@yozz.app/tls 0.1.2 → 0.1.4

package/dist/index.mjs

@@ -24,17 +24,7 @@ const NAMED_GROUPS = {
 	secp384r1: 24,
 	x25519: 29
 };
-/**
-* Every group this client implements, in the order it offers them — so the
-* first one carries the key share, and a server that accepts our first choice
-* negotiates without a HelloRetryRequest.
-*
-* P-384 is not optional here: `posteo.de` refuses X25519 and P-256 outright.
-*
-* It doubles as the default for `supportedGroups`, and `wire.test.ts` holds it
-* to covering every key of `NAMED_GROUPS` — `namedGroupFromCode` searches this
-* list, so a group implemented but missing from it would decode as unknown.
-*/
+/** In offer order; the first carries the key share. P-384 is required: `posteo.de` refuses X25519 and P-256. */
 const SUPPORTED_GROUPS = [
 	"x25519",
 	"secp256r1",
@@ -51,20 +41,8 @@ const SIGNATURE_SCHEMES = {
 	ed25519: 2055
 };
 /**
-* Every scheme this client can verify a CertificateVerify with, in the order it
-* offers them, and the default for `signatureSchemes`.
-*
-* The list is the security boundary, not just a preference: RFC 9846 §4.5.2
-* says a server's "signature algorithm MUST be one offered in the client's
-* `signature_algorithms` extension", and the handshake refuses one that is not.
-* So a scheme missing from here is a scheme the server may not sign with, and a
-* scheme present but unimplemented in `verify.ts` is a hole — `wire.test.ts`
-* holds this to covering every key of `SIGNATURE_SCHEMES`, the same way
-* `SUPPORTED_GROUPS` is held to `NAMED_GROUPS`.
-*
-* Ed25519 is offered where BoringSSL disables it by default. It is a smaller,
-* misuse-resistant signature over a curve we already carry for key exchange,
-* and refusing it would only push a server onto RSA.
+* The security boundary, not a preference: RFC 9846 §4.5.2 lets a server sign a CertificateVerify
+* only with a scheme offered here. Ed25519 is offered though BoringSSL disables it by default.
 */
 const SUPPORTED_SIGNATURE_SCHEMES = [
 	"ecdsa_secp256r1_sha256",
@@ -87,13 +65,6 @@ const CERTIFICATE_SIGNATURE_SCHEMES = {
 		algorithmOid: "1.2.840.10045.4.3.3",
 		curveOid: "1.3.132.0.34"
 	},
-	/**
-	* P-521 as a CERTIFICATE signature, which is not the P-521 that DECISIONS puts
-	* out of v1. That one is the ECDHE group and the CertificateVerify scheme —
-	* things a peer negotiates with us. This is a curve an intermediate we did not
-	* choose may already have been signed with, and `@yozz.app/x509` verifies it, so
-	* withholding it would understate the validator for no gain.
-	*/
 	ecdsa_secp521r1_sha512: {
 		code: 1539,
 		algorithmOid: "1.2.840.10045.4.3.4",
@@ -115,12 +86,7 @@ const CERTIFICATE_SIGNATURE_SCHEMES = {
 		curveOid: null
 	}
 };
-/**
-* What goes on the wire, in preference order. ECDSA first because those chains
-* are smaller and this client pays for every byte of a mail server's flight;
-* RSA-PKCS1 after, because that is what most of the WebPKI is actually signed
-* with and a server MUST be able to find it here.
-*/
+/** ECDSA first, for smaller chains. RSA-PKCS1 must be here: most of the WebPKI is signed with it. */
 const OFFERED_CERTIFICATE_SIGNATURE_SCHEMES = [
 	"ecdsa_secp256r1_sha256",
 	"ecdsa_secp384r1_sha384",
@@ -143,11 +109,7 @@ const EXTENSION_TYPES = {
 	psk_key_exchange_modes: 45,
 	key_share: 51
 };
-/**
-* RFC 9846 §4.3.9. This client offers `psk_dhe_ke` alone: `psk_ke` resumes with
-* no fresh key exchange, so one stolen ticket decrypts every session that ever
-* used it. Forward secrecy is the reason to run our own TLS in the first place.
-*/
+/** RFC 9846 §4.3.9. Only `psk_dhe_ke` is offered: `psk_ke` gives up forward secrecy. */
 const PSK_KEY_EXCHANGE_MODES = {
 	psk_ke: 0,
 	psk_dhe_ke: 1
@@ -191,13 +153,9 @@ const TLS_VERSION = {
 	V1_2: 771,
 	V1_3: 772
 };
-/**
-* RFC 9846 §4.2.3: SHA-256("HelloRetryRequest")
-*/
+/** RFC 9846 §4.2.3: SHA-256("HelloRetryRequest"). */
 const HRR_MAGIC_RANDOM = Uint8Array.of(207, 33, 173, 116, 229, 154, 97, 17, 190, 29, 140, 2, 30, 101, 184, 145, 194, 162, 17, 22, 122, 187, 140, 94, 7, 158, 9, 226, 200, 168, 51, 156);
-/**
-* RFC 9846 §4.2.3: Downgrade sentinels in the last 8 octets of ServerHello.random.
-*/
+/** RFC 9846 §4.2.3: the last 8 octets of ServerHello.random. */
 const DOWNGRADE_SENTINEL_TLS_1_2 = Uint8Array.of(68, 79, 87, 78, 71, 82, 68, 1);
 const DOWNGRADE_SENTINEL_TLS_1_1 = Uint8Array.of(68, 79, 87, 78, 71, 82, 68, 0);
 //#endregion
@@ -220,7 +178,10 @@ const decodeAlert = (bytes) => {
 		ok: false,
 		description: "decode_error"
 	};
-	const level = levelCode === 1 ? "warning" : levelCode === 2 ? "fatal" : void 0;
+	const level = (() => {
+		if (levelCode === 1) return "warning";
+		if (levelCode === 2) return "fatal";
+	})();
 	if (level === void 0) return {
 		ok: false,
 		description: "illegal_parameter"
@@ -253,21 +214,7 @@ const VALIDATION_FAILURE_ALERTS = {
 	"name-mismatch": "certificate_unknown",
 	"no-path-to-trust-anchor": "unknown_ca",
 	"maximum-chain-depth-exceeded": "unknown_ca",
-	/**
-	* §6.2's `unknown_ca` is "the certificate was not accepted because the CA
-	* certificate could not be located or could not be matched with a known
-	* trust anchor" — and a root distrusted for leaves this new is exactly a CA
-	* that cannot be matched, for this chain, however well we know it. The
-	* distinction the RFC has no alert for is kept where it is useful: in the
-	* failure code the caller reads, not on the wire.
-	*/
 	"certificate-authority-distrusted": "unknown_ca",
-	/**
-	* RFC 9846 §6.2: "certificate_unknown: Some other (unspecified) issue arose
-	* in processing the certificate, rendering it unacceptable." A validator
-	* refusing on its own policy is exactly the unspecified issue — the chain
-	* itself was fine, so none of the specific certificate alerts is true.
-	*/
 	"rejected-by-policy": "certificate_unknown"
 };
 const alertForValidationFailure = (failure) => ({
@@ -276,9 +223,6 @@ const alertForValidationFailure = (failure) => ({
 });
 //#endregion
 //#region src/bytes.ts
-/**
-* Byte-level encoding and decoding primitives for TLS records and messages.
-*/
 const concat$1 = (...parts) => {
 	const joined = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
 	let offset = 0;
@@ -323,9 +267,6 @@ const writeUint24 = (value) => {
 };
 //#endregion
 //#region src/handshake-messages.ts
-/**
-* TLS 1.3 Handshake Message Codec (RFC 9846 §4).
-*/
 const encodeExtensions = (extensions) => {
 	const parts = [];
 	let declaredTotalLen;
@@ -408,9 +349,7 @@ const encodeExtensions = (extensions) => {
 				if (ext.maxEarlyDataSize !== void 0) body = Uint8Array.of(ext.maxEarlyDataSize >>> 24 & 255, ext.maxEarlyDataSize >>> 16 & 255, ext.maxEarlyDataSize >>> 8 & 255, ext.maxEarlyDataSize & 255);
 				else body = /* @__PURE__ */ new Uint8Array(0);
 				break;
-			case "unknown":
-				body = ext.data;
-				break;
+			case "unknown": body = ext.data;
 		}
 		parts.push(writeUint16(extTypeCode), writeUint16(declaredExtLen ?? body.length), body);
 	}
@@ -461,46 +400,47 @@ const decodeExtensions = (bytes, context = "other", isHrr = false, allowPreBinde
 			ok: false,
 			description: "decode_error"
 		};
-		if (typeCode === EXTENSION_TYPES.server_name) if (extData.length === 0) extensions.push({
-			kind: "server_name",
-			serverNames: []
-		});
-		else {
-			if (extData.length < 2) return {
-				ok: false,
-				description: "decode_error"
-			};
-			const listLen = readUint16(extData, 0);
-			if (extData.length !== 2 + listLen) return {
-				ok: false,
-				description: "decode_error"
-			};
-			let nOffset = 2;
-			const serverNames = [];
-			while (nOffset < extData.length) {
-				if (nOffset + 3 > extData.length) return {
+		if (typeCode === EXTENSION_TYPES.server_name) {
+			if (extData.length === 0) extensions.push({
+				kind: "server_name",
+				serverNames: []
+			});
+			else {
+				if (extData.length < 2) return {
 					ok: false,
 					description: "decode_error"
 				};
-				const nameType = readUint8(extData, nOffset);
-				const nameLen = readUint16(extData, nOffset + 1);
-				nOffset += 3;
-				if (nOffset + nameLen > extData.length) return {
+				const listLen = readUint16(extData, 0);
+				if (extData.length !== 2 + listLen) return {
 					ok: false,
 					description: "decode_error"
 				};
-				if (nameType === 0) {
-					const nameBytes = extData.subarray(nOffset, nOffset + nameLen);
-					serverNames.push(new TextDecoder().decode(nameBytes));
+				let nOffset = 2;
+				const serverNames = [];
+				while (nOffset < extData.length) {
+					if (nOffset + 3 > extData.length) return {
+						ok: false,
+						description: "decode_error"
+					};
+					const nameType = readUint8(extData, nOffset);
+					const nameLen = readUint16(extData, nOffset + 1);
+					nOffset += 3;
+					if (nOffset + nameLen > extData.length) return {
+						ok: false,
+						description: "decode_error"
+					};
+					if (nameType === 0) {
+						const nameBytes = extData.subarray(nOffset, nOffset + nameLen);
+						serverNames.push(new TextDecoder().decode(nameBytes));
+					}
+					nOffset += nameLen;
 				}
-				nOffset += nameLen;
+				extensions.push({
+					kind: "server_name",
+					serverNames
+				});
 			}
-			extensions.push({
-				kind: "server_name",
-				serverNames
-			});
-		}
-		else if (typeCode === EXTENSION_TYPES.supported_groups) {
+		} else if (typeCode === EXTENSION_TYPES.supported_groups) {
 			if (extData.length < 2) return {
 				ok: false,
 				description: "decode_error"
@@ -533,15 +473,6 @@ const decodeExtensions = (bytes, context = "other", isHrr = false, allowPreBinde
 				schemes
 			});
 		} else if (typeCode === EXTENSION_TYPES.signature_algorithms_cert) {
-			/**
-			* Same `SignatureSchemeList` body as its sibling above, decoded for one
-			* reason: **so a test can read back what the ClientHello actually sent.**
-			* Left as `unknown` it still travelled correctly — `offeredExtensionCodes`
-			* keys on `typeCode` — but the drift gate in `wire.test.ts` could not name
-			* it, and a review found that gate passing with the extension deleted
-			* outright. A wire format nothing can assert on is a wire format nothing
-			* holds.
