@owf/eudi-jades 0.1.0

package/dist/index.d.mts

@@ -0,0 +1,1001 @@
+import { z } from "zod";
+
+//#region src/constants.d.ts
+/**
+ * JAdES Constants
+ *
+ * Algorithm definitions and OIDs as per ETSI TS 119 182-1.
+ */
+/**
+ * Supported signature algorithms with their hash algorithms.
+ */
+declare const ALGORITHMS: {
+  readonly RS256: {
+    readonly hash: "SHA-256";
+    readonly family: "RSA";
+  };
+  readonly RS384: {
+    readonly hash: "SHA-384";
+    readonly family: "RSA";
+  };
+  readonly RS512: {
+    readonly hash: "SHA-512";
+    readonly family: "RSA";
+  };
+  readonly PS256: {
+    readonly hash: "SHA-256";
+    readonly family: "RSA-PSS";
+  };
+  readonly PS384: {
+    readonly hash: "SHA-384";
+    readonly family: "RSA-PSS";
+  };
+  readonly PS512: {
+    readonly hash: "SHA-512";
+    readonly family: "RSA-PSS";
+  };
+  readonly ES256: {
+    readonly hash: "SHA-256";
+    readonly family: "ECDSA";
+    readonly namedCurve: "P-256";
+  };
+  readonly ES384: {
+    readonly hash: "SHA-384";
+    readonly family: "ECDSA";
+    readonly namedCurve: "P-384";
+  };
+  readonly ES512: {
+    readonly hash: "SHA-512";
+    readonly family: "ECDSA";
+    readonly namedCurve: "P-521";
+  };
+};
+/**
+ * Commitment type OIDs as per RFC 5035.
+ */
+declare enum CommitmentOIDs {
+  /** Proof of origin */
+  proofOfOrigin = "1.2.840.113549.1.9.16.6.1",
+  /** Proof of receipt */
+  proofOfReceipt = "1.2.840.113549.1.9.16.6.2",
+  /** Proof of delivery */
+  proofOfDelivery = "1.2.840.113549.1.9.16.6.3",
+  /** Proof of sender */
+  proofOfSender = "1.2.840.113549.1.9.16.6.4",
+  /** Proof of approval */
+  proofOfApproval = "1.2.840.113549.1.9.16.6.5",
+  /** Proof of creation */
+  proofOfCreation = "1.2.840.113549.1.9.16.6.6"
+}
+/**
+ * JAdES baseline profiles as per ETSI TS 119 182-1.
+ */
+declare enum JAdESProfile {
+  /** Basic - Baseline: basic signature format */
+  B_B = "B-B",
+  /** Basic with Time: signatures with timestamp */
+  B_T = "B-T",
+  /** Basic Long-Term: signatures with validation data for long-term preservation */
+  B_LT = "B-LT",
+  /** Basic Long-Term with Archive timestamps */
+  B_LTA = "B-LTA"
+}
+/**
+ * Detached signature mechanism identifiers as per ETSI TS 119 182-1 Section 5.2.8.
+ */
+declare const DETACHED_MECHANISM_IDS: {
+  /** HTTP Headers mechanism */readonly httpHeaders: "http://uri.etsi.org/19182/HttpHeaders"; /** Object digest mechanism */
+  readonly objectDigest: "http://uri.etsi.org/19182/ObjectIdByURIHash";
+};
+/**
+ * Critical header parameters that must be understood.
+ * ETSI TS 119 182-1 specifies these parameters as critical.
+ */
+declare const CRITICAL_PARAMETERS: readonly ["x5t#o", "sigX5ts", "sigT", "sigD", "sigPl", "sigPId", "srCms", "srAts", "adoTst", "b64"];
+//#endregion
+//#region src/schemas.d.ts
+/**
+ * Supported signature algorithms.
+ */
+declare const SignAlgSchema: z.ZodEnum<{
+  ES256: "ES256";
+  ES384: "ES384";
+  ES512: "ES512";
+  RS256: "RS256";
+  RS384: "RS384";
+  RS512: "RS512";
+  PS256: "PS256";
+  PS384: "PS384";
+  PS512: "PS512";
+}>;
+/**
+ * X.509 Certificate Thumbprint with algorithm specification.
+ * ETSI TS 119 182-1 Section 5.2.2.2
+ */
+declare const X5tOSchema: z.ZodObject<{
+  digAlg: z.ZodString;
+  digVal: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Signature policy descriptor.
