@e-sig/core 0.5.1 → 0.7.0

package/dist/pq-verify.js

@@ -0,0 +1,135 @@
+// pq-verify.ts
+//
+// Verify the post-quantum hybrid seal embedded in a signed PDF, and the combined
+// classical + post-quantum trust result — the "two-line" answer the product
+// pitch leans on:
+//
+//   classical (PAdES / PKCS#7 RSA): VALID  — every PDF reader, incl. Acrobat
+//   post-quantum (ML-DSA-65, FIPS 204):   VALID  — quantum-resistant
+//
+// The seal binds to the document by covering SHA-256 of the first `coveredBytes`
+// bytes (P0, the pre-seal PDF). Because the seal is embedded append-only and the
+// RSA /ByteRange signature is applied on top, tampering with the document breaks
+// BOTH the classical signature AND the post-quantum digest.
+import crypto from "node:crypto";
+import { verifyPdfSignature } from "./verify-pdf.js";
+import { verifyPqSealSignatures } from "./pq-seal.js";
+import { extractPqSeal } from "./pq-embed.js";
+import { certMatchesPqSeal } from "./pq-cert.js";
+/**
+ * Verify the embedded post-quantum seal against the document bytes. Never throws;
+ * a missing or malformed seal returns `{ present:false, ok:false }`. Pass
+ * `expectedMldsa65Fpr` to also pin the signer identity.
+ */
+export function verifyPqSeal(pdf, opts = {}) {
+    const failures = [];
+    const seal = extractPqSeal(pdf);
+    if (!seal) {
+        return { present: false, ok: false, failures: ["no post-quantum seal found"] };
+    }
+    const verdict = {
+        present: true,
+        ok: false,
+        alg: seal.alg,
+        keyId: seal.keyId,
+        mldsa65Fpr: seal.keys?.mldsa65Fpr,
+        signedAt: seal.signedAt,
+        coveredBytes: seal.coveredBytes,
+        uuaid: seal.uuaid,
+        failures,
+    };
+    // (1) Document binding: the seal must cover a real, in-bounds prefix.
+    const covered = seal.coveredBytes;
+    let digestBinds = false;
+    if (!Number.isInteger(covered) || covered <= 0 || covered > pdf.length) {
+        failures.push(`seal coveredBytes (${covered}) is out of range for a ${pdf.length}-byte file`);
+    }
+    else {
+        const recomputed = crypto.createHash("sha256").update(pdf.subarray(0, covered)).digest("hex");
+        digestBinds = recomputed === seal.digest;
+        if (!digestBinds) {
+            failures.push("post-quantum digest does not match the document — content altered");
+        }
+    }
+    verdict.digestBinds = digestBinds;
+    // (2) Signatures: both classical Ed25519 and post-quantum ML-DSA-65 must verify.
+    const sigs = verifyPqSealSignatures(seal);
+    verdict.ed25519 = sigs.ed25519;
+    verdict.mldsa65 = sigs.mldsa65;
+    verdict.fingerprintOk = sigs.fingerprintOk;
+    if (!sigs.ed25519)
+        failures.push("Ed25519 seal signature invalid");
+    if (!sigs.mldsa65)
+        failures.push("ML-DSA-65 seal signature invalid");
+    if (!sigs.fingerprintOk)
+        failures.push("ML-DSA-65 fingerprint inconsistent with its public key");
+    if (!sigs.keyIdOk)
+        failures.push("seal keyId inconsistent with its public keys");
+    if (!sigs.uuaidOk)
+        failures.push("seal carries a malformed UUAID assertion");
+    // (3) Optional identity pinning (in-band TOFU assertion).
+    let identityOk = true;
+    if (opts.expectedMldsa65Fpr) {
+        identityOk = (verdict.mldsa65Fpr ?? "").toLowerCase() === opts.expectedMldsa65Fpr.toLowerCase();
+        if (!identityOk) {
+            failures.push("post-quantum signer fingerprint does not match the expected (pinned) identity");
+        }
+    }
+    // (3b) Optional UUAID assertion pinning (IAASO-0004). Pins what the seal
+    // CLAIMS; the uuaid -> key direction is out of band, see PqSealVerdict.uuaid.
+    if (opts.expectedUuaid) {
+        const uuaidMatches = verdict.uuaid === opts.expectedUuaid;
+        verdict.uuaidMatches = uuaidMatches;
+        if (!uuaidMatches) {
+            identityOk = false;
+            failures.push(verdict.uuaid === undefined
+                ? "seal asserts no UUAID but one was expected"
+                : "seal's asserted UUAID does not match the expected (pinned) identity");
+        }
+    }
+    // (4) Optional X.509 identity: a self-signed ML-DSA-65 cert bound to this key.
+    if (opts.signerCert) {
+        const certOk = certMatchesPqSeal(opts.signerCert, seal);
+        verdict.certIdentityOk = certOk;
+        if (!certOk) {
+            identityOk = false;
+            failures.push("signer certificate is invalid or does not match the seal's post-quantum key");
+        }
+    }
+    verdict.ok = digestBinds && sigs.ok && identityOk;
+    return verdict;
+}
+/**
+ * Full document verification: classical PAdES signature + post-quantum hybrid
+ * seal. Also asserts that the seal-covered region falls within the RSA-signed
+ * prefix, so the classical signature genuinely protects the seal. Pass
+ * `requirePq` to reject unsealed documents and `expectedMldsa65Fpr` to pin the
+ * post-quantum signer.
+ */
+export function verifyDocument(pdf, opts = {}) {
+    const classical = verifyPdfSignature(pdf);
+    const postQuantum = verifyPqSeal(pdf, {
+        expectedMldsa65Fpr: opts.expectedMldsa65Fpr,
+        signerCert: opts.signerCert,
+        expectedUuaid: opts.expectedUuaid,
+    });
+    let sealWithinSignedRegion = true;
+    if (postQuantum.present && classical.byteRange && postQuantum.coveredBytes != null) {
+        const [a, b] = classical.byteRange;
+        const contentsStart = a + b; // end of the first signed chunk = start of /Contents
+        if (postQuantum.coveredBytes > contentsStart) {
+            sealWithinSignedRegion = false;
+            postQuantum.failures.push("seal covers bytes beyond the classically-signed region (not RSA-protected)");
+            postQuantum.ok = false;
+        }
+    }
+    if (opts.requirePq && !postQuantum.present) {
+        postQuantum.failures.push("post-quantum seal required but none present");
+    }
+    const pqSatisfied = postQuantum.present
+        ? postQuantum.ok && sealWithinSignedRegion
+        : !opts.requirePq;
+    const ok = classical.ok && pqSatisfied;
+    return { ok, classical, postQuantum };
+}
+//# sourceMappingURL=pq-verify.js.map

