@blamejs/pki 0.8.48 → 0.8.50

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.50 — 2026-10-05
+
+Decide where a certificate-transparency request goes and which trust anchors it is made under before reading anything else the caller passed, and keep a copied byte argument out of the caller's reach.
+
+### Fixed
+
+- `pki.ct.getProofByHash` and `pki.ct.getSthConsistency` read the fields of the signed tree heads they were given before the request was shaped, and `pki.ct.addChain` and `pki.ct.addPreChain` read the elements of the certificate chain. A getter on any of those fields runs the caller's code at that moment, so it could rewrite the URL and send the request to another host, or empty `tls.anchors` after the check that refuses an unpinned log had already approved them, which opened the connection with no anchors at all while leaving the URL it reported unchanged. `pki.ct.fetchLogList` had the same ordering for a different reason: it parsed the URL, which converts it and so can run a caller's `toString`, before it read the TLS configuration. No order of reads fixes this on its own, because whichever option is read first, reading a value nested inside it runs the caller's code and that code can rewrite the ones not yet read: reading the TLS first lets a getter on `tls.anchors` rewrite the URL and the pinned key, and shaping the request first lets a header getter replace the key a tree head is verified under, in place if it is a buffer. So two shapes are refused rather than ordered around. `opts.url` has to be a string, because asking an object for its text form runs the caller's code, and so does `opts.sigUrl`, the detached-signature URL `pki.ct.fetchLogList` takes, which is a destination on the same footing. `opts.tls` may not carry an accessor, because reading its members has to be inert. All three draw `ct/bad-input`. With those refused, every option a verb declares is taken at its entry, the pinned key is copied there, and the request is sent and the signature checked from what was taken. A caller passing plain values and a string URL sees no change, and options supplied through a defaults object on the prototype chain still work, including the transport.
+- The trust anchors, the client certificate and the client key a `pki.ct` verb is given are copied where they are taken, not referenced. Copying the anchor list copied the references in it, and an anchor is a mutable buffer, so a getter elsewhere in the options could write other bytes over an anchor after the check that refuses an unpinned log had approved it: every reference still pointed where it had, the URL was unchanged, and the connection was made under trust material no check had seen. A PEM string cannot be altered after the fact and is taken as it is; a value that is neither bytes nor a string reaches the transport unchanged, so a shape it does not accept still draws the refusal it draws today. Two side effects of taking the copy: a byte source that is not a Buffer, such as the `ArrayBuffer` that `crypto.subtle.exportKey` returns, is normalized to one and now reaches the connection as a usable anchor, and an anchor larger than the DER ceiling is refused as `ct/too-large` where it was previously passed on.
+- A TLS setting nobody set can no longer be answered by `Object.prototype`. A verb that fetches builds a record of the TLS settings for the request, and where the caller named none that record was an empty object literal, which inherits. A value installed on `Object.prototype` was therefore read from it, and one of the settings read that way is `useSystemStore`, the opt-in that turns off the refusal of a server with no pinned trust anchor: with it installed, a call that had named neither a transport nor an anchor opened a connection trusting the system store where it should have been refused. The record now has no prototype, so nothing can be inherited into it. Fixed in `pki.ct`, `pki.acme`, `pki.est`, `pki.scep`, `pki.cmp`, the certificate-path builder's authority-information-access fetch, and `pki.transport` itself, which is the refusal every one of those delegates to.
+- A byte input copied at a verb's entry is copied into storage of its own. The copy was taken with `Buffer.from`, which for a small result allocates out of the shared 64 KiB pool, so a caller whose own value came from that pool holds a view of the whole store and the copy lands inside it at another offset. A caller's code running after the copy and before the copy is used could then find it and overwrite it: supplying the pinned log key as a pooled buffer and rewriting the copy from inside the transport had `pki.ct.getSth` accept a tree head signed by another key. This is the copy every verb in the package takes of a byte argument, so the fix reaches each of them, not only the certificate-transparency ones. Copies of a caller's keys, hashes and signed bytes are now out of the caller's reach once taken, which is what taking them is for.
+- A request URL is parsed with the `URL` constructor and the string conversion the package captured at load, in every module that builds a destination from one: `pki.ct`, `pki.acme`, `pki.est`, `pki.scep`, `pki.cmp`, `pki.ocsp`, the revocation fetcher, the path validator, the HTTP transport and its Digest authentication. Reading either off the global object at the moment of the parse read whatever had been installed there by then. A caller's code running mid-request, through a getter on an option the verb had yet to read, could replace the constructor with one answering a genuine URL that named another host, or replace the conversion so it answered with another host's URL outright, and the endpoint was built from that answer while the URL the caller passed was still the one the call reported. Capturing the constructor is not enough on its own, because the value it returns reads its parts through `URL.prototype`, which is also replaceable: redefining `href` there answered every read of the destination. So `pki.ct` and the HTTP transport read each part of a parsed destination, the scheme, host, port, path and query, through accessors captured at load, and the transport reads the scheme once and decides from that one string whether the request is allowed, whether a trust anchor is required and which port it defaults to.
+
+## v0.8.49 — 2026-10-05
+
+Contact the certificate-transparency log the caller named, and refuse an options object that answers a second read differently.
+
+### Fixed
+
+- `pki.ct.getSth`, `pki.ct.getProofByHash`, `pki.ct.getSthConsistency`, `pki.ct.getEntries`, `pki.ct.getRoots` and `pki.ct.addChain` read `opts.url` once to check it was present and again to build the endpoint. An options object whose `url` is an accessor therefore answered the two separately: the check saw the log the caller named and the request went wherever the second read pointed, which for a measured case was a different host entirely. `opts.tls` was read the same way, once for the trust-anchor check that refuses an unpinned log and once more for the connection, so the anchors that satisfied the check need not have been the anchors the socket used. Each verb now takes its options through one door at its own entry, and that door refuses an options object carrying an accessor, which is the rule `pki.ct.signSct` in the same module already applied. It also refuses an object that changes which options it carries while they are being read, since no set of checks can answer for one. A caller passing a plain object sees no change. The refusal is `ct/bad-input` and it happens before any request is sent, so a rejected options object cannot reach a log. Refusing an accessor on the options object is not the whole rule, because the door never inspects the members of a value, and a getter on a header name runs while the request headers are being copied. Three things it could reach from there are now taken before it runs. The URL is taken and converted to text at the same point, since holding the value alone is not enough when the value is an object whose text form names the host: a getter that rewrote an object-valued URL's `href` moved the request just as a second read would have. The TLS settings are flattened at that point too, and the anchor list is copied rather than shared, because a getter that emptied the pinned list after the trust-anchor check had approved it left the connection pinned to nothing. A caller that supplies options through a defaults object on the prototype chain is unaffected, including a function-valued `transport`. `pki.ct.fetchLogList` checked which option names it had been given and never entered that door at all, so its `url` was read once to parse and once to fetch, its `sigUrl` twice, and its TLS configuration once for the anchor check and once for the connection; it enters the same door now, over its own option set. Note that this is stricter than before: an options object with an accessor property was previously accepted, and the toolkit answered from whichever read it happened to make. Pass plain values.
+
 ## v0.8.48 — 2026-10-05
 
 Assemble a verification verdict out of component results through the operation the package captured at load, and refuse the reserved end-of-contents encoding where an element belongs.

package/lib/acme.js

@@ -58,6 +58,11 @@ var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
  *  replacement installed after load could take over, and what it decides is the value that gets
  *  awaited. */
 var _Promise = intrinsic.Promise;
+/** @internal The URL parser, taken at load for the same reason: what it returns names the host a
+ *  request goes to, and this module resolves a `Location` and a link relation against a directory
+ *  origin with it. */
+var _URL = intrinsic.URL;
+var _urlCanParse = intrinsic.urlCanParse;
 /** @internal A refusal returned as a REJECTED promise is a verdict too: read from the global binding, a
  *  replacement whose `reject` resolves instead turns the refusal into a pass. */
 var _reject = intrinsic.uncurry(intrinsic.promiseReject);
@@ -198,7 +203,7 @@ var RENEWAL_RETRY_DEFAULT_SECONDS = constants.TIME.hours(6) / constants.TIME.sec
 function _isUrl(v) {
   if (!_isString(v) || !_isHttpUrlShape(v)) return false;
   var u;
-  try { u = new URL(v); }
+  try { u = new _URL(v); }
   catch (_e) { return false; }
   return (u.protocol === "http:" || u.protocol === "https:") && u.hostname.length > 0;
 }
@@ -1441,7 +1446,7 @@ var CLIENT_MAX_NONCE_POOL = 32;
 function _clientUrl(urlStr) {
   var s = String(urlStr);
   var url;
-  try { url = new URL(s); }
+  try { url = new _URL(s); }
   catch (e) { throw E("acme/bad-url", "the ACME URL did not parse: " + s, e); }
   if (url.protocol !== "https:") throw E("acme/insecure-url", "ACME requires https (RFC 8555 sec. 6.1), got " + url.protocol + " for " + s);
   var _uAuth = _uriAuthority(s, true);
@@ -1465,11 +1470,11 @@ function _clientUrl(urlStr) {
 }
 function _resolveLocation(loc, base) {
   var isAbsolute = true;
-  try { new URL(loc); }
+  try { new _URL(loc); }
   catch (_e) { isAbsolute = false; }
   if (isAbsolute) return _clientUrl(loc);
   var u;
-  try { u = new URL(loc, base); }
+  try { u = new _URL(loc, base); }
   catch (e) { throw E("acme/bad-url", "the Location header did not resolve to a valid URL: " + JSON.stringify(loc), e); }
   if (_queryRepaired(loc, u)) throw E("acme/bad-url", "a relative Link/Location query is not canonical (resolution re-encoded it): " + JSON.stringify(loc));
   return _clientUrl(u.href);
@@ -1479,9 +1484,10 @@ function _queryRepaired(rawRef, resolvedUrl) {
   return qi !== -1 && rawRef.slice(qi).split("#")[0] !== resolvedUrl.search;
 }
 var _defaultSleep = require("./sleep").sleep;
+/** @internal The settings this client forwards to its transport. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
 function _clientTls(o) {
-  var t = o.tls || {};
-  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+  return guard.identifier.pickSettings(o.tls, TLS_SETTINGS);
 }
 function _splitPemChain(text) {
   var ders;
@@ -1646,7 +1652,7 @@ function _badIpLiteral(uri) {
   var interior = _ipLiteralInterior(uri);
   if (interior === null) return false;
   if (_isIpvFuture(interior)) return false;
-  return !URL.canParse("http://[" + interior + "]/");
+  return !_urlCanParse("http://[" + interior + "]/");
 }
 function _uriStructurallyInvalid(uri) {
   return !_bracketsOnlyInAuthority(uri) || _hasEmptyAuthority(uri) || _authorityMultiAt(uri) || _multiFragment(uri) || _relFirstSegHasColon(uri) || _badPort(uri) || _badIpLiteral(uri);
@@ -1757,7 +1763,7 @@ function _parseLinkRelation(headers, base, relName, opts) {
     if (hNames[hi].toLowerCase() === "link") { raw = headers[hNames[hi]]; break; }
   }
   if (raw == null) return [];
-  var baseUrl = new URL(base), baseOrigin = baseUrl.origin, baseHref = baseUrl.href;
+  var baseUrl = new _URL(base), baseOrigin = baseUrl.origin, baseHref = baseUrl.href;
   var baseKey = _dedupKey(baseHref);
   var fields = Array.isArray(raw) ? raw : [raw], out = [], seen = Object.create(null), distinctCount = 0, totalBytes = 0;
   for (var fi = 0; fi < fields.length; fi++) {
@@ -1777,7 +1783,7 @@ function _parseLinkRelation(headers, base, relName, opts) {
       if (lv.anchor != null) {
         if (_linkUriInvalid(lv.anchor)) continue;
         var au;
-        try { au = new URL(lv.anchor, base); }
+        try { au = new _URL(lv.anchor, base); }
         catch (_ae) { continue; }
         if (_queryRepaired(lv.anchor, au)) continue;
         if (au.href !== baseHref) continue;
@@ -1789,7 +1795,7 @@ function _parseLinkRelation(headers, base, relName, opts) {
         if (opts.singleton) throw E("acme/bad-link", "a rel=\"" + relName + "\" Link target is not a usable ACME request URL: " + _stringify(lv.uri), e);
         continue;
       }
-      var parsed = new URL(resolved);
+      var parsed = new _URL(resolved);
       if (parsed.origin !== baseOrigin) throw E("acme/bad-link", "a rel=\"" + relName + "\" Link target is not on the request URL's origin (SSRF guard): " + JSON.stringify(lv.uri));
       var key = _dedupKey(parsed.href);
       if (seen[key]) continue;
@@ -1929,7 +1935,7 @@ function client(directoryUrl, opts) {
 
