@blamejs/pki 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.1 — 2026-08-30
+
+pki.ct verifies all of a certificate's SCTs against a trusted log-list and renders a certificate-level Certificate Transparency verdict, and pki.path.validate gains an optional CT gate.
+
+### Added
+
+- pki.ct.verifySctList(entry, list, logList, opts?) renders a certificate-level Certificate Transparency verdict (RFC 6962 sec. 3.3) over the set of SCTs a certificate carries, rather than one SCT at a time. It verifies each SCT against the trusted log-list through the same signature check pki.ct.verifySct applies, and reports how many distinct trusted logs verified an SCT (validScts, so a duplicated SCT cannot inflate the count), from how many distinct trusted log operators (operatorCount and operators), and whether that meets the CT policy. The policy is minScts and minOperators, both defaulting to the RFC floor of one valid SCT; the distinct-operator requirement is a browser CT policy layered on top of the RFC, so the caller sets the threshold and the verdict surfaces the counts. A policy shortfall is a verdict (policyOk: false), not an error, and a per-SCT trust or signature failure is recorded in its result row rather than sinking the verdict; only a mis-shaped entry, list, logList, or opts throws a typed CtError.
+- pki.ct.x509CertEntry(cert, issuer) reconstructs the precertificate log entry from a final certificate that carries embedded SCTs (RFC 6962 sec. 3.2), the piece the embedded-SCT verification path needs end to end. It removes the signedCertificateTimestampList extension from the certificate's TBSCertificate by byte surgery, leaving every other byte of the CA-signed structure intact, and computes issuerKeyHash as SHA-256 of the issuer's SubjectPublicKeyInfo. The returned entry feeds pki.ct.verifySctList or pki.ct.reconstructSignedData directly.
+- pki.path.validate accepts an optional Certificate Transparency gate: pass ctLogList (a pki.ct.parseLogList result) and ctPolicy ({ minScts, minOperators }) to verify the target certificate's embedded SCTs against the trusted log-list as part of path validation. The verdict carries a ct check on the target certificate's checks; a target that declares a CT policy but carries no SCT-list extension fails closed, and an SCT dated after the validation time (opts.time) is rejected rather than counted (RFC 6962 sec. 5.2, a client rejects a future-dated SCT). Callers that pass neither option are unaffected.
+
 ## v0.6.0 — 2026-08-30
 
 The toolkit's public APIs graduate to stable, and pki.ocsp.verifyRequest verifies a signed OCSP request for responder implementers.

package/README.md

@@ -242,7 +242,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.smime` | S/MIME message assembly, verification, encryption, and compression over the CMS layer (RFC 8551). `sign(content, signers, opts)` wraps a MIME entity in either form: `multipart/signed`, where the content stays readable in any MUA and a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`, or `application/pkcs7-mime; smime-type=signed-data`, where the whole entity is a base64 CMS SignedData. The signed bytes are the entity's §3.1.1 canonical form with CRLF line endings, and `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies while a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one, as `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat). The `smime-type` is derived from the CMS body rather than the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt`, so it is algorithm-agnostic: any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through. As with `cms.verify`, `verify` returns the per-signer verdict plus the recovered content, and `valid` and `trusted` are separate claims: `valid` says the signature is sound under a certificate the message carried, `trusted` says every signer chained to a root named in `opts.trustAnchors`. Anchoring here is validated for email at both ends of the chain — the signer certificate must carry `emailProtection` (RFC 8551 §4.4.4) and the anchor's own trust metadata must permit that purpose, since a root can be distrusted for email while remaining a good TLS root. Override either with `requiredEku` / `checkPurpose`. `compress(content, opts)` and `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (§3.6, RFC 3274), a size transform with no integrity or confidentiality (§2.4.5), bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Header protection (RFC 9788): `sign` and `encrypt` take `opts.protectHeaders`, which inlines the caller's `opts.headers` on the Cryptographic Payload root (its Content-Type gaining `hp="clear"` when signed or `hp="cipher"` when encrypted) so the CMS signature or encryption covers them, defeating a transport that rewrites or reads Subject, From, and the rest. `verify` and `decrypt` surface the authenticated inner set as `protectedHeaders` plus `headerProtection { present, mode, fromMismatch, confidential, legacy }`, so a tampered outer header cannot alter it and `fromMismatch` flags an outer From that disagrees. Encryption applies a Header Confidentiality Policy: the default `hcp_baseline` obscures the outer Subject to `[...]` and removes Comments and Keywords, so the real values live only in the ciphertext, and `decrypt` recovers them. Every emitted header routes through a fail-closed injection guard that rejects a CR, LF, or NUL value and a non-ftext name, and a malformed or contradictory `hp` wrap fails closed as `smime/bad-header-protection` rather than silently downgrading. The CMS crypto is unchanged. Inbound legacy RFC 8551 header protection is recognized opt-in: `verify` and `decrypt` with `opts.legacyHeaderProtection` detect a legacy `message/rfc822`-wrapped payload by the RFC 9788 §4.10.1 four-condition identification and surface the inner headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }`, where `headers` is an ordered `[{ name, value }]` array retaining legally repeated fields such as `Received`. Those never appear in `protectedHeaders` and never set `present: true`. Because a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, this is an explicit heuristic (§4.10.2, "no strong end-to-end guarantees"): a caller keying trust off `present` or `protectedHeaders` is never misled, and only one that explicitly reads `headerProtection.legacy.headers` and cross-checks `legacy.fromMismatch` consumes it. It is off by default, and a nested crypto layer, an inner `hp=`, a non-`message/rfc822` payload, or a duplicate Content-Type reports `legacy: null`. Bidirectionally interoperable with `openssl smime` and `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | Time-Stamp Protocol (RFC 3161). `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData over `pki.cms.sign` whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` with optional accuracy, nonce, and ordering, plus the §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` and `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq); `response` and `parseResponse` handle the TimeStampResp a TSA returns, either a granted status wrapping a token or a rejection with PKIStatus and failure info, with the §2.4.2 status-to-token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and, with a trust anchor supplied, full certification-path validation of the TSA certificate at the token's `genTime` — judged under the `timeStamping` purpose, so an anchor's own per-purpose trust metadata reaches the decision rather than sitting inert. It returns `{ valid, trusted, genTime, serialNumber, tstInfo, ... }`, where `trusted` is the separate claim that the authority chained to an anchor you named: without one there is nothing to chain to and it is `false`, which is the distinction a timestamp re-read years later turns on — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | Online Certificate Status Protocol (RFC 6960), both the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs, with the CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile or under SHA-2, plus an optional RFC 9654 nonce and an optional requestor signature. `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER, from the issuing CA directly or a delegated responder, under any `pki.cms.sign` key including the post-quantum ML-DSA and SLH-DSA sets, with `good`, `revoked` (reason and time), or `unknown` per-certificate status. `buildErrorResponse(status)` produces the unsigned §2.3 error (`tryLater`, `unauthorized`, and the rest). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA, or a CA-issued delegate bearing id-kp-OCSPSigning and id-pkix-ocsp-nocheck and passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency against `thisUpdate` and `nextUpdate`, and the request-nonce echo. It returns `{ status: "good" / "revoked" / "unknown", ... }` and never silently accepts. `verifyRequest(request, opts)` is the responder-side inverse of `buildRequest`: it verifies a client's signed request (RFC 6960 §4.1.1) under the requestor certificate the request carries, trying each embedded certificate since the field is unordered, and reports `signed`, `signatureValid`, every certificate whose key verified (`signerCerts`, so a key carried under an expired certificate beside its renewal is not hidden behind ordering) with the first one's decoded subject, the full embedded certificate bag (`certs`, including intermediates for path building), and the request's CertIDs; an unsigned request is reported with `signed: false` rather than refused. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify`, `verifyRequest` |
-| `pki.ct` | Certificate Transparency (RFC 6962). `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries, a TLS-presentation-language payload inside the §3.3 double DER wrap, into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature. `reconstructSignedData` rebuilds the exact `digitally-signed` preimage, and `verifySct` verifies an SCT signature against a log's public key, routing an ECDSA signature through the strict DER-conformance gate and verifying through the crypto engine, resolving true or false and throwing a typed error on a structural fault. On the producing side, `encodeSctList` builds the extension value byte for byte as the exact inverse of `parseSctList`, and `signSct` performs a log's signing step. For trust, `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs, recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2) and decoding the state and temporal-interval constraints; `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable, qualified, and readonly trusted; retired only before retirement; pending and rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256 and an EC P-256 arm, with forgeable-key defenses failing closed), cross-checked against `openssl dgst`. `fetchLogList(opts)` turns that chain into a live client: it GETs the `log_list.json` and its detached `log_list.sig` over `pki.transport`, verifies the detached signature over the raw fetched bytes against a caller-pinned distributor key before parsing, so an unverified document is never parsed, read, cached, or surfaced, then ingests the same bytes through `parseLogList` and returns the trusted-log set plus the surfaced `version` and `timestamp`. The toolkit bakes in no vendor URL or key, TLS trust is explicit with `rejectUnauthorized` always on, each response is size-capped before the trust chain, and the transport is injectable so the whole path is testable offline — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifyLogListSignature`, `fetchLogList` |
+| `pki.ct` | Certificate Transparency (RFC 6962). `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries, a TLS-presentation-language payload inside the §3.3 double DER wrap, into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature. `reconstructSignedData` rebuilds the exact `digitally-signed` preimage, and `verifySct` verifies an SCT signature against a log's public key, routing an ECDSA signature through the strict DER-conformance gate and verifying through the crypto engine, resolving true or false and throwing a typed error on a structural fault. On the producing side, `encodeSctList` builds the extension value byte for byte as the exact inverse of `parseSctList`, and `signSct` performs a log's signing step. For trust, `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs, recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2) and decoding the state and temporal-interval constraints; `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable, qualified, and readonly trusted; retired only before retirement; pending and rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256 and an EC P-256 arm, with forgeable-key defenses failing closed), cross-checked against `openssl dgst`. `fetchLogList(opts)` turns that chain into a live client: it GETs the `log_list.json` and its detached `log_list.sig` over `pki.transport`, verifies the detached signature over the raw fetched bytes against a caller-pinned distributor key before parsing, so an unverified document is never parsed, read, cached, or surfaced, then ingests the same bytes through `parseLogList` and returns the trusted-log set plus the surfaced `version` and `timestamp`. Above the per-SCT layer, `verifySctList` renders a certificate-level verdict over every SCT a certificate carries (§3.3), reporting how many distinct trusted logs verified an SCT (so a duplicated SCT cannot inflate the count) and from how many distinct trusted operators against a caller's CT policy (`minScts` and `minOperators`, both defaulting to the RFC floor of one), where a policy shortfall is a verdict and a per-SCT failure is a recorded row rather than a thrown call; `x509CertEntry` reconstructs the precertificate log entry from a final certificate by removing the SCT-list extension from its TBSCertificate as byte surgery, so its embedded SCTs verify end to end (§3.2). The toolkit bakes in no vendor URL or key, TLS trust is explicit with `rejectUnauthorized` always on, each response is size-capped before the trust chain, and the transport is injectable so the whole path is testable offline — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifySctList`, `x509CertEntry`, `verifyLogListSignature`, `fetchLogList` |
 | `pki.merkle` | Merkle-tree proof verification (RFC 6962 / RFC 9162). `leafHash`, `nodeHash`, and `emptyRootHash` build the domain-separated (0x00 leaf, 0x01 node) SHA-256 tree hashes. `verifyInclusion` folds an audit proof back to a root, and `verifyConsistency` reconstructs both the old and new root, which is the append-only guarantee; each is constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla and CCADB trust-store ingestion. `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export, both into one constraint-carrying anchor shape: the per-purpose trust bits, where only `CKT_NSS_TRUSTED_DELEGATOR` grants, and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer and serial rather than adjacency and are cross-checked against the parsed DER, so metadata cannot attach to the wrong root. `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
 | `pki.shbs` | Stateful hash-based signature verification: HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and in CMS by RFC 9708, profiled by NIST SP 800-208 for CNSA 2.0 firmware signing. `verify` checks an HSS signature, where every level must pass, and `verifyLms` a single-tree LMS, over the raw public-key and signature blobs the parsers already surface. Pure public-input SHA-256 and SHAKE256 hashing, a data-driven typecode registry, and bounds-before-slice reads; a malformed blob throws a typed `ShbsError` while a well-formed but wrong signature returns `false`. Verification only by design, since stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |

package/lib/ct.js

@@ -848,30 +848,285 @@ function _resolveNotAfter(entry, opts) {
  *     state: { usable: { timestamp: "2026-01-01T00:00:00Z" } } }] }] }), "utf8"));
  *   var ok = await pki.ct.verifySctWithLogList(sctEntry, embeddedSct, logList);
  */
-async function verifySctWithLogList(entry, sct, logList, opts) {
-  opts = opts || {};
-  if (logList == null || typeof logList !== "object" || logList.byLogId == null) throw _ctErr("ct/bad-input", "logList must be a pki.ct.parseLogList result");
-  if (sct == null || typeof sct !== "object" || typeof sct.logIdHex !== "string") throw _ctErr("ct/bad-input", "the SCT is missing its logIdHex");
+// The pure, NON-THROWING log resolution + state + temporal classifier shared by verifySctWithLogList
+// (which throws the mapped code on a non-ok status) and verifySctList (which records the code into a
+// result row and continues). Returns { status, log?, code?, message? } where status is one of
+// ok | bad-input | not-found | untrusted | temporal. A mis-shaped sct.timestamp (in the retired-log
+// gate) or a malformed opts.certNotAfter (in the temporal gate, via within) still THROWS -- those are
+// caller mis-shapes, not per-SCT trust outcomes (the three-tier rule: bad input throws, a per-SCT
+// verdict is recorded). The state and temporal gate semantics are verbatim from the original
+// verifySctWithLogList body, so its shipped RED vectors are the behavior guard for this refactor.
+function _classifyLog(sct, logList, entry, opts) {
+  if (logList == null || typeof logList !== "object" || logList.byLogId == null) return { status: "bad-input", code: "ct/bad-input", message: "logList must be a pki.ct.parseLogList result" };
+  if (sct == null || typeof sct !== "object" || typeof sct.logIdHex !== "string") return { status: "bad-input", code: "ct/bad-input", message: "the SCT is missing its logIdHex" };
   var log = logList.byLogId[sct.logIdHex];
-  if (log == null) throw _ctErr("ct/log-not-found", "no trusted CT log matches the SCT's logId " + sct.logIdHex);
+  if (log == null) return { status: "not-found", code: "ct/log-not-found", message: "no trusted CT log matches the SCT's logId " + sct.logIdHex };
   // State gate (fail-closed): trusted proceed; retired only before its retirement; else untrusted.
   if (!log.state.trusted) {
-    if (!log.state.conditional) throw _ctErr("ct/log-untrusted", "the CT log state '" + log.state.name + "' is not trusted");
+    if (!log.state.conditional) return { status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log state '" + log.state.name + "' is not trusted" };
     var ts = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp");
-    if (ts >= BigInt(guard.time.instantOf(log.state.since))) throw _ctErr("ct/log-untrusted", "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")");
+    if (ts >= BigInt(guard.time.instantOf(log.state.since))) return { status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")" };
   }
   // Temporal gate (fail-closed): the covered cert's notAfter must be in [start_inclusive, end_exclusive).
   if (log.temporalInterval) {
     var notAfter = _resolveNotAfter(entry, opts);
-    // within() validates notAfter (and the interval bounds) fail-closed before comparing: an Invalid
-    // Date is instanceof Date yet NaN, and NaN < x / NaN >= x are both false, so an unvalidated notAfter
-    // would silently BYPASS the [startInclusive, endExclusive) containment. A malformed notAfter throws
-    // inside within (pass a valid opts.certNotAfter); an out-of-window notAfter returns false here.
+    // An unresolvable notAfter is a failure for this windowed SCT, never a silent skip. within() then
+    // validates notAfter fail-closed before comparing: an Invalid Date is instanceof Date yet NaN, and
+    // NaN < x / NaN >= x are both false, so an unvalidated notAfter would BYPASS the containment. A
+    // malformed opts.certNotAfter throws inside within (a caller mis-shape); an out-of-window one is
+    // this recorded temporal status.
