@blamejs/pki 0.6.14 → 0.6.16

package/lib/ct.js

@@ -45,13 +45,9 @@ var constants = require("./constants.js");
 var frameworkError = require("./framework-error.js");
 var guard = require("./guard-all.js");
 var intrinsic = require("./guard-intrinsic.js");
-// Own-key membership through an operation taken at load. Written out, the question reads two
-// replaceable properties to answer one thing, and here it decides whether a log state is one this
-// toolkit trusts -- answering true for a name the table never carried trusts an untrusted log.
 var _hasOwn = intrinsic.hasOwn;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _JSON_SUFFIX = ".json";
-// A pathname ending with the literal ".json" suffix (matching /\.json$/), by suffix compare (no regex).
 function _endsWithJson(s) { return s.length >= _JSON_SUFFIX.length && _strSlice(s, s.length - _JSON_SUFFIX.length) === _JSON_SUFFIX; }
 var ByteReader = require("./byte-reader.js");
 var ByteWriter = require("./byte-writer.js");
@@ -66,35 +62,19 @@ var CtError = frameworkError.CtError;
 var PkiError = frameworkError.PkiError;
 var C = constants;
 
-// (code, message[, cause]) -> CtError, the factory the composed guards + the shared transport throw
-// through so a malformed value keeps the ct/* typed verdict (the optional cause carries the underlying
-// transport / evaluation error; existing 2-arg callers pass undefined, so the change preserves behavior).
 function _ctErr(c, m, cause) { return new CtError(c, m, cause); }
 
-// RFC 5246 sec. 7.4.1.4.1 code points: 1-byte values, never OIDs. Surfaced named; an
-// unknown code surfaces as its numeric byte with a null name (never rejected --
-// off-profile-pair rejection is a verifier-tier log-conformance concern).
 var HASH_ALGORITHMS = {
   0: "none", 1: "md5", 2: "sha1", 3: "sha224", 4: "sha256", 5: "sha384", 6: "sha512",
 };
 var SIGNATURE_ALGORITHMS = { 0: "anonymous", 1: "rsa", 2: "dsa", 3: "ecdsa" };
 
-// A minimum viable v1 SCT body: version(1) + LogID(32) + timestamp(8) +
-// empty-extensions(2) + digitally-signed{ hash(1) + sig(1) + empty-sig(2) } = 47.
 var SCT_MIN_BODY = 47;
 var LOGID_BYTES = 32;
-var MAX_SAFE = 9007199254740991n;   // 2^53 - 1; above this a Number loses precision
+var MAX_SAFE = 9007199254740991n;
 
-// ---- TlsReader: the RFC 6962 TLS-vector cursor, the shared bounded big-endian
-// ByteReader engine primitive bound to the ct/* fault domain. A lying inner length
-// can overrun only the current sub-reader's `end`, never the parent buffer, so
-// bounds-before-slice is structural (see lib/byte-reader.js).
 function TlsReader(buf, start, end) { return new ByteReader(buf, start, end, CtError, "ct/truncated"); }
 
-// Peel the RFC 6962 sec. 3.3 inner DER OCTET STRING (the certificate/OCSP layer
-// already peeled the outer extnValue OCTET STRING). Rides the strict codec, so
-// an indefinite length / constructed OCTET STRING / trailing bytes / single
-// wrap all fail closed here; the asn1/* fault attaches as `.cause`.
 function _peelInner(extValue) {
   var node;
   try { node = asn1.decode(extValue); }
@@ -107,16 +87,9 @@ function _toBuffer(v, field) {
   return guard.bytes.view(v, CtError, "ct/bad-input", field);
 }
 
-// Parse one SerializedSCT body inside a sub-reader bounded to the element (so a
-// lying extensions/signature length overruns the element, never the list). A
-// version this parser does not define is preserved OPAQUE, not rejected: RFC 6962
-// sec. 3.3 gives every SerializedSCT its own length prefix precisely so a client "can
-// still parse old SCTs while skipping over new SCTs whose versions they don't
-// understand", so an unknown version yields { unknown, version, rawSct } and the
-// v1-specific field decode (and the 47-byte floor) is skipped.
 function _parseSct(r, sctLen) {
   var bodyStart = r.pos;
-  var version = r.u8();   // sctLen >= 1 is guaranteed by the SerializedSCT<1..> check
+  var version = r.u8();
   if (version !== 0) {
     return { unknown: true, version: version, rawSct: r.buf.subarray(bodyStart, r.end) };
   }
@@ -217,8 +190,6 @@ function parseSctList(extValue) {
     throw new CtError("ct/empty-list", "an SCT list must contain at least one SCT (RFC 6962 sec. 3.3)");
   }
   var scts = [], unknownScts = [], all = [];
-  // The shared item counter bounds the TOTAL element count (known + preserved-
-  // unknown) before it can drive unbounded per-element work (RFC 6962 sec. 3.3).
   var sctCount = guard.limits.counter(C.LIMITS.SCT_MAX_COUNT, _ctErr, "ct/too-many-scts", "SCT");
   while (!outer.atEnd()) {
     if (outer.remaining() < 2) {
@@ -236,8 +207,6 @@ function parseSctList(extValue) {
     if (one.unknown) { var u = { version: one.version, rawSct: one.rawSct }; unknownScts.push(u); all.push(u); }
     else { scts.push(one); all.push(one); }
   }
-  // `all` preserves the exact wire order across known + unknown entries, so encodeSctList(all)
-  // reproduces the list byte-identically even when the two kinds were interleaved.
   return { scts: scts, unknownScts: unknownScts, all: all };
 }
 
