " + JSON.stringify(raw));
   var params = _splitLinkParams(rest), rel = "", relSeen = false, anchor = null, anchorSeen = false;
   for (var i = 0; i < params.length; i++) {
@@ -1780,14 +1792,16 @@ function _parseLinkRelation(headers, base, relName, opts) {
   var raw = null;
   var hNames = guard.identifier.optionNames(headers);
   for (var hi = 0; hi < hNames.length; hi++) {
-    if (hNames[hi].toLowerCase() === "link") { raw = headers[hNames[hi]]; break; }
+    if (_lower(hNames[hi]) === "link") { raw = headers[hNames[hi]]; break; }
   }
   if (raw == null) return [];
   var baseUrl = new _URL(base), baseOrigin = _urlOrigin(baseUrl), baseHref = _urlHref(baseUrl);
   var baseKey = _dedupKey(baseHref);
-  var fields = Array.isArray(raw) ? raw : [raw], out = [], seen = Object.create(null), distinctCount = 0, totalBytes = 0;
+  var fields = intrinsic.isArray(raw) ? raw : [raw], out = [], seen = intrinsic.create(null), distinctCount = 0, totalBytes = 0;
   for (var fi = 0; fi < fields.length; fi++) {
-    var field = String(fields[fi]);
+    /** @internal The header field is converted through the capture: read through the live global, a
+     *  replacement supplied the whole Link header and with it the target this client resolves. */
+    var field = _StringI(fields[fi]);
     totalBytes += field.length + 1;
     if (totalBytes > LINK_HEADER_MAX_BYTES) throw E("acme/bad-link", "the Link header(s) exceed the " + LINK_HEADER_MAX_BYTES + "-byte aggregate cap (RFC 8288, CWE-770)");
     if (_hasCtlOctet(field)) throw E("acme/bad-link", "a Link header must not contain control octets (RFC 9110 field-value)");
@@ -2202,7 +2216,8 @@ function client(directoryUrl, opts) {
   function _pollAuthorization(url, budget) { return _poll("authorization", url, budget); }
 
   function _readCertChain(res) {
-    var ctToken = String(res.headers["content-type"] || "").split(";")[0].trim().toLowerCase();
+    var ctParts = intrinsic.splitChar(_StringI(res.headers["content-type"] || ""), 59);
+    var ctToken = _lower(_acmeTrim(ctParts.length ? ctParts[0] : ""));
     if (ctToken !== "application/pem-certificate-chain") throw E("acme/bad-certificate-chain", "the certificate download returned an unexpected media type " + JSON.stringify(ctToken) + " (expected application/pem-certificate-chain, RFC 8555 sec. 7.4.2)");
     var chain = _splitPemChain(_bodyText(res));
     return { certificate: chain[0], chain: chain.slice(1), certificates: chain };

package/lib/asn1-der.js

@@ -566,8 +566,16 @@ function decodeOidContent(buf) {
           "OBJECT IDENTIFIER carries more than " + constants.LIMITS.OID_MAX_SUBIDENTIFIERS + " sub-identifiers");
       }
       var value = 0n;
-      for (var k = arcStart; k <= i; k++) value = value * 128n + BigInt(buf[k] & 0x7f);
-      arcs.push(value);
+      /** @internal The arc is accumulated through the captured conversion. Read off the global, a
+       *  replacement decides the sub-identifier, and therefore the dotted string every algorithm and
+       *  extension decision in this toolkit is made on: measured, the same two bytes rendered as
+       *  `1.2.3` and as `1.2.4`. */
+      for (var k = arcStart; k <= i; k++) value = value * 128n + intrinsic.BigInt(buf[k] & 0x7f);
+      /** @internal `append`, not a captured `push`: appending with `push` STORES at the index, and a
+       *  store walks the prototype chain for a setter, so an accessor installed at
+       *  `Array.prototype[0]` took the arc and answered with another. `append` defines the index on
+       *  the array itself. */
+      intrinsic.append(arcs, value);
       arcStart = i + 1;
     }
   }
@@ -577,9 +585,12 @@ function decodeOidContent(buf) {
   if (first < 40n) { a1 = 0n; a2 = first; }
   else if (first < 80n) { a1 = 1n; a2 = first - 40n; }
   else { a1 = 2n; a2 = first - 80n; }
-  var out = [a1.toString(), a2.toString()];
-  for (var j = 1; j < arcs.length; j++) out.push(arcs[j].toString());
-  return out.join(".");
+  /** @internal Each arc is rendered through the captured conversion. Read off the prototype, the
+   *  value that becomes the dotted identifier is whatever a replacement returns, and the identifier
+   *  is what every algorithm and extension decision in this toolkit is made on. */
+  var out = [intrinsic.bigIntToString(a1, 10), intrinsic.bigIntToString(a2, 10)];
+  for (var j = 1; j < arcs.length; j++) intrinsic.append(out, intrinsic.bigIntToString(arcs[j], 10));
+  return intrinsic.join(out, ".");
 }
 
