@embedpdf/core-signature 3.0.0-next.13

package/dist/index.js

@@ -0,0 +1,843 @@
+import * as asn1js from "asn1js";
+import * as pkijs from "pkijs";
+//#region src/cms/engine.ts
+let ensured = false;
+/**
+* PKI.js needs a WebCrypto engine. Browsers and Node ≥ 19 expose
+* `globalThis.crypto`; register it once, lazily, so importing this package
+* has no side effect.
+*/
+function ensureEngine() {
+	if (!ensured) {
+		ensured = true;
+		if (!pkijs.getCrypto()) {
+			const webcrypto = globalThis.crypto;
+			if (!webcrypto?.subtle) throw new Error("@embedpdf/core-signature needs WebCrypto (globalThis.crypto.subtle)");
+			pkijs.setEngine("embedpdf", new pkijs.CryptoEngine({
+				name: "embedpdf",
+				crypto: webcrypto
+			}));
+		}
+	}
+	return pkijs.getCrypto(true);
+}
+function toArrayBuffer(view) {
+	const copy = new Uint8Array(view.byteLength);
+	copy.set(view);
+	return copy.buffer;
+}
+function bytesEqual(a, b) {
+	if (a.byteLength !== b.byteLength) return false;
+	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+//#endregion
+//#region src/cms/oids.ts
+const OID = {
+	data: "1.2.840.113549.1.7.1",
+	signedData: "1.2.840.113549.1.7.2",
+	contentType: "1.2.840.113549.1.9.3",
+	messageDigest: "1.2.840.113549.1.9.4",
+	signingTime: "1.2.840.113549.1.9.5",
+	signingCertificateV2: "1.2.840.113549.1.9.16.2.47",
+	timestampToken: "1.2.840.113549.1.9.16.2.14",
+	sha1: "1.3.14.3.2.26",
+	sha256: "2.16.840.1.101.3.4.2.1",
+	sha384: "2.16.840.1.101.3.4.2.2",
+	sha512: "2.16.840.1.101.3.4.2.3",
+	rsaEncryption: "1.2.840.113549.1.1.1",
+	sha256WithRsa: "1.2.840.113549.1.1.11",
+	sha384WithRsa: "1.2.840.113549.1.1.12",
+	sha512WithRsa: "1.2.840.113549.1.1.13",
+	rsaPss: "1.2.840.113549.1.1.10",
+	mgf1: "1.2.840.113549.1.1.8",
+	ecdsaSha256: "1.2.840.10045.4.3.2",
+	ecdsaSha384: "1.2.840.10045.4.3.3",
+	ecdsaSha512: "1.2.840.10045.4.3.4",
+	subjectKeyIdentifier: "2.5.29.14",
+	keyUsage: "2.5.29.15",
+	basicConstraints: "2.5.29.19",
+	commonName: "2.5.4.3"
+};
+const DIGEST_BY_OID = {
+	[OID.sha1]: "sha1",
+	[OID.sha256]: "sha256",
+	[OID.sha384]: "sha384",
+	[OID.sha512]: "sha512"
+};
+const OID_BY_DIGEST = {
+	sha1: OID.sha1,
+	sha256: OID.sha256,
+	sha384: OID.sha384,
+	sha512: OID.sha512
+};
+/** WebCrypto hash names. */
+const WEBCRYPTO_HASH = {
+	sha1: "SHA-1",
+	sha256: "SHA-256",
+	sha384: "SHA-384",
+	sha512: "SHA-512"
+};
+const DIGEST_LENGTH = {
+	sha1: 20,
+	sha256: 32,
+	sha384: 48,
+	sha512: 64
+};
+//#endregion
+//#region src/cms/parse.ts
+var CmsError = class extends Error {
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+		this.name = "CmsError";
+	}
+};
+/** Parse a detached CMS SignedData with exactly one signer. Throws `CmsError`. */
+function parseDetachedCms(cms) {
+	return parseCmsInternal(cms).parsed;
+}
+function parseCmsInternal(cms) {
+	if (cms.byteLength === 0) throw new CmsError("malformed", "empty CMS");
+	const asn1 = asn1js.fromBER(toArrayBuffer(cms));
+	if (asn1.offset === -1) throw new CmsError("malformed", "CMS is not valid BER");
+	let contentInfo;
+	let signedData;
+	try {
+		contentInfo = new pkijs.ContentInfo({ schema: asn1.result });
+		if (contentInfo.contentType !== OID.signedData) throw new CmsError("unsupported", `CMS content type ${contentInfo.contentType} is not SignedData`);
+		signedData = new pkijs.SignedData({ schema: contentInfo.content });
+	} catch (err) {
+		if (err instanceof CmsError) throw err;
+		throw new CmsError("malformed", `CMS does not parse as SignedData: ${err.message}`);
+	}
+	if (signedData.encapContentInfo.eContent) throw new CmsError("unsupported", "CMS carries encapsulated content; a PDF signature is detached");
+	if (signedData.signerInfos.length !== 1) throw new CmsError("unsupported", `CMS has ${signedData.signerInfos.length} signers; exactly one is expected`);
+	const signerInfo = signedData.signerInfos[0];
+	const digestAlgorithm = DIGEST_BY_OID[signerInfo.digestAlgorithm.algorithmId];
+	if (!digestAlgorithm) throw new CmsError("unsupported", `digest algorithm ${signerInfo.digestAlgorithm.algorithmId}`);
+	const certificates = (signedData.certificates ?? []).filter((c) => c instanceof pkijs.Certificate);
+	const signerCertificate = findSignerCertificate(signerInfo, certificates);
