ooxml-core 0.9.0 → 0.11.0

package/dist/opc/properties/app.d.ts

@@ -0,0 +1,10 @@
+import type { AppProperties } from './types.js';
+/** Reads the known fields of `docProps/app.xml`. */
+export declare function parseAppProperties(xml: string | undefined): AppProperties;
+/**
+ * Writes `docProps/app.xml`. With `sourceXml` the source part is patched: an element whose
+ * value is unchanged is left byte for byte, a changed one is rewritten, an unset one removed,
+ * and every element the model does not know (statistics, `DigSig`, `HLinks`...) is kept.
+ */
+export declare function writeAppProperties(props: AppProperties, sourceXml?: string): string;
+//# sourceMappingURL=app.d.ts.map

package/dist/opc/properties/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/opc/properties/app.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAe,MAAM,YAAY,CAAC;AAuD7D,oDAAoD;AACpD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAWzE;AAmCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CA2BnF"}

package/dist/opc/properties/core.d.ts

@@ -0,0 +1,13 @@
+import type { CoreProperties } from './types.js';
+type CoreField = keyof CoreProperties;
+/** The core property names, in the order they are written. */
+export declare const CORE_PROPERTY_FIELDS: readonly CoreField[];
+/** Reads `docProps/core.xml`. Empty elements count as unset; text is not trimmed. */
+export declare function parseCoreProperties(xml: string | undefined): CoreProperties;
+/**
+ * Writes `docProps/core.xml`. With `sourceXml` the source part is patched: known fields are
+ * set, replaced or removed to match `props`, and every element the model does not know is kept.
+ */
+export declare function writeCoreProperties(props: CoreProperties, sourceXml?: string): string;
+export {};
+//# sourceMappingURL=core.d.ts.map

package/dist/opc/properties/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/opc/properties/core.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,KAAK,SAAS,GAAG,MAAM,cAAc,CAAC;AAqBtC,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,EAAE,SAAS,SAAS,EAAmC,CAAC;AAMzF,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAS3E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAsBrF"}

package/dist/opc/properties/custom.d.ts

@@ -0,0 +1,15 @@
+import { type CustomProperty } from './types.js';
+/** Reads `docProps/custom.xml`; a property of an unmodelled variant type is kept as `raw`. */
+export declare function parseCustomProperties(xml: string | undefined): CustomProperty[];
+/**
+ * Property ids for `properties`: a valid, unique `pid` (2 and up) is kept, every other property
+ * gets the next free id after the largest one in use.
+ */
+export declare function allocateCustomPropertyIds(properties: readonly CustomProperty[]): number[];
+/**
+ * `docProps/custom.xml` for `properties`, or `undefined` when there are none (the part and its
+ * relationship are then omitted). Names must be unique (case-insensitive, as Office requires):
+ * a later duplicate is dropped.
+ */
+export declare function writeCustomProperties(properties: readonly CustomProperty[]): string | undefined;
+//# sourceMappingURL=custom.d.ts.map

package/dist/opc/properties/custom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.d.ts","sourceRoot":"","sources":["../../../src/opc/properties/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAkC1E,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,EAAE,CAuB/E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,EAAE,CAUzF;AAmBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,GAAG,SAAS,CAoB/F"}

package/dist/opc/properties/index.d.ts

@@ -0,0 +1,5 @@
+export * from './types.js';
+export { CORE_PROPERTY_FIELDS, parseCoreProperties, writeCoreProperties } from './core.js';
+export { parseAppProperties, writeAppProperties } from './app.js';
+export { allocateCustomPropertyIds, parseCustomProperties, writeCustomProperties, } from './custom.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/opc/properties/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/opc/properties/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EACN,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,aAAa,CAAC"}

