@blamejs/pki 0.8.7 → 0.8.10

package/lib/guard-identifier.js

@@ -401,7 +401,62 @@ function _settle(opts, E, code, label) {
     throw E(code, label + " changes which options it carries while they are read, so no set of " +
       "them can be checked; pass an object whose properties are plain values");
   }
-  return opts;
+  return _withoutPlantedFields(opts, before);
+}
+
+/** @internal A language prototype, as opposed to one the caller built. A defaults object the
+ * caller put under their bag is theirs and sits below these in the chain. */
+function _isLanguageProto(o) {
+  return o === intrinsic.ObjectProto || o === intrinsic.ArrayProto ||
+    o === intrinsic.BufferProto || o === intrinsic.FunctionProto;
+}
+
+function _holderOf(obj, k) {
+  var visited = new _Set();
+  for (var o = obj; o !== null && o !== undefined && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
+    if (_getOwnPropertyDescriptor(o, k)) return o;
+  }
+  return null;
+}
+
+/** @internal An option is something the caller supplied, and a name whose descriptor sits on a
+ * language prototype was supplied by whoever wrote to that prototype. The verb reads its options
+ * with `opts.name`, which walks the chain, so such a name answers as though it had been passed:
+ * `historicalMode` treats a revocation as not yet in force and `softFail` waives an undetermined
+ * one, each turning a revoked certificate into a valid path. The unknown-key check catches a
+ * planted name that is not an option at all; one spelled like a real option passes it.
+ *
+ * What comes back reads `undefined` for those names and is otherwise the object that was passed:
+ * the same prototype chain, the same own fields, and one own `undefined` masking each planted
+ * name. So the caller's own field still wins, a defaults object under their bag still supplies its
+ * options whatever their type, the reported set of names does not change, and a verb in a polluted
+ * process still runs instead of failing on every call. With nothing planted the object is handed
+ * back untouched, which is every call outside a process that has been written to.
+ *
+ * The own fields are carried as OWN fields rather than left to be inherited from the object that
+ * was passed. A verb that forwards its options builds the forwarded set by copying own keys, and a
+ * bag whose fields had all become inherited arrives at the inner call carrying none of them. */
+function _withoutPlantedFields(obj, names) {
+  var planted = null;
+  for (var i = 0; i < names.length; i++) {
+    if (!_isLanguageProto(_holderOf(obj, names[i]))) continue;
+    if (planted === null) planted = [];
+    _append(planted, names[i]);
+  }
+  if (planted === null) return obj;
+  var shadow = _create(_getPrototypeOf(obj));
+  var own = _ownKeys(obj);
+  for (var k = 0; k < own.length; k++) {
+    var d = _getOwnPropertyDescriptor(obj, own[k]);
+    if (!d) continue;
+    _defineProperty(shadow, own[k], d);
+  }
+  for (var j = 0; j < planted.length; j++) {
+    if (_getOwnPropertyDescriptor(obj, planted[j])) continue;
+    _defineProperty(shadow, planted[j], { value: undefined, writable: true, enumerable: false, configurable: true });
+  }
+  return shadow;
 }
 
 /** @internal An injectable callback option, refused unless it is callable. A value that is present
@@ -445,8 +500,26 @@ function assertCallableOption(opts, key, E, code, label, shape) {
   return assertCallable(opts[key], E, code, label, shape);
 }
 
+/** @internal Whether a caller's object says something about itself, as opposed to inheriting the
+ * answer. A declaration is a promise the author of that object made, so it has to sit on the object
+ * they wrote: reading the flag through the object finds a value on `Function.prototype` that every
+ * function in the process carries, and a boundary reading it that way treats every caller as having
+ * promised whatever was planted there. The value is read from the descriptor rather than through
+ * the object, so an accessor further up the chain cannot answer either.
+ *
+ * @enforced-by guard-shape-reinlined
+ * @guard-shape /\.\s*blocksPrivateAddresses\s*===\s*true/ */
+function declaresOwn(obj, name) {
+  if (obj === null || obj === undefined) return false;
+  var d;
+  try { d = _getOwnPropertyDescriptor(_Object(obj), name); }
+  catch (_e) { return false; }
+  return !!d && !d.get && !d.set && d.value === true;
+}
+
 module.exports = intrinsic.freeze({
   assertCallable: assertCallable,
+  declaresOwn: declaresOwn,
   assertCallableOption: assertCallableOption,
   assertCanonicalOid: assertCanonicalOid,
   assertKnownKeys: assertKnownKeys,

