modern-pdf-lib 0.33.0 → 0.34.0

package/dist/{pdfDocument-Cgkkk8F8.mjs → pdfDocument-EcHxUnR6.mjs}

@@ -21926,7 +21926,200 @@ function findSignatures(pdfBytes) {
 	return results;
 }
 //#endregion
+//#region src/signature/cadesAttributes.ts
+/**
+* @module signature/cadesAttributes
+*
+* CAdES-BES / PAdES-B-B baseline signed attributes.
+*
+* Implements the ESS `signing-certificate-v2` attribute that binds a
+* signature to the exact signer certificate that produced it, defeating
+* certificate-substitution attacks.  This is the mandatory signed
+* attribute for the CAdES-BES and PAdES-B-B (a.k.a. PAdES Baseline)
+* conformance levels.
+*
+* Structure (RFC 5035 §3, "ESS Update: Adding CertID Algorithm Agility"):
+* ```
+* id-aa-signingCertificateV2 OBJECT IDENTIFIER ::= { iso(1)
+*     member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
+*     smime(16) id-aa(2) 47 }                       -- 1.2.840.113549.1.9.16.2.47
+*
+* Attribute ::= SEQUENCE {
+*   attrType   OBJECT IDENTIFIER,                   -- id-aa-signingCertificateV2
+*   attrValues SET OF SigningCertificateV2 }
+*
+* SigningCertificateV2 ::= SEQUENCE {
+*   certs    SEQUENCE OF ESSCertIDv2,
+*   policies SEQUENCE OF PolicyInformation OPTIONAL }  -- omitted here
+*
+* ESSCertIDv2 ::= SEQUENCE {
+*   hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256},
+*   certHash      Hash,                              -- OCTET STRING
+*   issuerSerial  IssuerSerial OPTIONAL }            -- omitted here
+*
+* Hash ::= OCTET STRING
+* ```
+*
+* Because `hashAlgorithm` carries `DEFAULT {algorithm id-sha256}`, DER
+* (X.690 §11.5) requires the field to be **omitted** when the hash is
+* SHA-256, and **present** for any other algorithm (e.g. SHA-384,
+* SHA-512).  `certHash` is the digest of the WHOLE DER certificate.
+*
+* References:
+* - RFC 5035 (Enhanced Security Services (ESS) Update — signing-certificate-v2)
+* - ETSI EN 319 122-1 (CAdES baseline) — requires id-aa-signingCertificateV2
+* - ETSI EN 319 142-1 (PAdES baseline) — PAdES-B-B uses the same attribute
+*
+* Every OID and ASN.1 element here was verified against RFC 5035.
+*
+* @packageDocumentation
+*/
+/** id-aa-signingCertificateV2 — RFC 5035 §3. */
+const ID_AA_SIGNING_CERTIFICATE_V2 = "1.2.840.113549.1.9.16.2.47";
+/** Hash algorithm OIDs (NIST CSOR; same values used throughout pkcs7.ts). */
+const SHA256_OID = "2.16.840.1.101.3.4.2.1";
+const SHA384_OID = "2.16.840.1.101.3.4.2.2";
+const SHA512_OID = "2.16.840.1.101.3.4.2.3";
+/** DER literal for an explicit NULL value (tag 0x05, length 0). */
+const DER_NULL = new Uint8Array([5, 0]);
+/**
+* Encode an AlgorithmIdentifier SEQUENCE for a SHA-2 hash with NULL
+* parameters: `SEQUENCE { OID, NULL }`.
+*
+* RFC 5035's ESSCertIDv2 uses the same AlgorithmIdentifier as the rest
+* of the CMS structure; SHA-2 digest algorithms carry NULL parameters
+* (RFC 5754 permits either NULL or absent — we emit NULL to match the
+* digestAlgorithm encoding already used by pkcs7.ts).
+*/
+function encodeHashAlgorithmIdentifier(hashOid) {
+	return encodeSequence([encodeOID(hashOid), DER_NULL]);
+}
+/** Map a Web Crypto hash name to its OID. */
+function hashNameToOid(hash) {
+	switch (hash) {
+		case "SHA-256": return SHA256_OID;
+		case "SHA-384": return SHA384_OID;
+		case "SHA-512": return SHA512_OID;
+		default: throw new Error(`Unsupported hash algorithm: ${String(hash)}`);
+	}
+}
+/**
+* Build the ESS `signing-certificate-v2` signed attribute (RFC 5035).
+*
+* The returned bytes are a complete DER-encoded `Attribute` SEQUENCE
+* suitable for insertion into the CMS `SignedAttributes` SET.