+ * ETSI TS 119 182-1 Section 5.2.4
+ */
+declare const SignaturePolicySchema: z.ZodObject<{
+  sigPolicyId: z.ZodOptional<z.ZodString>;
+  sigPolicyHash: z.ZodOptional<z.ZodObject<{
+    hashAlgo: z.ZodString;
+    hashVal: z.ZodString;
+  }, z.core.$strip>>;
+  sigPolicyQualifiers: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+}, z.core.$strip>;
+/**
+ * Signer identifier.
+ * ETSI TS 119 182-1 Section 5.2.3
+ */
+declare const SignerIdentifierSchema: z.ZodObject<{
+  issuerSerial: z.ZodOptional<z.ZodObject<{
+    issuer: z.ZodString;
+    serialNumber: z.ZodString;
+  }, z.core.$strip>>;
+  subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Detached signature descriptor.
+ * ETSI TS 119 182-1 Section 5.2.8
+ */
+declare const SigDSchema: z.ZodObject<{
+  mId: z.ZodString;
+  pars: z.ZodTuple<[z.ZodString, z.ZodString], null>;
+  hashM: z.ZodOptional<z.ZodString>;
+  ctM: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Timestamp tokens container.
+ */
+declare const TstTokensSchema: z.ZodObject<{
+  tstTokens: z.ZodArray<z.ZodObject<{
+    val: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Signature timestamp container (for B-T profile).
+ */
+declare const SigTstSchema: z.ZodObject<{
+  sigTst: z.ZodObject<{
+    tstTokens: z.ZodArray<z.ZodObject<{
+      val: z.ZodString;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * X.509 certificate values (for B-LT profile).
+ */
+declare const XValsSchema: z.ZodObject<{
+  xVals: z.ZodArray<z.ZodObject<{
+    x509Cert: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Revocation values (for B-LT profile).
+ */
+declare const RValsSchema: z.ZodObject<{
+  rVals: z.ZodObject<{
+    crlVals: z.ZodArray<z.ZodString>;
+    ocspVals: z.ZodArray<z.ZodString>;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * Archive timestamp (for B-LTA profile).
+ */
+declare const ArcTstSchema: z.ZodObject<{
+  arcTst: z.ZodObject<{
+    tstTokens: z.ZodArray<z.ZodObject<{
+      val: z.ZodString;
+    }, z.core.$strip>>;
+    canonAlg: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * ETSI Unsigned properties for different JAdES profiles.
+ */
+declare const EtsiUSchema: z.ZodUnion<readonly [z.ZodArray<z.ZodObject<{
+  sigTst: z.ZodObject<{
+    tstTokens: z.ZodArray<z.ZodObject<{
+      val: z.ZodString;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+}, z.core.$strip>>, z.ZodTuple<[z.ZodObject<{
+  sigTst: z.ZodObject<{
+    tstTokens: z.ZodArray<z.ZodObject<{
+      val: z.ZodString;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+  xVals: z.ZodArray<z.ZodObject<{
+    x509Cert: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+  rVals: z.ZodObject<{
+    crlVals: z.ZodArray<z.ZodString>;
+    ocspVals: z.ZodArray<z.ZodString>;
+  }, z.core.$strip>;
+}, z.core.$strip>], null>, z.ZodTuple<[z.ZodObject<{
+  sigTst: z.ZodObject<{
+    tstTokens: z.ZodArray<z.ZodObject<{
+      val: z.ZodString;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+  xVals: z.ZodArray<z.ZodObject<{
+    x509Cert: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+  rVals: z.ZodObject<{
+    crlVals: z.ZodArray<z.ZodString>;
+    ocspVals: z.ZodArray<z.ZodString>;
+  }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+  arcTst: z.ZodObject<{
+    tstTokens: z.ZodArray<z.ZodObject<{
+      val: z.ZodString;
+    }, z.core.$strip>>;
+    canonAlg: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+}, z.core.$strip>], null>]>;
+/**
+ * JAdES Protected Header parameters as per ETSI TS 119 182-1.
