@file-viewer/renderer-signature 3.0.0

package/dist/signature.worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/signature.worker.js

@@ -0,0 +1,108 @@
+const scope = self;
+let wasmPromise;
+const loadWasm = async () => {
+    if (wasmPromise)
+        return wasmPromise;
+    wasmPromise = (async () => {
+        try {
+            const wasmUrl = new URL('./rpgp-wasm/rpgp_wrapper_bg.wasm', import.meta.url);
+            const module = (await import('./rpgp-wasm/rpgp_wrapper.js'));
+            await module.default({ module_or_path: wasmUrl });
+            return module;
+        }
+        catch (error) {
+            wasmPromise = undefined;
+            throw Object.assign(new Error(error instanceof Error ? error.message : String(error)), {
+                code: 'wasm-initialization-failed'
+            });
+        }
+    })();
+    return wasmPromise;
+};
+const errorResponse = (id, error) => ({
+    id,
+    ok: false,
+    error: {
+        code: typeof error === 'object' && error && 'code' in error
+            ? String(error.code)
+            : 'internal-parser-error',
+        message: error instanceof Error ? error.message : String(error)
+    }
+});
+const normalizeInspectionResult = (value) => {
+    const result = value;
+    if (result.literalData && !(result.literalData.data instanceof Uint8Array)) {
+        result.literalData.data = Uint8Array.from(result.literalData.data);
+    }
+    return result;
+};
+scope.addEventListener('message', async (event) => {
+    const request = event.data;
+    if (!request ||
+        typeof request.id !== 'string' ||
+        !['classify', 'inspect', 'verify-detached'].includes(request.type)) {
+        scope.postMessage(errorResponse(typeof (request === null || request === void 0 ? void 0 : request.id) === 'string' ? request.id : 'unknown', Object.assign(new Error('Invalid signature Worker request.'), { code: 'invalid-input' })));
+        return;
+    }
+    try {
+        if ((request.type === 'classify' || request.type === 'inspect') &&
+            !(request.input instanceof ArrayBuffer)) {
+            throw Object.assign(new Error('Signature Worker input must be an ArrayBuffer.'), {
+                code: 'invalid-input'
+            });
+        }
+        if (request.type === 'inspect' &&
+            (!Array.isArray(request.publicKeys) ||
+                !request.publicKeys.every((value) => value instanceof ArrayBuffer))) {
+            throw Object.assign(new Error('OpenPGP inspection public keys are malformed.'), {
+                code: 'invalid-input'
+            });
+        }
+        if (request.type === 'verify-detached' &&
+            (!(request.content instanceof ArrayBuffer) ||
+                !(request.signature instanceof ArrayBuffer) ||
+                !Array.isArray(request.publicKeys) ||
+                !request.publicKeys.every((value) => value instanceof ArrayBuffer))) {
+            throw Object.assign(new Error('Detached verification request is malformed.'), {
+                code: 'invalid-input'
+            });
+        }
+        const wasm = await loadWasm();
+        let response;
+        switch (request.type) {
+            case 'classify':
+                response = {
+                    id: request.id,
+                    ok: true,
+                    type: 'classify',
+                    result: wasm.classify_openpgp(new Uint8Array(request.input), request.limits)
+                };
+                break;
+            case 'inspect':
+                response = {
+                    id: request.id,
+                    ok: true,
+                    type: 'inspect',
+                    result: normalizeInspectionResult(wasm.inspect_openpgp(new Uint8Array(request.input), request.publicKeys.map((value) => new Uint8Array(value)), request.limits))
+                };
+                break;
+            case 'verify-detached':
+                response = {
+                    id: request.id,
+                    ok: true,
+                    type: 'verify-detached',
+                    result: wasm.verify_detached_signature(new Uint8Array(request.content), new Uint8Array(request.signature), request.publicKeys.map((value) => new Uint8Array(value)), request.limits)
+                };
+                break;
+            default:
+                throw Object.assign(new Error('Unknown signature Worker request.'), {
+                    code: 'invalid-input'
+                });
+        }
+        scope.postMessage(response);
+    }
+    catch (error) {
+        scope.postMessage(errorResponse(request.id, error));
+    }
+});
+export {};