+*
+* Encoding rules applied (verified against RFC 5035):
+* - `hashAlgorithm` is OMITTED when `hashAlgorithm === 'SHA-256'` (the
+*   `DEFAULT {algorithm id-sha256}`), and INCLUDED for SHA-384/SHA-512.
+* - `certHash` is `subtle.digest(hashAlgorithm, <whole DER cert>)`.
+* - `issuerSerial` and `policies` are OPTIONAL and omitted.
+*
+* @param certDer        The DER-encoded X.509 signer certificate.
+* @param hashAlgorithm  The digest used for `certHash`.
+* @returns              DER-encoded `Attribute` SEQUENCE.
+*/
+async function buildSigningCertificateV2Attribute(certDer, hashAlgorithm) {
+	const digestBuffer = await getSubtle().digest(hashAlgorithm, toBuffer(certDer));
+	const certHash = new Uint8Array(digestBuffer);
+	const essCertIdParts = [];
+	if (hashAlgorithm !== "SHA-256") essCertIdParts.push(encodeHashAlgorithmIdentifier(hashNameToOid(hashAlgorithm)));
+	essCertIdParts.push(encodeOctetString(certHash));
+	const signingCertificateV2 = encodeSequence([encodeSequence([encodeSequence(essCertIdParts)])]);
+	return encodeSequence([encodeOID(ID_AA_SIGNING_CERTIFICATE_V2), encodeSet([signingCertificateV2])]);
+}
+/**
+* Best-effort DER scan for the `signing-certificate-v2` attribute inside
+* an encoded `SignedAttributes` SET (or any SET/SEQUENCE OF Attribute).
+*
+* When found, the embedded `certHash` OCTET STRING is returned so callers
+* can compare it against the signer certificate's digest.
+*
+* This walks: SET -> Attribute SEQUENCE { OID, SET { SigningCertificateV2
+* SEQUENCE { certs SEQUENCE OF { ESSCertIDv2 SEQUENCE { [algId], certHash } } } } }.
+*
+* @param signedAttrsDer  DER bytes of a SET (or constructed container) of Attributes.
+* @returns               `{ present, certHash? }`.
+*/
+function extractSigningCertificateV2(signedAttrsDer) {
+	try {
+		const container = parseDerTlv(signedAttrsDer, 0);
+		for (const attr of container.children) {
+			if (attr.tag !== 48 || attr.children.length < 2) continue;
+			const oidNode = attr.children[0];
+			if (oidNode.tag !== 6) continue;
+			if (decodeOidBytes(oidNode.data) !== ID_AA_SIGNING_CERTIFICATE_V2) continue;
+			const signingCertV2 = attr.children[1].children[0];
+			if (!signingCertV2) return {
+				present: true,
+				certHash: void 0
+			};
+			const certsSeqOf = signingCertV2.children[0];
+			if (!certsSeqOf) return {
+				present: true,
+				certHash: void 0
+			};
+			const essCertId = certsSeqOf.children[0];
+			if (!essCertId) return {
+				present: true,
+				certHash: void 0
+			};
+			for (const child of essCertId.children) if (child.tag === 4) return {
+				present: true,
+				certHash: child.data
+			};
+			return {
+				present: true,
+				certHash: void 0
+			};
+		}
+	} catch {}
+	return {
+		present: false,
+		certHash: void 0
+	};
+}
+//#endregion
 //#region src/signature/pkcs7.ts
+/**
+* @module signature/pkcs7
+*
+* PKCS#7 / CMS SignedData structure builder for PDF digital signatures.
+*
+* Builds a minimal but valid PKCS#7 SignedData structure using pure
+* TypeScript ASN.1 DER encoding.  Uses the Web Crypto API for
+* RSASSA-PKCS1-v1_5 or ECDSA signing.
