@blamejs/pki 0.2.27 → 0.2.28

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.28 — 2026-07-16
+
+The Certificate Transparency log-list trust surface arrives as pki.ct.parseLogList and pki.ct.verifySctWithLogList: resolve a trusted CT log's key from an SCT's log id and verify it in one step, ingesting the CT log-list JSON into state- and temporal-interval-constrained trusted logs.
+
+### Added
+
+- pki.ct.parseLogList(json, opts) ingests a Certificate Transparency log-list JSON document into { logs, byLogId } -- constraint-carrying trusted logs keyed by log id. Each log's key is base64-decoded to its DER SubjectPublicKeyInfo and validated as on-profile; the log id is recomputed as SHA-256 of the key and must equal the stated log_id (RFC 6962 section 3.2, ct/log-id-mismatch), so a swapped key or a flipped id is refused. The state (exactly one of pending/qualified/usable/readonly/retired/rejected) and temporal_interval decode into trust constraints, and two entries for one recomputed id must agree or the list is rejected (ct/duplicate-log). Parsing is offline and routes through the bounded, duplicate-member-rejecting JSON reader; every malformed input is a typed CtError.
+- pki.ct.verifySctWithLogList(entry, sct, logList, opts) resolves the trusted CT log for an SCT by its log id and verifies it in one step. The log's state gates trust (usable/qualified/readonly proceed; a retired log only for an SCT timestamped before its retirement; pending/rejected are ct/log-untrusted) and its temporal_interval gates the covered certificate (the cert's notAfter -- from the leaf certificate for a precert-free entry, or opts.certNotAfter -- must fall in the log's window, and a windowed log with no resolvable notAfter is ct/temporal-interval, never silently skipped). The signature check is delegated to the shipped pki.ct.verifySct. Resolves true for a valid signature from a trusted, in-window log, false on a cryptographic mismatch, and throws a typed CtError on any structural or trust failure.
+
 ## v0.2.27 — 2026-07-16
 
 CMS CompressedData arrives as pki.cms.compress / pki.cms.decompress, with the matching S/MIME pki.smime.compress / pki.smime.decompress: compress and recover RFC 3274 messages, with a bounded inflate that defends the decompression-bomb class.

package/README.md

@@ -225,7 +225,7 @@ is callable today; nothing below is a stub.
 | `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | RFC 6960 Online Certificate Status Protocol — the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs (CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile, or SHA-2; optional RFC 9654 nonce, optional requestor signature). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER — the issuing CA directly or a delegated responder, any `pki.cms.sign` key including the post-quantum ML-DSA / SLH-DSA sets, with `good` / `revoked` (reason + time) / `unknown` per-certificate status, and `buildErrorResponse(status)` the unsigned §2.3 error (`tryLater` / `unauthorized` / …). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA or a CA-issued delegate bearing id-kp-OCSPSigning **and** id-pkix-ocsp-nocheck, passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency (`thisUpdate`/`nextUpdate`), and the request-nonce echo — returning `{ status: "good" / "revoked" / "unknown", … }`, never a silent accept. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify` |
-| `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. The producing side: `encodeSctList` builds the extension value byte-for-byte (the exact inverse of `parseSctList`) and `signSct` performs a log's signing step (rebuilding the same signed-data preimage the verifier hashes and signing it with the log's ECDSA-P-256 / RSA key). Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct` |
+| `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. The producing side: `encodeSctList` builds the extension value byte-for-byte (the exact inverse of `parseSctList`) and `signSct` performs a log's signing step (rebuilding the same signed-data preimage the verifier hashes and signing it with the log's ECDSA-P-256 / RSA key). The trust surface: `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs — recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2), decoding the state + temporal-interval constraints — and `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable/qualified/readonly trusted; retired only before retirement; pending/rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla / CCADB trust-store ingestion — `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export into one identical constraint-carrying anchor shape: the per-purpose trust bits (only `CKT_NSS_TRUSTED_DELEGATOR` grants) and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer + serial (never adjacency) and are cross-checked against the parsed DER, so metadata can never attach to the wrong root; `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
 | `pki.shbs` | Stateful hash-based signature **verification** — HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and CMS by RFC 9708, profiled by NIST SP 800-208 (CNSA 2.0 firmware signing). `verify` checks an HSS signature (every level must pass) and `verifyLms` a single-tree LMS, over the raw public-key / signature blobs the parsers already surface. Pure public-input SHA-256 / SHAKE256 hashing, a data-driven typecode registry, bounds-before-slice reads; a malformed blob throws a typed `ShbsError`, a well-formed-but-wrong signature returns `false`. **Verify only by design** — stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |

package/lib/acme.js

@@ -41,6 +41,7 @@ var x509 = require("./schema-x509");
 var csr = require("./schema-csr");
 var pkix = require("./schema-pkix");
 var constants = require("./constants");
+var rfc3339 = require("./rfc3339");
 var subtle = require("./webcrypto").webcrypto.subtle;
 var frameworkError = require("./framework-error");
 