+	if (!signerCertificate) throw new CmsError("malformed", "the signer certificate is not carried by the CMS");
+	const signedAttrs = signerInfo.signedAttrs?.attributes ?? [];
+	if (signedAttrs.length === 0) throw new CmsError("unsupported", "CMS has no signed attributes; a PDF signature needs message-digest");
+	const attr = (type) => signedAttrs.find((a) => a.type === type);
+	const contentType = attr(OID.contentType);
+	if (contentType && contentType.values[0]?.valueBlock?.toString?.() !== OID.data) {
+		const oid = contentType.values[0];
+		if (!oid || oid.valueBlock.toString() !== OID.data) throw new CmsError("unsupported", "CMS content-type attribute is not id-data");
+	}
+	const messageDigestValue = attr(OID.messageDigest)?.values[0];
+	if (!messageDigestValue || !(messageDigestValue instanceof asn1js.OctetString)) throw new CmsError("malformed", "CMS has no message-digest attribute");
+	const messageDigest = new Uint8Array(messageDigestValue.valueBlock.valueHexView);
+	let signingTime = null;
+	const timeValue = attr(OID.signingTime)?.values[0];
+	if (timeValue instanceof asn1js.UTCTime || timeValue instanceof asn1js.GeneralizedTime) signingTime = timeValue.toDate();
+	const essAttr = attr(OID.signingCertificateV2);
+	let essCertHash = null;
+	if (essAttr) {
+		const members = ((essAttr.values[0]?.valueBlock?.value?.[0])?.valueBlock?.value?.[0])?.valueBlock?.value ?? [];
+		let cursor = 0;
+		const head = members[0];
+		if (head instanceof asn1js.Sequence && head.valueBlock.value[0] instanceof asn1js.ObjectIdentifier) {
+			if (head.valueBlock.value[0].valueBlock.toString() !== OID.sha256) throw new CmsError("unsupported", "signing-certificate-v2 uses a hash other than SHA-256");
+			cursor = 1;
+		}
+		const hash = members[cursor];
+		if (!(hash instanceof asn1js.OctetString)) throw new CmsError("malformed", "signing-certificate-v2 carries no certHash");
+		essCertHash = new Uint8Array(hash.valueBlock.valueHexView);
+	}
+	let timestampToken = null;
+	const tokenAttr = signerInfo.unsignedAttrs?.attributes.find((a) => a.type === OID.timestampToken);
+	if (tokenAttr?.values[0]) timestampToken = new Uint8Array(tokenAttr.values[0].toBER(false));
+	const ordered = [signerCertificate, ...certificates.filter((c) => c !== signerCertificate)];
+	return {
+		parsed: {
+			digestAlgorithm,
+			messageDigest,
+			signingTime,
+			signerCertificate: certDer(signerCertificate),
+			certificates: ordered.map(certDer),
+			signatureAlgorithm: signerInfo.signatureAlgorithm.algorithmId,
+			signingCertificateV2: essAttr !== void 0,
+			timestampToken
+		},
+		signedData,
+		signerInfo,
+		signerCertificate,
+		certificates: ordered,
+		essCertHash
+	};
+}
+function certDer(cert) {
+	return new Uint8Array(cert.toSchema(true).toBER(false));
+}
+function findSignerCertificate(signerInfo, certificates) {
+	const sid = signerInfo.sid;
+	if (sid instanceof pkijs.IssuerAndSerialNumber) {
+		for (const cert of certificates) if (cert.issuer.isEqual(sid.issuer) && bytesEqual(new Uint8Array(cert.serialNumber.valueBlock.valueHexView), new Uint8Array(sid.serialNumber.valueBlock.valueHexView))) return cert;
+		return null;
+	}
+	const ski = sid?.valueBlock?.valueHexView;
+	if (!ski) return null;
+	for (const cert of certificates) {
+		const ext = cert.extensions?.find((e) => e.extnID === OID.subjectKeyIdentifier);
+		const value = ext ? asn1js.fromBER(ext.extnValue.valueBlock.valueHexView) : null;
+		const inner = value && value.offset !== -1 ? value.result : null;
+		if (inner && bytesEqual(new Uint8Array(inner.valueBlock.valueHexView), new Uint8Array(ski))) return cert;
+	}
+	return null;
+}
+//#endregion
+//#region src/cms/verify.ts
+/** The DER of the signed attributes as they are signed: re-tagged as a SET. */
+function signedAttributesDer(signerInfo) {
+	const set = new asn1js.Set({ value: (signerInfo.signedAttrs?.attributes ?? []).map((a) => a.toSchema()) });
+	return new Uint8Array(set.toBER(false));
+}
+/**
+* Does the CMS's signature verify with the certificate it names, over the
+* attributes it signed? Says nothing about the content: the message digest
+* is compared by the caller (`validateSignatures`, `verifyForCompletion`).
