@blamejs/pki 0.8.58 → 0.8.60

package/CHANGELOG.md

@@ -4,6 +4,56 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.60 — 2026-10-07
+
+Build every list a parse or an encode reads from by defining its indexes, so an accessor inherited from the array prototype cannot take an element as it is added.
+
+### Changed
+
+- The library no longer has a storing append to reach for, and a check refuses one that is written anyway: a module that reads `push` or `unshift` off a prototype as a value, quotes either inside brackets, or binds either by destructuring fails the static gates with the non-storing form named in the message. A binding is read from the parse rather than from the text, so the form it is written in does not matter: a declaration, an assignment however deeply nested, a `for`-`of` or `for`-`in` header, a catch parameter, and the parameter list of any function, generator, method or arrow, with a computed, quoted or escaped key read as the name it denotes. An object literal is a different construct and is never read as one, including a literal used as a default inside a pattern. Both grow the list, so both store at an index the array has no own property at; the mutators that remain move or drop elements that already have own slots and reach no inherited accessor. A module prepending to a list counts its elements and appends them in order instead. An escaped spelling of either name is read as the name it denotes, since `p\u0075sh` and `"\x70ush"` are the same property. The ordinary call position is held to a per-module figure instead of a flat refusal, because the module that builds report lines still carries those calls: every other module in the library is held to zero and a new call in any of them fails, the one that is listed cannot grow, and converting calls without lowering a figure fails too. A module may only hold such a figure while nothing else in the library reads it, which is checked rather than asserted: a module another module requires decides something for that caller, so it is held to zero like the rest. What the check cannot settle is a property reached without naming it, through a runtime-assembled key or reflection, or a computed key whose value the program does not determine. What the rest rests on is that neither name is captured or exported anywhere in the library, so there is nothing to bind by habit, and that the non-storing primitives carry the tests for the behavior.
+- The same check now recognizes the variable-width and 64-bit integer writes (`writeUIntBE` and its siblings) alongside the fixed-width ones it already knew, so a module that reads one of those off the prototype at the moment it writes a field is reported like any other.
+
+### Fixed
+
+- The DER codec encodes the bytes a value describes. Four of its byte lists were built by prepending or by assigning at an index, and both are stores: an accessor inherited at an array index took the octets as they were produced, and the decisions read back off those lists were then read through the hole a store leaves. Measured: `pki.asn1.build.integer(128n)` emitted the INTEGER 0, a nine-digit integer emitted as all zeroes, -300 emitted as +212, `pki.asn1.build.oid("1.2.840.113549.1.1.11")` emitted a different OBJECT IDENTIFIER, a SEQUENCE wrapping 300 bytes emitted as `3000`, and tag 31 emitted a truncated identifier. The length octets, the identifier octets and an INTEGER's content octets are written into the output directly now, and an OID's sub-identifier octets are appended by defining each index, so all four describe the value they encode.
+- A decoded value's children are appended by defining the index, in both codecs. Those children are what every format module reads its fields out of. On a SEQUENCE of the integers 1 and 2 the first value came back as 9, and a certificate parsed with the accessor's value in place of its first relative distinguished name, throwing a bare TypeError rather than a typed refusal. The segments a constructed string is joined from, an identifier's arcs, and the checked children of every constructed element are built the same way.
+- Every list the schema engine builds is appended to by defining its index. The engine walks each SEQUENCE OF and SET OF into the list a format's own reader takes its elements from, and collects a structure's fields into the list that is concatenated in order into the bytes it emits, so an accessor at an array index decided both what a parse bound and what an encode wrote. The elements are also mapped through an operation captured at load, which neither dispatches through a replaceable `map` nor builds its result through the receiver's `Symbol.species`.
+- The tables that decide whether a string is a token, a label, a decimal-digit string or a hexadecimal escape held an entry per character they allow and nothing at the codes they do not, and reading one at a code it had no entry for answered from the array prototype. A value installed at index 47 therefore made `pki.acme.keyAuthorization` accept a challenge token carrying `/`, which the base64url set does not allow, instead of refusing it with `acme/bad-token`. The tables have no prototype now, so there is nothing to inherit. The same helper in the name guard was already written this way.
+- The certificate-policy tree is read at the depth a node was placed at. The per-depth layers were held in an array, so a depth with no node yet was a hole and reading it answered from the array prototype, which handed the policy processing a layer of the caller's choosing along with the expected policy sets its nodes carry. Creating a layer was a store at the same index. The layers are keyed in a record with no prototype now, and a generated node takes a qualifier only from a list that holds one.
+- Removing a policy node constructs nothing. The removal went through `splice`, which returns what it removed and therefore builds that result through the receiver's construction protocol: it reads the list's `constructor` and then that constructor's `Symbol.species`, so an accessor installed on `Array.prototype.constructor` ran during the unlink with the live list of policy-node records as its subject, which is a window to change a surviving node's expected-policy set before the walk reads it. Binding `splice` at load does not close that lookup, because the lookup is part of what the function does. The removal now defines the surviving slots and returns nothing. The same change covers the certificate list `pki.cmp` reorders while it accumulates authenticated CA certificates, the extension list every certificate parse builds, and the key-usage list `pki.webcrypto` copies from a caller.
