sm-crypto-wasm 0.3.1 → 0.7.1

package/dist/cms/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * CMS SignedData 子模块（`sm-crypto-wasm/cms`）。
+ *
+ * 只做签名/验签，不建立信任链；证书有效期/用途/链校验由调用方负责。
+ *
+ * CMS SignedData submodule (`sm-crypto-wasm/cms`).
+ *
+ * Signing/verification only, no trust chain building: certificate validity, key usage
+ * and chain validation are the caller's responsibility.
+ */
+export { CmsError, type CmsVerifyErrorCode } from './errors.js';
+export * from './oids.js';
+export type { CmsAttribute, CmsSignerIdentifier, CmsSignerInfo, ParsedSignedData, } from './parse.js';
+export { parseSignedData } from './parse.js';
+export type { SignDataOptions, SignDataResult } from './sign.js';
+export { signData } from './sign.js';
+export type { VerifySignedDataOptions, VerifySignedDataResult, VerifySignerResult, } from './verify.js';
+export { signerIdentifierHex, verifySignedData } from './verify.js';

package/dist/cms/index.js

@@ -0,0 +1,15 @@
+/**
+ * CMS SignedData 子模块（`sm-crypto-wasm/cms`）。
+ *
+ * 只做签名/验签，不建立信任链；证书有效期/用途/链校验由调用方负责。
+ *
+ * CMS SignedData submodule (`sm-crypto-wasm/cms`).
+ *
+ * Signing/verification only, no trust chain building: certificate validity, key usage
+ * and chain validation are the caller's responsibility.
+ */
+export { CmsError } from './errors.js';
+export * from './oids.js';
+export { parseSignedData } from './parse.js';
+export { signData } from './sign.js';
+export { signerIdentifierHex, verifySignedData } from './verify.js';

package/dist/cms/oids.d.ts

@@ -0,0 +1,47 @@
+/**
+ * CMS oid 常量。
+ *
+ * CMS OID constants.
+ */
+/**
+ * id-data（1.2.840.113549.1.7.1）。
+ *
+ * id-data (1.2.840.113549.1.7.1).
+ */
+export declare const OID_CMS_DATA = "1.2.840.113549.1.7.1";
+/**
+ * id-signedData（1.2.840.113549.1.7.2）。
+ *
+ * id-signedData (1.2.840.113549.1.7.2).
+ */
+export declare const OID_CMS_SIGNED_DATA = "1.2.840.113549.1.7.2";
+/**
+ * contentType 签名属性（1.2.840.113549.1.9.3）。
+ *
+ * The contentType signed attribute (1.2.840.113549.1.9.3).
+ */
+export declare const OID_CMS_CONTENT_TYPE = "1.2.840.113549.1.9.3";
+/**
+ * messageDigest 签名属性（1.2.840.113549.1.9.4）。
+ *
+ * The messageDigest signed attribute (1.2.840.113549.1.9.4).
+ */
+export declare const OID_CMS_MESSAGE_DIGEST = "1.2.840.113549.1.9.4";
+/**
+ * signingTime 签名属性（1.2.840.113549.1.9.5）。
+ *
+ * The signingTime signed attribute (1.2.840.113549.1.9.5).
+ */
+export declare const OID_CMS_SIGNING_TIME = "1.2.840.113549.1.9.5";
+/**
+ * SM3 摘要算法（1.2.156.10197.1.401）。
+ *
+ * The SM3 digest algorithm (1.2.156.10197.1.401).
+ */
+export declare const OID_SM3 = "1.2.156.10197.1.401";
+/**
+ * SM3withSM2（1.2.156.10197.1.501）。
+ *
+ * SM3withSM2 (1.2.156.10197.1.501).
+ */
+export declare const OID_SM3_WITH_SM2 = "1.2.156.10197.1.501";