package/dist/opc/properties/types.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Package document properties shared by every Office format: core (`docProps/core.xml`,
+ * Dublin Core and `cp:`), extended (`docProps/app.xml`) and custom (`docProps/custom.xml`).
+ * Absent fields are unset. Dates are kept as the W3CDTF text the part holds (ISO 8601).
+ */
+/** `docProps/core.xml` (ECMA-376 Part 2, 11). */
+export interface CoreProperties {
+    title?: string;
+    subject?: string;
+    /** `dc:creator`: the author. */
+    creator?: string;
+    /** `cp:keywords`: tags. */
+    keywords?: string;
+    /** `dc:description`: comments. */
+    description?: string;
+    lastModifiedBy?: string;
+    /** `dcterms:created`, W3CDTF. */
+    created?: string;
+    /** `dcterms:modified`, W3CDTF. */
+    modified?: string;
+    category?: string;
+    /** `cp:contentStatus` (Draft, Final, ...). */
+    contentStatus?: string;
+    /** `cp:revision`: the revision number as text. */
+    revision?: string;
+    /** `dc:language` (RFC 3066 tag). */
+    language?: string;
+    /** `dc:identifier`. */
+    identifier?: string;
+    /** `cp:lastPrinted`, W3CDTF. */
+    lastPrinted?: string;
+    /** `cp:version`. */
+    version?: string;
+}
+/** One `HeadingPairs` entry: a group name (`Worksheets`, `Named Ranges`) and its title count. */
+export interface HeadingPair {
+    name: string;
+    count: number;
+}
+/** The fields of `docProps/app.xml` this model reads and writes; other elements are preserved. */
+export interface AppProperties {
+    /** `Application` (`Microsoft Excel`). */
+    application?: string;
+    /** `AppVersion` (`16.0300`). */
+    appVersion?: string;
+    company?: string;
+    manager?: string;
+    /** Base for relative hyperlinks (`HyperlinkBase`). */
+    hyperlinkBase?: string;
+    template?: string;
+    /** `DocSecurity`: 0 none, 1 password protected, 2 read-only recommended, 4 read-only enforced, 8 locked for annotations. */
+    docSecurity?: number;
+    /** `TotalTime`: editing minutes. */
+    totalTime?: number;
+    scaleCrop?: boolean;
+    linksUpToDate?: boolean;
+    sharedDoc?: boolean;
+    hyperlinksChanged?: boolean;
+    /** `HeadingPairs`: groups of `titlesOfParts`, in order. */
+    headingPairs?: HeadingPair[];
+    /** `TitlesOfParts`: sheet names, named ranges, slide titles... grouped by `headingPairs`. */
+    titlesOfParts?: string[];
+}
+/** Variant types of a custom property value this model edits. */
+export type CustomPropertyType = 'lpwstr' | 'i4' | 'r8' | 'bool' | 'filetime';
+interface CustomPropertyBase {
+    name: string;
+    /** Property id (2 and up); allocated on write when absent or duplicated. */
+    pid?: number;
+    /** `linkTarget`: the name of a bookmark or defined name the value is linked to. */
+    linkTarget?: string;
+}
+/**
+ * A `docProps/custom.xml` property. `raw` keeps a value of any other variant type (`vt:i8`,
+ * `vt:lpstr`, `vt:date`, vectors...) as the variant element's XML, written back verbatim.
+ */
+export type CustomProperty = CustomPropertyBase & ({
+    type: 'lpwstr';
+    value: string;
+} | {
+    type: 'i4' | 'r8';
+    value: number;
+} | {
+    type: 'bool';
+    value: boolean;
+}
+/** W3CDTF / ISO 8601 UTC text (`2026-10-03T00:00:00Z`). */
+ | {
+    type: 'filetime';
+    value: string;
+} | {
+    type: 'raw';
+    xml: string;
+});
+/** All three property parts of a package. */
+export interface DocumentPropertySet {
+    core: CoreProperties;
+    app: AppProperties;
+    custom: CustomProperty[];
+}
+/** `fmtid` of user-defined custom properties (FMTID_UserDefinedProperties). */
+export declare const CUSTOM_PROPERTIES_FMTID = "{D5CDD505-2E9C-101B-9397-08002B2CF9AE}";
+export declare const PROPERTY_PART_NAMES: {
+    readonly core: "docProps/core.xml";
+    readonly app: "docProps/app.xml";
+    readonly custom: "docProps/custom.xml";
+};
+export declare const PROPERTY_CONTENT_TYPES: {
+    readonly core: "application/vnd.openxmlformats-package.core-properties+xml";
+    readonly app: "application/vnd.openxmlformats-officedocument.extended-properties+xml";
+    readonly custom: "application/vnd.openxmlformats-officedocument.custom-properties+xml";
+};
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/opc/properties/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/opc/properties/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACd;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC7B,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4HAA4H;IAC5H,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,IAAI,GAAG,MAAM,GAAG,UAAU,CAAC;AAE9E,UAAU,kBAAkB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAC9C,CACG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE;AAClC,2DAA2D;GACzD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAC9B,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,cAAc,EAAE,CAAC;CACzB;AAED,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,2CAA2C,CAAC;AAEhF,eAAO,MAAM,mBAAmB;;;;CAItB,CAAC;AAEX,eAAO,MAAM,sBAAsB;;;;CAIzB,CAAC"}

