@blamejs/pki 0.8.30 → 0.8.48

package/lib/ct.js

@@ -47,6 +47,27 @@ var guard = require("./guard-all.js");
 var intrinsic = require("./guard-intrinsic.js");
 var _hasOwn = intrinsic.hasOwn;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
+/** @internal The log fetch is gated on a resolved promise, and `resolve` builds from the RECEIVER, so
+ *  reading the global binding at the call decides whether the request is made at all. Taken at load. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
+/** @internal The operations the RFC 6962 sec. 4 client reads, taken at load. A log's response decides
+ *  a verdict, so which function answers "these bytes as base64", "this number as text" or "is this
+ *  the pinned log id" is fixed before any caller code runs. */
+var _stringOf = intrinsic.String;
+var _jsonStringify = intrinsic.stringify;
+var _bufferAlloc = intrinsic.bufferAlloc;
+var _bufferFrom = intrinsic.bufferFrom;
+var _byteLength = intrinsic.byteLength;
+var _bufToString = intrinsic.bufToString;
+var _bufferCompare = intrinsic.compare;
+var _subarray = intrinsic.subarray;
+var _toLowerCase = intrinsic.toLowerCase;
+var _bufCopy = intrinsic.uncurry(Buffer.prototype.copy);
+var _writeU64BE = intrinsic.uncurry(Buffer.prototype.writeBigUInt64BE);
+var _searchSet = intrinsic.uncurry(URLSearchParams.prototype.set);
+var _numberOf = intrinsic.Number;
+var _URL = URL;
 var _JSON_SUFFIX = ".json";
 function _endsWithJson(s) { return s.length >= _JSON_SUFFIX.length && _strSlice(s, s.length - _JSON_SUFFIX.length) === _JSON_SUFFIX; }
 var ByteReader = require("./byte-reader.js");
@@ -56,7 +77,14 @@ var webcrypto = require("./webcrypto.js");
 var validator = require("./validator-all.js");
 var rfc3339 = require("./rfc3339.js");
 var httpTransport = require("./http-transport.js");
+var merkle = require("./merkle.js");
 var subtle = webcrypto.webcrypto.subtle;
+/** @internal The two operations every signature check here runs, captured at load. The object was held
+ * and its METHODS fetched per call, which leaves them replaceable: a `verify` answering true accepts a
+ * signed tree head, a log list or an SCT that no log signed, and the import beside it decides which key
+ * the check runs under. `path-validate` holds the same pair the same way. */
+var _subtleImportKey = intrinsic.uncurry(subtle.importKey);
+var _subtleVerify = intrinsic.uncurry(subtle.verify);
 
 var CtError = frameworkError.CtError;
 var PkiError = frameworkError.PkiError;
@@ -83,8 +111,53 @@ function _peelInner(extValue) {
   catch (e) { throw new CtError("ct/bad-der", "the SCT-list extension value must be a DER OCTET STRING wrapping the TLS list (RFC 6962 sec. 3.3)", e); }
 }
 
-function _toBuffer(v, field) {
-  return guard.bytes.view(v, CtError, "ct/bad-input", field);
+/** @internal The response members read as integers, and so the members whose number tokens must denote
+ *  exactly the integer they are read as. These are the names `_uintField` is called with: a tree size, a
+ *  timestamp and a leaf index, each folded into a reconstructed binary preimage that a log signature is
+ *  checked over. A spelling that rounds to a different value than it denotes verifies under the log's
+ *  signature while the value handed back is not the one the log sent. */
+var EXACT_INTEGER_RESPONSE_MEMBERS = intrinsic.assign(intrinsic.create(null), {
+  tree_size: 1, timestamp: 1, leaf_index: 1,
+});
+
+/** @internal Every caller byte input enters through here, and it COPIES rather than views. A view stays
+ *  a window onto the caller's buffer, and these verbs import a key with an await before they verify: a
+ *  tree-head signature held as a view could be overwritten in that window, so the bytes verified would not
+ *  be the bytes supplied. Copying at the door makes the value checked the value used, on every route. */
+function _toBuffer(v, field, E, code, cap, capCode) {
+  /** @internal Normalized to a byte view before it is copied. The docs for these verbs name their byte
+   *  inputs `BufferSource`, and `guard.bytes.snapshot` takes a Buffer or a Uint8Array only, so the
+   *  ArrayBuffer `crypto.subtle.exportKey("spki", ...)` returns, which is how a caller holding a WebCrypto
+   *  key has it, was refused before the transport ran while a Buffer of identical bytes verified.
+   *  `guard.bytes.source` shares the caller's store, so the copy below is still the only allocation and
+   *  the copy-before-await reasoning above is unchanged.
+   *
+   *  The comment above said every caller byte input entered here and SEVEN sites called the narrow copy
+   *  directly, each with its own error factory, so the single door was a claim rather than a fact and the
+   *  normalization added here would have reached one of them. The factory and the code are parameters so
+   *  those sites can route through this one and keep the refusal they already gave. */
+  var cls = E === undefined ? CtError : E;
+  var reason = code === undefined ? "ct/bad-input" : code;
+  var viewed = guard.bytes.source(v, cls, reason, field);
+  /** @internal `cap`, where a caller passes one, is measured on the VIEW. The view shares the caller's
+   *  store and allocates nothing, so an input over the cap is refused before the copy below would take
+   *  it. Every cap in this module used to run after that copy, so a verb refusing a 64 MiB input had
+   *  already allocated 64 MiB to do it (CWE-770). The size comes off the view rather than off the
+   *  caller's own `length`, which a caller can shadow independently of the bytes. */
+  /** @internal `guard.bytes.*` takes the error CLASS and constructs it; `guard.limits.byteCap` takes a
+   *  FACTORY and calls it. Handing the class to both throws "Class constructor cannot be invoked without
+   *  new" instead of the refusal, so the factory is built from whichever class this call is using. */
+  /** @internal A site passing NO cap gets the DER ceiling rather than no bound at all. Leaving it
+   *  optional left most of this module's inputs copied at whatever size arrived: measured, a 32 MiB
+   *  value supplied as a 32-byte tree head hash allocated 32 MiB, and one supplied as its signature
+   *  allocated 64 MiB across the two reads, with the same on the chain, pinned-key, leaf-hash and
+   *  issuer-hash inputs. The default means a call added later is bounded without anyone remembering to
+   *  bound it, and a site that knows a narrower width still passes one. The refusal is `ct/too-large`,
+   *  which is what the value is. */
+  var bound = cap === undefined ? C.LIMITS.DER_MAX_BYTES : cap;
+  var boundCode = cap === undefined ? "ct/too-large" : (capCode === undefined ? reason : capCode);
+  guard.limits.byteCap(viewed, bound, function (c, m) { return new cls(c, m); }, boundCode, field);
+  return guard.bytes.snapshot(viewed, cls, reason, field);
 }
 
 function _parseSct(r, sctLen) {
@@ -179,7 +252,12 @@ function _parseSct(r, sctLen) {
  *   }
  */
 function parseSctList(extValue) {
-  var blob = _peelInner(_toBuffer(extValue, "the SCT-list extension value"));
+  /** @internal The raw value is bounded before it is copied, and then the peeled list is held to the
+   *  exact cap as before. The two differ by the DER header `_peelInner` may strip, at most five bytes for
+   *  an OCTET STRING of this size (tag, a 0x83 long-form marker and three length octets), so the outer
+   *  bound carries that slack and the semantic cap below is unchanged. */
+  var blob = _peelInner(_toBuffer(extValue, "the SCT-list extension value", undefined, undefined,
+    C.LIMITS.SCT_MAX_BYTES + SCT_LIST_WRAPPER_SLACK, "ct/too-large"));
   guard.limits.byteCap(blob, C.LIMITS.SCT_MAX_BYTES, _ctErr, "ct/too-large", "SCT list");
   var outer = new TlsReader(blob, 0, blob.length);
   var listLen = outer.u16("ct/bad-list");
@@ -207,14 +285,19 @@ function parseSctList(extValue) {
     if (one.unknown) { var u = { version: one.version, rawSct: one.rawSct }; unknownScts.push(u); all.push(u); }
     else { scts.push(one); all.push(one); }
   }
-  return { scts: scts, unknownScts: unknownScts, all: all };
+  return guard.verdict.of({ scts: scts, unknownScts: unknownScts, all: all });
 }
 
+/** @internal The DER header `_peelInner` may strip from an SCT-list extension value: an OCTET STRING
+ *  tag, a long-form length marker and three length octets reach five bytes at this size. The outer bound
+ *  on the raw value carries this slack so that bounding it cannot refuse a list the exact cap accepts. */
+var SCT_LIST_WRAPPER_SLACK = 8;
+
 function _u24Bytes(n) {
   if (n < 1 || n > 0xffffff) {
     throw new CtError("ct/bad-tbs-length", "a certificate / TBSCertificate length must be in 1..2^24-1, got " + n + " (RFC 6962 sec. 3.1)");
   }
-  return Buffer.from([(n >> 16) & 0xff, (n >> 8) & 0xff, n & 0xff]);
+  return _bufferFrom([(n >> 16) & 0xff, (n >> 8) & 0xff, n & 0xff]);
 }
 