package/dist/cms/oids.js

@@ -0,0 +1,47 @@
+/**
+ * CMS oid 常量。
+ *
+ * CMS OID constants.
+ */
+/**
+ * id-data（1.2.840.113549.1.7.1）。
+ *
+ * id-data (1.2.840.113549.1.7.1).
+ */
+export const OID_CMS_DATA = '1.2.840.113549.1.7.1';
+/**
+ * id-signedData（1.2.840.113549.1.7.2）。
+ *
+ * id-signedData (1.2.840.113549.1.7.2).
+ */
+export const OID_CMS_SIGNED_DATA = '1.2.840.113549.1.7.2';
+/**
+ * contentType 签名属性（1.2.840.113549.1.9.3）。
+ *
+ * The contentType signed attribute (1.2.840.113549.1.9.3).
+ */
+export const OID_CMS_CONTENT_TYPE = '1.2.840.113549.1.9.3';
+/**
+ * messageDigest 签名属性（1.2.840.113549.1.9.4）。
+ *
+ * The messageDigest signed attribute (1.2.840.113549.1.9.4).
+ */
+export const OID_CMS_MESSAGE_DIGEST = '1.2.840.113549.1.9.4';
+/**
+ * signingTime 签名属性（1.2.840.113549.1.9.5）。
+ *
+ * The signingTime signed attribute (1.2.840.113549.1.9.5).
+ */
+export const OID_CMS_SIGNING_TIME = '1.2.840.113549.1.9.5';
+/**
+ * SM3 摘要算法（1.2.156.10197.1.401）。
+ *
+ * The SM3 digest algorithm (1.2.156.10197.1.401).
+ */
+export const OID_SM3 = '1.2.156.10197.1.401';
+/**
+ * SM3withSM2（1.2.156.10197.1.501）。
+ *
+ * SM3withSM2 (1.2.156.10197.1.501).
+ */
+export const OID_SM3_WITH_SM2 = '1.2.156.10197.1.501';

