@e-sig/core 0.4.0

package/dist/verify-pdf.js

@@ -0,0 +1,338 @@
+// src/lib/integrations/esig/core/verify-pdf.ts
+//
+// Portable CRYPTOGRAPHIC verifier for PKCS#7-signed PDFs. Returns diagnostics
+// rather than throwing — callers decide whether to surface failures.
+//
+// `ok:true` means the signature is cryptographically valid over this exact
+// document, i.e. ALL of:
+//   1. Structure — the /ByteRange dictionary tiles the file around the
+//      /Contents hole, and the PKCS#7 blob DER-parses.
+//   2. Integrity (digest) — SHA-256 recomputed over the ByteRange-covered bytes
+//      equals the `messageDigest` signed attribute. A single flipped byte in the
+//      covered region fails this check.
+//   3. Authenticity (signature) — the RSA signature over DER(signedAttrs) taken
+//      as a SET verifies against the embedded signer certificate's public key.
+//
+// A tampered document therefore returns ok:false (not ok:true), which is the
+// whole point of a signature verifier. `verifyPdfStructure` is retained as the
+// historical name; `verifyPdfSignature` is the preferred alias.
+//
+// RFC 3161 (CAdES-T): if the SignerInfo carries an id-aa-timeStampToken
+// UNSIGNED attribute, we surface `timestamped:true` plus best-effort genTime /
+// TSA common name, AND enforce the §2.4.2 binding check — the TST's
+// messageImprint MUST equal sha256(signerInfo.signature). A mismatch is a hard
+// failure (ok:false). Absence of a timestamp is fine (backward compatible:
+// timestamped:false, ok unaffected).
+//
+// NOTE: this validates the signature MATH against the certificate embedded in
+// the document. It does NOT establish trust in that certificate (chain to a
+// trust anchor, revocation, AATL/EUTL membership) — self-issued signer certs
+// are their own trust root, so trust is an out-of-band, deployment-level concern.
+import crypto from "node:crypto";
+import forge from "node-forge";
+import { OID_TIMESTAMP_TOKEN, parseTstInfo } from "./timestamp.js";
+const asn1 = forge.asn1;
+/** OID id-messageDigest (PKCS#9 signed attribute). */
+const OID_MESSAGE_DIGEST = "1.2.840.113549.1.9.4";
+export function verifyPdfStructure(signed) {
+    const failures = [];
+    const text = signed.toString("binary");
+    const result = { ok: false, failures, timestamped: false };
+    const m = text.match(/\/ByteRange\s*\[\s*(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s*\]/);
+    if (!m) {
+        failures.push("no /ByteRange dictionary found");
+        return result;
+    }
+    const [a, b, c, d] = m.slice(1, 5).map(Number);
+    result.byteRange = [a, b, c, d];
+    const covered = b + d;
+    const hole = c - (a + b);
+    if (covered + hole !== signed.length) {
+        failures.push(`byte ranges (${covered}) + hole (${hole}) != file size (${signed.length})`);
+        return result;
+    }
+    result.pkcs7BudgetSize = hole - 2;
+    const contentsRegion = signed.slice(a + b + 1, c - 1);
+    const hexBlob = contentsRegion.toString("binary").replace(/[^0-9a-fA-F]/g, "");
+    const trimmedHex = hexBlob.replace(/(00)+$/, "");
+    const pkcs7Der = Buffer.from(trimmedHex, "hex").toString("binary");
+    result.pkcs7ActualSize = pkcs7Der.length;
+    try {
+        const root = forge.asn1.fromDer(pkcs7Der);
+        const p7 = forge.pkcs7.messageFromAsn1(root);
+        if (!p7.certificates || p7.certificates.length === 0) {
+            failures.push("PKCS#7 has no embedded certificates");
+            return result;
+        }
+        const signerCert = p7.certificates[0];
+        const subject = signerCert.subject;
+        result.signerCommonName = subject.getField("CN")?.value;
+        result.signerOrganization = subject.getField("O")?.value;
+        // ---- Cryptographic verification (integrity + authenticity) ----
+        // Recompute the digest over the ByteRange-covered bytes and RSA-verify the
+        // signature over the signed attributes. This is what makes ok:true mean
+        // "valid signature", not merely "well-formed structure".