package/dist/signatureAsn1.d.ts

@@ -0,0 +1,150 @@
+export type SignatureContainerKind = 'cms-signed-data' | 'cms-certificates' | 'cms-content' | 'timestamp-request' | 'timestamp-response' | 'timestamp-token' | 'timestamped-data' | 'unknown';
+export interface SignatureCertificateSummary {
+    index: number;
+    version?: number;
+    serialNumber: string;
+    subject: string;
+    issuer: string;
+    notBefore?: string;
+    notAfter?: string;
+    signatureAlgorithmOid?: string;
+    signatureAlgorithm?: string;
+    publicKeyAlgorithmOid?: string;
+    publicKeyAlgorithm?: string;
+    publicKeyCurveOid?: string;
+    subjectKeyIdentifier?: string;
+    fingerprintSha256?: string;
+}
+export interface SignatureSignerSummary {
+    index: number;
+    sid: string;
+    digestAlgorithmOid?: string;
+    digestAlgorithm?: string;
+    signatureAlgorithmOid?: string;
+    signatureAlgorithm?: string;
+    signingTime?: string;
+    messageDigest?: string;
+    contentTypeOid?: string;
+    certificateIndex?: number;
+    digestMatches?: boolean;
+    cryptographicSignatureValid?: boolean;
+    verificationError?: string;
+    signatureTimestampTokens: number;
+    signingCertificateV2: boolean;
+}
+export interface TimestampAccuracySummary {
+    seconds?: number;
+    millis?: number;
+    micros?: number;
+}
+export interface TimestampInfoSummary {
+    version?: number;
+    policyOid?: string;
+    serialNumber?: string;
+    generationTime?: string;
+    accuracy?: TimestampAccuracySummary;
+    ordering?: boolean;
+    nonce?: string;
+    tsa?: string;
+    messageImprintAlgorithmOid?: string;
+    messageImprintAlgorithm?: string;
+    messageImprint?: string;
+    messageImprintMatchesOriginal?: boolean;
+    certReq?: boolean;
+}
+export interface TimestampResponseSummary {
+    status?: number;
+    statusLabel?: string;
+    statusText: string[];
+    failureInfo?: string;
+}
+export interface SignatureInspection {
+    kind: SignatureContainerKind;
+    detectedFormat: string;
+    sourceSize: number;
+    contentTypeOid?: string;
+    contentType?: string;
+    signedContentTypeOid?: string;
+    signedContentType?: string;
+    digestAlgorithms: string[];
+    embeddedContent?: Uint8Array;
+    detached: boolean;
+    requiresOriginalContent: boolean;
+    originalContentSupplied: boolean;
+    certificates: SignatureCertificateSummary[];
+    signers: SignatureSignerSummary[];
+    timestamp?: TimestampInfoSummary;
+    timestampResponse?: TimestampResponseSummary;
+    crlCount: number;
+    timestampedData?: {
+        dataUri?: string;
+        filename?: string;
+        mediaType?: string;
+        hashProtected?: boolean;
+        temporalEvidenceEntries: number;
+    };
+    warnings: string[];
+}
+export interface SignatureAsn1Limits {
+    maxInputBytes: number;
+    maxOriginalContentBytes: number;
+    maxAsn1Nodes: number;
+    maxAsn1NestingDepth: number;
+    maxDigestAlgorithms: number;
+    maxCertificates: number;
+    maxCrls: number;
+    maxSigners: number;
+    maxAttributesPerSigner: number;
+    maxEmbeddedContentBytes: number;
+    maxTimestampEvidenceEntries: number;
+    maxEvidenceChains: number;
+    maxEvidenceTimestampsPerChain: number;
+    maxEvidenceTimestamps: number;
+    maxReducedHashTreeNodes: number;
+}
+export declare const DEFAULT_SIGNATURE_ASN1_LIMITS: Readonly<SignatureAsn1Limits>;
+export interface InspectSignatureOptions {
+    sourceFilename?: string;
+    extensionHint?: string;
+    originalContent?: ArrayBuffer | Uint8Array;
+    /** Per-call reductions of the absolute hostile-input ceilings. Limits cannot be raised. */
+    limits?: Partial<SignatureAsn1Limits>;
+}
+export interface EvidenceArchiveTimestampSummary {
+    chainIndex: number;
+    index: number;
+    digestAlgorithmOid?: string;
+    digestAlgorithm?: string;
+    reducedHashTreeNodes: number;
+    timestamp?: TimestampInfoSummary;
+    timestampSignerCount: number;
+    timestampSignaturesValid?: boolean;
+    evidenceDigestMatchesOriginal?: boolean;
+    warnings: string[];
+}
+export interface EvidenceRecordInspection {
+    kind: 'evidence-record';
+    detectedFormat: 'RFC 4998 EvidenceRecord';
+    sourceSize: number;
+    version?: number;
+    digestAlgorithms: string[];
+    archiveTimestampChains: number;
+    archiveTimestamps: EvidenceArchiveTimestampSummary[];
+    originalContentSupplied: boolean;
+    originalEvidenceMatches?: boolean;
+    fullyValidated: false;
+    warnings: string[];
+}
+export interface InspectEvidenceRecordOptions {
+    originalContent?: ArrayBuffer | Uint8Array;
+    /** Per-call reductions of the absolute hostile-input ceilings. Limits cannot be raised. */
+    limits?: Partial<SignatureAsn1Limits>;
+}
+export declare const inspectSignatureContainer: (input: ArrayBuffer | Uint8Array, options?: InspectSignatureOptions) => Promise<SignatureInspection>;
+/**
+ * Bounded RFC 4998 structural inspection. Only the first archive timestamp can
+ * be compared directly with supplied original bytes when no reduced hash tree
+ * is present. Renewal chains are reported but never over-claimed as validated.
+ */
+export declare const inspectEvidenceRecord: (input: ArrayBuffer | Uint8Array, options?: InspectEvidenceRecordOptions) => Promise<EvidenceRecordInspection>;
+export declare const signatureOidLabels: Readonly<Record<string, string>>;