@blamejs/core 0.18.11 → 0.18.12

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.12 (2026-08-05) — **Certificate Transparency SCT verification now works for real certificates (it previously rejected every embedded SCT); b.network.tls.ct.verifyScts / requireScts now require the issuing CA; broader Redis-client and TLS-verification test coverage.** b.network.tls.ct.verifyScts reconstructed the wrong RFC 6962 signed input for the SCTs embedded in a certificate — it built an x509_entry over the bare TBSCertificate instead of the precert_entry (issuer_key_hash + TBSCertificate) the log actually signed, and separately read the SCT's signature algorithm from a field the parser does not emit. Either alone made verification impossible: verifyScts and requireScts rejected every real embedded SCT. Verification now builds the RFC 6962 §3.2 precert_entry and requires the issuing CA so it can bind issuer_key_hash. This is a fail-closed fix — nothing invalid was ever trusted — but SCT enforcement now needs the issuer supplied. **Changed:** *b.network.tls.ct.verifyScts and requireScts now require the issuing CA* — Because an embedded SCT binds the issuing CA's key, verifying one needs that key. Pass the issuer to verifyScts as issuerCertDer (the issuer certificate DER), issuerSpkiDer (its SubjectPublicKeyInfo DER), or issuerKeyHash (the precomputed 32-byte SHA-256). Without it, verifyScts returns { ok: false, reason: "issuer-key-required" } and does not verify. requireScts derives the issuer from the peer's certificate chain automatically and accepts the same options; supply one explicitly only when the issuer is not present in the chain. verifyInclusion takes the same issuer options for embedded (precert_entry) leaves. · *Vendored @blamejs/pki refreshed to 0.3.32* — The vendored @blamejs/pki bundle behind the mutual-TLS CA engine is refreshed to 0.3.32, which adds C509 (CBOR-encoded certificate) extended-key-usage and extension registries (RFC 7633 TLS Feature, RFC 4556 PKINIT, and SSH/CMC/Bundle-Security purposes). No blamejs public API changes. · *Error- and edge-path tests for the Redis client and TLS-verification primitives* — b.redisClient (RESP framing and protocol-error edges, split replies, AUTH / SELECT on connect, push-message demux, connect/command timeouts, socket-error and close teardown) and b.network.tls (OCSP and Certificate-Transparency parse and verification branches, ECH config framing, and PKIX host/SAN matching) now have explicit tests for their boundary branches, driven through local fake servers and crafted certificates. **Fixed:** *Certificate Transparency SCT verification now works for certificate-embedded SCTs* — For an SCT embedded in a certificate's X.509v3 extension, the log computed its signature over the RFC 6962 §3.2 precert_entry — issuer_key_hash (SHA-256 of the issuing CA's SubjectPublicKeyInfo) followed by the TBSCertificate with the SCT extension removed. b.network.tls.ct.verifyScts instead reconstructed an x509_entry over just the stripped TBSCertificate, with no issuer binding, so the reconstructed input never matched what the log signed and no real embedded SCT could verify. It additionally read the SCT's signature-algorithm from a field name the parser does not emit, so the algorithm cross-check failed before the signature was even reached. verifyScts now builds the precert_entry and reads the parsed algorithm field, so a valid SCT verifies and a genuine mismatch is still refused. b.network.tls.ct.verifyInclusion builds the RFC 9162 §4.6 leaf the same way. The prior behaviour failed closed (it rejected rather than accepted), so no invalid certificate was ever trusted. **Security:** *SCT verification now binds each log key to the SCT's log ID* — An SCT's log ID is the SHA-256 of the log's public key (RFC 6962 §3.2). b.network.tls.ct.verifyScts now recomputes that hash from the configured key and refuses the SCT (reason "log-id-key-mismatch") when it does not equal the log ID the SCT names, before checking the signature. This prevents a misconfigured logKeys map from letting a key impersonate an approved log. · *SCT verification counts distinct logs, refuses future timestamps, and validates the minimum* — verifyScts now counts SCTs from distinct logs, so duplicate SCTs from a single log can no longer satisfy a "minimum 2 SCTs" diversity policy (verifiedCount reflects distinct logs). It refuses an SCT whose timestamp is in the future (RFC 6962 §5.2; opts.now / opts.clockSkewMs override the clock and the default five-minute skew). A minScts that is not a positive integer is rejected at the entry point rather than silently accepting an unverified certificate. Parsing an SCT extension from a peer certificate now fails closed on malformed DER — it returns no SCT instead of throwing, so a hostile certificate cannot raise an uncaught error out of verifyScts, parseScts, or the requireScts predicate.