@@ -51,27 +52,10 @@ function E(code, message, cause) { return new AcmeError(code, message, cause); }
 
 function _isObject(v) { return v && typeof v === "object" && !Array.isArray(v); }
 function _isString(v) { return typeof v === "string"; }
-// RFC 3339 date-time (date "T" time with a zone). Beyond the grammar this checks
-// CALENDAR validity -- a syntactically well-formed but impossible instant (month 13,
-// February 30, hour 25, a +25:00 offset) is rejected, so a downstream expiry / window
-// comparison never runs on a value JS Date would silently roll over.
-var RFC3339_RE = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:[Zz]|([+-])(\d{2}):(\d{2}))$/;
-function _isRfc3339(v) {
-  if (!_isString(v)) return false;
-  var m = RFC3339_RE.exec(v);
-  if (!m) return false;
-  var year = +m[1], month = +m[2], day = +m[3], hour = +m[4], min = +m[5], sec = +m[6];
-  if (month < 1 || month > 12) return false;
-  // Reject a :60 leap second: Node's Date.parse returns NaN for it, so an expiry /
-  // renewal-window comparison on such a value would silently pass (NaN <= x is
-  // false). This toolkit only handles instants it can compare, so it fails closed.
-  if (hour > 23 || min > 59 || sec > 59) return false;
-  var leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
-  var daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  if (day < 1 || day > daysInMonth[month - 1]) return false;
-  if (m[7]) { if (+m[8] > 23 || +m[9] > 59) return false; }   // numeric zone offset
-  return true;
-}
+// RFC 3339 date-time validity (grammar + calendar) lives in the shared lib/rfc3339.js primitive so a
+// downstream expiry / renewal-window comparison never runs on an impossible instant (month 13, a :60
+// leap second, a rolled-over value). pki.ct's log-list window parse composes the same primitive.
+function _isRfc3339(v) { return rfc3339.isValid(v); }
 // A URL string: an absolute http(s) URI with a real host (RFC 3986). ACME URLs are
 // server-provided endpoints downstream transport will trust, so they are PARSED
 // (not prefix-matched) -- a malformed value like "https://[" or a hostless

package/lib/constants.js

@@ -227,6 +227,9 @@ var LIMITS = {
   // enforced BEFORE parsing so a hostile document is refused up front.
   JSON_MAX_BYTES: BYTES.mib(1),
   JSON_MAX_DEPTH: 32,
+  // The CT log-list JSON ceiling -- the full "all logs" variant (with historical logs) exceeds the
+  // 1 MiB JSON_MAX_BYTES used for small ACME resource objects; 4 MiB gives headroom while staying bounded.
+  CT_LOG_LIST_MAX_BYTES: BYTES.mib(4),
   // PBKDF2 iteration ceiling on the DECRYPT side (RFC 8018 pwri / PBES2). An attacker-supplied
   // iterationCount is attacker-controlled work; a message above this is refused before any
   // derivation (typed cms/iteration-limit), and a caller may cap it lower via opts.maxIterations.

package/lib/ct.js

@@ -48,6 +48,7 @@ var ByteWriter = require("./byte-writer.js");
 var oid = require("./oid.js");
 var webcrypto = require("./webcrypto.js");
 var validator = require("./validator-all.js");
+var rfc3339 = require("./rfc3339.js");
 var subtle = webcrypto.webcrypto.subtle;
 
 var CtError = frameworkError.CtError;
@@ -592,12 +593,208 @@ async function signSct(entry, logKey, opts) {
   };
 }
 