+- An extension or an attribute is found by searching, not by indexing a selection. Written as a filter whose first element is taken, the selection is an empty list when nothing matched, and reading index 0 of an empty list answers from the array prototype: a value installed there stood in for an extension or attribute the input does not carry, and the refusal that follows the lookup was not reached. That covers the subject key identifier a CMS signer is matched by, the message-digest attribute a countersignature and an authenticated-attribute set are checked against, the key usage that decides whether an issuer may sign a CRL, the acmeIdentifier and SubjectAltName extensions a TLS-ALPN validation certificate must carry, and the authority key identifier `pki.acme.ariCertId` reads.
+- Every list a parse builds is appended to by defining its index, across the certificate, CRL, CSR, PKCS#8, CMS, OCSP, TSP, CMP, CMC, PKCS#12, attribute-certificate, trust-anchor and C509 readers, the CBOR codec under C509, and the content-key recovery in `pki.cms.decrypt`, whose key-derivation input is assembled the same way. A SCEP response's certificates and CRLs are checked one at a time and collected the same way, so the certificate returned is the one the check accepted. The trust anchors a path is built against, the addresses a request is allowed to connect to, the anchors a handshake runs under, the distribution-point names a revocation check compares, and the RC2 key schedule a legacy PKCS#12 import derives are all built this way too.
+- The lists built outside the readers are appended to the same way: a certificate's extension rows in the CSR, CRL and CRMF readers, the byte strings an HPKE key schedule is computed over, the peer chain `pki.transport.peerChain` returns, and the lists `pki.acme`, `pki.cmp`, `pki.est`, `pki.ct`, `pki.tuf`, `pki.tlog`, `pki.jose`, `pki.webcrypto` and the PKCS#11 URI reader build while they work.
+- A transparency-log tile is requested from the path its index describes. The path segments were prepended into a list and the per-segment prefix was then applied by a read-modify-write through the hole a prepend leaves, so an accessor at an array index reduced `pki.tlog.tilePath(0, 1234067n)` to `tile/0/`.
+- A C509 iPAddress constraint carries the address it encodes. Its octets were prepended into a list whose leading entry is both the prefix length checked for range and a byte the result carries, so an accessor at an array index decided the check and the emitted address together.
+- A length-prefixed vector declares the bytes it writes. The wire writer under `pki.ct`'s signed-certificate-timestamp list measured the caller's view and then wrote from that same view, so a body on a resizable buffer could shrink in between: the frame then declared more bytes than it carried, and the concatenation that assembles the output failed with an error from the runtime rather than a verdict from the writer. A bound was also converted inside the comparison the length is checked by, which ran the bound's own conversion before the prefix was written and let it replace the write that states the length: measured, a vector declared a length of zero over a payload of two bytes. The body is copied into the writer's own allocation before it is measured, the bounds are converted and typed up front, and the writes that place an integer in its field are bound when the module loads.
+- Every component of the preimage `pki.ct.reconstructSignedData` rebuilds is appended by defining its index, and the concatenation is bound at load. Those bytes are what a log's signature is verified over, so an accessor inherited at an array index replacing any one of them, the version, the signature type, the timestamp, the entry type, the certificate or the extensions, would put the verification on bytes the log never signed.
+- The lists `pki.cms.sign` builds while it works are appended to by defining their indexes: a message's signed attributes, its certificate set and its signer infos, including a countersignature's own signing-time attribute, signed-attribute bytes, signature algorithm and signature as they are assembled into the SignerInfo that is then signed.
+- A message carries the fields its caller asked for. The verbs that assemble a structure for signing collected its fields by storing at an index, so an accessor inherited at that index took a field as it was added and the structure was then signed over whatever the accessor answered. Two measured through their own verbs: `pki.cmp.build` returned a protected message carrying a transaction identifier of `eeee...` where the caller had supplied `0707...`, and the failure reason a SCEP CertRep states is a signed attribute that landed on such an index, so a FAILURE response could be signed stating a reason the caller never gave. Every list outside `pki.inspect` is appended to by defining its index now: `pki.cmp`'s messages and its accumulated CA certificates, `pki.ocsp`'s signed requests and responses, `pki.scep`'s responses, the certificate, CRL, attribute-certificate and certification-request signers, `pki.cms.encrypt`'s recipient infos, `pki.cmc`'s controls, the shared extension and name builders every signing verb embeds, the bags a PKCS#12 file carries under its MAC, the headers and parts of an S/MIME message, the key-derivation parameters an encrypted structure declares, the authentication path a hash-based signature is formed from, and the lists `pki.est`, `pki.acme`, `pki.webcrypto` and the TLS and key-description validators build while they work.
+- `pki.path.fetchingChecker` only fetches a revocation location whose address it is allowed to reach, and both halves of that decision are now bound when the module loads. The test for whether a host is an address literal, which decides whether the blocked-address check runs at all, and the blocked-address check itself were each read off their module at the moment they were used. Replacing the first made every host look like a name so the check was skipped; replacing the second made it answer that nothing is blocked. Either way a distribution point naming a loopback or link-local address was fetched. The operations that read a host, a response body and a media type are bound at load for the same reason, and the bracket test around an IPv6 literal reads character codes rather than comparing substrings.
+- A revocation response is read for the fields it carries itself. The transport seam returns a record of a status, headers and a body, and a transport handing back an object carrying none of them had every one of those reads answered from the object prototype, so an inherited status of 200 with an inherited body and headers was accepted as a revocation response. The three fields are read as the response's own now.