@@ -292,23 +261,18 @@ function reconstructSignedData(entry, sct) {
   if (entryType !== 0 && entryType !== 1) {
     throw new CtError("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1), got " + entryType + " (RFC 6962 sec. 3.1)");
   }
-  // A fully decoded v1 SCT (from parseSctList().scts[]) -- not an opaque
-  // unknownScts entry, whose body layout is undefined and cannot be signed over.
   if (!sct || typeof sct.timestamp !== "bigint" || sct.version !== 0) {
     throw new CtError("ct/bad-input", "reconstructSignedData expects a decoded v1 SCT from parseSctList().scts[]");
   }
-  // RFC 6962 3.2: the timestamp is a uint64. The BigInt-preserving range guard
-  // refuses a value that cannot fill the fixed 8-byte field, typed, rather than
-  // letting it escape as a raw RangeError from the Buffer write.
   var tsVal = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp (RFC 6962 3.2)");
   var parts = [];
-  parts.push(Buffer.from([sct.version & 0xff]));                          // Version -- v1(0)
-  parts.push(Buffer.from([0]));                                          // SignatureType -- certificate_timestamp(0)
-  var ts = Buffer.alloc(8); ts.writeBigUInt64BE(tsVal); parts.push(ts);   // uint64 timestamp
-  parts.push(Buffer.from([(entryType >> 8) & 0xff, entryType & 0xff]));  // LogEntryType (2 bytes BE)
+  parts.push(Buffer.from([sct.version & 0xff]));
+  parts.push(Buffer.from([0]));
+  var ts = Buffer.alloc(8); ts.writeBigUInt64BE(tsVal); parts.push(ts);
+  parts.push(Buffer.from([(entryType >> 8) & 0xff, entryType & 0xff]));
   if (entryType === 0) {
     var cert = _toBuffer(entry.leafCert, "leafCert");
-    parts.push(_u24Bytes(cert.length)); parts.push(cert);                // ASN.1Cert<1..2^24-1>
+    parts.push(_u24Bytes(cert.length)); parts.push(cert);
   } else {
     var ikh = _toBuffer(entry.issuerKeyHash, "issuerKeyHash");
     if (ikh.length !== 32) {
@@ -316,32 +280,20 @@ function reconstructSignedData(entry, sct) {
     }
     var tbs = _toBuffer(entry.tbsCertificate, "tbsCertificate");
     parts.push(ikh);
-    parts.push(_u24Bytes(tbs.length)); parts.push(tbs);                  // PreCert.tbs_certificate<1..2^24-1>
+    parts.push(_u24Bytes(tbs.length)); parts.push(tbs);
   }
-  var ext = _toBuffer(sct.extensions, "sct.extensions");                 // reuse the parsed raw bytes, never re-encode
-  // RFC 6962 3.2: CtExtensions is opaque<0..2^16-1>. A longer value is
-  // unrepresentable -- its 2-byte prefix would silently truncate mod 65536,
-  // an internally inconsistent preimage -- so it is refused, matching the
-  // range check the u24 certificate lengths get.
+  var ext = _toBuffer(sct.extensions, "sct.extensions");
   if (ext.length > 0xffff) {
     throw new CtError("ct/bad-extensions", "CtExtensions must be 0..65535 bytes, got " + ext.length + " (RFC 6962 3.2)");
   }
-  parts.push(Buffer.from([(ext.length >> 8) & 0xff, ext.length & 0xff])); parts.push(ext);   // CtExtensions
+  parts.push(Buffer.from([(ext.length >> 8) & 0xff, ext.length & 0xff])); parts.push(ext);
   return Buffer.concat(parts);
 }
 
-// RFC 6962 sec. 2.1.4 constrains an SCT to SHA-256 with either ECDSA (NIST P-256) or RSA;
-// the verifier enforces exactly that rather than accepting an off-profile hash / curve a
-// conformant log never uses. The SCT hash name -> the WebCrypto digest.
 var CT_HASH = { sha256: "SHA-256" };
-// The one EC named curve an SCT log key may use (P-256), keyed by the curve OID its SPKI
-// carries -> the WebCrypto curve name + the r/s coordinate width.
 var CT_EC_CURVE = {};
 CT_EC_CURVE[oid.byName("prime256v1")] = { curve: "P-256", coordLen: 32 };
 
-// Read the SubjectPublicKeyInfo algorithm OID (+ the EC curve OID) off a log key SPKI so
-// the verifier picks the WebCrypto import descriptor from the KEY, not just the SCT's
-// self-declared signature type. Fail-closed: a non-SPKI shape throws a typed ct/bad-input.
 function _spkiAlg(spki) {
   var node;
   try { node = asn1.decode(spki); } catch (e) { throw new CtError("ct/bad-input", "the CT log public key is not a well-formed SubjectPublicKeyInfo", e); }
@@ -355,19 +307,13 @@ function _spkiAlg(spki) {
     try { out.curveOid = asn1.read.oid(algId.children[1]); }
     catch (e2) { throw new CtError("ct/bad-input", "the EC log key SPKI curve parameters are not a named-curve OID", e2); }
   } else if (out.algOid === oid.byName("rsaEncryption")) {
-    // RFC 6962 sec. 2.1.4 requires an RSA log key of at least 2048 bits -- size it from the
-    // RSAPublicKey modulus in the subjectPublicKey BIT STRING.
     var mod, exp;
     try {
       var rsaSeq = asn1.decode(asn1.read.bitString(node.children[1]).bytes);
       mod = asn1.read.integer(rsaSeq.children[0]);
       exp = asn1.read.integer(rsaSeq.children[1]);
     } catch (e3) { throw new CtError("ct/bad-input", "the RSA log key SPKI is not a well-formed RSAPublicKey", e3); }
-    // A non-positive modulus is malformed -- fail closed rather than size its absolute value.
     if (mod <= 0n) throw new CtError("ct/bad-input", "the RSA log key modulus is not a positive integer");
-    // A small or even public exponent makes RSASSA-PKCS1-v1_5 verification forgeable (with
-    // e=1 the signature is simply the encoded DigestInfo). Require an odd exponent >= 3 --
-    // critical when the log key is taken from an untrusted log list rather than a pinned key.
     if (exp < 3n || (exp & 1n) === 0n) throw new CtError("ct/bad-input", "the RSA log key public exponent must be an odd integer >= 3");
     out.rsaBits = mod.toString(2).length;
   }
@@ -412,12 +358,8 @@ function _spkiAlg(spki) {
  *   var ok = await pki.ct.verifySct({ entryType: 0, leafCert: certDer }, sct, logKey);
  */
 async function verifySct(entry, sct, logPublicKey) {
-  // reconstructSignedData validates the entry + SCT and rebuilds the exact preimage.
   var message = reconstructSignedData(entry, sct);
   var spki = _toBuffer(logPublicKey, "the CT log public key (SPKI)");
-  // RFC 6962 sec. 3.2: an SCT names its log by LogID = SHA-256(log SPKI). When the SCT
-  // carries a logId, it MUST match the key it is verified against, so an SCT is never
-  // accepted against a different log's key (a key-confusion the bare signature check misses).
   if (sct.logId != null) {
     var keyId = Buffer.from(await subtle.digest("SHA-256", spki));
     if (!keyId.equals(_toBuffer(sct.logId, "sct.logId"))) {
@@ -435,9 +377,6 @@ async function verifySct(entry, sct, logPublicKey) {
     if (!ec) throw new CtError("ct/unsupported-algorithm", "unsupported SCT log EC curve (RFC 6962 sec. 2.1.4 mandates NIST P-256)");
     imp = { name: "ECDSA", namedCurve: ec.curve };
     ver = { name: "ECDSA", hash: hashName };
-    // The SCT signature is a DER ECDSA-Sig-Value; route it through the ORDER-AWARE conformance gate
-    // (primitive, minimal, and r,s in [1, n-1] per FIPS 186-5 sec. 6.4.2 -- rejecting an out-of-range
-    // r/s >= the curve order n, not only the r=s=0 shape) before converting to raw r||s.
     sig = validator.sig.ecdsaDerToP1363(sig, ec.curve, CtError, "ct/bad-signature");
   } else if (sigInfo.signatureName === "rsa") {
     if (alg.algOid !== oid.byName("rsaEncryption")) throw new CtError("ct/bad-input", "the SCT declares an RSA signature but the log key is not an RSA key");
@@ -447,8 +386,6 @@ async function verifySct(entry, sct, logPublicKey) {
   } else {
     throw new CtError("ct/unsupported-algorithm", "unsupported SCT signature algorithm " + JSON.stringify(sigInfo.signatureName) + " (RFC 6962 sec. 2.1.4 supports ecdsa/rsa)");
   }
-  // A wrong signature resolves false from subtle.verify (a verdict); a structural failure
-  // -- an unimportable key, an algorithm/key mismatch -- is re-thrown fail-closed.
   try {
     var key = await subtle.importKey("spki", spki, imp, false, ["verify"]);
     return await subtle.verify(ver, key, sig, message);
@@ -457,24 +394,14 @@ async function verifySct(entry, sct, logPublicKey) {
   }
 }
 
