@blamejs/pki 0.1.19 → 0.1.21

package/CHANGELOG.md

@@ -4,6 +4,33 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.21 — 2026-07-09
+
+SLH-DSA signatures verify in certification-path validation, and the post-quantum / EdDSA parameters-absent rule is enforced across every format.
+
+### Added
+
+- SLH-DSA signature verification in pki.path.validate — all twelve FIPS 205 parameter sets (id-slh-dsa-sha2-{128,192,256}{s,f} and the SHAKE sets). A certificate or CRL signed with SLH-DSA now verifies by importing the issuer's SLH-DSA public key and checking the one-shot signature over the raw signed region; the same rows serve both the certificate signature check and the CRL revocation checker. ML-DSA and the classical RSA / ECDSA / EdDSA set were already wired.
+- pki.oid.paramsMustBeAbsent(oid) — a predicate that reports whether an AlgorithmIdentifier bearing the given OID must encode its parameters field as absent (the ML-DSA and SLH-DSA families and the RFC 8410 Edwards / Montgomery curves). It is the single source the shared AlgorithmIdentifier decoder consults.
+- The OID registry now names the twelve pre-hash HashSLH-DSA identifiers (id-hash-slh-dsa-*, RFC 9909 §3), so a certificate or CRL that carries a HashSLH-DSA algorithm resolves to a name and is covered by the parameters-absent rule.
+
+### Fixed
+
+- The shared AlgorithmIdentifier decoder now rejects a present parameters field on the algorithms whose parameters MUST be absent — ML-DSA, SLH-DSA, Ed25519, Ed448, X25519, and X448 (RFC 9909 §3, RFC 9814 §4, RFC 9881 §2, RFC 8410 §3) — failing closed with a <format>/bad-algorithm-parameters code. Previously a stray explicit NULL or arbitrary bytes in that field were surfaced raw. The rule is enforced once in the shared decoder, so every format that names an algorithm inherits it; a conforming identifier, which omits the field, is unaffected.
+- Certification-path validation now enforces issuer-key / signature-algorithm consistency for the one-shot families whose public-key OID equals the signature OID — EdDSA, ML-DSA, and SLH-DSA — rejecting a mismatch with a path/algorithm-mismatch reason (RFC 9814 §4). Because the underlying WebCrypto import binds a public key of a different type to the requested algorithm name and verifies with the real key, a certificate or CRL signed by one key type but labelling its signatureAlgorithm as another one-shot type could otherwise validate; the check closes that algorithm-confusion path for both the certificate signature and the CRL revocation checker.
+
+## v0.1.20 — 2026-07-09
+
+An RFC 6962 Certificate Transparency SCT-list parser joins the toolkit.
+
+### Added
+
+- pki.ct.parseSctList(extValue) — RFC 6962 SCT-list parsing. It decodes the SignedCertificateTimestampList extension value (the raw extnValue content an x509 or OCSP extension surfaces) into { scts, unknownScts }. Each scts entry is a fully decoded v1 SCT: version (0), logId (32-byte Buffer) plus logIdHex, timestamp (exact BigInt) plus timestampMs (a Number, or null above 2^53) plus timestampDate, extensions (raw Buffer), the hashAlg / sigAlg code points plus a named signatureAlgorithm, the raw signature, and rawSct (the full SerializedSCT body). A SerializedSCT whose version is not v1 is preserved opaque in unknownScts as { version, rawSct } rather than failing the list (RFC 6962 §3.3 gives each SerializedSCT its own length so unknown versions are skippable). The extension value is the §3.3 double DER OCTET STRING wrap over a TLS-encoded list, decoded with a bounded reader that validates the list and per-SCT framing and every internal length, and asserts a per-list byte and count cap before it iterates. The signature is never verified and the log id never recomputed. Malformed input fails closed with a typed ct/* (or leaf asn1/*) code.
+- pki.ct.reconstructSignedData(entry, sct) — rebuilds the exact digitally-signed preimage a verifier hashes to check an SCT's signature (RFC 6962 §3.2), for a decoded v1 SCT. entry selects the log-entry form: { entryType: 0, leafCert } for an SCT delivered over TLS or OCSP (signed over the leaf certificate), or { entryType: 1, tbsCertificate, issuerKeyHash } for an SCT embedded in a certificate (signed over the issuer key hash and the precertificate TBS). The preimage reuses the parsed SCT's raw extensions byte-for-byte; a verifier hashes the returned bytes and checks the signature with the log's public key.
+- The certificate-extension value registry gains the SCT-list decoder and the precertificate-poison decoder (the poison value is content-validated as ASN.1 NULL, not merely tag-checked).
+- The OID registry gains the Certificate Transparency arc — the SCT-list, precertificate-poison, precertificate-signing-certificate, and OCSP SCT-list identifiers — so those extension OIDs resolve to names.
+- The error taxonomy gains CtError, carrying a stable ct/* code.
+
 ## v0.1.19 — 2026-07-09
 
 An RFC 9810 Certificate Management Protocol message parser joins the pki.schema family.

package/README.md

@@ -204,8 +204,9 @@ is callable today; nothing below is a stub.
 | `pki.schema.cmp` | Parse DER / PEM RFC 9810 Certificate Management Protocol messages (PKIMessage) — the header (version, sender / recipient incl. the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` / `bodyBytes` slices an external verifier reconstructs the protected part from; the CMP-before-OCSP dispatch order is enforced, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation. Pure and re-entrant, fail-closed — `validate`, `crlChecker` |
+| `pki.ct` | Parse RFC 6962 Certificate Transparency SCT lists — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage for external verification. Structure decoded, crypto surfaced raw, bounded decode, fail-closed — `parseSctList`, `reconstructSignedData` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI

package/index.js

@@ -30,6 +30,7 @@ var oid       = require("./lib/oid");
 var webcrypto = require("./lib/webcrypto");
 var schema    = require("./lib/schema-all");
 var path      = require("./lib/path-validate");
+var ct        = require("./lib/ct");
 
 module.exports = {
   version:   constants.version,
@@ -46,6 +47,10 @@ module.exports = {
   // `path` is RFC 5280 §6 certification-path validation — pki.path.validate
   // runs the §6.1 state machine over an already-parsed path + a trust anchor.
   path:      path,
+  // `ct` is RFC 6962 Certificate Transparency — pki.ct.parseSctList decodes the
+  // SCT-list extension a certificate / OCSP response carries; the signature is
+  // surfaced raw for external verification (pki.ct.reconstructSignedData).
+  ct:        ct,
   // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
   // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
   // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.