+ */
+declare const ProtectedHeaderSchema: z.ZodObject<{
+  alg: z.ZodOptional<z.ZodEnum<{
+    ES256: "ES256";
+    ES384: "ES384";
+    ES512: "ES512";
+    RS256: "RS256";
+    RS384: "RS384";
+    RS512: "RS512";
+    PS256: "PS256";
+    PS384: "PS384";
+    PS512: "PS512";
+  }>>;
+  cty: z.ZodOptional<z.ZodString>;
+  kid: z.ZodOptional<z.ZodString>;
+  x5u: z.ZodOptional<z.ZodString>;
+  x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  'x5t#S256': z.ZodOptional<z.ZodString>;
+  'x5t#o': z.ZodOptional<z.ZodObject<{
+    digAlg: z.ZodString;
+    digVal: z.ZodString;
+  }, z.core.$strip>>;
+  sigX5ts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    digAlg: z.ZodString;
+    digVal: z.ZodString;
+  }, z.core.$strip>>>;
+  srCms: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    commId: z.ZodString;
+    commQuals: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+  }, z.core.$strip>>>;
+  srAts: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+  sigPl: z.ZodOptional<z.ZodObject<{
+    sigPolicyId: z.ZodOptional<z.ZodString>;
+    sigPolicyHash: z.ZodOptional<z.ZodObject<{
+      hashAlgo: z.ZodString;
+      hashVal: z.ZodString;
+    }, z.core.$strip>>;
+    sigPolicyQualifiers: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+  }, z.core.$strip>>;
+  sigPId: z.ZodOptional<z.ZodObject<{
+    issuerSerial: z.ZodOptional<z.ZodObject<{
+      issuer: z.ZodString;
+      serialNumber: z.ZodString;
+    }, z.core.$strip>>;
+    subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  sigT: z.ZodOptional<z.ZodString>;
+  sigD: z.ZodOptional<z.ZodObject<{
+    mId: z.ZodString;
+    pars: z.ZodTuple<[z.ZodString, z.ZodString], null>;
+    hashM: z.ZodOptional<z.ZodString>;
+    ctM: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  b64: z.ZodOptional<z.ZodLiteral<false>>;
+  crit: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  iat: z.ZodOptional<z.ZodNumber>;
+  signedAt: z.ZodOptional<z.ZodNumber>;
+  jti: z.ZodOptional<z.ZodString>;
+  typ: z.ZodOptional<z.ZodString>;
+  adoTst: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+}, z.core.$loose>;
+/**
+ * Protected header schema for signing (alg required).
+ */
+declare const ProtectedHeaderForSigningSchema: z.ZodObject<{
+  cty: z.ZodOptional<z.ZodString>;
+  kid: z.ZodOptional<z.ZodString>;
+  x5u: z.ZodOptional<z.ZodString>;
+  x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  'x5t#S256': z.ZodOptional<z.ZodString>;
+  'x5t#o': z.ZodOptional<z.ZodObject<{
+    digAlg: z.ZodString;
+    digVal: z.ZodString;
+  }, z.core.$strip>>;
+  sigX5ts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    digAlg: z.ZodString;
+    digVal: z.ZodString;
+  }, z.core.$strip>>>;
+  srCms: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    commId: z.ZodString;
+    commQuals: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+  }, z.core.$strip>>>;
+  srAts: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+  sigPl: z.ZodOptional<z.ZodObject<{
+    sigPolicyId: z.ZodOptional<z.ZodString>;
+    sigPolicyHash: z.ZodOptional<z.ZodObject<{
+      hashAlgo: z.ZodString;
+      hashVal: z.ZodString;
+    }, z.core.$strip>>;
+    sigPolicyQualifiers: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+  }, z.core.$strip>>;
+  sigPId: z.ZodOptional<z.ZodObject<{
+    issuerSerial: z.ZodOptional<z.ZodObject<{
+      issuer: z.ZodString;
+      serialNumber: z.ZodString;
+    }, z.core.$strip>>;
+    subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  sigT: z.ZodOptional<z.ZodString>;
+  sigD: z.ZodOptional<z.ZodObject<{
+    mId: z.ZodString;
+    pars: z.ZodTuple<[z.ZodString, z.ZodString], null>;
+    hashM: z.ZodOptional<z.ZodString>;
+    ctM: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  b64: z.ZodOptional<z.ZodLiteral<false>>;
+  crit: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  iat: z.ZodOptional<z.ZodNumber>;
+  signedAt: z.ZodOptional<z.ZodNumber>;
+  jti: z.ZodOptional<z.ZodString>;
+  typ: z.ZodOptional<z.ZodString>;
+  adoTst: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+  alg: z.ZodEnum<{
+    ES256: "ES256";
+    ES384: "ES384";
+    ES512: "ES512";
+    RS256: "RS256";
+    RS384: "RS384";
+    RS512: "RS512";
+    PS256: "PS256";
+    PS384: "PS384";
+    PS512: "PS512";
+  }>;
+}, z.core.$loose>;
+/**
+ * JAdES Unprotected Header parameters.