package/dist/opc/relationship-types.d.ts

@@ -28,6 +28,7 @@ export declare const RELATIONSHIP_TYPES: {
     readonly diagramDrawing: "http://schemas.microsoft.com/office/2007/relationships/diagramDrawing";
     readonly coreProperties: "http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties";
     readonly extendedProperties: "http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties";
+    readonly customProperties: "http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties";
     readonly customXml: "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml";
     readonly worksheet: "http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet";
     readonly chartsheet: "http://schemas.openxmlformats.org/officeDocument/2006/relationships/chartsheet";

package/dist/opc/relationship-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relationship-types.d.ts","sourceRoot":"","sources":["../../src/opc/relationship-types.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDrB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,kBAAkB,CAAC"}
+{"version":3,"file":"relationship-types.d.ts","sourceRoot":"","sources":["../../src/opc/relationship-types.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDrB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,kBAAkB,CAAC"}

package/dist/opc/safe-href.d.ts

@@ -1,3 +1,37 @@
+/**
+ * One hyperlink safety policy for every format.
+ *
+ * - `isSafeHyperlinkHref` is the original strict check (http, https, mailto only) used by
+ *   callers that write external relationships from user input; its behaviour is unchanged.
+ * - `hyperlinkPolicy` separates two questions: may the href be **stored** in the document
+ *   (http, https, mailto, ftp, file, relative paths, UNC and drive paths, in-document
+ *   locations such as `#Sheet2!A1`), and may a viewer **open** it on click (http, https and
+ *   mailto only). Script-capable schemes (`javascript:`, `vbscript:`, `data:`, `mhtml:` and
+ *   relatives) are never stored or opened, including when hidden behind case changes,
+ *   whitespace, control characters or zero-width characters.
+ *
+ * The obfuscation hardening follows `isUrlSafe` of pptx-viewer
+ * (`packages/shared/src/render/hyperlink-security.ts`); see PROVENANCE.md.
+ */
 /** Only http(s) and mailto targets are accepted; anything else (notably `javascript:`) is rejected. */
 export declare function isSafeHyperlinkHref(href: string): boolean;
+/** Why a hyperlink may not be stored or opened. */
+export type HyperlinkRejection = 'empty' | 'script-scheme' | 'obfuscated-scheme' | 'control-characters' | 'unsupported-scheme' | 'not-openable';
+/** The verdict of {@link hyperlinkPolicy}; `reason` is set whenever `store` or `open` is false. */
+export interface HyperlinkPolicy {
+    /** The href may be kept in (written to) the document. */
+    readonly store: boolean;
+    /** A viewer may navigate to the href when the user activates the link. */
+    readonly open: boolean;
+    readonly reason?: HyperlinkRejection;
+}
+/**
+ * Classify a hyperlink target. Leading and trailing whitespace is ignored; anything else
+ * that could disguise the scheme makes the href unsafe.
+ */
+export declare function hyperlinkPolicy(href: string | undefined | null): HyperlinkPolicy;
+/** True when the href may be written to the document (see {@link hyperlinkPolicy}). */
+export declare function isStorableHyperlinkHref(href: string | undefined | null): boolean;
+/** True when a viewer may open the href on click (see {@link hyperlinkPolicy}). */
+export declare function isOpenableHyperlinkHref(href: string | undefined | null): boolean;
 //# sourceMappingURL=safe-href.d.ts.map

package/dist/opc/safe-href.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-href.d.ts","sourceRoot":"","sources":["../../src/opc/safe-href.ts"],"names":[],"mappings":"AAEA,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}
+{"version":3,"file":"safe-href.d.ts","sourceRoot":"","sources":["../../src/opc/safe-href.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,mDAAmD;AACnD,MAAM,MAAM,kBAAkB,GAC3B,OAAO,GACP,eAAe,GACf,mBAAmB,GACnB,oBAAoB,GACpB,oBAAoB,GACpB,cAAc,CAAC;AAElB,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAqCD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,eAAe,CAehF;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhF;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhF"}

