ooxml-core 0.9.0 → 0.10.0

package/dist/index.cjs

@@ -700,7 +700,12 @@ function resolveDiagramLayoutCategory(uniqueId, categories) {
 // src/opc/index.ts
 var opc_exports = {};
 __export(opc_exports, {
+  CORE_PROPERTY_FIELDS: () => CORE_PROPERTY_FIELDS,
+  CUSTOM_PROPERTIES_FMTID: () => CUSTOM_PROPERTIES_FMTID,
+  PROPERTY_CONTENT_TYPES: () => PROPERTY_CONTENT_TYPES,
+  PROPERTY_PART_NAMES: () => PROPERTY_PART_NAMES,
   RELATIONSHIP_TYPES: () => RELATIONSHIP_TYPES,
+  allocateCustomPropertyIds: () => allocateCustomPropertyIds,
   buildContentTypesXml: () => buildContentTypesXml,
   buildRelationshipsXml: () => buildRelationshipsXml,
   contentTypeForPart: () => contentTypeForPart,
@@ -709,12 +714,22 @@ __export(opc_exports, {
   ensureRelationship: () => ensureRelationship,
   findOfficeDocumentPart: () => findOfficeDocumentPart,
   getRelationshipId: () => getRelationshipId,
+  hyperlinkPolicy: () => hyperlinkPolicy,
+  isOpenableHyperlinkHref: () => isOpenableHyperlinkHref,
   isSafeHyperlinkHref: () => isSafeHyperlinkHref,
+  isStorableHyperlinkHref: () => isStorableHyperlinkHref,
   nextRelationshipId: () => nextRelationshipId,
+  parseAppProperties: () => parseAppProperties,
   parseContentTypes: () => parseContentTypes,
+  parseCoreProperties: () => parseCoreProperties,
+  parseCustomProperties: () => parseCustomProperties,
   parseRelationships: () => parseRelationships,
   relationshipsPartFor: () => relationshipsPartFor,
-  resolvePartPath: () => resolvePartPath
+  resolvePartPath: () => resolvePartPath,
+  signature: () => signature_exports,
+  writeAppProperties: () => writeAppProperties,
+  writeCoreProperties: () => writeCoreProperties,
+  writeCustomProperties: () => writeCustomProperties
 });
 
 // src/opc/relationship-types.ts
@@ -748,6 +763,7 @@ var RELATIONSHIP_TYPES = {
   diagramDrawing: "http://schemas.microsoft.com/office/2007/relationships/diagramDrawing",
   coreProperties: "http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties",
   extendedProperties: `${BASE}/extended-properties`,
+  customProperties: `${BASE}/custom-properties`,
   customXml: `${BASE}/customXml`,
   worksheet: `${BASE}/worksheet`,
   chartsheet: `${BASE}/chartsheet`,
@@ -843,6 +859,10 @@ var NS = {
   extendedProperties: "http://schemas.openxmlformats.org/officeDocument/2006/extended-properties",
   /** Dublin Core terms (`dcterms:created`). */
   dcterms: "http://purl.org/dc/terms/",
+  /** Custom document properties (`docProps/custom.xml`). */
+  customProperties: "http://schemas.openxmlformats.org/officeDocument/2006/custom-properties",
+  /** Document property variant types (`vt:lpwstr`, `vt:vector`). */
+  vt: "http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes",
   /** XML itself (`xml:space`). */
   xml: "http://www.w3.org/XML/1998/namespace"
 };
@@ -1021,6 +1041,716 @@ function isSafeHyperlinkHref(href) {
   const scheme = /^([a-z][a-z0-9+.-]*:)/i.exec(href.trim())?.[1];
   return scheme !== void 0 && SAFE_SCHEMES.has(scheme.toLowerCase());
 }
+var OPEN_SCHEMES = /* @__PURE__ */ new Set(["http", "https", "mailto"]);
+var STORE_SCHEMES = /* @__PURE__ */ new Set([...OPEN_SCHEMES, "ftp", "file"]);
+var SCRIPT_SCHEMES = /* @__PURE__ */ new Set([
+  "javascript",
+  "vbscript",
+  "livescript",
+  "jscript",
+  "mocha",
+  "data",
+  "mhtml",
+  "ms-its",
+  "mk",
+  "x-javascript",
+  "blob"
+]);
+var IGNORABLE = new RegExp(
+  "[\\u0000-\\u0020\\u007f\\u00ad\\u200b-\\u200f\\u202a-\\u202e\\u2060-\\u2064\\ufeff]",
+  "gu"
+);
+var CONTROL = new RegExp("[\\u0000-\\u001f\\u007f]", "u");
+var SCHEME = /^([a-z][a-z0-9+.-]*):/;
+var STORE_ONLY = { store: true, open: false, reason: "not-openable" };
+var reject = (reason) => ({
+  store: false,
+  open: false,
+  reason
+});
+function hyperlinkPolicy(href) {
+  if (typeof href !== "string") return reject("empty");
+  const trimmed = href.trim();
+  const normalized = trimmed.replace(IGNORABLE, "").toLowerCase();
+  if (normalized.length === 0) return reject("empty");
+  const scheme = SCHEME.exec(normalized)?.[1];
+  if (scheme !== void 0 && SCRIPT_SCHEMES.has(scheme)) return reject("script-scheme");
+  if (scheme !== void 0 && !trimmed.toLowerCase().startsWith(`${scheme}:`))
+    return reject("obfuscated-scheme");
+  if (CONTROL.test(trimmed)) return reject("control-characters");
+  if (scheme === void 0 || scheme.length === 1) return STORE_ONLY;