+
 - v0.18.11 (2026-08-03) — **A static file that is a symlink at the final path component now fails closed with a clean 404 instead of an uncaught error; broader DNS, field-crypto, and static-server coverage.** The static server refuses a symlink at the final path component (its O_NOFOLLOW TOCTOU defense) — but that refusal now falls back to a clean 404 / NOT_FOUND rather than propagating an uncaught error that hung the request or surfaced a raw ELOOP from staticServe.integrity(). Alongside the fix, error and edge branches of b.network.dns, b.cryptoField, and b.staticServe come under explicit test. **Changed:** *Error- and edge-path tests for the DNS, field-crypto, and static-server primitives* — b.network.dns (DoH oversized-body handling, DoT mid-query connection reset and socket reuse, cache expiry, system-resolver error paths), b.cryptoField (tampered / relocated / downgraded cell fail-closed nulling, key-row AAD and rowId resolution, unseal rate-cap configuration, on-read upgrade branches), and b.staticServe (integrity and confinement edge cases, idle-timeout teardown, the final-component symlink refusal above) now have explicit tests for their boundary branches. An unused internal date-formatting helper was removed. **Fixed:** *A final-component symlink (or a mid-hash read error) on a static file fails closed with a clean 404* — When computing a served file's SRI and ETag, the static server opens it with O_NOFOLLOW so a symlink swapped in at the final path component after the in-root check cannot be followed (a TOCTOU / CWE-22 / CWE-367 defense). On POSIX that open raises ELOOP for a symlinked target — the common atomic-deploy pattern where a stable name links to a hashed file (latest.js pointing at app.<hash>.js). That error, and any read error mid-hash, previously propagated uncaught: the middleware request hung with no response, and staticServe.integrity() threw a raw ELOOP instead of its documented NOT_FOUND. It now falls back exactly as a read error does — the middleware returns 404 (falls through) and integrity() throws NOT_FOUND. The symlink is still not served; the refusal is just clean. Windows is unaffected (O_NOFOLLOW is a no-op there).
 
 - v0.18.10 (2026-08-03) — **Encrypted-at-rest boot fails closed on a truncated db.enc instead of silently starting fresh over it; broader SAML and database test coverage.** A database running encrypted at rest whose db.enc snapshot is truncated below a valid envelope (an interrupted external copy or backup restore, a full tmpfs, filesystem corruption) no longer boots onto a fresh empty database that the next flush would persist over the corrupt copy — it now fails closed so the operator can restore from backup. Alongside the fix, adversarial and edge branches of b.auth.saml and b.db come under explicit test, and the vendored @blamejs/pki toolkit is refreshed. **Changed:** *Verification- and edge-path tests for the SAML SP and database primitives* — b.auth.saml (the XML-signature Reference handling with no URI or no Transforms, a foreign-namespace Conditions element failing closed to no-audience-restriction, RSA-OAEP SHA-384/SHA-512 key transport with AES-128-GCM assertion decryption, ed25519 sign/verify dispatch, and the single-logout build/parse paths) and b.db (encrypted-boot key and envelope fallbacks, the truncated-snapshot refusal above, flush-to-disk after close, the audit-chain rollback check against a non-empty log, and the boot-time NTP check thresholds) now have explicit tests for their boundary branches. · *Vendored @blamejs/pki refreshed to 0.3.29* — The vendored @blamejs/pki toolkit that backs the mutual-TLS CA engine (X.509 / CRL / PKCS#12 signing) is refreshed from 0.3.28 to 0.3.29. The upstream change is in that toolkit's ACME client and Retry-After parser, which the CA engine does not call, so there is no behaviour change to the certificate-authority surface — this is a supply-chain currency refresh. **Fixed:** *Encrypted boot fails closed on a truncated db.enc rather than starting fresh over it* — When a database is encrypted at rest and its durable db.enc snapshot exists but is too short to be a valid AEAD envelope — a truncation from an interrupted external copy or backup restore, a full tmpfs, or filesystem corruption — boot silently opened a fresh empty database. The next flush or close then persisted that empty database over the corrupt-but-present snapshot, masking the corruption and destroying the operator's chance to recover. Boot now fails closed with db/enc-truncated; restore db.enc from backup, or remove it to intentionally start empty. A valid snapshot is always written atomically and is never this short, so no healthy deployment is affected. **Detectors:** *Truncated db.enc must fail closed, not start fresh* — A source guard keeps the encrypted-boot path throwing on an under-length db.enc rather than returning to open a fresh database — so a truncated durable snapshot can never again be silently overwritten by the next flush.