+- A revocation response body is bytes, a string, or absent; a status is the number 200; a media type is a string. Anything else was converted, which ran the value's own conversion: a transport handing back an object decided the bytes a CRL or an OCSP response was then parsed from, a header holding one named the media type from itself, and a status holding one ran during the refusal that reports it. Binding the conversion does not close this, because what runs is the value's hook rather than the conversion. A body that is neither bytes nor a string is refused now and names that as the reason, a status is reported through the formatter that does not convert it, and a media type that is not a string reads as absent.
+- A revocation response's media type is read. It was parsed with the MIME entity reader, which takes the bytes of a whole entity rather than one header value, so the attempt failed for every response and the media type was reported as absent each time. The notes that compare it could therefore never appear, including the one stating that a CRL or an OCSP response arrived under an unexpected media type. The header value is read directly now, taking the span before any parameter and folding its case. The media type still only annotates a verdict and never selects a parser, which is chosen by where the location came from.
+- `pki.path.fetchingChecker` asked a certificate for its extension list by a read that answered from `Object.prototype` when the certificate carries none, so a list installed there was decoded and reported on. It is an own read now, and a value that is not an array is treated as no extensions.
+- A signer refuses to emit an artifact that violates the profile it is signing under, and that refusal is now reached. `pki.x509.sign`, `pki.csr.sign` and `pki.crl.sign` lint what the spec describes before they sign and throw `x509/profile-violation`, `csr/profile-violation` or `crl/profile-violation` naming the rule. The findings that decision reads were collected by storing at an index, so an accessor inherited from the array prototype took each finding as it was recorded and the index answered with the accessor's value: a benign severity there stood in for the error finding and the signer emitted the artifact instead. Measured, `pki.x509.sign` returned a signed CA certificate whose key usage omits keyCertSign. The profile-specific report the check adds for a caller-named profile was substituted whole by the same means. Every list in the linting engine is appended to by defining its index now, so the rules a signer refuses on are the rules that ran. The records that decision is read from were plain objects too, so a field a record does not carry was both written and read through the prototype chain: a finding's severity could be taken off it by an inherited setter, a byte reader's success could be answered as a fatal error, and a rule row that omits an optional field read it from `Object.prototype`, where a value supplied for `appliesTo` or `effectiveDate` stops the rule running at all. Those rows now carry no prototype, the optional reads are own reads, and a report's fields are defined rather than assigned.
+
+## v0.8.59 — 2026-10-07
+
+Render an object identifier, match a header name and read a media type through operations a replacement cannot answer.
+
+### Changed
+
+- The check that holds these modules to captured operations now counts a method reached through an index, not only one reached through a call. It is the same receiver one bracket over, and the earlier form could not see it: two live copies in the RFC 5280 policy-mapping walk, where the copy becomes a node's expected policy set, were found by other means.
+
+### Fixed
+
+- An object identifier is rendered to its dotted form through operations bound when the module loaded, and its arcs are collected by defining each index rather than by appending to the array. Three different replacements each decided that string, which is the value `pki.oid` resolves, which selects a signature algorithm and which names an extension: a replaced integer conversion made the content octets of `1.2.3` render as `1.3.4`, and an accessor inherited at the first index of every array took each arc as it was collected and made the same octets render as `0.1.3`. Appending stores at an index, and a store consults the prototype chain for a setter, so a list this build assembles is now built by defining its indexes.
+- A media type is read on the delimiter character and folded through a captured conversion, in `pki.acme`, `pki.cmp` and `pki.ct`. The token decides which parser a response body is handed to, and it was produced by splitting, trimming and folding through live operations. Splitting is now a character scan, which this toolkit requires in its libraries because a separator's own split hook is part of that operation.
+- `pki.est` reads a content-type parameter through captured operations, and collects the segments it searches by defining each index. That is where the RFC 7030 multipart boundary comes from, so the value decides where a multi-part response is divided: measured, a header declaring `boundary=wire` yielded `forged`, both through a replaced append and through an accessor inherited at an array index. The name comparison that selects a parameter, the slicing that extracts it and the quote stripping around it were each live, as were the name and value of every header on a part, which is where a part's own content type comes from: measured, a part declaring `application/pkcs8` was read as `application/pkcs7-mime` carrying `smime-type=certs-only`. Its two case-insensitive header lookups are folded through the capture on both sides of the comparison.
+- `pki.acme` parses a Link header through captured operations: the header is divided into links, each link into parameters, and the target cut out of its angle brackets, all through operations bound when the module loaded. The relation decides whether a header names a resource the client will follow and the target is the URL it would fetch, and both were produced by methods read off the live prototype: measured, a header stating one alternate chain resolved to a different URL.
+- `pki.cmc.build` selects which request arm a message carries through a selection that reads each candidate once and builds its own result, rather than through a method that is both read off the prototype and specified to construct its result through a replaceable protocol.
+- The algorithm, extension and criticality tables that `pki.path.validate`, `pki.cms`, `pki.crl`, `pki.key`, `pki.webcrypto`, `pki.x509` and the signature-scheme registry build when they load are built through captured walks, so a replacement installed before a module loads cannot decide which rows exist.
+
 ## v0.8.58 — 2026-10-07
 