+ */
+declare const UnprotectedHeaderSchema: z.ZodObject<{
+  etsiU: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodObject<{
+    sigTst: z.ZodObject<{
+      tstTokens: z.ZodArray<z.ZodObject<{
+        val: z.ZodString;
+      }, z.core.$strip>>;
+    }, z.core.$strip>;
+  }, z.core.$strip>>, z.ZodTuple<[z.ZodObject<{
+    sigTst: z.ZodObject<{
+      tstTokens: z.ZodArray<z.ZodObject<{
+        val: z.ZodString;
+      }, z.core.$strip>>;
+    }, z.core.$strip>;
+  }, z.core.$strip>, z.ZodObject<{
+    xVals: z.ZodArray<z.ZodObject<{
+      x509Cert: z.ZodString;
+    }, z.core.$strip>>;
+  }, z.core.$strip>, z.ZodObject<{
+    rVals: z.ZodObject<{
+      crlVals: z.ZodArray<z.ZodString>;
+      ocspVals: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+  }, z.core.$strip>], null>, z.ZodTuple<[z.ZodObject<{
+    sigTst: z.ZodObject<{
+      tstTokens: z.ZodArray<z.ZodObject<{
+        val: z.ZodString;
+      }, z.core.$strip>>;
+    }, z.core.$strip>;
+  }, z.core.$strip>, z.ZodObject<{
+    xVals: z.ZodArray<z.ZodObject<{
+      x509Cert: z.ZodString;
+    }, z.core.$strip>>;
+  }, z.core.$strip>, z.ZodObject<{
+    rVals: z.ZodObject<{
+      crlVals: z.ZodArray<z.ZodString>;
+      ocspVals: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+  }, z.core.$strip>, z.ZodObject<{
+    arcTst: z.ZodObject<{
+      tstTokens: z.ZodArray<z.ZodObject<{
+        val: z.ZodString;
+      }, z.core.$strip>>;
+      canonAlg: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+  }, z.core.$strip>], null>]>>;
+  disclosures: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  kid: z.ZodOptional<z.ZodString>;
+  kb_jwt: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+/**
+ * General JWS structure with multiple signatures.
+ */
+declare const GeneralJWSSchema: z.ZodObject<{
+  payload: z.ZodString;
+  signatures: z.ZodArray<z.ZodObject<{
+    protected: z.ZodString;
+    signature: z.ZodString;
+    header: z.ZodOptional<z.ZodObject<{
+      etsiU: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodObject<{
+        sigTst: z.ZodObject<{
+          tstTokens: z.ZodArray<z.ZodObject<{
+            val: z.ZodString;
+          }, z.core.$strip>>;
+        }, z.core.$strip>;
+      }, z.core.$strip>>, z.ZodTuple<[z.ZodObject<{
+        sigTst: z.ZodObject<{
+          tstTokens: z.ZodArray<z.ZodObject<{
+            val: z.ZodString;
+          }, z.core.$strip>>;
+        }, z.core.$strip>;
+      }, z.core.$strip>, z.ZodObject<{
+        xVals: z.ZodArray<z.ZodObject<{
+          x509Cert: z.ZodString;
+        }, z.core.$strip>>;
+      }, z.core.$strip>, z.ZodObject<{
+        rVals: z.ZodObject<{
+          crlVals: z.ZodArray<z.ZodString>;
+          ocspVals: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+      }, z.core.$strip>], null>, z.ZodTuple<[z.ZodObject<{
+        sigTst: z.ZodObject<{
+          tstTokens: z.ZodArray<z.ZodObject<{
+            val: z.ZodString;
+          }, z.core.$strip>>;
+        }, z.core.$strip>;
+      }, z.core.$strip>, z.ZodObject<{
+        xVals: z.ZodArray<z.ZodObject<{
+          x509Cert: z.ZodString;
+        }, z.core.$strip>>;
+      }, z.core.$strip>, z.ZodObject<{
+        rVals: z.ZodObject<{
+          crlVals: z.ZodArray<z.ZodString>;
+          ocspVals: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+      }, z.core.$strip>, z.ZodObject<{
+        arcTst: z.ZodObject<{
+          tstTokens: z.ZodArray<z.ZodObject<{
+            val: z.ZodString;
+          }, z.core.$strip>>;
+          canonAlg: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+      }, z.core.$strip>], null>]>>;
+      disclosures: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      kid: z.ZodOptional<z.ZodString>;
+      kb_jwt: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Flattened JWS structure (single signature).
