@embedpdf/core-signature 3.0.0-next.13 → 3.0.0-next.15

package/dist/index.js

@@ -1,90 +1,8 @@
+import { a as __exportAll, i as toArrayBuffer, r as ensureEngine, t as bytesEqual } from "./engine-C7lxkbZP.js";
+import { a as WEBCRYPTO_HASH, i as OID_BY_DIGEST, n as DIGEST_LENGTH, r as OID, t as DIGEST_BY_OID } from "./oids-BhZXI2ZX.js";
 import * as asn1js from "asn1js";
 import * as pkijs from "pkijs";
-//#region src/cms/engine.ts
-let ensured = false;
-/**
-* PKI.js needs a WebCrypto engine. Browsers and Node ≥ 19 expose
-* `globalThis.crypto`; register it once, lazily, so importing this package
-* has no side effect.
-*/
-function ensureEngine() {
-	if (!ensured) {
-		ensured = true;
-		if (!pkijs.getCrypto()) {
-			const webcrypto = globalThis.crypto;
-			if (!webcrypto?.subtle) throw new Error("@embedpdf/core-signature needs WebCrypto (globalThis.crypto.subtle)");
-			pkijs.setEngine("embedpdf", new pkijs.CryptoEngine({
-				name: "embedpdf",
-				crypto: webcrypto
-			}));
-		}
-	}
-	return pkijs.getCrypto(true);
-}
-function toArrayBuffer(view) {
-	const copy = new Uint8Array(view.byteLength);
-	copy.set(view);
-	return copy.buffer;
-}
-function bytesEqual(a, b) {
-	if (a.byteLength !== b.byteLength) return false;
-	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
-	return true;
-}
-//#endregion
-//#region src/cms/oids.ts
-const OID = {
-	data: "1.2.840.113549.1.7.1",
-	signedData: "1.2.840.113549.1.7.2",
-	contentType: "1.2.840.113549.1.9.3",
-	messageDigest: "1.2.840.113549.1.9.4",
-	signingTime: "1.2.840.113549.1.9.5",
-	signingCertificateV2: "1.2.840.113549.1.9.16.2.47",
-	timestampToken: "1.2.840.113549.1.9.16.2.14",
-	sha1: "1.3.14.3.2.26",
-	sha256: "2.16.840.1.101.3.4.2.1",
-	sha384: "2.16.840.1.101.3.4.2.2",
-	sha512: "2.16.840.1.101.3.4.2.3",
-	rsaEncryption: "1.2.840.113549.1.1.1",
-	sha256WithRsa: "1.2.840.113549.1.1.11",
-	sha384WithRsa: "1.2.840.113549.1.1.12",
-	sha512WithRsa: "1.2.840.113549.1.1.13",
-	rsaPss: "1.2.840.113549.1.1.10",
-	mgf1: "1.2.840.113549.1.1.8",
-	ecdsaSha256: "1.2.840.10045.4.3.2",
-	ecdsaSha384: "1.2.840.10045.4.3.3",
-	ecdsaSha512: "1.2.840.10045.4.3.4",
-	subjectKeyIdentifier: "2.5.29.14",
-	keyUsage: "2.5.29.15",
-	basicConstraints: "2.5.29.19",
-	commonName: "2.5.4.3"
-};
-const DIGEST_BY_OID = {
-	[OID.sha1]: "sha1",
-	[OID.sha256]: "sha256",
-	[OID.sha384]: "sha384",
-	[OID.sha512]: "sha512"
-};
-const OID_BY_DIGEST = {
-	sha1: OID.sha1,
-	sha256: OID.sha256,
-	sha384: OID.sha384,
-	sha512: OID.sha512
-};
-/** WebCrypto hash names. */
-const WEBCRYPTO_HASH = {
-	sha1: "SHA-1",
-	sha256: "SHA-256",
-	sha384: "SHA-384",
-	sha512: "SHA-512"
-};
-const DIGEST_LENGTH = {
-	sha1: 20,
-	sha256: 32,
-	sha384: 48,
-	sha512: 64
-};
-//#endregion
+import { EngineError, EngineErrorCode } from "@embedpdf/engine-core/runtime";
 //#region src/cms/parse.ts
 var CmsError = class extends Error {
 	constructor(reason, message) {
@@ -97,7 +15,7 @@ var CmsError = class extends Error {
 function parseDetachedCms(cms) {
 	return parseCmsInternal(cms).parsed;
 }
-function parseCmsInternal(cms) {
+function parseCmsInternal(cms, content = "detached") {
 	if (cms.byteLength === 0) throw new CmsError("malformed", "empty CMS");
 	const asn1 = asn1js.fromBER(toArrayBuffer(cms));
 	if (asn1.offset === -1) throw new CmsError("malformed", "CMS is not valid BER");
@@ -107,25 +25,33 @@ function parseCmsInternal(cms) {
 		contentInfo = new pkijs.ContentInfo({ schema: asn1.result });
 		if (contentInfo.contentType !== OID.signedData) throw new CmsError("unsupported", `CMS content type ${contentInfo.contentType} is not SignedData`);
 		signedData = new pkijs.SignedData({ schema: contentInfo.content });
-	} catch (err) {
-		if (err instanceof CmsError) throw err;
-		throw new CmsError("malformed", `CMS does not parse as SignedData: ${err.message}`);
+	} catch (error) {
+		if (error instanceof CmsError) throw error;
+		throw new CmsError("malformed", `CMS does not parse as SignedData: ${error.message}`);
+	}
+	const encapsulated = signedData.encapContentInfo;
+	const expectedContentType = content === "tst-info" ? OID.tstInfo : OID.data;
+	let eContent = null;
+	if (content === "detached") {
