@e-sig/core 0.4.0

package/dist/cert-issuer.js

@@ -0,0 +1,132 @@
+// src/lib/integrations/esig/core/cert-issuer.ts
+//
+// Portable self-signed cert issuance. Project-agnostic — given a subject name
+// (e.g. organization name), produces an RSA-2048 X.509 + PEM bundle ready
+// to feed into PemSigner.
+//
+// Includes app-side AES-256-GCM key wrapping so callers can persist keys at
+// rest without leaning on pgsodium / KMS / Vault. The wrapped blob is opaque;
+// only callers that know the passphrase can unwrap.
+import forge from "node-forge";
+import crypto from "node:crypto";
+const ENC_VERSION = "v1"; // scheme version prefix for future rotation
+const DEFAULT_CERT_VALIDITY_DAYS = 365;
+// PBKDF: scrypt N=2^15 ≈ 32MB / 100ms on modern CPU. Adequate at-rest
+// derivation when passphrase is a high-entropy 24+ char env var.
+const SCRYPT_N = 1 << 15;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const KEY_LEN = 32;
+const IV_LEN = 12;
+const SALT_LEN = 16;
+const MIN_PASSPHRASE_LEN = 24;
+/**
+ * Generate a self-signed RSA-2048 X.509 certificate suitable for PDF e-signing.
+ *
+ * ASCII-only subject — node-forge's `certificateFromPem` mis-counts byte length
+ * for non-ASCII values when round-tripping (concrete bug: em-dash in OU breaks
+ * parsing with "Too few bytes to parse DER"). The guard here prevents that.
+ */
+export function generateSelfSignedCert(opts) {
+    const { subjectName, validityDays = DEFAULT_CERT_VALIDITY_DAYS, commonNamePrefix = "E-sig" } = opts;
+    if (!/^[\x20-\x7e]+$/.test(subjectName)) {
+        throw new Error(`subjectName "${subjectName}" contains non-ASCII characters — would break node-forge cert round-trip`);
+    }
+    const keys = forge.pki.rsa.generateKeyPair(2048);
+    const cert = forge.pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    // Serial: 128 bits of CSPRNG entropy (RFC 5280 §4.1.2.2 — unique, unpredictable,
+    // ≤20 octets). Clear the top bit so the DER INTEGER is positive without a
+    // leading zero; force a nonzero leading byte so it isn't short-encoded.
+    const serialBytes = crypto.randomBytes(16);
+    serialBytes[0] = (serialBytes[0] & 0x7f) | 0x40;
+    cert.serialNumber = serialBytes.toString("hex");
+    const now = new Date();
+    cert.validity.notBefore = now;
+    cert.validity.notAfter = new Date(now.getTime() + validityDays * 86400_000);
+    const subject = [
+        { name: "commonName", value: `${commonNamePrefix} (${subjectName})` },
+        { name: "organizationName", value: subjectName },
+        { name: "organizationalUnitName", value: "E-signature" },
+        { name: "countryName", value: "US" },
+    ];
+    cert.setSubject(subject);
+    cert.setIssuer(subject);
+    cert.setExtensions(opts.extensions ?? [
+        { name: "basicConstraints", cA: false },
+        // digitalSignature + nonRepudiation (contentCommitment) — the key usages
+        // for a document-signing end-entity cert.
+        { name: "keyUsage", digitalSignature: true, nonRepudiation: true },
+        // Document signing → emailProtection (S/MIME/document). clientAuth (TLS
+        // client) was semantically wrong for a signing cert and is removed.
+        { name: "extKeyUsage", emailProtection: true },
+        // Subject Key Identifier improves cert hygiene / chain building.
+        { name: "subjectKeyIdentifier" },
+    ]);
+    cert.sign(keys.privateKey, forge.md.sha256.create());
+    const certPem = forge.pki.certificateToPem(cert);
+    const keyPem = forge.pki.privateKeyToPem(keys.privateKey);
+    const der = forge.asn1.toDer(forge.pki.certificateToAsn1(cert)).getBytes();
+    const fingerprint = crypto.createHash("sha256").update(Buffer.from(der, "binary")).digest("hex");
+    return {
+        keyPem,
+        certPem,
+        fingerprint,
+        notBefore: cert.validity.notBefore,
+        notAfter: cert.validity.notAfter,
+    };
+}
+// ---------- App-side key wrapping ----------
+function deriveKey(passphrase, salt) {
+    return crypto.scryptSync(passphrase, salt, KEY_LEN, {
+        N: SCRYPT_N,
+        r: SCRYPT_R,
+        p: SCRYPT_P,
+        maxmem: 64 * 1024 * 1024,
+    });
+}
+/**
+ * AES-256-GCM-encrypt a PEM-encoded private key for at-rest persistence.
+ * Layout: version(2) | salt(16) | iv(12) | authTag(16) | ciphertext.
+ *
+ * @param keyPem  PEM-encoded private key string.
+ * @param passphrase  ≥24 char high-entropy secret. Derived via scrypt with
+ *                    per-call random salt.
+ */
+export function encryptKeyPem(keyPem, passphrase) {
+    if (!passphrase || passphrase.length < MIN_PASSPHRASE_LEN) {
+        throw new Error(`encryptKeyPem: passphrase must be ≥${MIN_PASSPHRASE_LEN} chars`);
+    }
+    const salt = crypto.randomBytes(SALT_LEN);
+    const iv = crypto.randomBytes(IV_LEN);
+    const key = deriveKey(passphrase, salt);
+    const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+    const ciphertext = Buffer.concat([cipher.update(keyPem, "utf8"), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return Buffer.concat([Buffer.from(ENC_VERSION, "utf8"), salt, iv, authTag, ciphertext]);
+}
+/**
+ * Inverse of encryptKeyPem. Throws on:
+ *   - unknown version prefix (future-compat detection)
+ *   - wrong passphrase (AES-GCM auth-tag mismatch surfaces as error)
+ *   - tampered ciphertext (same as above)
+ */
+export function decryptKeyPem(blob, passphrase) {
+    if (!passphrase || passphrase.length < MIN_PASSPHRASE_LEN) {
+        throw new Error(`decryptKeyPem: passphrase must be ≥${MIN_PASSPHRASE_LEN} chars`);
+    }
+    const buf = Buffer.from(blob);
+    const version = buf.slice(0, 2).toString("utf8");
+    if (version !== ENC_VERSION) {
+        throw new Error(`Unknown key encryption version: ${version}`);
+    }
+    const salt = buf.slice(2, 2 + SALT_LEN);
+    const iv = buf.slice(2 + SALT_LEN, 2 + SALT_LEN + IV_LEN);
+    const authTag = buf.slice(2 + SALT_LEN + IV_LEN, 2 + SALT_LEN + IV_LEN + 16);
+    const ciphertext = buf.slice(2 + SALT_LEN + IV_LEN + 16);
+    const key = deriveKey(passphrase, salt);
+    const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(authTag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+//# sourceMappingURL=cert-issuer.js.map

