@blamejs/pki 0.8.56 → 0.8.58

package/lib/http-transport.js

@@ -115,6 +115,47 @@ var _urlUsername = intrinsic.urlUsername;
 var _urlPassword = intrinsic.urlPassword;
 var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
+/** @internal The rest of the operations this module decides on, bound at load. Every one of them
+ *  participates in a decision a socket is opened on: which scheme and host the request goes to,
+ *  whether an address is private, which header a value is read under, how a body is sized and
+ *  framed, and which TLS material a hop may carry. Read off the live prototype instead, a
+ *  co-resident replacement answers the comparison rather than the value. */
+var _charAt = intrinsic.uncurry(String.prototype.charAt);
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _strIndexOf = intrinsic.stringIndexOf;
+var _toLowerCase = intrinsic.toLowerCase;
+var _fromCharCode = intrinsic.fromCharCode;
+var _isArray = intrinsic.isArray;
+var _arrIndexOf = intrinsic.indexOf;
+var _arrPush = intrinsic.push;
+var _arrForEach = intrinsic.forEach;
+var _isBuffer = intrinsic.isBuffer;
+var _bufferFrom = intrinsic.bufferFrom;
+var _bufferAlloc = intrinsic.bufferAlloc;
+var _bufToString = intrinsic.bufToString;
+var _byteLength = intrinsic.byteLength;
+var _objectCreate = intrinsic.create;
+var _objectAssign = intrinsic.assign;
+var _objectKeys = intrinsic.keys;
+var _getPrototypeOf = intrinsic.getPrototypeOf;
+var _getOwnPropertyNames = intrinsic.getOwnPropertyNames;
+var _getOwnPropertyDescriptor = intrinsic.getOwnPropertyDescriptor;
+var _objectProto = intrinsic.ObjectProto;
+var _arrayProto = intrinsic.ArrayProto;
+var _hasOwn = intrinsic.hasOwn;
+var _concatList = intrinsic.concatList;
+var _taSet = intrinsic.typedArraySet;
+var _bufferAllocUnsafe = Buffer.allocUnsafe;
+/** @internal The three functions that actually open a connection, bound at load. Looked up on the
+ *  module when the connection is made, a replacement installed afterwards sent a request prepared
+ *  for one destination to another and handed the caller that peer's answer. */
+var _httpsRequest = nodeHttps.request;
+var _httpRequest = nodeHttp.request;
+var _tlsConnect = nodeTls.connect;
+var _netConnect = nodeNet.connect;
+var _mathMin = intrinsic.min;
+var _mathMax = intrinsic.max;
 var frameworkError = require("./framework-error");
 
 var TransportError = frameworkError.TransportError;
@@ -128,20 +169,30 @@ function _budget(value, key, dflt, max, E, code) {
   return guard.limits.cap(value, key, dflt, { E: E, code: code, min: 1, max: max, label: key });
 }
 
-var _LATIN1_WS = String.fromCharCode(0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x20, 0xa0);
+var _LATIN1_WS = _fromCharCode(0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x20, 0xa0);
+
+/** @internal The received bytes, copied out at the length that was counted. The copy is its own
+ *  allocation rather than a view, because the buffer it is taken from is reused as more data
+ *  arrives. */
+function _bodyCopy(buf, len) {
+  var out = _bufferAllocUnsafe(len);
+  _taSet(out, intrinsic.byteSlice(buf, 0, len), 0);
+  return out;
+}
 
 function _looksLikePemArmor(s) {
   var i = 0;
-  while (i < s.length && _LATIN1_WS.indexOf(s.charAt(i)) !== -1) i += 1;
-  return s.slice(i, i + 11) === "-----BEGIN ";
+  while (i < s.length && _strIndexOf(_LATIN1_WS, _charAt(s, i)) !== -1) i += 1;
+  return _strSlice(s, i, i + 11) === "-----BEGIN ";
 }
 function _wrap64Lines(s) {
   var out = "";
-  for (var i = 0; i < s.length; i += 64) out += s.slice(i, i + 64) + "\n";
+  for (var i = 0; i < s.length; i += 64) out += _strSlice(s, i, i + 64) + "\n";
   return out;
 }
 function _stripIpv6Brackets(s) {
-  return (s.length >= 2 && s.charAt(0) === "[" && s.charAt(s.length - 1) === "]") ? s.slice(1, s.length - 1) : s;
+  return (s.length >= 2 && _charAt(s, 0) === "[" && _charAt(s, s.length - 1) === "]")
+    ? _strSlice(s, 1, s.length - 1) : s;
 }
 
 var TLS_EXPORTER_LABEL = "EXPORTER-Channel-Binding";
@@ -150,9 +201,9 @@ var TLS_EXPORTER_LENGTH = 32;
 function _tlsExporter(socket, proto) {
   if (proto !== "TLSv1.3" || !socket || typeof socket.exportKeyingMaterial !== "function") return null;
   var out;
-  try { out = socket.exportKeyingMaterial(TLS_EXPORTER_LENGTH, TLS_EXPORTER_LABEL, Buffer.alloc(0)); }
+  try { out = socket.exportKeyingMaterial(TLS_EXPORTER_LENGTH, TLS_EXPORTER_LABEL, _bufferAlloc(0)); }
   catch (_ee) { return null; }
-  return (Buffer.isBuffer(out) && out.length === TLS_EXPORTER_LENGTH) ? out : null;
+  return (_isBuffer(out) && out.length === TLS_EXPORTER_LENGTH) ? out : null;
 }
 
 function _tlsInfo(socket) {
@@ -182,10 +233,10 @@ function _peerChain(socket) {
   var out = [];
   var seen = [];
   var cur = socket.getPeerCertificate(true);
-  while (cur && Buffer.isBuffer(cur.raw) && out.length < constants.LIMITS.TLS_MAX_PEER_CHAIN) {
-    if (seen.indexOf(cur) !== -1) break;
-    seen.push(cur);
-    out.push(cur.raw);
+  while (cur && _isBuffer(cur.raw) && out.length < constants.LIMITS.TLS_MAX_PEER_CHAIN) {
+    if (_arrIndexOf(seen, cur) !== -1) break;
+    _arrPush(seen, cur);
+    _arrPush(out, cur.raw);
     cur = cur.issuerCertificate;
   }
   return out;
@@ -193,26 +244,31 @@ function _peerChain(socket) {
 