+		if (encapsulated.eContent) throw new CmsError("unsupported", "CMS carries encapsulated content; a PDF signature is detached");
+	} else {
+		if (encapsulated.eContentType !== OID.tstInfo || !encapsulated.eContent) throw new CmsError("malformed", "a timestamp token must carry a TSTInfo");
+		eContent = new Uint8Array(encapsulated.eContent.getValue());
 	}
-	if (signedData.encapContentInfo.eContent) throw new CmsError("unsupported", "CMS carries encapsulated content; a PDF signature is detached");
 	if (signedData.signerInfos.length !== 1) throw new CmsError("unsupported", `CMS has ${signedData.signerInfos.length} signers; exactly one is expected`);
 	const signerInfo = signedData.signerInfos[0];
 	const digestAlgorithm = DIGEST_BY_OID[signerInfo.digestAlgorithm.algorithmId];
 	if (!digestAlgorithm) throw new CmsError("unsupported", `digest algorithm ${signerInfo.digestAlgorithm.algorithmId}`);
-	const certificates = (signedData.certificates ?? []).filter((c) => c instanceof pkijs.Certificate);
+	const certificates = (signedData.certificates ?? []).filter((certificate) => certificate instanceof pkijs.Certificate);
 	const signerCertificate = findSignerCertificate(signerInfo, certificates);
 	if (!signerCertificate) throw new CmsError("malformed", "the signer certificate is not carried by the CMS");
 	const signedAttrs = signerInfo.signedAttrs?.attributes ?? [];
 	if (signedAttrs.length === 0) throw new CmsError("unsupported", "CMS has no signed attributes; a PDF signature needs message-digest");
-	const attr = (type) => signedAttrs.find((a) => a.type === type);
+	const attr = (type) => signedAttrs.find((attribute) => attribute.type === type);
 	const contentType = attr(OID.contentType);
-	if (contentType && contentType.values[0]?.valueBlock?.toString?.() !== OID.data) {
+	if (contentType) {
 		const oid = contentType.values[0];
-		if (!oid || oid.valueBlock.toString() !== OID.data) throw new CmsError("unsupported", "CMS content-type attribute is not id-data");
+		if (!oid || oid.valueBlock.toString() !== expectedContentType) throw new CmsError("unsupported", `CMS content-type attribute is not ${content === "tst-info" ? "id-ct-TSTInfo" : "id-data"}`);
 	}
 	const messageDigestValue = attr(OID.messageDigest)?.values[0];
 	if (!messageDigestValue || !(messageDigestValue instanceof asn1js.OctetString)) throw new CmsError("malformed", "CMS has no message-digest attribute");
@@ -148,9 +74,9 @@ function parseCmsInternal(cms) {
 		essCertHash = new Uint8Array(hash.valueBlock.valueHexView);
 	}
 	let timestampToken = null;
-	const tokenAttr = signerInfo.unsignedAttrs?.attributes.find((a) => a.type === OID.timestampToken);
+	const tokenAttr = signerInfo.unsignedAttrs?.attributes.find((attribute) => attribute.type === OID.timestampToken);
 	if (tokenAttr?.values[0]) timestampToken = new Uint8Array(tokenAttr.values[0].toBER(false));
-	const ordered = [signerCertificate, ...certificates.filter((c) => c !== signerCertificate)];
+	const ordered = [signerCertificate, ...certificates.filter((certificate) => certificate !== signerCertificate)];
 	return {
 		parsed: {
 			digestAlgorithm,
@@ -166,7 +92,8 @@ function parseCmsInternal(cms) {
 		signerInfo,
 		signerCertificate,
 		certificates: ordered,
-		essCertHash
+		essCertHash,
+		eContent
 	};
 }
 function certDer(cert) {
@@ -181,7 +108,7 @@ function findSignerCertificate(signerInfo, certificates) {
 	const ski = sid?.valueBlock?.valueHexView;
 	if (!ski) return null;
 	for (const cert of certificates) {
-		const ext = cert.extensions?.find((e) => e.extnID === OID.subjectKeyIdentifier);
+		const ext = cert.extensions?.find((extension) => extension.extnID === OID.subjectKeyIdentifier);
 		const value = ext ? asn1js.fromBER(ext.extnValue.valueBlock.valueHexView) : null;
 		const inner = value && value.offset !== -1 ? value.result : null;
 		if (inner && bytesEqual(new Uint8Array(inner.valueBlock.valueHexView), new Uint8Array(ski))) return cert;
@@ -190,9 +117,9 @@ function findSignerCertificate(signerInfo, certificates) {
 }
 //#endregion
 //#region src/cms/verify.ts
-/** The DER of the signed attributes as they are signed: re-tagged as a SET. */
+/** The DER of the signed attributes as they are signed: re-tagged as a set. */
