@kitsy/pdf 0.0.0-stage → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+All notable changes to this package are listed here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the package uses
+[Semantic Versioning](https://semver.org/). Before 1.0.0, minor versions may
+include breaking changes.
+
+## [0.2.0] - Unreleased
+
+### Added
+
+- USB-token DSC signing through hey's `dsc` service: `findTokenCertificates`,
+  `heyTokenSigner`, `HeyDscError` and `HEY_HUB_URL`. The private key stays on
+  the token, and the user confirms each signature in a native dialog.
+- `CertSignPdf` has a "USB token" mode next to "Certificate file", with
+  one-time setup steps for users who haven't installed hey yet.
+
+## [0.1.0] - 2026-11-02
+
+First public release.
+
+### Added
+
+- Framework-free core (`@kitsy/pdf`): merge, split, images to PDF, watermark
+  and page numbers, metadata, organize pages, visible signatures, PDF to
+  images, compress, fill forms, protect / unlock (AES-256), PAdES digital
+  signatures with `.pfx` / `.p12` certificates, and signature verification.
+- React UIs (`@kitsy/pdf/react` and `@kitsy/pdf/react/<tool>`), with
+  `PdfToolsProvider` for navigation and page chrome.
+- `configurePdf()` for asset URLs and the Producer name; `@kitsy/pdf/vite`
+  with ready-made asset URLs for Vite apps.
+- Prebuilt `@kitsy/pdf/styles.css` for apps that do not use Tailwind CSS.

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 HEYPKV INNOVATIONS PRIVATE LIMITED
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,16 @@
+@kitsy/pdf
+Copyright 2026 HEYPKV INNOVATIONS PRIVATE LIMITED
+
+This product includes software developed by HEYPKV INNOVATIONS PRIVATE LIMITED
+(https://kitsy.ai).
+
+This product depends on third-party open-source software, which is installed
+from npm as dependencies and is not modified or bundled into this package's
+own files. See THIRD_PARTY_NOTICES.md for the list and their licenses.
+
+pdf.js is Copyright Mozilla Foundation and is licensed under the Apache
+License, Version 2.0.
+
+qpdf is Copyright Jay Berkenbilt and contributors and is licensed under the
+Apache License, Version 2.0. It reaches this package as WebAssembly through
+@neslinesli93/qpdf-wasm.

package/README.md

@@ -1,3 +1,257 @@
-# Temporary Holding Version
+# @kitsy/pdf
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+PDF tools that run entirely in the browser. Files, certificates and passwords
+never leave the user's device.
+
+- **Core** (`@kitsy/pdf`): framework-free functions that take and return bytes.
+- **React UIs** (`@kitsy/pdf/react`): a ready-made page for each tool.
+
+| Tool | Core function | React component | Subpath |
+| --- | --- | --- | --- |
+| Merge | `mergePdfs` | `MergePdf` | `@kitsy/pdf/react/merge` |
+| Split | `splitPdf` | `SplitPdf` | `@kitsy/pdf/react/split` |
+| Images to PDF | `imagesToPdf` | `ImagesToPdf` | `@kitsy/pdf/react/images-to-pdf` |
+| Watermark & page numbers | `stampPdf` | `WatermarkPdf` | `@kitsy/pdf/react/watermark` |
+| Edit metadata | `readPdfMetadata`, `writePdfMetadata` | `PdfMetadata` | `@kitsy/pdf/react/metadata` |
+| Organize pages | `organizePdf` | `OrganizePdf` | `@kitsy/pdf/react/organize` |
+| Sign (visible) | `applySignatures` | `SignPdf` | `@kitsy/pdf/react/sign` |
+| PDF to images | `renderPageToCanvas` + helpers | `PdfToImages` | `@kitsy/pdf/react/pdf-to-images` |
+| Compress | `compressPdf` | `CompressPdf` | `@kitsy/pdf/react/compress` |
+| Fill forms | `readFormFields`, `fillForm` | `FillPdfForm` | `@kitsy/pdf/react/fill-form` |
+| Protect / unlock (AES-256) | `protectPdf`, `unlockPdf` | `ProtectPdf` | `@kitsy/pdf/react/protect` |
+| Digital signature (`.pfx` / `.p12`, PAdES) | `readPkcs12`, `signPdfWithCertificate` | `CertSignPdf` | `@kitsy/pdf/react/certificate-sign` |
+| Verify signatures | `verifyPdfSignatures` | `VerifyPdfSignatures` | `@kitsy/pdf/react/verify-signatures` |
+
+## Install
+
+```sh
+npm install @kitsy/pdf
+# React UIs also need React 18 or later
+```
+
+The package is ESM only. It works with any modern bundler (Vite, webpack 5,
+Rollup, esbuild) and in Node 20 or later for the operations that don't need a
+browser.
