@file-viewer/renderer-signature 3.0.0

package/dist/structured/asic.d.ts

@@ -0,0 +1,3 @@
+import { type SignatureContainerLimits } from './limits.js';
+import type { AsicInspection } from './types.js';
+export declare const inspectAsicContainer: (input: ArrayBuffer | Uint8Array, requestedLimits?: Partial<SignatureContainerLimits>) => Promise<AsicInspection>;

package/dist/structured/asic.js

@@ -0,0 +1,188 @@
+import JSZip from 'jszip';
+import { normalizeSignatureContainerLimits } from './limits.js';
+import { inspectZipCentralDirectory } from './zipPreflight.js';
+const ASICS_MIME = 'application/vnd.etsi.asic-s+zip';
+const ASICE_MIME = 'application/vnd.etsi.asic-e+zip';
+const METADATA_PREFIX = 'META-INF/';
+const getExtension = (name) => {
+    const basename = name.split('/').pop() || '';
+    const dot = basename.lastIndexOf('.');
+    return dot > 0 ? basename.slice(dot + 1).toLowerCase() : '';
+};
+const signatureKind = (name) => {
+    const extension = getExtension(name);
+    if (['p7s', 'p7m', 'p7b', 'p7c', 'pkcs7', 'cms', 'cmsc'].includes(extension))
+        return 'cades';
+    if (['tst', 'tsr', 'tsq', 'tsd'].includes(extension))
+        return 'timestamp';
+    if (extension === 'ers')
+        return 'evidence-record';
+    if (extension === 'jws')
+        return 'jws';
+    if (extension === 'xml')
+        return 'xades-or-xml';
+    return 'unknown';
+};
+const contentTypeForName = (name) => {
+    const extension = getExtension(name);
+    return {
+        pdf: 'application/pdf',
+        xml: 'application/xml',
+        json: 'application/json',
+        txt: 'text/plain',
+        html: 'text/html',
+        htm: 'text/html',
+        png: 'image/png',
+        jpg: 'image/jpeg',
+        jpeg: 'image/jpeg',
+        gif: 'image/gif',
+        docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+    }[extension];
+};
+const safeArchiveReference = (value) => {
+    if (!value ||
+        value.startsWith('#') ||
+        value.includes('\u0000') ||
+        /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(value))
+        return undefined;
+    let decoded;
+    try {
+        decoded = decodeURIComponent(value);
+    }
+    catch {
+        return undefined;
+    }
+    if (decoded.startsWith('/') || decoded.includes('\\'))
+        return undefined;
+    const parts = decoded.split('/');
+    if (parts.some((part) => part === '..' || part === '.'))
+        return undefined;
+    return decoded.normalize('NFC');
+};
+/** Linear, non-validating extraction of same-container URI metadata only. */
+const collectXmlReferences = (data, maxXmlBytes) => {
+    if (data.byteLength > maxXmlBytes)
+        return [];
+    const text = new TextDecoder('utf-8', { fatal: false }).decode(data);
+    const references = [];
+    let cursor = 0;
+    while (cursor < text.length && references.length < 256) {
+        const uri = text.indexOf('URI', cursor);
+        if (uri < 0)
+            break;
+        cursor = uri + 3;
+        while (cursor < text.length && /\s/u.test(text[cursor]))
+            cursor += 1;
+        if (text[cursor] !== '=')
+            continue;
+        cursor += 1;
+        while (cursor < text.length && /\s/u.test(text[cursor]))
+            cursor += 1;
+        const quote = text[cursor];
+        if (quote !== '"' && quote !== "'")
+            continue;
+        const end = text.indexOf(quote, cursor + 1);
+        if (end < 0 || end - cursor > 4096)
+            break;
+        const safe = safeArchiveReference(text.slice(cursor + 1, end));
+        if (safe && !references.includes(safe))
+            references.push(safe);
+        cursor = end + 1;
+    }
+    return references;
+};
+const extractChecked = async (zip, entry) => {
+    const file = zip.file(entry.name);
+    if (!file)
+        throw new Error(`ASiC entry ${entry.name} disappeared after ZIP validation.`);
+    const data = await file.async('uint8array');
+    if (data.byteLength !== entry.uncompressedSize) {
+        throw new Error(`ASiC entry ${entry.name} inflated to an unexpected size.`);
+    }
+    return data;
+};
+export const inspectAsicContainer = async (input, requestedLimits) => {
+    const limits = normalizeSignatureContainerLimits(requestedLimits);