 Connect under the trust anchors, the address and the identity check the request named, not the ones a second read answers with.

package/lib/acme.js

@@ -88,8 +88,13 @@ var _sortI = intrinsic.sort;
 var _objectKeys = intrinsic.keys;
 var _lower = intrinsic.toLowerCase;
 var _StringI = intrinsic.String;
+var _acmeTrim = intrinsic.uncurry(String.prototype.trim);
 var _stringify = intrinsic.stringify;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: appending with `push` STORES at the index, and a store
+ *  walks the prototype chain for a setter, so an accessor installed at an array index receives each
+ *  element as it is appended and can define something else in its place. `append` defines the index
+ *  on the array itself. */
+var _push = intrinsic.append;
 var _pop = intrinsic.pop;
 var _shift = intrinsic.shift;
 var _join = intrinsic.join;
@@ -98,6 +103,7 @@ var _split = intrinsic.uncurry(String.prototype.split);
 var _parseIntI = intrinsic.parseInt;
 var _numToString = intrinsic.numberToString;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _charAtA = intrinsic.uncurry(String.prototype.charAt);
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _charAt = intrinsic.uncurry(String.prototype.charAt);
 var pkgVersion = require("../package.json").version;
@@ -351,7 +357,7 @@ var SPEC_NAMES = intrinsic.create(null);
   var kinds = _objectKeys(SPECS);
   for (var i = 0; i < kinds.length; i++) {
     var fields = SPECS[kinds[i]], names = [];
-    for (var j = 0; j < fields.length; j++) names[j] = fields[j].name;
+    for (var j = 0; j < fields.length; j++) _push(names, fields[j].name);
     SPEC_NAMES[kinds[i]] = names;
   }
 })();
@@ -750,14 +756,18 @@ async function verifyTlsAlpn01(certDer, token, accountJwk, identifier) {
   if (!_isString(idType)) throw E("acme/bad-input", "an identifier { type, value } is required");
   var cert = x509.parse(certDer);
   var exts = cert.extensions || [];
-  var acmeExt = exts.filter(function (e) { return e.oid === OID_ACME_IDENTIFIER; })[0];
+  /** @internal Each selection returns the first matching row or null. `filter(...)[0]` indexes a
+   *  result that is EMPTY when the extension is absent, and index 0 of an empty array answers from
+   *  the array prototype, so a value installed there would stand in for an extension the validation
+   *  certificate does not carry and the refusals below would not be reached. */
+  var acmeExt = guard.list.firstMatch(exts, function (e) { return e.oid === OID_ACME_IDENTIFIER; });
   if (!acmeExt) throw E("acme/bad-tlsalpn", "the validation certificate is missing the acmeIdentifier extension (RFC 8737 sec. 3)");
   if (!acmeExt.critical) throw E("acme/bad-tlsalpn", "the acmeIdentifier extension must be critical (RFC 8737 sec. 3)");
   var auth = _readAcmeIdentifier(acmeExt.value);
   var ka = await keyAuthorization(token, accountJwk);
   var expected = await _sha256(Buffer.from(ka, "ascii"));
   if (!auth.equals(expected)) throw E("acme/bad-tlsalpn", "the acmeIdentifier digest does not match the key authorization");
-  var sanExt = exts.filter(function (e) { return e.oid === OID_SAN; })[0];
+  var sanExt = guard.list.firstMatch(exts, function (e) { return e.oid === OID_SAN; });
   if (!sanExt) throw E("acme/bad-tlsalpn", "the validation certificate is missing the SubjectAltName");
   var san = _extDecoders.byOid[OID_SAN](sanExt.value);
   if (!san.names || san.names.length !== 1) throw E("acme/bad-tlsalpn", "the SubjectAltName must carry EXACTLY ONE entry (RFC 8737 sec. 3)");
@@ -1381,7 +1391,7 @@ async function keyChange(o) {
 function ariCertId(certDer) {
   if (!guard.bytes.isByteSource(certDer)) throw E("acme/bad-input", "ariCertId requires a DER certificate BufferSource");
   var cert = x509.parse(certDer);
-  var akiExt = (cert.extensions || []).filter(function (e) { return e.oid === OID_AKI; })[0];
+  var akiExt = guard.list.firstMatch(cert.extensions || [], function (e) { return e.oid === OID_AKI; });
   if (!akiExt) throw E("acme/bad-certid", "the certificate has no authorityKeyIdentifier extension (RFC 9773 sec. 4.1)");
   var aki = _extDecoders.byOid[OID_AKI](akiExt.value);
   if (!aki || !Buffer.isBuffer(aki.keyIdentifier)) throw E("acme/bad-certid", "the authorityKeyIdentifier has no keyIdentifier field (RFC 9773 sec. 4.1)");
@@ -1707,61 +1717,71 @@ function _hasCtlOctet(s) {
 }
 