package/lib/constants.js

@@ -117,6 +117,17 @@ var LIMITS = {
   PEM_MAX_BYTES: BYTES.mib(16),
   DER_MAX_INTEGER_BYTES: BYTES.kib(16),
   OID_MAX_SUBIDENTIFIER_BYTES: 32,
+  // Certificate Transparency SCT-list bounds (RFC 6962 §3.3). The outer sct_list
+  // vector carries a 2-byte length prefix, so a well-formed list body is at most
+  // 2^16-1 = 65535 bytes and the full TLS blob (prefix + body) is at most 65537.
+  // The byte cap sits at that structural maximum, so the largest conforming list
+  // is accepted while an oversized inner OCTET STRING (up to the DER document cap)
+  // is refused BEFORE the list is walked; the per-list count cap is likewise
+  // asserted before iteration so a hostile length prefix cannot drive unbounded
+  // work (the CVE-2022-0778 class: crafted bytes inside a certificate extension
+  // pinning a validator). A real chain carries 2-5 SCTs; 256 is far above policy.
+  SCT_MAX_BYTES: BYTES.kib(64) + 1,
+  SCT_MAX_COUNT: 256,
   // Certification-path length ceiling: bounds the per-cert asymmetric verify
   // work on an untrusted certificate bundle (a real chain is well under this;
   // the operator may override via opts.maxPathCerts).