+* `unsupported` means the algorithm is unknown to this engine, which is
+* never `invalid`.
+*/
+async function verifyCmsSignature(cms) {
+	let internal;
+	try {
+		internal = cms instanceof Uint8Array ? parseCmsInternal(cms) : cms;
+	} catch (err) {
+		return err instanceof CmsError && err.reason === "unsupported" ? "unsupported" : "invalid";
+	}
+	const engine = ensureEngine();
+	const { signerInfo, signerCertificate, parsed, essCertHash } = internal;
+	if (essCertHash) {
+		if (!bytesEqual(new Uint8Array(await engine.digest("SHA-256", toArrayBuffer(parsed.signerCertificate))), essCertHash)) return "invalid";
+	}
+	try {
+		return await engine.verifyWithPublicKey(toArrayBuffer(signedAttributesDer(signerInfo)), signerInfo.signature, signerCertificate.subjectPublicKeyInfo, signerInfo.signatureAlgorithm, WEBCRYPTO_HASH[parsed.digestAlgorithm]) ? "valid" : "invalid";
+	} catch (err) {
+		const message = err.message ?? "";
+		return /unsupported|unknown|not supported|not implemented/i.test(message) ? "unsupported" : "invalid";
+	}
+}
+//#endregion
+//#region src/cms/build.ts
+/**
+* Build a detached CMS SignedData around a raw signature: content-type,
+* message-digest, and for CAdES-B the ESS signing-certificate-v2 attribute;
+* the signer's certificate chain; one SignerInfo identified by issuer and
+* serial number.
+*/
+async function buildDetachedCms(input) {
+	const engine = ensureEngine();
+	if (input.digest.byteLength !== DIGEST_LENGTH[input.hash]) throw new Error(`digest is ${input.digest.byteLength} bytes; ${input.hash} needs ${DIGEST_LENGTH[input.hash]}`);
+	if (input.signer.hash !== input.hash) throw new Error(`the signer hashes with ${input.signer.hash}, the document was prepared with ${input.hash}`);
+	if (input.signer.certificateChain.length === 0) throw new Error("the signer carries no certificate");
+	const chain = input.signer.certificateChain.map((der) => pkijs.Certificate.fromBER(toArrayBuffer(der)));
+	const signerCert = chain[0];
+	const attributes = [new pkijs.Attribute({
+		type: OID.contentType,
+		values: [new asn1js.ObjectIdentifier({ value: OID.data })]
+	}), new pkijs.Attribute({
+		type: OID.messageDigest,
+		values: [new asn1js.OctetString({ valueHex: toArrayBuffer(input.digest) })]
+	})];
+	if (input.profile === "pkcs7" && input.signingTime) attributes.push(new pkijs.Attribute({
+		type: OID.signingTime,
+		values: [new asn1js.UTCTime({ valueDate: input.signingTime })]
+	}));
+	if (input.profile === "cades-b") {
+		const certHash = await engine.digest("SHA-256", toArrayBuffer(input.signer.certificateChain[0]));
+		const issuerSerial = new pkijs.IssuerSerial({
+			issuer: new pkijs.GeneralNames({ names: [new pkijs.GeneralName({
+				type: 4,
+				value: signerCert.issuer
+			})] }),
+			serialNumber: signerCert.serialNumber
+		});
+		const essCertId = new asn1js.Sequence({ value: [new asn1js.OctetString({ valueHex: certHash }), issuerSerial.toSchema()] });
+		attributes.push(new pkijs.Attribute({
+			type: OID.signingCertificateV2,
+			values: [new asn1js.Sequence({ value: [new asn1js.Sequence({ value: [essCertId] })] })]
+		}));
+	}
+	const digestAlgorithm = new pkijs.AlgorithmIdentifier({ algorithmId: OID_BY_DIGEST[input.hash] });
+	const signerInfo = new pkijs.SignerInfo({
+		version: 1,
+		sid: new pkijs.IssuerAndSerialNumber({
+			issuer: signerCert.issuer,
+			serialNumber: signerCert.serialNumber
+		}),
+		digestAlgorithm,
+		signedAttrs: new pkijs.SignedAndUnsignedAttributes({
+			type: 0,
+			attributes
+		}),
+		signatureAlgorithm: signatureAlgorithmFor(input.signer.algorithm, input.hash)
+	});
+	const toSign = new asn1js.Set({ value: attributes.map((a) => a.toSchema()) }).toBER(false);
+	const raw = await input.signer.sign(new Uint8Array(toSign));
+	const signature = input.signer.algorithm === "ECDSA" ? pkijs.createCMSECDSASignature(toArrayBuffer(raw)) : toArrayBuffer(raw);