package/NOTICE

@@ -60,7 +60,7 @@ Used for:    WebAuthn / passkey registration + authentication response
              server.cjs).
 --------------------------------------------------------------------------------
 Component:   @blamejs/pki
-Version:     0.3.29
+Version:     0.3.32
 Source:      https://github.com/blamejs/pki
 License:     Apache-2.0
 Copyright:   Copyright (c) blamejs contributors

package/lib/network-tls.js

@@ -1710,36 +1710,40 @@ function _extractSctExtensionFromCert(certDer) {
   var tbsChildren;
   try { tbsChildren = asn1.readSequence(tbs.value); }
   catch (_e) { return { sctListRaw: null }; }
-  var extensionsNode = null;
-  for (var i = 0; i < tbsChildren.length; i += 1) {
-    var ch = tbsChildren[i];
-    if (ch.tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && ch.tag === 3) {       // X.509 [3] EXPLICIT extensions tag
-      extensionsNode = asn1.readNode(ch.value, 0);
-      break;
+  // The extensions walk is fully guarded: a hostile peer controls this cert,
+  // so any malformed node fails closed to "no SCT extension" (the caller then
+  // refuses) rather than throwing out of verifyScts / parseScts / requireScts.
+  try {
+    var extensionsNode = null;
+    for (var i = 0; i < tbsChildren.length; i += 1) {
+      var ch = tbsChildren[i];
+      if (ch.tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && ch.tag === 3) {       // X.509 [3] EXPLICIT extensions tag
+        extensionsNode = asn1.readNode(ch.value, 0);
+        break;
+      }
     }
-  }
-  if (!extensionsNode || extensionsNode.tag !== asn1.TAG.SEQUENCE) {
+    if (!extensionsNode || extensionsNode.tag !== asn1.TAG.SEQUENCE) {
+      return { sctListRaw: null };
+    }
+    var extensions = asn1.readSequence(extensionsNode.value);
+    for (var e = 0; e < extensions.length; e += 1) {
+      var ext = extensions[e];                                                     // Extension ::= SEQUENCE { extnID OID, critical BOOL OPTIONAL, extnValue OCTET STRING }
+      if (ext.tag !== asn1.TAG.SEQUENCE) continue;
+      var extChildren = asn1.readSequence(ext.value);
+      if (extChildren.length === 0) continue;
+      var extOid = asn1.readOid(extChildren[0]);
+      if (extOid !== OID_CT_SCT_LIST) continue;
+      // The last child is the OCTET STRING extnValue. Per RFC 6962 §3.3
+      // that OCTET STRING wraps a SECOND OCTET STRING which contains the
+      // raw SignedCertificateTimestampList (TLS-encoded).
+      var extnValueOuter = asn1.readOctetString(extChildren[extChildren.length - 1]);
+      var inner = asn1.readNode(extnValueOuter);
+      if (inner.tag !== asn1.TAG.OCTET_STRING) return { sctListRaw: null };        // malformed SCT ext → fail closed
+      return { sctListRaw: inner.value };
+    }
+  } catch (_e) {
     return { sctListRaw: null };
   }
-  var extensions = asn1.readSequence(extensionsNode.value);
-  for (var e = 0; e < extensions.length; e += 1) {
-    var ext = extensions[e];                                                     // Extension ::= SEQUENCE { extnID OID, critical BOOL OPTIONAL, extnValue OCTET STRING }
-    if (ext.tag !== asn1.TAG.SEQUENCE) continue;
-    var extChildren = asn1.readSequence(ext.value);
-    if (extChildren.length === 0) continue;
-    var extOid = asn1.readOid(extChildren[0]);
-    if (extOid !== OID_CT_SCT_LIST) continue;
-    // The last child is the OCTET STRING extnValue. Per RFC 6962 §3.3
-    // that OCTET STRING wraps a SECOND OCTET STRING which contains the
-    // raw SignedCertificateTimestampList (TLS-encoded).
