@yozz.app/tls 0.1.0

package/dist/index.mjs

@@ -0,0 +1,3872 @@
+import { asciiLower, decodeCertificate, decodeDer, decodeInteger } from "@yozz.app/x509";
+//#region src/wire.ts
+const CONTENT_TYPES = {
+	change_cipher_spec: 20,
+	alert: 21,
+	handshake: 22,
+	application_data: 23
+};
+const HANDSHAKE_TYPES = {
+	client_hello: 1,
+	server_hello: 2,
+	new_session_ticket: 4,
+	end_of_early_data: 5,
+	encrypted_extensions: 8,
+	certificate: 11,
+	certificate_request: 13,
+	certificate_verify: 15,
+	finished: 20,
+	key_update: 24,
+	message_hash: 254
+};
+const NAMED_GROUPS = {
+	secp256r1: 23,
+	secp384r1: 24,
+	x25519: 29
+};
+/**
+* Every group this client implements, in the order it offers them — so the
+* first one carries the key share, and a server that accepts our first choice
+* negotiates without a HelloRetryRequest.
+*
+* P-384 is not optional here: `posteo.de` refuses X25519 and P-256 outright.
+*
+* It doubles as the default for `supportedGroups`, and `wire.test.ts` holds it
+* to covering every key of `NAMED_GROUPS` — `namedGroupFromCode` searches this
+* list, so a group implemented but missing from it would decode as unknown.
+*/
+const SUPPORTED_GROUPS = [
+	"x25519",
+	"secp256r1",
+	"secp384r1"
+];
+/** The wire code back to the name, `undefined` for a group we do not implement. */
+const namedGroupFromCode = (code) => SUPPORTED_GROUPS.find((name) => NAMED_GROUPS[name] === code);
+const SIGNATURE_SCHEMES = {
+	ecdsa_secp256r1_sha256: 1027,
+	ecdsa_secp384r1_sha384: 1283,
+	rsa_pss_rsae_sha256: 2052,
+	rsa_pss_rsae_sha384: 2053,
+	rsa_pss_rsae_sha512: 2054,
+	ed25519: 2055
+};
+/**
+* Every scheme this client can verify a CertificateVerify with, in the order it
+* offers them, and the default for `signatureSchemes`.
+*
+* The list is the security boundary, not just a preference: RFC 9846 §4.5.2
+* says a server's "signature algorithm MUST be one offered in the client's
+* `signature_algorithms` extension", and the handshake refuses one that is not.
+* So a scheme missing from here is a scheme the server may not sign with, and a
+* scheme present but unimplemented in `verify.ts` is a hole — `wire.test.ts`
+* holds this to covering every key of `SIGNATURE_SCHEMES`, the same way
+* `SUPPORTED_GROUPS` is held to `NAMED_GROUPS`.
+*
+* Ed25519 is offered where BoringSSL disables it by default. It is a smaller,
+* misuse-resistant signature over a curve we already carry for key exchange,
+* and refusing it would only push a server onto RSA.
+*/
+const SUPPORTED_SIGNATURE_SCHEMES = [
+	"ecdsa_secp256r1_sha256",
+	"ecdsa_secp384r1_sha384",
+	"rsa_pss_rsae_sha256",
+	"rsa_pss_rsae_sha384",
+	"rsa_pss_rsae_sha512",
+	"ed25519"
+];
+/** The wire code back to the name, `undefined` for a scheme we do not implement. */
+const signatureSchemeFromCode = (code) => SUPPORTED_SIGNATURE_SCHEMES.find((name) => SIGNATURE_SCHEMES[name] === code);
+const CERTIFICATE_SIGNATURE_SCHEMES = {
+	ecdsa_secp256r1_sha256: {
+		code: 1027,
+		algorithmOid: "1.2.840.10045.4.3.2",
+		curveOid: "1.2.840.10045.3.1.7"
+	},
+	ecdsa_secp384r1_sha384: {
+		code: 1283,
+		algorithmOid: "1.2.840.10045.4.3.3",
+		curveOid: "1.3.132.0.34"
+	},
+	/**
+	* P-521 as a CERTIFICATE signature, which is not the P-521 that DECISIONS puts
+	* out of v1. That one is the ECDHE group and the CertificateVerify scheme —
+	* things a peer negotiates with us. This is a curve an intermediate we did not
+	* choose may already have been signed with, and `@yozz.app/x509` verifies it, so
+	* withholding it would understate the validator for no gain.
+	*/
+	ecdsa_secp521r1_sha512: {
+		code: 1539,
+		algorithmOid: "1.2.840.10045.4.3.4",
+		curveOid: "1.3.132.0.35"
+	},
+	rsa_pkcs1_sha256: {
+		code: 1025,
+		algorithmOid: "1.2.840.113549.1.1.11",
+		curveOid: null
+	},
+	rsa_pkcs1_sha384: {
+		code: 1281,
+		algorithmOid: "1.2.840.113549.1.1.12",
+		curveOid: null
+	},
+	rsa_pkcs1_sha512: {
+		code: 1537,
+		algorithmOid: "1.2.840.113549.1.1.13",
+		curveOid: null
+	}
+};
+/**
+* What goes on the wire, in preference order. ECDSA first because those chains
+* are smaller and this client pays for every byte of a mail server's flight;
+* RSA-PKCS1 after, because that is what most of the WebPKI is actually signed
+* with and a server MUST be able to find it here.
+*/
+const OFFERED_CERTIFICATE_SIGNATURE_SCHEMES = [
+	"ecdsa_secp256r1_sha256",
+	"ecdsa_secp384r1_sha384",
+	"ecdsa_secp521r1_sha512",
+	"rsa_pkcs1_sha256",
+	"rsa_pkcs1_sha384",
+	"rsa_pkcs1_sha512"
+];
+const EXTENSION_TYPES = {
+	server_name: 0,
+	supported_groups: 10,
+	signature_algorithms: 13,
+	signature_algorithms_cert: 50,
+	/** RFC 7685. Sent, never read: a server has no reason to echo it. */
+	padding: 21,
+	pre_shared_key: 41,
+	early_data: 42,
+	supported_versions: 43,
+	cookie: 44,
+	psk_key_exchange_modes: 45,
+	key_share: 51
+};
+/**
+* RFC 9846 §4.3.9. This client offers `psk_dhe_ke` alone: `psk_ke` resumes with
+* no fresh key exchange, so one stolen ticket decrypts every session that ever
+* used it. Forward secrecy is the reason to run our own TLS in the first place.
+*/
+const PSK_KEY_EXCHANGE_MODES = {
+	psk_ke: 0,
+	psk_dhe_ke: 1
+};
+const ALERT_DESCRIPTIONS = {
+	close_notify: 0,
+	unexpected_message: 10,
+	bad_record_mac: 20,
+	record_overflow: 22,
+	handshake_failure: 40,
+	bad_certificate: 42,
+	unsupported_certificate: 43,
+	certificate_revoked: 44,
+	certificate_expired: 45,
+	certificate_unknown: 46,
+	illegal_parameter: 47,
+	unknown_ca: 48,
+	access_denied: 49,
+	decode_error: 50,
+	decrypt_error: 51,
+	protocol_version: 70,
+	insufficient_security: 71,
+	internal_error: 80,
+	inappropriate_fallback: 86,
+	user_canceled: 90,
+	missing_extension: 109,
+	unsupported_extension: 110,
+	unrecognized_name: 112,
+	bad_certificate_status_response: 113,
+	unknown_psk_identity: 115,
+	certificate_required: 116,
+	general_error: 117,
+	no_application_protocol: 120
+};
+const LEGACY_RECORD_VERSION = {
+	FIRST_CLIENT_HELLO: 769,
+	STANDARD: 771
+};
+const TLS_VERSION = {
+	V1_0: 769,
+	V1_2: 771,
+	V1_3: 772
+};
+/**
+* RFC 9846 §4.2.3: SHA-256("HelloRetryRequest")
+*/
+const HRR_MAGIC_RANDOM = Uint8Array.of(207, 33, 173, 116, 229, 154, 97, 17, 190, 29, 140, 2, 30, 101, 184, 145, 194, 162, 17, 22, 122, 187, 140, 94, 7, 158, 9, 226, 200, 168, 51, 156);
+/**
+* RFC 9846 §4.2.3: Downgrade sentinels in the last 8 octets of ServerHello.random.
+*/
+const DOWNGRADE_SENTINEL_TLS_1_2 = Uint8Array.of(68, 79, 87, 78, 71, 82, 68, 1);
+const DOWNGRADE_SENTINEL_TLS_1_1 = Uint8Array.of(68, 79, 87, 78, 71, 82, 68, 0);
+//#endregion
+//#region src/alert.ts
+const CODE_TO_DESCRIPTION = new Map(Object.entries(ALERT_DESCRIPTIONS).map(([desc, code]) => [code, desc]));
+const encodeAlert = (alert) => {
+	const levelCode = alert.level === "warning" ? 1 : 2;
+	const descCode = ALERT_DESCRIPTIONS[alert.description];
+	if (descCode === void 0) throw new Error(`Unknown alert description: ${alert.description}`);
+	return Uint8Array.of(levelCode, descCode);
+};
+const decodeAlert = (bytes) => {
+	if (bytes.length !== 2) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const levelCode = bytes[0];
+	const descCode = bytes[1];
+	if (levelCode === void 0 || descCode === void 0) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const level = levelCode === 1 ? "warning" : levelCode === 2 ? "fatal" : void 0;
+	if (level === void 0) return {
+		ok: false,
+		description: "illegal_parameter"
+	};
+	const description = CODE_TO_DESCRIPTION.get(descCode);
+	if (description === void 0) return {
+		ok: false,
+		description: "illegal_parameter",
+		unknownDescriptionCode: descCode
+	};
+	return {
+		ok: true,
+		alert: {
+			level,
+			description
+		}
+	};
+};
+const VALIDATION_FAILURE_ALERTS = {
+	"malformed-certificate": "bad_certificate",
+	"certificate-expired": "certificate_expired",
+	"certificate-not-yet-valid": "certificate_expired",
+	"unsupported-signature-algorithm": "unsupported_certificate",
+	"unknown-critical-extension": "unsupported_certificate",
+	"basic-constraints-violation": "bad_certificate",
+	"key-usage-violation": "bad_certificate",
+	"extended-key-usage-violation": "bad_certificate",
+	"name-constraints-violation": "bad_certificate",
+	"invalid-signature": "bad_certificate",
+	"name-mismatch": "certificate_unknown",
+	"no-path-to-trust-anchor": "unknown_ca",
+	"maximum-chain-depth-exceeded": "unknown_ca",
+	/**
+	* §6.2's `unknown_ca` is "the certificate was not accepted because the CA
+	* certificate could not be located or could not be matched with a known
+	* trust anchor" — and a root distrusted for leaves this new is exactly a CA
+	* that cannot be matched, for this chain, however well we know it. The
+	* distinction the RFC has no alert for is kept where it is useful: in the
+	* failure code the caller reads, not on the wire.
+	*/
+	"certificate-authority-distrusted": "unknown_ca",
+	/**
+	* RFC 9846 §6.2: "certificate_unknown: Some other (unspecified) issue arose
+	* in processing the certificate, rendering it unacceptable." A validator
+	* refusing on its own policy is exactly the unspecified issue — the chain
+	* itself was fine, so none of the specific certificate alerts is true.
+	*/
+	"rejected-by-policy": "certificate_unknown"
+};
+const alertForValidationFailure = (failure) => ({
+	level: "fatal",
+	description: VALIDATION_FAILURE_ALERTS[failure.code]
+});
+//#endregion
+//#region src/bytes.ts
+/**
+* Byte-level encoding and decoding primitives for TLS records and messages.
+*/
+const concat$1 = (...parts) => {
+	const joined = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+	let offset = 0;
+	for (const part of parts) {
+		joined.set(part, offset);
+		offset += part.length;
+	}
+	return joined;
+};
+const readUint8 = (bytes, offset) => {
+	if (!Number.isInteger(offset) || offset < 0 || offset >= bytes.length) throw new Error(`readUint8 out of bounds: offset ${offset}, length ${bytes.length}`);
+	const val = bytes[offset];
+	if (val === void 0) throw new Error(`readUint8 byte at offset ${offset} is undefined`);
+	return val;
+};
+const readUint16 = (bytes, offset) => {
+	if (!Number.isInteger(offset) || offset < 0 || offset + 2 > bytes.length) throw new Error(`readUint16 out of bounds: offset ${offset}, length ${bytes.length}`);
+	const b0 = bytes[offset];
+	const b1 = bytes[offset + 1];
+	if (b0 === void 0 || b1 === void 0) throw new Error(`readUint16 bytes at offset ${offset} undefined`);
+	return b0 << 8 | b1;
+};
+const readUint24 = (bytes, offset) => {
+	if (!Number.isInteger(offset) || offset < 0 || offset + 3 > bytes.length) throw new Error(`readUint24 out of bounds: offset ${offset}, length ${bytes.length}`);
+	const b0 = bytes[offset];
+	const b1 = bytes[offset + 1];
+	const b2 = bytes[offset + 2];
+	if (b0 === void 0 || b1 === void 0 || b2 === void 0) throw new Error(`readUint24 bytes at offset ${offset} undefined`);
+	return b0 << 16 | b1 << 8 | b2;
+};
+const writeUint8 = (value) => {
+	if (!Number.isInteger(value) || value < 0 || value > 255) throw new Error(`writeUint8 invalid value: ${value}`);
+	return Uint8Array.of(value);
+};
+const writeUint16 = (value) => {
+	if (!Number.isInteger(value) || value < 0 || value > 65535) throw new Error(`writeUint16 invalid value: ${value}`);
+	return Uint8Array.of(value >> 8 & 255, value & 255);
+};
+const writeUint24 = (value) => {
+	if (!Number.isInteger(value) || value < 0 || value > 16777215) throw new Error(`writeUint24 invalid value: ${value}`);
+	return Uint8Array.of(value >> 16 & 255, value >> 8 & 255, value & 255);
+};
+//#endregion
+//#region src/handshake-messages.ts
+/**
+* TLS 1.3 Handshake Message Codec (RFC 9846 §4).
+*/
+const encodeExtensions = (extensions) => {
+	const parts = [];
+	let declaredTotalLen;
+	for (const ext of extensions) {
+		const extTypeCode = ext.kind === "unknown" ? ext.typeCode : EXTENSION_TYPES[ext.kind];
+		if (extTypeCode === void 0) throw new Error(`Unknown extension kind: ${ext.kind}`);
+		let body;
+		let declaredExtLen;
+		switch (ext.kind) {
+			case "server_name":
+				if (ext.serverNames.length === 0) body = /* @__PURE__ */ new Uint8Array(0);
+				else {
+					const listParts = [];
+					for (const name of ext.serverNames) {
+						const nameBytes = new TextEncoder().encode(name);
+						listParts.push(writeUint8(0), writeUint16(nameBytes.length), nameBytes);
+					}
+					const listBytes = concat$1(...listParts);
+					body = concat$1(writeUint16(listBytes.length), listBytes);
+				}
+				break;
+			case "supported_groups": {
+				const groupsBytes = concat$1(...ext.groups.map((g) => writeUint16(g)));
+				body = concat$1(writeUint16(groupsBytes.length), groupsBytes);
+				break;
+			}
+			case "padding":
+				body = new Uint8Array(ext.length);
+				break;
+			case "signature_algorithms":
+			case "signature_algorithms_cert": {
+				const schemesBytes = concat$1(...ext.schemes.map((s) => writeUint16(s)));
+				body = concat$1(writeUint16(schemesBytes.length), schemesBytes);
+				break;
+			}
+			case "supported_versions":
+				if (ext.isServerHello) body = writeUint16(ext.versions[0] ?? 772);
+				else {
+					const versionsBytes = concat$1(...ext.versions.map((v) => writeUint16(v)));
+					body = concat$1(writeUint8(versionsBytes.length), versionsBytes);
+				}
+				break;
+			case "key_share":
+				if (ext.clientShares !== void 0) {
+					const sharesParts = [];
+					for (const share of ext.clientShares) sharesParts.push(writeUint16(share.group), writeUint16(share.keyExchange.length), share.keyExchange);
+					const sharesBytes = concat$1(...sharesParts);
+					body = concat$1(writeUint16(sharesBytes.length), sharesBytes);
+				} else if (ext.serverShare !== void 0) body = concat$1(writeUint16(ext.serverShare.group), writeUint16(ext.serverShare.keyExchange.length), ext.serverShare.keyExchange);
+				else if (ext.selectedGroup !== void 0) body = writeUint16(ext.selectedGroup);
+				else body = /* @__PURE__ */ new Uint8Array(0);
+				break;
+			case "cookie":
+				body = concat$1(writeUint16(ext.cookie.length), ext.cookie);
+				break;
+			case "pre_shared_key":
+				if (ext.selectedIdentity !== void 0) body = writeUint16(ext.selectedIdentity);
+				else if (ext.identities !== void 0) {
+					const idParts = [];
+					for (const id of ext.identities) {
+						const ageBytes = Uint8Array.of(id.obfuscatedTicketAge >>> 24 & 255, id.obfuscatedTicketAge >>> 16 & 255, id.obfuscatedTicketAge >>> 8 & 255, id.obfuscatedTicketAge & 255);
+						idParts.push(writeUint16(id.identity.length), id.identity, ageBytes);
+					}
+					const idBytes = concat$1(...idParts);
+					if (ext.truncatedPreBinder) {
+						declaredExtLen = idBytes.length + 2 + 35;
+						body = concat$1(writeUint16(idBytes.length), idBytes);
+					} else if (ext.binders !== void 0) {
+						const binderParts = [];
+						for (const binder of ext.binders) binderParts.push(writeUint8(binder.length), binder);
+						const binderBytes = concat$1(...binderParts);
+						body = concat$1(writeUint16(idBytes.length), idBytes, writeUint16(binderBytes.length), binderBytes);
+					} else body = concat$1(writeUint16(idBytes.length), idBytes);
+				} else body = /* @__PURE__ */ new Uint8Array(0);
+				break;
+			case "psk_key_exchange_modes":
+				body = concat$1(writeUint8(ext.modes.length), ...ext.modes.map((mode) => writeUint8(mode)));
+				break;
+			case "early_data":
+				if (ext.maxEarlyDataSize !== void 0) body = Uint8Array.of(ext.maxEarlyDataSize >>> 24 & 255, ext.maxEarlyDataSize >>> 16 & 255, ext.maxEarlyDataSize >>> 8 & 255, ext.maxEarlyDataSize & 255);
+				else body = /* @__PURE__ */ new Uint8Array(0);
+				break;
+			case "unknown":
+				body = ext.data;
+				break;
+		}
+		parts.push(writeUint16(extTypeCode), writeUint16(declaredExtLen ?? body.length), body);
+	}
+	const allExtensions = concat$1(...parts);
+	const actualLen = allExtensions.length;
+	if (extensions.some((e) => e.kind === "pre_shared_key" && e.truncatedPreBinder === true)) declaredTotalLen = actualLen + 35;
+	return concat$1(writeUint16(declaredTotalLen ?? actualLen), allExtensions);
+};
+const decodeExtensions = (bytes, context = "other", isHrr = false, allowPreBinderTruncation = false) => {
+	const isServerHello = context === "server_hello";
+	/** `key_share`, `supported_versions`, `cookie` and `pre_shared_key` live only in the hellos. */
+	const isHello = context !== "other";
+	if (bytes.length < 2) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const extTotalLength = readUint16(bytes, 0);
+	const exactOk = bytes.length === 2 + extTotalLength;
+	const truncatedOk = allowPreBinderTruncation && bytes.length === 2 + extTotalLength - 35;
+	if (!exactOk && !truncatedOk) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const seenTypes = /* @__PURE__ */ new Set();
+	const extensions = [];
+	let offset = 2;
+	while (offset < bytes.length) {
+		if (offset + 4 > bytes.length) return {
+			ok: false,
+			description: "decode_error"
+		};
+		const typeCode = readUint16(bytes, offset);
+		const dataLen = readUint16(bytes, offset + 2);
+		offset += 4;
+		if (seenTypes.has(typeCode)) return {
+			ok: false,
+			description: "illegal_parameter"
+		};
+		seenTypes.add(typeCode);
+		let extData;
+		if (offset + dataLen <= bytes.length) {
+			extData = bytes.subarray(offset, offset + dataLen);
+			offset += dataLen;
+		} else if (allowPreBinderTruncation && truncatedOk && typeCode === EXTENSION_TYPES.pre_shared_key) {
+			extData = bytes.subarray(offset);
+			offset = bytes.length;
+		} else return {
+			ok: false,
+			description: "decode_error"
+		};
+		if (typeCode === EXTENSION_TYPES.server_name) if (extData.length === 0) extensions.push({
+			kind: "server_name",
+			serverNames: []
+		});
+		else {
+			if (extData.length < 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const listLen = readUint16(extData, 0);
+			if (extData.length !== 2 + listLen) return {
+				ok: false,
+				description: "decode_error"
+			};
+			let nOffset = 2;
+			const serverNames = [];
+			while (nOffset < extData.length) {
+				if (nOffset + 3 > extData.length) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const nameType = readUint8(extData, nOffset);
+				const nameLen = readUint16(extData, nOffset + 1);
+				nOffset += 3;
+				if (nOffset + nameLen > extData.length) return {
+					ok: false,
+					description: "decode_error"
+				};
+				if (nameType === 0) {
+					const nameBytes = extData.subarray(nOffset, nOffset + nameLen);
+					serverNames.push(new TextDecoder().decode(nameBytes));
+				}
+				nOffset += nameLen;
+			}
+			extensions.push({
+				kind: "server_name",
+				serverNames
+			});
+		}
+		else if (typeCode === EXTENSION_TYPES.supported_groups) {
+			if (extData.length < 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const listLen = readUint16(extData, 0);
+			if (extData.length !== 2 + listLen || listLen % 2 !== 0) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const groups = [];
+			for (let i = 2; i < extData.length; i += 2) groups.push(readUint16(extData, i));
+			extensions.push({
+				kind: "supported_groups",
+				groups
+			});
+		} else if (typeCode === EXTENSION_TYPES.signature_algorithms) {
+			if (extData.length < 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const listLen = readUint16(extData, 0);
+			if (extData.length !== 2 + listLen || listLen % 2 !== 0) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const schemes = [];
+			for (let i = 2; i < extData.length; i += 2) schemes.push(readUint16(extData, i));
+			extensions.push({
+				kind: "signature_algorithms",
+				schemes
+			});
+		} else if (typeCode === EXTENSION_TYPES.signature_algorithms_cert) {
+			/**
+			* Same `SignatureSchemeList` body as its sibling above, decoded for one
+			* reason: **so a test can read back what the ClientHello actually sent.**
+			* Left as `unknown` it still travelled correctly — `offeredExtensionCodes`
+			* keys on `typeCode` — but the drift gate in `wire.test.ts` could not name
+			* it, and a review found that gate passing with the extension deleted
+			* outright. A wire format nothing can assert on is a wire format nothing
+			* holds.