+	signerInfo.signature = new asn1js.OctetString({ valueHex: signature });
+	const signedData = new pkijs.SignedData({
+		version: 1,
+		digestAlgorithms: [digestAlgorithm],
+		encapContentInfo: new pkijs.EncapsulatedContentInfo({ eContentType: OID.data }),
+		certificates: chain,
+		signerInfos: [signerInfo]
+	});
+	const contentInfo = new pkijs.ContentInfo({
+		contentType: OID.signedData,
+		content: signedData.toSchema(true)
+	});
+	return new Uint8Array(contentInfo.toSchema().toBER(false));
+}
+function signatureAlgorithmFor(algorithm, hash) {
+	switch (algorithm) {
+		case "RSA-PKCS1-v1_5": return new pkijs.AlgorithmIdentifier({
+			algorithmId: {
+				sha256: OID.sha256WithRsa,
+				sha384: OID.sha384WithRsa,
+				sha512: OID.sha512WithRsa
+			}[hash],
+			algorithmParams: new asn1js.Null()
+		});
+		case "ECDSA": return new pkijs.AlgorithmIdentifier({ algorithmId: {
+			sha256: OID.ecdsaSha256,
+			sha384: OID.ecdsaSha384,
+			sha512: OID.ecdsaSha512
+		}[hash] });
+		case "RSA-PSS": {
+			const hashAlgorithm = new pkijs.AlgorithmIdentifier({
+				algorithmId: OID_BY_DIGEST[hash],
+				algorithmParams: new asn1js.Null()
+			});
+			const params = new pkijs.RSASSAPSSParams({
+				hashAlgorithm,
+				maskGenAlgorithm: new pkijs.AlgorithmIdentifier({
+					algorithmId: OID.mgf1,
+					algorithmParams: hashAlgorithm.toSchema()
+				}),
+				saltLength: DIGEST_LENGTH[hash]
+			});
+			return new pkijs.AlgorithmIdentifier({
+				algorithmId: OID.rsaPss,
+				algorithmParams: params.toSchema()
+			});
+		}
+	}
+}
+//#endregion
+//#region src/gate.ts
+/**
+* The gate between a signer's answer and `signatures.complete`: the CMS
+* must fit the reserved room, hash with the prepared algorithm, carry the
+* prepared digest as its message digest, verify with its own certificate,
+* and match the profile the `/SubFilter` promises (CAdES: ESS
+* signing-certificate-v2 present, no CMS signing-time). A bad CMS never
+* reaches the document.
+*/
+async function verifyForCompletion(input) {
+	const { cms, prepared, profile } = input;
+	if (cms.byteLength > prepared.contentsSize) return {
+		ok: false,
+		reason: "too-large",
+		detail: `the CMS is ${cms.byteLength} bytes; ${prepared.contentsSize} were reserved`
+	};
+	let internal;
+	try {
+		internal = parseCmsInternal(cms);
+	} catch (err) {
+		return {
+			ok: false,
+			reason: "malformed",
+			detail: err instanceof CmsError ? err.message : String(err)
+		};
+	}
+	const parsed = internal.parsed;
+	if (parsed.digestAlgorithm !== prepared.algorithm) return {
+		ok: false,
+		reason: "algorithm-mismatch",
+		detail: `the CMS digests with ${parsed.digestAlgorithm}, the document was prepared with ${prepared.algorithm}`
+	};
+	if (!bytesEqual(parsed.messageDigest, prepared.digest)) return {
+		ok: false,
+		reason: "digest-mismatch",
+		detail: "the CMS message digest is not the prepared digest"
+	};
+	if (profile === "cades-b") {
+		if (!parsed.signingCertificateV2) return {
+			ok: false,
+			reason: "profile-violation",
+			detail: "CAdES requires the ESS signing-certificate-v2 attribute"
+		};
+		if (parsed.signingTime) return {
+			ok: false,
+			reason: "profile-violation",
+			detail: "PAdES forbids the CMS signing-time attribute"
+		};
+	}
+	const cryptography = await verifyCmsSignature(internal);
+	if (cryptography !== "valid") return {
+		ok: false,
+		reason: "signature-invalid",
+		detail: cryptography === "unsupported" ? "the signature algorithm is not supported" : "the signature does not verify"
+	};
+	return { ok: true };
+}
+//#endregion
+//#region src/trust.ts
+/**
+* Build and validate the certificate path from the CMS's signer to one
+* of the port's anchors at `at`. No port, or a port with no anchors, is
+* `unknown`: nothing was checked, and nothing was refused.