package/dist/pq-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-verify.js","sourceRoot":"","sources":["../src/pq-verify.ts"],"names":[],"mappings":"AAAA,eAAe;AACf,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,kBAAkB;AAClB,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,4DAA4D;AAE5D,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAiEjD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAA4B,EAAE;IACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAkB;QAC7B,OAAO,EAAE,IAAI;QACb,EAAE,EAAE,KAAK;QACT,GAAG,EAAG,IAAe,CAAC,GAAG;QACzB,KAAK,EAAG,IAAe,CAAC,KAAK;QAC7B,UAAU,EAAG,IAAe,CAAC,IAAI,EAAE,UAAU;QAC7C,QAAQ,EAAG,IAAe,CAAC,QAAQ;QACnC,YAAY,EAAG,IAAe,CAAC,YAAY;QAC3C,KAAK,EAAG,IAAe,CAAC,KAAK;QAC7B,QAAQ;KACT,CAAC;IAEF,sEAAsE;IACtE,MAAM,OAAO,GAAI,IAAe,CAAC,YAAY,CAAC;IAC9C,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,OAAO,2BAA2B,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9F,WAAW,GAAG,UAAU,KAAM,IAAe,CAAC,MAAM,CAAC;QACrD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;IAElC,iFAAiF;IACjF,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAc,CAAC,CAAC;IACpD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACjG,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACjF,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAE7E,0DAA0D;IAC1D,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC;QAChG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,8EAA8E;IAC9E,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC;QAC1D,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;QACpC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,KAAK,KAAK,SAAS;gBACzB,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,qEAAqE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAc,CAAC,CAAC;QAClE,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,OAAO,CAAC,EAAE,GAAG,WAAW,IAAI,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC;IAClD,OAAO,OAAO,CAAC;AACjB,CAAC;AA0BD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,OAA8B,EAAE;IAC1E,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,EAAE;QACpC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;IAEH,IAAI,sBAAsB,GAAG,IAAI,CAAC;IAClC,IAAI,WAAW,CAAC,OAAO,IAAI,SAAS,CAAC,SAAS,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QACnF,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;QACnC,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,qDAAqD;QAClF,IAAI,WAAW,CAAC,YAAY,GAAG,aAAa,EAAE,CAAC;YAC7C,sBAAsB,GAAG,KAAK,CAAC;YAC/B,WAAW,CAAC,QAAQ,CAAC,IAAI,CACvB,4EAA4E,CAC7E,CAAC;YACF,WAAW,CAAC,EAAE,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO;QACrC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,sBAAsB;QAC1C,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IAEpB,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,IAAI,WAAW,CAAC;IACvC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC"}