+        const covered = Buffer.concat([
+            signed.subarray(a, a + b),
+            signed.subarray(c, c + d),
+        ]);
+        const crypto_ = verifySignerCrypto(root, signerCert, covered);
+        result.digestValid = crypto_.digestValid;
+        result.signatureValid = crypto_.signatureValid;
+        for (const f of crypto_.failures)
+            failures.push(f);
+        // RFC 3161: inspect the first SignerInfo for an id-aa-timeStampToken.
+        const ts = inspectTimestamp(root);
+        if (ts.present) {
+            result.timestamped = true;
+            result.timestampTime = ts.timestampTime;
+            result.tsaCommonName = ts.tsaCommonName;
+            // §2.4.2 binding: TST messageImprint == sha256(signatureValue).
+            if (ts.sigValueHex && ts.messageImprintHashHex) {
+                const expected = sha256Hex(ts.sigValueHex);
+                if (expected !== ts.messageImprintHashHex.toLowerCase()) {
+                    failures.push("timestamp messageImprint does not match signature value");
+                }
+            }
+            else if (!ts.messageImprintHashHex) {
+                failures.push("timestamp present but messageImprint could not be read");
+            }
+        }
+    }
+    catch (e) {
+        failures.push(`PKCS#7 parse error: ${e.message}`);
+        return result;
+    }
+    result.ok = failures.length === 0;
+    return result;
+}
+/**
+ * Preferred name for {@link verifyPdfStructure}. Performs full cryptographic
+ * verification (structure + digest + signature); `ok:true` means the signature
+ * is valid over the exact document bytes.
+ */
+export const verifyPdfSignature = verifyPdfStructure;
+/**
+ * Cryptographically verify the first SignerInfo of a detached PKCS#7:
+ *   digestValid    — SHA-256(coveredContent) === messageDigest signed attribute
+ *   signatureValid — RSA-verify(signature) over DER(signedAttrs re-tagged SET)
+ *                    against the signer certificate's public key
+ *
+ * node-forge's high-level `pkcs7.verify()` does not support externally-detached
+ * content (the signed bytes live in the PDF, not the CMS), so we walk the ASN.1
+ * directly. The re-encoding of the [0] IMPLICIT signedAttrs as a UNIVERSAL SET
+ * OF reproduces exactly the bytes forge signed (same element order), so a
+ * forge-produced signature verifies byte-for-byte.
+ */
+function verifySignerCrypto(contentInfo, signerCert, coveredContent) {
+    const failures = [];
+    let digestValid = false;
+    let signatureValid = false;
+    try {
+        const signerInfo = firstSignerInfo(contentInfo);
+        if (!signerInfo) {
+            failures.push("could not locate SignerInfo for cryptographic verification");
+            return { digestValid, signatureValid, failures };
+        }
+        // signedAttrs = the [0] IMPLICIT context node; signature = the UNIVERSAL
+        // OCTET STRING (encryptedDigest). unsignedAttrs would be [1] — skip it.
+        let signedAttrs;
+        let signatureValue;
+        for (const child of signerInfo.value) {
+            if (child.tagClass === asn1.Class.CONTEXT_SPECIFIC && child.type === 0) {
+                signedAttrs = child;
+            }
+            if (child.tagClass === asn1.Class.UNIVERSAL &&
+                child.type === asn1.Type.OCTETSTRING &&
+                typeof child.value === "string") {
+                signatureValue = child.value;
+            }
+        }
+        if (!signedAttrs || !Array.isArray(signedAttrs.value)) {
+            failures.push("SignerInfo has no signed attributes (cannot verify)");
+            return { digestValid, signatureValid, failures };
+        }
+        // (1) messageDigest signed attribute vs recomputed digest of covered bytes.
+        const messageDigest = extractSignedAttrValue(signedAttrs, OID_MESSAGE_DIGEST);
+        if (!messageDigest) {
+            failures.push("messageDigest signed attribute missing");
+        }
+        else {
+            const recomputed = crypto.createHash("sha256").update(coveredContent).digest();
+            const claimed = Buffer.from(messageDigest, "binary");
+            digestValid =
+                recomputed.length === claimed.length &&
+                    crypto.timingSafeEqual(recomputed, claimed);
+            if (!digestValid) {
+                failures.push("document digest does not match messageDigest attribute — content altered after signing");
+            }
+        }
+        // (2) RSA signature over DER(signedAttrs as SET OF) vs signer public key.