 function _splitLinkValues(s) {
+  /** @internal The header is cut through the captured operations, the same as the parameters below:
+   *  each piece becomes a link whose relation decides whether this client follows it. */
   var out = [], start = 0, inAngle = false, inQuote = false;
   for (var i = 0; i < s.length; i++) {
-    var ch = s.charAt(i);
+    var ch = _charAtA(s, i);
     if (inQuote) { if (ch === "\\") { i++; continue; } if (ch === "\"") inQuote = false; continue; }
     if (ch === "\"") { inQuote = true; continue; }
     if (ch === "<") inAngle = true;
     else if (ch === ">") inAngle = false;
-    else if (ch === "," && !inAngle) { out.push(s.slice(start, i)); start = i + 1; }
+    else if (ch === "," && !inAngle) { intrinsic.append(out, _strSlice(s, start, i)); start = i + 1; }
   }
   if (inQuote || inAngle) throw E("acme/bad-link", "the Link header has an unterminated quote or angle bracket (RFC 8288)");
-  out.push(s.slice(start));
+  intrinsic.append(out, _strSlice(s, start));
   return out;
 }
 function _splitLinkParams(rest) {
   var parts = [], start = 0, inQuote = false;
   for (var i = 0; i < rest.length; i++) {
-    var ch = rest.charAt(i);
+    var ch = _charAtA(rest, i);
     if (inQuote) { if (ch === "\\") { i++; continue; } if (ch === "\"") inQuote = false; continue; }
     if (ch === "\"") inQuote = true;
-    else if (ch === ";") { parts.push(rest.slice(start, i)); start = i + 1; }
+    else if (ch === ";") { intrinsic.append(parts, _strSlice(rest, start, i)); start = i + 1; }
   }
-  parts.push(rest.slice(start));
+  intrinsic.append(parts, _strSlice(rest, start));
   var out = [];
   for (var j = 0; j < parts.length; j++) {
     var p = _trimOWS(parts[j]);
     if (p === "") { if (j === 0) continue; throw E("acme/bad-link", "an empty Link parameter (a ';' with no parameter) is malformed (RFC 8288): " + JSON.stringify(rest)); }
-    var eq = p.indexOf("=");
-    var name = (eq === -1 ? p : _trimOWS(p.slice(0, eq))).toLowerCase();
+    /** @internal The parameter name and value are cut and folded through the captured operations.
+     *  A Link parameter is what names the relation this client follows, and read off the prototype a
+     *  replacement chose it: measured, a header stating `rel=next` parsed as `alternate`. */
+    var eq = intrinsic.stringIndexOf(p, "=");
+    var name = _lower(eq === -1 ? p : _trimOWS(_strSlice(p, 0, eq)));
     if (!pkix.allCharsIn(name, _LINK_TOKEN_TABLE)) throw E("acme/bad-link", "a Link parameter name must be a token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
-    if (eq === -1) { out.push({ name: name, value: "", hasValue: false }); continue; }
-    var v = _trimOWS(p.slice(eq + 1));
-    if (v.length >= 2 && v.charAt(0) === "\"" && v.charAt(v.length - 1) === "\"") {
-      var inner = v.slice(1, -1);
+    if (eq === -1) { intrinsic.append(out, { name: name, value: "", hasValue: false }); continue; }
+    var v = _trimOWS(_strSlice(p, eq + 1));
+    if (v.length >= 2 && _charAtA(v, 0) === "\"" && _charAtA(v, v.length - 1) === "\"") {
+      var inner = _strSlice(v, 1, -1);
       if (!_isValidQuotedInterior(inner)) throw E("acme/bad-link", "a quoted Link parameter value is malformed (an unescaped quote or dangling backslash, RFC 7230): " + JSON.stringify(p));
       v = _unescapeQuotedPair(inner);
     } else if (!pkix.allCharsIn(v, _LINK_TOKEN_TABLE)) {
       throw E("acme/bad-link", "an unquoted Link parameter value must be a non-empty token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
     }
-    out.push({ name: name, value: v, hasValue: true });
+    intrinsic.append(out, { name: name, value: v, hasValue: true });
   }
   return out;
 }
 function _relHas(rel, relName) {
-  var toks = String(rel).split(" ");
-  for (var i = 0; i < toks.length; i++) { if (toks[i].toLowerCase() === relName) return true; }
+  /** @internal The relation names are scanned on the delimiter CHARACTER, which hard rule 11 requires
+   *  in lib/, and each token is folded through the captured conversion: the match decides whether a
+   *  Link header names the resource this client then follows. */
+  var toks = intrinsic.splitChar(_StringI(rel), 32);