+    if (notAfter == null) return { status: "temporal", log: log, code: "ct/temporal-interval", message: "the windowed CT log has no resolvable covered-certificate notAfter (pass a valid opts.certNotAfter)" };
     if (!guard.time.within(notAfter, log.temporalInterval.startInclusive, log.temporalInterval.endExclusive, _ctErr, "ct/temporal-interval", "the covered certificate notAfter (pass a valid opts.certNotAfter)")) {
-      throw _ctErr("ct/temporal-interval", "the covered certificate's notAfter is outside the CT log's temporal_interval");
+      return { status: "temporal", log: log, code: "ct/temporal-interval", message: "the covered certificate's notAfter is outside the CT log's temporal_interval" };
     }
   }
-  return verifySct(entry, sct, log.key);   // the shipped crypto verdict (re-checks the logId binding)
+  return { status: "ok", log: log };
+}
+
+async function verifySctWithLogList(entry, sct, logList, opts) {
+  opts = opts || {};
+  var c = _classifyLog(sct, logList, entry, opts);
+  if (c.status !== "ok") throw _ctErr(c.code, c.message);
+  return verifySct(entry, sct, c.log.key);   // the shipped crypto verdict (re-checks the logId binding)
+}
+
+// Options verifySctList reads. All optional; the defaults are the RFC 6962 sec. 3.3 floor (>= 1).
+var _VERIFY_SCT_LIST_OPTS = { minScts: 1, minOperators: 1, certNotAfter: 1, at: 1 };
+
+// A caller-supplied policy threshold: a positive integer, or null when omitted (defaulted by the caller).
+function _policyCount(v, name) {
+  if (v == null) return null;
+  if (typeof v !== "number" || !intrinsic.isInteger(v) || v < 1) throw _ctErr("ct/bad-input", name + " must be a positive integer");
+  return v;
+}
+
+/**
+ * @primitive  pki.ct.verifySctList
+ * @signature  pki.ct.verifySctList(entry, list, logList, opts?) -> Promise<verdict>
+ * @since      0.6.1
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.verifySct, pki.ct.verifySctWithLogList, pki.ct.parseLogList, pki.ct.parseSctList
+ *
+ * Render a certificate-level Certificate Transparency verdict over the SET of SCTs a certificate carries
+ * (RFC 6962 sec. 3.3), rather than one SCT at a time. Each SCT is resolved to a trusted log through
+ * `logList` and verified with the shipped `verifySct`; the verdict reports how many distinct trusted
+ * logs verified an SCT (`validScts`, so a duplicated SCT cannot inflate the count), from how many
+ * distinct trusted operators, and whether that meets the caller's CT policy. The RFC floor is one valid
+ * SCT (sec. 3.3), so `minScts` and `minOperators` both default to 1; the distinct-operator axis is a
+ * browser CT policy layered on top of the RFC, so the caller sets the threshold and the verdict surfaces
+ * the counts rather than hardcoding a browser's numbers.
+ *
+ * `entry` is the shared log-entry context for every SCT (`{ entryType: 0, leafCert }` for SCTs delivered
+ * over TLS/OCSP, or `{ entryType: 1, tbsCertificate, issuerKeyHash }` for embedded SCTs; the shape
+ * `pki.ct.x509CertEntry` produces). `list` is a `parseSctList` result, its `.scts` array, or an array of
+ * decoded v1 SCTs; unknown-version entries are counted `unknownScts` and never as valid. `logList` is a
+ * `parseLogList` result. A policy shortfall is a verdict (`policyOk: false`), not a throw; a per-SCT
+ * trust or crypto failure is recorded into its result row (`valid: false`, with a `code` for a
+ * structural or trust exclusion, without one for a cryptographic mismatch) and the loop continues; only
+ * a mis-shaped `entry` / `list` / `logList` / `opts` throws a typed `CtError`.
+ *
+ * @opts
+ *   - `minScts` (int, default 1) -- required count of valid SCTs from trusted, in-window logs.
+ *   - `minOperators` (int, default 1) -- required count of distinct trusted operators among them.
+ *   - `certNotAfter` (Date) -- the covered certificate's notAfter for each windowed log's temporal gate;
+ *     auto-derived from `entry.leafCert` for entryType 0, required for a precert entry against a windowed log.
+ *   - `at` (Date) -- the validation time; when supplied, an SCT whose timestamp is later than it is
+ *     rejected and not counted (RFC 6962 sec. 5.2, a client rejects a future-dated SCT). The
+ *     pki.path.validate CT gate passes its opts.time here.
+ * @example
+ *   // requires: logListJsonBytes -- the CT log-list JSON a distributor publishes (the log_list.json browsers consume)
+ *   // requires: sctExtValue -- a certificate's SCT-list extension value (a signedCertificateTimestampList extension)
+ *   // requires: certDer -- the DER of the certificate the SCTs cover
+ *   var logList = pki.ct.parseLogList(logListJsonBytes);
+ *   var list = pki.ct.parseSctList(sctExtValue);
+ *   var verdict = await pki.ct.verifySctList({ entryType: 0, leafCert: certDer }, list, logList,
+ *     { minScts: 2, minOperators: 2 });
+ *   verdict.policyOk;        // did the certificate meet the CT policy?
+ *   verdict.operators;       // the distinct trusted operators whose logs verified an SCT
+ */
+async function verifySctList(entry, list, logList, opts) {
+  opts = guard.identifier.optionsObject(opts, _ctErr, "ct/bad-input", "pki.ct.verifySctList options");
+  guard.identifier.assertKnownKeys(opts, _VERIFY_SCT_LIST_OPTS, _ctErr, "ct/bad-input", "pki.ct.verifySctList has an unknown option: ");
+  var minScts = _policyCount(opts.minScts, "opts.minScts"); if (minScts == null) minScts = 1;
+  var minOperators = _policyCount(opts.minOperators, "opts.minOperators"); if (minOperators == null) minOperators = 1;
+  if (logList == null || typeof logList !== "object" || logList.byLogId == null) throw _ctErr("ct/bad-input", "logList must be a pki.ct.parseLogList result");
+  if (entry == null || (entry.entryType !== 0 && entry.entryType !== 1)) throw _ctErr("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1) (RFC 6962 sec. 3.1)");
+  // The validation time, when supplied, arms the RFC 6962 sec. 5.2 rule that a future-dated SCT is
+  // rejected: a log cannot have issued an SCT after the moment we verify it, so its timestamp must not
+  // be later than `at`. Held as a millisecond Number and compared against the SCT's BigInt uint64
+  // timestamp (a BigInt-vs-Number relational comparison is exact).