 function signedAttributesDer(signerInfo) {
-	const set = new asn1js.Set({ value: (signerInfo.signedAttrs?.attributes ?? []).map((a) => a.toSchema()) });
+	const set = new asn1js.Set({ value: (signerInfo.signedAttrs?.attributes ?? []).map((attribute) => attribute.toSchema()) });
 	return new Uint8Array(set.toBER(false));
 }
 /**
@@ -206,8 +133,8 @@ async function verifyCmsSignature(cms) {
 	let internal;
 	try {
 		internal = cms instanceof Uint8Array ? parseCmsInternal(cms) : cms;
-	} catch (err) {
-		return err instanceof CmsError && err.reason === "unsupported" ? "unsupported" : "invalid";
+	} catch (error) {
+		return error instanceof CmsError && error.reason === "unsupported" ? "unsupported" : "invalid";
 	}
 	const engine = ensureEngine();
 	const { signerInfo, signerCertificate, parsed, essCertHash } = internal;
@@ -216,8 +143,8 @@ async function verifyCmsSignature(cms) {
 	}
 	try {
 		return await engine.verifyWithPublicKey(toArrayBuffer(signedAttributesDer(signerInfo)), signerInfo.signature, signerCertificate.subjectPublicKeyInfo, signerInfo.signatureAlgorithm, WEBCRYPTO_HASH[parsed.digestAlgorithm]) ? "valid" : "invalid";
-	} catch (err) {
-		const message = err.message ?? "";
+	} catch (error) {
+		const message = error.message ?? "";
 		return /unsupported|unknown|not supported|not implemented/i.test(message) ? "unsupported" : "invalid";
 	}
 }
@@ -276,10 +203,9 @@ async function buildDetachedCms(input) {
 		}),
 		signatureAlgorithm: signatureAlgorithmFor(input.signer.algorithm, input.hash)
 	});
-	const toSign = new asn1js.Set({ value: attributes.map((a) => a.toSchema()) }).toBER(false);
+	const toSign = new asn1js.Set({ value: attributes.map((attribute) => attribute.toSchema()) }).toBER(false);
 	const raw = await input.signer.sign(new Uint8Array(toSign));
-	const signature = input.signer.algorithm === "ECDSA" ? pkijs.createCMSECDSASignature(toArrayBuffer(raw)) : toArrayBuffer(raw);
-	signerInfo.signature = new asn1js.OctetString({ valueHex: signature });
+	signerInfo.signature = new asn1js.OctetString({ valueHex: cmsSignatureValue(input.signer.algorithm, raw) });
 	const signedData = new pkijs.SignedData({
 		version: 1,
 		digestAlgorithms: [digestAlgorithm],
@@ -293,6 +219,11 @@ async function buildDetachedCms(input) {
 	});
 	return new Uint8Array(contentInfo.toSchema().toBER(false));
 }
+/** A raw signature as a SignerInfo carries it (ECDSA `r || s` becomes DER). */
+function cmsSignatureValue(algorithm, raw) {
+	return algorithm === "ECDSA" ? pkijs.createCMSECDSASignature(toArrayBuffer(raw)) : toArrayBuffer(raw);
+}
+/** The SignerInfo signature algorithm of a raw key and hash. */
 function signatureAlgorithmFor(algorithm, hash) {
 	switch (algorithm) {
 		case "RSA-PKCS1-v1_5": return new pkijs.AlgorithmIdentifier({
@@ -329,6 +260,109 @@ function signatureAlgorithmFor(algorithm, hash) {
 	}
 }
 //#endregion
+//#region src/cms/timestamp.ts
+var timestamp_exports = /* @__PURE__ */ __exportAll({
+	buildTimestampToken: () => buildTimestampToken,
+	readTimestampInfo: () => readTimestampInfo
+});
+/** Read a token's TSTInfo (the encapsulated content of an RFC 3161 token). Throws `CmsError`. */
+function readTimestampInfo(eContent) {
+	const asn1 = asn1js.fromBER(toArrayBuffer(eContent));
+	if (asn1.offset === -1) throw new CmsError("malformed", "TSTInfo is not valid BER");
+	let info;
+	try {
+		info = new pkijs.TSTInfo({ schema: asn1.result });
+	} catch (error) {
+		throw new CmsError("malformed", `TSTInfo does not parse: ${error.message}`);
+	}
+	const algorithm = DIGEST_BY_OID[info.messageImprint.hashAlgorithm.algorithmId];
+	if (!algorithm) throw new CmsError("unsupported", `message imprint algorithm ${info.messageImprint.hashAlgorithm.algorithmId}`);
+	return {
+		imprintAlgorithm: algorithm,
+		imprint: new Uint8Array(info.messageImprint.hashedMessage.valueBlock.valueHexView),
+		genTime: info.genTime
+	};
+}
+/**
+* Build an RFC 3161 timestamp token: a SignedData whose content is a
+* TSTInfo stamping `digest`, signed by the authority over content-type
+* (id-ct-TSTInfo), message-digest (of the TSTInfo) and ESS
+* signing-certificate-v2. What a timestamp authority returns; used by the
+* test authority, never to stamp a real document.
