pptx-viewer-core 1.2.5 → 1.2.7

package/dist/signature-node/index.js

@@ -2,10 +2,10 @@
 
 var xmldom = require('@xmldom/xmldom');
 var xmlCrypto = require('xml-crypto');
-var crypto = require('crypto');
+var crypto2 = require('crypto');
 var path = require('path');
 var tls = require('tls');
-var forge = require('node-forge');
+var forge3 = require('node-forge');
 var http = require('http');
 var https = require('https');
 var fs = require('fs/promises');
@@ -13,10 +13,10 @@ var JSZip = require('jszip');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-var crypto__default = /*#__PURE__*/_interopDefault(crypto);
+var crypto2__default = /*#__PURE__*/_interopDefault(crypto2);
 var path__default = /*#__PURE__*/_interopDefault(path);
 var tls__default = /*#__PURE__*/_interopDefault(tls);
-var forge__default = /*#__PURE__*/_interopDefault(forge);
+var forge3__default = /*#__PURE__*/_interopDefault(forge3);
 var http__default = /*#__PURE__*/_interopDefault(http);
 var https__default = /*#__PURE__*/_interopDefault(https);
 var fs__default = /*#__PURE__*/_interopDefault(fs);
@@ -219,6 +219,89 @@ function canonicalizeSignedInfoXml(signedInfoXml) {
   }
   return canonicalizeNode(signedInfoDoc.documentElement, "http://www.w3.org/2001/10/xml-exc-c14n#");
 }
+
+// src/signature-node/pem-utils.ts
+function firstPemBlockForLabel(text, label) {
+  const begin = `-----BEGIN ${label}-----`;
+  const end = `-----END ${label}-----`;
+  const beginIndex = text.indexOf(begin);
+  if (beginIndex === -1) {
+    return void 0;
+  }
+  const endIndex = text.indexOf(end, beginIndex + begin.length);
+  if (endIndex === -1) {
+    return void 0;
+  }
+  return { index: beginIndex, block: text.slice(beginIndex, endIndex + end.length) };
+}
+function extractPemBlocks(text, label) {
+  const begin = `-----BEGIN ${label}-----`;
+  const end = `-----END ${label}-----`;
+  const blocks = [];
+  let searchFrom = 0;
+  for (; ; ) {
+    const beginIndex = text.indexOf(begin, searchFrom);
+    if (beginIndex === -1) {
+      break;
+    }
+    const contentStart = beginIndex + begin.length;
+    const endIndex = text.indexOf(end, contentStart);
+    if (endIndex === -1) {
+      break;
+    }
+    blocks.push(text.slice(beginIndex, endIndex + end.length));
+    searchFrom = endIndex + end.length;
+  }
+  return blocks;
+}
+function extractFirstPemBlock(text, labels) {
+  let best;
+  for (const label of labels) {
+    const found = firstPemBlockForLabel(text, label);
+    if (found && (!best || found.index < best.index)) {
+      best = found;
+    }
+  }
+  return best?.block;
+}
+
+// src/signature-node/timestamp-tag-scanner.ts
+var MAX_TAG_WINDOW = 256;
+var OPEN_TAG_PATTERN = /^<(?:[\w.-]+:)?(?:EncapsulatedTimeStamp|SignatureTimeStamp)\b[^>]*>/i;
+var CLOSE_TAG_PATTERN = /^<\/(?:[\w.-]+:)?(?:EncapsulatedTimeStamp|SignatureTimeStamp)>/i;
+function findCloseTagIndex(xml, fromIndex) {
+  let searchFrom = fromIndex;
+  for (; ; ) {
+    const ltIndex = xml.indexOf("<", searchFrom);
+    if (ltIndex === -1) {
+      return void 0;
+    }
+    const window = xml.slice(ltIndex, ltIndex + MAX_TAG_WINDOW);
+    if (CLOSE_TAG_PATTERN.test(window)) {
+      return ltIndex;
+    }
+    searchFrom = ltIndex + 1;
+  }
+}
+function findTimestampTagContent(xml) {
+  let searchFrom = 0;
+  for (; ; ) {
+    const ltIndex = xml.indexOf("<", searchFrom);
+    if (ltIndex === -1) {
