@certysign/sdk 2.2.0 → 2.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@certysign/sdk",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Official Node.js SDK for CertySign — hash-based digital signing, X.509 certificates, and PKI services. Documents never leave your system.",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/lib/SignatureEmbedder.js

@@ -103,7 +103,7 @@ class SignatureEmbedder {
     if (!entry) throw new Error('embedInPdf: at least one signature entry is required');
 
     const signerEmail    = entry.signerEmail || entry.recipientEmail || entry.signerName || 'CertySign';
-    const certSerial     = entry.certSerialNumber || '';
+    let   certSerial     = entry.certSerialNumber || '';
     const signDate       = entry.timestamp  ? new Date(entry.timestamp) :
                            entry.signedAt   ? new Date(entry.signedAt)  : new Date();
     const reason         = entry.reason     || 'Digital signature';
@@ -119,6 +119,32 @@ class SignatureEmbedder {
       throw new Error('embedInPdf: either signCallback or signature is required');
     }
 
+    // ── Auto-resolve cert serial from PEM if not explicitly provided ──
+    if (!certSerial && certPem) {
+      try {
+        const parsedCert = forge.certificateFromPem(certPem);
+        certSerial = (parsedCert.serialNumber || '').toUpperCase();
+      } catch { /* ignore parse errors — stamp will show empty cert serial */ }
+    }
+
+    // ── signCallback pre-flight: discover cert serial before drawing stamp ──
+    // When using signCallback without a known cert serial, we call the callback
+    // with a dummy hash to learn the certificate. Then we re-call with the real
+    // ByteRange hash below. This ensures the visual stamp shows the cert serial.
+    let preflightResult = null;
+    if (signCallback && !certSerial) {
+      const dummyHash = '0'.repeat(64); // SHA-256 dummy
+      preflightResult = await signCallback(dummyHash);
+      const preflightCertPem = preflightResult.data?.certificate || preflightResult.certificate;
+      certSerial = preflightResult.data?.certSerialNumber || preflightResult.certSerialNumber || '';
+      if (!certSerial && preflightCertPem) {
+        try {
+          const parsedCert = forge.certificateFromPem(preflightCertPem);
+          certSerial = (parsedCert.serialNumber || '').toUpperCase();
+        } catch { /* ignore */ }
+      }
+    }
+
     // ── Determine target page ──
     const pos     = entry.signaturePosition || {};
     const pageIdx = pos.page