+*/
+async function validateChain(cms, trust, at = { kind: "now" }) {
+	if (!trust) return {
+		status: "unknown",
+		reason: "no trust anchors configured"
+	};
+	const anchors = await trust.anchors();
+	if (anchors.length === 0) return {
+		status: "unknown",
+		reason: "no trust anchors configured"
+	};
+	ensureEngine();
+	let internal;
+	try {
+		internal = cms instanceof Uint8Array ? parseCmsInternal(cms) : cms;
+	} catch (err) {
+		return {
+			status: "untrusted",
+			reason: err.message
+		};
+	}
+	const trustedCerts = anchors.map((der) => pkijs.Certificate.fromBER(toArrayBuffer(der)));
+	const chainEngine = new pkijs.CertificateChainValidationEngine({
+		certs: internal.certificates,
+		trustedCerts,
+		checkDate: at.kind === "now" ? /* @__PURE__ */ new Date() : at.genTime
+	});
+	try {
+		const result = await chainEngine.verify();
+		if (!result.result) return {
+			status: "untrusted",
+			reason: result.resultMessage || `chain validation code ${result.resultCode}`
+		};
+		return {
+			status: "trusted",
+			path: (result.certificatePath ?? []).map((c) => new Uint8Array(c.toSchema(true).toBER(false)))
+		};
+	} catch (err) {
+		return {
+			status: "untrusted",
+			reason: err.message
+		};
+	}
+}
+//#endregion
+//#region src/sign.ts
+var SigningError = class extends Error {
+	constructor(reason, detail) {
+		super(`signing refused (${reason}): ${detail}`);
+		this.reason = reason;
+		this.name = "SigningError";
+	}
+};
+function profileFor(subFilter) {
+	return subFilter === "adbe.pkcs7.detached" ? "pkcs7" : "cades-b";
+}
+/**
+* Sign a field in one call: `prepare` on the engine, the signer turns the
+* digest into a CMS (or a raw signature this package wraps), the gate
+* checks the CMS matches what was prepared, `complete` installs it. Any
+* failure aborts the candidate and rethrows; the document is never left
+* with a pending signing.
+*/
+async function sign(doc, input) {
+	if (!doc.signatures) throw new Error("this engine does not implement signatures");
+	const { signer, ...rest } = input;
+	const subFilter = rest.subFilter ?? "ETSI.CAdES.detached";
+	const profile = profileFor(subFilter);
+	const digest = rest.digest ?? (signer.kind === "raw" ? signer.hash : "sha256");
+	const prepared = await doc.signatures.prepare({
+		...rest,
+		subFilter,
+		digest
+	});
+	try {
+		const cms = signer.kind === "cms" ? await signer.sign({
+			digest: prepared.digest,
+			algorithm: prepared.algorithm,
+			subFilter
+		}) : await buildDetachedCms({
+			digest: prepared.digest,
+			hash: prepared.algorithm,
+			profile,
+			signer,
+			signingTime: profile === "pkcs7" ? /* @__PURE__ */ new Date() : void 0
+		});
+		const gate = await verifyForCompletion({
+			cms,
+			prepared,
+			profile
+		});
+		if (!gate.ok) throw new SigningError(gate.reason, gate.detail);
+		return await doc.signatures.complete({
+			signingId: prepared.signingId,
+			cms,
+			expectedVersion: prepared.expectedVersion
+		});
+	} catch (err) {
+		await doc.signatures.abort(prepared.signingId).catch(() => void 0);
+		throw err;
+	}
+}
+//#endregion
+//#region src/verdict.ts
+/**
+* Validate every signature of a document: integrity from the engine's
+* bytes, cryptography from the CMS, trust from the caller's anchors.