package/dist/render-pdf.d.ts

@@ -10,11 +10,11 @@ export interface RenderHtmlToPdfOptions {
     };
     printBackground?: boolean;
     /**
-     * Override the chromium executable path. If omitted:
-     *   - on Vercel / AWS Lambda: load @sparticuz/chromium
-     *   - on macOS: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
-     *   - on Linux: try common google-chrome / chromium paths
-     * Set this when porting to an environment outside that matrix.
+     * Override the chromium executable path. If omitted, resolution order is:
+     *   1. ESIG_CHROME_PATH / PUPPETEER_EXECUTABLE_PATH / CHROME_PATH env vars
+     *   2. on Vercel / AWS Lambda: load @sparticuz/chromium
+     *   3. platform scan: common Chrome/Chromium/Edge/Brave install locations
+     * Set this (or an env var) when porting to an environment outside that matrix.
      */
     executablePath?: string;
     /** Override puppeteer launch args. Default: --no-sandbox --disable-setuid-sandbox. */

package/dist/render-pdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-pdf.d.ts","sourceRoot":"","sources":["../src/render-pdf.ts"],"names":[],"mappings":"AAMA,OAAkB,EAAgB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE3E,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAuCD,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwCnF"}
+{"version":3,"file":"render-pdf.d.ts","sourceRoot":"","sources":["../src/render-pdf.ts"],"names":[],"mappings":"AAMA,OAAkB,EAAgB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE3E,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyED,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwCnF"}

package/dist/render-pdf.js

@@ -4,32 +4,66 @@
 // Lambda environment to use @sparticuz/chromium, falls back to system Chrome
 // for local dev.
 import puppeteer from "puppeteer-core";
+const CHROME_ENV_VARS = ["ESIG_CHROME_PATH", "PUPPETEER_EXECUTABLE_PATH", "CHROME_PATH"];
+const CHROME_CANDIDATES = {
+    darwin: [
+        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+        "/Applications/Chromium.app/Contents/MacOS/Chromium",
+        "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+        "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
+    ],
+    linux: [
+        "/usr/bin/google-chrome",
+        "/usr/bin/google-chrome-stable",
+        "/usr/bin/chromium",
+        "/usr/bin/chromium-browser",
+        "/snap/bin/chromium",
+        "/usr/bin/microsoft-edge",
+        "/usr/bin/brave-browser",
+    ],
+    win32: [
+        "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+        "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+    ],
+};
+async function isExecutable(p) {
+    try {
+        const fs = await import("node:fs");
+        // X_OK is meaningless on Windows; existence is the useful check there.
+        await fs.promises.access(p, process.platform === "win32" ? fs.constants.F_OK : fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 async function resolveExecutablePath(opts) {
     if (opts.executablePath)
         return opts.executablePath;
+    for (const envVar of CHROME_ENV_VARS) {
+        const p = process.env[envVar];
+        if (!p)
+            continue;
+        if (await isExecutable(p))
+            return p;
+        // An explicitly set env var pointing nowhere is a config error — fail loud
+        // rather than silently falling through to a different browser.
+        throw new Error(`renderHtmlToPdf: ${envVar}="${p}" is not an executable file.`);
+    }
     if (process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.VERCEL_ENV) {
         const chromium = (await import("@sparticuz/chromium")).default;
         return await chromium.executablePath();
     }
-    if (process.platform === "darwin") {
-        return "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome";
-    }
-    for (const p of [
-        "/usr/bin/google-chrome",
-        "/usr/bin/chromium",
-        "/usr/bin/chromium-browser",
-        "/snap/bin/chromium",
-    ]) {
-        try {
-            const fs = await import("node:fs");
-            await fs.promises.access(p, fs.constants.X_OK);
+    const candidates = CHROME_CANDIDATES[process.platform] ?? [];
+    for (const p of candidates) {
+        if (await isExecutable(p))
             return p;
-        }
-        catch {
-            // try next
-        }
     }
-    throw new Error("renderHtmlToPdf: no Chrome/Chromium executable found. Install Chrome or pass options.executablePath.");
+    throw new Error("renderHtmlToPdf: no Chrome/Chromium executable found. Tried:\n" +
+        candidates.map((p) => `  - ${p}`).join("\n") +
+        "\nInstall Chrome/Chromium, or point to a browser with options.executablePath " +
+        "or the ESIG_CHROME_PATH / PUPPETEER_EXECUTABLE_PATH / CHROME_PATH env var.");
 }
 async function resolveLaunchArgs(opts) {
     if (opts.launchArgs)

