From 2d61d02ed93d466203f16c4086384dba6e005f1a Mon Sep 17 00:00:00 2001
From: token <61819790+239573049@users.noreply.github.com>
Date: Wed, 22 Jul 2026 18:46:40 +0800
Subject: [PATCH] =?UTF-8?q?fix(acme):=20=E4=BF=AE=E5=A4=8D=20internal=20?=
 =?UTF-8?q?=E8=BD=BD=E8=8D=B7=E5=B1=9E=E6=80=A7=E5=9C=A8=20AOT=20=E4=B8=8B?=
 =?UTF-8?q?=E8=A2=AB=E4=B8=A2=E5=BC=83=E5=AF=BC=E8=87=B4=20finalize=20CSR?=
 =?UTF-8?q?=20=E4=B8=BA=E7=A9=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Order.Payload.Csr 与 Account.Payload.OnlyReturnExisting 声明为 internal，
System.Text.Json 源生成器只序列化 public 成员，二者被静默丢弃：
- finalize 请求缺少 csr 字段，Let's Encrypt 报
  'asn1: syntax error: sequence truncated'
- onlyReturnExisting 丢失会破坏"仅返回已有账号"流程

改为 public 并加 [JsonInclude]。外层 Payload 类本身是 internal，
不会扩大公共 API 表面。

本地验证：真实 CSR 经签名后 csr 字段完整往返（DER 278B，tag 0x30），
onlyReturnExisting 正常序列化。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/Certes/Acme/Resource/Account.cs | 7 ++++++-
 src/Certes/Acme/Resource/Order.cs   | 8 +++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/Certes/Acme/Resource/Account.cs b/src/Certes/Acme/Resource/Account.cs
index bba2ac8..4b2cc93 100644
--- a/src/Certes/Acme/Resource/Account.cs
+++ b/src/Certes/Acme/Resource/Account.cs
@@ -71,8 +71,13 @@ internal class Payload : Account
             /// <value>
             /// The only return existing flag.
             /// </value>
+            // Must be public for the source generator to emit it — see the note on
+            // Order.Payload.Csr. An internal setter would be silently dropped, breaking
+            // the "return existing account" lookup. Payload is internal, so the public
+            // accessor does not widen the API surface.
             [JsonPropertyName("onlyReturnExisting")]
-            internal bool? OnlyReturnExisting { get; set; }
+            [JsonInclude]
+            public bool? OnlyReturnExisting { get; set; }
         }
     }
 }
diff --git a/src/Certes/Acme/Resource/Order.cs b/src/Certes/Acme/Resource/Order.cs
index 680a618..5b31b06 100644
--- a/src/Certes/Acme/Resource/Order.cs
+++ b/src/Certes/Acme/Resource/Order.cs
@@ -107,8 +107,14 @@ internal class Payload : Order
             /// <value>
             /// The CSR.
             /// </value>
+            // Must be public: System.Text.Json's source generator serializes only public
+            // members, so an internal Csr is silently dropped and finalize sends a payload
+            // with no csr — the server then fails with "asn1: syntax error: sequence
+            // truncated". The enclosing Payload class is internal, so this does not widen
+            // the public API surface.
             [JsonPropertyName("csr")]
-            internal string Csr { get; set; }
+            [JsonInclude]
+            public string Csr { get; set; }
         }
     }
 }