+  var atMs = null;
+  if (opts.at != null) { guard.time.assertValid(opts.at, _ctErr, "ct/bad-input", "opts.at (the validation time)"); atMs = guard.time.instantOf(opts.at); }
+  // A present certNotAfter must be a valid Date: a non-Date is a caller mis-shape that throws, never a
+  // value silently ignored (entryType 0 would fall back to the certificate's own notAfter) or demoted to
+  // a per-SCT temporal failure (entryType 1) -- the malformed-options contract, matching opts.at.
+  if (opts.certNotAfter != null) guard.time.assertValid(opts.certNotAfter, _ctErr, "ct/bad-input", "opts.certNotAfter (the covered certificate's notAfter)");
+  // Validate the shared entry's required fields up front: a mis-shaped entry is a caller error that
+  // throws (not a per-SCT row or a verdict rendered without examining it), even when the SCT list is
+  // empty. The same fields reconstructSignedData reads for the preimage.
+  if (entry.entryType === 0) { _toBuffer(entry.leafCert, "entry.leafCert"); }
+  else {
+    if (_toBuffer(entry.issuerKeyHash, "entry.issuerKeyHash").length !== 32) throw _ctErr("ct/bad-issuer-key-hash", "entry.issuerKeyHash must be exactly 32 bytes (SHA-256 of the issuer SPKI, RFC 6962 sec. 3.2)");
+    _toBuffer(entry.tbsCertificate, "entry.tbsCertificate");
+  }
+  // Normalize the list into the known v1 SCTs plus the count of forward-compat unknown-version entries
+  // (M7 -- their body layout is undefined, so they are unverifiable, never a valid SCT, never a throw).
+  var scts, unknownScts;
+  if (list != null && intrinsic.isArray(list.scts)) { scts = list.scts; unknownScts = intrinsic.isArray(list.unknownScts) ? list.unknownScts.length : 0; }
+  else if (intrinsic.isArray(list)) { scts = list; unknownScts = 0; }
+  else throw _ctErr("ct/bad-input", "list must be a pki.ct.parseSctList result, its .scts array, or an array of decoded v1 SCTs");
+  // Bound the per-SCT verification work a caller-supplied array can demand to the same cap parseSctList
+  // enforces on wire input, so a bare oversized array cannot force an unbounded run of signature checks.
+  if (scts.length > C.LIMITS.SCT_MAX_COUNT) throw _ctErr("ct/too-many-scts", "the SCT list has " + scts.length + " entries, exceeding the SCT_MAX_COUNT cap of " + C.LIMITS.SCT_MAX_COUNT + " (RFC 6962 sec. 3.3)");
+
+  var results = [], validScts = 0, operators = [], seenOps = intrinsic.create(null), seenLogs = intrinsic.create(null);
+  for (var i = 0; i < scts.length; i++) {
+    var sct = scts[i];
+    var row = { logIdHex: (sct && typeof sct.logIdHex === "string") ? sct.logIdHex : null, valid: false,
+      operator: null, logState: null,
+      timestamp: (sct && typeof sct.timestamp === "bigint") ? sct.timestamp : null, code: undefined, reason: undefined };
+    // Classification can THROW for a malformed per-SCT field (a bad timestamp on a retired-log match):
+    // that is a recorded per-SCT outcome, never a thrown aggregate abort, so it matches the usable-log
+    // malformed-SCT path below and one bad SCT cannot sink the verdict or a valid sibling.
+    var c;
+    try { c = _classifyLog(sct, logList, entry, opts); }
+    catch (e) {
+      if (!(e && e.isPkiError)) throw e;
+      row.code = e.code; row.reason = e.message; intrinsic.push(results, row); continue;
+    }
+    if (c.log) { row.operator = c.log.operator; row.logState = c.log.state.name; }
+    if (c.status !== "ok") { row.code = c.code; row.reason = c.message; intrinsic.push(results, row); continue; }
+    // A trust exclusion is a recorded code above; the crypto check below is false-is-a-verdict. But a
+    // structurally-defective SCT from a trusted log (a malformed signature encoding, an unsupported hash
+    // or curve) makes verifySct THROW a typed CtError -- for the aggregate that is a recorded per-SCT
+    // outcome (M10, the verdict-collector tier), never a thrown call that would sink the verdict or a
+    // valid sibling. A non-PkiError (an unexpected bug) is re-thrown, never swallowed into a verdict.
+    var ok;
+    try { ok = await verifySct(entry, sct, c.log.key); }
+    catch (e) {
+      if (!(e && e.isPkiError)) throw e;
+      row.code = e.code; row.reason = e.message; intrinsic.push(results, row); continue;
+    }
+    // RFC 6962 sec. 5.2: reject a future-dated SCT even when its signature verifies -- a log cannot have
+    // issued it after the validation time, so it is recorded as a rejection and never counted. An SCT
+    // dated after the certificate's OWN notAfter is deliberately NOT rejected: RFC 6962 sec. 5.1 permits
+    // a log to accept an already-expired certificate, so such an SCT is legitimate.