+*/
+async function buildTimestampToken(input) {
+	const engine = ensureEngine();
+	if (input.digest.byteLength !== DIGEST_LENGTH[input.hash]) throw new Error(`digest is ${input.digest.byteLength} bytes; ${input.hash} needs ${DIGEST_LENGTH[input.hash]}`);
+	const authorityCert = pkijs.Certificate.fromBER(toArrayBuffer(input.authority.certificateChain[0]));
+	const serial = globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(8));
+	serial[0] &= 127;
+	const eContent = new pkijs.TSTInfo({
+		version: 1,
+		policy: "1.3.6.1.4.1.57264.1.1",
+		messageImprint: new pkijs.MessageImprint({
+			hashAlgorithm: new pkijs.AlgorithmIdentifier({ algorithmId: OID_BY_DIGEST[input.hash] }),
+			hashedMessage: new asn1js.OctetString({ valueHex: toArrayBuffer(input.digest) })
+		}),
+		serialNumber: new asn1js.Integer({ valueHex: toArrayBuffer(serial) }),
+		genTime: input.genTime ?? /* @__PURE__ */ new Date()
+	}).toSchema().toBER(false);
+	const contentDigest = await engine.digest(WEBCRYPTO_HASH[input.authority.hash], eContent);
+	const certHash = await engine.digest("SHA-256", toArrayBuffer(input.authority.certificateChain[0]));
+	const issuerSerial = new pkijs.IssuerSerial({
+		issuer: new pkijs.GeneralNames({ names: [new pkijs.GeneralName({
+			type: 4,
+			value: authorityCert.issuer
+		})] }),
+		serialNumber: authorityCert.serialNumber
+	});
+	const attributes = [
+		new pkijs.Attribute({
+			type: OID.contentType,
+			values: [new asn1js.ObjectIdentifier({ value: OID.tstInfo })]
+		}),
+		new pkijs.Attribute({
+			type: OID.messageDigest,
+			values: [new asn1js.OctetString({ valueHex: contentDigest })]
+		}),
+		new pkijs.Attribute({
+			type: OID.signingCertificateV2,
+			values: [new asn1js.Sequence({ value: [new asn1js.Sequence({ value: [new asn1js.Sequence({ value: [new asn1js.OctetString({ valueHex: certHash }), issuerSerial.toSchema()] })] })] })]
+		})
+	];
+	const digestAlgorithm = new pkijs.AlgorithmIdentifier({ algorithmId: OID_BY_DIGEST[input.authority.hash] });
+	const signerInfo = new pkijs.SignerInfo({
+		version: 1,
+		sid: new pkijs.IssuerAndSerialNumber({
+			issuer: authorityCert.issuer,
+			serialNumber: authorityCert.serialNumber
+		}),
+		digestAlgorithm,
+		signedAttrs: new pkijs.SignedAndUnsignedAttributes({
+			type: 0,
+			attributes
+		}),
+		signatureAlgorithm: signatureAlgorithmFor(input.authority.algorithm, input.authority.hash)
+	});
+	const toSign = new asn1js.Set({ value: attributes.map((attribute) => attribute.toSchema()) }).toBER(false);
+	const raw = await input.authority.sign(new Uint8Array(toSign));
+	signerInfo.signature = new asn1js.OctetString({ valueHex: cmsSignatureValue(input.authority.algorithm, raw) });
+	const signedData = new pkijs.SignedData({
+		version: 3,
+		digestAlgorithms: [digestAlgorithm],
+		encapContentInfo: new pkijs.EncapsulatedContentInfo({
+			eContentType: OID.tstInfo,
+			eContent: new asn1js.OctetString({ valueHex: eContent })
+		}),
+		certificates: [authorityCert],
+		signerInfos: [signerInfo]
+	});
+	const contentInfo = new pkijs.ContentInfo({
+		contentType: OID.signedData,
+		content: signedData.toSchema(true)
+	});
+	return new Uint8Array(contentInfo.toSchema().toBER(false));
+}
+//#endregion
 //#region src/gate.ts
 /**
 * The gate between a signer's answer and `signatures.complete`: the CMS
@@ -345,14 +379,15 @@ async function verifyForCompletion(input) {
 		reason: "too-large",
 		detail: `the CMS is ${cms.byteLength} bytes; ${prepared.contentsSize} were reserved`
 	};
+	if (profile === "timestamp") return verifyTimestampToken(cms, prepared);
 	let internal;
 	try {
 		internal = parseCmsInternal(cms);
-	} catch (err) {
+	} catch (error) {
 		return {
 			ok: false,
 			reason: "malformed",
-			detail: err instanceof CmsError ? err.message : String(err)
+			detail: error instanceof CmsError ? error.message : String(error)
 		};
 	}
 	const parsed = internal.parsed;
@@ -386,6 +421,47 @@ async function verifyForCompletion(input) {
 	};
 	return { ok: true };
 }
+/**
+* A document timestamp's token: it must stamp the prepared digest with the
+* prepared algorithm, its own message digest must cover its TSTInfo, and
+* its signature must verify with the authority's certificate.
