@blamejs/pki 0.1.19 → 0.1.20

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.20 — 2026-07-09
+
+An RFC 6962 Certificate Transparency SCT-list parser joins the toolkit.
+
+### Added
+
+- pki.ct.parseSctList(extValue) — RFC 6962 SCT-list parsing. It decodes the SignedCertificateTimestampList extension value (the raw extnValue content an x509 or OCSP extension surfaces) into { scts, unknownScts }. Each scts entry is a fully decoded v1 SCT: version (0), logId (32-byte Buffer) plus logIdHex, timestamp (exact BigInt) plus timestampMs (a Number, or null above 2^53) plus timestampDate, extensions (raw Buffer), the hashAlg / sigAlg code points plus a named signatureAlgorithm, the raw signature, and rawSct (the full SerializedSCT body). A SerializedSCT whose version is not v1 is preserved opaque in unknownScts as { version, rawSct } rather than failing the list (RFC 6962 §3.3 gives each SerializedSCT its own length so unknown versions are skippable). The extension value is the §3.3 double DER OCTET STRING wrap over a TLS-encoded list, decoded with a bounded reader that validates the list and per-SCT framing and every internal length, and asserts a per-list byte and count cap before it iterates. The signature is never verified and the log id never recomputed. Malformed input fails closed with a typed ct/* (or leaf asn1/*) code.
+- pki.ct.reconstructSignedData(entry, sct) — rebuilds the exact digitally-signed preimage a verifier hashes to check an SCT's signature (RFC 6962 §3.2), for a decoded v1 SCT. entry selects the log-entry form: { entryType: 0, leafCert } for an SCT delivered over TLS or OCSP (signed over the leaf certificate), or { entryType: 1, tbsCertificate, issuerKeyHash } for an SCT embedded in a certificate (signed over the issuer key hash and the precertificate TBS). The preimage reuses the parsed SCT's raw extensions byte-for-byte; a verifier hashes the returned bytes and checks the signature with the log's public key.
+- The certificate-extension value registry gains the SCT-list decoder and the precertificate-poison decoder (the poison value is content-validated as ASN.1 NULL, not merely tag-checked).
+- The OID registry gains the Certificate Transparency arc — the SCT-list, precertificate-poison, precertificate-signing-certificate, and OCSP SCT-list identifiers — so those extension OIDs resolve to names.
+- The error taxonomy gains CtError, carrying a stable ct/* code.
+
 ## v0.1.19 — 2026-07-09
 
 An RFC 9810 Certificate Management Protocol message parser joins the pki.schema family.

package/README.md

@@ -204,8 +204,9 @@ is callable today; nothing below is a stub.
 | `pki.schema.cmp` | Parse DER / PEM RFC 9810 Certificate Management Protocol messages (PKIMessage) — the header (version, sender / recipient incl. the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` / `bodyBytes` slices an external verifier reconstructs the protected part from; the CMP-before-OCSP dispatch order is enforced, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation. Pure and re-entrant, fail-closed — `validate`, `crlChecker` |
+| `pki.ct` | Parse RFC 6962 Certificate Transparency SCT lists — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage for external verification. Structure decoded, crypto surfaced raw, bounded decode, fail-closed — `parseSctList`, `reconstructSignedData` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI

package/index.js

@@ -30,6 +30,7 @@ var oid       = require("./lib/oid");
 var webcrypto = require("./lib/webcrypto");
 var schema    = require("./lib/schema-all");
 var path      = require("./lib/path-validate");
+var ct        = require("./lib/ct");
 
 module.exports = {
   version:   constants.version,
@@ -46,6 +47,10 @@ module.exports = {
   // `path` is RFC 5280 §6 certification-path validation — pki.path.validate
   // runs the §6.1 state machine over an already-parsed path + a trust anchor.
   path:      path,
+  // `ct` is RFC 6962 Certificate Transparency — pki.ct.parseSctList decodes the
+  // SCT-list extension a certificate / OCSP response carries; the signature is
+  // surfaced raw for external verification (pki.ct.reconstructSignedData).
+  ct:        ct,
   // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
   // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
   // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.