+
+## Configure assets (once, at start-up)
+
+Page previews use the pdf.js worker, and Protect / Unlock uses qpdf compiled
+to WebAssembly. Your bundler has to serve these files, so tell the package where
+they are.
+
+**Vite:**
+
+```js
+import { configurePdf } from "@kitsy/pdf";
+import { viteAssets } from "@kitsy/pdf/vite";
+
+configurePdf({ ...viteAssets, producer: "My App" });
+```
+
+`viteAssets` resolves both files from `@kitsy/pdf`'s own dependencies, so the
+worker always matches the pdf.js version in use.
+
+**Other bundlers:** copy these files into your public folder, then pass their
+URLs:
+
+- `node_modules/pdfjs-dist/build/pdf.worker.min.mjs`
+- `node_modules/@neslinesli93/qpdf-wasm/dist/qpdf.wasm`
+
+Use the `pdfjs-dist` copy that `@kitsy/pdf` itself resolves (`npm ls pdfjs-dist`).
+pdf.js requires the worker and the library to be the same version.
+
+```js
+configurePdf({
+  pdfjsWorkerSrc: "/pdf.worker.min.mjs",
+  qpdfWasmUrl: "/qpdf.wasm",
+});
+```
+
+| Option | Needed for | Notes |
+| --- | --- | --- |
+| `pdfjsWorkerSrc` | Previews, Organize, PDF to images, visible-signature preview | Required for those tools |
+| `qpdfWasmUrl` | Protect / unlock | Required for that tool |
+| `pdfjsAssetsBase` | Rendering CJK text and unembedded standard fonts | Optional. A folder containing `cmaps/` and `standard_fonts/` copied from `pdfjs-dist` |
+| `producer` | The Producer field of PDFs created from scratch | Default `"@kitsy/pdf"` |
+
+Tools that need a missing URL throw an error naming the option.
+
+## Core usage
+
+Every function takes `ArrayBuffer` or `Uint8Array` input and returns
+`Uint8Array` output.
+
+```js
+import { mergePdfs, splitPdf, stampPdf, protectPdf, browserQpdf } from "@kitsy/pdf";
+
+const merged = await mergePdfs([
+  { name: "a.pdf", bytes: aBytes },
+  { name: "b.pdf", bytes: bBytes, pages: "1-3, 5" },
+]);
+
+const parts = await splitPdf(merged, { mode: "every", every: 2 });
+// parts: [{ name, pageIndices, bytes }, ...]