+      return void 0;
+    }
+    const window = xml.slice(ltIndex, ltIndex + MAX_TAG_WINDOW);
+    const openMatch = OPEN_TAG_PATTERN.exec(window);
+    if (openMatch) {
+      const contentStart = ltIndex + openMatch[0].length;
+      const closeIndex = findCloseTagIndex(xml, contentStart);
+      return closeIndex === void 0 ? void 0 : xml.slice(contentStart, closeIndex);
+    }
+    searchFrom = ltIndex + 1;
+  }
+}
+
+// src/signature-node/pki-validation.ts
 function certPemFromBase64(certBase64) {
   try {
     const der = Buffer.from(certBase64, "base64");
@@ -239,7 +322,7 @@ ${lines.join("\n")}
 }
 function certFingerprintSha256(certPem) {
   try {
-    const cert = new crypto__default.default.X509Certificate(certPem);
+    const cert = new crypto2__default.default.X509Certificate(certPem);
     return cert.fingerprint256.replace(/:/g, "").toLowerCase();
   } catch {
     return void 0;
@@ -248,12 +331,173 @@ function certFingerprintSha256(certPem) {
 function asn1Child(node, index) {
   return Array.isArray(node.value) ? node.value[index] : void 0;
 }
+async function evaluateTimestampAuthority(signatureXml) {
+  try {
+    const content = findTimestampTagContent(signatureXml);
+    if (!content?.trim()) {
+      return { status: "not-present" };
+    }
+    const tokenBase64 = content.replace(/\s+/g, "");
+    const tokenDer = Buffer.from(tokenBase64, "base64");
+    if (tokenDer.length === 0) {
+      return { status: "invalid", error: "Empty timestamp token." };
+    }
+    const asn1 = forge3__default.default.asn1.fromDer(forge3__default.default.util.createBuffer(tokenDer.toString("binary")));
+    const contentType = asn1Child(asn1, 0);
+    if (!contentType) {
+      return {
+        status: "invalid",
+        error: "Malformed timestamp token structure."
+      };
+    }
+    return { status: "valid" };
+  } catch (err) {
+    return {
+      status: "error",
+      error: `Timestamp evaluation failed: ${String(err)}`
+    };
+  }
+}
+
+// src/signature-node/certificate-utils.ts
+var PRIVATE_KEY_PEM_LABELS = [
+  "RSA PRIVATE KEY",
+  "EC PRIVATE KEY",
+  "ENCRYPTED PRIVATE KEY",
+  "PRIVATE KEY"
+];
+function certificateInfoFromBase64(certBase64) {
+  try {
+    const certificate = new crypto2__default.default.X509Certificate(Buffer.from(certBase64, "base64"));
+    return {
+      subject: certificate.subject || void 0,
+      issuer: certificate.issuer || void 0,
+      serialNumber: certificate.serialNumber || void 0,
+      validFrom: certificate.validFrom || void 0,
+      validTo: certificate.validTo || void 0
+    };
+  } catch {
+    return void 0;
+  }
+}
+function validateCertificateChain(certBase64List, additionalRootsPem) {
+  if (certBase64List.length === 0) {
+    return { status: "not-checked" };
+  }
+  try {
+    const chain = certBase64List.map((value) => {
+      const der = forge3__default.default.util.decode64(value);
+      return forge3__default.default.pki.certificateFromAsn1(forge3__default.default.asn1.fromDer(der));
+    });
+    const rootPem = [...tls__default.default.rootCertificates, ...additionalRootsPem];
+    const caStore = forge3__default.default.pki.createCaStore(rootPem);
+    const verified = forge3__default.default.pki.verifyCertificateChain(caStore, chain);
+    return verified ? { status: "trusted" } : {
+      status: "untrusted",
+      error: "Certificate chain is not trusted."