+*
+* Structure overview:
+* ```
+* ContentInfo {
+*   contentType: signedData (1.2.840.113549.1.7.2)
+*   content: SignedData {
+*     version: 1
+*     digestAlgorithms: { SHA-256 }
+*     encapContentInfo: { data (1.2.840.113549.1.7.1) }
+*     certificates: [0] IMPLICIT { certificate }
+*     signerInfos: {
+*       SignerInfo {
+*         version: 1
+*         issuerAndSerialNumber
+*         digestAlgorithm: SHA-256
+*         signedAttrs: { contentType, signingTime, messageDigest }
+*         signatureAlgorithm
+*         signature
+*       }
+*     }
+*   }
+* }
+* ```
+*
+* References:
+* - RFC 5652 (Cryptographic Message Syntax)
+* - RFC 3161 (Internet X.509 PKI Time-Stamp Protocol)
+* - PKCS#7 / CMS SignedData
+*
+* @packageDocumentation
+*/
 /** OID constants for ASN.1 structures. */
 const OID = {
 	signedData: "1.2.840.113549.1.7.2",
@@ -21938,6 +22131,8 @@ const OID = {
 	sha256WithRSA: "1.2.840.113549.1.1.11",
 	sha384WithRSA: "1.2.840.113549.1.1.12",
 	sha512WithRSA: "1.2.840.113549.1.1.13",
+	rsaPss: "1.2.840.113549.1.1.10",
+	mgf1: "1.2.840.113549.1.1.8",
 	ecPublicKey: "1.2.840.10045.2.1",
 	ecdsaWithSHA256: "1.2.840.10045.4.3.2",
 	ecdsaWithSHA384: "1.2.840.10045.4.3.3",
@@ -22188,6 +22383,52 @@ function encodeSignatureAlgorithm(keyAlgo, hashAlgo) {
 	throw new Error(`Unsupported key algorithm: ${keyAlgo}`);
 }
 /**
+* Encode the AlgorithmIdentifier for an RSASSA-PSS signature (RFC 4055 §3.1).
+*
+* ```
+* AlgorithmIdentifier ::= SEQUENCE {
+*   algorithm  id-RSASSA-PSS,                       -- 1.2.840.113549.1.1.10
+*   parameters RSASSA-PSS-params }
+*
+* RSASSA-PSS-params ::= SEQUENCE {
+*   hashAlgorithm    [0] HashAlgorithm    DEFAULT sha1Identifier,
+*   maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1Identifier,
+*   saltLength       [2] INTEGER          DEFAULT 20,
+*   trailerField     [3] INTEGER          DEFAULT 1 }
+* ```
+*
+* The `[0]`/`[1]`/`[2]` tags are EXPLICIT (the fields are tagged in the
+* ASN.1 module without `IMPLICIT`, and the CMS modules import EXPLICIT
+* tagging by default), so each wraps the full underlying TLV.  Per
+* RFC 4055, when the hash is SHA-256 the hashAlgorithm AlgorithmIdentifier
+* is `{ id-sha256, NULL }` and the maskGenAlgorithm is
+* `{ id-mgf1, { id-sha256, NULL } }`.  `trailerField` is the default (1)
+* and is omitted (RFC 4055 mandates generators omit it).
+*
+* Salt length equals the hash output length: 32 (SHA-256), 48 (SHA-384),
+* 64 (SHA-512).
+*/
+function encodeRsaPssSignatureAlgorithm(hashAlgo) {
+	const hashOid = HASH_OID_MAP[hashAlgo];
+	if (!hashOid) throw new Error(`Unsupported hash for RSA-PSS: ${hashAlgo}`);
+	const saltLength = PSS_SALT_LENGTH[hashAlgo];
+	if (saltLength === void 0) throw new Error(`Unsupported hash for RSA-PSS: ${hashAlgo}`);
+	const hashAlgId = encodeSequence([encodeOID(hashOid), encodeTlv(TAG.NULL, /* @__PURE__ */ new Uint8Array(0))]);
+	const mgfAlgId = encodeSequence([encodeOID(OID.mgf1), hashAlgId]);
+	const params = encodeSequence([
+		encodeContextTag(0, hashAlgId),
+		encodeContextTag(1, mgfAlgId),
+		encodeContextTag(2, encodeIntegerValue(saltLength))
+	]);
+	return encodeSequence([encodeOID(OID.rsaPss), params]);
+}
+/** PSS salt length (= hash output length in bytes) per hash algorithm. */
+const PSS_SALT_LENGTH = {
+	"SHA-256": 32,
+	"SHA-384": 48,
+	"SHA-512": 64
+};
+/**
 * Parse a single DER TLV from a byte array at the given offset.
 */
 function parseDerTlv(data, offset) {
@@ -22351,11 +22592,11 @@ function getSubtle() {
 /**
 * Import a PKCS#8 private key for signing.
 */
-async function importPrivateKey(pkcs8Der, keyAlgorithm, hashAlgorithm, namedCurve) {
+async function importPrivateKey(pkcs8Der, keyAlgorithm, hashAlgorithm, namedCurve, rsaScheme = "pkcs1v15") {
 	const subtle = getSubtle();
 	let algorithm;
 	if (keyAlgorithm === "RSA") algorithm = {
-		name: "RSASSA-PKCS1-v1_5",
+		name: rsaScheme === "pss" ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
 		hash: hashAlgorithm
 	};
 	else algorithm = {
@@ -22367,10 +22608,17 @@ async function importPrivateKey(pkcs8Der, keyAlgorithm, hashAlgorithm, namedCurv
 /**
 * Sign data using the imported private key.
