@kitsy/pdf 0.0.0-stage → 0.1.0

package/dist/chunk-4USCGC24.js

@@ -0,0 +1,304 @@
+import { PasswordInput } from './chunk-2K5X7L5J.js';
+import { readPkcs12, CertificatePasswordError, signPdfWithCertificate } from './chunk-U2ROTOPF.js';
+import { openRenderDocument, renderThumbnail } from './chunk-DPEJU4P6.js';
+import { describeCertificate, webCryptoSigner, verifyPdfSignatures } from './chunk-5OIMR74G.js';
+import { useSinglePdf } from './chunk-BK3MYSUS.js';
+import { PdfToolPage, PdfToolColumns, SideTips, SelectedPdfCard, FileDropzone, cardClass, SummaryList, secondaryButtonClass, primaryButtonClass, fieldLabelClass, inputClass, StatusBanner, BackToPdfTools } from './chunk-H6EERRCR.js';
+import { downloadBlob, toBaseName, formatBytes } from './chunk-EKHEY3LI.js';
+import { useRef, useState, useEffect, useCallback } from 'react';
+import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
+
+var REASONS = [
+  "I am the author of this document",
+  "I approve this document",
+  "I have reviewed this document",
+  "I agree to the terms of this document"
+];
+var BOX = { width: 0.38, height: 0.09 };
+var POSITIONS = {
+  "bottom-right": { x: 0.98 - BOX.width, y: 0.97 - BOX.height, label: "Bottom right" },
+  "bottom-left": { x: 0.02, y: 0.97 - BOX.height, label: "Bottom left" },
+  "top-right": { x: 0.98 - BOX.width, y: 0.03, label: "Top right" },
+  "top-left": { x: 0.02, y: 0.03, label: "Top left" }
+};
+var formatDate = (date) => date.toLocaleDateString(void 0, { year: "numeric", month: "short", day: "numeric" });
+function usePagePreview(bytes, pageIndex) {
+  const [preview, setPreview] = useState(null);
+  useEffect(() => {
+    if (!bytes) {
+      setPreview(null);
+      return void 0;
+    }
+    let cancelled = false;
+    let url = null;
+    let doc = null;
+    (async () => {
+      doc = await openRenderDocument(bytes);
+      const thumb = await renderThumbnail(doc, pageIndex + 1, 220);
+      url = thumb.url;
+      if (cancelled) URL.revokeObjectURL(url);
+      else setPreview(thumb);
+    })().catch(() => {
+    });
+    return () => {
+      cancelled = true;
+      if (url) URL.revokeObjectURL(url);
+      doc?.destroy();
+    };
+  }, [bytes, pageIndex]);
+  return preview;
+}
+function CertSignPdf() {
+  const certInputRef = useRef(null);
+  const [certFile, setCertFile] = useState(null);
+  const [certPassword, setCertPassword] = useState("");
+  const [signer, setSigner] = useState(null);
+  const [certificate, setCertificate] = useState(null);
+  const [reason, setReason] = useState(REASONS[1]);
+  const [customReason, setCustomReason] = useState("");
+  const [location, setLocation] = useState("");
+  const [visible, setVisible] = useState(true);
+  const [pageIndex, setPageIndex] = useState(0);
+  const [position, setPosition] = useState("bottom-right");
+  const [isWorking, setIsWorking] = useState(false);
+  const [status, setStatus] = useState({
+    tone: "info",
+    text: "Add a PDF and your certificate (.pfx or .p12) to sign it digitally."
+  });
+  useEffect(() => {
+    document.title = "Digital Signature (Certificate) | Apps";
+  }, []);
+  const onError = useCallback((text) => setStatus({ tone: "error", text }), []);
+  const onLoaded = useCallback(({ file, pageCount }) => {
+    setPageIndex(Math.max(0, pageCount - 1));
+    setStatus({ tone: "success", text: `${file.name} loaded. Now open your certificate.` });
+  }, []);
+  const pdf = useSinglePdf({ onError, onLoaded });
+  const preview = usePagePreview(visible ? pdf.bytes : null, pageIndex);
+  const forgetCertificate = () => {
+    setSigner(null);
+    setCertificate(null);
+    setCertPassword("");
+  };
+  const chooseCertificate = (file) => {
+    if (!file) return;
+    forgetCertificate();
+    setCertFile(file);
+  };
+  const openCertificate = async () => {
+    if (!certFile) return;
+    setIsWorking(true);
+    try {
+      const identity = readPkcs12(new Uint8Array(await certFile.arrayBuffer()), certPassword);
+      const summary = describeCertificate(identity.certificate);
+      const nextSigner = await webCryptoSigner(identity);
+      identity.privateKeyPkcs8.fill(0);
+      setSigner(nextSigner);
+      setCertificate(summary);
+      setCertPassword("");
+      setStatus({ tone: "success", text: `Certificate for ${summary.commonName || "(no name)"} opened.` });
+    } catch (error) {
+      setStatus({
+        tone: "error",
+        text: error instanceof CertificatePasswordError ? error.message : error?.message || "Could not open the certificate."
+      });
+    } finally {
+      setIsWorking(false);
+    }
+  };
+  const now = /* @__PURE__ */ new Date();
+  const expired = certificate && (now > certificate.notAfter || now < certificate.notBefore);
+  const finalReason = reason === "custom" ? customReason.trim() : reason;
+  const canSign = Boolean(pdf.bytes && signer && !pdf.signed && !expired);
+  const handleSign = async (event) => {
+    event.preventDefault();
+    if (!canSign) return;
+    setIsWorking(true);
+    setStatus({ tone: "info", text: "Signing your PDF..." });
+    try {
+      const spot2 = POSITIONS[position];
+      const signed = await signPdfWithCertificate(pdf.bytes, signer, {
+        reason: finalReason,
+        location: location.trim(),
+        visible: visible ? { pageIndex, x: spot2.x, y: spot2.y, ...BOX } : null
+      });
+      const [check] = await verifyPdfSignatures(signed);
+      if (!check?.intact || !check.coversWholeFile) {
+        throw new Error("The signed file did not pass verification. Nothing was downloaded.");
+      }
+      const blob = new Blob([signed], { type: "application/pdf" });
+      downloadBlob(blob, `${toBaseName(pdf.file.name, "document")}-signed.pdf`);
+      setStatus({
+        tone: "success",
+        text: `Signed and verified (${formatBytes(blob.size)}). Your download has started.`
+      });
+    } catch (error) {
+      setStatus({ tone: "error", text: `Signing failed: ${error?.message || "Please try again."}` });
+    } finally {
+      setIsWorking(false);
+    }
+  };
+  const busy = isWorking || pdf.isReading;
+  const spot = POSITIONS[position];
+  return /* @__PURE__ */ jsx(
+    PdfToolPage,
+    {
+      title: "Digital Signature (Certificate)",
+      description: "Sign a PDF with your digital certificate (.pfx / .p12). Viewers such as Adobe Reader show who signed it and flag any later change. Your certificate and its private key never leave your browser.",
+      stats: [
+        { value: "PAdES", label: "Standard" },
+        { value: certificate ? "Ready" : "-", label: "Certificate" }
+      ],
+      children: /* @__PURE__ */ jsx(
+        PdfToolColumns,
+        {
+          main: /* @__PURE__ */ jsxs("form", { onSubmit: handleSign, children: [
+            pdf.file ? /* @__PURE__ */ jsx(SelectedPdfCard, { file: pdf.file, pageCount: pdf.pageCount, onRemove: pdf.clear, disabled: busy }) : /* @__PURE__ */ jsx(
+              FileDropzone,
+              {
+                accept: ".pdf,application/pdf",
+                disabled: busy,
+                onFiles: pdf.selectFiles,
+                title: "Drag and drop the PDF to sign",
+                hint: "or click to browse from your device"
+              }
+            ),
+            pdf.signed ? /* @__PURE__ */ jsx("p", { className: "mt-2 text-xs text-rose-700 dark:text-rose-300", children: "Adding a second signature to an already-signed PDF is not supported yet." }) : null,
+            /* @__PURE__ */ jsxs("section", { className: `mt-5 ${cardClass}`, children: [
+              /* @__PURE__ */ jsx("h3", { className: "text-sm font-semibold text-slate-900 dark:text-slate-100", children: "1. Your certificate" }),
+              /* @__PURE__ */ jsx(
+                "input",
+                {
+                  ref: certInputRef,
+                  type: "file",
+                  accept: ".pfx,.p12,application/x-pkcs12",
+                  className: "hidden",
+                  onChange: (event) => {
+                    chooseCertificate(event.target.files?.[0]);
+                    event.target.value = "";
+                  }
+                }
+              ),
+              certificate ? /* @__PURE__ */ jsxs("div", { className: "mt-3", children: [