+    };
+  } catch (error) {
+    return {
+      status: "untrusted",
+      error: `Certificate trust validation failed: ${String(error)}`
+    };
+  }
+}
+function signatureAlgorithmToVerifyAlgorithm(signatureMethod) {
+  switch (signatureMethod) {
+    case "http://www.w3.org/2000/09/xmldsig#rsa-sha1":
+      return "RSA-SHA1";
+    case "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256":
+      return "RSA-SHA256";
+    case "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384":
+      return "RSA-SHA384";
+    case "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512":
+      return "RSA-SHA512";
+    default:
+      return void 0;
+  }
+}
+function verifySignatureValue(signatureXml, certBase64List) {
+  try {
+    const parser = new xmldom.DOMParser();
+    const doc = parser.parseFromString(signatureXml, "text/xml");
+    const signatureNode = doc.getElementsByTagNameNS(XMLDSIG_NS, "Signature")[0];
+    if (!signatureNode) {
+      return "not-checked";
+    }
+    const certPem = certBase64List.length > 0 ? certPemFromBase64(certBase64List[0]) : void 0;
+    if (!certPem) {
+      return "not-checked";
+    }
+    const signedInfoNode = doc.getElementsByTagNameNS(XMLDSIG_NS, "SignedInfo")[0];
+    const signatureValueNode = doc.getElementsByTagNameNS(XMLDSIG_NS, "SignatureValue")[0];
+    if (!signedInfoNode || !signatureValueNode) {
+      return "invalid";
+    }
+    const canonicalizationMethod = doc.getElementsByTagNameNS(XMLDSIG_NS, "CanonicalizationMethod").item(0)?.getAttribute("Algorithm") ?? "http://www.w3.org/2001/10/xml-exc-c14n#";
+    const signatureMethod = doc.getElementsByTagNameNS(XMLDSIG_NS, "SignatureMethod").item(0)?.getAttribute("Algorithm");
+    const verifyAlgorithm = signatureAlgorithmToVerifyAlgorithm(signatureMethod ?? void 0);
+    if (!verifyAlgorithm) {
+      return "invalid";
+    }
+    const canonicalSignedInfo = canonicalizeNode(signedInfoNode, canonicalizationMethod);
+    const signatureValueBase64 = signatureValueNode.textContent?.replace(/\s+/g, "").trim() ?? "";
+    if (signatureValueBase64.length === 0) {
+      return "invalid";
+    }
+    const verifier = crypto2__default.default.createVerify(verifyAlgorithm);
+    verifier.update(Buffer.from(canonicalSignedInfo, "utf8"));
+    verifier.end();
+    const isValid = verifier.verify(certPem, Buffer.from(signatureValueBase64, "base64"));
+    return isValid ? "verified" : "invalid";
+  } catch {
+    return "invalid";
+  }
+}
+function loadSigningMaterialFromBuffer(certificateBuffer, certificatePath, certificatePassword) {
+  const extension = path__default.default.extname(certificatePath).toLowerCase();
+  if (extension === ".pfx" || extension === ".p12") {
+    const p12Der = forge3__default.default.util.createBuffer(Buffer.from(certificateBuffer).toString("binary"));
+    const p12Asn1 = forge3__default.default.asn1.fromDer(p12Der);
+    const p12 = forge3__default.default.pkcs12.pkcs12FromAsn1(p12Asn1, certificatePassword || "");
+    const keyBag = p12.getBags({
+      bagType: forge3__default.default.pki.oids.pkcs8ShroudedKeyBag
+    })[forge3__default.default.pki.oids.pkcs8ShroudedKeyBag];
+    const certBag = p12.getBags({ bagType: forge3__default.default.pki.oids.certBag })[forge3__default.default.pki.oids.certBag];
+    if (!keyBag || keyBag.length === 0 || !keyBag[0]?.key) {
+      throw new Error("No private key found in PKCS#12 certificate.");
+    }
+    if (!certBag || certBag.length === 0 || !certBag[0]?.cert) {
+      throw new Error("No certificate found in PKCS#12 certificate.");
+    }
+    return {