package/lib/ct.js

@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.ct
+ * @nav        Transparency
+ * @title      CT
+ * @order      210
+ * @slug       ct
+ *
+ * @intro
+ *   Certificate Transparency SCT-list handling per RFC 6962. `parseSctList`
+ *   decodes the `SignedCertificateTimestampList` an X.509 certificate (or an
+ *   OCSP response) carries in the SCT extension into its individual signed
+ *   certificate timestamps.
+ *
+ *   The SCT payload is encoded in the TLS presentation language (RFC 8446 §3 /
+ *   RFC 5246 §4 conventions) — positional, tag-less, fixed-width big-endian
+ *   integers and length-prefixed opaque vectors — NOT ASN.1/DER. So this module
+ *   owns a bounded big-endian TLS-struct reader rather than composing the DER
+ *   schema engine; the only ASN.1 surface is the §3.3 double wrap (the
+ *   extension value is a DER OCTET STRING whose content is another DER OCTET
+ *   STRING whose content is the TLS list — the certificate/OCSP layer peels the
+ *   outer, this module peels the inner).
+ *
+ *   Structure is decoded, crypto is surfaced RAW: each SCT surfaces its `logId`
+ *   (32 raw bytes — SHA-256 of the log's SPKI, never recomputed), the exact
+ *   `timestamp` as a BigInt, the raw `extensions`, the named-but-not-interpreted
+ *   `hashAlg`/`sigAlg` code points, and the raw `signature`. The parser NEVER
+ *   verifies a signature, recomputes a LogID, or trusts a log — a verifier
+ *   composes `webcrypto` over `reconstructSignedData(...)`, the exact
+ *   `digitally-signed` preimage. DER-only carrier, fail-closed.
+ *
+ * @card
+ *   Parse RFC 6962 Certificate Transparency SCT lists from a certificate or OCSP
+ *   extension — per-SCT logId / timestamp (BigInt) / algorithm / raw signature,
+ *   the signed-preimage reconstruction surfaced for external verification,
+ *   bounded TLS-struct decode, fail-closed.
+ */
+
+var asn1 = require("./asn1-der.js");
+var constants = require("./constants.js");
+var frameworkError = require("./framework-error.js");
+
+var CtError = frameworkError.CtError;
+var C = constants;
+
+// RFC 5246 §7.4.1.4.1 code points — 1-byte, NOT OIDs. Surfaced named; an
+// unknown code surfaces as its numeric byte with a null name (never rejected —
+// off-profile-pair rejection is a verifier-tier log-conformance concern).
+var HASH_ALGORITHMS = {
+  0: "none", 1: "md5", 2: "sha1", 3: "sha224", 4: "sha256", 5: "sha384", 6: "sha512",
+};
+var SIGNATURE_ALGORITHMS = { 0: "anonymous", 1: "rsa", 2: "dsa", 3: "ecdsa" };
+
+// A minimum viable v1 SCT body: version(1) + LogID(32) + timestamp(8) +
+// empty-extensions(2) + digitally-signed{ hash(1) + sig(1) + empty-sig(2) } = 47.
+var SCT_MIN_BODY = 47;
+var LOGID_BYTES = 32;
+var MAX_SAFE = 9007199254740991n;   // 2^53 - 1; above this a Number loses precision
+
+// ---- TlsReader — the one net-new primitive (an ENCODING layer, not a schema
+// combinator): a bounded big-endian TLS-vector cursor with a hard [pos, end).
+// A lying inner length can overrun only the current sub-reader's `end`, never
+// the parent buffer, so bounds-before-slice is structural.
+function TlsReader(buf, start, end) { this.buf = buf; this.pos = start; this.end = end; }
+TlsReader.prototype._need = function (n, code) {
+  if (this.pos + n > this.end) {
+    throw new CtError(code || "ct/truncated", "need " + n + " byte(s), only " + (this.end - this.pos) + " remain");
+  }
+};
+TlsReader.prototype.u8 = function (code) { this._need(1, code); return this.buf[this.pos++]; };
+TlsReader.prototype.u16 = function (code) { this._need(2, code); var v = this.buf.readUInt16BE(this.pos); this.pos += 2; return v; };
+TlsReader.prototype.u24 = function (code) {
+  this._need(3, code);
+  var v = (this.buf[this.pos] << 16) | (this.buf[this.pos + 1] << 8) | this.buf[this.pos + 2];
+  this.pos += 3; return v;
+};
+TlsReader.prototype.u64 = function (code) { this._need(8, code); var v = this.buf.readBigUInt64BE(this.pos); this.pos += 8; return v; };
+TlsReader.prototype.fixed = function (n, code) {
+  this._need(n, code);
+  var s = this.buf.subarray(this.pos, this.pos + n); this.pos += n; return s;
+};
+// opaque<min..max> — a length-prefixed vector (lenWidth-byte big-endian prefix).
+// The length prefix itself is a plain read (a truncation there is ct/truncated);
+// only a LYING length whose body overruns the bound carries the field's own code.
+TlsReader.prototype.vector = function (lenWidth, min, max, code) {
+  var len = lenWidth === 3 ? this.u24() : this.u16();
+  if (len < min) throw new CtError(code, "vector length " + len + " below minimum " + min);
+  if (max != null && len > max) throw new CtError(code, "vector length " + len + " above maximum " + max);
+  this._need(len, code);
+  var s = this.buf.subarray(this.pos, this.pos + len); this.pos += len; return s;
+};
+TlsReader.prototype.subReader = function (len, code) {
+  this._need(len, code);
+  var r = new TlsReader(this.buf, this.pos, this.pos + len); this.pos += len; return r;
+};
+TlsReader.prototype.remaining = function () { return this.end - this.pos; };
+TlsReader.prototype.atEnd = function () { return this.pos === this.end; };
+
+// Peel the RFC 6962 §3.3 inner DER OCTET STRING (the certificate/OCSP layer
+// already peeled the outer extnValue OCTET STRING). Rides the strict codec, so
+// an indefinite length / constructed OCTET STRING / trailing bytes / single
+// wrap all fail closed here; the asn1/* fault attaches as `.cause`.
+function _peelInner(extValue) {
+  var node;
+  try { node = asn1.decode(extValue); }
+  catch (e) { throw new CtError("ct/bad-der", "the SCT-list extension value is not valid DER (RFC 6962 §3.3)", e); }
+  try { return asn1.read.octetString(node); }
+  catch (e) { throw new CtError("ct/bad-der", "the SCT-list extension value must be a DER OCTET STRING wrapping the TLS list (RFC 6962 §3.3)", e); }
+}
+
+function _toBuffer(v, field) {
+  if (Buffer.isBuffer(v)) return v;
+  if (v instanceof Uint8Array) return Buffer.from(v);
+  throw new CtError("ct/bad-input", field + " must be a Buffer or Uint8Array");
+}
+
+// Parse one SerializedSCT body inside a sub-reader bounded to the element (so a
+// lying extensions/signature length overruns the element, never the list). A
+// version this parser does not define is preserved OPAQUE, not rejected: RFC 6962
+// §3.3 gives every SerializedSCT its own length prefix precisely so a client "can
+// still parse old SCTs while skipping over new SCTs whose versions they don't
+// understand" — so an unknown version yields { unknown, version, rawSct } and the
+// v1-specific field decode (and the 47-byte floor) is skipped.
+function _parseSct(r, sctLen) {
+  var bodyStart = r.pos;
+  var version = r.u8();   // sctLen >= 1 is guaranteed by the SerializedSCT<1..> check
+  if (version !== 0) {
+    return { unknown: true, version: version, rawSct: r.buf.subarray(bodyStart, r.end) };
+  }
+  if (sctLen < SCT_MIN_BODY) {
+    throw new CtError("ct/sct-too-short", "a v1 SCT body is at least " + SCT_MIN_BODY + " bytes, got " + sctLen + " (RFC 6962 §3.2)");
+  }
+  var logId = r.fixed(LOGID_BYTES);
+  var timestamp = r.u64();
+  var extensions = r.vector(2, 0, null, "ct/ext-overrun");
+  var hashAlg = r.u8();
+  var sigAlg = r.u8();
+  var signature = r.vector(2, 0, null, "ct/sig-overrun");
+  if (!r.atEnd()) {
+    throw new CtError("ct/sct-trailing-bytes", (r.end - r.pos) + " byte(s) left in a SerializedSCT after the signature (RFC 6962 §3.3)");
+  }
+  var timestampMs = timestamp <= MAX_SAFE ? Number(timestamp) : null;
+  return {
+    version: 0,
+    logId: logId, logIdHex: logId.toString("hex"),
+    timestamp: timestamp,
+    timestampMs: timestampMs,
+    timestampDate: new Date(timestampMs != null ? timestampMs : Number(timestamp)),
+    extensions: extensions,
+    hashAlg: hashAlg, sigAlg: sigAlg,
+    signatureAlgorithm: {
+      hash: hashAlg, hashName: HASH_ALGORITHMS[hashAlg] || null,
+      signature: sigAlg, signatureName: SIGNATURE_ALGORITHMS[sigAlg] || null,
+    },
+    signature: signature,
+    rawSct: r.buf.subarray(bodyStart, r.end),
+  };
+}
+
+/**