 /**
@@ -273,27 +356,27 @@ function reconstructSignedData(entry, sct) {
   }
   var tsVal = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp (RFC 6962 3.2)");
   var parts = [];
-  parts.push(Buffer.from([sct.version & 0xff]));
-  parts.push(Buffer.from([0]));
-  var ts = Buffer.alloc(8); ts.writeBigUInt64BE(tsVal); parts.push(ts);
-  parts.push(Buffer.from([(entryType >> 8) & 0xff, entryType & 0xff]));
+  parts.push(_bufferFrom([sct.version & 0xff]));
+  parts.push(_bufferFrom([0]));
+  var ts = _bufferAlloc(8); ts.writeBigUInt64BE(tsVal); parts.push(ts);
+  parts.push(_bufferFrom([(entryType >> 8) & 0xff, entryType & 0xff]));
   if (entryType === 0) {
-    var cert = _toBuffer(entry.leafCert, "leafCert");
+    var cert = _toBuffer(entry.leafCert, "leafCert", undefined, undefined, 0xffffff, "ct/bad-tbs-length");
     parts.push(_u24Bytes(cert.length)); parts.push(cert);
   } else {
     var ikh = _toBuffer(entry.issuerKeyHash, "issuerKeyHash");
     if (ikh.length !== 32) {
       throw new CtError("ct/bad-issuer-key-hash", "issuer_key_hash must be exactly 32 bytes (SHA-256 of the issuer SPKI), got " + ikh.length + " (RFC 6962 sec. 3.2)");
     }
-    var tbs = _toBuffer(entry.tbsCertificate, "tbsCertificate");
+    var tbs = _toBuffer(entry.tbsCertificate, "tbsCertificate", undefined, undefined, 0xffffff, "ct/bad-tbs-length");
     parts.push(ikh);
     parts.push(_u24Bytes(tbs.length)); parts.push(tbs);
   }
-  var ext = _toBuffer(sct.extensions, "sct.extensions");
+  var ext = _toBuffer(sct.extensions, "sct.extensions", undefined, undefined, 0xffff, "ct/bad-extensions");
   if (ext.length > 0xffff) {
     throw new CtError("ct/bad-extensions", "CtExtensions must be 0..65535 bytes, got " + ext.length + " (RFC 6962 3.2)");
   }
-  parts.push(Buffer.from([(ext.length >> 8) & 0xff, ext.length & 0xff])); parts.push(ext);
+  parts.push(_bufferFrom([(ext.length >> 8) & 0xff, ext.length & 0xff])); parts.push(ext);
   return Buffer.concat(parts);
 }
 
@@ -365,19 +448,35 @@ function _spkiAlg(spki) {
  *   var ok = await pki.ct.verifySct({ entryType: 0, leafCert: certDer }, sct, logKey);
  */
 async function verifySct(entry, sct, logPublicKey) {
-  var message = reconstructSignedData(entry, sct);
+  if (sct === null || typeof sct !== "object") {
+    throw new CtError("ct/bad-input", "the SCT must be an object from pki.ct.parseSctList or pki.ct.signSct");
+  }
+  /** @internal Every member of the caller's SCT is taken ONCE, and everything below reads this record. The
+   *  preimage is built from some of them and the verification runs after an awaited digest, so reading a
+   *  member on both sides would let the value that shaped the preimage differ from the value checked
+   *  against it. One read each removes the question rather than answering it per member. */
+  var rec = {
+    version: sct.version, logId: sct.logId, timestamp: sct.timestamp,
+    extensions: sct.extensions, signatureAlgorithm: sct.signatureAlgorithm, signature: sct.signature,
+  };
+  var message = reconstructSignedData(entry, rec);
+  /** @internal COPIED. The logId check digests this key and awaits that digest, and the key is then read
+   *  again to resolve its algorithm and to import it for the verification. Held as a view, the key whose
+   *  SHA-256 matched sct.logId need not be the key the signature is checked under: a caller reusing the
+   *  buffer in that window passes the logId check with one key and verifies with another, so the SCT
+   *  verifies while naming a log that did not sign it. */
   var spki = _toBuffer(logPublicKey, "the CT log public key (SPKI)");
-  if (sct.logId != null) {
+  if (rec.logId != null) {
     var keyId = Buffer.from(await subtle.digest("SHA-256", spki));
-    if (!keyId.equals(_toBuffer(sct.logId, "sct.logId"))) {
+    if (!keyId.equals(_toBuffer(rec.logId, "sct.logId"))) {
       throw new CtError("ct/log-id-mismatch", "the SCT logId does not match SHA-256 of the provided log key (RFC 6962 sec. 3.2)");
     }
   }
-  var sigInfo = sct.signatureAlgorithm || {};
+  var sigInfo = rec.signatureAlgorithm || {};
   var hashName = CT_HASH[sigInfo.hashName];
   if (!hashName) throw new CtError("ct/unsupported-algorithm", "unsupported SCT hash algorithm " + JSON.stringify(sigInfo.hashName) + " (RFC 6962 sec. 2.1.4 mandates sha256)");
   var alg = _spkiAlg(spki);
-  var imp, ver, sig = _toBuffer(sct.signature, "sct.signature");
+  var imp, ver, sig = _toBuffer(rec.signature, "sct.signature");
   if (sigInfo.signatureName === "ecdsa") {
     if (alg.algOid !== oid.byName("ecPublicKey")) throw new CtError("ct/bad-input", "the SCT declares an ECDSA signature but the log key is not an EC key");
     var ec = CT_EC_CURVE[alg.curveOid];
@@ -394,8 +493,8 @@ async function verifySct(entry, sct, logPublicKey) {
     throw new CtError("ct/unsupported-algorithm", "unsupported SCT signature algorithm " + JSON.stringify(sigInfo.signatureName) + " (RFC 6962 sec. 2.1.4 supports ecdsa/rsa)");
   }
   try {
-    var key = await subtle.importKey("spki", spki, imp, false, ["verify"]);
-    return await subtle.verify(ver, key, sig, message);
+    var key = await _subtleImportKey(subtle, "spki", spki, imp, false, ["verify"]);
+    return await _subtleVerify(subtle, ver, key, sig, message);
   } catch (e) {
     throw new CtError("ct/verify-error", "the SCT signature could not be evaluated", e);
   }
@@ -421,10 +520,10 @@ function _encodeSctBody(sct) {
   if (logId.length !== LOGID_BYTES) throw new CtError("ct/bad-input", "an SCT logId must be exactly " + LOGID_BYTES + " bytes (RFC 6962 sec. 3.2)");
   w.bytes(logId);
   w.u64(guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp"), "ct/bad-input");
-  w.vector(2, 0, 0xffff, _toBuffer(sct.extensions, "sct.extensions"), "ct/bad-input");
+  w.vector(2, 0, 0xffff, _toBuffer(sct.extensions, "sct.extensions", undefined, undefined, 0xffff), "ct/bad-input");
   w.u8(sct.hashAlg, "ct/bad-input");
   w.u8(sct.sigAlg, "ct/bad-input");
-  w.vector(2, 0, 0xffff, _toBuffer(sct.signature, "sct.signature"), "ct/bad-input");
+  w.vector(2, 0, 0xffff, _toBuffer(sct.signature, "sct.signature", undefined, undefined, 0xffff), "ct/bad-input");
   return w.build();
 }
 
@@ -584,7 +683,7 @@ function _parseLogState(state) {
   if (member == null || typeof member !== "object") throw _ctErr("ct/bad-state", "the CT log state " + name + " is malformed");
   var since = rfc3339.parse(member.timestamp, _ctErr, "ct/bad-date", "the CT log state timestamp");
   var trust = LOG_STATE_TRUST[name];
-  return { name: name, since: since, trusted: trust === "yes", conditional: trust === "conditional" };
+  return guard.verdict.of({ name: name, since: since, trusted: trust === "yes", conditional: trust === "conditional" });
 }
 
 function _parseTemporalInterval(ti) {
@@ -606,14 +705,14 @@ function _parseLog(log, operatorName) {
   _spkiAlg(spki);
   var logId = nodeCrypto.createHash("sha256").update(spki).digest();
   if (!logId.equals(statedId)) throw _ctErr("ct/log-id-mismatch", "the CT log_id does not match SHA-256 of the log key (RFC 6962 sec. 3.2)");
-  return {
+  return guard.verdict.of({
     logId: logId, logIdHex: logId.toString("hex"), key: spki,
     description: typeof log.description === "string" ? log.description : null,
     url: typeof log.url === "string" ? log.url : (typeof log.submission_url === "string" ? log.submission_url : null),
     mmd: typeof log.mmd === "number" ? log.mmd : null,
     operator: operatorName, state: _parseLogState(log.state), temporalInterval: _parseTemporalInterval(log.temporal_interval),
     trusted: false,
-  };
+  });
 }
 
 function _sameTemporal(a, b) {
@@ -664,8 +763,13 @@ function _logsAgree(a, b) {
  */
 function parseLogList(json, opts) {
   void opts;
+  /** @internal The named members, for the reason at the response reader: a log list carries tree sizes and
+   *  state timestamps that are read as integers, and the list is signed, so a spelling that rounds to a
+   *  different value than it denotes would verify under the distributor's signature while naming
+   *  something else. */
   var doc = guard.json.parse(json, _ctErr, {
     maxBytes: C.LIMITS.CT_LOG_LIST_MAX_BYTES, maxDepth: C.LIMITS.JSON_MAX_DEPTH,
+    exactIntegerMembers: EXACT_INTEGER_RESPONSE_MEMBERS,
     badJson: "ct/bad-json", tooDeep: "ct/too-deep", duplicateMember: "ct/duplicate-member",
     tooLarge: "ct/too-large", badInput: "ct/bad-input", label: "the CT log list",
   });
@@ -695,7 +799,7 @@ function parseLogList(json, opts) {
   var version = typeof doc.version === "string" ? doc.version : null;
   var timestamp = (typeof doc.log_list_timestamp === "string" && rfc3339.isValid(doc.log_list_timestamp))
     ? rfc3339.parse(doc.log_list_timestamp, _ctErr, "ct/bad-date", "log_list_timestamp") : null;
-  return { logs: logs, byLogId: byLogId, version: version, timestamp: timestamp };
+  return guard.verdict.of({ logs: logs, byLogId: byLogId, version: version, timestamp: timestamp });
 }
 