+    if (ok === true && atMs != null && sct.timestamp > atMs) {
+      row.code = "ct/future-timestamp"; row.reason = "the SCT timestamp is later than the validation time (RFC 6962 sec. 5.2)";
+      intrinsic.push(results, row); continue;
+    }
+    row.valid = ok === true;
+    // Count each distinct trusted log once: a duplicated SCT, or a second SCT from the same log, is one
+    // attestation, so a repeat cannot inflate validScts past a minScts policy (the count is over the set
+    // of logs, not raw SCT copies). The duplicate row is still recorded for diagnostics.
+    if (row.valid && !seenLogs[sct.logIdHex]) {
+      seenLogs[sct.logIdHex] = true;
+      validScts++;
+      if (c.log.operator != null && !seenOps[c.log.operator]) { seenOps[c.log.operator] = true; intrinsic.push(operators, c.log.operator); }
+    }
+    intrinsic.push(results, row);
+  }
+  var operatorCount = operators.length;
+  var policyOk = validScts >= minScts && operatorCount >= minOperators;
+  return {
+    policyOk: policyOk, totalScts: scts.length + unknownScts, validScts: validScts, unknownScts: unknownScts,
+    operatorCount: operatorCount, operators: operators, required: { minScts: minScts, minOperators: minOperators },
+    results: results,
+    reason: policyOk ? null : ("CT policy not met: " + validScts + " valid SCT(s) from " + operatorCount + " distinct operator(s); require at least " + minScts + " SCT(s) from at least " + minOperators + " operator(s)"),
+  };
+}
+
+// A cert / issuer argument as a parsed x509: a DER Buffer, a PEM string, or an unmodified
+// pki.schema.x509.parse result. Routed through guard.parsed (provenance-based, getter-free) so a
+// caller object cannot spoof "already parsed" through a lying accessor; a malformed one is a typed
+// ct/bad-cert-entry, never a silently-skipped input.
+function _asParsedCert(v, field) {
+  // Inline require (circular load with schema-x509 -> schema-pkix), matching _resolveNotAfter above.
+  var x509 = require("./schema-x509.js");   // allow:inline-require -- circular load (see _resolveNotAfter)
+  return guard.parsed.acceptDerived(v, "certificate", x509.parse, _ctErr, "ct/bad-cert-entry", field);
+}
+
+/**
+ * @primitive  pki.ct.x509CertEntry
+ * @signature  pki.ct.x509CertEntry(cert, issuer) -> { entryType, tbsCertificate, issuerKeyHash }
+ * @since      0.6.1
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.verifySctList, pki.ct.reconstructSignedData, pki.ct.verifySct
+ *
+ * Reconstruct the precertificate log entry from a FINAL certificate carrying embedded SCTs, so those
+ * SCTs can be verified end to end (RFC 6962 sec. 3.2): "reconstruct this TBSCertificate from the final
+ * certificate by extracting the TBSCertificate from it and deleting the SCT extension". Returns the
+ * `{ entryType: 1, tbsCertificate, issuerKeyHash }` entry `pki.ct.verifySctList` / `reconstructSignedData`
+ * consume, where `tbsCertificate` is the leaf TBS with ONLY the signedCertificateTimestampList extension
+ * removed and `issuerKeyHash` is `SHA-256(issuer SubjectPublicKeyInfo DER)` (32 bytes). The signed
+ * `tbs_certificate` an SCT covers is also without the CT poison extension (RFC 6962 sec. 3.2, "without
+ * the signature and the poison extension"), which sits in the same position the SCT list takes in the
+ * final certificate, so deleting the SCT-list extension IS the whole reconstruction: no poison extension
+ * is re-added. (The Precertificate Signing Certificate case, where the precert issuer differs from the
+ * final issuer, is out of scope; the common flow issues both from the one CA.)
+ *
+ * The removal is byte surgery on the CA-signed bytes, never a value re-serialization: the extensions
+ * list and the two enclosing containers are rebuilt from every OTHER element's raw DER, so the only
+ * bytes that change are the removed extension and the recomputed canonical DER length prefixes. `cert`
+ * and `issuer` each accept a DER `Buffer`, a PEM string, or a `pki.schema.x509.parse` result. A
+ * certificate with no extensions or no SCT-list extension is `ct/no-sct-extension`; an argument that is
+ * not a certificate is `ct/bad-cert-entry`, and malformed certificate bytes carry the X.509 parse fault.
+ *
+ * @example
+ *   // requires: leafCertDer -- the DER of a final certificate carrying embedded SCTs
+ *   // requires: issuerCertDer -- the DER of the certificate that issued it
+ *   // requires: sctExtValue -- the leaf's signedCertificateTimestampList extension value
+ *   // requires: logList -- a pki.ct.parseLogList result
+ *   var entry = pki.ct.x509CertEntry(leafCertDer, issuerCertDer);
+ *   var verdict = await pki.ct.verifySctList(entry, pki.ct.parseSctList(sctExtValue), logList,
+ *     { certNotAfter: pki.schema.x509.parse(leafCertDer).validity.notAfter });
+ */
+// The issuer contributes only its SubjectPublicKeyInfo (issuerKeyHash = SHA-256 of it), so it accepts
+// anything x509CertEntry's cert does PLUS a bare { subjectPublicKeyInfo: { bytes } } -- a trust anchor
+// carries its key without a full certificate, and requiring a whole cert there would refuse a leaf
+// validated directly under an anchor.
+function _issuerSpki(v, field) {
+  if (v != null && typeof v === "object" && !intrinsic.isBuffer(v) && v.subjectPublicKeyInfo != null && v.subjectPublicKeyInfo.bytes != null) {
+    // Validate the bare-form bytes as a BufferSource so a malformed value fails through the typed CT
+    // error contract, not a native TypeError from the SHA-256 update downstream.