+*/
+async function verifyTimestampToken(cms, prepared) {
+	let internal;
+	let info;
+	try {
+		internal = parseCmsInternal(cms, "tst-info");
+		info = readTimestampInfo(internal.eContent);
+	} catch (error) {
+		return {
+			ok: false,
+			reason: "malformed",
+			detail: error instanceof CmsError ? error.message : String(error)
+		};
+	}
+	if (info.imprintAlgorithm !== prepared.algorithm) return {
+		ok: false,
+		reason: "algorithm-mismatch",
+		detail: `the token stamps a ${info.imprintAlgorithm} digest, the document was prepared with ${prepared.algorithm}`
+	};
+	if (!bytesEqual(info.imprint, prepared.digest)) return {
+		ok: false,
+		reason: "digest-mismatch",
+		detail: "the token's message imprint is not the prepared digest"
+	};
+	if (!bytesEqual(new Uint8Array(await ensureEngine().digest(WEBCRYPTO_HASH[internal.parsed.digestAlgorithm], toArrayBuffer(internal.eContent))), internal.parsed.messageDigest)) return {
+		ok: false,
+		reason: "signature-invalid",
+		detail: "the token's message digest does not cover its TSTInfo"
+	};
+	const cryptography = await verifyCmsSignature(internal);
+	if (cryptography !== "valid") return {
+		ok: false,
+		reason: "signature-invalid",
+		detail: cryptography === "unsupported" ? "the signature algorithm is not supported" : "the token signature does not verify"
+	};
+	return { ok: true };
+}
 //#endregion
 //#region src/trust.ts
 /**
@@ -407,10 +483,10 @@ async function validateChain(cms, trust, at = { kind: "now" }) {
 	let internal;
 	try {
 		internal = cms instanceof Uint8Array ? parseCmsInternal(cms) : cms;
-	} catch (err) {
+	} catch (error) {
 		return {
 			status: "untrusted",
-			reason: err.message
+			reason: error.message
 		};
 	}
 	const trustedCerts = anchors.map((der) => pkijs.Certificate.fromBER(toArrayBuffer(der)));
@@ -427,91 +503,103 @@ async function validateChain(cms, trust, at = { kind: "now" }) {
 		};
 		return {
 			status: "trusted",
-			path: (result.certificatePath ?? []).map((c) => new Uint8Array(c.toSchema(true).toBER(false)))
+			path: (result.certificatePath ?? []).map((certificate) => new Uint8Array(certificate.toSchema(true).toBER(false)))
 		};
-	} catch (err) {
+	} catch (error) {
 		return {
 			status: "untrusted",
-			reason: err.message
+			reason: error.message
 		};
 	}
 }
 //#endregion
 //#region src/sign.ts
-var SigningError = class extends Error {
-	constructor(reason, detail) {
-		super(`signing refused (${reason}): ${detail}`);
-		this.reason = reason;
-		this.name = "SigningError";
-	}
-};
+/**
+* The gate refused the key's answer: `SignatureRefused`, with the gate's
+* reason in `details.reason`.
+*/
+function signingRefused(reason, detail) {
+	return new EngineError(EngineErrorCode.SignatureRefused, `signing refused (${reason}): ${detail}`, { details: { reason } });
+}
 function profileFor(subFilter) {
-	return subFilter === "adbe.pkcs7.detached" ? "pkcs7" : "cades-b";
+	switch (subFilter) {
+		case "adbe.pkcs7.detached": return "pkcs7";
+		case "ETSI.CAdES.detached": return "cades-b";
+		case "ETSI.RFC3161": return "timestamp";
+		default: throw new EngineError(EngineErrorCode.InvalidArg, `unknown subFilter '${String(subFilter)}'`, { details: { field: "subFilter" } });
+	}
 }
 /**
-* Sign a field in one call: `prepare` on the engine, the signer turns the
+* Sign a field in one call: `prepare` on the engine, the key turns the
 * digest into a CMS (or a raw signature this package wraps), the gate
 * checks the CMS matches what was prepared, `complete` installs it. Any
-* failure aborts the candidate and rethrows; the document is never left
+* failure cancels the candidate and rethrows; the document is never left
 * with a pending signing.
 */
 async function sign(doc, input) {
-	if (!doc.signatures) throw new Error("this engine does not implement signatures");
-	const { signer, ...rest } = input;
-	const subFilter = rest.subFilter ?? "ETSI.CAdES.detached";
+	const { key, ...rest } = input;
+	const timestamp = rest.kind === "timestamp";
+	if (timestamp && key.kind !== "cms") throw new EngineError(EngineErrorCode.InvalidArg, "a document timestamp needs a timestamp authority: a CMS key that returns an RFC 3161 token", { details: { field: "key" } });
+	const subFilter = timestamp ? "ETSI.RFC3161" : rest.subFilter ?? "ETSI.CAdES.detached";
 	const profile = profileFor(subFilter);
-	const digest = rest.digest ?? (signer.kind === "raw" ? signer.hash : "sha256");
+	const digest = rest.digest ?? (key.kind === "raw" ? key.hash : "sha256");
 	const prepared = await doc.signatures.prepare({
 		...rest,
-		subFilter,
+		...timestamp ? {} : { subFilter },
 		digest
 	});
 	try {
-		const cms = signer.kind === "cms" ? await signer.sign({
-			digest: prepared.digest,
-			algorithm: prepared.algorithm,
-			subFilter
-		}) : await buildDetachedCms({
-			digest: prepared.digest,
-			hash: prepared.algorithm,
-			profile,
-			signer,
-			signingTime: profile === "pkcs7" ? /* @__PURE__ */ new Date() : void 0
-		});
+		const cms = await cmsFor(key, prepared, subFilter, profile);
 		const gate = await verifyForCompletion({
 			cms,
 			prepared,
 			profile
 		});
-		if (!gate.ok) throw new SigningError(gate.reason, gate.detail);
+		if (!gate.ok) throw signingRefused(gate.reason, gate.detail);
 		return await doc.signatures.complete({
 			signingId: prepared.signingId,
 			cms,
 			expectedVersion: prepared.expectedVersion
 		});
-	} catch (err) {
-		await doc.signatures.abort(prepared.signingId).catch(() => void 0);
-		throw err;
+	} catch (error) {
+		await doc.signatures.cancel(prepared.signingId).catch(() => void 0);
+		throw error;
 	}
 }
+/** The key's answer for the prepared digest: a service's CMS, or one built here around a raw signature. */
+async function cmsFor(key, prepared, subFilter, profile) {
+	if (key.kind === "cms") return key.sign({
+		digest: prepared.digest,
+		algorithm: prepared.algorithm,
+		subFilter
+	});
+	if (profile === "timestamp") throw new EngineError(EngineErrorCode.InvalidArg, "a raw key cannot make a timestamp token");
+	return buildDetachedCms({
+		digest: prepared.digest,
+		hash: prepared.algorithm,
+		profile,
+		signer: key,
+		signingTime: profile === "pkcs7" ? /* @__PURE__ */ new Date() : void 0
+	});
+}
 //#endregion
 //#region src/verdict.ts
 /**
 * Validate every signature of a document: integrity from the engine's
 * bytes, cryptography from the CMS, trust from the caller's anchors.