 function _resolveNotAfter(entry, opts) {
@@ -751,29 +855,33 @@ function _resolveNotAfter(entry, opts) {
  *   var res = await pki.ct.verifySctWithLogList(sctEntry, embeddedSct, logList);   // { valid, logId, logIdHex, operator, logState, timestamp }
  */
 function _classifyLog(sct, logList, entry, opts) {
-  if (logList == null || typeof logList !== "object" || logList.byLogId == null) return { status: "bad-input", code: "ct/bad-input", message: "logList must be a pki.ct.parseLogList result" };
-  if (sct == null || typeof sct !== "object" || typeof sct.logIdHex !== "string") return { status: "bad-input", code: "ct/bad-input", message: "the SCT is missing its logIdHex" };
+  if (logList == null || typeof logList !== "object" || logList.byLogId == null) return guard.verdict.of({ status: "bad-input", code: "ct/bad-input", message: "logList must be a pki.ct.parseLogList result" });
+  if (sct == null || typeof sct !== "object" || typeof sct.logIdHex !== "string") return guard.verdict.of({ status: "bad-input", code: "ct/bad-input", message: "the SCT is missing its logIdHex" });
   var log = logList.byLogId[sct.logIdHex];
-  if (log == null) return { status: "not-found", code: "ct/log-not-found", message: "no trusted CT log matches the SCT's logId " + sct.logIdHex };
+  if (log == null) return guard.verdict.of({ status: "not-found", code: "ct/log-not-found", message: "no trusted CT log matches the SCT's logId " + sct.logIdHex });
   if (!log.state.trusted) {
-    if (!log.state.conditional) return { status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log state '" + log.state.name + "' is not trusted" };
+    if (!log.state.conditional) return guard.verdict.of({ status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log state '" + log.state.name + "' is not trusted" });
     var ts = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp");
-    if (ts >= BigInt(guard.time.instantOf(log.state.since))) return { status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")" };
+    if (ts >= BigInt(guard.time.instantOf(log.state.since))) return guard.verdict.of({ status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")" });
   }
   if (log.temporalInterval) {
     var notAfter = _resolveNotAfter(entry, opts);
-    if (notAfter == null) return { status: "temporal", log: log, code: "ct/temporal-interval", message: "the windowed CT log has no resolvable covered-certificate notAfter (pass a valid opts.certNotAfter)" };
+    if (notAfter == null) return guard.verdict.of({ status: "temporal", log: log, code: "ct/temporal-interval", message: "the windowed CT log has no resolvable covered-certificate notAfter (pass a valid opts.certNotAfter)" });
     if (!guard.time.within(notAfter, log.temporalInterval.startInclusive, log.temporalInterval.endExclusive, _ctErr, "ct/temporal-interval", "the covered certificate notAfter (pass a valid opts.certNotAfter)")) {
-      return { status: "temporal", log: log, code: "ct/temporal-interval", message: "the covered certificate's notAfter is outside the CT log's temporal_interval" };
+      return guard.verdict.of({ status: "temporal", log: log, code: "ct/temporal-interval", message: "the covered certificate's notAfter is outside the CT log's temporal_interval" });
     }
   }
-  return { status: "ok", log: log };
+  return guard.verdict.of({ status: "ok", log: log });
 }
 
 async function verifySctWithLogList(entry, sct, logList, opts) {
   opts = opts || {};
   var c = _classifyLog(sct, logList, entry, opts);
   if (c.status !== "ok") throw _ctErr(c.code, c.message);
+  /** @internal Read before the verify, so the timestamp the verdict states is the one the signature covered.
+   *  Read after it, a caller's record could answer the verification with one instant and the report with
+   *  another, and the verdict would name a time nothing signed. */
+  var reportedTimestamp = sct.timestamp;
   var valid = await verifySct(entry, sct, c.log.key);
   return guard.verdict.of({
     valid: valid,
@@ -781,7 +889,7 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
     logIdHex: c.log.logIdHex,
     operator: c.log.operator,
     logState: c.log.state.name,
-    timestamp: sct.timestamp,
+    timestamp: reportedTimestamp,
   });
 }
 
@@ -862,9 +970,11 @@ async function verifySctList(entry, list, logList, opts) {
   var results = [], validScts = 0, operators = [], seenOps = intrinsic.create(null), seenLogs = intrinsic.create(null);
   for (var i = 0; i < scts.length; i++) {
     var sct = scts[i];
-    var row = { logIdHex: (sct && typeof sct.logIdHex === "string") ? sct.logIdHex : null, valid: false,
+    /** @internal The row is a per-SCT verdict a caller reads `valid` off, so it carries the sentinel
+     *  from the moment it exists rather than at each of the five places it is appended. */
+    var row = guard.verdict.of({ logIdHex: (sct && typeof sct.logIdHex === "string") ? sct.logIdHex : null, valid: false,
       operator: null, logState: null,
-      timestamp: (sct && typeof sct.timestamp === "bigint") ? sct.timestamp : null, code: undefined, reason: undefined };
+      timestamp: (sct && typeof sct.timestamp === "bigint") ? sct.timestamp : null, code: undefined, reason: undefined });
     var c;
     try { c = _classifyLog(sct, logList, entry, opts); }
     catch (e) {
@@ -945,7 +1055,14 @@ function _asParsedCert(v, field) {
  */
 function _issuerSpki(v, field) {
   if (v != null && typeof v === "object" && !intrinsic.isBuffer(v) && v.subjectPublicKeyInfo != null && v.subjectPublicKeyInfo.bytes != null) {
-    return guard.bytes.view(v.subjectPublicKeyInfo.bytes, CtError, "ct/bad-cert-entry", field + " subjectPublicKeyInfo.bytes");
+    /** @internal A VIEW rather than a copy, as the parsed-certificate branch below also returns, and the
+     *  wide guard so the whole BufferSource set this module documents is read. The narrow one took a
+     *  Buffer or a Uint8Array only, so an issuer named by a DataView or by the ArrayBuffer a WebCrypto
+     *  export returns was refused with `ct/bad-cert-entry`, blaming the certificate for the container its
+     *  key arrived in; the issuerKeyHash binds the entry to its issuer, so one key has to give one hash
+     *  however it is held. */
+    return guard.bytes.source(v.subjectPublicKeyInfo.bytes, CtError, "ct/bad-cert-entry",
+      field + " subjectPublicKeyInfo.bytes");
   }
   return _asParsedCert(v, field).subjectPublicKeyInfo.bytes;
 }
@@ -1008,8 +1125,22 @@ function x509CertEntry(cert, issuer) {
  *   var ok = await pki.ct.verifyLogListSignature(logListJsonBytes, logListSig, googleSignerSpki);
  */
 async function verifyLogListSignature(json, signature, publicKey) {
-  var message = typeof json === "string" ? Buffer.from(json) : _toBuffer(json, "the CT log list JSON");
-  guard.limits.byteCap(message, C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, "ct/too-large", "the CT log list");
+  /** @internal Both arms are bounded before they allocate. A string is measured with
+   *  `Buffer.byteLength`, which computes the UTF-8 size without encoding it, so a string over the cap is
+   *  refused before `Buffer.from` would take it; its character count would not do, a character reaching
+   *  four bytes. The byte arm caps the view inside `_toBuffer`, before its copy. */
+  var message;
+  if (typeof json === "string") {
+    var jsonBytes = _byteLength(json);
+    if (jsonBytes > C.LIMITS.CT_LOG_LIST_MAX_BYTES) {
+      throw _ctErr("ct/too-large", "the CT log list is " + jsonBytes + " bytes, over the " +
+        C.LIMITS.CT_LOG_LIST_MAX_BYTES + "-byte cap");
+    }
+    message = _bufferFrom(json, "utf8");
+  } else {
+    message = _toBuffer(json, "the CT log list JSON", undefined, undefined,
+      C.LIMITS.CT_LOG_LIST_MAX_BYTES, "ct/too-large");
+  }
   var sig = _toBuffer(signature, "the CT log list signature");
   var spki = _toBuffer(publicKey, "the CT log list signer public key (SPKI)");
   var alg = _spkiAlg(spki);
@@ -1028,8 +1159,8 @@ async function verifyLogListSignature(json, signature, publicKey) {
     throw new CtError("ct/unsupported-algorithm", "unsupported CT log-list signer key algorithm (only rsaEncryption / ecPublicKey P-256)");
   }
   try {
-    var key = await subtle.importKey("spki", spki, imp, false, ["verify"]);
-    return await subtle.verify(ver, key, sig, message);
+    var key = await _subtleImportKey(subtle, "spki", spki, imp, false, ["verify"]);
+    return await _subtleVerify(subtle, ver, key, sig, message);
   } catch (e) {
     throw new CtError("ct/verify-error", "the CT log-list signature could not be evaluated", e);
   }
@@ -1071,8 +1202,11 @@ function _sigUrlFor(parsed) {
 }
 
 function _fetchBody(transport, url, req, label) {
-  return Promise.resolve().then(function () {
-    return transport({ method: "GET", url: url, headers: req.headers, tls: req.tls, timeout: req.timeout, maxResponseBytes: req.maxResponseBytes });
+  return _promiseResolve(_Promise, undefined).then(function () {
+    var request = { method: req.method || "GET", url: url, headers: req.headers, tls: req.tls,
+      timeout: req.timeout, maxResponseBytes: req.maxResponseBytes };
+    if (req.body !== undefined) request.body = req.body;
+    return transport(request);
   }).then(function (res) {
     res = res || {};
     var h = intrinsic.create(null);
@@ -1083,13 +1217,750 @@ function _fetchBody(transport, url, req, label) {
     if (body.length > req.maxResponseBytes) throw _ctErr("ct/response-too-large", "the " + label + " (" + body.length + " bytes) exceeds the " + req.maxResponseBytes + "-byte cap");
     if (res.status !== 200) throw _ctErr("ct/http-error", "the CT server returned HTTP " + JSON.stringify(res.status) + " for the " + label);
     if (body.length === 0) throw _ctErr("ct/empty-response", "the CT server returned a 200 with an empty " + label);
-    return { body: body, status: res.status, contentType: _fetchCtypeToken(h), tls: res.tls || null };
+    return guard.verdict.of({ body: body, status: res.status, contentType: _fetchCtypeToken(h), tls: res.tls || null });
   }).catch(function (e) {
     if (e instanceof PkiError) throw e;
     throw _ctErr("ct/transport-error", "the CT " + label + " request failed in the transport", e);
   });
 }
 