+      privateKeyPem: forge3__default.default.pki.privateKeyToPem(keyBag[0].key),
+      certificatePem: forge3__default.default.pki.certificateToPem(certBag[0].cert)
+    };
+  }
+  const pem = Buffer.from(certificateBuffer).toString("utf8");
+  const privateKeyPem = extractFirstPemBlock(pem, PRIVATE_KEY_PEM_LABELS);
+  const certificatePem = extractFirstPemBlock(pem, ["CERTIFICATE"]);
+  if (!privateKeyPem || !certificatePem) {
+    throw new Error("PEM certificate must contain both private key and certificate.");
+  }
+  return {
+    privateKeyPem,
+    certificatePem
+  };
+}
+function pemCertificateToBase64(pem) {
+  return pem.replace(/-----BEGIN CERTIFICATE-----/g, "").replace(/-----END CERTIFICATE-----/g, "").replace(/\s+/g, "").trim();
+}
+function asn1Child2(node, index) {
+  return Array.isArray(node.value) ? node.value[index] : void 0;
+}
 function asn1Bytes(node) {
   return typeof node.value === "string" ? node.value : "";
 }
 function extractOcspUrls(certPem) {
   try {
-    const cert = new crypto__default.default.X509Certificate(certPem);
+    const cert = new crypto2__default.default.X509Certificate(certPem);
     const infoAccess = cert.infoAccess;
     if (!infoAccess) {
       return [];
@@ -316,45 +560,45 @@ function httpPost(url, body, contentType) {
 var SHA1_OID = "1.3.14.3.2.26";
 function buildOcspRequestDer(leafPem, issuerPem) {
   try {
-    const leaf = forge__default.default.pki.certificateFromPem(leafPem);
-    const issuer = forge__default.default.pki.certificateFromPem(issuerPem);
-    const issuerNameDer = forge__default.default.asn1.toDer(forge__default.default.pki.distinguishedNameToAsn1(issuer.subject)).getBytes();
-    const issuerNameHash = forge__default.default.md.sha1.create().update(issuerNameDer).digest().getBytes();
-    const pubKeyDer = forge__default.default.asn1.toDer(forge__default.default.pki.publicKeyToAsn1(issuer.publicKey)).getBytes();
-    const pubKeyAsn1 = forge__default.default.asn1.fromDer(pubKeyDer);
-    const bitString = asn1Child(pubKeyAsn1, 1);
+    const leaf = forge3__default.default.pki.certificateFromPem(leafPem);
+    const issuer = forge3__default.default.pki.certificateFromPem(issuerPem);
+    const issuerNameDer = forge3__default.default.asn1.toDer(forge3__default.default.pki.distinguishedNameToAsn1(issuer.subject)).getBytes();
+    const issuerNameHash = forge3__default.default.md.sha1.create().update(issuerNameDer).digest().getBytes();
+    const pubKeyDer = forge3__default.default.asn1.toDer(forge3__default.default.pki.publicKeyToAsn1(issuer.publicKey)).getBytes();
+    const pubKeyAsn1 = forge3__default.default.asn1.fromDer(pubKeyDer);
+    const bitString = asn1Child2(pubKeyAsn1, 1);
     const rawKey = bitString ? asn1Bytes(bitString).substring(1) : "";
-    const issuerKeyHash = forge__default.default.md.sha1.create().update(rawKey).digest().getBytes();
-    const serialBytes = forge__default.default.util.hexToBytes(leaf.serialNumber);
-    const request = forge__default.default.asn1.create(forge__default.default.asn1.Class.UNIVERSAL, forge__default.default.asn1.Type.SEQUENCE, true, [
-      forge__default.default.asn1.create(forge__default.default.asn1.Class.UNIVERSAL, forge__default.default.asn1.Type.SEQUENCE, true, [
-        forge__default.default.asn1.create(forge__default.default.asn1.Class.UNIVERSAL, forge__default.default.asn1.Type.SEQUENCE, true, [
-          forge__default.default.asn1.create(forge__default.default.asn1.Class.UNIVERSAL, forge__default.default.asn1.Type.SEQUENCE, true, [
