@mostajs/pdf-sign 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog — @mostajs/pdf-sign
+
+**Auteur** : Dr Hamid MADANI <drmdh@msn.com>
+
+Le format suit [Keep a Changelog](https://keepachangelog.com/fr/) ; versionnage [SemVer](https://semver.org/lang/fr/).
+
+## [0.1.0] — 2026-07-01
+
+### Ajouté
+
+- Moteur **hybride** de signature PDF : cœur Node (PKCS#7 détaché via `@signpdf`) + bascule pyhanko (PAdES visible + permissions AES-256).
+- API : `signPdf`, `verifyPdf`, `detectEngines`, `resolvePython`, `pyhankoAvailable`, `loadPdfSignConfig`.
+- CLI `mosta-pdf-sign` : `sign`, `verify`, `engines`.
+- Configuration 100 % `.env` via `@mostajs/config` (préfixe `PDF_SIGN_*`).
+- Script Python embarqué `python/sign_with_perms.py` (portage générique et paramétré du pipeline `pyhanko + pikepdf`), + `setup-venv.sh` et `requirements.txt`.
+- Cachet visible « image de fond + texte » (logo/tampon) via `field.stampImage` / `PDF_SIGN_STAMP_IMAGE` (moteur pyhanko, `stamp.TextStampStyle`).
+- Vérification : validation cryptographique pyhanko si disponible (authentification automatique du mot de passe utilisateur vide sur PDF chiffré, nom du signataire lisible), sinon détection Node (`/ByteRange`).
+- Tests `@mostajs/mjs-unit` et exemples `examples/*.mjs`.

package/README.md

@@ -0,0 +1,101 @@
+# @mostajs/pdf-sign
+
+**Auteur** : Dr Hamid MADANI <drmdh@msn.com>
+**Licence** : AGPL-3.0-or-later
+
+Signature numérique de PDF pour l'écosystème `@mostajs/*`. Moteur **hybride** :
+
+- **cœur Node** — signature PKCS#7 détachée via [`@signpdf`](https://github.com/vbuch/node-signpdf), cachet invisible, **aucune dépendance Python** ;
+- **bascule pyhanko** — signature **PAdES** visible + **permissions restrictives** (chiffrement AES-256, R=6) quand un venv Python est disponible.
+
+Configuration **100 % `.env`** (via `@mostajs/config`), API + CLI. Portage générique et paramétré du pipeline `pyhanko + pikepdf` éprouvé.
+
+## Pourquoi — valeur probante (SIH & documents officiels)
+
+La signature électronique de PDF apporte la **preuve médico-légale** et la **valeur probante** exigées par l'interopérabilité et la sécurité d'un Système d'Information Hospitalier :
+
+| Domaine | Documents |
+|---|---|
+| Clinique | CRH, CRO, comptes rendus d'imagerie / biologie signés par le praticien |
+| Administratif | certificats de séjour, ordonnances, dossiers de sortie |
+| Financier / CNAS-CASNOS | factures, bordereaux de remboursement, prises en charge |
+
+Le module reste **générique** : il ne connaît aucun métier. La sémantique (quel document, quel signataire) est portée par l'appelant.
+
+## Installation
+
+```bash
+pnpm add @mostajs/pdf-sign
+# Moteur pyhanko (optionnel : PAdES + permissions) :
+bash node_modules/@mostajs/pdf-sign/python/setup-venv.sh
+export PDF_SIGN_PYTHON="$(pwd)/node_modules/@mostajs/pdf-sign/python/.venv/bin/python"
+```
+
+## API
+
+```js
+import { signPdf, verifyPdf, detectEngines } from "@mostajs/pdf-sign";
+
+// Signature (auto : pyhanko si dispo, sinon Node)
+await signPdf({
+  input: "crh.pdf",
+  output: "crh.signe.pdf",
+  p12: "praticien.p12",
+  passphrase: process.env.P12_PASS,
+  meta: { reason: "Compte rendu d'hospitalisation", name: "Dr H. Madani", location: "Alger, DZ" },
+});
+
+// Signature restreinte (PAdES + chiffrement AES-256 — exige pyhanko)
+await signPdf({
+  input: "facture-cnas.pdf",
+  output: "facture-cnas.signe.pdf",
+  p12: "etablissement.p12",
+  passphrase: process.env.P12_PASS,
+  permissions: { extract: false, modifyOther: false, printHighres: true },
+  field: { page: 1, box: [320, 40, 575, 140], stampImage: "logo-chu.png" }, // cachet visible image + texte
+  engine: "pyhanko",
+});
+
+// Vérification
+const r = verifyPdf({ input: "crh.signe.pdf", trustPem: "ac-racine.pem" });
+console.log(r.signed, r.signatures);
+
+// État des moteurs
+console.log(detectEngines());
+```
+
+## CLI
+
+```bash
+mosta-pdf-sign sign in.pdf out.pdf --p12 cert.p12 --pass secret \
+    --reason "Ordonnance" --name "Dr H. Madani" --location "Alger, DZ"
+mosta-pdf-sign sign in.pdf out.pdf --p12 cert.p12 --pass secret --restrict --engine pyhanko
+mosta-pdf-sign verify out.pdf --trust ac-racine.pem
+mosta-pdf-sign engines
+```
+
+## Configuration (`.env`)
+
+| Clé | Rôle |
+|---|---|
+| `PDF_SIGN_P12` / `PDF_SIGN_PASSPHRASE` / `PDF_SIGN_PASSPHRASE_FILE` | certificat PKCS#12 et secret |
+| `PDF_SIGN_ENGINE` | `auto` (défaut) · `node` · `pyhanko` |
+| `PDF_SIGN_PYTHON` | binaire Python du venv pyhanko |
+| `PDF_SIGN_REASON` / `_LOCATION` / `_NAME` / `_CONTACT` | métadonnées du cachet |
+| `PDF_SIGN_FIELD_PAGE` / `PDF_SIGN_FIELD_BOX` | page (0-based) et boîte `x1,y1,x2,y2` (points, origine bas-gauche) |
+| `PDF_SIGN_STAMP_IMAGE` | image de fond du cachet visible (logo/tampon derrière le texte ; moteur pyhanko) |
+| `PDF_SIGN_RESTRICT` | `true` → permissions restrictives (pyhanko) |
+| `PDF_SIGN_TRUST_PEM` | certificat de confiance pour la vérification |
+
+## Moteurs
+
+| Moteur | PKCS#7 | PAdES visible | Permissions AES-256 | Dépendance |
+|---|:---:|:---:|:---:|---|
+| `node` | ✅ | ❌ | ❌ | aucune (JS pur) |
+| `pyhanko` | ✅ | ✅ | ✅ | venv `pyhanko>=0.25`, `pikepdf>=8` |
+
+Le cœur Node **lève une erreur** si des permissions sont demandées : le PAdES et le chiffrement exigent pyhanko.
+
+## Voir aussi
+
+- `@mostajs/pdf-sign-ui` — couche de présentation (formulaire de signature, vérification, headless + composants).