+			*/
+			if (extData.length < 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const listLen = readUint16(extData, 0);
+			if (extData.length !== 2 + listLen || listLen % 2 !== 0) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const schemes = [];
+			for (let i = 2; i < extData.length; i += 2) schemes.push(readUint16(extData, i));
+			extensions.push({
+				kind: "signature_algorithms_cert",
+				schemes
+			});
+		} else if (typeCode === EXTENSION_TYPES.padding) extensions.push({
+			kind: "padding",
+			length: extData.length
+		});
+		else if (isHello && typeCode === EXTENSION_TYPES.supported_versions) if (isServerHello) {
+			if (extData.length !== 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			extensions.push({
+				kind: "supported_versions",
+				versions: [readUint16(extData, 0)],
+				isServerHello: true
+			});
+		} else {
+			if (extData.length < 1) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const listLen = readUint8(extData, 0);
+			if (extData.length !== 1 + listLen || listLen % 2 !== 0) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const versions = [];
+			for (let i = 1; i < extData.length; i += 2) versions.push(readUint16(extData, i));
+			extensions.push({
+				kind: "supported_versions",
+				versions,
+				isServerHello: false
+			});
+		}
+		else if (isHello && typeCode === EXTENSION_TYPES.key_share) if (isHrr) {
+			if (extData.length !== 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			extensions.push({
+				kind: "key_share",
+				selectedGroup: readUint16(extData, 0)
+			});
+		} else if (isServerHello) {
+			if (extData.length < 4) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const group = readUint16(extData, 0);
+			const kLen = readUint16(extData, 2);
+			if (extData.length !== 4 + kLen) return {
+				ok: false,
+				description: "decode_error"
+			};
+			extensions.push({
+				kind: "key_share",
+				serverShare: {
+					group,
+					keyExchange: extData.subarray(4, 4 + kLen)
+				}
+			});
+		} else {
+			if (extData.length < 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const listLen = readUint16(extData, 0);
+			if (extData.length !== 2 + listLen) return {
+				ok: false,
+				description: "decode_error"
+			};
+			let sOffset = 2;
+			const clientShares = [];
+			while (sOffset < extData.length) {
+				if (sOffset + 4 > extData.length) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const group = readUint16(extData, sOffset);
+				const kLen = readUint16(extData, sOffset + 2);
+				sOffset += 4;
+				if (sOffset + kLen > extData.length) return {
+					ok: false,
+					description: "decode_error"
+				};
+				clientShares.push({
+					group,
+					keyExchange: extData.subarray(sOffset, sOffset + kLen)
+				});
+				sOffset += kLen;
+			}
+			extensions.push({
+				kind: "key_share",
+				clientShares
+			});
+		}
+		else if (isHello && typeCode === EXTENSION_TYPES.cookie) {
+			if (extData.length < 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const cLen = readUint16(extData, 0);
+			if (extData.length !== 2 + cLen) return {
+				ok: false,
+				description: "decode_error"
+			};
+			if (readUint16(extData, 0) === 0) return {
+				ok: false,
+				description: "decode_error"
+			};
+			extensions.push({
+				kind: "cookie",
+				cookie: extData.subarray(2)
+			});
+		} else if (isHello && typeCode === EXTENSION_TYPES.pre_shared_key) if (isServerHello) {
+			if (extData.length !== 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			extensions.push({
+				kind: "pre_shared_key",
+				selectedIdentity: readUint16(extData, 0)
+			});
+		} else {
+			if (extData.length < 4) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const idListLen = readUint16(extData, 0);
+			let idOffset = 2;
+			if (idOffset + idListLen > extData.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const identities = [];
+			const idEnd = 2 + idListLen;
+			while (idOffset < idEnd) {
+				if (idOffset + 6 > idEnd) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const idLen = readUint16(extData, idOffset);
+				idOffset += 2;
+				if (idOffset + idLen + 4 > idEnd) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const identity = extData.subarray(idOffset, idOffset + idLen);
+				idOffset += idLen;
+				const age = (extData[idOffset] ?? 0) << 24 | (extData[idOffset + 1] ?? 0) << 16 | (extData[idOffset + 2] ?? 0) << 8 | (extData[idOffset + 3] ?? 0);
+				idOffset += 4;
+				identities.push({
+					identity,
+					obfuscatedTicketAge: age >>> 0
+				});
+			}
+			if (idOffset === extData.length && dataLen === extData.length + 35) extensions.push({
+				kind: "pre_shared_key",
+				identities,
+				binders: [],
+				truncatedPreBinder: true
+			});
+			else {
+				if (idOffset + 2 > extData.length) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const binderListLen = readUint16(extData, idOffset);
+				idOffset += 2;
+				if (idOffset + binderListLen !== extData.length) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const binders = [];
+				while (idOffset < extData.length) {
+					const bLen = readUint8(extData, idOffset);
+					idOffset += 1;
+					if (idOffset + bLen > extData.length) return {
+						ok: false,
+						description: "decode_error"
+					};
+					binders.push(extData.subarray(idOffset, idOffset + bLen));
+					idOffset += bLen;
+				}
+				extensions.push({
+					kind: "pre_shared_key",
+					identities,
+					binders
+				});
+			}
+		}
+		else if (context === "client_hello" && typeCode === EXTENSION_TYPES.psk_key_exchange_modes) {
+			if (extData.length < 2) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const modesLen = readUint8(extData, 0);
+			if (modesLen === 0 || extData.length !== 1 + modesLen) return {
+				ok: false,
+				description: "decode_error"
+			};
+			extensions.push({
+				kind: "psk_key_exchange_modes",
+				modes: [...extData.subarray(1)]
+			});
+		} else if (typeCode === EXTENSION_TYPES.early_data) if (extData.length === 4) {
+			const maxEarlyDataSize = (extData[0] ?? 0) << 24 | (extData[1] ?? 0) << 16 | (extData[2] ?? 0) << 8 | (extData[3] ?? 0);
+			extensions.push({
+				kind: "early_data",
+				maxEarlyDataSize: maxEarlyDataSize >>> 0
+			});
+		} else extensions.push({ kind: "early_data" });
+		else extensions.push({
+			kind: "unknown",
+			typeCode,
+			data: extData
+		});
+	}
+	return {
+		ok: true,
+		value: extensions
+	};
+};
+const encodeHandshakeMessage = (msg) => {
+	let typeCode;
+	let body;
+	let declaredLength;
+	switch (msg.kind) {
+		case "client_hello": {
+			typeCode = HANDSHAKE_TYPES.client_hello;
+			const suitesBytes = concat$1(...msg.cipherSuites.map((s) => writeUint16(s)));
+			const suitesBlock = concat$1(writeUint16(suitesBytes.length), suitesBytes);
+			const sessionBlock = concat$1(writeUint8(msg.legacySessionId.length), msg.legacySessionId);
+			const compBlock = concat$1(writeUint8(msg.legacyCompressionMethods.length), msg.legacyCompressionMethods);
+			const extBlock = encodeExtensions(msg.extensions);
+			body = concat$1(writeUint16(msg.legacyVersion), msg.random, sessionBlock, suitesBlock, compBlock, extBlock);
+			if (msg.truncatedPreBinder) declaredLength = body.length + 35;
+			break;
+		}
+		case "server_hello": {
+			typeCode = HANDSHAKE_TYPES.server_hello;
+			const sessionBlock = concat$1(writeUint8(msg.legacySessionIdEcho.length), msg.legacySessionIdEcho);
+			const extBlock = encodeExtensions(msg.extensions);
+			body = concat$1(writeUint16(msg.legacyVersion), msg.random, sessionBlock, writeUint16(msg.cipherSuite), writeUint8(msg.legacyCompressionMethod), extBlock);
+			break;
+		}
+		case "encrypted_extensions":
+			typeCode = HANDSHAKE_TYPES.encrypted_extensions;
+			body = encodeExtensions(msg.extensions);
+			break;
+		case "certificate": {
+			typeCode = HANDSHAKE_TYPES.certificate;
+			const contextBlock = concat$1(writeUint8(msg.certificateRequestContext.length), msg.certificateRequestContext);
+			const entryParts = [];
+			for (const entry of msg.certificateList) {
+				const certBlock = concat$1(writeUint24(entry.certData.length), entry.certData);
+				const extBlock = entry.rawExtensions ?? encodeExtensions(entry.extensions);
+				entryParts.push(certBlock, extBlock);
+			}
+			const listBytes = concat$1(...entryParts);
+			body = concat$1(contextBlock, writeUint24(listBytes.length), listBytes);
+			break;
+		}
+		case "certificate_request":
+			typeCode = HANDSHAKE_TYPES.certificate_request;
+			body = concat$1(concat$1(writeUint8(msg.certificateRequestContext.length), msg.certificateRequestContext), encodeExtensions(msg.extensions));
+			break;
+		case "certificate_verify":
+			typeCode = HANDSHAKE_TYPES.certificate_verify;
+			body = concat$1(writeUint16(msg.scheme), writeUint16(msg.signature.length), msg.signature);
+			break;
+		case "finished":
+			typeCode = HANDSHAKE_TYPES.finished;
+			body = msg.verifyData;
+			break;
+		case "new_session_ticket":
+			typeCode = HANDSHAKE_TYPES.new_session_ticket;
+			body = concat$1(Uint8Array.of(msg.ticketLifetime >>> 24 & 255, msg.ticketLifetime >>> 16 & 255, msg.ticketLifetime >>> 8 & 255, msg.ticketLifetime & 255), Uint8Array.of(msg.ticketAgeAdd >>> 24 & 255, msg.ticketAgeAdd >>> 16 & 255, msg.ticketAgeAdd >>> 8 & 255, msg.ticketAgeAdd & 255), concat$1(writeUint8(msg.ticketNonce.length), msg.ticketNonce), concat$1(writeUint16(msg.ticket.length), msg.ticket), encodeExtensions(msg.extensions));
+			break;
+		case "key_update":
+			typeCode = HANDSHAKE_TYPES.key_update;
+			body = Uint8Array.of(msg.requestUpdate ? 1 : 0);
+			break;
+		case "end_of_early_data":
+			typeCode = HANDSHAKE_TYPES.end_of_early_data;
+			body = /* @__PURE__ */ new Uint8Array(0);
+			break;
+	}
+	return concat$1(writeUint8(typeCode), writeUint24(declaredLength ?? body.length), body);
+};
+const decodeHandshakeMessage = (bytes) => {
+	if (bytes.length < 4) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const typeCode = readUint8(bytes, 0);
+	const length = readUint24(bytes, 1);
+	if (!(typeCode === HANDSHAKE_TYPES.client_hello && bytes.length === 4 + length - 35) && bytes.length !== 4 + length) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const body = bytes.subarray(4);
+	switch (typeCode) {
+		case HANDSHAKE_TYPES.client_hello: {
+			if (body.length < 34) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const legacyVersion = readUint16(body, 0);
+			const random = body.subarray(2, 34);
+			let offset = 34;
+			if (offset + 1 > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const sessLen = readUint8(body, offset);
+			offset += 1;
+			if (offset + sessLen > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const legacySessionId = body.subarray(offset, offset + sessLen);
+			offset += sessLen;
+			if (offset + 2 > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const suitesLen = readUint16(body, offset);
+			offset += 2;
+			if (offset + suitesLen > body.length || suitesLen % 2 !== 0) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const cipherSuites = [];
+			for (let i = offset; i < offset + suitesLen; i += 2) cipherSuites.push(readUint16(body, i));
+			offset += suitesLen;
+			if (offset + 1 > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const compLen = readUint8(body, offset);
+			offset += 1;
+			if (offset + compLen > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const legacyCompressionMethods = body.subarray(offset, offset + compLen);
+			offset += compLen;
+			let extensions = [];
+			if (offset < body.length) {
+				const extRes = decodeExtensions(body.subarray(offset), "client_hello", false, true);
+				if (!extRes.ok) return extRes;
+				extensions = extRes.value;
+			}
+			const truncatedPreBinder = extensions.some((e) => e.kind === "pre_shared_key" && e.truncatedPreBinder === true);
+			return {
+				ok: true,
+				value: {
+					kind: "client_hello",
+					legacyVersion,
+					random,
+					legacySessionId,
+					cipherSuites,
+					legacyCompressionMethods,
+					extensions,
+					...truncatedPreBinder ? { truncatedPreBinder: true } : {}
+				}
+			};
+		}
+		case HANDSHAKE_TYPES.server_hello: {
+			if (body.length < 34) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const legacyVersion = readUint16(body, 0);
+			/**
+			* Two bytes in, and they decide whether the rest is even this message.
+			* RFC 9846 §4.2.3: "A client which receives a TLS 1.3 Server Hello with a
+			* legacy_version value not equal to 0x0303 MUST abort the handshake with a
+			* protocol_version alert." An SSL 3.0 ServerHello has no extensions block
+			* at all, so parsing on gets a decode_error where the honest answer — and
+			* the one that tells a self-hosted user their server is too old — is right
+			* here.
+			*/
+			if (legacyVersion !== 771) return {
+				ok: false,
+				description: "protocol_version"
+			};
+			const random = body.subarray(2, 34);
+			let offset = 34;
+			if (offset + 1 > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const sessLen = readUint8(body, offset);
+			offset += 1;
+			if (offset + sessLen > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const legacySessionIdEcho = body.subarray(offset, offset + sessLen);
+			offset += sessLen;
+			if (offset + 3 > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const cipherSuite = readUint16(body, offset);
+			const legacyCompressionMethod = readUint8(body, offset + 2);
+			offset += 3;
+			const isHrr = random.length === 32 && random.every((b, i) => b === [
+				207,
+				33,
+				173,
+				116,
+				229,
+				154,
+				97,
+				17,
+				190,
+				29,
+				140,
+				2,
+				30,
+				101,
+				184,
+				145,
+				194,
+				162,
+				17,
+				22,
+				122,
+				187,
+				140,
+				94,
+				7,
+				158,
+				9,
+				226,
+				200,
+				168,
+				51,
+				156
+			][i]);
+			let extensions = [];
+			if (offset < body.length) {
+				const extRes = decodeExtensions(body.subarray(offset), "server_hello", isHrr);
+				if (!extRes.ok) return extRes;
+				extensions = extRes.value;
+			}
+			return {
+				ok: true,
+				value: {
+					kind: "server_hello",
+					legacyVersion,
+					random,
+					legacySessionIdEcho,
+					cipherSuite,
+					legacyCompressionMethod,
+					extensions
+				}
+			};
+		}
+		case HANDSHAKE_TYPES.encrypted_extensions: {
+			const extRes = decodeExtensions(body);
+			if (!extRes.ok) return extRes;
+			return {
+				ok: true,
+				value: {
+					kind: "encrypted_extensions",
+					extensions: extRes.value
+				}
+			};
+		}
+		case HANDSHAKE_TYPES.certificate: {
+			if (body.length < 4) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const ctxLen = readUint8(body, 0);
+			let offset = 1;
+			if (offset + ctxLen > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const certificateRequestContext = body.subarray(offset, offset + ctxLen);
+			offset += ctxLen;
+			if (offset + 3 > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const listLen = readUint24(body, offset);
+			offset += 3;
+			if (offset + listLen !== body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const certificateList = [];
+			const listEnd = offset + listLen;
+			while (offset < listEnd) {
+				if (offset + 3 > listEnd) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const certLen = readUint24(body, offset);
+				offset += 3;
+				if (offset + certLen > listEnd) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const certData = body.subarray(offset, offset + certLen);
+				offset += certLen;
+				if (offset + 2 > listEnd) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const extLen = readUint16(body, offset);
+				if (offset + 2 + extLen > listEnd) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const rawExtensions = body.subarray(offset, offset + 2 + extLen);
+				const extRes = decodeExtensions(rawExtensions);
+				if (!extRes.ok) return extRes;
+				offset += 2 + extLen;
+				certificateList.push({
+					certData,
+					extensions: extRes.value,
+					rawExtensions
+				});
+			}
+			return {
+				ok: true,
+				value: {
+					kind: "certificate",
+					certificateRequestContext,
+					certificateList
+				}
+			};
+		}
+		case HANDSHAKE_TYPES.certificate_request: {
+			if (body.length < 1) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const ctxLen = readUint8(body, 0);
+			let offset = 1;
+			if (offset + ctxLen > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const certificateRequestContext = body.subarray(offset, offset + ctxLen);
+			offset += ctxLen;
+			const extRes = decodeExtensions(body.subarray(offset));
+			if (!extRes.ok) return extRes;
+			return {
+				ok: true,
+				value: {
+					kind: "certificate_request",
+					certificateRequestContext,
+					extensions: extRes.value
+				}
+			};
+		}
+		case HANDSHAKE_TYPES.certificate_verify: {
+			if (body.length < 4) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const scheme = readUint16(body, 0);
+			const sigLen = readUint16(body, 2);
+			if (body.length !== 4 + sigLen) return {
+				ok: false,
+				description: "decode_error"
+			};
+			return {
+				ok: true,
+				value: {
+					kind: "certificate_verify",
+					scheme,
+					signature: body.subarray(4)
+				}
+			};
+		}
+		case HANDSHAKE_TYPES.finished: return {
+			ok: true,
+			value: {
+				kind: "finished",
+				verifyData: body
+			}
+		};
+		case HANDSHAKE_TYPES.new_session_ticket: {
+			if (body.length < 13) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const ticketLifetime = (body[0] ?? 0) << 24 | (body[1] ?? 0) << 16 | (body[2] ?? 0) << 8 | (body[3] ?? 0);
+			const ticketAgeAdd = (body[4] ?? 0) << 24 | (body[5] ?? 0) << 16 | (body[6] ?? 0) << 8 | (body[7] ?? 0);
+			let offset = 8;
+			const nonceLen = readUint8(body, offset);
+			offset += 1;
+			if (offset + nonceLen > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const ticketNonce = body.subarray(offset, offset + nonceLen);
+			offset += nonceLen;
+			if (offset + 2 > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const ticketLen = readUint16(body, offset);
+			offset += 2;
+			if (ticketLen === 0) return {
+				ok: false,
+				description: "decode_error"
+			};
+			if (offset + ticketLen > body.length) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const ticket = body.subarray(offset, offset + ticketLen);
+			offset += ticketLen;
+			const extRes = decodeExtensions(body.subarray(offset));
+			if (!extRes.ok) return extRes;
+			return {
+				ok: true,
+				value: {
+					kind: "new_session_ticket",
+					ticketLifetime: ticketLifetime >>> 0,
+					ticketAgeAdd: ticketAgeAdd >>> 0,
+					ticketNonce,
+					ticket,
+					extensions: extRes.value
+				}
+			};
+		}
+		case HANDSHAKE_TYPES.key_update: {
+			if (body.length !== 1) return {
+				ok: false,
+				description: "decode_error"
+			};
+			const val = body[0];
+			if (val !== 0 && val !== 1) return {
+				ok: false,
+				description: "illegal_parameter"
+			};
+			return {
+				ok: true,
+				value: {
+					kind: "key_update",
+					requestUpdate: val === 1
+				}
+			};
+		}
+		case HANDSHAKE_TYPES.end_of_early_data:
+			if (body.length !== 0) return {
+				ok: false,
+				description: "decode_error"
+			};
+			return {
+				ok: true,
+				value: { kind: "end_of_early_data" }
+			};
+		default: return {
+			ok: false,
+			description: "unexpected_message"
+		};
+	}
+};
+/**
+* How many trailing octets of a ClientHello the binder list occupies, given one
+* offered identity: a uint16 list length, a uint8 entry length, and the binder.
