@c9up/vellum 0.1.0

package/dist/native.js

@@ -0,0 +1,194 @@
+/**
+ * Loader for the Rust PDF engine.
+ *
+ * The engine is not optional. Parsing, authoring and rendering PDF have no
+ * JavaScript implementation in this package, so a missing binary is a hard
+ * failure with an actionable message — never a silent degradation that lets
+ * one deployment behave differently from another.
+ */
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { arch, platform } from "node:process";
+import { fileURLToPath } from "node:url";
+import { VellumError } from "./errors.js";
+const requireNative = createRequire(import.meta.url);
+const here = dirname(fileURLToPath(import.meta.url));
+const platformMap = {
+    "linux-x64": "linux-x64-gnu",
+    "linux-arm64": "linux-arm64-gnu",
+    "darwin-x64": "darwin-x64",
+    "darwin-arm64": "darwin-arm64",
+    "win32-x64": "win32-x64-msvc",
+};
+let native;
+let loadError;
+try {
+    const suffix = platformMap[`${platform}-${arch}`];
+    if (suffix) {
+        native = requireNative(join(here, `../index.${suffix}.node`));
+    }
+}
+catch (error) {
+    loadError = error;
+}
+export function isNativeAvailable() {
+    return native !== undefined;
+}
+/** Why the engine could not be loaded, phrased for whoever has to fix it. */
+function unavailableReason() {
+    const target = `${platform}-${arch}`;
+    if (loadError !== undefined) {
+        return `failed to load (${loadError instanceof Error ? loadError.message : String(loadError)})`;
+    }
+    return platformMap[target] !== undefined
+        ? "binary not found"
+        : `no prebuilt binary for ${target}`;
+}
+/** Raised when an operation needs the Rust engine and it is not there. */
+export class VellumNativeRequiredError extends VellumError {
+    constructor() {
+        super("NAPI_REQUIRED", `The Rust PDF engine is required but not loaded — ${unavailableReason()}.\n` +
+            "Install the prebuilt binary for this platform, or build it with `pnpm build:napi`.");
+        this.name = "VellumNativeRequiredError";
+    }
+}
+/** The engine, or a refusal explaining how to get one. */
+function engine() {
+    if (native === undefined)
+        throw new VellumNativeRequiredError();
+    return native;
+}
+/**
+ * Run engine work, translating its failures into coded errors.
+ *
+ * The engine reports failures as plain reasons. Without this, a caller
+ * catching a corrupt upload would get an `Error` it cannot branch on.
+ */
+function run(code, work) {
+    const loaded = engine();
+    try {
+        return work(loaded);
+    }
+    catch (error) {
+        throw new VellumError(code, error instanceof Error ? error.message : String(error), { cause: error });
+    }
+}
+export function inspectNative(pdf) {
+    return run("INVALID_PDF", (loaded) => loaded.inspect(pdf));
+}
+export function createBlankNative(pages) {
+    return run("WRITE_FAILED", (loaded) => loaded.createBlank([...pages]));
+}
+/**
+ * Rasterise one page, addressed from zero.
+ *
+ * The engine hands this to the libuv thread pool, so the returned promise
+ * settles without the calling thread ever blocking.
+ */
+export async function renderPageNative(pdf, pageIndex, options) {
+    const loaded = engine();
+    try {
+        return await loaded.renderPage(pdf, pageIndex, options);
+    }
+    catch (error) {
+        throw new VellumError("RENDER_FAILED", error instanceof Error ? error.message : String(error), { cause: error });
+    }
+}
+/** Rasterise every page, in document order. */
+export async function renderAllNative(pdf, options) {
+    const loaded = engine();
+    try {
+        return await loaded.renderAll(pdf, options);
+    }
+    catch (error) {
+        throw new VellumError("RENDER_FAILED", error instanceof Error ? error.message : String(error), { cause: error });
+    }
+}
+export function pageDimensionsNative(pdf) {
+    return run("INVALID_PDF", (loaded) => loaded.pageDimensions(pdf));
+}
+export function metadataNative(pdf) {
+    return run("INVALID_PDF", (loaded) => loaded.metadata(pdf));
+}
+export async function extractTextNative(pdf, pageIndex) {
+    const loaded = engine();
+    try {
+        return await loaded.extractText(pdf, pageIndex);
+    }
+    catch (error) {
+        throw new VellumError("EXTRACT_FAILED", error instanceof Error ? error.message : String(error), { cause: error });
+    }
+}
+export async function extractTextAllNative(pdf) {
+    const loaded = engine();
+    try {
+        return await loaded.extractTextAll(pdf);
+    }
+    catch (error) {
+        throw new VellumError("EXTRACT_FAILED", error instanceof Error ? error.message : String(error), { cause: error });
+    }
+}
+async function edit(code, work) {
+    const loaded = engine();
+    try {
+        return await work(loaded);
+    }
+    catch (error) {
+        throw new VellumError(code, error instanceof Error ? error.message : String(error), { cause: error });
+    }
+}
+export function mergeNative(documents) {
+    return edit("MERGE_FAILED", (loaded) => loaded.merge([...documents]));
+}
+export function selectPagesNative(pdf, pageIndexes) {
+    return edit("SELECT_FAILED", (loaded) => loaded.selectPages(pdf, [...pageIndexes]));
+}
+export function splitNative(pdf) {
+    return edit("SPLIT_FAILED", (loaded) => loaded.split(pdf));
+}
+export function rotateNative(pdf, degrees, pageIndexes) {
+    return edit("ROTATE_FAILED", (loaded) => loaded.rotate(pdf, degrees, pageIndexes ? [...pageIndexes] : undefined));
+}
+export function stampNative(pdf, image, options) {
+    return edit("STAMP_FAILED", (loaded) => loaded.stamp(pdf, image, options));
+}
+export function stampTextNative(pdf, text, options) {
+    return edit("STAMP_TEXT_FAILED", (loaded) => loaded.stampText(pdf, text, options));
+}
+export function formFieldsNative(pdf) {
+    return run("INVALID_PDF", (loaded) => loaded.formFields(pdf));
+}
+export function fillFormNative(pdf, values) {
+    return edit("FILL_FAILED", (loaded) => loaded.fillForm(pdf, values));
+}
+export function flattenFormNative(pdf) {
+    return edit("FLATTEN_FAILED", (loaded) => loaded.flattenForm(pdf));
+}
+export function prepareSignatureNative(pdf, options) {
+    return edit("SIGN_FAILED", (loaded) => loaded.prepareSignature(pdf, options));
+}
+export function embedSignatureNative(prepared, value) {
+    return edit("SIGN_FAILED", (loaded) => loaded.embedSignature(prepared, value));
+}
+export function signCmsNative(digest, key, certificates, signedAt) {
+    return edit("SIGN_FAILED", (loaded) => loaded.signCms(digest, key, [...certificates], signedAt));
+}
+export function timestampQueryNative(cms) {
+    return run("TIMESTAMP_FAILED", (loaded) => loaded.timestampQuery(cms));
+}
+export function attachTimestampNative(cms, response, nonce) {
+    return run("TIMESTAMP_FAILED", (loaded) => loaded.attachTimestamp(cms, response, nonce));
+}
+export function verifySignaturesNative(pdf, trust) {
+    return edit("VERIFY_FAILED", (loaded) => loaded.verifySignatures(pdf, trust));
+}
+export function responderUrlNative(certificate) {
+    return run("VERIFY_FAILED", (loaded) => loaded.responderUrl(certificate));
+}
+export function revocationQueryNative(certificate, issuer) {
+    return run("VERIFY_FAILED", (loaded) => loaded.revocationQuery(certificate, issuer));
+}
+export function readRevocationNative(response, certificate, issuer, at) {
+    return run("VERIFY_FAILED", (loaded) => loaded.readRevocation(response, certificate, issuer, at ?? undefined));
+}
+//# sourceMappingURL=native.js.map