   var transport = checkedTransport;
   if (!transport) {
-    var t0 = opts.tls || {};
+    var t0 = opts.tls != null ? opts.tls : intrinsic.create(null);
     var hasAnchors = t0.anchors !== undefined && t0.anchors !== null && !(Array.isArray(t0.anchors) && t0.anchors.length === 0);
     if (!hasAnchors && t0.useSystemStore !== true) throw E("acme/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true (RFC 8555 sec. 6.1)");
     transport = httpTransport.https({ E: E, errPrefix: "acme" });
@@ -1950,10 +1956,10 @@ function client(directoryUrl, opts) {
   var dirCache = null;
   var nonces = [];
   var kid = null;
-  var trustedOrigin = new URL(dirUrl).origin;
+  var trustedOrigin = new _URL(dirUrl).origin;
   function _tlsFor(url) {
     var t = budgets.tls;
-    if (new URL(url).origin !== trustedOrigin) {
+    if (new _URL(url).origin !== trustedOrigin) {
       t = Object.assign({}, t);
       t.cert = null; t.key = null; t.servername = null;
     }
@@ -2018,7 +2024,7 @@ function client(directoryUrl, opts) {
         if (redirects >= budgets.maxRedirects) throw E("acme/too-many-redirects", "the redirect budget of " + budgets.maxRedirects + " was exceeded");
         if (!_isString(h["location"])) throw E("acme/bad-redirect", "a " + status + " redirect carried no Location header (RFC 7231 sec. 6.4)");
         var next;
-        try { next = new URL(h["location"], url).href; }
+        try { next = new _URL(h["location"], url).href; }
         catch (e) { throw E("acme/bad-redirect", "the redirect Location did not resolve to a valid URL", e); }
         return _sendFollowing(method, _clientUrl(next), headers, body, redirects + 1);
       }
@@ -2364,7 +2370,7 @@ function client(directoryUrl, opts) {
     return _resource("renewalInfo").then(function (base) {
       // allow:nan-date-comparison-unguarded -- notAfterMs is a codec-parsed cert date; clk() is validated finite.
       if (clk() > notAfterMs) throw E("acme/certificate-expired", "the certificate expired before the RenewalInfo request could be issued; a client MUST NOT check RenewalInfo after expiry (RFC 9773 sec. 4.3)");
-      var u = new URL(base);
+      var u = new _URL(base);
       u.pathname = _stripTrailingSlash(u.pathname) + "/" + certId;
       var url = _clientUrl(u.href);
       return _send("GET", url, { accept: "application/json" }, null).then(function (res) {

package/lib/cmp-build.js

@@ -34,6 +34,10 @@ var intrinsic = require("./guard-intrinsic");
  *  the construction to whatever that binding holds, and one settling without awaiting its argument runs
  *  the continuation before the check has finished. */
 var _Promise = intrinsic.Promise;
+/** @internal The URL parser, taken at load: what it returns names the host a transfer is sent to. The
+ *  conversion it is handed is taken with it, since a replacement answers with a host of its own. */
+var _URL = intrinsic.URL;
+var _stringOf = intrinsic.String;
 var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _hasOwn = intrinsic.hasOwn;
 var _isArray = intrinsic.isArray;
@@ -997,9 +1001,10 @@ function _cmpMessageDer(input) {
   return der;
 }
 
+/** @internal The settings this transfer forwards to its transport. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
 function _tlsForTransfer(opts) {
-  var t = opts.tls || {};
-  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+  return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
 }
 
 function _ctypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
@@ -1053,10 +1058,10 @@ function _transfer(url, message, opts) {
   var transport = _assertTransport(opts);
   var der = _cmpMessageDer(message);
   var parsedUrl;
-  try { parsedUrl = new URL(String(url)); }
+  try { parsedUrl = new _URL(_stringOf(url)); }
   catch (e) { throw _err("cmp/bad-url", "the CMP URL did not parse: " + guard.text.showValue(url), e); }
   if (!transport) {
-    var t = opts.tls || {};
+    var t = opts.tls != null ? opts.tls : intrinsic.create(null);
     var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(Array.isArray(t.anchors) && t.anchors.length === 0);
     if (!hasAnchors && t.useSystemStore !== true) throw _err("cmp/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned server (RFC 9811 sec. 5)");
     transport = httpTransport.https({ E: _err, errPrefix: "cmp" });
@@ -1120,7 +1125,7 @@ function wellKnownUrl(base, opts) {
     return "unknown wellKnownUrl option " + JSON.stringify(k) + " (expected label / operation)";
   });
   var u;
-  try { u = new URL(String(base)); }
+  try { u = new _URL(_stringOf(base)); }
   catch (e) { throw _err("cmp/bad-url", "the CMP base URL did not parse: " + guard.text.showValue(base), e); }
   if (u.protocol !== "https:" && u.protocol !== "http:") throw _err("cmp/bad-url", "the CMP base URL must be http or https (a well-known URI is authority-rooted over HTTP), got " + u.protocol + ": " + JSON.stringify(String(base)));
   if (u.search || u.hash) throw _err("cmp/bad-url", "the CMP base URL must not carry a query or fragment component (RFC 9811 sec. 3.4)");

package/lib/ct.js

@@ -67,7 +67,17 @@ var _bufCopy = intrinsic.uncurry(Buffer.prototype.copy);
 var _writeU64BE = intrinsic.uncurry(Buffer.prototype.writeBigUInt64BE);
 var _searchSet = intrinsic.uncurry(URLSearchParams.prototype.set);
 var _numberOf = intrinsic.Number;
-var _URL = URL;
+var _URL = intrinsic.URL;
+/** @internal Every part of a parsed destination is read through the accessor captured at load, not off
+ *  the value's own prototype: a header getter that redefined `URL.prototype.href` had the request go to
+ *  the host its getter named while the url the caller passed was still the one reported. */
+var _urlHref = intrinsic.urlHref;
+var _urlOrigin = intrinsic.urlOrigin;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlPathname = intrinsic.urlPathname;
+var _urlSearchParams = intrinsic.urlSearchParams;
+var _urlSetPathname = intrinsic.urlSetPathname;
+var _urlSetSearch = intrinsic.urlSetSearch;
 var _JSON_SUFFIX = ".json";
 function _endsWithJson(s) { return s.length >= _JSON_SUFFIX.length && _strSlice(s, s.length - _JSON_SUFFIX.length) === _JSON_SUFFIX; }
 var ByteReader = require("./byte-reader.js");
@@ -1171,12 +1181,48 @@ var DEFAULT_FETCH_TIMEOUT = C.TIME.seconds(30);
 var MAX_FETCH_TIMEOUT = C.TIME.seconds(600);
 var KNOWN_FETCH_OPTS = intrinsic.assign(intrinsic.create(null), { url: 1, signerKey: 1, sigUrl: 1, transport: 1, tls: 1, headers: 1, timeout: 1, maxResponseBytes: 1, requireJsonContentType: 1 });
 