-			*/
 			if (extData.length < 2) return {
 				ok: false,
 				description: "decode_error"
@@ -561,97 +492,99 @@ const decodeExtensions = (bytes, context = "other", isHrr = false, allowPreBinde
 			kind: "padding",
 			length: extData.length
 		});
-		else if (isHello && typeCode === EXTENSION_TYPES.supported_versions) if (isServerHello) {
-			if (extData.length !== 2) return {
-				ok: false,
-				description: "decode_error"
-			};
-			extensions.push({
-				kind: "supported_versions",
-				versions: [readUint16(extData, 0)],
-				isServerHello: true
-			});
-		} else {
-			if (extData.length < 1) return {
-				ok: false,
-				description: "decode_error"
-			};
-			const listLen = readUint8(extData, 0);
-			if (extData.length !== 1 + listLen || listLen % 2 !== 0) return {
-				ok: false,
-				description: "decode_error"
-			};
-			const versions = [];
-			for (let i = 1; i < extData.length; i += 2) versions.push(readUint16(extData, i));
-			extensions.push({
-				kind: "supported_versions",
-				versions,
-				isServerHello: false
-			});
-		}
-		else if (isHello && typeCode === EXTENSION_TYPES.key_share) if (isHrr) {
-			if (extData.length !== 2) return {
-				ok: false,
-				description: "decode_error"
-			};
-			extensions.push({
-				kind: "key_share",
-				selectedGroup: readUint16(extData, 0)
-			});
-		} else if (isServerHello) {
-			if (extData.length < 4) return {
-				ok: false,
-				description: "decode_error"
-			};
-			const group = readUint16(extData, 0);
-			const kLen = readUint16(extData, 2);
-			if (extData.length !== 4 + kLen) return {
-				ok: false,
-				description: "decode_error"
-			};
-			extensions.push({
-				kind: "key_share",
-				serverShare: {
-					group,
-					keyExchange: extData.subarray(4, 4 + kLen)
-				}
-			});
-		} else {
-			if (extData.length < 2) return {
-				ok: false,
-				description: "decode_error"
-			};
-			const listLen = readUint16(extData, 0);
-			if (extData.length !== 2 + listLen) return {
-				ok: false,
-				description: "decode_error"
-			};
-			let sOffset = 2;
-			const clientShares = [];
-			while (sOffset < extData.length) {
-				if (sOffset + 4 > extData.length) return {
+		else if (isHello && typeCode === EXTENSION_TYPES.supported_versions) {
+			if (isServerHello) {
+				if (extData.length !== 2) return {
 					ok: false,
 					description: "decode_error"
 				};
-				const group = readUint16(extData, sOffset);
-				const kLen = readUint16(extData, sOffset + 2);
-				sOffset += 4;
-				if (sOffset + kLen > extData.length) return {
+				extensions.push({
+					kind: "supported_versions",
+					versions: [readUint16(extData, 0)],
+					isServerHello: true
+				});
+			} else {
+				if (extData.length < 1) return {
 					ok: false,
 					description: "decode_error"
 				};
-				clientShares.push({
-					group,
-					keyExchange: extData.subarray(sOffset, sOffset + kLen)
+				const listLen = readUint8(extData, 0);
+				if (extData.length !== 1 + listLen || listLen % 2 !== 0) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const versions = [];
+				for (let i = 1; i < extData.length; i += 2) versions.push(readUint16(extData, i));
+				extensions.push({
+					kind: "supported_versions",
+					versions,
+					isServerHello: false
 				});
-				sOffset += kLen;
 			}
-			extensions.push({
-				kind: "key_share",
-				clientShares
-			});
-		}
-		else if (isHello && typeCode === EXTENSION_TYPES.cookie) {
+		} else if (isHello && typeCode === EXTENSION_TYPES.key_share) {
+			if (isHrr) {
+				if (extData.length !== 2) return {
+					ok: false,
+					description: "decode_error"
+				};
+				extensions.push({
+					kind: "key_share",
+					selectedGroup: readUint16(extData, 0)
+				});
+			} else if (isServerHello) {
+				if (extData.length < 4) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const group = readUint16(extData, 0);
+				const kLen = readUint16(extData, 2);
+				if (extData.length !== 4 + kLen) return {
+					ok: false,
+					description: "decode_error"
+				};
+				extensions.push({
+					kind: "key_share",
+					serverShare: {
+						group,
+						keyExchange: extData.subarray(4, 4 + kLen)
+					}
+				});
+			} else {
+				if (extData.length < 2) return {
+					ok: false,
+					description: "decode_error"
+				};
+				const listLen = readUint16(extData, 0);
+				if (extData.length !== 2 + listLen) return {
+					ok: false,
+					description: "decode_error"
+				};
+				let sOffset = 2;
+				const clientShares = [];
+				while (sOffset < extData.length) {
+					if (sOffset + 4 > extData.length) return {
+						ok: false,
+						description: "decode_error"
+					};
+					const group = readUint16(extData, sOffset);
+					const kLen = readUint16(extData, sOffset + 2);
+					sOffset += 4;
+					if (sOffset + kLen > extData.length) return {
+						ok: false,
+						description: "decode_error"
+					};
+					clientShares.push({
+						group,
+						keyExchange: extData.subarray(sOffset, sOffset + kLen)
+					});
+					sOffset += kLen;
+				}
+				extensions.push({
+					kind: "key_share",
+					clientShares
+				});
+			}
+		} else if (isHello && typeCode === EXTENSION_TYPES.cookie) {
 			if (extData.length < 2) return {
 				ok: false,
 				description: "decode_error"
@@ -669,84 +602,85 @@ const decodeExtensions = (bytes, context = "other", isHrr = false, allowPreBinde
 				kind: "cookie",
 				cookie: extData.subarray(2)
 			});
-		} else if (isHello && typeCode === EXTENSION_TYPES.pre_shared_key) if (isServerHello) {
-			if (extData.length !== 2) return {
-				ok: false,
-				description: "decode_error"
-			};
-			extensions.push({
-				kind: "pre_shared_key",
-				selectedIdentity: readUint16(extData, 0)
-			});
-		} else {
-			if (extData.length < 4) return {
-				ok: false,
-				description: "decode_error"
-			};
-			const idListLen = readUint16(extData, 0);
-			let idOffset = 2;
-			if (idOffset + idListLen > extData.length) return {
-				ok: false,
-				description: "decode_error"
-			};
-			const identities = [];
-			const idEnd = 2 + idListLen;
-			while (idOffset < idEnd) {
-				if (idOffset + 6 > idEnd) return {
-					ok: false,
-					description: "decode_error"
-				};
-				const idLen = readUint16(extData, idOffset);
-				idOffset += 2;
-				if (idOffset + idLen + 4 > idEnd) return {
+		} else if (isHello && typeCode === EXTENSION_TYPES.pre_shared_key) {
+			if (isServerHello) {
+				if (extData.length !== 2) return {
 					ok: false,
 					description: "decode_error"
 				};
-				const identity = extData.subarray(idOffset, idOffset + idLen);
-				idOffset += idLen;
-				const age = (extData[idOffset] ?? 0) << 24 | (extData[idOffset + 1] ?? 0) << 16 | (extData[idOffset + 2] ?? 0) << 8 | (extData[idOffset + 3] ?? 0);
-				idOffset += 4;
-				identities.push({
-					identity,
-					obfuscatedTicketAge: age >>> 0
+				extensions.push({
+					kind: "pre_shared_key",
+					selectedIdentity: readUint16(extData, 0)
 				});
-			}
-			if (idOffset === extData.length && dataLen === extData.length + 35) extensions.push({
-				kind: "pre_shared_key",
-				identities,
-				binders: [],
-				truncatedPreBinder: true
-			});
-			else {
-				if (idOffset + 2 > extData.length) return {
+			} else {
+				if (extData.length < 4) return {
 					ok: false,
 					description: "decode_error"
 				};
-				const binderListLen = readUint16(extData, idOffset);
-				idOffset += 2;
-				if (idOffset + binderListLen !== extData.length) return {
+				const idListLen = readUint16(extData, 0);
+				let idOffset = 2;
+				if (idOffset + idListLen > extData.length) return {
 					ok: false,
 					description: "decode_error"
 				};
-				const binders = [];
-				while (idOffset < extData.length) {
-					const bLen = readUint8(extData, idOffset);
-					idOffset += 1;
-					if (idOffset + bLen > extData.length) return {
+				const identities = [];
+				const idEnd = 2 + idListLen;
+				while (idOffset < idEnd) {
+					if (idOffset + 6 > idEnd) return {
 						ok: false,
 						description: "decode_error"
 					};
-					binders.push(extData.subarray(idOffset, idOffset + bLen));
-					idOffset += bLen;
+					const idLen = readUint16(extData, idOffset);
+					idOffset += 2;
+					if (idOffset + idLen + 4 > idEnd) return {
+						ok: false,
+						description: "decode_error"
+					};
+					const identity = extData.subarray(idOffset, idOffset + idLen);
+					idOffset += idLen;
+					const age = (extData[idOffset] ?? 0) << 24 | (extData[idOffset + 1] ?? 0) << 16 | (extData[idOffset + 2] ?? 0) << 8 | (extData[idOffset + 3] ?? 0);
+					idOffset += 4;
+					identities.push({
+						identity,
+						obfuscatedTicketAge: age >>> 0
+					});
 				}
-				extensions.push({
+				if (idOffset === extData.length && dataLen === extData.length + 35) extensions.push({
 					kind: "pre_shared_key",
 					identities,
-					binders
+					binders: [],
+					truncatedPreBinder: true
 				});
+				else {
+					if (idOffset + 2 > extData.length) return {
+						ok: false,
+						description: "decode_error"
+					};
+					const binderListLen = readUint16(extData, idOffset);
+					idOffset += 2;
+					if (idOffset + binderListLen !== extData.length) return {
+						ok: false,
+						description: "decode_error"
+					};
+					const binders = [];
+					while (idOffset < extData.length) {
+						const bLen = readUint8(extData, idOffset);
+						idOffset += 1;
+						if (idOffset + bLen > extData.length) return {
+							ok: false,
+							description: "decode_error"
+						};
+						binders.push(extData.subarray(idOffset, idOffset + bLen));
+						idOffset += bLen;
+					}
+					extensions.push({
+						kind: "pre_shared_key",
+						identities,
+						binders
+					});
+				}
 			}
-		}
-		else if (context === "client_hello" && typeCode === EXTENSION_TYPES.psk_key_exchange_modes) {
+		} else if (context === "client_hello" && typeCode === EXTENSION_TYPES.psk_key_exchange_modes) {
 			if (extData.length < 2) return {
 				ok: false,
 				description: "decode_error"
@@ -760,14 +694,15 @@ const decodeExtensions = (bytes, context = "other", isHrr = false, allowPreBinde
 				kind: "psk_key_exchange_modes",
 				modes: [...extData.subarray(1)]
 			});
-		} else if (typeCode === EXTENSION_TYPES.early_data) if (extData.length === 4) {
-			const maxEarlyDataSize = (extData[0] ?? 0) << 24 | (extData[1] ?? 0) << 16 | (extData[2] ?? 0) << 8 | (extData[3] ?? 0);
-			extensions.push({
-				kind: "early_data",
-				maxEarlyDataSize: maxEarlyDataSize >>> 0
-			});
-		} else extensions.push({ kind: "early_data" });
-		else extensions.push({
+		} else if (typeCode === EXTENSION_TYPES.early_data) {
+			if (extData.length === 4) {
+				const maxEarlyDataSize = (extData[0] ?? 0) << 24 | (extData[1] ?? 0) << 16 | (extData[2] ?? 0) << 8 | (extData[3] ?? 0);
+				extensions.push({
+					kind: "early_data",
+					maxEarlyDataSize: maxEarlyDataSize >>> 0
+				});
+			} else extensions.push({ kind: "early_data" });
+		} else extensions.push({
 			kind: "unknown",
 			typeCode,
 			data: extData
@@ -818,10 +753,13 @@ const encodeHandshakeMessage = (msg) => {
 			body = concat$1(contextBlock, writeUint24(listBytes.length), listBytes);
 			break;
 		}
-		case "certificate_request":
+		case "certificate_request": {
 			typeCode = HANDSHAKE_TYPES.certificate_request;
-			body = concat$1(concat$1(writeUint8(msg.certificateRequestContext.length), msg.certificateRequestContext), encodeExtensions(msg.extensions));
+			const contextBlock = concat$1(writeUint8(msg.certificateRequestContext.length), msg.certificateRequestContext);
+			const extBlock = encodeExtensions(msg.extensions);
+			body = concat$1(contextBlock, extBlock);
 			break;
+		}
 		case "certificate_verify":
 			typeCode = HANDSHAKE_TYPES.certificate_verify;
 			body = concat$1(writeUint16(msg.scheme), writeUint16(msg.signature.length), msg.signature);
@@ -830,10 +768,16 @@ const encodeHandshakeMessage = (msg) => {
 			typeCode = HANDSHAKE_TYPES.finished;
 			body = msg.verifyData;
 			break;
-		case "new_session_ticket":
+		case "new_session_ticket": {
 			typeCode = HANDSHAKE_TYPES.new_session_ticket;
-			body = concat$1(Uint8Array.of(msg.ticketLifetime >>> 24 & 255, msg.ticketLifetime >>> 16 & 255, msg.ticketLifetime >>> 8 & 255, msg.ticketLifetime & 255), Uint8Array.of(msg.ticketAgeAdd >>> 24 & 255, msg.ticketAgeAdd >>> 16 & 255, msg.ticketAgeAdd >>> 8 & 255, msg.ticketAgeAdd & 255), concat$1(writeUint8(msg.ticketNonce.length), msg.ticketNonce), concat$1(writeUint16(msg.ticket.length), msg.ticket), encodeExtensions(msg.extensions));
+			const lifeBytes = Uint8Array.of(msg.ticketLifetime >>> 24 & 255, msg.ticketLifetime >>> 16 & 255, msg.ticketLifetime >>> 8 & 255, msg.ticketLifetime & 255);
+			const ageBytes = Uint8Array.of(msg.ticketAgeAdd >>> 24 & 255, msg.ticketAgeAdd >>> 16 & 255, msg.ticketAgeAdd >>> 8 & 255, msg.ticketAgeAdd & 255);
+			const nonceBlock = concat$1(writeUint8(msg.ticketNonce.length), msg.ticketNonce);
+			const ticketBlock = concat$1(writeUint16(msg.ticket.length), msg.ticket);
+			const extBlock = encodeExtensions(msg.extensions);
+			body = concat$1(lifeBytes, ageBytes, nonceBlock, ticketBlock, extBlock);
 			break;
+		}
 		case "key_update":
 			typeCode = HANDSHAKE_TYPES.key_update;
 			body = Uint8Array.of(msg.requestUpdate ? 1 : 0);
@@ -841,7 +785,6 @@ const encodeHandshakeMessage = (msg) => {
 		case "end_of_early_data":
 			typeCode = HANDSHAKE_TYPES.end_of_early_data;
 			body = /* @__PURE__ */ new Uint8Array(0);
-			break;
 	}
 	return concat$1(writeUint8(typeCode), writeUint24(declaredLength ?? body.length), body);
 };
@@ -930,15 +873,6 @@ const decodeHandshakeMessage = (bytes) => {
 				description: "decode_error"
 			};
 			const legacyVersion = readUint16(body, 0);
-			/**
-			* Two bytes in, and they decide whether the rest is even this message.