-    var extnValueOuter = asn1.readOctetString(extChildren[extChildren.length - 1]);
-    var inner = asn1.readNode(extnValueOuter);
-    if (inner.tag !== asn1.TAG.OCTET_STRING) {
-      throw new TlsTrustError("tls/ct-bad-extension",
-        "SCT extension extnValue does not wrap a second OCTET STRING");
-    }
-    return { sctListRaw: inner.value };
-  }
   return { sctListRaw: null };
 }
 
@@ -1887,27 +1891,67 @@ function _parseSct(sctBuf) {
   };
 }
 
-// Build the canonical signed-entry per RFC 6962 §3.2 for X.509
-// pre-cert-free chains (issued cert path):
+// Serialize the RFC 6962 §3.2 / RFC 9162 §4.6 entry_type + signed_entry
+// pair. An SCT embedded in the leaf's X.509v3 extension was signed by the
+// log over the PRECERTIFICATE, so it is a precert_entry — signed_entry is
+//   PreCert { opaque issuer_key_hash[32]; TBSCertificate tbs_certificate; }
+// = issuer_key_hash (32 raw bytes) || tbs_certificate (24-bit length ||
+// DER TBSCertificate with the SCT extension removed). A directly-logged
+// final certificate is an x509_entry: ASN.1Cert (24-bit length || DER).
+// A 32-byte issuerKeyHash selects precert_entry; its absence selects
+// x509_entry. issuer_key_hash is SHA-256 over the DER SubjectPublicKeyInfo
+// of the issuing CA's public key (RFC 6962 §3.2).
+function _ctSignedEntry(tbsOrCertDer, issuerKeyHash) {
+  var lenBytes = Buffer.alloc(3);                                                // RFC 6962 24-bit length prefix
+  lenBytes.writeUIntBE(tbsOrCertDer.length, 0, 3);
+  if (Buffer.isBuffer(issuerKeyHash)) {
+    if (issuerKeyHash.length !== 32) {                                           // RFC 6962 opaque issuer_key_hash[32]
+      throw new TlsTrustError("tls/ct-bad-issuer-key-hash",
+        "issuer_key_hash must be 32 bytes (SHA-256 of issuer SubjectPublicKeyInfo), got " +
+        issuerKeyHash.length);
+    }
+    return { entryType: 1,                                                       // precert_entry
+      signedEntry: Buffer.concat([issuerKeyHash, lenBytes, tbsOrCertDer]) };
+  }
+  return { entryType: 0,                                                         // x509_entry
+    signedEntry: Buffer.concat([lenBytes, tbsOrCertDer]) };
+}
+
+// Resolve the RFC 6962 issuer_key_hash from operator-supplied opts, in
+// precedence order: issuerKeyHash (precomputed 32-byte Buffer) |
+// issuerSpkiDer (DER SubjectPublicKeyInfo, hashed) | issuerCertDer (issuing
+// CA cert; its SPKI is extracted and hashed). Returns a 32-byte Buffer, or
+// null when no issuer material was supplied.
+function _resolveIssuerKeyHash(opts) {
+  if (Buffer.isBuffer(opts.issuerKeyHash)) return opts.issuerKeyHash;
+  if (Buffer.isBuffer(opts.issuerSpkiDer)) {
+    return nodeCrypto.createHash("sha256").update(opts.issuerSpkiDer).digest();  // RFC 6962 SHA-256 of SPKI
+  }
+  if (Buffer.isBuffer(opts.issuerCertDer)) {
+    var spkiDer = new nodeCrypto.X509Certificate(opts.issuerCertDer)
+      .publicKey.export({ type: "spki", format: "der" });
+    return nodeCrypto.createHash("sha256").update(spkiDer).digest();
+  }
+  return null;
+}
+
+// Build the canonical signed-entry per RFC 6962 §3.2. For an embedded SCT
+// (issuerKeyHash present) this is a precert_entry:
 //   sct_version (1) || signature_type (1=certificate_timestamp) ||
-//   timestamp (8) || entry_type (0=x509_entry) ||
-//   signed_entry (3-byte length || ASN.1 cert without SCT extension) ||
-//   ct_extensions (2-byte length || N)
-function _buildSctSignedEntry(certWithoutSctDer, sct) {
+//   timestamp (8) || entry_type (1=precert_entry) ||
+//   issuer_key_hash (32) || tbs_certificate (3-byte length || TBS without
+//     the SCT extension) || ct_extensions (2-byte length || N)
+function _buildSctSignedEntry(certWithoutSctDer, sct, issuerKeyHash) {
+  var entry = _ctSignedEntry(certWithoutSctDer, issuerKeyHash);
   var head = Buffer.alloc(1 + 1 + 8 + 2);                                        // fixed-shape header bytes
   head[0] = sct.version;
   head[1] = 0;                                                                   // signature_type = certificate_timestamp
   head.writeBigUInt64BE(BigInt(sct.timestamp), 2);                               // past version+sig-type
-  head.writeUInt16BE(0, 10);                                                     // entry_type = x509_entry (2 bytes; high byte = 0, low byte = 0)
-  // signed_entry: 3-byte length prefix + cert DER.