+// ---- CT log-list trust surface (RFC 6962 sec. 3.2 + the CT log-list v3 JSON schema) --------------
+
+// The recognized CT log states (the schema `state` oneOf) mapped to a trust decision (the deployed
+// Chrome/Apple CT policy): usable/qualified/readonly are trusted; retired is CONDITIONALLY trusted
+// (only for an SCT timestamped before the retirement instant, checked at verify); pending/rejected
+// are not trusted.
+var LOG_STATE_TRUST = { pending: "no", qualified: "yes", usable: "yes", readonly: "yes", retired: "conditional", rejected: "no" };
+
+// Decode a log's `state` oneOf: EXACTLY ONE recognized member, whose timestamp is an RFC 3339 instant.
+// Zero, multiple, or an unrecognized member -> ct/bad-state (fail-closed, never a silent default-trust).
+function _parseLogState(state) {
+  if (state == null || typeof state !== "object") throw _ctErr("ct/bad-state", "a CT log entry is missing its state");
+  var keys = Object.keys(state);
+  if (keys.length !== 1 || !Object.prototype.hasOwnProperty.call(LOG_STATE_TRUST, keys[0])) {
+    throw _ctErr("ct/bad-state", "a CT log state must carry exactly one recognized member (pending/qualified/usable/readonly/retired/rejected)");
+  }
+  var name = keys[0], member = state[name];
+  if (member == null || typeof member !== "object") throw _ctErr("ct/bad-state", "the CT log state " + name + " is malformed");
+  var since = rfc3339.parse(member.timestamp, _ctErr, "ct/bad-date", "the CT log state timestamp");
+  var trust = LOG_STATE_TRUST[name];
+  return { name: name, since: since, trusted: trust === "yes", conditional: trust === "conditional" };
+}
+
+// Decode a log's `temporal_interval` (both bounds RFC 3339, start strictly before end) or null.
+function _parseTemporalInterval(ti) {
+  if (ti == null) return null;
+  if (typeof ti !== "object") throw _ctErr("ct/bad-log-list", "a CT log temporal_interval must be an object");
+  var start = rfc3339.parse(ti.start_inclusive, _ctErr, "ct/bad-date", "temporal_interval.start_inclusive");
+  var end = rfc3339.parse(ti.end_exclusive, _ctErr, "ct/bad-date", "temporal_interval.end_exclusive");
+  if (start.getTime() >= end.getTime()) throw _ctErr("ct/bad-log-list", "a CT log temporal_interval start_inclusive must be strictly before end_exclusive");
+  return { startInclusive: start, endExclusive: end };
+}
+
+// One log-list entry -> a constraint-carrying trusted-log record. The load-bearing M-BIND step: the
+// log-id is RECOMPUTED as SHA-256(SPKI) and MUST equal the stated log_id (RFC 6962 sec. 3.2), so the
+// trusted set is keyed by the authoritative binding, never the document's self-assertion -- a swapped
+// key or a flipped id is refused. The key is also validated as a well-formed, on-profile SPKI at ingest.
+function _parseLog(log, operatorName) {
+  if (log == null || typeof log !== "object") throw _ctErr("ct/bad-log-list", "a CT log entry is not an object");
+  if (typeof log.key !== "string" || typeof log.log_id !== "string") throw _ctErr("ct/bad-log-list", "a CT log entry is missing its key or log_id");
+  var spki = guard.encoding.base64(log.key, C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, "ct/bad-log-list", "the CT log key");
+  var statedId = guard.encoding.base64(log.log_id, 64, _ctErr, "ct/bad-log-list", "the CT log id");
+  if (statedId.length !== 32) throw _ctErr("ct/bad-log-list", "a CT log_id must be 32 bytes (SHA-256), got " + statedId.length);
+  _spkiAlg(spki);   // fail-fast: a non-SPKI / malformed key (or a forgeable RSA e < 3) throws ct/bad-input; the full EC-curve / RSA-size profile is enforced by verifySct at verify time
+  var logId = nodeCrypto.createHash("sha256").update(spki).digest();
+  if (!logId.equals(statedId)) throw _ctErr("ct/log-id-mismatch", "the CT log_id does not match SHA-256 of the log key (RFC 6962 sec. 3.2)");
+  return {
+    logId: logId, logIdHex: logId.toString("hex"), key: spki,
+    description: typeof log.description === "string" ? log.description : null,
+    url: typeof log.url === "string" ? log.url : (typeof log.submission_url === "string" ? log.submission_url : null),
+    mmd: typeof log.mmd === "number" ? log.mmd : null,
+    operator: operatorName, state: _parseLogState(log.state), temporalInterval: _parseTemporalInterval(log.temporal_interval),
+    trusted: false,   // set below from the state (usable/qualified/readonly), so a consumer reads a plain bool
+  };
+}
+
+// Two entries for one recomputed log-id must be byte-identical (collapse) or the list is inconsistent.
+function _sameTemporal(a, b) {
+  if (a == null && b == null) return true;