-			* RFC 9846 §4.2.3: "A client which receives a TLS 1.3 Server Hello with a
-			* legacy_version value not equal to 0x0303 MUST abort the handshake with a
-			* protocol_version alert." An SSL 3.0 ServerHello has no extensions block
-			* at all, so parsing on gets a decode_error where the honest answer — and
-			* the one that tells a self-hosted user their server is too old — is right
-			* here.
-			*/
 			if (legacyVersion !== 771) return {
 				ok: false,
 				description: "protocol_version"
@@ -1224,49 +1158,11 @@ const decodeHandshakeMessage = (bytes) => {
 		};
 	}
 };
-/**
-* How many trailing octets of a ClientHello the binder list occupies, given one
-* offered identity: a uint16 list length, a uint8 entry length, and the binder.
-*
-* It is the tail of the message because `pre_shared_key` MUST be its last
-* extension (RFC 9846 §4.3.11), and that is the whole reason the truncation
-* §4.3.11.2 asks for needs no parsing to find.
-*/
+/** The tail of the message, since `pre_shared_key` must be last (RFC 9846 §4.3.11): list length, entry length, binder. */
 const binderListLength = (binderLength) => 3 + binderLength;
 /**
-* Builds a production ClientHello per RFC 9846 §4.2.2.
-*/
-/**
-* RFC 7685's padding rule, and how many octets of body it wants — `null` when
-* the message needs no padding at all.
-*
-* §4, *Example Usage*: "if the ClientHello message length is between 256 and
-* 511 bytes, then a padding extension SHOULD be added to make the ClientHello
-* 512 bytes long." The range is not arithmetic, it is a bug: F5 load balancers
-* of a certain vintage hang on a ClientHello in it, and a mail client that
-* dials whatever host a user names meets middleboxes nobody chose.
-*
-* **The extension is not free, which is what the `- 4` is.** §4: "Note that a
-* padding extension of length zero adds 4 bytes to the ClientHello" — its own
-* type and length fields. So a 509-byte message cannot be padded to exactly 512
-* and takes an empty one instead, landing at 513, out of the range and past the
-* hazard. The zero floor is that case, not a rounding guard.
-*
-* **A retried ClientHello may be padded independently, and that is spelled out
-* rather than inferred.** §4.1.2 lists what a second ClientHello may change from
-* the first and includes "Optionally adding, removing, or changing the length of
-* the `padding` extension [RFC7685]" — so a HelloRetryRequest that alters the
-* key share, and with it the length, does not have to carry the first hello's
-* padding forward. Table 1 gives the extension `CH` and nothing else, so a
-* server echoing it earns `illegal_parameter` from `misplacedExtensionAlert`
-* like any other extension in a message where it is not defined.
-*
-* **This client only reached the range when `signature_algorithms_cert` was
-* added.** Before it, the 84-character hostname BoGo picks for
-* `ClientHelloPadding` produced 255 bytes — one byte short, and `scope.ts`
-* carried a rule saying so and predicting that any further extension would make
-* its premise false. It did: 273. The prediction is the reason this is
-* implemented rather than discovered against a real mail host.
+* RFC 7685 §4: a ClientHello of 256..511 bytes is padded to 512. The extension's own 4-byte header
+* counts, so a 509-byte message takes an empty one and lands at 513.
 */
 const PADDING_TARGET = 512;
 const PADDING_RANGE_START = 256;
@@ -1292,19 +1188,10 @@ const encodeProductionClientHello = (options) => {
 			kind: "signature_algorithms",
 			schemes: (options.signatureSchemes ?? SUPPORTED_SIGNATURE_SCHEMES).map((name) => SIGNATURE_SCHEMES[name])
 		},
-		(
-		/**
-		* NOT derived from `signatureSchemes`, and not configurable with it. That
-		* option is the caller's policy about what may sign a CertificateVerify;
-		* this is a fact about what `@yozz.app/x509` can verify in a chain, and a caller
-		* narrowing the first has said nothing about the second. RFC 9846 §4.3.3 is
-		* why both must be sent: omitting this one makes `signature_algorithms`
-		* answer for certificates too, which is the answer that was wrong.
-		*/
 		{
 			kind: "signature_algorithms_cert",
 			schemes: OFFERED_CERTIFICATE_SIGNATURE_SCHEMES.map((name) => CERTIFICATE_SIGNATURE_SCHEMES[name].code)
-		}),
+		},
 		{
 			kind: "supported_versions",
 			versions: [TLS_VERSION.V1_3],
@@ -1322,12 +1209,6 @@ const encodeProductionClientHello = (options) => {
 		kind: "cookie",
 		cookie: options.cookie
 	});
-	/**
-	* Offered on every ClientHello, resumption in hand or not: RFC 9846 §4.7.1
-	* lets a server decline to issue a ticket to a client that has not said it
-	* can use one, and BoringSSL's server does exactly that. Without it the first
-	* connection never earns the session the second one needs.
-	*/
 	extensions.push({
 		kind: "psk_key_exchange_modes",
 		modes: [PSK_KEY_EXCHANGE_MODES.psk_dhe_ke]
@@ -1340,13 +1221,6 @@ const encodeProductionClientHello = (options) => {
 		}],
 		binders: [new Uint8Array(options.psk.binderLength)]
 	});
-	/**
-	* §4.3.11 puts `pre_shared_key` last, and `bindClientHello` DEPENDS on it: it
-	* cuts a fixed-size tail off the finished message rather than parsing for the
-	* binder list. An extension appended after this point would move that tail, so
-	* the binder would cover the wrong bytes — and the only symptom is a server
-	* refusing a handshake for no stated reason. Cheaper to fail here.
-	*/
 	if (options.psk !== void 0 && extensions.at(-1)?.kind !== "pre_shared_key") throw new Error("pre_shared_key must be the last ClientHello extension");
 	const build = (withExtensions) => encodeHandshakeMessage({
 		kind: "client_hello",
@@ -1360,11 +1234,6 @@ const encodeProductionClientHello = (options) => {
 	const unpadded = build(extensions);
 	const padding = paddingFor(unpadded.length);
 	if (padding === null) return unpadded;
-	/**
-	* BEFORE `pre_shared_key`, which §4.3.11 requires to be last and which
-	* `bindClientHello` reads as a fixed-size tail. Appending after it would move
-	* that tail and the binder would cover the wrong bytes.
-	*/
 	const insertAt = extensions.at(-1)?.kind === "pre_shared_key" ? -1 : extensions.length;
 	return build(extensions.toSpliced(insertAt, 0, {
 		kind: "padding",
@@ -1373,12 +1242,7 @@ const encodeProductionClientHello = (options) => {
 };
 //#endregion
 //#region src/key-schedule.ts
-/**
-* The two suites the spike measured as necessary and sufficient across real mail
-* providers — `posteo.de` takes only the second. `TLS_CHACHA20_POLY1305_SHA256`
-* is deliberately absent: WebCrypto has no ChaCha20, and RFC 9846 keeps it
-* optional.
-*/
+/** `posteo.de` takes only the second. ChaCha20 is absent: WebCrypto has none. */
 const CIPHER_SUITES = {
 	TLS_AES_128_GCM_SHA256: {
 		code: 4865,
@@ -1404,21 +1268,13 @@ const concat = (...parts) => {
 	}
 	return joined;
 };
-/**
-* WebCrypto's types demand a buffer proven not to be shared, which a view into a
-* caller's array cannot prove — the same boundary `@yozz.app/x509`'s verifier copies
-* at, for the same reason. Handshake-sized, and against an HMAC.
-*/
+/** WebCrypto's types want a buffer proven not to be shared, which a view cannot prove. */
 const nonShared$3 = (bytes) => new Uint8Array(bytes);
 const hmac = async (hash, key, message) => new Uint8Array(await crypto.subtle.sign("HMAC", await crypto.subtle.importKey("raw", nonShared$3(key), {
 	name: "HMAC",
 	hash
 }, false, ["sign"]), nonShared$3(message)));
-/**
-* RFC 5869 §2.1. An empty salt means HashLen zero octets — which is also how RFC
-* 8446 §7.1 draws the Early Secret's `0` — and the substitution is not optional:
-* WebCrypto refuses a zero-length HMAC key outright.
-*/
+/** RFC 5869 §2.1. WebCrypto refuses a zero-length HMAC key, so an empty salt becomes HashLen zeros. */
 const hkdfExtract = (suite, salt, ikm) => {
 	const { hash, hashLength } = CIPHER_SUITES[suite];
 	return hmac(hash, salt.length === 0 ? new Uint8Array(hashLength) : salt, ikm);
@@ -1435,72 +1291,31 @@ const hkdfExpand = async (suite, prk, info, length) => {
 	}
 	return output;
 };
-/**
-* The `HkdfLabel` struct of RFC 9846 §7.1 — a uint16 length, then the label
-* under a `tls13 ` prefix and the context, each with a one-octet length. Getting
-* this wrong produces keys that are simply different, so it fails at `Finished`
-* with `decrypt_error` and never nearer the cause.
-*/
+/** RFC 9846 §7.1 `HkdfLabel`. */
 const hkdfLabel = (label, context, length) => {
 	const prefixed = new TextEncoder().encode(`tls13 ${label}`);
 	if (prefixed.length < 7 || prefixed.length > 255) throw new Error(`HkdfLabel label must be 7..255 octets, got ${prefixed.length}: "${label}"`);
 	if (context.length > 255) throw new Error("HkdfLabel context is over 255 octets");
 	return concat(Uint8Array.of(length >> 8, length & 255), Uint8Array.of(prefixed.length), prefixed, Uint8Array.of(context.length), context);
 };
-/**
-* `async` so that a rejected label fails the same way a rejected length does.
-* Without it `hkdfLabel` throws synchronously, as an argument evaluated before
-* the call, and a caller using `.catch()` rather than `await` would miss it.
-*/
+/** `async` so a rejected label rejects the promise rather than throwing synchronously. */
 const hkdfExpandLabel = async (suite, secret, label, context, length) => hkdfExpand(suite, secret, hkdfLabel(label, context, length), length);
 /**
-* RFC 9846 §7.1's `Derive-Secret(Secret, Label, Messages)` — and it takes
-* MESSAGES, hashing them itself, because that is what the RFC's signature says.
-*
-* An earlier shape took the transcript pre-hashed while keeping this name. That
-* invites a handshake author reading the RFC to pass `ClientHello ‖ ServerHello`
-* straight in, which derives a secret that is merely different: every such bug
-* surfaces at `Finished` as `decrypt_error`, nowhere near the cause. Pass
-* nothing for the empty transcript. For the one derivation that takes an EMPTY
-* context rather than `Hash("")` — the `finished` key — use `hkdfExpandLabel`.
+* RFC 9846 §7.1 `Derive-Secret`, taking MESSAGES and hashing them as the RFC's signature does.
+* Pass nothing for the empty transcript; for an empty context (the `finished` key) use `hkdfExpandLabel`.
 */
 const deriveSecret = async (suite, secret, label, ...messages) => hkdfExpandLabel(suite, secret, label, await transcriptHash(suite, ...messages), CIPHER_SUITES[suite].hashLength);
-/** `Transcript-Hash` over the handshake messages as they went on the wire. */
 const transcriptHash = async (suite, ...messages) => new Uint8Array(await crypto.subtle.digest(CIPHER_SUITES[suite].hash, concat(...messages)));
-/**
-* The three Extracts of the schedule, each folding in the one input it exists
-* for. `Derive-Secret(., "derived", "")` between them is the step that is easy
-* to forget, and it hashes the EMPTY transcript rather than the handshake so
-* far.
-*/
+/** The three Extracts. `Derive-Secret(., "derived", "")` between them hashes the EMPTY transcript. */
 const earlySecret = (suite, psk) => hkdfExtract(suite, /* @__PURE__ */ new Uint8Array(0), psk ?? new Uint8Array(CIPHER_SUITES[suite].hashLength));
 const handshakeSecret = async (suite, early, sharedSecret) => hkdfExtract(suite, await deriveSecret(suite, early, "derived"), sharedSecret);
 const masterSecret = async (suite, handshake) => hkdfExtract(suite, await deriveSecret(suite, handshake, "derived"), new Uint8Array(CIPHER_SUITES[suite].hashLength));
 /**
-* RFC 9846 §7.5's `TLS-Exporter`, verbatim:
-*
-* ```
-* TLS-Exporter(label, context_value, key_length) =
-*     HKDF-Expand-Label(Derive-Secret(Secret, label, ""),
-*                       "exporter", Hash(context_value), key_length)
-* ```
-*
-* `Secret` is the `exporter_master_secret`, and the caller holds it because
-* this module never holds a connection. Note the two DIFFERENT hashes: the
-* inner `Derive-Secret` hashes the EMPTY string, which is why it takes no
-* messages, and the outer one hashes the caller's context.
-*
-* **This is the only caller that can reach `hkdfExpand`'s multi-block loop.**
-* Every expansion in a TLS 1.3 schedule is at most one hash length, so T(1) is
-* all a handshake ever runs; an exporter is the one that asks for more, and
-* BoGo asks for 1024 octets — 32 blocks under SHA-256, 16 under SHA-384.
-*
-* `key_length` is bounded by HKDF itself (255 × hashLength) and `hkdfExpand`
-* rejects anything past it, so a caller asking for a megabyte gets an error
-* rather than a truncated key.
+* RFC 9846 §7.5 TLS-Exporter. The only caller that reaches `hkdfExpand`'s multi-block loop, since
+* BoGo asks for 1024 octets.