+    return guard.bytes.view(v.subjectPublicKeyInfo.bytes, CtError, "ct/bad-cert-entry", field + " subjectPublicKeyInfo.bytes");
+  }
+  return _asParsedCert(v, field).subjectPublicKeyInfo.bytes;
+}
+
+function x509CertEntry(cert, issuer) {
+  var leaf = _asParsedCert(cert, "cert"), issSpki = _issuerSpki(issuer, "issuer");
+  var tbs = asn1.decode(leaf.tbsBytes);
+  // extensions [3] EXPLICIT is the last TBSCertificate field (context-constructed tag 3).
+  var wrapIdx = -1;
+  for (var i = 0; i < tbs.children.length; i++) {
+    if (tbs.children[i].tagClass === "context" && tbs.children[i].tagNumber === 3) { wrapIdx = i; break; }
+  }
+  if (wrapIdx < 0) throw _ctErr("ct/no-sct-extension", "the certificate has no extensions, so it carries no embedded SCT list (RFC 6962 sec. 3.2)");
+  var extsSeq = tbs.children[wrapIdx].children[0];   // the SEQUENCE OF Extension
+  var sctOid = asn1.build.oid(oid.byName("signedCertificateTimestampList"));
+  var kept = [], removed = 0;
+  for (var j = 0; j < extsSeq.children.length; j++) {
+    var ext = extsSeq.children[j];
+    // ext.children[0] is the extnID OID node; compare its exact TLV bytes to the SCT-list OID.
+    if (ext.children[0] && intrinsic.bufferEquals(ext.children[0].bytes, sctOid)) { removed++; continue; }
+    intrinsic.push(kept, ext.bytes);
+  }
+  if (removed === 0) throw _ctErr("ct/no-sct-extension", "the certificate carries no signedCertificateTimestampList extension (RFC 6962 sec. 3.2)");
+  // Rebuild the TBSCertificate SEQUENCE from raw child bytes; canonical DER lengths reproduce the
+  // original framing minus the removed extension. When the SCT-list was the ONLY extension, `kept` is
+  // empty and the extensions field is dropped ENTIRELY -- RFC 5280 Extensions is SIZE (1..MAX) and the
+  // [3] field is OPTIONAL, so an empty [3] SEQUENCE {} would be invalid and would not match the signed
+  // precert TBS, whose extensions field is likewise absent once its sole poison extension is removed.
+  var tbsChildren = [];
+  for (var k = 0; k < tbs.children.length; k++) {
+    if (k !== wrapIdx) { intrinsic.push(tbsChildren, tbs.children[k].bytes); continue; }
+    if (kept.length > 0) intrinsic.push(tbsChildren, asn1.build.explicit(3, asn1.build.sequence(kept)));
+  }
+  var issuerKeyHash = nodeCrypto.createHash("sha256").update(issSpki).digest();
+  return { entryType: 1, tbsCertificate: asn1.build.sequence(tbsChildren), issuerKeyHash: issuerKeyHash };
 }
 
 /**
@@ -1113,6 +1368,8 @@ module.exports = {
   signSct: signSct,
   parseLogList: parseLogList,
   verifySctWithLogList: verifySctWithLogList,
+  verifySctList: verifySctList,
+  x509CertEntry: x509CertEntry,
   verifyLogListSignature: verifyLogListSignature,
   fetchLogList: fetchLogList,
   HASH_ALGORITHMS: HASH_ALGORITHMS,

package/lib/path-validate.js

@@ -33,6 +33,7 @@
 var webcrypto = require("./webcrypto");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var ct = require("./ct");
 var errors = require("./framework-error");
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
@@ -1278,17 +1279,73 @@ function validateCriticalExtensionStructure(cert) {
 // inputs appear together. A grep of one function would have shipped a list missing four real
 // options and rejected callers that work today.
 var _VALIDATE_OPTS = {
-  checkPurpose: 1, historicalMode: 1, initialAnyPolicyInhibit: 1, initialExcludedSubtrees: 1,
-  initialExplicitPolicy: 1, initialPermittedSubtrees: 1, initialPolicyMappingInhibit: 1,
-  maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1, requiredEku: 1, revocationChecker: 1,
-  softFail: 1, time: 1, trustAnchor: 1, userInitialPolicySet: 1, verifier: 1
+  checkPurpose: 1, ctLogList: 1, ctPolicy: 1, historicalMode: 1, initialAnyPolicyInhibit: 1,
+  initialExcludedSubtrees: 1, initialExplicitPolicy: 1, initialPermittedSubtrees: 1,
+  initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1,
+  requiredEku: 1, revocationChecker: 1, softFail: 1, time: 1, trustAnchor: 1,
+  userInitialPolicySet: 1, verifier: 1
 };
 
+// The opt-in Certificate Transparency gate (RFC 6962). When opts.ctLogList is supplied, the target's
+// embedded SCTs are verified against the trusted log-list and the caller's CT policy, and the verdict is
+// recorded on the target's checks. Fail-closed: a target that declares a CT policy but carries no
+// SCT-list extension is refused. Reached only through opts.ctLogList, so every existing caller is
+// unaffected. The SCT-list extension OID is looked up through the shared registry, never a literal.
+var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
+async function ctGateCheck(leaf, certs, anchor, ctLogList, ctPolicy, n, at) {
+  var exts = leaf.extensions || [], sctExt = null;
+  for (var i = 0; i < exts.length; i++) {
+    if (exts[i] && (exts[i].oid === OID_SCT_LIST || exts[i].name === "signedCertificateTimestampList")) { sctExt = exts[i]; break; }
+  }
+  if (sctExt == null) return { name: "ct", ok: false, code: "path/ct-required" };
+  // The leaf's issuer contributes issuerKeyHash: the certificate that signed it (certs[n-2] in the
+  // anchor->target order), or the anchor itself when the target is validated directly beneath it.