+ */
+declare const FlattenedJWSSchema: z.ZodObject<{
+  protected: z.ZodString;
+  payload: z.ZodString;
+  signature: z.ZodString;
+  header: z.ZodOptional<z.ZodObject<{
+    etsiU: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodObject<{
+      sigTst: z.ZodObject<{
+        tstTokens: z.ZodArray<z.ZodObject<{
+          val: z.ZodString;
+        }, z.core.$strip>>;
+      }, z.core.$strip>;
+    }, z.core.$strip>>, z.ZodTuple<[z.ZodObject<{
+      sigTst: z.ZodObject<{
+        tstTokens: z.ZodArray<z.ZodObject<{
+          val: z.ZodString;
+        }, z.core.$strip>>;
+      }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+      xVals: z.ZodArray<z.ZodObject<{
+        x509Cert: z.ZodString;
+      }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+      rVals: z.ZodObject<{
+        crlVals: z.ZodArray<z.ZodString>;
+        ocspVals: z.ZodArray<z.ZodString>;
+      }, z.core.$strip>;
+    }, z.core.$strip>], null>, z.ZodTuple<[z.ZodObject<{
+      sigTst: z.ZodObject<{
+        tstTokens: z.ZodArray<z.ZodObject<{
+          val: z.ZodString;
+        }, z.core.$strip>>;
+      }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+      xVals: z.ZodArray<z.ZodObject<{
+        x509Cert: z.ZodString;
+      }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+      rVals: z.ZodObject<{
+        crlVals: z.ZodArray<z.ZodString>;
+        ocspVals: z.ZodArray<z.ZodString>;
+      }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+      arcTst: z.ZodObject<{
+        tstTokens: z.ZodArray<z.ZodObject<{
+          val: z.ZodString;
+        }, z.core.$strip>>;
+        canonAlg: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+    }, z.core.$strip>], null>]>>;
+    disclosures: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    kid: z.ZodOptional<z.ZodString>;
+    kb_jwt: z.ZodOptional<z.ZodString>;
+  }, z.core.$loose>>;
+}, z.core.$strip>;
+/**
+ * Compact JWS representation.
+ */
+declare const CompactJWSSchema: z.ZodObject<{
+  protected: z.ZodString;
+  payload: z.ZodString;
+  signature: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Sign options for JAdES signing.
+ */
+declare const SignOptionsSchema: z.ZodObject<{
+  alg: z.ZodEnum<{
+    ES256: "ES256";
+    ES384: "ES384";
+    ES512: "ES512";
+    RS256: "RS256";
+    RS384: "RS384";
+    RS512: "RS512";
+    PS256: "PS256";
+    PS384: "PS384";
+    PS512: "PS512";
+  }>;
+  kid: z.ZodOptional<z.ZodString>;
+  certificates: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+//#endregion
+//#region src/types.d.ts
+/**
+ * Supported signature algorithms.
+ */
+type SignAlg = z.infer<typeof SignAlgSchema>;
+/**
+ * X.509 Certificate Thumbprint with algorithm specification.
+ */
+type X5tO = z.infer<typeof X5tOSchema>;
+/**
+ * Commitment reference as per ETSI TS 119 182-1 Section 5.2.5.
+ */
+interface CommitmentReference {
+  /** Commitment type identifier (OID or URI) */
+  commId: string | CommitmentOIDs;
+  /** Commitment qualifiers */
+  commQuals?: object[];
+}
+/**
+ * Signature policy descriptor.
+ */
+type SignaturePolicy = z.infer<typeof SignaturePolicySchema>;
+/**
+ * Signer identifier.
+ */
+type SignerIdentifier = z.infer<typeof SignerIdentifierSchema>;
+/**
+ * Detached signature descriptor - ETSI TS 119 182-1 Section 5.2.8.
+ */
+type SigD = z.infer<typeof SigDSchema>;
+/**
+ * JAdES Protected Header parameters as per ETSI TS 119 182-1.
+ */
+type ProtectedHeaderParams = z.infer<typeof ProtectedHeaderSchema>;
+/**
+ * JAdES Unprotected Header parameters.
+ */
+type UnprotectedHeaderParams = z.infer<typeof UnprotectedHeaderSchema>;
+/**
+ * ETSI Unsigned properties for different JAdES profiles.
+ */
+type EtsiU = z.infer<typeof EtsiUSchema>;
+/**
+ * Signature timestamp container.
+ */
+type SigTst = z.infer<typeof SigTstSchema>;
+/**
+ * Timestamp tokens container.
+ */
+type TstTokens = z.infer<typeof TstTokensSchema>;
+/**
+ * X.509 certificate values for B-LT profile.
+ */
+type XVals = z.infer<typeof XValsSchema>;
+/**
+ * Revocation values (CRL and OCSP) for B-LT profile.
+ */
+type RVals = z.infer<typeof RValsSchema>;
+/**
+ * Archive timestamp for B-LTA profile.
+ */
+type ArcTst = z.infer<typeof ArcTstSchema>;
+/**
+ * General JWS structure with multiple signatures.
+ */
+type GeneralJWS = z.infer<typeof GeneralJWSSchema>;
+/**
+ * Compact JWS representation.