 */
-async function validateSignatures(doc, opts = {}) {
+async function validateSignatures(doc, options = {}) {
 	if (!doc.signatures) throw new Error("this engine does not implement signatures");
 	const snapshot = await doc.signatures.list();
 	const verdicts = [];
 	for (const signature of snapshot.signatures) {
 		if (!signature.signed) continue;
-		verdicts.push(await validateOne(doc, snapshot, signature, opts));
+		verdicts.push(await validateOne(doc, snapshot, signature, options));
 	}
 	return verdicts;
 }
-async function validateOne(doc, snapshot, signature, opts) {
-	const at = opts.at ?? { kind: "now" };
+async function validateOne(doc, snapshot, signature, options) {
+	const at = options.at ?? { kind: "now" };
 	let integrity = "indeterminate";
 	let cryptography = "unsupported";
 	let trust = "unknown";
@@ -520,21 +608,21 @@ async function validateOne(doc, snapshot, signature, opts) {
 	let cms = null;
 	if (!snapshot.chainValid || signature.coverage === "malformed") integrity = snapshot.chainValid ? "invalid" : "indeterminate";
 	else try {
-		internal = parseCmsInternal(await doc.signatures.contents(signature.field));
+		internal = parseCmsInternal(await doc.signatures.getContents(signature.field));
 		cms = internal.parsed;
-		const digestMatches = bytesEqual(await doc.signatures.digest(signature.field, cms.digestAlgorithm), cms.messageDigest);
+		const digestMatches = bytesEqual(await doc.signatures.getDigest(signature.field, cms.digestAlgorithm), cms.messageDigest);
 		integrity = signature.coverage === "whole-revision" && digestMatches ? "valid" : "invalid";
-	} catch (err) {
-		integrity = err instanceof CmsError && err.reason === "unsupported" ? "indeterminate" : "invalid";
-		if (!(err instanceof CmsError)) integrity = "indeterminate";
+	} catch (error) {
+		integrity = error instanceof CmsError && error.reason === "unsupported" ? "indeterminate" : "invalid";
+		if (!(error instanceof CmsError)) integrity = "indeterminate";
 	}
 	if (internal) {
 		cryptography = await verifyCmsSignature(internal);
-		const chain = await validateChain(internal, opts.trust, at);
+		const chain = await validateChain(internal, options.trust, at);
 		trust = chain.status;
 		trustReason = chain.reason;
 	}
-	const modifications = await modificationsOf(doc, snapshot, signature, opts.until ?? "persisted");
+	const modifications = await modificationsOf(doc, snapshot, signature, options.until ?? "persisted");
 	let summary;
 	if (integrity === "invalid" || cryptography === "invalid" || modifications.verdict === "forbidden") summary = "invalid";
 	else if (integrity === "indeterminate" || cryptography === "unsupported" || modifications.verdict === "indeterminate") summary = "indeterminate";
@@ -581,67 +669,15 @@ async function modificationsOf(doc, snapshot, signature, until) {
 			...analysis.later.revisionCount > 0 ? { laterRevisions: analysis.later.revisionCount } : {},
 			...analysis.later.undoneObjectNumbers.length > 0 ? { undone: true } : {}
 		};
-	} catch (err) {
+	} catch (error) {
 		return {
 			verdict: "indeterminate",
-			detail: `analysis failed: ${err.message}`,
+			detail: `analysis failed: ${error.message}`,
 			basis: "persisted"
 		};
 	}
 }
 //#endregion
-//#region src/signers/self-signed.ts
-/**
-* A self-signed certificate over a WebCrypto key pair: the shape a personal
-* signer, a test signer, and a demo all need. It is its own trust anchor and
-* nothing else's — Acrobat shows a signature made with it as "validity
-* unknown" until the reader trusts the certificate explicitly.