+  if (OPEN_SCHEMES.has(scheme)) return { store: true, open: true };
+  if (STORE_SCHEMES.has(scheme)) return STORE_ONLY;
+  return reject("unsupported-scheme");
+}
+function isStorableHyperlinkHref(href) {
+  return hyperlinkPolicy(href).store;
+}
+function isOpenableHyperlinkHref(href) {
+  return hyperlinkPolicy(href).open;
+}
+
+// src/opc/properties/types.ts
+var CUSTOM_PROPERTIES_FMTID = "{D5CDD505-2E9C-101B-9397-08002B2CF9AE}";
+var PROPERTY_PART_NAMES = {
+  core: "docProps/core.xml",
+  app: "docProps/app.xml",
+  custom: "docProps/custom.xml"
+};
+var PROPERTY_CONTENT_TYPES = {
+  core: "application/vnd.openxmlformats-package.core-properties+xml",
+  app: "application/vnd.openxmlformats-officedocument.extended-properties+xml",
+  custom: "application/vnd.openxmlformats-officedocument.custom-properties+xml"
+};
+
+// src/opc/properties/core.ts
+var XSI = "http://www.w3.org/2001/XMLSchema-instance";
+var FIELDS = [
+  ["title", "dc", false],
+  ["subject", "dc", false],
+  ["creator", "dc", false],
+  ["keywords", "cp", false],
+  ["description", "dc", false],
+  ["lastModifiedBy", "cp", false],
+  ["created", "dcterms", true],
+  ["modified", "dcterms", true],
+  ["category", "cp", false],
+  ["contentStatus", "cp", false],
+  ["revision", "cp", false],
+  ["language", "dc", false],
+  ["identifier", "dc", false],
+  ["lastPrinted", "cp", false],
+  ["version", "cp", false]
+];
+var CORE_PROPERTY_FIELDS = FIELDS.map(([field]) => field);
+var EMPTY_CORE = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<cp:coreProperties xmlns:cp="${NS.cp}" xmlns:dc="${NS.dc}" xmlns:dcterms="${NS.dcterms}" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="${XSI}"/>`;
+function parseCoreProperties(xml) {
+  const out = {};
+  if (!xml) return out;
+  const root = parseXml(xml, { label: "core properties" }).documentElement;
+  for (const [field, prefix] of FIELDS) {
+    const text = first(root, field, NS[prefix])?.textContent ?? "";
+    if (text !== "") out[field] = text;
+  }
+  return out;
+}
+function writeCoreProperties(props, sourceXml) {
+  const doc = parseXml(sourceXml ?? EMPTY_CORE, { label: "core properties" });
+  const root = doc.documentElement;
+  for (const [field, prefix, isDate] of FIELDS) {
+    const ns = NS[prefix];
+    const value = props[field];
+    let element = first(root, field, ns);
+    if (value === void 0 || value === "") {
+      if (element && (element.textContent ?? "") !== "") root.removeChild(element);
+      continue;
+    }
+    if (!element) {
+      element = doc.createElementNS(ns, `${prefix}:${field}`);
+      if (isDate) element.setAttributeNS(XSI, "xsi:type", "dcterms:W3CDTF");
+      root.appendChild(element);
+    }
+    if (element.textContent !== value) element.textContent = value;
+  }
+  const out = buildXml(doc);
+  return out.startsWith("<?xml") ? out : `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+${out}`;
+}
+
+// src/opc/properties/app.ts
+var FIELDS2 = [
+  ["template", "Template", "text"],
+  ["totalTime", "TotalTime", "int"],
+  ["application", "Application", "text"],
+  ["docSecurity", "DocSecurity", "int"],
+  ["scaleCrop", "ScaleCrop", "bool"],
+  ["headingPairs", "HeadingPairs", "pairs"],
+  ["titlesOfParts", "TitlesOfParts", "titles"],
+  ["manager", "Manager", "text"],
+  ["company", "Company", "text"],
+  ["linksUpToDate", "LinksUpToDate", "bool"],
+  ["sharedDoc", "SharedDoc", "bool"],
+  ["hyperlinkBase", "HyperlinkBase", "text"],
+  ["hyperlinksChanged", "HyperlinksChanged", "bool"],
+  ["appVersion", "AppVersion", "text"]
+];
+var EMPTY_APP = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Properties xmlns="${NS.extendedProperties}" xmlns:vt="${NS.vt}"/>`;
+function vectorItems(element) {
+  const vector = first(element, "vector", NS.vt);
+  return vector ? elements(vector) : [];
+}
+function readPairs(element) {
+  const variants = vectorItems(element).map((variant) => elements(variant)[0]);
+  const out = [];
+  for (let i = 0; i + 1 < variants.length; i += 2) {
+    const name = variants[i]?.textContent ?? "";
+    const count = Number.parseInt(variants[i + 1]?.textContent ?? "", 10);
+    out.push({ name, count: Number.isFinite(count) ? count : 0 });
+  }
+  return out;
+}
+function readField(element, kind) {
+  const text = element.textContent ?? "";