+                /* @__PURE__ */ jsx(
+                  SummaryList,
+                  {
+                    items: [
+                      { label: "Signer", value: certificate.commonName || "(no name)" },
+                      { label: "Organisation", value: certificate.organization || "-" },
+                      { label: "Issued by", value: certificate.issuerCommonName || certificate.issuerOrganization || "-" },
+                      { label: "Valid", value: `${formatDate(certificate.notBefore)} \u2013 ${formatDate(certificate.notAfter)}` }
+                    ]
+                  }
+                ),
+                expired ? /* @__PURE__ */ jsx("p", { className: "mt-2 text-xs text-rose-700 dark:text-rose-300", children: "This certificate is not valid today, so it cannot be used to sign." }) : certificate.selfSigned ? /* @__PURE__ */ jsx("p", { className: "mt-2 text-xs text-amber-700 dark:text-amber-300", children: "Self-signed certificate: the signature is valid, but viewers will show the signer as untrusted." }) : null,
+                /* @__PURE__ */ jsxs("button", { type: "button", onClick: forgetCertificate, disabled: busy, className: `mt-3 ${secondaryButtonClass}`, children: [
+                  /* @__PURE__ */ jsx("i", { className: "fa-solid fa-rotate" }),
+                  "Use a different certificate"
+                ] })
+              ] }) : /* @__PURE__ */ jsxs("div", { className: "mt-3 grid gap-3 sm:grid-cols-[auto_minmax(0,1fr)_auto] sm:items-end", children: [
+                /* @__PURE__ */ jsxs("button", { type: "button", onClick: () => certInputRef.current?.click(), disabled: busy, className: secondaryButtonClass, children: [
+                  /* @__PURE__ */ jsx("i", { className: "fa-solid fa-id-card" }),
+                  certFile ? certFile.name : "Choose .pfx / .p12"
+                ] }),
+                /* @__PURE__ */ jsx(
+                  PasswordInput,
+                  {
+                    id: "certificate-password",
+                    label: "Certificate password",
+                    value: certPassword,
+                    onChange: setCertPassword,
+                    disabled: busy || !certFile,
+                    autoComplete: "off"
+                  }
+                ),
+                /* @__PURE__ */ jsxs("button", { type: "button", onClick: openCertificate, disabled: busy || !certFile, className: primaryButtonClass, children: [
+                  /* @__PURE__ */ jsx("i", { className: "fa-solid fa-unlock-keyhole" }),
+                  "Open"
+                ] })
+              ] })
+            ] }),
+            /* @__PURE__ */ jsxs("fieldset", { className: `mt-5 ${cardClass}`, disabled: busy, children: [
+              /* @__PURE__ */ jsx("legend", { className: "px-1 text-sm font-semibold text-slate-900 dark:text-slate-100", children: "2. Signature details" }),
+              /* @__PURE__ */ jsxs("div", { className: "grid gap-4 sm:grid-cols-2", children: [
+                /* @__PURE__ */ jsxs("label", { className: fieldLabelClass, children: [
+                  "Reason",
+                  /* @__PURE__ */ jsxs("select", { value: reason, onChange: (event) => setReason(event.target.value), className: `mt-2 ${inputClass}`, children: [
+                    REASONS.map((option) => /* @__PURE__ */ jsx("option", { value: option, children: option }, option)),
+                    /* @__PURE__ */ jsx("option", { value: "custom", children: "Other\u2026" })
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsxs("label", { className: fieldLabelClass, children: [
+                  "Location (optional)",
+                  /* @__PURE__ */ jsx("input", { type: "text", value: location, maxLength: 80, onChange: (event) => setLocation(event.target.value), placeholder: "City", className: `mt-2 ${inputClass}` })
+                ] }),
+                reason === "custom" ? /* @__PURE__ */ jsxs("label", { className: `sm:col-span-2 ${fieldLabelClass}`, children: [
+                  "Your reason",
+                  /* @__PURE__ */ jsx("input", { type: "text", value: customReason, maxLength: 120, onChange: (event) => setCustomReason(event.target.value), className: `mt-2 ${inputClass}` })
+                ] }) : null
+              ] }),
+              /* @__PURE__ */ jsxs("label", { className: "mt-4 flex items-center gap-3 text-sm text-slate-700 dark:text-slate-300", children: [
+                /* @__PURE__ */ jsx("input", { type: "checkbox", checked: visible, onChange: (event) => setVisible(event.target.checked), className: "h-4 w-4 accent-[#1F8CFF]" }),
+                "Show a signature box on the page"
+              ] }),
+              visible && pdf.pageCount ? /* @__PURE__ */ jsxs("div", { className: "mt-3 grid gap-4 sm:grid-cols-[minmax(0,1fr)_auto]", children: [
+                /* @__PURE__ */ jsxs("div", { className: "grid gap-3 sm:grid-cols-2", children: [
+                  /* @__PURE__ */ jsxs("label", { className: fieldLabelClass, children: [
+                    "Page",
+                    /* @__PURE__ */ jsx("select", { value: pageIndex, onChange: (event) => setPageIndex(Number(event.target.value)), className: `mt-2 ${inputClass}`, children: Array.from({ length: pdf.pageCount }, (_, index) => /* @__PURE__ */ jsxs("option", { value: index, children: [
+                      "Page ",
+                      index + 1,
+                      index === pdf.pageCount - 1 ? " (last)" : ""
+                    ] }, index)) })
+                  ] }),
+                  /* @__PURE__ */ jsxs("label", { className: fieldLabelClass, children: [
+                    "Position",
+                    /* @__PURE__ */ jsx("select", { value: position, onChange: (event) => setPosition(event.target.value), className: `mt-2 ${inputClass}`, children: Object.entries(POSITIONS).map(([value, option]) => /* @__PURE__ */ jsx("option", { value, children: option.label }, value)) })
+                  ] })
+                ] }),
+                preview ? /* @__PURE__ */ jsxs("div", { className: "relative mx-auto w-28 shadow-sm", style: { aspectRatio: `${preview.width} / ${preview.height}` }, children: [
+                  /* @__PURE__ */ jsx("img", { src: preview.url, alt: `Page ${pageIndex + 1} preview`, className: "absolute inset-0 h-full w-full" }),
+                  /* @__PURE__ */ jsx(
+                    "div",
+                    {
+                      className: "absolute border-2 border-[#1F8CFF] bg-[#1F8CFF]/15",
+                      style: { left: `${spot.x * 100}%`, top: `${spot.y * 100}%`, width: `${BOX.width * 100}%`, height: `${BOX.height * 100}%` },
+                      "aria-hidden": "true"
+                    }
+                  )
+                ] }) : null
+              ] }) : null
+            ] }),
+            /* @__PURE__ */ jsx(StatusBanner, { status }),
+            /* @__PURE__ */ jsxs("div", { className: "mt-5 flex flex-wrap gap-3", children: [
+              /* @__PURE__ */ jsxs("button", { type: "submit", disabled: busy || !canSign || reason === "custom" && !finalReason, className: primaryButtonClass, children: [
+                /* @__PURE__ */ jsx("i", { className: `fa-solid ${isWorking ? "fa-spinner fa-spin" : "fa-file-signature"}` }),
+                isWorking ? "Working..." : "Sign & Download"
+              ] }),
+              /* @__PURE__ */ jsx(BackToPdfTools, {})
+            ] })
+          ] }),
+          side: /* @__PURE__ */ jsxs(Fragment, { children: [
+            /* @__PURE__ */ jsx("h2", { className: "text-base font-semibold text-slate-900 dark:text-slate-100", children: "About digital signatures" }),
+            /* @__PURE__ */ jsx(
+              SideTips,
+              {
+                tips: [
+                  "This is a cryptographic signature (PAdES), not just an image. Any later change to the file is detected.",
+                  "Whether viewers show it as trusted depends on who issued your certificate, not on this tool.",
+                  "Your .pfx file, its password, and its private key stay in this browser tab and are never uploaded.",
+                  "USB token DSCs (ePass, ProxKey, etc.) need a small local helper; that support is coming.",
+                  "Check any signed PDF with Verify Signatures."