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/**
+ * @mostajs/pdf-sign — CLI. `mosta-pdf-sign sign|verify|engines`.
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import { signPdf } from "./sign.js";
+import { verifyPdf } from "./verify.js";
+import { detectEngines } from "./engines.js";
+function opt(argv, name) {
+    const i = argv.indexOf(`--${name}`);
+    return i >= 0 && i + 1 < argv.length ? argv[i + 1] : undefined;
+}
+function flag(argv, name) {
+    return argv.includes(`--${name}`);
+}
+const HELP = `mosta-pdf-sign — signature numérique de PDF (moteur hybride Node + pyhanko)
+
+  mosta-pdf-sign sign <in.pdf> [out.pdf] [options]
+      --p12 <fichier>       certificat PKCS#12 (ou PDF_SIGN_P12)
+      --pass <str> | --pass-file <fichier>
+      --engine auto|node|pyhanko   (défaut auto)
+      --restrict            permissions restrictives (PAdES pyhanko requis)
+      --reason --name --location --contact
+  mosta-pdf-sign verify <pdf> [--trust cert.pem] [--engine ...]
+  mosta-pdf-sign engines  état des moteurs disponibles
+`;
+async function main() {
+    const argv = process.argv.slice(2);
+    const cmd = argv[0];
+    const rest = argv.slice(1).filter((a) => !a.startsWith("--"));
+    if (!cmd || cmd === "--help" || cmd === "-h") {
+        process.stdout.write(HELP);
+        return;
+    }
+    if (cmd === "engines") {
+        console.log(JSON.stringify(detectEngines(), null, 2));
+        return;
+    }
+    if (cmd === "sign") {
+        const input = rest[0];
+        const output = rest[1];
+        if (!input) {
+            process.stderr.write("Entrée PDF manquante.\n" + HELP);
+            process.exit(1);
+        }
+        const res = await signPdf({
+            input,
+            output,
+            p12: opt(argv, "p12"),
+            passphrase: opt(argv, "pass"),
+            passphraseFile: opt(argv, "pass-file"),
+            engine: opt(argv, "engine"),
+            permissions: flag(argv, "restrict") ? {} : undefined,
+            meta: {
+                reason: opt(argv, "reason"), name: opt(argv, "name"),
+                location: opt(argv, "location"), contact: opt(argv, "contact"),
+            },
+        });
+        console.log(`OK — signé (${res.engine}) : ${res.output ?? "<buffer>"}`);
+        return;
+    }
+    if (cmd === "verify") {
+        const input = rest[0];
+        if (!input) {
+            process.stderr.write("PDF à vérifier manquant.\n");
+            process.exit(1);
+        }
+        const res = verifyPdf({ input, trustPem: opt(argv, "trust"), engine: opt(argv, "engine") });
+        console.log(JSON.stringify(res, null, 2));
+        return;
+    }
+    process.stderr.write(`Commande inconnue : ${cmd}\n` + HELP);
+    process.exit(1);
+}
+main().catch((e) => { process.stderr.write(String(e?.message ?? e) + "\n"); process.exit(1); });
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,SAAS,GAAG,CAAC,IAAc,EAAE,IAAY;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AACD,SAAS,IAAI,CAAC,IAAc,EAAE,IAAY;IACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,IAAI,GAAG;;;;;;;;;;CAUZ,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9D,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAErF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACxF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;YACxB,KAAK;YACL,MAAM;YACN,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAW;YAC/B,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;YAC7B,cAAc,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;YACtC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAA2B;YACrD,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;YACpD,IAAI,EAAE;gBACJ,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;gBACpD,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;aAC/D;SACF,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACpF,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAA2B,EAAE,CAAC,CAAC;QACtH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,14 @@
+import type { SignEngine, SignField, SignMeta } from "./types.js";
+export interface PdfSignConfig {
+    p12?: string;
+    passphrase?: string;
+    passphraseFile?: string;
+    engine: SignEngine;
+    python?: string;
+    meta: SignMeta;
+    field: SignField;
+    restrict: boolean;
+    trustPem?: string;
+}
+export declare function loadPdfSignConfig(): PdfSignConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAOD,wBAAgB,iBAAiB,IAAI,aAAa,CAwBjD"}

package/dist/config.js

@@ -0,0 +1,44 @@
+/**
+ * @mostajs/pdf-sign — configuration via @mostajs/config (.env). Rien en dur.
+ *
+ * Clés :
+ *   PDF_SIGN_P12 / PDF_SIGN_PASSPHRASE / PDF_SIGN_PASSPHRASE_FILE
+ *   PDF_SIGN_ENGINE (auto|node|pyhanko) · PDF_SIGN_PYTHON (bin du venv pyhanko)
+ *   PDF_SIGN_REASON / PDF_SIGN_LOCATION / PDF_SIGN_NAME / PDF_SIGN_CONTACT
+ *   PDF_SIGN_FIELD_PAGE / PDF_SIGN_FIELD_BOX ("x1,y1,x2,y2") · PDF_SIGN_STAMP_IMAGE (logo du cachet) · PDF_SIGN_RESTRICT (bool)
+ *   PDF_SIGN_TRUST_PEM (validation)
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import { getEnv, getEnvBool } from "@mostajs/config";
+function parseBox(s) {
+    const n = s.split(",").map((x) => Number(x.trim()));
+    return n.length === 4 && n.every((v) => !Number.isNaN(v)) ? n : undefined;
+}
+export function loadPdfSignConfig() {
+    const engine = getEnv("PDF_SIGN_ENGINE", "auto");
+    const box = getEnv("PDF_SIGN_FIELD_BOX", "");
+    const page = getEnv("PDF_SIGN_FIELD_PAGE", "");
+    return {
+        p12: getEnv("PDF_SIGN_P12", "") || undefined,
+        passphrase: getEnv("PDF_SIGN_PASSPHRASE", "") || undefined,
+        passphraseFile: getEnv("PDF_SIGN_PASSPHRASE_FILE", "") || undefined,
+        engine: (["auto", "node", "pyhanko"].includes(engine) ? engine : "auto"),
+        python: getEnv("PDF_SIGN_PYTHON", "") || undefined,
+        meta: {
+            reason: getEnv("PDF_SIGN_REASON", "") || undefined,
+            location: getEnv("PDF_SIGN_LOCATION", "") || undefined,
+            name: getEnv("PDF_SIGN_NAME", "") || undefined,
+            contact: getEnv("PDF_SIGN_CONTACT", "") || undefined,
+        },
+        field: {
+            page: page ? Number(page) : undefined,
+            box: box ? parseBox(box) : undefined,
+            stampImage: getEnv("PDF_SIGN_STAMP_IMAGE", "") || undefined,
+        },
+        restrict: getEnvBool("PDF_SIGN_RESTRICT", false),
+        trustPem: getEnv("PDF_SIGN_TRUST_PEM", "") || undefined,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAerD,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAsC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,SAAS;QAC5C,UAAU,EAAE,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC,IAAI,SAAS;QAC1D,cAAc,EAAE,MAAM,CAAC,0BAA0B,EAAE,EAAE,CAAC,IAAI,SAAS;QACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAe;QACtF,MAAM,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC,IAAI,SAAS;QAClD,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC,IAAI,SAAS;YAClD,QAAQ,EAAE,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,IAAI,SAAS;YACtD,IAAI,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,IAAI,SAAS;YAC9C,OAAO,EAAE,MAAM,CAAC,kBAAkB,EAAE,EAAE,CAAC,IAAI,SAAS;SACrD;QACD,KAAK,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACrC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACpC,UAAU,EAAE,MAAM,CAAC,sBAAsB,EAAE,EAAE,CAAC,IAAI,SAAS;SAC5D;QACD,QAAQ,EAAE,UAAU,CAAC,mBAAmB,EAAE,KAAK,CAAC;QAChD,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,CAAC,IAAI,SAAS;KACxD,CAAC;AACJ,CAAC"}