 function _decodeText(buf, encoding) {

package/lib/cmc-build.js

@@ -173,7 +173,10 @@ function fixedRequestId(req, index) {
     return "unknown field " + JSON.stringify(k) + " on request " + index +
       " -- a request names one of tcr / crm / orm, and optionally bodyPartID";
   });
-  var arms = ["tcr", "crm", "orm"].filter(function (k) { return req[k] != null; });
+  /** @internal `selectList`, not the live `filter`: the selection decides which request arm this
+   *  message carries, and `Array.prototype.filter` is both read off the prototype and specified to
+   *  build its result through the species constructor. */
+  var arms = intrinsic.selectList(["tcr", "crm", "orm"], function (k) { return req[k] != null; });
   if (arms.length !== 1) {
     throw E("cmc/bad-input",
       "each request names exactly one of tcr / crm / orm, got " + (arms.length ? arms.join(" + ") : "none") +

package/lib/cmp-build.js

@@ -29,6 +29,7 @@ var cmp = require("./schema-cmp");
 var crmf = require("./crmf-sign");
 var schemaCrmf = require("./schema-crmf");
 var intrinsic = require("./guard-intrinsic");
+var _strTrim = intrinsic.uncurry(String.prototype.trim);
 /** @internal The promise a signature self-check is awaited through, built from the constructor captured
  *  at load. `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands
  *  the construction to whatever that binding holds, and one settling without awaiting its argument runs
@@ -1012,7 +1013,15 @@ function _tlsForTransfer(opts) {
   return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
 }
 
-function _ctypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
+/** @internal The media type is read through the captured operations, and on the delimiter CHARACTER
+ *  rather than through `split`, which hard rule 11 bans in lib/ because the separator's own
+ *  `Symbol.split` is part of that operation. The token decides which parser a response body is
+ *  handed to. */
+function _ctypeToken(headers) {
+  var raw = intrinsic.String((headers || {})["content-type"] || "");
+  var parts = intrinsic.splitChar(raw, 59);
+  return intrinsic.toLowerCase(_strTrim(parts.length ? parts[0] : ""));
+}
 function _isPkixcmp(headers) { var t = _ctypeToken(headers); return t === PKIXCMP || t === PKIXCMP_POLL; }
 
 /** @internal The sentinel is added at the one exit rather than at each `return`, so a branch added

package/lib/cms-decrypt.js

@@ -631,9 +631,13 @@ var HASH_W3C = intrinsic.create(null); HASH_W3C[O("sha1")] = "SHA-1"; HASH_W3C[O
 function _hashW3c(o) { if (!HASH_W3C[o]) throw _err("cms/unsupported-algorithm", "unsupported OAEP hash " + o); return HASH_W3C[o]; }
 
 var X963_HASH = intrinsic.create(null);
-[["dhSinglePass-stdDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-stdDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-stdDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-stdDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-stdDH-sha512kdf-scheme", "SHA-512"],
+var _X963_ROWS = [["dhSinglePass-stdDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-stdDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-stdDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-stdDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-stdDH-sha512kdf-scheme", "SHA-512"],
  ["dhSinglePass-cofactorDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-cofactorDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-cofactorDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-cofactorDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-cofactorDH-sha512kdf-scheme", "SHA-512"]
-].forEach(function (r) { X963_HASH[O(r[0])] = r[1]; });
+];
+/** @internal The registry is built through the captured walk. The method is read off the live
+ *  prototype at the moment it runs even where the receiver is a literal, and these rows decide which
+ *  hash a key-agreement recipient's KDF uses. */
+intrinsic.forEach(_X963_ROWS, function (r) { X963_HASH[O(r[0])] = r[1]; });
 function _x963Hash(scheme) { if (!X963_HASH[scheme]) throw _err("cms/unsupported-algorithm", "unsupported kari key-agreement scheme " + scheme); return X963_HASH[scheme]; }
 function _kariWrap(kea) {
   var params = asn1.decode(kea.parameters);