+    const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+    const directory = inspectZipCentralDirectory(bytes, limits);
+    const fileEntries = directory.entries.filter((entry) => !entry.directory);
+    const mimetypeEntry = fileEntries.find((entry) => entry.name === 'mimetype');
+    if (!mimetypeEntry ||
+        mimetypeEntry.localHeaderOffset !== 0 ||
+        mimetypeEntry.compressionMethod !== 0) {
+        throw new Error('ASiC requires an uncompressed first-entry mimetype file.');
+    }
+    const zip = await JSZip.loadAsync(bytes, { checkCRC32: true, createFolders: false });
+    const mimetypeBytes = await extractChecked(zip, mimetypeEntry);
+    const mediaType = new TextDecoder('ascii', { fatal: true }).decode(mimetypeBytes);
+    if (mediaType !== ASICS_MIME && mediaType !== ASICE_MIME) {
+        throw new Error(`Unsupported ASiC mimetype ${JSON.stringify(mediaType)}.`);
+    }
+    const documentEntries = fileEntries.filter((entry) => entry.name !== 'mimetype' && !entry.name.startsWith(METADATA_PREFIX));
+    const metadataEntries = fileEntries.filter((entry) => entry.name.startsWith(METADATA_PREFIX));
+    if (documentEntries.length > limits.maxDocuments)
+        throw new Error(`ASiC document count exceeds ${limits.maxDocuments}.`);
+    const signatureEntries = metadataEntries.filter((entry) => {
+        const basename = entry.name.slice(METADATA_PREFIX.length).toLowerCase();
+        return (basename.includes('signature') ||
+            basename.includes('timestamp') ||
+            ['p7s', 'p7m', 'xml', 'tst', 'tsr', 'ers', 'jws'].includes(getExtension(entry.name)));
+    });
+    if (signatureEntries.length > limits.maxSignatureMembers)
+        throw new Error(`ASiC signature-member count exceeds ${limits.maxSignatureMembers}.`);
+    const documents = [];
+    for (const entry of documentEntries) {
+        documents.push({
+            name: entry.name,
+            compressedSize: entry.compressedSize,
+            uncompressedSize: entry.uncompressedSize,
+            mediaType: contentTypeForName(entry.name),
+            data: await extractChecked(zip, entry)
+        });
+    }
+    const signatures = [];
+    for (const entry of signatureEntries) {
+        const data = await extractChecked(zip, entry);
+        signatures.push({
+            name: entry.name,
+            compressedSize: entry.compressedSize,
+            uncompressedSize: entry.uncompressedSize,
+            data,
+            kind: signatureKind(entry.name),
+            referencedDocuments: getExtension(entry.name) === 'xml'
+                ? collectXmlReferences(data, limits.maxXmlBytes).filter((reference) => documents.some((document) => document.name === reference))
+                : []
+        });
+    }
+    const signatureNames = new Set(signatureEntries.map((entry) => entry.name));
+    const metadata = metadataEntries
+        .filter((entry) => !signatureNames.has(entry.name))
+        .map((entry) => ({
+        name: entry.name,
+        compressedSize: entry.compressedSize,
+        uncompressedSize: entry.uncompressedSize,
+        mediaType: contentTypeForName(entry.name)
+    }));
+    const kind = mediaType === ASICS_MIME ? 'ASiC-S' : 'ASiC-E';
+    const warnings = [
+        'ZIP paths, entry sizes, compression ratios, CRCs and aggregate inflation were checked before extracted content was exposed.',
+        'No URI, certificate URL, revocation endpoint or package reference is fetched automatically.',
+        'Package parsing and member mapping do not establish certificate trust, policy compliance or legal validity.'
+    ];
+    if (kind === 'ASiC-S' && documents.length !== 1)
+        warnings.push(`ASiC-S normally carries one document; this package contains ${documents.length}.`);
+    if (!signatures.length)
+        warnings.push('No signature or timestamp member was detected under META-INF.');
+    return {
+        kind,
+        mediaType,
+        sourceSize: bytes.byteLength,
+        entryCount: fileEntries.length,
+        totalUncompressedBytes: directory.totalUncompressedBytes,
+        documents,
+        signatures,
+        metadata,
+        warnings
+    };
+};