+ */
+type CompactJWS = z.infer<typeof CompactJWSSchema>;
+/**
+ * Sign options for JAdES signing.
+ */
+type SignOptions = z.infer<typeof SignOptionsSchema> & {
+  /** Signer function */signer: (data: string) => Promise<string>;
+};
+/**
+ * Verify options for JAdES verification.
+ */
+interface VerifyOptions {
+  /** Verifier function */
+  verifier: (data: string, signature: string) => Promise<boolean>;
+}
+//#endregion
+//#region src/token.d.ts
+/**
+ * JAdES Token class for creating conformant JAdES signatures.
+ */
+declare class Token<T extends Record<string, unknown> = Record<string, unknown>> {
+  private protectedHeader;
+  private unprotectedHeader;
+  private readonly payload;
+  private encodedPayload;
+  private signature;
+  /**
+   * Create a new JAdES Token.
+   *
+   * @param payload - The payload to sign. If undefined, creates a detached signature.
+   */
+  constructor(payload?: T);
+  /**
+   * Set the protected header parameters.
+   *
+   * @param header - Protected header parameters
+   * @returns this for method chaining
+   */
+  setProtectedHeader(header: ProtectedHeaderParams): this;
+  /**
+   * Set the unprotected header parameters.
+   *
+   * @param header - Unprotected header parameters
+   * @returns this for method chaining
+   */
+  setUnprotectedHeader(header: UnprotectedHeaderParams): this;
+  /**
+   * Set X.509 certificate chain (x5c header).
+   *
+   * ETSI TS 119 182-1 Section 5.1.8
+   *
+   * @param certs - Array of base64-encoded DER certificates
+   * @returns this for method chaining
+   */
+  setX5c(certs: string[]): this;
+  /**
+   * Set X.509 certificate URL (x5u header).
+   *
+   * ETSI TS 119 182-1 Section 5.1.5
+   *
+   * @param uri - URI to certificate resource
+   * @returns this for method chaining
+   */
+  setX5u(uri: string): this;
+  /**
+   * Set X.509 certificate SHA-256 thumbprint (x5t#S256 header).
+   *
+   * ETSI TS 119 182-1 Section 5.1.7
+   *
+   * @param thumbprint - Base64url-encoded SHA-256 thumbprint
+   * @returns this for method chaining
+   */
+  setX5tS256(thumbprint: string): this;
+  /**
+   * Set X.509 certificate thumbprint with other algorithm (x5t#o header).
+   *
+   * ETSI TS 119 182-1 Section 5.2.2.2
+   *
+   * @param x5tO - X5tO object with algorithm and digest value
+   * @returns this for method chaining
+   */
+  setX5tO(x5tO: X5tO): this;
+  /**
+   * Set signing time (sigT header).
+   *
+   * ETSI TS 119 182-1 Section 5.2.1
+   *
+   * @param time - ISO 8601 timestamp (defaults to current time)
+   * @returns this for method chaining
+   */
+  setSigningTime(time?: string): this;
+  /**
+   * Set signedAt timestamp in protected header.
+   *
+   * @param sec - Unix timestamp in seconds (defaults to current time)
+   * @returns this for method chaining
+   */
+  setSignedAt(sec?: number): this;
+  /**
+   * Set issued at timestamp (iat) in protected header.
+   *
+   * @param sec - Unix timestamp in seconds (defaults to current time)
+   * @returns this for method chaining
+   */
+  setIssuedAt(sec?: number): this;
+  /**
+   * Set key ID (kid header).
+   *
+   * @param kid - Key identifier
+   * @returns this for method chaining
+   */
+  setKid(kid: string): this;
+  /**
+   * Set content type (cty header).
+   *
+   * @param cty - Content type
+   * @returns this for method chaining
+   */
+  setContentType(cty: string): this;
+  /**
+   * Set token type (typ header).
+   *
+   * @param typ - Token type
+   * @returns this for method chaining
+   */
+  setType(typ: string): this;
+  /**
+   * Set b64 header parameter.
+   *
+   * ETSI TS 119 182-1 Section 5.1.10
+   * RFC 7797 Section 3
+   *
+   * @param b64 - If true (default), payload is base64url encoded. If false, payload is unencoded.
+   * @returns this for method chaining
+   */
+  setB64(b64: boolean): this;
+  /**
+   * Configure detached signature mode.
+   *
+   * ETSI TS 119 182-1 Section 5.2.8
+   *
+   * @param sigD - Detached signature descriptor
+   * @returns this for method chaining
+   */
+  setDetached(sigD: SigD): this;
+  /**
+   * Get the signing input (data to be signed).
+   *
+   * @returns The signing input string (header.payload)
+   */
+  getSigningInput(): string;
+  /**
+   * Get the hash of the signing input for external signing.