 */
-async function signData(key, data, keyAlgorithm, hashAlgorithm) {
+async function signData(key, data, keyAlgorithm, hashAlgorithm, rsaScheme = "pkcs1v15") {
 	const subtle = getSubtle();
 	let algorithm;
-	if (keyAlgorithm === "RSA") algorithm = { name: "RSASSA-PKCS1-v1_5" };
+	if (keyAlgorithm === "RSA") if (rsaScheme === "pss") {
+		const saltLength = PSS_SALT_LENGTH[hashAlgorithm];
+		if (saltLength === void 0) throw new Error(`Unsupported hash for RSA-PSS: ${hashAlgorithm}`);
+		algorithm = {
+			name: "RSA-PSS",
+			saltLength
+		};
+	} else algorithm = { name: "RSASSA-PKCS1-v1_5" };
 	else algorithm = {
 		name: "ECDSA",
 		hash: hashAlgorithm
@@ -22394,11 +22642,12 @@ async function buildPkcs7Signature(dataHash, options) {
 	const hashAlgorithm = signerInfoOpts.hashAlgorithm;
 	const keyAlgo = detectKeyAlgorithm(signerInfoOpts.certificate);
 	const namedCurve = keyAlgo === "EC" ? detectNamedCurve(signerInfoOpts.certificate) : void 0;
+	const rsaScheme = keyAlgo === "RSA" && signerInfoOpts.signatureScheme === "pss" ? "pss" : "pkcs1v15";
 	const { issuerDer, serialDer } = extractIssuerAndSerial(signerInfoOpts.certificate);
-	const privateKey = await importPrivateKey(signerInfoOpts.privateKey, keyAlgo, hashAlgorithm, namedCurve);
-	const signedAttrs = buildSignedAttributes(dataHash, hashAlgorithm, options.signingDate ?? /* @__PURE__ */ new Date());
-	const signatureValue = await signData(privateKey, encodeSet(signedAttrs), keyAlgo, hashAlgorithm);
-	const signerInfoValue = buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgo, signedAttrs, keyAlgo === "EC" ? convertEcdsaToDer(signatureValue) : signatureValue);
+	const privateKey = await importPrivateKey(signerInfoOpts.privateKey, keyAlgo, hashAlgorithm, namedCurve, rsaScheme);
+	const signedAttrs = await buildSignedAttributes(dataHash, hashAlgorithm, options.signingDate ?? /* @__PURE__ */ new Date(), options.cades === true ? signerInfoOpts.certificate : void 0);
+	const signatureValue = await signData(privateKey, encodeSet(signedAttrs), keyAlgo, hashAlgorithm, rsaScheme);
+	const signerInfoValue = buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgo, signedAttrs, keyAlgo === "EC" ? convertEcdsaToDer(signatureValue) : signatureValue, rsaScheme);
 	const signedData = buildSignedData(hashAlgorithm, signerInfoOpts.certificate, signerInfoValue);
 	return encodeSequence([encodeOID(OID.signedData), encodeContextTag(0, signedData)]);
 }
@@ -22409,24 +22658,61 @@ async function buildPkcs7Signature(dataHash, options) {
 * 1. contentType (data)
 * 2. signingTime
 * 3. messageDigest (the hash of the PDF content)
-*/
-function buildSignedAttributes(dataHash, _hashAlgorithm, signingTime) {
-	return [
-		encodeSequence([encodeOID(OID.contentType), encodeSet([encodeOID(OID.data)])]),
-		encodeSequence([encodeOID(OID.signingTime), encodeSet([encodeUTCTime(signingTime)])]),
-		encodeSequence([encodeOID(OID.messageDigest), encodeSet([encodeOctetString(dataHash)])])
+*
+* When `cadesCertDer` is provided, the ESS `signing-certificate-v2`
+* attribute (RFC 5035) is added and the whole SET OF is re-sorted into
+* DER order (X.690 §11.6) so the resulting SignedAttributes encoding is
+* valid.  When omitted, the original three attributes are returned in
+* their original order so the output stays byte-identical to prior
+* versions.