package/dist/engines.d.ts

@@ -0,0 +1,11 @@
+import type { EngineAvailability } from "./types.js";
+/** Répertoire des scripts Python embarqués (proven pipeline). */
+export declare const PYTHON_DIR: string;
+export declare const SIGN_PY: string;
+/** Résout le binaire Python : explicite > venv local du module > python3. */
+export declare function resolvePython(explicit?: string): string;
+/** Vrai si ce Python importe pyhanko + pikepdf (moteur PAdES + permissions). */
+export declare function pyhankoAvailable(python: string): boolean;
+/** État des moteurs disponibles. */
+export declare function detectEngines(explicitPython?: string): EngineAvailability;
+//# sourceMappingURL=engines.d.ts.map

package/dist/engines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engines.d.ts","sourceRoot":"","sources":["../src/engines.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD,iEAAiE;AACjE,eAAO,MAAM,UAAU,QAAgC,CAAC;AACxD,eAAO,MAAM,OAAO,QAA4C,CAAC;AAGjE,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOxD;AAED,oCAAoC;AACpC,wBAAgB,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAGzE"}

package/dist/engines.js

@@ -0,0 +1,39 @@
+/**
+ * @mostajs/pdf-sign — détection des moteurs (Node toujours, pyhanko si venv/deps).
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const HERE = dirname(fileURLToPath(import.meta.url)); // dist/
+/** Répertoire des scripts Python embarqués (proven pipeline). */
+export const PYTHON_DIR = resolve(HERE, "..", "python");
+export const SIGN_PY = resolve(PYTHON_DIR, "sign_with_perms.py");
+const VENV_PY = resolve(PYTHON_DIR, ".venv", "bin", "python");
+/** Résout le binaire Python : explicite > venv local du module > python3. */
+export function resolvePython(explicit) {
+    if (explicit && existsSync(explicit))
+        return explicit;
+    if (existsSync(VENV_PY))
+        return VENV_PY;
+    return "python3";
+}
+/** Vrai si ce Python importe pyhanko + pikepdf (moteur PAdES + permissions). */
+export function pyhankoAvailable(python) {
+    try {
+        execFileSync(python, ["-c", "import pyhanko, pikepdf"], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** État des moteurs disponibles. */
+export function detectEngines(explicitPython) {
+    const python = resolvePython(explicitPython);
+    return { node: true, pyhanko: pyhankoAvailable(python), python };
+}
+//# sourceMappingURL=engines.js.map

package/dist/engines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engines.js","sourceRoot":"","sources":["../src/engines.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ;AAC9D,iEAAiE;AACjE,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAE9D,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtD,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC;QACH,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,yBAAyB,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,aAAa,CAAC,cAAuB;IACnD,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @mostajs/pdf-sign — signature numérique de PDF, moteur hybride (Node + pyhanko).
+ *
+ * Cœur Node (PKCS#7 via @signpdf) + bascule pyhanko (PAdES + permissions AES-256) si
+ * disponible. Réutilise le pipeline éprouvé pyhanko+pikepdf. Config 100% `.env`.
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+export { signPdf } from "./sign.js";
+export { verifyPdf } from "./verify.js";
+export { detectEngines, resolvePython, pyhankoAvailable } from "./engines.js";
+export { loadPdfSignConfig, type PdfSignConfig } from "./config.js";
+export type { SignOptions, SignResult, SignMeta, SignField, SignPermissions, SignEngine, VerifyOptions, VerifyResult, SignatureInfo, EngineAvailability, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EACV,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EACzE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,GAC/D,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,14 @@
+/**
+ * @mostajs/pdf-sign — signature numérique de PDF, moteur hybride (Node + pyhanko).
+ *
+ * Cœur Node (PKCS#7 via @signpdf) + bascule pyhanko (PAdES + permissions AES-256) si
+ * disponible. Réutilise le pipeline éprouvé pyhanko+pikepdf. Config 100% `.env`.
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+export { signPdf } from "./sign.js";
+export { verifyPdf } from "./verify.js";
+export { detectEngines, resolvePython, pyhankoAvailable } from "./engines.js";
+export { loadPdfSignConfig } from "./config.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAsB,MAAM,aAAa,CAAC"}

package/dist/node-signer.d.ts

@@ -0,0 +1,4 @@
+import type { SignOptions, SignResult } from "./types.js";
+/** Signe un PDF côté Node (PKCS#7 détaché, cachet invisible). */
+export declare function signNode(opts: SignOptions): Promise<SignResult>;
+//# sourceMappingURL=node-signer.d.ts.map

package/dist/node-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-signer.d.ts","sourceRoot":"","sources":["../src/node-signer.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D,iEAAiE;AACjE,wBAAsB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBrE"}