+/** @internal The TLS settings flattened into a record of plain values, with the anchor LIST copied.
+ *  `opts.tls` is the caller's object and its members are read later than the trust-anchor check that
+ *  approves them, so leaving either shared let a getter elsewhere in the bag empty the pinned anchors
+ *  and rewrite the servername after the check had passed: the anchors checked were then not the anchors
+ *  the connection used. Copying the list is what closes that, since emptying an array the caller still
+ *  holds is the lever. Flatten once, check that record, and connect under the same one. */
+/** @internal One piece of trust material, copied rather than referenced. An anchor, a client
+ *  certificate and a client key are each a Buffer the caller still holds, and copying the list that
+ *  holds them copies the references in it: a header getter that wrote an attacker's PEM OVER an
+ *  anchor's bytes left every reference pointing where it did and still opened the connection under
+ *  trust material the unpinned-log check had already approved, MEASURED on this module. A PEM string
+ *  cannot be changed after the fact and is taken as it is; anything that is neither is handed on
+ *  unchanged, so the transport keeps giving the refusal it gives today for a shape it does not
+ *  accept. */
+function _trustValue(v, field) {
+  if (typeof v === "string") return v;
+  if (guard.bytes.isByteSource(v)) return _toBuffer(v, field, _ctErr, "ct/bad-input");
+  return v;
+}
+
 function _tlsForFetch(opts) {
-  var t = opts.tls || {};
-  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+  /** @internal A record with NO prototype where the caller supplied no TLS at all, because the empty
+   *  object a literal gives inherits from `Object.prototype` and every field below is then answerable
+   *  from there. MEASURED: a getter inside `opts.sth` set `Object.prototype.useSystemStore = true`, the
+   *  record built here inherited it, and the refusal that turns away an unpinned log was skipped, so a
+   *  call that had named neither a transport nor an anchor opened a connection trusting the system
+   *  store. Where the caller DID supply a TLS record this is settled at the door and the record read
+   *  here is the flat one taken then, whose seven fields are its own. */
+  var t = opts.tls != null ? opts.tls : intrinsic.create(null);
+  var anchors = t.anchors;
+  /** @internal Copied by index rather than with `slice`, which consults the array's species and so
+   *  would run a caller's constructor. `guard.list.copyMap` walks it with a narrowed count and copies
+   *  each element's bytes as it goes. */
+  anchors = intrinsic.isArray(anchors)
+    ? guard.list.copyMap(anchors, function (a, i) { return _trustValue(a, "opts.tls.anchors[" + i + "]"); })
+    : _trustValue(anchors, "opts.tls.anchors");
+  return { anchors: anchors, useSystemStore: t.useSystemStore, cert: _trustValue(t.cert, "opts.tls.cert"),
+    key: _trustValue(t.key, "opts.tls.key"), minVersion: t.minVersion, servername: t.servername,
+    checkServerIdentity: t.checkServerIdentity };
 }
 
-function _sameOrigin(a, b) { return new URL(a).origin === new URL(b).origin; }
+function _sameOrigin(a, b) { return _urlOrigin(new _URL(a)) === _urlOrigin(new _URL(b)); }
 
 /** @internal Refused at the door and again where the value is used. */
 function _assertTransport(opts) {
@@ -1188,17 +1234,20 @@ function _fetchCtypeToken(headers) { return String((headers || {})["content-type
 
 function _parseHttpsUrl(u, label) {
   var parsed;
-  try { parsed = new URL(String(u)); }
-  catch (e) { throw _ctErr("ct/bad-url", "the CT log-list " + label + " did not parse: " + String(u), e); }
-  if (parsed.protocol !== "https:") throw _ctErr("ct/insecure-url", "the CT log-list " + label + " must be https, got " + parsed.protocol + " for " + String(u));
+  var text = _stringOf(u);
+  try { parsed = new _URL(text); }
+  catch (e) { throw _ctErr("ct/bad-url", "the CT log-list " + label + " did not parse: " + text, e); }
+  var scheme = _urlProtocol(parsed);
+  if (scheme !== "https:") throw _ctErr("ct/insecure-url", "the CT log-list " + label + " must be https, got " + scheme + " for " + text);
   return parsed;
 }
 
 function _sigUrlFor(parsed) {
-  if (!_endsWithJson(parsed.pathname)) throw _ctErr("ct/bad-input", "cannot derive the detached-signature URL from a non-.json path (" + JSON.stringify(parsed.pathname) + "); pass opts.sigUrl explicitly");
-  var sig = new URL(parsed.href);
-  sig.pathname = _strSlice(parsed.pathname, 0, parsed.pathname.length - _JSON_SUFFIX.length) + ".sig";
-  return sig.href;
+  var path = _urlPathname(parsed);
+  if (!_endsWithJson(path)) throw _ctErr("ct/bad-input", "cannot derive the detached-signature URL from a non-.json path (" + JSON.stringify(path) + "); pass opts.sigUrl explicitly");
+  var sig = new _URL(_urlHref(parsed));
+  _urlSetPathname(sig, _strSlice(path, 0, path.length - _JSON_SUFFIX.length) + ".sig");
+  return _urlHref(sig);
 }
 
 function _fetchBody(transport, url, req, label) {
@@ -1231,6 +1280,10 @@ var STH_PREIMAGE_BYTES = 50;
 var CT_VERSION_V1 = 0;
 var SIG_TYPE_TREE_HASH = 1;
 var CT_V1_PREFIX = "ct/v1/";
+/** @internal The union across the sec. 4 messages rather than one set per message, because a caller
+ *  drives several of them from a single options bag: the same record carries the pinned key for the
+ *  tree head and the range for the entries. An option a message does not read is ignored by it, so the
+ *  refusal this list makes is of a name no message knows. */
 var KNOWN_CLIENT_OPTS = intrinsic.assign(intrinsic.create(null), {
   url: 1, logKey: 1, transport: 1, tls: 1, headers: 1, timeout: 1, maxResponseBytes: 1,
   sth: 1, oldSth: 1, newSth: 1, leafHash: 1, start: 1, end: 1, chain: 1,
@@ -1241,50 +1294,179 @@ var KNOWN_CLIENT_OPTS = intrinsic.assign(intrinsic.create(null), {
  *  with or without the `ct/v1/` prefix the specification fixes, and neither spelling doubles it. */
 function _endpoint(url, message) {
   var parsed = _parseHttpsUrl(url, "log URL");
-  var path = parsed.pathname;
+  var path = _urlPathname(parsed);
   if (path.length === 0 || path[path.length - 1] !== "/") path += "/";
   var tail = CT_V1_PREFIX;
   if (path.length >= CT_V1_PREFIX.length + 1 &&
       _strSlice(path, path.length - CT_V1_PREFIX.length) === CT_V1_PREFIX) tail = "";
-  var out = new _URL(parsed.href);
-  out.pathname = path + tail + message;
-  out.search = "";
+  var out = new _URL(_urlHref(parsed));
+  _urlSetPathname(out, path + tail + message);
+  _urlSetSearch(out, "");
   return out;
 }
 