+                ]
+              }
+            )
+          ] })
+        }
+      )
+    }
+  );
+}
+
+export { CertSignPdf };
+//# sourceMappingURL=chunk-4USCGC24.js.map
+//# sourceMappingURL=chunk-4USCGC24.js.map

package/dist/chunk-4USCGC24.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/certsign/CertSignPdf.tsx"],"names":["spot"],"mappings":";;;;;;;;;;AAyBA,IAAM,OAAA,GAAU;AAAA,EACd,kCAAA;AAAA,EACA,yBAAA;AAAA,EACA,+BAAA;AAAA,EACA;AACF,CAAA;AAEA,IAAM,GAAA,GAAM,EAAE,KAAA,EAAO,IAAA,EAAM,QAAQ,IAAA,EAAK;AACxC,IAAM,SAAA,GAAY;AAAA,EAChB,cAAA,EAAgB,EAAE,CAAA,EAAG,IAAA,GAAO,GAAA,CAAI,KAAA,EAAO,CAAA,EAAG,IAAA,GAAO,GAAA,CAAI,MAAA,EAAQ,KAAA,EAAO,cAAA,EAAe;AAAA,EACnF,aAAA,EAAe,EAAE,CAAA,EAAG,IAAA,EAAM,GAAG,IAAA,GAAO,GAAA,CAAI,MAAA,EAAQ,KAAA,EAAO,aAAA,EAAc;AAAA,EACrE,WAAA,EAAa,EAAE,CAAA,EAAG,IAAA,GAAO,IAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,KAAA,EAAO,WAAA,EAAY;AAAA,EAChE,YAAY,EAAE,CAAA,EAAG,MAAM,CAAA,EAAG,IAAA,EAAM,OAAO,UAAA;AACzC,CAAA;AAEA,IAAM,UAAA,GAAa,CAAC,IAAA,KAClB,IAAA,CAAK,kBAAA,CAAmB,MAAA,EAAW,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,GAAA,EAAK,WAAW,CAAA;AAExF,SAAS,cAAA,CAAe,OAAO,SAAA,EAAW;AACxC,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,IAAI,CAAA;AAC3C,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,IAAI,GAAA,GAAM,IAAA;AACV,IAAA,IAAI,GAAA,GAAM,IAAA;AACV,IAAA,CAAC,YAAY;AACX,MAAA,GAAA,GAAM,MAAM,mBAAmB,KAAK,CAAA;AACpC,MAAA,MAAM,QAAQ,MAAM,eAAA,CAAgB,GAAA,EAAK,SAAA,GAAY,GAAG,GAAG,CAAA;AAC3D,MAAA,GAAA,GAAM,KAAA,CAAM,GAAA;AACZ,MAAA,IAAI,SAAA,EAAW,GAAA,CAAI,eAAA,CAAgB,GAAG,CAAA;AAAA,sBACtB,KAAK,CAAA;AAAA,IACvB,CAAA,GAAG,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACnB,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,IAAI,GAAA,EAAK,GAAA,CAAI,eAAA,CAAgB,GAAG,CAAA;AAChC,MAAA,GAAA,EAAK,OAAA,EAAQ;AAAA,IACf,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,KAAA,EAAO,SAAS,CAAC,CAAA;AACrB,EAAA,OAAO,OAAA;AACT;AAEe,SAAR,WAAA,GAA+B;AACpC,EAAA,MAAM,YAAA,GAAe,OAAO,IAAI,CAAA;AAChC,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAI,SAAS,IAAI,CAAA;AAC7C,EAAA,MAAM,CAAC,YAAA,EAAc,eAAe,CAAA,GAAI,SAAS,EAAE,CAAA;AACnD,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,SAAS,IAAI,CAAA;AACzC,EAAA,MAAM,CAAC,WAAA,EAAa,cAAc,CAAA,GAAI,SAAS,IAAI,CAAA;AACnD,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,IAAI,QAAA,CAAS,OAAA,CAAQ,CAAC,CAAC,CAAA;AAC/C,EAAA,MAAM,CAAC,YAAA,EAAc,eAAe,CAAA,GAAI,SAAS,EAAE,CAAA;AACnD,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAI,SAAS,EAAE,CAAA;AAC3C,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,SAAA,EAAW,YAAY,CAAA,GAAI,SAAS,CAAC,CAAA;AAC5C,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAI,SAAS,cAAc,CAAA;AACvD,EAAA,MAAM,CAAC,SAAA,EAAW,YAAY,CAAA,GAAI,SAAS,KAAK,CAAA;AAChD,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,QAAA,CAAS;AAAA,IACnC,IAAA,EAAM,MAAA;AAAA,IACN,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,QAAA,CAAS,KAAA,GAAQ,wCAAA;AAAA,EACnB,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,CAAC,IAAA,KAAS,SAAA,CAAU,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,CAAA,EAAG,EAAE,CAAA;AAC5E,EAAA,MAAM,WAAW,WAAA,CAAY,CAAC,EAAE,IAAA,EAAM,WAAU,KAAM;AACpD,IAAA,YAAA,CAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,SAAA,GAAY,CAAC,CAAC,CAAA;AACvC,IAAA,SAAA,CAAU,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,GAAG,IAAA,CAAK,IAAI,uCAAuC,CAAA;AAAA,EACxF,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,EAAE,OAAA,EAAS,UAAU,CAAA;AAC9C,EAAA,MAAM,UAAU,cAAA,CAAe,OAAA,GAAU,GAAA,CAAI,KAAA,GAAQ,MAAM,SAAS,CAAA;AAEpE,EAAA,MAAM,oBAAoB,MAAM;AAC9B,IAAA,SAAA,CAAU,IAAI,CAAA;AACd,IAAA,cAAA,CAAe,IAAI,CAAA;AACnB,IAAA,eAAA,CAAgB,EAAE,CAAA;AAAA,EACpB,CAAA;AAEA,EAAA,MAAM,iBAAA,GAAoB,CAAC,IAAA,KAAS;AAClC,IAAA,IAAI,CAAC,IAAA,EAAM;AACX,IAAA,iBAAA,EAAkB;AAClB,IAAA,WAAA,CAAY,IAAI,CAAA;AAAA,EAClB,CAAA;AAEA,EAAA,MAAM,kBAAkB,YAAY;AAClC,IAAA,IAAI,CAAC,QAAA,EAAU;AACf,IAAA,YAAA,CAAa,IAAI,CAAA;AACjB,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,WAAW,IAAI,UAAA,CAAW,MAAM,QAAA,CAAS,WAAA,EAAa,CAAA,EAAG,YAAY,CAAA;AACtF,MAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,QAAA,CAAS,WAAW,CAAA;AAExD,MAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,QAAQ,CAAA;AACjD,MAAA,QAAA,CAAS,eAAA,CAAgB,KAAK,CAAC,CAAA;AAC/B,MAAA,SAAA,CAAU,UAAU,CAAA;AACpB,MAAA,cAAA,CAAe,OAAO,CAAA;AACtB,MAAA,eAAA,CAAgB,EAAE,CAAA;AAClB,MAAA,SAAA,CAAU,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,mBAAmB,OAAA,CAAQ,UAAA,IAAc,WAAW,CAAA,QAAA,CAAA,EAAY,CAAA;AAAA,IACrG,SAAS,KAAA,EAAO;AACd,MAAA,SAAA,CAAU;AAAA,QACR,IAAA,EAAM,OAAA;AAAA,QACN,MAAM,KAAA,YAAiB,wBAAA,GAA2B,KAAA,CAAM,OAAA,GAAU,OAAO,OAAA,IAAW;AAAA,OACrF,CAAA;AAAA,IACH,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,MAAM,UAAU,WAAA,KAAgB,GAAA,GAAM,WAAA,CAAY,QAAA,IAAY,MAAM,WAAA,CAAY,SAAA,CAAA;AAChF,EAAA,MAAM,WAAA,GAAc,MAAA,KAAW,QAAA,GAAW,YAAA,CAAa,MAAK,GAAI,MAAA;AAChE,EAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,KAAA,IAAS,UAAU,CAAC,GAAA,CAAI,MAAA,IAAU,CAAC,OAAO,CAAA;AAEtE,EAAA,MAAM,UAAA,GAAa,OAAO,KAAA,KAAU;AAClC,IAAA,KAAA,CAAM,cAAA,EAAe;AACrB,IAAA,IAAI,CAAC,OAAA,EAAS;AACd,IAAA,YAAA,CAAa,IAAI,CAAA;AACjB,IAAA,SAAA,CAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,uBAAuB,CAAA;AACvD,IAAA,IAAI;AACF,MAAA,MAAMA,KAAAA,GAAO,UAAU,QAAQ,CAAA;AAC/B,MAAA,MAAM,MAAA,GAAS,MAAM,sBAAA,CAAuB,GAAA,CAAI,OAAO,MAAA,EAAQ;AAAA,QAC7D,MAAA,EAAQ,WAAA;AAAA,QACR,QAAA,EAAU,SAAS,IAAA,EAAK;AAAA,QACxB,OAAA,EAAS,OAAA,GAAU,EAAE,SAAA,EAAW,CAAA,EAAGA,KAAAA,CAAK,CAAA,EAAG,CAAA,EAAGA,KAAAA,CAAK,CAAA,EAAG,GAAG,GAAA,EAAI,GAAI;AAAA,OAClE,CAAA;AAED,MAAA,MAAM,CAAC,KAAK,CAAA,GAAI,MAAM,oBAAoB,MAAM,CAAA;AAChD,MAAA,IAAI,CAAC,KAAA,EAAO,MAAA,IAAU,CAAC,MAAM,eAAA,EAAiB;AAC5C,QAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AAAA,MACtF;AACA,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,CAAC,MAAkB,CAAA,EAAG,EAAE,IAAA,EAAM,iBAAA,EAAmB,CAAA;AACvE,MAAA,YAAA,CAAa,IAAA,EAAM,GAAG,UAAA,CAAW,GAAA,CAAI,KAAK,IAAA,EAAM,UAAU,CAAC,CAAA,WAAA,CAAa,CAAA;AACxE,MAAA,SAAA,CAAU;AAAA,QACR,IAAA,EAAM,SAAA;AAAA,QACN,IAAA,EAAM,CAAA,qBAAA,EAAwB,WAAA,CAAY,IAAA,CAAK,IAAI,CAAC,CAAA,6BAAA;AAAA,OACrD,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,SAAA,CAAU,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,mBAAmB,KAAA,EAAO,OAAA,IAAW,mBAAmB,CAAA,CAAA,EAAI,CAAA;AAAA,IAC/F,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,IAAA,GAAO,aAAa,GAAA,CAAI,SAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,UAAU,QAAQ,CAAA;AAE/B,EAAA,uBACE,GAAA;AAAA,IAAC,WAAA;AAAA,IAAA;AAAA,MACC,KAAA,EAAM,iCAAA;AAAA,MACN,WAAA,EAAY,mMAAA;AAAA,MACZ,KAAA,EAAO;AAAA,QACL,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,UAAA,EAAW;AAAA,QACpC,EAAE,KAAA,EAAO,WAAA,GAAc,OAAA,GAAU,GAAA,EAAK,OAAO,aAAA;AAAc,OAC7D;AAAA,MAEA,QAAA,kBAAA,GAAA;AAAA,QAAC,cAAA;AAAA,QAAA;AAAA,UACC,IAAA,kBACE,IAAA,CAAC,MAAA,EAAA,EAAK,QAAA,EAAU,UAAA,EACb,QAAA,EAAA;AAAA,YAAA,GAAA,CAAI,IAAA,mBACH,GAAA,CAAC,eAAA,EAAA,EAAgB,IAAA,EAAM,IAAI,IAAA,EAAM,SAAA,EAAW,GAAA,CAAI,SAAA,EAAW,QAAA,EAAU,GAAA,CAAI,KAAA,EAAO,QAAA,EAAU,MAAM,CAAA,mBAEhG,GAAA;AAAA,cAAC,YAAA;AAAA,cAAA;AAAA,gBACC,MAAA,EAAO,sBAAA;AAAA,gBACP,QAAA,EAAU,IAAA;AAAA,gBACV,SAAS,GAAA,CAAI,WAAA;AAAA,gBACb,KAAA,EAAM,+BAAA;AAAA,gBACN,IAAA,EAAK;AAAA;AAAA,aACP;AAAA,YAED,IAAI,MAAA,mBACH,GAAA,CAAC,OAAE,SAAA,EAAU,+CAAA,EAAgD,sFAE7D,CAAA,GACE,IAAA;AAAA,4BAEJ,IAAA,CAAC,SAAA,EAAA,EAAQ,SAAA,EAAW,CAAA,KAAA,EAAQ,SAAS,CAAA,CAAA,EACnC,QAAA,EAAA;AAAA,8BAAA,GAAA,CAAC,IAAA,EAAA,EAAG,SAAA,EAAU,0DAAA,EAA2D,QAAA,EAAA,qBAAA,EAAmB,CAAA;AAAA,8BAC5F,GAAA;AAAA,gBAAC,OAAA;AAAA,gBAAA;AAAA,kBACC,GAAA,EAAK,YAAA;AAAA,kBACL,IAAA,EAAK,MAAA;AAAA,kBACL,MAAA,EAAO,gCAAA;AAAA,kBACP,SAAA,EAAU,QAAA;AAAA,kBACV,QAAA,EAAU,CAAC,KAAA,KAAU;AACnB,oBAAA,iBAAA,CAAkB,KAAA,CAAM,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAC,CAAA;AACzC,oBAAA,KAAA,CAAM,OAAO,KAAA,GAAQ,EAAA;AAAA,kBACvB;AAAA;AAAA,eACF;AAAA,cACC,WAAA,mBACC,IAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAU,MAAA,EACb,QAAA,EAAA;AAAA,gCAAA,GAAA;AAAA,kBAAC,WAAA;AAAA,kBAAA;AAAA,oBACC,KAAA,EAAO;AAAA,sBACL,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,WAAA,CAAY,cAAc,WAAA,EAAY;AAAA,sBAChE,EAAE,KAAA,EAAO,cAAA,EAAgB,KAAA,EAAO,WAAA,CAAY,gBAAgB,GAAA,EAAI;AAAA,sBAChE,EAAE,OAAO,WAAA,EAAa,KAAA,EAAO,YAAY,gBAAA,IAAoB,WAAA,CAAY,sBAAsB,GAAA,EAAI;AAAA,sBACnG,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,GAAG,UAAA,CAAW,WAAA,CAAY,SAAS,CAAC,CAAA,QAAA,EAAM,UAAA,CAAW,WAAA,CAAY,QAAQ,CAAC,CAAA,CAAA;AAAG;AACxG;AAAA,iBACF;AAAA,gBACC,OAAA,mBACC,GAAA,CAAC,GAAA,EAAA,EAAE,SAAA,EAAU,iDAAgD,QAAA,EAAA,oEAAA,EAAkE,CAAA,GAC7H,WAAA,CAAY,UAAA,mBACd,GAAA,CAAC,GAAA,EAAA,EAAE,SAAA,EAAU,iDAAA,EAAkD,6GAE/D,CAAA,GACE,IAAA;AAAA,gCACJ,IAAA,CAAC,QAAA,EAAA,EAAO,IAAA,EAAK,QAAA,EAAS,OAAA,EAAS,iBAAA,EAAmB,QAAA,EAAU,IAAA,EAAM,SAAA,EAAW,CAAA,KAAA,EAAQ,oBAAoB,CAAA,CAAA,EACvG,QAAA,EAAA;AAAA,kCAAA,GAAA,CAAC,GAAA,EAAA,EAAE,WAAU,oBAAA,EAAqB,CAAA;AAAA,kBAAE;AAAA,iBAAA,EAEtC;AAAA,eAAA,EACF,CAAA,mBAEA,IAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAU,qEAAA,EACb,QAAA,EAAA;AAAA,gCAAA,IAAA,CAAC,QAAA,EAAA,EAAO,IAAA,EAAK,QAAA,EAAS,OAAA,EAAS,MAAM,YAAA,CAAa,OAAA,EAAS,KAAA,EAAM,EAAG,QAAA,EAAU,IAAA,EAAM,SAAA,EAAW,oBAAA,EAC7F,QAAA,EAAA;AAAA,kCAAA,GAAA,CAAC,GAAA,EAAA,EAAE,WAAU,qBAAA,EAAsB,CAAA;AAAA,kBAClC,QAAA,GAAW,SAAS,IAAA,GAAO;AAAA,iBAAA,EAC9B,CAAA;AAAA,gCACA,GAAA;AAAA,kBAAC,aAAA;AAAA,kBAAA;AAAA,oBACC,EAAA,EAAG,sBAAA;AAAA,oBACH,KAAA,EAAM,sBAAA;AAAA,oBACN,KAAA,EAAO,YAAA;AAAA,oBACP,QAAA,EAAU,eAAA;AAAA,oBACV,QAAA,EAAU,QAAQ,CAAC,QAAA;AAAA,oBACnB,YAAA,EAAa;AAAA;AAAA,iBACf;AAAA,gCACA,IAAA,CAAC,QAAA,EAAA,EAAO,IAAA,EAAK,QAAA,EAAS,OAAA,EAAS,eAAA,EAAiB,QAAA,EAAU,IAAA,IAAQ,CAAC,QAAA,EAAU,SAAA,EAAW,kBAAA,EACtF,QAAA,EAAA;AAAA,kCAAA,GAAA,CAAC,GAAA,EAAA,EAAE,WAAU,4BAAA,EAA6B,CAAA;AAAA,kBAAE;AAAA,iBAAA,EAE9C;AAAA,eAAA,EACF;AAAA,aAAA,EAEJ,CAAA;AAAA,iCAEC,UAAA,EAAA,EAAS,SAAA,EAAW,QAAQ,SAAS,CAAA,CAAA,EAAI,UAAU,IAAA,EAClD,QAAA,EAAA;AAAA,8BAAA,GAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,+DAAA,EAAgE,QAAA,EAAA,sBAAA,EAAoB,CAAA;AAAA,8BACtG,IAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAU,2BAAA,EACb,QAAA,EAAA;AAAA,gCAAA,IAAA,CAAC,OAAA,EAAA,EAAM,WAAW,eAAA,EAAiB,QAAA,EAAA;AAAA,kBAAA,QAAA;AAAA,kCAEjC,IAAA,CAAC,QAAA,EAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,UAAU,CAAC,KAAA,KAAU,SAAA,CAAU,KAAA,CAAM,OAAO,KAAK,CAAA,EAAG,SAAA,EAAW,CAAA,KAAA,EAAQ,UAAU,CAAA,CAAA,EACrG,QAAA,EAAA;AAAA,oBAAA,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAA,qBACZ,GAAA,CAAC,YAAoB,KAAA,EAAO,MAAA,EACzB,QAAA,EAAA,MAAA,EAAA,EADU,MAEb,CACD,CAAA;AAAA,oCACD,GAAA,CAAC,QAAA,EAAA,EAAO,KAAA,EAAM,QAAA,EAAS,QAAA,EAAA,aAAA,EAAM;AAAA,mBAAA,EAC/B;AAAA,iBAAA,EACF,CAAA;AAAA,gCACA,IAAA,CAAC,OAAA,EAAA,EAAM,SAAA,EAAW,eAAA,EAAiB,QAAA,EAAA;AAAA,kBAAA,qBAAA;AAAA,kCAEjC,GAAA,CAAC,WAAM,IAAA,EAAK,MAAA,EAAO,OAAO,QAAA,EAAU,SAAA,EAAW,IAAI,QAAA,EAAU,CAAC,UAAU,WAAA,CAAY,KAAA,CAAM,OAAO,KAAK,CAAA,EAAG,aAAY,MAAA,EAAO,SAAA,EAAW,CAAA,KAAA,EAAQ,UAAU,CAAA,CAAA,EAAI;AAAA,iBAAA,EAC/J,CAAA;AAAA,gBACC,WAAW,QAAA,mBACV,IAAA,CAAC,WAAM,SAAA,EAAW,CAAA,cAAA,EAAiB,eAAe,CAAA,CAAA,EAAI,QAAA,EAAA;AAAA,kBAAA,aAAA;AAAA,sCAEnD,OAAA,EAAA,EAAM,IAAA,EAAK,QAAO,KAAA,EAAO,YAAA,EAAc,WAAW,GAAA,EAAK,QAAA,EAAU,CAAC,KAAA,KAAU,eAAA,CAAgB,MAAM,MAAA,CAAO,KAAK,GAAG,SAAA,EAAW,CAAA,KAAA,EAAQ,UAAU,CAAA,CAAA,EAAI;AAAA,iBAAA,EACrJ,CAAA,GACE;AAAA,eAAA,EACN,CAAA;AAAA,8BAEA,IAAA,CAAC,OAAA,EAAA,EAAM,SAAA,EAAU,yEAAA,EACf,QAAA,EAAA;AAAA,gCAAA,GAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,UAAA,EAAW,OAAA,EAAS,SAAS,QAAA,EAAU,CAAC,KAAA,KAAU,UAAA,CAAW,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG,WAAU,0BAAA,EAA2B,CAAA;AAAA,gBAAE;AAAA,eAAA,EAEzI,CAAA;AAAA,cACC,WAAW,GAAA,CAAI,SAAA,mBACd,IAAA,CAAC,KAAA,EAAA,EAAI,WAAU,mDAAA,EACb,QAAA,EAAA;AAAA,gCAAA,IAAA,CAAC,KAAA,EAAA,EAAI,WAAU,2BAAA,EACb,QAAA,EAAA;AAAA,kCAAA,IAAA,CAAC,OAAA,EAAA,EAAM,WAAW,eAAA,EAAiB,QAAA,EAAA;AAAA,oBAAA,MAAA;AAAA,oCAEjC,GAAA,CAAC,QAAA,EAAA,EAAO,KAAA,EAAO,SAAA,EAAW,QAAA,EAAU,CAAC,KAAA,KAAU,YAAA,CAAa,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA,EAAG,SAAA,EAAW,CAAA,KAAA,EAAQ,UAAU,CAAA,CAAA,EACnH,QAAA,EAAA,KAAA,CAAM,IAAA,CAAK,EAAE,QAAQ,GAAA,CAAI,SAAA,EAAU,EAAG,CAAC,CAAA,EAAG,KAAA,qBACzC,IAAA,CAAC,QAAA,EAAA,EAAmB,OAAO,KAAA,EAAO,QAAA,EAAA;AAAA,sBAAA,OAAA;AAAA,sBAC1B,KAAA,GAAQ,CAAA;AAAA,sBACb,KAAA,KAAU,GAAA,CAAI,SAAA,GAAY,CAAA,GAAI,SAAA,GAAY;AAAA,qBAAA,EAAA,EAFhC,KAGb,CACD,CAAA,EACH;AAAA,mBAAA,EACF,CAAA;AAAA,kCACA,IAAA,CAAC,OAAA,EAAA,EAAM,SAAA,EAAW,eAAA,EAAiB,QAAA,EAAA;AAAA,oBAAA,UAAA;AAAA,oCAEjC,GAAA,CAAC,QAAA,EAAA,EAAO,KAAA,EAAO,QAAA,EAAU,UAAU,CAAC,KAAA,KAAU,WAAA,CAAY,KAAA,CAAM,MAAA,CAAO,KAAK,CAAA,EAAG,SAAA,EAAW,QAAQ,UAAU,CAAA,CAAA,EACzG,QAAA,EAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,KAAA,EAAO,MAAM,CAAA,qBAC5C,GAAA,CAAC,YAAmB,KAAA,EACjB,QAAA,EAAA,MAAA,CAAO,KAAA,EAAA,EADG,KAEb,CACD,CAAA,EACH;AAAA,mBAAA,EACF;AAAA,iBAAA,EACF,CAAA;AAAA,gBACC,OAAA,mBACC,IAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAU,mCAAkC,KAAA,EAAO,EAAE,WAAA,EAAa,CAAA,EAAG,QAAQ,KAAK,CAAA,GAAA,EAAM,OAAA,CAAQ,MAAM,IAAG,EAC5G,QAAA,EAAA;AAAA,kCAAA,GAAA,CAAC,KAAA,EAAA,EAAI,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,GAAA,EAAK,QAAQ,SAAA,GAAY,CAAC,CAAA,QAAA,CAAA,EAAY,SAAA,EAAU,gCAAA,EAAiC,CAAA;AAAA,kCACxG,GAAA;AAAA,oBAAC,KAAA;AAAA,oBAAA;AAAA,sBACC,SAAA,EAAU,oDAAA;AAAA,sBACV,KAAA,EAAO,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAI,GAAG,CAAA,CAAA,CAAA,EAAK,GAAA,EAAK,CAAA,EAAG,IAAA,CAAK,CAAA,GAAI,GAAG,CAAA,CAAA,CAAA,EAAK,KAAA,EAAO,CAAA,EAAG,GAAA,CAAI,KAAA,GAAQ,GAAG,CAAA,CAAA,CAAA,EAAK,MAAA,EAAQ,CAAA,EAAG,GAAA,CAAI,MAAA,GAAS,GAAG,CAAA,CAAA,CAAA,EAAI;AAAA,sBACzH,aAAA,EAAY;AAAA;AAAA;AACd,iBAAA,EACF,CAAA,GACE;AAAA,eAAA,EACN,CAAA,GACE;AAAA,aAAA,EACN,CAAA;AAAA,4BAEA,GAAA,CAAC,gBAAa,MAAA,EAAgB,CAAA;AAAA,4BAE9B,IAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAU,2BAAA,EACb,QAAA,EAAA;AAAA,8BAAA,IAAA,CAAC,QAAA,EAAA,EAAO,IAAA,EAAK,QAAA,EAAS,QAAA,EAAU,IAAA,IAAQ,CAAC,OAAA,IAAY,MAAA,KAAW,QAAA,IAAY,CAAC,WAAA,EAAc,SAAA,EAAW,kBAAA,EACpG,QAAA,EAAA;AAAA,gCAAA,GAAA,CAAC,OAAE,SAAA,EAAW,CAAA,SAAA,EAAY,SAAA,GAAY,oBAAA,GAAuB,mBAAmB,CAAA,CAAA,EAAI,CAAA;AAAA,gBACnF,YAAY,YAAA,GAAe;AAAA,eAAA,EAC9B,CAAA;AAAA,kCACC,cAAA,EAAA,EAAe;AAAA,aAAA,EAClB;AAAA,WAAA,EACF,CAAA;AAAA,UAEF,sBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,4BAAA,GAAA,CAAC,IAAA,EAAA,EAAG,SAAA,EAAU,4DAAA,EAA6D,QAAA,EAAA,0BAAA,EAAwB,CAAA;AAAA,4BACnG,GAAA;AAAA,cAAC,QAAA;AAAA,cAAA;AAAA,gBACC,IAAA,EAAM;AAAA,kBACJ,yGAAA;AAAA,kBACA,8FAAA;AAAA,kBACA,oGAAA;AAAA,kBACA,0FAAA;AAAA,kBACA;AAAA;AACF;AAAA;AACF,WAAA,EACF;AAAA;AAAA;AAEJ;AAAA,GACF;AAEJ","file":"chunk-4USCGC24.js","sourcesContent":["import