+  if (kind === "pairs") return readPairs(element);
+  if (kind === "titles") return vectorItems(element).map((item) => item.textContent ?? "");
+  if (kind === "bool") return text.trim() === "true" || text.trim() === "1";
+  if (kind === "int") {
+    const value = Number.parseInt(text, 10);
+    return Number.isFinite(value) ? value : void 0;
+  }
+  return text === "" ? void 0 : text;
+}
+function parseAppProperties(xml) {
+  const out = {};
+  if (!xml) return out;
+  const root = parseXml(xml, { label: "app properties" }).documentElement;
+  for (const [field, local, kind] of FIELDS2) {
+    const element = first(root, local, NS.extendedProperties);
+    if (!element) continue;
+    const value = readField(element, kind);
+    if (value !== void 0) out[field] = value;
+  }
+  return out;
+}
+var same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+function fill(doc, element, kind, value) {
+  while (element.firstChild) element.removeChild(element.firstChild);
+  const vt = (local, text) => {
+    const node = doc.createElementNS(NS.vt, `vt:${local}`);
+    if (text !== void 0) node.textContent = text;
+    return node;
+  };
+  if (kind === "pairs" || kind === "titles") {
+    const items = kind === "pairs" ? value.flatMap((pair) => [
+      vt("lpstr", pair.name),
+      vt("i4", String(Math.trunc(pair.count)))
+    ]) : value.map((title) => vt("lpstr", title));
+    const vector = vt("vector");
+    vector.setAttribute("size", String(items.length));
+    vector.setAttribute("baseType", kind === "pairs" ? "variant" : "lpstr");
+    for (const item of items) {
+      if (kind === "pairs") {
+        const variant = vt("variant");
+        variant.appendChild(item);
+        vector.appendChild(variant);
+      } else vector.appendChild(item);
+    }
+    element.appendChild(vector);
+    return;
+  }
+  element.textContent = kind === "bool" ? value ? "true" : "false" : String(value);
+}
+function writeAppProperties(props, sourceXml) {
+  const doc = parseXml(sourceXml ?? EMPTY_APP, { label: "app properties" });
+  const root = doc.documentElement;
+  const prior = parseAppProperties(sourceXml);
+  FIELDS2.forEach(([field, local, kind], index) => {
+    const value = props[field];
+    const existing = first(root, local, NS.extendedProperties);
+    if (value === void 0 || kind === "text" && value === "") {
+      if (existing && (existing.textContent ?? "") !== "") root.removeChild(existing);
+      return;
+    }
+    if (existing && same(prior[field], value)) return;
+    let element = existing;
+    if (!element) {
+      element = doc.createElementNS(NS.extendedProperties, local);
+      const next = FIELDS2.slice(index + 1).map(([, name]) => first(root, name, NS.extendedProperties)).find((node) => node !== void 0);
+      root.insertBefore(element, next ?? null);
+    }
+    fill(doc, element, kind, value);
+  });
+  const out = buildXml(doc);
+  return out.startsWith("<?xml") ? out : `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+${out}`;
+}
+
+// src/opc/properties/custom.ts
+var escape = (text, attribute = false) => {
+  const out = text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return attribute ? out.replace(/"/g, "&quot;") : out;
+};
+var isVt = (element) => element.namespaceURI === NS.vt || element.prefix === "vt";
+function readValue(variant) {
+  const text = variant.textContent ?? "";
+  switch (isVt(variant) ? variant.localName : "") {
+    case "lpwstr":
+      return { name: "", type: "lpwstr", value: text };
+    case "i4":
+    case "int": {
+      const value = Number.parseInt(text, 10);
+      return Number.isFinite(value) ? { name: "", type: "i4", value } : void 0;
+    }
+    case "r8": {
+      const value = Number(text);
+      return text.trim() !== "" && Number.isFinite(value) ? { name: "", type: "r8", value } : void 0;
+    }
+    case "bool":
+      return { name: "", type: "bool", value: text.trim() === "true" || text.trim() === "1" };
+    case "filetime":
+      return { name: "", type: "filetime", value: text };
+    default:
+      return void 0;
+  }
+}
+function parseCustomProperties(xml) {
+  if (!xml) return [];
+  const root = parseXml(xml, { label: "custom properties" }).documentElement;
+  const out = [];
+  for (const property of children(root, "property", NS.customProperties)) {
+    const name = property.getAttribute("name") ?? "";