-// The TLS-vector WRITER bound to the ct/* fault domain -- the encode twin of TlsReader,
-// over the shared ByteWriter engine primitive (see lib/byte-writer.js).
 function TlsWriter() { return new ByteWriter(CtError, "ct/bad-input"); }
 
-// Encode one SerializedSCT body. A v1 SCT is rebuilt from its fields in the exact _parseSct
-// order (so it round-trips byte-identically); an opaque non-v1 entry re-emits its rawSct
-// verbatim (RFC 6962 sec. 3.3 forward-compat symmetry -- encode preserves what parse preserved).
 function _encodeSctBody(sct) {
   if (!sct || typeof sct !== "object") throw new CtError("ct/bad-input", "each SCT must be an object");
   if (sct.version !== 0) {
-    // The SerializedSCT version is a single byte (RFC 6962 sec. 3.2), so a declared version must be a
-    // 0..255 integer -- reject a non-byte value rather than masking it (a masked 263 would spoof v7).
     if (typeof sct.version !== "number" || !Number.isInteger(sct.version) || sct.version < 0 || sct.version > 255) {
       throw new CtError("ct/bad-input", "an SCT version must be a byte in 0..255 (RFC 6962 sec. 3.2)");
     }
-    // An opaque entry re-emits its rawSct verbatim, but the SerializedSCT's on-wire version is
-    // rawSct[0] -- refuse a rawSct whose leading byte disagrees with the declared version, so encode
-    // never emits a list whose framing our own parser would reject or re-classify (RFC 6962 sec. 3.3).
     var raw = _toBuffer(sct.rawSct, "sct.rawSct");
     if (raw.length < 1 || raw[0] !== sct.version) {
       throw new CtError("ct/bad-input", "an opaque SCT's rawSct[0] must equal its declared version (RFC 6962 sec. 3.3)");
@@ -482,15 +409,15 @@ function _encodeSctBody(sct) {
     return raw;
   }
   var w = new TlsWriter();
-  w.u8(0, "ct/bad-input");                                                            // Version -- v1(0)
+  w.u8(0, "ct/bad-input");
   var logId = _toBuffer(sct.logId, "sct.logId");
   if (logId.length !== LOGID_BYTES) throw new CtError("ct/bad-input", "an SCT logId must be exactly " + LOGID_BYTES + " bytes (RFC 6962 sec. 3.2)");
   w.bytes(logId);
-  w.u64(guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp"), "ct/bad-input");   // uint64 timestamp
-  w.vector(2, 0, 0xffff, _toBuffer(sct.extensions, "sct.extensions"), "ct/bad-input");  // CtExtensions<0..2^16-1>
-  w.u8(sct.hashAlg, "ct/bad-input");                                                   // digitally-signed hash
-  w.u8(sct.sigAlg, "ct/bad-input");                                                    // digitally-signed signature
-  w.vector(2, 0, 0xffff, _toBuffer(sct.signature, "sct.signature"), "ct/bad-input");   // signature<0..2^16-1>
+  w.u64(guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp"), "ct/bad-input");
+  w.vector(2, 0, 0xffff, _toBuffer(sct.extensions, "sct.extensions"), "ct/bad-input");
+  w.u8(sct.hashAlg, "ct/bad-input");
+  w.u8(sct.sigAlg, "ct/bad-input");
+  w.vector(2, 0, 0xffff, _toBuffer(sct.signature, "sct.signature"), "ct/bad-input");
   return w.build();
 }
 
@@ -536,26 +463,18 @@ function encodeSctList(scts) {
   for (var i = 0; i < scts.length; i++) {
     sctCount.tick();
     var ew = new TlsWriter();
-    ew.vector(2, 1, 0xffff, _encodeSctBody(scts[i]), "ct/bad-input");   // SerializedSCT<1..2^16-1>
+    ew.vector(2, 1, 0xffff, _encodeSctBody(scts[i]), "ct/bad-input");
     var el = ew.build();
     total += el.length;
-    // Enforce the sct_list<1..2^16-1> body cap INCREMENTALLY, so an over-long list fails at the first
-    // element that crosses the bound instead of accumulating the whole (potentially large) set first.
     if (total > 0xffff) throw new CtError("ct/too-large", "the SCT list body exceeds the 65535-byte maximum (RFC 6962 sec. 3.3)");
     elements.push(el);
   }
   var lw = new TlsWriter();
-  lw.vector(2, 1, 0xffff, Buffer.concat(elements, total), "ct/too-large");   // sct_list<1..2^16-1>
-  return asn1.build.octetString(lw.build());                                 // RFC 6962 sec. 3.3 DER OCTET STRING wrap
+  lw.vector(2, 1, 0xffff, Buffer.concat(elements, total), "ct/too-large");
+  return asn1.build.octetString(lw.build());
 }
 
-// A CT log private key -> its PKCS#8 DER (for WebCrypto sign) + the SPKI DER (for the LogID +
-// the sec. 2.1.4 algorithm profile). Accepts a PKCS#8 DER Buffer, a PEM string, a node
-// KeyObject, or a { key, format, type } input.
 function _logKeyMaterial(logKey) {
-  // Every key operation runs inside the guard: a duck-typed impostor (an object carrying an
-  // asymmetricKeyType but not a real KeyObject) fails at export/createPublicKey and surfaces the
-  // typed ct/bad-input, never a raw TypeError. The private-key check keeps its own CtError.
   try {
     var keyObj;
     if (logKey && typeof logKey === "object" && logKey.asymmetricKeyType) keyObj = logKey;
@@ -628,7 +547,6 @@ async function signSct(entry, logKey, opts) {
   if (opts.logId != null && !_toBuffer(opts.logId, "opts.logId").equals(logId)) {
     throw new CtError("ct/bad-input", "opts.logId does not match SHA-256 of the log key (RFC 6962 sec. 3.4)");
   }
-  // Reuse the ONE preimage builder the verifier uses -- sign and verify cannot diverge.
   var preimage = reconstructSignedData(entry, { version: 0, timestamp: timestamp, extensions: extensions });
   var priv = await subtle.importKey("pkcs8", mat.pkcs8, imp, false, ["sign"]);
   var sigRaw = Buffer.from(await subtle.sign(sign, priv, preimage));
@@ -639,23 +557,14 @@ async function signSct(entry, logKey, opts) {
     timestamp: timestamp,
     extensions: extensions,
     hashAlg: hashAlg, sigAlg: sigAlg,
-    // The `|| null` fallbacks mirror parseSctList's shape; unreachable here since signSct only ever
-    // emits the in-map sha256(4) + ecdsa(3)/rsa(1) code points (coverage residual).
     signatureAlgorithm: { hash: hashAlg, hashName: HASH_ALGORITHMS[hashAlg] || null, signature: sigAlg, signatureName: SIGNATURE_ALGORITHMS[sigAlg] || null },
     signature: signature,
   };
 }
 