 */
 const exportKeyingMaterial = async (suite, exporterMaster, label, context, length) => hkdfExpandLabel(suite, await deriveSecret(suite, exporterMaster, label), "exporter", await transcriptHash(suite, context), length);
-/** RFC 9846 §7.3. Both halves come off the same traffic secret. */
+/** RFC 9846 §7.3. */
 const trafficKeys = async (suite, secret) => {
 	const { keyLength, ivLength } = CIPHER_SUITES[suite];
 	const [key, iv] = await Promise.all([hkdfExpandLabel(suite, secret, "key", /* @__PURE__ */ new Uint8Array(0), keyLength), hkdfExpandLabel(suite, secret, "iv", /* @__PURE__ */ new Uint8Array(0), ivLength)]);
@@ -1509,25 +1324,16 @@ const trafficKeys = async (suite, secret) => {
 		iv
 	};
 };
-/** RFC 9846 §4.5.3. The base key is the sender's handshake traffic secret. */
+/** RFC 9846 §4.5.3. */
 const finishedKey = (suite, baseKey) => hkdfExpandLabel(suite, baseKey, "finished", /* @__PURE__ */ new Uint8Array(0), CIPHER_SUITES[suite].hashLength);
-/** Our own `Finished.verify_data`, to send. */
 const verifyData = (suite, key, transcript) => hmac(CIPHER_SUITES[suite].hash, key, transcript);
-/**
-* Their `Finished.verify_data`, to check — through `subtle.verify`, which is
-* constant-time, rather than a byte comparison that is not. Correctness here is
-* free, so there is no reason to spend a timing side channel on it.
-*/
+/** Through `subtle.verify`, which is constant-time. */
 const isVerifyDataValid = async (suite, key, transcript, received) => crypto.subtle.verify("HMAC", await crypto.subtle.importKey("raw", nonShared$3(key), {
 	name: "HMAC",
 	hash: CIPHER_SUITES[suite].hash
 }, false, ["verify"]), nonShared$3(received), nonShared$3(transcript));
 //#endregion
 //#region src/key-share.ts
-/**
-* TLS 1.3 Key Share and Diffie-Hellman Key Exchange (RFC 9846 §4.3.8) over WebCrypto.
-* Supports X25519, secp256r1 (P-256), and secp384r1 (P-384).
-*/
 const nonShared$2 = (bytes) => new Uint8Array(bytes);
 const toBase64Url = (bytes) => {
 	let binary = "";
@@ -1650,7 +1456,6 @@ const bigIntToBytes$1 = (value, byteLength) => {
 	}
 	return bytes;
 };
-/** The generation parameters per group, so the switch below has one arm to read. */
 const GENERATION_ALGORITHMS = {
 	x25519: { name: "X25519" },
 	secp256r1: {
@@ -1683,7 +1488,8 @@ const importPrivateShare = async (group, privateKeyBytes) => {
 			};
 		}
 		case "secp256r1": {
-			const [x, y] = ecScalarMult(bytesToBigInt(privateKeyBytes), P256.G, P256.p);
+			const d = bytesToBigInt(privateKeyBytes);
+			const [x, y] = ecScalarMult(d, P256.G, P256.p);
 			const xBytes = bigIntToBytes$1(x, 32);
 			const yBytes = bigIntToBytes$1(y, 32);
 			const publicKey = concat$1(Uint8Array.of(4), xBytes, yBytes);
@@ -1704,7 +1510,8 @@ const importPrivateShare = async (group, privateKeyBytes) => {
 			};
 		}
 		case "secp384r1": {
-			const [x, y] = ecScalarMult(bytesToBigInt(privateKeyBytes), P384.G, P384.p);
+			const d = bytesToBigInt(privateKeyBytes);
+			const [x, y] = ecScalarMult(d, P384.G, P384.p);
 			const xBytes = bigIntToBytes$1(x, 48);
 			const yBytes = bigIntToBytes$1(y, 48);
 			const publicKey = concat$1(Uint8Array.of(4), xBytes, yBytes);
@@ -1762,48 +1569,15 @@ const deriveSharedSecret = async (group, privateKey, peerPublicKeyBytes) => {
 };
 //#endregion
 //#region src/pinning.ts
-/**
-* RFC 7469 §2.1.1's pin: base64 of SHA-256 over the SubjectPublicKeyInfo DER.
-*
-* A STRING, and that is the load-bearing part. The pin goes into a caller's
-* store, which for YOZZ means it is serialised and read back, and a
-* `Uint8Array` through `JSON.stringify` becomes `{"0":48,"1":89,...}` — an
-* object that revives as something no byte comparison will ever match, so every
-* reconnection reads as a rotation. It is also the format `openssl x509
-* -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary |
-* base64` prints, which is how a user checks a pin out of band.
-*/
+/** RFC 7469 §2.1.1: base64 of SHA-256 over the SPKI DER. A string, so it survives the caller's JSON store. */
 const publicKeyPin = async (subjectPublicKeyInfoDer) => {
 	const digest = await crypto.subtle.digest("SHA-256", new Uint8Array(subjectPublicKeyInfoDer));
 	return btoa(String.fromCharCode(...new Uint8Array(digest)));
 };
 /**
-* A `Validator` that runs another one and then refuses any chain whose leaf key
-* is not the pinned one.
-*
-* The inner validator runs FIRST and its failure is returned untouched. A pin
-* that matched could otherwise carry an expired or unanchored chain through,
-* which would make pinning a way to weaken validation rather than a check on
-* top of it.
-*
-* A mismatch is `rejected-by-policy`, which `@yozz.app/tls` maps to a
-* `certificate_unknown` alert. It deliberately is not one of the codes that
-* name a property of the chain: the chain is fine. Reporting a rotated key as
-* `no-path-to-trust-anchor` would send a user to their CA over a problem that
-* has nothing to do with one.
-*
-* `pin` is required. There is no null-means-allow-anything mode, because that
-* is a pinned validator that silently never fires — a caller with no pin yet
-* passes the unwrapped validator and learns one from the result.
-*
-* **One per connection**, since a pin belongs to a host and the caller is the
-* one holding the store that maps between them. Reusing an instance across
-* hosts refuses the second one, which is the safe direction and still a bug.
-*
-* ONE pin, not a set. HPKP needed a backup pin to stop a browser bricking a
-* site it could not un-pin; a mismatch here asks the user, who can accept. The
-* case that would need a set is a hostname behind independently keyed
-* frontends, and every IP of all nine stage-3 mail hosts serves one key.
+* The inner validator runs first and its failure is returned untouched. A mismatch is
+* `rejected-by-policy`: the chain is fine. `pin` is required; a caller without one passes the
+* unwrapped validator. One instance per connection.
 */
 const pinnedValidator = ({ validator, pin }) => ({
 	name: `${validator.name}+spki-pin`,
@@ -1819,17 +1593,10 @@ const pinnedValidator = ({ validator, pin }) => ({
 });
 //#endregion
 //#region src/record.ts
-/**
-* TLS 1.3 Record Layer (RFC 9846 §5): plaintext and AEAD framing, sealing, and opening.
-*/
 const nonShared$1 = (bytes) => new Uint8Array(bytes);
 /** 2^14 of content, plus the one byte naming its type (RFC 9846 §5.2). */
 const MAX_INNER_PLAINTEXT = 16385;
-/**
-* `TLSPlaintext.length` is `uint16` but RFC 9846 §5.1 caps it at 2^14 — the
-* ceiling every check below and the fragmenting writer in `handshake.ts` share,
-* so a message larger than one record is split rather than refused.
-*/
+/** RFC 9846 §5.1. */
 const MAX_RECORD_PLAINTEXT = 16384;
 const sealPlain = (type, payload, legacyVersion = LEGACY_RECORD_VERSION.STANDARD) => {
 	if (payload.length > 16384) throw new Error("record_overflow");
@@ -1896,12 +1663,13 @@ const sealAead = async (key, iv, seq, type, payload, paddingZeros = 0) => {
 	const aad = Uint8Array.of(CONTENT_TYPES.application_data, 3, 3, ciphertextLength >> 8 & 255, ciphertextLength & 255);
 	const nonce = buildNonce(iv, seq);
 	const cryptoKey = key instanceof CryptoKey ? key : await crypto.subtle.importKey("raw", nonShared$1(key), { name: "AES-GCM" }, false, ["encrypt"]);
-	return concat$1(aad, new Uint8Array(await crypto.subtle.encrypt({
+	const ciphertextWithTag = new Uint8Array(await crypto.subtle.encrypt({
 		name: "AES-GCM",
 		iv: nonce,
 		additionalData: aad,
 		tagLength: 128
-	}, cryptoKey, nonShared$1(innerPlaintext))));
+	}, cryptoKey, nonShared$1(innerPlaintext)));
+	return concat$1(aad, ciphertextWithTag);
 };
 const openAead = async (key, iv, seq, record) => {
 	if (record.length < 5) return {
@@ -1921,14 +1689,6 @@ const openAead = async (key, iv, seq, record) => {
 		ok: false,
 		description: "decode_error"
 	};
-	/**
-	* The one place the version is NOT ignored, and §5.2 is why: on a
-	* TLSCiphertext "the legacy_record_version field is always 0x0303... there
-	* are no historical compatibility concerns where other values might be
-	* received". A ciphertext is never the initial ClientHello, so 0x0301 is not
-	* a case either — §5.1's "MUST be ignored" governs the PLAINTEXT field, which
-	* `openPlain` and `RecordReader` duly ignore.
-	*/
 	if ((v0 << 8 | v1) !== LEGACY_RECORD_VERSION.STANDARD) return {
 		ok: false,
 		description: "decode_error"
@@ -1964,12 +1724,6 @@ const openAead = async (key, iv, seq, record) => {
 			description: "bad_record_mac"
 		};
 	}
-	/**
-	* RFC 9846 §5.2: content is capped at 2^14, and the inner plaintext is that
-	* plus the one content-type byte. Padding does NOT buy room — checking the
-	* content alone lets 2^14 of it through with padding stacked on top, which is
-	* the record BoGo's `LargePlaintext-TLS13-Padded-16384-1` sends.
-	*/
 	if (innerPlaintext.length > MAX_INNER_PLAINTEXT) return {
 		ok: false,
 		description: "record_overflow"
@@ -2052,86 +1806,14 @@ var RecordReader = class {
 };
 //#endregion
 //#region src/session.ts
-/**
-* Session resumption — RFC 9846 §2.2, §4.3.11 and §4.7.1.
-*
-* A `NewSessionTicket` is not a session. It NAMES one: the secret it stands for
-* is derived from the connection that issued it, and the ticket itself is an
-* opaque label the server chose. So this module turns a ticket plus the
-* issuing connection's resumption master secret into a value a caller can
-* store, and computes the binder that proves, on the next connection, that we
-* hold the secret rather than merely the label.
-*
-* Nothing here reads or writes a record, and nothing here decides when to
-* resume — the handshake supplies the transcript and asks. That is what lets
-* every rule about whether a ticket is usable live here, stated once, rather
-* than at each of the sites that would otherwise have to remember them: two
-* that decide a ticket is not a session at all, and four that decide a stored
-* one may not go on the wire today.
-*/
-/**
-* **Both `Date` fields are real `Date`s, and a caller that persists a session
-* has to revive them.** JSON turns them into strings, and this module reads them
-* with `.getTime()` — a rehydrated string would throw out of `startTls` rather
-* than being refused. The store is the caller's, so the revival is too.
-*/
-/**
-* RFC 9846 §4.7.1: "Servers MUST NOT use any value greater than 604800 seconds
-* (7 days)", and "Clients MUST NOT use tickets for longer than 7 days after
-* issuance, regardless of the ticket_lifetime". A server that sends more has not
-* earned a fatal alert — the RFC names none — so the ceiling is applied on the
-* way in and the session is simply shorter-lived than the server hoped.
-*/
+/** RFC 9846 §4.7.1: 7 days, applied on the way in rather than as an alert. */
 const MAX_TICKET_LIFETIME_SECONDS = 604800;
-/**
-* How long a chain of tickets may outlive the handshake that authenticated it.
-*
-* RFC 9846 §4.7.1 asks for a limit and says what it should weigh: "the lifetime
-* of the peer's certificate, the likelihood of intervening revocation, and the
-* time since the peer's online CertificateVerify signature". Two of those three
-* are sharp here — v1 checks no revocation at all, so a compromised key is only
-* ever noticed by a chain being rebuilt, and public mail leaves rotate every
-* 60-90 days. So the ceiling is the same week a single ticket gets: resumption
-* stops until a full handshake proves the peer again, which for a client that
-* reconnects daily costs one handshake in seven.
-*/
+/** RFC 9846 §4.7.1's recommended limit on renewed keying material. v1 checks no revocation, so a week. */
 const MAX_AUTHENTICATION_AGE_SECONDS = 604800;
-/**
-* The largest ticket this client will keep.
-*
-* `opaque ticket<1..2^16-1>` allows 65535, and the ClientHello it would ride
-* back in declares its extensions with a uint16 too — so a ticket near that
-* ceiling cannot be ENCODED, and the throw lands on the connection AFTER the one
-* that received it, out of a session the caller has already stored. A ticket the
-* next ClientHello cannot carry is not a session, and refusing it here is the
-* only place that decision is made once.
-*
-* 16KiB is far above anything real: RFC 8448's ticket is 178 octets, and
-* OpenSSL and BoringSSL mint a few hundred. It coincides with a record's
-* capacity and is not derived from it — the limit being dodged is the uint16
-* extension block, roughly four times larger. A ticket at this ceiling still
-* overruns one record, which is what keeps the fragmenting writer exercised.
-*/
+/** A ticket must ride back inside a uint16 extension block. Real tickets are a few hundred octets. */
 const MAX_TICKET_BYTES = 16384;
-/**
-* RFC 9846 §4.7.1's `PSK = HKDF-Expand-Label(resumption_secret, "resumption",
-* ticket_nonce, Hash.length)` — 9846 renamed it, and 8446's
-* `resumption_master_secret` appears nowhere in the newer document — or
-* `undefined` for a ticket that
-* could never be used, which is a different thing from one that has expired
-* since. Both live here because both are properties of the ticket's own fields,
-* and a caller handed a session it can never offer has been given a liability to
-* store rather than a session.