package/dist/render-pdf.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-pdf.js","sourceRoot":"","sources":["../src/render-pdf.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,iBAAiB;AAEjB,OAAO,SAA6C,MAAM,gBAAgB,CAAC;AA4B3E,KAAK,UAAU,qBAAqB,CAAC,IAA4B;IAC/D,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/D,OAAO,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,8DAA8D,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI;QACd,wBAAwB;QACxB,mBAAmB;QACnB,2BAA2B;QAC3B,oBAAoB;KACrB,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAA4B;IAC3D,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/D,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACzC,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,4EAA4E;QAC5E,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACd,0EAA0E;YAC1E,wEAAwE;YACxE,MAAM,IAAI;iBACP,QAAQ,CAAC,GAAG,EAAE;gBACb,MAAM,CAAC,GAAI,UAAsE,CAAC,QAAQ,CAAC;gBAC3F,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;YACzB,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI;gBACrB,GAAG,EAAE,OAAO;gBACZ,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO;aACf;YACD,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"render-pdf.js","sourceRoot":"","sources":["../src/render-pdf.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,iBAAiB;AAEjB,OAAO,SAA6C,MAAM,gBAAgB,CAAC;AA4B3E,MAAM,eAAe,GAAG,CAAC,kBAAkB,EAAE,2BAA2B,EAAE,aAAa,CAAU,CAAC;AAElG,MAAM,iBAAiB,GAA+C;IACpE,MAAM,EAAE;QACN,8DAA8D;QAC9D,oDAAoD;QACpD,gEAAgE;QAChE,8DAA8D;KAC/D;IACD,KAAK,EAAE;QACL,wBAAwB;QACxB,+BAA+B;QAC/B,mBAAmB;QACnB,2BAA2B;QAC3B,oBAAoB;QACpB,yBAAyB;QACzB,wBAAwB;KACzB;IACD,KAAK,EAAE;QACL,4DAA4D;QAC5D,kEAAkE;QAClE,mEAAmE;KACpE;CACF,CAAC;AAEF,KAAK,UAAU,YAAY,CAAC,CAAS;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,uEAAuE;QACvE,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAA4B;IAC/D,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACpC,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/D,OAAO,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gEAAgE;QAC9D,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5C,+EAA+E;QAC/E,4EAA4E,CAC/E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAA4B;IAC3D,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/D,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACzC,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,4EAA4E;QAC5E,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACd,0EAA0E;YAC1E,wEAAwE;YACxE,MAAM,IAAI;iBACP,QAAQ,CAAC,GAAG,EAAE;gBACb,MAAM,CAAC,GAAI,UAAsE,CAAC,QAAQ,CAAC;gBAC3F,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;YACzB,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI;gBACrB,GAAG,EAAE,OAAO;gBACZ,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO;aACf;YACD,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/sign-document.d.ts

@@ -1,5 +1,6 @@
 import type { CertStore, AuditLogStore, PdfStorageStore, EsigAuditAction } from "./adapters.js";
 import type { TsaTransport } from "./types.js";
+import type { PqSigningKeys } from "./pq-seal.js";
 export interface SignDocumentInput {
     /** Fully-rendered, signature-embedded HTML (the consumer composes this). */
     html: string;
@@ -30,6 +31,15 @@ export interface SignDocumentInput {
     signingTime?: Date;
     /** Optional RFC-3161 timestamp transport. Provide one to upgrade to CAdES-T. */
     tsa?: TsaTransport;
+    /**
+     * Optional post-quantum hybrid seal (Ed25519 + ML-DSA-65). Provide signing
+     * keys (e.g. from `ensureActivePqKeys` or `loadPqSigningKeys`) to embed a
+     * quantum-resistant seal covered by the classical PAdES signature.
+     */
+    pq?: {
+        keys: PqSigningKeys;
+        signedAt?: Date;
+    };
     /** Audit row fields. */
     action?: EsigAuditAction | string;
     targetTable?: string;
@@ -49,6 +59,12 @@ export interface SignDocumentResult {
     /** True when an RFC-3161 token was embedded (CAdES-T); false = CAdES-B. */
     timestamped: boolean;
     tsaError?: string;
+    /** True when a post-quantum hybrid seal (ML-DSA-65) was embedded. */
+    pqSealed: boolean;
+    /** Seal keyId, when post-quantum sealed. */
+    pqKeyId?: string;
+    /** ML-DSA-65 public-key fingerprint, when post-quantum sealed. */
+    pqMldsa65Fpr?: string;
 }
 export declare function signDocument(input: SignDocumentInput): Promise<SignDocumentResult>;
 //# sourceMappingURL=sign-document.d.ts.map