+        if (!signatureValue) {
+            failures.push("SignerInfo signature value missing");
+        }
+        else {
+            const setDer = asn1.toDer(asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SET, true, signedAttrs.value)).getBytes();
+            const md = forge.md.sha256.create();
+            md.update(setDer);
+            try {
+                signatureValid = signerCert.publicKey.verify(md.digest().getBytes(), signatureValue);
+                if (!signatureValid) {
+                    failures.push("signature does not verify against the signer certificate");
+                }
+            }
+            catch (e) {
+                signatureValid = false;
+                failures.push(`signature verification threw: ${e.message}`);
+            }
+        }
+    }
+    catch (e) {
+        failures.push(`cryptographic verification error: ${e.message}`);
+    }
+    return { digestValid, signatureValid, failures };
+}
+/** Locate the first SignerInfo SEQUENCE inside a PKCS#7 SignedData ASN.1 tree. */
+function firstSignerInfo(contentInfo) {
+    if (!Array.isArray(contentInfo.value))
+        return undefined;
+    let signedData;
+    for (const child of contentInfo.value) {
+        if (child.tagClass === asn1.Class.CONTEXT_SPECIFIC && Array.isArray(child.value)) {
+            signedData = child.value[0];
+        }
+    }
+    if (!signedData || !Array.isArray(signedData.value))
+        return undefined;
+    let signerInfos;
+    for (const child of signedData.value) {
+        if (child.tagClass === asn1.Class.UNIVERSAL &&
+            child.type === asn1.Type.SET &&
+            Array.isArray(child.value)) {
+            signerInfos = child; // last UNIVERSAL SET = signerInfos (first = digestAlgorithms)
+        }
+    }
+    if (!signerInfos || !Array.isArray(signerInfos.value) || signerInfos.value.length === 0) {
+        return undefined;
+    }
+    return signerInfos.value[0];
+}
+/**
+ * From a signed-attributes node ([0] IMPLICIT SET OF Attribute), return the
+ * value bytes (forge binary string) of the attribute with the given OID, or
+ * undefined. Attribute ::= SEQUENCE { OID, SET OF AttributeValue }.
+ */
+function extractSignedAttrValue(signedAttrs, oid) {
+    for (const attr of signedAttrs.value) {
+        if (!Array.isArray(attr.value) || attr.value.length < 2)
+            continue;
+        const oidNode = attr.value[0];
+        if (oidNode.type !== asn1.Type.OID || safeOid(oidNode.value) !== oid)
+            continue;
+        const set = attr.value[1];
+        if (!Array.isArray(set.value) || set.value.length === 0)
+            return undefined;
+        const val = set.value[0];
+        return typeof val.value === "string" ? val.value : undefined;
+    }
+    return undefined;
+}
+/**
+ * Walk the parsed PKCS#7 ASN.1 to the first SignerInfo, returning its
+ * signatureValue (hex) and, if present, the embedded TimeStampToken metadata.
+ */
+function inspectTimestamp(contentInfo) {
+    if (!Array.isArray(contentInfo.value))
+        return { present: false };
+    // content [0] EXPLICIT → SignedData SEQUENCE
+    let signedData;
+    for (const child of contentInfo.value) {
+        if (child.tagClass === asn1.Class.CONTEXT_SPECIFIC && Array.isArray(child.value)) {
+            signedData = child.value[0];
+        }
+    }
+    if (!signedData || !Array.isArray(signedData.value))
+        return { present: false };
+    // signerInfos = the last UNIVERSAL SET among SignedData children.
+    let signerInfos;
+    for (const child of signedData.value) {
+        if (child.tagClass === asn1.Class.UNIVERSAL &&
+            child.type === asn1.Type.SET &&
+            Array.isArray(child.value)) {
+            signerInfos = child;
+        }
+    }
+    if (!signerInfos || !Array.isArray(signerInfos.value) || signerInfos.value.length === 0) {
+        return { present: false };
+    }
+    const signerInfo = signerInfos.value[0];
+    if (!Array.isArray(signerInfo.value))
+        return { present: false };
+    const siChildren = signerInfo.value;
+    // SignerInfo signature is the last UNIVERSAL OCTET STRING (encryptedDigest).