+*/
+async function validateSignatures(doc, opts = {}) {
+	if (!doc.signatures) throw new Error("this engine does not implement signatures");
+	const snapshot = await doc.signatures.list();
+	const verdicts = [];
+	for (const signature of snapshot.signatures) {
+		if (!signature.signed) continue;
+		verdicts.push(await validateOne(doc, snapshot, signature, opts));
+	}
+	return verdicts;
+}
+async function validateOne(doc, snapshot, signature, opts) {
+	const at = opts.at ?? { kind: "now" };
+	let integrity = "indeterminate";
+	let cryptography = "unsupported";
+	let trust = "unknown";
+	let trustReason;
+	let internal = null;
+	let cms = null;
+	if (!snapshot.chainValid || signature.coverage === "malformed") integrity = snapshot.chainValid ? "invalid" : "indeterminate";
+	else try {
+		internal = parseCmsInternal(await doc.signatures.contents(signature.field));
+		cms = internal.parsed;
+		const digestMatches = bytesEqual(await doc.signatures.digest(signature.field, cms.digestAlgorithm), cms.messageDigest);
+		integrity = signature.coverage === "whole-revision" && digestMatches ? "valid" : "invalid";
+	} catch (err) {
+		integrity = err instanceof CmsError && err.reason === "unsupported" ? "indeterminate" : "invalid";
+		if (!(err instanceof CmsError)) integrity = "indeterminate";
+	}
+	if (internal) {
+		cryptography = await verifyCmsSignature(internal);
+		const chain = await validateChain(internal, opts.trust, at);
+		trust = chain.status;
+		trustReason = chain.reason;
+	}
+	const modifications = await modificationsOf(doc, snapshot, signature, opts.until ?? "persisted");
+	let summary;
+	if (integrity === "invalid" || cryptography === "invalid" || modifications.verdict === "forbidden") summary = "invalid";
+	else if (integrity === "indeterminate" || cryptography === "unsupported" || modifications.verdict === "indeterminate") summary = "indeterminate";
+	else summary = trust === "trusted" ? "valid" : "valid-untrusted";
+	return {
+		signature,
+		integrity,
+		cryptography,
+		trust,
+		trustReason,
+		validatedAt: at,
+		modifications,
+		summary,
+		cms
+	};
+}
+/**
+* What changed after the signature, from the engine's revision analysis:
+* the current document judged against the revision the signature sealed
+* (net state; a certification also replays every intervening revision).
+* A signature that seals the last revision is `unchanged` without analysis.
+*/
+async function modificationsOf(doc, snapshot, signature, until) {
+	if (signature.revisionIndex === null) return {
+		verdict: "indeterminate",
+		detail: "the signature seals no whole revision",
+		basis: "persisted"
+	};
+	if (until === "persisted" && signature.revisionIndex === snapshot.revisions.length - 1) return {
+		verdict: "unchanged",
+		basis: "persisted"
+	};
+	try {
+		const analysis = await doc.signatures.analyze({
+			since: { signatureIndex: signature.index },
+			until
+		});
+		const primary = analysis.current.primary;
+		const detail = primary && primary.verdict === "forbidden" ? `object ${primary.objectNumber}, ${primary.rule}${primary.detail ? `: ${primary.detail}` : ""}` : primary && primary.verdict === "incomplete" ? `object ${primary.objectNumber}: ${primary.detail ?? "incomplete evidence"}` : void 0;
+		return {
+			verdict: analysis.current.verdict,
+			detail,
+			basis: analysis.basis.source,
+			...analysis.later.revisionCount > 0 ? { laterRevisions: analysis.later.revisionCount } : {},
+			...analysis.later.undoneObjectNumbers.length > 0 ? { undone: true } : {}
+		};
+	} catch (err) {
+		return {
+			verdict: "indeterminate",
+			detail: `analysis failed: ${err.message}`,
+			basis: "persisted"
+		};
+	}
+}
+//#endregion
+//#region src/signers/self-signed.ts
+/**
+* A self-signed certificate over a WebCrypto key pair: the shape a personal
+* signer, a test signer, and a demo all need. It is its own trust anchor and
+* nothing else's — Acrobat shows a signature made with it as "validity
+* unknown" until the reader trusts the certificate explicitly.