+*/
+async function buildSignedAttributes(dataHash, _hashAlgorithm, signingTime, cadesCertDer) {
+	const contentTypeAttr = encodeSequence([encodeOID(OID.contentType), encodeSet([encodeOID(OID.data)])]);
+	const signingTimeAttr = encodeSequence([encodeOID(OID.signingTime), encodeSet([encodeUTCTime(signingTime)])]);
+	const messageDigestAttr = encodeSequence([encodeOID(OID.messageDigest), encodeSet([encodeOctetString(dataHash)])]);
+	if (cadesCertDer === void 0) return [
+		contentTypeAttr,
+		signingTimeAttr,
+		messageDigestAttr
 	];
+	return sortDerSetMembers([
+		contentTypeAttr,
+		signingTimeAttr,
+		messageDigestAttr,
+		await buildSigningCertificateV2Attribute(cadesCertDer, _hashAlgorithm)
+	]);
+}
+/**
+* Sort the members of a SET OF into DER canonical order (X.690 §11.6):
+* by ascending lexicographic comparison of their complete DER encodings,
+* padding the shorter encoding with conceptual trailing zero octets.
+*/
+function sortDerSetMembers(members) {
+	return [...members].sort(compareDerEncodings);
+}
+/**
+* Compare two DER encodings as unsigned octet strings, treating a
+* shorter array as if padded with trailing zero octets (X.690 §11.6).
+*/
+function compareDerEncodings(a, b) {
+	const len = Math.max(a.length, b.length);
+	for (let i = 0; i < len; i++) {
+		const av = a[i] ?? 0;
+		const bv = b[i] ?? 0;
+		if (av !== bv) return av - bv;
+	}
+	return 0;
 }
 /**
 * Build a SignerInfo SEQUENCE.
 */
-function buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgorithm, signedAttrs, signatureValue) {
+function buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgorithm, signedAttrs, signatureValue, rsaScheme = "pkcs1v15") {
 	return encodeSequence([
 		encodeIntegerValue(1),
 		encodeSequence([issuerDer, serialDer]),
 		encodeDigestAlgorithm(hashAlgorithm),
 		encodeContextTag(0, concat(...signedAttrs)),
-		encodeSignatureAlgorithm(keyAlgorithm, hashAlgorithm),
+		keyAlgorithm === "RSA" && rsaScheme === "pss" ? encodeRsaPssSignatureAlgorithm(hashAlgorithm) : encodeSignatureAlgorithm(keyAlgorithm, hashAlgorithm),
 		encodeOctetString(signatureValue)
 	]);
 }
@@ -22725,6 +23011,9 @@ function parsePkcs7Structure(pkcs7Bytes) {
 			signedAttrsRaw = encodeSet(signedAttrs);
 			idx++;
 		}
+		let signatureAlgorithmOid = "";
+		const sigAlgoNode = signerInfo.children[idx];
+		if (sigAlgoNode && sigAlgoNode.children.length > 0) signatureAlgorithmOid = decodeOidBytes(sigAlgoNode.children[0].data);
 		idx++;
 		const signatureNode = signerInfo.children[idx];
 		const signatureValue = signatureNode ? signatureNode.data : /* @__PURE__ */ new Uint8Array(0);
@@ -22733,7 +23022,8 @@ function parsePkcs7Structure(pkcs7Bytes) {
 			signedAttrs,
 			signedAttrsRaw,
 			signatureValue,
-			digestAlgorithm
+			digestAlgorithm,
+			signatureAlgorithmOid
 		};
 	} catch {
 		return null;
@@ -22881,6 +23171,23 @@ async function verifySignatures(pdfBytes) {
 		} catch {
 			certificateValid = false;
 		}
+		let cadesSigningCertPresent;
+		let cadesSigningCertHashValid;
+		try {
+			const ess = extractSigningCertificateV2(parsed.signedAttrsRaw);
+			cadesSigningCertPresent = ess.present;
+			if (ess.present && ess.certHash) {
+				const algo = {
+					32: "SHA-256",
+					48: "SHA-384",
+					64: "SHA-512"
+				}[ess.certHash.length];
+				if (algo) {
+					const digest = new Uint8Array(await getSubtle().digest(algo, toBuffer(parsed.certificate)));
+					cadesSigningCertHashValid = digest.length === ess.certHash.length && digest.every((b, i) => b === ess.certHash[i]);
+				}
+			}
+		} catch {}
 		results.push({
 			fieldName: fieldInfo.fieldName,
 			signedBy,
@@ -22888,7 +23195,9 @@ async function verifySignatures(pdfBytes) {
 			integrityValid,
 			certificateValid,
 			signingDate,