package/dist/cms/parse.d.ts

@@ -0,0 +1,217 @@
+/**
+ * CMS SignedData 解析（只读）。
+ *
+ * 关键点（红线 #1）：
+ * `signedAttrs` 的签名输入是**原始 DER 字节**（SET OF Attribute），而不是
+ * 解析后重新编码的结果。这里保留：
+ * - `raw`：把 `[0] IMPLICIT` 的首字节（0xA0）换成 SET（0x31）后的字节；
+ * - 对 BER indefinite-length，先编码为 definite-length 再替换首字节。
+ * 除首字节外不做任何重编码，避免 SET 顺序/长度编码差异破坏合法签名。
+ *
+ * BER 只在 CMS 路径启用；证书本身仍按 DER 严格解析。
+ *
+ * CMS SignedData parsing (read-only).
+ *
+ * Key point (red line #1): the signing input of `signedAttrs` is the **original DER
+ * bytes** (a SET OF Attribute), not a re-encoding of the parsed form. This module keeps:
+ * - `raw`: the bytes obtained by replacing the leading byte of `[0] IMPLICIT` (0xA0)
+ *   with the SET tag (0x31);
+ * - for BER indefinite-length, the value is first encoded as definite-length and then
+ *   the leading byte is replaced.
+ * Nothing but the leading byte is re-encoded, so SET ordering or length-encoding
+ * differences can never break a valid signature.
+ *
+ * BER is enabled on the CMS path only; certificates themselves are still parsed as
+ * strict DER.
+ */
+import { type Asn1Node } from '../asn1/index.js';
+import type { Certificate } from '../x509/types.js';
+/**
+ * 一个签名属性（Attribute ::= SEQUENCE { attrType, attrValues SET OF }).
+ *
+ * A single signed attribute (`Attribute ::= SEQUENCE { attrType, attrValues SET OF }`).
+ */
+export interface CmsAttribute {
+    /**
+     * 属性类型 OID。
+     *
+     * The attribute type OID.
+     */
+    readonly oid: string;
+    /**
+     * AttributeValue 节点（原始视图）。
+     *
+     * AttributeValue nodes (raw views).
+     */
+    readonly values: readonly Asn1Node[];
+    /**
+     * 整个 Attribute 的原始 DER。
+     *
+     * Raw DER of the whole Attribute.
+     */
+    readonly raw: Uint8Array;
+}
+/**
+ * 签名者标识。
+ *
+ * The signer identifier.
+ */
+export type CmsSignerIdentifier = {
+    readonly type: 'issuerAndSerialNumber';
+    /**
+     * 签发者 Name 的原始 DER，用于按字节匹配证书。
+     *
+     * Raw DER of the issuer Name, used to match certificates byte for byte.
+     */
+    readonly issuerRaw: Uint8Array;
+    /**
+     * 证书序列号（ASN.1 INTEGER，无符号大整数）。
+     *
+     * The certificate serial number (an ASN.1 INTEGER held as a bigint).
+     */
+    readonly serialNumber: bigint;
+} | {
+    readonly type: 'subjectKeyIdentifier';
+    /**
+     * `subjectKeyIdentifier` 的原始字节。
+     *
+     * Raw bytes of the `subjectKeyIdentifier` extension value.
+     */
+    readonly keyIdentifier: Uint8Array;
+};
+/**
+ * 解析后的 SignerInfo。
+ *
+ * A parsed SignerInfo.
+ */
+export interface CmsSignerInfo {
+    /**
+     * SignerInfo 版本号（原样解析，不做校验）。
+     *
+     * The SignerInfo version, taken as parsed and not validated.
+     */
+    readonly version: number;
+    /**
+     * 签名者标识（`issuerAndSerialNumber` 或 `subjectKeyIdentifier`）。
+     *
+     * The signer identifier (`issuerAndSerialNumber` or `subjectKeyIdentifier`).
+     */
+    readonly sid: CmsSignerIdentifier;
+    /**
+     * 摘要算法 OID；验签层只接受 SM3（`OID_SM3`）。
+     *
+     * Digest algorithm OID; the verification layer only accepts SM3 (`OID_SM3`).
+     */
+    readonly digestAlgorithm: string;
+    /**
+     * signedAttrs 的签名输入字节（SET tag 0x31）。
+     * 没有 signedAttrs 时为 `undefined`（直接签内容）。
+     *
+     * The signing-input bytes of signedAttrs (SET tag 0x31).
+     * `undefined` when there are no signedAttrs (the content is signed directly).
+     */
+    readonly signedAttrs?: {
+        readonly raw: Uint8Array;
+        readonly attributes: readonly CmsAttribute[];
+    };
+    /**
+     * 签名算法 OID；验签层只接受 SM3withSM2（`OID_SM3_WITH_SM2`）。
+     *
+     * Signature algorithm OID; the verification layer only accepts SM3withSM2
+     * (`OID_SM3_WITH_SM2`).
+     */
+    readonly signatureAlgorithm: string;
+    /**
+     * 签名字节（DER 的 `SEQUENCE { r, s }`，验签前转成裸 `r || s`）。
+     *
+     * Signature bytes (a DER `SEQUENCE { r, s }`, converted to raw `r || s` before
+     * verification).
+     */
+    readonly signature: Uint8Array;
+}
+/**
+ * 解析后的 SignedData。
+ *
+ * A parsed SignedData.
+ */
+export interface ParsedSignedData {
+    /**
+     * SignedData 版本号（原样解析，不做校验）。
+     *
+     * The SignedData version, taken as parsed and not validated.
+     */
+    readonly version: number;
+    /**
+     * `digestAlgorithms` 里的算法 OID 列表。
+     *
+     * The algorithm OIDs listed in `digestAlgorithms`.
+     */
+    readonly digestAlgorithms: readonly string[];
+    /**
+     * 内容类型 OID（本仓库的签名路径固定输出 id-data）。
+     *
+     * The content type OID (the signing path here always emits id-data).
+     */
+    readonly eContentType: string;
+    /**
+     * 内嵌内容；detached 时为 `undefined`。
+     *
+     * The embedded content; `undefined` for detached signatures.
+     */
+    readonly eContent?: Uint8Array;
+    /**
+     * 解析成功的 X.509 证书（无法解析的 CertificateChoices 已跳过）。
+     *
+     * Successfully parsed X.509 certificates (unparseable CertificateChoices skipped).
+     */
+    readonly certificates: readonly Certificate[];
+    /**
+     * SignerInfo 列表，顺序与 CMS 中一致。
+     *
+     * The SignerInfo entries, in the order they appear in the CMS.
+     */
+    readonly signerInfos: readonly CmsSignerInfo[];
+    /**
+     * 整个 ContentInfo 的原始 DER。
+     *
+     * Raw DER of the whole ContentInfo.
+     */
+    readonly raw: Uint8Array;
+}
+/**
+ * 解析 CMS ContentInfo（仅接受 SignedData）。
+ *
+ * @param input PEM（`CMS` / `PKCS7`）、base64、hex 或 DER/BER 字节。
+ * @throws CmsError 结构非法、不是 SignedData、或尾部有多余字节。
+ *
+ * Parses a CMS ContentInfo (SignedData only).
+ *
+ * @param input PEM (`CMS` / `PKCS7`), base64, hex, or DER/BER bytes.
+ * @throws CmsError When the structure is invalid, is not SignedData, or has trailing
+ *   bytes.
+ */
+export declare function parseSignedData(input: string | Uint8Array): ParsedSignedData;
+/**
+ * 读取签名属性中的时间值（供验签层使用）。
+ *
+ * Reads the time value of a signed attribute (used by the verification layer).
+ */
+export declare function attributeTime(attribute: CmsAttribute | undefined): Date | undefined;
+/**
+ * 读取签名属性中的 OCTET STRING 值（messageDigest）。
+ *
+ * Reads the OCTET STRING value of a signed attribute (messageDigest).
+ */
+export declare function attributeOctets(attribute: CmsAttribute | undefined): Uint8Array | undefined;
+/**
+ * 读取签名属性中的 OID 值（contentType）。
+ *
+ * Reads the OID value of a signed attribute (contentType).
+ */
+export declare function attributeOid(attribute: CmsAttribute | undefined): string | undefined;
+/**
+ * 十六进制便捷函数（供错误信息/调试使用）。
+ *
+ * Hex convenience helper, for error messages and debugging.
+ */
+export declare function cmsHex(bytes: Uint8Array): string;