+/** @internal RFC 6962 sec. 3.5 fixes the TreeHeadSignature preimage at these 50 bytes: the version,
+ *  the signature type, the timestamp and tree size as big-endian uint64s, then the 32-byte root.
+ *  `v1(0)` and `tree_hash(1)` are the sec. 3.2 enum values. */
+var STH_PREIMAGE_BYTES = 50;
+var CT_VERSION_V1 = 0;
+var SIG_TYPE_TREE_HASH = 1;
+var CT_V1_PREFIX = "ct/v1/";
+var KNOWN_CLIENT_OPTS = intrinsic.assign(intrinsic.create(null), {
+  url: 1, logKey: 1, transport: 1, tls: 1, headers: 1, timeout: 1, maxResponseBytes: 1,
+  sth: 1, oldSth: 1, newSth: 1, leafHash: 1, start: 1, end: 1, chain: 1,
+  tbsCertificate: 1, issuerKeyHash: 1,
+});
+
+/** @internal The endpoint URL for one of the sec. 4 messages. A caller may pin the log's base URL
+ *  with or without the `ct/v1/` prefix the specification fixes, and neither spelling doubles it. */
+function _endpoint(url, message) {
+  var parsed = _parseHttpsUrl(url, "log URL");
+  var path = parsed.pathname;
+  if (path.length === 0 || path[path.length - 1] !== "/") path += "/";
+  var tail = CT_V1_PREFIX;
+  if (path.length >= CT_V1_PREFIX.length + 1 &&
+      _strSlice(path, path.length - CT_V1_PREFIX.length) === CT_V1_PREFIX) tail = "";
+  var out = new _URL(parsed.href);
+  out.pathname = path + tail + message;
+  out.search = "";
+  return out;
+}
+
+/** @internal The shared request shape every message uses: the caller's transport or a pinned-anchor
+ *  one, the caps, and the header filter. Factored so a verb adds a path and a body and nothing else,
+ *  and so a rule about reaching a log is stated once. */
+function _clientRequest(opts, label) {
+  guard.identifier.assertKnownKeys(opts, KNOWN_CLIENT_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
+  var transport = _assertTransport(opts);
+  if (opts.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log's base URL (there is no baked-in log)");
+  if (!transport) {
+    var t = opts.tls || {};
+    var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(intrinsic.isArray(t.anchors) && t.anchors.length === 0);
+    if (!hasAnchors && t.useSystemStore !== true) {
+      throw _ctErr("ct/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned CT log server (RFC 6962 sec. 3.2)");
+    }
+    transport = httpTransport.https({ E: _ctErr, errPrefix: "ct" });
+  }
+  var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_FETCH_TIMEOUT, { E: _ctErr, code: "ct/bad-input", min: 1, max: MAX_FETCH_TIMEOUT });
+  var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.CT_LOG_LIST_MAX_BYTES, { E: _ctErr, code: "ct/bad-input", min: 1, max: C.LIMITS.CT_LOG_LIST_MAX_BYTES });
+  var headers = intrinsic.create(null);
+  guard.identifier.optionNames(opts.headers).forEach(function (k) {
+    var lk = _toLowerCase(k);
+    if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = opts.headers[k];
+  });
+  return { transport: transport, req: { headers: headers, tls: _tlsForFetch(opts), timeout: timeout,
+    maxResponseBytes: maxResponseBytes }, label: label };
+}
+
+/** @internal A sec. 4 message, fetched and read as JSON. The specification returns every error as a
+ *  4xx or 5xx with a human-readable message, which `_fetchBody` already turns into a typed refusal,
+ *  so a non-200 never reaches the reader. */
+async function _clientJson(opts, message, label, query, body) {
+  var ctx = _clientRequest(opts, label);
+  var url = _endpoint(opts.url, message);
+  if (query) intrinsic.keys(query).forEach(function (k) { _searchSet(url.searchParams, k, query[k]); });
+  var req = ctx.req;
+  if (body !== undefined) {
+    req = intrinsic.assign(intrinsic.create(null), req);
+    req.method = "POST";
+    req.body = body;
+    var h = intrinsic.create(null);
+    intrinsic.keys(req.headers).forEach(function (k) { h[k] = req.headers[k]; });
+    h["content-type"] = "application/json";
+    req.headers = h;
+  }
+  var res = await _fetchBody(ctx.transport, url.href, req, label);
+  /** @internal The exact-integer rule applies to the NAMED members, the ones `_uintField` reads. RFC 6962
+   *  responses are ordinary JSON, where `1e3` is legal, so the stricter `integersOnly` would refuse a
+   *  document a conforming log may emit; what this refuses is a spelling whose value is not exactly its
+   *  own integer. `1.0000000000000001` converts to the Number 1, so `_uintField` cannot be asked about it
+   *  afterwards, and a tree size or timestamp read that way is folded into the reconstructed binary
+   *  preimage a signature is checked over: the rounded spelling verifies, and the value the caller is
+   *  handed is not the one the log sent.
+   *
+   *  Named rather than applied document-wide even though RFC 6962 closes every schema here, because a
+   *  rule over every number is a bet that no field anywhere in the format is fractional, and that bet
+   *  reads as safe right up until a field nobody thought about. Naming the members that need it says what
+   *  is actually meant and cannot be wrong about the rest. */
+  var parsed = guard.json.parse(res.body, _ctErr, {
+    maxBytes: req.maxResponseBytes, maxDepth: C.LIMITS.JSON_MAX_DEPTH,
+    exactIntegerMembers: EXACT_INTEGER_RESPONSE_MEMBERS,
+    badJson: "ct/bad-json", tooDeep: "ct/too-deep", duplicateMember: "ct/duplicate-member",
+    tooLarge: "ct/too-large", badInput: "ct/bad-input", label: "the " + label + " response",
+  });
+  if (!parsed || typeof parsed !== "object" || intrinsic.isArray(parsed)) {
+    throw _ctErr("ct/bad-json", "the " + label + " is not a JSON object");
+  }
+  return parsed;
+}
+
+/** @internal A base64 field, decoded and held to a byte length where the specification fixes one. */
+function _b64Field(obj, name, code, label, exactLen) {
+  var v = obj[name];
+  if (typeof v !== "string") throw _ctErr(code, "the " + label + " field " + name + " is not a base64 string");
+  var buf = guard.encoding.base64(v, C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, code, name);
+  if (exactLen !== undefined && buf.length !== exactLen) {
+    throw _ctErr(code, "the " + label + " field " + name + " is " + buf.length + " bytes, expected " + exactLen);
+  }
+  return buf;
+}
+
+/** @internal A non-negative integer field the specification states in decimal. */
+function _uintField(obj, name, code, label) {
+  var v = obj[name];
+  if (typeof v !== "number" || !intrinsic.isSafeInteger(v) || v < 0) {
+    if (typeof v !== "string") {
+      throw _ctErr(code, "the " + label + " field " + name + " is not a non-negative integer");
+    }
+    return guard.range.decimalUint64(v, _ctErr, code, "the " + label + " field " + name);
+  }
+  return intrinsic.BigInt(v);
+}
+
+/**
+ * @primitive  pki.ct.sthSignedData
+ * @signature  pki.ct.sthSignedData(sth) -> Buffer
+ * @since      0.8.40
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.verifySth, pki.ct.getSth
+ *
+ * The 50 bytes a log signs to produce a signed tree head, which RFC 6962 sec. 3.5 fixes as the
+ * `TreeHeadSignature` structure: the version, the signature type `tree_hash`, the timestamp and the
+ * tree size as big-endian uint64s, then the 32-byte root hash. Given as a verb so a caller holding an
+ * STH from anywhere can check it without a fetch.
+ *
+ * @opts
+ *   timestamp:  number | bigint,  // the log's timestamp, milliseconds since the epoch
+ *   treeSize:   number | bigint,  // the number of entries the head commits to
+ *   rootHash:   Buffer,           // the 32-byte Merkle tree head
+ *
+ * @example
+ *   pki.ct.sthSignedData({ timestamp: 1800000000000, treeSize: 3,
+ *     rootHash: pki.merkle.emptyRootHash() }).length;   // -> 50
+ */
+/** @internal Two of these five are here so that what `pki.ct.getSth` RETURNS is what this verb TAKES. A
+ *  client that fetches a tree head and then wants the bytes the log signed has to be able to hand one
+ *  verb's result to the other, and both fields the fetch adds were refused as unknown:
+ *
+ *  - `raw` is the log's own JSON document, which getSth hands back beside the decoded fields.
+ *  - `then` is the sentinel `guard.verdict.of` defines on every verdict, own and non-enumerable, so that
+ *    resolving one cannot run an inherited accessor. `guard.identifier.assertKnownKeys` reads own
+ *    non-enumerable names deliberately, so it sees it.
+ *
+ *  Neither reaches the preimage, which is built from the timestamp, the tree size and the root hash. The
+ *  allowlist still catches what it is for: a caller's misspelling of one of those three. */
+var _STH_KEYS = intrinsic.assign(intrinsic.create(null),
+  { timestamp: 1, treeSize: 1, rootHash: 1, signature: 1, raw: 1, then: 1 });
+function sthSignedData(sth) {
+  sth = sth || {};
+  guard.identifier.assertKnownKeys(sth, _STH_KEYS, _ctErr, "ct/bad-input", "unknown sth field ");
+  var ts = guard.range.uint64(sth.timestamp, _ctErr, "ct/bad-input", "sth.timestamp");
+  var size = guard.range.uint64(sth.treeSize, _ctErr, "ct/bad-input", "sth.treeSize");
+  var root = _toBuffer(sth.rootHash, "sth.rootHash");