package/lib/cms-verify.js

@@ -126,9 +126,9 @@ var SIG_SCHEME = intrinsic.assign(intrinsic.create(null), {
   ecdsaWithSHA384: { kind: "ec", hash: "SHA-384", params: "absent" },
   ecdsaWithSHA512: { kind: "ec", hash: "SHA-512", params: "absent" },
 });
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
+intrinsic.forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + intrinsic.toUpperCase(s), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
 function _isDerNull(p) { return guard.der.isNull(p); }
 function _algParamsOk(shape, p) { return shape === "null" ? _isDerNull(p) : (p === null || p === undefined); }
 var EC_CURVE = intrinsic.create(null);

package/lib/crl-sign.js

@@ -108,8 +108,8 @@ var KNOWN_REVOKED_KEYS = intrinsic.assign(intrinsic.create(null), {
 });
 
 var REQUIRED_CRITICALITY = intrinsic.create(null);
-[["cRLNumber", false], ["authorityKeyIdentifier", false], ["freshestCRL", false], ["authorityInfoAccess", false],
-  ["issuingDistributionPoint", true], ["deltaCRLIndicator", true]].forEach(function (r) { REQUIRED_CRITICALITY[O(r[0])] = r[1]; });
+intrinsic.forEach([["cRLNumber", false], ["authorityKeyIdentifier", false], ["freshestCRL", false], ["authorityInfoAccess", false],
+  ["issuingDistributionPoint", true], ["deltaCRLIndicator", true]], function (r) { REQUIRED_CRITICALITY[O(r[0])] = r[1]; });
 
 var REQUIRED_ENTRY_CRITICALITY = intrinsic.create(null);
 (function () {
@@ -199,7 +199,7 @@ var _PRE_ENCODED_IDP_SCHEMA = pkix.issuingDistributionPoint("crl/bad-idp");
 function _validatePreEncodedIdp(inner) {
   if (!inner.children || !inner.children.length) throw _err("crl/bad-idp", "pre-encoded issuingDistributionPoint MUST NOT be empty (RFC 5280 sec. 5.2.5)");
   var f = schema.walk(_PRE_ENCODED_IDP_SCHEMA, inner, NS).fields;
-  ["onlyContainsUserCerts", "onlyContainsCACerts", "onlyContainsAttributeCerts"].forEach(function (name) {
+  intrinsic.forEach(["onlyContainsUserCerts", "onlyContainsCACerts", "onlyContainsAttributeCerts"], function (name) {
     if (f[name].present && f[name].value !== true) throw _err("crl/bad-idp", "pre-encoded issuingDistributionPoint " + name + " encodes its DEFAULT FALSE, which DER omits (X.690 sec. 11.5)");
   });
   if (f.indirectCRL.present) throw _err("crl/bad-idp", _INDIRECT_IDP_DEFERRED);

package/lib/ct.js

@@ -63,6 +63,7 @@ var _bufToString = intrinsic.bufToString;
 var _bufferCompare = intrinsic.compare;
 var _subarray = intrinsic.subarray;
 var _toLowerCase = intrinsic.toLowerCase;
+var _ctTrim = intrinsic.uncurry(String.prototype.trim);
 var _bufCopy = intrinsic.uncurry(Buffer.prototype.copy);
 var _writeU64BE = intrinsic.uncurry(Buffer.prototype.writeBigUInt64BE);
 var _searchSet = intrinsic.uncurry(URLSearchParams.prototype.set);
@@ -1230,7 +1231,15 @@ function _assertTransport(opts) {
     "(request) => Promise<{ status, headers, body }>");
 }
 