package/dist/opc/signature/constants.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Constants for OOXML digital signature processing.
+ *
+ * OPC URIs, algorithm URIs, digest mappings, and enterprise
+ * environment variable names used across both platform-agnostic
+ * and Node-only signature modules.
+ */
+/** The OOXML relationship type for the digital signature origin part. */
+export declare const DIGITAL_SIGNATURE_ORIGIN_REL_TYPE = "http://schemas.openxmlformats.org/package/2006/relationships/digital-signature/origin";
+/** The OOXML relationship type for individual signature parts. */
+export declare const DIGITAL_SIGNATURE_REL_TYPE = "http://schemas.openxmlformats.org/package/2006/relationships/digital-signature/signature";
+/** Custom pptx-viewer manifest namespace for extended signature references. */
+export declare const PPTX_VIEWER_MANIFEST_NS = "urn:pptx-viewer:ooxml-signature:v1";
+/** W3C XML Digital Signature namespace. */
+export declare const XMLDSIG_NS = "http://www.w3.org/2000/09/xmldsig#";
+/** OPC relationship transform algorithm URI. */
+export declare const OPC_RELATIONSHIP_TRANSFORM = "http://schemas.openxmlformats.org/package/2006/RelationshipTransform";
+/** Enveloped signature transform algorithm URI. */
+export declare const XML_TRANSFORM_ENVELOPED_SIGNATURE = "http://www.w3.org/2000/09/xmldsig#enveloped-signature";
+/** Set of supported XML canonicalization transform algorithm URIs. */
+export declare const SUPPORTED_XML_CANON_TRANSFORMS: Set<string>;
+/** Environment variable: path to file containing enterprise trust root PEM certificates. */
+export declare const ENTERPRISE_TRUST_ROOTS_FILE_ENV = "PPTX_VIEWER_TRUST_ROOTS_FILE";
+/** Environment variable: inline PEM trust roots. */
+export declare const ENTERPRISE_TRUST_ROOTS_PEM_ENV = "PPTX_VIEWER_TRUST_ROOTS_PEM";
+/** Environment variable: require revocation check. */
+export declare const ENTERPRISE_REQUIRE_REVOCATION_ENV = "PPTX_VIEWER_REQUIRE_REVOCATION_CHECK";
+/** Environment variable: fail on unknown revocation status. */
+export declare const ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV = "PPTX_VIEWER_FAIL_ON_REVOCATION_UNKNOWN";
+/** Environment variable: require timestamp authority. */
+export declare const ENTERPRISE_REQUIRE_TIMESTAMP_ENV = "PPTX_VIEWER_REQUIRE_TIMESTAMP";
+/**
+ * Mapping from XML Digital Signature digest algorithm URIs to hash function names.
+ * Used by Node-only code with `node:crypto` (lowercase names).
+ */
+export declare const DIGEST_ALGORITHM_TO_HASH: Record<string, string>;
+/**
+ * Mapping from XML Digital Signature digest algorithm URIs to Web Crypto algorithm names.
+ * Used by platform-agnostic code with `crypto.subtle.digest`.
+ */
+export declare const DIGEST_ALGORITHM_TO_WEB_CRYPTO: Record<string, string>;
+//# sourceMappingURL=constants.d.ts.map

package/dist/opc/signature/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/opc/signature/constants.ts"],"names":[],"mappings":"AACA;;;;;;GAMG;AAEH,yEAAyE;AACzE,eAAO,MAAM,iCAAiC,0FAC0C,CAAC;AAEzF,kEAAkE;AAClE,eAAO,MAAM,0BAA0B,6FACoD,CAAC;AAE5F,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,uCAAuC,CAAC;AAE5E,2CAA2C;AAC3C,eAAO,MAAM,UAAU,uCAAuC,CAAC;AAE/D,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,yEACgC,CAAC;AAExE,mDAAmD;AACnD,eAAO,MAAM,iCAAiC,0DACU,CAAC;AAEzD,sEAAsE;AACtE,eAAO,MAAM,8BAA8B,aAMzC,CAAC;AAEH,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,iCAAiC,CAAC;AAE9E,oDAAoD;AACpD,eAAO,MAAM,8BAA8B,gCAAgC,CAAC;AAE5E,sDAAsD;AACtD,eAAO,MAAM,iCAAiC,yCAAyC,CAAC;AAExF,+DAA+D;AAC/D,eAAO,MAAM,yCAAyC,2CAA2C,CAAC;AAElG,yDAAyD;AACzD,eAAO,MAAM,gCAAgC,kCAAkC,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK3D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKjE,CAAC"}