package/dist/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkB1C,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAErD,MAAM,WAAW,GAA2B;IAC3C,WAAW,EAAE,eAAe;IAC5B,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,YAAY;IAC1B,cAAc,EAAE,cAAc;IAC9B,WAAW,EAAE,gBAAgB;CAC7B,CAAC;AAsBF,IAAI,MAAgC,CAAC;AACrC,IAAI,SAAkB,CAAC;AAEvB,IAAI,CAAC;IACJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,MAAM,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;AACF,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IAChB,SAAS,GAAG,KAAK,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,OAAO,MAAM,KAAK,SAAS,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,mBAAmB,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;IACjG,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,SAAS;QACvC,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,0BAA0B,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,0EAA0E;AAC1E,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IACzD;QACC,KAAK,CACJ,eAAe,EACf,oDAAoD,iBAAiB,EAAE,KAAK;YAC3E,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IACzC,CAAC;CACD;AAED,0DAA0D;AAC1D,SAAS,MAAM;IACd,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;IAChE,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,GAAG,CAAI,IAAY,EAAE,IAAiC;IAC9D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACpB,IAAI,EACJ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACxC,OAAO,GAAG,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAA8B;IAC/D,OAAO,GAAG,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,GAAW,EACX,SAAiB,EACjB,OAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACpB,eAAe,EACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AACF,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,GAAW,EACX,OAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACpB,eAAe,EACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC/C,OAAO,GAAG,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,GAAW,EACX,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAW;IACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AACF,CAAC;AAED,KAAK,UAAU,IAAI,CAClB,IAAY,EACZ,IAA0C;IAE1C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACpB,IAAI,EACJ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAgC;IAC3D,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAChC,GAAW,EACX,WAAkC;IAElC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CACvC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACtC,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY,CAC3B,GAAW,EACX,OAAe,EACf,WAAmC;IAEnC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CACvC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAC1B,GAAW,EACX,KAAa,EACb,OAA2B;IAE3B,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,GAAW,EACX,IAAY,EACZ,OAA+B;IAE/B,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC3C,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,cAAc,CAC7B,GAAW,EACX,MAA8B;IAE9B,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,GAAW,EACX,OAA+B;IAE/B,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,QAAgB,EAChB,KAAa;IAEb,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC5B,MAAc,EACd,GAAW,EACX,YAAmC,EACnC,QAAgB;IAEhB,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,QAAQ,CAAC,CACxD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC/C,OAAO,GAAG,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,GAAW,EACX,QAAgB,EAChB,KAAa;IAEb,OAAO,GAAG,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CACzC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAC5C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,GAAW,EACX,KAAyB;IAEzB,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACrD,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,WAAmB,EACnB,MAAc;IAEd,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CACtC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,QAAgB,EAChB,WAAmB,EACnB,MAAc,EACd,EAAiB;IAEjB,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CACtC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,SAAS,CAAC,CACrE,CAAC;AACH,CAAC"}