package/lib/guard-intrinsic.js

@@ -96,6 +96,7 @@ var _ObjectFn = Object;
 var _ObjectProto = Object.prototype;
 var _BufferProto = Buffer.prototype;
 var _ArrayProto = Array.prototype;
+var _FunctionProto = Function.prototype;
 var _Set = Set;
 var _Map = Map;
 var _WeakMap = WeakMap;
@@ -216,6 +217,7 @@ module.exports = Object.freeze({
   ObjectProto: _ObjectProto,
   BufferProto: _BufferProto,
   ArrayProto: _ArrayProto,
+  FunctionProto: _FunctionProto,
   setAdd: _setAdd,
   setHas: _setHas,
   mapGet: _mapGet,

package/lib/guard-limits.js

@@ -7,6 +7,10 @@ var constants = require("./constants");
 var _isInteger = require("./guard-intrinsic").isInteger;
 var _freeze = require("./guard-intrinsic").freeze;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
+var _isFinite = require("./guard-intrinsic").isFinite;
+var _Number = require("./guard-intrinsic").Number;
+var _hrtimeBigint = process.hrtime.bigint;
+function _monotonicNow() { return _Number(_hrtimeBigint() / 1000000n); }
 
 // @enforced-by behavioral -- a config-time cap validator has no rename-proof code
 function cap(value, key, dflt, opts) {
@@ -109,7 +113,42 @@ function budget(limits) {
   return _freeze(self);
 }
 
+/** @internal A wall-clock bound shared across several operations, where a per-operation timeout
+ * bounds each one and nothing bounds their sum. `now` is the clock, which a caller supplies so a
+ * test drives the bound without waiting; it defaults to the monotonic one, because a wall clock
+ * that steps backward would extend the deadline it was meant to enforce.
+ *
+ * `expired()` answers the question and `remaining()` gives the budget a per-operation timeout
+ * should be narrowed to, never below zero, so a caller that hands `remaining()` to a timeout
+ * cannot ask for one that outlives the deadline.
+ */
+// @enforced-by behavioral -- an elapsed-time comparison has no rename-proof shape that separates a deadline from any other subtraction; the vectors driving a checker to its bound are the guard
+function deadline(totalMs, opts) {
+  opts = opts || {};
+  var now = typeof opts.now === "function" ? opts.now : _monotonicNow;
+  if (!_isInteger(totalMs) || totalMs < 0) {
+    throw new TypeError("guard.limits.deadline: the total must be a non-negative integer of milliseconds");
+  }
+  var started = now();
+  if (typeof started !== "number" || !_isFinite(started)) {
+    throw new TypeError("guard.limits.deadline: the clock must return a finite number of milliseconds");
+  }
+  var self = {
+    elapsed: function () {
+      var at = now();
+      return typeof at === "number" && _isFinite(at) && at > started ? at - started : 0;
+    },
+    remaining: function () {
+      var left = totalMs - self.elapsed();
+      return left > 0 ? left : 0;
+    },
+    expired: function () { return self.remaining() === 0; },
+    total: function () { return totalMs; },
+  };
+  return _freeze(self);
+}
+
 module.exports = _freeze({
   cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap,
-  budget: budget, isBudgetExceeded: isBudgetExceeded,
+  budget: budget, isBudgetExceeded: isBudgetExceeded, deadline: deadline,
 });

package/lib/guard-list.js

@@ -48,10 +48,35 @@ function allMatch(list, predicate) {
   return true;
 }
 
+// @enforced-by caller-array-copied-live
+function snapshot(list) {
+  if (!_isArray(list)) throw new TypeError("guard.list.snapshot: the receiver must be an array");
+  var n = list.length;
+  var out = [];
+  for (var i = 0; i < n; i++) {
+    _defineProperty(out, i, { value: list[i], writable: true, enumerable: true, configurable: true });
+  }
+  return out;
+}
+
+// @enforced-by caller-array-copied-live
+function copyMap(list, fn) {
+  if (!_isArray(list)) throw new TypeError("guard.list.copyMap: the receiver must be an array");
+  if (typeof fn !== "function") throw new TypeError("guard.list.copyMap: the second argument must be a function");
+  var n = list.length;
+  var out = [];
+  for (var i = 0; i < n; i++) {
+    _defineProperty(out, i, { value: fn(list[i], i), writable: true, enumerable: true, configurable: true });
+  }
+  return out;
+}
+
 module.exports = _freeze({
   append: append,
   contains: contains,
   containsAll: containsAll,
   anyMatches: anyMatches,
   allMatch: allMatch,
+  snapshot: snapshot,
+  copyMap: copyMap,
 });