package/dist/cert-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-issuer.js","sourceRoot":"","sources":["../src/cert-issuer.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,0BAA0B;AAC1B,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,oDAAoD;AAEpD,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,4CAA4C;AACtE,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;AACzB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAyB9B;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAyB;IAC9D,MAAM,EAAE,WAAW,EAAE,YAAY,GAAG,0BAA0B,EAAE,gBAAgB,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;IACpG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,gBAAgB,WAAW,0EAA0E,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;IAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,iFAAiF;IACjF,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3C,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,YAAY,GAAG,SAAS,CAAC,CAAC;IAE5E,MAAM,OAAO,GAAG;QACd,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,gBAAgB,KAAK,WAAW,GAAG,EAAE;QACrE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE;QAChD,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,aAAa,EAAE;QACxD,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;KACrC,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxB,IAAI,CAAC,aAAa,CAChB,IAAI,CAAC,UAAU,IAAI;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE;QACvC,yEAAyE;QACzE,0CAA0C;QAC1C,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;QAClE,wEAAwE;QACxE,oEAAoE;QACpE,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE;QAC9C,iEAAiE;QACjE,EAAE,IAAI,EAAE,sBAAsB,EAAE;KACjC,CACF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjG,OAAO;QACL,MAAM;QACN,OAAO;QACP,WAAW;QACX,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;KACjC,CAAC;AACJ,CAAC;AAED,8CAA8C;AAE9C,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY;IACjD,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;QAClD,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,UAAkB;IAC9D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,sCAAsC,kBAAkB,QAAQ,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,UAAkB;IAChE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,sCAAsC,kBAAkB,QAAQ,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,QAAQ,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,QAAQ,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC"}