+  var issuer = n >= 2 ? certs[n - 2] : { subjectPublicKeyInfo: { bytes: anchor.publicKey } };
+  var entry, list;
+  try {
+    entry = ct.x509CertEntry(leaf, issuer);
+    list = ct.parseSctList(sctExt.value);
+  } catch (e) {
+    return { name: "ct", ok: false, code: pathCode(e, "path/ct-required") };
+  }
+  // verifySctList throws only for a mis-shaped caller configuration (a bad ctPolicy threshold value, a
+  // ctLogList that is not a parseLogList result): that is the caller's error, surfaced at the path
+  // boundary as path/bad-input rather than leaking the ct/* domain code of a layer they did not call.
+  // verifySctList throws only for a mis-shaped caller configuration (a bad ctPolicy threshold value, a
+  // ctLogList that is not a parseLogList result): that is the caller's error, surfaced at the path
+  // boundary as path/bad-input rather than leaking the ct/* domain code of a layer they did not call.
+  var verdict;
+  try {
+    verdict = await ct.verifySctList(entry, list, ctLogList,
+      { minScts: ctPolicy.minScts, minOperators: ctPolicy.minOperators, certNotAfter: leaf.validity.notAfter, at: at });
+  } catch (e) {
+    if (e && e.isPkiError) throw E("path/bad-input", "validate: the CT policy or log-list is invalid (" + (e.code || "ct/bad-input") + "): " + e.message);
+    throw e;
+  }
+  return { name: "ct", ok: verdict.policyOk === true, code: verdict.policyOk ? undefined : "path/ct-policy-not-met" };
+}
+
 async function validate(path, opts) {
   opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "validate: opts");
   guard.identifier.assertKnownKeys(opts, _VALIDATE_OPTS, E, "path/bad-input",
     "pki.path.validate has an unknown option. The anchor here is `trustAnchor`, singular; " +
     "pki.path.build takes `trustAnchors`. The unknown option was: ");
+  // A CT policy without a log-list cannot be enforced -- refuse it at entry rather than silently
+  // skipping the CT gate and returning a valid path the caller believes was CT-checked (fail-closed).
+  if (opts.ctPolicy != null && opts.ctLogList == null) throw E("path/bad-input", "validate: opts.ctPolicy requires opts.ctLogList (the trusted CT log-list to verify the certificate's SCTs against)");
+  // Validate the CT policy's KEYS at entry: a misspelled key (e.g. `minSCTs`) would otherwise read as
+  // undefined and silently default to the RFC floor of 1, applying a weaker policy than the caller asked
+  // for. The values are validated by verifySctList when the gate runs.
+  // Validate the whole CT configuration at entry, independent of whether the target carries an SCT
+  // extension, so a malformed policy or log-list is always path/bad-input -- never masked as a
+  // per-certificate path/ct-required just because the target happens to lack SCTs.
+  if (opts.ctLogList != null) {
+    if (typeof opts.ctLogList !== "object" || opts.ctLogList.byLogId == null) throw E("path/bad-input", "validate: opts.ctLogList must be a pki.ct.parseLogList result");
+    var ctp = guard.identifier.optionsObject(opts.ctPolicy, E, "path/bad-input", "validate: opts.ctPolicy");
+    guard.identifier.assertKnownKeys(ctp, { minScts: 1, minOperators: 1 }, E, "path/bad-input", "validate: opts.ctPolicy has an unknown key (the CT policy keys are minScts / minOperators): ");
+    if (ctp.minScts != null && (typeof ctp.minScts !== "number" || !intrinsic.isInteger(ctp.minScts) || ctp.minScts < 1)) throw E("path/bad-input", "validate: opts.ctPolicy.minScts must be a positive integer");
+    if (ctp.minOperators != null && (typeof ctp.minOperators !== "number" || !intrinsic.isInteger(ctp.minOperators) || ctp.minOperators < 1)) throw E("path/bad-input", "validate: opts.ctPolicy.minOperators must be a positive integer");
+  }
   if (!intrinsic.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
   // Bound the per-cert asymmetric-verify work BEFORE parsing an untrusted bundle
   // (the policy-tree cap guards CVE-2023-0464-style blow-up; this guards linear
@@ -1607,6 +1664,15 @@ async function validate(path, opts) {
     failed = true;
   }
 
+  // Opt-in CT gate: verify the target's embedded SCTs and record the verdict on its checks (RFC 6962).
+  if (opts.ctLogList != null) {
+    var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || {}, n, opts.time);
+    var target = null;
+    for (var tr = 0; tr < state.results.length; tr++) { if (state.results[tr].index === n - 1) { target = state.results[tr]; break; } }
+    if (target) intrinsic.push(target.checks, ctCheck);
+    if (!ctCheck.ok) failed = true;
+  }
+
   return {
     valid: !failed,
     // What the revocation rule and the anchor's own trust metadata actually decided. `valid` alone

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9aa382b4-23a6-46b3-b0c6-809ac7fb8e71",
+  "serialNumber": "urn:uuid:1d7ac08a-caae-46f2-b074-9a7c370ea22f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-30T09:44:19.627Z",
+    "timestamp": "2026-08-30T12:52:47.496Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.0",
+      "bom-ref": "@blamejs/pki@0.6.1",
       "type": "application",
       "name": "pki",
-      "version": "0.6.0",
+      "version": "0.6.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.0",
+      "ref": "@blamejs/pki@0.6.1",
       "dependsOn": []
     }
   ]