React, { useCallback, useEffect, useRef, useState } from \"react\";\nimport { downloadBlob, formatBytes, toBaseName } from \"../shared/files\";\nimport { PasswordInput } from \"../shared/PasswordInput\";\nimport { openRenderDocument, renderThumbnail } from \"../shared/pdfRender\";\nimport {\n  BackToPdfTools,\n  FileDropzone,\n  PdfToolColumns,\n  PdfToolPage,\n  SelectedPdfCard,\n  SideTips,\n  StatusBanner,\n  SummaryList,\n  cardClass,\n  fieldLabelClass,\n  inputClass,\n  primaryButtonClass,\n  secondaryButtonClass,\n} from \"../shared/ToolLayout\";\nimport { useSinglePdf } from \"../shared/useSinglePdf\";\nimport { describeCertificate, webCryptoSigner } from \"./cms\";\nimport { signPdfWithCertificate } from \"./padesCore\";\nimport { CertificatePasswordError, readPkcs12 } from \"./pkcs12\";\nimport { verifyPdfSignatures } from \"./verifyCore\";\n\nconst REASONS = [\n  \"I am the author of this document\",\n  \"I approve this document\",\n  \"I have reviewed this document\",\n  \"I agree to the terms of this document\",\n];\n\nconst BOX = { width: 0.38, height: 0.09 };\nconst POSITIONS = {\n  \"bottom-right\": { x: 0.98 - BOX.width, y: 0.97 - BOX.height, label: \"Bottom right\" },\n  \"bottom-left\": { x: 0.02, y: 0.97 - BOX.height, label: \"Bottom left\" },\n  \"top-right\": { x: 0.98 - BOX.width, y: 0.03, label: \"Top right\" },\n  \"top-left\": { x: 0.02, y: 0.03, label: \"Top left\" },\n};\n\nconst formatDate = (date: Date) =>\n  date.toLocaleDateString(undefined, { year: \"numeric\", month: \"short\", day: \"numeric\" });\n\nfunction usePagePreview(bytes, pageIndex) {\n  const [preview, setPreview] = useState(null);\n  useEffect(() => {\n    if (!bytes) {\n      setPreview(null);\n      return undefined;\n    }\n    let cancelled = false;\n    let url = null;\n    let doc = null;\n    (async () => {\n      doc = await openRenderDocument(bytes);\n      const thumb = await renderThumbnail(doc, pageIndex + 1, 220);\n      url = thumb.url;\n      if (cancelled) URL.revokeObjectURL(url);\n      else setPreview(thumb);\n    })().catch(() => {});\n    return () => {\n      cancelled = true;\n      if (url) URL.revokeObjectURL(url);\n      doc?.destroy();\n    };\n  }, [bytes, pageIndex]);\n  return preview;\n}\n\nexport default function CertSignPdf() {\n  const certInputRef = useRef(null);\n  const [certFile, setCertFile] = useState(null);\n  const [certPassword, setCertPassword] = useState(\"\");\n  const [signer, setSigner] = useState(null);\n  const [certificate, setCertificate] = useState(null);\n  const [reason, setReason] = useState(REASONS[1]);\n  const [customReason, setCustomReason] = useState(\"\");\n  const [location, setLocation] = useState(\"\");\n  const [visible, setVisible] = useState(true);\n  const [pageIndex, setPageIndex] = useState(0);\n  const [position, setPosition] = useState(\"bottom-right\");\n  const [isWorking, setIsWorking] = useState(false);\n  const [status, setStatus] = useState({\n    tone: \"info\",\n    text: \"Add a PDF and your certificate (.pfx or .p12) to sign it digitally.\",\n  });\n\n  useEffect(() => {\n    document.title = \"Digital Signature (Certificate) | Apps\";\n  }, []);\n\n  const onError = useCallback((text) => setStatus({ tone: \"error\", text }), []);\n  const onLoaded = useCallback(({ file, pageCount }) => {\n    setPageIndex(Math.max(0, pageCount - 1));\n    setStatus({ tone: \"success\", text: `${file.name} loaded. Now open your certificate.` });\n  }, []);\n  const pdf = useSinglePdf({ onError, onLoaded });\n  const preview = usePagePreview(visible ? pdf.bytes : null, pageIndex);\n\n  const forgetCertificate = () => {\n    setSigner(null);\n    setCertificate(null);\n    setCertPassword(\"\");\n  };\n\n  const chooseCertificate = (file) => {\n    if (!file) return;\n    forgetCertificate();\n    setCertFile(file);\n  };\n\n  const openCertificate = async () => {\n    if (!certFile) return;\n    setIsWorking(true);\n    try {\n      const identity = readPkcs12(new Uint8Array(await certFile.arrayBuffer()), certPassword);\n      const summary = describeCertificate(identity.certificate);\n      // The key is imported as non-extractable; drop our copy of its bytes.\n      const nextSigner = await webCryptoSigner(identity);\n      identity.privateKeyPkcs8.fill(0);\n      setSigner(nextSigner);\n      setCertificate(summary);\n      setCertPassword(\"\");\n      setStatus({ tone: \"success\", text: `Certificate for ${summary.commonName || \"(no name)\"} opened.` });\n    } catch (error) {\n      setStatus({\n        tone: \"error\",\n        text: error instanceof CertificatePasswordError ? error.message : error?.message || \"Could not open the certificate.\",\n      });\n    } finally {\n      setIsWorking(false);\n    }\n  };\n\n  const now = new Date();\n  const expired = certificate && (now > certificate.notAfter || now < certificate.notBefore);\n  const finalReason = reason === \"custom\" ? customReason.trim() : reason;\n  const canSign = Boolean(pdf.bytes && signer && !pdf.signed && !expired);\n\n  const handleSign = async (event) => {\n    event.preventDefault();\n    if (!canSign) return;\n    setIsWorking(true);\n    setStatus({ tone: \"info\", text: \"Signing your PDF...\" });\n    try {\n      const spot = POSITIONS[position];\n      const signed = await signPdfWithCertificate(pdf.bytes, signer, {\n        reason: finalReason,\n        location: location.trim(),\n        visible: visible ? { pageIndex, x: spot.x, y: spot.y, ...BOX } : null,\n      });\n      // Check our own output before handing it over.\n      const [check] = await verifyPdfSignatures(signed);\n      if (!check?.intact || !check.coversWholeFile) {\n        throw new Error(\"The signed file did not pass verification. Nothing was downloaded.\");\n      }\n      const blob = new Blob([signed as BlobPart], { type: \"application/pdf\" });\n      downloadBlob(blob, `${toBaseName(pdf.file.name, \"document\")}-signed.pdf`);\n      setStatus({\n        tone: \"success\",\n        text: `Signed and verified (${formatBytes(blob.size)}). Your download has started.`,\n      });\n    } catch (error) {\n      setStatus({ tone: \"error\", text: `Signing failed: ${error?.message || \"Please try again.\"}` });\n    } finally {\n      setIsWorking(false);\n    }\n  };\n\n  const busy = isWorking || pdf.isReading;\n  const spot = POSITIONS[position];\n\n  return (\n    <PdfToolPage\n      title=\"Digital Signature (Certificate)\"\n      description=\"Sign a PDF with your digital certificate (.pfx / .p12). Viewers such as Adobe Reader show who signed it and flag any later change. Your certificate and its private key never leave your browser.