+*
+* It is the tail of the message because `pre_shared_key` MUST be its last
+* extension (RFC 9846 §4.3.11), and that is the whole reason the truncation
+* §4.3.11.2 asks for needs no parsing to find.
+*/
+const binderListLength = (binderLength) => 3 + binderLength;
+/**
+* Builds a production ClientHello per RFC 9846 §4.2.2.
+*/
+/**
+* RFC 7685's padding rule, and how many octets of body it wants — `null` when
+* the message needs no padding at all.
+*
+* §4, *Example Usage*: "if the ClientHello message length is between 256 and
+* 511 bytes, then a padding extension SHOULD be added to make the ClientHello
+* 512 bytes long." The range is not arithmetic, it is a bug: F5 load balancers
+* of a certain vintage hang on a ClientHello in it, and a mail client that
+* dials whatever host a user names meets middleboxes nobody chose.
+*
+* **The extension is not free, which is what the `- 4` is.** §4: "Note that a
+* padding extension of length zero adds 4 bytes to the ClientHello" — its own
+* type and length fields. So a 509-byte message cannot be padded to exactly 512
+* and takes an empty one instead, landing at 513, out of the range and past the
+* hazard. The zero floor is that case, not a rounding guard.
+*
+* **A retried ClientHello may be padded independently, and that is spelled out
+* rather than inferred.** §4.1.2 lists what a second ClientHello may change from
+* the first and includes "Optionally adding, removing, or changing the length of
+* the `padding` extension [RFC7685]" — so a HelloRetryRequest that alters the
+* key share, and with it the length, does not have to carry the first hello's
+* padding forward. Table 1 gives the extension `CH` and nothing else, so a
+* server echoing it earns `illegal_parameter` from `misplacedExtensionAlert`
+* like any other extension in a message where it is not defined.
+*
+* **This client only reached the range when `signature_algorithms_cert` was
+* added.** Before it, the 84-character hostname BoGo picks for
+* `ClientHelloPadding` produced 255 bytes — one byte short, and `scope.ts`
+* carried a rule saying so and predicting that any further extension would make
+* its premise false. It did: 273. The prediction is the reason this is
+* implemented rather than discovered against a real mail host.
+*/
+const PADDING_TARGET = 512;
+const PADDING_RANGE_START = 256;
+const PADDING_EXTENSION_HEADER_BYTES = 4;
+const paddingFor = (messageLength) => {
+	if (messageLength < PADDING_RANGE_START || messageLength >= PADDING_TARGET) return null;
+	return Math.max(0, PADDING_TARGET - messageLength - PADDING_EXTENSION_HEADER_BYTES);
+};
+const encodeProductionClientHello = (options) => {
+	const random = options.random ?? crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+	const legacySessionId = options.legacySessionId ?? crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+	const group = options.group ?? "x25519";
+	const extensions = [
+		{
+			kind: "server_name",
+			serverNames: [options.serverName]
+		},
+		{
+			kind: "supported_groups",
+			groups: (options.supportedGroups ?? SUPPORTED_GROUPS).map((name) => NAMED_GROUPS[name])
+		},
+		{
+			kind: "signature_algorithms",
+			schemes: (options.signatureSchemes ?? SUPPORTED_SIGNATURE_SCHEMES).map((name) => SIGNATURE_SCHEMES[name])
+		},
+		(
+		/**
+		* NOT derived from `signatureSchemes`, and not configurable with it. That
+		* option is the caller's policy about what may sign a CertificateVerify;
+		* this is a fact about what `@yozz.app/x509` can verify in a chain, and a caller
+		* narrowing the first has said nothing about the second. RFC 9846 §4.3.3 is
+		* why both must be sent: omitting this one makes `signature_algorithms`
+		* answer for certificates too, which is the answer that was wrong.
+		*/
+		{
+			kind: "signature_algorithms_cert",
+			schemes: OFFERED_CERTIFICATE_SIGNATURE_SCHEMES.map((name) => CERTIFICATE_SIGNATURE_SCHEMES[name].code)
+		}),
+		{
+			kind: "supported_versions",
+			versions: [TLS_VERSION.V1_3],
+			isServerHello: false
+		},
+		{
+			kind: "key_share",
+			clientShares: [{
+				group: NAMED_GROUPS[group],
+				keyExchange: options.keySharePublicKey
+			}]
+		}
+	];
+	if (options.cookie !== void 0) extensions.push({
+		kind: "cookie",
+		cookie: options.cookie
+	});
+	/**
+	* Offered on every ClientHello, resumption in hand or not: RFC 9846 §4.7.1
+	* lets a server decline to issue a ticket to a client that has not said it
+	* can use one, and BoringSSL's server does exactly that. Without it the first
+	* connection never earns the session the second one needs.
+	*/
+	extensions.push({
+		kind: "psk_key_exchange_modes",
+		modes: [PSK_KEY_EXCHANGE_MODES.psk_dhe_ke]
+	});
+	if (options.psk !== void 0) extensions.push({
+		kind: "pre_shared_key",
+		identities: [{
+			identity: options.psk.identity,
+			obfuscatedTicketAge: options.psk.obfuscatedTicketAge
+		}],
+		binders: [new Uint8Array(options.psk.binderLength)]
+	});
+	/**
+	* §4.3.11 puts `pre_shared_key` last, and `bindClientHello` DEPENDS on it: it
+	* cuts a fixed-size tail off the finished message rather than parsing for the
+	* binder list. An extension appended after this point would move that tail, so
+	* the binder would cover the wrong bytes — and the only symptom is a server
+	* refusing a handshake for no stated reason. Cheaper to fail here.
+	*/
+	if (options.psk !== void 0 && extensions.at(-1)?.kind !== "pre_shared_key") throw new Error("pre_shared_key must be the last ClientHello extension");
+	const build = (withExtensions) => encodeHandshakeMessage({
+		kind: "client_hello",
+		legacyVersion: TLS_VERSION.V1_2,
+		random,
+		legacySessionId,
+		cipherSuites: [4865, 4866],
+		legacyCompressionMethods: Uint8Array.of(0),
+		extensions: withExtensions
+	});
+	const unpadded = build(extensions);
+	const padding = paddingFor(unpadded.length);
+	if (padding === null) return unpadded;
+	/**
+	* BEFORE `pre_shared_key`, which §4.3.11 requires to be last and which
+	* `bindClientHello` reads as a fixed-size tail. Appending after it would move
+	* that tail and the binder would cover the wrong bytes.
+	*/
+	const insertAt = extensions.at(-1)?.kind === "pre_shared_key" ? -1 : extensions.length;
+	return build(extensions.toSpliced(insertAt, 0, {
+		kind: "padding",
+		length: padding
+	}));
+};
+//#endregion
+//#region src/key-schedule.ts
+/**
+* The two suites the spike measured as necessary and sufficient across real mail
+* providers — `posteo.de` takes only the second. `TLS_CHACHA20_POLY1305_SHA256`
+* is deliberately absent: WebCrypto has no ChaCha20, and RFC 9846 keeps it
+* optional.
+*/
+const CIPHER_SUITES = {
+	TLS_AES_128_GCM_SHA256: {
+		code: 4865,
+		hash: "SHA-256",
+		hashLength: 32,
+		keyLength: 16,
+		ivLength: 12
+	},
+	TLS_AES_256_GCM_SHA384: {
+		code: 4866,
+		hash: "SHA-384",
+		hashLength: 48,
+		keyLength: 32,
+		ivLength: 12
+	}
+};
+const concat = (...parts) => {
+	const joined = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+	let offset = 0;
+	for (const part of parts) {
+		joined.set(part, offset);
+		offset += part.length;
+	}
+	return joined;
+};
+/**
+* WebCrypto's types demand a buffer proven not to be shared, which a view into a
+* caller's array cannot prove — the same boundary `@yozz.app/x509`'s verifier copies
+* at, for the same reason. Handshake-sized, and against an HMAC.
+*/
+const nonShared$3 = (bytes) => new Uint8Array(bytes);
+const hmac = async (hash, key, message) => new Uint8Array(await crypto.subtle.sign("HMAC", await crypto.subtle.importKey("raw", nonShared$3(key), {
+	name: "HMAC",
+	hash
+}, false, ["sign"]), nonShared$3(message)));
+/**
+* RFC 5869 §2.1. An empty salt means HashLen zero octets — which is also how RFC
+* 8446 §7.1 draws the Early Secret's `0` — and the substitution is not optional:
+* WebCrypto refuses a zero-length HMAC key outright.
+*/
+const hkdfExtract = (suite, salt, ikm) => {
+	const { hash, hashLength } = CIPHER_SUITES[suite];
+	return hmac(hash, salt.length === 0 ? new Uint8Array(hashLength) : salt, ikm);
+};
+/** RFC 5869 §2.3. */
+const hkdfExpand = async (suite, prk, info, length) => {
+	const { hash, hashLength } = CIPHER_SUITES[suite];
+	if (!Number.isInteger(length) || length < 0 || length > 255 * hashLength) throw new Error(`HKDF-Expand cannot produce ${length} octets under ${hash}`);
+	const output = new Uint8Array(length);
+	let block = /* @__PURE__ */ new Uint8Array(0);
+	for (let counter = 1; (counter - 1) * hashLength < length; counter += 1) {
+		block = await hmac(hash, prk, concat(block, info, Uint8Array.of(counter)));
+		output.set(block.subarray(0, length - (counter - 1) * hashLength), (counter - 1) * hashLength);
+	}
+	return output;
+};
+/**
+* The `HkdfLabel` struct of RFC 9846 §7.1 — a uint16 length, then the label
+* under a `tls13 ` prefix and the context, each with a one-octet length. Getting
+* this wrong produces keys that are simply different, so it fails at `Finished`
+* with `decrypt_error` and never nearer the cause.
+*/
+const hkdfLabel = (label, context, length) => {
+	const prefixed = new TextEncoder().encode(`tls13 ${label}`);
+	if (prefixed.length < 7 || prefixed.length > 255) throw new Error(`HkdfLabel label must be 7..255 octets, got ${prefixed.length}: "${label}"`);
+	if (context.length > 255) throw new Error("HkdfLabel context is over 255 octets");
+	return concat(Uint8Array.of(length >> 8, length & 255), Uint8Array.of(prefixed.length), prefixed, Uint8Array.of(context.length), context);
+};
+/**
+* `async` so that a rejected label fails the same way a rejected length does.
+* Without it `hkdfLabel` throws synchronously, as an argument evaluated before
+* the call, and a caller using `.catch()` rather than `await` would miss it.
+*/
+const hkdfExpandLabel = async (suite, secret, label, context, length) => hkdfExpand(suite, secret, hkdfLabel(label, context, length), length);
+/**
+* RFC 9846 §7.1's `Derive-Secret(Secret, Label, Messages)` — and it takes
+* MESSAGES, hashing them itself, because that is what the RFC's signature says.
+*
+* An earlier shape took the transcript pre-hashed while keeping this name. That
+* invites a handshake author reading the RFC to pass `ClientHello ‖ ServerHello`
+* straight in, which derives a secret that is merely different: every such bug
+* surfaces at `Finished` as `decrypt_error`, nowhere near the cause. Pass
+* nothing for the empty transcript. For the one derivation that takes an EMPTY
+* context rather than `Hash("")` — the `finished` key — use `hkdfExpandLabel`.
+*/
+const deriveSecret = async (suite, secret, label, ...messages) => hkdfExpandLabel(suite, secret, label, await transcriptHash(suite, ...messages), CIPHER_SUITES[suite].hashLength);
+/** `Transcript-Hash` over the handshake messages as they went on the wire. */
+const transcriptHash = async (suite, ...messages) => new Uint8Array(await crypto.subtle.digest(CIPHER_SUITES[suite].hash, concat(...messages)));
+/**
+* The three Extracts of the schedule, each folding in the one input it exists
+* for. `Derive-Secret(., "derived", "")` between them is the step that is easy
+* to forget, and it hashes the EMPTY transcript rather than the handshake so
+* far.
+*/
+const earlySecret = (suite, psk) => hkdfExtract(suite, /* @__PURE__ */ new Uint8Array(0), psk ?? new Uint8Array(CIPHER_SUITES[suite].hashLength));
+const handshakeSecret = async (suite, early, sharedSecret) => hkdfExtract(suite, await deriveSecret(suite, early, "derived"), sharedSecret);
+const masterSecret = async (suite, handshake) => hkdfExtract(suite, await deriveSecret(suite, handshake, "derived"), new Uint8Array(CIPHER_SUITES[suite].hashLength));
+/**
+* RFC 9846 §7.5's `TLS-Exporter`, verbatim:
+*
+* ```
+* TLS-Exporter(label, context_value, key_length) =
+*     HKDF-Expand-Label(Derive-Secret(Secret, label, ""),
+*                       "exporter", Hash(context_value), key_length)
+* ```
+*
+* `Secret` is the `exporter_master_secret`, and the caller holds it because
+* this module never holds a connection. Note the two DIFFERENT hashes: the
+* inner `Derive-Secret` hashes the EMPTY string, which is why it takes no
+* messages, and the outer one hashes the caller's context.
+*
+* **This is the only caller that can reach `hkdfExpand`'s multi-block loop.**
+* Every expansion in a TLS 1.3 schedule is at most one hash length, so T(1) is
+* all a handshake ever runs; an exporter is the one that asks for more, and
+* BoGo asks for 1024 octets — 32 blocks under SHA-256, 16 under SHA-384.
+*
+* `key_length` is bounded by HKDF itself (255 × hashLength) and `hkdfExpand`
+* rejects anything past it, so a caller asking for a megabyte gets an error
+* rather than a truncated key.
+*/
+const exportKeyingMaterial = async (suite, exporterMaster, label, context, length) => hkdfExpandLabel(suite, await deriveSecret(suite, exporterMaster, label), "exporter", await transcriptHash(suite, context), length);
+/** RFC 9846 §7.3. Both halves come off the same traffic secret. */
+const trafficKeys = async (suite, secret) => {
+	const { keyLength, ivLength } = CIPHER_SUITES[suite];
+	const [key, iv] = await Promise.all([hkdfExpandLabel(suite, secret, "key", /* @__PURE__ */ new Uint8Array(0), keyLength), hkdfExpandLabel(suite, secret, "iv", /* @__PURE__ */ new Uint8Array(0), ivLength)]);
+	return {
+		key,
+		iv
+	};
+};
+/** RFC 9846 §4.5.3. The base key is the sender's handshake traffic secret. */
+const finishedKey = (suite, baseKey) => hkdfExpandLabel(suite, baseKey, "finished", /* @__PURE__ */ new Uint8Array(0), CIPHER_SUITES[suite].hashLength);
+/** Our own `Finished.verify_data`, to send. */
+const verifyData = (suite, key, transcript) => hmac(CIPHER_SUITES[suite].hash, key, transcript);
+/**
+* Their `Finished.verify_data`, to check — through `subtle.verify`, which is
+* constant-time, rather than a byte comparison that is not. Correctness here is
+* free, so there is no reason to spend a timing side channel on it.
+*/
+const isVerifyDataValid = async (suite, key, transcript, received) => crypto.subtle.verify("HMAC", await crypto.subtle.importKey("raw", nonShared$3(key), {
+	name: "HMAC",
+	hash: CIPHER_SUITES[suite].hash
+}, false, ["verify"]), nonShared$3(received), nonShared$3(transcript));
+//#endregion
+//#region src/key-share.ts
+/**
+* TLS 1.3 Key Share and Diffie-Hellman Key Exchange (RFC 9846 §4.3.8) over WebCrypto.
+* Supports X25519, secp256r1 (P-256), and secp384r1 (P-384).