package/dist/responder.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Deciding whether a revocation responder may be contacted.
+ *
+ * The address comes out of the certificate inside the document being checked,
+ * which is to say: from whoever sent the document. Following it unconditionally
+ * turns "check whether this signature is still valid" into "make my server
+ * issue an HTTP request wherever this stranger points" — the cloud metadata
+ * endpoint, a Redis on loopback, or simply a URL that confirms the document was
+ * opened and reveals the address it was opened from.
+ *
+ * So the default is a public responder over HTTP, and an application whose
+ * authority answers on the internal network says so by name. Everything
+ * refused answers `"unknown"`, never `"good"`: a responder that was not asked
+ * has told us nothing.
+ */
+/** Who an application is willing to ask about revocation. */
+export type ResponderPolicy = ReadonlyArray<string> | ((url: URL) => boolean | Promise<boolean>);
+/** Why a responder was refused, in a sentence a caller can act on. */
+export interface ResponderRefusal {
+    refused: string;
+}
+/**
+ * Decide whether `url` may be asked.
+ *
+ * @param policy What the application allows: a list of hostnames, or a
+ *   predicate. Absent, only public hosts over http/https are contacted.
+ */
+export declare function mayAsk(url: string, policy?: ResponderPolicy): Promise<URL | ResponderRefusal>;
+//# sourceMappingURL=responder.d.ts.map

package/dist/responder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responder.d.ts","sourceRoot":"","sources":["../src/responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,eAAe,GACxB,aAAa,CAAC,MAAM,CAAC,GACrB,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AA2C9C,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAC3B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAuCjC"}