-*/
+/** RFC 9846 §4.7.1's `PSK`, or `undefined` for a ticket that could never be used. */
 const sessionFromTicket = async ({ serverName, expectedPeerName, suite, resumptionSecret, receivedAt, authenticatedAt, peerSignatureScheme, peerCertificateChain, ticket, ticketNonce, ticketAgeAdd, ticketLifetime }) => {
-	/**
-	* Three ways a ticket is not a session at all: no window to be used in, too
-	* large to ride back in a ClientHello, or behind a certificate check already
-	* past the ceiling — the last of which a long-held `IDLE` connection reaches
-	* on its own, renewing on day 8 of a chain that started at day 0. Refusing
-	* here rather than only at `isSessionOfferable` is the difference between a
-	* caller storing nothing and a caller storing a liability.
-	*/
 	if (ticketLifetime === 0 || ticket.length > MAX_TICKET_BYTES || !isWithinAuthenticationCeiling(authenticatedAt, receivedAt)) return;
 	return {
 		serverName,
@@ -2147,70 +1829,23 @@ const sessionFromTicket = async ({ serverName, expectedPeerName, suite, resumpti
 		preSharedKey: await hkdfExpandLabel(suite, resumptionSecret, "resumption", ticketNonce, CIPHER_SUITES[suite].hashLength)
 	};
 };
-/**
-* `| undefined` because the argument is a rehydrated value wearing a type, and
-* a store that dropped the field entirely is the first thing this has to
-* survive rather than throw on.
-*/
+/** `| undefined`: a rehydrated value wearing a type. */
 const isDerChain = (chain) => chain?.leafDer instanceof Uint8Array && Array.isArray(chain.intermediateDer) && chain.intermediateDer.every((der) => der instanceof Uint8Array);
 /**
-* The two fields a `TlsSession` carries that TypeScript cannot vouch for, and
-* the ONE place that decides they are usable.
-*
-* A session is a value the caller stored and revived, so its type is a claim
-* rather than a fact. JSON is the ordinary way it becomes false: a
-* `SignatureScheme` comes back as a string that is no longer a scheme we
-* implement, and a `Uint8Array` comes back as `{"0":48,...}` — or the field is
-* simply gone. Neither is visible to the compiler and both are typed correctly.
-*
-* **It throws where it is CALLED FROM that matters, and that is `startTls`,
-* before a byte goes out.** A cross-model review found this check living only
-* in `inheritedAuthentication`, which runs after the client's Finished — so a
-* store that had dropped the chain reached `validatePath` with `undefined` and
-* came back out of `startTls` as a raw `TypeError`, mid-handshake, where every
-* other failure in the package is a typed `TlsFailure`. Two other shapes were
-* worse than that one: a JSON-revived chain reached `validatePath` and was
-* refused as `malformed-certificate`, blaming the mail host for a broken store,
-* and with `reverifyOnResume: false` the throw landed AFTER the handshake
-* completed on the wire.
-*
-* It throws rather than returning a `TlsFailure` because it is the CALLER's
-* bug, not the peer's — the same reason an empty `supportedGroups` throws.
+* A revived session's type is a claim: JSON turns a scheme into an arbitrary string and a byte
+* array into an object. Called from `startTls` before a byte goes out; throws because a broken
+* store is the caller's bug, not the peer's.
 */
 const assertUsableSession = (session) => {
 	if (!SUPPORTED_SIGNATURE_SCHEMES.includes(session.peerSignatureScheme)) throw new Error("the stored session names no signature scheme this client implements");
 	if (!isDerChain(session.peerCertificateChain)) throw new Error("the stored session carries no usable peer certificate chain");
 };
 /**
-* What the connection ABOUT TO MINT A TICKET should record — and the reason it
-* lives here rather than inline in the handshake.
-*
-* A resumed handshake verifies no SIGNATURE: no Certificate, no
-* CertificateVerify. (It may re-validate the stored chain — `reverifyOnResume`
-* in `handshake.ts` — which is a different claim and does not re-prove the
-* signature.) So it INHERITS, and inheriting is load-bearing. `authenticatedAt` is what
-* `isWithinAuthenticationCeiling` above measures against, and RFC 9846 §4.7.1
-* is explicit about why the measurement exists: "it is possible to continue
-* issuing new tickets which indefinitely extend the lifetime of the keying
-* material originally derived from an initial non-PSK handshake". Take a fresh
-* instant here and every renewed ticket looks newly authenticated, the ceiling
-* never bites, and resumption to a peer outlives the one signature that ever
-* proved it — which in v1 nothing else would catch, because v1 checks no
-* revocation at all.
-*
-* That failure is invisible: the handshake succeeds, the data flows, and the
-* only symptom is a limit silently not applying. It is extracted so the rule
-* has somewhere to be tested, because no peer this package can drive mints a
-* ticket on a resumed connection — see the call site in `handshake.ts`.
+* A resumed handshake verifies no signature, so a ticket it mints inherits the original
+* authentication. A fresh instant here would defeat `MAX_AUTHENTICATION_AGE_SECONDS` silently.
 */
 const inheritedAuthentication = (resumed, verifiedNow) => {
 	if (resumed !== void 0) {
-		/**
-		* The same rehydration check `startTls` already ran on the way in, because
-		* this function is reachable without it: it is exported, unit-tested
-		* directly, and is where the renewal rule is stated. Running it twice costs
-		* two comparisons and removes the question of which caller is responsible.
-		*/
 		assertUsableSession(resumed);
 		const { authenticatedAt, peerSignatureScheme, peerCertificateChain } = resumed;
 		return {
@@ -2227,70 +1862,32 @@ const isWithinAuthenticationCeiling = (authenticatedAt, now) => {
 	return age >= 0 && age < MAX_AUTHENTICATION_AGE_SECONDS * 1e3;
 };
 const ticketAgeMs = (session, now) => now.getTime() - session.receivedAt.getTime();
-/**
-* RFC 9846 §4.3.11.1: the age we report is the real age in milliseconds plus
-* the server's own random offset, modulo 2^32. The offset is what stops a
-* passive observer tying two connections together by their ticket ages.
-*/
+/** RFC 9846 §4.3.11.1: age in milliseconds plus the server's offset, modulo 2^32. */
 const obfuscatedTicketAge = (session, now) => (ticketAgeMs(session, now) + session.ticketAgeAdd) % 4294967296;
-/**
-* DNS names are case-insensitive, so a caller that round-trips a hostname
-* through anything case-normalising would otherwise silently stop resuming.
-*
-* The fold is `@yozz.app/x509`'s own, imported rather than rewritten: it maps A-Z
-* and nothing else, which is exact for an LDH hostname. `String.toLowerCase()`
-* is full Unicode and would WIDEN this comparison — KELVIN SIGN folds to `k` —
-* in a security check whose sibling package refuses to normalise anything it
-* does not have to. An IP is compared as written.
-*/
+/** `asciiLower`, not `toLowerCase`: KELVIN SIGN folds to `k` under Unicode, which would widen a security check. */
 const isSamePeerName = (a, b) => {
 	if (a === null || b === null) return a === b;
 	if (a.kind !== b.kind) return false;
 	return a.kind === "dns" ? asciiLower(a.value) === asciiLower(b.value) : a.value === b.value;
 };
 /**
-* Whether a stored session may still go on the wire.
-*
-* The identity checks come first and they are the load-bearing ones: a resumed
-* handshake proves nothing about who the peer is, so the session may only be
-* offered on a connection asking for exactly the identity the issuing
-* connection proved. Same host, and the same `expectedPeerName` policy — an
-* unset one and a `null` one are different answers, and neither may stand in
-* for the other.
-*
-* Then two clocks, because a ticket has two ages. Its own, which the server set
-* a lifetime on; and the age of the CERTIFICATE CHECK behind it, which renewal
-* would otherwise extend forever (§4.7.1). A negative age fails both: it encodes
-* as a huge `obfuscated_ticket_age`, which a server doing 0-RTT anti-replay
-* reads as a replayed ticket.
+* Identity first: a resumed handshake proves nothing about the peer. Then two clocks, the
+* ticket's own age and the age of the certificate check behind it. A negative age would encode
+* as a huge `obfuscated_ticket_age`.
 */
 const isSessionOfferable = (session, serverName, expectedPeerName, now) => {
 	const age = ticketAgeMs(session, now);
 	return asciiLower(session.serverName) === asciiLower(serverName) && isSamePeerName(session.expectedPeerName, expectedPeerName) && age >= 0 && age < session.lifetimeSeconds * 1e3 && isWithinAuthenticationCeiling(session.authenticatedAt, now);
 };
 /**
-* RFC 9846 §4.3.11.2's `PskBinderEntry`, "computed in the same way as the
-* Finished message but with the BaseKey being the binder_key".
-*
-* The transcript it runs over is the handshake so far ending in a TRUNCATED
-* ClientHello — everything up to and including the identity list, with the
-* binder list itself cut off. After a HelloRetryRequest that is three messages
-* (`message_hash`, the retry, the truncated second ClientHello), not one, which
-* is why this takes the whole transcript rather than a single message.
+* RFC 9846 §4.3.11.2, over the transcript ending in a truncated ClientHello. After a
+* HelloRetryRequest that is three messages, hence the whole transcript rather than one.
 */
 const pskBinder = async (session, ...transcript) => {
 	const binderKey = await deriveSecret(session.suite, await earlySecret(session.suite, session.preSharedKey), "res binder");
 	return verifyData(session.suite, await finishedKey(session.suite, binderKey), await transcriptHash(session.suite, ...transcript));
 };
-/**
-* The same ClientHello with its binder filled in.
-*
-* The binder covers the message it travels in, so it cannot be written by the
-* pass that lays the message out — the bytes have to exist first, with the
-* binder's own space zeroed, and then be overwritten. `precedingMessages` is
-* the handshake before this ClientHello: empty for the first one, and the
-* `message_hash` plus the HelloRetryRequest for a retried one.
-*/
+/** The binder covers the message it travels in, so the bytes exist first with the binder zeroed. */
 const bindClientHello = async (session, clientHello, precedingMessages) => {
 	const binderLength = CIPHER_SUITES[session.suite].hashLength;
 	const truncated = clientHello.subarray(0, clientHello.length - binderListLength(binderLength));
@@ -2301,9 +1898,6 @@ const bindClientHello = async (session, clientHello, precedingMessages) => {
 };
 //#endregion
 //#region src/transcript.ts
-/**
-* TLS 1.3 Running Transcript and Transcript Hash (RFC 9846 §4.1).
-*/
 var Transcript = class {
 	suite;
 	messages = [];
@@ -2314,11 +1908,7 @@ var Transcript = class {
 	add(message) {
 		this.messages.push(message);
 	}
-	/**
-	* RFC 9846 §4.1:
-	* When a HelloRetryRequest is sent or received, the transcript is reconstructed as:
-	* message_hash (type 254) || uint24(Hash.length) || Hash(ClientHello1)
-	*/
+	/** RFC 9846 §4.1: after a HelloRetryRequest, ClientHello1 becomes `message_hash || uint24(Hash.length) || Hash(ClientHello1)`. */
 	async replaceClientHello1WithMessageHash() {
 		if (this.hasReplacedClientHello1) throw new Error("replaceClientHello1WithMessageHash may be called only once");
 		if (this.messages.length === 0) throw new Error("No ClientHello1 in transcript to replace");
@@ -2338,9 +1928,6 @@ var Transcript = class {
 };
 //#endregion
 //#region src/verify.ts
-/**
-* CertificateVerify signature verification and leaf public key importing (RFC 9846 §4.5.2).
-*/
 const nonShared = (bytes) => new Uint8Array(bytes);
 const parseOid = (bytes) => {
 	if (bytes.length === 0) return "";
@@ -2400,7 +1987,9 @@ const derToP1363 = (derSignature, scalarLength) => {
 	if (rNode === void 0 || sNode === void 0) throw new Error("ECDSA signature missing r or s");
 	const rBigInt = decodeInteger(rNode);
 	const sBigInt = decodeInteger(sNode);
-	return concat$1(bigIntToBytes(rBigInt, scalarLength), bigIntToBytes(sBigInt, scalarLength));
+	const rBytes = bigIntToBytes(rBigInt, scalarLength);
+	const sBytes = bigIntToBytes(sBigInt, scalarLength);
+	return concat$1(rBytes, sBytes);
 };
 const importLeafKey = async (spkiDer, scheme, algorithmOid) => {
 	const algorithm = getSpkiAlgorithm(spkiDer);
@@ -2409,12 +1998,6 @@ const importLeafKey = async (spkiDer, scheme, algorithmOid) => {
 		ok: false,
 		description: "bad_certificate"
 	};
-	/**
-	* §4.3.3 names the two RSA-PSS families apart: `rsa_pss_rsae_*` are
-	* "RSASSA-PSS algorithms with public key OID rsaEncryption", and an
-	* id-RSASSA-PSS key belongs to `rsa_pss_pss_*`, which this client does not
-	* offer. Accepting both OIDs here took a key the scheme forbids.