+    const variant = elements(property)[0];
+    if (!name || !variant) continue;
+    const value = readValue(variant) ?? {
+      name,
+      type: "raw",
+      xml: buildXml(variant)
+    };
+    const pid = Number.parseInt(property.getAttribute("pid") ?? "", 10);
+    const linkTarget = property.getAttribute("linkTarget");
+    out.push({
+      ...value,
+      name,
+      ...Number.isFinite(pid) ? { pid } : {},
+      ...linkTarget ? { linkTarget } : {}
+    });
+  }
+  return out;
+}
+function allocateCustomPropertyIds(properties) {
+  const used = /* @__PURE__ */ new Set();
+  const kept = properties.map((property) => {
+    const pid = property.pid;
+    if (pid === void 0 || !Number.isInteger(pid) || pid < 2 || used.has(pid)) return void 0;
+    used.add(pid);
+    return pid;
+  });
+  let next = Math.max(1, ...used) + 1;
+  return kept.map((pid) => pid ?? next++);
+}
+function variantXml(property) {
+  switch (property.type) {
+    case "raw":
+      return property.xml;
+    case "lpwstr":
+      return `<vt:lpwstr>${escape(property.value)}</vt:lpwstr>`;
+    case "i4":
+      return `<vt:i4>${Math.trunc(property.value)}</vt:i4>`;
+    case "r8":
+      return `<vt:r8>${String(property.value)}</vt:r8>`;
+    case "bool":
+      return `<vt:bool>${property.value ? "true" : "false"}</vt:bool>`;
+    case "filetime":
+      return `<vt:filetime>${escape(property.value)}</vt:filetime>`;
+  }
+}
+function writeCustomProperties(properties) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = properties.filter((property) => {
+    const key = property.name.toLowerCase();
+    if (!property.name || seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  if (!unique.length) return void 0;
+  const pids = allocateCustomPropertyIds(unique);
+  const body = unique.map((property, index) => {
+    const link = property.linkTarget ? ` linkTarget="${escape(property.linkTarget, true)}"` : "";
+    return `<property fmtid="${CUSTOM_PROPERTIES_FMTID}" pid="${pids[index] ?? index + 2}" name="${escape(property.name, true)}"${link}>${variantXml(property)}</property>`;
+  }).join("");
+  return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Properties xmlns="${NS.customProperties}" xmlns:vt="${NS.vt}">${body}</Properties>`;
+}
+
+// src/opc/signature/index.ts
+var signature_exports = {};
+__export(signature_exports, {
+  DIGEST_ALGORITHM_TO_HASH: () => DIGEST_ALGORITHM_TO_HASH,
+  DIGEST_ALGORITHM_TO_WEB_CRYPTO: () => DIGEST_ALGORITHM_TO_WEB_CRYPTO,
+  DIGITAL_SIGNATURE_ORIGIN_REL_TYPE: () => DIGITAL_SIGNATURE_ORIGIN_REL_TYPE,
+  DIGITAL_SIGNATURE_REL_TYPE: () => DIGITAL_SIGNATURE_REL_TYPE,
+  ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV: () => ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV,
+  ENTERPRISE_REQUIRE_REVOCATION_ENV: () => ENTERPRISE_REQUIRE_REVOCATION_ENV,
+  ENTERPRISE_REQUIRE_TIMESTAMP_ENV: () => ENTERPRISE_REQUIRE_TIMESTAMP_ENV,
+  ENTERPRISE_TRUST_ROOTS_FILE_ENV: () => ENTERPRISE_TRUST_ROOTS_FILE_ENV,
+  ENTERPRISE_TRUST_ROOTS_PEM_ENV: () => ENTERPRISE_TRUST_ROOTS_PEM_ENV,
+  OPC_RELATIONSHIP_TRANSFORM: () => OPC_RELATIONSHIP_TRANSFORM,
+  PPTX_VIEWER_MANIFEST_NS: () => PPTX_VIEWER_MANIFEST_NS,
+  SIGNATURE_PART_PREFIX: () => SIGNATURE_PART_PREFIX,
+  SUPPORTED_XML_CANON_TRANSFORMS: () => SUPPORTED_XML_CANON_TRANSFORMS,
+  XMLDSIG_NS: () => XMLDSIG_NS,
+  XML_TRANSFORM_ENVELOPED_SIGNATURE: () => XML_TRANSFORM_ENVELOPED_SIGNATURE,
+  computeDetailStatus: () => computeDetailStatus,
+  computeDigestBase64: () => computeDigestBase64,
+  computeVerificationStatus: () => computeVerificationStatus,
+  detectDigitalSignatures: () => detectDigitalSignatures,
+  escapeXmlAttr: () => escapeXmlAttr,
+  escapeXmlText: () => escapeXmlText,
+  extractAllTagText: () => extractAllTagText,
+  extractFirstTagText: () => extractFirstTagText,
+  extractTagAttribute: () => extractTagAttribute,
+  getSignaturePathsToStrip: () => getSignaturePathsToStrip,
+  isSignaturePart: () => isSignaturePart,
+  isValidBase64: () => isValidBase64,
+  normalizePartPath: () => normalizePartPath,
+  parseSignatureXml: () => parseSignatureXml,
+  resolveReferenceUriToPart: () => resolveReferenceUriToPart,
+  verifySignatureDigests: () => verifySignatureDigests
+});
+
+// src/opc/signature/detection.ts
+var SIGNATURE_PART_PREFIX = "_xmlsignatures/";
+var SIGNATURE_PREFIX = SIGNATURE_PART_PREFIX;