package/dist/node-signer.js

@@ -0,0 +1,35 @@
+/**
+ * @mostajs/pdf-sign — cœur Node (signature PKCS#7 détachée via @signpdf).
+ *
+ * Ne gère PAS les permissions/chiffrement ni le PAdES/LTV : pour cela, moteur pyhanko.
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { SignPdf } from "@signpdf/signpdf";
+import { P12Signer } from "@signpdf/signer-p12";
+import { plainAddPlaceholder } from "@signpdf/placeholder-plain";
+/** Signe un PDF côté Node (PKCS#7 détaché, cachet invisible). */
+export async function signNode(opts) {
+    if (opts.permissions) {
+        throw new Error("Le cœur Node ne gère pas les permissions/PAdES — utilisez engine:'pyhanko' (python/setup-venv.sh).");
+    }
+    const pdfBuffer = typeof opts.input === "string" ? readFileSync(opts.input) : Buffer.from(opts.input);
+    const p12Buffer = typeof opts.p12 === "string" ? readFileSync(opts.p12) : Buffer.from(opts.p12);
+    const withPlaceholder = plainAddPlaceholder({
+        pdfBuffer,
+        reason: opts.meta?.reason ?? "Signature",
+        contactInfo: opts.meta?.contact ?? "",
+        name: opts.meta?.name ?? "",
+        location: opts.meta?.location ?? "",
+    });
+    const signer = new P12Signer(p12Buffer, { passphrase: opts.passphrase ?? "" });
+    const signed = await new SignPdf().sign(withPlaceholder, signer);
+    if (opts.output) {
+        writeFileSync(opts.output, signed);
+        return { output: opts.output, engine: "node" };
+    }
+    return { bytes: new Uint8Array(signed), engine: "node" };
+}
+//# sourceMappingURL=node-signer.js.map

package/dist/node-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-signer.js","sourceRoot":"","sources":["../src/node-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAiB;IAC9C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtG,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhG,MAAM,eAAe,GAAG,mBAAmB,CAAC;QAC1C,SAAS;QACT,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,WAAW;QACxC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE;QACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE;QAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEjE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC"}

package/dist/pyhanko-signer.d.ts

@@ -0,0 +1,4 @@
+import type { SignOptions, SignResult } from "./types.js";
+/** Signe via pyhanko (PAdES visible + éventuelles permissions restrictives). */
+export declare function signPyhanko(opts: SignOptions, python: string): SignResult;
+//# sourceMappingURL=pyhanko-signer.d.ts.map

package/dist/pyhanko-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pyhanko-signer.d.ts","sourceRoot":"","sources":["../src/pyhanko-signer.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAmB,UAAU,EAAE,MAAM,YAAY,CAAC;AAqB3E,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CA8BzE"}

package/dist/pyhanko-signer.js

@@ -0,0 +1,59 @@
+/**
+ * @mostajs/pdf-sign — moteur pyhanko (PAdES + permissions AES-256), via le script Python embarqué.
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { SIGN_PY } from "./engines.js";
+function toFile(dir, name, data) {
+    const p = join(dir, name);
+    writeFileSync(p, data);
+    return p;
+}
+function mapPermissions(p) {
+    return {
+        accessibility: p.accessibility ?? true,
+        extract: p.extract ?? false,
+        modify_annotation: p.modifyAnnotation ?? false,
+        modify_assembly: p.modifyAssembly ?? false,
+        modify_other: p.modifyOther ?? false,
+        print_lowres: p.printLowres ?? true,
+        print_highres: p.printHighres ?? true,
+    };
+}
+/** Signe via pyhanko (PAdES visible + éventuelles permissions restrictives). */
+export function signPyhanko(opts, python) {
+    const dir = mkdtempSync(join(tmpdir(), "mosta-pdf-sign-"));
+    try {
+        const inPath = typeof opts.input === "string" ? opts.input : toFile(dir, "in.pdf", opts.input);
+        const p12Path = typeof opts.p12 === "string" ? opts.p12 : toFile(dir, "cert.p12", opts.p12);
+        const outPath = opts.output ?? join(dir, "out.pdf");
+        let passFile = opts.passphraseFile;
+        if (!passFile)
+            passFile = toFile(dir, ".pass", opts.passphrase ?? "");
+        const perms = opts.permissions ? mapPermissions(opts.permissions) : null;
+        const cfg = {
+            meta: opts.meta ?? {},
+            field: {
+                name: opts.field?.name,
+                page: opts.field?.page ?? 0,
+                box: opts.field?.box ?? [320, 40, 575, 140],
+                stamp_image: opts.field?.stampImage,
+            },
+            permissions: perms,
+        };
+        const cfgPath = toFile(dir, "config.json", JSON.stringify(cfg));
+        execFileSync(python, [SIGN_PY, "sign", inPath, outPath, p12Path, passFile, cfgPath], { stdio: "inherit" });
+        if (opts.output)
+            return { output: outPath, engine: "pyhanko" };
+        return { bytes: readFileSync(outPath), engine: "pyhanko" };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=pyhanko-signer.js.map

package/dist/pyhanko-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pyhanko-signer.js","sourceRoot":"","sources":["../src/pyhanko-signer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,SAAS,MAAM,CAAC,GAAW,EAAE,IAAY,EAAE,IAAyB;IAClE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,CAAkB;IACxC,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;QACtC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK;QAC3B,iBAAiB,EAAE,CAAC,CAAC,gBAAgB,IAAI,KAAK;QAC9C,eAAe,EAAE,CAAC,CAAC,cAAc,IAAI,KAAK;QAC1C,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,KAAK;QACpC,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QACnC,aAAa,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;KACtC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpD,IAAI,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;QACnC,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAEtE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,MAAM,GAAG,GAAG;YACV,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACrB,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI;gBACtB,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC;gBAC3B,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC;gBAC3C,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU;aACpC;YACD,WAAW,EAAE,KAAK;SACnB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAEhE,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3G,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/sign.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @mostajs/pdf-sign — dispatcher HYBRIDE.
+ *
+ * `auto` (défaut) : pyhanko si disponible (PAdES + permissions), sinon cœur Node.
+ * `node` : force PKCS#7 Node. `pyhanko` : force PAdES (erreur si venv absent).
+ * Fusionne les options avec la config `.env`.
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import type { SignOptions, SignResult } from "./types.js";
+export declare function signPdf(opts: SignOptions): Promise<SignResult>;
+//# sourceMappingURL=sign.d.ts.map

package/dist/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAM1D,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA8BpE"}