+
+const stamped = await stampPdf(merged, {
+  watermark: { text: "CONFIDENTIAL", opacity: 0.15 },
+  pageNumbers: { format: "Page {n} of {total}", position: "bottom-center" },
+});
+
+const { bytes: locked } = await protectPdf(stamped, { userPassword: "s3cret", print: "low" }, browserQpdf);
+```
+
+### Digital signatures with a certificate
+
+```js
+import { readPkcs12, webCryptoSigner, signPdfWithCertificate, verifyPdfSignatures } from "@kitsy/pdf";
+
+const identity = readPkcs12(pfxBytes, password); // throws CertificatePasswordError on a wrong password
+const signer = await webCryptoSigner(identity); // private key becomes a non-extractable CryptoKey
+identity.privateKeyPkcs8.fill(0);
+
+const signed = await signPdfWithCertificate(pdfBytes, signer, {
+  reason: "I approve this document",
+  location: "Bengaluru",
+  visible: { pageIndex: 0, x: 0.6, y: 0.88, width: 0.38, height: 0.09 }, // or null
+});
+
+const [check] = await verifyPdfSignatures(signed);
+// { intact: true, coversWholeFile: true, signer: { commonName, ... }, signingTime, ... }
+```
+
+Details:
+
+- Signatures are PAdES baseline B (`ETSI.CAdES.detached`) using SHA-256 and
+  RSA. Adobe Reader, poppler (`pdfsig`) and OpenSSL validate them.
+- `.pfx` / `.p12` files with modern (AES) or legacy (3DES / RC2) encryption are
+  supported. Only RSA keys are supported.
+- `signer` is any object of the form `{ certificate, chain?, sign(bytes) }`
+  (`RawSigner`). You can plug in a hardware token or remote signer by
+  implementing `sign`.
+- `verifyPdfSignatures` checks integrity, whether anything was added after
+  signing, and the certificate details. It does **not** check whether the
+  certificate is trusted or revoked.
+
+### Digital signatures with a USB token
+
+USB-token DSCs (ePass2003, ProxKey, Watchdata, mToken, SafeNet and other
+PKCS#11 tokens) sign through [hey](https://github.com/kitsyai/hey) and its
+[dsc](https://github.com/kitsyai/dsc) service on the user's computer. The user
+runs `hey up dsc` once; the private key never leaves the token, and `dsc` shows
+a native confirmation dialog before every signature.
+
+```js
+import { findTokenCertificates, heyTokenSigner, signPdfWithCertificate, HeyDscError } from "@kitsy/pdf";
+
+try {
+  const [token] = await findTokenCertificates(); // [{ id, certificate, label, summary }]
+  const signer = heyTokenSigner(token, { document: "contract.pdf" }); // name shown in the dialog
+  const signed = await signPdfWithCertificate(pdfBytes, signer, { reason: "I approve this document" });
+} catch (error) {
+  if (error instanceof HeyDscError) {
+    // error.code: "no_hub" | "not_set_up" | "not_running" | "declined" | "pin_incorrect" | "pin_locked" | ...
+  }
+}
+```
+
+Your site's origin must be on the hey hub's allow-list, which you set in hey's
+`dsc` pack. If your site sends a Content-Security-Policy, add
+`http://127.0.0.1:8525` to `connect-src`. `CertSignPdf` (React) includes a
+"USB token" mode with the setup steps for users.
+
+## React usage
+
+Each component is a full page. Load them lazily through the per-tool subpaths:
+
+```jsx
+import { lazy, Suspense } from "react";
+import { PdfToolsProvider } from "@kitsy/pdf/react";
+
+const MergePdf = lazy(() => import("@kitsy/pdf/react/merge"));
+
+export function MergePage() {
+  return (
+    <PdfToolsProvider
+      backLink={{ href: "/tools", label: "All tools" }}
+      renderLink={({ href, className, children }) => (
+        <RouterLink to={href} className={className}>{children}</RouterLink>
+      )}
+    >
+      <Suspense fallback={null}>
+        <MergePdf />
+      </Suspense>
+    </PdfToolsProvider>
+  );
+}
+```
+
+`PdfToolsProvider` is optional. It accepts:
+
+- `backLink`: `{ href, label? }`, shown under each tool. Omit it to hide the
+  link.
+- `renderLink`: renders links with your router. The default is a plain `<a>`.
+- `header`: a React node shown above the title card, such as your app's
+  navigation.
+- `className`: classes for the outer wrapper. The default is `py-8 sm:py-12`.