+function isSignaturePart(path) {
+  return path.replace(/^\//, "").toLowerCase().startsWith(SIGNATURE_PART_PREFIX);
+}
+function detectDigitalSignatures(zipEntryPaths) {
+  const sigPaths = zipEntryPaths.filter(
+    (p) => p.startsWith(SIGNATURE_PREFIX) && p.endsWith(".xml")
+  );
+  return {
+    hasSignatures: sigPaths.length > 0,
+    signatureCount: sigPaths.length,
+    signaturePaths: sigPaths
+  };
+}
+function getSignaturePathsToStrip(zipEntryPaths) {
+  return zipEntryPaths.filter((p) => p.startsWith(SIGNATURE_PREFIX));
+}
+function findByLocalName(parent, localName) {
+  if (!parent) {
+    return void 0;
+  }
+  if (parent[localName] !== void 0 && typeof parent[localName] === "object") {
+    return parent[localName];
+  }
+  for (const key of Object.keys(parent)) {
+    const parts = key.split(":");
+    if (parts[parts.length - 1] === localName && typeof parent[key] === "object") {
+      return parent[key];
+    }
+  }
+  return void 0;
+}
+function findScalarByLocalName(parent, localName) {
+  if (!parent) {
+    return void 0;
+  }
+  if (parent[localName] !== void 0) {
+    const v = parent[localName];
+    if (typeof v === "string") {
+      return v;
+    }
+    if (typeof v === "number" || typeof v === "boolean") {
+      return String(v);
+    }
+    if (typeof v === "object" && v !== null && "#text" in v) {
+      return String(v["#text"]);
+    }
+  }
+  for (const key of Object.keys(parent)) {
+    const parts = key.split(":");
+    if (parts[parts.length - 1] === localName) {
+      const v = parent[key];
+      if (typeof v === "string") {
+        return v;
+      }
+      if (typeof v === "number" || typeof v === "boolean") {
+        return String(v);
+      }
+      if (typeof v === "object" && v !== null && "#text" in v) {
+        return String(v["#text"]);
+      }
+    }
+  }
+  return void 0;
+}
+function findAllByLocalName(parent, localName) {
+  if (!parent) {
+    return [];
+  }
+  for (const key of Object.keys(parent)) {
+    const parts = key.split(":");
+    if (parts[parts.length - 1] === localName) {
+      const v = parent[key];
+      if (Array.isArray(v)) {
+        return v;
+      }
+      if (typeof v === "object" && v !== null) {
+        return [v];
+      }
+    }
+  }
+  return [];
+}
+function parseSignatureXml(signatureXml, signaturePath) {
+  const signature = findByLocalName(signatureXml, "Signature");
+  const signedInfo = findByLocalName(signature, "SignedInfo");
+  const sigMethodNode = findByLocalName(signedInfo, "SignatureMethod");
+  const signatureMethod = sigMethodNode?.["@_Algorithm"];
+  const signatureValue = findScalarByLocalName(signature, "SignatureValue")?.replace(/\s+/g, "");
+  const references = [];
+  const refNodes = findAllByLocalName(signedInfo, "Reference");
+  for (const ref of refNodes) {
+    const uri = String(ref["@_URI"] || "");
+    const dmNode = findByLocalName(ref, "DigestMethod");
+    const digestMethod2 = dmNode?.["@_Algorithm"];
+    const digestValue = findScalarByLocalName(ref, "DigestValue")?.replace(/\s+/g, "");
+    references.push({
+      uri,
+      ...digestMethod2 === void 0 ? {} : { digestMethod: digestMethod2 },
+      ...digestValue === void 0 ? {} : { digestValue }
+    });
+  }
+  const digestMethod = references[0]?.digestMethod;
+  const keyInfo = findByLocalName(signature, "KeyInfo");
+  const x509Data = findByLocalName(keyInfo, "X509Data");
+  let certificate;
+  if (x509Data) {
+    const certBase64 = findScalarByLocalName(x509Data, "X509Certificate")?.replace(/\s+/g, "");
+    if (certBase64) {
+      const issuerSerial = findByLocalName(x509Data, "X509IssuerSerial");
+      const issuer = findScalarByLocalName(issuerSerial, "X509IssuerName");
+      const serialNumber = findScalarByLocalName(issuerSerial, "X509SerialNumber");
+      const subject = findScalarByLocalName(x509Data, "X509SubjectName");
+      certificate = {
+        certificateBase64: certBase64,
+        ...issuer ? { issuer } : {},
+        ...subject ? { subject } : {},
+        ...serialNumber ? { serialNumber } : {}
+      };
+    }
+  }
+  let status = "unverified";
+  if (certificate?.validTo) {
+    const expiry = new Date(certificate.validTo);
+    if (expiry < /* @__PURE__ */ new Date()) {
+      status = "expired";
+    }
+  }
+  return {
+    signaturePath,