 function _pemifyAnchor(a) {
   if (typeof a === "string") return a;
-  if (Buffer.isBuffer(a)) {
-    if (_looksLikePemArmor(a.toString("latin1", 0, 64))) return a;
-    var b64 = _wrap64Lines(a.toString("base64"));
+  if (_isBuffer(a)) {
+    if (_looksLikePemArmor(_bufToString(a, "latin1", 0, 64))) return a;
+    var b64 = _wrap64Lines(_bufToString(a, "base64"));
     return "-----BEGIN CERTIFICATE-----\n" + b64 + "-----END CERTIFICATE-----\n";
   }
   return a;
 }
 function _pemifyAnchors(anchors) {
-  var list = Array.isArray(anchors) ? guard.list.copyMap(anchors, _pemifyAnchor) : [_pemifyAnchor(anchors)];
+  var list = _isArray(anchors) ? guard.list.copyMap(anchors, _pemifyAnchor) : [_pemifyAnchor(anchors)];
   return list;
 }
 
+/** @internal The platform trust store is read through the provider bound at load. Looked up on the
+ *  module at call time, a replacement installed after load answered with its own list and became the
+ *  trust a `useSystemStore` connection is accepted under. */
+var _getCACertificates = typeof nodeTls.getCACertificates === "function" ? nodeTls.getCACertificates : null;
+
 var _systemCaCache = null;
 function _systemCa() {
   if (_systemCaCache !== null) return _systemCaCache;
   var out = [];
-  if (typeof nodeTls.getCACertificates === "function") {
-    ["system", "bundled"].forEach(function (t) {
+  if (_getCACertificates !== null) {
+    _arrForEach(["system", "bundled"], function (t) {
       // allow:swallow-unverified a store TYPE unsupported on this node is skipped; the other type
-      try { var c = nodeTls.getCACertificates(t); if (Array.isArray(c)) out = out.concat(c); } catch (_e) { }
+      try { var c = intrinsic.apply(_getCACertificates, nodeTls, [t]); if (_isArray(c)) out = _concatList(out, c); } catch (_e) { }
     });
   }
   _systemCaCache = out;
@@ -282,9 +338,19 @@ function _makeGuardedLookup(lookupFn) {
   return function guardedLookup(hostname, options, callback) {
     lookupFn(hostname, options || {}, function (err, address, family) {
       if (err) return callback(err);
-      if (Array.isArray(address)) {
-        for (var i = 0; i < address.length; i++) if (_isBlockedIp(address[i].address)) return callback(_blockedAddrErr(hostname, address[i].address));
-        return callback(null, address);
+      /** @internal Each address is read ONCE, the read is what gets classified, and the SNAPSHOT is
+       *  what the socket layer is handed. Forwarding the list the resolver returned let the entry be
+       *  read again after it was cleared: a `lookup` answering a public address to this check and a
+       *  loopback one to the connection reached loopback with `blockPrivateAddresses` set. */
+      if (_isArray(address)) {
+        var checked = [];
+        for (var i = 0; i < address.length; i++) {
+          var entry = address[i];
+          var one = { address: entry && entry.address, family: entry && entry.family };
+          if (_isBlockedIp(one.address)) return callback(_blockedAddrErr(hostname, one.address));
+          checked[i] = one;
+        }
+        return callback(null, checked);
       }
       if (_isBlockedIp(address)) return callback(_blockedAddrErr(hostname, address));
       return callback(null, address, family);
@@ -295,75 +361,81 @@ var _guardedLookup = _makeGuardedLookup(nodeDns.lookup);
 