+  for (var i = 0; i < toks.length; i++) { if (_lower(toks[i]) === relName) return true; }
   return false;
 }
 function _parseLinkValue(raw) {
   var s = _trimOWS(raw);
   if (s === "") return null;
-  var gt = s.indexOf(">");
-  if (s.charAt(0) !== "<" || gt === -1) throw E("acme/bad-link", "a Link value must be <URI-Reference> with parameters (RFC 8288): " + JSON.stringify(raw));
+  var gt = intrinsic.stringIndexOf(s, ">");
+  if (_charAtA(s, 0) !== "<" || gt === -1) throw E("acme/bad-link", "a Link value must be <URI-Reference> with parameters (RFC 8288): " + JSON.stringify(raw));
   var rest = _stripLeadingOWS(s, gt + 1);
-  if (rest !== "" && rest.charAt(0) !== ";") throw E("acme/bad-link", "a Link value's parameters must be introduced by ';' (RFC 8288): " + JSON.stringify(raw));
-  var uri = s.slice(1, gt);
+  if (rest !== "" && _charAtA(rest, 0) !== ";") throw E("acme/bad-link", "a Link value's parameters must be introduced by ';' (RFC 8288): " + JSON.stringify(raw));
+  /** @internal The target this client may follow is cut through the captured operation: read off the
+   *  prototype, a replacement decided the URL a Link header resolves to. */
+  var uri = _strSlice(s, 1, gt);
   if (_linkUriInvalid(uri)) throw E("acme/bad-link", "a Link URI-Reference contains a character, percent-escape, or encoded dot-segment not permitted by RFC 3986: " + JSON.stringify(raw));
   var params = _splitLinkParams(rest), rel = "", relSeen = false, anchor = null, anchorSeen = false;
   for (var i = 0; i < params.length; i++) {
@@ -1780,14 +1800,16 @@ function _parseLinkRelation(headers, base, relName, opts) {
   var raw = null;
   var hNames = guard.identifier.optionNames(headers);
   for (var hi = 0; hi < hNames.length; hi++) {
-    if (hNames[hi].toLowerCase() === "link") { raw = headers[hNames[hi]]; break; }
+    if (_lower(hNames[hi]) === "link") { raw = headers[hNames[hi]]; break; }
   }
   if (raw == null) return [];
   var baseUrl = new _URL(base), baseOrigin = _urlOrigin(baseUrl), baseHref = _urlHref(baseUrl);
   var baseKey = _dedupKey(baseHref);
-  var fields = Array.isArray(raw) ? raw : [raw], out = [], seen = Object.create(null), distinctCount = 0, totalBytes = 0;
+  var fields = intrinsic.isArray(raw) ? raw : [raw], out = [], seen = intrinsic.create(null), distinctCount = 0, totalBytes = 0;
   for (var fi = 0; fi < fields.length; fi++) {
-    var field = String(fields[fi]);
+    /** @internal The header field is converted through the capture: read through the live global, a
+     *  replacement supplied the whole Link header and with it the target this client resolves. */
+    var field = _StringI(fields[fi]);
     totalBytes += field.length + 1;
     if (totalBytes > LINK_HEADER_MAX_BYTES) throw E("acme/bad-link", "the Link header(s) exceed the " + LINK_HEADER_MAX_BYTES + "-byte aggregate cap (RFC 8288, CWE-770)");
     if (_hasCtlOctet(field)) throw E("acme/bad-link", "a Link header must not contain control octets (RFC 9110 field-value)");
@@ -1821,7 +1843,7 @@ function _parseLinkRelation(headers, base, relName, opts) {
       if (seen[key]) continue;
       seen[key] = true;
       distinctCount += 1;
-      if (key !== baseKey) out.push(resolved);
+      if (key !== baseKey) _push(out,resolved);
     }
   }
   if (opts.singleton && distinctCount > 1) throw E("acme/bad-link", "the Link header names more than one distinct rel=\"" + relName + "\" target (RFC 8288 sec. 3.3, a singleton relation)");
@@ -1919,7 +1941,7 @@ function _resignKeysOf(raw) {
     if (!_isObject(e)) throw E("acme/bad-input", "each resignKeys entry must be { alg: string, key: CryptoKey } (RFC 8555 sec. 6.2); entry " + i + " is not");
     var a = e.alg, k = e.key;
     if (!_isString(a) || !wcEngine.isCryptoKeyLike(k)) throw E("acme/bad-input", "each resignKeys entry must be { alg: string, key: CryptoKey } (RFC 8555 sec. 6.2); entry " + i + " is not");
-    out[i] = intrinsic.freeze({ alg: a, key: k });
+    _push(out, intrinsic.freeze({ alg: a, key: k }));
   }
   return intrinsic.freeze(out);
 }
@@ -2202,7 +2224,8 @@ function client(directoryUrl, opts) {
   function _pollAuthorization(url, budget) { return _poll("authorization", url, budget); }
 