package/dist/sign.js

@@ -0,0 +1,35 @@
+import { detectEngines } from "./engines.js";
+import { signNode } from "./node-signer.js";
+import { signPyhanko } from "./pyhanko-signer.js";
+import { loadPdfSignConfig } from "./config.js";
+export async function signPdf(opts) {
+    const cfg = loadPdfSignConfig();
+    const merged = {
+        ...opts,
+        p12: opts.p12 ?? cfg.p12,
+        passphrase: opts.passphrase ?? cfg.passphrase,
+        passphraseFile: opts.passphraseFile ?? cfg.passphraseFile,
+        meta: { ...cfg.meta, ...opts.meta },
+        field: { ...cfg.field, ...opts.field },
+        permissions: opts.permissions ?? (cfg.restrict ? {} : undefined),
+        engine: opts.engine ?? cfg.engine,
+    };
+    if (!merged.p12)
+        throw new Error("Certificat PKCS#12 manquant (opts.p12 ou PDF_SIGN_P12).");
+    const avail = detectEngines(cfg.python);
+    const want = merged.engine ?? "auto";
+    let engine;
+    if (want === "pyhanko") {
+        if (!avail.pyhanko)
+            throw new Error("Moteur pyhanko indisponible — lancer python/setup-venv.sh (ou PDF_SIGN_PYTHON).");
+        engine = "pyhanko";
+    }
+    else if (want === "node") {
+        engine = "node";
+    }
+    else {
+        engine = avail.pyhanko ? "pyhanko" : "node"; // auto : préfère pyhanko
+    }
+    return engine === "pyhanko" ? signPyhanko(merged, avail.python) : signNode(merged);
+}
+//# sourceMappingURL=sign.js.map

package/dist/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB;IAC7C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAgB;QAC1B,GAAG,IAAI;QACP,GAAG,EAAE,IAAI,CAAC,GAAG,IAAK,GAAG,CAAC,GAAc;QACpC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU;QAC7C,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc;QACzD,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE;QACnC,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;QACtC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;KAClC,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAE5F,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;IAErC,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACvH,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,yBAAyB;IACxE,CAAC;IAED,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/F,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,79 @@
+/**
+ * @mostajs/pdf-sign — types publics.
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+/** Métadonnées de la signature (motif, lieu, signataire). */
+export interface SignMeta {
+    reason?: string;
+    location?: string;
+    name?: string;
+    contact?: string;
+}
+/** Position du cachet de signature visible. Boîte en points PDF (origine bas-gauche). */
+export interface SignField {
+    name?: string;
+    /** Index de page 0-based (0 = page 1). */
+    page?: number;
+    /** [x1, y1, x2, y2] en points (A4 = 595×842). */
+    box?: [number, number, number, number];
+    /** Image de fond du cachet visible (chemin ; logo/tampon derrière le texte). Moteur pyhanko. */
+    stampImage?: string;
+}
+/** Permissions restrictives (chiffrement AES-256). Requiert le moteur pyhanko. */
+export interface SignPermissions {
+    extract?: boolean;
+    modifyAnnotation?: boolean;
+    modifyAssembly?: boolean;
+    modifyOther?: boolean;
+    printLowres?: boolean;
+    printHighres?: boolean;
+    accessibility?: boolean;
+}
+export type SignEngine = "auto" | "node" | "pyhanko";
+export interface SignOptions {
+    /** PDF source : chemin ou octets. */
+    input: string | Uint8Array;
+    /** Chemin de sortie ; si absent, les octets signés sont renvoyés. */
+    output?: string;
+    /** Certificat PKCS#12 : chemin ou octets. */
+    p12: string | Uint8Array;
+    passphrase?: string;
+    passphraseFile?: string;
+    meta?: SignMeta;
+    field?: SignField;
+    /** Restrictions d'édition. `false`/absent = aucune (le cœur Node suffit) ; objet = PAdES pyhanko. */
+    permissions?: SignPermissions | false;
+    /** `auto` (défaut) = pyhanko si dispo sinon Node ; `node` = PKCS#7 ; `pyhanko` = PAdES. */
+    engine?: SignEngine;
+}
+export interface SignResult {
+    output?: string;
+    bytes?: Uint8Array;
+    engine: "node" | "pyhanko";
+}
+export interface VerifyOptions {
+    input: string;
+    /** Certificat de confiance (PEM) pour la validation pyhanko. */
+    trustPem?: string;
+    engine?: SignEngine;
+}
+export interface SignatureInfo {
+    field?: string;
+    intact?: boolean;
+    valid?: boolean;
+    trusted?: boolean;
+    signer?: string;
+}
+export interface VerifyResult {
+    signed: boolean;
+    signatures: SignatureInfo[];
+    engine: "pyhanko" | "node";
+}
+export interface EngineAvailability {
+    node: boolean;
+    pyhanko: boolean;
+    python?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,yFAAyF;AACzF,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3B,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qGAAqG;IACrG,WAAW,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IACtC,2FAA2F;IAC3F,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/types.js

@@ -0,0 +1,8 @@
+/**
+ * @mostajs/pdf-sign — types publics.
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/verify.d.ts

@@ -0,0 +1,3 @@
+import type { VerifyOptions, VerifyResult } from "./types.js";
+export declare function verifyPdf(opts: VerifyOptions): VerifyResult;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI9D,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CAsB3D"}

package/dist/verify.js

@@ -0,0 +1,36 @@
+/**
+ * @mostajs/pdf-sign — vérification de signature.
+ *
+ * pyhanko (validation cryptographique complète) si disponible ; sinon détection Node
+ * basique (présence d'un dictionnaire de signature).
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { detectEngines, SIGN_PY } from "./engines.js";
+import { loadPdfSignConfig } from "./config.js";
+export function verifyPdf(opts) {
+    const cfg = loadPdfSignConfig();
+    const avail = detectEngines(cfg.python);
+    const trust = opts.trustPem ?? cfg.trustPem;
+    const want = opts.engine ?? cfg.engine;
+    if (avail.pyhanko && want !== "node") {
+        try {
+            const args = trust ? [SIGN_PY, "verify", opts.input, trust] : [SIGN_PY, "verify", opts.input];
+            const out = execFileSync(avail.python, args, { encoding: "utf-8" });
+            const line = out.trim().split("\n").pop() ?? "{}";
+            const parsed = JSON.parse(line);
+            return { signed: !!parsed.signed, signatures: parsed.signatures ?? [], engine: "pyhanko" };
+        }
+        catch {
+            /* repli sur la détection Node */
+        }
+    }
+    // Détection Node basique : présence d'un /ByteRange + dictionnaire de signature.
+    const s = readFileSync(opts.input).toString("latin1");
+    const signed = s.includes("/ByteRange") && /\/Type\s*\/Sig|adbe\.pkcs7|ETSI\.CAdES/.test(s);
+    return { signed, signatures: signed ? [{ intact: undefined, valid: undefined }] : [], engine: "node" };
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC3C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;IAEvC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9F,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,MAAgB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzG,CAAC"}