+/** @internal The door every sec. 4 message enters by: the declared options refused if one is not
+ *  recognized, then taken ONCE into a plain record. A caller's bag is the caller's, so an option
+ *  reached through an accessor answers each read separately, and this code read several of them twice:
+ *  `url` for a presence check and again to build the endpoint, which let the check approve one host
+ *  while the request went to another; `tls` for the anchor check and again for the connection, which
+ *  would be a pin approved on one object and a socket opened under another. Reading from the record
+ *  afterwards means the value that was checked is the value that is used. Every verb calls this at its
+ *  own entry and passes the record down, rather than relying on a check further in. */
+/** @internal `keyName` is the option this message VERIFIES against, or null for one that verifies
+ *  nothing. The option list is the union across the messages so that one bag drives several of them,
+ *  and an option a message does not read is ignored by it; settling the pinned key at every door
+ *  instead would make a message that never checks a signature refuse a bag over a field it does not
+ *  consume. `getSth` and the two chain submissions name it; the proof, consistency, entries and roots
+ *  messages pass null. */
+function _clientDoor(opts, keyName) {
+  /** @internal `optionsObject` is the door `signSct` in this module already enters by, and it REFUSES
+   *  an options bag carrying an accessor rather than tolerating one: a bag whose properties are not
+   *  plain values is a shape no set of checks can answer for, and it also refuses one that changes
+   *  which options it carries while they are read. Refusing beats copying, because a copy leaves the
+   *  caller's shape acceptable and every future read in this module has to remember to use the copy.
+   *  It also leaves ABSENCE intact, which materializing the declared names would not: an absent
+   *  `transport` means "open the connection yourself, under the pinned anchors", while one present
+   *  holding `undefined` is a transport that is not callable. */
+  var bag = guard.identifier.optionsObject(opts, _ctErr, "ct/bad-input", "pki.ct client options");
+  guard.identifier.assertKnownKeys(bag, KNOWN_CLIENT_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
+  /** @internal The bag is returned as it came, not copied. A copy cannot reproduce what reading it
+   *  does: an option supplied through a caller's defaults object is reached along the prototype chain,
+   *  and the enumeration that would drive a copy deliberately omits an inherited FUNCTION member,
+   *  because that is how `Object.prototype.toString` is kept from counting as an option. Copying
+   *  therefore dropped an inherited `transport`, and dropping a transport is not a smaller result: it
+   *  falls through to opening a real connection where the caller passed a fake one. What makes the
+   *  repeated reads safe instead is that this door refuses a bag whose properties are not plain values,
+   *  and that each option below is taken into a local ONCE, before anything that could run caller code.
+   *  EVERY DECLARED OPTION IS TAKEN HERE, and the ones a verdict rests on are made immune, but the
+   *  request is NOT shaped here. Shaping it here was tried and is wrong: copying the request headers
+   *  runs whatever getters the caller's header object carries, and doing that before a verb reads its
+   *  own options put every verification input at the mercy of one. A header getter swapped `logKey` for
+   *  an attacker's SPKI, then overwrote the same buffer in place once the reference was held, then
+   *  overwrote `sth.rootHash` so an empty audit proof verified. Each was worse than the wrong-host case
+   *  the move was meant to close. The verb's inputs are the more valuable thing, so the headers are
+   *  copied at send time as they always were, and the destination is protected by making it immune
+   *  instead: a string url cannot be rewritten, and a flattened tls with its anchor list copied cannot
+   *  be emptied. Taking the top level is safe because the door has already refused a bag whose
+   *  properties are not plain values, so no read here runs caller code. */
+  return { o: _settleDecisive(_takeTopLevel(bag, KNOWN_CLIENT_OPTS), keyName) };
+}
+
+/** @internal Every DECLARED option the bag can answer, read once into a record of plain values, before
+ *  anything derives from one. `in` is used rather than an enumeration because the door accepts an option
+ *  supplied through a caller's defaults object, and an enumeration omits an inherited FUNCTION member,
+ *  which silently dropped a `transport` and fell through to opening a real connection. It consults the
+ *  prototype chain exactly as the direct reads it replaces did, so it carries no new exposure, and
+ *  absence survives: a name the bag cannot answer is left out rather than materialized as `undefined`,
+ *  which a guard that tells absent from present-and-undefined depends on. */
+function _takeTopLevel(bag, known) {
+  var o = intrinsic.create(null);
+  intrinsic.forEach(intrinsic.keys(known), function (k) {
+    if (k in bag) o[k] = bag[k];
+  });
+  return o;
+}
+
+/** @internal The two values a verdict rests on, made IMMUNE rather than merely taken. Holding a
+ *  reference is not holding a value: a header getter copied an attacker's SPKI OVER the caller's
+ *  `logKey` buffer in place and an attacker-signed tree head was accepted, and a getter inside `tls`
+ *  rewrote an object-valued url's `hostname` and the request went to another host. Both happened after
+ *  the option had been taken, because what was taken could still be changed from outside. A string and
+ *  a copied buffer cannot be, so the destination and the pin stop depending on what the caller does
+ *  next. Done here, before anything nested is read, for the same reason the taking is. */
+function _settleDecisive(o, keyName) {
+  /** @internal There is no order that fixes this by itself, which is what two rounds of reordering
+   *  showed: converting the url asks an object for its text and that runs the caller's code, which
+   *  emptied the anchor list not yet flattened; flattening the anchors first reads `tls.anchors` and
+   *  that runs the caller's code too, which rewrote the url not yet converted. So the caller's code is
+   *  refused HERE instead of ordered around. A url has to be a string, which needs no conversion, and
+   *  a tls carries no accessor, which makes reading its members inert. After that nothing in settling
+   *  runs caller code and the order stops mattering. */
+  if (o.url != null && typeof o.url !== "string") {
+    throw _ctErr("ct/bad-input", "opts.url must be a string -- an object is asked for its text form, " +
+      "and asking runs the caller's code, which is how a request reached a host its URL had not named");
+  }
+  /** @internal The detached-signature URL is a destination too, and only the log-list fetch declares
+   *  it, so the rule is the same one: a value that has to be converted is a value whose conversion
+   *  runs here, after everything else has been settled, where it could still rewrite what was. */
+  if (o.sigUrl != null && typeof o.sigUrl !== "string") {
+    throw _ctErr("ct/bad-input", "opts.sigUrl must be a string -- an object is asked for its text " +
+      "form, and asking runs the caller's code after the other options have been settled");
+  }
+  if (o.tls != null) {
+    guard.identifier.refuseAccessorFields(o.tls,
+      guard.identifier.readableNames(o.tls, _ctErr, "ct/bad-input", "opts.tls"),
+      _ctErr, "ct/bad-input", "opts.tls");
+    /** @internal And the ELEMENTS of the anchor list, which refusing accessors on `tls` itself does not
+     *  reach. An accessor on `anchors[0]` runs when the list is copied, and one that overwrote
+     *  `sth.rootHash` with the leaf being proven had an empty audit path verify. The refusal has to go
+     *  as deep as the reading does. */
+    var suppliedAnchors = o.tls.anchors;
+    if (suppliedAnchors != null) {
+      guard.identifier.refuseAccessorFields(suppliedAnchors,
+        guard.identifier.readableIndices(suppliedAnchors, _ctErr, "ct/bad-input", "opts.tls.anchors"),
+        _ctErr, "ct/bad-input", "opts.tls.anchors");
+    }
+    /** @internal Flattened HERE, with the anchor list copied, because the caller still holds the object
+     *  and a getter anywhere else in the bag emptied the list after the trust-anchor check approved it.
+     *  Reading its members and its elements is inert now that both refuse an accessor, so this runs no
+     *  caller code and the order it runs in stops mattering. */
+    o.tls = _tlsForFetch(o);
+  }
+  if (keyName !== null && o[keyName] != null) {
+    o[keyName] = _toBuffer(o[keyName], "opts." + keyName, _ctErr, "ct/bad-input");
+  }
+  return o;
+}
+
 /** @internal The shared request shape every message uses: the caller's transport or a pinned-anchor
  *  one, the caps, and the header filter. Factored so a verb adds a path and a body and nothing else,
- *  and so a rule about reaching a log is stated once. */
-function _clientRequest(opts, label) {
-  guard.identifier.assertKnownKeys(opts, KNOWN_CLIENT_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
-  var transport = _assertTransport(opts);
-  if (opts.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log's base URL (there is no baked-in log)");
+ *  and so a rule about reaching a log is stated once. `o` has already been through `_clientDoor`, so
+ *  every read here is of a plain value. */
+function _clientRequest(o) {
+  var transport = _assertTransport(o);
+  /** @internal ONE read, and the presence check and the endpoint both decide from it. Read again after
+   *  the header copy below, which runs whatever getters the caller's header object carries, it was
+   *  whatever that code had since made it: a getter on a header name rewrote `url` and moved the request
+   *  to another host after this check had approved the original.
+   *  AND CONVERTED HERE, not at the endpoint. Holding the value alone is not enough when it is an
+   *  object, because the text form is what names the host and `String()` asks the object for it: a
+   *  header getter that rewrote an object-valued url's `href` moved the request just the same, the
+   *  conversion being the last reader. The endpoint is built from this string. */
+  if (o.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log's base URL (there is no baked-in log)");
+  var url = _stringOf(o.url);
+  /** @internal Flattened BEFORE the header copy below, which invokes whatever getters the caller's
+   *  header object carries. One of those emptied the pinned anchors after this check had approved them,
+   *  so the check and the connection have to read the same flat record and it has to exist first. */
+  var tls = _tlsForFetch(o);
   if (!transport) {
-    var t = opts.tls || {};
-    var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(intrinsic.isArray(t.anchors) && t.anchors.length === 0);
-    if (!hasAnchors && t.useSystemStore !== true) {
+    var hasAnchors = tls.anchors !== undefined && tls.anchors !== null && !(intrinsic.isArray(tls.anchors) && tls.anchors.length === 0);
+    if (!hasAnchors && tls.useSystemStore !== true) {
       throw _ctErr("ct/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned CT log server (RFC 6962 sec. 3.2)");
     }
     transport = httpTransport.https({ E: _ctErr, errPrefix: "ct" });
   }
-  var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_FETCH_TIMEOUT, { E: _ctErr, code: "ct/bad-input", min: 1, max: MAX_FETCH_TIMEOUT });
-  var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.CT_LOG_LIST_MAX_BYTES, { E: _ctErr, code: "ct/bad-input", min: 1, max: C.LIMITS.CT_LOG_LIST_MAX_BYTES });
+  var timeout = guard.limits.cap(o.timeout, "timeout", DEFAULT_FETCH_TIMEOUT, { E: _ctErr, code: "ct/bad-input", min: 1, max: MAX_FETCH_TIMEOUT });
+  var maxResponseBytes = guard.limits.cap(o.maxResponseBytes, "maxResponseBytes", C.LIMITS.CT_LOG_LIST_MAX_BYTES, { E: _ctErr, code: "ct/bad-input", min: 1, max: C.LIMITS.CT_LOG_LIST_MAX_BYTES });
   var headers = intrinsic.create(null);
-  guard.identifier.optionNames(opts.headers).forEach(function (k) {
+  var supplied = o.headers;
+  intrinsic.forEach(guard.identifier.optionNames(supplied), function (k) {
     var lk = _toLowerCase(k);
-    if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = opts.headers[k];
+    if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = supplied[k];
   });
-  return { transport: transport, req: { headers: headers, tls: _tlsForFetch(opts), timeout: timeout,
-    maxResponseBytes: maxResponseBytes }, label: label };
+  return { transport: transport, url: url, req: { headers: headers, tls: tls, timeout: timeout,
+    maxResponseBytes: maxResponseBytes } };
 }
 