   function _readCertChain(res) {
-    var ctToken = String(res.headers["content-type"] || "").split(";")[0].trim().toLowerCase();
+    var ctParts = intrinsic.splitChar(_StringI(res.headers["content-type"] || ""), 59);
+    var ctToken = _lower(_acmeTrim(ctParts.length ? ctParts[0] : ""));
     if (ctToken !== "application/pem-certificate-chain") throw E("acme/bad-certificate-chain", "the certificate download returned an unexpected media type " + JSON.stringify(ctToken) + " (expected application/pem-certificate-chain, RFC 8555 sec. 7.4.2)");
     var chain = _splitPemChain(_bodyText(res));
     return { certificate: chain[0], chain: chain.slice(1), certificates: chain };

package/lib/alt-sig.js

@@ -73,7 +73,9 @@ var _forEach = intrinsic.forEach;
 var _map = intrinsic.map;
 var _bufferFrom = intrinsic.bufferFrom;
 var _bufferConcat = intrinsic.bufferConcat;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 
 function _err(code, message, cause) { return new AltSigError(code, message, cause); }
 

package/lib/asn1-der.js

@@ -41,7 +41,6 @@ var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _isArray = intrinsic.isArray;
-var _unshift = intrinsic.unshift;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 /** @internal A Date's fields are read through the prototype's own getters, captured at load, so
  * a getter the instance carries or one replaced later cannot change what a time encodes to or
@@ -329,7 +328,12 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
         if (cp + 2 > limit) throw new Asn1Error("asn1/truncated", "indefinite-length value is missing its end-of-contents octets");
         if (buf[cp] === 0x00 && buf[cp + 1] === 0x00) break;
         child = _decodeTLV(buf, cp, limit, depth + 1, maxDepth, ber, strDepth, ctr);
-        children.push(child.node);
+        /** @internal The decoded child is APPENDED by defining its index. Stored with `push`, the
+         *  store walks the prototype chain for a setter, so an accessor at an array index received
+         *  each child as it was decoded and could define another node in its place: measured, a
+         *  SEQUENCE of two INTEGERs decoded with its first value changed from 1 to 9. Every format
+         *  module in this toolkit reads its fields out of this list. */
+        intrinsic.append(children, child.node);
         cp = child.end;
       }
       contentEnd = cp;
@@ -337,7 +341,7 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
     } else {
       while (cp < contentEnd) {
         child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth, ber, strDepth, ctr);
-        children.push(child.node);
+        intrinsic.append(children, child.node);
         cp = child.end;
       }
       end = contentEnd;
@@ -366,9 +370,9 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
       if (children[s].tagClass !== "universal" || children[s].tagNumber !== TAGS.OCTET_STRING) {
         throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
       }
-      segments.push(children[s].content);
+      intrinsic.append(segments, children[s].content);
     }
-    node.content = Buffer.concat(segments);
+    node.content = intrinsic.bufferConcat(segments);
     node.constructed = false;
     node.children = null;
   }
@@ -481,9 +485,9 @@ function readOctetStringImplicit(node, tag) {
       if (seg.tagClass !== "universal" || seg.tagNumber !== TAGS.OCTET_STRING || seg.constructed || !seg.content) {
         throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
       }
-      segments.push(seg.content);
+      intrinsic.append(segments, seg.content);
     }
-    return Buffer.concat(segments);
+    return intrinsic.bufferConcat(segments);
   }
   _expectPrimitive(node, "readOctetStringImplicit");
   return node.content;
@@ -566,8 +570,16 @@ function decodeOidContent(buf) {
           "OBJECT IDENTIFIER carries more than " + constants.LIMITS.OID_MAX_SUBIDENTIFIERS + " sub-identifiers");
       }
       var value = 0n;
-      for (var k = arcStart; k <= i; k++) value = value * 128n + BigInt(buf[k] & 0x7f);
-      arcs.push(value);
+      /** @internal The arc is accumulated through the captured conversion. Read off the global, a
+       *  replacement decides the sub-identifier, and therefore the dotted string every algorithm and
+       *  extension decision in this toolkit is made on: measured, the same two bytes rendered as
+       *  `1.2.3` and as `1.2.4`. */
+      for (var k = arcStart; k <= i; k++) value = value * 128n + intrinsic.BigInt(buf[k] & 0x7f);
+      /** @internal `append`, not a captured `push`: appending with `push` STORES at the index, and a
+       *  store walks the prototype chain for a setter, so an accessor installed at
+       *  `Array.prototype[0]` took the arc and answered with another. `append` defines the index on
+       *  the array itself. */
+      intrinsic.append(arcs, value);
       arcStart = i + 1;
     }
   }
@@ -577,9 +589,12 @@ function decodeOidContent(buf) {
   if (first < 40n) { a1 = 0n; a2 = first; }
   else if (first < 80n) { a1 = 1n; a2 = first - 40n; }
   else { a1 = 2n; a2 = first - 80n; }
-  var out = [a1.toString(), a2.toString()];
-  for (var j = 1; j < arcs.length; j++) out.push(arcs[j].toString());
-  return out.join(".");
+  /** @internal Each arc is rendered through the captured conversion. Read off the prototype, the
+   *  value that becomes the dotted identifier is whatever a replacement returns, and the identifier
+   *  is what every algorithm and extension decision in this toolkit is made on. */
+  var out = [intrinsic.bigIntToString(a1, 10), intrinsic.bigIntToString(a2, 10)];
+  for (var j = 1; j < arcs.length; j++) intrinsic.append(out, intrinsic.bigIntToString(arcs[j], 10));
+  return intrinsic.join(out, ".");
 }
 
 function _decodeText(buf, encoding) {
@@ -755,12 +770,22 @@ function encodeLength(n) {
   if (typeof n !== "number" || !isFinite(n) || n < 0 || Math.floor(n) !== n) {
     throw new Asn1Error("asn1/bad-length", "length must be a non-negative integer");
   }
-  if (n < 0x80) return Buffer.from([n]);
-  var bytes = [];
+  if (n < 0x80) return intrinsic.bufferFrom([n]);
+  /** @internal The octets are counted and then written into the output from its end, rather than
+   *  prepended into an array. A prepend STORES at an index, and a store walks the prototype chain
+   *  for a setter, so an accessor at an array index took each octet as it was produced and left the
+   *  list reading back whatever its getter answers. These are the length octets of every DER element
+   *  longer than 127 bytes: measured, a SEQUENCE wrapping a 300-byte OCTET STRING emitted as `3000`,
+   *  an empty SEQUENCE. A typed array handles its own integer-indexed writes and consults no
+   *  prototype accessor, which is why the output is filled directly. */
+  var count = 0;
+  for (var probe = n; probe > 0; probe = intrinsic.floor(probe / 256)) count++;
+  if (count > 126) throw new Asn1Error("asn1/length-too-large", "length needs more than 126 octets");
+  var out = intrinsic.bufferAlloc(count + 1);
+  out[0] = 0x80 | count;
   var v = n;
-  while (v > 0) { _unshift(bytes, v & 0xff); v = Math.floor(v / 256); }
-  if (bytes.length > 126) throw new Asn1Error("asn1/length-too-large", "length needs more than 126 octets");
-  return Buffer.concat([Buffer.from([0x80 | bytes.length]), Buffer.from(bytes)]);
+  for (var i = count; i >= 1; i--) { out[i] = v & 0xff; v = intrinsic.floor(v / 256); }
+  return out;
 }
 
 /** @internal The identifier comes from the one function that composes one. Writing the octet here
@@ -831,12 +856,24 @@ function encodeIdentifier(classBits, constructed, tagNumber) {
       ") and is not assigned to any type, so no encoding of it is a DER element");
   }
   var lead = cls | (constructed ? CONSTRUCTED_BIT : 0);
-  if (tagNumber < 0x1f) return Buffer.from([lead | tagNumber]);
-  var body = [];
+  if (tagNumber < 0x1f) return intrinsic.bufferFrom([lead | tagNumber]);
+  /** @internal Counted, then written into the output from its end, for the reason `encodeLength` is:
+   *  a prepend stores at an index and a store consults a setter inherited there. These are the
+   *  identifier octets of a high-tag-number element, so they name the type every reader dispatches
+   *  on: measured, tag 31 emitted as `1f00`. Every octet but the last carries the continuation bit. */
+  var count = 0;
+  for (var probe = tagNumber; ; probe = intrinsic.floor(probe / 128)) {
+    count++;
+    if (probe < 128) break;
+  }
+  var out = intrinsic.bufferAlloc(count + 1);
+  out[0] = lead | 0x1f;
   var v = tagNumber;
-  do { _unshift(body, v & 0x7f); v = Math.floor(v / 128); } while (v > 0);
-  for (var i = 0; i < body.length - 1; i++) body[i] |= 0x80;
-  return Buffer.concat([Buffer.from([lead | 0x1f]), Buffer.from(body)]);
+  for (var i = count; i >= 1; i--) {
+    out[i] = (v & 0x7f) | (i === count ? 0x00 : 0x80);
+    v = intrinsic.floor(v / 128);
+  }
+  return out;
 }
 