+
+### Styling
+
+The components use [Tailwind CSS](https://tailwindcss.com) utility classes.
+Dark mode is driven by a `dark` class on `<html>` or any ancestor element.
+
+- **Your app uses Tailwind v4:** add the package to your sources, and use a
+  class-based dark variant:
+
+  ```css
+  @import "tailwindcss";
+  @source "../node_modules/@kitsy/pdf/dist";
+  @custom-variant dark (&:where(.dark, .dark *));
+  ```
+
+- **Your app doesn't use Tailwind:** import the prebuilt stylesheet. It is
+  about 32 KB, and its reset applies only inside the tools' root element.
+
+  ```js
+  import "@kitsy/pdf/styles.css";
+  ```
+
+Icons use [Font Awesome 6 Free](https://fontawesome.com) class names
+(`fa-solid ...`). Load Font Awesome in your app if you want them. Without it,
+the tools still work but show no icons.
+
+## Browser support
+
+Current Chrome, Edge, Firefox and Safari. These APIs are required:
+
+- WebCrypto (`crypto.subtle`)
+- WebAssembly
+- `DecompressionStream`
+- `createImageBitmap`
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck
+pnpm test
+pnpm run build   # dist/ with JS, type definitions and styles.css
+pnpm pack        # inspect exactly what would be published
+```
+
+## Publishing
+
+1. Update the version in `package.json` and `CHANGELOG.md`.
+2. `pnpm run check` (typecheck, tests, build). `prepublishOnly` runs it
+   again.
+3. `npm publish`. The repository's `.npmrc` maps the `@kitsy` scope to the
+   public registry (registry.npmjs.org), overriding a user-level mapping to a
+   private registry. A command-line `--registry` flag does **not** override a
+   scope mapping; `--@kitsy:registry=https://registry.npmjs.org/` does. Check
+   the "Publishing to" line of `npm publish --dry-run` first. Log in with
+   `npm login --registry=https://registry.npmjs.org/` as a member of the
+   `kitsy` npm organisation (with 2FA if the organisation requires it).
+
+## License
+
+[Apache-2.0](LICENSE). Copyright 2026 HEYPKV INNOVATIONS PRIVATE LIMITED.
+Third-party licenses are listed in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,48 @@
+# Third-party notices
+
+`@kitsy/pdf` is licensed under the [Apache License 2.0](LICENSE). It uses the
+open-source packages below. They are installed from npm as dependencies; this
+package does not copy or modify their code. When you bundle an app that uses
+`@kitsy/pdf`, your bundle includes code from these packages, so their licenses
+apply to that bundle too.
+
+## Runtime dependencies
+
+| Package | License | Used for |
+| --- | --- | --- |
+| [pdf-lib](https://github.com/Hopding/pdf-lib) | MIT | Reading and writing PDFs |
+| [@pdf-lib/standard-fonts](https://github.com/Hopding/standard-fonts), [@pdf-lib/upng](https://github.com/Hopding/upng) | MIT | pdf-lib internals |
+| [pako](https://github.com/nodeca/pako) | MIT AND Zlib | Compression (via pdf-lib) |
+| [pdfjs-dist](https://github.com/mozilla/pdf.js) (pdf.js) | Apache-2.0 | Page previews, PDF to images |
+| [@neslinesli93/qpdf-wasm](https://github.com/neslinesli93/qpdf-wasm) | ISC | Encryption and decryption (Protect / Unlock) |
+| [qpdf](https://github.com/qpdf/qpdf) (inside the WebAssembly above) | Apache-2.0 | Encryption and decryption |
+| [pkijs](https://github.com/PeculiarVentures/PKI.js) | BSD-3-Clause | CMS signatures and X.509 certificates |
+| [asn1js](https://github.com/PeculiarVentures/ASN1.js) | BSD-3-Clause | ASN.1 encoding (via pkijs) |
+| [bytestreamjs](https://github.com/PeculiarVentures/ByteStream.js) | BSD-3-Clause | pkijs internals |
+| [pvtsutils](https://github.com/PeculiarVentures/pvtsutils), [pvutils](https://github.com/PeculiarVentures/pvutils) | MIT | pkijs internals |
+| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | MIT | pkijs internals |
+| [tslib](https://github.com/microsoft/tslib) | 0BSD | Helpers used by dependencies |
+| [node-forge](https://github.com/digitalbazaar/forge) | BSD-3-Clause OR GPL-2.0 (used under BSD-3-Clause) | Decrypting `.pfx` / `.p12` certificate files only |
+| [@fontsource/dancing-script](https://github.com/fontsource/font-files) | OFL-1.1 (font), MIT (packaging) | Typed signature style (React UI) |
+| [@fontsource/great-vibes](https://github.com/fontsource/font-files) | OFL-1.1 (font), MIT (packaging) | Typed signature style (React UI) |
+
+`pdfjs-dist` also lists `@napi-rs/canvas` (MIT) as an optional dependency for
+Node. Browsers do not use it.