+*/
+const nonShared$2 = (bytes) => new Uint8Array(bytes);
+const toBase64Url = (bytes) => {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i += 1) {
+		const b = bytes[i];
+		if (b !== void 0) binary += String.fromCharCode(b);
+	}
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+};
+const fromBase64Url = (b64url) => {
+	let b64 = b64url.replaceAll("-", "+").replaceAll("_", "/");
+	while (b64.length % 4 !== 0) b64 += "=";
+	const binary = atob(b64);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+};
+const mod = (a, m) => (a % m + m) % m;
+const modInverse = (k, m) => {
+	let [a, b] = [k, m];
+	let [x0, x1] = [0n, 1n];
+	if (m === 1n) return 0n;
+	while (a > 1n) {
+		const q = a / b;
+		[a, b] = [b, a % b];
+		[x0, x1] = [x1 - q * x0, x0];
+	}
+	if (x1 < 0n) x1 += m;
+	return x1;
+};
+const jacobianAdd = (p1, p2, p) => {
+	if (p1 === null) return p2;
+	if (p2 === null) return p1;
+	const [x1, y1, z1] = p1;
+	const [x2, y2, z2] = p2;
+	const z1z1 = mod(z1 * z1, p);
+	const z2z2 = mod(z2 * z2, p);
+	const u1 = mod(x1 * z2z2, p);
+	const u2 = mod(x2 * z1z1, p);
+	const s1 = mod(y1 * z2 * z2z2, p);
+	const s2 = mod(y2 * z1 * z1z1, p);
+	if (u1 === u2) {
+		if (s1 === s2) return jacobianDouble(p1, p);
+		return null;
+	}
+	const h = mod(u2 - u1, p);
+	const i = mod(4n * h * h, p);
+	const j = mod(h * i, p);
+	const r = mod(2n * (s2 - s1), p);
+	const v = mod(u1 * i, p);
+	const x3 = mod(r * r - j - 2n * v, p);
+	return [
+		x3,
+		mod(r * (v - x3) - 2n * s1 * j, p),
+		mod(mod((z1 + z2) * (z1 + z2) - z1z1 - z2z2, p) * h, p)
+	];
+};
+const jacobianDouble = (p1, p) => {
+	if (p1 === null) return null;
+	const [x1, y1, z1] = p1;
+	const a = mod(x1 * x1, p);
+	const b = mod(y1 * y1, p);
+	const c = mod(b * b, p);
+	const d = mod(2n * (mod((x1 + b) * (x1 + b), p) - a - c), p);
+	const z1z1 = mod(z1 * z1, p);
+	const e = mod(3n * (x1 - z1z1) * (x1 + z1z1), p);
+	const f = mod(e * e - 2n * d, p);
+	return [
+		f,
+		mod(e * (d - f) - 8n * c, p),
+		mod(2n * y1 * z1, p)
+	];
+};
+const ecScalarMult = (k, generator, p) => {
+	const [gx, gy] = generator;
+	const pJac = [
+		gx,
+		gy,
+		1n
+	];
+	let rJac = null;
+	let curr = pJac;
+	let scalar = k;
+	while (scalar > 0n) {
+		if (scalar & 1n) rJac = jacobianAdd(rJac, curr, p);
+		curr = jacobianDouble(curr, p);
+		scalar >>= 1n;
+	}
+	if (rJac === null) throw new Error("Scalar multiplication resulted in point at infinity");
+	const [rx, ry, rz] = rJac;
+	const zInv = modInverse(rz, p);
+	const zInv2 = mod(zInv * zInv, p);
+	const zInv3 = mod(zInv2 * zInv, p);
+	return [mod(rx * zInv2, p), mod(ry * zInv3, p)];
+};
+const P256 = {
+	p: 2n ** 256n - 2n ** 224n + 2n ** 192n + 2n ** 96n - 1n,
+	G: [48439561293906451759052585252797914202762949526041747995844080717082404635286n, 36134250956749795798585127919587881956611106672985015071877198253568414405109n]
+};
+const P384 = {
+	p: 2n ** 384n - 2n ** 128n - 2n ** 96n + 2n ** 32n - 1n,
+	G: [26247035095799689268623156744566981891852923491109213387815615900925518854738050089022388053975719786650872476732087n, 8325710961489029985546751289520108179287853048861315594709205902480503199884419224438643760392947333078086511627871n]
+};
+const bytesToBigInt = (bytes) => {
+	let hex = "";
+	for (let i = 0; i < bytes.length; i += 1) {
+		const b = bytes[i];
+		if (b !== void 0) hex += b.toString(16).padStart(2, "0");
+	}
+	return BigInt(`0x${hex}`);
+};
+const bigIntToBytes$1 = (value, byteLength) => {
+	let hex = value.toString(16);
+	if (hex.length % 2 !== 0) hex = `0${hex}`;
+	const targetHex = hex.padStart(byteLength * 2, "0");
+	const bytes = new Uint8Array(byteLength);
+	for (let i = 0; i < byteLength; i += 1) {
+		const byteHex = targetHex.slice(i * 2, i * 2 + 2);
+		bytes[i] = Number.parseInt(byteHex, 16);
+	}
+	return bytes;
+};
+/** The generation parameters per group, so the switch below has one arm to read. */
+const GENERATION_ALGORITHMS = {
+	x25519: { name: "X25519" },
+	secp256r1: {
+		name: "ECDH",
+		namedCurve: "P-256"
+	},
+	secp384r1: {
+		name: "ECDH",
+		namedCurve: "P-384"
+	}
+};
+const generateKeyShare = async (group) => {
+	const generated = await crypto.subtle.generateKey(GENERATION_ALGORITHMS[group], true, ["deriveBits"]);
+	if (!("privateKey" in generated)) throw new Error(`WebCrypto returned a single key for ${group}, not a pair`);
+	return {
+		privateKey: generated.privateKey,
+		publicKey: new Uint8Array(await crypto.subtle.exportKey("raw", generated.publicKey))
+	};
+};
+const importPrivateShare = async (group, privateKeyBytes) => {
+	switch (group) {
+		case "x25519": {
+			const pkcs8 = concat$1(Uint8Array.of(48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 110, 4, 34, 4, 32), privateKeyBytes);
+			const privateKey = await crypto.subtle.importKey("pkcs8", nonShared$2(pkcs8), { name: "X25519" }, true, ["deriveBits"]);
+			const jwk = await crypto.subtle.exportKey("jwk", privateKey);
+			if (jwk.x === void 0) throw new Error("Failed to export X25519 public key from private key");
+			return {
+				privateKey,
+				publicKey: fromBase64Url(jwk.x)
+			};
+		}
+		case "secp256r1": {
+			const [x, y] = ecScalarMult(bytesToBigInt(privateKeyBytes), P256.G, P256.p);
+			const xBytes = bigIntToBytes$1(x, 32);
+			const yBytes = bigIntToBytes$1(y, 32);
+			const publicKey = concat$1(Uint8Array.of(4), xBytes, yBytes);
+			const jwk = {
+				kty: "EC",
+				crv: "P-256",
+				d: toBase64Url(privateKeyBytes),
+				x: toBase64Url(xBytes),
+				y: toBase64Url(yBytes),
+				ext: true
+			};
+			return {
+				privateKey: await crypto.subtle.importKey("jwk", jwk, {
+					name: "ECDH",
+					namedCurve: "P-256"
+				}, true, ["deriveBits"]),
+				publicKey
+			};
+		}
+		case "secp384r1": {
+			const [x, y] = ecScalarMult(bytesToBigInt(privateKeyBytes), P384.G, P384.p);
+			const xBytes = bigIntToBytes$1(x, 48);
+			const yBytes = bigIntToBytes$1(y, 48);
+			const publicKey = concat$1(Uint8Array.of(4), xBytes, yBytes);
+			const jwk = {
+				kty: "EC",
+				crv: "P-384",
+				d: toBase64Url(privateKeyBytes),
+				x: toBase64Url(xBytes),
+				y: toBase64Url(yBytes),
+				ext: true
+			};
+			return {
+				privateKey: await crypto.subtle.importKey("jwk", jwk, {
+					name: "ECDH",
+					namedCurve: "P-384"
+				}, true, ["deriveBits"]),
+				publicKey
+			};
+		}
+	}
+};
+const deriveSharedSecret = async (group, privateKey, peerPublicKeyBytes) => {
+	switch (group) {
+		case "x25519": {
+			const peerKey = await crypto.subtle.importKey("raw", nonShared$2(peerPublicKeyBytes), { name: "X25519" }, false, []);
+			const bits = await crypto.subtle.deriveBits({
+				name: "X25519",
+				public: peerKey
+			}, privateKey, 256);
+			return new Uint8Array(bits);
+		}
+		case "secp256r1": {
+			const peerKey = await crypto.subtle.importKey("raw", nonShared$2(peerPublicKeyBytes), {
+				name: "ECDH",
+				namedCurve: "P-256"
+			}, false, []);
+			const bits = await crypto.subtle.deriveBits({
+				name: "ECDH",
+				public: peerKey
+			}, privateKey, 256);
+			return new Uint8Array(bits);
+		}
+		case "secp384r1": {
+			const peerKey = await crypto.subtle.importKey("raw", nonShared$2(peerPublicKeyBytes), {
+				name: "ECDH",
+				namedCurve: "P-384"
+			}, false, []);
+			const bits = await crypto.subtle.deriveBits({
+				name: "ECDH",
+				public: peerKey
+			}, privateKey, 384);
+			return new Uint8Array(bits);
+		}
+	}
+};
+//#endregion
+//#region src/pinning.ts
+/**
+* RFC 7469 §2.1.1's pin: base64 of SHA-256 over the SubjectPublicKeyInfo DER.
+*
+* A STRING, and that is the load-bearing part. The pin goes into a caller's
+* store, which for YOZZ means it is serialised and read back, and a
+* `Uint8Array` through `JSON.stringify` becomes `{"0":48,"1":89,...}` — an
+* object that revives as something no byte comparison will ever match, so every
+* reconnection reads as a rotation. It is also the format `openssl x509
+* -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary |
+* base64` prints, which is how a user checks a pin out of band.
+*/
+const publicKeyPin = async (subjectPublicKeyInfoDer) => {
+	const digest = await crypto.subtle.digest("SHA-256", new Uint8Array(subjectPublicKeyInfoDer));
+	return btoa(String.fromCharCode(...new Uint8Array(digest)));
+};
+/**
+* A `Validator` that runs another one and then refuses any chain whose leaf key
+* is not the pinned one.
+*
+* The inner validator runs FIRST and its failure is returned untouched. A pin
+* that matched could otherwise carry an expired or unanchored chain through,
+* which would make pinning a way to weaken validation rather than a check on
+* top of it.
+*
+* A mismatch is `rejected-by-policy`, which `@yozz.app/tls` maps to a
+* `certificate_unknown` alert. It deliberately is not one of the codes that
+* name a property of the chain: the chain is fine. Reporting a rotated key as
+* `no-path-to-trust-anchor` would send a user to their CA over a problem that
+* has nothing to do with one.
+*
+* `pin` is required. There is no null-means-allow-anything mode, because that
+* is a pinned validator that silently never fires — a caller with no pin yet
+* passes the unwrapped validator and learns one from the result.
+*
+* **One per connection**, since a pin belongs to a host and the caller is the
+* one holding the store that maps between them. Reusing an instance across
+* hosts refuses the second one, which is the safe direction and still a bug.
+*
+* ONE pin, not a set. HPKP needed a backup pin to stop a browser bricking a
+* site it could not un-pin; a mismatch here asks the user, who can accept. The
+* case that would need a set is a hostname behind independently keyed
+* frontends, and every IP of all nine stage-3 mail hosts serves one key.
+*/
+const pinnedValidator = ({ validator, pin }) => ({
+	name: `${validator.name}+spki-pin`,
+	validatePath: async (request) => {
+		const result = await validator.validatePath(request);
+		if (!result.ok) return result;
+		if (await publicKeyPin(result.path.leafSubjectPublicKeyInfoDer) !== pin) return {
+			ok: false,
+			reason: { code: "rejected-by-policy" }
+		};
+		return result;
+	}
+});
+//#endregion
+//#region src/record.ts
+/**
+* TLS 1.3 Record Layer (RFC 9846 §5): plaintext and AEAD framing, sealing, and opening.
+*/
+const nonShared$1 = (bytes) => new Uint8Array(bytes);
+/** 2^14 of content, plus the one byte naming its type (RFC 9846 §5.2). */
+const MAX_INNER_PLAINTEXT = 16385;
+/**
+* `TLSPlaintext.length` is `uint16` but RFC 9846 §5.1 caps it at 2^14 — the
+* ceiling every check below and the fragmenting writer in `handshake.ts` share,
+* so a message larger than one record is split rather than refused.
+*/
+const MAX_RECORD_PLAINTEXT = 16384;
+const sealPlain = (type, payload, legacyVersion = LEGACY_RECORD_VERSION.STANDARD) => {
+	if (payload.length > 16384) throw new Error("record_overflow");
+	const typeCode = CONTENT_TYPES[type];
+	if (typeCode === void 0) throw new Error(`Unknown content type: ${type}`);
+	return concat$1(writeUint8(typeCode), writeUint16(legacyVersion), writeUint16(payload.length), payload);
+};
+const openPlain = (record) => {
+	if (record.length < 5) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const typeCode = record[0];
+	const v0 = record[1];
+	const v1 = record[2];
+	const l0 = record[3];
+	const l1 = record[4];
+	if (typeCode === void 0 || v0 === void 0 || v1 === void 0 || l0 === void 0 || l1 === void 0) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const length = l0 << 8 | l1;
+	if (length > 16384) return {
+		ok: false,
+		description: "record_overflow"
+	};
+	if (record.length !== 5 + length) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const type = Object.entries(CONTENT_TYPES).find(([, code]) => code === typeCode)?.[0];
+	if (type === void 0) return {
+		ok: false,
+		description: "decode_error"
+	};
+	return {
+		ok: true,
+		type,
+		payload: record.subarray(5)
+	};
+};
+const buildNonce = (iv, seq) => {
+	if (iv.length !== 12) throw new Error(`AEAD IV must be 12 octets, got ${iv.length}`);
+	const nonce = /* @__PURE__ */ new Uint8Array(12);
+	nonce.set(iv);
+	const view = /* @__PURE__ */ new DataView(/* @__PURE__ */ new ArrayBuffer(8));
+	view.setBigUint64(0, BigInt(seq), false);
+	for (let i = 0; i < 8; i += 1) {
+		const b = nonce[4 + i];
+		const s = view.getUint8(i);
+		if (b !== void 0) nonce[4 + i] = b ^ s;
+	}
+	return nonce;
+};
+const sealAead = async (key, iv, seq, type, payload, paddingZeros = 0) => {
+	if (payload.length > 16384) throw new Error("record_overflow");
+	const typeCode = CONTENT_TYPES[type];
+	if (typeCode === void 0) throw new Error(`Unknown content type: ${type}`);
+	const innerPlaintext = new Uint8Array(payload.length + 1 + paddingZeros);
+	innerPlaintext.set(payload, 0);
+	innerPlaintext[payload.length] = typeCode;
+	const ciphertextLength = innerPlaintext.length + 16;
+	if (ciphertextLength > 16640) throw new Error("record_overflow");
+	const aad = Uint8Array.of(CONTENT_TYPES.application_data, 3, 3, ciphertextLength >> 8 & 255, ciphertextLength & 255);
+	const nonce = buildNonce(iv, seq);
+	const cryptoKey = key instanceof CryptoKey ? key : await crypto.subtle.importKey("raw", nonShared$1(key), { name: "AES-GCM" }, false, ["encrypt"]);
+	return concat$1(aad, new Uint8Array(await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: nonce,
+		additionalData: aad,
+		tagLength: 128
+	}, cryptoKey, nonShared$1(innerPlaintext))));
+};
+const openAead = async (key, iv, seq, record) => {
+	if (record.length < 5) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const outerType = record[0];
+	const v0 = record[1];
+	const v1 = record[2];
+	const l0 = record[3];
+	const l1 = record[4];
+	if (outerType === void 0 || v0 === void 0 || v1 === void 0 || l0 === void 0 || l1 === void 0) return {
+		ok: false,
+		description: "decode_error"
+	};
+	if (outerType !== CONTENT_TYPES.application_data) return {
+		ok: false,
+		description: "decode_error"
+	};
+	/**
+	* The one place the version is NOT ignored, and §5.2 is why: on a
+	* TLSCiphertext "the legacy_record_version field is always 0x0303... there
+	* are no historical compatibility concerns where other values might be
+	* received". A ciphertext is never the initial ClientHello, so 0x0301 is not
+	* a case either — §5.1's "MUST be ignored" governs the PLAINTEXT field, which
+	* `openPlain` and `RecordReader` duly ignore.
+	*/
+	if ((v0 << 8 | v1) !== LEGACY_RECORD_VERSION.STANDARD) return {
+		ok: false,
+		description: "decode_error"
+	};
+	const length = l0 << 8 | l1;
+	if (length > 16640) return {
+		ok: false,
+		description: "record_overflow"
+	};
+	if (record.length !== 5 + length) return {
+		ok: false,
+		description: "decode_error"
+	};
+	if (length < 17) return {
+		ok: false,
+		description: "bad_record_mac"
+	};
+	const aad = record.subarray(0, 5);
+	const ciphertextWithTag = record.subarray(5);
+	const nonce = buildNonce(iv, seq);
+	const cryptoKey = key instanceof CryptoKey ? key : await crypto.subtle.importKey("raw", nonShared$1(key), { name: "AES-GCM" }, false, ["decrypt"]);
+	let innerPlaintext;
+	try {
+		innerPlaintext = new Uint8Array(await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: nonShared$1(nonce),
+			additionalData: nonShared$1(aad),
+			tagLength: 128
+		}, cryptoKey, nonShared$1(ciphertextWithTag)));
+	} catch {
+		return {
+			ok: false,
+			description: "bad_record_mac"
+		};
+	}
+	/**
+	* RFC 9846 §5.2: content is capped at 2^14, and the inner plaintext is that
+	* plus the one content-type byte. Padding does NOT buy room — checking the
+	* content alone lets 2^14 of it through with padding stacked on top, which is
+	* the record BoGo's `LargePlaintext-TLS13-Padded-16384-1` sends.
+	*/
+	if (innerPlaintext.length > MAX_INNER_PLAINTEXT) return {
+		ok: false,
+		description: "record_overflow"
+	};
+	let i = innerPlaintext.length - 1;
+	while (i >= 0 && innerPlaintext[i] === 0) i -= 1;
+	if (i < 0) return {
+		ok: false,
+		description: "unexpected_message"
+	};
+	const innerTypeCode = innerPlaintext[i];
+	const payload = innerPlaintext.subarray(0, i);
+	const type = Object.entries(CONTENT_TYPES).find(([, code]) => code === innerTypeCode)?.[0];
+	if (type === void 0) return {
+		ok: false,
+		description: "unexpected_message"
+	};
+	return {
+		ok: true,
+		type,
+		payload
+	};
+};
+var RecordReader = class {
+	buffer = /* @__PURE__ */ new Uint8Array(0);
+	readChunk;
+	constructor(readChunk) {
+		this.readChunk = readChunk ?? (() => Promise.resolve(null));
+	}
+	feed(chunk) {
+		this.buffer = concat$1(this.buffer, chunk);
+	}
+	async readRecord() {
+		while (this.buffer.length < 5) {
+			const chunk = await this.readChunk();
+			if (chunk === null) {
+				if (this.buffer.length === 0) return {
+					ok: true,
+					kind: "eof"
+				};
+				return {
+					ok: false,
+					kind: "truncated"
+				};
+			}
+			this.buffer = concat$1(this.buffer, chunk);
+		}
+		const v0 = this.buffer[1];
+		const v1 = this.buffer[2];
+		const l0 = this.buffer[3];
+		const l1 = this.buffer[4];
+		if (v0 === void 0 || v1 === void 0 || l0 === void 0 || l1 === void 0) return {
+			ok: false,
+			kind: "alert",
+			description: "decode_error"
+		};
+		const length = l0 << 8 | l1;
+		if (length > 16640) return {
+			ok: false,
+			kind: "alert",
+			description: "record_overflow"
+		};
+		const totalRecordLength = 5 + length;
+		while (this.buffer.length < totalRecordLength) {
+			const chunk = await this.readChunk();
+			if (chunk === null) return {
+				ok: false,
+				kind: "truncated"
+			};
+			this.buffer = concat$1(this.buffer, chunk);
+		}
+		const record = this.buffer.subarray(0, totalRecordLength);
+		this.buffer = this.buffer.subarray(totalRecordLength);
+		return {
+			ok: true,
+			kind: "record",
+			record
+		};
+	}
+};
+//#endregion
+//#region src/session.ts
+/**
+* Session resumption — RFC 9846 §2.2, §4.3.11 and §4.7.1.
+*
+* A `NewSessionTicket` is not a session. It NAMES one: the secret it stands for
+* is derived from the connection that issued it, and the ticket itself is an
+* opaque label the server chose. So this module turns a ticket plus the
+* issuing connection's resumption master secret into a value a caller can
+* store, and computes the binder that proves, on the next connection, that we
+* hold the secret rather than merely the label.
+*
+* Nothing here reads or writes a record, and nothing here decides when to
+* resume — the handshake supplies the transcript and asks. That is what lets
+* every rule about whether a ticket is usable live here, stated once, rather
+* than at each of the sites that would otherwise have to remember them: two
+* that decide a ticket is not a session at all, and four that decide a stored
+* one may not go on the wire today.
+*/
+/**
+* **Both `Date` fields are real `Date`s, and a caller that persists a session
+* has to revive them.** JSON turns them into strings, and this module reads them
+* with `.getTime()` — a rehydrated string would throw out of `startTls` rather
+* than being refused. The store is the caller's, so the revival is too.
+*/
+/**
+* RFC 9846 §4.7.1: "Servers MUST NOT use any value greater than 604800 seconds
+* (7 days)", and "Clients MUST NOT use tickets for longer than 7 days after
+* issuance, regardless of the ticket_lifetime". A server that sends more has not
+* earned a fatal alert — the RFC names none — so the ceiling is applied on the
+* way in and the session is simply shorter-lived than the server hoped.
+*/
+const MAX_TICKET_LIFETIME_SECONDS = 604800;
+/**
+* How long a chain of tickets may outlive the handshake that authenticated it.
+*
+* RFC 9846 §4.7.1 asks for a limit and says what it should weigh: "the lifetime
+* of the peer's certificate, the likelihood of intervening revocation, and the
+* time since the peer's online CertificateVerify signature". Two of those three
+* are sharp here — v1 checks no revocation at all, so a compromised key is only
+* ever noticed by a chain being rebuilt, and public mail leaves rotate every
+* 60-90 days. So the ceiling is the same week a single ticket gets: resumption
+* stops until a full handshake proves the peer again, which for a client that
+* reconnects daily costs one handshake in seven.
+*/
+const MAX_AUTHENTICATION_AGE_SECONDS = 604800;
+/**
+* The largest ticket this client will keep.
+*
+* `opaque ticket<1..2^16-1>` allows 65535, and the ClientHello it would ride
+* back in declares its extensions with a uint16 too — so a ticket near that
+* ceiling cannot be ENCODED, and the throw lands on the connection AFTER the one
+* that received it, out of a session the caller has already stored. A ticket the
+* next ClientHello cannot carry is not a session, and refusing it here is the
+* only place that decision is made once.
+*
+* 16KiB is far above anything real: RFC 8448's ticket is 178 octets, and
+* OpenSSL and BoringSSL mint a few hundred. It coincides with a record's
+* capacity and is not derived from it — the limit being dodged is the uint16
+* extension block, roughly four times larger. A ticket at this ceiling still
+* overruns one record, which is what keeps the fragmenting writer exercised.
+*/
+const MAX_TICKET_BYTES = 16384;
+/**
+* RFC 9846 §4.7.1's `PSK = HKDF-Expand-Label(resumption_secret, "resumption",
+* ticket_nonce, Hash.length)` — 9846 renamed it, and 8446's
+* `resumption_master_secret` appears nowhere in the newer document — or
+* `undefined` for a ticket that
+* could never be used, which is a different thing from one that has expired
+* since. Both live here because both are properties of the ticket's own fields,
+* and a caller handed a session it can never offer has been given a liability to
+* store rather than a session.