package/dist/cert-lifecycle.d.ts

@@ -0,0 +1,16 @@
+import type { CertStore, StoredCert } from "./adapters.js";
+export interface EnsureCertResult {
+    cert: StoredCert;
+    certPem: string;
+    /** Decrypted PEM private key — keep in memory only; never persist plaintext. */
+    keyPem: string;
+}
+export declare function ensureActiveCert(opts: {
+    store: CertStore;
+    tenantId: string;
+    /** Cert subject CN (e.g. the tenant/org display name). ASCII-clean it upstream. */
+    subjectName: string;
+    /** Passphrase used to encrypt/decrypt the key at rest in the CertStore. */
+    passphrase: string;
+}): Promise<EnsureCertResult>;
+//# sourceMappingURL=cert-lifecycle.d.ts.map

package/dist/cert-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-lifecycle.d.ts","sourceRoot":"","sources":["../src/cert-lifecycle.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB5B"}

package/dist/cert-lifecycle.js

@@ -0,0 +1,30 @@
+// cert-lifecycle.ts
+//
+// Stack-agnostic "ensure an active signing cert for this tenant" helper. Depends
+// only on the CertStore interface + the crypto in cert-issuer — no DB, no stack.
+// Creates a cert on first call; on expiry, deactivates the old one and issues a
+// fresh cert with `rotatedFromId` pointing at the predecessor.
+import { generateSelfSignedCert, encryptKeyPem, decryptKeyPem, } from "./cert-issuer.js";
+export async function ensureActiveCert(opts) {
+    const existing = await opts.store.findActive(opts.tenantId);
+    if (existing && existing.notAfter > new Date()) {
+        return {
+            cert: existing,
+            certPem: existing.certPem,
+            keyPem: decryptKeyPem(existing.keyPemEncrypted, opts.passphrase),
+        };
+    }
+    if (existing) {
+        await opts.store.deactivate(existing.id);
+    }
+    const generated = generateSelfSignedCert({ subjectName: opts.subjectName });
+    const keyPemEncrypted = encryptKeyPem(generated.keyPem, opts.passphrase);
+    const cert = await opts.store.insert({
+        tenantId: opts.tenantId,
+        generated,
+        keyPemEncrypted,
+        rotatedFromId: existing?.id ?? null,
+    });
+    return { cert, certPem: generated.certPem, keyPem: generated.keyPem };
+}
+//# sourceMappingURL=cert-lifecycle.js.map

package/dist/cert-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-lifecycle.js","sourceRoot":"","sources":["../src/cert-lifecycle.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,+DAA+D;AAE/D,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAC;AAU1B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAOtC;IACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC/C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS;QACT,eAAe;QACf,aAAa,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { PemSigner, type PemSignerInput } from "./pem-signer.js";
+export { generateSelfSignedCert, encryptKeyPem, decryptKeyPem, type GenerateCertOptions, type GeneratedCert, } from "./cert-issuer.js";
+export { renderHtmlToPdf, type RenderHtmlToPdfOptions } from "./render-pdf.js";
+export { signPdf, type SignPdfInput, type SignPdfResult } from "./sign-pdf.js";
+export { verifyPdfStructure, verifyPdfSignature, type VerifyResult } from "./verify-pdf.js";
+export { buildTimeStampReq, parseTimeStampResp, parseTstInfo, OID_TIMESTAMP_TOKEN, } from "./timestamp.js";
+export type { Signer, SigningCertPem, SignedPdfMetadata, TsaTransport, } from "./types.js";
+export type { StoredCert, CertStore, AuditLogEntry, AuditLogRow, AuditLogStore, EsigAuditAction, PdfStorageStore, } from "./adapters.js";
+export { ensureActiveCert, type EnsureCertResult } from "./cert-lifecycle.js";
+export { signDocument, type SignDocumentInput, type SignDocumentResult, } from "./sign-document.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,UAAU,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,21 @@
+// @e-sig/core
+//
+// Portable, self-contained PDF e-signature engine. Zero database / storage /
+// auth / framework assumptions: render HTML→PDF, issue a self-signed org cert,
+// PKCS#7-detached sign (optional RFC-3161 TSA → CAdES-T), verify.
+//
+// - Bring-your-own persistence via the CertStore / AuditLogStore / PdfStorageStore
+//   interfaces (./adapters). A Supabase reference impl ships as @e-sig/supabase.
+// - `signDocument()` is the optional end-to-end orchestrator over those stores.
+// ---- Crypto primitives ----
+export { PemSigner } from "./pem-signer.js";
+export { generateSelfSignedCert, encryptKeyPem, decryptKeyPem, } from "./cert-issuer.js";
+export { renderHtmlToPdf } from "./render-pdf.js";
+export { signPdf } from "./sign-pdf.js";
+export { verifyPdfStructure, verifyPdfSignature } from "./verify-pdf.js";
+export { buildTimeStampReq, parseTimeStampResp, parseTstInfo, OID_TIMESTAMP_TOKEN, } from "./timestamp.js";
+// ---- Cert lifecycle (stack-agnostic; interface-only) ----
+export { ensureActiveCert } from "./cert-lifecycle.js";
+// ---- End-to-end orchestrator ----
+export { signDocument, } from "./sign-document.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,iFAAiF;AACjF,gFAAgF;AAEhF,8BAA8B;AAC9B,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAyC,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAmBxB,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAE9E,oCAAoC;AACpC,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC"}