package/dist/opc/signature/detection.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Detect, parse, and validate digital signatures in OOXML packages.
+ *
+ * Digital signatures live in `_xmlsignatures/` parts:
+ * - `_xmlsignatures/origin.sigs` - relationship origin
+ * - `_xmlsignatures/sig1.xml`, `sig2.xml`, etc. - individual signatures
+ *
+ * Each signature XML follows the W3C XML-DSig spec and contains:
+ * - `ds:SignedInfo` with `ds:Reference` digests
+ * - `ds:SignatureValue` (base64-encoded signature)
+ * - `ds:KeyInfo > ds:X509Data > ds:X509Certificate` (base64-encoded DER cert)
+ */
+/** Result of signature detection. */
+export interface SignatureDetectionResult {
+    hasSignatures: boolean;
+    signatureCount: number;
+    signaturePaths: string[];
+}
+/** X.509 certificate information extracted from a signature. */
+export interface SignatureCertificateInfo {
+    /** Base64-encoded DER certificate data. */
+    certificateBase64: string;
+    /** Issuer distinguished name (CN, O, etc.) if parseable. */
+    issuer?: string;
+    /** Subject distinguished name (CN, O, etc.) if parseable. */
+    subject?: string;
+    /** Certificate serial number as hex string. */
+    serialNumber?: string;
+    /** Not-before validity date (ISO string). */
+    validFrom?: string;
+    /** Not-after validity date (ISO string). */
+    validTo?: string;
+}
+/** Status of a digital signature. */
+export type SignatureStatus = 'valid' | 'invalid' | 'expired' | 'unknownCA' | 'unverified';
+/** Parsed digital signature with certificate info and validation status. */
+export interface ParsedSignature {
+    /** Path to the signature XML in the ZIP. */
+    signaturePath: string;
+    /** The canonicalized signing method algorithm URI. */
+    signatureMethod?: string;
+    /** The digest method algorithm URI from the first reference. */
+    digestMethod?: string;
+    /** Base64-encoded signature value. */
+    signatureValue?: string;
+    /** Certificate information, if X.509 data was found. */
+    certificate?: SignatureCertificateInfo;
+    /** Signature validation status. */
+    status: SignatureStatus;
+    /** Reference URIs and their digest values. */
+    references: SignatureReference[];
+}
+/** A single ds:Reference in the SignedInfo. */
+export interface SignatureReference {
+    /** The URI identifying the signed part. */
+    uri: string;
+    /** The digest method algorithm. */
+    digestMethod?: string;
+    /** Base64-encoded digest value. */
+    digestValue?: string;
+}
+/** The path prefix for all digital signature parts in an OOXML package. */
+export declare const SIGNATURE_PART_PREFIX = "_xmlsignatures/";
+/**
+ * Whether a package part (a zip entry path, with or without the leading slash, any case) is a
+ * digital signature part: the origin, a signature, or their relationships.
+ */
+export declare function isSignaturePart(path: string): boolean;
+/**
+ * Detect digital signatures by checking for `_xmlsignatures/` paths in the ZIP entries.
+ */
+export declare function detectDigitalSignatures(zipEntryPaths: string[]): SignatureDetectionResult;
+/**
+ * Get the list of ZIP entry paths that should be removed to strip signatures.
+ * Includes all `_xmlsignatures/` entries (XML, .sigs, .rels, etc.).
+ */
+export declare function getSignaturePathsToStrip(zipEntryPaths: string[]): string[];
+/**
+ * Parse a single ds:Signature XML document into structured signature info.
+ *
+ * @param signatureXml - The parsed XML object (from fast-xml-parser).
+ * @param signaturePath - Path to the sig*.xml file in the ZIP.
+ * @returns Parsed signature info with certificate data and unverified status.
+ */
+export declare function parseSignatureXml(signatureXml: Record<string, unknown>, signaturePath: string): ParsedSignature;
+/**
+ * Verify a signature's digest references against actual document content.
+ *
+ * Uses the Web Crypto API (SubtleCrypto) to compute SHA-256/SHA-1 digests
+ * of referenced parts and compare against the signed digest values.
+ *
+ * @param signature - The parsed signature to verify.
+ * @param getPartContent - Function that retrieves part content by URI.
+ * @returns The updated signature status after digest verification.
+ */
+export declare function verifySignatureDigests(signature: ParsedSignature, getPartContent: (uri: string) => Promise<ArrayBuffer | undefined>): Promise<SignatureStatus>;
+//# sourceMappingURL=detection.d.ts.map

package/dist/opc/signature/detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detection.d.ts","sourceRoot":"","sources":["../../../src/opc/signature/detection.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;GAWG;AAEH,qCAAqC;AACrC,MAAM,WAAW,wBAAwB;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,gEAAgE;AAChE,MAAM,WAAW,wBAAwB;IACxC,2CAA2C;IAC3C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3F,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC/B,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,mCAAmC;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,8CAA8C;IAC9C,UAAU,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IAClC,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAGvD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,wBAAwB,CAUzF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE1E;AA2FD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,aAAa,EAAE,MAAM,GACnB,eAAe,CAsEjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,eAAe,EAC1B,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,GAC/D,OAAO,CAAC,eAAe,CAAC,CA6C1B"}