+*/
+const sessionFromTicket = async ({ serverName, expectedPeerName, suite, resumptionSecret, receivedAt, authenticatedAt, peerSignatureScheme, peerCertificateChain, ticket, ticketNonce, ticketAgeAdd, ticketLifetime }) => {
+	/**
+	* Three ways a ticket is not a session at all: no window to be used in, too
+	* large to ride back in a ClientHello, or behind a certificate check already
+	* past the ceiling — the last of which a long-held `IDLE` connection reaches
+	* on its own, renewing on day 8 of a chain that started at day 0. Refusing
+	* here rather than only at `isSessionOfferable` is the difference between a
+	* caller storing nothing and a caller storing a liability.
+	*/
+	if (ticketLifetime === 0 || ticket.length > MAX_TICKET_BYTES || !isWithinAuthenticationCeiling(authenticatedAt, receivedAt)) return;
+	return {
+		serverName,
+		expectedPeerName,
+		suite,
+		ticket,
+		ticketAgeAdd,
+		receivedAt,
+		authenticatedAt,
+		peerSignatureScheme,
+		peerCertificateChain,
+		lifetimeSeconds: Math.min(ticketLifetime, MAX_TICKET_LIFETIME_SECONDS),
+		preSharedKey: await hkdfExpandLabel(suite, resumptionSecret, "resumption", ticketNonce, CIPHER_SUITES[suite].hashLength)
+	};
+};
+/**
+* `| undefined` because the argument is a rehydrated value wearing a type, and
+* a store that dropped the field entirely is the first thing this has to
+* survive rather than throw on.
+*/
+const isDerChain = (chain) => chain?.leafDer instanceof Uint8Array && Array.isArray(chain.intermediateDer) && chain.intermediateDer.every((der) => der instanceof Uint8Array);
+/**
+* The two fields a `TlsSession` carries that TypeScript cannot vouch for, and
+* the ONE place that decides they are usable.
+*
+* A session is a value the caller stored and revived, so its type is a claim
+* rather than a fact. JSON is the ordinary way it becomes false: a
+* `SignatureScheme` comes back as a string that is no longer a scheme we
+* implement, and a `Uint8Array` comes back as `{"0":48,...}` — or the field is
+* simply gone. Neither is visible to the compiler and both are typed correctly.
+*
+* **It throws where it is CALLED FROM that matters, and that is `startTls`,
+* before a byte goes out.** A cross-model review found this check living only
+* in `inheritedAuthentication`, which runs after the client's Finished — so a
+* store that had dropped the chain reached `validatePath` with `undefined` and
+* came back out of `startTls` as a raw `TypeError`, mid-handshake, where every
+* other failure in the package is a typed `TlsFailure`. Two other shapes were
+* worse than that one: a JSON-revived chain reached `validatePath` and was
+* refused as `malformed-certificate`, blaming the mail host for a broken store,
+* and with `reverifyOnResume: false` the throw landed AFTER the handshake
+* completed on the wire.
+*
+* It throws rather than returning a `TlsFailure` because it is the CALLER's
+* bug, not the peer's — the same reason an empty `supportedGroups` throws.
+*/
+const assertUsableSession = (session) => {
+	if (!SUPPORTED_SIGNATURE_SCHEMES.includes(session.peerSignatureScheme)) throw new Error("the stored session names no signature scheme this client implements");
+	if (!isDerChain(session.peerCertificateChain)) throw new Error("the stored session carries no usable peer certificate chain");
+};
+/**
+* What the connection ABOUT TO MINT A TICKET should record — and the reason it
+* lives here rather than inline in the handshake.
+*
+* A resumed handshake verifies no SIGNATURE: no Certificate, no
+* CertificateVerify. (It may re-validate the stored chain — `reverifyOnResume`
+* in `handshake.ts` — which is a different claim and does not re-prove the
+* signature.) So it INHERITS, and inheriting is load-bearing. `authenticatedAt` is what
+* `isWithinAuthenticationCeiling` above measures against, and RFC 9846 §4.7.1
+* is explicit about why the measurement exists: "it is possible to continue
+* issuing new tickets which indefinitely extend the lifetime of the keying
+* material originally derived from an initial non-PSK handshake". Take a fresh
+* instant here and every renewed ticket looks newly authenticated, the ceiling
+* never bites, and resumption to a peer outlives the one signature that ever
+* proved it — which in v1 nothing else would catch, because v1 checks no
+* revocation at all.
+*
+* That failure is invisible: the handshake succeeds, the data flows, and the
+* only symptom is a limit silently not applying. It is extracted so the rule
+* has somewhere to be tested, because no peer this package can drive mints a
+* ticket on a resumed connection — see the call site in `handshake.ts`.
+*/
+const inheritedAuthentication = (resumed, verifiedNow) => {
+	if (resumed !== void 0) {
+		/**
+		* The same rehydration check `startTls` already ran on the way in, because
+		* this function is reachable without it: it is exported, unit-tested
+		* directly, and is where the renewal rule is stated. Running it twice costs
+		* two comparisons and removes the question of which caller is responsible.
+		*/
+		assertUsableSession(resumed);
+		const { authenticatedAt, peerSignatureScheme, peerCertificateChain } = resumed;
+		return {
+			authenticatedAt,
+			peerSignatureScheme,
+			peerCertificateChain
+		};
+	}
+	if (verifiedNow === void 0) throw new Error("a connection authenticated the peer neither freshly nor by resumption");
+	return verifiedNow;
+};
+const isWithinAuthenticationCeiling = (authenticatedAt, now) => {
+	const age = now.getTime() - authenticatedAt.getTime();
+	return age >= 0 && age < MAX_AUTHENTICATION_AGE_SECONDS * 1e3;
+};
+const ticketAgeMs = (session, now) => now.getTime() - session.receivedAt.getTime();
+/**
+* RFC 9846 §4.3.11.1: the age we report is the real age in milliseconds plus
+* the server's own random offset, modulo 2^32. The offset is what stops a
+* passive observer tying two connections together by their ticket ages.
+*/
+const obfuscatedTicketAge = (session, now) => (ticketAgeMs(session, now) + session.ticketAgeAdd) % 4294967296;
+/**
+* DNS names are case-insensitive, so a caller that round-trips a hostname
+* through anything case-normalising would otherwise silently stop resuming.
+*
+* The fold is `@yozz.app/x509`'s own, imported rather than rewritten: it maps A-Z
+* and nothing else, which is exact for an LDH hostname. `String.toLowerCase()`
+* is full Unicode and would WIDEN this comparison — KELVIN SIGN folds to `k` —
+* in a security check whose sibling package refuses to normalise anything it
+* does not have to. An IP is compared as written.
+*/
+const isSamePeerName = (a, b) => {
+	if (a === null || b === null) return a === b;
+	if (a.kind !== b.kind) return false;
+	return a.kind === "dns" ? asciiLower(a.value) === asciiLower(b.value) : a.value === b.value;
+};
+/**
+* Whether a stored session may still go on the wire.
+*
+* The identity checks come first and they are the load-bearing ones: a resumed
+* handshake proves nothing about who the peer is, so the session may only be
+* offered on a connection asking for exactly the identity the issuing
+* connection proved. Same host, and the same `expectedPeerName` policy — an
+* unset one and a `null` one are different answers, and neither may stand in
+* for the other.
+*
+* Then two clocks, because a ticket has two ages. Its own, which the server set
+* a lifetime on; and the age of the CERTIFICATE CHECK behind it, which renewal
+* would otherwise extend forever (§4.7.1). A negative age fails both: it encodes
+* as a huge `obfuscated_ticket_age`, which a server doing 0-RTT anti-replay
+* reads as a replayed ticket.
+*/
+const isSessionOfferable = (session, serverName, expectedPeerName, now) => {
+	const age = ticketAgeMs(session, now);
+	return asciiLower(session.serverName) === asciiLower(serverName) && isSamePeerName(session.expectedPeerName, expectedPeerName) && age >= 0 && age < session.lifetimeSeconds * 1e3 && isWithinAuthenticationCeiling(session.authenticatedAt, now);
+};
+/**
+* RFC 9846 §4.3.11.2's `PskBinderEntry`, "computed in the same way as the
+* Finished message but with the BaseKey being the binder_key".
+*
+* The transcript it runs over is the handshake so far ending in a TRUNCATED
+* ClientHello — everything up to and including the identity list, with the
+* binder list itself cut off. After a HelloRetryRequest that is three messages
+* (`message_hash`, the retry, the truncated second ClientHello), not one, which
+* is why this takes the whole transcript rather than a single message.
+*/
+const pskBinder = async (session, ...transcript) => {
+	const binderKey = await deriveSecret(session.suite, await earlySecret(session.suite, session.preSharedKey), "res binder");
+	return verifyData(session.suite, await finishedKey(session.suite, binderKey), await transcriptHash(session.suite, ...transcript));
+};
+/**
+* The same ClientHello with its binder filled in.
+*
+* The binder covers the message it travels in, so it cannot be written by the
+* pass that lays the message out — the bytes have to exist first, with the
+* binder's own space zeroed, and then be overwritten. `precedingMessages` is
+* the handshake before this ClientHello: empty for the first one, and the
+* `message_hash` plus the HelloRetryRequest for a retried one.
+*/
+const bindClientHello = async (session, clientHello, precedingMessages) => {
+	const binderLength = CIPHER_SUITES[session.suite].hashLength;
+	const truncated = clientHello.subarray(0, clientHello.length - binderListLength(binderLength));
+	const binder = await pskBinder(session, ...precedingMessages, truncated);
+	const bound = new Uint8Array(clientHello);
+	bound.set(binder, clientHello.length - binderLength);
+	return bound;
+};
+//#endregion
+//#region src/transcript.ts
+/**
+* TLS 1.3 Running Transcript and Transcript Hash (RFC 9846 §4.1).
+*/
+var Transcript = class {
+	suite;
+	messages = [];
+	hasReplacedClientHello1 = false;
+	constructor(suite = "TLS_AES_128_GCM_SHA256") {
+		this.suite = suite;
+	}
+	add(message) {
+		this.messages.push(message);
+	}
+	/**
+	* RFC 9846 §4.1:
+	* When a HelloRetryRequest is sent or received, the transcript is reconstructed as:
+	* message_hash (type 254) || uint24(Hash.length) || Hash(ClientHello1)
+	*/
+	async replaceClientHello1WithMessageHash() {
+		if (this.hasReplacedClientHello1) throw new Error("replaceClientHello1WithMessageHash may be called only once");
+		if (this.messages.length === 0) throw new Error("No ClientHello1 in transcript to replace");
+		const ch1 = this.messages[0];
+		if (ch1 === void 0) throw new Error("ClientHello1 is undefined");
+		const hash = await transcriptHash(this.suite, ch1);
+		const messageHashMsg = concat$1(writeUint8(HANDSHAKE_TYPES.message_hash), writeUint24(hash.length), hash);
+		this.messages[0] = messageHashMsg;
+		this.hasReplacedClientHello1 = true;
+	}
+	async hash() {
+		return transcriptHash(this.suite, ...this.messages);
+	}
+	getMessages() {
+		return [...this.messages];
+	}
+};
+//#endregion
+//#region src/verify.ts
+/**
+* CertificateVerify signature verification and leaf public key importing (RFC 9846 §4.5.2).
+*/
+const nonShared = (bytes) => new Uint8Array(bytes);
+const parseOid = (bytes) => {
+	if (bytes.length === 0) return "";
+	const first = bytes[0];
+	if (first === void 0) return "";
+	const arcs = [Math.floor(first / 40), first % 40];
+	let currentArc = 0;
+	for (let i = 1; i < bytes.length; i += 1) {
+		const b = bytes[i];
+		if (b === void 0) break;
+		currentArc = currentArc << 7 | b & 127;
+		if ((b & 128) === 0) {
+			arcs.push(currentArc);
+			currentArc = 0;
+		}
+	}
+	return arcs.join(".");
+};
+const SCHEME_CURVE_OIDS = {
+	[SIGNATURE_SCHEMES.ecdsa_secp256r1_sha256]: "1.2.840.10045.3.1.7",
+	[SIGNATURE_SCHEMES.ecdsa_secp384r1_sha384]: "1.3.132.0.34"
+};
+const getSpkiAlgorithm = (spkiDer) => {
+	try {
+		const tree = decodeDer(spkiDer);
+		if (tree.tagClass !== "universal" || tree.tagNumber !== 16 || !tree.isConstructed) return;
+		const algId = tree.children[0];
+		if (algId === void 0 || algId.tagNumber !== 16 || !algId.isConstructed) return;
+		const oidNode = algId.children[0];
+		if (oidNode === void 0 || oidNode.tagNumber !== 6) return;
+		const parameters = algId.children[1];
+		return {
+			oid: parseOid(oidNode.content),
+			curveOid: parameters !== void 0 && parameters.tagNumber === 6 ? parseOid(parameters.content) : void 0
+		};
+	} catch {
+		return;
+	}
+};
+const bigIntToBytes = (value, byteLength) => {
+	let hex = value.toString(16);
+	if (hex.length % 2 !== 0) hex = `0${hex}`;
+	const targetHex = hex.padStart(byteLength * 2, "0");
+	const bytes = new Uint8Array(byteLength);
+	for (let i = 0; i < byteLength; i += 1) {
+		const byteHex = targetHex.slice(i * 2, i * 2 + 2);
+		bytes[i] = Number.parseInt(byteHex, 16);
+	}
+	return bytes;
+};
+const derToP1363 = (derSignature, scalarLength) => {
+	const tree = decodeDer(derSignature);
+	if (tree.tagClass !== "universal" || tree.tagNumber !== 16 || !tree.isConstructed) throw new Error("malformed ECDSA signature DER SEQUENCE");
+	if (tree.children.length !== 2) throw new Error("ECDSA signature SEQUENCE must have exactly 2 integers");
+	const rNode = tree.children[0];
+	const sNode = tree.children[1];
+	if (rNode === void 0 || sNode === void 0) throw new Error("ECDSA signature missing r or s");
+	const rBigInt = decodeInteger(rNode);
+	const sBigInt = decodeInteger(sNode);
+	return concat$1(bigIntToBytes(rBigInt, scalarLength), bigIntToBytes(sBigInt, scalarLength));
+};
+const importLeafKey = async (spkiDer, scheme, algorithmOid) => {
+	const algorithm = getSpkiAlgorithm(spkiDer);
+	const oid = algorithmOid ?? algorithm?.oid;
+	if (oid === void 0) return {
+		ok: false,
+		description: "bad_certificate"
+	};
+	/**
+	* §4.3.3 names the two RSA-PSS families apart: `rsa_pss_rsae_*` are
+	* "RSASSA-PSS algorithms with public key OID rsaEncryption", and an
+	* id-RSASSA-PSS key belongs to `rsa_pss_pss_*`, which this client does not
+	* offer. Accepting both OIDs here took a key the scheme forbids.
+	*/
+	const requiredCurveOid = SCHEME_CURVE_OIDS[scheme];
+	if (requiredCurveOid !== void 0 && algorithm !== void 0 && algorithm.curveOid !== requiredCurveOid) return {
+		ok: false,
+		description: "illegal_parameter"
+	};
+	try {
+		switch (scheme) {
+			case SIGNATURE_SCHEMES.rsa_pss_rsae_sha256:
+				if (oid !== "1.2.840.113549.1.1.1") return {
+					ok: false,
+					description: "illegal_parameter"
+				};
+				return {
+					ok: true,
+					key: await crypto.subtle.importKey("spki", nonShared(spkiDer), {
+						name: "RSA-PSS",
+						hash: "SHA-256"
+					}, false, ["verify"])
+				};
+			case SIGNATURE_SCHEMES.rsa_pss_rsae_sha384:
+				if (oid !== "1.2.840.113549.1.1.1") return {
+					ok: false,
+					description: "illegal_parameter"
+				};
+				return {
+					ok: true,
+					key: await crypto.subtle.importKey("spki", nonShared(spkiDer), {
+						name: "RSA-PSS",
+						hash: "SHA-384"
+					}, false, ["verify"])
+				};
+			case SIGNATURE_SCHEMES.rsa_pss_rsae_sha512:
+				if (oid !== "1.2.840.113549.1.1.1") return {
+					ok: false,
+					description: "illegal_parameter"
+				};
+				return {
+					ok: true,
+					key: await crypto.subtle.importKey("spki", nonShared(spkiDer), {
+						name: "RSA-PSS",
+						hash: "SHA-512"
+					}, false, ["verify"])
+				};
+			case SIGNATURE_SCHEMES.ecdsa_secp256r1_sha256:
+				if (oid !== "1.2.840.10045.2.1") return {
+					ok: false,
+					description: "illegal_parameter"
+				};
+				return {
+					ok: true,
+					key: await crypto.subtle.importKey("spki", nonShared(spkiDer), {
+						name: "ECDSA",
+						namedCurve: "P-256"
+					}, false, ["verify"])
+				};
+			case SIGNATURE_SCHEMES.ecdsa_secp384r1_sha384:
+				if (oid !== "1.2.840.10045.2.1") return {
+					ok: false,
+					description: "illegal_parameter"
+				};
+				return {
+					ok: true,
+					key: await crypto.subtle.importKey("spki", nonShared(spkiDer), {
+						name: "ECDSA",
+						namedCurve: "P-384"
+					}, false, ["verify"])
+				};
+			case SIGNATURE_SCHEMES.ed25519:
+				if (oid !== "1.3.101.112") return {
+					ok: false,
+					description: "illegal_parameter"
+				};
+				return {
+					ok: true,
+					key: await crypto.subtle.importKey("spki", nonShared(spkiDer), { name: "Ed25519" }, false, ["verify"])
+				};
+			default: return {
+				ok: false,
+				description: "illegal_parameter"
+			};
+		}
+	} catch {
+		return {
+			ok: false,
+			description: "bad_certificate"
+		};
+	}
+};
+const verifyCertificateVerify = async (options) => {
+	const keyRes = await importLeafKey(options.spkiDer, options.scheme, options.algorithmOid);
+	if (!keyRes.ok) return keyRes;
+	const signedData = concat$1((/* @__PURE__ */ new Uint8Array(64)).fill(32), new TextEncoder().encode("TLS 1.3, server CertificateVerify"), Uint8Array.of(0), options.transcriptHash);
+	let isValid = false;
+	try {
+		switch (options.scheme) {
+			case SIGNATURE_SCHEMES.rsa_pss_rsae_sha256:
+				isValid = await crypto.subtle.verify({
+					name: "RSA-PSS",
+					saltLength: 32
+				}, keyRes.key, nonShared(options.signature), nonShared(signedData));
+				break;
+			case SIGNATURE_SCHEMES.rsa_pss_rsae_sha384:
+				isValid = await crypto.subtle.verify({
+					name: "RSA-PSS",
+					saltLength: 48
+				}, keyRes.key, nonShared(options.signature), nonShared(signedData));
+				break;
+			case SIGNATURE_SCHEMES.rsa_pss_rsae_sha512:
+				isValid = await crypto.subtle.verify({
+					name: "RSA-PSS",
+					saltLength: 64
+				}, keyRes.key, nonShared(options.signature), nonShared(signedData));
+				break;
+			case SIGNATURE_SCHEMES.ecdsa_secp256r1_sha256: {
+				const p1363Sig = derToP1363(options.signature, 32);
+				isValid = await crypto.subtle.verify({
+					name: "ECDSA",
+					hash: "SHA-256"
+				}, keyRes.key, nonShared(p1363Sig), nonShared(signedData));
+				break;
+			}
+			case SIGNATURE_SCHEMES.ecdsa_secp384r1_sha384: {
+				const p1363Sig = derToP1363(options.signature, 48);
+				isValid = await crypto.subtle.verify({
+					name: "ECDSA",
+					hash: "SHA-384"
+				}, keyRes.key, nonShared(p1363Sig), nonShared(signedData));
+				break;
+			}
+			case SIGNATURE_SCHEMES.ed25519:
+				isValid = await crypto.subtle.verify({ name: "Ed25519" }, keyRes.key, nonShared(options.signature), nonShared(signedData));
+				break;
+			default: return {
+				ok: false,
+				description: "illegal_parameter"
+			};
+		}
+	} catch {
+		return {
+			ok: false,
+			description: "decrypt_error"
+		};
+	}
+	if (!isValid) return {
+		ok: false,
+		description: "decrypt_error"
+	};
+	return { ok: true };
+};
+//#endregion
+//#region src/handshake.ts
+/**
+* TLS 1.3 Handshake State Machine and Connection Management (RFC 9846 §4, App. E.4).
+*/
+/**
+* How large a handshake message we will buffer.