package/dist/pem-signer.d.ts

@@ -0,0 +1,42 @@
+import { Signer } from "@signpdf/utils";
+import type { TsaTransport } from "./types.js";
+export interface PemSignerInput {
+    keyPem: string;
+    certPem: string;
+    /**
+     * Optional RFC 3161 timestamp transport. When provided, each produced
+     * signature is upgraded from CAdES-B to CAdES-T by embedding a
+     * TimeStampToken. The caller injects the network POST so this package never
+     * performs egress (the TSA only ever receives a SHA-256 hash, never PHI).
+     */
+    tsa?: TsaTransport;
+    /**
+     * Strict PAdES baseline (ETSI EN 319 142-1) mode. When true, the CMS
+     * `signing-time` signed attribute is removed (PAdES requires the claimed time
+     * to live in the signature dictionary /M entry, not the CMS). Default false
+     * keeps `signing-time` for backward compatibility with existing deployments;
+     * the ESS `signing-certificate-v2` attribute is added in BOTH modes.
+     */
+    padesStrict?: boolean;
+}
+export declare class PemSigner extends Signer {
+    private privateKey;
+    private certificate;
+    private tsa?;
+    private padesStrict;
+    /** True after the most recent sign() embedded a TimeStampToken (CAdES-T). */
+    lastTimestamped: boolean;
+    /** Set when a non-required TSA call failed (signature falls back to CAdES-B). */
+    lastTsaError?: string;
+    constructor({ keyPem, certPem, tsa, padesStrict }: PemSignerInput);
+    sign(pdfBuffer: Buffer, signingTime?: Date): Promise<Buffer>;
+    /**
+     * Insert the ESS signing-certificate-v2 signed attribute into the first
+     * SignerInfo's signed-attributes set and recompute the RSA signature over the
+     * modified set. In `padesStrict` mode the PAdES-forbidden signing-time
+     * attribute is also removed. Returns the new signatureValue (forge binary
+     * string) so the caller can timestamp the FINAL signature.
+     */
+    private addSigningCertV2AndResign;
+}
+//# sourceMappingURL=pem-signer.d.ts.map

package/dist/pem-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pem-signer.d.ts","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,MAAM,EAAgB,MAAM,gBAAgB,CAAC;AAStD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAS/C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,SAAU,SAAQ,MAAM;IACnC,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,GAAG,CAAC,CAAe;IAC3B,OAAO,CAAC,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,UAAS;IAC/B,iFAAiF;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEjB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,cAAc;IAc3D,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IA2ElE;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;CAwClC"}