-  var lenBytes = Buffer.alloc(3);                                                // RFC 6962 24-bit length prefix
-  lenBytes[0] = (certWithoutSctDer.length >> 16) & 0xff;                         // base-256 length high byte
-  lenBytes[1] = (certWithoutSctDer.length >> 8) & 0xff;                          // base-256 length mid byte
-  lenBytes[2] = certWithoutSctDer.length & 0xff;                                 // base-256 length low byte
+  head.writeUInt16BE(entry.entryType, 10);                                       // entry_type (precert_entry=1 / x509_entry=0)
   // ct_extensions: 2-byte length + bytes.
   var extHead = Buffer.alloc(2);                                                 // RFC 6962 2-byte ct_extensions length prefix
   extHead.writeUInt16BE(sct.extensions.length, 0);
-  return Buffer.concat([head, lenBytes, certWithoutSctDer, extHead, sct.extensions]);
+  return Buffer.concat([head, entry.signedEntry, extHead, sct.extensions]);
 }
 
 // Strip the SCT extension from a DER cert + return the rebuilt cert
@@ -2029,6 +2073,15 @@ function _encodeAsn1FromNode(node) {
 // CT log list (https://www.gstatic.com/ct/log_list/v3/log_list.json
 // or equivalent) — log keys rotate, so the framework does NOT bake
 // them in; that drift is the operator's to manage.
+//
+// An SCT embedded in the certificate was signed by the log over the
+// PRECERTIFICATE (RFC 6962 §3.2 precert_entry), whose signed-entry binds
+// the issuing CA via issuer_key_hash = SHA-256(issuer SubjectPublicKeyInfo).
+// The issuing CA is therefore REQUIRED to verify: supply it as
+// opts.issuerCertDer (issuer cert DER), opts.issuerSpkiDer (DER
+// SubjectPublicKeyInfo), or opts.issuerKeyHash (precomputed 32-byte hash).
+// Without it verification cannot proceed and returns reason
+// "issuer-key-required" (fails closed).
 function verifyScts(certDer, opts) {
   opts = opts || {};
   if (!Buffer.isBuffer(certDer)) {
@@ -2036,6 +2089,12 @@ function verifyScts(certDer, opts) {
       "verifyScts: certDer must be a Buffer");
   }
   var logKeys = opts.logKeys || {};
+  if (opts.minScts !== undefined &&
+      (typeof opts.minScts !== "number" || !isFinite(opts.minScts) ||
+       opts.minScts < 1 || Math.floor(opts.minScts) !== opts.minScts)) {
+    throw new TlsTrustError("tls/ct-bad-input",
+      "verifyScts: minScts must be a positive integer (a policy of 0 would accept unverified certs)");
+  }
   var minScts = typeof opts.minScts === "number" ? opts.minScts : 2;             // Chrome CT policy min-2-SCTs
   var ext = _extractSctExtensionFromCert(certDer);
   if (!ext.sctListRaw) {
@@ -2047,6 +2106,19 @@ function verifyScts(certDer, opts) {
     return { ok: false, reason: "parse-error",
              error: (e && e.message) || String(e), scts: [] };
   }
+  // Resolve the issuing-CA key hash — embedded SCTs are precert_entry and
+  // cannot be verified without it (RFC 6962 §3.2). Fail closed when absent.
+  var issuerKeyHash;
+  try { issuerKeyHash = _resolveIssuerKeyHash(opts); }
+  catch (e) {
+    return { ok: false, reason: "bad-issuer-key",
+             error: (e && e.message) || String(e), scts: scts,
+             minScts: minScts, verifiedCount: 0, totalScts: scts.length };
+  }
+  if (!issuerKeyHash) {
+    return { ok: false, reason: "issuer-key-required", scts: [],
+             minScts: minScts, verifiedCount: 0, totalScts: scts.length };
+  }
   // Strip the SCT extension to compute the signed-entry per §3.2.
   var stripped;
   try { stripped = _stripSctExtensionFromCert(certDer); }
@@ -2054,10 +2126,24 @@ function verifyScts(certDer, opts) {
     return { ok: false, reason: "strip-failed",
              error: (e && e.message) || String(e), scts: scts };
   }
-  var verifiedCount = 0;
+  // Chrome CT policy counts SCTs from DISTINCT logs (diversity), so a single
+  // log — in the trivial case the same SCT duplicated — cannot alone satisfy a
+  // minScts >= 2 gate. Track the set of logs that produced a verified SCT.