 function _hasSelfSigned(l) {
   for (var i = 0; i + 4 <= l.length; i++) {
-    if (l.charCodeAt(i) === 0x73 && l.charCodeAt(i + 1) === 0x65 && l.charCodeAt(i + 2) === 0x6c && l.charCodeAt(i + 3) === 0x66) {
-      if (l.indexOf("signed", i + 4) === i + 4) return true;
-      var mid = l.charCodeAt(i + 4);
-      if (i + 4 < l.length && mid !== 0x0a && mid !== 0x0d && mid !== 0x2028 && mid !== 0x2029 && l.indexOf("signed", i + 5) === i + 5) return true;
+    if (_charCodeAt(l, i) === 0x73 && _charCodeAt(l, i + 1) === 0x65 && _charCodeAt(l, i + 2) === 0x6c && _charCodeAt(l, i + 3) === 0x66) {
+      if (_strIndexOf(l, "signed", i + 4) === i + 4) return true;
+      var mid = _charCodeAt(l, i + 4);
+      if (i + 4 < l.length && mid !== 0x0a && mid !== 0x0d && mid !== 0x2028 && mid !== 0x2029 && _strIndexOf(l, "signed", i + 5) === i + 5) return true;
     }
   }
   return false;
 }
 function _hasWordBounded(l, word) {
-  var at = l.indexOf(word);
+  var at = _strIndexOf(l, word);
   while (at !== -1) {
-    var before = at === 0 || !_isLowerWordChar(l.charCodeAt(at - 1));
+    var before = at === 0 || !_isLowerWordChar(_charCodeAt(l, at - 1));
     var afterI = at + word.length;
-    var after = afterI === l.length || !_isLowerWordChar(l.charCodeAt(afterI));
+    var after = afterI === l.length || !_isLowerWordChar(_charCodeAt(l, afterI));
     if (before && after) return true;
-    at = l.indexOf(word, at + 1);
+    at = _strIndexOf(l, word, at + 1);
   }
   return false;
 }
 function _isLowerWordChar(c) { return (c >= 97 && c <= 122) || (c >= 48 && c <= 57) || c === 95; }
 function _classifyError(e, C) {
   if (e && e.pkiBlockedAddress) return C("blocked-address");
-  var s = String((e && e.code) || "") + " " + String((e && e.message) || "");
-  var l = s.toLowerCase();
-  if (l.indexOf("protocol_version") !== -1 || l.indexOf("unsupported_protocol") !== -1 || l.indexOf("version_too_low") !== -1 ||
-      l.indexOf("wrong_version") !== -1 || l.indexOf("no_protocols_available") !== -1 || l.indexOf("inappropriate_fallback") !== -1) return C("tls-floor");
-  if (l.indexOf("cert") !== -1 || l.indexOf("verify") !== -1 || l.indexOf("altname") !== -1 || l.indexOf("hostname") !== -1 ||
-      l.indexOf("depth_zero") !== -1 || l.indexOf("local_issuer") !== -1 || l.indexOf("handshake") !== -1 ||
+  var s = _stringOf((e && e.code) || "") + " " + _stringOf((e && e.message) || "");
+  var l = _toLowerCase(s);
+  if (_strIndexOf(l, "protocol_version") !== -1 || _strIndexOf(l, "unsupported_protocol") !== -1 || _strIndexOf(l, "version_too_low") !== -1 ||
+      _strIndexOf(l, "wrong_version") !== -1 || _strIndexOf(l, "no_protocols_available") !== -1 || _strIndexOf(l, "inappropriate_fallback") !== -1) return C("tls-floor");
+  if (_strIndexOf(l, "cert") !== -1 || _strIndexOf(l, "verify") !== -1 || _strIndexOf(l, "altname") !== -1 || _strIndexOf(l, "hostname") !== -1 ||
+      _strIndexOf(l, "depth_zero") !== -1 || _strIndexOf(l, "local_issuer") !== -1 || _strIndexOf(l, "handshake") !== -1 ||
       _hasSelfSigned(l) || _hasWordBounded(l, "ssl") || _hasWordBounded(l, "tls")) return C("server-auth-failed");
   return C("transport-error");
 }
 
-function _keySet(names) { var m = Object.create(null); for (var i = 0; i < names.length; i++) m[names[i]] = true; return m; }
+function _keySet(names) { var m = _objectCreate(null); for (var i = 0; i < names.length; i++) m[names[i]] = true; return m; }
 var PROXY_KEYS = _keySet(["url", "auth", "tls"]);
 var PROXY_AUTH_KEYS = _keySet(["scheme", "username", "password", "allowMD5", "allowLegacyQop"]);
 var PROXY_DIGEST_KNOBS = ["allowMD5", "allowLegacyQop"];
 var PROXY_TLS_KEYS = _keySet(["anchors", "useSystemStore", "servername", "minVersion"]);
 