package/dist/structured/containerClient.d.ts

@@ -0,0 +1,12 @@
+import { type SignatureContainerLimits } from './limits.js';
+import type { AsicInspection } from './types.js';
+export declare class SignatureContainerWorkerClient {
+    private readonly workerFactory?;
+    private worker?;
+    private readonly pending;
+    constructor(workerFactory?: (() => Worker) | undefined);
+    private ensureWorker;
+    private failWorker;
+    inspectAsic(input: ArrayBuffer, requestedLimits?: Partial<SignatureContainerLimits>): Promise<AsicInspection>;
+    dispose(): void;
+}

package/dist/structured/containerClient.js

@@ -0,0 +1,71 @@
+import { normalizeSignatureContainerLimits } from './limits.js';
+let nextContainerRequestId = 0;
+export class SignatureContainerWorkerClient {
+    constructor(workerFactory) {
+        this.workerFactory = workerFactory;
+        this.pending = new Map();
+    }
+    ensureWorker() {
+        if (this.worker)
+            return this.worker;
+        if (typeof Worker === 'undefined')
+            throw new Error('ASiC inspection requires Web Worker support.');
+        const worker = this.workerFactory
+            ? this.workerFactory()
+            : new Worker(new URL('../container.worker.js', import.meta.url), {
+                type: 'module',
+                name: 'file-viewer-signature-container'
+            });
+        worker.addEventListener('message', (event) => {
+            const pending = this.pending.get(event.data.id);
+            if (!pending)
+                return;
+            clearTimeout(pending.timer);
+            this.pending.delete(event.data.id);
+            if (event.data.ok)
+                pending.resolve(event.data.result);
+            else
+                pending.reject(Object.assign(new Error(event.data.error.message), { code: event.data.error.code }));
+        });
+        worker.addEventListener('error', (event) => this.failWorker(new Error(event.message || 'ASiC Worker failed.')));
+        worker.addEventListener('messageerror', () => this.failWorker(new Error('ASiC Worker returned an unreadable response.')));
+        this.worker = worker;
+        return worker;
+    }
+    failWorker(error) {
+        var _a;
+        (_a = this.worker) === null || _a === void 0 ? void 0 : _a.terminate();
+        this.worker = undefined;
+        for (const pending of this.pending.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+        }
+        this.pending.clear();
+    }
+    inspectAsic(input, requestedLimits) {
+        if (this.pending.size >= 2)
+            return Promise.reject(new Error('ASiC Worker request limit exceeded.'));
+        const limits = normalizeSignatureContainerLimits(requestedLimits);
+        if (input.byteLength === 0 || input.byteLength > limits.maxContainerBytes) {
+            return Promise.reject(new Error(`ASiC input exceeds the ${limits.maxContainerBytes}-byte boundary.`));
+        }
+        const worker = this.ensureWorker();
+        const id = `signature-container-${++nextContainerRequestId}`;
+        const transferable = input.slice(0);
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.failWorker(new DOMException('ASiC inspection timed out.', 'TimeoutError'));
+            }, limits.maxWorkerMs);
+            this.pending.set(id, { resolve, reject, timer });
+            worker.postMessage({
+                id,
+                type: 'inspect-asic',
+                input: transferable,
+                limits
+            }, [transferable]);
+        });
+    }
+    dispose() {
+        this.failWorker(new DOMException('ASiC Worker was terminated.', 'AbortError'));
+    }
+}

package/dist/structured/containerProtocol.d.ts

@@ -0,0 +1,20 @@
+import type { SignatureContainerLimits } from './limits.js';
+import type { AsicInspection } from './types.js';
+export interface AsicWorkerRequest {
+    id: string;
+    type: 'inspect-asic';
+    input: ArrayBuffer;
+    limits: SignatureContainerLimits;
+}
+export type AsicWorkerResponse = {
+    id: string;
+    ok: true;
+    result: AsicInspection;
+} | {
+    id: string;
+    ok: false;
+    error: {
+        code: 'invalid-input' | 'unsafe-archive' | 'internal-parser-error';
+        message: string;
+    };
+};

package/dist/structured/containerProtocol.js

@@ -0,0 +1 @@
+export {};

package/dist/structured/jws.d.ts

@@ -0,0 +1,3 @@
+import type { InspectJwsOptions, JwsInspection } from './types.js';
+export declare const isProbablyJws: (bytes: Uint8Array, filename?: string) => boolean;
+export declare const inspectJws: (input: ArrayBuffer | Uint8Array | string, options?: InspectJwsOptions) => Promise<JwsInspection>;