package/dist/pem-signer.js

@@ -0,0 +1,276 @@
+// src/lib/integrations/esig/core/pem-signer.ts
+//
+// Portable PKCS#7 signer for @signpdf/signpdf, driven by raw PEM input.
+//
+// Drops the PKCS#12 round-trip (broken in node-forge — see Phase 19 spike
+// bug notes) by taking PEM key + cert and using forge.pkcs7.createSignedData
+// directly. Project-agnostic: no DB, no storage, no project-specific assumptions.
+//
+// RFC 3161 (CAdES-T): when a TsaTransport is supplied, after signing we request
+// a TimeStampToken over the SignerInfo signatureValue (encryptedDigest) and
+// splice it into the SignerInfo as the id-aa-timeStampToken UNSIGNED attribute.
+// The token is added by walking the DER and appending a hand-built [1] node to
+// the SignerInfo SEQUENCE — we do NOT use forge's unauthenticatedAttributes
+// auto-serialization, which is broken in 1.4.0 (a `.values` vs `.value` bug in
+// the per-attribute path emits a malformed [1]).
+//
+// @signpdf/signpdf calls `signer.sign(pdfBuffer, signingTime)` (two args, and
+// it awaits the result), so the TSA transport is supplied via the constructor,
+// not per-call.
+import forge from "node-forge";
+import { Signer, SignPdfError } from "@signpdf/utils";
+import { buildTimeStampReq, parseTimeStampResp, derStringToUint8, uint8ToDerString, OID_TIMESTAMP_TOKEN, } from "./timestamp.js";
+const asn1 = forge.asn1;
+/** id-aa-signingCertificateV2 (ESS, RFC 5035) — binds the signer cert into the signed data. */
+const OID_SIGNING_CERT_V2 = "1.2.840.113549.1.9.16.2.47";
+/** id-signingTime (PKCS#9) — PAdES forbids this signed attribute (time belongs in /M). */
+const OID_SIGNING_TIME = "1.2.840.113549.1.9.5";
+export class PemSigner extends Signer {
+    privateKey;
+    certificate;
+    tsa;
+    padesStrict;
+    /** True after the most recent sign() embedded a TimeStampToken (CAdES-T). */
+    lastTimestamped = false;
+    /** Set when a non-required TSA call failed (signature falls back to CAdES-B). */
+    lastTsaError;
+    constructor({ keyPem, certPem, tsa, padesStrict }) {
+        super();
+        if (!keyPem.includes("-----BEGIN")) {
+            throw new Error("PemSigner: keyPem must be PEM-encoded");
+        }
+        if (!certPem.includes("-----BEGIN CERTIFICATE-----")) {
+            throw new Error("PemSigner: certPem must be a PEM-encoded X.509 certificate");
+        }
+        this.privateKey = forge.pki.privateKeyFromPem(keyPem);
+        this.certificate = forge.pki.certificateFromPem(certPem);
+        this.tsa = tsa;
+        this.padesStrict = padesStrict ?? false;
+    }
+    async sign(pdfBuffer, signingTime) {
+        if (!Buffer.isBuffer(pdfBuffer)) {
+            throw new SignPdfError("PDF expected as Buffer.", SignPdfError.TYPE_INPUT);
+        }
+        // Reset per-call timestamp state (signpdf calls sign() once per signature).
+        this.lastTimestamped = false;
+        this.lastTsaError = undefined;
+        const p7 = forge.pkcs7.createSignedData();
+        p7.content = forge.util.createBuffer(pdfBuffer.toString("binary"));
+        p7.addCertificate(this.certificate);
+        p7.addSigner({
+            key: this.privateKey,
+            certificate: this.certificate,
+            digestAlgorithm: forge.pki.oids.sha256,
+            authenticatedAttributes: [
+                { type: forge.pki.oids.contentType, value: forge.pki.oids.data },
+                // @types/node-forge declares value as string but the runtime accepts
+                // and prefers a Date — matches the official forge.pkcs7 docs.
+                { type: forge.pki.oids.signingTime, value: (signingTime ?? new Date()) },
+                { type: forge.pki.oids.messageDigest },
+            ],
+        });
+        p7.sign({ detached: true });
+        // Add the ESS signing-certificate-v2 signed attribute (binds THIS cert into
+        // the signed data — required for PAdES/CAdES baseline) and re-sign the
+        // modified signed-attributes set. forge cannot encode this attribute in its
+        // authenticatedAttributes list, so we splice it in and recompute the RSA
+        // signature over the exact bytes. Returns the NEW signatureValue.
+        const p7Asn1 = p7.toAsn1();
+        const sigValue = this.addSigningCertV2AndResign(p7Asn1);
+        // No timestamp requested → CAdES-B (now cert-bound).
+        if (!this.tsa) {
+            return Buffer.from(forge.asn1.toDer(p7Asn1).getBytes(), "binary");
+        }
+        // CAdES-T: request a TimeStampToken over the (final) SignerInfo signatureValue.
+        try {
+            const reqDer = buildTimeStampReq(sigValue);
+            const respBytes = await this.tsa.fetch(derStringToUint8(reqDer));
+            const { token } = parseTimeStampResp(uint8ToDerString(respBytes));
+            // Attribute ::= SEQUENCE { attrType OID, attrValues SET OF AttributeValue }
+            const attrSeq = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [
+                asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false, asn1.oidToDer(OID_TIMESTAMP_TOKEN).getBytes()),
+                asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SET, true, [token]),
+            ]);
+            // unsignedAttrs ::= [1] IMPLICIT SET OF Attribute
+            const unsignedAttrs = asn1.create(asn1.Class.CONTEXT_SPECIFIC, 1, true, [attrSeq]);
+            // Splice via DER-walk (NOT forge unauthenticatedAttributes, which is
+            // broken in 1.4.0). Append the [1] node to the first SignerInfo SEQUENCE.
+            spliceUnsignedAttrs(p7Asn1, unsignedAttrs);
+            this.lastTimestamped = true;
+        }
+        catch (e) {
+            if (this.tsa.required) {
+                throw e;
+            }
+            // Non-required: degrade gracefully to CAdES-B.
+            this.lastTimestamped = false;
+            this.lastTsaError = String(e);
+        }
+        return Buffer.from(forge.asn1.toDer(p7Asn1).getBytes(), "binary");
+    }
+    /**
+     * Insert the ESS signing-certificate-v2 signed attribute into the first
+     * SignerInfo's signed-attributes set and recompute the RSA signature over the
+     * modified set. In `padesStrict` mode the PAdES-forbidden signing-time
+     * attribute is also removed. Returns the new signatureValue (forge binary
+     * string) so the caller can timestamp the FINAL signature.
+     */
+    addSigningCertV2AndResign(p7Asn1) {
+        const signerInfo = firstSignerInfoSeq(p7Asn1);
+        const siChildren = signerInfo.value;
+        // signedAttrs = the [0] IMPLICIT context node; encryptedDigest = the
+        // UNIVERSAL OCTET STRING (the signature to overwrite).
+        let signedAttrs;
+        let sigOctet;
+        for (const child of siChildren) {
+            if (child.tagClass === asn1.Class.CONTEXT_SPECIFIC && child.type === 0) {
+                signedAttrs = child;
+            }
+            if (child.tagClass === asn1.Class.UNIVERSAL && child.type === asn1.Type.OCTETSTRING) {
