@stackforge-eu/factur-x 1.0.7 → 1.0.8

package/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.0.8] — 2026-05-27
+
+- **PDF trailer was missing the `/ID` entry required by PDF/A-3.** ISO 19005-3
+  (and PDF 1.7 §14.4) require the trailer dictionary to carry an `/ID` array of
+  two byte strings: the first immutable identifier of the original document,
+  the second updated on every modification. `pdf-lib` initializes
+  `trailerInfo = {}` and never writes one on save, so veraPDF and the FNFE-MPE
+  Factur-X profile rejected every PDF this library produced as non-conformant.
+  Added `ensureIdTrailer` in `src/core/embed.ts` which runs after the first
+  `pdfDoc.save()` when `addPdfA3Metadata` is on: it computes an MD5 over the
+  serialized bytes (per PDF 1.7 §14.4 — uniqueness, not cryptographic strength,
+  is what matters), preserves any pre-existing first identifier, and writes the
+  pair before re-saving. Regression tests added in `tests/embed.test.ts`
+  covering both the no-existing-trailer and existing-trailer paths (thanks
+  @sco-indy, #3).
+
 ## [1.0.7] — 2026-05-27
 
 - **`fx:ConformanceLevel` in the XMP metadata used the raw `Profile` enum
@@ -113,6 +129,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - Deno compatibility test suite
 
 [Unreleased]: https://github.com/StackForge-EU/factur-x/commits/main
+[1.0.8]: https://github.com/StackForge-EU/factur-x/compare/v1.0.7...v1.0.8
 [1.0.7]: https://github.com/StackForge-EU/factur-x/compare/v1.0.6...v1.0.7
 [1.0.6]: https://github.com/StackForge-EU/factur-x/compare/v1.0.5...v1.0.6
 [1.0.5]: https://github.com/StackForge-EU/factur-x/compare/v1.0.4...v1.0.5

package/dist/index.cjs

@@ -4,6 +4,7 @@ var fs = require('fs');
 var path = require('path');
 var url = require('url');
 var console = require('console');
+var crypto = require('crypto');
 var pdfLib = require('pdf-lib');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -1122,6 +1123,17 @@ function resolveXmpConformanceLevel(profile, flavor) {
   if (flavor === "xrechnung" /* XRECHNUNG */) return "XRECHNUNG";
   return XMP_CONFORMANCE_LEVEL[profile];
 }
+function ensureIdTrailer(pdfDoc, pdfContentBytes) {
+  const existingIdTrailer = pdfDoc.context.trailerInfo.ID;
+  const currentContentHash = pdfLib.PDFHexString.of(crypto.createHash("md5").update(pdfContentBytes).digest("hex"));
+  const hasValidIdTrailer = existingIdTrailer instanceof pdfLib.PDFArray && existingIdTrailer.size() === 2;
+  if (hasValidIdTrailer) {
+    const existingFirstId = existingIdTrailer.lookup(0);
+    pdfDoc.context.trailerInfo.ID = pdfDoc.context.obj([existingFirstId, currentContentHash]);
+  } else {
+    pdfDoc.context.trailerInfo.ID = pdfDoc.context.obj([currentContentHash, currentContentHash]);
+  }
+}
 function ensureOutputIntent(pdfDoc, iccBytes, identifier) {
   const existing = pdfDoc.catalog.lookup(pdfLib.PDFName.of("OutputIntents"));
   if (existing instanceof pdfLib.PDFArray && existing.size() > 0) return;
@@ -1397,9 +1409,13 @@ async function embedFacturX(options) {
     const metadataRef = pdfDoc.context.register(metadataStream);
     pdfDoc.catalog.set(pdfLib.PDFName.of("Metadata"), metadataRef);
   }
-  const resultPdf = await pdfDoc.save();
+  let pdfContentBytes = await pdfDoc.save();
+  if (addPdfA3Metadata) {
+    ensureIdTrailer(pdfDoc, pdfContentBytes);
+    pdfContentBytes = await pdfDoc.save();
+  }
   return {
-    pdf: resultPdf,
+    pdf: pdfContentBytes,
     xml,
     ...validation ? { validation } : {},
     ...xsdValidation ? { xsdValidation } : {}

package/dist/index.js

@@ -2,7 +2,8 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
 import console from 'console';
-import { AFRelationship, PDFDocument, PDFName, PDFArray, PDFDict, PDFStream, PDFRawStream, decodePDFRawStream, PDFString, PDFRef, PDFHexString } from 'pdf-lib';
+import { createHash } from 'crypto';
+import { AFRelationship, PDFDocument, PDFName, PDFArray, PDFDict, PDFStream, PDFRawStream, decodePDFRawStream, PDFString, PDFHexString, PDFRef } from 'pdf-lib';
 
 // src/types/input.ts
 var DocumentTypeCode = /* @__PURE__ */ ((DocumentTypeCode2) => {
@@ -1092,6 +1093,17 @@ function resolveXmpConformanceLevel(profile, flavor) {
   if (flavor === "xrechnung" /* XRECHNUNG */) return "XRECHNUNG";
   return XMP_CONFORMANCE_LEVEL[profile];
 }
+function ensureIdTrailer(pdfDoc, pdfContentBytes) {
+  const existingIdTrailer = pdfDoc.context.trailerInfo.ID;
+  const currentContentHash = PDFHexString.of(createHash("md5").update(pdfContentBytes).digest("hex"));
+  const hasValidIdTrailer = existingIdTrailer instanceof PDFArray && existingIdTrailer.size() === 2;
+  if (hasValidIdTrailer) {
+    const existingFirstId = existingIdTrailer.lookup(0);
+    pdfDoc.context.trailerInfo.ID = pdfDoc.context.obj([existingFirstId, currentContentHash]);
+  } else {
+    pdfDoc.context.trailerInfo.ID = pdfDoc.context.obj([currentContentHash, currentContentHash]);
+  }
+}
 function ensureOutputIntent(pdfDoc, iccBytes, identifier) {
   const existing = pdfDoc.catalog.lookup(PDFName.of("OutputIntents"));
   if (existing instanceof PDFArray && existing.size() > 0) return;
@@ -1367,9 +1379,13 @@ async function embedFacturX(options) {
     const metadataRef = pdfDoc.context.register(metadataStream);
     pdfDoc.catalog.set(PDFName.of("Metadata"), metadataRef);
   }
-  const resultPdf = await pdfDoc.save();
+  let pdfContentBytes = await pdfDoc.save();
+  if (addPdfA3Metadata) {
+    ensureIdTrailer(pdfDoc, pdfContentBytes);
+    pdfContentBytes = await pdfDoc.save();
+  }
   return {
-    pdf: resultPdf,
+    pdf: pdfContentBytes,
     xml,
     ...validation ? { validation } : {},
     ...xsdValidation ? { xsdValidation } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackforge-eu/factur-x",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "type": "module",
   "description": "Embed Factur-X, ZUGFeRD, and XRechnung structured invoice XML into PDF/A-3 documents",
   "keywords": [