package/dist/sign-document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign-document.d.ts","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,eAAe,EACf,eAAe,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAE5D,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,aAAa,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;IAEzB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IAEnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,gFAAgF;IAChF,GAAG,CAAC,EAAE,YAAY,CAAC;IAEnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAmF7B"}
+{"version":3,"file":"sign-document.d.ts","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,eAAe,EACf,eAAe,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAE5D,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,aAAa,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;IAEzB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IAEnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,gFAAgF;IAChF,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;OAIG;IACH,EAAE,CAAC,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC;IAE9C,wBAAwB;IACxB,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,QAAQ,EAAE,OAAO,CAAC;IAClB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CA6F7B"}

package/dist/sign-document.js

@@ -35,6 +35,7 @@ export async function signDocument(input) {
         name: input.signer.name,
         signingTime: signedAt,
         tsa: input.tsa,
+        pqSeal: input.pq ? { keys: input.pq.keys, signedAt: input.pq.signedAt ?? signedAt } : undefined,
     });
     // 4. Persist the signed PDF (+ optional signature image).
     const tsKey = signedAt.toISOString().replace(/[:.]/g, "-");
@@ -78,6 +79,12 @@ export async function signDocument(input) {
                 degraded: !!input.tsa && !r.timestamped,
                 error: r.tsaError ?? null,
             },
+            post_quantum: {
+                sealed: r.pqSealed,
+                ...(r.pqSealed
+                    ? { alg: "hybrid-ed25519-ml-dsa-65", key_id: r.pqKeyId, mldsa65_fpr: r.pqMldsa65Fpr }
+                    : {}),
+            },
         },
     });
     return {
@@ -88,6 +95,9 @@ export async function signDocument(input) {
         certFingerprint: cert.cert.certFingerprint,
         timestamped: r.timestamped,
         tsaError: r.tsaError,
+        pqSealed: r.pqSealed,
+        pqKeyId: r.pqKeyId,
+        pqMldsa65Fpr: r.pqMldsa65Fpr,
     };
 }
 //# sourceMappingURL=sign-document.js.map

package/dist/sign-document.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-document.js","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAAA,mBAAmB;AACnB,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA6DvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAwB;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;IAEjD,0BAA0B;IAC1B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;QACtB,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qBAAqB;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,QAAQ;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,CAAC,SAAS;QAClB,WAAW,EAAE,iBAAiB;KAC/B,CAAC,CAAC;IAEH,IAAI,iBAAqC,CAAC;IAC1C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,gBAAgB,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACvC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;YACjC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;SAC9C,CAAC,CAAC;QACH,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,YAAY;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,QAAQ,EAAE;YACR,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;YACzB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,SAAS,EAAE;gBACT,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG;gBACtB,OAAO,EAAE,CAAC,CAAC,WAAW;gBACtB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW;gBACvC,KAAK,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;aAC1B;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,iBAAiB;QACjB,UAAU,EAAE,KAAK,CAAC,EAAE;QACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sign-document.js","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAAA,mBAAmB;AACnB,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA0EvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAwB;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;IAEjD,0BAA0B;IAC1B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;QACtB,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qBAAqB;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,QAAQ;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;KAChG,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,CAAC,SAAS;QAClB,WAAW,EAAE,iBAAiB;KAC/B,CAAC,CAAC;IAEH,IAAI,iBAAqC,CAAC;IAC1C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,gBAAgB,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACvC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;YACjC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;SAC9C,CAAC,CAAC;QACH,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,YAAY;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,QAAQ,EAAE;YACR,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;YACzB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,SAAS,EAAE;gBACT,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG;gBACtB,OAAO,EAAE,CAAC,CAAC,WAAW;gBACtB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW;gBACvC,KAAK,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;aAC1B;YACD,YAAY,EAAE;gBACZ,MAAM,EAAE,CAAC,CAAC,QAAQ;gBAClB,GAAG,CAAC,CAAC,CAAC,QAAQ;oBACZ,CAAC,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE;oBACrF,CAAC,CAAC,EAAE,CAAC;aACR;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,iBAAiB;QACjB,UAAU,EAAE,KAAK,CAAC,EAAE;QACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;KAC7B,CAAC;AACJ,CAAC"}