+                sigOctet = child;
+            }
+        }
+        if (!signedAttrs || !Array.isArray(signedAttrs.value) || !sigOctet) {
+            throw new Error("PemSigner: could not locate signed attributes to add signing-certificate-v2");
+        }
+        let attrs = signedAttrs.value;
+        if (this.padesStrict) {
+            attrs = attrs.filter((a) => {
+                const oidNode = Array.isArray(a.value) ? a.value[0] : undefined;
+                return !(oidNode && oidNode.type === asn1.Type.OID && safeOid(oidNode.value) === OID_SIGNING_TIME);
+            });
+        }
+        attrs.push(buildSigningCertV2Attr(this.certificate));
+        signedAttrs.value = attrs;
+        // Re-sign: RSA over DER(signedAttrs re-tagged as SET OF), SHA-256.
+        const setDer = asn1.toDer(asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SET, true, attrs)).getBytes();
+        const md = forge.md.sha256.create();
+        md.update(setDer);
+        const newSig = this.privateKey.sign(md); // RSASSA-PKCS1-V1_5 (forge default)
+        sigOctet.value = newSig;
+        return newSig;
+    }
+}
+/**
+ * Build the ESS signing-certificate-v2 signed attribute (RFC 5035) binding the
+ * signer certificate into the signed data:
+ *   Attribute { OID id-aa-signingCertificateV2, SET { SigningCertificateV2 } }
+ *   SigningCertificateV2 ::= SEQUENCE { certs SEQUENCE OF ESSCertIDv2 }
+ *   ESSCertIDv2 ::= SEQUENCE { certHash OCTET STRING, issuerSerial IssuerSerial }
+ * hashAlgorithm defaults to SHA-256 and is omitted (DEFAULT).
+ */
+function buildSigningCertV2Attr(cert) {
+    const certDer = asn1.toDer(forge.pki.certificateToAsn1(cert)).getBytes();
+    const md = forge.md.sha256.create();
+    md.update(certDer);
+    const certHash = md.digest().getBytes();
+    // IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber INTEGER }
+    const issuerName = forge.pki.distinguishedNameToAsn1(cert.issuer);
+    const generalName = asn1.create(asn1.Class.CONTEXT_SPECIFIC, 4, true, [issuerName]); // directoryName [4]
+    const generalNames = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [generalName]);
+    let serialBytes = forge.util.hexToBytes(cert.serialNumber);
+    if (serialBytes.length > 0 && (serialBytes.charCodeAt(0) & 0x80) !== 0) {
+        serialBytes = "\x00" + serialBytes; // keep the INTEGER positive
+    }
+    const serial = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, serialBytes);
+    const issuerSerial = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [generalNames, serial]);
+    const essCertId = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [
+        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false, certHash),
+        issuerSerial,
+    ]);
+    const certsSeq = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [essCertId]);
+    const signingCertV2 = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [certsSeq]);
+    return asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [
+        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false, asn1.oidToDer(OID_SIGNING_CERT_V2).getBytes()),
+        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SET, true, [signingCertV2]),
+    ]);
+}
+/** OID decode that never throws (returns "" on malformed input). */
+function safeOid(der) {
+    try {
+        return asn1.derToOid(der);
+    }
+    catch {
+        return "";
+    }
+}
+/** Locate the first SignerInfo SEQUENCE inside a PKCS#7 SignedData ASN.1 tree. */
+function firstSignerInfoSeq(contentInfo) {
+    if (!Array.isArray(contentInfo.value)) {
+        throw new Error("PemSigner: ContentInfo has no children");
+    }
+    let signedData;
+    for (const child of contentInfo.value) {
+        if (child.tagClass === asn1.Class.CONTEXT_SPECIFIC && Array.isArray(child.value)) {
+            signedData = child.value[0];
+        }
+    }
+    if (!signedData || !Array.isArray(signedData.value)) {
+        throw new Error("PemSigner: SignedData not found");
+    }
+    let signerInfos;
+    for (const child of signedData.value) {
+        if (child.tagClass === asn1.Class.UNIVERSAL && child.type === asn1.Type.SET && Array.isArray(child.value)) {
+            signerInfos = child; // last UNIVERSAL SET = signerInfos
+        }
+    }
+    if (!signerInfos || !Array.isArray(signerInfos.value) || signerInfos.value.length === 0) {
+        throw new Error("PemSigner: signerInfos SET not found");
+    }
+    const si = signerInfos.value[0];
+    if (!Array.isArray(si.value)) {
+        throw new Error("PemSigner: SignerInfo SEQUENCE malformed");
+    }
+    return si;
+}
+/**
+ * Locate the (first) SignerInfo SEQUENCE inside a PKCS#7 SignedData ASN.1 tree
+ * and append the supplied unsigned-attributes [1] node to it.
+ *
+ *   ContentInfo ::= SEQUENCE { contentType OID, content [0] EXPLICIT SignedData }
+ *   SignedData ::= SEQUENCE { version, digestAlgorithms SET, encapContentInfo,
+ *                             certificates [0] IMPLICIT OPTIONAL,
+ *                             crls [1] IMPLICIT OPTIONAL,
+ *                             signerInfos SET OF SignerInfo }
+ *   SignerInfo ::= SEQUENCE { version, sid, digestAlgorithm,
+ *                             signedAttrs [0] IMPLICIT OPTIONAL,
+ *                             signatureAlgorithm, signature,
+ *                             unsignedAttrs [1] IMPLICIT OPTIONAL }
+ *
+ * signerInfos is the last UNIVERSAL SET among SignedData's children (the first
+ * SET is digestAlgorithms). We append the unsigned attrs as the final child of
+ * the first SignerInfo SEQUENCE.
+ */
+function spliceUnsignedAttrs(contentInfo, unsignedAttrs) {
+    if (!Array.isArray(contentInfo.value)) {
+        throw new Error("RFC3161 splice: ContentInfo has no children");
+    }
+    // content [0] EXPLICIT → SignedData SEQUENCE
+    let signedData;
+    for (const child of contentInfo.value) {
+        if (child.tagClass === asn1.Class.CONTEXT_SPECIFIC && Array.isArray(child.value)) {
+            signedData = child.value[0];
+        }
+    }
+    if (!signedData || !Array.isArray(signedData.value)) {
+        throw new Error("RFC3161 splice: SignedData not found");
+    }
+    // signerInfos = the last UNIVERSAL SET among SignedData children.
+    let signerInfos;
+    for (const child of signedData.value) {
+        if (child.tagClass === asn1.Class.UNIVERSAL &&
+            child.type === asn1.Type.SET &&
+            Array.isArray(child.value)) {
+            signerInfos = child; // keep the last one encountered
+        }
+    }
+    if (!signerInfos || !Array.isArray(signerInfos.value) || signerInfos.value.length === 0) {
+        throw new Error("RFC3161 splice: signerInfos SET not found");
+    }
+    const signerInfo = signerInfos.value[0];
+    if (!Array.isArray(signerInfo.value)) {
+        throw new Error("RFC3161 splice: SignerInfo SEQUENCE malformed");
+    }
+    signerInfo.value.push(unsignedAttrs);
+}
+//# sourceMappingURL=pem-signer.js.map