package/lib/guard-name.js

@@ -325,7 +325,6 @@ function _charTable(chars) {
   for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true;
   return t;
 }
-var _FQDN_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-");
 var _DIGDOT_TABLE = _charTable("0123456789.");
 function _allCharsIn(s, table) {
   if (s.length === 0) return false;
@@ -344,12 +343,18 @@ function uriSchemeIs(s, scheme) {
   return lowerAscii(_strSlice(s, 0, scheme.length)) === scheme;
 }
 
-/** @internal A host name of two or more labels that is not an address, which is the form a URI
- * name constraint is compared by (RFC 5280 sec. 4.2.1.10). */
+/** @internal A host name that is not an address, which is the form a URI name constraint is
+ * compared by (RFC 5280 sec. 4.2.1.10). The clause holds a URI constraint to "a fully qualified
+ * domain name" and names in the same sentence what that excludes: a URI with no authority
+ * component, and one whose authority names an IP address. It states no label count, so a single
+ * label is a host like any other and `com` constrains a top-level domain. The host is read by its
+ * labels rather than by which characters it holds: a character test admits an empty label and a
+ * hyphen at a label edge, and the suffix comparison below would then match a base against a name
+ * that is not a name. */
 function isFqdnHost(host) {
+  if (typeof host !== "string") return false;
   var h = stripTrailingDot(host);
-  if (h === "" || _indexOf(h, ".") === -1) return false;
-  if (!_allCharsIn(h, _FQDN_TABLE)) return false;
+  if (!_isHostName(h)) return false;
   if (_allCharsIn(h, _DIGDOT_TABLE)) return false;
   return true;
 }
@@ -386,6 +391,112 @@ function _isHostName(s) {
   return true;
 }
 