\"\n      stats={[\n        { value: \"PAdES\", label: \"Standard\" },\n        { value: certificate ? \"Ready\" : \"-\", label: \"Certificate\" },\n      ]}\n    >\n      <PdfToolColumns\n        main={\n          <form onSubmit={handleSign}>\n            {pdf.file ? (\n              <SelectedPdfCard file={pdf.file} pageCount={pdf.pageCount} onRemove={pdf.clear} disabled={busy} />\n            ) : (\n              <FileDropzone\n                accept=\".pdf,application/pdf\"\n                disabled={busy}\n                onFiles={pdf.selectFiles}\n                title=\"Drag and drop the PDF to sign\"\n                hint=\"or click to browse from your device\"\n              />\n            )}\n            {pdf.signed ? (\n              <p className=\"mt-2 text-xs text-rose-700 dark:text-rose-300\">\n                Adding a second signature to an already-signed PDF is not supported yet.\n              </p>\n            ) : null}\n\n            <section className={`mt-5 ${cardClass}`}>\n              <h3 className=\"text-sm font-semibold text-slate-900 dark:text-slate-100\">1. Your certificate</h3>\n              <input\n                ref={certInputRef}\n                type=\"file\"\n                accept=\".pfx,.p12,application/x-pkcs12\"\n                className=\"hidden\"\n                onChange={(event) => {\n                  chooseCertificate(event.target.files?.[0]);\n                  event.target.value = \"\";\n                }}\n              />\n              {certificate ? (\n                <div className=\"mt-3\">\n                  <SummaryList\n                    items={[\n                      { label: \"Signer\", value: certificate.commonName || \"(no name)\" },\n                      { label: \"Organisation\", value: certificate.organization || \"-\" },\n                      { label: \"Issued by\", value: certificate.issuerCommonName || certificate.issuerOrganization || \"-\" },\n                      { label: \"Valid\", value: `${formatDate(certificate.notBefore)} – ${formatDate(certificate.notAfter)}` },\n                    ]}\n                  />\n                  {expired ? (\n                    <p className=\"mt-2 text-xs text-rose-700 dark:text-rose-300\">This certificate is not valid today, so it cannot be used to sign.</p>\n                  ) : certificate.selfSigned ? (\n                    <p className=\"mt-2 text-xs text-amber-700 dark:text-amber-300\">\n                      Self-signed certificate: the signature is valid, but viewers will show the signer as untrusted.\n                    </p>\n                  ) : null}\n                  <button type=\"button\" onClick={forgetCertificate} disabled={busy} className={`mt-3 ${secondaryButtonClass}`}>\n                    <i className=\"fa-solid fa-rotate\" />\n                    Use a different certificate\n                  </button>\n                </div>\n              ) : (\n                <div className=\"mt-3 grid gap-3 sm:grid-cols-[auto_minmax(0,1fr)_auto] sm:items-end\">\n                  <button type=\"button\" onClick={() => certInputRef.current?.click()} disabled={busy} className={secondaryButtonClass}>\n                    <i className=\"fa-solid fa-id-card\" />\n                    {certFile ? certFile.name : \"Choose .pfx / .p12\"}\n                  </button>\n                  <PasswordInput\n                    id=\"certificate-password\"\n                    label=\"Certificate password\"\n                    value={certPassword}\n                    onChange={setCertPassword}\n                    disabled={busy || !certFile}\n                    autoComplete=\"off\"\n                  />\n                  <button type=\"button\" onClick={openCertificate} disabled={busy || !certFile} className={primaryButtonClass}>\n                    <i className=\"fa-solid fa-unlock-keyhole\" />\n                    Open\n                  </button>\n                </div>\n              )}\n            </section>\n\n            <fieldset className={`mt-5 ${cardClass}`} disabled={busy}>\n              <legend className=\"px-1 text-sm font-semibold text-slate-900 dark:text-slate-100\">2. Signature details</legend>\n              <div className=\"grid gap-4 sm:grid-cols-2\">\n                <label className={fieldLabelClass}>\n                  Reason\n                  <select value={reason} onChange={(event) => setReason(event.target.value)} className={`mt-2 ${inputClass}`}>\n                    {REASONS.map((option) => (\n                      <option key={option} value={option}>\n                        {option}\n                      </option>\n                    ))}\n                    <option value=\"custom\">Other…</option>\n                  </select>\n                </label>\n                <label className={fieldLabelClass}>\n                  Location (optional)\n                  <input type=\"text\" value={location} maxLength={80} onChange={(event) => setLocation(event.target.value)} placeholder=\"City\" className={`mt-2 ${inputClass}`} />\n                </label>\n                {reason === \"custom\" ? (\n                  <label className={`sm:col-span-2 ${fieldLabelClass}`}>\n                    Your reason\n                    <input type=\"text\" value={customReason} maxLength={120} onChange={(event) => setCustomReason(event.target.value)} className={`mt-2 ${inputClass}`} />\n                  </label>\n                ) : null}\n              </div>\n\n              <label className=\"mt-4 flex items-center gap-3 text-sm text-slate-700 dark:text-slate-300\">\n                <input type=\"checkbox\" checked={visible} onChange={(event) => setVisible(event.target.checked)} className=\"h-4 w-4 accent-[#1F8CFF]\" />\n                Show a signature box on the page\n              </label>\n              {visible && pdf.pageCount ? (\n                <div className=\"mt-3 grid gap-4 sm:grid-cols-[minmax(0,1fr)_auto]\">\n                  <div className=\"grid gap-3 sm:grid-cols-2\">\n                    <label className={fieldLabelClass}>\n                      Page\n                      <select value={pageIndex} onChange={(event) => setPageIndex(Number(event.target.value))} className={`mt-2 ${inputClass}`}>\n                        {Array.from({ length: pdf.pageCount }, (_, index) => (\n                          <option key={index} value={index}>\n                            Page {index + 1}\n                            {index === pdf.pageCount - 1 ? \" (last)\" : \"\"}\n                          </option>\n                        ))}\n                      </select>\n                    </label>\n                    <label className={fieldLabelClass}>\n                      Position\n                      <select value={position} onChange={(event) => setPosition(event.target.value)} className={`mt-2 ${inputClass}`}>\n                        {Object.entries(POSITIONS).map(([value, option]) => (\n                          <option key={value} value={value}>\n                            {option.label}\n                          </option>\n                        ))}\n                      </select>\n                    </label>\n                  </div>\n                  {preview ? (\n                    <div className=\"relative mx-auto w-28 shadow-sm\" style={{ aspectRatio: `${preview.width} / ${preview.height}` }}>\n                      <img src={preview.url} alt={`Page ${pageIndex + 1} preview`} className=\"absolute inset-0 h-full w-full\" />\n                      <div\n                        className=\"absolute border-2 border-[#1F8CFF] bg-[#1F8CFF]/15\"\n                        style={{ left: `${spot.x * 100}%`, top: `${spot.y * 100}%`, width: `${BOX.width * 100}%`, height: `${BOX.height * 100}%` }}\n                        aria-hidden=\"true\"\n                      />\n                    </div>\n                  ) : null}\n                </div>\n              ) : null}\n            </fieldset>\n\n            <StatusBanner status={status} />\n\n            <div className=\"mt-5 flex flex-wrap gap-3\">\n              <button type=\"submit\" disabled={busy || !canSign || (reason === \"custom\" && !finalReason)} className={primaryButtonClass}>\n                <i className={`fa-solid ${isWorking ? \"fa-spinner fa-spin\" : \"fa-file-signature\"}`} />\n                {isWorking ? \"Working...\" : \"Sign & Download\"}\n              </button>\n              <BackToPdfTools />\n            </div>\n          </form>\n        }\n        side={\n          <>\n            <h2 className=\"text-base font-semibold text-slate-900 dark:text-slate-100\">About digital signatures</h2>\n            <SideTips\n              tips={[\n                \"This is a cryptographic signature (PAdES), not just an image. Any later change to the file is detected.\",\n                \"Whether viewers show it as trusted depends on who issued your certificate, not on this tool.\",\n                \"Your .pfx file, its password, and its private key stay in this browser tab and are never uploaded.\",\n                \"USB token DSCs (ePass, ProxKey, etc.) need a small local helper; that support is coming.\",\n                \"Check any signed PDF with Verify Signatures.\",\n              ]}\n            />\n          </>\n        }\n      />\n    </PdfToolPage>\n  );\n}\n"]}

package/dist/chunk-5OIMR74G.js

@@ -0,0 +1,273 @@
+import { signatureFields } from './chunk-7MTEMQLL.js';
+import * as asn1js from 'asn1js';
+import * as pkijs from 'pkijs';
+import { PDFDocument, PDFArray, PDFNumber, PDFHexString, PDFString, PDFName } from 'pdf-lib';
+
+var OID = {
+  data: "1.2.840.113549.1.7.1",
+  signedData: "1.2.840.113549.1.7.2",
+  contentType: "1.2.840.113549.1.9.3",
+  messageDigest: "1.2.840.113549.1.9.4",
+  signingTime: "1.2.840.113549.1.9.5",
+  signingCertificateV2: "1.2.840.113549.1.9.16.2.47",
+  sha256: "2.16.840.1.101.3.4.2.1",
+  sha256WithRSA: "1.2.840.113549.1.1.11",
+  commonName: "2.5.4.3",
+  organization: "2.5.4.10",
+  organizationalUnit: "2.5.4.11",
+  email: "1.2.840.113549.1.9.1"
+};
+var buffer = (bytes) => bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+async function sha256(data) {
+  return new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", data));
+}
+function compareBytes(a, b) {
+  for (let i = 0; i < Math.min(a.length, b.length); i += 1) {
+    if (a[i] !== b[i]) return a[i] - b[i];
+  }
+  return a.length - b.length;
+}
+function parseCertificate(der) {
+  try {
+    return pkijs.Certificate.fromBER(buffer(der));
+  } catch {
+    throw new Error("Could not read the signing certificate.");
+  }
+}
+async function signingCertificateV2(der, cert) {
+  const issuerSerial = new asn1js.Sequence({
+    value: [
+      new asn1js.Sequence({
+        value: [new asn1js.Constructed({ idBlock: { tagClass: 3, tagNumber: 4 }, value: [cert.issuer.toSchema()] })]
+      }),
+      cert.serialNumber
+    ]
+  });
+  const essCertId = new asn1js.Sequence({
+    value: [new asn1js.OctetString({ valueHex: buffer(await sha256(der)) }), issuerSerial]
+  });
+  return new asn1js.Sequence({ value: [new asn1js.Sequence({ value: [essCertId] })] });
+}
+async function buildCmsSignature(documentDigest, signer) {
+  const cert = parseCertificate(signer.certificate);
+  const chain = (signer.chain || []).map(parseCertificate);
+  const attributes = [
+    new pkijs.Attribute({ type: OID.contentType, values: [new asn1js.ObjectIdentifier({ value: OID.data })] }),
+    new pkijs.Attribute({
+      type: OID.messageDigest,
+      values: [new asn1js.OctetString({ valueHex: buffer(documentDigest) })]
+    }),
+    new pkijs.Attribute({
+      type: OID.signingCertificateV2,
+      values: [await signingCertificateV2(signer.certificate, cert)]
+    })
+  ].map((attribute) => ({ attribute, der: new Uint8Array(attribute.toSchema().toBER()) })).sort((a, b) => compareBytes(a.der, b.der)).map(({ attribute }) => attribute);
+  const toBeSigned = new Uint8Array(new asn1js.Set({ value: attributes.map((a) => a.toSchema()) }).toBER());
+  const signature = await signer.sign(toBeSigned);
+  const signerInfo = new pkijs.SignerInfo({
+    version: 1,
+    sid: new pkijs.IssuerAndSerialNumber({ issuer: cert.issuer, serialNumber: cert.serialNumber }),
+    digestAlgorithm: new pkijs.AlgorithmIdentifier({ algorithmId: OID.sha256 }),
+    signedAttrs: new pkijs.SignedAndUnsignedAttributes({ type: 0, attributes }),
+    signatureAlgorithm: new pkijs.AlgorithmIdentifier({ algorithmId: OID.sha256WithRSA, algorithmParams: new asn1js.Null() }),
+    signature: new asn1js.OctetString({ valueHex: buffer(signature) })
+  });
+  const signedData = new pkijs.SignedData({
+    version: 1,
+    encapContentInfo: new pkijs.EncapsulatedContentInfo({ eContentType: OID.data }),
+    digestAlgorithms: [new pkijs.AlgorithmIdentifier({ algorithmId: OID.sha256 })],
+    certificates: [cert, ...chain],
+    signerInfos: [signerInfo]
+  });
+  const contentInfo = new pkijs.ContentInfo({ contentType: OID.signedData, content: signedData.toSchema(true) });
+  return new Uint8Array(contentInfo.toSchema().toBER());
+}
+async function webCryptoSigner(identity) {
+  const key = await globalThis.crypto.subtle.importKey(
+    "pkcs8",
+    identity.privateKeyPkcs8,
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return {
+    certificate: identity.certificate,
+    chain: identity.chain,
+    sign: async (data) => new Uint8Array(await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, data))
+  };
+}
+function nameValue(name, oid) {
+  const entry = name.typesAndValues.find((item) => item.type === oid);
+  return entry ? String(entry.value.valueBlock.value) : "";
+}
+function describeCertificate(der) {
+  const cert = parseCertificate(der);
+  const hex = (bytes) => Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, "0")).join(":");
+  let keyBits = 0;
+  try {
+    const rsa = cert.subjectPublicKeyInfo.parsedKey;
+    const modulus = new Uint8Array(rsa?.modulus?.valueBlock?.valueHexView || []);
+    keyBits = (modulus[0] === 0 ? modulus.length - 1 : modulus.length) * 8;
+  } catch {
+    keyBits = 0;
+  }
+  return {
+    commonName: nameValue(cert.subject, OID.commonName),
