@e-sig/core 0.4.0

package/dist/timestamp.js

@@ -0,0 +1,278 @@
+// src/lib/integrations/esig/core/timestamp.ts
+//
+// RFC 3161 Time-Stamp Protocol (TSP) primitives — pure node-forge, dep-free.
+//
+// Implements the minimum needed to upgrade a CAdES-B signature to CAdES-T by
+// embedding an RFC 3161 TimeStampToken (TST) as an UNSIGNED attribute
+// (id-aa-timeStampToken, OID 1.2.840.113549.1.9.16.2.14) inside the PKCS#7
+// SignerInfo. The timestamp is computed over the SignerInfo signatureValue
+// (encryptedDigest) per RFC 3161 §2.4.1.
+//
+// The actual network POST to the TSA is injected by the caller (see
+// TsaTransport in ./types) so this package never performs egress itself — the
+// TSA only ever receives a SHA-256 hash, never any PHI.
+import forge from "node-forge";
+const asn1 = forge.asn1;
+/** OID for the id-aa-timeStampToken unsigned attribute (RFC 3161). */
+export const OID_TIMESTAMP_TOKEN = "1.2.840.113549.1.9.16.2.14";
+const OID_SHA256 = "2.16.840.1.101.3.4.2.1";
+const OID_TST_INFO = "1.2.840.113549.1.9.16.1.4"; // id-ct-TSTInfo
+const OID_SIGNED_DATA = "1.2.840.113549.1.7.2"; // id-signedData
+const OID_COMMON_NAME = "2.5.4.3"; // id-at-commonName
+/** Convert a forge binary string (DER) to a Uint8Array. */
+export function derStringToUint8(der) {
+    const out = new Uint8Array(der.length);
+    for (let i = 0; i < der.length; i++)
+        out[i] = der.charCodeAt(i) & 0xff;
+    return out;
+}
+/** Convert a Uint8Array to a forge binary string (DER). */
+export function uint8ToDerString(bytes) {
+    let s = "";
+    // Chunk to avoid String.fromCharCode argument-count limits on large inputs.
+    const CHUNK = 0x8000;
+    for (let i = 0; i < bytes.length; i += CHUNK) {
+        s += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK));
+    }
+    return s;
+}
+/**
+ * Build an RFC 3161 TimeStampReq (DER, forge binary string) over the given
+ * signatureValue bytes.
+ *
+ *   TimeStampReq ::= SEQUENCE {
+ *     version        INTEGER { v1(1) },
+ *     messageImprint MessageImprint,
+ *     reqPolicy      TSAPolicyId OPTIONAL,   -- omitted
+ *     nonce          INTEGER OPTIONAL,
+ *     certReq        BOOLEAN DEFAULT FALSE }
+ *
+ *   MessageImprint ::= SEQUENCE {
+ *     hashAlgorithm AlgorithmIdentifier,
+ *     hashedMessage OCTET STRING }
+ *
+ * The messageImprint hash input is the RAW signatureValue bytes (a forge
+ * binary string), hashed with SHA-256.
+ */
+export function buildTimeStampReq(sigValueBinary) {
+    const md = forge.md.sha256.create();
+    md.update(sigValueBinary);
+    const hashed = md.digest().getBytes(); // forge binary string
+    // AlgorithmIdentifier ::= SEQUENCE { OID sha256, NULL }
+    const hashAlgorithm = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [
+        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false, asn1.oidToDer(OID_SHA256).getBytes()),
+        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.NULL, false, ""),
+    ]);
+    // MessageImprint ::= SEQUENCE { hashAlgorithm, hashedMessage OCTET STRING }
+    const messageImprint = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [
+        hashAlgorithm,
+        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false, hashed),
+    ]);
+    // version INTEGER (1)
+    const version = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, asn1.integerToDer(1).getBytes());
+    // nonce INTEGER (16 random bytes; prepend 0x00 if the high bit is set so the
+    // value is interpreted as a positive integer).