+    // unsignedAttrs, if present, is a [1] IMPLICIT context-specific node.
+    let sigValueHex;
+    let unsignedAttrs;
+    for (const child of siChildren) {
+        if (child.tagClass === asn1.Class.UNIVERSAL &&
+            child.type === asn1.Type.OCTETSTRING &&
+            typeof child.value === "string") {
+            sigValueHex = forge.util.bytesToHex(child.value);
+        }
+        if (child.tagClass === asn1.Class.CONTEXT_SPECIFIC && child.type === 1) {
+            unsignedAttrs = child;
+        }
+    }
+    if (!unsignedAttrs || !Array.isArray(unsignedAttrs.value)) {
+        return { present: false, sigValueHex };
+    }
+    // Find the Attribute whose attrType OID is id-aa-timeStampToken.
+    for (const attr of unsignedAttrs.value) {
+        if (!Array.isArray(attr.value) || attr.value.length < 2)
+            continue;
+        const oidNode = attr.value[0];
+        if (oidNode.type !== asn1.Type.OID || safeOid(oidNode.value) !== OID_TIMESTAMP_TOKEN) {
+            continue;
+        }
+        const setNode = attr.value[1];
+        if (!Array.isArray(setNode.value) || setNode.value.length === 0)
+            continue;
+        const token = setNode.value[0];
+        const info = parseTstInfo(token);
+        return {
+            present: true,
+            sigValueHex,
+            messageImprintHashHex: info.messageImprintHashHex,
+            timestampTime: toIsoGeneralizedTime(info.genTime),
+            tsaCommonName: info.tsaCommonName,
+        };
+    }
+    return { present: false, sigValueHex };
+}
+function safeOid(der) {
+    try {
+        return asn1.derToOid(der);
+    }
+    catch {
+        return "";
+    }
+}
+/** sha256 of a hex string, returned as lowercase hex. */
+function sha256Hex(hex) {
+    const md = forge.md.sha256.create();
+    md.update(forge.util.hexToBytes(hex));
+    return md.digest().toHex().toLowerCase();
+}
+/** Convert an ASN.1 GeneralizedTime (e.g. 20260528123456Z) to ISO 8601. */
+function toIsoGeneralizedTime(gt) {
+    if (!gt)
+        return undefined;
+    const m = gt.match(/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(?:\.\d+)?Z?$/);
+    if (!m)
+        return gt;
+    const [, y, mo, d, h, mi, s] = m;
+    const iso = `${y}-${mo}-${d}T${h}:${mi}:${s}Z`;
+    const parsed = new Date(iso);
+    return Number.isNaN(parsed.getTime()) ? gt : parsed.toISOString();
+}
+//# sourceMappingURL=verify-pdf.js.map

package/dist/verify-pdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-pdf.js","sourceRoot":"","sources":["../src/verify-pdf.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,yBAAyB;AACzB,uEAAuE;AACvE,uDAAuD;AACvD,gFAAgF;AAChF,iFAAiF;AACjF,wCAAwC;AACxC,gFAAgF;AAChF,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,gEAAgE;AAChE,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,oEAAoE;AACpE,+EAA+E;AAC/E,2EAA2E;AAC3E,qCAAqC;AACrC,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,kFAAkF;AAElF,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,MAAM,YAAY,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAExB,sDAAsD;AACtD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AA4BlD,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAEzE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,OAAO,aAAa,IAAI,mBAAmB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC;IAElC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAA+B,CAAC;QAC3E,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QACnC,MAAM,CAAC,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAA2B,CAAC;QAC9E,MAAM,CAAC,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAA2B,CAAC;QAE/E,kEAAkE;QAClE,2EAA2E;QAC3E,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;SAC1B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnD,sEAAsE;QACtE,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;YAC1B,MAAM,CAAC,aAAa,GAAG,EAAE,CAAC,aAAa,CAAC;YACxC,MAAM,CAAC,aAAa,GAAG,EAAE,CAAC,aAAa,CAAC;YAExC,gEAAgE;YAChE,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,qBAAqB,EAAE,CAAC;gBAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;gBAC3C,IAAI,QAAQ,KAAK,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxD,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC;gBACrC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,WAA4B,EAC5B,UAAiC,EACjC,cAAsB;IAEtB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC5E,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;QACnD,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,WAAwC,CAAC;QAC7C,IAAI,cAAkC,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACvE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;gBACvC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW;gBACpC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAC/B,CAAC;gBACD,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YACrE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;QACnD,CAAC;QAED,4EAA4E;QAC5E,MAAM,aAAa,GAAG,sBAAsB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC;YAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACrD,WAAW;gBACT,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;oBACpC,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CACX,wFAAwF,CACzF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAC1E,CAAC,QAAQ,EAAE,CAAC;YACb,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClB,IAAI,CAAC;gBACH,cAAc,GAAI,UAAU,CAAC,SAAqC,CAAC,MAAM,CACvE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EACtB,cAAc,CACf,CAAC;gBACF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,QAAQ,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,cAAc,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,iCAAkC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,qCAAsC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,WAA4B;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YACvC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;YACD,WAAW,GAAG,KAAK,CAAC,CAAC,8DAA8D;QACrF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,WAA4B,EAC5B,GAAW;IAEX,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAe,CAAC,KAAK,GAAG;YAAE,SAAS;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QAC5C,OAAO,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,WAA4B;IAOpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEjE,6CAA6C;IAC7C,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE/E,kEAAkE;IAClE,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YACvC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;YACD,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,UAAU,CAAC,KAA0B,CAAC;IAEzD,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,WAA+B,CAAC;IACpC,IAAI,aAA0C,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YACvC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW;YACpC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAC/B,CAAC;YACD,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvE,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACzC,CAAC;IAED,iEAAiE;IACjE,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAA0B,EAAE,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAe,CAAC,KAAK,mBAAmB,EAAE,CAAC;YAC/F,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QAElD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,WAAW;YACX,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;YACjD,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,2EAA2E;AAC3E,SAAS,oBAAoB,CAAC,EAAW;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;AACpE,CAAC"}

package/package.json

@@ -0,0 +1,92 @@
+{
+  "name": "@e-sig/core",
+  "version": "0.4.0",
+  "description": "Self-contained PKCS#7 PDF signing — no SaaS, no metering, no per-doc fees. Render→sign→verify engine + pluggable persistence interfaces + end-to-end signDocument() orchestrator.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./signature-block": {
+      "types": "./dist/signature-block.d.ts",
+      "import": "./dist/signature-block.js",
+      "default": "./dist/signature-block.js"
+    },
+    "./adapters": {
+      "types": "./dist/adapters.d.ts",
+      "import": "./dist/adapters.js",
+      "default": "./dist/adapters.js"
+    }
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "CONSUMING.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build",
+    "pretest": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "pdf",
+    "esignature",
+    "e-signature",
+    "pkcs7",
+    "pades",
+    "etsi",
+    "cades",
+    "self-hosted",
+    "documenso",
+    "docuseal",
+    "self-contained",
+    "esign",
+    "ueta",
+    "hipaa"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vmvtech/esig-suite.git",
+    "directory": "packages/esig-core"
+  },
+  "homepage": "https://github.com/vmvtech/esig-suite/tree/main/packages/esig-core#readme",
+  "dependencies": {
+    "@signpdf/placeholder-plain": "^3.3.0",
+    "@signpdf/signpdf": "^3.3.0",
+    "@signpdf/utils": "^3.3.0",
+    "node-forge": "^1.4.0",
+    "puppeteer-core": "^24.0.0 || ^25.0.0"
+  },
+  "peerDependencies": {
+    "@sparticuz/chromium": "^140.0.0 || ^148.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@sparticuz/chromium": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@sparticuz/chromium": "^140.0.0",
+    "@types/node": "^22.0.0",
+    "@types/node-forge": "^1.3.0",
+    "typescript": "^5.4.0",
+    "vitest": "^2.1.9"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  }
+}