-			reason: fieldInfo.reason
+			reason: fieldInfo.reason,
+			cadesSigningCertPresent,
+			cadesSigningCertHashValid
 		});
 	}
 	return results;
@@ -22911,17 +23220,33 @@ async function verifySignature(pdfBytes, byteRange, signatureBytes, certificateB
 		if (!parsed) return false;
 		const subtle = getSubtle();
 		const keyAlgo = detectKeyAlgorithm(certificateBytes);
+		const isPss = parsed.signatureAlgorithmOid === "1.2.840.113549.1.1.10";
+		const PSS_SALT_LENGTH = {
+			"SHA-256": 32,
+			"SHA-384": 48,
+			"SHA-512": 64
+		};
 		const spki = extractSubjectPublicKeyInfo(certificateBytes);
 		let importAlgo;
 		let verifyAlgo;
 		let sigBytes = parsed.signatureValue;
-		if (keyAlgo === "RSA") {
+		if (keyAlgo === "RSA") if (isPss) {
+			importAlgo = {
+				name: "RSA-PSS",
+				hash: parsed.digestAlgorithm
+			};
+			verifyAlgo = {
+				name: "RSA-PSS",
+				saltLength: PSS_SALT_LENGTH[parsed.digestAlgorithm] ?? 32
+			};
+		} else {
 			importAlgo = {
 				name: "RSASSA-PKCS1-v1_5",
 				hash: parsed.digestAlgorithm
 			};
 			verifyAlgo = { name: "RSASSA-PKCS1-v1_5" };
-		} else {
+		}
+		else {
 			const namedCurve = detectNamedCurve(certificateBytes);
 			importAlgo = {
 				name: "ECDSA",
@@ -25659,6 +25984,6 @@ function createPdf() {
 	return new PdfDocument();
 }
 //#endregion
-export { PdfOutlineTree as $, deviceNColor as $n, setCharacterSpacing as $r, getRedactionMarks as $t, encodeUTCTime as A, endArtifact as An, curveToFinal as Ar, pngEmbed_exports as At, prepareForSigning as B, rotationMatrix as Bn, rectangle as Br, PageSizes as Bt, encodeInteger as C, pdfCatalog_exports as Cn, clip as Cr, parseTiffIfd as Ct, encodePrintableString as D, beginMarkedContentSequence as Dn, closeFillEvenOddAndStroke as Dr, detectImageFormat as Dt, encodeOctetString as E, beginMarkedContent as En, closeFillAndStroke as Er, isWebPLossless as Et, parseDerTlv as F, degreesToRadians as Fn, fillAndStroke as Fr, extractMetrics as Ft, isAccessible as G, translate as Gn, setLineWidth as Gr, encodeQrCode as Gt, mergePdfs as H, scale as Hn, setFlatness as Hr, wrapText as Ht, toBuffer as I, radians as In, fillEvenOdd as Ir, PdfStreamWriter as It, PdfStructureTree as J, cmyk as Jn, beginText as Jr, buildPatternObjects as Jt, summarizeIssues as K, applyFillColor as Kn, setMiterLimit as Kr, qrCodeToOperators as Kt, computeSignatureHash as L, radiansToDegrees as Ln, fillEvenOddAndStroke as Lr, PdfWriter as Lt, extractIssuerAndSerial as M, wrapInMarkedContent as Mn, ellipsePath as Mr, isTrueType as Mt, extractSubjectPublicKeyInfo as N, concatMatrix as Nn, endPath as Nr, EmbeddedFont as Nt, encodeSequence as O, beginMarkedContentWithProperties as On, closePath as Or, getImageFormatName as Ot, getSubtle as P, degrees as Pn, fill as Pr, fontSubset_exports as Pt, PdfOutlineItem as Q, componentsToColor as Qn, nextLine as Qr, applyRedactions as Qt, embedSignature as R, restoreState as Rn, lineTo as Rr, serializePdf as Rt, encodeContextTag as S, formatPdfDate$1 as Sn, circlePath as Sr, isTiff as St, encodeOID as T, beginArtifactWithType as Tn, closeAndStroke as Tr, isWebP as Tt, splitPdf as U, setGraphicsState as Un, setLineCap as Ur, renderMultiPageTable as Ut, copyPages as V, saveState as Vn, setDashPattern as Vr, PdfPage as Vt, checkAccessibility as W, skew as Wn, setLineJoin as Wr, renderTable as Wt, buildViewerPreferencesDict as X, colorToComponents as Xn, moveText as Xr, radialGradient as Xt, PdfViewerPreferences as Y, cmykToRgb as Yn, endText as Yr, linearGradient as Yt, parseViewerPreferences as Z, colorToHex as Zn, moveTextSetLeading as Zr, tilingPattern as Zt, signPdf as _, createAnnotation as _n, spotColor as _r, formatHexContext as _t, getPageLabels as a, setTextRise as ai, drawSvgOnPage as