+    let nonceBytes = forge.random.getBytesSync(16);
+    if ((nonceBytes.charCodeAt(0) & 0x80) !== 0) {
+        nonceBytes = "\x00" + nonceBytes;
+    }
+    const nonce = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, nonceBytes);
+    // certReq BOOLEAN TRUE
+    const certReq = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.BOOLEAN, false, String.fromCharCode(0xff));
+    const req = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [
+        version,
+        messageImprint,
+        nonce,
+        certReq,
+    ]);
+    return asn1.toDer(req).getBytes();
+}
+/**
+ * Parse an RFC 3161 TimeStampResp (DER forge binary string) and return the
+ * embedded TimeStampToken as a forge ASN.1 object.
+ *
+ *   TimeStampResp ::= SEQUENCE {
+ *     status         PKIStatusInfo,
+ *     timeStampToken TimeStampToken OPTIONAL }
+ *
+ *   PKIStatusInfo ::= SEQUENCE {
+ *     status       PKIStatus (INTEGER),
+ *     statusString PKIFreeText OPTIONAL,
+ *     failInfo     PKIFailureInfo OPTIONAL }
+ *
+ * Accepts status 0 (granted) or 1 (grantedWithMods); throws otherwise, with the
+ * integer status and (if present) failInfo bits.
+ */
+export function parseTimeStampResp(respBinary) {
+    const resp = asn1.fromDer(respBinary);
+    if (!Array.isArray(resp.value) || resp.value.length < 1) {
+        throw new Error("RFC3161: malformed TimeStampResp (no PKIStatusInfo)");
+    }
+    const statusInfo = resp.value[0];
+    if (!Array.isArray(statusInfo.value) || statusInfo.value.length < 1) {
+        throw new Error("RFC3161: malformed PKIStatusInfo");
+    }
+    const statusNode = statusInfo.value[0];
+    const status = derIntToNumber(statusNode.value);
+    if (status !== 0 && status !== 1) {
+        // Best-effort failInfo (BIT STRING) for diagnostics.
+        let failInfo = "";
+        for (const child of statusInfo.value) {
+            if (child.type === asn1.Type.BITSTRING && typeof child.value === "string") {
+                failInfo = ` failInfo=0x${forge.util.bytesToHex(child.value)}`;
+                break;
+            }
+        }
+        throw new Error(`RFC3161: TSA rejected request (PKIStatus=${status})${failInfo}`);
+    }
+    const token = resp.value[1];
+    if (!token) {
+        throw new Error("RFC3161: TimeStampResp granted but no timeStampToken present");
+    }
+    return { token };
+}
+/**
+ * Parse a TimeStampToken (a CMS SignedData ContentInfo whose eContentType is
+ * id-ct-TSTInfo) and extract best-effort metadata. Only
+ * `messageImprintHashHex` is treated as load-bearing (used by the verifier's
+ * §2.4.2 binding check); the rest are returned as undefined on any parse miss
+ * rather than throwing.
+ */
+export function parseTstInfo(tokenAsn1) {
+    const result = {};
+    try {
+        if (!Array.isArray(tokenAsn1.value))
+            return result;
+        // ContentInfo ::= SEQUENCE { contentType OID, content [0] EXPLICIT SignedData }
+        let signedData;
+        for (const child of tokenAsn1.value) {
+            if (child.type === asn1.Type.OID &&
+                safeOid(child.value) === OID_SIGNED_DATA) {
+                continue;
+            }
+            if (child.tagClass === asn1.Class.CONTEXT_SPECIFIC && Array.isArray(child.value)) {
+                signedData = child.value[0];
+            }
+        }
+        if (!signedData || !Array.isArray(signedData.value))
+            return result;
+        // SignedData -> EncapsulatedContentInfo ::= SEQUENCE {
+        //   eContentType OID (== id-ct-TSTInfo),
+        //   eContent [0] EXPLICIT OCTET STRING OPTIONAL }
+        let tstInfoBytes;
+        for (const sdChild of signedData.value) {
+            if (sdChild.type !== asn1.Type.SEQUENCE || !Array.isArray(sdChild.value))
+                continue;
+            const seq = sdChild.value;
+            const first = seq[0];
+            if (first &&
+                first.type === asn1.Type.OID &&
+                safeOid(first.value) === OID_TST_INFO) {
+                const explicit = seq[1];
+                if (explicit && Array.isArray(explicit.value)) {
+                    const oct = explicit.value[0];
+                    if (oct && oct.type === asn1.Type.OCTETSTRING) {
+                        if (typeof oct.value === "string") {
+                            tstInfoBytes = oct.value;
+                        }
+                        else if (Array.isArray(oct.value) && oct.value.length > 0) {
+                            // Constructed/definite OCTET STRING wrapper.