-function _fetchCtypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
+/** @internal The media type is read through the captured operations, and on the delimiter CHARACTER
+ *  rather than through `split`, which hard rule 11 bans in lib/ because the separator's own
+ *  `Symbol.split` is part of that operation. The token decides which parser a log's response body is
+ *  handed to. */
+function _fetchCtypeToken(headers) {
+  var raw = intrinsic.String((headers || {})["content-type"] || "");
+  var parts = intrinsic.splitChar(raw, 59);
+  return _toLowerCase(_ctTrim(parts.length ? parts[0] : ""));
+}
 
 function _parseHttpsUrl(u, label) {
   var parsed;

package/lib/est.js

@@ -76,6 +76,9 @@ var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _toLowerCase = intrinsic.uncurry(String.prototype.toLowerCase);
+var _estTrim = intrinsic.uncurry(String.prototype.trim);
+var _estCharAt = intrinsic.uncurry(String.prototype.charAt);
+var _estIndexOf = intrinsic.stringIndexOf;
 /** @internal Each verb gates its body on a resolved promise and returns its refusals as rejected ones,
  *  and both build from the RECEIVER, so reading the global binding at the call decides whether the body
  *  runs and whether a refusal stays a refusal. Taken at load. */
@@ -250,7 +253,7 @@ function _isMultipartMixedPrefix(ct) {
 }
 
 function _multipartBoundary(contentType) {
-  var ct = String(contentType || "");
+  var ct = _stringOf(contentType || "");
   if (!_isMultipartMixedPrefix(ct)) return null;
   var bp = _ctParam(ct, "boundary");
   if (bp.duplicated) {
@@ -356,12 +359,16 @@ function splitMultipartMixed(body, contentType) {
     var lines = _splitCrlf(_unfoldHeaders(rawHeaders));
     for (var li = 0; li < lines.length; li++) {
       var line = lines[li];
-      var col = line.indexOf(":");
-      if (col > 0) headers[line.slice(0, col).trim().toLowerCase()] = line.slice(col + 1).trim();
+      /** @internal A part's header name and value are cut, trimmed and folded through the captured
+       *  operations. One of those headers is the part's own content type, which selects the reader
+       *  its body goes to: measured, a part stating `application/pkcs8` was read as
+       *  `application/pkcs7-mime` with a `smime-type` of `certs-only`. */
+      var col = _estIndexOf(line, ":");
+      if (col > 0) headers[_toLowerCase(_estTrim(_strSlice(line, 0, col)))] = _estTrim(_strSlice(line, col + 1));
     }
     var partCt = headers["content-type"] || "";
     if (_ciStartsWith(partCt, "MULTIPART/")) throw E("est/bad-multipart", "a nested multipart part is not permitted");
-    parts.push({ headers: headers, contentType: partCt, body: partBody });
+    intrinsic.append(parts, { headers: headers, contentType: partCt, body: partBody });
   }
   return parts;
 }
@@ -457,29 +464,37 @@ function _recipientMatches(recipientInfos, opts) {
   return false;
 }
 
+/** @internal The segments are collected through the captured append. Read off the prototype, a
+ *  replacement decides which segments a parameter is then looked for in, and one of those parameters
+ *  is the multipart boundary a response body is divided on: measured, a `boundary=wire` header
+ *  yielded `forged`. */
 function _splitContentTypeParams(s) {
   var segs = [], cur = "", inQuote = false;
   for (var i = 0; i < s.length; i++) {
-    var ch = s[i];
+    var ch = _estCharAt(s, i);
     if (ch === '"') { inQuote = !inQuote; cur += ch; }
-    else if (ch === ";" && !inQuote) { segs.push(cur); cur = ""; }
+    else if (ch === ";" && !inQuote) { intrinsic.append(segs, cur); cur = ""; }
     else cur += ch;
   }
-  segs.push(cur);
+  intrinsic.append(segs, cur);
   return segs;
 }
 