+  // Coverage residual: the || guard is exercised across null/interval, interval/null, and both-interval
+  // inputs; the remaining c8 sub-arm is a short-circuit path (when `a == null` is true, `b == null` is
+  // never evaluated) with no additional reachable input.
+  if (a == null || b == null) return false;
+  return a.startInclusive.getTime() === b.startInclusive.getTime() && a.endExclusive.getTime() === b.endExclusive.getTime();
+}
+function _logsAgree(a, b) {
+  return a.state.name === b.state.name && a.state.since.getTime() === b.state.since.getTime() && _sameTemporal(a.temporalInterval, b.temporalInterval);
+}
+
+/**
+ * @primitive  pki.ct.parseLogList
+ * @signature  pki.ct.parseLogList(json, opts?) -> { logs, byLogId }
+ * @since      0.2.28
+ * @status     experimental
+ * @spec       RFC 6962
+ * @related    pki.ct.verifySctWithLogList, pki.ct.verifySct
+ *
+ * Ingest a Certificate Transparency log-list JSON document (the `log_list.json` browsers consume) into a
+ * set of constraint-carrying trusted logs, keyed by log-id. `json` is a Buffer or string -- the caller
+ * supplies the already-fetched, already-authenticated bytes (offline, no network fetch). Parsing routes
+ * through the bounded, duplicate-member-rejecting JSON reader; for each log it base64-decodes the `key`
+ * to its DER SubjectPublicKeyInfo, validates it as a well-formed on-profile key, **recomputes**
+ * `SHA-256(SPKI)` and fail-closed **requires** it equal the stated `log_id` (RFC 6962 sec. 3.2 -- a log
+ * whose stated id disagrees with its key is refused as `ct/log-id-mismatch`), and decodes the `state`
+ * (exactly one of pending/qualified/usable/readonly/retired/rejected) and `temporal_interval`. Returns
+ * `{ logs, byLogId }` where each log is `{ logId, logIdHex, key, description, url, mmd, operator, state:
+ * { name, since, trusted, conditional }, temporalInterval, trusted }` and `byLogId` is a null-proto
+ * `{ logIdHex: log }` map. Every malformed / oversized / mis-bound input is a typed `CtError`.
+ *
+ * @example
+ *   var logList = pki.ct.parseLogList(logListJsonBytes);
+ *   logList.logs[0].trusted;   // was the first log trusted (usable/qualified/readonly)?
+ */
+function parseLogList(json, opts) {
+  void opts;
+  var doc = guard.json.parse(json, _ctErr, {
+    maxBytes: C.LIMITS.CT_LOG_LIST_MAX_BYTES, maxDepth: C.LIMITS.JSON_MAX_DEPTH,
+    badJson: "ct/bad-json", tooDeep: "ct/too-deep", duplicateMember: "ct/duplicate-member",
+    tooLarge: "ct/too-large", badInput: "ct/bad-input", label: "the CT log list",
+  });
+  if (doc == null || typeof doc !== "object" || !Array.isArray(doc.operators)) throw _ctErr("ct/bad-log-list", "the CT log list must be a JSON object with an operators array");
+  var logs = [], byLogId = Object.create(null);
+  for (var i = 0; i < doc.operators.length; i++) {
+    var op = doc.operators[i];
+    if (op == null || typeof op !== "object" || typeof op.name !== "string") throw _ctErr("ct/bad-log-list", "a CT log-list operator is missing its name");
+    var arrays = [op.logs, op.tiled_logs];
+    for (var a = 0; a < arrays.length; a++) {
+      var arr = arrays[a];
+      if (arr == null) continue;
+      if (!Array.isArray(arr)) throw _ctErr("ct/bad-log-list", "a CT log-list operator's logs / tiled_logs must be an array");
+      for (var j = 0; j < arr.length; j++) {
+        var rec = _parseLog(arr[j], op.name);
+        rec.trusted = rec.state.trusted;   // usable/qualified/readonly; retired stays false (conditional at verify)
+        var prev = byLogId[rec.logIdHex];
+        if (prev) {
+          if (!_logsAgree(prev, rec)) throw _ctErr("ct/duplicate-log", "two CT log entries share log-id " + rec.logIdHex + " but disagree");
+          continue;   // a byte-identical duplicate collapses to the one already recorded
+        }
+        byLogId[rec.logIdHex] = rec;
+        logs.push(rec);
+      }
+    }
+  }
+  return { logs: logs, byLogId: byLogId };
+}
+
+// The covered certificate's notAfter for the temporal gate: an explicit opts.certNotAfter, else derived
+// from a leafCert (entryType 0) via the shipped x509 parser, else null (a precert TBS can't be parsed).
+function _resolveNotAfter(entry, opts) {
+  if (opts.certNotAfter instanceof Date) return opts.certNotAfter;
+  if (entry && entry.entryType === 0 && entry.leafCert != null) {
+    // Inline require (circular-load): ct.js is loaded before schema-x509 finishes initializing in the
+    // index chain (schema-x509 -> schema-pkix is mid-init when ct.js is first required), so a top-level