+
+## Optional peer dependency
+
+| Package | License |
+| --- | --- |
+| [react](https://github.com/facebook/react) | MIT |
+
+## Not included
+
+- Font Awesome: the React UI uses its class names (`fa-solid ...`) for icons
+  but does not ship it. If you load it, its own license applies (icons
+  CC BY 4.0, fonts SIL OFL 1.1, code MIT).
+- pdf.js CMaps and standard fonts are not shipped. If you serve them (see
+  `pdfjsAssetsBase` in the README), they come from `pdfjs-dist` under its
+  licenses.
+
+The full license text of each package is in its folder under `node_modules`
+after install, and at the links above.

package/dist/chunk-2K5X7L5J.js

@@ -0,0 +1,43 @@
+import { fieldLabelClass, inputClass } from './chunk-H6EERRCR.js';
+import { useState } from 'react';
+import { jsxs, jsx } from 'react/jsx-runtime';
+
+function PasswordInput({ id, label, value, onChange, disabled, autoComplete = "new-password", hint = "", inputRef = void 0 }) {
+  const [visible, setVisible] = useState(false);
+  const hintId = `${id}-hint`;
+  return /* @__PURE__ */ jsxs("div", { children: [
+    /* @__PURE__ */ jsx("label", { htmlFor: id, className: fieldLabelClass, children: label }),
+    /* @__PURE__ */ jsxs("div", { className: "mt-2 flex items-center gap-2", children: [
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          id,
+          ref: inputRef,
+          type: visible ? "text" : "password",
+          value,
+          onChange: (event) => onChange(event.target.value),
+          disabled,
+          autoComplete,
+          spellCheck: false,
+          "aria-describedby": hint ? hintId : void 0,
+          className: inputClass
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => setVisible((current) => !current),
+          className: "shrink-0 text-xs font-semibold normal-case tracking-normal text-[#1F8CFF]",
+          "aria-label": visible ? `Hide ${label}` : `Show ${label}`,
+          children: visible ? "Hide" : "Show"
+        }
+      )
+    ] }),
+    hint ? /* @__PURE__ */ jsx("p", { id: hintId, className: "mt-1 text-[11px] text-slate-500 dark:text-slate-400", children: hint }) : null
+  ] });
+}
+
+export { PasswordInput };
+//# sourceMappingURL=chunk-2K5X7L5J.js.map
+//# sourceMappingURL=chunk-2K5X7L5J.js.map