+*/
+async function selfSignedCertificate(input) {
+	ensureEngine();
+	const cert = new pkijs.Certificate();
+	cert.version = 2;
+	const serial = /* @__PURE__ */ new Uint8Array(8);
+	globalThis.crypto.getRandomValues(serial);
+	serial[0] &= 127;
+	cert.serialNumber = new asn1js.Integer({ valueHex: serial.buffer });
+	const name = new pkijs.AttributeTypeAndValue({
+		type: OID.commonName,
+		value: new asn1js.Utf8String({ value: input.commonName })
+	});
+	cert.issuer.typesAndValues.push(name);
+	cert.subject.typesAndValues.push(name);
+	const now = Date.now();
+	cert.notBefore.value = /* @__PURE__ */ new Date(now - 24 * 3600 * 1e3);
+	cert.notAfter.value = new Date(now + (input.validityDays ?? 365) * 24 * 3600 * 1e3);
+	const basicConstraints = new pkijs.BasicConstraints({ cA: true });
+	const keyUsage = new asn1js.BitString({
+		valueHex: new Uint8Array([132]).buffer,
+		unusedBits: 2
+	});
+	cert.extensions = [new pkijs.Extension({
+		extnID: OID.basicConstraints,
+		critical: true,
+		extnValue: basicConstraints.toSchema().toBER(false),
+		parsedValue: basicConstraints
+	}), new pkijs.Extension({
+		extnID: OID.keyUsage,
+		critical: true,
+		extnValue: keyUsage.toBER(false)
+	})];
+	await cert.subjectPublicKeyInfo.importKey(input.publicKey);
+	await cert.sign(input.privateKey, WEBCRYPTO_HASH[input.hash]);
+	return new Uint8Array(cert.toSchema(true).toBER(false));
+}
+/** The subject common name of a DER certificate, or null when it has none. */
+function certificateCommonName(der) {
+	ensureEngine();
+	const copy = new Uint8Array(der.byteLength);
+	copy.set(der);
+	const text = (pkijs.Certificate.fromBER(copy.buffer).subject.typesAndValues.find((entry) => entry.type === OID.commonName)?.value)?.valueBlock?.value;
+	return typeof text === "string" && text.length > 0 ? text : null;
+}
+//#endregion
+//#region src/signers/webcrypto.ts
+/**
+* A `RawSigner` over a WebCrypto private key: the key never leaves the
+* runtime. The algorithm and hash come from the key itself.
+*/
+function webCryptoSigner(input) {
+	const keyAlgorithm = input.privateKey.algorithm;
+	let algorithm;
+	let hash;
+	switch (keyAlgorithm.name) {
+		case "RSASSA-PKCS1-v1_5":
+			algorithm = "RSA-PKCS1-v1_5";
+			hash = hashFromWebCrypto(keyAlgorithm.hash.name);
+			break;
+		case "RSA-PSS":
+			algorithm = "RSA-PSS";
+			hash = hashFromWebCrypto(keyAlgorithm.hash.name);
+			break;
+		case "ECDSA":
+			algorithm = "ECDSA";
+			hash = input.hash ?? "sha256";
+			break;
+		default: throw new Error(`unsupported WebCrypto key algorithm ${keyAlgorithm.name}`);
+	}
+	return {
+		kind: "raw",
+		certificateChain: input.certificateChain,
+		algorithm,
+		hash,
+		async sign(data) {
+			const params = algorithm === "RSA-PSS" ? {
+				name: "RSA-PSS",
+				saltLength: {
+					sha256: 32,
+					sha384: 48,
+					sha512: 64
+				}[hash]
+			} : algorithm === "ECDSA" ? {
+				name: "ECDSA",
+				hash: WEBCRYPTO_HASH[hash]
+			} : { name: "RSASSA-PKCS1-v1_5" };
+			const copy = new Uint8Array(data.byteLength);
+			copy.set(data);
+			const signature = await globalThis.crypto.subtle.sign(params, input.privateKey, copy);
+			return new Uint8Array(signature);
+		}
+	};
+}
+function hashFromWebCrypto(name) {
+	switch (name) {
+		case "SHA-256": return "sha256";
+		case "SHA-384": return "sha384";
+		case "SHA-512": return "sha512";
+		default: throw new Error(`unsupported key hash ${name}`);
+	}
+}
+/**
+* A throwaway signer for tests and demos: a fresh key pair and a
+* self-signed certificate, never persisted. Trust it with
+* `{ anchors: async () => [signer.certificate] }`.