 /** @internal A sec. 4 message, fetched and read as JSON. The specification returns every error as a
  *  4xx or 5xx with a human-readable message, which `_fetchBody` already turns into a typed refusal,
  *  so a non-200 never reaches the reader. */
-async function _clientJson(opts, message, label, query, body) {
-  var ctx = _clientRequest(opts, label);
-  var url = _endpoint(opts.url, message);
-  if (query) intrinsic.keys(query).forEach(function (k) { _searchSet(url.searchParams, k, query[k]); });
+async function _clientJson(door, message, label, query, body) {
+  /** @internal Shaped at send time, from the record the door settled. Shaping it at the door instead
+   *  ran the caller's header getters before any verb had captured its verification inputs. */
+  var ctx = _clientRequest(door.o);
+  var url = _endpoint(ctx.url, message);
+  if (query) intrinsic.keys(query).forEach(function (k) { _searchSet(_urlSearchParams(url), k, query[k]); });
   var req = ctx.req;
   if (body !== undefined) {
     req = intrinsic.assign(intrinsic.create(null), req);
@@ -1295,7 +1477,7 @@ async function _clientJson(opts, message, label, query, body) {
     h["content-type"] = "application/json";
     req.headers = h;
   }
-  var res = await _fetchBody(ctx.transport, url.href, req, label);
+  var res = await _fetchBody(ctx.transport, _urlHref(url), req, label);
   /** @internal The exact-integer rule applies to the NAMED members, the ones `_uintField` reads. RFC 6962
    *  responses are ordinary JSON, where `1e3` is legal, so the stricter `integersOnly` would refuse a
    *  document a conforming log may emit; what this refuses is a spelling whose value is not exactly its
@@ -1466,7 +1648,8 @@ async function verifySth(sth, logKey) {
  *   sth.treeSize;   // -> 3n
  */
 async function getSth(opts) {
-  opts = opts || {};
+  var door = _clientDoor(opts || {}, "logKey");
+  opts = door.o;
   /** @internal ONE read of the option, and the presence check and the copy both decide from it. Reading
    *  it twice let an accessor answer the two separately: a non-null value for the check and an
    *  attacker's SPKI for the copy, and the tree head was then verified against a key the caller never
@@ -1478,7 +1661,7 @@ async function getSth(opts) {
     throw _ctErr("ct/bad-input", "opts.logKey is required -- the caller-pinned log SPKI; an unverified tree head is not a result");
   }
   var pinnedKey = _toBuffer(suppliedLogKey, "opts.logKey", _ctErr, "ct/bad-input");
-  var doc = await _clientJson(opts, "get-sth", "sth");
+  var doc = await _clientJson(door,"get-sth", "sth");
   var sth = {
     treeSize: _uintField(doc, "tree_size", "ct/bad-sth", "sth"),
     timestamp: _uintField(doc, "timestamp", "ct/bad-sth", "sth"),
@@ -1524,7 +1707,8 @@ async function getSth(opts) {
  *   p.verified;   // -> true
  */
 async function getProofByHash(opts) {
-  opts = opts || {};
+  var door = _clientDoor(opts || {}, null);
+  opts = door.o;
   var sth = _assertSth(opts.sth, "opts.sth");
   /** @internal Copied for the reason the tree head is: it is sent on the wire and then folded against the
    *  head after the fetch returns, so a view would let the leaf being proved differ from the leaf asked
@@ -1533,7 +1717,7 @@ async function getProofByHash(opts) {
   if (leafHash.length !== 32) {
     throw _ctErr("ct/bad-input", "opts.leafHash must be exactly 32 bytes (a v1 leaf hash), got " + leafHash.length);
   }
-  var doc = await _clientJson(opts, "get-proof-by-hash", "audit proof", {
+  var doc = await _clientJson(door,"get-proof-by-hash", "audit proof", {
     hash: _bufToString(leafHash, "base64"), tree_size: _stringOf(sth.treeSize),
   });
   var leafIndex = _uintField(doc, "leaf_index", "ct/bad-proof", "audit proof");
@@ -1579,14 +1763,15 @@ async function getProofByHash(opts) {
  *   c.verified;   // -> true
  */
 async function getSthConsistency(opts) {
-  opts = opts || {};
+  var door = _clientDoor(opts || {}, null);
+  opts = door.o;
   var oldSth = _assertSth(opts.oldSth, "opts.oldSth");
   var newSth = _assertSth(opts.newSth, "opts.newSth");
   if (oldSth.treeSize > newSth.treeSize) {
     throw _ctErr("ct/bad-input", "opts.oldSth names tree size " + oldSth.treeSize +
       ", which is larger than opts.newSth's " + newSth.treeSize);
   }
-  var doc = await _clientJson(opts, "get-sth-consistency", "consistency proof", {
+  var doc = await _clientJson(door,"get-sth-consistency", "consistency proof", {
     first: _stringOf(oldSth.treeSize), second: _stringOf(newSth.treeSize),
   });
   var consistency = _b64Array(doc, "consistency", "ct/bad-consistency", "consistency proof", 32, C.LIMITS.MERKLE_MAX_PROOF_NODES);
@@ -1636,7 +1821,8 @@ async function getSthConsistency(opts) {
  *   e.entries[0].leafInput;   // -> <Buffer ...>
  */
 async function getEntries(opts) {
-  opts = opts || {};
+  var door = _clientDoor(opts || {}, null);
+  opts = door.o;
   var start = guard.range.uint64(opts.start, _ctErr, "ct/bad-input", "opts.start");
   var end = guard.range.uint64(opts.end, _ctErr, "ct/bad-input", "opts.end");
   if (end < start) {
@@ -1647,7 +1833,7 @@ async function getEntries(opts) {
     throw _ctErr("ct/bad-input", "a range of " + requested + " entries exceeds the " +
       C.LIMITS.CT_MAX_ENTRIES_PER_REQUEST + "-entry request cap");
   }
-  var doc = await _clientJson(opts, "get-entries", "entries", { start: _stringOf(start), end: _stringOf(end) });
+  var doc = await _clientJson(door,"get-entries", "entries", { start: _stringOf(start), end: _stringOf(end) });
   var raw = doc.entries;
   if (!intrinsic.isArray(raw)) throw _ctErr("ct/bad-entries", "the entries field is not an array");
   if (intrinsic.BigInt(raw.length) > requested) {
@@ -1692,8 +1878,9 @@ async function getEntries(opts) {
  *   r.certificates.length;   // -> 2
  */
 async function getRoots(opts) {
-  opts = opts || {};
-  var doc = await _clientJson(opts, "get-roots", "roots");
+  /** @internal This message carries no options of its own, so the door's record is all that is used. */
+  var door = _clientDoor(opts || {}, null);
+  var doc = await _clientJson(door, "get-roots", "roots");
   return guard.verdict.of({ certificates: _b64Array(doc, "certificates", "ct/bad-roots", "roots", undefined, C.LIMITS.CT_MAX_ROOTS) });
 }
 
@@ -1775,7 +1962,8 @@ async function addPreChain(opts) {
  *  The chain encoding, the response shape, and the refusal when the receipt does not verify are one
  *  rule stated once. */
 async function _addChain(opts, message, entryType) {
-  opts = opts || {};
+  var door = _clientDoor(opts || {}, "logKey");
+  opts = door.o;
   /** @internal ONE read of the option, used by the presence check here and by the copy below. Reading it
    *  twice let an accessor answer the two separately, presenting a non-null value to the check and an
    *  attacker's SPKI to the copy, and the returned receipt was then verified against a key the caller
@@ -1808,7 +1996,7 @@ async function _addChain(opts, message, entryType) {
     : { entryType: 1, tbsCertificate: _snap(opts.tbsCertificate, "opts.tbsCertificate"),
       issuerKeyHash: _snap(opts.issuerKeyHash, "opts.issuerKeyHash") };
   var pinnedKey = _snap(suppliedLogKey, "opts.logKey");
-  var doc = await _clientJson(opts, message, "SCT", null, _jsonStringify({ chain: chain }));
+  var doc = await _clientJson(door,message, "SCT", null, _jsonStringify({ chain: chain }));
   var version = doc.sct_version;
   if (version !== 0) {
     throw _ctErr("ct/bad-sct", "the log returned sct_version " + guard.text.showValue(version) +
@@ -2000,11 +2188,21 @@ function _b64Array(obj, name, code, label, exactLen, maxCount) {
  *   r.logs[0] && r.logs[0].trusted;   // the verified, trusted-log set (the detached signature checked first)
  */
 async function fetchLogList(opts) {
-  opts = opts || {};
+  /** @internal The same door the sec. 4 verbs enter by, over this verb's own option set. Checking the
+   *  NAMES alone left every value still to be read from the caller's object, and `url` was read twice,
+   *  once to parse and once to fetch, so an accessor sent the request somewhere the parse never saw. */
+  opts = guard.identifier.optionsObject(opts, _ctErr, "ct/bad-input", "pki.ct.fetchLogList options");
   guard.identifier.assertKnownKeys(opts, KNOWN_FETCH_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
+  /** @internal Every declared option taken before anything derives from one, for the reason
+   *  `_clientDoor` does it: there is no safe order, because reading a NESTED value inside any of them
+   *  runs the caller's code and that code can rewrite the ones not yet taken. Parsing the url first let
+   *  its `toString` empty the pinned anchor list; taking the tls first let a getter on `tls.anchors`
+   *  rewrite the url and the signer key. Taking the top level first closes both. */
+  opts = _settleDecisive(_takeTopLevel(opts, KNOWN_FETCH_OPTS), "signerKey");
   /** @internal Read once, at the door, and carried from here. Asking again would let an option that
    * answers differently on each read hand back something other than the value that was checked. */
   var transport = _assertTransport(opts);
+  var fetchTls = _tlsForFetch(opts);
   /** @internal ONE read, and both the presence check and the copy decide from it. Reading it twice let an
    *  accessor present a non-null value to the check and an attacker's SPKI to the copy, so the list was
    *  verified under a distributor key the caller never pinned.
@@ -2016,23 +2214,31 @@ async function fetchLogList(opts) {
   var pinnedSigner = _toBuffer(suppliedSignerKey, "opts.signerKey", _ctErr, "ct/bad-input");
   if (opts.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log_list.json URL (there is no baked-in vendor URL)");
   var jsonParsed = _parseHttpsUrl(opts.url, "URL");
-  var jsonUrl = jsonParsed.href;
-  var sigUrl = opts.sigUrl != null ? _parseHttpsUrl(opts.sigUrl, "signature URL").href : _sigUrlFor(jsonParsed);
-  if (!_sameOrigin(jsonUrl, sigUrl)) throw _ctErr("ct/bad-input", "opts.sigUrl must share the log-list URL's origin (" + jsonParsed.origin + "); a cross-origin detached-signature host is not supported");
+  var jsonUrl = _urlHref(jsonParsed);
+  /** @internal ONE read: the presence test and the parse decide from the same value. */
+  var suppliedSigUrl = opts.sigUrl;
+  /** @internal Through the captured accessor like every other read of a parsed destination here. No
+   *  caller code can run between the settle above and this line, the bag refusing an accessor and both
+   *  urls having to be strings, so this one has no vector of its own; it is read this way because a
+   *  site that reads a destination off the prototype is the shape that has to stay absent. */
+  var sigUrl = suppliedSigUrl != null
+    ? _urlHref(_parseHttpsUrl(suppliedSigUrl, "signature URL"))
+    : _sigUrlFor(jsonParsed);
+  if (!_sameOrigin(jsonUrl, sigUrl)) throw _ctErr("ct/bad-input", "opts.sigUrl must share the log-list URL's origin (" + _urlOrigin(jsonParsed) + "); a cross-origin detached-signature host is not supported");
   if (!transport) {
-    var t = opts.tls || {};
-    var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(Array.isArray(t.anchors) && t.anchors.length === 0);
-    if (!hasAnchors && t.useSystemStore !== true) throw _ctErr("ct/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned CT server (RFC 6962 sec. 3.2)");
+    var hasAnchors = fetchTls.anchors !== undefined && fetchTls.anchors !== null && !(intrinsic.isArray(fetchTls.anchors) && fetchTls.anchors.length === 0);
+    if (!hasAnchors && fetchTls.useSystemStore !== true) throw _ctErr("ct/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned CT server (RFC 6962 sec. 3.2)");
     transport = httpTransport.https({ E: _ctErr, errPrefix: "ct" });
   }
   var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_FETCH_TIMEOUT, { E: _ctErr, code: "ct/bad-input", min: 1, max: MAX_FETCH_TIMEOUT });
   var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.CT_LOG_LIST_MAX_BYTES, { E: _ctErr, code: "ct/bad-input", min: 1, max: C.LIMITS.CT_LOG_LIST_MAX_BYTES });
   var headers = intrinsic.create(null);
-  guard.identifier.optionNames(opts.headers).forEach(function (k) {
-    var lk = k.toLowerCase();
-    if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = opts.headers[k];
+  var suppliedHeaders = opts.headers;
+  intrinsic.forEach(guard.identifier.optionNames(suppliedHeaders), function (k) {
+    var lk = _toLowerCase(k);
+    if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = suppliedHeaders[k];
   });
-  var req = { headers: headers, tls: _tlsForFetch(opts), timeout: timeout, maxResponseBytes: maxResponseBytes };
+  var req = { headers: headers, tls: fetchTls, timeout: timeout, maxResponseBytes: maxResponseBytes };
   /** @internal Read before the request goes out, so the option that decides the check is the one the call
    *  was made with rather than whatever it says once the response is back. */
   var requireJsonContentType = opts.requireJsonContentType === true;