+*
+* `Handshake.length` is a uint24, so the RFC's own ceiling is 16MB — which is
+* 16MB a peer can make us hold before we are able to check a single byte of it.
+* The cap is ours to choose, and 16KB was too small: BoGo's `LargeMessage`
+* sends a 51-certificate chain of about 23KB and expects it to arrive, and a
+* real chain of ML-DSA certificates would be larger still.
+*/
+const MAX_HANDSHAKE_MESSAGE_BODY = 65536;
+/**
+* Ceilings on records that carry the conversation nowhere.
+*
+* TLS 1.3 sets none of these. A peer may send zero-length application records
+* as a traffic-analysis countermeasure (RFC 9846 §5.4), `user_canceled` alerts
+* are warnings to be ignored (§6.1), and `KeyUpdate` has no rate — so a peer
+* that sends any of them forever costs us everything and itself nothing. The
+* numbers are BoringSSL's, adopted exactly because BoGo pins them from both
+* sides: 32 empty fragments must pass and 33 must fail, 4 `user_canceled` must
+* pass and 5 must fail.
+*
+* All three count CONSECUTIVE occurrences and reset the moment a byte of
+* application data is delivered — BoringSSL's own rule, in as many words:
+* "Only when at least one byte is returned, clear the counters for empty
+* records and warnings" (`ssl/tls_record.cc`), with `key_update_count` cleared
+* on delivered data in `ssl/ssl_lib.cc`. Counting them over the connection's
+* LIFETIME instead would kill a perfectly ordinary IMAP session on its 33rd
+* rekey, hours in, which is exactly the connection this client is for.
+*/
+const MAX_CONSECUTIVE_EMPTY_RECORDS = 32;
+const MAX_WARNING_ALERTS = 4;
+const MAX_KEY_UPDATES = 32;
+/**
+* `NewSessionTicket` belongs on that list too, and BoGo pins no number for it,
+* so this one is ours. It is the same shape of abuse — a post-handshake message
+* a peer may send at will, which `read()` answers by looping instead of
+* returning — with a sharper edge than the others: each ticket now costs an HKDF
+* expansion AND a call into the caller's own storage. A peer that sends them
+* forever starves the read the application is waiting on.
+*
+* 32 is far above anything real. OpenSSL, BoringSSL and Node all send two.
+*/
+const MAX_CONSECUTIVE_SESSION_TICKETS = 32;
+/**
+* What the server may answer with, per message.
+*
+* RFC 9846 §4.3 is flat about it: an endpoint MUST NOT send an extension
+* response the peer did not request, and one that arrives anyway is fatal —
+* `unsupported_extension`. So the test is TWO things at once, and both matter:
+* the extension has to be one we actually offered, AND one defined for the
+* message it turned up in.
+*
+* Matched by TYPE CODE rather than by our decoder's `kind`, because everything
+* we do not model decodes to `unknown` and two different unknowns would
+* otherwise look alike.
+*
+* The lists are RFC 9846 §4.3's table, plus RFC 8449's `record_size_limit`.
+* A `CertificateEntry` carries only responses to offers this client does not
+* make, so in practice nothing may appear there at all.
+*/
+const PERMITTED_IN_SERVER_HELLO = [
+	41,
+	43,
+	51
+];
+const PERMITTED_IN_ENCRYPTED_EXTENSIONS = [
+	0,
+	1,
+	10,
+	14,
+	15,
+	16,
+	19,
+	20,
+	28,
+	42
+];
+const PERMITTED_IN_CERTIFICATE_ENTRY = [5, 18];
+/** A HelloRetryRequest's cookie answers no offer — the server starts that one. */
+const COOKIE = 44;
+/**
+* How large a cookie we will echo back.
+*
+* A ClientHello's extensions are `Extension extensions<8..2^16-1>` — the whole
+* BLOCK is a uint16 — and a cookie is `opaque cookie<1..2^16-1>` chosen by the
+* server. So a cookie near its own legal maximum makes a ClientHello that CANNOT
+* BE ENCODED at all, by anyone; the limit is the wire format's, not ours, and
+* fragmenting records does not touch it.
+*
+* That draws the line this file follows: an input the PEER sizes gets a typed
+* failure, an input the CALLER sizes is allowed to throw. A ticket is bounded
+* where it is stored (`MAX_TICKET_BYTES`), and the cookie here — 16KiB leaves
+* room for the largest ticket we keep and every other extension several times
+* over. Real cookies are tens of bytes; they carry a server's stateless retry
+* state, not data.
+*/
+const MAX_ECHOED_COOKIE_BYTES = 16384;
+/**
+* A HelloRetryRequest is NOT a ServerHello for this purpose.
+*
+* RFC 9846's Table 1 gives each extension the messages it may appear in, and HRR
+* is a column of its own: `supported_versions` and `key_share` are `CH, SH, HRR`
+* and `cookie` is `CH, HRR`, while `pre_shared_key` is `CH, SH` — excluded from
+* the retry on purpose. Reusing the ServerHello list plus a cookie was right
+* until this client offered a PSK; from then on 41 was in the offered set AND in
+* the permitted one, so a retry carrying `pre_shared_key` passed both halves of
+* the check and was silently ignored. §4.3 makes it `illegal_parameter`.
+*/
+const PERMITTED_IN_HELLO_RETRY_REQUEST = [
+	43,
+	COOKIE,
+	51
+];
+const extensionTypeCode = (extension) => extension.kind === "unknown" ? extension.typeCode : EXTENSION_TYPES[extension.kind];
+/**
+* Which alert a server extension has earned, if any. RFC 9846 §4.3 draws a line
+* between two failures that look alike and are not:
+*
+*  - an extension we never offered is a response to nothing —
+*    `unsupported_extension`;
+*  - an extension we DID offer, turning up in a message where that extension is
+*    not defined, is a misplaced one — `illegal_parameter`.
+*/
+const misplacedExtensionAlert = (extensions, offered, permitted) => {
+	for (const extension of extensions) {
+		const code = extensionTypeCode(extension);
+		if (!offered.has(code)) return "unsupported_extension";
+		if (!permitted.includes(code)) return "illegal_parameter";
+	}
+	return null;
+};
+const isSameBytes = (a, b) => a.length === b.length && a.every((byte, index) => byte === b[index]);
+const expectedKeyShareLength = (group) => {
+	if (group === "x25519") return 32;
+	if (group === "secp256r1") return 65;
+	return 97;
+};
+const suiteFromCode = (code) => {
+	if (code === 4865) return "TLS_AES_128_GCM_SHA256";
+	if (code === 4866) return "TLS_AES_256_GCM_SHA384";
+};
+/**
+* What a session looks like in a ClientHello, with the binder still to come.
+*
+* The caller passes the instant rather than this reading a clock, because the
+* two ClientHellos want different answers: the first is built from the same
+* reading that decided the session was offerable at all, and the retried one
+* from a fresh reading, which RFC 9846 §4.2.2 asks for in as many words.
+*/
+const pskOffer = (session, now) => session === void 0 ? void 0 : {
+	identity: session.ticket,
+	obfuscatedTicketAge: obfuscatedTicketAge(session, now),
+	binderLength: CIPHER_SUITES[session.suite].hashLength
+};
+const rebindTranscript = (suite, previous) => {
+	const next = new Transcript(suite);
+	for (const message of previous.getMessages()) next.add(message);
+	return next;
+};
+/**
+* A ClientHello as records, fragmented if it does not fit in one.
+*
+* RFC 9846 §5.1 allows it — "Handshake messages MAY be coalesced into a single
+* TLSPlaintext record or fragmented across several records" — and this client
+* needs it, because two of the things that go INTO a ClientHello are sized by
+* the peer. A ticket is `opaque ticket<1..2^16-1>` (§4.7.1) and comes back as
+* the PSK identity; a HelloRetryRequest cookie is `opaque cookie<1..2^16-1>`
+* (§4.3.2) and comes back echoed. Either at its legal maximum overruns a single
+* record, and `sealPlain` answers that by THROWING — so a server could hand us a
+* 16KB ticket and poison the next connection before a byte went out.
+*
+* The legacy record version rides on every fragment: §5.1 deprecates the field
+* and requires it ignored, so the only thing that matters is the middlebox
+* compatibility the first ClientHello's 0x0301 buys, and a fragment of that
+* message is still that message.
+*/
+const clientHelloRecords = (message, legacyVersion) => Array.from({ length: Math.ceil(message.length / MAX_RECORD_PLAINTEXT) }, (_, index) => sealPlain("handshake", message.subarray(index * MAX_RECORD_PLAINTEXT, (index + 1) * MAX_RECORD_PLAINTEXT), legacyVersion));
+/**
+* The state machine, with the replay hooks as a second argument. Exported for
+* `replay.ts` and for nothing else, which `index.test.ts` enforces by name: the
+* import guard on `replay.ts` cannot see a production file that reaches past it
+* to here.
+*/
+const runHandshake = async (options, replay) => {
+	const { transport, serverName } = options;
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	/**
+	* The identity the chain is checked against, resolved once. It is what the
+	* session is bound to, so it has to be the SAME expression the validator is
+	* given — computing it twice is how the two come to disagree.
+	*/
+	const expectedPeerName = options.expectedPeerName !== void 0 ? options.expectedPeerName : {
+		kind: "dns",
+		value: serverName
+	};
+	/**
+	* Before a byte goes out, and deliberately before `isSessionOfferable` gets a
+	* say. A session is a value the caller stored and revived, so the two fields
+	* TypeScript cannot vouch for are checked at the door — see
+	* `assertUsableSession`, and the review that moved it here from a call site
+	* one flight too late.
+	*
+	* Unconditional rather than only-if-we-would-offer-it: a session whose shape
+	* did not survive the store is the caller's bug whether or not this
+	* connection would have used it, and finding out on the connection that
+	* happens to match is finding out late.
+	*/
+	if (options.session !== void 0) assertUsableSession(options.session);
+	let transcript = new Transcript();
+	const reader = new RecordReader(() => transport.read());
+	const handshakeBuffer = [];
+	const extractNextHandshakeMessage = () => {
+		const combined = concat$1(...handshakeBuffer);
+		if (combined.length < 4) return { kind: "need-more" };
+		const length = readUint24(combined, 1);
+		if (length > MAX_HANDSHAKE_MESSAGE_BODY) return { kind: "overflow" };
+		if (combined.length < 4 + length) return { kind: "need-more" };
+		const msgBytes = combined.subarray(0, 4 + length);
+		const remainder = combined.subarray(4 + length);
+		handshakeBuffer.length = 0;
+		if (remainder.length > 0) handshakeBuffer.push(remainder);
+		return {
+			kind: "message",
+			bytes: msgBytes
+		};
+	};
+	let clientWriteKeys = null;
+	/**
+	* The compatibility-mode ChangeCipherSpec, owed once we send a non-empty
+	* legacy_session_id and paid exactly once.
+	*
+	* RFC 9846 D.4 puts it "immediately before the second flight", and the second
+	* flight is whatever we protect first: a retried ClientHello, the Finished
+	* flight, or a fatal alert when the handshake ends early. Sending it only
+	* before Finished left every aborted handshake without it, and a peer that
+	* expects a middlebox-friendly stream reads the alert that follows as a
+	* malformed ChangeCipherSpec instead of the alert it is.
+	*/
+	let compatibilityCcsPending = false;
+	const sendCompatibilityCcsIfPending = async () => {
+		if (!compatibilityCcsPending) return;
+		compatibilityCcsPending = false;
+		await transport.write(sealPlain("change_cipher_spec", Uint8Array.of(1)));
+	};
+	/**
+	* A peer that hangs up mid-handshake is a truncated connection, not a bug in
+	* this file. `ByteDuplex.write` rejects when the socket has gone, and letting
+	* that escape turned "the server closed on us" into an unhandled error with a
+	* stack trace where a typed failure belongs.
+	*/
+	const writeToPeer = async (record) => {
+		try {
+			await transport.write(record);
+			return true;
+		} catch {
+			return false;
+		}
+	};
+	const sendFatalAlert = async (description) => {
+		try {
+			const alertBytes = encodeAlert({
+				level: "fatal",
+				description
+			});
+			if (clientWriteKeys === null) {
+				await transport.write(sealPlain("alert", alertBytes));
+				return;
+			}
+			await sendCompatibilityCcsIfPending();
+			const sealed = await sealAead(clientWriteKeys.key, clientWriteKeys.iv, clientWriteKeys.seq, "alert", alertBytes);
+			clientWriteKeys = {
+				key: clientWriteKeys.key,
+				iv: clientWriteKeys.iv,
+				seq: clientWriteKeys.seq + 1n
+			};
+			await transport.write(sealed);
+		} catch {}
+	};
+	const failAlert = async (description) => {
+		await sendFatalAlert(description);
+		return {
+			ok: false,
+			reason: {
+				kind: "alert-sent",
+				alert: {
+					level: "fatal",
+					description
+				}
+			}
+		};
+	};
+	/**
+	* Every path validation this connection performs, at both the sites that
+	* perform one — the peer's Certificate on a full handshake, and the stored
+	* chain again on a resumed one. Written once because the two must ask the
+	* same question: a re-check under a laxer policy than the original would
+	* report a chain as still good on terms it was never accepted on.
+	*/
+	const validatePeerChain = (chain) => options.validator.validatePath({
+		peerCertificateDer: chain.leafDer,
+		untrustedIntermediateDer: chain.intermediateDer,
+		trustAnchors: options.trustAnchors,
+		validationTime: options.validationTime,
+		expectedPeerName,
+		requiredKeyUsages: ["digitalSignature"],
+		requiredExtendedKeyUsages: ["serverAuth"],
+		maximumIntermediateCount: null
+	});
+	const failValidation = async (reason, chain) => {
+		const alert = alertForValidationFailure(reason);
+		await sendFatalAlert(alert.description);
+		return {
+			ok: false,
+			reason: {
+				kind: "certificate",
+				reason,
+				alert,
+				chain
+			}
+		};
+	};
+	/**
+	* What we offer, and which of them carries the share. The RFC calls the
+	* second one out separately (§4.3.8): a HelloRetryRequest may only move us to
+	* a group we offered and did NOT already share, so both facts are needed.
+	*/
+	/**
+	* COPIED, not aliased. The list is read twice — once for ClientHello1 and
+	* again for the ClientHello a HelloRetryRequest asks for, a full round trip
+	* later — and RFC 9846 §4.2.4 requires the second to offer what the first
+	* did. A caller holding a mutable array could otherwise change it in between,
+	* or after the checks below have already passed on it.
+	*/
+	const offeredGroups = [...options.supportedGroups ?? SUPPORTED_GROUPS];
+	const firstOfferedGroup = offeredGroups[0];
+	if (firstOfferedGroup === void 0) throw new Error("supportedGroups must offer at least one group");
+	/**
+	* RFC 9846 §4.3.7: "The `named_group_list` MUST NOT contain any duplicate
+	* entries. A recipient MAY abort a connection with a fatal
+	* `illegal_parameter` alert if it detects a duplicate entry." So a repeat is
+	* a ClientHello a conforming peer may hang up on, and the caller would see it
+	* as an unexplained server-side refusal. It throws rather than returning a
+	* typed failure because it is OUR bug, not the peer's — the same reason the
+	* empty case above does.
+	*/
+	if (new Set(offeredGroups).size !== offeredGroups.length) throw new Error("supportedGroups must not repeat a group");
+	/**
+	* COPIED and checked for the same reasons as the groups above: the list is
+	* read again for the ClientHello a HelloRetryRequest asks for, and again when
+	* the CertificateVerify arrives to decide whether the server signed with
+	* something we offered. §4.3.3 gives `supported_signature_algorithms` a
+	* `<2..2^16-2>` bound, so an empty list is not encodable; a repeat is our bug
+	* either way, which is why both throw rather than returning a typed failure.
+	*
+	* **This one stays the CALLER'S list, where `offeredExtensionCodes` and
+	* `offeredGroupCodes` below are read back off the ClientHello we sent.** Those
+	* two decide whether the server's ANSWER was solicited, and a constant would
+	* refuse the replayed document's own server. This decides whether a SIGNATURE
+	* is one we would accept, and the two diverge in the direction that matters:
+	* if the encoder ever failed to narrow what went out, reading the wire would
+	* make us accept the wider set silently, while reading the option refuses and
+	* the interop failure is visible. The caller's policy binds what we accept
+	* even when the bytes disagree. BoGo holds the wire's half of it — narrow the
+	* offer with `-verify-prefs` and `VerifyPreferences-Advertised` reads the
+	* extension back.
+	*/
+	const offeredSchemes = [...options.signatureSchemes ?? SUPPORTED_SIGNATURE_SCHEMES];
+	if (offeredSchemes.length === 0) throw new Error("signatureSchemes must offer at least one scheme");
+	if (new Set(offeredSchemes).size !== offeredSchemes.length) throw new Error("signatureSchemes must not repeat a scheme");
+	let clientShare;
+	let ch1MessageBytes;
+	let sentSessionId;
+	let ch1Random;
+	/** The group our CURRENT share is on — reassigned only by a HelloRetryRequest. */
+	let effectiveGroupName;
+	/**
+	* The session the ClientHello on the wire actually carries — `undefined` when
+	* there is none to offer, when the one we hold is for another host or past its
+	* lifetime, and when a HelloRetryRequest moves us to a hash it cannot bind
+	* under. Everything downstream reads it as "did we ask to resume", so it has
+	* to mean the message we sent rather than the one we considered sending.
+	*/
+	let offeredSession;
+	if (replay !== void 0) {
+		const ch1 = replay.clientHelloMessages[0];
+		const priv = replay.clientEphemeralPrivateKeys[0];
+		if (ch1 === void 0 || priv === void 0) throw new Error("Replay missing ClientHello1 or private key");
+		ch1MessageBytes = ch1;
+		effectiveGroupName = "x25519";
+		clientShare = await importPrivateShare(effectiveGroupName, priv);
+		const decodedCh1 = decodeHandshakeMessage(ch1);
+		if (!decodedCh1.ok || decodedCh1.value.kind !== "client_hello") throw new Error("Malformed replay ClientHello1");
+		sentSessionId = decodedCh1.value.legacySessionId;
+		ch1Random = decodedCh1.value.random;
+		/**
+		* A replayed trace can be a RESUMED one, and until §4 was driven through
+		* here nothing had noticed: this branch was written for §3 and §5, both full
+		* handshakes, and left `offeredSession` unset. The document's ClientHello
+		* then went out carrying `pre_shared_key` while the state machine believed
+		* it had offered no session, so the server's acceptance answered an offer
+		* this side did not think it had made.
+		*
+		* Gated by `isSessionOfferable` exactly as the production branch is, rather
+		* than taking the caller's session on trust — a replay that offers a session
+		* the rules would have refused proves the wrong thing.
+		*/
+		offeredSession = options.session !== void 0 && isSessionOfferable(options.session, serverName, expectedPeerName, now()) ? options.session : void 0;
+	} else {
+		effectiveGroupName = firstOfferedGroup;
+		clientShare = await generateKeyShare(effectiveGroupName);
+		sentSessionId = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+		ch1Random = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+		const offeredAt = now();
+		offeredSession = options.session !== void 0 && isSessionOfferable(options.session, serverName, expectedPeerName, offeredAt) ? options.session : void 0;
+		ch1MessageBytes = encodeProductionClientHello({
+			serverName,
+			keySharePublicKey: clientShare.publicKey,
+			group: effectiveGroupName,
+			supportedGroups: offeredGroups,
+			signatureSchemes: offeredSchemes,
+			legacySessionId: sentSessionId,
+			random: ch1Random,
+			psk: pskOffer(offeredSession, offeredAt)
+		});
+		if (offeredSession !== void 0) ch1MessageBytes = await bindClientHello(offeredSession, ch1MessageBytes, []);
+	}
+	/**
+	* What we offered, read back off the ClientHello we actually SENT rather than
+	* from the values beside it — the replay path sends RFC 8448's ClientHello,
+	* whose offers are not ours, and a constant here would refuse the document's
+	* own server. That applies to the GROUPS as much as to the extension codes:
+	* `offeredGroups` is what this client would have offered, not what the bytes
+	* on the wire did.