package/lib/constants.js

@@ -117,6 +117,17 @@ var LIMITS = {
   PEM_MAX_BYTES: BYTES.mib(16),
   DER_MAX_INTEGER_BYTES: BYTES.kib(16),
   OID_MAX_SUBIDENTIFIER_BYTES: 32,
+  // Certificate Transparency SCT-list bounds (RFC 6962 §3.3). The outer sct_list
+  // vector carries a 2-byte length prefix, so a well-formed list body is at most
+  // 2^16-1 = 65535 bytes and the full TLS blob (prefix + body) is at most 65537.
+  // The byte cap sits at that structural maximum, so the largest conforming list
+  // is accepted while an oversized inner OCTET STRING (up to the DER document cap)
+  // is refused BEFORE the list is walked; the per-list count cap is likewise
+  // asserted before iteration so a hostile length prefix cannot drive unbounded
+  // work (the CVE-2022-0778 class: crafted bytes inside a certificate extension
+  // pinning a validator). A real chain carries 2-5 SCTs; 256 is far above policy.
+  SCT_MAX_BYTES: BYTES.kib(64) + 1,
+  SCT_MAX_COUNT: 256,
   // Certification-path length ceiling: bounds the per-cert asymmetric verify
   // work on an untrusted certificate bundle (a real chain is well under this;
   // the operator may override via opts.maxPathCerts).