package/dist/sign-pdf.d.ts

@@ -1,8 +1,35 @@
-import type { TsaTransport } from "./types.js";
+import type { ExternalSigner, TsaTransport } from "./types.js";
+import { type PqSigningKeys } from "./pq-seal.js";
+/**
+ * The /SubFilter values `signPdf` can emit. Both denote a detached PKCS#7,
+ * which is what `PemSigner` produces; the legacy `adbe.pkcs7.sha1` /
+ * `adbe.x509.rsa.sha1` forms are deliberately absent because this signer
+ * cannot produce them.
+ */
+export declare const SUPPORTED_SUBFILTERS: readonly ["ETSI.CAdES.detached", "adbe.pkcs7.detached"];
+export type SubFilter = (typeof SUPPORTED_SUBFILTERS)[number];
 export interface SignPdfInput {
     pdf: Buffer;
-    keyPem: string;
-    certPem: string;
+    /**
+     * PEM-encoded RSA private key (in-memory signing). Required unless
+     * `externalSigner` is provided — the two are mutually exclusive.
+     */
+    keyPem?: string;
+    /**
+     * PEM-encoded X.509 certificate. Required with `keyPem`; with
+     * `externalSigner` it defaults to `externalSigner.certificatePem`.
+     */
+    certPem?: string;
+    /**
+     * External signing seam (HSM / KMS): the RSA private key stays outside this
+     * process and the PKCS#7 signature is produced by
+     * `externalSigner.signRsaSha256` (sync or async — RSASSA-PKCS1-v1_5/SHA-256
+     * over raw bytes, e.g. PKCS#11 CKM_SHA256_RSA_PKCS). Mutually exclusive with
+     * `keyPem`. Output is byte-identical to the `keyPem` path for the same key.
+     * See `ExternalSigner` in types.ts; a PKCS#11 adapter ships as
+     * `@e-sig/hsm-pkcs11`.
+     */
+    externalSigner?: ExternalSigner;
     reason: string;
     location: string;
     contactInfo: string;
@@ -17,8 +44,14 @@ export interface SignPdfInput {
     /**
      * Subfilter. Default ETSI.CAdES.detached (PAdES B-B baseline). Override
      * to adbe.pkcs7.detached for legacy Adobe Reader 9+ compatibility.
+     *
+     * Restricted to the two values this signer can actually produce — a
+     * detached PKCS#7. Anything else is rejected: /SubFilter is written into
+     * the signature dictionary as a PDF name, so an unvalidated value is a
+     * dictionary-injection vector for any caller that feeds this from user or
+     * tenant input. (Defence in depth — the serializer now escapes names too.)
      */
-    subFilter?: string;
+    subFilter?: SubFilter;
     /**
      * Optional RFC 3161 timestamp transport. When provided, the signature is
      * upgraded to CAdES-T and the default `signatureLength` rises to 30720. The
@@ -33,6 +66,27 @@ export interface SignPdfInput {
      * (keeps `signing-time` for backward compatibility).
      */
     padesStrict?: boolean;
+    /**
+     * Optional post-quantum hybrid seal (Ed25519 + ML-DSA-65, FIPS 204). When
+     * provided, a seal over SHA-256 of the pre-signature PDF is embedded FIRST (an
+     * append-only incremental update), so the classical RSA /ByteRange signature
+     * applied on top cryptographically covers it. The classical signature remains
+     * valid in every PDF reader; the seal is the quantum-resistant layer, verified
+     * by `verifyPqSeal` / `verifyDocument`.
+     */
+    pqSeal?: {
+        /** Hybrid signing keys (see generatePqKeyBundle / loadPqSigningKeys). */
+        keys: PqSigningKeys;
+        /** Seal timestamp. Defaults to `signingTime` or now. */
+        signedAt?: Date;
+        /**
+         * Optional UUAID this signer asserts as its identity (IAASO-0004
+         * attribution). Signed into the seal, so it is immutable once embedded —
+         * but it is a claim by the seal key, not proof of identity. Omit to produce
+         * a seal byte-identical to pre-`uuaid` output.
+         */
+        uuaid?: string;
+    };
 }
 export interface SignPdfResult {
     signedPdf: Buffer;
@@ -41,6 +95,14 @@ export interface SignPdfResult {
     timestamped: boolean;
     /** Present when a non-required TSA request failed (signature is CAdES-B). */
     tsaError?: string;
+    /** True when a post-quantum hybrid seal was embedded (and is RSA-covered). */
+    pqSealed: boolean;
+    /** Seal keyId (128-bit hex over both public keys), when sealed. */
+    pqKeyId?: string;
+    /** ML-DSA-65 public-key fingerprint (SHA-256 hex), when sealed. */
+    pqMldsa65Fpr?: string;
+    /** The UUAID asserted in the seal, when one was supplied. */
+    pqUuaid?: string;
 }
 export declare function signPdf(input: SignPdfInput): Promise<SignPdfResult>;
 //# sourceMappingURL=sign-pdf.d.ts.map

package/dist/sign-pdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign-pdf.d.ts","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAW/C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAyCzE"}
+{"version":3,"file":"sign-pdf.d.ts","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAsC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAYtF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yDAA0D,CAAC;AAE5F,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACP,yEAAyE;QACzE,IAAI,EAAE,aAAa,CAAC;QACpB,wDAAwD;QACxD,QAAQ,CAAC,EAAE,IAAI,CAAC;QAChB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAsFzE"}