+    organization: nameValue(cert.subject, OID.organization),
+    organizationalUnit: nameValue(cert.subject, OID.organizationalUnit),
+    email: nameValue(cert.subject, OID.email),
+    issuerCommonName: nameValue(cert.issuer, OID.commonName),
+    issuerOrganization: nameValue(cert.issuer, OID.organization),
+    serialNumber: hex(cert.serialNumber.valueBlock.valueHexView.slice().buffer),
+    notBefore: cert.notBefore.value,
+    notAfter: cert.notAfter.value,
+    selfSigned: cert.subject.isEqual(cert.issuer),
+    keyBits
+  };
+}
+var N = (name) => PDFName.of(name);
+var DIGESTS = {
+  "1.3.14.3.2.26": "SHA-1",
+  [OID.sha256]: "SHA-256",
+  "2.16.840.1.101.3.4.2.2": "SHA-384",
+  "2.16.840.1.101.3.4.2.3": "SHA-512"
+};
+function text(value) {
+  return value instanceof PDFString || value instanceof PDFHexString ? value.decodeText() : "";
+}
+function parsePdfDate(value) {
+  const match = /^D:(\d{4})(\d{2})?(\d{2})?(\d{2})?(\d{2})?(\d{2})?([Zz]|[+-]\d{2}'?\d{2}'?)?/.exec(value || "");
+  if (!match) return null;
+  const [, y, mo = "01", d = "01", h = "00", mi = "00", s = "00", tz = "Z"] = match;
+  let offset = "Z";
+  if (/^[+-]/.test(tz)) {
+    const digits = tz.replace(/'/g, "");
+    offset = `${digits.slice(0, 3)}:${digits.slice(3, 5) || "00"}`;
+  }
+  const date = /* @__PURE__ */ new Date(`${y}-${mo}-${d}T${h}:${mi}:${s}${offset}`);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+function derLength(bytes) {
+  if (bytes.length < 2) return 0;
+  const first = bytes[1];
+  if (first < 128) return 2 + first;
+  const count = first & 127;
+  let length = 0;
+  for (let i = 0; i < count; i += 1) length = length * 256 + bytes[2 + i];
+  return 2 + count + length;
+}
+function isHexOrSpace(byte) {
+  return byte >= 48 && byte <= 57 || // 0-9
+  byte >= 65 && byte <= 70 || // A-F
+  byte >= 97 && byte <= 102 || // a-f
+  byte === 32 || byte === 10 || byte === 13 || byte === 9 || byte === 12 || byte === 0;
+}
+function cmsTime(value) {
+  if (value instanceof asn1js.UTCTime || value instanceof asn1js.GeneralizedTime) {
+    const date = value.toDate();
+    return Number.isNaN(date.getTime()) ? null : date;
+  }
+  return null;
+}
+function attributeValue(signerInfo, oid) {
+  return signerInfo.signedAttrs?.attributes.find((attribute) => attribute.type === oid)?.values[0];
+}
+async function checkSignature(file, name, dict) {
+  const check = {
+    fieldName: name,
+    subFilter: dict.lookup(N("SubFilter"))?.decodeText?.() ?? "",
+    intact: null,
+    coversWholeFile: false,
+    signer: null,
+    certificateValidAtSigning: null,
+    signingTime: parsePdfDate(text(dict.lookup(N("M")))),
+    reason: text(dict.lookup(N("Reason"))),
+    location: text(dict.lookup(N("Location"))),
+    problem: ""
+  };
+  const byteRange = dict.lookup(N("ByteRange"));
+  const contents = dict.lookup(N("Contents"));
+  const range = byteRange instanceof PDFArray ? byteRange.asArray().map((item) => item instanceof PDFNumber ? item.asNumber() : NaN) : [];
+  if (range.length !== 4 || range.some((value) => !Number.isInteger(value) || value < 0) || !(contents instanceof PDFHexString || contents instanceof PDFString)) {
+    check.problem = "The signature is incomplete or malformed.";
+    return check;
+  }
+  const [start, firstLength, secondStart, secondLength] = range;
+  const structureOk = start === 0 && firstLength < secondStart && secondStart + secondLength <= file.length && file[firstLength] === 60 && file[secondStart - 1] === 62 && // The unsigned gap must be exactly the /Contents hex string. Anything else
+  // in it (a signature-wrapping attack) would be unsigned content.
+  file.subarray(firstLength + 1, secondStart - 1).every(isHexOrSpace);
+  check.coversWholeFile = structureOk && secondStart + secondLength === file.length;
+  if (!structureOk) {
+    check.intact = false;
+    check.problem = "The signed byte range does not match the file.";
+    return check;
+  }
+  if (!/^(ETSI\.CAdES\.detached|adbe\.pkcs7\.detached)$/.test(check.subFilter)) {
+    check.problem = `The ${check.subFilter || "unknown"} signature format is not supported here.`;
+    return check;
+  }
+  const signed = new Uint8Array(firstLength + secondLength);
+  signed.set(file.subarray(0, firstLength), 0);
+  signed.set(file.subarray(secondStart, secondStart + secondLength), firstLength);
+  const raw = contents.asBytes();
+  const der = raw.subarray(0, derLength(raw));
+  let signedData;
+  try {
+    const contentInfo = pkijs.ContentInfo.fromBER(der.slice().buffer);
+    signedData = new pkijs.SignedData({ schema: contentInfo.content });
+  } catch {
+    check.intact = false;
+    check.problem = "The signature data could not be read.";
+    return check;
+  }
+  const signerInfo = signedData.signerInfos[0];
+  const sid = signerInfo?.sid;
+  const signerCert = (signedData.certificates || []).find(
+    (cert) => cert instanceof pkijs.Certificate && sid instanceof pkijs.IssuerAndSerialNumber && cert.issuer.isEqual(sid.issuer) && cert.serialNumber.isEqual(sid.serialNumber)
+  );
+  if (signerCert) {
+    check.signer = describeCertificate(new Uint8Array(signerCert.toSchema().toBER()));
+  }
+  const signingTimeAttr = attributeValue(signerInfo, OID.signingTime);
+  if (!check.signingTime) check.signingTime = cmsTime(signingTimeAttr);
+  if (check.signer && check.signingTime) {
+    check.certificateValidAtSigning = check.signingTime >= check.signer.notBefore && check.signingTime <= check.signer.notAfter;
+  }
+  const digestName = DIGESTS[signerInfo.digestAlgorithm.algorithmId];
+  if (!digestName) {
+    check.problem = "The signature uses an unsupported digest algorithm.";
+    return check;
+  }
+  try {
+    const result = await signedData.verify({
+      signer: 0,
+      data: signed.slice().buffer,
+      checkChain: false,
+      extendedMode: true
+    });
+    check.intact = Boolean(result.signatureVerified);
+    if (!check.intact) check.problem = "The document was changed after it was signed, or the signature is corrupt.";
+  } catch (error) {
+    check.intact = false;
+    check.problem = error?.code === 15 || /message digest/i.test(String(error?.message || error?.date || "")) ? "The document was changed after it was signed." : "The signature does not match the document or its certificate.";
+  }
+  return check;
+}
+async function verifyPdfSignatures(bytes) {
+  const file = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let doc;
+  try {
+    doc = await PDFDocument.load(file, { ignoreEncryption: true, updateMetadata: false });
+  } catch {
+    throw new Error("This file is not a readable PDF.");
+  }
+  const checks = [];
+  for (const field of signatureFields(doc)) {
+    if (field.value) checks.push(await checkSignature(file, field.name, field.value));
+  }
+  return checks;
+}
+
+export { buildCmsSignature, describeCertificate, parsePdfDate, sha256, verifyPdfSignatures, webCryptoSigner };
+//# sourceMappingURL=chunk-5OIMR74G.js.map
+//# sourceMappingURL=chunk-5OIMR74G.js.map