package/lib/ct.js

@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.ct
+ * @nav        Transparency
+ * @title      CT
+ * @order      210
+ * @slug       ct
+ *
+ * @intro
+ *   Certificate Transparency SCT-list handling per RFC 6962. `parseSctList`
+ *   decodes the `SignedCertificateTimestampList` an X.509 certificate (or an
+ *   OCSP response) carries in the SCT extension into its individual signed
+ *   certificate timestamps.
+ *
+ *   The SCT payload is encoded in the TLS presentation language (RFC 8446 §3 /
+ *   RFC 5246 §4 conventions) — positional, tag-less, fixed-width big-endian
+ *   integers and length-prefixed opaque vectors — NOT ASN.1/DER. So this module
+ *   owns a bounded big-endian TLS-struct reader rather than composing the DER
+ *   schema engine; the only ASN.1 surface is the §3.3 double wrap (the
+ *   extension value is a DER OCTET STRING whose content is another DER OCTET
+ *   STRING whose content is the TLS list — the certificate/OCSP layer peels the
+ *   outer, this module peels the inner).
+ *
+ *   Structure is decoded, crypto is surfaced RAW: each SCT surfaces its `logId`
+ *   (32 raw bytes — SHA-256 of the log's SPKI, never recomputed), the exact
+ *   `timestamp` as a BigInt, the raw `extensions`, the named-but-not-interpreted
+ *   `hashAlg`/`sigAlg` code points, and the raw `signature`. The parser NEVER
+ *   verifies a signature, recomputes a LogID, or trusts a log — a verifier
+ *   composes `webcrypto` over `reconstructSignedData(...)`, the exact
+ *   `digitally-signed` preimage. DER-only carrier, fail-closed.
+ *
+ * @card
+ *   Parse RFC 6962 Certificate Transparency SCT lists from a certificate or OCSP
+ *   extension — per-SCT logId / timestamp (BigInt) / algorithm / raw signature,
+ *   the signed-preimage reconstruction surfaced for external verification,
+ *   bounded TLS-struct decode, fail-closed.
+ */
+
+var asn1 = require("./asn1-der.js");
+var constants = require("./constants.js");
+var frameworkError = require("./framework-error.js");
+
+var CtError = frameworkError.CtError;
+var C = constants;
+
+// RFC 5246 §7.4.1.4.1 code points — 1-byte, NOT OIDs. Surfaced named; an
+// unknown code surfaces as its numeric byte with a null name (never rejected —
+// off-profile-pair rejection is a verifier-tier log-conformance concern).
+var HASH_ALGORITHMS = {
+  0: "none", 1: "md5", 2: "sha1", 3: "sha224", 4: "sha256", 5: "sha384", 6: "sha512",
+};
+var SIGNATURE_ALGORITHMS = { 0: "anonymous", 1: "rsa", 2: "dsa", 3: "ecdsa" };
+
+// A minimum viable v1 SCT body: version(1) + LogID(32) + timestamp(8) +
+// empty-extensions(2) + digitally-signed{ hash(1) + sig(1) + empty-sig(2) } = 47.
+var SCT_MIN_BODY = 47;
+var LOGID_BYTES = 32;
+var MAX_SAFE = 9007199254740991n;   // 2^53 - 1; above this a Number loses precision
+
+// ---- TlsReader — the one net-new primitive (an ENCODING layer, not a schema
+// combinator): a bounded big-endian TLS-vector cursor with a hard [pos, end).
+// A lying inner length can overrun only the current sub-reader's `end`, never
+// the parent buffer, so bounds-before-slice is structural.
+function TlsReader(buf, start, end) { this.buf = buf; this.pos = start; this.end = end; }
+TlsReader.prototype._need = function (n, code) {
+  if (this.pos + n > this.end) {
+    throw new CtError(code || "ct/truncated", "need " + n + " byte(s), only " + (this.end - this.pos) + " remain");
+  }
+};
+TlsReader.prototype.u8 = function (code) { this._need(1, code); return this.buf[this.pos++]; };
+TlsReader.prototype.u16 = function (code) { this._need(2, code); var v = this.buf.readUInt16BE(this.pos); this.pos += 2; return v; };
+TlsReader.prototype.u24 = function (code) {
+  this._need(3, code);
+  var v = (this.buf[this.pos] << 16) | (this.buf[this.pos + 1] << 8) | this.buf[this.pos + 2];
+  this.pos += 3; return v;
+};
+TlsReader.prototype.u64 = function (code) { this._need(8, code); var v = this.buf.readBigUInt64BE(this.pos); this.pos += 8; return v; };
+TlsReader.prototype.fixed = function (n, code) {
+  this._need(n, code);
+  var s = this.buf.subarray(this.pos, this.pos + n); this.pos += n; return s;
+};
+// opaque<min..max> — a length-prefixed vector (lenWidth-byte big-endian prefix).
+// The length prefix itself is a plain read (a truncation there is ct/truncated);
+// only a LYING length whose body overruns the bound carries the field's own code.
+TlsReader.prototype.vector = function (lenWidth, min, max, code) {
+  var len = lenWidth === 3 ? this.u24() : this.u16();
+  if (len < min) throw new CtError(code, "vector length " + len + " below minimum " + min);
+  if (max != null && len > max) throw new CtError(code, "vector length " + len + " above maximum " + max);
+  this._need(len, code);
+  var s = this.buf.subarray(this.pos, this.pos + len); this.pos += len; return s;
+};
+TlsReader.prototype.subReader = function (len, code) {
+  this._need(len, code);
+  var r = new TlsReader(this.buf, this.pos, this.pos + len); this.pos += len; return r;
+};
+TlsReader.prototype.remaining = function () { return this.end - this.pos; };
+TlsReader.prototype.atEnd = function () { return this.pos === this.end; };
+
+// Peel the RFC 6962 §3.3 inner DER OCTET STRING (the certificate/OCSP layer
+// already peeled the outer extnValue OCTET STRING). Rides the strict codec, so
+// an indefinite length / constructed OCTET STRING / trailing bytes / single