+	*/
+	const [offeredExtensionCodes, offeredGroupCodes] = (() => {
+		const decoded = decodeHandshakeMessage(ch1MessageBytes);
+		if (!decoded.ok || decoded.value.kind !== "client_hello") throw new Error("our own ClientHello does not decode");
+		const groups = decoded.value.extensions.find((e) => e.kind === "supported_groups");
+		return [new Set(decoded.value.extensions.map(extensionTypeCode)), new Set(groups?.kind === "supported_groups" ? groups.groups : [])];
+	})();
+	compatibilityCcsPending = sentSessionId.length > 0;
+	transcript.add(ch1MessageBytes);
+	for (const record of clientHelloRecords(ch1MessageBytes, LEGACY_RECORD_VERSION.FIRST_CLIENT_HELLO)) if (!await writeToPeer(record)) return {
+		ok: false,
+		reason: { kind: "truncated" }
+	};
+	let hasSeenHrr = false;
+	let negotiatedSuite;
+	let hrrSelectedSuite;
+	let serverShareKeyExchange;
+	let realServerHelloBytes;
+	/** The offered session, once the server has said it took it. */
+	let resumedSession;
+	while (realServerHelloBytes === void 0) {
+		let extracted = extractNextHandshakeMessage();
+		while (extracted.kind === "need-more") {
+			const recResult = await reader.readRecord();
+			if (!recResult.ok) {
+				if (recResult.kind === "truncated") return {
+					ok: false,
+					reason: { kind: "truncated" }
+				};
+				return failAlert(recResult.description);
+			}
+			if (recResult.kind === "eof") return {
+				ok: false,
+				reason: { kind: "truncated" }
+			};
+			const record = recResult.record;
+			if (record[0] === 20) continue;
+			if (record[0] === 23) return failAlert("unexpected_message");
+			const plainRes = openPlain(record);
+			if (!plainRes.ok) return failAlert(plainRes.description);
+			/**
+			* A server that refuses the ClientHello says so with a cleartext alert —
+			* `protocol_version` when it speaks no TLS 1.3, `handshake_failure` when
+			* it shares no cipher. Answering with our own `unexpected_message` threw
+			* away the only sentence in the exchange that says WHY, and a
+			* self-hosted user's report of "unexpected message" is undiagnosable.
+			*/
+			if (plainRes.type === "alert") {
+				const alertRes = decodeAlert(plainRes.payload);
+				if (alertRes.ok) return {
+					ok: false,
+					reason: {
+						kind: "alert-received",
+						alert: alertRes.alert
+					}
+				};
+				if (alertRes.unknownDescriptionCode !== void 0) return {
+					ok: false,
+					reason: {
+						kind: "alert-received-unknown",
+						code: alertRes.unknownDescriptionCode
+					}
+				};
+				return failAlert(alertRes.description);
+			}
+			if (plainRes.type !== "handshake") return failAlert("unexpected_message");
+			handshakeBuffer.push(plainRes.payload);
+			extracted = extractNextHandshakeMessage();
+		}
+		if (extracted.kind === "overflow") return failAlert("decode_error");
+		const shBytes = extracted.bytes;
+		const decoded = decodeHandshakeMessage(shBytes);
+		if (!decoded.ok) return failAlert(decoded.description);
+		const msg = decoded.value;
+		if (msg.kind !== "server_hello") return failAlert("unexpected_message");
+		if (msg.legacyCompressionMethod !== 0) return failAlert("illegal_parameter");
+		if (!isSameBytes(msg.legacySessionIdEcho, sentSessionId)) return failAlert("illegal_parameter");
+		const randomSuffix = msg.random.subarray(24);
+		if (isSameBytes(randomSuffix, DOWNGRADE_SENTINEL_TLS_1_2) || isSameBytes(randomSuffix, DOWNGRADE_SENTINEL_TLS_1_1)) return failAlert("illegal_parameter");
+		/**
+		* supported_versions must say 0x0304 — and after a HelloRetryRequest it must
+		* say the SAME thing it said there. RFC 9846 §4.2.4: "The value of
+		* selected_version in the HelloRetryRequest supported_versions extension
+		* MUST be retained in the ServerHello, and a client MUST abort the
+		* handshake with an illegal_parameter alert if the value changes."
+		*
+		* Since 0x0304 is the only value this client ever accepts, "changed" and
+		* "absent or not 0x0304" are the same test; only the alert differs, and
+		* which alert is the whole of what the peer learns.
+		*/
+		const versionsExt = msg.extensions.find((e) => e.kind === "supported_versions");
+		const wrongVersionAlert = hasSeenHrr ? "illegal_parameter" : "protocol_version";
+		if (versionsExt === void 0 || versionsExt.kind !== "supported_versions") return failAlert(wrongVersionAlert);
+		if (versionsExt.versions[0] !== TLS_VERSION.V1_3) return failAlert(wrongVersionAlert);
+		const serverHelloExtensionAlert = misplacedExtensionAlert(msg.extensions, /* @__PURE__ */ new Set([...offeredExtensionCodes, COOKIE]), isSameBytes(msg.random, HRR_MAGIC_RANDOM) ? PERMITTED_IN_HELLO_RETRY_REQUEST : PERMITTED_IN_SERVER_HELLO);
+		if (serverHelloExtensionAlert !== null) return failAlert(serverHelloExtensionAlert);
+		const selectedSuite = suiteFromCode(msg.cipherSuite);
+		if (selectedSuite === void 0) return failAlert("illegal_parameter");
+		if (hrrSelectedSuite !== void 0 && selectedSuite !== hrrSelectedSuite) return failAlert("illegal_parameter");
+		negotiatedSuite = selectedSuite;
+		transcript = rebindTranscript(negotiatedSuite, transcript);
+		const keyShareExt = msg.extensions.find((e) => e.kind === "key_share");
+		const cookieExt = msg.extensions.find((e) => e.kind === "cookie");
+		if (isSameBytes(msg.random, HRR_MAGIC_RANDOM)) {
+			if (hasSeenHrr) return failAlert("unexpected_message");
+			/**
+			* A HelloRetryRequest may ask for a different group, or for a cookie, or
+			* for both — RFC 9846 §4.2.4 requires neither extension on its own. One
+			* that asks for NOTHING is the empty retry, and there is nothing the
+			* second ClientHello could say differently.
+			*/
+			if (keyShareExt === void 0 && cookieExt === void 0) return failAlert("illegal_parameter");
+			/**
+			* A HelloRetryRequest ends the server's flight — the next thing on the
+			* wire is our second ClientHello. Bytes still buffered behind it are the
+			* start of a message the server means to finish AFTER our reply, which
+			* §5.1 does not allow and which would be spliced onto the real
+			* ServerHello when it arrives.
+			*/
+			if (handshakeBuffer.some((chunk) => chunk.length > 0)) return failAlert("unexpected_message");
+			hasSeenHrr = true;
+			hrrSelectedSuite = negotiatedSuite;
+			/**
+			* RFC 9846 §4.2.4: in the updated ClientHello the client "SHOULD NOT offer
+			* any pre-shared keys associated with a hash other than that of the
+			* selected cipher suite". Offering one anyway would be worse than
+			* pointless — the binder is a MAC under the PSK's own hash, so a server
+			* that took it would then key the connection from a schedule the other
+			* hash produced.
+			*/
+			if (offeredSession !== void 0 && CIPHER_SUITES[offeredSession.suite].hash !== CIPHER_SUITES[negotiatedSuite].hash) offeredSession = void 0;
+			if (keyShareExt !== void 0) {
+				/**
+				* RFC 9846 §4.3.8 puts TWO conditions on the retried group, and both are
+				* `illegal_parameter`: it must be one we offered in `supported_groups`,
+				* and it must NOT be the one we already sent a key share for.
+				*
+				* The second is what makes a retry a change. Without it a server can
+				* bounce us back onto the group we already offered a share on — a round
+				* trip that costs us a fresh key and gains the handshake nothing, which
+				* §4.2.4 forbids in as many words: abort "if the HelloRetryRequest would
+				* not result in any change in the ClientHello".
+				*/
+				const selectedCode = keyShareExt.selectedGroup;
+				const selectedGroup = selectedCode === void 0 ? void 0 : namedGroupFromCode(selectedCode);
+				if (selectedCode === void 0 || !offeredGroupCodes.has(selectedCode) || selectedGroup === void 0 || selectedGroup === effectiveGroupName) return failAlert("illegal_parameter");
+				effectiveGroupName = selectedGroup;
+			}
+			await transcript.replaceClientHello1WithMessageHash();
+			transcript.add(shBytes);
+			let ch2MessageBytes;
+			if (replay !== void 0) {
+				const ch2 = replay.clientHelloMessages[1];
+				const priv2 = replay.clientEphemeralPrivateKeys[1];
+				if (ch2 === void 0 || priv2 === void 0) throw new Error("Replay missing ClientHello2 or private key for HRR");
+				ch2MessageBytes = ch2;
+				clientShare = await importPrivateShare(effectiveGroupName, priv2);
+			} else {
+				if (keyShareExt !== void 0) clientShare = await generateKeyShare(effectiveGroupName);
+				const cookie = cookieExt?.kind === "cookie" ? cookieExt.cookie : void 0;
+				if (cookie !== void 0 && cookie.length > MAX_ECHOED_COOKIE_BYTES) return failAlert("illegal_parameter");
+				ch2MessageBytes = encodeProductionClientHello({
+					serverName,
+					keySharePublicKey: clientShare.publicKey,
+					group: effectiveGroupName,
+					supportedGroups: offeredGroups,
+					signatureSchemes: offeredSchemes,
+					legacySessionId: sentSessionId,
+					random: ch1Random,
+					cookie,
+					psk: pskOffer(offeredSession, now())
+				});
+				if (offeredSession !== void 0) ch2MessageBytes = await bindClientHello(offeredSession, ch2MessageBytes, transcript.getMessages());
+			}
+			/**
+			* RFC 9846 D.4: in compatibility mode the client sends one dummy
+			* ChangeCipherSpec immediately before its second flight — which is THIS
+			* message when the server retried, and the Finished flight otherwise.
+			* Sending it only before Finished left a retried handshake without the
+			* record the peer was waiting on.
+			*/
+			await sendCompatibilityCcsIfPending();
+			transcript.add(ch2MessageBytes);
+			for (const record of clientHelloRecords(ch2MessageBytes, LEGACY_RECORD_VERSION.STANDARD)) if (!await writeToPeer(record)) return {
+				ok: false,
+				reason: { kind: "truncated" }
+			};
+			continue;
+		}
+		/**
+		* RFC 9846 §4.3.11, the server's half of a resumption. Three ways it can be
+		* wrong and each is a different sentence of the RFC:
+		*
+		*  - answering a `pre_shared_key` we did not send is §4.3's response to
+		*    nothing, and the retry that drops a PSK is exactly how a ClientHello
+		*    that offered one comes to be answered by a ServerHello that may not;
+		*  - `selected_identity` is an index into the list we sent, and this client
+		*    sends one identity, so 0 is the only value in range;
+		*  - the suite has to carry the PSK's own hash, or the connection is keyed
+		*    from a schedule the other hash produced.
+		*/
+		const serverPskExt = msg.extensions.find((e) => e.kind === "pre_shared_key");
+		if (serverPskExt !== void 0) {
+			if (offeredSession === void 0) return failAlert("unsupported_extension");
+			if (serverPskExt.kind !== "pre_shared_key" || serverPskExt.selectedIdentity !== 0) return failAlert("illegal_parameter");
+			if (CIPHER_SUITES[offeredSession.suite].hash !== CIPHER_SUITES[selectedSuite].hash) return failAlert("illegal_parameter");
+			resumedSession = offeredSession;
+		}
+		/**
+		* A real ServerHello has to carry the share the key exchange runs on, and
+		* WHICH alert that earns depends on whether a PSK was selected.
+		*
+		* §4.3.11 is one sentence with three clauses — `selected_identity` in range,
+		* a suite whose Hash matches the PSK, "and that a server `key_share`
+		* extension is present if required by the ClientHello
+		* `psk_key_exchange_modes` extension. If these values are not consistent,
+		* the client MUST abort the handshake with an `illegal_parameter` alert."
+		* We offer `psk_dhe_ke` alone, so a selected PSK always requires the share.
+		*
+		* Without a PSK there is no such sentence and the extension is simply the
+		* mandatory one §9.2 is about, which `missing_extension` names.
+		*/
+		if (keyShareExt === void 0) return failAlert(resumedSession !== void 0 ? "illegal_parameter" : "missing_extension");
+		if (keyShareExt.serverShare === void 0) return failAlert("illegal_parameter");
+		if (keyShareExt.serverShare.group !== NAMED_GROUPS[effectiveGroupName]) return failAlert("illegal_parameter");
+		serverShareKeyExchange = keyShareExt.serverShare.keyExchange;
+		realServerHelloBytes = shBytes;
+	}
+	if (negotiatedSuite === void 0 || serverShareKeyExchange === void 0) throw new Error("ServerHello negotiation incomplete");
+	/**
+	* RFC 9846 §5.1: a handshake message may not span a key change, and the keys
+	* change here. Bytes still in the buffer are the start of a message sent in
+	* the clear that the server means to finish under the handshake keys — and
+	* left alone they would be spliced onto the front of the decrypted flight.
+	*/
+	if (handshakeBuffer.some((chunk) => chunk.length > 0)) return failAlert("unexpected_message");
+	transcript.add(realServerHelloBytes);
+	const shareLen = expectedKeyShareLength(effectiveGroupName);
+	if (serverShareKeyExchange.length !== shareLen || effectiveGroupName !== "x25519" && serverShareKeyExchange[0] !== 4) return failAlert("illegal_parameter");
+	let sharedSecret;
+	try {
+		sharedSecret = await deriveSharedSecret(effectiveGroupName, clientShare.privateKey, serverShareKeyExchange);
+	} catch {
+		return failAlert("illegal_parameter");
+	}
+	const early = await earlySecret(negotiatedSuite, resumedSession?.preSharedKey);
+	const hsSecret = await handshakeSecret(negotiatedSuite, early, sharedSecret);
+	const c_hs_traffic = await deriveSecret(negotiatedSuite, hsSecret, "c hs traffic", ...transcript.getMessages());
+	const s_hs_traffic = await deriveSecret(negotiatedSuite, hsSecret, "s hs traffic", ...transcript.getMessages());
+	const clientHsKeys = await trafficKeys(negotiatedSuite, c_hs_traffic);
+	const serverHsKeys = await trafficKeys(negotiatedSuite, s_hs_traffic);
+	let clientHsSeq = 0n;
+	let serverHsSeq = 0n;
+	clientWriteKeys = {
+		key: clientHsKeys.key,
+		iv: clientHsKeys.iv,
+		seq: clientHsSeq
+	};
+	let eeReceived = false;
+	let certReceived = false;
+	let cvReceived = false;
+	let finReceived = false;
+	let certRequestContext = null;
+	let leafDer;
+	let intermediates = [];
+	let cvScheme;
+	let cvSignature;
+	let transcriptHashAtCert;
+	/**
+	* Set by whichever path validation this connection actually performs — the
+	* peer's Certificate on a full handshake, the stored chain on a resumed one
+	* that re-checks. It stays `null` when neither runs, which is the resumption
+	* that trusts what it stored.
+	*/
+	let peerPublicKeyPin = null;
+	let emptyRecordsSeen = 0;
+	while (!finReceived) {
+		let extracted = extractNextHandshakeMessage();
+		while (extracted.kind === "need-more") {
+			const recResult = await reader.readRecord();
+			if (!recResult.ok) {
+				if (recResult.kind === "truncated") return {
+					ok: false,
+					reason: { kind: "truncated" }
+				};
+				return failAlert(recResult.description);
+			}
+			if (recResult.kind === "eof") return {
+				ok: false,
+				reason: { kind: "truncated" }
+			};
+			const record = recResult.record;
+			if (record[0] === 20) {
+				emptyRecordsSeen += 1;
+				if (emptyRecordsSeen > MAX_CONSECUTIVE_EMPTY_RECORDS) return failAlert("unexpected_message");
+				continue;
+			}
+			if (record[0] !== 23) return failAlert("unexpected_message");
+			emptyRecordsSeen = 0;
+			const openRes = await openAead(serverHsKeys.key, serverHsKeys.iv, serverHsSeq, record);
+			serverHsSeq += 1n;
+			if (!openRes.ok) return failAlert(openRes.description);
+			if (openRes.type === "alert") {
+				const alertRes = decodeAlert(openRes.payload);
+				if (alertRes.ok) return {
+					ok: false,
+					reason: {
+						kind: "alert-received",
+						alert: alertRes.alert
+					}
+				};
+				if (alertRes.unknownDescriptionCode !== void 0) return {
+					ok: false,
+					reason: {
+						kind: "alert-received-unknown",
+						code: alertRes.unknownDescriptionCode
+					}
+				};
+				return failAlert(alertRes.description);
+			}
+			if (openRes.type !== "handshake") return failAlert("unexpected_message");
+			handshakeBuffer.push(openRes.payload);
+			extracted = extractNextHandshakeMessage();
+		}
+		if (extracted.kind === "overflow") return failAlert("decode_error");
+		const nextMsgBytes = extracted.bytes;
+		const decoded = decodeHandshakeMessage(nextMsgBytes);
+		if (!decoded.ok) return failAlert(decoded.description);
+		const msg = decoded.value;
+		if (!eeReceived) {
+			if (msg.kind !== "encrypted_extensions") return failAlert("unexpected_message");
+			const eeExtensionAlert = misplacedExtensionAlert(msg.extensions, offeredExtensionCodes, PERMITTED_IN_ENCRYPTED_EXTENSIONS);
+			if (eeExtensionAlert !== null) return failAlert(eeExtensionAlert);
+			eeReceived = true;
+			transcript.add(nextMsgBytes);
+			continue;
+		}
+		/**
+		* A resumed handshake is authenticated by the PSK, so RFC 9846 §2.2 sends
+		* neither Certificate nor CertificateVerify — EncryptedExtensions is
+		* followed by Finished and nothing else. Skipping the two branches is what
+		* makes a Certificate that arrives anyway an `unexpected_message`.
+		*
+		* **No chain arrives HERE, which is not the same as no chain being
+		* validated.** The one the session stored is re-validated after this loop
+		* ends, unless `reverifyOnResume` was turned off — see the check below the
+		* `break`.
+		*/
+		if (resumedSession === void 0 && !certReceived) {
+			if (msg.kind === "certificate_request") {
+				certRequestContext = msg.certificateRequestContext;
+				transcript.add(nextMsgBytes);
+				continue;
+			}
+			if (msg.kind !== "certificate") return failAlert("unexpected_message");
+			if (msg.certificateList.length === 0) return failAlert("decode_error");
+			const firstCert = msg.certificateList[0];
+			if (firstCert === void 0) return failAlert("bad_certificate");
+			const certificateExtensionAlert = msg.certificateList.map((entry) => misplacedExtensionAlert(entry.extensions, offeredExtensionCodes, PERMITTED_IN_CERTIFICATE_ENTRY)).find((alert) => alert !== null);
+			if (certificateExtensionAlert != null) return failAlert(certificateExtensionAlert);
+			leafDer = firstCert.certData;
+			intermediates = msg.certificateList.slice(1).map((c) => c.certData);
+			certReceived = true;
+			transcript.add(nextMsgBytes);
+			transcriptHashAtCert = await transcript.hash();
+			continue;
+		}
+		if (resumedSession === void 0 && !cvReceived) {
+			if (msg.kind !== "certificate_verify") return failAlert("unexpected_message");
+			cvReceived = true;
+			/**
+			* RFC 9846 §4.5.2: "If the CertificateVerify message is sent by a server,
+			* the signature algorithm MUST be one offered in the client's
+			* `signature_algorithms` extension unless no valid certificate chain can
+			* be produced without unsupported algorithms".
+			*
+			* Checked here, on the message, rather than left to `importLeafKey`'s
+			* unknown-scheme case: that one answers "we cannot verify this", and it
+			* cannot answer "we can verify it but never asked for it" — which is the
+			* one that matters, because a scheme the client withheld is a scheme it
+			* declined, and honouring it anyway would let a server pick an algorithm
+			* out of the set we deliberately shrank.
+			*
+			* Deliberately AHEAD of `validatePath` below, which is where BoringSSL
+			* differs — it validates the chain on the Certificate message, a flight
+			* earlier. So a flight that is both signed with an unoffered scheme and
+			* carries an untrusted chain reports `illegal_parameter` where BoringSSL
+			* would report the certificate. The RFC names no order and no BoGo test
+			* pairs the two faults, so this is not a divergence to record: it is a
+			* message-level parameter check, and it is cheaper than the path build it
+			* would otherwise precede for a signature that can never be accepted.
