ooxml-core 0.2.0

package/dist/pptx/signature-node/index.d.ts

@@ -0,0 +1,172 @@
+import { A as DIGITAL_SIGNATURE_REL_TYPE, B as XML_TRANSFORM_ENVELOPED_SIGNATURE, C as SignatureDetailStatus, D as DIGEST_ALGORITHM_TO_HASH, E as TimestampAuthorityStatus, F as ENTERPRISE_TRUST_ROOTS_PEM_ENV, I as OPC_RELATIONSHIP_TRANSFORM, L as PPTX_VIEWER_MANIFEST_NS, M as ENTERPRISE_REQUIRE_REVOCATION_ENV, N as ENTERPRISE_REQUIRE_TIMESTAMP_ENV, O as DIGEST_ALGORITHM_TO_WEB_CRYPTO, P as ENTERPRISE_TRUST_ROOTS_FILE_ENV, R as SUPPORTED_XML_CANON_TRANSFORMS, S as SignatureDetail, T as SignatureValidationPolicy, _ as ParsedReferenceTransform, a as resolveReferenceUriToPart, b as SignResult, c as extractAllTagText, d as isValidBase64, f as CertificateRevocationStatus, g as OfficeSignatureReference, h as LoadedSigningMaterial, i as normalizePartPath, j as ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, k as DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, l as extractFirstTagText, m as DigitalSignatureVerificationStatus, n as computeVerificationStatus, o as escapeXmlAttr, p as DigitalSignatureReport, r as computeDigestBase64$1, s as escapeXmlText, t as computeDetailStatus, u as extractTagAttribute, v as ReferenceTransformResult, w as SignatureReferenceCheck, x as SignatureCertificateInfo, y as SignOptions, z as XMLDSIG_NS } from "../chunks/signature-inspection-status-Bh2oap7B.js";
+import JSZip from "jszip";
+//#region src/pptx/signature-node/xml-canonicalization.d.ts
+/**
+ * XML canonicalization and DOM navigation utilities for digital signatures.
+ *
+ * Node-only — depends on `@xmldom/xmldom` and `xml-crypto`.
+ *
+ * All public functions use minimal structural (duck-typed) interfaces instead
+ * of the standard lib.dom.d.ts types. @xmldom/xmldom's Document/Element/Node
+ * types do not extend the standard DOM interfaces in TypeScript 6 (the old DOM
+ * lib baked into @xmldom/xmldom's .d.ts predates properties like
+ * activeViewTransition), so using the standard types causes TS2345 errors in
+ * the DTS build. These structural interfaces are satisfied by both xmldom and
+ * standard DOM objects at runtime.
+ */
+/** A DOM element-like collection returned by getElementsByTagName. */
+interface XmlElementCollection {
+  readonly length: number;
+  item(index: number): XmlElement | null;
+  [index: number]: XmlElement;
+  [Symbol.iterator](): Iterator<XmlElement>;
+}
+/** Structural interface covering the @xmldom/xmldom Element operations used here. */
+interface XmlElement {
+  readonly nodeName: string;
+  readonly localName?: string | null;
+  readonly textContent: string | null;
+  readonly parentNode: {
+    removeChild(child: XmlElement): XmlElement;
+  } | null;
+  getAttribute(name: string): string | null;
+  getElementsByTagName(localName: string): XmlElementCollection;
+  getElementsByTagNameNS(namespaceURI: string | null, localName: string): XmlElementCollection;
+}
+/** Structural interface covering @xmldom/xmldom Document operations used here. */
+interface XmlDocument {
+  readonly documentElement: XmlElement | null;
+  getElementsByTagName(localName: string): XmlElementCollection;
+  getElementsByTagNameNS(namespaceURI: string | null, localName: string): XmlElementCollection;
+}
+/** Get the local name of a DOM node, stripping any namespace prefix. */
+export declare function getNodeLocalName(node: XmlElement): string;
+/**
+ * Find the first descendant element matching a local name,
+ * ignoring namespace prefixes.
+ */
+export declare function getFirstDescendantElementByLocalName(parent: XmlDocument | XmlElement, localName: string): XmlElement | undefined;
+/**
+ * Canonicalize a DOM node using the specified canonicalization algorithm.
+ * Delegates to xml-crypto's C14N implementation.
+ * Accepts `any` because @xmldom/xmldom nodes are not assignable to
+ * lib.dom.d.ts Node in TypeScript 6.
+ */
+export declare function canonicalizeNode(node: any, algorithm: string): string;
+/**
+ * Canonicalize a `<SignedInfo>` XML fragment for signature verification.
+ * Uses Exclusive XML Canonicalization (exc-c14n#).
+ */
+export declare function canonicalizeSignedInfoXml(signedInfoXml: string): string;
+//#endregion
+//#region src/pptx/signature-node/certificate-utils.d.ts
+/** Extract certificate metadata from a Base64-encoded DER certificate. */
+export declare function certificateInfoFromBase64(certBase64: string): SignatureCertificateInfo | undefined;
+/**
+ * Validate a certificate chain against system trust roots and optional additional roots.