+*/
+async function createTestSigner(opts = {}) {
+	ensureEngine();
+	const hash = opts.hash ?? "sha256";
+	const keys = await generateSigningKeyPair(opts.algorithm ?? "RSA-PKCS1-v1_5", hash, true);
+	const certificate = await selfSignedCertificate({
+		publicKey: keys.publicKey,
+		privateKey: keys.privateKey,
+		commonName: opts.commonName ?? "EmbedPDF test signer",
+		hash
+	});
+	return {
+		...webCryptoSigner({
+			privateKey: keys.privateKey,
+			certificateChain: [certificate],
+			hash
+		}),
+		certificate,
+		privateKey: keys.privateKey
+	};
+}
+/** A WebCrypto signing key pair; `extractable: false` keeps the private key inside the runtime for good. */
+async function generateSigningKeyPair(algorithm, hash, extractable) {
+	return await globalThis.crypto.subtle.generateKey(algorithm === "ECDSA" ? {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	} : {
+		name: algorithm === "RSA-PSS" ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+		modulusLength: 2048,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		]),
+		hash: WEBCRYPTO_HASH[hash]
+	}, extractable, ["sign", "verify"]);
+}
+//#endregion
+//#region src/signers/remote.ts
+/**
+* A `CmsSigner` over the customer's own signing service or HSM: the engine's
+* digest goes out, a finished detached CMS comes back. Nothing but the
+* digest (and which hash and profile it is for) ever leaves the runtime.
+*/
+function remoteSigner(input) {
+	return {
+		kind: "cms",
+		sign: (request) => input.sign(request)
+	};
+}
+//#endregion
+//#region src/signers/personal.ts
+/**
+* One self-signed identity per subject (a person's name), persisted in the
+* caller's store and created on first use. The private key is generated
+* non-extractable: it can sign, it can be stored by the browser, it can
+* never be read out. This is Preview's "sign with your own signature"
+* experience with real cryptography behind it — a reader who trusts the
+* certificate validates the signature; every other reader sees "validity
+* unknown", which is the honest answer for a self-issued identity.
+*/
+async function personalSigner(input) {
+	ensureEngine();
+	const hash = input.hash ?? "sha256";
+	let record = await input.store.load(input.subject);
+	if (!record) {
+		const keys = await generateSigningKeyPair(input.algorithm ?? "RSA-PKCS1-v1_5", hash, false);
+		const certificate = await selfSignedCertificate({
+			publicKey: keys.publicKey,
+			privateKey: keys.privateKey,
+			commonName: input.subject,
+			hash
+		});
+		record = {
+			privateKey: keys.privateKey,
+			certificate
+		};
+		await input.store.save(input.subject, record);
+	}
+	return {
+		...webCryptoSigner({
+			privateKey: record.privateKey,
+			certificateChain: [record.certificate],
+			hash
+		}),
+		certificate: record.certificate,
+		subject: input.subject
+	};
+}
+/** An in-memory store: tests, and runtimes without IndexedDB. */
+function memoryKeyStore() {
+	const records = /* @__PURE__ */ new Map();
+	return {
+		load: async (subject) => records.get(subject) ?? null,
+		save: async (subject, record) => {
+			records.set(subject, record);
+		},
+		remove: async (subject) => {
+			records.delete(subject);
+		}
+	};
+}
+/**
+* An IndexedDB store: the browser keeps the non-extractable `CryptoKey`
+* itself (structured clone), so the key survives reloads without ever
+* existing as bytes.
+*/
+function indexedDbKeyStore(dbName, opts = {}) {
+	const storeName = opts.storeName ?? "keys";
+	let opening = null;
+	const open = () => {
+		opening ?? (opening = new Promise((resolve, reject) => {
+			const request = indexedDB.open(dbName, 1);
+			request.onupgradeneeded = () => {
+				if (!request.result.objectStoreNames.contains(storeName)) request.result.createObjectStore(storeName);
+			};
+			request.onsuccess = () => resolve(request.result);
+			request.onerror = () => reject(request.error ?? /* @__PURE__ */ new Error("indexedDB open failed"));
+		}));
+		return opening;
+	};
+	const run = async (mode, op) => {
+		const db = await open();
+		return new Promise((resolve, reject) => {
+			const request = op(db.transaction(storeName, mode).objectStore(storeName));
+			request.onsuccess = () => resolve(request.result);
+			request.onerror = () => reject(request.error ?? /* @__PURE__ */ new Error("indexedDB request failed"));
+		});
+	};
+	return {
+		load: async (subject) => await run("readonly", (s) => s.get(subject)) ?? null,
+		save: (subject, record) => run("readwrite", (s) => s.put(record, subject)).then(() => void 0),
+		remove: (subject) => run("readwrite", (s) => s.delete(subject)).then(() => void 0)
+	};
+}
+//#endregion
+export { CmsError, SigningError, buildDetachedCms, certificateCommonName, createTestSigner, generateSigningKeyPair, indexedDbKeyStore, memoryKeyStore, parseDetachedCms, personalSigner, profileFor, remoteSigner, selfSignedCertificate, sign, validateChain, validateSignatures, verifyCmsSignature, verifyForCompletion, webCryptoSigner };
+
+//# sourceMappingURL=index.js.map