-function _copyAnchor(a) { return (a !== null && typeof a === "object" && nodeUtil.types.isProxy(a)) ? a : (Buffer.isBuffer(a) ? Buffer.from(a) : a); }
+function _copyAnchor(a) { return (a !== null && typeof a === "object" && nodeUtil.types.isProxy(a)) ? a : (_isBuffer(a) ? _bufferFrom(a) : a); }
 function _noopProxyErr(code, message) { var e = new Error(message); e.code = code; e.isPkiError = true; return e; }
 function _copyableRecord(p) {
   if (!guard.identifier.isPlainRecord(p)) return false;
-  var proto = Object.getPrototypeOf(p);
-  if (proto !== Object.prototype && proto !== null) return false;
+  var proto = _getPrototypeOf(p);
+  if (proto !== _objectProto && proto !== null) return false;
   if (Object.getOwnPropertySymbols(p).length !== 0) return false;
   var ownEnumData = 0;
-  var names = Object.getOwnPropertyNames(p);
+  var names = _getOwnPropertyNames(p);
   for (var i = 0; i < names.length; i++) {
-    var d = Object.getOwnPropertyDescriptor(p, names[i]);
+    var d = _getOwnPropertyDescriptor(p, names[i]);
     if (!d.enumerable || d.get || d.set) return false;
     ownEnumData++;
   }
   var readable = guard.identifier.readableNames(p, _noopProxyErr, "transport/bad-proxy", "opts.proxy");
   if (readable.length !== ownEnumData) return false;
   for (var j = 0; j < readable.length; j++) {
-    var rd = Object.getOwnPropertyDescriptor(p, readable[j]);
+    var rd = _getOwnPropertyDescriptor(p, readable[j]);
     if (!rd || !rd.enumerable || rd.get || rd.set) return false;
   }
   return true;
 }
 function _copyableArray(a) {
-  if (a === null || typeof a !== "object" || nodeUtil.types.isProxy(a) || !Array.isArray(a) || Object.getPrototypeOf(a) !== Array.prototype) return false;
+  if (a === null || typeof a !== "object" || nodeUtil.types.isProxy(a) || !_isArray(a) || _getPrototypeOf(a) !== _arrayProto) return false;
   if (a.length > constants.LIMITS.PROXY_MAX_TLS_ANCHORS) return false;
   if (Object.getOwnPropertySymbols(a).length !== 0) return false;
-  var names = Object.getOwnPropertyNames(a);
+  var names = _getOwnPropertyNames(a);
   for (var i = 0; i < names.length; i++) {
-    var d = Object.getOwnPropertyDescriptor(a, names[i]);
+    var d = _getOwnPropertyDescriptor(a, names[i]);
     if (d.get || d.set) return false;
   }
+  /** @internal Every index has to be the array's OWN. A descriptor walk cannot see a HOLE, so a
+   *  sparse list whose gap is answered by an accessor on `Array.prototype` passed this check and
+   *  then read a different value at each read: the validation saw one anchor and the conversion
+   *  used another. Reading by index is specified to consult the prototype at a hole, which is why
+   *  the gap is refused here rather than read carefully later. */
+  for (var k = 0; k < a.length; k++) { if (!_hasOwn(a, k)) return false; }
   return true;
 }
 function snapshotProxy(p) {
@@ -379,7 +451,7 @@ function snapshotProxy(p) {
         for (var i = 0; i < a.length; i++) copied[i] = _copyAnchor(a[i]);
         out.tls.anchors = copied;
       } else if (typeof a === "string") out.tls.anchors = a;
-      else if (a !== null && typeof a === "object" && !nodeUtil.types.isProxy(a) && Buffer.isBuffer(a)) out.tls.anchors = Buffer.from(a);
+      else if (a !== null && typeof a === "object" && !nodeUtil.types.isProxy(a) && _isBuffer(a)) out.tls.anchors = _bufferFrom(a);
     }
     return out;
   } catch (_e) {
@@ -392,7 +464,8 @@ function snapshotProxy(p) {
  *  the parsed origin; they are passed in rather than read again here, so the authority this builds for
  *  the CONNECT target is the same authority the socket options were built from. */
 function _validateProxy(request, defaults, E, C, originHost, originStatedPort, originScheme) {
-  var proxy = request.proxy !== undefined ? request.proxy : defaults.proxy;
+  var rawProxy = request.proxy;
+  var proxy = rawProxy !== undefined ? rawProxy : defaults.proxy;
   if (proxy === undefined || proxy === null) return null;
   guard.identifier.assertPlainRecord(proxy, E, C("bad-proxy"), "opts.proxy");
   if (!_copyableRecord(proxy)) throw E(C("bad-proxy"), "opts.proxy must be a plain object with only own enumerable data properties");
@@ -443,21 +516,25 @@ function _validateProxy(request, defaults, E, C, originHost, originStatedPort, o
     var pAnchors = ptls ? ptls.anchors : undefined;
     if (pAnchors !== undefined && pAnchors !== null && typeof pAnchors === "object" && nodeUtil.types.isProxy(pAnchors)) throw E(C("bad-proxy"), "opts.proxy.tls.anchors must not be a Proxy");
     var pUseSystem = ptls ? ptls.useSystemStore === true : false;
-    var pHasAnchors = pAnchors !== undefined && pAnchors !== null && !(Array.isArray(pAnchors) && pAnchors.length === 0);
+    var pHasAnchors = pAnchors !== undefined && pAnchors !== null && !(_isArray(pAnchors) && pAnchors.length === 0);
     if (!pHasAnchors && !pUseSystem) throw E(C("bad-proxy"), "an https proxy requires explicit tls trust: set proxy.tls.anchors or proxy.tls.useSystemStore");
     if (pHasAnchors) {
-      if (Array.isArray(pAnchors) && !_copyableArray(pAnchors)) throw E(C("bad-proxy"), "opts.proxy.tls.anchors must be a plain array of PEM strings or DER Buffers");
-      var pAnchorList = Array.isArray(pAnchors) ? pAnchors : [pAnchors];
+      if (_isArray(pAnchors) && !_copyableArray(pAnchors)) throw E(C("bad-proxy"), "opts.proxy.tls.anchors must be a plain array of PEM strings or DER Buffers");
+      var pAnchorList = _isArray(pAnchors) ? pAnchors : [pAnchors];
       for (var pai = 0; pai < pAnchorList.length; pai++) {
         var pan = pAnchorList[pai];
-        if ((pan !== null && typeof pan === "object" && nodeUtil.types.isProxy(pan)) || (typeof pan !== "string" && !Buffer.isBuffer(pan))) throw E(C("bad-proxy"), "opts.proxy.tls.anchors must be a PEM string or a DER Buffer (or an array of them)");
+        if ((pan !== null && typeof pan === "object" && nodeUtil.types.isProxy(pan)) || (typeof pan !== "string" && !_isBuffer(pan))) throw E(C("bad-proxy"), "opts.proxy.tls.anchors must be a PEM string or a DER Buffer (or an array of them)");
       }
     }
     var pMinVersion = (ptls && ptls.minVersion !== undefined && ptls.minVersion !== null) ? ptls.minVersion : DEFAULT_MIN_VERSION;
     if (pMinVersion !== "TLSv1.2" && pMinVersion !== "TLSv1.3") throw E(C("bad-proxy"), "proxy.tls.minVersion must be 'TLSv1.2' or 'TLSv1.3', got " + guard.text.showValue(pMinVersion));
     var pCa = [];
-    if (pHasAnchors) pCa = pCa.concat(_pemifyAnchors(pAnchors));
-    if (pUseSystem) pCa = pCa.concat(_systemCa());
+    /** @internal `concatList`, not the captured `concat`: `Array.prototype.concat` is specified to
+     * consult `Symbol.isConcatSpreadable` on each argument, so capturing the method leaves the
+     * SPREADING replaceable and an inherited hook replaced a validated anchor with another one in
+     * the CONNECT options. `concatList` copies own indexes and appends own indexes. */
+    if (pHasAnchors) pCa = _concatList(pCa, _pemifyAnchors(pAnchors));
+    if (pUseSystem) pCa = _concatList(pCa, _systemCa());
     proxyTls = { ca: pCa.length ? pCa : undefined, minVersion: pMinVersion, servername: pServername };
   }
 
@@ -472,7 +549,7 @@ function _validateProxy(request, defaults, E, C, originHost, originStatedPort, o
 }
 
 function _basicProxyHeader(auth) {
-  return "Basic " + Buffer.from(auth.username + ":" + auth.password, "utf8").toString("base64");
+  return "Basic " + _bufToString(_bufferFrom(auth.username + ":" + auth.password, "utf8"), "base64");
 }
 