package/lib/est.js

@@ -80,6 +80,11 @@ var _toLowerCase = intrinsic.uncurry(String.prototype.toLowerCase);
  *  and both build from the RECEIVER, so reading the global binding at the call decides whether the body
  *  runs and whether a refusal stays a refusal. Taken at load. */
 var _Promise = intrinsic.Promise;
+/** @internal The URL parser, taken at load: what it returns names the host an enrollment request goes
+ *  to, and a redirect is resolved against the current operation URL with it. The conversion the parser
+ *  is handed is taken with it, since a replacement answers with a host of its own. */
+var _URL = intrinsic.URL;
+var _stringOf = intrinsic.String;
 var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var pkix = require("./schema-pkix");
@@ -803,21 +808,22 @@ function _csrDer(input) {
 
 function _parseUrl(urlStr) {
   var url;
-  try { url = new URL(String(urlStr)); }
+  try { url = new _URL(_stringOf(urlStr)); }
   catch (e) { throw E("est/bad-url", "the EST server URL did not parse: " + String(urlStr), e); }
   if (url.protocol !== "https:") throw E("est/insecure-url", "EST requires https (RFC 7030 sec. 3.3), got " + url.protocol + " for " + urlStr);
   return url;
 }
 
+/** @internal The settings this client forwards to its transport. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
 function _tlsForRequest(opts) {
-  var t = opts.tls || {};
-  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+  return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
 }
 
 function _redirectTarget(current, location, method, opts) {
   if (location == null || String(location).trim() === "") throw E("est/http-error", "a redirect response carried no Location header");
   var resolved;
-  try { resolved = new URL(String(location), current.href); }
+  try { resolved = new _URL(_stringOf(location), current.href); }
   catch (e) { throw E("est/bad-url", "a redirect Location did not parse: " + location, e); }
   if (resolved.protocol !== "https:") throw E("est/insecure-redirect", "a redirect to a non-https URL is refused (RFC 7030 sec. 3.2.1): " + resolved.protocol);
   var safeMethod = method === "GET" || method === "HEAD";
@@ -980,13 +986,13 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
  * answer, so a verb that holds one passes it and this reads the option only when none was held. */
 function _client(op, method, baseUrl, body, headers, opts, proxySnap, onAttempt, checked) {
   var base;
-  try { base = new URL(String(baseUrl)); }
+  try { base = new _URL(_stringOf(baseUrl)); }
   catch (e) { throw E("est/bad-url", "the EST base URL did not parse: " + guard.text.showValue(baseUrl), e); }
   if (base.search || base.hash) throw E("est/bad-url", "the EST base URL must not carry a query or fragment component (RFC 7030 sec. 3.2.2)");
   var url = _parseUrl(paths(baseUrl, { label: opts.label })[op]);
   var transport = checked !== undefined ? checked : _assertTransport(opts);
   if (!transport) {
-    var t = opts.tls || {};
+    var t = opts.tls != null ? opts.tls : intrinsic.create(null);
     var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(Array.isArray(t.anchors) && t.anchors.length === 0);
     if (!hasAnchors && t.useSystemStore !== true) throw E("est/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned server (RFC 7030 sec. 3.6)");
     transport = httpTransport.https({ E: E, errPrefix: "est" });

package/lib/guard-bytes.js

@@ -247,14 +247,29 @@ function source(input, ErrorClass, code, label) {
   throw _raise(ErrorClass, code, label + ": expected a BufferSource (ArrayBuffer / TypedArray / Buffer)");
 }
 
+/** @internal Into a store of its own, not through `Buffer.from`. A small `Buffer.from` takes its result
+ *  out of the 64 KiB allocation pool, so a caller whose own input came from that pool holds a view of
+ *  the whole store and the copy lands inside it at another offset. MEASURED through a shipped verb: a
+ *  caller's transport, which runs after the key is copied and before the signature is checked, found
+ *  the copy in the pool it shared, wrote an attacker's SPKI over it, and the forged tree head was
+ *  accepted. Every consumer of this door relies on the copy being out of the caller's reach, which is
+ *  the whole reason the copy is taken. The deep copy below has always allocated its own store; this is
+ *  the same allocation. */
+function _ownedCopy(src) {
+  var len = _lengthOf(src);
+  var owned = new _ArrayBuffer(len);
+  _taSet(new _Uint8Array(owned), src);
+  return _bufferFrom(owned, 0, len);
+}
+
 // @enforced-by behavioral -- a copy has no rename-proof code shape to detect (any
 function snapshot(input, ErrorClass, code, label) {
-  return _bufferFrom(view(input, ErrorClass, code, label));
+  return _ownedCopy(view(input, ErrorClass, code, label));
 }
 
 // @enforced-by behavioral -- a copy has no rename-proof shape to detect; the guard
 function snapshotSource(input, ErrorClass, code, label) {
-  return _bufferFrom(source(input, ErrorClass, code, label));
+  return _ownedCopy(source(input, ErrorClass, code, label));
 }
 
 // @enforced-by behavioral -- a copy has no rename-proof code shape to detect (any `Buffer.from(x)`

package/lib/guard-identifier.js

@@ -124,6 +124,27 @@ function optionNames(obj, known) {
   return out;
 }
 
+/** @internal The named settings of a caller's nested record, taken into a record with NO prototype.
+ *  Each module declares its own `names`, because which settings a verb forwards is that verb's
+ *  statement and a shared list would name settings for a verb that does not read them; what is shared
+ *  is that the result cannot inherit. An absent record yields the same shape with every name
+ *  undefined, where the empty object literal it replaces inherited from `Object.prototype`: MEASURED,
+ *  a `useSystemStore` installed there was read as a caller's opt-in and the refusal of a server with
+ *  no pinned anchor was skipped. A name is read off the record itself, so a caller's own defaults
+ *  object on the chain still answers for it.
+ *
+ * @enforced-by behavioral -- a read into a fresh record has no rename-proof shape of its own; the
+ * conformance vectors are each module's own refusal of an unpinned server under a polluted prototype.
+ */
+function pickSettings(record, names) {
+  var out = _create(null);
+  var src = record === null || record === undefined ? null : record;
+  for (var i = 0; i < names.length; i++) {
+    out[names[i]] = src === null ? undefined : src[names[i]];
+  }
+  return out;
+}
+
 /** @internal A caller's options bag copied onto a prototype-less object, keyed by every own string
  *  property, not the enumerable ones alone. Each is read once, so an accessor-backed option
  *  answers the copy and not the later reads. Inherited properties are left behind: the copy is
@@ -609,6 +630,7 @@ module.exports = intrinsic.freeze({
   snapshotOptions: snapshotOptions,
   optionNames: optionNames,
   ownOptions: ownOptions,
+  pickSettings: pickSettings,
   readableNames: readableNames,
   readableIndices: readableIndices
 });

package/lib/guard-intrinsic.js

@@ -68,6 +68,30 @@ var _promiseAny = Promise.any;
  *  present on the supported runtime floor. */
 var _promiseTry = Promise["try"];
 var _promiseWithResolvers = Promise.withResolvers;
+/** @internal The URL parser, captured for the reason the promise constructor is: what it returns names
+ *  the host a request is sent to. A replacement installed while a call is in flight answers with a
+ *  genuine URL of its own, and an endpoint built from that answer reaches a host the caller never
+ *  wrote while the url the caller passed is still the one the call reports. `canParse` is captured
+ *  beside it because a module that decides a form with it is deciding from the same binding. */
+var _URL = URL;
+var _urlCanParse = URL.canParse;
+/** @internal And its accessors, because capturing a constructor does not capture the prototype the
+ *  value it returns reads through. MEASURED: with the constructor captured, a header getter that
+ *  redefined `URL.prototype.href` had every request go to the host its own getter named while the url
+ *  the caller passed was still the one the call reported. The parts of a destination are read through
+ *  these, and the two that build an endpoint are written through the captured setters. */
+var _urlHref = getter(URL.prototype, "href", "URL.prototype");
+var _urlOrigin = getter(URL.prototype, "origin", "URL.prototype");
+var _urlProtocol = getter(URL.prototype, "protocol", "URL.prototype");
+var _urlPathname = getter(URL.prototype, "pathname", "URL.prototype");
+var _urlSearch = getter(URL.prototype, "search", "URL.prototype");
+var _urlHostname = getter(URL.prototype, "hostname", "URL.prototype");
+var _urlPort = getter(URL.prototype, "port", "URL.prototype");
+var _urlUsername = getter(URL.prototype, "username", "URL.prototype");
+var _urlPassword = getter(URL.prototype, "password", "URL.prototype");
+var _urlSearchParams = getter(URL.prototype, "searchParams", "URL.prototype");
+var _urlSetPathname = setter(URL.prototype, "pathname", "URL.prototype");
+var _urlSetSearch = setter(URL.prototype, "search", "URL.prototype");
 var _asyncIterator = Symbol.asyncIterator;
 
 var _arrForEach = uncurry(Array.prototype.forEach);
@@ -160,6 +184,18 @@ function getter(proto, name, who) {
   return uncurry(d.get);
 }
 