+    // require would see a half-built pkix. Deferred to first use, when every module is initialized.
+    var x509 = require("./schema-x509.js");   // allow:inline-require -- circular load with schema-x509 -> schema-pkix (see note above)
+    try {
+      return x509.parse(_toBuffer(entry.leafCert, "entry.leafCert")).validity.notAfter;
+    } catch (_e) {
+      return null;   // a malformed leafCert -> no resolvable notAfter -> fail-closed ct/temporal-interval at the caller
+    }
+  }
+  return null;
+}
+
+/**
+ * @primitive  pki.ct.verifySctWithLogList
+ * @signature  pki.ct.verifySctWithLogList(entry, sct, logList, opts?) -> Promise<boolean>
+ * @since      0.2.28
+ * @status     experimental
+ * @spec       RFC 6962
+ * @related    pki.ct.parseLogList, pki.ct.verifySct
+ *
+ * Resolve the trusted CT log for an SCT and verify it in one step. `logList` is a `parseLogList` result;
+ * the log is resolved by `sct.logIdHex` (an unknown log is `ct/log-not-found`). The log's **state** gates
+ * trust (usable/qualified/readonly proceed; a retired log proceeds only for an SCT timestamped before its
+ * retirement instant; pending/rejected are `ct/log-untrusted`); its **temporal_interval** gates the
+ * covered certificate (the cert's `notAfter` -- from `entry.leafCert` when `entryType` is 0, or
+ * `opts.certNotAfter` -- must fall in `[start_inclusive, end_exclusive)`, and a windowed log with no
+ * resolvable notAfter is `ct/temporal-interval`, never silently skipped). Then the crypto is delegated to
+ * the shipped `verifySct(entry, sct, log.key)` (which independently re-checks `logId == SHA-256(key)`).
+ * Resolves `true` for a valid signature from a trusted, in-window log; `false` on a cryptographic
+ * mismatch (a verdict); throws a typed `CtError` on any structural / trust failure.
+ *
+ * @opts certNotAfter A `Date` -- the covered certificate's notAfter for the temporal-interval gate (required for a precert entry).
+ * @example
+ *   var ok = await pki.ct.verifySctWithLogList(sctEntry, embeddedSct, logList);
+ */
+async function verifySctWithLogList(entry, sct, logList, opts) {
+  opts = opts || {};
+  if (logList == null || typeof logList !== "object" || logList.byLogId == null) throw _ctErr("ct/bad-input", "logList must be a pki.ct.parseLogList result");
+  if (sct == null || typeof sct !== "object" || typeof sct.logIdHex !== "string") throw _ctErr("ct/bad-input", "the SCT is missing its logIdHex");
+  var log = logList.byLogId[sct.logIdHex];
+  if (log == null) throw _ctErr("ct/log-not-found", "no trusted CT log matches the SCT's logId " + sct.logIdHex);
+  // State gate (fail-closed): trusted proceed; retired only before its retirement; else untrusted.
+  if (!log.state.trusted) {
+    if (!log.state.conditional) throw _ctErr("ct/log-untrusted", "the CT log state '" + log.state.name + "' is not trusted");
+    var ts = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp");
+    if (ts >= BigInt(log.state.since.getTime())) throw _ctErr("ct/log-untrusted", "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")");
+  }
+  // Temporal gate (fail-closed): the covered cert's notAfter must be in [start_inclusive, end_exclusive).
+  if (log.temporalInterval) {
+    var notAfter = _resolveNotAfter(entry, opts);
+    // An Invalid Date (getTime() === NaN) is still `instanceof Date`, and NaN < x / NaN >= x are both
+    // false, so it would silently BYPASS the window containment -- reject it fail-closed, exactly like
+    // the codec's readTime rejects a NaN instant (a caller may pass a lenient `new Date(badString)`).
+    if (!(notAfter instanceof Date) || isNaN(notAfter.getTime())) throw _ctErr("ct/temporal-interval", "the CT log has a temporal_interval but the covered certificate's notAfter is not available or not a valid date (pass a valid opts.certNotAfter)");
+    var t = notAfter.getTime();
+    if (t < log.temporalInterval.startInclusive.getTime() || t >= log.temporalInterval.endExclusive.getTime()) {
+      throw _ctErr("ct/temporal-interval", "the covered certificate's notAfter is outside the CT log's temporal_interval");
+    }
+  }
+  return verifySct(entry, sct, log.key);   // the shipped crypto verdict (re-checks the logId binding)
+}
+
 module.exports = {
   parseSctList: parseSctList,
   reconstructSignedData: reconstructSignedData,
   verifySct: verifySct,
   encodeSctList: encodeSctList,
   signSct: signSct,
+  parseLogList: parseLogList,
+  verifySctWithLogList: verifySctWithLogList,
   HASH_ALGORITHMS: HASH_ALGORITHMS,
   SIGNATURE_ALGORITHMS: SIGNATURE_ALGORITHMS,
 };