package/dist/responder.js

@@ -0,0 +1,101 @@
+/**
+ * Deciding whether a revocation responder may be contacted.
+ *
+ * The address comes out of the certificate inside the document being checked,
+ * which is to say: from whoever sent the document. Following it unconditionally
+ * turns "check whether this signature is still valid" into "make my server
+ * issue an HTTP request wherever this stranger points" — the cloud metadata
+ * endpoint, a Redis on loopback, or simply a URL that confirms the document was
+ * opened and reveals the address it was opened from.
+ *
+ * So the default is a public responder over HTTP, and an application whose
+ * authority answers on the internal network says so by name. Everything
+ * refused answers `"unknown"`, never `"good"`: a responder that was not asked
+ * has told us nothing.
+ */
+/** Hosts that are never a public certificate authority. */
+function isPrivateHost(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return true;
+    // IPv6 loopback, unspecified, unique-local (fc00::/7) and link-local (fe80::/10).
+    if (host === "::1" || host === "::")
+        return true;
+    if (/^f[cd][0-9a-f]{2}:/.test(host))
+        return true;
+    if (/^fe[89ab][0-9a-f]:/.test(host))
+        return true;
+    // An IPv4-mapped IPv6 address is the same machine under another spelling,
+    // and the URL parser rewrites `::ffff:127.0.0.1` as `::ffff:7f00:1` — so a
+    // check that only reads dotted quads waves loopback straight through.
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(host) ??
+        (() => {
+            const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(host);
+            if (hex === null)
+                return null;
+            const packed = (Number.parseInt(hex[1], 16) << 16) |
+                Number.parseInt(hex[2], 16);
+            return [
+                host,
+                [24, 16, 8, 0].map((shift) => (packed >>> shift) & 0xff).join("."),
+            ];
+        })();
+    const literal = mapped?.[1] ?? host;
+    const parts = literal.split(".");
+    if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p)))
+        return false;
+    const [a, b] = parts.map(Number);
+    return (a === 0 || // this network
+        a === 127 || // loopback
+        a === 10 || // private
+        (a === 172 && b >= 16 && b <= 31) || // private
+        (a === 192 && b === 168) || // private
+        (a === 169 && b === 254) || // link-local, and the cloud metadata address
+        (a === 100 && b >= 64 && b <= 127) || // carrier-grade NAT
+        a >= 224 // multicast and reserved
+    );
+}
+/**
+ * Decide whether `url` may be asked.
+ *
+ * @param policy What the application allows: a list of hostnames, or a
+ *   predicate. Absent, only public hosts over http/https are contacted.
+ */
+export async function mayAsk(url, policy) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return { refused: `the certificate names "${url}", which is not a URL` };
+    }
+    if (typeof policy === "function") {
+        return (await policy(parsed))
+            ? parsed
+            : { refused: `the configured policy refused ${parsed.origin}` };
+    }
+    if (policy !== undefined) {
+        return policy.includes(parsed.hostname)
+            ? parsed
+            : {
+                refused: `${parsed.hostname} is not among the responders this application allows` +
+                    ` (${policy.join(", ") || "none"})`,
+            };
+    }
+    // OCSP is defined over HTTP. Anything else is a scheme somebody wanted the
+    // server to speak, not a way to ask about a certificate.
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return {
+            refused: `the certificate names a ${parsed.protocol.replace(":", "")} responder, which is not asked`,
+        };
+    }
+    if (isPrivateHost(parsed.hostname)) {
+        return {
+            refused: `the certificate names ${parsed.hostname}, an address on this network — ` +
+                "a document does not get to choose which of your own services is contacted. " +
+                "Name it in `allowedResponders` if that really is your authority.",
+        };
+    }
+    return parsed;
+}
+//# sourceMappingURL=responder.js.map