package/examples/sign-basic.mjs

@@ -0,0 +1,28 @@
+/**
+ * Exemple — signature de base (moteur auto) + vérification.
+ *
+ * Usage : node examples/sign-basic.mjs <in.pdf> <cert.p12> <passphrase> [out.pdf]
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import { signPdf, verifyPdf, detectEngines } from "../dist/index.js";
+
+const [input, p12, passphrase, output = "signe.pdf"] = process.argv.slice(2);
+if (!input || !p12) {
+  console.error("Usage : node examples/sign-basic.mjs <in.pdf> <cert.p12> <passphrase> [out.pdf]");
+  process.exit(1);
+}
+
+console.log("Moteurs :", detectEngines());
+
+const res = await signPdf({
+  input,
+  output,
+  p12,
+  passphrase,
+  meta: { reason: "Compte rendu d'hospitalisation", name: "Dr H. Madani", location: "Alger, DZ" },
+});
+console.log(`Signé (${res.engine}) → ${res.output}`);
+
+console.log("Vérification :", JSON.stringify(verifyPdf({ input: output }), null, 2));

package/examples/sign-restricted.mjs

@@ -0,0 +1,33 @@
+/**
+ * Exemple — signature PAdES + permissions restrictives (chiffrement AES-256).
+ * Exige le moteur pyhanko : bash python/setup-venv.sh puis exporter PDF_SIGN_PYTHON.
+ *
+ * Usage : node examples/sign-restricted.mjs <in.pdf> <cert.p12> <passphrase> [out.pdf]
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import { signPdf, detectEngines } from "../dist/index.js";
+
+const [input, p12, passphrase, output = "signe-restreint.pdf"] = process.argv.slice(2);
+if (!input || !p12) {
+  console.error("Usage : node examples/sign-restricted.mjs <in.pdf> <cert.p12> <passphrase> [out.pdf]");
+  process.exit(1);
+}
+
+const avail = detectEngines();
+if (!avail.pyhanko) {
+  console.error("Moteur pyhanko indisponible — lancer python/setup-venv.sh et exporter PDF_SIGN_PYTHON.");
+  process.exit(1);
+}
+
+const res = await signPdf({
+  input,
+  output,
+  p12,
+  passphrase,
+  engine: "pyhanko",
+  permissions: { extract: false, modifyAnnotation: false, modifyOther: false, printHighres: true },
+  meta: { reason: "Facture CNAS — valeur probante", name: "Établissement", location: "Alger, DZ" },
+});
+console.log(`Signé + restreint (${res.engine}) → ${res.output}`);

package/examples/sign-stamped.mjs

@@ -0,0 +1,28 @@
+/**
+ * Exemple — cachet visible « image de fond + texte » (logo/tampon) + PAdES.
+ * Exige le moteur pyhanko (bash python/setup-venv.sh, PDF_SIGN_PYTHON).
+ *
+ * Usage : node examples/sign-stamped.mjs <in.pdf> <cert.p12> <passphrase> <logo.png> [out.pdf]
+ *
+ * @author Dr Hamid MADANI <drmdh@msn.com>
+ * @license AGPL-3.0-or-later
+ */
+import { signPdf, verifyPdf, detectEngines } from "../dist/index.js";
+
+const [input, p12, passphrase, logo, output = "signe-cachet.pdf"] = process.argv.slice(2);
+if (!input || !p12 || !logo) {
+  console.error("Usage : node examples/sign-stamped.mjs <in.pdf> <cert.p12> <passphrase> <logo.png> [out.pdf]");
+  process.exit(1);
+}
+if (!detectEngines().pyhanko) {
+  console.error("Moteur pyhanko indisponible — lancer python/setup-venv.sh et exporter PDF_SIGN_PYTHON.");
+  process.exit(1);
+}
+
+const res = await signPdf({
+  input, output, p12, passphrase, engine: "pyhanko", permissions: {},
+  meta: { reason: "Compte rendu d'hospitalisation", name: "Dr Hamid MADANI", location: "Alger, DZ" },
+  field: { page: 1, box: [320, 40, 575, 140], stampImage: logo }, // cachet image + texte, bas-droite p.2
+});
+console.log(`Signé avec cachet image (${res.engine}) → ${res.output}`);
+console.log("Vérification :", JSON.stringify(verifyPdf({ input: output }), null, 2));