 /**
@@ -933,19 +970,29 @@ function intToDer(v) {
     v = BigInt(v);
   }
   if (typeof v !== "bigint") throw new Asn1Error("asn1/bad-integer", "integer must be number or BigInt");
-  if (v === 0n) return Buffer.from([0]);
-  var bytes = [];
+  if (v === 0n) return intrinsic.bufferFrom([0]);
+  /** @internal The content octets are written into the output directly, in both signs. The positive
+   *  branch prepended into an array and then read `bytes[0]` to decide whether the value needed a
+   *  leading zero to read as positive, and the negative branch stored at each index; both are stores,
+   *  so an accessor inherited at an array index took the octets and answered the decision. Measured:
+   *  128 encoded as the INTEGER 0, a nine-digit value as all zeroes, and -300 as +212. A typed array
+   *  consults no prototype accessor for an integer-indexed write, and `bufferAlloc` zero-fills, so
+   *  the leading zero is the allocation rather than a second prepend. */
   if (v > 0n) {
-    var t = v;
-    while (t > 0n) { _unshift(bytes, Number(t & 0xffn)); t >>= 8n; }
-    if (bytes[0] & 0x80) _unshift(bytes, 0x00);
-  } else {
-    var len = 1;
-    while (v < -(1n << BigInt(8 * len - 1))) len += 1;
-    var tc = (1n << BigInt(8 * len)) + v;
-    for (var i = len - 1; i >= 0; i--) { bytes[i] = Number(tc & 0xffn); tc >>= 8n; }
+    var n = 0;
+    for (var t = v; t > 0n; t >>= 8n) n++;
+    var pad = ((v >> intrinsic.BigInt(8 * (n - 1))) & 0xffn) >= 0x80n ? 1 : 0;
+    var outP = intrinsic.bufferAlloc(n + pad);
+    var tp = v;
+    for (var i = n + pad - 1; i >= pad; i--) { outP[i] = intrinsic.Number(tp & 0xffn); tp >>= 8n; }
+    return outP;
   }
-  return Buffer.from(bytes);
+  var len = 1;
+  while (v < -(1n << intrinsic.BigInt(8 * len - 1))) len += 1;
+  var tc = (1n << intrinsic.BigInt(8 * len)) + v;
+  var outN = intrinsic.bufferAlloc(len);
+  for (var j = len - 1; j >= 0; j--) { outN[j] = intrinsic.Number(tc & 0xffn); tc >>= 8n; }
+  return outN;
 }
 
 function encodeOidContent(dotted) {
@@ -958,15 +1005,22 @@ function encodeOidContent(dotted) {
   var subids = intrinsic.concat([a1 * 40n + a2], arcs.slice(2));
   var out = [];
   for (var s = 0; s < subids.length; s++) {
-    var body = [];
     var v = subids[s];
-    do { _unshift(body, Number(v & 0x7fn)); v >>= 7n; } while (v > 0n);
-    if (body.length > constants.LIMITS.OID_MAX_SUBIDENTIFIER_BYTES) {
+    /** @internal Each sub-identifier's octets are counted and then appended most-significant first,
+     *  rather than prepended into a list and patched in place. A prepend stores at an index, and the
+     *  continuation bit was then set by a read-modify-write that read back through the hole a store
+     *  leaves under an inherited setter. This is the OID an algorithm or a signature is named by:
+     *  measured, sha256WithRSAEncryption emitted as `0609000000008000000000`, a different OID. */
+    var count = 1;
+    for (var probe = v >> 7n; probe > 0n; probe >>= 7n) count++;
+    if (count > constants.LIMITS.OID_MAX_SUBIDENTIFIER_BYTES) {
       throw new OidError("oid/subidentifier-too-large",
         "OID sub-identifier exceeds " + constants.LIMITS.OID_MAX_SUBIDENTIFIER_BYTES + " octets");
     }
-    for (var k = 0; k < body.length - 1; k++) body[k] |= 0x80;
-    for (var j = 0; j < body.length; j++) out.push(body[j]);
+    for (var k = count - 1; k >= 0; k--) {
+      var octet = intrinsic.Number((v >> intrinsic.BigInt(7 * k)) & 0x7fn);
+      intrinsic.append(out, k === 0 ? octet : octet | 0x80);
+    }
   }
   return Buffer.from(out);
 }
@@ -1160,7 +1214,12 @@ function _intContent(v, who) {
 function _asBufferArray(arr, who) {
   if (!_isArray(arr)) throw new Asn1Error("asn1/bad-children", who + ": expected an array of TLV buffers");
   var n = arr.length, out = [];
-  for (var i = 0; i < n; i++) out[i] = _asBuffer(arr[i], who);
+  /** @internal Each checked child is APPENDED by defining its index. Assigning at the index is a
+   *  store, and a store walks the prototype chain for a setter, so an accessor inherited at an array
+   *  index took the child and left the list reading back its getter's value instead. This list is
+   *  every constructed element's children: measured, a SEQUENCE wrapping a 300-byte OCTET STRING
+   *  emitted as `3000`, an empty SEQUENCE, with the checked child discarded. */
+  for (var i = 0; i < n; i++) intrinsic.append(out, _asBuffer(arr[i], who));
   return out;
 }