package/dist/responder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responder.js","sourceRoot":"","sources":["../src/responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,2DAA2D;AAC3D,SAAS,aAAa,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,kFAAkF;IAClF,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,MAAM,GACX,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1C,CAAC,GAAG,EAAE;YACL,MAAM,GAAG,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,MAAM,GACX,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO;gBACN,IAAI;gBACJ,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aAClE,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACd,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAC;IACrE,OAAO,CACN,CAAC,KAAK,CAAC,IAAI,eAAe;QAC1B,CAAC,KAAK,GAAG,IAAI,WAAW;QACxB,CAAC,KAAK,EAAE,IAAI,UAAU;QACtB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,UAAU;QAC/C,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,UAAU;QACtC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,6CAA6C;QACzE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,oBAAoB;QAC1D,CAAC,IAAI,GAAG,CAAC,yBAAyB;KAClC,CAAC;AACH,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC3B,GAAW,EACX,MAAwB;IAExB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,OAAO,EAAE,0BAA0B,GAAG,uBAAuB,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC;gBACA,OAAO,EACN,GAAG,MAAM,CAAC,QAAQ,sDAAsD;oBACxE,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;aACpC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO;YACN,OAAO,EAAE,2BAA2B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,gCAAgC;SACpG,CAAC;IACH,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO;YACN,OAAO,EACN,yBAAyB,MAAM,CAAC,QAAQ,iCAAiC;gBACzE,6EAA6E;gBAC7E,kEAAkE;SACnE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/services/main.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Container service accessor — `import vellum from '@c9up/vellum/services/main'`.
+ *
+ * Populated by `VellumProvider.boot()`. Reading it before the provider has
+ * booted throws rather than answering with an unconfigured service, which
+ * would render with defaults nobody chose.
+ */
+import type { Vellum } from "../Vellum.js";
+/** @internal Called by the provider once the service exists. */
+export declare function setVellum(service: Vellum): void;
+/** @internal Test helper — forget the service between cases. */
+export declare function clearVellum(): void;
+declare const vellum: Vellum;
+export default vellum;
+//# sourceMappingURL=main.d.ts.map

package/dist/services/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/services/main.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE/C;AAED,gEAAgE;AAChE,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAYD,QAAA,MAAM,MAAM,EAAE,MAaZ,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist/services/main.js

@@ -0,0 +1,39 @@
+/**
+ * Container service accessor — `import vellum from '@c9up/vellum/services/main'`.
+ *
+ * Populated by `VellumProvider.boot()`. Reading it before the provider has
+ * booted throws rather than answering with an unconfigured service, which
+ * would render with defaults nobody chose.
+ */
+let instance;
+/** @internal Called by the provider once the service exists. */
+export function setVellum(service) {
+    instance = service;
+}
+/** @internal Test helper — forget the service between cases. */
+export function clearVellum() {
+    instance = undefined;
+}
+function resolve() {
+    if (!instance) {
+        throw new Error("[vellum] Vellum service accessed before VellumProvider.boot() ran. " +
+            "Check that `@c9up/vellum/provider` is listed in your reamrc.ts providers.");
+    }
+    return instance;
+}
+const vellum = new Proxy(Object.create(null), {
+    get(_target, property) {
+        // A module loader probes an imported binding for `then` to see whether
+        // it is thenable, and for well-known symbols. Answering those by
+        // resolving the service would throw during the import itself, before
+        // any provider had a chance to boot.
+        if (property === "then" || typeof property === "symbol") {
+            return undefined;
+        }
+        const service = resolve();
+        const value = Reflect.get(service, property, service);
+        return typeof value === "function" ? value.bind(service) : value;
+    },
+});
+export default vellum;
+//# sourceMappingURL=main.js.map