-            forge__default.default.asn1.create(forge__default.default.asn1.Class.UNIVERSAL, forge__default.default.asn1.Type.SEQUENCE, true, [
-              forge__default.default.asn1.create(forge__default.default.asn1.Class.UNIVERSAL, forge__default.default.asn1.Type.SEQUENCE, true, [
-                forge__default.default.asn1.create(
-                  forge__default.default.asn1.Class.UNIVERSAL,
-                  forge__default.default.asn1.Type.OID,
+    const issuerKeyHash = forge3__default.default.md.sha1.create().update(rawKey).digest().getBytes();
+    const serialBytes = forge3__default.default.util.hexToBytes(leaf.serialNumber);
+    const request = forge3__default.default.asn1.create(forge3__default.default.asn1.Class.UNIVERSAL, forge3__default.default.asn1.Type.SEQUENCE, true, [
+      forge3__default.default.asn1.create(forge3__default.default.asn1.Class.UNIVERSAL, forge3__default.default.asn1.Type.SEQUENCE, true, [
+        forge3__default.default.asn1.create(forge3__default.default.asn1.Class.UNIVERSAL, forge3__default.default.asn1.Type.SEQUENCE, true, [
+          forge3__default.default.asn1.create(forge3__default.default.asn1.Class.UNIVERSAL, forge3__default.default.asn1.Type.SEQUENCE, true, [
+            forge3__default.default.asn1.create(forge3__default.default.asn1.Class.UNIVERSAL, forge3__default.default.asn1.Type.SEQUENCE, true, [
+              forge3__default.default.asn1.create(forge3__default.default.asn1.Class.UNIVERSAL, forge3__default.default.asn1.Type.SEQUENCE, true, [
+                forge3__default.default.asn1.create(
+                  forge3__default.default.asn1.Class.UNIVERSAL,
+                  forge3__default.default.asn1.Type.OID,
                   false,
-                  forge__default.default.asn1.oidToDer(SHA1_OID).getBytes()
+                  forge3__default.default.asn1.oidToDer(SHA1_OID).getBytes()
                 ),
-                forge__default.default.asn1.create(forge__default.default.asn1.Class.UNIVERSAL, forge__default.default.asn1.Type.NULL, false, "")
+                forge3__default.default.asn1.create(forge3__default.default.asn1.Class.UNIVERSAL, forge3__default.default.asn1.Type.NULL, false, "")
               ]),
-              forge__default.default.asn1.create(
-                forge__default.default.asn1.Class.UNIVERSAL,
-                forge__default.default.asn1.Type.OCTETSTRING,
+              forge3__default.default.asn1.create(
+                forge3__default.default.asn1.Class.UNIVERSAL,
+                forge3__default.default.asn1.Type.OCTETSTRING,
                 false,
                 issuerNameHash
               ),
-              forge__default.default.asn1.create(
-                forge__default.default.asn1.Class.UNIVERSAL,
-                forge__default.default.asn1.Type.OCTETSTRING,
+              forge3__default.default.asn1.create(
+                forge3__default.default.asn1.Class.UNIVERSAL,
+                forge3__default.default.asn1.Type.OCTETSTRING,
                 false,
                 issuerKeyHash
               ),
-              forge__default.default.asn1.create(
-                forge__default.default.asn1.Class.UNIVERSAL,
-                forge__default.default.asn1.Type.INTEGER,
+              forge3__default.default.asn1.create(
+                forge3__default.default.asn1.Class.UNIVERSAL,
+                forge3__default.default.asn1.Type.INTEGER,
                 false,
                 serialBytes
               )
@@ -363,50 +607,50 @@ function buildOcspRequestDer(leafPem, issuerPem) {
         ])
       ])
     ]);
-    return Buffer.from(forge__default.default.asn1.toDer(request).getBytes(), "binary");