+ * @primitive  pki.ct.parseSctList
+ * @signature  pki.ct.parseSctList(extValue) -> { scts, unknownScts }
+ * @since      0.1.20
+ * @status     experimental
+ * @spec       RFC 6962, RFC 5246, RFC 8446
+ * @related    pki.ct.reconstructSignedData, pki.schema.x509.parse
+ *
+ * Parse the value of an RFC 6962 SCT-list extension (the raw `extnValue`
+ * content an `x509.parse` / OCSP extension already surfaces) into
+ * `{ scts, unknownScts }`. Each entry of `scts` is a fully decoded v1 SCT:
+ * `version` (0), `logId` (32-byte Buffer) + `logIdHex`, `timestamp` (BigInt,
+ * exact) + `timestampMs` (Number or `null` above 2^53) + `timestampDate`,
+ * `extensions` (raw Buffer), `hashAlg` / `sigAlg` (1-byte code points) + a named
+ * `signatureAlgorithm`, the raw `signature` Buffer, and `rawSct` (the full
+ * SerializedSCT body). A SerializedSCT whose version this parser does not define
+ * is preserved OPAQUE in `unknownScts` as `{ version, rawSct }` rather than
+ * failing the list — RFC 6962 §3.3 frames each SerializedSCT with its own length
+ * so unknown versions are skippable (forward compatibility).
+ *
+ * The extension value is a DER `OCTET STRING` wrapping the TLS-encoded list
+ * (RFC 6962 §3.3 double wrap); everything below that peel is TLS presentation
+ * language, decoded with a bounded cursor. Structure is decoded, crypto is
+ * surfaced RAW — the signature is never verified and the LogID never recomputed.
+ *
+ * Throws `CtError` with a stable `ct/*` code on any malformed input (a bad inner
+ * DER wrap is `ct/bad-der` with the `asn1/*` fault as `.cause`), never a raw
+ * `TypeError`.
+ *
+ * @example
+ *   var cert = pki.schema.x509.parse(pem);
+ *   var sctOid = pki.oid.byName("signedCertificateTimestampList");
+ *   var ext = (cert.extensions || []).find(function (e) { return e.oid === sctOid; });
+ *   if (ext) {
+ *     var list = pki.ct.parseSctList(ext.value);
+ *     list.scts[0].logIdHex;      // the log's key id
+ *     list.scts[0].timestamp;     // exact BigInt ms since epoch
+ *   }
+ */
+function parseSctList(extValue) {
+  if (!Buffer.isBuffer(extValue) && !(extValue instanceof Uint8Array)) {
+    throw new CtError("ct/bad-input", "parseSctList expects the SCT-list extension value as a Buffer or Uint8Array");
+  }
+  var blob = _peelInner(Buffer.isBuffer(extValue) ? extValue : Buffer.from(extValue));
+  if (blob.length > C.LIMITS.SCT_MAX_BYTES) {
+    throw new CtError("ct/too-large", "SCT list " + blob.length + " bytes exceeds the cap " + C.LIMITS.SCT_MAX_BYTES);
+  }
+  var outer = new TlsReader(blob, 0, blob.length);
+  var listLen = outer.u16("ct/bad-list");
+  if (listLen + 2 !== blob.length) {
+    throw new CtError("ct/bad-list", "the SCT list declared length " + listLen + " does not match the " + (blob.length - 2) + " byte(s) present (RFC 6962 §3.3)");
+  }
+  if (listLen < 1) {
+    throw new CtError("ct/empty-list", "an SCT list must contain at least one SCT (RFC 6962 §3.3)");
+  }
+  var scts = [], unknownScts = [];
+  while (!outer.atEnd()) {
+    if (outer.remaining() < 2) {
+      throw new CtError("ct/list-trailing-bytes", "a dangling partial element after the last complete SCT (RFC 6962 §3.3)");
+    }
+    var sctLen = outer.u16("ct/list-trailing-bytes");
+    if (sctLen < 1) {
+      throw new CtError("ct/sct-empty", "a SerializedSCT must be non-empty (RFC 6962 §3.3)");
+    }
+    if (outer.remaining() < sctLen) {
+      throw new CtError("ct/list-trailing-bytes", "a SerializedSCT length " + sctLen + " overruns the list (RFC 6962 §3.3)");
+    }
+    var one = _parseSct(outer.subReader(sctLen, "ct/list-trailing-bytes"), sctLen);
+    if (one.unknown) unknownScts.push({ version: one.version, rawSct: one.rawSct });
+    else scts.push(one);
+    // The cap bounds the TOTAL element count (known + preserved-unknown) before it
+    // can drive unbounded per-element work.
+    if (scts.length + unknownScts.length > C.LIMITS.SCT_MAX_COUNT) {
+      throw new CtError("ct/too-many-scts", "SCT count exceeds the cap " + C.LIMITS.SCT_MAX_COUNT);
+    }
+  }
+  return { scts: scts, unknownScts: unknownScts };
+}
+
+function _u24Bytes(n) {
+  if (n < 1 || n > 0xffffff) {
+    throw new CtError("ct/bad-tbs-length", "a certificate / TBSCertificate length must be in 1..2^24-1, got " + n + " (RFC 6962 §3.1)");
+  }
+  return Buffer.from([(n >> 16) & 0xff, (n >> 8) & 0xff, n & 0xff]);
+}
+
+/**
+ * @primitive  pki.ct.reconstructSignedData
+ * @signature  pki.ct.reconstructSignedData(entry, sct) -> Buffer
+ * @since      0.1.20
+ * @status     experimental
+ * @spec       RFC 6962
+ * @related    pki.ct.parseSctList
+ *
+ * Rebuild the exact `digitally-signed` preimage bytes an external verifier
+ * hashes to check an SCT's signature (RFC 6962 §3.2), for a parsed `sct`.
+ * `entry` selects the log-entry arm:
+ *   - `{ entryType: 0, leafCert: <DER Buffer> }` — an SCT delivered over TLS /
+ *     OCSP, signed over `x509_entry(0)` with the leaf certificate.
+ *   - `{ entryType: 1, tbsCertificate: <DER Buffer>, issuerKeyHash: <32B> }` —
+ *     an SCT EMBEDDED in a certificate, signed over `precert_entry(1)` with the
+ *     issuer key hash + the precertificate TBS (the TBS with only the SCT
+ *     extension removed). `issuerKeyHash` is SHA-256 of the issuer's SPKI DER.
+ *
+ * The preimage reuses the parsed SCT's raw `extensions` byte-for-byte and
+ * re-emits the fixed-width scalars canonically. This never verifies anything —
+ * a verifier hashes the returned bytes and checks the signature with the log's
+ * public key (compose `webcrypto`). Throws `CtError` (`ct/bad-entry-type`,
+ * `ct/bad-issuer-key-hash`, `ct/bad-tbs-length`) on a malformed entry.
+ *
+ * @example
+ *   var sct = pki.ct.parseSctList(sctExtValue).scts[0];
+ *   var preimage = pki.ct.reconstructSignedData({ entryType: 0, leafCert: der }, sct);
+ *   // hash `preimage` + verify against the log's public key at the verify layer
+ */
+function reconstructSignedData(entry, sct) {
+  entry = entry || {};
+  var entryType = entry.entryType;
+  if (entryType !== 0 && entryType !== 1) {
+    throw new CtError("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1), got " + entryType + " (RFC 6962 §3.1)");
+  }
+  // A fully decoded v1 SCT (from parseSctList().scts[]) — not an opaque
+  // unknownScts entry, whose body layout is undefined and cannot be signed over.
+  if (!sct || typeof sct.timestamp !== "bigint" || sct.version !== 0) {
+    throw new CtError("ct/bad-input", "reconstructSignedData expects a decoded v1 SCT from parseSctList().scts[]");
+  }
+  var parts = [];
+  parts.push(Buffer.from([sct.version & 0xff]));                          // Version — v1(0)
+  parts.push(Buffer.from([0]));                                          // SignatureType — certificate_timestamp(0)
+  var ts = Buffer.alloc(8); ts.writeBigUInt64BE(BigInt(sct.timestamp)); parts.push(ts);   // uint64 timestamp
+  parts.push(Buffer.from([(entryType >> 8) & 0xff, entryType & 0xff]));  // LogEntryType (2 bytes BE)
+  if (entryType === 0) {
+    var cert = _toBuffer(entry.leafCert, "leafCert");
+    parts.push(_u24Bytes(cert.length)); parts.push(cert);                // ASN.1Cert<1..2^24-1>
+  } else {
+    var ikh = _toBuffer(entry.issuerKeyHash, "issuerKeyHash");
+    if (ikh.length !== 32) {
+      throw new CtError("ct/bad-issuer-key-hash", "issuer_key_hash must be exactly 32 bytes (SHA-256 of the issuer SPKI), got " + ikh.length + " (RFC 6962 §3.2)");
+    }
+    var tbs = _toBuffer(entry.tbsCertificate, "tbsCertificate");
+    parts.push(ikh);
+    parts.push(_u24Bytes(tbs.length)); parts.push(tbs);                  // PreCert.tbs_certificate<1..2^24-1>
+  }
+  var ext = _toBuffer(sct.extensions, "sct.extensions");                 // reuse the parsed raw bytes, never re-encode
+  parts.push(Buffer.from([(ext.length >> 8) & 0xff, ext.length & 0xff])); parts.push(ext);   // CtExtensions
+  return Buffer.concat(parts);
+}
+
+module.exports = {
+  parseSctList: parseSctList,
+  reconstructSignedData: reconstructSignedData,
+  HASH_ALGORITHMS: HASH_ALGORITHMS,
+  SIGNATURE_ALGORITHMS: SIGNATURE_ALGORITHMS,
+};