+  if (root.length !== 32) {
+    throw _ctErr("ct/bad-input", "sth.rootHash must be exactly 32 bytes (SHA-256), got " + root.length);
+  }
+  var out = _bufferAlloc(STH_PREIMAGE_BYTES);
+  out[0] = CT_VERSION_V1;
+  out[1] = SIG_TYPE_TREE_HASH;
+  _writeU64BE(out, ts, 2);
+  _writeU64BE(out, size, 10);
+  _bufCopy(root, out, 18);
+  return out;
+}
+
+/**
+ * @primitive  pki.ct.verifySth
+ * @signature  pki.ct.verifySth(sth, logKey) -> Promise<boolean>
+ * @since      0.8.40
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.sthSignedData, pki.ct.getSth
+ *
+ * Verify a signed tree head's `tree_head_signature` over the `sthSignedData` preimage under a log's
+ * SubjectPublicKeyInfo. Resolves `true` or `false`: whether a given key signed a given head is a
+ * verdict about the head, not a fault in it. A malformed input throws.
+ *
+ * `sth.signature` is the `digitally-signed` structure the log returns, hash and signature algorithm
+ * bytes included, which is what `pki.ct.verifySct` also takes.
+ *
+ * @example
+ *   var pair = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
+ *   var logSpki = await pki.key.export(pair.publicKey);
+ *   var head = { timestamp: 1800000000000, treeSize: 1, rootHash: pki.merkle.emptyRootHash() };
+ *   var raw = Buffer.from(await pki.webcrypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" },
+ *     pair.privateKey, pki.ct.sthSignedData(head)));
+ *   var der = pki.asn1.build.sequence([
+ *     pki.asn1.build.integer(BigInt("0x" + raw.subarray(0, 32).toString("hex"))),
+ *     pki.asn1.build.integer(BigInt("0x" + raw.subarray(32).toString("hex")))]);
+ *   head.signature = Buffer.concat([Buffer.from([4, 3, (der.length >> 8) & 0xff, der.length & 0xff]), der]);
+ *   await pki.ct.verifySth(head, logSpki);
+ *   // -> true
+ */
+async function verifySth(sth, logKey) {
+  sth = sth || {};
+  var signature = _toBuffer(sth.signature, "sth.signature");
+  var signedData = sthSignedData({ timestamp: sth.timestamp, treeSize: sth.treeSize, rootHash: sth.rootHash });
+  return await _verifyDigitallySigned(signedData, signature, logKey, "the signed tree head");
+}
+
+/**
+ * @primitive  pki.ct.getSth
+ * @signature  pki.ct.getSth(opts) -> Promise<{ treeSize, timestamp, rootHash, signature, raw }>
+ * @since      0.8.40
+ * @status     stable
+ * @spec       RFC 6962
+ * @defends    signature-bypass (CWE-347)
+ * @related    pki.ct.verifySth, pki.ct.getProofByHash, pki.merkle.verifyInclusion
+ *
+ * Fetch a log's latest signed tree head (RFC 6962 sec. 4.3) and verify it under the key
+ * `opts.logKey` pins. An STH whose signature does not verify is `ct/sth-untrusted` and no field of it
+ * is returned: a tree head nobody vouched for is not a tree head, and everything a client does next
+ * is measured against its root.
+ *
+ * `opts.logKey` is required. There is no unverified mode and no baked-in key.
+ *
+ * `treeSize` and `timestamp` come back as `BigInt`, since both are uint64 on the wire.
+ *
+ * @opts
+ *   url:              string,    // the log's base URL, with or without the ct/v1/ prefix
+ *   logKey:           BufferSource, // the log's SubjectPublicKeyInfo, pinned by the caller
+ *   transport:        function,  // optional (request) => Promise<{ status, headers, body }>
+ *   tls:              object,    // optional { anchors, useSystemStore, ... } when no transport is given
+ *   headers:          object,    // optional extra request headers
+ *   timeout:          number,    // optional per-request timeout in milliseconds
+ *   maxResponseBytes: number,    // optional response cap
+ *
+ * @example
+ *   // requires: base -- the CT log's base URL, e.g. https://ct.googleapis.com/logs/us/argon2025h1/
+ *   // requires: spki -- the log's SubjectPublicKeyInfo, from a verified log list
+ *   // requires: t -- a transport, e.g. the one pki.ct.fetchLogList uses by default
+ *   var sth = await pki.ct.getSth({ url: base, logKey: spki, transport: t });
+ *   sth.treeSize;   // -> 3n
+ */
+async function getSth(opts) {
+  opts = opts || {};
+  /** @internal ONE read of the option, and the presence check and the copy both decide from it. Reading
+   *  it twice let an accessor answer the two separately: a non-null value for the check and an
+   *  attacker's SPKI for the copy, and the tree head was then verified against a key the caller never
+   *  pinned. The key is COPIED at the call, before the request goes out. Read after the fetch instead,
+   *  it is whatever the caller's buffer holds by then: a caller reusing that buffer has the tree head
+   *  checked against a key it never pinned, so the log that answered need not be the log it asked. */
+  var suppliedLogKey = opts.logKey;
+  if (suppliedLogKey == null) {
+    throw _ctErr("ct/bad-input", "opts.logKey is required -- the caller-pinned log SPKI; an unverified tree head is not a result");
+  }
+  var pinnedKey = _toBuffer(suppliedLogKey, "opts.logKey", _ctErr, "ct/bad-input");
+  var doc = await _clientJson(opts, "get-sth", "sth");
+  var sth = {
+    treeSize: _uintField(doc, "tree_size", "ct/bad-sth", "sth"),
+    timestamp: _uintField(doc, "timestamp", "ct/bad-sth", "sth"),
+    rootHash: _b64Field(doc, "sha256_root_hash", "ct/bad-sth", "sth", 32),
+    signature: _b64Field(doc, "tree_head_signature", "ct/bad-sth", "sth"),
+  };
+  var ok = await verifySth(sth, pinnedKey);
+  if (ok !== true) {
+    throw _ctErr("ct/sth-untrusted", "the signed tree head did not verify under the pinned log key -- " +
+      "its tree size, timestamp and root are not attested and were not returned");
+  }
+  sth.raw = doc;
+  return guard.verdict.of(sth);
+}
+
+/**
+ * @primitive  pki.ct.getProofByHash
+ * @signature  pki.ct.getProofByHash(opts) -> Promise<{ leafIndex, auditPath, verified }>
+ * @since      0.8.40
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.getSth, pki.merkle.verifyInclusion
+ *
+ * Fetch the Merkle audit proof for a leaf hash (RFC 6962 sec. 4.5) and fold it to the root of the
+ * tree head it was requested at. `opts.sth` is a VERIFIED head, from `pki.ct.getSth`: the tree size
+ * the query needs comes from it, so a size and a head cannot disagree, and its root is what the proof
+ * is folded against. A proof that does not fold, or that does not support the leaf index the log
+ * states, is `ct/proof-mismatch`.
+ *
+ * @opts
+ *   url:      string,       // the log's base URL
+ *   leafHash: BufferSource, // the 32-byte v1 leaf hash to prove
+ *   sth:      object,       // a verified { treeSize, rootHash } from pki.ct.getSth
+ *   transport, tls, headers, timeout, maxResponseBytes  // as pki.ct.getSth takes them
+ *
+ * @example
+ *   // requires: base -- the CT log's base URL, e.g. https://ct.googleapis.com/logs/us/argon2025h1/
+ *   // requires: spki -- the log's SubjectPublicKeyInfo, from a verified log list
+ *   // requires: t -- a transport, e.g. the one pki.ct.fetchLogList uses by default
+ *   // requires: lh -- a v1 leaf hash, from pki.ct.getEntries or a certificate you hold
+ *   // requires: sth -- a verified tree head from pki.ct.getSth
+ *   var p = await pki.ct.getProofByHash({ url: base, leafHash: lh, sth: sth, transport: t });
+ *   p.verified;   // -> true
+ */
+async function getProofByHash(opts) {
+  opts = opts || {};
+  var sth = _assertSth(opts.sth, "opts.sth");
+  /** @internal Copied for the reason the tree head is: it is sent on the wire and then folded against the
+   *  head after the fetch returns, so a view would let the leaf being proved differ from the leaf asked
+   *  about. */
+  var leafHash = _toBuffer(opts.leafHash, "opts.leafHash", _ctErr, "ct/bad-input");
+  if (leafHash.length !== 32) {
+    throw _ctErr("ct/bad-input", "opts.leafHash must be exactly 32 bytes (a v1 leaf hash), got " + leafHash.length);
+  }
+  var doc = await _clientJson(opts, "get-proof-by-hash", "audit proof", {
+    hash: _bufToString(leafHash, "base64"), tree_size: _stringOf(sth.treeSize),
+  });
+  var leafIndex = _uintField(doc, "leaf_index", "ct/bad-proof", "audit proof");
+  var auditPath = _b64Array(doc, "audit_path", "ct/bad-proof", "audit proof", 32, C.LIMITS.MERKLE_MAX_PROOF_NODES);
+  var folded = merkle.verifyInclusion({
+    leafIndex: leafIndex, treeSize: sth.treeSize, leafHash: leafHash,
+    proof: auditPath, rootHash: sth.rootHash,
+  });
+  if (folded !== true) {
+    throw _ctErr("ct/proof-mismatch", "the audit proof the log served does not fold this leaf to the " +
+      "root of the tree head it was requested at");
+  }
+  return guard.verdict.of({ leafIndex: leafIndex, auditPath: auditPath, verified: true });
+}
+
+/**
+ * @primitive  pki.ct.getSthConsistency
+ * @signature  pki.ct.getSthConsistency(opts) -> Promise<{ consistency, verified }>
+ * @since      0.8.40
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.getSth, pki.merkle.verifyConsistency
+ *
+ * Fetch the Merkle consistency proof between two tree heads (RFC 6962 sec. 4.4) and check that the