package/dist/sign-pdf.js

@@ -7,10 +7,13 @@
 // TSA is supplied the default /Contents budget is raised to fit the TST + TSA
 // cert chain, and an overflow guard rejects a result whose PKCS#7 exceeded the
 // placeholder (which @signpdf would otherwise silently truncate).
+import crypto from "node:crypto";
 import { SignPdf } from "@signpdf/signpdf";
-import { plainAddPlaceholder } from "@signpdf/placeholder-plain";
+import { plainAddPlaceholder } from "./vendor/placeholder-plain/index.js";
 import { PemSigner } from "./pem-signer.js";
 import { verifyPdfStructure } from "./verify-pdf.js";
+import { buildPqSeal, publicMaterialForKeys } from "./pq-seal.js";
+import { embedPqSeal } from "./pq-embed.js";
 /** Default /Contents budget (bytes) when no timestamp is embedded. */
 const DEFAULT_SIGNATURE_LENGTH = 8192;
 /**
@@ -19,12 +22,53 @@ const DEFAULT_SIGNATURE_LENGTH = 8192;
  * bytes ≈ 15 KB of DER headroom.
  */
 const TIMESTAMPED_SIGNATURE_LENGTH = 30720;
+/**
+ * The /SubFilter values `signPdf` can emit. Both denote a detached PKCS#7,
+ * which is what `PemSigner` produces; the legacy `adbe.pkcs7.sha1` /
+ * `adbe.x509.rsa.sha1` forms are deliberately absent because this signer
+ * cannot produce them.
+ */
+export const SUPPORTED_SUBFILTERS = ["ETSI.CAdES.detached", "adbe.pkcs7.detached"];
 const signpdfInstance = new SignPdf();
 export async function signPdf(input) {
+    if (input.externalSigner && input.keyPem) {
+        throw new Error("signPdf: pass either keyPem or externalSigner, not both");
+    }
+    if (!input.externalSigner && !input.keyPem) {
+        throw new Error("signPdf: keyPem or externalSigner is required");
+    }
+    // Runtime check, not just a type: the attack surface is JS callers passing
+    // an unvalidated string straight through from user/tenant input.
+    if (input.subFilter !== undefined &&
+        !SUPPORTED_SUBFILTERS.includes(input.subFilter)) {
+        throw new Error(`signPdf: unsupported subFilter ${JSON.stringify(input.subFilter)} — ` +
+            `expected one of ${SUPPORTED_SUBFILTERS.join(", ")}`);
+    }
     const budget = input.signatureLength ??
         (input.tsa ? TIMESTAMPED_SIGNATURE_LENGTH : DEFAULT_SIGNATURE_LENGTH);
+    // Post-quantum seal FIRST (append-only), so the classical /ByteRange signature
+    // applied below cryptographically covers it. The seal signs SHA-256 of the
+    // pre-seal PDF (P0); coveredBytes = P0.length locates that region in the final
+    // file (incremental updates never rewrite prior bytes).
+    let basePdf = input.pdf;
+    let pqKeyId;
+    let pqMldsa65Fpr;
+    if (input.pqSeal) {
+        const digestHex = crypto.createHash("sha256").update(input.pdf).digest("hex");
+        const seal = buildPqSeal({
+            digestHex,
+            coveredBytes: input.pdf.length,
+            keys: input.pqSeal.keys,
+            signedAt: input.pqSeal.signedAt ?? input.signingTime,
+            uuaid: input.pqSeal.uuaid,
+        });
+        basePdf = embedPqSeal(input.pdf, seal);
+        const pub = publicMaterialForKeys(input.pqSeal.keys);
+        pqKeyId = pub.keyId;
+        pqMldsa65Fpr = pub.mldsa65Fpr;
+    }
     const withPlaceholder = plainAddPlaceholder({
-        pdfBuffer: input.pdf,
+        pdfBuffer: basePdf,
         reason: input.reason,
         contactInfo: input.contactInfo,
         name: input.name,
@@ -35,6 +79,7 @@ export async function signPdf(input) {
     const signer = new PemSigner({
         keyPem: input.keyPem,
         certPem: input.certPem,
+        externalSigner: input.externalSigner,
         tsa: input.tsa,
         padesStrict: input.padesStrict,
     });
@@ -55,6 +100,10 @@ export async function signPdf(input) {
         placeholderBudget: budget,
         timestamped: signer.lastTimestamped,
         tsaError: signer.lastTsaError,
+        pqSealed: !!input.pqSeal,
+        pqKeyId,
+        pqMldsa65Fpr,
+        pqUuaid: input.pqSeal?.uuaid,
     };
 }
 //# sourceMappingURL=sign-pdf.js.map