package/dist/services/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/services/main.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,IAAI,QAA4B,CAAC;AAEjC,gEAAgE;AAChE,MAAM,UAAU,SAAS,CAAC,OAAe;IACxC,QAAQ,GAAG,OAAO,CAAC;AACpB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,WAAW;IAC1B,QAAQ,GAAG,SAAS,CAAC;AACtB,CAAC;AAED,SAAS,OAAO;IACf,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACd,qEAAqE;YACpE,2EAA2E,CAC5E,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,MAAM,GAAW,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;IACrD,GAAG,CAAC,OAAO,EAAE,QAAQ;QACpB,uEAAuE;QACvE,iEAAiE;QACjE,qEAAqE;QACrE,qCAAqC;QACrC,IAAI,QAAQ,KAAK,MAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist/signers.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Signers that need nothing but a key you hold.
+ *
+ * A signer bound to a certified provider is not here and should not be: it
+ * belongs to whoever has the account, as an adapter of its own. This package
+ * ships the contract and the one implementation that has no vendor behind it.
+ */
+import type { Signer } from "./Vellum.js";
+/** A key you hold, and the certificate that vouches for it. */
+export interface Pkcs8SignerOptions {
+    /** The private key, PKCS#8 DER. */
+    key: Buffer;
+    /** The signer's certificate, DER. */
+    certificate: Buffer;
+    /**
+     * The rest of the chain, DER, nearest issuer first.
+     *
+     * Worth supplying: a verifier that has to go and find the issuers itself
+     * will often decide it cannot.
+     */
+    chain?: ReadonlyArray<Buffer>;
+}
+/**
+ * Sign with a key held by the application.
+ *
+ * ```ts
+ * // config/vellum.ts
+ * signers: {
+ *   internal: pkcs8Signer({
+ *     key: readFileSync(app.makePath('storage/signing.key.der')),
+ *     certificate: readFileSync(app.makePath('storage/signing.crt.der')),
+ *   }),
+ * }
+ * ```
+ *
+ * This is an *advanced* signature: it proves the document has not changed
+ * since a particular key signed it. Whether that is enough is a question about
+ * the document, not about the code — where the law requires a qualified
+ * signature, the key has to live with a certified provider, and that is an
+ * adapter rather than this.
+ *
+ * PKCS#8 and DER rather than a `.p12` bundle: reading PKCS#12 in Rust is not
+ * something to put underneath a signature, and
+ * `openssl pkcs12 -in bundle.p12 -nodes` gets you here in one command.
+ */
+export declare function pkcs8Signer(options: Pkcs8SignerOptions): Signer;
+/** Where to ask for a timestamp, and how. */
+export interface TimestampOptions {
+    /** The authority's RFC 3161 endpoint. */
+    url: string;
+    /** Anything the authority needs, such as an Authorization header. */
+    headers?: Record<string, string>;
+    /** How long to wait before giving up. Default 10 seconds. */
+    timeoutMs?: number;
+}
+/**
+ * Add a trusted timestamp to whatever `inner` signs.
+ *
+ * ```ts
+ * signers: {
+ *   internal: timestamped(pkcs8Signer({ key, certificate }), {
+ *     url: 'https://freetsa.org/tsr',
+ *   }),
+ * }
+ * ```
+ *
+ * A signature proves a document has not changed since a key signed it, not
+ * *when*. Once the signing certificate expires, a verifier cannot tell a
+ * signature made while it was valid from one forged afterwards, and stops
+ * accepting it. For a document kept for years — which is most of the documents
+ * anyone bothers to sign — a timestamp is what keeps it verifiable.
+ *
+ * It wraps any signer, so it works over a provider's as well as the local one.
+ * The token goes on as an unsigned attribute, which is what lets it be added
+ * without disturbing the signature.
+ *
+ * The signature grows by a few kilobytes, so a document prepared with a tight
+ * `capacity` may need a larger one.
+ */
+export declare function timestamped(inner: Signer, options: TimestampOptions): Signer;
+//# sourceMappingURL=signers.d.ts.map

package/dist/signers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signers.d.ts","sourceRoot":"","sources":["../src/signers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IAClC,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAmB/D;AAED,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAChC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAuC5E"}