-// ---- CT log-list trust surface (RFC 6962 sec. 3.2 + the CT log-list v3 JSON schema) --------------
 
-// The recognized CT log states (the schema `state` oneOf) mapped to a trust decision (the deployed
-// Chrome/Apple CT policy): usable/qualified/readonly are trusted; retired is CONDITIONALLY trusted
-// (only for an SCT timestamped before the retirement instant, checked at verify); pending/rejected
-// are not trusted.
 var LOG_STATE_TRUST = { pending: "no", qualified: "yes", usable: "yes", readonly: "yes", retired: "conditional", rejected: "no" };
 
-// Decode a log's `state` oneOf: EXACTLY ONE recognized member, whose timestamp is an RFC 3339 instant.
-// Zero, multiple, or an unrecognized member -> ct/bad-state (fail-closed, never a silent default-trust).
 function _parseLogState(state) {
   if (state == null || typeof state !== "object") throw _ctErr("ct/bad-state", "a CT log entry is missing its state");
   var keys = Object.keys(state);
@@ -669,7 +578,6 @@ function _parseLogState(state) {
   return { name: name, since: since, trusted: trust === "yes", conditional: trust === "conditional" };
 }
 
-// Decode a log's `temporal_interval` (both bounds RFC 3339, start strictly before end) or null.
 function _parseTemporalInterval(ti) {
   if (ti == null) return null;
   if (typeof ti !== "object") throw _ctErr("ct/bad-log-list", "a CT log temporal_interval must be an object");
@@ -680,17 +588,13 @@ function _parseTemporalInterval(ti) {
   return { startInclusive: start, endExclusive: end };
 }
 
-// One log-list entry -> a constraint-carrying trusted-log record. The load-bearing M-BIND step: the
-// log-id is RECOMPUTED as SHA-256(SPKI) and MUST equal the stated log_id (RFC 6962 sec. 3.2), so the
-// trusted set is keyed by the authoritative binding, never the document's self-assertion -- a swapped
-// key or a flipped id is refused. The key is also validated as a well-formed, on-profile SPKI at ingest.
 function _parseLog(log, operatorName) {
   if (log == null || typeof log !== "object") throw _ctErr("ct/bad-log-list", "a CT log entry is not an object");
   if (typeof log.key !== "string" || typeof log.log_id !== "string") throw _ctErr("ct/bad-log-list", "a CT log entry is missing its key or log_id");
   var spki = guard.encoding.base64(log.key, C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, "ct/bad-log-list", "the CT log key");
   var statedId = guard.encoding.base64(log.log_id, 64, _ctErr, "ct/bad-log-list", "the CT log id");
   if (statedId.length !== 32) throw _ctErr("ct/bad-log-list", "a CT log_id must be 32 bytes (SHA-256), got " + statedId.length);
-  _spkiAlg(spki);   // fail-fast: a non-SPKI / malformed key (or a forgeable RSA e < 3) throws ct/bad-input; the full EC-curve / RSA-size profile is enforced by verifySct at verify time
+  _spkiAlg(spki);
   var logId = nodeCrypto.createHash("sha256").update(spki).digest();
   if (!logId.equals(statedId)) throw _ctErr("ct/log-id-mismatch", "the CT log_id does not match SHA-256 of the log key (RFC 6962 sec. 3.2)");
   return {
@@ -699,16 +603,12 @@ function _parseLog(log, operatorName) {
     url: typeof log.url === "string" ? log.url : (typeof log.submission_url === "string" ? log.submission_url : null),
     mmd: typeof log.mmd === "number" ? log.mmd : null,
     operator: operatorName, state: _parseLogState(log.state), temporalInterval: _parseTemporalInterval(log.temporal_interval),
-    trusted: false,   // set below from the state (usable/qualified/readonly), so a consumer reads a plain bool
+    trusted: false,
   };
 }
 
-// Two entries for one recomputed log-id must be byte-identical (collapse) or the list is inconsistent.
 function _sameTemporal(a, b) {
   if (a == null && b == null) return true;
-  // Coverage residual: the || guard is exercised across null/interval, interval/null, and both-interval
-  // inputs; the remaining c8 sub-arm is a short-circuit path (when `a == null` is true, `b == null` is
-  // never evaluated) with no additional reachable input.
   if (a == null || b == null) return false;
   return guard.time.instantOf(a.startInclusive) === guard.time.instantOf(b.startInclusive) &&
     guard.time.instantOf(a.endExclusive) === guard.time.instantOf(b.endExclusive);
@@ -772,40 +672,31 @@ function parseLogList(json, opts) {
       if (!Array.isArray(arr)) throw _ctErr("ct/bad-log-list", "a CT log-list operator's logs / tiled_logs must be an array");
       for (var j = 0; j < arr.length; j++) {
         var rec = _parseLog(arr[j], op.name);
-        rec.trusted = rec.state.trusted;   // usable/qualified/readonly; retired stays false (conditional at verify)
+        rec.trusted = rec.state.trusted;
         var prev = byLogId[rec.logIdHex];
         if (prev) {
           if (!_logsAgree(prev, rec)) throw _ctErr("ct/duplicate-log", "two CT log entries share log-id " + rec.logIdHex + " but disagree");
-          continue;   // a byte-identical duplicate collapses to the one already recorded
+          continue;
         }
         byLogId[rec.logIdHex] = rec;
         logs.push(rec);
       }
     }
   }
-  // Surface the document's own version + timestamp additively (the staleness surface the live-fetch client
-  // returns for the caller to police freshness). Read LENIENTLY -- a missing / non-string / unparseable
-  // scalar yields null, never a new throw, so every existing caller of the { logs, byLogId } shape is
-  // behavior-preserving.
   var version = typeof doc.version === "string" ? doc.version : null;
   var timestamp = (typeof doc.log_list_timestamp === "string" && rfc3339.isValid(doc.log_list_timestamp))
     ? rfc3339.parse(doc.log_list_timestamp, _ctErr, "ct/bad-date", "log_list_timestamp") : null;
   return { logs: logs, byLogId: byLogId, version: version, timestamp: timestamp };
 }
 