+  var verifiedLogIds = Object.create(null);
+  var now = (typeof opts.now === "number" && isFinite(opts.now)) ? opts.now : Date.now();
+  var futureSkewMs = (typeof opts.clockSkewMs === "number" && isFinite(opts.clockSkewMs) &&
+                      opts.clockSkewMs >= 0) ? opts.clockSkewMs : C.TIME.minutes(5);
   var perSctResults = [];
   for (var s = 0; s < scts.length; s += 1) {
     var sct = scts[s];
+    // RFC 6962 §5.2 — a future SCT timestamp signals log misbehaviour
+    // (out-of-order issuance or a log clock fault); refuse it, allowing a
+    // small skew for honest clock drift.
+    if (sct.timestamp > now + futureSkewMs) {
+      perSctResults.push({ logIdHex: sct.logIdHex, verified: false,
+        reason: "timestamp-in-future", timestamp: sct.timestamp });
+      continue;
+    }
     var pem = logKeys[sct.logIdHex];
     if (!pem) {
       perSctResults.push({ logIdHex: sct.logIdHex, verified: false,
@@ -2065,7 +2151,7 @@ function verifyScts(certDer, opts) {
       continue;
     }
     var signedEntry;
-    try { signedEntry = _buildSctSignedEntry(stripped, sct); }
+    try { signedEntry = _buildSctSignedEntry(stripped, sct, issuerKeyHash); }
     catch (e) {
       perSctResults.push({ logIdHex: sct.logIdHex, verified: false,
         reason: "build-entry-failed",
@@ -2089,13 +2175,25 @@ function verifyScts(certDer, opts) {
         error: (e && e.message) || String(e) });
       continue;
     }
+    // RFC 6962 §3.2 — the SCT's log_id is the SHA-256 of the log's public key
+    // (DER SubjectPublicKeyInfo). Enforce that the configured key actually
+    // hashes to the claimed log_id before trusting its signature, so a
+    // misconfigured logKeys map cannot let a key impersonate an approved log.
+    var configuredLogId = nodeCrypto.createHash("sha256")
+      .update(keyObj.export({ type: "spki", format: "der" })).digest();
+    if (!configuredLogId.equals(sct.logId)) {
+      perSctResults.push({ logIdHex: sct.logIdHex, verified: false,
+        reason: "log-id-key-mismatch",
+        configuredKeyId: configuredLogId.toString("hex") });
+      continue;
+    }
     // RFC 6962 §2.1.4 — log-key SignatureAndHashAlgorithm pair must
     // match the SCT's signatureAlgorithm. signatureAlgo enum 1=RSA,
     // 3=ECDSA. Cross-check against the actual log-key type so a
     // malformed log-keys map can't silently accept SCTs signed
     // under one algorithm against a key registered under another.
     var keyType = keyObj.asymmetricKeyType;
-    var sctSigAlgo = sct.signatureAlgo;
+    var sctSigAlgo = sct.sigAlgo;   // the field _parseSct emits (RFC 5246 SignatureAlgorithm enum)
     var algoOk = (sctSigAlgo === 1 && keyType === "rsa") ||                       // TLS 1.2 SignatureAlgorithm rsa
                  (sctSigAlgo === 3 && (keyType === "ec" || keyType === "ecdsa")); // TLS 1.2 SignatureAlgorithm ecdsa
     if (!algoOk) {
@@ -2113,8 +2211,9 @@ function verifyScts(certDer, opts) {
       continue;
     }
     perSctResults.push({ logIdHex: sct.logIdHex, verified: verified });
-    if (verified) verifiedCount += 1;
+    if (verified) verifiedLogIds[sct.logIdHex] = true;
   }
+  var verifiedCount = Object.keys(verifiedLogIds).length;                         // distinct verified logs (Chrome CT diversity)
   return {
     ok:             verifiedCount >= minScts,
     reason:         verifiedCount >= minScts ? null : "insufficient-verified",
@@ -2340,7 +2439,15 @@ var ct = Object.freeze({
   },
   // verifyScts — full RFC 6962 verification. opts.logKeys maps
   // log_id (hex SHA-256 of the log's pubkey) → PEM public key.