-*/
-async function selfSignedCertificate(input) {
-	ensureEngine();
-	const cert = new pkijs.Certificate();
-	cert.version = 2;
-	const serial = /* @__PURE__ */ new Uint8Array(8);
-	globalThis.crypto.getRandomValues(serial);
-	serial[0] &= 127;
-	cert.serialNumber = new asn1js.Integer({ valueHex: serial.buffer });
-	const name = new pkijs.AttributeTypeAndValue({
-		type: OID.commonName,
-		value: new asn1js.Utf8String({ value: input.commonName })
-	});
-	cert.issuer.typesAndValues.push(name);
-	cert.subject.typesAndValues.push(name);
-	const now = Date.now();
-	cert.notBefore.value = /* @__PURE__ */ new Date(now - 24 * 3600 * 1e3);
-	cert.notAfter.value = new Date(now + (input.validityDays ?? 365) * 24 * 3600 * 1e3);
-	const basicConstraints = new pkijs.BasicConstraints({ cA: true });
-	const keyUsage = new asn1js.BitString({
-		valueHex: new Uint8Array([132]).buffer,
-		unusedBits: 2
-	});
-	cert.extensions = [new pkijs.Extension({
-		extnID: OID.basicConstraints,
-		critical: true,
-		extnValue: basicConstraints.toSchema().toBER(false),
-		parsedValue: basicConstraints
-	}), new pkijs.Extension({
-		extnID: OID.keyUsage,
-		critical: true,
-		extnValue: keyUsage.toBER(false)
-	})];
-	await cert.subjectPublicKeyInfo.importKey(input.publicKey);
-	await cert.sign(input.privateKey, WEBCRYPTO_HASH[input.hash]);
-	return new Uint8Array(cert.toSchema(true).toBER(false));
-}
-/** The subject common name of a DER certificate, or null when it has none. */
-function certificateCommonName(der) {
-	ensureEngine();
-	const copy = new Uint8Array(der.byteLength);
-	copy.set(der);
-	const text = (pkijs.Certificate.fromBER(copy.buffer).subject.typesAndValues.find((entry) => entry.type === OID.commonName)?.value)?.valueBlock?.value;
-	return typeof text === "string" && text.length > 0 ? text : null;
-}
-//#endregion
 //#region src/signers/webcrypto.ts
 /**
 * A `RawSigner` over a WebCrypto private key: the key never leaves the
@@ -703,14 +739,14 @@ function hashFromWebCrypto(name) {
 * self-signed certificate, never persisted. Trust it with
 * `{ anchors: async () => [signer.certificate] }`.
 */
-async function createTestSigner(opts = {}) {
-	ensureEngine();
-	const hash = opts.hash ?? "sha256";
-	const keys = await generateSigningKeyPair(opts.algorithm ?? "RSA-PKCS1-v1_5", hash, true);
+async function createTestSigner(options = {}) {
+	const { selfSignedCertificate } = await Promise.resolve().then(() => self_signed_exports);
+	const hash = options.hash ?? "sha256";
+	const keys = await generateSigningKeyPair(options.algorithm ?? "RSA-PKCS1-v1_5", hash, true);
 	const certificate = await selfSignedCertificate({
 		publicKey: keys.publicKey,
 		privateKey: keys.privateKey,
-		commonName: opts.commonName ?? "EmbedPDF test signer",
+		commonName: options.commonName ?? "EmbedPDF test signer",
 		hash
 	});
 	return {
@@ -723,6 +759,25 @@ async function createTestSigner(opts = {}) {
 		privateKey: keys.privateKey
 	};
 }
+/**
+* A throwaway RFC 3161 timestamp authority for tests and demos: it stamps
+* whatever digest it is given with the current time, signed by a fresh
+* self-signed key. The key for `sign(doc, { kind: 'timestamp', key })`;
+* never use it to stamp a real document.
+*/
+async function createTestTimestampAuthority(options = {}) {
+	const authority = await createTestSigner({ commonName: options.commonName ?? "EmbedPDF test timestamp authority" });
+	const { buildTimestampToken } = await Promise.resolve().then(() => timestamp_exports);
+	return {
+		kind: "cms",
+		certificate: authority.certificate,
+		sign: ({ digest, algorithm }) => buildTimestampToken({
+			digest,
+			hash: algorithm,
+			authority
+		})
+	};
+}
 /** A WebCrypto signing key pair; `extractable: false` keeps the private key inside the runtime for good. */
 async function generateSigningKeyPair(algorithm, hash, extractable) {
 	return await globalThis.crypto.subtle.generateKey(algorithm === "ECDSA" ? {
@@ -742,9 +797,10 @@ async function generateSigningKeyPair(algorithm, hash, extractable) {
 //#endregion
 //#region src/signers/remote.ts
 /**
-* A `CmsSigner` over the customer's own signing service or HSM: the engine's
-* digest goes out, a finished detached CMS comes back. Nothing but the
-* digest (and which hash and profile it is for) ever leaves the runtime.
+* A `CmsSigner` over the customer's own signing service, HSM or timestamp
+* authority: the engine's digest goes out, a finished detached CMS (or, for
+* `'ETSI.RFC3161'`, an RFC 3161 token) comes back. Nothing but the digest
+* (and which hash and profile it is for) ever leaves the runtime.
 */
 function remoteSigner(input) {
 	return {
@@ -764,10 +820,12 @@ function remoteSigner(input) {
 * unknown", which is the honest answer for a self-issued identity.