+// wrap all fail closed here; the asn1/* fault attaches as `.cause`.
+function _peelInner(extValue) {
+  var node;
+  try { node = asn1.decode(extValue); }
+  catch (e) { throw new CtError("ct/bad-der", "the SCT-list extension value is not valid DER (RFC 6962 §3.3)", e); }
+  try { return asn1.read.octetString(node); }
+  catch (e) { throw new CtError("ct/bad-der", "the SCT-list extension value must be a DER OCTET STRING wrapping the TLS list (RFC 6962 §3.3)", e); }
+}
+
+function _toBuffer(v, field) {
+  if (Buffer.isBuffer(v)) return v;
+  if (v instanceof Uint8Array) return Buffer.from(v);
+  throw new CtError("ct/bad-input", field + " must be a Buffer or Uint8Array");
+}
+
+// Parse one SerializedSCT body inside a sub-reader bounded to the element (so a
+// lying extensions/signature length overruns the element, never the list). A
+// version this parser does not define is preserved OPAQUE, not rejected: RFC 6962
+// §3.3 gives every SerializedSCT its own length prefix precisely so a client "can
+// still parse old SCTs while skipping over new SCTs whose versions they don't
+// understand" — so an unknown version yields { unknown, version, rawSct } and the
+// v1-specific field decode (and the 47-byte floor) is skipped.
+function _parseSct(r, sctLen) {
+  var bodyStart = r.pos;
+  var version = r.u8();   // sctLen >= 1 is guaranteed by the SerializedSCT<1..> check
+  if (version !== 0) {
+    return { unknown: true, version: version, rawSct: r.buf.subarray(bodyStart, r.end) };
+  }
+  if (sctLen < SCT_MIN_BODY) {
+    throw new CtError("ct/sct-too-short", "a v1 SCT body is at least " + SCT_MIN_BODY + " bytes, got " + sctLen + " (RFC 6962 §3.2)");
+  }
+  var logId = r.fixed(LOGID_BYTES);
+  var timestamp = r.u64();
+  var extensions = r.vector(2, 0, null, "ct/ext-overrun");
+  var hashAlg = r.u8();
+  var sigAlg = r.u8();
+  var signature = r.vector(2, 0, null, "ct/sig-overrun");
+  if (!r.atEnd()) {
+    throw new CtError("ct/sct-trailing-bytes", (r.end - r.pos) + " byte(s) left in a SerializedSCT after the signature (RFC 6962 §3.3)");
+  }
+  var timestampMs = timestamp <= MAX_SAFE ? Number(timestamp) : null;
+  return {
+    version: 0,
+    logId: logId, logIdHex: logId.toString("hex"),
+    timestamp: timestamp,
+    timestampMs: timestampMs,
+    timestampDate: new Date(timestampMs != null ? timestampMs : Number(timestamp)),
+    extensions: extensions,
+    hashAlg: hashAlg, sigAlg: sigAlg,
+    signatureAlgorithm: {
+      hash: hashAlg, hashName: HASH_ALGORITHMS[hashAlg] || null,
+      signature: sigAlg, signatureName: SIGNATURE_ALGORITHMS[sigAlg] || null,
+    },
+    signature: signature,
+    rawSct: r.buf.subarray(bodyStart, r.end),
+  };
+}
+
+/**
+ * @primitive  pki.ct.parseSctList
+ * @signature  pki.ct.parseSctList(extValue) -> { scts, unknownScts }
+ * @since      0.1.20
+ * @status     experimental
+ * @spec       RFC 6962, RFC 5246, RFC 8446
+ * @related    pki.ct.reconstructSignedData, pki.schema.x509.parse
+ *
+ * Parse the value of an RFC 6962 SCT-list extension (the raw `extnValue`
+ * content an `x509.parse` / OCSP extension already surfaces) into
+ * `{ scts, unknownScts }`. Each entry of `scts` is a fully decoded v1 SCT:
+ * `version` (0), `logId` (32-byte Buffer) + `logIdHex`, `timestamp` (BigInt,
+ * exact) + `timestampMs` (Number or `null` above 2^53) + `timestampDate`,
+ * `extensions` (raw Buffer), `hashAlg` / `sigAlg` (1-byte code points) + a named
+ * `signatureAlgorithm`, the raw `signature` Buffer, and `rawSct` (the full
+ * SerializedSCT body). A SerializedSCT whose version this parser does not define
+ * is preserved OPAQUE in `unknownScts` as `{ version, rawSct }` rather than
+ * failing the list — RFC 6962 §3.3 frames each SerializedSCT with its own length
+ * so unknown versions are skippable (forward compatibility).
+ *
+ * The extension value is a DER `OCTET STRING` wrapping the TLS-encoded list
+ * (RFC 6962 §3.3 double wrap); everything below that peel is TLS presentation
+ * language, decoded with a bounded cursor. Structure is decoded, crypto is
+ * surfaced RAW — the signature is never verified and the LogID never recomputed.
+ *
+ * Throws `CtError` with a stable `ct/*` code on any malformed input (a bad inner
+ * DER wrap is `ct/bad-der` with the `asn1/*` fault as `.cause`), never a raw
+ * `TypeError`.
+ *
+ * @example
+ *   var cert = pki.schema.x509.parse(pem);
+ *   var sctOid = pki.oid.byName("signedCertificateTimestampList");
+ *   var ext = (cert.extensions || []).find(function (e) { return e.oid === sctOid; });
+ *   if (ext) {
+ *     var list = pki.ct.parseSctList(ext.value);
+ *     list.scts[0].logIdHex;      // the log's key id
+ *     list.scts[0].timestamp;     // exact BigInt ms since epoch
+ *   }
+ */
+function parseSctList(extValue) {
+  if (!Buffer.isBuffer(extValue) && !(extValue instanceof Uint8Array)) {
+    throw new CtError("ct/bad-input", "parseSctList expects the SCT-list extension value as a Buffer or Uint8Array");
+  }
+  var blob = _peelInner(Buffer.isBuffer(extValue) ? extValue : Buffer.from(extValue));
+  if (blob.length > C.LIMITS.SCT_MAX_BYTES) {
+    throw new CtError("ct/too-large", "SCT list " + blob.length + " bytes exceeds the cap " + C.LIMITS.SCT_MAX_BYTES);
+  }
+  var outer = new TlsReader(blob, 0, blob.length);
+  var listLen = outer.u16("ct/bad-list");
+  if (listLen + 2 !== blob.length) {