+/** @internal A host name written as labels separated by dots (RFC 1034 sec. 3.5, RFC 1123 sec. 2.1),
+ * with no trailing dot: the caller strips the one dot a comparison strips, so a second one is an
+ * empty label and is refused. */
+// @enforced-by behavioral -- an LDH label walk has no rename-proof shape that separates it from any other per-character scan; the vectors refusing an empty label, a hyphen at a label edge and a name past 253 octets are the guard
+function isHostName(s) { return typeof s === "string" && _isHostName(s); }
+
+/** @internal The labels of `s`, in order, with no trailing-dot handling of its own: the caller
+ * normalizes the dot through `stripTrailingDot` so both sides of a comparison are normalized by
+ * one symbol. A name carrying an empty label yields an empty string at that position, which a
+ * label test then refuses, rather than being dropped. */
+// @enforced-by behavioral -- splitting on a dot has no rename-proof shape; the vectors counting the labels of a name carrying an empty one are the guard
+function hostLabels(s) {
+  var out = [], start = 0;
+  for (var i = 0; i <= s.length; i++) {
+    if (i === s.length || _charCodeAt(s, i) === 0x2e) {
+      _append(out, _strSlice(s, start, i));
+      start = i + 1;
+    }
+  }
+  return out;
+}
+
+function _isAlnumLower(c) { return (c >= 0x61 && c <= 0x7a) || (c >= 0x30 && c <= 0x39); }
+
+/** @internal Whether `l` is a well-formed A-label (RFC 5890 sec. 2.3.2.1): the `xn--` prefix
+ * followed by groups of lower-case alphanumerics separated by single hyphens, each group non-empty.
+ * The label is not decoded, because RFC 5891 sec. 3.1 rule 2 compares a pair of A-labels as
+ * case-insensitive ASCII without validating either. */
+// @enforced-by behavioral -- an `xn--` prefix scan has no rename-proof shape; the vectors refusing `xn--`, a trailing hyphen and an empty group are the guard
+function isXnLabel(l) {
+  if (typeof l !== "string") return false;
+  var n = l.length;
+  if (!(n >= 4 && _charCodeAt(l, 0) === 0x78 && _charCodeAt(l, 1) === 0x6e &&
+        _charCodeAt(l, 2) === 0x2d && _charCodeAt(l, 3) === 0x2d)) return false;
+  var i = 4, g = 0;
+  while (i < n && _isAlnumLower(_charCodeAt(l, i))) { i++; g++; }
+  if (g < 1) return false;
+  while (i < n) {
+    if (_charCodeAt(l, i) !== 0x2d) return false;
+    i++;
+    var g2 = 0;
+    while (i < n && _isAlnumLower(_charCodeAt(l, i))) { i++; g2++; }
+    if (g2 < 1) return false;
+  }
+  return true;
+}
+
+var _SCHEME_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+.-");
+
+/** @internal The scheme and the host of a URI, read to RFC 3986 sec. 3: the scheme up to its colon,
+ * and, when `//` follows that colon, the authority up to the first `/`, `?` or `#`, with userinfo
+ * and port removed and an IPv6 literal's brackets stripped. `hasAuthority` is false for a URI
+ * written without `//`, which RFC 3986 sec. 3.3 permits and which therefore has no host; a caller
+ * that needs a host decides what to do with that rather than being handed a guess. `host` is null
+ * when the authority carries none, and `bracketed` says the host arrived inside `[]`, which is the
+ * only place an IPv6 literal may appear. Percent-escapes are left as written, so a caller comparing
+ * the host decides whether to accept one. */
+// @enforced-by behavioral -- a URI walk has no rename-proof shape that separates it from any other character scan; the vectors reading a scheme, refusing two userinfo separators and stripping a port are the guard
+function uriParts(uri) {
+  if (typeof uri !== "string") return null;
+  var n = uri.length;
+  if (n === 0) return null;
+  var c0 = _charCodeAt(uri, 0);
+  if (!((c0 >= 0x41 && c0 <= 0x5a) || (c0 >= 0x61 && c0 <= 0x7a))) return null;
+  var p = 1;
+  while (p < n && _SCHEME_TABLE[_charCodeAt(uri, p)]) p += 1;
+  if (_charCodeAt(uri, p) !== 0x3a) return null;
+  var scheme = _strSlice(uri, 0, p);
+  if (_charCodeAt(uri, p + 1) !== 0x2f || _charCodeAt(uri, p + 2) !== 0x2f) {
+    return { scheme: scheme, hasAuthority: false, host: null, bracketed: false };
+  }
+  p += 3;
+  var authStart = p;
+  while (p < n) {
+    var d = _charCodeAt(uri, p);
+    if (d === 0x2f || d === 0x3f || d === 0x23) break;
+    p += 1;
+  }
+  var authority = _strSlice(uri, authStart, p);
+  var firstAt = _indexOf(authority, "@");
+  if (firstAt !== _lastIndexOf(authority, "@")) return null;
+  if (firstAt !== -1) authority = _strSlice(authority, firstAt + 1);
+  var host = _strSlice(authority, 0, _portStripIndex(authority));
+  if (host === "") return { scheme: scheme, hasAuthority: true, host: null, bracketed: false };
+  var hn = host.length;
+  if (hn >= 2 && _charCodeAt(host, 0) === 0x5b && _charCodeAt(host, hn - 1) === 0x5d) {
+    return { scheme: scheme, hasAuthority: true, host: _strSlice(host, 1, hn - 1), bracketed: true };
+  }
+  return { scheme: scheme, hasAuthority: true, host: host, bracketed: false };
+}
+
+/** @internal Where a `:port` suffix starts, or the length when there is none. RFC 3986 sec. 3.2.3
+ * writes `port = *DIGIT`, so a colon with nothing after it is a port too, and leaving that colon on
+ * the host would make the authority compare as a name carrying a character no name carries. A
+ * bracketed IPv6 literal has colons of its own, so the scan reads digits back from the end and
+ * requires the colon immediately before them; the closing bracket is what stops it. */
+function _portStripIndex(s) {
+  var i = s.length;
+  while (i > 0) {
+    var c = _charCodeAt(s, i - 1);
+    if (c >= 0x30 && c <= 0x39) i -= 1;
+    else break;
+  }
+  return (i > 0 && _charCodeAt(s, i - 1) === 0x3a) ? i - 1 : s.length;
+}
+
 var _ATEXT_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$%&'*+-/=?^_`{|}~");
 