package/lib/rfc3339.js

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @internal
+ * lib/rfc3339.js -- RFC 3339 date-time parsing + validation, a fail-closed engine primitive shared by
+ * pki.acme (a boolean field-validator over server-supplied JSON) and pki.ct (parse a CT log-list
+ * timestamp / temporal-interval bound to a comparable Date). Beyond the grammar it enforces CALENDAR
+ * validity -- a syntactically well-formed but impossible instant (month 13, February 30, hour 25, a
+ * :60 leap second, a +25:00 offset) is rejected, so a downstream expiry / window comparison never runs
+ * on a value JS `Date` would silently roll over or `Date.parse` would NaN. Like the byte-reader / guard
+ * family, `parse` takes the caller's `(code, message) -> error` factory so every consumer keeps its own
+ * domain fault code.
+ */
+
+// date "T" time with a zone (Z or a numeric offset); an optional fractional second.
+var RFC3339_RE = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:[Zz]|([+-])(\d{2}):(\d{2}))$/;
+
+// isValid(v) -> boolean: v is a syntactically well-formed AND calendar-valid RFC 3339 date-time string.
+function isValid(v) {
+  if (typeof v !== "string") return false;
+  var m = RFC3339_RE.exec(v);
+  if (!m) return false;
+  var year = +m[1], month = +m[2], day = +m[3], hour = +m[4], min = +m[5], sec = +m[6];
+  if (month < 1 || month > 12) return false;
+  // Reject a :60 leap second (Node's Date.parse returns NaN for it, so a comparison on such a value
+  // would silently pass) and any hour/minute/second out of range.
+  if (hour > 23 || min > 59 || sec > 59) return false;
+  var leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+  var daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  if (day < 1 || day > daysInMonth[month - 1]) return false;
+  if (m[7]) { if (+m[8] > 23 || +m[9] > 59) return false; }   // a numeric zone offset must itself be valid
+  return true;
+}
+
+// parse(v, E, code, label) -> Date: a calendar-valid RFC 3339 date-time as a comparable Date; otherwise
+// throws E(code, message) (the caller's (code, message) factory). isValid guarantees `new Date(v)` is a
+// real instant (never NaN), so a returned Date is always safe to compare.
+function parse(v, E, code, label) {
+  if (!isValid(v)) throw E(code, (label || "the value") + " is not a valid RFC 3339 date-time");
+  return new Date(v);
+}
+
+module.exports = { isValid: isValid, parse: parse };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:0c393bfc-d076-4de6-8aca-b3027ef12b2a",
+  "serialNumber": "urn:uuid:517b8e6e-813e-4f65-9d63-651831e57f82",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T13:18:09.528Z",
+    "timestamp": "2026-07-16T14:06:47.411Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.27",
+      "bom-ref": "@blamejs/pki@0.2.28",
       "type": "application",
       "name": "pki",
-      "version": "0.2.27",
+      "version": "0.2.28",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.27",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.28",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.27",
+      "ref": "@blamejs/pki@0.2.28",
       "dependsOn": []
     }
   ]