+    return Buffer.from(forge3__default.default.asn1.toDer(request).getBytes(), "binary");
   } catch {
     return void 0;
   }
 }
 function parseOcspResponseStatus(data) {
   try {
-    const asn1 = forge__default.default.asn1.fromDer(forge__default.default.util.createBuffer(data.toString("binary")));
-    const statusNode = asn1Child(asn1, 0);
+    const asn1 = forge3__default.default.asn1.fromDer(forge3__default.default.util.createBuffer(data.toString("binary")));
+    const statusNode = asn1Child2(asn1, 0);
     if (!statusNode || asn1Bytes(statusNode) !== "\0") {
       return "error";
     }
-    const respBytesWrapper = asn1Child(asn1, 1);
+    const respBytesWrapper = asn1Child2(asn1, 1);
     if (!respBytesWrapper) {
       return "unknown";
     }
-    const respBytesSeq = asn1Child(respBytesWrapper, 0);
+    const respBytesSeq = asn1Child2(respBytesWrapper, 0);
     if (!respBytesSeq) {
       return "unknown";
     }
-    const respOctet = asn1Child(respBytesSeq, 1);
+    const respOctet = asn1Child2(respBytesSeq, 1);
     if (!respOctet) {
       return "unknown";
     }
-    const basicResp = forge__default.default.asn1.fromDer(forge__default.default.util.createBuffer(asn1Bytes(respOctet)));
-    const tbsData = asn1Child(basicResp, 0);
+    const basicResp = forge3__default.default.asn1.fromDer(forge3__default.default.util.createBuffer(asn1Bytes(respOctet)));
+    const tbsData = asn1Child2(basicResp, 0);
     if (!tbsData) {
       return "unknown";
     }
-    const first = asn1Child(tbsData, 0);
-    const responsesIdx = first?.tagClass === forge__default.default.asn1.Class.CONTEXT_SPECIFIC && first.type === 0 ? 3 : 2;
-    const responses = asn1Child(tbsData, responsesIdx);
+    const first = asn1Child2(tbsData, 0);
+    const responsesIdx = first?.tagClass === forge3__default.default.asn1.Class.CONTEXT_SPECIFIC && first.type === 0 ? 3 : 2;
+    const responses = asn1Child2(tbsData, responsesIdx);
     if (!responses) {
       return "unknown";
     }
-    const single = asn1Child(responses, 0);
+    const single = asn1Child2(responses, 0);
     if (!single) {
       return "unknown";
     }
-    const certStatus = asn1Child(single, 1);
+    const certStatus = asn1Child2(single, 1);
     if (!certStatus) {
       return "unknown";
     }
-    if (certStatus.tagClass === forge__default.default.asn1.Class.CONTEXT_SPECIFIC) {
+    if (certStatus.tagClass === forge3__default.default.asn1.Class.CONTEXT_SPECIFIC) {
       if (certStatus.type === 0) {
         return "good";
       }
@@ -449,164 +693,8 @@ async function evaluateCertificateRevocation(leafCertPem, issuerCertPem) {
     checkedCrlUrls
   };
 }
-var TIMESTAMP_TAG_REGEX = /<(?:[\w.-]+:)?(?:EncapsulatedTimeStamp|SignatureTimeStamp)[^>]*>([\s\S]*?)<\/(?:[\w.-]+:)?(?:EncapsulatedTimeStamp|SignatureTimeStamp)>/i;
-async function evaluateTimestampAuthority(signatureXml) {
-  try {
-    const match = TIMESTAMP_TAG_REGEX.exec(signatureXml);
-    if (!match?.[1]?.trim()) {
-      return { status: "not-present" };
-    }
-    const tokenBase64 = match[1].replace(/\s+/g, "");
-    const tokenDer = Buffer.from(tokenBase64, "base64");
-    if (tokenDer.length === 0) {
-      return { status: "invalid", error: "Empty timestamp token." };
-    }
-    const asn1 = forge__default.default.asn1.fromDer(forge__default.default.util.createBuffer(tokenDer.toString("binary")));
-    const contentType = asn1Child(asn1, 0);
-    if (!contentType) {
-      return {
-        status: "invalid",
-        error: "Malformed timestamp token structure."