+ * older is a prefix of the newer. Both `opts.oldSth` and `opts.newSth` are VERIFIED heads, so the two
+ * sizes the query needs and both roots the proof is checked against come from heads a log signed. A
+ * proof that does not reconstruct both roots is `ct/consistency-mismatch`, which is the append-only
+ * failure: the log rewrote history or served a proof for a different pair.
+ *
+ * @opts
+ *   url:    string,  // the log's base URL
+ *   oldSth: object,  // the earlier verified { treeSize, rootHash }
+ *   newSth: object,  // the later verified { treeSize, rootHash }
+ *   transport, tls, headers, timeout, maxResponseBytes  // as pki.ct.getSth takes them
+ *
+ * @example
+ *   // requires: base -- the CT log's base URL, e.g. https://ct.googleapis.com/logs/us/argon2025h1/
+ *   // requires: spki -- the log's SubjectPublicKeyInfo, from a verified log list
+ *   // requires: t -- a transport, e.g. the one pki.ct.fetchLogList uses by default
+ *   // requires: a -- an earlier verified tree head from pki.ct.getSth
+ *   // requires: b -- a later verified tree head from pki.ct.getSth
+ *   var c = await pki.ct.getSthConsistency({ url: base, oldSth: a, newSth: b, transport: t });
+ *   c.verified;   // -> true
+ */
+async function getSthConsistency(opts) {
+  opts = opts || {};
+  var oldSth = _assertSth(opts.oldSth, "opts.oldSth");
+  var newSth = _assertSth(opts.newSth, "opts.newSth");
+  if (oldSth.treeSize > newSth.treeSize) {
+    throw _ctErr("ct/bad-input", "opts.oldSth names tree size " + oldSth.treeSize +
+      ", which is larger than opts.newSth's " + newSth.treeSize);
+  }
+  var doc = await _clientJson(opts, "get-sth-consistency", "consistency proof", {
+    first: _stringOf(oldSth.treeSize), second: _stringOf(newSth.treeSize),
+  });
+  var consistency = _b64Array(doc, "consistency", "ct/bad-consistency", "consistency proof", 32, C.LIMITS.MERKLE_MAX_PROOF_NODES);
+  var ok = merkle.verifyConsistency({
+    oldSize: oldSth.treeSize, newSize: newSth.treeSize,
+    oldRoot: oldSth.rootHash, newRoot: newSth.rootHash, proof: consistency,
+  });
+  if (ok !== true) {
+    throw _ctErr("ct/consistency-mismatch", "the consistency proof the log served does not reconstruct " +
+      "both tree heads -- the older is not shown to be a prefix of the newer");
+  }
+  return guard.verdict.of({ consistency: consistency, verified: true });
+}
+
+/**
+ * @primitive  pki.ct.getEntries
+ * @signature  pki.ct.getEntries(opts) -> Promise<{ entries, requested, truncated }>
+ * @since      0.8.40
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.getSth, pki.merkle.root
+ *
+ * Fetch log entries by index range (RFC 6962 sec. 4.6). Each entry comes back as `leafInput` and
+ * `extraData` buffers.
+ *
+ * **This response carries no signature.** The specification states that this message is not signed,
+ * and that the retrieved data is verified by constructing the Merkle Tree Hash corresponding to a
+ * retrieved tree head. So nothing here is verified, and a caller that needs the entries to be the
+ * log's must build the tree and compare it with a head from `pki.ct.getSth`.
+ *
+ * A log may serve fewer entries than the range asks for, which the specification permits: "Logs MAY
+ * restrict the number of entries that can be retrieved per 'get-entries' request." That is reported
+ * as `truncated` beside `requested` rather than treated as a fault, so a caller paginates. MORE
+ * entries than the range asks for is a fault and is refused.
+ *
+ * @opts
+ *   url:   string,          // the log's base URL
+ *   start: number | bigint, // the first index, 0-based and inclusive
+ *   end:   number | bigint, // the last index, inclusive
+ *   transport, tls, headers, timeout, maxResponseBytes  // as pki.ct.getSth takes them
+ *
+ * @example
+ *   // requires: base -- the CT log's base URL, e.g. https://ct.googleapis.com/logs/us/argon2025h1/
+ *   // requires: spki -- the log's SubjectPublicKeyInfo, from a verified log list
+ *   // requires: t -- a transport, e.g. the one pki.ct.fetchLogList uses by default
+ *   var e = await pki.ct.getEntries({ url: base, start: 0, end: 1, transport: t });
+ *   e.entries[0].leafInput;   // -> <Buffer ...>
+ */
+async function getEntries(opts) {
+  opts = opts || {};
+  var start = guard.range.uint64(opts.start, _ctErr, "ct/bad-input", "opts.start");
+  var end = guard.range.uint64(opts.end, _ctErr, "ct/bad-input", "opts.end");
+  if (end < start) {
+    throw _ctErr("ct/bad-input", "opts.end (" + end + ") is before opts.start (" + start + ")");
+  }
+  var requested = end - start + 1n;
+  if (requested > intrinsic.BigInt(C.LIMITS.CT_MAX_ENTRIES_PER_REQUEST)) {
+    throw _ctErr("ct/bad-input", "a range of " + requested + " entries exceeds the " +
+      C.LIMITS.CT_MAX_ENTRIES_PER_REQUEST + "-entry request cap");
+  }
+  var doc = await _clientJson(opts, "get-entries", "entries", { start: _stringOf(start), end: _stringOf(end) });
+  var raw = doc.entries;
+  if (!intrinsic.isArray(raw)) throw _ctErr("ct/bad-entries", "the entries field is not an array");
+  if (intrinsic.BigInt(raw.length) > requested) {
+    throw _ctErr("ct/bad-entries", "the log served " + raw.length + " entries for a range of " + requested);
+  }
+  var entries = [];
+  for (var i = 0; i < raw.length; i++) {
+    var e = raw[i];
+    if (!e || typeof e !== "object") throw _ctErr("ct/bad-entries", "entries[" + i + "] is not an object");
+    if (typeof e.leaf_input !== "string" || typeof e.extra_data !== "string") {
+      throw _ctErr("ct/bad-entries", "entries[" + i + "] is missing leaf_input or extra_data");
+    }
+    guard.list.append(entries, {
+      leafInput: guard.encoding.base64(e.leaf_input, C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, "ct/bad-entries", "entries[" + i + "].leaf_input"),
+      extraData: guard.encoding.base64(e.extra_data, C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, "ct/bad-entries", "entries[" + i + "].extra_data"),
+    });
+  }
+  return guard.verdict.of({ entries: entries, requested: _numberOf(requested),
+    truncated: intrinsic.BigInt(entries.length) < requested });
+}
+
+/**
+ * @primitive  pki.ct.getRoots
+ * @signature  pki.ct.getRoots(opts) -> Promise<{ certificates }>
+ * @since      0.8.40
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.addChain
+ *
+ * Fetch the root certificates a log accepts (RFC 6962 sec. 4.7), as DER buffers. This response
+ * carries no signature either, so it tells a caller what to submit rather than what to trust.
+ *
+ * @opts
+ *   url: string,   // the log's base URL
+ *   transport, tls, headers, timeout, maxResponseBytes  // as pki.ct.getSth takes them
+ *
+ * @example
+ *   // requires: base -- the CT log's base URL, e.g. https://ct.googleapis.com/logs/us/argon2025h1/
+ *   // requires: spki -- the log's SubjectPublicKeyInfo, from a verified log list
+ *   // requires: t -- a transport, e.g. the one pki.ct.fetchLogList uses by default
+ *   var r = await pki.ct.getRoots({ url: base, transport: t });
+ *   r.certificates.length;   // -> 2
+ */
+async function getRoots(opts) {
+  opts = opts || {};
+  var doc = await _clientJson(opts, "get-roots", "roots");
+  return guard.verdict.of({ certificates: _b64Array(doc, "certificates", "ct/bad-roots", "roots", undefined, C.LIMITS.CT_MAX_ROOTS) });
+}
+
+/**
+ * @primitive  pki.ct.addChain
+ * @signature  pki.ct.addChain(opts) -> Promise<{ sct, verified }>
+ * @since      0.8.40
+ * @status     stable
+ * @spec       RFC 6962
+ * @defends    signature-bypass (CWE-347)
+ * @related    pki.ct.addPreChain, pki.ct.verifySct
+ *
+ * Submit a certificate chain to a log (RFC 6962 sec. 4.1) and verify the signed certificate timestamp
+ * it returns. The SCT is the log's promise to include the certificate, so it is checked against the
+ * chain it was issued for and the key `opts.logKey` pins: one that does not verify, or that names a
+ * different log, is `ct/sct-untrusted` and is not returned. A receipt nobody can check is not a
+ * receipt.
+ *
+ * `opts.chain[0]` is the end-entity certificate the SCT covers; the rest are the issuers the log needs
+ * to build a path, and are submitted unread.
+ *
+ * @opts
+ *   url:     string,         // the log's base URL
+ *   logKey:  BufferSource,   // the log's SubjectPublicKeyInfo, pinned by the caller
+ *   chain:   Array,          // [leafDer, ...issuerDers], each a DER Buffer
+ *   transport, tls, headers, timeout, maxResponseBytes  // as pki.ct.getSth takes them
+ *
+ * @example
+ *   // requires: base -- the CT log's base URL, e.g. https://ct.googleapis.com/logs/us/argon2025h1/
+ *   // requires: spki -- the log's SubjectPublicKeyInfo, from a verified log list
+ *   // requires: t -- a transport, e.g. the one pki.ct.fetchLogList uses by default
+ *   // requires: leafDer -- the end-entity certificate to submit (DER)
+ *   var r = await pki.ct.addChain({ url: base, logKey: spki, chain: [leafDer], transport: t });
+ *   r.verified;   // -> true
+ */
+async function addChain(opts) {