package/llms.txt

@@ -0,0 +1,57 @@
+# @mostajs/pdf-sign — fiche LLM
+> Signature numérique de PDF, moteur HYBRIDE : cœur Node (PKCS#7 détaché via @signpdf, zéro Python) + bascule pyhanko (PAdES visible + permissions AES-256) quand un venv est disponible. Config 100 % `.env`, CLI + API. Portage générique du pipeline pyhanko+pikepdf éprouvé. IMPLÉMENTÉ 0.1.0.
+
+- Version: 0.1.0 · Licence: AGPL-3.0-or-later · Auteur: Dr Hamid MADANI <drmdh@msn.com>
+- Chemin: mostajs/mosta-pdf-sign-stack/mosta-pdf-sign · UI: ../mosta-pdf-sign-ui
+
+## RÔLE
+Le mécanisme de scellement probant d'UN PDF (signer + vérifier), pas l'orchestration métier.
+GÉNÉRIQUE : ne connaît aucun domaine. La sémantique (quel document, quel signataire, quelle
+valeur légale) est portée par l'appelant via options/`.env`.
+
+## POURQUOI (SIH & documents officiels)
+Valeur probante médico-légale exigée par l'interopérabilité (chap. 11) et la sécurité (chap. 12) :
+- cliniques : CRH, CRO, comptes rendus d'imagerie/biologie signés par le praticien ;
+- administratifs : certificats de séjour, ordonnances, dossiers de sortie ;
+- financiers/CNAS-CASNOS : factures, bordereaux de remboursement, prises en charge.
+La signature PAdES + permissions AES-256 garantit intégrité, authenticité et non-répudiation.
+
+## DEUX MOTEURS
+- **node** (défaut si pas de venv) : PKCS#7 détaché, cachet invisible, aucune dépendance Python.
+  NE gère PAS permissions/chiffrement/PAdES.
+- **pyhanko** (si venv) : PAdES visible + permissions restrictives (chiffrement AES-256, R=6) via le
+  script Python embarqué `python/sign_with_perms.py`. Pipeline : pikepdf chiffre → IncrementalPdfFileWriter
+  (writer.encrypt(owner)) → append_signature_field → PdfSigner PAdES. Préserve chiffrement ET signature.
+- **auto** : pyhanko si dispo, sinon node.
+
+## EXPORTS ("@mostajs/pdf-sign")
+- signPdf(opts): Promise<SignResult>   — fusionne opts + `.env`, dispatch node/pyhanko
+- verifyPdf(opts): VerifyResult         — validation pyhanko complète si dispo, sinon détection Node (/ByteRange)
+- detectEngines(python?): EngineAvailability   — { node:true, pyhanko:bool, python }
+- resolvePython / pyhankoAvailable
+- loadPdfSignConfig(): PdfSignConfig     — lecture `.env` via @mostajs/config
+- types SignOptions/SignResult/SignMeta/SignField/SignPermissions/SignEngine/Verify*
+
+## CONFIG (.env — via @mostajs/config, rien en dur)
+PDF_SIGN_P12 / PDF_SIGN_PASSPHRASE / PDF_SIGN_PASSPHRASE_FILE
+PDF_SIGN_ENGINE (auto|node|pyhanko) · PDF_SIGN_PYTHON (bin du venv)
+PDF_SIGN_REASON / _LOCATION / _NAME / _CONTACT (métadonnées du cachet)
+PDF_SIGN_FIELD_PAGE / PDF_SIGN_FIELD_BOX ("x1,y1,x2,y2") · PDF_SIGN_STAMP_IMAGE (logo du cachet visible, pyhanko) · PDF_SIGN_RESTRICT (bool → permissions)
+PDF_SIGN_TRUST_PEM (certificat de confiance pour la vérification)
+
+## CLI
+mosta-pdf-sign sign <in.pdf> [out.pdf] --p12 c.p12 --pass s [--engine …] [--restrict] [--reason …]
+mosta-pdf-sign verify <pdf> [--trust cert.pem] [--engine …]
+mosta-pdf-sign engines
+
+## MOTEUR pyhanko (optionnel)
+bash python/setup-venv.sh  → .venv local → exporter PDF_SIGN_PYTHON=…/.venv/bin/python
+requiert pyhanko>=0.25, pikepdf>=8.
+
+## PIÈGES
+- Le cœur Node lève si `permissions` est demandé : le PAdES/chiffrement EXIGE pyhanko.
+- `engine:'pyhanko'` sans venv → erreur explicite (lancer setup-venv.sh).
+- p12 obligatoire (opts.p12 ou PDF_SIGN_P12) sinon throw.
+- box en points PDF, origine bas-gauche (A4 = 595×842) ; défaut cachet bas-droite [320,40,575,140].
+- field.stampImage / PDF_SIGN_STAMP_IMAGE : cachet visible « image de fond + texte » (pyhanko stamp.TextStampStyle, opacité 0.35). Ignoré par le cœur Node.
+- La passphrase peut passer par fichier (PASSPHRASE_FILE) pour ne jamais transiter en argv (pyhanko).

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@mostajs/pdf-sign",
+  "version": "0.1.0",
+  "description": "Signature numérique de PDF pour @mostajs — moteur HYBRIDE : cœur Node (PKCS#7 via @signpdf) + bascule pyhanko (PAdES + permissions AES-256) si disponible. Config .env, CLI, API. Réutilise le pipeline éprouvé pyhanko+pikepdf.",
+  "author": "Dr Hamid MADANI <drmdh@msn.com>",
+  "license": "AGPL-3.0-or-later",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "mosta-pdf-sign": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "python/*.py",
+    "python/*.txt",
+    "python/*.sh",
+    "examples/*.mjs",
+    "README.md",
+    "llms.txt",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "bash test-scripts/run-tests.sh"
+  },
+  "keywords": [
+    "pdf",
+    "signature",
+    "pades",
+    "pkcs7",
+    "pkcs12",
+    "pyhanko",
+    "signpdf",
+    "sign",
+    "mostajs"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@mostajs/config": "^1.1.0",
+    "@signpdf/signpdf": "^3.2.4",
+    "@signpdf/signer-p12": "^3.2.4",
+    "@signpdf/placeholder-plain": "^3.2.4",
+    "pdf-lib": "^1.17.1"
+  },
+  "devDependencies": {
+    "@mostajs/mjs-unit": "^0.4.1",
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

package/python/requirements.txt

@@ -0,0 +1,3 @@
+# @mostajs/pdf-sign — dépendances du moteur pyhanko (PAdES + permissions).
+pyhanko>=0.25
+pikepdf>=8

package/python/setup-venv.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# @mostajs/pdf-sign — crée le venv Python du moteur pyhanko (optionnel : PAdES + permissions).
+# @author Dr Hamid MADANI <drmdh@msn.com> · AGPL-3.0-or-later
+set -euo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+python3 -m venv "$HERE/.venv"
+"$HERE/.venv/bin/pip" install --upgrade pip >/dev/null
+"$HERE/.venv/bin/pip" install -r "$HERE/requirements.txt"
+echo "OK — venv pyhanko prêt : $HERE/.venv (exporter PDF_SIGN_PYTHON=$HERE/.venv/bin/python)"