-  // Operators populate from the Chrome CT log list. Returns
+  // Operators populate from the Chrome CT log list. Embedded SCTs are
+  // precert_entry, so the issuing CA is required — pass opts.issuerCertDer
+  // (issuer cert DER), opts.issuerSpkiDer, or opts.issuerKeyHash (32-byte
+  // SHA-256 of the issuer SubjectPublicKeyInfo); without it verification
+  // fails closed with reason "issuer-key-required". verifiedCount counts
+  // DISTINCT logs (Chrome CT diversity), so duplicate SCTs from one log do
+  // not inflate it. opts.minScts (default 2) must be a positive integer.
+  // Future-dated SCTs are refused (RFC 6962 §5.2; opts.now / opts.clockSkewMs
+  // override the wall-clock and the default 5-minute skew). Returns
   // { ok, verifiedCount, totalScts, scts: [{ logIdHex, verified, ... }] }.
   verifyScts: verifyScts,
   // Operator middleware predicate: refuse a peer cert lacking SCT
@@ -2354,6 +2461,10 @@ var ct = Object.freeze({
   //   opts: {
   //     sct:              { logIdHex, timestamp, signedEntryDer? } — from parseScts
   //     leafCertificate:  Buffer — leaf cert DER (the entry hashed at the leaf)
+  //     issuerCertDer / issuerSpkiDer / issuerKeyHash:  the issuing CA — an
+  //                       embedded SCT is a precert_entry, so the leaf binds
+  //                       issuer_key_hash; omit only for a directly-logged
+  //                       (x509_entry) certificate
   //     leafIndex:        integer — position in the tree (from RFC 9162 §6.7 get-proof-by-hash)
   //     auditPath:        [Buffer] — the inclusion-proof siblings, bottom-up
   //     sthFromLog:       { treeSize, rootHash[, sha256RootHash] }
@@ -2389,11 +2500,20 @@ var ct = Object.freeze({
       return { valid: false, reason: "bad-audit-path" };
     }
 
-    // Build the leaf bytes per RFC 9162 §4.6 — TimestampedEntry.
-    // entry_type = x509_entry (0); signed_entry = strip-SCT-extension(cert).
-    // Operators may pass a pre-built signedEntryDer when the SCT was
+    // Build the leaf bytes per RFC 9162 §4.6 — TimestampedEntry. An SCT
+    // embedded in the leaf's X.509v3 extension is a precert_entry: supply
+    // the issuing CA (opts.issuerCertDer / issuerSpkiDer / issuerKeyHash)
+    // and the leaf binds issuer_key_hash || tbs, matching what the log
+    // hashed. Without an issuer the leaf is an x509_entry over the cert
+    // bytes. Operators may pass a pre-built signedEntryDer when the SCT was
     // already extracted via parseScts() + the framework has the
     // pre-issuance cert; otherwise we strip the SCT extension here.
+    var issuerKeyHash;
+    try { issuerKeyHash = _resolveIssuerKeyHash(opts); }
+    catch (e) {
+      return { valid: false, reason: "bad-issuer-key",
+               error: (e && e.message) || String(e) };
+    }
     var signedEntryDer = opts.sct.signedEntryDer;
     if (!Buffer.isBuffer(signedEntryDer)) {
       try { signedEntryDer = _stripSctExtensionFromCert(opts.leafCertificate); }
@@ -2404,9 +2524,9 @@ var ct = Object.freeze({
     }
 
     // RFC 9162 §4.6 MerkleTreeLeaf — version (1) + leaf_type (0) +
-    // timestamp (uint64) + entry_type (uint16) + signed_entry (variable-
-    // length cert DER with 24-bit length prefix) + extensions (variable-
-    // length, 16-bit length prefix, empty for x509_entry).