-// The covered certificate's notAfter for the temporal gate: an explicit opts.certNotAfter, else derived
-// from a leafCert (entryType 0) via the shipped x509 parser, else null (a precert TBS can't be parsed).
 function _resolveNotAfter(entry, opts) {
   if (guard.time.isDate(opts.certNotAfter)) return opts.certNotAfter;
   if (entry && entry.entryType === 0 && entry.leafCert != null) {
-    // Inline require (circular-load): ct.js is loaded before schema-x509 finishes initializing in the
-    // index chain (schema-x509 -> schema-pkix is mid-init when ct.js is first required), so a top-level
-    // require would see a half-built pkix. Deferred to first use, when every module is initialized.
     var x509 = require("./schema-x509.js");   // allow:inline-require -- circular load with schema-x509 -> schema-pkix (see note above)
     try {
       return x509.parse(_toBuffer(entry.leafCert, "entry.leafCert")).validity.notAfter;
     } catch (_e) {
-      return null;   // a malformed leafCert -> no resolvable notAfter -> fail-closed ct/temporal-interval at the caller
+      return null;
     }
   }
   return null;
@@ -850,33 +741,18 @@ function _resolveNotAfter(entry, opts) {
  *     state: { usable: { timestamp: "2026-01-01T00:00:00Z" } } }] }] }), "utf8"));
  *   var res = await pki.ct.verifySctWithLogList(sctEntry, embeddedSct, logList);   // { valid, logId, logIdHex, operator, logState, timestamp }
  */
-// The pure, NON-THROWING log resolution + state + temporal classifier shared by verifySctWithLogList
-// (which throws the mapped code on a non-ok status) and verifySctList (which records the code into a
-// result row and continues). Returns { status, log?, code?, message? } where status is one of
-// ok | bad-input | not-found | untrusted | temporal. A mis-shaped sct.timestamp (in the retired-log
-// gate) or a malformed opts.certNotAfter (in the temporal gate, via within) still THROWS -- those are
-// caller mis-shapes, not per-SCT trust outcomes (the three-tier rule: bad input throws, a per-SCT
-// verdict is recorded). The state and temporal gate semantics are verbatim from the original
-// verifySctWithLogList body, so its shipped RED vectors are the behavior guard for this refactor.
 function _classifyLog(sct, logList, entry, opts) {
   if (logList == null || typeof logList !== "object" || logList.byLogId == null) return { status: "bad-input", code: "ct/bad-input", message: "logList must be a pki.ct.parseLogList result" };
   if (sct == null || typeof sct !== "object" || typeof sct.logIdHex !== "string") return { status: "bad-input", code: "ct/bad-input", message: "the SCT is missing its logIdHex" };
   var log = logList.byLogId[sct.logIdHex];
   if (log == null) return { status: "not-found", code: "ct/log-not-found", message: "no trusted CT log matches the SCT's logId " + sct.logIdHex };
-  // State gate (fail-closed): trusted proceed; retired only before its retirement; else untrusted.
   if (!log.state.trusted) {
     if (!log.state.conditional) return { status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log state '" + log.state.name + "' is not trusted" };
     var ts = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp");
     if (ts >= BigInt(guard.time.instantOf(log.state.since))) return { status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")" };
   }
-  // Temporal gate (fail-closed): the covered cert's notAfter must be in [start_inclusive, end_exclusive).
   if (log.temporalInterval) {
     var notAfter = _resolveNotAfter(entry, opts);
-    // An unresolvable notAfter is a failure for this windowed SCT, never a silent skip. within() then
-    // validates notAfter fail-closed before comparing: an Invalid Date is instanceof Date yet NaN, and
-    // NaN < x / NaN >= x are both false, so an unvalidated notAfter would BYPASS the containment. A
-    // malformed opts.certNotAfter throws inside within (a caller mis-shape); an out-of-window one is
-    // this recorded temporal status.
     if (notAfter == null) return { status: "temporal", log: log, code: "ct/temporal-interval", message: "the windowed CT log has no resolvable covered-certificate notAfter (pass a valid opts.certNotAfter)" };
     if (!guard.time.within(notAfter, log.temporalInterval.startInclusive, log.temporalInterval.endExclusive, _ctErr, "ct/temporal-interval", "the covered certificate notAfter (pass a valid opts.certNotAfter)")) {
       return { status: "temporal", log: log, code: "ct/temporal-interval", message: "the covered certificate's notAfter is outside the CT log's temporal_interval" };
@@ -889,10 +765,7 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
   opts = opts || {};
   var c = _classifyLog(sct, logList, entry, opts);
   if (c.status !== "ok") throw _ctErr(c.code, c.message);
-  // The crypto verdict alone hid WHICH trusted log accepted the SCT and when. Surface the resolved log
-  // record so a caller can record the operator / log state / timestamp for a policy decision instead of
-  // re-deriving them, rather than reading a bare boolean that drops the whole record it just resolved.
-  var valid = await verifySct(entry, sct, c.log.key);   // re-checks the logId binding
+  var valid = await verifySct(entry, sct, c.log.key);
   return {
     valid: valid,
     logId: c.log.logId,
@@ -903,10 +776,8 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
   };
 }
 
-// Options verifySctList reads. All optional; the defaults are the RFC 6962 sec. 3.3 floor (>= 1).
 var _VERIFY_SCT_LIST_OPTS = { minScts: 1, minOperators: 1, certNotAfter: 1, at: 1 };
 