an, setColorSpace as ar, sha256 as at, detectKeyAlgorithm as b, buildInfoDict as bn, drawImageXObject as br, decodeTiffPage as bt, embedPageAsFormXObject as c, showTextArray as ci, interpolateLinearRgb as cn, setFillColorGray as cr, decodePermissions as ct, attachFile as d, showTextWithSpacing as di, parseSvgPath as dn, setStrokeColor as dr, aesEncryptCBC as dt, setFont as ei, markForRedaction as en, deviceNResourceName as er, loadPdf as et, buildEmbeddedFilesNameTree as f, parseSvgTransform as fn, setStrokeColorCmyk as fr, rc4 as ft, getSignatures as g, buildAnnotationDict as gn, setStrokingColor as gr, PdfParseError as gt, verifySignatures as h, annotationFromDict as hn, setStrokeColorSpace as hr, base64Encode as ht, PdfPluginManager as i, setTextRenderingMode as ii, endLayerContent as in, rgbToCmyk as ir, verifyUserPassword as it, encodeUtf8String as j, endMarkedContent as jn, curveToInitial as jr, isOpenTypeCFF as jt, encodeSet as k, createMarkedContentScope as kn, curveTo as kr, getSupportedFormats as kt, addWatermark as l, showTextHex as li, parseSvg as ln, setFillColorRgb as lr, encodePermissions as lt, verifySignature as m, PdfAnnotation as mn, setStrokeColorRgb as mr, base64Decode as mt, StandardFonts as n, setLeading as ni, PdfLayerManager as nn, hexToColor as nr, computeFileEncryptionKey as nt, removePageLabels as o, setWordSpacing as oi, svgToPdfOperators as on, setFillColor as or, sha384 as ot, getAttachments as p, AnnotationFlags as pn, setStrokeColorGray as pr, md5 as pt, PdfStructureElement as q, applyStrokeColor as qn, stroke as qr, buildGradientObjects as qt, createPdf as r, setTextMatrix as ri, beginLayerContent as rn, rgb as rr, verifyOwnerPassword as rt, setPageLabels as s, showText as si, applySpreadMethod as sn, setFillColorCmyk as sr, sha512 as st, PdfDocument as t, setFontSize as ti, PdfLayer as tn, grayscale as tr, PdfEncryptionHandler as tt, addWatermarkToPage as u, showTextNextLine as ui, parseSvgColor as un, setFillingColor as ur, aesDecryptCBC as ut, buildPkcs7Signature as v, buildCatalog as vn, spotResourceName as vr, decodeTiff as vt, encodeLength as w, beginArtifact as wn, clipEvenOdd as wr, decodeWebP as wt, detectNamedCurve as x, buildPageTree as xn, drawXObject as xr, getTiffPageCount as xt, decodeOidBytes as y, buildDocumentStructure as yn, drawImageWithMatrix as yr, decodeTiffAll as yt, findSignatures as z, rotate as zn, moveTo as zr, libdeflateWasm_exports as zt };
+export { parseViewerPreferences as $, colorToHex as $n, moveTextSetLeading as $r, tilingPattern as $t, encodeUTCTime as A, beginMarkedContentWithProperties as An, closePath as Ar, getImageFormatName as At, embedSignature as B, restoreState as Bn, lineTo as Br, serializePdf as Bt, encodeInteger as C, buildPageTree as Cn, drawXObject as Cr, getTiffPageCount as Ct, encodePrintableString as D, beginArtifactWithType as Dn, closeAndStroke as Dr, isWebP as Dt, encodeOctetString as E, beginArtifact as En, clipEvenOdd as Er, decodeWebP as Et, parseDerTlv as F, concatMatrix as Fn, endPath as Fr, EmbeddedFont as Ft, splitPdf as G, setGraphicsState as Gn, setLineCap as Gr, renderMultiPageTable as Gt, prepareForSigning as H, rotationMatrix as Hn, rectangle as Hr, PageSizes as Ht, toBuffer as I, degrees as In, fill as Ir, fontSubset_exports as It, summarizeIssues as J, applyFillColor as Jn, setMiterLimit as Jr, qrCodeToOperators as Jt, checkAccessibility as K, skew as Kn, setLineJoin as Kr, renderTable as Kt, buildSigningCertificateV2Attribute as L, degreesToRadians as Ln, fillAndStroke as Lr, extractMetrics as Lt, extractIssuerAndSerial as M, endArtifact as Mn, curveToFinal as Mr, pngEmbed_exports as Mt, extractSubjectPublicKeyInfo as N, endMarkedContent as Nn, curveToInitial as Nr, isOpenTypeCFF as