package/dist/opc/signature/digest.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Platform-agnostic digest computation using the Web Crypto API.
+ *
+ * Works in both browser and Node.js (18+) environments via `crypto.subtle`.
+ */
+/**
+ * Compute a Base64-encoded digest of the given content using Web Crypto.
+ *
+ * @param content - The binary data to hash.
+ * @param digestAlgorithmUri - An XML Digital Signature digest algorithm URI
+ *   (e.g. `http://www.w3.org/2001/04/xmlenc#sha256`).
+ * @returns The Base64-encoded digest, or `undefined` if the algorithm is unsupported
+ *   or `crypto.subtle` is unavailable.
+ */
+export declare function computeDigestBase64(content: Uint8Array, digestAlgorithmUri: string): Promise<string | undefined>;
+//# sourceMappingURL=digest.d.ts.map

package/dist/opc/signature/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../../src/opc/signature/digest.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAIH;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,UAAU,EACnB,kBAAkB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc7B"}

package/dist/opc/signature/index.d.ts

@@ -0,0 +1,8 @@
+export { SIGNATURE_PART_PREFIX, detectDigitalSignatures, getSignaturePathsToStrip, isSignaturePart, parseSignatureXml, verifySignatureDigests, type ParsedSignature, type SignatureCertificateInfo, type SignatureDetectionResult, type SignatureReference, type SignatureStatus, } from './detection.js';
+export { DIGEST_ALGORITHM_TO_HASH, DIGEST_ALGORITHM_TO_WEB_CRYPTO, DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, DIGITAL_SIGNATURE_REL_TYPE, ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, ENTERPRISE_REQUIRE_REVOCATION_ENV, ENTERPRISE_REQUIRE_TIMESTAMP_ENV, ENTERPRISE_TRUST_ROOTS_FILE_ENV, ENTERPRISE_TRUST_ROOTS_PEM_ENV, OPC_RELATIONSHIP_TRANSFORM, PPTX_VIEWER_MANIFEST_NS, SUPPORTED_XML_CANON_TRANSFORMS, XMLDSIG_NS, XML_TRANSFORM_ENVELOPED_SIGNATURE, } from './constants.js';
+export type { CertificateRevocationStatus, DigitalSignatureReport, DigitalSignatureVerificationStatus, LoadedSigningMaterial, OfficeSignatureReference, ParsedReferenceTransform, ReferenceTransformResult, SignatureCertificateInfo as SignatureNodeCertificateInfo, SignatureDetail, SignatureDetailStatus, SignatureReferenceCheck, SignatureValidationPolicy, SignOptions, SignResult, TimestampAuthorityStatus, } from './types.js';
+export { escapeXmlAttr, escapeXmlText, extractAllTagText, extractFirstTagText, extractTagAttribute, isValidBase64, } from './xml-utils.js';
+export { normalizePartPath, resolveReferenceUriToPart } from './reference-utils.js';
+export { computeDigestBase64 } from './digest.js';
+export { computeDetailStatus, computeVerificationStatus } from './inspection-status.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/opc/signature/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/opc/signature/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,wBAAwB,EACxB,8BAA8B,EAC9B,iCAAiC,EACjC,0BAA0B,EAC1B,yCAAyC,EACzC,iCAAiC,EACjC,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,UAAU,EACV,iCAAiC,GACjC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACX,2BAA2B,EAC3B,sBAAsB,EACtB,kCAAkC,EAClC,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,IAAI,4BAA4B,EACxD,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,wBAAwB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/opc/signature/inspection-status.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Pure status-computation logic for digital signature inspection.
+ *
+ * These functions are platform-agnostic - they accept data and policy
+ * as parameters instead of reading from the environment.
+ */
+import type { DigitalSignatureReport, SignatureDetail, SignatureDetailStatus, SignatureValidationPolicy } from './types.js';
+/**
+ * Compute the overall status for an individual signature detail
+ * based on its reference checks, trust, revocation, and timestamp statuses.
+ *
+ * @param detail - A partial `SignatureDetail` with the fields needed for status computation.
+ * @param policy - The validation policy controlling revocation/timestamp strictness.
+ * @returns The computed status for this signature detail.
+ */
+export declare function computeDetailStatus(detail: Pick<SignatureDetail, 'signatureValueStatus' | 'missingPartReferences' | 'referenceChecks' | 'certificateTrustStatus' | 'certificateRevocationStatus' | 'timestampAuthorityStatus'>, policy: SignatureValidationPolicy): SignatureDetailStatus;
+/**
+ * Compute the overall verification status from all signature details.
+ *
+ * @param details - Array of signature details from all signatures in the package.
+ * @returns The overall verification status for the report.
+ */
+export declare function computeVerificationStatus(details: SignatureDetail[]): DigitalSignatureReport['verificationStatus'];
+//# sourceMappingURL=inspection-status.d.ts.map