package/dist/signers.js

@@ -0,0 +1,98 @@
+/**
+ * Signers that need nothing but a key you hold.
+ *
+ * A signer bound to a certified provider is not here and should not be: it
+ * belongs to whoever has the account, as an adapter of its own. This package
+ * ships the contract and the one implementation that has no vendor behind it.
+ */
+import { VellumError } from "./errors.js";
+import { attachTimestampNative, signCmsNative, timestampQueryNative, } from "./native.js";
+/**
+ * Sign with a key held by the application.
+ *
+ * ```ts
+ * // config/vellum.ts
+ * signers: {
+ *   internal: pkcs8Signer({
+ *     key: readFileSync(app.makePath('storage/signing.key.der')),
+ *     certificate: readFileSync(app.makePath('storage/signing.crt.der')),
+ *   }),
+ * }
+ * ```
+ *
+ * This is an *advanced* signature: it proves the document has not changed
+ * since a particular key signed it. Whether that is enough is a question about
+ * the document, not about the code — where the law requires a qualified
+ * signature, the key has to live with a certified provider, and that is an
+ * adapter rather than this.
+ *
+ * PKCS#8 and DER rather than a `.p12` bundle: reading PKCS#12 in Rust is not
+ * something to put underneath a signature, and
+ * `openssl pkcs12 -in bundle.p12 -nodes` gets you here in one command.
+ */
+export function pkcs8Signer(options) {
+    if (options.key.length === 0) {
+        throw new VellumError("SIGNER_INVALID", "The signing key is empty.");
+    }
+    if (options.certificate.length === 0) {
+        throw new VellumError("SIGNER_INVALID", "The certificate is empty.");
+    }
+    const certificates = [options.certificate, ...(options.chain ?? [])];
+    return {
+        async sign(digest) {
+            return signCmsNative(digest, options.key, certificates, new Date().toISOString());
+        },
+    };
+}
+/**
+ * Add a trusted timestamp to whatever `inner` signs.
+ *
+ * ```ts
+ * signers: {
+ *   internal: timestamped(pkcs8Signer({ key, certificate }), {
+ *     url: 'https://freetsa.org/tsr',
+ *   }),
+ * }
+ * ```
+ *
+ * A signature proves a document has not changed since a key signed it, not
+ * *when*. Once the signing certificate expires, a verifier cannot tell a
+ * signature made while it was valid from one forged afterwards, and stops
+ * accepting it. For a document kept for years — which is most of the documents
+ * anyone bothers to sign — a timestamp is what keeps it verifiable.
+ *
+ * It wraps any signer, so it works over a provider's as well as the local one.
+ * The token goes on as an unsigned attribute, which is what lets it be added
+ * without disturbing the signature.
+ *
+ * The signature grows by a few kilobytes, so a document prepared with a tight
+ * `capacity` may need a larger one.
+ */
+export function timestamped(inner, options) {
+    return {
+        async sign(digest) {
+            const cms = await inner.sign(digest);
+            const { query, nonce } = timestampQueryNative(cms);
+            let answer;
+            try {
+                answer = await fetch(options.url, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/timestamp-query",
+                        ...options.headers,
+                    },
+                    body: new Uint8Array(query),
+                    signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+                });
+            }
+            catch (error) {
+                throw new VellumError("TIMESTAMP_UNREACHABLE", `The timestamp authority at ${options.url} could not be reached.`, { cause: error });
+            }
+            if (!answer.ok) {
+                throw new VellumError("TIMESTAMP_REFUSED", `The timestamp authority at ${options.url} answered ${answer.status}.`);
+            }
+            return attachTimestampNative(cms, Buffer.from(await answer.arrayBuffer()), nonce);
+        },
+    };
+}
+//# sourceMappingURL=signers.js.map

package/dist/signers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signers.js","sourceRoot":"","sources":["../src/signers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACN,qBAAqB,EACrB,aAAa,EACb,oBAAoB,GACpB,MAAM,aAAa,CAAC;AAkBrB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,WAAW,CAAC,OAA2B;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO;QACN,KAAK,CAAC,IAAI,CAAC,MAAc;YACxB,OAAO,aAAa,CACnB,MAAM,EACN,OAAO,CAAC,GAAG,EACX,YAAY,EACZ,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CACxB,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,OAAyB;IACnE,OAAO;QACN,KAAK,CAAC,IAAI,CAAC,MAAc;YACxB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEnD,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACJ,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE;oBACjC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACR,cAAc,EAAE,6BAA6B;wBAC7C,GAAG,OAAO,CAAC,OAAO;qBAClB;oBACD,IAAI,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC;oBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;iBACxD,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,8BAA8B,OAAO,CAAC,GAAG,wBAAwB,EACjE,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,WAAW,CACpB,mBAAmB,EACnB,8BAA8B,OAAO,CAAC,GAAG,aAAa,MAAM,CAAC,MAAM,GAAG,CACtE,CAAC;YACH,CAAC;YAED,OAAO,qBAAqB,CAC3B,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,EACvC,KAAK,CACL,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}