 */
 async function personalSigner(input) {
+	const { ensureEngine } = await import("./engine-C7lxkbZP.js").then((n) => n.n);
 	ensureEngine();
 	const hash = input.hash ?? "sha256";
 	let record = await input.store.load(input.subject);
 	if (!record) {
+		const { selfSignedCertificate } = await Promise.resolve().then(() => self_signed_exports);
 		const keys = await generateSigningKeyPair(input.algorithm ?? "RSA-PKCS1-v1_5", hash, false);
 		const certificate = await selfSignedCertificate({
 			publicKey: keys.publicKey,
@@ -809,8 +867,8 @@ function memoryKeyStore() {
 * itself (structured clone), so the key survives reloads without ever
 * existing as bytes.
 */
-function indexedDbKeyStore(dbName, opts = {}) {
-	const storeName = opts.storeName ?? "keys";
+function indexedDbKeyStore(dbName, options = {}) {
+	const storeName = options.storeName ?? "keys";
 	let opening = null;
 	const open = () => {
 		opening ?? (opening = new Promise((resolve, reject) => {
@@ -832,12 +890,68 @@ function indexedDbKeyStore(dbName, opts = {}) {
 		});
 	};
 	return {
-		load: async (subject) => await run("readonly", (s) => s.get(subject)) ?? null,
-		save: (subject, record) => run("readwrite", (s) => s.put(record, subject)).then(() => void 0),
-		remove: (subject) => run("readwrite", (s) => s.delete(subject)).then(() => void 0)
+		load: async (subject) => await run("readonly", (store) => store.get(subject)) ?? null,
+		save: (subject, record) => run("readwrite", (store) => store.put(record, subject)).then(() => void 0),
+		remove: (subject) => run("readwrite", (store) => store.delete(subject)).then(() => void 0)
 	};
 }
 //#endregion
-export { CmsError, SigningError, buildDetachedCms, certificateCommonName, createTestSigner, generateSigningKeyPair, indexedDbKeyStore, memoryKeyStore, parseDetachedCms, personalSigner, profileFor, remoteSigner, selfSignedCertificate, sign, validateChain, validateSignatures, verifyCmsSignature, verifyForCompletion, webCryptoSigner };
+//#region src/signers/self-signed.ts
+var self_signed_exports = /* @__PURE__ */ __exportAll({
+	certificateCommonName: () => certificateCommonName,
+	selfSignedCertificate: () => selfSignedCertificate
+});
+/**
+* A self-signed certificate over a WebCrypto key pair: the shape a personal
+* signer, a test signer, and a demo all need. It is its own trust anchor and
+* nothing else's — Acrobat shows a signature made with it as "validity
+* unknown" until the reader trusts the certificate explicitly.
+*/
+async function selfSignedCertificate(input) {
+	ensureEngine();
+	const cert = new pkijs.Certificate();
+	cert.version = 2;
+	const serial = /* @__PURE__ */ new Uint8Array(8);
+	globalThis.crypto.getRandomValues(serial);
+	serial[0] &= 127;
+	cert.serialNumber = new asn1js.Integer({ valueHex: serial.buffer });
+	const name = new pkijs.AttributeTypeAndValue({
+		type: OID.commonName,
+		value: new asn1js.Utf8String({ value: input.commonName })
+	});
+	cert.issuer.typesAndValues.push(name);
+	cert.subject.typesAndValues.push(name);
+	const now = Date.now();
+	cert.notBefore.value = /* @__PURE__ */ new Date(now - 24 * 3600 * 1e3);
+	cert.notAfter.value = new Date(now + (input.validityDays ?? 365) * 24 * 3600 * 1e3);
+	const basicConstraints = new pkijs.BasicConstraints({ cA: true });
+	const keyUsage = new asn1js.BitString({
+		valueHex: new Uint8Array([132]).buffer,
+		unusedBits: 2
+	});
+	cert.extensions = [new pkijs.Extension({
+		extnID: OID.basicConstraints,
+		critical: true,
+		extnValue: basicConstraints.toSchema().toBER(false),
+		parsedValue: basicConstraints
+	}), new pkijs.Extension({
+		extnID: OID.keyUsage,
+		critical: true,
+		extnValue: keyUsage.toBER(false)
+	})];
+	await cert.subjectPublicKeyInfo.importKey(input.publicKey);
+	await cert.sign(input.privateKey, WEBCRYPTO_HASH[input.hash]);
+	return new Uint8Array(cert.toSchema(true).toBER(false));
+}
+/** The subject common name of a DER certificate, or null when it has none. */
+function certificateCommonName(der) {
+	ensureEngine();
+	const copy = new Uint8Array(der.byteLength);
+	copy.set(der);
+	const text = (pkijs.Certificate.fromBER(copy.buffer).subject.typesAndValues.find((entry) => entry.type === OID.commonName)?.value)?.valueBlock?.value;
+	return typeof text === "string" && text.length > 0 ? text : null;
+}
+//#endregion
+export { CmsError, buildDetachedCms, certificateCommonName, createTestSigner, createTestTimestampAuthority, generateSigningKeyPair, indexedDbKeyStore, memoryKeyStore, parseDetachedCms, personalSigner, profileFor, remoteSigner, selfSignedCertificate, sign, validateChain, validateSignatures, verifyCmsSignature, verifyForCompletion, webCryptoSigner };
 
 //# sourceMappingURL=index.js.map