 /** @internal The `Proxy-Authorization` value answering a proxy's `Proxy-Authenticate: Digest` challenge
@@ -501,10 +578,10 @@ function _digestProxyCredential(headers, pinfo, C, E) {
   }, E);
 }
 function _proxyErrorClass(e, C) {
-  var code = String((e && e.code) || "");
-  if (code.indexOf("ERR_TLS") === 0 || code.indexOf("ERR_SSL") === 0 || code.indexOf("SSL") !== -1 ||
-      code.indexOf("CERT") !== -1 || code.indexOf("SELF_SIGNED") !== -1 || code.indexOf("VERIFY") !== -1 ||
-      code.indexOf("_SIGNATURE") !== -1 || code.indexOf("ALTNAME") !== -1) return C("proxy-tls-failed");
+  var code = _stringOf((e && e.code) || "");
+  if (_strIndexOf(code, "ERR_TLS") === 0 || _strIndexOf(code, "ERR_SSL") === 0 || _strIndexOf(code, "SSL") !== -1 ||
+      _strIndexOf(code, "CERT") !== -1 || _strIndexOf(code, "SELF_SIGNED") !== -1 || _strIndexOf(code, "VERIFY") !== -1 ||
+      _strIndexOf(code, "_SIGNATURE") !== -1 || _strIndexOf(code, "ALTNAME") !== -1) return C("proxy-tls-failed");
   return C("proxy-connect-failed");
 }
 
@@ -548,18 +625,22 @@ function _proxyErrorClass(e, C) {
  */
 function httpsTransport(defaults) {
   defaults = defaults || {};
-  var E = typeof defaults.E === "function" ? defaults.E : defaultE;
+  /** @internal Each of these is read ONCE, into the value both the test and the use see, and the
+   *  error factory a refusal is built from is one of them. */
+  var rawE = defaults.E;
+  var E = typeof rawE === "function" ? rawE : defaultE;
   var prefix = defaults.errPrefix || "transport";
   function C(name) { return prefix + "/" + name; }
   /** @internal No prototype where no TLS was bound: an empty object literal inherits from
    *  `Object.prototype`, so a value installed there would answer for a setting nobody set, and one of
    *  the settings read from this record is the opt-in that turns away an unpinned server. */
-  var tlsDefaults = defaults.tls != null ? defaults.tls : intrinsic.create(null);
+  var rawDefaultTls = defaults.tls;
+  var tlsDefaults = rawDefaultTls != null ? rawDefaultTls : intrinsic.create(null);
 
   function _prepare(request) {
     var url;
     try { url = new _URL(_stringOf(request.url)); }
-    catch (e) { throw E(C("bad-url"), "the request URL did not parse: " + String(request.url), e); }
+    catch (e) { throw E(C("bad-url"), "the request URL did not parse: " + _stringOf(request.url), e); }
     /** @internal https is the floor, and `request.allowPlaintextHttp` is the one thing that moves
      * it, per request and never as a default. It exists for the two objects whose integrity does
      * not come from the transport: a CRL and an OCSP response are signed, their signatures are
@@ -578,10 +659,17 @@ function httpsTransport(defaults) {
       throw E(C("insecure-url"), "transport requires https (RFC 7030 sec. 3.3), got " + scheme);
     }
 
-    var reqTls = request.tls != null ? request.tls : intrinsic.create(null);
-    var anchors = reqTls.anchors !== undefined ? reqTls.anchors : tlsDefaults.anchors;
-    var useSystem = (reqTls.useSystemStore !== undefined ? reqTls.useSystemStore : tlsDefaults.useSystemStore) === true;
-    var hasAnchors = anchors !== undefined && anchors !== null && !(Array.isArray(anchors) && anchors.length === 0);
+    /** @internal Each setting is read ONCE, into the value the presence test and the use share. Read
+     *  twice, the second read decided: a `tls` answering an object to the test and nothing to the use
+     *  left `reqTls` undefined, and the anchor read on the next line threw a raw TypeError out of a
+     *  public verb instead of this module's typed refusal. */
+    var rawReqTls = request.tls;
+    var reqTls = rawReqTls != null ? rawReqTls : intrinsic.create(null);
+    var rawAnchors = reqTls.anchors;
+    var anchors = rawAnchors !== undefined ? rawAnchors : tlsDefaults.anchors;
+    var rawUseSystem = reqTls.useSystemStore;
+    var useSystem = (rawUseSystem !== undefined ? rawUseSystem : tlsDefaults.useSystemStore) === true;
+    var hasAnchors = anchors !== undefined && anchors !== null && !(_isArray(anchors) && anchors.length === 0);
     /** @internal A trust anchor is what makes an https server identifiable, so a request with
      * neither an anchor nor the system store is refused rather than left unpinned. A plaintext hop
      * negotiates no certificate, so there is nothing for an anchor to pin; what protects the object
@@ -590,8 +678,10 @@ function httpsTransport(defaults) {
       throw E(C("no-trust-anchors"), "no explicit trust anchor and useSystemStore not set -- refusing an unpinned server (RFC 7030 sec. 3.6)");
     }
 
-    var timeout = _budget(request.timeout !== undefined ? request.timeout : defaults.timeout, "timeout", DEFAULT_TIMEOUT, MAX_TIMEOUT, E, C("bad-input"));
-    var maxBytes = _budget(request.maxResponseBytes !== undefined ? request.maxResponseBytes : defaults.maxResponseBytes, "maxResponseBytes", constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, E, C("bad-input"));
+    var rawTimeout = request.timeout;
+    var timeout = _budget(rawTimeout !== undefined ? rawTimeout : defaults.timeout, "timeout", DEFAULT_TIMEOUT, MAX_TIMEOUT, E, C("bad-input"));
+    var rawMaxBytes = request.maxResponseBytes;
+    var maxBytes = _budget(rawMaxBytes !== undefined ? rawMaxBytes : defaults.maxResponseBytes, "maxResponseBytes", constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, E, C("bad-input"));
 
     var minVersion = reqTls.minVersion || tlsDefaults.minVersion || DEFAULT_MIN_VERSION;
     if (minVersion !== "TLSv1.2" && minVersion !== "TLSv1.3") throw E(C("bad-input"), "tls.minVersion must be 'TLSv1.2' or 'TLSv1.3' (never below the floor), got " + minVersion);
@@ -601,12 +691,12 @@ function httpsTransport(defaults) {
     if (!bodyIsFn && guard.bytes.isByteSource(body)) body = guard.bytes.source(body, E, C("bad-input"), "the request body");
 