package/dist/opc/signature/inspection-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspection-status.d.ts","sourceRoot":"","sources":["../../../src/opc/signature/inspection-status.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,IAAI,CACX,eAAe,EACb,sBAAsB,GACtB,uBAAuB,GACvB,iBAAiB,GACjB,wBAAwB,GACxB,6BAA6B,GAC7B,0BAA0B,CAC5B,EACD,MAAM,EAAE,yBAAyB,GAC/B,qBAAqB,CAsDvB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,eAAe,EAAE,GACxB,sBAAsB,CAAC,oBAAoB,CAAC,CA2B9C"}

package/dist/opc/signature/reference-utils.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Pure string utilities for resolving digital signature reference URIs
+ * to ZIP part paths. Platform-agnostic (no Node dependencies).
+ */
+/** Normalize a ZIP part path: convert backslashes to forward slashes and strip leading slashes. */
+export declare function normalizePartPath(partPath: string): string;
+/**
+ * Resolve a signature reference URI to a ZIP part path.
+ * Returns `undefined` for empty URIs, fragment-only URIs (#...), or invalid input.
+ */
+export declare function resolveReferenceUriToPart(uri: string): string | undefined;
+//# sourceMappingURL=reference-utils.d.ts.map

package/dist/opc/signature/reference-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-utils.d.ts","sourceRoot":"","sources":["../../../src/opc/signature/reference-utils.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOzE"}

package/dist/opc/signature/types.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Rich types for digital signature inspection, signing, and PKI validation.
+ *
+ * These are platform-agnostic - used by both browser-level detection
+ * and Node-only full verification modules.
+ */
+export type CertificateRevocationStatus = 'good' | 'revoked' | 'unknown' | 'not-checked' | 'error';
+export type TimestampAuthorityStatus = 'valid' | 'invalid' | 'not-present' | 'not-checked' | 'error' | 'untrusted';
+export interface SignatureReferenceCheck {
+    uri: string;
+    resolvedPartPath?: string;
+    existsInPackage: boolean;
+    digestAlgorithm?: string;
+    digestExpectedBase64?: string;
+    digestActualBase64?: string;
+    digestStatus: 'verified' | 'mismatch' | 'missing-part' | 'unsupported-transform' | 'unsupported-algorithm' | 'insufficient-data';
+    transformAlgorithms: string[];
+}
+export interface SignatureCertificateInfo {
+    subject?: string;
+    issuer?: string;
+    serialNumber?: string;
+    validFrom?: string;
+    validTo?: string;
+}
+export type SignatureDetailStatus = 'verified' | 'digest-mismatch' | 'reference-missing' | 'signature-invalid' | 'certificate-untrusted' | 'certificate-revoked' | 'timestamp-invalid' | 'timestamp-untrusted' | 'structural-only';
+export interface SignatureDetail {
+    path: string;
+    signatureMethod?: string;
+    canonicalizationMethod?: string;
+    signingTime?: string;
+    referenceCount: number;
+    missingPartReferences: string[];
+    unsupportedTransforms: string[];
+    referenceChecks: SignatureReferenceCheck[];
+    certificate?: SignatureCertificateInfo;
+    signatureValueStatus: 'verified' | 'invalid' | 'not-checked';
+    certificateTrustStatus: 'trusted' | 'untrusted' | 'not-checked';
+    certificateTrustError?: string;
+    certificateRevocationStatus: CertificateRevocationStatus;
+    certificateRevocationError?: string;
+    timestampAuthorityStatus: TimestampAuthorityStatus;
+    timestampAuthorityError?: string;
+    certificateFingerprintSha256?: string;
+    status: SignatureDetailStatus;
+}
+export type DigitalSignatureVerificationStatus = 'unsigned' | 'verified-trusted' | 'verified-untrusted' | 'certificate-revoked' | 'digest-mismatch' | 'reference-missing' | 'signature-invalid' | 'timestamp-invalid' | 'timestamp-untrusted' | 'present-not-verified' | 'invalid-package' | 'error';
+export interface DigitalSignatureReport {
+    supported: boolean;
+    hasSignature: boolean;
+    signatureCount: number;
+    signaturePaths: string[];
+    verificationStatus: DigitalSignatureVerificationStatus;
+    error?: string;
+    details?: SignatureDetail[];
+    hasOriginRelationship?: boolean;
+}
+export interface SignOptions {
+    certificatePath: string;
+    certificatePassword?: string;
+}
+export interface SignResult {
+    success: boolean;
+    signedData?: Uint8Array;
+    report: DigitalSignatureReport;
+    error?: string;
+}
+export interface LoadedSigningMaterial {
+    privateKeyPem: string;
+    certificatePem: string;
+}
+export interface ParsedReferenceTransform {
+    algorithm: string;
+    relationshipReferenceIds: string[];
+}
+export interface ReferenceTransformResult {
+    data: Uint8Array;
+    unsupportedAlgorithms: string[];
+}
+export interface SignatureValidationPolicy {
+    requireRevocationCheck: boolean;
+    failOnRevocationUnknown: boolean;
+    requireTimestamp: boolean;
+}
+export interface OfficeSignatureReference {
+    uri: string;
+    digestMethod: string;
+    digestValue: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/opc/signature/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/opc/signature/types.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAIH,MAAM,MAAM,2BAA2B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,OAAO,CAAC;AAEnG,MAAM,MAAM,wBAAwB,GACjC,OAAO,GACP,SAAS,GACT,aAAa,GACb,aAAa,GACb,OAAO,GACP,WAAW,CAAC;AAIf,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EACT,UAAU,GACV,UAAU,GACV,cAAc,GACd,uBAAuB,GACvB,uBAAuB,GACvB,mBAAmB,CAAC;IACvB,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAID,MAAM,WAAW,wBAAwB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,MAAM,qBAAqB,GAC9B,UAAU,GACV,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,uBAAuB,GACvB,qBAAqB,GACrB,mBAAmB,GACnB,qBAAqB,GACrB,iBAAiB,CAAC;AAErB,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,eAAe,EAAE,uBAAuB,EAAE,CAAC;IAC3C,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,oBAAoB,EAAE,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;IAC7D,sBAAsB,EAAE,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;IAChE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2BAA2B,EAAE,2BAA2B,CAAC;IACzD,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,wBAAwB,EAAE,wBAAwB,CAAC;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,MAAM,EAAE,qBAAqB,CAAC;CAC9B;AAID,MAAM,MAAM,kCAAkC,GAC3C,UAAU,GACV,kBAAkB,GAClB,oBAAoB,GACpB,qBAAqB,GACrB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GACtB,iBAAiB,GACjB,OAAO,CAAC;AAEX,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,EAAE,kCAAkC,CAAC;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAID,MAAM,WAAW,WAAW;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,WAAW,wBAAwB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,UAAU,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAChC;AAID,MAAM,WAAW,yBAAyB;IACzC,sBAAsB,EAAE,OAAO,CAAC;IAChC,uBAAuB,EAAE,OAAO,CAAC;IACjC,gBAAgB,EAAE,OAAO,CAAC;CAC1B;AAID,MAAM,WAAW,wBAAwB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACpB"}