package/lib/framework-error.js

@@ -179,6 +179,15 @@ var CmpError = defineClass("CmpError", { withCause: true });
 // `.cause`.
 var PathError = defineClass("PathError", { withCause: true });
 
+// CtError — a byte sequence that is not a well-formed RFC 6962 Certificate
+// Transparency SCT list: a malformed inner DER OCTET-STRING wrap, or a TLS
+// presentation-language framing violation (a lying vector length, a field read
+// past its bound, a truncated element). An SCT whose version this parser does
+// not define is NOT an error — RFC 6962 §3.3 makes unknown versions skippable,
+// so they are preserved opaque. Carries the underlying leaf fault (e.g. the
+// inner `asn1/*` decode error) as `.cause`.
+var CtError = defineClass("CtError", { withCause: true });
+
 module.exports = {
   PkiError:         PkiError,
   defineClass:      defineClass,
@@ -199,4 +208,5 @@ module.exports = {
   Pkcs12Error:      Pkcs12Error,
   CmpError:         CmpError,
   PathError:        PathError,
+  CtError:          CtError,
 };

package/lib/oid.js

@@ -116,6 +116,15 @@ var FAMILIES = {
   pkixKp: { base: [1, 3, 6, 1, 5, 5, 7, 3], of: {
     serverAuth: 1, clientAuth: 2, codeSigning: 3, emailProtection: 4, timeStamping: 8, ocspSigning: 9 } },
 
+  // Google Certificate Transparency (RFC 6962) on the 1.3.6.1.4.1.11129.2.4 arc:
+  // the SCT-list X.509 extension (§3.3), the precertificate poison (§3.1), the
+  // precert-signing EKU (§3.1, naming only), and the OCSP-delivered SCT list
+  // (§3.3). The SCT payload itself is TLS presentation language, not DER — it is
+  // parsed by lib/ct.js (pki.ct), never routed through the DER schema engine.
+  ct: { base: [1, 3, 6, 1, 4, 1, 11129, 2, 4], of: {
+    signedCertificateTimestampList: 2, precertificatePoison: 3,
+    precertificateSigningCert: 4, ocspSignedCertificateTimestampList: 5 } },
+
   // PKCS#1 RSA public-key + RSASSA signature algorithms.
   rsa: { base: [1, 2, 840, 113549, 1, 1], of: {
     rsaEncryption: 1, rsaesOaep: 7, mgf1: 8, rsassaPss: 10,
@@ -208,9 +217,10 @@ var FAMILIES = {
     sha256: 1, sha384: 2, sha512: 3, "sha3-256": 8, "sha3-512": 10, shake256: 12 } },
 