 /** @internal A quoted local part (RFC 5321 sec. 4.1.2 Quoted-string): printable ASCII between
@@ -534,18 +645,23 @@ function constraintBaseRefusal(tag, base) {
       : "must be a host name, optionally written as a subtree with a leading dot";
   }
   /** @internal RFC 5280 sec. 4.2.1.10 says of a URI constraint: "The constraint MUST be specified as
-   * a fully qualified domain name and MAY specify a host or a domain. Examples would be
-   * host.example.com and .example.com." Its dNSName paragraph states no such requirement, so a single
-   * label is a valid dNSName base and is not a valid URI base. A caller meets this rule at the door,
-   * whether through `pki.trust.anchor` or through the validator's subtree seeds. A base a certificate
-   * carries in its own extension never reaches a door, and `uriMatch` is what holds it to the rule
-   * there, answering `path/name-constraint-unsupported` for a host it cannot read as fully qualified.
-   * `constraintBaseUnreadable` does not judge label count and does not stand in for that check. */
+   * a fully qualified domain name and MAY specify a host or a domain", and the same sentence names
+   * what that excludes: a URI with no authority component, and one whose authority names an IP
+   * address. Its dNSName paragraph states no such requirement, so an address is a valid dNSName base
+   * and is not a valid URI base. Neither paragraph states a label count. A caller meets this rule at
+   * the door, whether through `pki.trust.anchor` or through the validator's subtree seeds. A base a
+   * certificate carries in its own extension never reaches a door, and `uriMatch` holds it to the
+   * same `isFqdnHost` this calls, so the door and the comparison cannot answer differently. */
   if (tag === 6) {
-    var h = _hostConstraintBody(_toLowerCase(base));
-    var dotted = _isHostName(h) && _indexOf(h, ".") !== -1 && !_allCharsIn(h, _DIGDOT_TABLE);
-    return dotted ? null
-      : "must be a fully qualified domain name, which RFC 5280 sec. 4.2.1.10 requires of a URI constraint and not of a dNSName one";
+    /** @internal Only the leading dot comes off here. `isFqdnHost` takes a host as a URI carries
+     * it and strips the one trailing dot that makes a name absolute, so stripping it here too
+     * would let a base ending in two dots through as one ending in none. */
+    var uriBody = _toLowerCase(base);
+    if (_charAt(uriBody, 0) === ".") uriBody = _strSlice(uriBody, 1);
+    if (isFqdnHost(uriBody)) return null;
+    return _allCharsIn(stripTrailingDot(uriBody), _DIGDOT_TABLE)
+      ? "must be a domain name rather than an address, RFC 5280 sec. 4.2.1.10 naming an address in a URI's authority as what a URI constraint cannot be compared against"
+      : "must be a domain name, which RFC 5280 sec. 4.2.1.10 requires of a URI constraint, optionally written as a subtree with a leading dot";
   }
   return null;
 }
@@ -656,6 +772,7 @@ module.exports = intrinsic.freeze({
   isAttributeDescriptor: isAttributeDescriptor,
   lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,
+  isHostName: isHostName, hostLabels: hostLabels, isXnLabel: isXnLabel, uriParts: uriParts,
   constraintBaseRefusal: constraintBaseRefusal,
   constraintBaseUnreadable: constraintBaseUnreadable,
 });

package/lib/guard-text.js

@@ -50,4 +50,36 @@ function keyOf(v) {
   return typeof v === "string" || typeof v === "number" ? v : undefined;
 }
 