-// A caller-supplied policy threshold: a positive integer, or null when omitted (defaulted by the caller).
 function _policyCount(v, name) {
   if (v == null) return null;
   if (typeof v !== "number" || !intrinsic.isInteger(v) || v < 1) throw _ctErr("ct/bad-input", name + " must be a positive integer");
@@ -965,32 +836,18 @@ async function verifySctList(entry, list, logList, opts) {
   var minOperators = _policyCount(opts.minOperators, "opts.minOperators"); if (minOperators == null) minOperators = 1;
   if (logList == null || typeof logList !== "object" || logList.byLogId == null) throw _ctErr("ct/bad-input", "logList must be a pki.ct.parseLogList result");
   if (entry == null || (entry.entryType !== 0 && entry.entryType !== 1)) throw _ctErr("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1) (RFC 6962 sec. 3.1)");
-  // The validation time, when supplied, arms the RFC 6962 sec. 5.2 rule that a future-dated SCT is
-  // rejected: a log cannot have issued an SCT after the moment we verify it, so its timestamp must not
-  // be later than `at`. Held as a millisecond Number and compared against the SCT's BigInt uint64
-  // timestamp (a BigInt-vs-Number relational comparison is exact).
   var atMs = null;
   if (opts.at != null) { guard.time.assertValid(opts.at, _ctErr, "ct/bad-input", "opts.at (the validation time)"); atMs = guard.time.instantOf(opts.at); }
-  // A present certNotAfter must be a valid Date: a non-Date is a caller mis-shape that throws, never a
-  // value silently ignored (entryType 0 would fall back to the certificate's own notAfter) or demoted to
-  // a per-SCT temporal failure (entryType 1) -- the malformed-options contract, matching opts.at.
   if (opts.certNotAfter != null) guard.time.assertValid(opts.certNotAfter, _ctErr, "ct/bad-input", "opts.certNotAfter (the covered certificate's notAfter)");
-  // Validate the shared entry's required fields up front: a mis-shaped entry is a caller error that
-  // throws (not a per-SCT row or a verdict rendered without examining it), even when the SCT list is
-  // empty. The same fields reconstructSignedData reads for the preimage.
   if (entry.entryType === 0) { _toBuffer(entry.leafCert, "entry.leafCert"); }
   else {
     if (_toBuffer(entry.issuerKeyHash, "entry.issuerKeyHash").length !== 32) throw _ctErr("ct/bad-issuer-key-hash", "entry.issuerKeyHash must be exactly 32 bytes (SHA-256 of the issuer SPKI, RFC 6962 sec. 3.2)");
     _toBuffer(entry.tbsCertificate, "entry.tbsCertificate");
   }
-  // Normalize the list into the known v1 SCTs plus the count of forward-compat unknown-version entries
-  // (M7 -- their body layout is undefined, so they are unverifiable, never a valid SCT, never a throw).
   var scts, unknownScts;
   if (list != null && intrinsic.isArray(list.scts)) { scts = list.scts; unknownScts = intrinsic.isArray(list.unknownScts) ? list.unknownScts.length : 0; }
   else if (intrinsic.isArray(list)) { scts = list; unknownScts = 0; }
   else throw _ctErr("ct/bad-input", "list must be a pki.ct.parseSctList result, its .scts array, or an array of decoded v1 SCTs");
-  // Bound the per-SCT verification work a caller-supplied array can demand to the same cap parseSctList
-  // enforces on wire input, so a bare oversized array cannot force an unbounded run of signature checks.
   if (scts.length > C.LIMITS.SCT_MAX_COUNT) throw _ctErr("ct/too-many-scts", "the SCT list has " + scts.length + " entries, exceeding the SCT_MAX_COUNT cap of " + C.LIMITS.SCT_MAX_COUNT + " (RFC 6962 sec. 3.3)");
 
   var results = [], validScts = 0, operators = [], seenOps = intrinsic.create(null), seenLogs = intrinsic.create(null);
@@ -999,9 +856,6 @@ async function verifySctList(entry, list, logList, opts) {
     var row = { logIdHex: (sct && typeof sct.logIdHex === "string") ? sct.logIdHex : null, valid: false,
       operator: null, logState: null,
       timestamp: (sct && typeof sct.timestamp === "bigint") ? sct.timestamp : null, code: undefined, reason: undefined };
-    // Classification can THROW for a malformed per-SCT field (a bad timestamp on a retired-log match):
-    // that is a recorded per-SCT outcome, never a thrown aggregate abort, so it matches the usable-log
-    // malformed-SCT path below and one bad SCT cannot sink the verdict or a valid sibling.
     var c;
     try { c = _classifyLog(sct, logList, entry, opts); }
     catch (e) {
@@ -1010,29 +864,17 @@ async function verifySctList(entry, list, logList, opts) {
     }
     if (c.log) { row.operator = c.log.operator; row.logState = c.log.state.name; }
     if (c.status !== "ok") { row.code = c.code; row.reason = c.message; intrinsic.push(results, row); continue; }
-    // A trust exclusion is a recorded code above; the crypto check below is false-is-a-verdict. But a
-    // structurally-defective SCT from a trusted log (a malformed signature encoding, an unsupported hash
-    // or curve) makes verifySct THROW a typed CtError -- for the aggregate that is a recorded per-SCT
-    // outcome (M10, the verdict-collector tier), never a thrown call that would sink the verdict or a
-    // valid sibling. A non-PkiError (an unexpected bug) is re-thrown, never swallowed into a verdict.
     var ok;
     try { ok = await verifySct(entry, sct, c.log.key); }
     catch (e) {
       if (!(e && e.isPkiError)) throw e;
       row.code = e.code; row.reason = e.message; intrinsic.push(results, row); continue;
     }
-    // RFC 6962 sec. 5.2: reject a future-dated SCT even when its signature verifies -- a log cannot have
-    // issued it after the validation time, so it is recorded as a rejection and never counted. An SCT
-    // dated after the certificate's OWN notAfter is deliberately NOT rejected: RFC 6962 sec. 5.1 permits
-    // a log to accept an already-expired certificate, so such an SCT is legitimate.
     if (ok === true && atMs != null && sct.timestamp > atMs) {
       row.code = "ct/future-timestamp"; row.reason = "the SCT timestamp is later than the validation time (RFC 6962 sec. 5.2)";
       intrinsic.push(results, row); continue;
     }
     row.valid = ok === true;
-    // Count each distinct trusted log once: a duplicated SCT, or a second SCT from the same log, is one
-    // attestation, so a repeat cannot inflate validScts past a minScts policy (the count is over the set
-    // of logs, not raw SCT copies). The duplicate row is still recorded for diagnostics.
     if (row.valid && !seenLogs[sct.logIdHex]) {
       seenLogs[sct.logIdHex] = true;
       validScts++;
@@ -1043,7 +885,7 @@ async function verifySctList(entry, list, logList, opts) {
   var operatorCount = operators.length;
   var policyOk = validScts >= minScts && operatorCount >= minOperators;
   return {
-    valid: policyOk,   // canonical toolkit-wide verdict alias, beside this verb's `policyOk`
+    valid: policyOk,
     policyOk: policyOk, totalScts: scts.length + unknownScts, validScts: validScts, unknownScts: unknownScts,
     operatorCount: operatorCount, operators: operators, required: { minScts: minScts, minOperators: minOperators },
     results: results,
@@ -1051,12 +893,7 @@ async function verifySctList(entry, list, logList, opts) {
   };
 }
 