   // NIST signature algorithms — FIPS 204 ML-DSA + FIPS 205 SLH-DSA share the
-  // signature arc 2.16.840.1.101.3.4.3. The 12 Pure SLH-DSA parameter sets are
-  // assigned sequentially (RFC 9909 §3): the SHA-2 sets .20-.25, then the SHAKE
-  // sets .26-.31.
+  // signature arc 2.16.840.1.101.3.4.3. RFC 9909 §3 assigns the 12 Pure SLH-DSA
+  // sets .20-.31 (SHA-2 .20-.25, SHAKE .26-.31) and the 12 pre-hash HashSLH-DSA
+  // sets .35-.46, each pairing a parameter set with its message-digest hash. The
+  // parameters MUST be absent for every one of them (enforced via paramsMustBeAbsent).
   nistSig: { base: [2, 16, 840, 1, 101, 3, 4, 3], of: {
     "id-ml-dsa-44": 17, "id-ml-dsa-65": 18, "id-ml-dsa-87": 19,
     "id-slh-dsa-sha2-128s": 20, "id-slh-dsa-sha2-128f": 21,
@@ -218,7 +228,13 @@ var FAMILIES = {
     "id-slh-dsa-sha2-256s": 24, "id-slh-dsa-sha2-256f": 25,
     "id-slh-dsa-shake-128s": 26, "id-slh-dsa-shake-128f": 27,
     "id-slh-dsa-shake-192s": 28, "id-slh-dsa-shake-192f": 29,
-    "id-slh-dsa-shake-256s": 30, "id-slh-dsa-shake-256f": 31 } },
+    "id-slh-dsa-shake-256s": 30, "id-slh-dsa-shake-256f": 31,
+    "id-hash-slh-dsa-sha2-128s-with-sha256": 35, "id-hash-slh-dsa-sha2-128f-with-sha256": 36,
+    "id-hash-slh-dsa-sha2-192s-with-sha512": 37, "id-hash-slh-dsa-sha2-192f-with-sha512": 38,
+    "id-hash-slh-dsa-sha2-256s-with-sha512": 39, "id-hash-slh-dsa-sha2-256f-with-sha512": 40,
+    "id-hash-slh-dsa-shake-128s-with-shake128": 41, "id-hash-slh-dsa-shake-128f-with-shake128": 42,
+    "id-hash-slh-dsa-shake-192s-with-shake256": 43, "id-hash-slh-dsa-shake-192f-with-shake256": 44,
+    "id-hash-slh-dsa-shake-256s-with-shake256": 45, "id-hash-slh-dsa-shake-256f-with-shake256": 46 } },
 
   // NIST KEM — FIPS 203 ML-KEM (arc 2.16.840.1.101.3.4.4).
   nistKem: { base: [2, 16, 840, 1, 101, 3, 4, 4], of: {
@@ -393,10 +409,58 @@ function fromDER(input) {
   return asn1.read.oid(node);
 }
 
+// Algorithm identifiers whose `parameters` field MUST be absent — no explicit
+// NULL, no bytes. The FIPS 204 ML-DSA and FIPS 205 SLH-DSA signature families
+// and the RFC 8410 Edwards / Montgomery curves each carry this MUST: RFC 9909 §3
+// (SLH-DSA in X.509), RFC 9814 §4 (SLH-DSA in CMS), RFC 9881 §2 (ML-DSA in X.509),
+// RFC 8410 §3 (Ed25519 / Ed448 / X25519 / X448). Built by NAME through the same
+// registry every caller uses, so a typo fails closed at load rather than silently
+// dropping a member. One set drives the single shared AlgorithmIdentifier reject
+// (schema-pkix), so every format consumer inherits the rule with no per-format code.
+var _PARAMS_ABSENT = new Set();
+[
+  "id-ml-dsa-44", "id-ml-dsa-65", "id-ml-dsa-87",
+  "id-slh-dsa-sha2-128s", "id-slh-dsa-sha2-128f", "id-slh-dsa-sha2-192s",
+  "id-slh-dsa-sha2-192f", "id-slh-dsa-sha2-256s", "id-slh-dsa-sha2-256f",
+  "id-slh-dsa-shake-128s", "id-slh-dsa-shake-128f", "id-slh-dsa-shake-192s",
+  "id-slh-dsa-shake-192f", "id-slh-dsa-shake-256s", "id-slh-dsa-shake-256f",
+  // Pre-hash HashSLH-DSA sets (RFC 9909 §3) — parameters MUST be absent too.
+  "id-hash-slh-dsa-sha2-128s-with-sha256", "id-hash-slh-dsa-sha2-128f-with-sha256",
+  "id-hash-slh-dsa-sha2-192s-with-sha512", "id-hash-slh-dsa-sha2-192f-with-sha512",
+  "id-hash-slh-dsa-sha2-256s-with-sha512", "id-hash-slh-dsa-sha2-256f-with-sha512",
+  "id-hash-slh-dsa-shake-128s-with-shake128", "id-hash-slh-dsa-shake-128f-with-shake128",
+  "id-hash-slh-dsa-shake-192s-with-shake256", "id-hash-slh-dsa-shake-192f-with-shake256",
+  "id-hash-slh-dsa-shake-256s-with-shake256", "id-hash-slh-dsa-shake-256f-with-shake256",
+  "Ed25519", "Ed448", "X25519", "X448",
+].forEach(function (nm) { _PARAMS_ABSENT.add(byName(nm)); });
+
+/**
+ * @primitive  pki.oid.paramsMustBeAbsent
+ * @signature  pki.oid.paramsMustBeAbsent(dotted) -> boolean
+ * @since      0.1.21
+ * @status     experimental
+ * @spec       RFC 9909, RFC 9814, RFC 9881, RFC 8410
+ * @related    pki.oid.name, pki.oid.byName
+ *
+ * True when an AlgorithmIdentifier bearing this OID MUST encode its `parameters`
+ * field as ABSENT (not an explicit NULL, not any bytes): the FIPS 204 ML-DSA and
+ * FIPS 205 SLH-DSA signature families and the RFC 8410 Edwards / Montgomery
+ * curves. The shared AlgorithmIdentifier decoder consults this and fails closed
+ * on a present-parameters violation, so every format inherits the rule.
+ *
+ * @example
+ *   pki.oid.paramsMustBeAbsent(pki.oid.byName("id-slh-dsa-sha2-128s")); // -> true
+ *   pki.oid.paramsMustBeAbsent(pki.oid.byName("rsaEncryption"));        // -> false
+ */
+function paramsMustBeAbsent(dotted) {
+  return _PARAMS_ABSENT.has(dotted);
+}
+
 module.exports = {
   name:           name,
   byName:         byName,
   has:            has,
+  paramsMustBeAbsent: paramsMustBeAbsent,
   register:       register,
   registerFamily: registerFamily,
   all:            all,