+    ...signatureMethod === void 0 ? {} : { signatureMethod },
+    ...digestMethod === void 0 ? {} : { digestMethod },
+    ...signatureValue === void 0 ? {} : { signatureValue },
+    ...certificate === void 0 ? {} : { certificate },
+    status,
+    references
+  };
+}
+async function verifySignatureDigests(signature, getPartContent) {
+  if (!signature.references.length) {
+    return "unverified";
+  }
+  if (typeof globalThis.crypto?.subtle === "undefined") {
+    return "unverified";
+  }
+  for (const ref of signature.references) {
+    if (!ref.digestValue || !ref.uri) {
+      continue;
+    }
+    const algo = ref.digestMethod?.toLowerCase() || "";
+    let hashAlgo;
+    if (algo.includes("sha256") || algo.includes("sha-256")) {
+      hashAlgo = "SHA-256";
+    } else if (algo.includes("sha512") || algo.includes("sha-512")) {
+      hashAlgo = "SHA-512";
+    } else if (algo.includes("sha1") || algo.includes("sha-1")) {
+      hashAlgo = "SHA-1";
+    } else {
+      continue;
+    }
+    const content = await getPartContent(ref.uri);
+    if (!content) {
+      continue;
+    }
+    try {
+      const digest = await crypto.subtle.digest(hashAlgo, content);
+      const digestBase64 = arrayBufferToBase64(digest);
+      if (digestBase64 !== ref.digestValue) {
+        return "invalid";
+      }
+    } catch {
+      return "unverified";
+    }
+  }
+  return signature.certificate ? "valid" : "unknownCA";
+}
+function arrayBufferToBase64(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.byteLength; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+
+// src/opc/signature/constants.ts
+var DIGITAL_SIGNATURE_ORIGIN_REL_TYPE = "http://schemas.openxmlformats.org/package/2006/relationships/digital-signature/origin";
+var DIGITAL_SIGNATURE_REL_TYPE = "http://schemas.openxmlformats.org/package/2006/relationships/digital-signature/signature";
+var PPTX_VIEWER_MANIFEST_NS = "urn:pptx-viewer:ooxml-signature:v1";
+var XMLDSIG_NS = "http://www.w3.org/2000/09/xmldsig#";
+var OPC_RELATIONSHIP_TRANSFORM = "http://schemas.openxmlformats.org/package/2006/RelationshipTransform";
+var XML_TRANSFORM_ENVELOPED_SIGNATURE = "http://www.w3.org/2000/09/xmldsig#enveloped-signature";
+var SUPPORTED_XML_CANON_TRANSFORMS = /* @__PURE__ */ new Set([
+  "http://www.w3.org/TR/2001/REC-xml-c14n-20010315",
+  "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments",
+  "http://www.w3.org/2001/10/xml-exc-c14n#",
+  "http://www.w3.org/2001/10/xml-exc-c14n#WithComments",
+  XML_TRANSFORM_ENVELOPED_SIGNATURE
+]);
+var ENTERPRISE_TRUST_ROOTS_FILE_ENV = "PPTX_VIEWER_TRUST_ROOTS_FILE";
+var ENTERPRISE_TRUST_ROOTS_PEM_ENV = "PPTX_VIEWER_TRUST_ROOTS_PEM";
+var ENTERPRISE_REQUIRE_REVOCATION_ENV = "PPTX_VIEWER_REQUIRE_REVOCATION_CHECK";
+var ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV = "PPTX_VIEWER_FAIL_ON_REVOCATION_UNKNOWN";
+var ENTERPRISE_REQUIRE_TIMESTAMP_ENV = "PPTX_VIEWER_REQUIRE_TIMESTAMP";
+var DIGEST_ALGORITHM_TO_HASH = {
+  "http://www.w3.org/2000/09/xmldsig#sha1": "sha1",
+  "http://www.w3.org/2001/04/xmlenc#sha256": "sha256",
+  "http://www.w3.org/2001/04/xmlenc#sha384": "sha384",
+  "http://www.w3.org/2001/04/xmlenc#sha512": "sha512"
+};
+var DIGEST_ALGORITHM_TO_WEB_CRYPTO = {
+  "http://www.w3.org/2000/09/xmldsig#sha1": "SHA-1",
+  "http://www.w3.org/2001/04/xmlenc#sha256": "SHA-256",
+  "http://www.w3.org/2001/04/xmlenc#sha384": "SHA-384",
+  "http://www.w3.org/2001/04/xmlenc#sha512": "SHA-512"
+};
+
+// src/opc/signature/xml-utils.ts
+function escapeXmlAttr(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function escapeXmlText(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function isValidBase64(value) {
+  return typeof value === "string" && value.length > 0 && /^[A-Za-z0-9+/=\s]+$/.test(value);
+}
+function extractTagAttribute(xml, tagName, attributeName) {
+  const pattern = new RegExp(
+    `<${tagName}\\b[^>]*\\b${attributeName}="(?<attributeValue>[^"]+)"`,
+    "i"
+  );
+  const match = xml.match(pattern);
+  return match?.groups?.["attributeValue"]?.trim();
+}
+function extractFirstTagText(xml, localName) {
+  const pattern = new RegExp(
+    `<([\\w.-]+:)?${localName}\\b[^>]*>([\\s\\S]*?)<\\/([\\w.-]+:)?${localName}>`,
+    "i"
+  );
+  const match = xml.match(pattern);
+  return match?.[2]?.replace(/\s+/g, "").trim() || void 0;
+}
+function extractAllTagText(xml, localName) {