-// A cert / issuer argument as a parsed x509: a DER Buffer, a PEM string, or an unmodified
-// pki.schema.x509.parse result. Routed through guard.parsed (provenance-based, getter-free) so a
-// caller object cannot spoof "already parsed" through a lying accessor; a malformed one is a typed
-// ct/bad-cert-entry, never a silently-skipped input.
 function _asParsedCert(v, field) {
-  // Inline require (circular load with schema-x509 -> schema-pkix), matching _resolveNotAfter above.
   var x509 = require("./schema-x509.js");   // allow:inline-require -- circular load (see _resolveNotAfter)
   return guard.parsed.acceptDerived(v, "certificate", x509.parse, _ctErr, "ct/bad-cert-entry", field);
 }
@@ -1097,14 +934,8 @@ function _asParsedCert(v, field) {
  *   var verdict = await pki.ct.verifySctList(entry, pki.ct.parseSctList(sctExtValue), logList,
  *     { certNotAfter: pki.schema.x509.parse(leafCertDer).validity.notAfter });
  */
-// The issuer contributes only its SubjectPublicKeyInfo (issuerKeyHash = SHA-256 of it), so it accepts
-// anything x509CertEntry's cert does PLUS a bare { subjectPublicKeyInfo: { bytes } } -- a trust anchor
-// carries its key without a full certificate, and requiring a whole cert there would refuse a leaf
-// validated directly under an anchor.
 function _issuerSpki(v, field) {
   if (v != null && typeof v === "object" && !intrinsic.isBuffer(v) && v.subjectPublicKeyInfo != null && v.subjectPublicKeyInfo.bytes != null) {
-    // Validate the bare-form bytes as a BufferSource so a malformed value fails through the typed CT
-    // error contract, not a native TypeError from the SHA-256 update downstream.
     return guard.bytes.view(v.subjectPublicKeyInfo.bytes, CtError, "ct/bad-cert-entry", field + " subjectPublicKeyInfo.bytes");
   }
   return _asParsedCert(v, field).subjectPublicKeyInfo.bytes;
@@ -1113,27 +944,20 @@ function _issuerSpki(v, field) {
 function x509CertEntry(cert, issuer) {
   var leaf = _asParsedCert(cert, "cert"), issSpki = _issuerSpki(issuer, "issuer");
   var tbs = asn1.decode(leaf.tbsBytes);
-  // extensions [3] EXPLICIT is the last TBSCertificate field (context-constructed tag 3).
   var wrapIdx = -1;
   for (var i = 0; i < tbs.children.length; i++) {
     if (tbs.children[i].tagClass === "context" && tbs.children[i].tagNumber === 3) { wrapIdx = i; break; }
   }
   if (wrapIdx < 0) throw _ctErr("ct/no-sct-extension", "the certificate has no extensions, so it carries no embedded SCT list (RFC 6962 sec. 3.2)");
-  var extsSeq = tbs.children[wrapIdx].children[0];   // the SEQUENCE OF Extension
+  var extsSeq = tbs.children[wrapIdx].children[0];
   var sctOid = asn1.build.oid(oid.byName("signedCertificateTimestampList"));
   var kept = [], removed = 0;
   for (var j = 0; j < extsSeq.children.length; j++) {
     var ext = extsSeq.children[j];
-    // ext.children[0] is the extnID OID node; compare its exact TLV bytes to the SCT-list OID.
     if (ext.children[0] && intrinsic.bufferEquals(ext.children[0].bytes, sctOid)) { removed++; continue; }
     intrinsic.push(kept, ext.bytes);
   }
   if (removed === 0) throw _ctErr("ct/no-sct-extension", "the certificate carries no signedCertificateTimestampList extension (RFC 6962 sec. 3.2)");
-  // Rebuild the TBSCertificate SEQUENCE from raw child bytes; canonical DER lengths reproduce the
-  // original framing minus the removed extension. When the SCT-list was the ONLY extension, `kept` is
-  // empty and the extensions field is dropped ENTIRELY -- RFC 5280 Extensions is SIZE (1..MAX) and the
-  // [3] field is OPTIONAL, so an empty [3] SEQUENCE {} would be invalid and would not match the signed
-  // precert TBS, whose extensions field is likewise absent once its sole poison extension is removed.
   var tbsChildren = [];
   for (var k = 0; k < tbs.children.length; k++) {
     if (k !== wrapIdx) { intrinsic.push(tbsChildren, tbs.children[k].bytes); continue; }
@@ -1176,12 +1000,10 @@ function x509CertEntry(cert, issuer) {
  */
 async function verifyLogListSignature(json, signature, publicKey) {
   var message = typeof json === "string" ? Buffer.from(json) : _toBuffer(json, "the CT log list JSON");
-  // Bound the signed message before the digest/verify (the same cap parseLogList enforces) so a hostile
-  // caller cannot force unbounded hashing work on an oversized input (CWE-400).
   guard.limits.byteCap(message, C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, "ct/too-large", "the CT log list");
   var sig = _toBuffer(signature, "the CT log list signature");
   var spki = _toBuffer(publicKey, "the CT log list signer public key (SPKI)");
-  var alg = _spkiAlg(spki);   // fail-closed: a non-SPKI key or a forgeable RSA e < 3 throws ct/bad-input
+  var alg = _spkiAlg(spki);
   var imp, ver;
   if (alg.algOid === oid.byName("rsaEncryption")) {
     if (!(alg.rsaBits >= 2048)) throw new CtError("ct/unsupported-algorithm", "the CT log-list signer RSA key is below the 2048-bit minimum");
@@ -1192,15 +1014,10 @@ async function verifyLogListSignature(json, signature, publicKey) {
     if (!ec) throw new CtError("ct/unsupported-algorithm", "unsupported CT log-list signer EC curve (only NIST P-256)");
     imp = { name: "ECDSA", namedCurve: ec.curve };
     ver = { name: "ECDSA", hash: "SHA-256" };
-    // A DER ECDSA-Sig-Value: route through the ORDER-AWARE conformance gate (primitive, minimal, and
-    // r,s in [1, n-1] per FIPS 186-5 sec. 6.4.2 -- defeating the CVE-2022-21449 r=s=0 forgery AND an
-    // out-of-range r/s >= the curve order n) before the raw r||s conversion.
     sig = validator.sig.ecdsaDerToP1363(sig, ec.curve, CtError, "ct/bad-signature");
   } else {
     throw new CtError("ct/unsupported-algorithm", "unsupported CT log-list signer key algorithm (only rsaEncryption / ecPublicKey P-256)");
   }
-  // A wrong signature resolves false from subtle.verify (a verdict); a structural failure -- an
-  // unimportable key -- is re-thrown fail-closed.
   try {
     var key = await subtle.importKey("spki", spki, imp, false, ["verify"]);
     return await subtle.verify(ver, key, sig, message);
@@ -1209,30 +1026,20 @@ async function verifyLogListSignature(json, signature, publicKey) {
   }
 }
 
-// ---- CT log-list live-fetch client (RFC 6962 sec. 3.2; the Chrome/Apple detached log_list.sig model) ----
 
 var DEFAULT_FETCH_TIMEOUT = C.TIME.seconds(30);
 var MAX_FETCH_TIMEOUT = C.TIME.seconds(600);
 var KNOWN_FETCH_OPTS = { url: 1, signerKey: 1, sigUrl: 1, transport: 1, tls: 1, headers: 1, timeout: 1, maxResponseBytes: 1, requireJsonContentType: 1 };
 
-// Map opts.tls (operator-facing) to the transport request.tls shape. rejectUnauthorized is NOT here -- the
-// transport forces it on unconditionally; the verb never disables server verification.
 function _tlsForFetch(opts) {
   var t = opts.tls || {};
   return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
 }
 
-// Do the two URLs share an origin (scheme + host + port)? Both args are already-validated absolute URL
-// strings (each came from `new URL(...).href` after the https gate), so the parse cannot fail here.
 function _sameOrigin(a, b) { return new URL(a).origin === new URL(b).origin; }
 
-// The response content-type token (before any ;-parameters), lowercased.
 function _fetchCtypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
 