package/dist/pem-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pem-signer.js","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,gBAAgB;AAEhB,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAExB,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AACzD,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAsBhD,MAAM,OAAO,SAAU,SAAQ,MAAM;IAC3B,UAAU,CAA2B;IACrC,WAAW,CAAwB;IACnC,GAAG,CAAgB;IACnB,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,GAAG,KAAK,CAAC;IAC/B,iFAAiF;IAC1E,YAAY,CAAU;IAE7B,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAkB;QAC/D,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAA6B,CAAC;QAClF,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,WAAkB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAE9B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC1C,EAAE,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC;YACX,GAAG,EAAE,IAAI,CAAC,UAAU;YACpB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM;YACtC,uBAAuB,EAAE;gBACvB,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;gBAChE,qEAAqE;gBACrE,8DAA8D;gBAC9D,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAsB,EAAE;gBAC7F,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;aACvC;SACF,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5B,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAExD,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpE,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;YAElE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAC1E,IAAI,CAAC,MAAM,CACT,IAAI,CAAC,KAAK,CAAC,SAAS,EACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EACb,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAC9C;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC;YAEH,kDAAkD;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,qEAAqE;YACrE,0EAA0E;YAC1E,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAE3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,CAAC,CAAC;YACV,CAAC;YACD,+CAA+C;YAC/C,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;YAC7B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACK,yBAAyB,CAAC,MAAuB;QACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,KAA0B,CAAC;QAEzD,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,WAAwC,CAAC;QAC7C,IAAI,QAAqC,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACvE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpF,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,KAAK,GAAG,WAAW,CAAC,KAA0B,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrF,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAe,CAAC,KAAK,gBAAgB,CAAC,CAAC;YAC/G,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;QAE1B,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC;QAC7E,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;IAExC,0EAA0E;IAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB;IACzG,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAChG,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,WAAW,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC,4BAA4B;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzG,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC;QACzE,YAAY;KACb,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9F,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,WAA4B;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1G,WAAW,GAAG,KAAK,CAAC,CAAC,mCAAmC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,mBAAmB,CAC1B,WAA4B,EAC5B,aAA8B;IAE9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,6CAA6C;IAC7C,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YACvC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;YACD,WAAW,GAAG,KAAK,CAAC,CAAC,gCAAgC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAEA,UAAU,CAAC,KAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC9D,CAAC"}