+  return await _addChain(opts, "add-chain", 0);
+}
+
+/**
+ * @primitive  pki.ct.addPreChain
+ * @signature  pki.ct.addPreChain(opts) -> Promise<{ sct, verified }>
+ * @since      0.8.40
+ * @status     stable
+ * @spec       RFC 6962
+ * @defends    signature-bypass (CWE-347)
+ * @related    pki.ct.addChain, pki.ct.verifySct
+ *
+ * Submit a precertificate chain to a log (RFC 6962 sec. 4.2) and verify the signed certificate
+ * timestamp it returns. A precertificate SCT covers the `precert_entry` form, whose signed data is the
+ * issuer key hash and the TBSCertificate rather than the certificate itself, so `opts.tbsCertificate`
+ * and `opts.issuerKeyHash` supply what that form needs. Verification is otherwise as `addChain`
+ * describes it.
+ *
+ * @opts
+ *   url:            string,       // the log's base URL
+ *   logKey:         BufferSource, // the log's SubjectPublicKeyInfo, pinned by the caller
+ *   chain:          Array,        // [precertDer, ...issuerDers]
+ *   tbsCertificate: BufferSource, // the TBSCertificate the SCT covers
+ *   issuerKeyHash:  BufferSource, // SHA-256 of the issuer's SubjectPublicKeyInfo, 32 bytes
+ *   transport, tls, headers, timeout, maxResponseBytes  // as pki.ct.getSth takes them
+ *
+ * @example
+ *   // requires: base -- the CT log's base URL, e.g. https://ct.googleapis.com/logs/us/argon2025h1/
+ *   // requires: spki -- the log's SubjectPublicKeyInfo, from a verified log list
+ *   // requires: t -- a transport, e.g. the one pki.ct.fetchLogList uses by default
+ *   // requires: preDer -- the precertificate to submit (DER)
+ *   // requires: tbs -- its TBSCertificate
+ *   // requires: ikh -- SHA-256 of the issuer SubjectPublicKeyInfo
+ *   var r = await pki.ct.addPreChain({ url: base, logKey: spki, chain: [preDer],
+ *     tbsCertificate: tbs, issuerKeyHash: ikh, transport: t });
+ *   r.verified;   // -> true
+ */
+async function addPreChain(opts) {
+  return await _addChain(opts, "add-pre-chain", 1);
+}
+
+/** @internal The two submission messages differ in their path and in the entry form the SCT covers.
+ *  The chain encoding, the response shape, and the refusal when the receipt does not verify are one
+ *  rule stated once. */
+async function _addChain(opts, message, entryType) {
+  opts = opts || {};
+  /** @internal ONE read of the option, used by the presence check here and by the copy below. Reading it
+   *  twice let an accessor answer the two separately, presenting a non-null value to the check and an
+   *  attacker's SPKI to the copy, and the returned receipt was then verified against a key the caller
+   *  never pinned. */
+  var suppliedLogKey = opts.logKey;
+  if (suppliedLogKey == null) {
+    throw _ctErr("ct/bad-input", "opts.logKey is required -- the caller-pinned log SPKI; an unverified SCT is not a receipt");
+  }
+  if (!intrinsic.isArray(opts.chain) || opts.chain.length === 0) {
+    throw _ctErr("ct/bad-input", "opts.chain must be a non-empty array of DER certificates, leaf first");
+  }
+  /** @internal Each element is copied ONCE and both the submitted body and the entry the returned SCT is
+   *  verified over are derived from that one copy. Reading `opts.chain[0]` a second time lets an indexed
+   *  accessor hand one certificate to the log and another to the check, so the receipt would attest a
+   *  certificate that was never submitted. The length is bound for the same reason. */
+  var chainLen = opts.chain.length;
+  var chainDer = [], chain = [];
+  for (var i = 0; i < chainLen; i++) {
+    guard.list.append(chainDer, _toBuffer(opts.chain[i], "opts.chain[" + i + "]"));
+    guard.list.append(chain, _bufToString(chainDer[i], "base64"));
+  }
+  /** @internal The entry and the pinned key are COPIED before the request goes out. Both are read again
+   *  after it returns: the entry is the preimage the returned SCT is verified over, and the key is what
+   *  the SCT's logId is matched against and what the signature is checked under. Held as views, a caller
+   *  reusing either buffer during the request gets a receipt for bytes it did not submit, or one checked
+   *  against a log it did not pin. */
+  function _snap(v, label) { return _toBuffer(v, label, _ctErr, "ct/bad-input"); }
+  var entry = entryType === 0
+    ? { entryType: 0, leafCert: chainDer[0] }
+    : { entryType: 1, tbsCertificate: _snap(opts.tbsCertificate, "opts.tbsCertificate"),
+      issuerKeyHash: _snap(opts.issuerKeyHash, "opts.issuerKeyHash") };
+  var pinnedKey = _snap(suppliedLogKey, "opts.logKey");
+  var doc = await _clientJson(opts, message, "SCT", null, _jsonStringify({ chain: chain }));
+  var version = doc.sct_version;
+  if (version !== 0) {
+    throw _ctErr("ct/bad-sct", "the log returned sct_version " + guard.text.showValue(version) +
+      "; this build reads v1(0) (RFC 6962 sec. 3.2)");
+  }
+  var sct = {
+    version: 0,
+    logId: _b64Field(doc, "id", "ct/bad-sct", "sct", 32),
+    timestamp: _uintField(doc, "timestamp", "ct/bad-sct", "sct"),
+    extensions: typeof doc.extensions === "string" && doc.extensions.length === 0
+      ? _bufferAlloc(0) : _b64Field(doc, "extensions", "ct/bad-sct", "sct"),
+    signature: _b64Field(doc, "signature", "ct/bad-sct", "sct"),
+  };
+  var pinnedId = nodeCrypto.createHash("sha256").update(pinnedKey).digest();
+  if (_bufferCompare(sct.logId, pinnedId) !== 0) {
+    throw _ctErr("ct/sct-untrusted", "the SCT names log id " + _bufToString(sct.logId, "hex") +
+      " where the pinned key's id is " + _bufToString(pinnedId, "hex") + " -- it is not this log's receipt");
+  }
+  var signedData = reconstructSignedData(entry, sct);
+  var ok = await _verifyDigitallySigned(signedData, sct.signature, pinnedKey, "the SCT");
+  if (ok !== true) {
+    throw _ctErr("ct/sct-untrusted", "the SCT the log returned did not verify over the chain it was " +
+      "issued for -- it is not a receipt and was not returned");
+  }
+  /** @internal Returned in the SCT shape the rest of this module reads, which is what `parseSctList` and
+   *  `signSct` produce: the algorithm bytes decoded into `signatureAlgorithm`, and `signature` the raw
+   *  signature rather than the TLS digitally-signed structure it arrived in. A receipt is only useful if
+   *  it can be embedded and re-verified, and `encodeSctList` and `verifySct` both take that shape, so
+   *  handing back the wire structure made the receipt unusable by every verb that consumes one. The
+   *  verification above ran over the wire structure, which is the form the log signed. */
+  var decodedSig = _parseDigitallySigned(sct.signature, "the SCT");
+  var alg = decodedSig.signatureAlgorithm;
+  return guard.verdict.of({
+    sct: {
+      version: sct.version, logId: sct.logId,
+      /** @internal `logIdHex` as well as the bytes, because the log-list verbs key a log by the hex and
+       *  not by the Buffer: without it a receipt this verb had just verified was refused outright by
+       *  `verifySctWithLogList` and dropped by `verifySctList` as a policy failure. The comment below
+       *  claims this is the shape `parseSctList` produces, and that claim is only true with this field,
+       *  which `parseSctList` and `signSct` both carry. */
+      logIdHex: _bufToString(sct.logId, "hex"),
+      timestamp: sct.timestamp, extensions: sct.extensions,
+      /** @internal Both spellings, because the module's own consumers read different ones:
+       *  `encodeSctList` takes the flat algorithm bytes and `verifySct` the named object. This is the
+       *  shape `parseSctList` produces, which is what makes the two round-trip. */
+      hashAlg: alg.hash, sigAlg: alg.signature,
+      signatureAlgorithm: alg, signature: decodedSig.signature,
+    },
+    verified: true,
+  });
+}
+
+/** @internal The TLS `digitally-signed` structure a log returns, read into the shape `verifySct`
+ *  already takes: a hash-algorithm byte, a signature-algorithm byte, a uint16 length, then that many
+ *  signature bytes. The length is held to the bytes that follow it rather than trusted, and trailing
+ *  bytes are refused, so a structure claiming less than it carries cannot hide one. */
+function _parseDigitallySigned(buf, label) {
+  if (buf.length < 4) {
+    throw _ctErr("ct/bad-signature", label + " is shorter than a digitally-signed header (4 bytes), got " + buf.length);
+  }
+  var hashAlg = buf[0], sigAlg = buf[1];
+  var len = (buf[2] << 8) | buf[3];
+  if (buf.length !== 4 + len) {
+    throw _ctErr("ct/bad-signature", label + " states a " + len + "-byte signature but carries " +
+      (buf.length - 4) + " bytes after its header");
+  }
+  return {
+    signatureAlgorithm: { hash: hashAlg, hashName: HASH_ALGORITHMS[hashAlg] || null,
+      signature: sigAlg, signatureName: SIGNATURE_ALGORITHMS[sigAlg] || null },
+    signature: _subarray(buf, 4),
+  };
+}
+
+/** @internal A digitally-signed structure verified over a preimage under a log's SPKI, through the