 function _ctParam(contentType, name) {
-  var segs = _splitContentTypeParams(String(contentType || ""));
+  var segs = _splitContentTypeParams(_stringOf(contentType || ""));
   var value = null, count = 0;
+  /** @internal Each parameter is read through the captured operations. The name decides which
+   *  parameter this is, and the value it returns is the one a caller acts on: for the RFC 7030
+   *  multipart boundary, it is where a response body is split. */
   for (var i = 1; i < segs.length; i++) {
-    var eq = segs[i].indexOf("=");
+    var seg = segs[i];
+    var eq = _estIndexOf(seg, "=");
     if (eq === -1) continue;
-    if (segs[i].slice(0, eq).trim().toLowerCase() !== name) continue;
+    if (_toLowerCase(_estTrim(_strSlice(seg, 0, eq))) !== name) continue;
     count++;
     if (count > 1) continue;
-    var val = segs[i].slice(eq + 1).trim();
-    if (val.length >= 2 && val.charAt(0) === '"' && val.charAt(val.length - 1) === '"') val = val.slice(1, -1);
+    var val = _estTrim(_strSlice(seg, eq + 1));
+    if (val.length >= 2 && _estCharAt(val, 0) === '"' && _estCharAt(val, val.length - 1) === '"') val = _strSlice(val, 1, -1);
     value = val;
   }
   return { value: value, duplicated: count > 1 };
@@ -501,12 +516,15 @@ function _mediaType(seg) {
   return _toLowerCase(_strSlice(seg, a, b));
 }
 
+/** @internal The media type and the S/MIME type are produced through the captured conversions. The
+ *  media type selects which reader a part's body goes to, and read through the live global `String`
+ *  a replacement chose it: measured, `text/plain` arrived as `application/pkcs8`. */
 function _partMediaType(contentType) {
-  var segs = _splitContentTypeParams(String(contentType || ""));
+  var segs = _splitContentTypeParams(_stringOf(contentType || ""));
   var st = _ctParam(contentType, "smime-type");
   return {
     media: _mediaType(segs[0]),
-    smimeType: st.value === null ? null : st.value.toLowerCase(),
+    smimeType: st.value === null ? null : _toLowerCase(st.value),
     ambiguous: st.duplicated,
   };
 }
@@ -1279,7 +1297,7 @@ function _requestBinding(der) {
   var body = cmcFmt.parse(der);
   var ids = [];
   var paths = [];
-  [body.requests, body.controls, body.cmsSequence, body.otherMsgs].forEach(function (list) {
+  intrinsic.forEach([body.requests, body.controls, body.cmsSequence, body.otherMsgs], function (list) {
     (list || []).forEach(function (el) {
       if (el && el.bodyPartID != null) { ids.push(el.bodyPartID); paths.push([el.bodyPartID]); }
     });
@@ -1325,7 +1343,7 @@ function _collectNestedPaths(list, prefix, out, depth) {
     catch (_e) { /* allow:swallow-unverified the outer request must itself parse for this to run, which already rejects a malformed nested ContentInfo; a payload that survives that and still fails to read back lands on the same no-path refusal the non-pkiData route below takes, which the vectors drive */ return; }
     if (!inner || inner.kind !== "pkiData") return;
     var path = prefix.concat([el.bodyPartID]);
-    [inner.requests, inner.controls, inner.cmsSequence, inner.otherMsgs].forEach(function (l) {
+    intrinsic.forEach([inner.requests, inner.controls, inner.cmsSequence, inner.otherMsgs], function (l) {
       (l || []).forEach(function (e2) { if (e2 && e2.bodyPartID != null) out.push(path.concat([e2.bodyPartID])); });
     });
     _collectNestedPaths(inner.cmsSequence, path, out, depth + 1);
@@ -1405,7 +1423,7 @@ function _fullcmcResult(res, opts, wanted, sent) {
   }
   var smimeType = pt200.smimeType;
   if (smimeType === "certs-only") {
-    var unecho = ["transactionId", "senderNonce", "dataReturn"].filter(function (k) {
+    var unecho = intrinsic.selectList(["transactionId", "senderNonce", "dataReturn"], function (k) {
       return sent[k] != null;
     });
     if (unecho.length) {
@@ -1731,21 +1749,23 @@ function _assertConfidentialCipher(res) {
 
 function _ciHeaderList(headers, name) {
   headers = headers || {};
-  var lname = name.toLowerCase(), keys = guard.identifier.optionNames(headers), parts = [];
+  /** @internal The header NAME a value is selected under is folded through the captured conversion on
+   *  both sides of the comparison: the match decides which header this response is read from. */
+  var lname = _toLowerCase(name), keys = guard.identifier.optionNames(headers), parts = [];
   for (var i = 0; i < keys.length; i++) {
-    if (keys[i].toLowerCase() !== lname) continue;
+    if (_toLowerCase(keys[i]) !== lname) continue;
     var v = headers[keys[i]];
     if (v == null) continue;
-    parts.push(Array.isArray(v) ? v.join(", ") : String(v));
+    intrinsic.append(parts, intrinsic.isArray(v) ? intrinsic.join(v, ", ") : _stringOf(v));
   }
-  return parts.length ? parts.join(", ") : null;
+  return parts.length ? intrinsic.join(parts, ", ") : null;
 }
 