-      };
-    }
-    return { status: "valid" };
-  } catch (err) {
-    return {
-      status: "error",
-      error: `Timestamp evaluation failed: ${String(err)}`
-    };
-  }
-}
-
-// src/signature-node/certificate-utils.ts
-function certificateInfoFromBase64(certBase64) {
-  try {
-    const certificate = new crypto__default.default.X509Certificate(Buffer.from(certBase64, "base64"));
-    return {
-      subject: certificate.subject || void 0,
-      issuer: certificate.issuer || void 0,
-      serialNumber: certificate.serialNumber || void 0,
-      validFrom: certificate.validFrom || void 0,
-      validTo: certificate.validTo || void 0
-    };
-  } catch {
-    return void 0;
-  }
-}
-function validateCertificateChain(certBase64List, additionalRootsPem) {
-  if (certBase64List.length === 0) {
-    return { status: "not-checked" };
-  }
-  try {
-    const chain = certBase64List.map((value) => {
-      const der = forge__default.default.util.decode64(value);
-      return forge__default.default.pki.certificateFromAsn1(forge__default.default.asn1.fromDer(der));
-    });
-    const rootPem = [...tls__default.default.rootCertificates, ...additionalRootsPem];
-    const caStore = forge__default.default.pki.createCaStore(rootPem);
-    const verified = forge__default.default.pki.verifyCertificateChain(caStore, chain);
-    return verified ? { status: "trusted" } : {
-      status: "untrusted",
-      error: "Certificate chain is not trusted."
-    };
-  } catch (error) {
-    return {
-      status: "untrusted",
-      error: `Certificate trust validation failed: ${String(error)}`
-    };
-  }
-}
-function signatureAlgorithmToVerifyAlgorithm(signatureMethod) {
-  switch (signatureMethod) {
-    case "http://www.w3.org/2000/09/xmldsig#rsa-sha1":
-      return "RSA-SHA1";
-    case "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256":
-      return "RSA-SHA256";
-    case "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384":
-      return "RSA-SHA384";
-    case "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512":
-      return "RSA-SHA512";
-    default:
-      return void 0;
-  }
-}
-function verifySignatureValue(signatureXml, certBase64List) {
-  try {
-    const parser = new xmldom.DOMParser();
-    const doc = parser.parseFromString(signatureXml, "text/xml");
-    const signatureNode = doc.getElementsByTagNameNS(XMLDSIG_NS, "Signature")[0];
-    if (!signatureNode) {
-      return "not-checked";
-    }
-    const certPem = certBase64List.length > 0 ? certPemFromBase64(certBase64List[0]) : void 0;
-    if (!certPem) {
-      return "not-checked";
-    }
-    const signedInfoNode = doc.getElementsByTagNameNS(XMLDSIG_NS, "SignedInfo")[0];
-    const signatureValueNode = doc.getElementsByTagNameNS(XMLDSIG_NS, "SignatureValue")[0];
-    if (!signedInfoNode || !signatureValueNode) {
-      return "invalid";
-    }
-    const canonicalizationMethod = doc.getElementsByTagNameNS(XMLDSIG_NS, "CanonicalizationMethod").item(0)?.getAttribute("Algorithm") ?? "http://www.w3.org/2001/10/xml-exc-c14n#";
-    const signatureMethod = doc.getElementsByTagNameNS(XMLDSIG_NS, "SignatureMethod").item(0)?.getAttribute("Algorithm");
-    const verifyAlgorithm = signatureAlgorithmToVerifyAlgorithm(signatureMethod ?? void 0);
-    if (!verifyAlgorithm) {
-      return "invalid";
-    }
-    const canonicalSignedInfo = canonicalizeNode(signedInfoNode, canonicalizationMethod);
-    const signatureValueBase64 = signatureValueNode.textContent?.replace(/\s+/g, "").trim() ?? "";
-    if (signatureValueBase64.length === 0) {
-      return "invalid";
-    }
-    const verifier = crypto__default.default.createVerify(verifyAlgorithm);
-    verifier.update(Buffer.from(canonicalSignedInfo, "utf8"));
-    verifier.end();
-    const isValid = verifier.verify(certPem, Buffer.from(signatureValueBase64, "base64"));
-    return isValid ? "verified" : "invalid";
-  } catch {
-    return "invalid";
-  }