+ *  one signature path this module already uses for an SCT. Resolves a boolean: whether a key signed
+ *  something is a verdict, and a malformed structure throws before any verify is attempted. */
+async function _verifyDigitallySigned(preimage, wireSignature, logKey, label) {
+  var parsed = _parseDigitallySigned(_toBuffer(wireSignature, label + " signature"), label);
+  var spki = _toBuffer(logKey, "the CT log public key (SPKI)");
+  var hashName = CT_HASH[parsed.signatureAlgorithm.hashName];
+  if (!hashName) {
+    throw _ctErr("ct/unsupported-algorithm", "unsupported " + label + " hash algorithm " +
+      guard.text.showValue(parsed.signatureAlgorithm.hashName) + " (RFC 6962 sec. 2.1.4 mandates sha256)");
+  }
+  var alg = _spkiAlg(spki);
+  var imp, ver, sig = parsed.signature;
+  if (parsed.signatureAlgorithm.signatureName === "ecdsa") {
+    if (alg.algOid !== oid.byName("ecPublicKey")) throw _ctErr("ct/bad-input", label + " declares an ECDSA signature but the log key is not an EC key");
+    var ec = CT_EC_CURVE[alg.curveOid];
+    if (!ec) throw _ctErr("ct/unsupported-algorithm", "unsupported CT log EC curve (RFC 6962 sec. 2.1.4 mandates NIST P-256)");
+    imp = { name: "ECDSA", namedCurve: ec.curve };
+    ver = { name: "ECDSA", hash: hashName };
+    sig = validator.sig.ecdsaDerToP1363(sig, ec.curve, CtError, "ct/bad-signature");
+  } else if (parsed.signatureAlgorithm.signatureName === "rsa") {
+    if (alg.algOid !== oid.byName("rsaEncryption")) throw _ctErr("ct/bad-input", label + " declares an RSA signature but the log key is not an RSA key");
+    if (!(alg.rsaBits >= 2048)) throw _ctErr("ct/unsupported-algorithm", "the CT log RSA key is below the RFC 6962 sec. 2.1.4 minimum of 2048 bits");
+    imp = { name: "RSASSA-PKCS1-v1_5", hash: hashName };
+    ver = { name: "RSASSA-PKCS1-v1_5" };
+  } else {
+    throw _ctErr("ct/unsupported-algorithm", "unsupported " + label + " signature algorithm " +
+      guard.text.showValue(parsed.signatureAlgorithm.signatureName) + " (RFC 6962 sec. 2.1.4 supports ecdsa/rsa)");
+  }
+  try {
+    var key = await _subtleImportKey(subtle, "spki", spki, imp, false, ["verify"]);
+    return await _subtleVerify(subtle, ver, key, sig, preimage);
+  } catch (e) {
+    throw _ctErr("ct/verify-error", label + " signature could not be evaluated", e);
+  }
+}
+
+/** @internal A tree head a caller passes in, held to carrying the two values a proof is checked
+ *  against. It is expected to have come from `getSth`, which returns nothing unverified. */
+function _assertSth(sth, label) {
+  if (!sth || typeof sth !== "object") {
+    throw _ctErr("ct/bad-input", label + " is required -- a verified tree head from pki.ct.getSth; a proof against nothing proves nothing");
+  }
+  /** @internal COPIED, not viewed. Every caller of this holds the result across a network fetch and then
+   *  folds a proof against it, so a view would let the trusted root change between the moment the caller
+   *  supplied it and the moment the fold reads it. An empty proof folds a one-leaf tree to its own leaf
+   *  hash, so a root overwritten with a leaf hash mid-fetch would make an empty proof verify against a
+   *  tree head nobody ever supplied. */
+  var root = _toBuffer(sth.rootHash, label + ".rootHash", _ctErr, "ct/bad-input");
+  if (root.length !== 32) throw _ctErr("ct/bad-input", label + ".rootHash must be exactly 32 bytes, got " + root.length);
+  return { treeSize: guard.range.uint64(sth.treeSize, _ctErr, "ct/bad-input", label + ".treeSize"), rootHash: root };
+}
+
+/** @internal An array of base64 members, each decoded and held to a byte length where one is fixed. */
+/** @internal `maxCount` bounds the ELEMENT COUNT, and every caller passes one. The bound used to be keyed
+ *  on `exactLen === 32`, the fixed width a proof node has, so the one caller whose entries have no fixed
+ *  width, the accepted-roots response, had no bound at all: a configured log is trusted for its own
+ *  signatures and not for its resource use, and a response body well inside the transport's byte cap
+ *  carries about a million empty strings, each of which becomes its own Buffer here (CWE-770). Keying a
+ *  resource bound on an unrelated shape test is what left one caller out of it. */
+function _b64Array(obj, name, code, label, exactLen, maxCount) {
+  var arr = obj[name];
+  if (!intrinsic.isArray(arr)) throw _ctErr(code, "the " + label + " field " + name + " is not an array");
+  if (arr.length > maxCount) {
+    throw _ctErr(code, "the " + label + " carries " + arr.length + " entries, exceeding " + maxCount);
+  }
+  void exactLen;
+  var out = [];
+  for (var i = 0; i < arr.length; i++) {
+    if (typeof arr[i] !== "string") throw _ctErr(code, name + "[" + i + "] is not a base64 string");
+    var buf = guard.encoding.base64(arr[i], C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, code, name + "[" + i + "]");
+    if (exactLen !== undefined && buf.length !== exactLen) {
+      throw _ctErr(code, name + "[" + i + "] is " + buf.length + " bytes, expected " + exactLen);
+    }
+    guard.list.append(out, buf);
+  }
+  return out;
+}
+
 /**
  * @primitive  pki.ct.fetchLogList
  * @signature  pki.ct.fetchLogList(opts) -> Promise<{ logs, byLogId, version, timestamp, raw, status, contentType, tls }>
@@ -1134,7 +2005,15 @@ async function fetchLogList(opts) {
   /** @internal Read once, at the door, and carried from here. Asking again would let an option that
    * answers differently on each read hand back something other than the value that was checked. */
   var transport = _assertTransport(opts);
-  if (opts.signerKey == null) throw _ctErr("ct/bad-input", "opts.signerKey is required -- the caller-pinned CT log-list distributor SPKI (there is no baked-in key)");
+  /** @internal ONE read, and both the presence check and the copy decide from it. Reading it twice let an
+   *  accessor present a non-null value to the check and an attacker's SPKI to the copy, so the list was
+   *  verified under a distributor key the caller never pinned.
+   *  COPIED at the call, before either fetch. The list is verified under this key after BOTH requests
+   *  return, so read from the caller's object at that point it is whatever the buffer holds by then: a
+   *  caller reusing it has the list checked against a distributor it never pinned. */
+  var suppliedSignerKey = opts.signerKey;
+  if (suppliedSignerKey == null) throw _ctErr("ct/bad-input", "opts.signerKey is required -- the caller-pinned CT log-list distributor SPKI (there is no baked-in key)");
+  var pinnedSigner = _toBuffer(suppliedSignerKey, "opts.signerKey", _ctErr, "ct/bad-input");
   if (opts.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log_list.json URL (there is no baked-in vendor URL)");
   var jsonParsed = _parseHttpsUrl(opts.url, "URL");
   var jsonUrl = jsonParsed.href;
@@ -1154,10 +2033,13 @@ async function fetchLogList(opts) {
     if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = opts.headers[k];
   });
   var req = { headers: headers, tls: _tlsForFetch(opts), timeout: timeout, maxResponseBytes: maxResponseBytes };
+  /** @internal Read before the request goes out, so the option that decides the check is the one the call
+   *  was made with rather than whatever it says once the response is back. */
+  var requireJsonContentType = opts.requireJsonContentType === true;
   var jsonRes = await _fetchBody(transport, jsonUrl, req, "CT log-list JSON");
-  if (opts.requireJsonContentType === true && jsonRes.contentType !== "application/json") throw _ctErr("ct/bad-content-type", "the CT log-list JSON GET returned content-type " + JSON.stringify(jsonRes.contentType || null) + " (opts.requireJsonContentType is set)");
+  if (requireJsonContentType && jsonRes.contentType !== "application/json") throw _ctErr("ct/bad-content-type", "the CT log-list JSON GET returned content-type " + JSON.stringify(jsonRes.contentType || null) + " (opts.requireJsonContentType is set)");
   var sigRes = await _fetchBody(transport, sigUrl, req, "CT log-list signature");
-  var ok = await verifyLogListSignature(jsonRes.body, sigRes.body, opts.signerKey);
+  var ok = await verifyLogListSignature(jsonRes.body, sigRes.body, pinnedSigner);
   if (ok !== true) throw _ctErr("ct/log-list-untrusted", "the CT log-list detached signature did not verify against the pinned distributor key -- the fetched list is untrusted and was not parsed");
   var parsed = parseLogList(jsonRes.body);
   return guard.verdict.of({
@@ -1178,6 +2060,15 @@ module.exports = {
   x509CertEntry: x509CertEntry,
   verifyLogListSignature: verifyLogListSignature,
   fetchLogList: fetchLogList,
+  sthSignedData: sthSignedData,
+  verifySth: verifySth,
+  getSth: getSth,
+  getProofByHash: getProofByHash,
+  getSthConsistency: getSthConsistency,
+  getEntries: getEntries,
+  getRoots: getRoots,
+  addChain: addChain,
+  addPreChain: addPreChain,
   HASH_ALGORITHMS: HASH_ALGORITHMS,
   SIGNATURE_ALGORITHMS: SIGNATURE_ALGORITHMS,
 };