+ */
+export declare function validateCertificateChain(certBase64List: string[], additionalRootsPem: string[]): {
+  status: 'trusted' | 'untrusted' | 'not-checked';
+  error?: string;
+};
+/**
+ * Cryptographically verify the SignatureValue in an XML signature
+ * using the embedded certificate.
+ */
+export declare function verifySignatureValue(signatureXml: string, certBase64List: string[]): 'verified' | 'invalid' | 'not-checked';
+/**
+ * Load a private key and certificate from a PKCS#12 (.pfx/.p12) or PEM buffer.
+ */
+export declare function loadSigningMaterialFromBuffer(certificateBuffer: Uint8Array, certificatePath: string, certificatePassword?: string): LoadedSigningMaterial;
+/** Convert a PEM certificate to Base64-encoded DER (strip armour + whitespace). */
+export declare function pemCertificateToBase64(pem: string): string;
+//#endregion
+//#region src/pptx/signature-node/pki-validation.d.ts
+/** Wrap a Base64-encoded DER certificate in PEM armour. */
+export declare function certPemFromBase64(certBase64: string): string | undefined;
+/** SHA-256 fingerprint of a PEM certificate (lowercase hex, no colons). */
+export declare function certFingerprintSha256(certPem: string): string | undefined;
+export declare function evaluateTimestampAuthority(signatureXml: string): Promise<{
+  status: TimestampAuthorityStatus;
+  error?: string;
+}>;
+//#endregion
+//#region src/pptx/signature-node/ocsp.d.ts
+export declare function extractOcspUrls(certPem: string): string[];
+export declare function buildOcspRequestDer(leafPem: string, issuerPem: string): Buffer | undefined;
+export declare function parseOcspResponseStatus(data: Buffer): CertificateRevocationStatus;
+export declare function evaluateCertificateRevocation(leafCertPem: string, issuerCertPem: string | undefined): Promise<{
+  status: CertificateRevocationStatus;
+  error?: string;
+  checkedOcspUrls: string[];
+  checkedCrlUrls: string[];
+}>;
+//#endregion
+//#region src/pptx/signature-node/environment.d.ts
+/** Extract individual PEM certificates from a text block. */
+export declare function extractPemCertificatesFromText(text: string): string[];
+/**
+ * Load enterprise trust root certificates from environment-configured sources.
+ *
+ * Checks `PPTX_VIEWER_TRUST_ROOTS_PEM` for inline PEM data and
+ * `PPTX_VIEWER_TRUST_ROOTS_FILE` for file paths (semicolon/comma-separated).
+ */
+export declare function loadEnterpriseTrustRoots(): Promise<string[]>;
+/**
+ * Read the signature validation policy from environment variables.
+ */
+export declare function getSignatureValidationPolicy(): SignatureValidationPolicy;
+//#endregion
+//#region src/pptx/signature-node/reference-transforms.d.ts
+/**
+ * Parse `<ds:Transform>` elements from a `<ds:Reference>` node.
+ */
+export declare function extractReferenceTransforms(referenceNode: XmlElement): ParsedReferenceTransform[];
+/**
+ * Apply a chain of transforms to binary part data.
+ * Supports OPC Relationship Transform and XML canonicalization algorithms.
+ */
+export declare function applyReferenceTransforms(partBytes: Uint8Array, transforms: ParsedReferenceTransform[]): ReferenceTransformResult;
+//#endregion
+//#region src/pptx/signature-node/reference-checks.d.ts
+/**
+ * Compute a Base64-encoded digest using Node.js `crypto` (synchronous).
+ */
+export declare function computeDigestBase64(content: Uint8Array, digestAlgorithmUri: string): string | undefined;
+/**
+ * Verify all `<ds:Reference>` digests in an XML signature.
+ */
+export declare function buildReferenceChecksFromSignatureXml(zip: JSZip, signatureXml: string): Promise<SignatureReferenceCheck[]>;
+/**
+ * Verify references from a PptxViewer manifest extension in the signature XML.
+ */
+export declare function buildReferenceChecksFromPptxViewerManifest(zip: JSZip, signatureXml: string): Promise<SignatureReferenceCheck[]>;
+//#endregion
+//#region src/pptx/signature-node/signing.d.ts
+/**
+ * Sign all content in a PPTX package with a certificate.
+ *
+ * Removes any existing signatures, creates a new XML-DSig signature
+ * covering all non-signature parts, and returns the signed data
+ * along with a post-sign verification report.
+ */
+export declare function signPptxWithCertificate(data: Uint8Array, certificateBuffer: Uint8Array, options: SignOptions): Promise<SignResult>;
+//#endregion
+//#region src/pptx/signature-node/inspection.d.ts
+/**
+ * Inspect all digital signatures in a PPTX package.