+    throw new CtError("ct/bad-list", "the SCT list declared length " + listLen + " does not match the " + (blob.length - 2) + " byte(s) present (RFC 6962 §3.3)");
+  }
+  if (listLen < 1) {
+    throw new CtError("ct/empty-list", "an SCT list must contain at least one SCT (RFC 6962 §3.3)");
+  }
+  var scts = [], unknownScts = [];
+  while (!outer.atEnd()) {
+    if (outer.remaining() < 2) {
+      throw new CtError("ct/list-trailing-bytes", "a dangling partial element after the last complete SCT (RFC 6962 §3.3)");
+    }
+    var sctLen = outer.u16("ct/list-trailing-bytes");
+    if (sctLen < 1) {
+      throw new CtError("ct/sct-empty", "a SerializedSCT must be non-empty (RFC 6962 §3.3)");
+    }
+    if (outer.remaining() < sctLen) {
+      throw new CtError("ct/list-trailing-bytes", "a SerializedSCT length " + sctLen + " overruns the list (RFC 6962 §3.3)");
+    }
+    var one = _parseSct(outer.subReader(sctLen, "ct/list-trailing-bytes"), sctLen);
+    if (one.unknown) unknownScts.push({ version: one.version, rawSct: one.rawSct });
+    else scts.push(one);
+    // The cap bounds the TOTAL element count (known + preserved-unknown) before it
+    // can drive unbounded per-element work.
+    if (scts.length + unknownScts.length > C.LIMITS.SCT_MAX_COUNT) {
+      throw new CtError("ct/too-many-scts", "SCT count exceeds the cap " + C.LIMITS.SCT_MAX_COUNT);
+    }
+  }
+  return { scts: scts, unknownScts: unknownScts };
+}
+
+function _u24Bytes(n) {
+  if (n < 1 || n > 0xffffff) {
+    throw new CtError("ct/bad-tbs-length", "a certificate / TBSCertificate length must be in 1..2^24-1, got " + n + " (RFC 6962 §3.1)");
+  }
+  return Buffer.from([(n >> 16) & 0xff, (n >> 8) & 0xff, n & 0xff]);
+}
+
+/**
+ * @primitive  pki.ct.reconstructSignedData
+ * @signature  pki.ct.reconstructSignedData(entry, sct) -> Buffer
+ * @since      0.1.20
+ * @status     experimental
+ * @spec       RFC 6962
+ * @related    pki.ct.parseSctList
+ *
+ * Rebuild the exact `digitally-signed` preimage bytes an external verifier
+ * hashes to check an SCT's signature (RFC 6962 §3.2), for a parsed `sct`.
+ * `entry` selects the log-entry arm:
+ *   - `{ entryType: 0, leafCert: <DER Buffer> }` — an SCT delivered over TLS /
+ *     OCSP, signed over `x509_entry(0)` with the leaf certificate.
+ *   - `{ entryType: 1, tbsCertificate: <DER Buffer>, issuerKeyHash: <32B> }` —
+ *     an SCT EMBEDDED in a certificate, signed over `precert_entry(1)` with the
+ *     issuer key hash + the precertificate TBS (the TBS with only the SCT
+ *     extension removed). `issuerKeyHash` is SHA-256 of the issuer's SPKI DER.
+ *
+ * The preimage reuses the parsed SCT's raw `extensions` byte-for-byte and
+ * re-emits the fixed-width scalars canonically. This never verifies anything —
+ * a verifier hashes the returned bytes and checks the signature with the log's
+ * public key (compose `webcrypto`). Throws `CtError` (`ct/bad-entry-type`,
+ * `ct/bad-issuer-key-hash`, `ct/bad-tbs-length`) on a malformed entry.
+ *
+ * @example
+ *   var sct = pki.ct.parseSctList(sctExtValue).scts[0];
+ *   var preimage = pki.ct.reconstructSignedData({ entryType: 0, leafCert: der }, sct);
+ *   // hash `preimage` + verify against the log's public key at the verify layer
+ */
+function reconstructSignedData(entry, sct) {
+  entry = entry || {};
+  var entryType = entry.entryType;
+  if (entryType !== 0 && entryType !== 1) {
+    throw new CtError("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1), got " + entryType + " (RFC 6962 §3.1)");
+  }
+  // A fully decoded v1 SCT (from parseSctList().scts[]) — not an opaque
+  // unknownScts entry, whose body layout is undefined and cannot be signed over.
+  if (!sct || typeof sct.timestamp !== "bigint" || sct.version !== 0) {
+    throw new CtError("ct/bad-input", "reconstructSignedData expects a decoded v1 SCT from parseSctList().scts[]");
+  }
+  var parts = [];
+  parts.push(Buffer.from([sct.version & 0xff]));                          // Version — v1(0)
+  parts.push(Buffer.from([0]));                                          // SignatureType — certificate_timestamp(0)
+  var ts = Buffer.alloc(8); ts.writeBigUInt64BE(BigInt(sct.timestamp)); parts.push(ts);   // uint64 timestamp
+  parts.push(Buffer.from([(entryType >> 8) & 0xff, entryType & 0xff]));  // LogEntryType (2 bytes BE)
+  if (entryType === 0) {
+    var cert = _toBuffer(entry.leafCert, "leafCert");
+    parts.push(_u24Bytes(cert.length)); parts.push(cert);                // ASN.1Cert<1..2^24-1>
+  } else {
+    var ikh = _toBuffer(entry.issuerKeyHash, "issuerKeyHash");
+    if (ikh.length !== 32) {
+      throw new CtError("ct/bad-issuer-key-hash", "issuer_key_hash must be exactly 32 bytes (SHA-256 of the issuer SPKI), got " + ikh.length + " (RFC 6962 §3.2)");
+    }
+    var tbs = _toBuffer(entry.tbsCertificate, "tbsCertificate");
+    parts.push(ikh);
+    parts.push(_u24Bytes(tbs.length)); parts.push(tbs);                  // PreCert.tbs_certificate<1..2^24-1>
+  }
+  var ext = _toBuffer(sct.extensions, "sct.extensions");                 // reuse the parsed raw bytes, never re-encode
+  parts.push(Buffer.from([(ext.length >> 8) & 0xff, ext.length & 0xff])); parts.push(ext);   // CtExtensions
+  return Buffer.concat(parts);
+}
+
+module.exports = {
+  parseSctList: parseSctList,
+  reconstructSignedData: reconstructSignedData,
+  HASH_ALGORITHMS: HASH_ALGORITHMS,
+  SIGNATURE_ALGORITHMS: SIGNATURE_ALGORITHMS,
+};