Nt, encodeSequence as O, beginMarkedContent as On, closeFillAndStroke as Or, isWebPLossless as Ot, getSubtle as P, wrapInMarkedContent as Pn, ellipsePath as Pr, isTrueType as Pt, buildViewerPreferencesDict as Q, colorToComponents as Qn, moveText as Qr, radialGradient as Qt, extractSigningCertificateV2 as R, radians as Rn, fillEvenOdd as Rr, PdfStreamWriter as Rt, encodeContextTag as S, buildInfoDict as Sn, drawImageXObject as Sr, decodeTiffPage as St, encodeOID as T, pdfCatalog_exports as Tn, clip as Tr, parseTiffIfd as Tt, copyPages as U, saveState as Un, setDashPattern as Ur, PdfPage as Ut, findSignatures as V, rotate as Vn, moveTo as Vr, libdeflateWasm_exports as Vt, mergePdfs as W, scale as Wn, setFlatness as Wr, wrapText as Wt, PdfStructureTree as X, cmyk as Xn, beginText as Xr, buildPatternObjects as Xt, PdfStructureElement as Y, applyStrokeColor as Yn, stroke as Yr, buildGradientObjects as Yt, PdfViewerPreferences as Z, cmykToRgb as Zn, endText as Zr, linearGradient as Zt, signPdf as _, annotationFromDict as _n, setStrokeColorSpace as _r, base64Encode as _t, getPageLabels as a, setTextMatrix as ai, beginLayerContent as an, rgb as ar, verifyOwnerPassword as at, detectKeyAlgorithm as b, buildCatalog as bn, spotResourceName as br, decodeTiff as bt, embedPageAsFormXObject as c, setWordSpacing as ci, svgToPdfOperators as cn, setFillColor as cr, sha384 as ct, attachFile as d, showTextHex as di, parseSvg as dn, setFillColorRgb as dr, encodePermissions as dt, nextLine as ei, applyRedactions as en, componentsToColor as er, PdfOutlineItem as et, buildEmbeddedFilesNameTree as f, showTextNextLine as fi, parseSvgColor as fn, setFillingColor as fr, aesDecryptCBC as ft, getSignatures as g, PdfAnnotation as gn, setStrokeColorRgb as gr, base64Decode as gt, verifySignatures as h, AnnotationFlags as hn, setStrokeColorGray as hr, md5 as ht, PdfPluginManager as i, setLeading as ii, PdfLayerManager as in, hexToColor as ir, computeFileEncryptionKey as it, encodeUtf8String as j, createMarkedContentScope as jn, curveTo as jr, getSupportedFormats as jt, encodeSet as k, beginMarkedContentSequence as kn, closeFillEvenOddAndStroke as kr, detectImageFormat as kt, addWatermark as l, showText as li, applySpreadMethod as ln, setFillColorCmyk as lr, sha512 as lt, verifySignature as m, parseSvgTransform as mn, setStrokeColorCmyk as mr, rc4 as mt, StandardFonts as n, setFont as ni, markForRedaction as nn, deviceNResourceName as nr, loadPdf as nt, removePageLabels as o, setTextRenderingMode as oi, endLayerContent as on, rgbToCmyk as or, verifyUserPassword as ot, getAttachments as p, showTextWithSpacing as pi, parseSvgPath as pn, setStrokeColor as pr, aesEncryptCBC as pt, isAccessible as q, translate as qn, setLineWidth as qr, encodeQrCode as qt, createPdf as r, setFontSize as ri, PdfLayer as rn, grayscale as rr, PdfEncryptionHandler as rt, setPageLabels as s, setTextRise as si, drawSvgOnPage as sn, setColorSpace as sr, sha256 as st, PdfDocument as t, setCharacterSpacing as ti, getRedactionMarks as tn, deviceNColor as tr, PdfOutlineTree as tt, addWatermarkToPage as u, showTextArray as ui, interpolateLinearRgb as un, setFillColorGray as ur, decodePermissions as ut, buildPkcs7Signature as v, buildAnnotationDict as vn, setStrokingColor as vr, PdfParseError as vt, encodeLength as w, formatPdfDate$1 as wn, circlePath as wr, isTiff as wt, detectNamedCurve as x, buildDocumentStructure as xn, drawImageWithMatrix as xr, decodeTiffAll as xt, decodeOidBytes as y, createAnnotation as yn, spotColor as yr, formatHexContext as yt, computeSignatureHash as z, radiansToDegrees as zn, fillEvenOddAndStroke as zr, PdfWriter as zt };
 
-//# sourceMappingURL=pdfDocument-Cgkkk8F8.mjs.map
+//# sourceMappingURL=pdfDocument-EcHxUnR6.mjs.map