-// Parse a URL and require https BEFORE any request -- runs even when a transport is INJECTED, so an insecure
-// URL never reaches the wire (the CT log list is fetched over TLS; the detached signature is the authenticity
-// gate, but the fetch stays confined to https, consistent with the est/acme clients). A parse failure is
-// ct/bad-url; a non-https scheme is ct/insecure-url.
 function _parseHttpsUrl(u, label) {
   var parsed;
   try { parsed = new URL(String(u)); }
@@ -1241,10 +1048,6 @@ function _parseHttpsUrl(u, label) {
   return parsed;
 }
 
-// Derive the detached-signature URL from the (already parsed, https) log_list.json URL by the Chrome/Apple
-// convention: the final ".json" path suffix rewritten to ".sig". A path that does NOT end in ".json" cannot
-// yield an unambiguous sig URL, so the caller must pass opts.sigUrl explicitly (guards never guess a value).
-// The derived URL inherits the json URL's https origin.
 function _sigUrlFor(parsed) {
   if (!_endsWithJson(parsed.pathname)) throw _ctErr("ct/bad-input", "cannot derive the detached-signature URL from a non-.json path (" + JSON.stringify(parsed.pathname) + "); pass opts.sigUrl explicitly");
   var sig = new URL(parsed.href);
@@ -1252,15 +1055,7 @@ function _sigUrlFor(parsed) {
   return sig.href;
 }
 
-// One bounded GET returning { body: Buffer, status, contentType, tls }. The body is re-viewed through the
-// byte guard (a detached backing buffer fails as ct/bad-input, never a silent empty body); a string body
-// falls back to a UTF-8 encode -- the width a real socket already counts -- so the size cap and verify/parse
-// see the same bytes, never a typed array stringified to "48,130,..." garbage. An oversized body ->
-// ct/response-too-large (the post-hoc twin of the transport's streaming abort); a non-200 -> ct/http-error
-// carrying the status; an empty 200 body -> ct/empty-response. Both GETs must succeed before verify.
 function _fetchBody(transport, url, req, label) {
-  // Wrap the transport call in a Promise.resolve().then so a SYNCHRONOUS throw from an injected transport
-  // becomes a rejection the catch below can type (not an uncaught throw crossing the API boundary).
   return Promise.resolve().then(function () {
     return transport({ method: "GET", url: url, headers: req.headers, tls: req.tls, timeout: req.timeout, maxResponseBytes: req.maxResponseBytes });
   }).then(function (res) {
@@ -1275,10 +1070,6 @@ function _fetchBody(transport, url, req, label) {
     if (body.length === 0) throw _ctErr("ct/empty-response", "the CT server returned a 200 with an empty " + label);
     return { body: body, status: res.status, contentType: _fetchCtypeToken(h), tls: res.tls || null };
   }).catch(function (e) {
-    // An already-typed PkiError (the default transport's ct/*, this function's own ct/* verdicts, or a
-    // caller-thrown typed error) propagates UNCHANGED; any other throw from an injected transport -- a raw
-    // network Error, a synchronous throw -- is wrapped as a typed ct/transport-error so a fetch failure never
-    // crosses the API boundary untyped (the documented typed-error contract).
     if (e instanceof PkiError) throw e;
     throw _ctErr("ct/transport-error", "the CT " + label + " request failed in the transport", e);
   });
@@ -1327,17 +1118,9 @@ async function fetchLogList(opts) {
   guard.identifier.assertKnownKeys(opts, KNOWN_FETCH_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
   if (opts.signerKey == null) throw _ctErr("ct/bad-input", "opts.signerKey is required -- the caller-pinned CT log-list distributor SPKI (there is no baked-in key)");
   if (opts.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log_list.json URL (there is no baked-in vendor URL)");
-  // Parse + https-gate both URLs BEFORE any transport call -- the gate runs across the injectable seam so an
-  // http URL never reaches even an injected transport (the documented HTTPS guarantee holds either way).
   var jsonParsed = _parseHttpsUrl(opts.url, "URL");
   var jsonUrl = jsonParsed.href;
   var sigUrl = opts.sigUrl != null ? _parseHttpsUrl(opts.sigUrl, "signature URL").href : _sigUrlFor(jsonParsed);
-  // The detached signature MUST share the log-list URL's origin. The log-list trust rests on the pinned-key
-  // signature, not on where the signature is hosted; requiring one origin means both GETs carry the same
-  // per-origin credentials + TLS identity with NO cross-origin leak (an Authorization/Cookie header or an
-  // mTLS client certificate configured for the log-list host can never reach a different signature host). A
-  // caller with a genuinely separate signature host fetches it itself and composes verifyLogListSignature +
-  // parseLogList directly.
   if (!_sameOrigin(jsonUrl, sigUrl)) throw _ctErr("ct/bad-input", "opts.sigUrl must share the log-list URL's origin (" + jsonParsed.origin + "); a cross-origin detached-signature host is not supported");
   var transport = opts.transport;
   if (!transport) {
@@ -1348,23 +1131,15 @@ async function fetchLogList(opts) {
   }
   var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_FETCH_TIMEOUT, { E: _ctErr, code: "ct/bad-input", min: 1, max: MAX_FETCH_TIMEOUT });
   var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.CT_LOG_LIST_MAX_BYTES, { E: _ctErr, code: "ct/bad-input", min: 1, max: C.LIMITS.CT_LOG_LIST_MAX_BYTES });
-  // Forward custom opts.headers but STRIP the request-framing headers so a caller cannot desync the request
-  // framing; the verb owns the GET method (no body).
   var headers = {};
   Object.keys(opts.headers || {}).forEach(function (k) {
     var lk = k.toLowerCase();
     if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = opts.headers[k];
   });
   var req = { headers: headers, tls: _tlsForFetch(opts), timeout: timeout, maxResponseBytes: maxResponseBytes };
-  // Two bounded GETs; BOTH must succeed before verify. The JSON is fetched first (its content-type is the one
-  // opts.requireJsonContentType polices). Both requests carry the same per-origin credentials + TLS identity,
-  // which is sound because the signature shares the log-list origin (gated above).
   var jsonRes = await _fetchBody(transport, jsonUrl, req, "CT log-list JSON");
   if (opts.requireJsonContentType === true && jsonRes.contentType !== "application/json") throw _ctErr("ct/bad-content-type", "the CT log-list JSON GET returned content-type " + JSON.stringify(jsonRes.contentType || null) + " (opts.requireJsonContentType is set)");
   var sigRes = await _fetchBody(transport, sigUrl, req, "CT log-list signature");
-  // VERIFY BEFORE PARSE: the fetched JSON is untrusted until the detached signature verifies over the RAW
-  // bytes against the caller-pinned key. parseLogList runs ONLY on a strict === true verdict, over the SAME
-  // Buffer -- nothing re-serialized between verify and parse.
   var ok = await verifyLogListSignature(jsonRes.body, sigRes.body, opts.signerKey);
   if (ok !== true) throw _ctErr("ct/log-list-untrusted", "the CT log-list detached signature did not verify against the pinned distributor key -- the fetched list is untrusted and was not parsed");
   var parsed = parseLogList(jsonRes.body);