+    // timestamp (uint64) + entry_type (uint16) + signed_entry (issuer_key_
+    // hash for precert_entry, then a 24-bit-length cert/TBS) + extensions
+    // (16-bit length prefix, empty here).
     var ts = opts.sct.timestamp;
     if (typeof ts !== "number" && typeof ts !== "bigint") {
       return { valid: false, reason: "bad-sct-timestamp" };
@@ -2414,16 +2534,21 @@ var ct = Object.freeze({
     var tsBuf = Buffer.alloc(8);                                                 // TLS uint64 width
     var tsBig = typeof ts === "bigint" ? ts : BigInt(Math.floor(ts));
     tsBuf.writeBigUInt64BE(tsBig);
-    var entryTypeBuf = Buffer.from([0x00, 0x00]);
-    var lenBuf = Buffer.alloc(3);                                                // TLS uint24 length prefix
-    lenBuf.writeUIntBE(signedEntryDer.length, 0, 3);
+    var leafEntry;
+    try { leafEntry = _ctSignedEntry(signedEntryDer, issuerKeyHash); }
+    catch (e) {
+      return { valid: false, reason: "bad-issuer-key",
+               error: (e && e.message) || String(e) };
+    }
+    var entryTypeBuf = Buffer.from([(leafEntry.entryType >> 8) & 0xff,           // entry_type uint16
+                                    leafEntry.entryType & 0xff]);
     var extensionsBuf = Buffer.from([0x00, 0x00]);                               // empty extensions vector
     var leafBytes = Buffer.concat([
       Buffer.from([0x00]),                                                       // version v1
       Buffer.from([0x00]),                                                       // leaf_type timestamped_entry
       tsBuf,
       entryTypeBuf,
-      lenBuf, signedEntryDer,
+      leafEntry.signedEntry,
       extensionsBuf,
     ]);
 
@@ -2533,7 +2658,22 @@ var ct = Object.freeze({
         return new TlsTrustError("tls/ct-no-cert",
           "requireScts: peer cert.raw missing");
       }
-      var rv = verifyScts(peerCert.raw, opts);
+      // Embedded SCTs are precert_entry and need the issuing CA key
+      // (RFC 6962 §3.2). Derive it from the peer's issuer in the chain when
+      // the operator did not supply issuer material explicitly. Node sets
+      // issuerCertificate to the cert itself at the self-signed root, so
+      // guard against binding a cert to its own key.
+      var effOpts = opts;
+      if (!Buffer.isBuffer(opts.issuerKeyHash) &&
+          !Buffer.isBuffer(opts.issuerSpkiDer) &&
+          !Buffer.isBuffer(opts.issuerCertDer) &&
+          peerCert.issuerCertificate &&
+          peerCert.issuerCertificate !== peerCert &&
+          Buffer.isBuffer(peerCert.issuerCertificate.raw)) {
+        effOpts = Object.assign({}, opts,
+          { issuerCertDer: peerCert.issuerCertificate.raw });
+      }
+      var rv = verifyScts(peerCert.raw, effOpts);
       if (!rv.ok) {
         // Map verifier reason → operator-facing error code so call
         // sites can distinguish "no SCT extension at all" from
@@ -3434,4 +3574,6 @@ module.exports = {
   NetworkTlsError:     NetworkTlsError,
   _resetForTest:       _resetForTest,
   _checkServerIdentityStrict: _checkServerIdentityStrict,
+  _stripSctExtensionFromCert: _stripSctExtensionFromCert,
+  _buildSctSignedEntry: _buildSctSignedEntry,
 };

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-08-03T19:33:52.595Z"
+      "refreshedAt": "2026-08-06T00:01:44.784Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-08-03T19:33:52.595Z"
+      "refreshedAt": "2026-08-06T00:01:44.784Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-08-03T19:33:52.595Z"
+      "refreshedAt": "2026-08-06T00:01:44.784Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-08-03T19:33:52.595Z"
+      "refreshedAt": "2026-08-06T00:01:44.784Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-03T19:33:52.595Z"
+      "refreshedAt": "2026-08-06T00:01:44.784Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-03T19:33:52.595Z"
+      "refreshedAt": "2026-08-06T00:01:44.784Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -159,10 +159,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-03T19:33:52.595Z"
+      "refreshedAt": "2026-08-06T00:01:44.784Z"
     },
     "@blamejs/pki": {
-      "version": "0.3.29",
+      "version": "0.3.32",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -182,12 +182,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-03T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.3.29:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-05T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.3.32:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:8eb19192bcc9e9660b5fe72376d27de33a1c2c3b44ba18b1b3aeb9f0d95ed2bf"
+        "server": "sha256:275a0ef678a74e9ce035658ae95b18c05dcf69200bf934f609f149d1c8e739e3"
       },
-      "refreshedAt": "2026-08-03T19:33:52.595Z"
+      "refreshedAt": "2026-08-06T00:01:44.784Z"
     }
   }
 }