-}
-function loadSigningMaterialFromBuffer(certificateBuffer, certificatePath, certificatePassword) {
-  const extension = path__default.default.extname(certificatePath).toLowerCase();
-  if (extension === ".pfx" || extension === ".p12") {
-    const p12Der = forge__default.default.util.createBuffer(Buffer.from(certificateBuffer).toString("binary"));
-    const p12Asn1 = forge__default.default.asn1.fromDer(p12Der);
-    const p12 = forge__default.default.pkcs12.pkcs12FromAsn1(p12Asn1, certificatePassword || "");
-    const keyBag = p12.getBags({
-      bagType: forge__default.default.pki.oids.pkcs8ShroudedKeyBag
-    })[forge__default.default.pki.oids.pkcs8ShroudedKeyBag];
-    const certBag = p12.getBags({ bagType: forge__default.default.pki.oids.certBag })[forge__default.default.pki.oids.certBag];
-    if (!keyBag || keyBag.length === 0 || !keyBag[0]?.key) {
-      throw new Error("No private key found in PKCS#12 certificate.");
-    }
-    if (!certBag || certBag.length === 0 || !certBag[0]?.cert) {
-      throw new Error("No certificate found in PKCS#12 certificate.");
-    }
-    return {
-      privateKeyPem: forge__default.default.pki.privateKeyToPem(keyBag[0].key),
-      certificatePem: forge__default.default.pki.certificateToPem(certBag[0].cert)
-    };
-  }
-  const pem = Buffer.from(certificateBuffer).toString("utf8");
-  const privateKeyMatch = pem.match(
-    /-----BEGIN (?:RSA |EC |ENCRYPTED )?PRIVATE KEY-----[\s\S]+?-----END (?:RSA |EC |ENCRYPTED )?PRIVATE KEY-----/m
-  );
-  const certMatch = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/m);
-  if (!privateKeyMatch || !certMatch) {
-    throw new Error("PEM certificate must contain both private key and certificate.");
-  }
-  return {
-    privateKeyPem: privateKeyMatch[0],
-    certificatePem: certMatch[0]
-  };
-}
-function pemCertificateToBase64(pem) {
-  return pem.replace(/-----BEGIN CERTIFICATE-----/g, "").replace(/-----END CERTIFICATE-----/g, "").replace(/\s+/g, "").trim();
-}
 function extractPemCertificatesFromText(text) {
-  const matches = text.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) ?? [];
-  return matches.map((value) => value.trim()).filter((value) => value.length > 0);
+  return extractPemBlocks(text, "CERTIFICATE").map((value) => value.trim()).filter((value) => value.length > 0);
 }
 function parseBooleanEnv(envValue) {
   if (!envValue) {
@@ -747,7 +835,7 @@ function computeDigestBase642(content, digestAlgorithmUri) {
   if (!hashName) {
     return void 0;
   }
-  return crypto__default.default.createHash(hashName).update(Buffer.from(content)).digest("base64");
+  return crypto2__default.default.createHash(hashName).update(Buffer.from(content)).digest("base64");
 }
 async function buildReferenceChecksFromSignatureXml(zip, signatureXml) {
   const parser = new xmldom.DOMParser();
@@ -1080,7 +1168,7 @@ async function buildOfficeReferenceList(zip) {
       continue;
     }
     const entryBytes = await entry.async("uint8array");
-    const digestValue = crypto__default.default.createHash("sha256").update(Buffer.from(entryBytes)).digest("base64");
+    const digestValue = crypto2__default.default.createHash("sha256").update(Buffer.from(entryBytes)).digest("base64");
     references.push({
       uri: `/${normalizePartPath(entryPath)}`,
       digestMethod,
@@ -1096,7 +1184,7 @@ function buildOfficeSignatureXml(references, privateKeyPem, certificatePem) {
   ).join("");
   const signedInfoXml = `<SignedInfo xmlns="${XMLDSIG_NS}"><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>${signedInfoReferencesXml}</SignedInfo>`;
   const canonicalSignedInfo = canonicalizeSignedInfoXml(signedInfoXml);
-  const signer = crypto__default.default.createSign("RSA-SHA256");
+  const signer = crypto2__default.default.createSign("RSA-SHA256");
   signer.update(Buffer.from(canonicalSignedInfo, "utf8"));
   signer.end();
   const signatureValueBase64 = signer.sign(privateKeyPem).toString("base64");