package/dist/chunk-2K5X7L5J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/PasswordInput.tsx"],"names":[],"mappings":";;;;AAIO,SAAS,aAAA,CAAc,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,YAAA,GAAe,cAAA,EAAgB,IAAA,GAAO,EAAA,EAAI,QAAA,GAAW,QAAU,EAAG;AACtI,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,KAAK,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,GAAG,EAAE,CAAA,KAAA,CAAA;AACpB,EAAA,4BACG,KAAA,EAAA,EACC,QAAA,EAAA;AAAA,oBAAA,GAAA,CAAC,OAAA,EAAA,EAAM,OAAA,EAAS,EAAA,EAAI,SAAA,EAAW,iBAC5B,QAAA,EAAA,KAAA,EACH,CAAA;AAAA,oBACA,IAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAU,8BAAA,EACb,QAAA,EAAA;AAAA,sBAAA,GAAA;AAAA,QAAC,OAAA;AAAA,QAAA;AAAA,UACC,EAAA;AAAA,UACA,GAAA,EAAK,QAAA;AAAA,UACL,IAAA,EAAM,UAAU,MAAA,GAAS,UAAA;AAAA,UACzB,KAAA;AAAA,UACA,UAAU,CAAC,KAAA,KAAU,QAAA,CAAS,KAAA,CAAM,OAAO,KAAK,CAAA;AAAA,UAChD,QAAA;AAAA,UACA,YAAA;AAAA,UACA,UAAA,EAAY,KAAA;AAAA,UACZ,kBAAA,EAAkB,OAAO,MAAA,GAAS,MAAA;AAAA,UAClC,SAAA,EAAW;AAAA;AAAA,OACb;AAAA,sBACA,GAAA;AAAA,QAAC,QAAA;AAAA,QAAA;AAAA,UACC,IAAA,EAAK,QAAA;AAAA,UACL,SAAS,MAAM,UAAA,CAAW,CAAC,OAAA,KAAY,CAAC,OAAO,CAAA;AAAA,UAC/C,SAAA,EAAU,2EAAA;AAAA,UACV,cAAY,OAAA,GAAU,CAAA,KAAA,EAAQ,KAAK,CAAA,CAAA,GAAK,QAAQ,KAAK,CAAA,CAAA;AAAA,UAEpD,oBAAU,MAAA,GAAS;AAAA;AAAA;AACtB,KAAA,EACF,CAAA;AAAA,IACC,IAAA,uBACE,GAAA,EAAA,EAAE,EAAA,EAAI,QAAQ,SAAA,EAAU,qDAAA,EACtB,gBACH,CAAA,GACE;AAAA,GAAA,EACN,CAAA;AAEJ","file":"chunk-2K5X7L5J.js","sourcesContent":["import React, { useState } from \"react\";\nimport { fieldLabelClass, inputClass } from \"./ToolLayout\";\n\n/** A password field with a show/hide toggle; the hint is linked via aria-describedby. */\nexport function PasswordInput({ id, label, value, onChange, disabled, autoComplete = \"new-password\", hint = \"\", inputRef = undefined }) {\n  const [visible, setVisible] = useState(false);\n  const hintId = `${id}-hint`;\n  return (\n    <div>\n      <label htmlFor={id} className={fieldLabelClass}>\n        {label}\n      </label>\n      <div className=\"mt-2 flex items-center gap-2\">\n        <input\n          id={id}\n          ref={inputRef}\n          type={visible ? \"text\" : \"password\"}\n          value={value}\n          onChange={(event) => onChange(event.target.value)}\n          disabled={disabled}\n          autoComplete={autoComplete}\n          spellCheck={false}\n          aria-describedby={hint ? hintId : undefined}\n          className={inputClass}\n        />\n        <button\n          type=\"button\"\n          onClick={() => setVisible((current) => !current)}\n          className=\"shrink-0 text-xs font-semibold normal-case tracking-normal text-[#1F8CFF]\"\n          aria-label={visible ? `Hide ${label}` : `Show ${label}`}\n        >\n          {visible ? \"Hide\" : \"Show\"}\n        </button>\n      </div>\n      {hint ? (\n        <p id={hintId} className=\"mt-1 text-[11px] text-slate-500 dark:text-slate-400\">\n          {hint}\n        </p>\n      ) : null}\n    </div>\n  );\n}\n"]}