package/lib/framework-error.js

@@ -179,6 +179,15 @@ var CmpError = defineClass("CmpError", { withCause: true });
 // `.cause`.
 var PathError = defineClass("PathError", { withCause: true });
 
+// CtError — a byte sequence that is not a well-formed RFC 6962 Certificate
+// Transparency SCT list: a malformed inner DER OCTET-STRING wrap, or a TLS
+// presentation-language framing violation (a lying vector length, a field read
+// past its bound, a truncated element). An SCT whose version this parser does
+// not define is NOT an error — RFC 6962 §3.3 makes unknown versions skippable,
+// so they are preserved opaque. Carries the underlying leaf fault (e.g. the
+// inner `asn1/*` decode error) as `.cause`.
+var CtError = defineClass("CtError", { withCause: true });
+
 module.exports = {
   PkiError:         PkiError,
   defineClass:      defineClass,
@@ -199,4 +208,5 @@ module.exports = {
   Pkcs12Error:      Pkcs12Error,
   CmpError:         CmpError,
   PathError:        PathError,
+  CtError:          CtError,
 };

package/lib/oid.js

@@ -116,6 +116,15 @@ var FAMILIES = {
   pkixKp: { base: [1, 3, 6, 1, 5, 5, 7, 3], of: {
     serverAuth: 1, clientAuth: 2, codeSigning: 3, emailProtection: 4, timeStamping: 8, ocspSigning: 9 } },
 