-	*/
 	const requiredCurveOid = SCHEME_CURVE_OIDS[scheme];
 	if (requiredCurveOid !== void 0 && algorithm !== void 0 && algorithm.curveOid !== requiredCurveOid) return {
 		ok: false,
@@ -2506,7 +2089,9 @@ const importLeafKey = async (spkiDer, scheme, algorithmOid) => {
 const verifyCertificateVerify = async (options) => {
 	const keyRes = await importLeafKey(options.spkiDer, options.scheme, options.algorithmOid);
 	if (!keyRes.ok) return keyRes;
-	const signedData = concat$1((/* @__PURE__ */ new Uint8Array(64)).fill(32), new TextEncoder().encode("TLS 1.3, server CertificateVerify"), Uint8Array.of(0), options.transcriptHash);
+	const prefix = (/* @__PURE__ */ new Uint8Array(64)).fill(32);
+	const context = new TextEncoder().encode("TLS 1.3, server CertificateVerify");
+	const signedData = concat$1(prefix, context, Uint8Array.of(0), options.transcriptHash);
 	let isValid = false;
 	try {
 		switch (options.scheme) {
@@ -2566,68 +2151,22 @@ const verifyCertificateVerify = async (options) => {
 };
 //#endregion
 //#region src/handshake.ts
-/**
-* TLS 1.3 Handshake State Machine and Connection Management (RFC 9846 §4, App. E.4).
-*/
-/**
-* How large a handshake message we will buffer.
-*
-* `Handshake.length` is a uint24, so the RFC's own ceiling is 16MB — which is
-* 16MB a peer can make us hold before we are able to check a single byte of it.
-* The cap is ours to choose, and 16KB was too small: BoGo's `LargeMessage`
-* sends a 51-certificate chain of about 23KB and expects it to arrive, and a
-* real chain of ML-DSA certificates would be larger still.
-*/
+/** The uint24 allows 16 MB. BoGo's `LargeMessage` sends a 23 KB chain and expects it to arrive. */
 const MAX_HANDSHAKE_MESSAGE_BODY = 65536;
 /**
-* Ceilings on records that carry the conversation nowhere.
-*
-* TLS 1.3 sets none of these. A peer may send zero-length application records
-* as a traffic-analysis countermeasure (RFC 9846 §5.4), `user_canceled` alerts
-* are warnings to be ignored (§6.1), and `KeyUpdate` has no rate — so a peer
-* that sends any of them forever costs us everything and itself nothing. The
-* numbers are BoringSSL's, adopted exactly because BoGo pins them from both
-* sides: 32 empty fragments must pass and 33 must fail, 4 `user_canceled` must
-* pass and 5 must fail.
-*
-* All three count CONSECUTIVE occurrences and reset the moment a byte of
-* application data is delivered — BoringSSL's own rule, in as many words:
-* "Only when at least one byte is returned, clear the counters for empty
-* records and warnings" (`ssl/tls_record.cc`), with `key_update_count` cleared
-* on delivered data in `ssl/ssl_lib.cc`. Counting them over the connection's
-* LIFETIME instead would kill a perfectly ordinary IMAP session on its 33rd
-* rekey, hours in, which is exactly the connection this client is for.
+* TLS 1.3 bounds none of these; the numbers are BoringSSL's, which BoGo pins from both sides. They
+* count CONSECUTIVE occurrences and reset on delivered application data, so a long IMAP session
+* survives its 33rd rekey.
 */
 const MAX_CONSECUTIVE_EMPTY_RECORDS = 32;
 const MAX_WARNING_ALERTS = 4;
 const MAX_KEY_UPDATES = 32;
-/**
-* `NewSessionTicket` belongs on that list too, and BoGo pins no number for it,
-* so this one is ours. It is the same shape of abuse — a post-handshake message
-* a peer may send at will, which `read()` answers by looping instead of
-* returning — with a sharper edge than the others: each ticket now costs an HKDF
-* expansion AND a call into the caller's own storage. A peer that sends them
-* forever starves the read the application is waiting on.
-*
-* 32 is far above anything real. OpenSSL, BoringSSL and Node all send two.
-*/
+/** BoGo pins none; each ticket costs an HKDF expansion and a call into the caller's store. Real servers send two. */
 const MAX_CONSECUTIVE_SESSION_TICKETS = 32;
 /**
-* What the server may answer with, per message.
-*
-* RFC 9846 §4.3 is flat about it: an endpoint MUST NOT send an extension
-* response the peer did not request, and one that arrives anyway is fatal —
-* `unsupported_extension`. So the test is TWO things at once, and both matter:
-* the extension has to be one we actually offered, AND one defined for the
-* message it turned up in.
-*
-* Matched by TYPE CODE rather than by our decoder's `kind`, because everything
-* we do not model decodes to `unknown` and two different unknowns would
-* otherwise look alike.
-*
-* The lists are RFC 9846 §4.3's table, plus RFC 8449's `record_size_limit`.
-* A `CertificateEntry` carries only responses to offers this client does not
-* make, so in practice nothing may appear there at all.
+* RFC 9846 §4.3: a response to an offer we never made is `unsupported_extension`; an offered one in
+* a message where it is not defined is `illegal_parameter`. Matched by type code, since every
+* unmodelled extension decodes alike. §4.3's table plus RFC 8449's `record_size_limit`.
 */
 const PERMITTED_IN_SERVER_HELLO = [
 	41,
@@ -2649,49 +2188,15 @@ const PERMITTED_IN_ENCRYPTED_EXTENSIONS = [
 const PERMITTED_IN_CERTIFICATE_ENTRY = [5, 18];
 /** A HelloRetryRequest's cookie answers no offer — the server starts that one. */
 const COOKIE = 44;
-/**
-* How large a cookie we will echo back.
-*
-* A ClientHello's extensions are `Extension extensions<8..2^16-1>` — the whole
-* BLOCK is a uint16 — and a cookie is `opaque cookie<1..2^16-1>` chosen by the
-* server. So a cookie near its own legal maximum makes a ClientHello that CANNOT
-* BE ENCODED at all, by anyone; the limit is the wire format's, not ours, and
-* fragmenting records does not touch it.
-*
-* That draws the line this file follows: an input the PEER sizes gets a typed
-* failure, an input the CALLER sizes is allowed to throw. A ticket is bounded
-* where it is stored (`MAX_TICKET_BYTES`), and the cookie here — 16KiB leaves
-* room for the largest ticket we keep and every other extension several times
-* over. Real cookies are tens of bytes; they carry a server's stateless retry
-* state, not data.
-*/
+/** A cookie near its legal maximum makes a ClientHello the uint16 extension block cannot encode. Real cookies are tens of bytes. */
 const MAX_ECHOED_COOKIE_BYTES = 16384;
-/**
-* A HelloRetryRequest is NOT a ServerHello for this purpose.
-*
-* RFC 9846's Table 1 gives each extension the messages it may appear in, and HRR
-* is a column of its own: `supported_versions` and `key_share` are `CH, SH, HRR`
-* and `cookie` is `CH, HRR`, while `pre_shared_key` is `CH, SH` — excluded from
-* the retry on purpose. Reusing the ServerHello list plus a cookie was right
-* until this client offered a PSK; from then on 41 was in the offered set AND in
-* the permitted one, so a retry carrying `pre_shared_key` passed both halves of
-* the check and was silently ignored. §4.3 makes it `illegal_parameter`.
-*/
+/** RFC 9846 Table 1 gives HRR its own column: `pre_shared_key` is `CH, SH` only. */
 const PERMITTED_IN_HELLO_RETRY_REQUEST = [
 	43,
 	COOKIE,
 	51
 ];
 const extensionTypeCode = (extension) => extension.kind === "unknown" ? extension.typeCode : EXTENSION_TYPES[extension.kind];
-/**
-* Which alert a server extension has earned, if any. RFC 9846 §4.3 draws a line
-* between two failures that look alike and are not:
-*
-*  - an extension we never offered is a response to nothing —
-*    `unsupported_extension`;
-*  - an extension we DID offer, turning up in a message where that extension is
-*    not defined, is a misplaced one — `illegal_parameter`.
-*/
 const misplacedExtensionAlert = (extensions, offered, permitted) => {
 	for (const extension of extensions) {
 		const code = extensionTypeCode(extension);
@@ -2710,14 +2215,7 @@ const suiteFromCode = (code) => {
 	if (code === 4865) return "TLS_AES_128_GCM_SHA256";
 	if (code === 4866) return "TLS_AES_256_GCM_SHA384";
 };
-/**
-* What a session looks like in a ClientHello, with the binder still to come.
-*
-* The caller passes the instant rather than this reading a clock, because the
-* two ClientHellos want different answers: the first is built from the same
-* reading that decided the session was offerable at all, and the retried one
-* from a fresh reading, which RFC 9846 §4.2.2 asks for in as many words.
-*/
+/** The caller passes the instant: a retried ClientHello wants a fresh reading (RFC 9846 §4.2.2). */
 const pskOffer = (session, now) => session === void 0 ? void 0 : {
 	identity: session.ticket,
 	obfuscatedTicketAge: obfuscatedTicketAge(session, now),
@@ -2728,54 +2226,16 @@ const rebindTranscript = (suite, previous) => {
 	for (const message of previous.getMessages()) next.add(message);
 	return next;
 };
-/**
-* A ClientHello as records, fragmented if it does not fit in one.
-*
-* RFC 9846 §5.1 allows it — "Handshake messages MAY be coalesced into a single
-* TLSPlaintext record or fragmented across several records" — and this client
-* needs it, because two of the things that go INTO a ClientHello are sized by
-* the peer. A ticket is `opaque ticket<1..2^16-1>` (§4.7.1) and comes back as
-* the PSK identity; a HelloRetryRequest cookie is `opaque cookie<1..2^16-1>`
-* (§4.3.2) and comes back echoed. Either at its legal maximum overruns a single
-* record, and `sealPlain` answers that by THROWING — so a server could hand us a
-* 16KB ticket and poison the next connection before a byte went out.
-*
-* The legacy record version rides on every fragment: §5.1 deprecates the field
-* and requires it ignored, so the only thing that matters is the middlebox
-* compatibility the first ClientHello's 0x0301 buys, and a fragment of that
-* message is still that message.
-*/
+/** RFC 9846 §5.1 allows fragmenting, and a peer-sized ticket or cookie can overrun one record. */
 const clientHelloRecords = (message, legacyVersion) => Array.from({ length: Math.ceil(message.length / MAX_RECORD_PLAINTEXT) }, (_, index) => sealPlain("handshake", message.subarray(index * MAX_RECORD_PLAINTEXT, (index + 1) * MAX_RECORD_PLAINTEXT), legacyVersion));
-/**
-* The state machine, with the replay hooks as a second argument. Exported for
-* `replay.ts` and for nothing else, which `index.test.ts` enforces by name: the
-* import guard on `replay.ts` cannot see a production file that reaches past it
-* to here.
-*/
+/** Exported for `replay.ts` only, which `index.test.ts` enforces. */
 const runHandshake = async (options, replay) => {
 	const { transport, serverName } = options;
 	const now = options.now ?? (() => /* @__PURE__ */ new Date());
-	/**
-	* The identity the chain is checked against, resolved once. It is what the
-	* session is bound to, so it has to be the SAME expression the validator is
-	* given — computing it twice is how the two come to disagree.
-	*/
 	const expectedPeerName = options.expectedPeerName !== void 0 ? options.expectedPeerName : {
 		kind: "dns",
 		value: serverName
 	};
-	/**
-	* Before a byte goes out, and deliberately before `isSessionOfferable` gets a
-	* say. A session is a value the caller stored and revived, so the two fields
-	* TypeScript cannot vouch for are checked at the door — see
-	* `assertUsableSession`, and the review that moved it here from a call site
-	* one flight too late.
-	*
-	* Unconditional rather than only-if-we-would-offer-it: a session whose shape
-	* did not survive the store is the caller's bug whether or not this
-	* connection would have used it, and finding out on the connection that
-	* happens to match is finding out late.
-	*/
 	if (options.session !== void 0) assertUsableSession(options.session);
 	let transcript = new Transcript();
 	const reader = new RecordReader(() => transport.read());
@@ -2796,29 +2256,12 @@ const runHandshake = async (options, replay) => {
 		};
 	};
 	let clientWriteKeys = null;
-	/**
-	* The compatibility-mode ChangeCipherSpec, owed once we send a non-empty
-	* legacy_session_id and paid exactly once.
-	*
-	* RFC 9846 D.4 puts it "immediately before the second flight", and the second
-	* flight is whatever we protect first: a retried ClientHello, the Finished
-	* flight, or a fatal alert when the handshake ends early. Sending it only
-	* before Finished left every aborted handshake without it, and a peer that
-	* expects a middlebox-friendly stream reads the alert that follows as a
-	* malformed ChangeCipherSpec instead of the alert it is.
-	*/
 	let compatibilityCcsPending = false;
 	const sendCompatibilityCcsIfPending = async () => {
 		if (!compatibilityCcsPending) return;
 		compatibilityCcsPending = false;
 		await transport.write(sealPlain("change_cipher_spec", Uint8Array.of(1)));
 	};
-	/**
-	* A peer that hangs up mid-handshake is a truncated connection, not a bug in
-	* this file. `ByteDuplex.write` rejects when the socket has gone, and letting
-	* that escape turned "the server closed on us" into an unhandled error with a
-	* stack trace where a typed failure belongs.
-	*/
 	const writeToPeer = async (record) => {
 		try {
 			await transport.write(record);
@@ -2860,13 +2303,6 @@ const runHandshake = async (options, replay) => {
 			}
 		};
 	};
-	/**
-	* Every path validation this connection performs, at both the sites that
-	* perform one — the peer's Certificate on a full handshake, and the stored
-	* chain again on a resumed one. Written once because the two must ask the
-	* same question: a re-check under a laxer policy than the original would
-	* report a chain as still good on terms it was never accepted on.
-	*/
 	const validatePeerChain = (chain) => options.validator.validatePath({
 		peerCertificateDer: chain.leafDer,
 		untrustedIntermediateDer: chain.intermediateDer,
@@ -2890,51 +2326,10 @@ const runHandshake = async (options, replay) => {
 			}
 		};
 	};
-	/**
-	* What we offer, and which of them carries the share. The RFC calls the
-	* second one out separately (§4.3.8): a HelloRetryRequest may only move us to
-	* a group we offered and did NOT already share, so both facts are needed.