-module.exports = intrinsic.freeze({ decode: decode, showValue: showValue, keyOf: keyOf });
+/** @internal What a caught value says about itself, as a string, for a boundary that reports a
+ * fault it did not cause. The value came from caller code, so every step of reading it is a step
+ * the caller chose the behavior of: `message` may be an accessor that throws, a Symbol that
+ * refuses string conversion, or an object whose `toString` throws, and the value itself may be a
+ * Proxy that refuses every read. A boundary whose whole contract is to turn a fault into a verdict
+ * cannot afford any of those to leave it, which is what happens when the description is built by
+ * reading `e.message` in the open.
+ *
+ * Every read is attempted and none is required. A value that answers nothing readable is described
+ * by its type, which is what `showValue` would have said about it anyway.
+ *
+ * @enforced-by guard-shape-reinlined
+ * @guard-shape /([\w$]+)\s*&&\s*\1\.message\s*\?\s*\1\.message\s*:|([\w$]+)\.message\s*\|\|\s*\2\b/ */
+function describeThrown(e) {
+  var m;
+  try { m = e === null || e === undefined ? undefined : e.message; }
+  catch (_readFailed) { return _thrownFallback(e); }
+  if (typeof m === "string" && m.length > 0) return m;
+  if (m === undefined || m === null) return _thrownFallback(e);
+  try {
+    if (typeof m === "symbol") return intrinsic.String(m);
+    return "" + m;
+  } catch (_convertFailed) { return _thrownFallback(e); }
+}
+
+function _thrownFallback(e) {
+  try { return showValue(e); }
+  catch (_showFailed) { return "a value that reports nothing readable"; }
+}
+
+module.exports = intrinsic.freeze({
+  decode: decode, showValue: showValue, keyOf: keyOf, describeThrown: describeThrown,
+});

package/lib/http-transport.js

@@ -134,7 +134,7 @@ function _pemifyAnchor(a) {
   return a;
 }
 function _pemifyAnchors(anchors) {
-  var list = Array.isArray(anchors) ? anchors.map(_pemifyAnchor) : [_pemifyAnchor(anchors)];
+  var list = Array.isArray(anchors) ? guard.list.copyMap(anchors, _pemifyAnchor) : [_pemifyAnchor(anchors)];
   return list;
 }
 
@@ -366,7 +366,11 @@ function _validateProxy(request, defaults, E, C, url) {
   var originHost = _stripIpv6Brackets(url.hostname);
   var originAuthHost = nodeNet.isIP(originHost) === 6 ? "[" + originHost + "]" : originHost;
   var phost = _stripIpv6Brackets(purl.hostname);
-  return { secure: secure, host: phost, port: purl.port ? +purl.port : (secure ? 443 : 80), originHost: originHost, originAuthority: originAuthHost + ":" + (url.port || 443), auth: auth, proxyTls: proxyTls };
+  /** @internal The CONNECT target is the origin's own authority, so an origin URL that states no
+   * port takes the default for the origin's scheme, not the proxy's. Defaulting it to 443 opens
+   * the tunnel to a port an `http:` origin does not listen on. */
+  var originPort = url.port || (url.protocol === "http:" ? 80 : 443);
+  return { secure: secure, host: phost, port: purl.port ? +purl.port : (secure ? 443 : 80), originHost: originHost, originAuthority: originAuthHost + ":" + originPort, auth: auth, proxyTls: proxyTls };
 }
 
 function _basicProxyHeader(auth) {
@@ -453,13 +457,30 @@ function httpsTransport(defaults) {
     var url;
     try { url = new URL(String(request.url)); }
     catch (e) { throw E(C("bad-url"), "the request URL did not parse: " + String(request.url), e); }
-    if (url.protocol !== "https:") throw E(C("insecure-url"), "transport requires https (RFC 7030 sec. 3.3), got " + url.protocol);
+    /** @internal https is the floor, and `request.allowPlaintextHttp` is the one thing that moves
+     * it, per request and never as a default. It exists for the two objects whose integrity does
+     * not come from the transport: a CRL and an OCSP response are signed, their signatures are
+     * verified after the fetch, and an https-only revocation fetch needs the responder's own
+     * certificate validated first, which is the loop the plaintext form exists to break. Nothing
+     * else in this toolkit sets it. Every other guard stays: the address checks, the size cap, the
+     * timeout, and the refusal to follow a redirect, which is what would otherwise turn one
+     * plaintext hop into a downgrade of the next. */
+    var plaintextAllowed = request.allowPlaintextHttp === true;
+    if (url.protocol !== "https:" && !(plaintextAllowed && url.protocol === "http:")) {
+      throw E(C("insecure-url"), "transport requires https (RFC 7030 sec. 3.3), got " + url.protocol);
+    }
 