+                            tstInfoBytes = oct.value[0].value;
+                        }
+                    }
+                }
+                break;
+            }
+        }
+        if (!tstInfoBytes)
+            return result;
+        // TSTInfo ::= SEQUENCE {
+        //   version INTEGER, policy OID, messageImprint MessageImprint,
+        //   serialNumber INTEGER, genTime GeneralizedTime, ... }
+        const tstInfo = asn1.fromDer(tstInfoBytes);
+        if (!Array.isArray(tstInfo.value))
+            return result;
+        const fields = tstInfo.value;
+        // messageImprint is the first SEQUENCE child; its last element is the
+        // hashedMessage OCTET STRING.
+        for (const f of fields) {
+            if (f.type === asn1.Type.SEQUENCE && Array.isArray(f.value)) {
+                const mi = f.value;
+                const hashed = mi[mi.length - 1];
+                if (hashed && hashed.type === asn1.Type.OCTETSTRING && typeof hashed.value === "string") {
+                    result.messageImprintHashHex = forge.util.bytesToHex(hashed.value);
+                    break;
+                }
+            }
+        }
+        // genTime GeneralizedTime.
+        for (const f of fields) {
+            if (f.type === asn1.Type.GENERALIZEDTIME && typeof f.value === "string") {
+                result.genTime = f.value;
+            }
+        }
+        // serialNumber heuristic: among the INTEGER fields (version + serialNumber),
+        // serialNumber is the larger-byte one.
+        let bestSerial;
+        let bestLen = 0;
+        for (const f of fields) {
+            if (f.type === asn1.Type.INTEGER && typeof f.value === "string" && f.value.length > bestLen) {
+                bestLen = f.value.length;
+                bestSerial = f.value;
+            }
+        }
+        if (bestSerial)
+            result.serialHex = forge.util.bytesToHex(bestSerial);
+        // TSA common name: best-effort from the signer certificate(s).
+        result.tsaCommonName = extractFirstCommonName(signedData);
+    }
+    catch {
+        // Best-effort: swallow parse errors, returning whatever we have.
+    }
+    return result;
+}
+/** Best-effort scan for the first commonName (OID 2.5.4.3) string value. */
+function extractFirstCommonName(node) {
+    let found;
+    const walk = (n) => {
+        if (found)
+            return;
+        if (!Array.isArray(n.value))
+            return;
+        const children = n.value;
+        for (let i = 0; i < children.length; i++) {
+            const c = children[i];
+            if (c.type === asn1.Type.OID &&
+                typeof c.value === "string" &&
+                safeOid(c.value) === OID_COMMON_NAME &&
+                i + 1 < children.length) {
+                const v = children[i + 1];
+                if (typeof v.value === "string" && v.value.length > 0) {
+                    found = v.value;
+                    return;
+                }
+            }
+        }
+        for (const c of children)
+            walk(c);
+    };
+    walk(node);
+    return found;
+}
+function safeOid(der) {
+    try {
+        return asn1.derToOid(der);
+    }
+    catch {
+        return "";
+    }
+}
+/** Decode a DER INTEGER content (forge binary string) to a JS number. */
+function derIntToNumber(bytes) {
+    let n = 0;
+    for (let i = 0; i < bytes.length; i++) {
+        n = n * 256 + (bytes.charCodeAt(i) & 0xff);
+    }
+    return n;
+}
+//# sourceMappingURL=timestamp.js.map

package/dist/timestamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestamp.js","sourceRoot":"","sources":["../src/timestamp.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,6EAA6E;AAC7E,EAAE;AACF,6EAA6E;AAC7E,sEAAsE;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,yCAAyC;AACzC,EAAE;AACF,oEAAoE;AACpE,8EAA8E;AAC9E,wDAAwD;AAExD,OAAO,KAAK,MAAM,YAAY,CAAC;AAE/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAExB,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEhE,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,YAAY,GAAG,2BAA2B,CAAC,CAAC,gBAAgB;AAClE,MAAM,eAAe,GAAG,sBAAsB,CAAC,CAAC,gBAAgB;AAChE,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,mBAAmB;AAEtD,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,4EAA4E;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7C,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAC5B,IAAI,EACJ,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAwB,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAAsB;IACtD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB;IAE7D,wDAAwD;IACxD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QAChF,IAAI,CAAC,MAAM,CACT,IAAI,CAAC,KAAK,CAAC,SAAS,EACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EACb,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CACrC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;KAC7D,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjF,aAAa;QACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;KACxE,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CACzB,IAAI,CAAC,KAAK,CAAC,SAAS,EACpB,IAAI,CAAC,IAAI,CAAC,OAAO,EACjB,KAAK,EACL,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAChC,CAAC;IAEF,6EAA6E;IAC7E,+CAA+C;IAC/C,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IACnC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAEtF,uBAAuB;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CACzB,IAAI,CAAC,KAAK,CAAC,SAAS,EACpB,IAAI,CAAC,IAAI,CAAC,OAAO,EACjB,KAAK,EACL,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAC1B,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACtE,OAAO;QACP,cAAc;QACd,KAAK;QACL,OAAO;KACR,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IAC1D,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,KAAe,CAAC,CAAC;IAE1D,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,qDAAqD;QACrD,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC1E,QAAQ,GAAG,eAAe,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/D,MAAM;YACR,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAgC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,SAA0B;IAMrD,MAAM,MAAM,GAKR,EAAE,CAAC;IAEP,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAEnD,gFAAgF;QAChF,IAAI,UAAuC,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAA0B,EAAE,CAAC;YACzD,IACE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC5B,OAAO,CAAC,KAAK,CAAC,KAAe,CAAC,KAAK,eAAe,EAClD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;YACjD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAEnE,uDAAuD;QACvD,yCAAyC;QACzC,kDAAkD;QAClD,IAAI,YAAgC,CAAC;QACrC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAS;YACnF,MAAM,GAAG,GAAG,OAAO,CAAC,KAA0B,CAAC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,IACE,KAAK;gBACL,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC5B,OAAO,CAAC,KAAK,CAAC,KAAe,CAAC,KAAK,YAAY,EAC/C,CAAC;gBACD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxB,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;oBACjD,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;wBAC9C,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BAClC,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC;wBAC3B,CAAC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC5D,6CAA6C;4BAC7C,YAAY,GAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAqB,CAAC,KAAe,CAAC;wBACnE,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC;QAEjC,yBAAyB;QACzB,gEAAgE;QAChE,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,KAA0B,CAAC;QAElD,sEAAsE;QACtE,8BAA8B;QAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,KAA0B,CAAC;gBACxC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACjC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxF,MAAM,CAAC,qBAAqB,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACnE,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,uCAAuC;QACvC,IAAI,UAA8B,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;gBAC5F,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;gBACzB,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,UAAU;YAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAErE,+DAA+D;QAC/D,MAAM,CAAC,aAAa,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,SAAS,sBAAsB,CAAC,IAAqB;IACnD,IAAI,KAAyB,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAkB,EAAE,EAAE;QAClC,IAAI,KAAK;YAAE,OAAO;QAClB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAA0B,CAAC;QAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACtB,IACE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;gBACxB,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAC3B,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,eAAe;gBACpC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EACvB,CAAC;gBACD,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtD,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;oBAChB,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,44 @@
+export interface Signer {
+    /** Display name shown to humans (PDF visible signature block + cert binding). */
+    name: string;
+    /** Email — embedded in PKCS#7 contactInfo. ASCII recommended. */
+    email: string;
+}
+export interface SigningCertPem {
+    /** PEM-encoded RSA private key. */
+    keyPem: string;
+    /** PEM-encoded X.509 certificate. */
+    certPem: string;
+    /** SHA-256 hex digest of the DER-encoded cert (for audit attribution). */
+    fingerprint: string;
+}
+export interface SignedPdfMetadata {
+    /** Why the doc was signed — embedded in PDF signature dictionary. */
+    reason: string;
+    /** Geographic or URL context — embedded in PDF signature dictionary. */
+    location: string;
+    /** Signer's primary contact — embedded in PDF signature dictionary. */
+    contactInfo: string;
+    /** Signer's display name — embedded in PDF signature dictionary. */
+    name: string;
+    /** When the signature was applied. Defaults to now. */
+    signingTime?: Date;
+}
+/**
+ * Caller-injected RFC 3161 timestamp transport.