-	*/
-	/**
-	* COPIED, not aliased. The list is read twice — once for ClientHello1 and
-	* again for the ClientHello a HelloRetryRequest asks for, a full round trip
-	* later — and RFC 9846 §4.2.4 requires the second to offer what the first
-	* did. A caller holding a mutable array could otherwise change it in between,
-	* or after the checks below have already passed on it.
-	*/
 	const offeredGroups = [...options.supportedGroups ?? SUPPORTED_GROUPS];
 	const firstOfferedGroup = offeredGroups[0];
 	if (firstOfferedGroup === void 0) throw new Error("supportedGroups must offer at least one group");
-	/**
-	* RFC 9846 §4.3.7: "The `named_group_list` MUST NOT contain any duplicate
-	* entries. A recipient MAY abort a connection with a fatal
-	* `illegal_parameter` alert if it detects a duplicate entry." So a repeat is
-	* a ClientHello a conforming peer may hang up on, and the caller would see it
-	* as an unexplained server-side refusal. It throws rather than returning a
-	* typed failure because it is OUR bug, not the peer's — the same reason the
-	* empty case above does.
-	*/
 	if (new Set(offeredGroups).size !== offeredGroups.length) throw new Error("supportedGroups must not repeat a group");
-	/**
-	* COPIED and checked for the same reasons as the groups above: the list is
-	* read again for the ClientHello a HelloRetryRequest asks for, and again when
-	* the CertificateVerify arrives to decide whether the server signed with
-	* something we offered. §4.3.3 gives `supported_signature_algorithms` a
-	* `<2..2^16-2>` bound, so an empty list is not encodable; a repeat is our bug
-	* either way, which is why both throw rather than returning a typed failure.
-	*
-	* **This one stays the CALLER'S list, where `offeredExtensionCodes` and
-	* `offeredGroupCodes` below are read back off the ClientHello we sent.** Those
-	* two decide whether the server's ANSWER was solicited, and a constant would
-	* refuse the replayed document's own server. This decides whether a SIGNATURE
-	* is one we would accept, and the two diverge in the direction that matters:
-	* if the encoder ever failed to narrow what went out, reading the wire would
-	* make us accept the wider set silently, while reading the option refuses and
-	* the interop failure is visible. The caller's policy binds what we accept
-	* even when the bytes disagree. BoGo holds the wire's half of it — narrow the
-	* offer with `-verify-prefs` and `VerifyPreferences-Advertised` reads the
-	* extension back.
-	*/
 	const offeredSchemes = [...options.signatureSchemes ?? SUPPORTED_SIGNATURE_SCHEMES];
 	if (offeredSchemes.length === 0) throw new Error("signatureSchemes must offer at least one scheme");
 	if (new Set(offeredSchemes).size !== offeredSchemes.length) throw new Error("signatureSchemes must not repeat a scheme");
@@ -2942,15 +2337,9 @@ const runHandshake = async (options, replay) => {
 	let ch1MessageBytes;
 	let sentSessionId;
 	let ch1Random;
-	/** The group our CURRENT share is on — reassigned only by a HelloRetryRequest. */
+	/** Reassigned only by a HelloRetryRequest. */
 	let effectiveGroupName;
-	/**
-	* The session the ClientHello on the wire actually carries — `undefined` when
-	* there is none to offer, when the one we hold is for another host or past its
-	* lifetime, and when a HelloRetryRequest moves us to a hash it cannot bind
-	* under. Everything downstream reads it as "did we ask to resume", so it has
-	* to mean the message we sent rather than the one we considered sending.
-	*/
+	/** The session the ClientHello on the wire carries; a HelloRetryRequest onto another hash unsets it. */
 	let offeredSession;
 	if (replay !== void 0) {
 		const ch1 = replay.clientHelloMessages[0];
@@ -2963,18 +2352,6 @@ const runHandshake = async (options, replay) => {
 		if (!decodedCh1.ok || decodedCh1.value.kind !== "client_hello") throw new Error("Malformed replay ClientHello1");
 		sentSessionId = decodedCh1.value.legacySessionId;
 		ch1Random = decodedCh1.value.random;
-		/**
-		* A replayed trace can be a RESUMED one, and until §4 was driven through
-		* here nothing had noticed: this branch was written for §3 and §5, both full
-		* handshakes, and left `offeredSession` unset. The document's ClientHello
-		* then went out carrying `pre_shared_key` while the state machine believed
-		* it had offered no session, so the server's acceptance answered an offer
-		* this side did not think it had made.
-		*
-		* Gated by `isSessionOfferable` exactly as the production branch is, rather
-		* than taking the caller's session on trust — a replay that offers a session
-		* the rules would have refused proves the wrong thing.
-		*/
 		offeredSession = options.session !== void 0 && isSessionOfferable(options.session, serverName, expectedPeerName, now()) ? options.session : void 0;
 	} else {
 		effectiveGroupName = firstOfferedGroup;
@@ -2995,14 +2372,6 @@ const runHandshake = async (options, replay) => {
 		});
 		if (offeredSession !== void 0) ch1MessageBytes = await bindClientHello(offeredSession, ch1MessageBytes, []);
 	}
-	/**
-	* What we offered, read back off the ClientHello we actually SENT rather than
-	* from the values beside it — the replay path sends RFC 8448's ClientHello,
-	* whose offers are not ours, and a constant here would refuse the document's
-	* own server. That applies to the GROUPS as much as to the extension codes:
-	* `offeredGroups` is what this client would have offered, not what the bytes
-	* on the wire did.
-	*/
 	const [offeredExtensionCodes, offeredGroupCodes] = (() => {
 		const decoded = decodeHandshakeMessage(ch1MessageBytes);
 		if (!decoded.ok || decoded.value.kind !== "client_hello") throw new Error("our own ClientHello does not decode");
@@ -3042,13 +2411,6 @@ const runHandshake = async (options, replay) => {
 			if (record[0] === 23) return failAlert("unexpected_message");
 			const plainRes = openPlain(record);
 			if (!plainRes.ok) return failAlert(plainRes.description);
-			/**
-			* A server that refuses the ClientHello says so with a cleartext alert —
-			* `protocol_version` when it speaks no TLS 1.3, `handshake_failure` when
-			* it shares no cipher. Answering with our own `unexpected_message` threw
-			* away the only sentence in the exchange that says WHY, and a
-			* self-hosted user's report of "unexpected message" is undiagnosable.
-			*/
 			if (plainRes.type === "alert") {
 				const alertRes = decodeAlert(plainRes.payload);
 				if (alertRes.ok) return {
@@ -3081,17 +2443,6 @@ const runHandshake = async (options, replay) => {
 		if (!isSameBytes(msg.legacySessionIdEcho, sentSessionId)) return failAlert("illegal_parameter");
 		const randomSuffix = msg.random.subarray(24);
 		if (isSameBytes(randomSuffix, DOWNGRADE_SENTINEL_TLS_1_2) || isSameBytes(randomSuffix, DOWNGRADE_SENTINEL_TLS_1_1)) return failAlert("illegal_parameter");
-		/**
-		* supported_versions must say 0x0304 — and after a HelloRetryRequest it must
-		* say the SAME thing it said there. RFC 9846 §4.2.4: "The value of
-		* selected_version in the HelloRetryRequest supported_versions extension
-		* MUST be retained in the ServerHello, and a client MUST abort the
-		* handshake with an illegal_parameter alert if the value changes."
-		*
-		* Since 0x0304 is the only value this client ever accepts, "changed" and
-		* "absent or not 0x0304" are the same test; only the alert differs, and
-		* which alert is the whole of what the peer learns.
-		*/
 		const versionsExt = msg.extensions.find((e) => e.kind === "supported_versions");
 		const wrongVersionAlert = hasSeenHrr ? "illegal_parameter" : "protocol_version";
 		if (versionsExt === void 0 || versionsExt.kind !== "supported_versions") return failAlert(wrongVersionAlert);
@@ -3107,44 +2458,12 @@ const runHandshake = async (options, replay) => {
 		const cookieExt = msg.extensions.find((e) => e.kind === "cookie");
 		if (isSameBytes(msg.random, HRR_MAGIC_RANDOM)) {
 			if (hasSeenHrr) return failAlert("unexpected_message");
-			/**
-			* A HelloRetryRequest may ask for a different group, or for a cookie, or
-			* for both — RFC 9846 §4.2.4 requires neither extension on its own. One
-			* that asks for NOTHING is the empty retry, and there is nothing the
-			* second ClientHello could say differently.
-			*/
 			if (keyShareExt === void 0 && cookieExt === void 0) return failAlert("illegal_parameter");
-			/**
-			* A HelloRetryRequest ends the server's flight — the next thing on the
-			* wire is our second ClientHello. Bytes still buffered behind it are the
-			* start of a message the server means to finish AFTER our reply, which
-			* §5.1 does not allow and which would be spliced onto the real
-			* ServerHello when it arrives.
-			*/
 			if (handshakeBuffer.some((chunk) => chunk.length > 0)) return failAlert("unexpected_message");
 			hasSeenHrr = true;
 			hrrSelectedSuite = negotiatedSuite;
-			/**
-			* RFC 9846 §4.2.4: in the updated ClientHello the client "SHOULD NOT offer
-			* any pre-shared keys associated with a hash other than that of the
-			* selected cipher suite". Offering one anyway would be worse than
-			* pointless — the binder is a MAC under the PSK's own hash, so a server
-			* that took it would then key the connection from a schedule the other
-			* hash produced.
-			*/
 			if (offeredSession !== void 0 && CIPHER_SUITES[offeredSession.suite].hash !== CIPHER_SUITES[negotiatedSuite].hash) offeredSession = void 0;
 			if (keyShareExt !== void 0) {
-				/**
-				* RFC 9846 §4.3.8 puts TWO conditions on the retried group, and both are
-				* `illegal_parameter`: it must be one we offered in `supported_groups`,
-				* and it must NOT be the one we already sent a key share for.
-				*
-				* The second is what makes a retry a change. Without it a server can
-				* bounce us back onto the group we already offered a share on — a round
-				* trip that costs us a fresh key and gains the handshake nothing, which
-				* §4.2.4 forbids in as many words: abort "if the HelloRetryRequest would
-				* not result in any change in the ClientHello".
-				*/
 				const selectedCode = keyShareExt.selectedGroup;
 				const selectedGroup = selectedCode === void 0 ? void 0 : namedGroupFromCode(selectedCode);
 				if (selectedCode === void 0 || !offeredGroupCodes.has(selectedCode) || selectedGroup === void 0 || selectedGroup === effectiveGroupName) return failAlert("illegal_parameter");
@@ -3176,13 +2495,6 @@ const runHandshake = async (options, replay) => {
 				});
 				if (offeredSession !== void 0) ch2MessageBytes = await bindClientHello(offeredSession, ch2MessageBytes, transcript.getMessages());
 			}
-			/**
-			* RFC 9846 D.4: in compatibility mode the client sends one dummy
-			* ChangeCipherSpec immediately before its second flight — which is THIS
-			* message when the server retried, and the Finished flight otherwise.
-			* Sending it only before Finished left a retried handshake without the
-			* record the peer was waiting on.
-			*/
 			await sendCompatibilityCcsIfPending();
 			transcript.add(ch2MessageBytes);
 			for (const record of clientHelloRecords(ch2MessageBytes, LEGACY_RECORD_VERSION.STANDARD)) if (!await writeToPeer(record)) return {
@@ -3191,18 +2503,6 @@ const runHandshake = async (options, replay) => {
 			};
 			continue;
 		}
-		/**
-		* RFC 9846 §4.3.11, the server's half of a resumption. Three ways it can be
-		* wrong and each is a different sentence of the RFC:
-		*
-		*  - answering a `pre_shared_key` we did not send is §4.3's response to
-		*    nothing, and the retry that drops a PSK is exactly how a ClientHello
-		*    that offered one comes to be answered by a ServerHello that may not;
-		*  - `selected_identity` is an index into the list we sent, and this client
-		*    sends one identity, so 0 is the only value in range;
-		*  - the suite has to carry the PSK's own hash, or the connection is keyed
-		*    from a schedule the other hash produced.
-		*/
 		const serverPskExt = msg.extensions.find((e) => e.kind === "pre_shared_key");
 		if (serverPskExt !== void 0) {
 			if (offeredSession === void 0) return failAlert("unsupported_extension");
@@ -3210,20 +2510,6 @@ const runHandshake = async (options, replay) => {
 			if (CIPHER_SUITES[offeredSession.suite].hash !== CIPHER_SUITES[selectedSuite].hash) return failAlert("illegal_parameter");
 			resumedSession = offeredSession;
 		}
-		/**
-		* A real ServerHello has to carry the share the key exchange runs on, and
-		* WHICH alert that earns depends on whether a PSK was selected.
-		*
-		* §4.3.11 is one sentence with three clauses — `selected_identity` in range,
-		* a suite whose Hash matches the PSK, "and that a server `key_share`
-		* extension is present if required by the ClientHello
-		* `psk_key_exchange_modes` extension. If these values are not consistent,
-		* the client MUST abort the handshake with an `illegal_parameter` alert."
-		* We offer `psk_dhe_ke` alone, so a selected PSK always requires the share.
-		*
-		* Without a PSK there is no such sentence and the extension is simply the
-		* mandatory one §9.2 is about, which `missing_extension` names.