+ *
+ * Performs full cryptographic verification including:
+ * - Reference digest checks (standard XML-DSig + PptxViewer manifest)
+ * - Signature value verification (RSA-SHA256/384/512)
+ * - Certificate chain validation against system + enterprise trust roots
+ * - OCSP revocation checking
+ * - Timestamp authority evaluation
+ *
+ * @param data - The raw PPTX file bytes.
+ * @returns A comprehensive digital signature report.
+ */
+export declare function inspectPptxDigitalSignatures(data: Uint8Array): Promise<DigitalSignatureReport>;
+//#endregion
+export { type CertificateRevocationStatus, DIGEST_ALGORITHM_TO_HASH, DIGEST_ALGORITHM_TO_WEB_CRYPTO, DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, DIGITAL_SIGNATURE_REL_TYPE, type DigitalSignatureReport, type DigitalSignatureVerificationStatus, ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, ENTERPRISE_REQUIRE_REVOCATION_ENV, ENTERPRISE_REQUIRE_TIMESTAMP_ENV, ENTERPRISE_TRUST_ROOTS_FILE_ENV, ENTERPRISE_TRUST_ROOTS_PEM_ENV, type LoadedSigningMaterial, OPC_RELATIONSHIP_TRANSFORM, type OfficeSignatureReference, PPTX_VIEWER_MANIFEST_NS, type ParsedReferenceTransform, type ReferenceTransformResult, SUPPORTED_XML_CANON_TRANSFORMS, type SignOptions, type SignResult, type SignatureCertificateInfo, type SignatureDetail, type SignatureDetailStatus, type SignatureReferenceCheck, type SignatureValidationPolicy, type TimestampAuthorityStatus, XMLDSIG_NS, XML_TRANSFORM_ENVELOPED_SIGNATURE, computeDetailStatus, computeDigestBase64$1 as computeDigestBase64WebCrypto, computeVerificationStatus, escapeXmlAttr, escapeXmlText, extractAllTagText, extractFirstTagText, extractTagAttribute, isValidBase64, normalizePartPath, resolveReferenceUriToPart };
+//# sourceMappingURL=index.d.ts.map

package/dist/pptx/signature-node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/pptx/signature-node/xml-canonicalization.ts","../../../src/pptx/signature-node/certificate-utils.ts","../../../src/pptx/signature-node/pki-validation.ts","../../../src/pptx/signature-node/ocsp.ts","../../../src/pptx/signature-node/environment.ts","../../../src/pptx/signature-node/reference-transforms.ts","../../../src/pptx/signature-node/reference-checks.ts","../../../src/pptx/signature-node/signing.ts","../../../src/pptx/signature-node/inspection.ts"],"mappings":";;;;;;;;;;;;;;;;;UAkBiB;WACP;EACT,KAAK,gBAAgB;GACpB,gBAAgB;GAChB,OAAO,aAAa,SAAS;;;UAId;WACP;WACA;WACA;WACA;IAAc,YAAY,OAAO,aAAa;;EACvD,aAAa;EACb,qBAAqB,oBAAoB;EACzC,uBAAuB,6BAA6B,oBAAoB;;;UAIxD;WACP,iBAAiB;EAC1B,qBAAqB,oBAAoB;EACzC,uBAAuB,6BAA6B,oBAAoB;;;wBAIzD,iBAAiB,MAAM;;;;;wBAavB,qCACf,QAAQ,cAAc,YACtB,oBACE;;;;;;;wBAqBa,iBAAiB,WAAW;;;;;wBAS5B,0BAA0B;;;;wBC3D1B,0BACf,qBACE;;;;wBAkBa,yBACf,0BACA;EAEA;EACA;;;;;;wBAgDe,qBACf,sBACA;;;;wBAiDe,8BACf,mBAAmB,YACnB,yBACA,+BACE;;wBAmCa,uBAAuB;;;;wBC7KvB,kBAAkB;;wBAkBlB,sBAAsB;wBAqBhB,2BACrB,uBACE;EAAU,QAAQ;EAA0B;;;;wBC/B/B,gBAAgB;wBA2EhB,oBAAoB,iBAAiB,oBAAoB;wBA8DzD,wBAAwB,MAAM,SAAS;wBA8DjC,8BACrB,qBACA,oCACE;EACF,QAAQ;EACR;EACA;EACA;;;;;wBCzNe,+BAA+B;;;;;;;wBA8BzB,4BAA4B;;;;wBAqBlC,gCAAgC;;;;;;wBC3ChC,2BAA2B,eAAe,aAAa;;;;;wBAyEvD,yBACf,WAAW,YACX,YAAY,6BACV;;;;;;wBC9Ea,oBACf,SAAS,YACT;;;;wBAYqB,qCACrB,KAAK,OACL,uBACE,QAAQ;;;;wBAkGW,2CACrB,KAAK,OACL,uBACE,QAAQ;;;;;;;;;;wBCuBW,wBACrB,MAAM,YACN,mBAAmB,YACnB,SAAS,cACP,QAAQ;;;;;;;;;;;;;;;;wBCxHW,6BACrB,MAAM,aACJ,QAAQ"}