+   *
+   * @param algorithm - Hash algorithm (defaults to algorithm from header)
+   * @returns Promise resolving to hash bytes
+   */
+  getHash(algorithm?: string): Promise<Uint8Array>;
+  /**
+   * Set the signature (for external signing).
+   *
+   * @param signature - Base64url-encoded signature
+   * @returns this for method chaining
+   */
+  setSignature(signature: string): this;
+  /**
+   * Sign the token using the provided signer function.
+   *
+   * @param signer - Async function that signs data and returns base64url signature
+   * @returns Promise resolving to this for method chaining
+   */
+  sign(signer: (data: string) => Promise<string>): Promise<this>;
+  /**
+   * Export to compact JWS serialization.
+   *
+   * @returns Compact JWS string (header.payload.signature)
+   */
+  toString(): string;
+  /**
+   * Export to General JWS JSON serialization.
+   *
+   * @returns GeneralJWS object
+   */
+  toJSON(): GeneralJWS;
+  /**
+   * Export to flattened JWS JSON serialization.
+   *
+   * @returns Flattened JWS object
+   */
+  toFlattenedJSON(): {
+    protected: string;
+    payload: string;
+    signature: string;
+    header?: UnprotectedHeaderParams;
+  };
+  /**
+   * Get the protected header object.
+   */
+  getProtectedHeader(): ProtectedHeaderParams;
+  /**
+   * Get the unprotected header object.
+   */
+  getUnprotectedHeader(): UnprotectedHeaderParams;
+  /**
+   * Get the payload.
+   */
+  getPayload(): T | undefined;
+  private getEncodedProtectedHeader;
+  private buildFinalHeader;
+  private validateBeforeSign;
+  private getHashAlgorithm;
+}
+//#endregion
+//#region src/verifier.d.ts
+/**
+ * Result of JAdES signature verification.
+ */
+interface VerifyResult<T = unknown> {
+  /** Decoded protected header */
+  header: ProtectedHeaderParams;
+  /** Decoded payload */
+  payload: T;
+  /** Unprotected header (if present) */
+  unprotectedHeader?: UnprotectedHeaderParams;
+  /** Whether the signature is valid */
+  valid: boolean;
+}
+/**
+ * Verify a JAdES signature in compact serialization.
+ *
+ * @param jws - Compact JWS string
+ * @param verifier - Async function that verifies signature
+ * @returns Promise resolving to verification result
+ */
+declare function verifyCompact<T = unknown>(jws: string, verifier: (data: string, signature: string) => Promise<boolean>): Promise<VerifyResult<T>>;
+/**
+ * Verify a JAdES signature in General JWS JSON serialization.
+ *
+ * @param generalJws - General JWS object
+ * @param verifier - Async function that verifies signature
+ * @param signatureIndex - Index of signature to verify (default: 0)
+ * @returns Promise resolving to verification result
+ */
+declare function verifyGeneral<T = unknown>(generalJws: GeneralJWS, verifier: (data: string, signature: string) => Promise<boolean>, signatureIndex?: number): Promise<VerifyResult<T>>;
+/**
+ * Verify a JAdES signature (auto-detects format).
+ *
+ * @param jws - JWS string or GeneralJWS object
+ * @param verifier - Async function that verifies signature
+ * @returns Promise resolving to verification result
+ */
+declare function verify<T = unknown>(jws: string | GeneralJWS, verifier: (data: string, signature: string) => Promise<boolean>): Promise<VerifyResult<T>>;
+/**
+ * Decode a JWS without verifying the signature.
+ * Use this only for inspection - always verify before trusting the content.
+ *
+ * @param jws - JWS string or GeneralJWS object
+ * @returns Decoded header and payload
+ */
+declare function decode<T = unknown>(jws: string | GeneralJWS): {
+  header: ProtectedHeaderParams;
+  payload: T;
+  unprotectedHeader?: UnprotectedHeaderParams;
+};
+//#endregion
+//#region src/utils.d.ts
+/**
+ * Parse PEM-encoded certificate chain and return base64 DER strings.
+ *
+ * @param pem - One or more PEM-encoded certificates
+ * @returns Array of base64-encoded DER certificate strings
+ */
+declare function parseCerts(pem: string): string[];
+/**
+ * Generate x5c header value from PEM certificates.
+ * The certificates are converted to base64-encoded DER format.
+ *
+ * ETSI TS 119 182-1 Section 5.1.8
+ *
+ * @param certs - PEM-encoded certificate(s) or array of base64 DER certs
+ * @returns Array of base64-encoded DER certificate strings
+ */
+declare function generateX5c(certs: string | string[]): string[];
+/**
+ * Generate x5t#S256 header value (SHA-256 thumbprint of certificate).