+  // Google Certificate Transparency (RFC 6962) on the 1.3.6.1.4.1.11129.2.4 arc:
+  // the SCT-list X.509 extension (§3.3), the precertificate poison (§3.1), the
+  // precert-signing EKU (§3.1, naming only), and the OCSP-delivered SCT list
+  // (§3.3). The SCT payload itself is TLS presentation language, not DER — it is
+  // parsed by lib/ct.js (pki.ct), never routed through the DER schema engine.
+  ct: { base: [1, 3, 6, 1, 4, 1, 11129, 2, 4], of: {
+    signedCertificateTimestampList: 2, precertificatePoison: 3,
+    precertificateSigningCert: 4, ocspSignedCertificateTimestampList: 5 } },
+
   // PKCS#1 RSA public-key + RSASSA signature algorithms.
   rsa: { base: [1, 2, 840, 113549, 1, 1], of: {
     rsaEncryption: 1, rsaesOaep: 7, mgf1: 8, rsassaPss: 10,

package/lib/schema-pkix.js

@@ -16,6 +16,10 @@
 var asn1 = require("./asn1-der");
 var constants = require("./constants");
 var schema = require("./schema-engine");
+// ct is a leaf format module (requires only the codec / oid / constants / error
+// core, never pkix) so the SCT-list extension VALUE decoder registers here as a
+// registry row, not a switch. The one-directional edge keeps the layering acyclic.
+var ct = require("./ct");
 
 var PEM_RE = /-----BEGIN ([A-Z0-9 ]+)-----([\s\S]*?)-----END \1-----/;
 
@@ -603,6 +607,29 @@ function certExtensionDecoders(ns) {
     catch (e) { throw ns.E(C, "SubjectKeyIdentifier must be an OCTET STRING (RFC 5280 §4.2.1.2)", e); }
   }
 
+  // signedCertificateTimestampList (RFC 6962 §3.3) — the extension value is a DER
+  // OCTET STRING wrapping the TLS-encoded SCT list. Delegated to the CT module,
+  // which owns the inner peel + the bounded TLS decode; structure is decoded, the
+  // signature stays raw and unverified. The registry contract is that a decoder
+  // throws a `<prefix>/bad-*` code, so the CT module's own `ct/*` fault is wrapped
+  // and carried as `.cause` rather than leaking a foreign namespace here.
+  function sctList(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    try { return ct.parseSctList(buf); }
+    catch (e) { throw ns.E(C, "malformed signedCertificateTimestampList extension value (RFC 6962 §3.3)", e); }
+  }
+
+  // precertificatePoison (RFC 6962 §3.1) — a critical extension whose value is
+  // exactly ASN.1 NULL (05 00), the marker distinguishing a precertificate from
+  // a final certificate. Content-validated, not merely tag-checked.
+  function precertPoison(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "PrecertificatePoison");
+    try { asn1.read.nullValue(n); }
+    catch (e) { throw ns.E(C, "the precertificate poison extension value must be ASN.1 NULL (RFC 6962 §3.1)", e); }
+    return { poison: true };
+  }
+
   function O(nm) { return ns.oid.byName(nm); }
   var byOid = {};
   byOid[O("basicConstraints")] = basicConstraints;
@@ -617,6 +644,8 @@ function certExtensionDecoders(ns) {
   byOid[O("extKeyUsage")] = extKeyUsage;
   byOid[O("authorityKeyIdentifier")] = authorityKeyIdentifier;
   byOid[O("subjectKeyIdentifier")] = subjectKeyIdentifier;
+  byOid[O("signedCertificateTimestampList")] = sctList;
+  byOid[O("precertificatePoison")] = precertPoison;
   return { byOid: byOid };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c8d0b092-58fa-4019-9da1-b2b636e61608",
+  "serialNumber": "urn:uuid:f23ca197-835e-4ec8-8d04-486fb3d9deac",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-09T11:21:47.988Z",
+    "timestamp": "2026-07-09T14:17:20.162Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.19",
+      "bom-ref": "@blamejs/pki@0.1.20",
       "type": "application",
       "name": "pki",
-      "version": "0.1.19",
+      "version": "0.1.20",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.19",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.20",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.19",
+      "ref": "@blamejs/pki@0.1.20",
       "dependsOn": []
     }
   ]