+			*/
+			const offeredScheme = signatureSchemeFromCode(msg.scheme);
+			if (offeredScheme === void 0 || !offeredSchemes.includes(offeredScheme)) return failAlert("illegal_parameter");
+			cvScheme = offeredScheme;
+			cvSignature = msg.signature;
+			if (leafDer === void 0) throw new Error("Leaf certificate is undefined");
+			const pathRes = await validatePeerChain({
+				leafDer,
+				intermediateDer: intermediates
+			});
+			if (!pathRes.ok) return failValidation(pathRes.reason, "peer-sent");
+			let leafCert;
+			try {
+				leafCert = decodeCertificate(leafDer);
+			} catch {
+				return failAlert("bad_certificate");
+			}
+			if (transcriptHashAtCert === void 0) throw new Error("transcriptHashAtCert undefined");
+			const cvVerifyRes = await verifyCertificateVerify({
+				scheme: SIGNATURE_SCHEMES[cvScheme],
+				signature: cvSignature,
+				spkiDer: leafCert.subjectPublicKeyInfo.der,
+				algorithmOid: leafCert.subjectPublicKeyInfo.algorithm.oid,
+				transcriptHash: transcriptHashAtCert
+			});
+			if (!cvVerifyRes.ok) return failAlert(cvVerifyRes.description);
+			/**
+			* AFTER the signature, not after the path build. The pin names the key
+			* that authenticated this peer, and until this line the peer has only
+			* sent a chain — which is public, so sending one proves nothing. One
+			* message of difference, and it is the message the whole learn/check
+			* split is about.
+			*
+			* From the validated PATH rather than from `leafCert`, which
+			* CertificateVerify just ran against. They are the same bytes —
+			* `ValidatedPath` carries the leaf's SPKI DER precisely so `tls` need not
+			* parse the certificate twice, and `YOZZ_VALIDATOR`'s path,
+			* `decodeCertificate`'s field and `exportKey('spki')` were compared
+			* directly and agree — and the path is the copy `pinnedValidator`
+			* compares, so sourcing the learn from anywhere else could only introduce
+			* a way for the two halves to disagree.
+			*/
+			peerPublicKeyPin = await publicKeyPin(pathRes.path.leafSubjectPublicKeyInfoDer);
+			transcript.add(nextMsgBytes);
+			continue;
+		}
+		if (!finReceived) {
+			if (msg.kind !== "finished") return failAlert("unexpected_message");
+			finReceived = true;
+			const sFinKey = await finishedKey(negotiatedSuite, s_hs_traffic);
+			if (!await isVerifyDataValid(negotiatedSuite, sFinKey, await transcript.hash(), msg.verifyData)) return failAlert("decrypt_error");
+			transcript.add(nextMsgBytes);
+			if (handshakeBuffer.some((chunk) => chunk.length > 0)) return failAlert("unexpected_message");
+			break;
+		}
+	}
+	/**
+	* The resumed handshake's certificate check, over the chain the session
+	* stored (see `reverifyOnResume`). It runs HERE, one message later than
+	* BoringSSL's `state_server_certificate_reverify`, which sits between
+	* EncryptedExtensions and the server's Finished (`tls13_client.cc`). Ours
+	* waits for that Finished, so the flight is proven to come from the party
+	* holding the pre-shared key before we spend a path build on it. BoGo sees
+	* the same thing either way — a fatal alert where the client's Finished was
+	* due — which is why the placement is a choice rather than a divergence.
+	*
+	* The alert leaves protected, under the handshake key, and takes the
+	* compatibility ChangeCipherSpec with it if one is still owed.
+	*/
+	if (resumedSession !== void 0 && (options.reverifyOnResume ?? true)) {
+		const reverified = await validatePeerChain(resumedSession.peerCertificateChain);
+		if (!reverified.ok) return failValidation(reverified.reason, "session-stored");
+		peerPublicKeyPin = await publicKeyPin(reverified.path.leafSubjectPublicKeyInfoDer);
+	}
+	const master = await masterSecret(negotiatedSuite, hsSecret);
+	const c_ap_traffic = await deriveSecret(negotiatedSuite, master, "c ap traffic", ...transcript.getMessages());
+	const s_ap_traffic = await deriveSecret(negotiatedSuite, master, "s ap traffic", ...transcript.getMessages());
+	/**
+	* RFC 9846 §7.1's `exporter_master_secret`, over ClientHello...server
+	* Finished — the SAME transcript as the two traffic secrets above, and one
+	* message short of `res master` below. It is derived here and kept because
+	* the exporter outlives the handshake and the transcript does not.
+	*/
+	const exporterMaster = await deriveSecret(negotiatedSuite, master, "exp master", ...transcript.getMessages());
+	await sendCompatibilityCcsIfPending();
+	if (certRequestContext !== null) {
+		const emptyCertMsg = encodeHandshakeMessage({
+			kind: "certificate",
+			certificateRequestContext: certRequestContext,
+			certificateList: []
+		});
+		transcript.add(emptyCertMsg);
+		const sealedCertRecord = await sealAead(clientHsKeys.key, clientHsKeys.iv, clientHsSeq, "handshake", emptyCertMsg);
+		clientHsSeq += 1n;
+		clientWriteKeys = {
+			key: clientHsKeys.key,
+			iv: clientHsKeys.iv,
+			seq: clientHsSeq
+		};
+		if (!await writeToPeer(sealedCertRecord)) return {
+			ok: false,
+			reason: { kind: "truncated" }
+		};
+	}
+	const cFinKey = await finishedKey(negotiatedSuite, c_hs_traffic);
+	const clientFinMsg = encodeHandshakeMessage({
+		kind: "finished",
+		verifyData: await verifyData(negotiatedSuite, cFinKey, await transcript.hash())
+	});
+	transcript.add(clientFinMsg);
+	const sealedFinRecord = await sealAead(clientHsKeys.key, clientHsKeys.iv, clientHsSeq, "handshake", clientFinMsg);
+	clientHsSeq += 1n;
+	clientWriteKeys = {
+		key: clientHsKeys.key,
+		iv: clientHsKeys.iv,
+		seq: clientHsSeq
+	};
+	if (!await writeToPeer(sealedFinRecord)) return {
+		ok: false,
+		reason: { kind: "truncated" }
+	};
+	/**
+	* RFC 9846 §7.1's `resumption_master_secret`. It runs over the transcript
+	* through the CLIENT's Finished — one message further than the application
+	* traffic secrets above, which is the whole reason it is derived down here
+	* rather than beside them. Every ticket the server later sends expands from
+	* it, so it outlives the handshake and the transcript does not.
+	*/
+	const resumptionSecret = await deriveSecret(negotiatedSuite, master, "res master", ...transcript.getMessages());
+	/**
+	* When the peer was proved, by which signature, and over which chain —
+	* inherited whole on a resumed handshake, which proves none of the three. The
+	* rule and its consequences live in `session.ts` beside the ceiling that
+	* reads `authenticatedAt`, because that is the only place any of them can be
+	* tested: no peer this package can drive mints a ticket on a resumed
+	* connection (see the note where these reach `sessionFromTicket` below).
+	*/
+	const { authenticatedAt, peerSignatureScheme, peerCertificateChain } = inheritedAuthentication(resumedSession, cvScheme === void 0 || leafDer === void 0 ? void 0 : {
+		authenticatedAt: now(),
+		peerSignatureScheme: cvScheme,
+		peerCertificateChain: {
+			leafDer,
+			intermediateDer: intermediates
+		}
+	});
+	let clientTrafficSecret = c_ap_traffic;
+	let serverTrafficSecret = s_ap_traffic;
+	let clientAppKeys = await trafficKeys(negotiatedSuite, clientTrafficSecret);
+	let serverAppKeys = await trafficKeys(negotiatedSuite, serverTrafficSecret);
+	let clientAppSeq = 0n;
+	let serverAppSeq = 0n;
+	/**
+	* TLS 1.3 closes each direction on its own (RFC 9846 §6.1): a `close_notify`
+	* says the SENDER is done writing, and says nothing about the receiver.
+	* Holding one flag for both made the peer's goodbye close our write side —
+	* so we never sent ours back, and a peer waiting for it waited forever.
+	*/
+	let peerSentCloseNotify = false;
+	let sentCloseNotify = false;
+	clientWriteKeys = {
+		key: clientAppKeys.key,
+		iv: clientAppKeys.iv,
+		seq: clientAppSeq
+	};
+	let writeQueue = Promise.resolve();
+	const queueWrite = (action) => {
+		const next = writeQueue.then(action, action);
+		writeQueue = next.then(() => {}, () => {});
+		return next;
+	};
+	const syncClientWriteKeys = () => {
+		clientWriteKeys = {
+			key: clientAppKeys.key,
+			iv: clientAppKeys.iv,
+			seq: clientAppSeq
+		};
+	};
+	/**
+	* Send the alert, then fail with it. Every established-connection failure goes
+	* out through the write queue, because sealing outside it is how one AES-GCM
+	* `(key, nonce)` came to cover two plaintexts.
+	*/
+	const abortWith = async (description) => {
+		await queueWrite(async () => {
+			await sendFatalAlert(description);
+		});
+		return {
+			ok: false,
+			reason: {
+				kind: "alert-sent",
+				alert: {
+					level: "fatal",
+					description
+				}
+			}
+		};
+	};
+	let emptyPostHandshakeRecords = 0;
+	let warningAlertsSeen = 0;
+	let keyUpdatesSeen = 0;
+	let sessionTicketsSeen = 0;
+	/**
+	* A `KeyUpdate` asking us to update in return is answered ONCE, on the next
+	* thing we write — not once per request.
+	*
+	* RFC 9846 §4.7.3 requires the response but sets no deadline, and a peer can
+	* put several requests in flight before any of them is answered. Answering
+	* each one turns one cheap record into an unbounded reply stream, and a peer
+	* strict about unsolicited KeyUpdates (BoGo is, and so is BoringSSL) drops
+	* the connection on the second.
+	*
+	* Owing it to the WRITE path is also what keeps the key rotation inside the
+	* write queue, where every client-write key and sequence mutation has to
+	* happen: sealing one outside it is how a single AES-GCM (key, nonce) came to
+	* cover two plaintexts once already.
+	*/
+	let keyUpdateResponseOwed = false;
+	const payKeyUpdateResponse = async () => {
+		if (!keyUpdateResponseOwed) return;
+		keyUpdateResponseOwed = false;
+		const kuMsg = encodeHandshakeMessage({
+			kind: "key_update",
+			requestUpdate: false
+		});
+		const sealedKu = await sealAead(clientAppKeys.key, clientAppKeys.iv, clientAppSeq, "handshake", kuMsg);
+		clientAppSeq += 1n;
+		await transport.write(sealedKu);
+		clientTrafficSecret = await hkdfExpandLabel(negotiatedSuite, clientTrafficSecret, "traffic upd", /* @__PURE__ */ new Uint8Array(0), CIPHER_SUITES[negotiatedSuite].hashLength);
+		clientAppKeys = await trafficKeys(negotiatedSuite, clientTrafficSecret);
+		clientAppSeq = 0n;
+		syncClientWriteKeys();
+	};
+	return {
+		ok: true,
+		connection: {
+			read: async () => {
+				while (true) {
+					if (peerSentCloseNotify) return {
+						ok: true,
+						kind: "closed"
+					};
+					let extracted = extractNextHandshakeMessage();
+					if (extracted.kind === "message") {} else if (extracted.kind === "overflow") return abortWith("decode_error");
+					else {
+						const recResult = await reader.readRecord();
+						if (!recResult.ok) {
+							if (recResult.kind === "truncated") return {
+								ok: false,
+								reason: { kind: "truncated" }
+							};
+							return abortWith(recResult.description);
+						}
+						if (recResult.kind === "eof") return {
+							ok: false,
+							reason: { kind: "truncated" }
+						};
+						const record = recResult.record;
+						if (record[0] !== 23) return abortWith("unexpected_message");
+						const openRes = await openAead(serverAppKeys.key, serverAppKeys.iv, serverAppSeq, record);
+						serverAppSeq += 1n;
+						if (!openRes.ok) return abortWith(openRes.description);
+						if (openRes.type === "application_data") {
+							if (openRes.payload.length === 0) {
+								emptyPostHandshakeRecords += 1;
+								if (emptyPostHandshakeRecords > MAX_CONSECUTIVE_EMPTY_RECORDS) return abortWith("unexpected_message");
+								continue;
+							}
+							emptyPostHandshakeRecords = 0;
+							warningAlertsSeen = 0;
+							keyUpdatesSeen = 0;
+							sessionTicketsSeen = 0;
+							return {
+								ok: true,
+								kind: "data",
+								bytes: openRes.payload
+							};
+						}
+						if (openRes.type === "alert") {
+							const alertRes = decodeAlert(openRes.payload);
+							if (!alertRes.ok) {
+								if (alertRes.unknownDescriptionCode !== void 0) return {
+									ok: false,
+									reason: {
+										kind: "alert-received-unknown",
+										code: alertRes.unknownDescriptionCode
+									}
+								};
+								return abortWith(alertRes.description);
+							}
+							if (alertRes.alert.description === "close_notify") {
+								peerSentCloseNotify = true;
+								return {
+									ok: true,
+									kind: "closed"
+								};
+							}
+							if (alertRes.alert.description === "user_canceled") {
+								warningAlertsSeen += 1;
+								if (warningAlertsSeen > MAX_WARNING_ALERTS) return abortWith("unexpected_message");
+								continue;
+							}
+							return {
+								ok: false,
+								reason: {
+									kind: "alert-received",
+									alert: alertRes.alert
+								}
+							};
+						}
+						if (openRes.type !== "handshake") return abortWith("unexpected_message");
+						handshakeBuffer.push(openRes.payload);
+						extracted = extractNextHandshakeMessage();
+						while (extracted.kind === "need-more") {
+							const more = await reader.readRecord();
+							if (!more.ok) {
+								if (more.kind === "truncated") return {
+									ok: false,
+									reason: { kind: "truncated" }
+								};
+								return abortWith(more.description);
+							}
+							if (more.kind === "eof") return {
+								ok: false,
+								reason: { kind: "truncated" }
+							};
+							if (more.record[0] !== 23) return abortWith("unexpected_message");
+							const moreOpen = await openAead(serverAppKeys.key, serverAppKeys.iv, serverAppSeq, more.record);
+							serverAppSeq += 1n;
+							if (!moreOpen.ok) return abortWith(moreOpen.description);
+							if (moreOpen.type !== "handshake") return abortWith("unexpected_message");
+							handshakeBuffer.push(moreOpen.payload);
+							extracted = extractNextHandshakeMessage();
+						}
+						if (extracted.kind === "overflow") return abortWith("decode_error");
+					}
+					if (extracted.kind !== "message") continue;
+					const decoded = decodeHandshakeMessage(extracted.bytes);
+					if (!decoded.ok) return abortWith(decoded.description);
+					if (decoded.value.kind === "new_session_ticket") {
+						sessionTicketsSeen += 1;
+						if (sessionTicketsSeen > MAX_CONSECUTIVE_SESSION_TICKETS) return abortWith("unexpected_message");
+						const { onSession } = options;
+						if (onSession !== void 0) {
+							const session = await sessionFromTicket({
+								serverName,
+								expectedPeerName,
+								suite: negotiatedSuite,
+								resumptionSecret,
+								receivedAt: now(),
+								authenticatedAt,
+								/**
+								* These three are what a RENEWAL writes down, and reaching them
+								* took the package's first §4 replay through the state machine.
+								* No peer this package can DRIVE mints a ticket on a resumed
+								* connection: Node's OpenSSL issues two on the full handshake and
+								* none on the resumption, BoGo runs all 106 of its resumption
+								* tests at `-resume-count 1` so no third connection offers one
+								* back, and RFC 8448 §4 publishes no NewSessionTicket.
+								*
+								* So `session.test.ts` replays §4 and seals §3's ticket under §4's
+								* OWN published server application key — which works because the
+								* server derives that key over ClientHello..server Finished,
+								* before the `EndOfEarlyData` this client never sends. The
+								* decryption is the delivery mechanism and the proof of the key
+								* schedule at once. Point `inheritedAuthentication` at a fresh
+								* authentication and that test fails.
+								*/
+								peerSignatureScheme,
+								peerCertificateChain,
+								ticket: decoded.value.ticket,
+								ticketNonce: decoded.value.ticketNonce,
+								ticketAgeAdd: decoded.value.ticketAgeAdd,
+								ticketLifetime: decoded.value.ticketLifetime
+							});
+							/**
+							* The caller's storage is not on the connection's critical path. A
+							* ticket is an optimisation — losing one costs a resumption, and
+							* letting a `localStorage` quota error out of here would cost the
+							* connection AND break `TlsReadResult`, which is total everywhere
+							* else in this file.
+							*/
+							if (session !== void 0) try {
+								await onSession(session);
+							} catch {}
+						}
+						continue;
+					}
+					if (decoded.value.kind === "key_update") {
+						keyUpdatesSeen += 1;
+						if (keyUpdatesSeen > MAX_KEY_UPDATES) return abortWith("unexpected_message");
+						const hashLen = CIPHER_SUITES[negotiatedSuite].hashLength;
+						serverTrafficSecret = await hkdfExpandLabel(negotiatedSuite, serverTrafficSecret, "traffic upd", /* @__PURE__ */ new Uint8Array(0), hashLen);
+						serverAppKeys = await trafficKeys(negotiatedSuite, serverTrafficSecret);
+						serverAppSeq = 0n;
+						if (decoded.value.requestUpdate) keyUpdateResponseOwed = true;
+						continue;
+					}
+					return abortWith("unexpected_message");
+				}
+			},
+			write: async (plaintext) => {
+				if (sentCloseNotify) return {
+					ok: false,
+					reason: {
+						kind: "alert-sent",
+						alert: {
+							level: "warning",
+							description: "close_notify"
+						}
+					}
+				};
+				const run = async () => {
+					await payKeyUpdateResponse();
+					const hashLen = CIPHER_SUITES[negotiatedSuite].hashLength;
+					if (clientAppSeq >= 2n ** 24n) {
+						const kuMsg = encodeHandshakeMessage({
+							kind: "key_update",
+							requestUpdate: false
+						});
+						const sealedKu = await sealAead(clientAppKeys.key, clientAppKeys.iv, clientAppSeq, "handshake", kuMsg);
+						clientAppSeq += 1n;
+						await transport.write(sealedKu);
+						clientTrafficSecret = await hkdfExpandLabel(negotiatedSuite, clientTrafficSecret, "traffic upd", /* @__PURE__ */ new Uint8Array(0), hashLen);
+						clientAppKeys = await trafficKeys(negotiatedSuite, clientTrafficSecret);
+						clientAppSeq = 0n;
+					}
+					for (let offset = 0; offset < plaintext.length; offset += MAX_RECORD_PLAINTEXT) {
+						const sealed = await sealAead(clientAppKeys.key, clientAppKeys.iv, clientAppSeq, "application_data", plaintext.subarray(offset, offset + MAX_RECORD_PLAINTEXT));
+						clientAppSeq += 1n;
+						syncClientWriteKeys();
+						await transport.write(sealed);
+					}
+					return { ok: true };
+				};
+				return queueWrite(run);
+			},
+			close: async () => {
+				if (sentCloseNotify) return { ok: true };
+				sentCloseNotify = true;
+				const run = async () => {
+					await payKeyUpdateResponse();
+					const alertPayload = encodeAlert({
+						level: "warning",
+						description: "close_notify"
+					});
+					const sealedAlert = await sealAead(clientAppKeys.key, clientAppKeys.iv, clientAppSeq, "alert", alertPayload);
+					clientAppSeq += 1n;
+					syncClientWriteKeys();
+					try {
+						await transport.write(sealedAlert);
+						return { ok: true };
+					} catch {
+						return {
+							ok: false,
+							reason: { kind: "truncated" }
+						};
+					}
+				};
+				return queueWrite(run);
+			},
+			/**
+			* Not queued and not stateful — it reads a secret fixed at the end of the
+			* handshake and touches no sequence number, so it cannot race a write the
+			* way `close` and the KeyUpdate response can.
+			*/
+			exportKeyingMaterial: (label, context, length) => exportKeyingMaterial(negotiatedSuite, exporterMaster, label, context, length)
+		},
+		negotiatedGroup: effectiveGroupName,
+		isResumed: resumedSession !== void 0,
+		isHelloRetryRequested: hasSeenHrr,
+		peerSignatureScheme,
+		peerPublicKeyPin
+	};
+};
+const startTls = (options) => runHandshake(options);
+//#endregion
+export { CIPHER_SUITES, NAMED_GROUPS, SIGNATURE_SCHEMES, SUPPORTED_GROUPS, SUPPORTED_SIGNATURE_SCHEMES, deriveSecret, earlySecret, finishedKey, handshakeSecret, hkdfExpandLabel, hkdfExtract, isVerifyDataValid, masterSecret, namedGroupFromCode, pinnedValidator, publicKeyPin, signatureSchemeFromCode, startTls, trafficKeys, transcriptHash, verifyData };