+/** @internal The write half of the same question: a replaced setter can drop the write and leave the
+ *  value it was given to change unchanged. */
+// @enforced-by behavioral -- reading a descriptor's `set` is not distinguishable from testing one
+function setter(proto, name, who) {
+  var d = _getOwnPropertyDescriptor(proto, name);
+  if (!d || typeof d.set !== "function") {
+    throw new TypeError("guard.intrinsic.setter: this runtime has no intrinsic " + who + "." +
+      name + " accessor, so the value's own would have to be invoked instead");
+  }
+  return uncurry(d.set);
+}
+
 var _taByteLength = getter(_getPrototypeOf(Uint8Array.prototype), "byteLength", "%TypedArray%.prototype");
 var _dvByteLength = getter(DataView.prototype, "byteLength", "DataView.prototype");
 
@@ -231,6 +267,21 @@ module.exports = Object.freeze({
   promiseAny: _promiseAny,
   promiseTry: _promiseTry,
   promiseWithResolvers: _promiseWithResolvers,
+  setter: setter,
+  URL: _URL,
+  urlCanParse: _urlCanParse,
+  urlHref: _urlHref,
+  urlOrigin: _urlOrigin,
+  urlProtocol: _urlProtocol,
+  urlPathname: _urlPathname,
+  urlSearch: _urlSearch,
+  urlHostname: _urlHostname,
+  urlPort: _urlPort,
+  urlUsername: _urlUsername,
+  urlPassword: _urlPassword,
+  urlSearchParams: _urlSearchParams,
+  urlSetPathname: _urlSetPathname,
+  urlSetSearch: _urlSetSearch,
   asyncIterator: _asyncIterator,
   forEach: _arrForEach,
   map: _arrMap,

package/lib/http-digest.js

@@ -7,6 +7,8 @@ var crypto = require("crypto");
 var constants = require("./constants");
 var intrinsic = require("./guard-intrinsic");
 var _hasOwn = intrinsic.hasOwn;
+/** @internal The URL parser, taken at load: the origin it reports is what a challenge is bound to. */
+var _URL = intrinsic.URL;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _fromCharCode = intrinsic.fromCharCode;
@@ -293,7 +295,7 @@ function answer(challenge, params, E) {
 function _domainEntry(d) {
   d = String(d == null ? "" : d);
   if (d.charAt(0) === "/") return { origin: null, full: d };
-  try { var u = new URL(d); return { origin: u.origin.toLowerCase(), full: (u.pathname || "/") + (u.search || "") }; }
+  try { var u = new _URL(d); return { origin: u.origin.toLowerCase(), full: (u.pathname || "/") + (u.search || "") }; }
   catch (_e) { return null; }
 }
 

package/lib/http-transport.js

@@ -79,6 +79,21 @@ var intrinsic = require("./guard-intrinsic");
  *  step rejected proceed, and `peerChain`'s refusal to tunnel through a proxy is one of those. Taken at
  *  load. */
 var _Promise = intrinsic.Promise;
+/** @internal The URL parser, taken at load: what it returns names the host the socket is opened to,
+ *  for the request itself and for a proxy it is tunneled through. The conversion it is handed is taken
+ *  with it, since a replacement answers with a host of its own. */
+var _URL = intrinsic.URL;
+var _stringOf = intrinsic.String;
+/** @internal The parts of that destination are read through the accessors captured at load, not off the
+ *  prototype the parsed value reads through: a replaced `URL.prototype.hostname` names the host this
+ *  module then opens a socket to. */
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlHostname = intrinsic.urlHostname;
+var _urlPort = intrinsic.urlPort;
+var _urlPathname = intrinsic.urlPathname;
+var _urlSearch = intrinsic.urlSearch;
+var _urlUsername = intrinsic.urlUsername;
+var _urlPassword = intrinsic.urlPassword;
 var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var frameworkError = require("./framework-error");
@@ -331,7 +346,10 @@ function snapshotProxy(p) {
   }
 }
 
-function _validateProxy(request, defaults, E, C, url) {
+/** @internal `originHost`, `statedPort` and `scheme` are the values the request path already read off
+ *  the parsed origin; they are passed in rather than read again here, so the authority this builds for
+ *  the CONNECT target is the same authority the socket options were built from. */
+function _validateProxy(request, defaults, E, C, originHost, originStatedPort, originScheme) {
   var proxy = request.proxy !== undefined ? request.proxy : defaults.proxy;
   if (proxy === undefined || proxy === null) return null;
   guard.identifier.assertPlainRecord(proxy, E, C("bad-proxy"), "opts.proxy");
@@ -339,11 +357,12 @@ function _validateProxy(request, defaults, E, C, url) {
   guard.identifier.assertKnownKeys(proxy, PROXY_KEYS, E, C("bad-proxy"), "opts.proxy has an unknown option ");
   if (typeof proxy.url !== "string") throw E(C("bad-proxy"), "opts.proxy.url must be a string, got " + guard.text.showValue(proxy.url));
   var purl;
-  try { purl = new URL(proxy.url); }
+  try { purl = new _URL(proxy.url); }
   catch (e) { throw E(C("bad-proxy"), "opts.proxy.url did not parse: " + guard.text.showValue(proxy.url), e); }
-  if (purl.protocol !== "http:" && purl.protocol !== "https:") throw E(C("bad-proxy"), "opts.proxy.url must be an http or https URL, got " + purl.protocol);
-  if (purl.username || purl.password) throw E(C("bad-proxy"), "opts.proxy.url must not carry credentials in its userinfo; supply opts.proxy.auth over an https proxy");
-  var secure = purl.protocol === "https:";
+  var pscheme = _urlProtocol(purl);
+  if (pscheme !== "http:" && pscheme !== "https:") throw E(C("bad-proxy"), "opts.proxy.url must be an http or https URL, got " + pscheme);
+  if (_urlUsername(purl) || _urlPassword(purl)) throw E(C("bad-proxy"), "opts.proxy.url must not carry credentials in its userinfo; supply opts.proxy.auth over an https proxy");
+  var secure = pscheme === "https:";
   if (!secure && proxy.tls !== undefined && proxy.tls !== null) throw E(C("bad-proxy"), "opts.proxy.tls applies only to an https proxy; an http proxy connection is plaintext (a supplied tls policy would be silently ignored)");
 
   var auth = null;
@@ -396,14 +415,14 @@ function _validateProxy(request, defaults, E, C, url) {
     proxyTls = { ca: pCa.length ? pCa : undefined, minVersion: pMinVersion, servername: (ptls && ptls.servername) || null };
   }
 
-  var originHost = _stripIpv6Brackets(url.hostname);
   var originAuthHost = nodeNet.isIP(originHost) === 6 ? "[" + originHost + "]" : originHost;
-  var phost = _stripIpv6Brackets(purl.hostname);
+  var phost = _stripIpv6Brackets(_urlHostname(purl));
   /** @internal The CONNECT target is the origin's own authority, so an origin URL that states no
    * port takes the default for the origin's scheme, not the proxy's. Defaulting it to 443 opens
    * the tunnel to a port an `http:` origin does not listen on. */
-  var originPort = url.port || (url.protocol === "http:" ? 80 : 443);
-  return { secure: secure, host: phost, port: purl.port ? +purl.port : (secure ? 443 : 80), originHost: originHost, originAuthority: originAuthHost + ":" + originPort, auth: auth, proxyTls: proxyTls };
+  var originPort = originStatedPort || (originScheme === "http:" ? 80 : 443);
+  var pport = _urlPort(purl);
+  return { secure: secure, host: phost, port: pport ? +pport : (secure ? 443 : 80), originHost: originHost, originAuthority: originAuthHost + ":" + originPort, auth: auth, proxyTls: proxyTls };
 }
 
 function _basicProxyHeader(auth) {
@@ -484,11 +503,14 @@ function httpsTransport(defaults) {
   var E = typeof defaults.E === "function" ? defaults.E : defaultE;
   var prefix = defaults.errPrefix || "transport";
   function C(name) { return prefix + "/" + name; }
-  var tlsDefaults = defaults.tls || {};
+  /** @internal No prototype where no TLS was bound: an empty object literal inherits from
+   *  `Object.prototype`, so a value installed there would answer for a setting nobody set, and one of
+   *  the settings read from this record is the opt-in that turns away an unpinned server. */
+  var tlsDefaults = defaults.tls != null ? defaults.tls : intrinsic.create(null);
 
   function _prepare(request) {
     var url;
-    try { url = new URL(String(request.url)); }
+    try { url = new _URL(_stringOf(request.url)); }
     catch (e) { throw E(C("bad-url"), "the request URL did not parse: " + String(request.url), e); }
     /** @internal https is the floor, and `request.allowPlaintextHttp` is the one thing that moves
      * it, per request and never as a default. It exists for the two objects whose integrity does
@@ -499,11 +521,16 @@ function httpsTransport(defaults) {
      * timeout, and the refusal to follow a redirect, which is what would otherwise turn one
      * plaintext hop into a downgrade of the next. */
     var plaintextAllowed = request.allowPlaintextHttp === true;
-    if (url.protocol !== "https:" && !(plaintextAllowed && url.protocol === "http:")) {
-      throw E(C("insecure-url"), "transport requires https (RFC 7030 sec. 3.3), got " + url.protocol);
+    /** @internal Read ONCE, through the captured accessor, and every decision below made from that
+     *  string. The scheme decides whether the request is allowed at all, whether an anchor is
+     *  required and which port it defaults to, so a prototype whose getter answers each read
+     *  differently would have those three agree on nothing. */
+    var scheme = _urlProtocol(url);
+    if (scheme !== "https:" && !(plaintextAllowed && scheme === "http:")) {
+      throw E(C("insecure-url"), "transport requires https (RFC 7030 sec. 3.3), got " + scheme);
     }
 