package/dist/opc/signature/xml-utils.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Pure regex-based XML extraction utilities for digital signature processing.
+ *
+ * These functions operate on raw XML strings without requiring a DOM parser,
+ * making them platform-agnostic (browser + Node).
+ */
+/**
+ * Escape special characters in an XML attribute value.
+ * Handles `&`, `<`, `>`, `"`, and `'` so the result is safe inside both
+ * double- and single-quoted attributes.
+ */
+export declare function escapeXmlAttr(value: string): string;
+/**
+ * Escape special characters in XML text content.
+ * Only `&`, `<`, and `>` need escaping outside of attribute values.
+ */
+export declare function escapeXmlText(value: string): string;
+/** Validate that `value` only contains characters from the standard base64 alphabet. */
+export declare function isValidBase64(value: string): boolean;
+/**
+ * Extract an attribute value from the first matching XML tag via regex.
+ * Namespace prefixes on the tag name are supported via the pattern.
+ */
+export declare function extractTagAttribute(xml: string, tagName: string, attributeName: string): string | undefined;
+/**
+ * Extract the text content of the first matching tag, ignoring namespace prefixes.
+ * Whitespace within the content is collapsed.
+ */
+export declare function extractFirstTagText(xml: string, localName: string): string | undefined;
+/**
+ * Extract the text content of all matching tags, ignoring namespace prefixes.
+ * Whitespace within each match is collapsed.
+ */
+export declare function extractAllTagText(xml: string, localName: string): string[];
+//# sourceMappingURL=xml-utils.d.ts.map

package/dist/opc/signature/xml-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xml-utils.d.ts","sourceRoot":"","sources":["../../../src/opc/signature/xml-utils.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAOpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOtF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAe1E"}