package/python/sign_with_perms.py

@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+"""sign_with_perms.py — signature PAdES + permissions restrictives (pyhanko + pikepdf).
+
+Version paramétrée (config JSON) du pipeline éprouvé : applique éventuellement des
+permissions PDF restrictives (chiffrement AES-256) PUIS signe en PAdES visible, en
+incremental update sur le PDF chiffré — préservant l'authentification du chiffrement
+ET la validité cryptographique de la signature.
+
+Usage :
+  sign_with_perms.py sign   INPUT.pdf OUTPUT.pdf CERT.p12 PASSFILE CONFIG.json
+  sign_with_perms.py verify PDF CERT.pem
+
+Le moteur Node (@mostajs/pdf-sign) écrit CONFIG.json puis appelle ce script.
+
+@author Dr Hamid MADANI <drmdh@msn.com>
+@license AGPL-3.0-or-later
+"""
+import sys
+import io
+import json
+import secrets
+import string
+
+
+def do_sign(inp, outp, p12_path, p12_pass_file, config_path):
+    import pikepdf
+    from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
+    from pyhanko.sign import signers, fields, PdfSignatureMetadata
+    from pyhanko.sign.fields import SigFieldSpec
+
+    with open(p12_pass_file, "rb") as f:
+        p12_pass = f.read().strip()
+    with open(config_path, "r", encoding="utf-8") as f:
+        cfg = json.load(f)
+
+    meta_cfg = cfg.get("meta", {})
+    field_cfg = cfg.get("field", {})
+    perms_cfg = cfg.get("permissions")  # None => pas de chiffrement/restriction
+
+    src_buf = inp
+    # --- 1. permissions + chiffrement (optionnel) via pikepdf, en mémoire ---
+    owner_pwd = None
+    if perms_cfg is not None:
+        print("-- 1/3 permissions (chiffrement AES-256) --", flush=True)
+        owner_pwd = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(40))
+        perms = pikepdf.Permissions(
+            accessibility=perms_cfg.get("accessibility", True),
+            extract=perms_cfg.get("extract", False),
+            modify_annotation=perms_cfg.get("modify_annotation", False),
+            modify_assembly=perms_cfg.get("modify_assembly", False),
+            modify_form=True,  # requis pour signer après chiffrement
+            modify_other=perms_cfg.get("modify_other", False),
+            print_lowres=perms_cfg.get("print_lowres", True),
+            print_highres=perms_cfg.get("print_highres", True),
+        )
+        encryption = pikepdf.Encryption(user="", owner=owner_pwd, R=6, allow=perms)
+        buf = io.BytesIO()
+        with pikepdf.open(inp) as pdf:
+            pdf.save(buf, encryption=encryption)
+        buf.seek(0)
+        src_buf = buf
+
+    # --- 2. champ de signature ---
+    print("-- 2/3 champ de signature --", flush=True)
+    writer = IncrementalPdfFileWriter(src_buf if isinstance(src_buf, io.BytesIO) else open(src_buf, "rb"))
+    if owner_pwd is not None:
+        writer.encrypt(owner_pwd)
+
+    field_name = field_cfg.get("name", "Signature1")
+    box = tuple(field_cfg.get("box", [320, 40, 575, 140]))
+    on_page = field_cfg.get("page", 0)
+    fields.append_signature_field(
+        writer,
+        sig_field_spec=SigFieldSpec(sig_field_name=field_name, on_page=on_page, box=box),
+    )
+
+    # --- 3. signature PAdES ---
+    print("-- 3/3 signature PAdES --", flush=True)
+    signer = signers.SimpleSigner.load_pkcs12(pfx_file=p12_path, passphrase=p12_pass)
+    meta = PdfSignatureMetadata(
+        field_name=field_name,
+        reason=meta_cfg.get("reason", "Authentification du document"),
+        location=meta_cfg.get("location", ""),
+        name=meta_cfg.get("name", ""),
+        contact_info=meta_cfg.get("contact", ""),
+        subfilter=fields.SigSeedSubFilter.PADES,
+    )
+
+    # Apparence du cachet visible : image de fond (logo/tampon) + texte, si une image est fournie.
+    stamp_style = _build_stamp_style(field_cfg.get("stamp_image"), meta_cfg)
+
+    with open(outp, "wb") as out_f:
+        signers.PdfSigner(signature_meta=meta, signer=signer, stamp_style=stamp_style).sign_pdf(writer, output=out_f)
+    print(f"OK -- PDF signé : {outp}", flush=True)
+
+
+def _build_stamp_style(stamp_image, meta_cfg):
+    """Style de cachet visible « image de fond + texte » (ou None → texte par défaut de pyhanko)."""
+    if not stamp_image:
+        return None
+    from pyhanko import stamp
+    from pyhanko.pdf_utils import images
+
+    lines = [x for x in (meta_cfg.get("name"), meta_cfg.get("reason"), meta_cfg.get("location")) if x]
+    # %(ts)s est substitué par pyhanko (horodatage) ; le reste est du texte littéral.
+    text = ("\n".join(lines) + "\n" if lines else "") + "Signé le %(ts)s"
+    return stamp.TextStampStyle(
+        stamp_text=text,
+        background=images.PdfImage(stamp_image),
+        background_opacity=0.35,
+    )
+
+
+def _cert_name(cert):
+    """Nom lisible du signataire (sujet du certificat) plutôt que le repr brut."""
+    try:
+        return cert.subject.human_friendly
+    except Exception:
+        return str(cert) if cert else ""
+
+
+def do_verify(pdf_path, cert_pem):
+    import logging
+    # Silence les logs internes (tracebacks de chaîne de confiance) : on renvoie le verdict en JSON.
+    for name in ("pyhanko", "pyhanko_certvalidator"):
+        logging.getLogger(name).setLevel(logging.CRITICAL)
+
+    from pyhanko.pdf_utils.reader import PdfFileReader
+    from pyhanko.sign.validation import validate_pdf_signature
+    from pyhanko_certvalidator import ValidationContext
+    from pyhanko.keys import load_cert_from_pemder
+
+    vc = None
+    try:
+        trust = load_cert_from_pemder(cert_pem) if cert_pem else None
+        vc = ValidationContext(trust_roots=[trust]) if trust else ValidationContext(allow_fetching=False)
+    except Exception:
+        vc = ValidationContext(allow_fetching=False)
+
+    with open(pdf_path, "rb") as f:
+        r = PdfFileReader(f)
+        # PDF chiffré (permissions restrictives) : s'authentifier avec le mot de passe
+        # utilisateur vide (lecture libre) avant d'énumérer les signatures.
+        if getattr(r, "encrypted", False):
+            try:
+                r.decrypt("")
+            except Exception:
+                pass
+        sigs = r.embedded_signatures
+        if not sigs:
+            print(json.dumps({"signed": False, "signatures": []}))
+            return
+        out = []
+        for s in sigs:
+            status = validate_pdf_signature(s, vc)
+            out.append({
+                "field": s.field_name,
+                "intact": bool(status.intact),
+                "valid": bool(status.valid),
+                "trusted": bool(getattr(status, "trusted", False)),
+                "signer": _cert_name(getattr(status, "signing_cert", None)),
+            })
+        print(json.dumps({"signed": True, "signatures": out}))
+
+
+if __name__ == "__main__":
+    if len(sys.argv) >= 2 and sys.argv[1] == "sign" and len(sys.argv) == 7:
+        do_sign(sys.argv[2], sys.argv[3], sys.argv[4], sys.argv[5], sys.argv[6])
+    elif len(sys.argv) >= 2 and sys.argv[1] == "verify" and len(sys.argv) >= 3:
+        do_verify(sys.argv[2], sys.argv[3] if len(sys.argv) > 3 else None)
+    else:
+        print(__doc__)
+        sys.exit(1)