 function _ciHeader(headers, name) {
   headers = headers || {};
-  var lname = name.toLowerCase(), keys = guard.identifier.optionNames(headers), found = null, n = 0;
+  var lname = _toLowerCase(name), keys = guard.identifier.optionNames(headers), found = null, n = 0;
   for (var i = 0; i < keys.length; i++) {
-    if (keys[i].toLowerCase() !== lname) continue;
+    if (_toLowerCase(keys[i]) !== lname) continue;
     n += 1;
     if (n === 1) found = headers[keys[i]];
   }

package/lib/guard-identifier.js

@@ -257,7 +257,7 @@ var _CONCRETE_TYPED_MEMBERS = ["BYTES_PER_ELEMENT"];
 var _BUFFER_PROTO_MEMBERS = ["parent", "offset"];
 
 var _ARRAY_MEMBERS = _ARRAY_PROTO_MEMBERS;
-var _REGEXP_MEMBERS = ["lastIndex"].concat(_REGEXP_PROTO_MEMBERS);
+var _REGEXP_MEMBERS = intrinsic.concatList(["lastIndex"], _REGEXP_PROTO_MEMBERS);
 var _VIEW_MEMBERS = _TYPED_PROTO_MEMBERS.concat(_CONCRETE_TYPED_MEMBERS);
 var _BUFFER_KIND_MEMBERS = _VIEW_MEMBERS.concat(_BUFFER_PROTO_MEMBERS);
 var _DATAVIEW_MEMBERS = _DATAVIEW_PROTO_MEMBERS;

package/lib/guard-limits.js

@@ -16,13 +16,19 @@ function _monotonicNow() { return _Number(_hrtimeBigint() / 1000000n); }
 function cap(value, key, dflt, opts) {
   if (value === undefined) return dflt;
   opts = opts || {};
-  var min = opts.min === undefined ? 0 : opts.min;
-  if (!_isInteger(min) || (opts.max !== undefined && !_isInteger(opts.max))) {
+  /** @internal Each bound is read ONCE, into the value the integer check and the comparison share.
+   *  Read twice, the check saw one bound and the comparison another, so an `opts` answering a valid
+   *  small integer to the check and a large one to the comparison configured a cap that admitted a
+   *  value above the bound it had just been validated against. */
+  var rawMin = opts.min, rawMax = opts.max;
+  var min = rawMin === undefined ? 0 : rawMin;
+  var hasMax = rawMax !== undefined;
+  if (!_isInteger(min) || (hasMax && !_isInteger(rawMax))) {
     throw new TypeError("guard.limits.cap: the min/max bounds for " + key + " must be integers");
   }
-  if (!_isInteger(value) || value < min || (opts.max !== undefined && value > opts.max)) {
-    var want = "an integer >= " + min + (opts.max !== undefined ? " and <= " + opts.max : "");
-    if (min === 0 && opts.max === undefined) want = "a non-negative integer";
+  if (!_isInteger(value) || value < min || (hasMax && value > rawMax)) {
+    var want = "an integer >= " + min + (hasMax ? " and <= " + rawMax : "");
+    if (min === 0 && !hasMax) want = "a non-negative integer";
     if (opts.E) throw opts.E(opts.code, (opts.label || key) + " must be " + want);
     throw new TypeError("decode: " + key + " must be " + want);
   }
@@ -136,7 +142,8 @@ function budget(limits) {
 // @enforced-by behavioral -- an elapsed-time comparison has no rename-proof shape that separates a deadline from any other subtraction; the vectors driving a checker to its bound are the guard
 function deadline(totalMs, opts) {
   opts = opts || {};
-  var now = typeof opts.now === "function" ? opts.now : _monotonicNow;
+  var rawNow = opts.now;
+  var now = typeof rawNow === "function" ? rawNow : _monotonicNow;
   if (!_isInteger(totalMs) || totalMs < 0) {
     throw new TypeError("guard.limits.deadline: the total must be a non-negative integer of milliseconds");
   }