package/dist/sign-pdf.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-pdf.js","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,kEAAkE;AAElE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,sEAAsE;AACtE,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,CAAC;AA+C3C,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,MAAM,MAAM,GACV,KAAK,CAAC,eAAe;QACrB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,mBAAmB,CAAC;QAC1C,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,MAAM;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,qBAAqB;KACpD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAEtF,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,IAAI,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,SAAS,CAAC,eAAe,IAAI,MAAM,CAAC;IAC3D,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,wCAAwC,cAAc,8BAA8B,CACtG,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,MAAM,CAAC,eAAe;QACnC,QAAQ,EAAE,MAAM,CAAC,YAAY;KAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sign-pdf.js","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,kEAAkE;AAElE,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,sEAAsE;AACtE,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,qBAAqB,EAAE,qBAAqB,CAAU,CAAC;AAsG5F,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,2EAA2E;IAC3E,iEAAiE;IACjE,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAE,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK;YACpE,mBAAmB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,KAAK,CAAC,eAAe;QACrB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAExE,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,wDAAwD;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;IACxB,IAAI,OAA2B,CAAC;IAChC,IAAI,YAAgC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,WAAW,CAAC;YACvB,SAAS;YACT,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;YAC9B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACvB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW;YACpD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;QACpB,YAAY,GAAG,GAAG,CAAC,UAAU,CAAC;IAChC,CAAC;IAED,MAAM,eAAe,GAAG,mBAAmB,CAAC;QAC1C,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,MAAM;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,qBAAqB;KACpD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAEtF,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,IAAI,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,SAAS,CAAC,eAAe,IAAI,MAAM,CAAC;IAC3D,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,wCAAwC,cAAc,8BAA8B,CACtG,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,MAAM,CAAC,eAAe;QACnC,QAAQ,EAAE,MAAM,CAAC,YAAY;QAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;QACxB,OAAO;QACP,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK;KAC7B,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -24,6 +24,42 @@ export interface SignedPdfMetadata {
     /** When the signature was applied. Defaults to now. */
     signingTime?: Date;
 }
+/** RSA key sizes supported by the {@link ExternalSigner} seam. */
+export type ExternalSignerKeyType = "rsa-2048" | "rsa-3072" | "rsa-4096";
+/**
+ * Caller-injected signing seam — lets the RSA private key live OUTSIDE this
+ * process (HSM via PKCS#11, KMS, remote signing service…). The key material
+ * never touches @e-sig/core; only the certificate (public) and a sign callback
+ * are supplied. Pass it to `signPdf({ externalSigner })` or
+ * `new PemSigner({ externalSigner })` in place of `keyPem`.
+ *
+ * Design note (why a single raw-bytes callback is sufficient): the PKCS#7
+ * signature that ends up in the PDF is ALWAYS recomputed by `PemSigner` over
+ * the final signed-attributes SET (after the ESS signing-certificate-v2 splice)
+ * — node-forge's internal sync signing pass is discarded. That recomputation
+ * happens in our own async code with the exact to-be-signed bytes in hand, so
+ * the external signer is invoked exactly once, may be async (network HSMs),
+ * and needs no node-forge shim.
+ *
+ * A PKCS#11 reference adapter ships as `@e-sig/hsm-pkcs11`.
+ */
+export interface ExternalSigner {
+    /** RSA modulus size of the external key. Validated against `certificatePem`. */
+    keyType: ExternalSignerKeyType;
+    /**
+     * PEM-encoded X.509 certificate whose public key matches the external
+     * private key. Embedded in the PKCS#7 and used for structural validation.
+     */
+    certificatePem: string;
+    /**
+     * Sign `data` with RSASSA-PKCS1-v1_5 / SHA-256 — the signer hashes the raw
+     * bytes itself (PKCS#11 mechanism CKM_SHA256_RSA_PKCS does exactly this).
+     * This is byte-identical to what node-forge produces with `key.sign(md)` for
+     * the same key. Must return the raw signature, exactly modulus-sized
+     * (256/384/512 bytes for rsa-2048/3072/4096). Sync or async.
+     */
+    signRsaSha256(data: Uint8Array): Uint8Array | Promise<Uint8Array>;
+}
 /**
  * Caller-injected RFC 3161 timestamp transport.
  *

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,MAAM;IACrB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,WAAW,CAAC,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,MAAM;IACrB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,WAAW,CAAC,EAAE,IAAI,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEzE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,OAAO,EAAE,qBAAqB,CAAC;IAC/B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACnE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}