+ *
+ * ETSI TS 119 182-1 Section 5.1.7
+ *
+ * @param certDer - Base64-encoded DER certificate
+ * @returns Base64url-encoded SHA-256 thumbprint
+ */
+declare function generateX5tS256(certDer: string): Promise<string>;
+/**
+ * Generate x5t#o header value (certificate thumbprint with specified algorithm).
+ *
+ * ETSI TS 119 182-1 Section 5.2.2.2
+ *
+ * @param certDer - Base64-encoded DER certificate
+ * @param algorithm - Hash algorithm ('SHA-384' or 'SHA-512')
+ * @returns X5tO object with algorithm identifier and digest value
+ */
+declare function generateX5tO(certDer: string, algorithm?: 'SHA-384' | 'SHA-512'): Promise<X5tO>;
+/**
+ * Generate sigX5ts header value (certificate chain thumbprints).
+ *
+ * ETSI TS 119 182-1 Section 5.2.2.3
+ *
+ * @param certsDer - Array of base64-encoded DER certificates
+ * @param algorithm - Hash algorithm ('SHA-384' or 'SHA-512')
+ * @returns Array of X5tO objects
+ */
+declare function generateSigX5ts(certsDer: string[], algorithm?: 'SHA-384' | 'SHA-512'): Promise<X5tO[]>;
+/**
+ * Generate a JAdES-compliant kid from X.509 certificate.
+ *
+ * According to ETSI TS 119 182-1 Section 5.1.4, the kid should be
+ * the base64 encoding of DER-encoded IssuerSerial sequence.
+ *
+ * This implementation generates a SHA-256 thumbprint of the certificate
+ * as a simpler approach that uniquely identifies the certificate.
+ *
+ * @param certDer - Base64-encoded DER certificate
+ * @returns Base64url-encoded key identifier
+ */
+declare function generateKid(certDer: string): Promise<string>;
+/**
+ * Encode an object as a base64url JSON string.
+ *
+ * @param obj - Object to encode
+ * @returns Base64url-encoded JSON string
+ */
+declare function encodeJSON(obj: object): string;
+/**
+ * Decode a base64url JSON string to an object.
+ *
+ * @param encoded - Base64url-encoded JSON string
+ * @returns Decoded object
+ */
+declare function decodeJSON<T = unknown>(encoded: string): T;
+/**
+ * Get current ISO 8601 timestamp for sigT header.
+ *
+ * @returns ISO 8601 timestamp string
+ */
+declare function getSigningTime(): string;
+/**
+ * Validate that the protected header has at least one certificate header.
+ * As per ETSI TS 119 182-1 Section 5.1.7, a JAdES signature shall have
+ * at least one of: x5t#S256, x5c, x5t#o, sigX5ts.
+ *
+ * @param header - Protected header object
+ * @returns true if valid
+ * @throws JAdESException if no certificate header is present
+ */
+declare function validateCertificateHeaders(header: Record<string, unknown>): boolean;
+//#endregion
+//#region src/jades-exception.d.ts
+/**
+ * JAdES Exception
+ *
+ * Custom exception for JAdES-related errors.
+ */
+declare class JAdESException extends Error {
+  constructor(message: string);
+}
+//#endregion
+export { ALGORITHMS, type ArcTst, ArcTstSchema, CRITICAL_PARAMETERS, CommitmentOIDs, type CommitmentReference, type CompactJWS, CompactJWSSchema, DETACHED_MECHANISM_IDS, type EtsiU, EtsiUSchema, FlattenedJWSSchema, type GeneralJWS, GeneralJWSSchema, JAdESException, JAdESProfile, ProtectedHeaderForSigningSchema, type ProtectedHeaderParams, ProtectedHeaderSchema, type RVals, RValsSchema, type SigD, SigDSchema, type SigTst, SigTstSchema, type SignAlg, SignAlgSchema, type SignOptions, SignOptionsSchema, type SignaturePolicy, SignaturePolicySchema, type SignerIdentifier, SignerIdentifierSchema, Token, type TstTokens, TstTokensSchema, type UnprotectedHeaderParams, UnprotectedHeaderSchema, type VerifyOptions, type VerifyResult, type X5tO, X5tOSchema, type XVals, XValsSchema, decode, decodeJSON, encodeJSON, generateKid, generateSigX5ts, generateX5c, generateX5tO, generateX5tS256, getSigningTime, parseCerts, validateCertificateHeaders, verify, verifyCompact, verifyGeneral };
+//# sourceMappingURL=index.d.mts.map