     var reqHeaders = guard.identifier.ownOptions(request.headers);
-    Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "proxy-authorization" || lk === "proxy-connection") delete reqHeaders[k]; });
+    _arrForEach(_objectKeys(reqHeaders), function (k) { var lk = _toLowerCase(k); if (lk === "proxy-authorization" || lk === "proxy-connection") delete reqHeaders[k]; });
     if (bodyIsFn) {
-      Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "content-length" || lk === "transfer-encoding" || lk === "expect") delete reqHeaders[k]; });
+      _arrForEach(_objectKeys(reqHeaders), function (k) { var lk = _toLowerCase(k); if (lk === "content-length" || lk === "transfer-encoding" || lk === "expect") delete reqHeaders[k]; });
     } else if (body != null && body !== "") {
-      Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "content-length" || lk === "transfer-encoding") delete reqHeaders[k]; });
-      reqHeaders["Content-Length"] = Buffer.byteLength(body);
+      _arrForEach(_objectKeys(reqHeaders), function (k) { var lk = _toLowerCase(k); if (lk === "content-length" || lk === "transfer-encoding") delete reqHeaders[k]; });
+      reqHeaders["Content-Length"] = _byteLength(body);
     }
 
     var host = _stripIpv6Brackets(_urlHostname(url));
@@ -622,11 +712,23 @@ function httpsTransport(defaults) {
       rejectUnauthorized: true,
       agent: false,
     };
-    var cert = reqTls.cert !== undefined ? reqTls.cert : tlsDefaults.cert;
-    var key = reqTls.key !== undefined ? reqTls.key : tlsDefaults.key;
-    var callerCsi = typeof reqTls.checkServerIdentity === "function" ? reqTls.checkServerIdentity
-      : (typeof tlsDefaults.checkServerIdentity === "function" ? tlsDefaults.checkServerIdentity : null);
-    var sni = (reqTls.servername !== undefined ? reqTls.servername : tlsDefaults.servername) || host;
+    var rawCert = reqTls.cert, rawKey = reqTls.key;
+    var cert = rawCert !== undefined ? rawCert : tlsDefaults.cert;
+    var key = rawKey !== undefined ? rawKey : tlsDefaults.key;
+    /** @internal The hook is read once and that one value is both type-checked and installed. Read
+     *  twice, the type check passed on a function and something else was installed as the identity
+     *  check this connection is accepted on. The transport's default is read ONLY where the request
+     *  supplied no function of its own, because a per-request hook overrides it and reading it anyway
+     *  runs an accessor the request opted out of. */
+    var rawCsi = reqTls.checkServerIdentity;
+    var callerCsi = null;
+    if (typeof rawCsi === "function") callerCsi = rawCsi;
+    else {
+      var rawDefaultCsi = tlsDefaults.checkServerIdentity;
+      if (typeof rawDefaultCsi === "function") callerCsi = rawDefaultCsi;
+    }
+    var rawSni = reqTls.servername;
+    var sni = (rawSni !== undefined ? rawSni : tlsDefaults.servername) || host;
     /** @internal Typed here, the way `opts.proxy.tls.servername` is typed on the proxy arm. The value
      * is read three times after this point and each read is a separate conversion: once to decide it
      * is not an address literal, once by the TLS layer for the name sent in the handshake, and once
@@ -635,8 +737,8 @@ function httpsTransport(defaults) {
     if (typeof sni !== "string") throw E(C("bad-input"), "tls.servername must be a string, got " + guard.text.showValue(sni));
     if (sni && !_isIP(sni)) options.servername = sni;
     var caList = [];
-    if (hasAnchors) caList = caList.concat(_pemifyAnchors(anchors));
-    if (useSystem) caList = caList.concat(_systemCa());
+    if (hasAnchors) caList = _concatList(caList, _pemifyAnchors(anchors));
+    if (useSystem) caList = _concatList(caList, _systemCa());
     if (caList.length) options.ca = caList;
     if (cert) options.cert = cert;
     if (key) options.key = key;
@@ -666,7 +768,8 @@ function httpsTransport(defaults) {
       if (typedProxyError) throw e;
       throw E(C("bad-proxy"), "opts.proxy could not be validated", e);
     }
-    var blockPrivate = (request.blockPrivateAddresses !== undefined ? request.blockPrivateAddresses : defaults.blockPrivateAddresses) === true;
+    var rawBlockPrivate = request.blockPrivateAddresses;
+    var blockPrivate = (rawBlockPrivate !== undefined ? rawBlockPrivate : defaults.blockPrivateAddresses) === true;
     if (blockPrivate && proxyInfo) throw E(C("bad-proxy"), "blockPrivateAddresses cannot be enforced through a forward proxy, which resolves the origin itself and would reach a private origin the transport never checks; use a direct connection for a private-address-blocked fetch");
     if (blockPrivate) {
       if (_isBlockedIp(host)) throw E(C("blocked-address"), "refusing to connect to the private / loopback / link-local address literal " + host);
@@ -708,28 +811,60 @@ function httpsTransport(defaults) {
         try {
           /** @internal A plaintext request goes through `node:http`, which has no TLS options to
            * ignore; `prep.plaintext` is set only where the scheme check let `http:` through. */
+          /** @internal The request function is the one bound at load, not the property looked up on
+           * the module when the request is made: a replacement installed afterwards sent a request
+           * prepared for one host to another and handed the caller that server's response. */
           var client = prep.plaintext ? nodeHttp : nodeHttps;
-          req = client.request(options, function (res) {
+          var clientRequest = prep.plaintext ? _httpRequest : _httpsRequest;
+          /** @internal The socket is built here rather than by the agent node makes for the request.
+           * `agent: false` still leaves the construction on the agent prototype, so a replacement
+           * installed after load returned a connection to another destination and the request went
+           * out over it: measured, an `https:` request under `blockPrivateAddresses` reached a local
+           * plaintext listener, presented no certificate, and its body reached the caller. The
+           * options are the ones node computed for this hop, forwarded unchanged, so every TLS
+           * setting the request carries still applies; only the function that opens the socket is
+           * this module's. The tunnel path already supplies its own and keeps it. */
+          if (options.createConnection === undefined) {
+            options.createConnection = prep.plaintext
+              ? function (opts) { return intrinsic.apply(_netConnect, nodeNet, [opts]); }
+              : function (opts) { return intrinsic.apply(_tlsConnect, nodeTls, [opts]); };
+          }
+          /** @internal `agent: false` is NOT no agent: node builds one from the default agent's