+  const result = [];
+  const regex = new RegExp(
+    `<([\\w.-]+:)?${localName}\\b[^>]*>([\\s\\S]*?)<\\/([\\w.-]+:)?${localName}>`,
+    "gi"
+  );
+  let match = regex.exec(xml);
+  while (match) {
+    const value = match[2]?.replace(/\s+/g, "").trim();
+    if (value) {
+      result.push(value);
+    }
+    match = regex.exec(xml);
+  }
+  return result;
+}
+
+// src/opc/signature/reference-utils.ts
+function normalizePartPath(partPath) {
+  return partPath.replace(/\\/g, "/").replace(/^\/+/, "");
+}
+function resolveReferenceUriToPart(uri) {
+  const trimmed = uri.trim();
+  if (trimmed.length === 0 || trimmed.startsWith("#")) {
+    return void 0;
+  }
+  const decoded = decodeURIComponent(trimmed);
+  return normalizePartPath(decoded.startsWith("/") ? decoded.slice(1) : decoded);
+}
+
+// src/opc/signature/digest.ts
+async function computeDigestBase64(content, digestAlgorithmUri) {
+  const webCryptoAlgo = DIGEST_ALGORITHM_TO_WEB_CRYPTO[digestAlgorithmUri];
+  if (!webCryptoAlgo) {
+    return void 0;
+  }
+  if (typeof globalThis.crypto?.subtle === "undefined") {
+    return void 0;
+  }
+  const buf = new ArrayBuffer(content.byteLength);
+  new Uint8Array(buf).set(content);
+  const digest = await globalThis.crypto.subtle.digest(webCryptoAlgo, buf);
+  return uint8ArrayToBase64(new Uint8Array(digest));
+}
+function uint8ArrayToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.byteLength; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+
+// src/opc/signature/inspection-status.ts
+function computeDetailStatus(detail, policy) {
+  const hasDigestMismatch = detail.referenceChecks.some(
+    (check) => check.digestStatus === "mismatch"
+  );
+  const hasMissingPart = detail.missingPartReferences.length > 0;
+  const hasVerifiedDigest = detail.referenceChecks.some(
+    (check) => check.digestStatus === "verified"
+  );
+  const revocationUnknown = detail.certificateRevocationStatus === "unknown" || detail.certificateRevocationStatus === "not-checked" || detail.certificateRevocationStatus === "error";
+  const timestampMissingOrUntrusted = detail.timestampAuthorityStatus === "not-present" || detail.timestampAuthorityStatus === "not-checked" || detail.timestampAuthorityStatus === "error" || detail.timestampAuthorityStatus === "untrusted";
+  if (detail.signatureValueStatus === "invalid") {
+    return "signature-invalid";
+  }
+  if (hasMissingPart) {
+    return "reference-missing";
+  }
+  if (hasDigestMismatch) {
+    return "digest-mismatch";
+  }
+  if (detail.certificateRevocationStatus === "revoked") {
+    return "certificate-revoked";
+  }
+  if (policy.requireRevocationCheck && (policy.failOnRevocationUnknown ? revocationUnknown : detail.certificateRevocationStatus !== "good")) {
+    return "certificate-untrusted";
+  }
+  if (detail.timestampAuthorityStatus === "invalid") {
+    return "timestamp-invalid";
+  }
+  if (policy.requireTimestamp && timestampMissingOrUntrusted) {
+    return "timestamp-untrusted";
+  }
+  if (detail.timestampAuthorityStatus === "untrusted") {
+    return "timestamp-untrusted";
+  }
+  if (detail.certificateTrustStatus === "untrusted" && detail.signatureValueStatus === "verified") {
+    return "certificate-untrusted";
+  }
+  if (hasVerifiedDigest && detail.signatureValueStatus === "verified") {
+    return "verified";
+  }
+  return "structural-only";
+}
+function computeVerificationStatus(details) {
+  const hasInvalidSignature = details.some((detail) => detail.status === "signature-invalid");
+  const hasMissing = details.some((detail) => detail.status === "reference-missing");
+  const hasMismatch = details.some((detail) => detail.status === "digest-mismatch");
+  const hasUntrusted = details.some((detail) => detail.status === "certificate-untrusted");
+  const hasRevoked = details.some((detail) => detail.status === "certificate-revoked");
+  const hasTimestampInvalid = details.some((detail) => detail.status === "timestamp-invalid");
+  const hasTimestampUntrusted = details.some((detail) => detail.status === "timestamp-untrusted");
+  const allVerified = details.every((detail) => detail.status === "verified");
+  return hasInvalidSignature ? "signature-invalid" : hasRevoked ? "certificate-revoked" : hasTimestampInvalid ? "timestamp-invalid" : hasTimestampUntrusted ? "timestamp-untrusted" : hasMissing ? "reference-missing" : hasMismatch ? "digest-mismatch" : allVerified ? "verified-trusted" : hasUntrusted ? "verified-untrusted" : "present-not-verified";