+ *
+ * The consumer supplies the network POST so this package stays dependency-free
+ * and performs no egress itself. `fetch` receives the DER-encoded TimeStampReq
+ * bytes and MUST return the raw DER-encoded TimeStampResp bytes. The TSA only
+ * ever sees a SHA-256 hash — never PHI.
+ */
+export interface TsaTransport {
+    /** POST the TimeStampReq DER to the TSA and return the TimeStampResp DER. */
+    fetch: (reqDerBytes: Uint8Array) => Promise<Uint8Array>;
+    /**
+     * When true, a TSA failure aborts signing (throws). When false/omitted, a
+     * failure degrades gracefully to a plain CAdES-B signature.
+     */
+    required?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,MAAM;IACrB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,WAAW,CAAC,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}

package/dist/types.js

@@ -0,0 +1,10 @@
+// src/lib/integrations/esig/core/types.ts
+//
+// Phase 21 — public types for the portable e-sig core.
+//
+// The `core/` module is project-agnostic: pure crypto + rendering + PDF
+// structural verification. Database, Storage, and Auth concerns live in
+// `adapters/` (the current Supabase implementation) or in whatever you
+// supply when porting to another project.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,uDAAuD;AACvD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,0CAA0C"}

package/dist/verify-pdf.d.ts

@@ -0,0 +1,33 @@
+export interface VerifyResult {
+    ok: boolean;
+    byteRange?: [number, number, number, number];
+    pkcs7ActualSize?: number;
+    pkcs7BudgetSize?: number;
+    signerCommonName?: string;
+    signerOrganization?: string;
+    /**
+     * True when SHA-256 over the ByteRange-covered bytes equals the messageDigest
+     * signed attribute (the document has not been altered under the signature).
+     */
+    digestValid?: boolean;
+    /**
+     * True when the RSA signature over the signed attributes verifies against the
+     * embedded signer certificate's public key.
+     */
+    signatureValid?: boolean;
+    /** True if an RFC 3161 TimeStampToken (CAdES-T) is embedded. */
+    timestamped: boolean;
+    /** ISO genTime of the timestamp, if parseable. */
+    timestampTime?: string;
+    /** Common name of the TSA signer cert, if parseable. */
+    tsaCommonName?: string;
+    failures: string[];
+}
+export declare function verifyPdfStructure(signed: Buffer): VerifyResult;
+/**
+ * Preferred name for {@link verifyPdfStructure}. Performs full cryptographic
+ * verification (structure + digest + signature); `ok:true` means the signature
+ * is valid over the exact document bytes.
+ */
+export declare const verifyPdfSignature: typeof verifyPdfStructure;
+//# sourceMappingURL=verify-pdf.d.ts.map

package/dist/verify-pdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-pdf.d.ts","sourceRoot":"","sources":["../src/verify-pdf.ts"],"names":[],"mappings":"AAyCA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gEAAgE;IAChE,WAAW,EAAE,OAAO,CAAC;IACrB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CA4E/D;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,2BAAqB,CAAC"}