+           * constructor and that agent's own builder opens the socket, so the builder above was never
+           * reached. Left unset with a builder present, node skips the agent altogether, which is the
+           * same no-pooling behavior `agent: false` was there for. */
+          options.agent = undefined;
+          req = intrinsic.apply(clientRequest, client, [options, function (res) {
             var tlsInfo = _tlsInfo(res.socket);
             /** @internal Captured for consistency with the rest of the file, not because this gates
              * anything: an understated `content-length` only skips this EARLY refusal, and the cap is
              * enforced below on the bytes actually counted as they arrive. */
             var declared = intrinsic.parseInt((res.headers || {})["content-length"], 10);
-            if (Number.isFinite(declared) && declared > prep.maxBytes) { fail(C("response-too-large"), "the declared content-length " + declared + " exceeds the " + prep.maxBytes + "-byte cap (RFC 7030 sec. 6)"); return; }
-            var buf = Buffer.allocUnsafe(0);
+            if (intrinsic.numberIsFinite(declared) && declared > prep.maxBytes) { fail(C("response-too-large"), "the declared content-length " + declared + " exceeds the " + prep.maxBytes + "-byte cap (RFC 7030 sec. 6)"); return; }
+            var buf = _bufferAllocUnsafe(0);
             var len = 0;
             var total = 0;
             res.on("data", function (chunk) {
-              total += chunk.length;
+              /** @internal The arriving chunk is measured ONCE, from its bytes rather than from a
+               * `length` property. Read four times off the chunk, a value answering one size to the
+               * cap and another to the accounting resolved a response LONGER than the bytes that
+               * arrived and longer than the cap allowed: measured, eight bytes under a cap of eight
+               * resolved as sixteen. `sizeOf` reads the view's own byte length. */
+              var n = intrinsic.sizeOf(chunk);
+              total += n;
               if (total > prep.maxBytes) { fail(C("response-too-large"), "the response exceeded the " + prep.maxBytes + "-byte cap (RFC 7030 sec. 6)"); return; }
-              if (len + chunk.length > buf.length) {
-                var want = Math.min(prep.maxBytes, Math.max(buf.length ? buf.length * 2 : 8192, len + chunk.length));
-                var grown = Buffer.allocUnsafe(want);
-                buf.copy(grown, 0, 0, len);
+              if (len + n > buf.length) {
+                var want = _mathMin(prep.maxBytes, _mathMax(buf.length ? buf.length * 2 : 8192, len + n));
+                var grown = _bufferAllocUnsafe(want);
+                /** @internal The bytes already received are moved, and the arriving chunk is placed,
+                 * through the typed-array write bound at load. `Buffer.prototype.copy` read off the
+                 * prototype decided what the response body holds: replaced after load, a response
+                 * that arrived as one value reached the caller as another. */
+                _taSet(grown, intrinsic.byteSlice(buf, 0, len), 0);
                 buf = grown;
               }
-              chunk.copy(buf, len);
-              len += chunk.length;
+              _taSet(buf, chunk, len);
+              len += n;
             });
             res.on("end", function () {
               if (settled) return;
@@ -739,13 +874,21 @@ function httpsTransport(defaults) {
               resolve({
                 status: res.statusCode,
                 headers: lower,
-                body: Buffer.from(buf.subarray(0, len)),
+                /** @internal The body is allocated at the counted length and written through the
+                 *  typed-array write, so neither the length nor the bytes come from an operation a
+                 *  replacement answers. Two earlier spellings were both steerable: a typed array's
+                 *  `subarray` builds its result through the SPECIES constructor, and `Buffer.from`
+                 *  handed an object reads that object's `valueOf` and `length`, which decided both
+                 *  what the body held and how long it was: measured, a response of eight bytes came
+                 *  back as 64 under a `maxResponseBytes` of 8. `byteSlice` reads the backing buffer,
+                 *  the byte offset and the length directly and builds the view itself. */
+                body: _bodyCopy(buf, len),
                 tls: tlsInfo,
               });
             });
             res.on("error", function (e) { fail(C("transport-error"), "the response stream failed", e); });
-          });
-          req.on("error", function (e) { fail(_classifyError(e, C), "the request failed: " + ((e && e.message) || String(e)), e); });
+          }]);
+          req.on("error", function (e) { fail(_classifyError(e, C), "the request failed: " + ((e && e.message) || _stringOf(e)), e); });
           if (typeof prep.body === "function") {
             req.once("socket", function (socket) {
               function _writeBoundBody() {
@@ -758,9 +901,9 @@ function httpsTransport(defaults) {
                     else if (typeof b !== "string") { fail(C("bad-input"), "the request body callback must return bytes or a string; a missing return, null, or any other value is refused"); return; }
                   } catch (ve) { _settleReject(ve); return; }
                   try {
-                    if (b !== "") { req.setHeader("Content-Length", Buffer.byteLength(b)); req.write(b); }
+                    if (b !== "") { req.setHeader("Content-Length", _byteLength(b)); req.write(b); }
                     req.end();
-                  } catch (e2) { fail(C("transport-error"), "the request body could not be written: " + ((e2 && e2.message) || String(e2)), e2); }
+                  } catch (e2) { fail(C("transport-error"), "the request body could not be written: " + ((e2 && e2.message) || _stringOf(e2)), e2); }
                 }, function (e) { fail(C("transport-error"), "the channel-binding body callback failed", e); });
               }
               if (socket.getFinished && socket.getFinished()) { _writeBoundBody(); return; }
@@ -770,7 +913,7 @@ function httpsTransport(defaults) {
             if (prep.body != null && prep.body !== "") req.write(prep.body);
             req.end();
           }
-        } catch (e) { fail(C("transport-error"), "the request could not be initiated: " + ((e && e.message) || String(e)), e); }
+        } catch (e) { fail(C("transport-error"), "the request could not be initiated: " + ((e && e.message) || _stringOf(e)), e); }
       }
 