package/dist/render-pdf.d.ts

@@ -0,0 +1,33 @@
+import { type PaperFormat } from "puppeteer-core";
+export interface RenderHtmlToPdfOptions {
+    html: string;
+    format?: PaperFormat;
+    margin?: {
+        top?: string;
+        bottom?: string;
+        left?: string;
+        right?: string;
+    };
+    printBackground?: boolean;
+    /**
+     * Override the chromium executable path. If omitted:
+     *   - on Vercel / AWS Lambda: load @sparticuz/chromium
+     *   - on macOS: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
+     *   - on Linux: try common google-chrome / chromium paths
+     * Set this when porting to an environment outside that matrix.
+     */
+    executablePath?: string;
+    /** Override puppeteer launch args. Default: --no-sandbox --disable-setuid-sandbox. */
+    launchArgs?: string[];
+    /**
+     * Enable JavaScript execution in the rendered document. Default FALSE:
+     * document templates are static HTML, and executing untrusted/interpolated
+     * HTML with JS enabled is an SSRF / data-exfiltration surface. Set true only
+     * if your templates genuinely need in-page scripting.
+     */
+    javascriptEnabled?: boolean;
+    /** Max ms to wait for content + subresources to load. Default 30000. */
+    timeoutMs?: number;
+}
+export declare function renderHtmlToPdf(opts: RenderHtmlToPdfOptions): Promise<Buffer>;
+//# sourceMappingURL=render-pdf.d.ts.map

package/dist/render-pdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-pdf.d.ts","sourceRoot":"","sources":["../src/render-pdf.ts"],"names":[],"mappings":"AAMA,OAAkB,EAAgB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE3E,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAuCD,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwCnF"}