-    var reqTls = request.tls || {};
+    var reqTls = request.tls != null ? request.tls : intrinsic.create(null);
     var anchors = reqTls.anchors !== undefined ? reqTls.anchors : tlsDefaults.anchors;
     var useSystem = (reqTls.useSystemStore !== undefined ? reqTls.useSystemStore : tlsDefaults.useSystemStore) === true;
     var hasAnchors = anchors !== undefined && anchors !== null && !(Array.isArray(anchors) && anchors.length === 0);
@@ -511,7 +538,7 @@ function httpsTransport(defaults) {
      * neither an anchor nor the system store is refused rather than left unpinned. A plaintext hop
      * negotiates no certificate, so there is nothing for an anchor to pin; what protects the object
      * fetched over one is its own signature, checked after the fetch by the verb that asked. */
-    if (url.protocol === "https:" && !hasAnchors && !useSystem) {
+    if (scheme === "https:" && !hasAnchors && !useSystem) {
       throw E(C("no-trust-anchors"), "no explicit trust anchor and useSystemStore not set -- refusing an unpinned server (RFC 7030 sec. 3.6)");
     }
 
@@ -534,13 +561,14 @@ function httpsTransport(defaults) {
       reqHeaders["Content-Length"] = Buffer.byteLength(body);
     }
 
-    var host = _stripIpv6Brackets(url.hostname);
-    var plaintext = url.protocol === "http:";
+    var host = _stripIpv6Brackets(_urlHostname(url));
+    var plaintext = scheme === "http:";
+    var statedPort = _urlPort(url);
     var options = {
       method: request.method || "GET",
       hostname: host,
-      port: url.port || (plaintext ? 80 : 443),
-      path: url.pathname + url.search,
+      port: statedPort || (plaintext ? 80 : 443),
+      path: _urlPathname(url) + _urlSearch(url),
       headers: reqHeaders,
       minVersion: minVersion,
       rejectUnauthorized: true,
@@ -566,7 +594,7 @@ function httpsTransport(defaults) {
       };
     }
     var proxyInfo;
-    try { proxyInfo = _validateProxy(request, defaults, E, C, url); }
+    try { proxyInfo = _validateProxy(request, defaults, E, C, host, statedPort, scheme); }
     catch (e) {
       var typedProxyError = false;
       try {

package/lib/ocsp.js

@@ -32,6 +32,8 @@ var _ocspIntrinsic = require("./guard-intrinsic");
  *  the construction to whatever that binding holds, and one settling without awaiting its argument runs
  *  the continuation before the check has finished. */
 var _Promise = _ocspIntrinsic.Promise;
+/** @internal The URL parser, taken at load: the href it reports is the responder a request is sent to. */
+var _URL = _ocspIntrinsic.URL;
 var _promiseResolve = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseResolve);
 /** @internal A refusal returned as a REJECTED promise is a verdict too: read from the global binding, a
  *  replacement whose `reject` resolves instead turns each `ocsp/bad-input` below into a pass. */
@@ -921,7 +923,7 @@ function httpRequest(der, responderUrl, opts) {
    * the string the sec. 5 size bound has to be measured on. The appended segment is base64 under
    * the sec. 2.3 unreserved set, which holds no `.`, so it cannot become a dot segment itself. */
   var normalized;
-  try { normalized = new URL(responderUrl).href; }
+  try { normalized = new _URL(responderUrl).href; }
   catch (e) { throw E("ocsp/bad-input", "httpRequest: the responder URL does not parse as a URL: " + guard.text.describeThrown(e), e); }
   var base = normalized.charAt(normalized.length - 1) === "/"
     ? normalized : normalized + "/";

package/lib/path-validate.js

@@ -67,6 +67,9 @@ var _reject = intrinsic.uncurry(intrinsic.promiseReject);
  * whatever the binding holds: a descriptor failure answering `false` through a replaced constructor is
  * not a refusal, and this module's verdicts are what a caller acts on. */
 var _Promise = intrinsic.Promise;
+/** @internal The URL parser, taken at load: the host it reports from an access descriptor is the host a
+ *  revocation fetch would be directed to. */
+var _URL = intrinsic.URL;
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -3146,7 +3149,7 @@ async function _fetchAiaIssuers(current, aia) {
     if (ad.accessMethod !== OID.caIssuers) continue;
     if (!ad.accessLocation || ad.accessLocation.tag !== 6) continue;
     var u;
-    try { u = new URL(ad.accessLocation.value); }
+    try { u = new _URL(ad.accessLocation.value); }
     catch (_e) { continue; }
     if (u.protocol !== "https:") continue;
     if (_isBlockedAiaHost(u.hostname)) continue;
@@ -3348,7 +3351,7 @@ async function build(leaf, opts) {
        * hostname taken from a certificate would be opened on that promise.
        * @guard-via guard.identifier.declaresOwn */
       transportGuardsAddresses: guard.identifier.declaresOwn(aiaTransport, "blocksPrivateAddresses"),
-      tls: opts.tls || {},
+      tls: opts.tls != null ? opts.tls : intrinsic.create(null),
       timeout: opts.aiaTimeout,
       maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "build: opts.maxResponseBytes", constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES, { E: E, code: "path/bad-input", min: 1, max: constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES }),
       maxPerCert: guard.limits.cap(opts.maxAiaPerCert, "build: opts.maxAiaPerCert", constants.LIMITS.PATH_AIA_MAX_PER_CERT, { E: E, code: "path/bad-input", min: 0 }),

package/lib/revocation-fetch.js

@@ -31,6 +31,9 @@ var OID_AD_OCSP = oid.byName("ocsp");
 var OID_OCSP_NONCE = oid.byName("ocspNonce");
 
 var _append = guard.list.append;
+/** @internal The URL parser, taken at load: the host it reports is the distribution point a fetch is
+ *  directed to. */
+var _URL = intrinsic.URL;
 var LIMITS = constants.LIMITS;
 
 var CHECKER_OPTS = intrinsic.assign(intrinsic.create(null), {
@@ -162,7 +165,7 @@ function _ocspCandidates(descriptions, net_, skips) {
 function _acceptableUrl(value, net_) {
   if (typeof value !== "string" || value === "") return _no("is not one this client fetches");
   var u;
-  try { u = new URL(value); }
+  try { u = new _URL(value); }
   catch (_e) { return _no("is not one this client fetches"); }   // allow:swallow-unverified a value that is not a URL names no location
   if (u.protocol !== "https:" && !(net_.allowHttp && u.protocol === "http:")) return _no("is not one this client fetches");
   var host = u.hostname;

package/lib/scep.js

@@ -37,6 +37,12 @@
 
 var frameworkError = require("./framework-error");
 var ScepError = frameworkError.ScepError;
+var intrinsic = require("./guard-intrinsic");
+/** @internal The URL parser, taken at load: what it returns names the host an operation is sent to,
+ *  and a redirect is resolved against the current operation URL with it. The conversion the parser is
+ *  handed is taken with it, since a replacement answers with a host of its own. */
+var _URL = intrinsic.URL;
+var _stringOf = intrinsic.String;
 var oid = require("./oid");
 var asn1 = require("./asn1-der");
 var b = asn1.build;
@@ -661,14 +667,15 @@ function _responseLen(body) {
   if (Buffer.isBuffer(body)) return guard.bytes.lengthOf(body);
   return guard.bytes.lengthOf(guard.bytes.source(body, ScepError, "scep/bad-response", "the response body"));
 }
+/** @internal The settings this client forwards to its transport. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
 function _tlsForRequest(opts) {
-  var t = opts.tls || {};
-  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+  return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
 }
 function _redirectTarget(current, location, method, allowCrossOrigin) {
   if (location == null || _trim(String(location)) === "") throw _err("scep/bad-response", "a redirect response carried no Location header");
   var resolved;
-  try { resolved = new URL(String(location), current.href); }
+  try { resolved = new _URL(_stringOf(location), current.href); }
   catch (e) { throw _err("scep/bad-url", "a redirect Location did not parse: " + location, e); }
   if (resolved.protocol !== "http:" && resolved.protocol !== "https:") throw _err("scep/bad-url", "a redirect to a non-HTTP scheme is refused: " + resolved.protocol);
   if (current.protocol === "https:" && resolved.protocol !== "https:") throw _err("scep/insecure-redirect", "a redirect from https to " + resolved.protocol + " is refused");
@@ -678,7 +685,7 @@ function _redirectTarget(current, location, method, allowCrossOrigin) {
 }
 function _scepUrl(baseUrl, operation) {
   var url;
-  try { url = new URL(String(baseUrl)); }
+  try { url = new _URL(_stringOf(baseUrl)); }
   catch (e) { throw _err("scep/bad-url", "the SCEP base URL did not parse: " + _showValue(baseUrl), e); }
   if (url.protocol !== "http:" && url.protocol !== "https:") throw _err("scep/bad-url", "the SCEP base URL must be http or https, got " + url.protocol);
   if (url.hash) throw _err("scep/bad-url", "the SCEP base URL must not carry a fragment");
@@ -693,7 +700,7 @@ function _pkiMethod(opts) {
 }
 function _pkiRequest(method, opUrl, reqMsg, clientOpts) {
   if (method === "GET") {
-    var getUrl = new URL(opUrl.href);
+    var getUrl = new _URL(opUrl.href);
     getUrl.searchParams.set("message", Buffer.from(reqMsg).toString("base64"));
     return _client("GET", getUrl, null, {}, clientOpts);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.48",
+  "version": "0.8.50",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:0f0eb9a3-9ce3-42bb-ba73-3ad3528eccf7",
+  "serialNumber": "urn:uuid:4d5a42e5-0e36-46fe-8ef5-f6f19d7c2347",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-05T06:06:36.873Z",
+    "timestamp": "2026-10-05T11:51:03.115Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.48",
+      "bom-ref": "@blamejs/pki@0.8.50",
       "type": "application",
       "name": "pki",
-      "version": "0.8.48",
+      "version": "0.8.50",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.48",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.50",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.48",
+      "ref": "@blamejs/pki@0.8.50",
       "dependsOn": []
     }
   ]