     var reqTls = request.tls || {};
     var anchors = reqTls.anchors !== undefined ? reqTls.anchors : tlsDefaults.anchors;
     var useSystem = (reqTls.useSystemStore !== undefined ? reqTls.useSystemStore : tlsDefaults.useSystemStore) === true;
     var hasAnchors = anchors !== undefined && anchors !== null && !(Array.isArray(anchors) && anchors.length === 0);
-    if (!hasAnchors && !useSystem) throw E(C("no-trust-anchors"), "no explicit trust anchor and useSystemStore not set -- refusing an unpinned server (RFC 7030 sec. 3.6)");
+    /** @internal A trust anchor is what makes an https server identifiable, so a request with
+     * neither an anchor nor the system store is refused rather than left unpinned. A plaintext hop
+     * negotiates no certificate, so there is nothing for an anchor to pin; what protects the object
+     * fetched over one is its own signature, checked after the fetch by the verb that asked. */
+    if (url.protocol === "https:" && !hasAnchors && !useSystem) {
+      throw E(C("no-trust-anchors"), "no explicit trust anchor and useSystemStore not set -- refusing an unpinned server (RFC 7030 sec. 3.6)");
+    }
 
     var timeout = _budget(request.timeout !== undefined ? request.timeout : defaults.timeout, "timeout", DEFAULT_TIMEOUT, MAX_TIMEOUT, E, C("bad-input"));
     var maxBytes = _budget(request.maxResponseBytes !== undefined ? request.maxResponseBytes : defaults.maxResponseBytes, "maxResponseBytes", constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, E, C("bad-input"));
@@ -481,10 +502,11 @@ function httpsTransport(defaults) {
     }
 
     var host = _stripIpv6Brackets(url.hostname);
+    var plaintext = url.protocol === "http:";
     var options = {
       method: request.method || "GET",
       hostname: host,
-      port: url.port || 443,
+      port: url.port || (plaintext ? 80 : 443),
       path: url.pathname + url.search,
       headers: reqHeaders,
       minVersion: minVersion,
@@ -528,7 +550,7 @@ function httpsTransport(defaults) {
       options.lookup = _guardedLookup;
     }
 
-    return { options: options, timeout: timeout, maxBytes: maxBytes, body: body, proxy: proxyInfo, blockPrivate: blockPrivate, callerCsi: callerCsi };
+    return { options: options, timeout: timeout, maxBytes: maxBytes, body: body, proxy: proxyInfo, blockPrivate: blockPrivate, callerCsi: callerCsi, plaintext: plaintext };
   }
 
   var _transportFn = function transport(request) {
@@ -561,7 +583,10 @@ function httpsTransport(defaults) {
 
       function issue(options) {
         try {
-          req = nodeHttps.request(options, function (res) {
+          /** @internal A plaintext request goes through `node:http`, which has no TLS options to
+           * ignore; `prep.plaintext` is set only where the scheme check let `http:` through. */
+          var client = prep.plaintext ? nodeHttp : nodeHttps;
+          req = client.request(options, function (res) {
             var tlsInfo = _tlsInfo(res.socket);
             var declared = parseInt((res.headers || {})["content-length"], 10);
             if (Number.isFinite(declared) && declared > prep.maxBytes) { fail(C("response-too-large"), "the declared content-length " + declared + " exceeds the " + prep.maxBytes + "-byte cap (RFC 7030 sec. 6)"); return; }
@@ -673,6 +698,13 @@ function httpsTransport(defaults) {
           creq = null;
           socket.on("error", function (e) { fail(_classifyError(e, C), "the tunnel socket failed: " + ((e && e.message) || String(e)), e); });
           var idHost = prep.options.servername || pinfo.originHost;
+          /** @internal A plaintext origin speaks HTTP over the tunnel the CONNECT opened, so the
+           * connection the request is issued on is that socket. Handing back a TLS wrapper would
+           * start a handshake against a server that does not speak TLS. */
+          if (prep.plaintext) {
+            issue(Object.assign({}, prep.options, { createConnection: function () { return socket; } }));
+            return;
+          }
           issue(Object.assign({}, prep.options, {
             createConnection: function () {
               return nodeTls.connect({