-		*/
 		if (keyShareExt === void 0) return failAlert(resumedSession !== void 0 ? "illegal_parameter" : "missing_extension");
 		if (keyShareExt.serverShare === void 0) return failAlert("illegal_parameter");
 		if (keyShareExt.serverShare.group !== NAMED_GROUPS[effectiveGroupName]) return failAlert("illegal_parameter");
@@ -3231,12 +2517,6 @@ const runHandshake = async (options, replay) => {
 		realServerHelloBytes = shBytes;
 	}
 	if (negotiatedSuite === void 0 || serverShareKeyExchange === void 0) throw new Error("ServerHello negotiation incomplete");
-	/**
-	* RFC 9846 §5.1: a handshake message may not span a key change, and the keys
-	* change here. Bytes still in the buffer are the start of a message sent in
-	* the clear that the server means to finish under the handshake keys — and
-	* left alone they would be spliced onto the front of the decrypted flight.
-	*/
 	if (handshakeBuffer.some((chunk) => chunk.length > 0)) return failAlert("unexpected_message");
 	transcript.add(realServerHelloBytes);
 	const shareLen = expectedKeyShareLength(effectiveGroupName);
@@ -3270,12 +2550,7 @@ const runHandshake = async (options, replay) => {
 	let cvScheme;
 	let cvSignature;
 	let transcriptHashAtCert;
-	/**
-	* Set by whichever path validation this connection actually performs — the
-	* peer's Certificate on a full handshake, the stored chain on a resumed one
-	* that re-checks. It stays `null` when neither runs, which is the resumption
-	* that trusts what it stored.
-	*/
+	/** Set by whichever path validation ran; `null` on a resumption that trusts what it stored. */
 	let peerPublicKeyPin = null;
 	let emptyRecordsSeen = 0;
 	while (!finReceived) {
@@ -3339,17 +2614,6 @@ const runHandshake = async (options, replay) => {
 			transcript.add(nextMsgBytes);
 			continue;
 		}
-		/**
-		* A resumed handshake is authenticated by the PSK, so RFC 9846 §2.2 sends
-		* neither Certificate nor CertificateVerify — EncryptedExtensions is
-		* followed by Finished and nothing else. Skipping the two branches is what
-		* makes a Certificate that arrives anyway an `unexpected_message`.
-		*
-		* **No chain arrives HERE, which is not the same as no chain being
-		* validated.** The one the session stored is re-validated after this loop
-		* ends, unless `reverifyOnResume` was turned off — see the check below the
-		* `break`.
-		*/
 		if (resumedSession === void 0 && !certReceived) {
 			if (msg.kind === "certificate_request") {
 				certRequestContext = msg.certificateRequestContext;
@@ -3372,28 +2636,6 @@ const runHandshake = async (options, replay) => {
 		if (resumedSession === void 0 && !cvReceived) {
 			if (msg.kind !== "certificate_verify") return failAlert("unexpected_message");
 			cvReceived = true;
-			/**
-			* RFC 9846 §4.5.2: "If the CertificateVerify message is sent by a server,
-			* the signature algorithm MUST be one offered in the client's
-			* `signature_algorithms` extension unless no valid certificate chain can
-			* be produced without unsupported algorithms".
-			*
-			* Checked here, on the message, rather than left to `importLeafKey`'s
-			* unknown-scheme case: that one answers "we cannot verify this", and it
-			* cannot answer "we can verify it but never asked for it" — which is the
-			* one that matters, because a scheme the client withheld is a scheme it
-			* declined, and honouring it anyway would let a server pick an algorithm
-			* out of the set we deliberately shrank.
-			*
-			* Deliberately AHEAD of `validatePath` below, which is where BoringSSL
-			* differs — it validates the chain on the Certificate message, a flight
-			* earlier. So a flight that is both signed with an unoffered scheme and
-			* carries an untrusted chain reports `illegal_parameter` where BoringSSL
-			* would report the certificate. The RFC names no order and no BoGo test
-			* pairs the two faults, so this is not a divergence to record: it is a
-			* message-level parameter check, and it is cheaper than the path build it
-			* would otherwise precede for a signature that can never be accepted.
-			*/
 			const offeredScheme = signatureSchemeFromCode(msg.scheme);
 			if (offeredScheme === void 0 || !offeredSchemes.includes(offeredScheme)) return failAlert("illegal_parameter");
 			cvScheme = offeredScheme;
@@ -3419,22 +2661,6 @@ const runHandshake = async (options, replay) => {
 				transcriptHash: transcriptHashAtCert
 			});
 			if (!cvVerifyRes.ok) return failAlert(cvVerifyRes.description);
-			/**
-			* AFTER the signature, not after the path build. The pin names the key
-			* that authenticated this peer, and until this line the peer has only
-			* sent a chain — which is public, so sending one proves nothing. One
-			* message of difference, and it is the message the whole learn/check
-			* split is about.
-			*
-			* From the validated PATH rather than from `leafCert`, which
-			* CertificateVerify just ran against. They are the same bytes —
-			* `ValidatedPath` carries the leaf's SPKI DER precisely so `tls` need not
-			* parse the certificate twice, and `YOZZ_VALIDATOR`'s path,
-			* `decodeCertificate`'s field and `exportKey('spki')` were compared
-			* directly and agree — and the path is the copy `pinnedValidator`
-			* compares, so sourcing the learn from anywhere else could only introduce
-			* a way for the two halves to disagree.
-			*/
 			peerPublicKeyPin = await publicKeyPin(pathRes.path.leafSubjectPublicKeyInfoDer);
 			transcript.add(nextMsgBytes);
 			continue;
@@ -3449,19 +2675,6 @@ const runHandshake = async (options, replay) => {
 			break;
 		}
 	}
-	/**
-	* The resumed handshake's certificate check, over the chain the session
-	* stored (see `reverifyOnResume`). It runs HERE, one message later than
-	* BoringSSL's `state_server_certificate_reverify`, which sits between
-	* EncryptedExtensions and the server's Finished (`tls13_client.cc`). Ours
-	* waits for that Finished, so the flight is proven to come from the party
-	* holding the pre-shared key before we spend a path build on it. BoGo sees
-	* the same thing either way — a fatal alert where the client's Finished was
-	* due — which is why the placement is a choice rather than a divergence.
-	*
-	* The alert leaves protected, under the handshake key, and takes the
-	* compatibility ChangeCipherSpec with it if one is still owed.
-	*/
 	if (resumedSession !== void 0 && (options.reverifyOnResume ?? true)) {
 		const reverified = await validatePeerChain(resumedSession.peerCertificateChain);
 		if (!reverified.ok) return failValidation(reverified.reason, "session-stored");
@@ -3470,12 +2683,6 @@ const runHandshake = async (options, replay) => {
 	const master = await masterSecret(negotiatedSuite, hsSecret);
 	const c_ap_traffic = await deriveSecret(negotiatedSuite, master, "c ap traffic", ...transcript.getMessages());
 	const s_ap_traffic = await deriveSecret(negotiatedSuite, master, "s ap traffic", ...transcript.getMessages());
-	/**
-	* RFC 9846 §7.1's `exporter_master_secret`, over ClientHello...server
-	* Finished — the SAME transcript as the two traffic secrets above, and one
-	* message short of `res master` below. It is derived here and kept because
-	* the exporter outlives the handshake and the transcript does not.
-	*/
 	const exporterMaster = await deriveSecret(negotiatedSuite, master, "exp master", ...transcript.getMessages());
 	await sendCompatibilityCcsIfPending();
 	if (certRequestContext !== null) {
@@ -3498,9 +2705,10 @@ const runHandshake = async (options, replay) => {
 		};
 	}
 	const cFinKey = await finishedKey(negotiatedSuite, c_hs_traffic);
+	const clientVerifyData = await verifyData(negotiatedSuite, cFinKey, await transcript.hash());
 	const clientFinMsg = encodeHandshakeMessage({
 		kind: "finished",
-		verifyData: await verifyData(negotiatedSuite, cFinKey, await transcript.hash())
+		verifyData: clientVerifyData
 	});
 	transcript.add(clientFinMsg);
 	const sealedFinRecord = await sealAead(clientHsKeys.key, clientHsKeys.iv, clientHsSeq, "handshake", clientFinMsg);
@@ -3514,22 +2722,7 @@ const runHandshake = async (options, replay) => {
 		ok: false,
 		reason: { kind: "truncated" }
 	};
-	/**
-	* RFC 9846 §7.1's `resumption_master_secret`. It runs over the transcript
-	* through the CLIENT's Finished — one message further than the application
-	* traffic secrets above, which is the whole reason it is derived down here
-	* rather than beside them. Every ticket the server later sends expands from
-	* it, so it outlives the handshake and the transcript does not.
-	*/
 	const resumptionSecret = await deriveSecret(negotiatedSuite, master, "res master", ...transcript.getMessages());
-	/**
-	* When the peer was proved, by which signature, and over which chain —
-	* inherited whole on a resumed handshake, which proves none of the three. The
-	* rule and its consequences live in `session.ts` beside the ceiling that
-	* reads `authenticatedAt`, because that is the only place any of them can be
-	* tested: no peer this package can drive mints a ticket on a resumed
-	* connection (see the note where these reach `sessionFromTicket` below).
-	*/
 	const { authenticatedAt, peerSignatureScheme, peerCertificateChain } = inheritedAuthentication(resumedSession, cvScheme === void 0 || leafDer === void 0 ? void 0 : {
 		authenticatedAt: now(),
 		peerSignatureScheme: cvScheme,
@@ -3544,12 +2737,6 @@ const runHandshake = async (options, replay) => {
 	let serverAppKeys = await trafficKeys(negotiatedSuite, serverTrafficSecret);
 	let clientAppSeq = 0n;
 	let serverAppSeq = 0n;
-	/**
-	* TLS 1.3 closes each direction on its own (RFC 9846 §6.1): a `close_notify`
-	* says the SENDER is done writing, and says nothing about the receiver.
-	* Holding one flag for both made the peer's goodbye close our write side —
-	* so we never sent ours back, and a peer waiting for it waited forever.
-	*/
 	let peerSentCloseNotify = false;
 	let sentCloseNotify = false;
 	clientWriteKeys = {
@@ -3570,11 +2757,6 @@ const runHandshake = async (options, replay) => {
 			seq: clientAppSeq
 		};
 	};
-	/**
-	* Send the alert, then fail with it. Every established-connection failure goes
-	* out through the write queue, because sealing outside it is how one AES-GCM
-	* `(key, nonce)` came to cover two plaintexts.
-	*/
 	const abortWith = async (description) => {
 		await queueWrite(async () => {
 			await sendFatalAlert(description);
@@ -3594,21 +2776,6 @@ const runHandshake = async (options, replay) => {
 	let warningAlertsSeen = 0;
 	let keyUpdatesSeen = 0;
 	let sessionTicketsSeen = 0;
-	/**
-	* A `KeyUpdate` asking us to update in return is answered ONCE, on the next
-	* thing we write — not once per request.
-	*
-	* RFC 9846 §4.7.3 requires the response but sets no deadline, and a peer can
-	* put several requests in flight before any of them is answered. Answering
-	* each one turns one cheap record into an unbounded reply stream, and a peer
-	* strict about unsolicited KeyUpdates (BoGo is, and so is BoringSSL) drops
-	* the connection on the second.
-	*
-	* Owing it to the WRITE path is also what keeps the key rotation inside the
-	* write queue, where every client-write key and sequence mutation has to
-	* happen: sealing one outside it is how a single AES-GCM (key, nonce) came to
-	* cover two plaintexts once already.
-	*/
 	let keyUpdateResponseOwed = false;
 	const payKeyUpdateResponse = async () => {
 		if (!keyUpdateResponseOwed) return;
@@ -3743,23 +2910,6 @@ const runHandshake = async (options, replay) => {
 								resumptionSecret,
 								receivedAt: now(),
 								authenticatedAt,
-								/**
-								* These three are what a RENEWAL writes down, and reaching them
-								* took the package's first §4 replay through the state machine.
-								* No peer this package can DRIVE mints a ticket on a resumed
-								* connection: Node's OpenSSL issues two on the full handshake and
-								* none on the resumption, BoGo runs all 106 of its resumption
-								* tests at `-resume-count 1` so no third connection offers one
-								* back, and RFC 8448 §4 publishes no NewSessionTicket.
-								*
-								* So `session.test.ts` replays §4 and seals §3's ticket under §4's
-								* OWN published server application key — which works because the
-								* server derives that key over ClientHello..server Finished,
-								* before the `EndOfEarlyData` this client never sends. The
-								* decryption is the delivery mechanism and the proof of the key
-								* schedule at once. Point `inheritedAuthentication` at a fresh
-								* authentication and that test fails.
-								*/
 								peerSignatureScheme,
 								peerCertificateChain,
 								ticket: decoded.value.ticket,
@@ -3767,13 +2917,6 @@ const runHandshake = async (options, replay) => {
 								ticketAgeAdd: decoded.value.ticketAgeAdd,
 								ticketLifetime: decoded.value.ticketLifetime
 							});
-							/**
-							* The caller's storage is not on the connection's critical path. A
-							* ticket is an optimisation — losing one costs a resumption, and
-							* letting a `localStorage` quota error out of here would cost the
-							* connection AND break `TlsReadResult`, which is total everywhere
-							* else in this file.
-							*/
 							if (session !== void 0) try {
 								await onSession(session);
 							} catch {}
@@ -3853,11 +2996,6 @@ const runHandshake = async (options, replay) => {
 				};
 				return queueWrite(run);
 			},
-			/**
-			* Not queued and not stateful — it reads a secret fixed at the end of the
-			* handshake and touches no sequence number, so it cannot race a write the
-			* way `close` and the KeyUpdate response can.
-			*/
 			exportKeyingMaterial: (label, context, length) => exportKeyingMaterial(negotiatedSuite, exporterMaster, label, context, length)
 		},
 		negotiatedGroup: effectiveGroupName,