package/lib/path-validate.js

@@ -86,9 +86,16 @@ var SIG_ALGS = {};
 // NULL must be present — RSASSA-PKCS1-v1_5, RFC 4055 §5) or "absent" (parameters
 // must be omitted — ECDSA/EdDSA/ML-DSA, RFC 5758/8410). A cert deviating from
 // its algorithm's required shape is malformed and rejected before verify.
-function _sig(name, verify, imp, params, ecdsa) {
+// `sameKeyOid` marks the one-shot families whose PUBLIC-KEY algorithm OID is the
+// SAME as the signature algorithm OID — EdDSA, ML-DSA, SLH-DSA. For these, Node's
+// WebCrypto imports an SPKI of ANOTHER type under the requested name and verifies
+// with the real key (it does NOT reject a mismatched SPKI the way it does for
+// RSA/ECDSA), so the issuer-key <-> signature-algorithm consistency (RFC 9814 §4)
+// must be checked structurally: the SPKI OID must equal the signature OID.
+function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   var entry = { verify: verify, imp: imp, params: params };
   if (ecdsa) entry.ecdsa = true;
+  if (sameKeyOid) entry.sameKeyOid = true;
   SIG_ALGS[oid.byName(name)] = entry;
 }
 // RSASSA-PKCS1-v1_5 — parameters MUST be NULL.
@@ -99,13 +106,22 @@ _sig("sha512WithRSAEncryption", { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" },
 _sig("ecdsaWithSHA256", { name: "ECDSA", hash: "SHA-256" }, { name: "ECDSA" }, "absent", true);
 _sig("ecdsaWithSHA384", { name: "ECDSA", hash: "SHA-384" }, { name: "ECDSA" }, "absent", true);
 _sig("ecdsaWithSHA512", { name: "ECDSA", hash: "SHA-512" }, { name: "ECDSA" }, "absent", true);
-// EdDSA (one-shot, no hash parameter) — params absent.
-_sig("Ed25519", { name: "Ed25519" }, { name: "Ed25519" }, "absent");
-_sig("Ed448", { name: "Ed448" }, { name: "Ed448" }, "absent");
-// ML-DSA (FIPS 204) — params absent.
-_sig("id-ml-dsa-44", { name: "ML-DSA-44" }, { name: "ML-DSA-44" }, "absent");
-_sig("id-ml-dsa-65", { name: "ML-DSA-65" }, { name: "ML-DSA-65" }, "absent");
-_sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent");
+// EdDSA (one-shot, no hash parameter) — params absent; key OID == sig OID.
+_sig("Ed25519", { name: "Ed25519" }, { name: "Ed25519" }, "absent", false, true);
+_sig("Ed448", { name: "Ed448" }, { name: "Ed448" }, "absent", false, true);
+// ML-DSA (FIPS 204) — params absent; key OID == sig OID.
+_sig("id-ml-dsa-44", { name: "ML-DSA-44" }, { name: "ML-DSA-44" }, "absent", false, true);
+_sig("id-ml-dsa-65", { name: "ML-DSA-65" }, { name: "ML-DSA-65" }, "absent", false, true);
+_sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", false, true);
+// SLH-DSA (FIPS 205) — params absent; key OID == sig OID. The twelve pure sets;
+// the RFC 9909 §3 OID name maps to the WebCrypto set name by id-slh-dsa-<set> ->
+// SLH-DSA-<SET> (the webcrypto SLH_DSA_NODE keys). One-shot verify like ML-DSA.
+["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+ "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+].forEach(function (set) {
+  var wc = "SLH-DSA-" + set.toUpperCase();
+  _sig("id-slh-dsa-" + set, { name: wc }, { name: wc }, "absent", false, true);
+});
 
 // RSASSA-PSS resolves its hash + salt from the AlgorithmIdentifier parameters.
 var OID_RSA_PSS = oid.byName("rsassaPss");
@@ -238,6 +254,24 @@ function resolveDescriptor(sigAlg) {
   return d;
 }
 
+// RFC 9814 §4 issuer-key <-> signature-algorithm consistency (algorithm-confusion
+// defense). For the one-shot families whose public key shares the signature OID
+// (EdDSA, ML-DSA, SLH-DSA), Node's WebCrypto imports an SPKI of a DIFFERENT type
+// under the requested name and verifies with the real key — so an Ed25519-signed
+// certificate labelled SLH-DSA would otherwise validate. Enforce structurally:
+// the issuer SPKI's algorithm OID MUST equal the signature algorithm OID. (For
+// RSA/ECDSA — different key vs signature OIDs — WebCrypto's import already rejects
+// a mismatched key type, so `sameKeyOid` is not set and this is a no-op.)
+function assertKeyMatchesSigAlg(spkiBytes, sigOid, d) {
+  if (!d || !d.sameKeyOid) return;
+  var keyOid;
+  try { keyOid = asn1.read.oid(asn1.decode(spkiBytes).children[0].children[0]); }
+  catch (e) { throw E("path/algorithm-mismatch", "cannot read the issuer public-key algorithm identifier", e); }
+  if (keyOid !== sigOid) {
+    throw E("path/algorithm-mismatch", "issuer public-key algorithm " + keyOid + " does not match the signature algorithm " + sigOid + " (RFC 9814 §4 - algorithm confusion)");
+  }
+}
+
 // DER Ecdsa-Sig-Value SEQUENCE { r, s } -> fixed-width r||s (P1363), rejecting
 // r or s outside [1, n-1] (CVE-2022-21449 "Psychic Signatures").
 function ecdsaDerToP1363(der, curve) {
@@ -270,8 +304,10 @@ function ecdsaDerToP1363(der, curve) {
 // Verify cert.signatureValue over cert.tbsBytes with the working public key.
 function builtinVerify(state, cert) {
   var d;
-  try { d = resolveDescriptor(cert.signatureAlgorithm); }
-  catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e }); }
+  try {
+    d = resolveDescriptor(cert.signatureAlgorithm);
+    assertKeyMatchesSigAlg(state.workingPublicKey, cert.signatureAlgorithm.oid, d);
+  } catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e }); }
   // The signature is an octet-aligned BIT STRING (no unused bits) for every
   // supported algorithm; a non-zero unused-bit count is malformed.
   if (cert.signatureValue.unusedBits !== 0) return Promise.resolve({ ok: false, code: "path/bad-signature" });
@@ -1387,8 +1423,10 @@ function crlEntryReason(entry) {
 