+}
 
 // src/diagram/relationships.ts
 function diagramRelationshipsPart(partPath) {
@@ -1428,11 +2158,11 @@ function styleRef(element) {
 function parseStyleReferences(style) {
   const refs = {};
   const line2 = styleRef(first(style, "lnRef", NS.a));
-  const fill = styleRef(first(style, "fillRef", NS.a));
+  const fill2 = styleRef(first(style, "fillRef", NS.a));
   const effect = styleRef(first(style, "effectRef", NS.a));
   const font = styleRef(first(style, "fontRef", NS.a));
   if (line2) refs.line = line2;
-  if (fill) refs.fill = fill;
+  if (fill2) refs.fill = fill2;
   if (effect) refs.effect = effect;
   if (font) refs.font = font;
   return refs;
@@ -1484,23 +2214,23 @@ function fillElementOf(properties) {
   ) : void 0;
 }
 function parseDrawingFill(properties) {
-  const fill = fillElementOf(properties);
-  if (!fill) return void 0;
-  switch (fill.localName) {
+  const fill2 = fillElementOf(properties);
+  if (!fill2) return void 0;
+  switch (fill2.localName) {
     case "noFill":
       return { kind: "none" };
     case "solidFill": {
-      const color = parseDrawingColorIn(fill);
+      const color = parseDrawingColorIn(fill2);
       return color ? { kind: "solid", color } : { kind: "unsupported", element: "solidFill" };
     }
     case "gradFill": {
-      const stops = children(first(fill, "gsLst", NS.a) ?? fill, "gs", NS.a).flatMap((stop) => {
+      const stops = children(first(fill2, "gsLst", NS.a) ?? fill2, "gs", NS.a).flatMap((stop) => {
         const color = parseDrawingColorIn(stop);
         const position = Number.parseInt(stop.getAttribute("pos") ?? "", 10);
         return color && Number.isFinite(position) ? [{ position: position / 1e3, color }] : [];
       });
-      const angle = Number.parseInt(first(fill, "lin", NS.a)?.getAttribute("ang") ?? "", 10);
-      const path = first(fill, "path", NS.a)?.getAttribute("path");
+      const angle = Number.parseInt(first(fill2, "lin", NS.a)?.getAttribute("ang") ?? "", 10);
+      const path = first(fill2, "path", NS.a)?.getAttribute("path");
       return {
         kind: "gradient",
         stops,
@@ -1509,22 +2239,22 @@ function parseDrawingFill(properties) {
       };
     }
     case "pattFill": {
-      const foreground = parseDrawingColorIn(first(fill, "fgClr", NS.a));
-      const background = parseDrawingColorIn(first(fill, "bgClr", NS.a));
+      const foreground = parseDrawingColorIn(first(fill2, "fgClr", NS.a));
+      const background = parseDrawingColorIn(first(fill2, "bgClr", NS.a));
       return {
         kind: "pattern",
-        preset: fill.getAttribute("prst") ?? "",
+        preset: fill2.getAttribute("prst") ?? "",
         ...foreground ? { foreground } : {},
         ...background ? { background } : {}
       };
     }
     case "blipFill": {
-      const blip = first(fill, "blip", NS.a);
+      const blip = first(fill2, "blip", NS.a);
       const relId = blip?.getAttributeNS(NS.r, "embed") || blip?.getAttribute("r:embed") || void 0;
       return { kind: "picture", ...relId ? { relId } : {} };
     }
     default:
-      return { kind: "unsupported", element: fill.localName };
+      return { kind: "unsupported", element: fill2.localName };
   }
 }
 function parseDrawingLine(ln) {
@@ -1532,8 +2262,8 @@ function parseDrawingLine(ln) {
   const line2 = {};
   const width = Number.parseInt(ln.getAttribute("w") ?? "", 10);
   if (Number.isFinite(width)) line2.widthEmu = width;
-  const fill = parseDrawingFill(ln);
-  if (fill) line2.fill = fill;
+  const fill2 = parseDrawingFill(ln);
+  if (fill2) line2.fill = fill2;
   const dash = first(ln, "prstDash", NS.a)?.getAttribute("val");
   if (dash) line2.dash = dash;
   const cap = ln.getAttribute("cap");
@@ -1753,8 +2483,8 @@ function parseShape(sp, index, group, issues) {
   if (transform.flipVertical) shape.flipVertical = true;
   if (adjustments) shape.adjustments = adjustments;
   if (paths) shape.paths = paths;
-  const fill = parseDrawingFill(spPr);
-  if (fill) shape.fill = fill;
+  const fill2 = parseDrawingFill(spPr);
+  if (fill2) shape.fill = fill2;
   const line2 = parseDrawingLine(first(spPr, "ln", NS.a));
   if (line2) shape.line = line2;
   const style = first(sp, "style", NS.dsp);