       if (!prep.proxy) { issue(prep.options); return; }
@@ -783,9 +926,13 @@ function httpsTransport(defaults) {
       var cr, done;
 
       function issueConnect(credential) {
-        var pheaders = Object.assign(Object.create(null), { Host: pinfo.originAuthority, Connection: "keep-alive" });
+        var pheaders = _objectAssign(_objectCreate(null), { Host: pinfo.originAuthority, Connection: "keep-alive" });
         if (credential) pheaders["Proxy-Authorization"] = credential;
-        var connectOpts = { host: pinfo.host, port: pinfo.port, method: "CONNECT", path: pinfo.originAuthority, headers: pheaders, agent: false };
+        /** @internal The CONNECT socket is opened the same way the request's is, and for the same
+         * reason: `agent: false` leaves the construction on the agent prototype, where a replacement
+         * can return a raw socket in place of the proxy's TLS connection. On this path that costs
+         * more than a redirected request, because the CONNECT carries `Proxy-Authorization`. */
+        var connectOpts = { host: pinfo.host, port: pinfo.port, method: "CONNECT", path: pinfo.originAuthority, headers: pheaders };
         try {
           if (pinfo.secure) {
             connectOpts.ca = pinfo.proxyTls.ca;
@@ -794,11 +941,13 @@ function httpsTransport(defaults) {
             var pIdentity = pinfo.proxyTls.servername || pinfo.host;
             connectOpts.servername = (pIdentity && !_isIP(pIdentity)) ? pIdentity : "";
             connectOpts.checkServerIdentity = function (host, cert) { return _checkServerIdentity(pIdentity, cert); };
-            cr = nodeHttps.request(connectOpts);
+            connectOpts.createConnection = function (opts) { return intrinsic.apply(_tlsConnect, nodeTls, [opts]); };
+            cr = intrinsic.apply(_httpsRequest, nodeHttps, [connectOpts]);
           } else {
-            cr = nodeHttp.request(connectOpts);
+            connectOpts.createConnection = function (opts) { return intrinsic.apply(_netConnect, nodeNet, [opts]); };
+            cr = intrinsic.apply(_httpRequest, nodeHttp, [connectOpts]);
           }
-        } catch (e) { fail(C("proxy-connect-failed"), "the CONNECT request could not be initiated: " + ((e && e.message) || String(e)), e); return; }
+        } catch (e) { fail(C("proxy-connect-failed"), "the CONNECT request could not be initiated: " + ((e && e.message) || _stringOf(e)), e); return; }
         creq = cr;
         done = false;
         cr.on("connect", function (res, socket) { onProxyResponse(res, socket); });
@@ -809,7 +958,7 @@ function httpsTransport(defaults) {
           res.on("end", function () { });
           onProxyResponse(res, null);
         });
-        cr.on("error", function (e) { fail(pinfo.secure ? _proxyErrorClass(e, C) : C("proxy-connect-failed"), "the CONNECT request failed: " + ((e && e.message) || String(e)), e); });
+        cr.on("error", function (e) { fail(pinfo.secure ? _proxyErrorClass(e, C) : C("proxy-connect-failed"), "the CONNECT request failed: " + ((e && e.message) || _stringOf(e)), e); });
         cr.end();
       }
 
@@ -821,18 +970,18 @@ function httpsTransport(defaults) {
         if (socket && sc >= 200 && sc < 300) {
           tunnelSocket = socket;
           creq = null;
-          socket.on("error", function (e) { fail(_classifyError(e, C), "the tunnel socket failed: " + ((e && e.message) || String(e)), e); });
+          socket.on("error", function (e) { fail(_classifyError(e, C), "the tunnel socket failed: " + ((e && e.message) || _stringOf(e)), e); });
           var idHost = prep.options.servername || pinfo.originHost;
           /** @internal A plaintext origin speaks HTTP over the tunnel the CONNECT opened, so the
            * connection the request is issued on is that socket. Handing back a TLS wrapper would
            * start a handshake against a server that does not speak TLS. */
           if (prep.plaintext) {
-            issue(Object.assign({}, prep.options, { createConnection: function () { return socket; } }));
+            issue(_objectAssign({}, prep.options, { createConnection: function () { return socket; } }));
             return;
           }
-          issue(Object.assign({}, prep.options, {
+          issue(_objectAssign({}, prep.options, {
             createConnection: function () {
-              return nodeTls.connect({
+              return intrinsic.apply(_tlsConnect, nodeTls, [{
                 socket: socket,
                 host: prep.options.hostname,
                 servername: prep.options.servername,
@@ -846,7 +995,7 @@ function httpsTransport(defaults) {
                 },
                 cert: prep.options.cert,
                 key: prep.options.key,
-              });
+              }]);
             },
           }));
           return;
@@ -920,7 +1069,7 @@ function httpsTransport(defaults) {
         try { if (socket) socket.destroy(); } catch (_de) { /* allow:swallow-unverified the socket is being abandoned either way */ }
         fn(arg);
       }
-      try { socket = nodeTls.connect(connectOpts); }
+      try { socket = intrinsic.apply(_tlsConnect, nodeTls, [connectOpts]); }
       catch (e) {
         reject(E(_classifyError(e, C), "the TLS connection failed: " + e.message, e));
         return;