 function verifyCrlSignature(theCrl, issuer) {
   var d;
-  try { d = resolveDescriptor(theCrl.signatureAlgorithm); }
-  catch (_e) { return Promise.resolve(false); }
+  try {
+    d = resolveDescriptor(theCrl.signatureAlgorithm);
+    assertKeyMatchesSigAlg(issuer.workingPublicKey, theCrl.signatureAlgorithm.oid, d);
+  } catch (_e) { return Promise.resolve(false); }
   if (theCrl.signatureValue.unusedBits !== 0) return Promise.resolve(false);   // non-octet-aligned signature
   var key;
   return subtle.importKey("spki", issuer.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {

package/lib/schema-pkix.js

@@ -16,6 +16,10 @@
 var asn1 = require("./asn1-der");
 var constants = require("./constants");
 var schema = require("./schema-engine");
+// ct is a leaf format module (requires only the codec / oid / constants / error
+// core, never pkix) so the SCT-list extension VALUE decoder registers here as a
+// registry row, not a switch. The one-directional edge keeps the layering acyclic.
+var ct = require("./ct");
 
 var PEM_RE = /-----BEGIN ([A-Z0-9 ]+)-----([\s\S]*?)-----END \1-----/;
 
@@ -152,6 +156,15 @@ function algorithmIdentifier(ns, opts) {
     arity: { min: 1 }, code: ns.prefix + "/bad-algorithm-identifier", what: "AlgorithmIdentifier",
     build: function (m, ctx) {
       var dotted = m.fields.algorithm.value;
+      // RFC 9909 §3 / RFC 9814 §4 / RFC 9881 §2 / RFC 8410 §3: for the PQC
+      // signature families (ML-DSA, SLH-DSA) and the Edwards/Montgomery curves,
+      // the `parameters` field MUST be absent — no explicit NULL, no bytes.
+      // Enforced ONCE here so every consumer of the shared AlgorithmIdentifier
+      // inherits the rule; the guard-parity bug class is structurally impossible.
+      if (m.fields.parameters.present && ctx.oid.paramsMustBeAbsent(dotted)) {
+        throw ctx.E(ctx.prefix + "/bad-algorithm-parameters",
+          "the " + (ctx.oid.name(dotted) || dotted) + " AlgorithmIdentifier parameters field MUST be absent (RFC 9909 §3 / RFC 9814 §4 / RFC 9881 §2 / RFC 8410 §3)");
+      }
       return { oid: dotted, name: ctx.oid.name(dotted) || null, parameters: m.fields.parameters.present ? m.fields.parameters.node.bytes : null };
     },
   });
@@ -603,6 +616,29 @@ function certExtensionDecoders(ns) {
     catch (e) { throw ns.E(C, "SubjectKeyIdentifier must be an OCTET STRING (RFC 5280 §4.2.1.2)", e); }
   }
 
+  // signedCertificateTimestampList (RFC 6962 §3.3) — the extension value is a DER
+  // OCTET STRING wrapping the TLS-encoded SCT list. Delegated to the CT module,
+  // which owns the inner peel + the bounded TLS decode; structure is decoded, the
+  // signature stays raw and unverified. The registry contract is that a decoder
+  // throws a `<prefix>/bad-*` code, so the CT module's own `ct/*` fault is wrapped
+  // and carried as `.cause` rather than leaking a foreign namespace here.
+  function sctList(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    try { return ct.parseSctList(buf); }
+    catch (e) { throw ns.E(C, "malformed signedCertificateTimestampList extension value (RFC 6962 §3.3)", e); }
+  }
+
+  // precertificatePoison (RFC 6962 §3.1) — a critical extension whose value is
+  // exactly ASN.1 NULL (05 00), the marker distinguishing a precertificate from
+  // a final certificate. Content-validated, not merely tag-checked.
+  function precertPoison(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "PrecertificatePoison");
+    try { asn1.read.nullValue(n); }
+    catch (e) { throw ns.E(C, "the precertificate poison extension value must be ASN.1 NULL (RFC 6962 §3.1)", e); }
+    return { poison: true };
+  }
+
   function O(nm) { return ns.oid.byName(nm); }
   var byOid = {};
   byOid[O("basicConstraints")] = basicConstraints;
@@ -617,6 +653,8 @@ function certExtensionDecoders(ns) {
   byOid[O("extKeyUsage")] = extKeyUsage;
   byOid[O("authorityKeyIdentifier")] = authorityKeyIdentifier;
   byOid[O("subjectKeyIdentifier")] = subjectKeyIdentifier;
+  byOid[O("signedCertificateTimestampList")] = sctList;
+  byOid[O("precertificatePoison")] = precertPoison;
   return { byOid: byOid };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c8d0b092-58fa-4019-9da1-b2b636e61608",
+  "serialNumber": "urn:uuid:bcaea9d8-cd0d-4a9f-8ac3-72b3efecc8be",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-09T11:21:47.988Z",
+    "timestamp": "2026-07-09T15:12:46.820Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.19",
+      "bom-ref": "@blamejs/pki@0.1.21",
       "type": "application",
       "name": "pki",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.19",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.19",
+      "ref": "@blamejs/pki@0.1.21",
       "dependsOn": []
     }
   ]