modern-pdf-lib 0.33.0 → 0.34.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/dist/browser.cjs +6 -3
- package/dist/browser.d.cts +5 -5
- package/dist/browser.d.mts +5 -5
- package/dist/browser.mjs +4 -4
- package/dist/{compressionAnalysis-0m5jJG1_.d.mts → compressionAnalysis-4EW8MJBa.d.mts} +2 -2
- package/dist/{compressionAnalysis-0m5jJG1_.d.mts.map → compressionAnalysis-4EW8MJBa.d.mts.map} +1 -1
- package/dist/{compressionAnalysis-CSBcmi0_.d.cts → compressionAnalysis-Cz3yWa-O.d.cts} +2 -2
- package/dist/{compressionAnalysis-CSBcmi0_.d.cts.map → compressionAnalysis-Cz3yWa-O.d.cts.map} +1 -1
- package/dist/create.cjs +2 -2
- package/dist/create.d.cts +2 -2
- package/dist/create.d.mts +2 -2
- package/dist/create.mjs +2 -2
- package/dist/{fontEmbed-Bzv89wgp.d.mts → fontEmbed-CTTeV1mZ.d.mts} +2 -2
- package/dist/{fontEmbed-Bzv89wgp.d.mts.map → fontEmbed-CTTeV1mZ.d.mts.map} +1 -1
- package/dist/{fontEmbed-Dwl1XeEA.d.cts → fontEmbed-DxvWoqOt.d.cts} +2 -2
- package/dist/{fontEmbed-Dwl1XeEA.d.cts.map → fontEmbed-DxvWoqOt.d.cts.map} +1 -1
- package/dist/{index-BJtSRrMf.d.mts → index-C240uDcb.d.mts} +95 -45
- package/dist/index-C240uDcb.d.mts.map +1 -0
- package/dist/{index-BqYQ9lsY.d.cts → index-Z4U1Jx0K.d.cts} +95 -45
- package/dist/index-Z4U1Jx0K.d.cts.map +1 -0
- package/dist/index.cjs +6 -3
- package/dist/index.d.cts +5 -5
- package/dist/index.d.mts +5 -5
- package/dist/index.mjs +4 -4
- package/dist/{layout-BYXpcYtC.cjs → layout-ClbkITM3.cjs} +2 -2
- package/dist/{layout-xOcesNCh.mjs → layout-XgQY_Uba.mjs} +2 -2
- package/dist/parse.cjs +1 -1
- package/dist/parse.d.cts +2 -2
- package/dist/parse.d.mts +2 -2
- package/dist/parse.mjs +1 -1
- package/dist/{pdfDocument-B8tQcZqj.d.cts → pdfDocument-BX5o5hI7.d.cts} +13 -1
- package/dist/{pdfDocument-B-8iPl_j.d.mts.map → pdfDocument-BX5o5hI7.d.cts.map} +1 -1
- package/dist/{pdfDocument-B-8iPl_j.d.mts → pdfDocument-C7TItmPQ.d.mts} +13 -1
- package/dist/{pdfDocument-B8tQcZqj.d.cts.map → pdfDocument-C7TItmPQ.d.mts.map} +1 -1
- package/dist/{pdfDocument-Bh4ebDqE.cjs → pdfDocument-Dyj4AmT1.cjs} +358 -21
- package/dist/{pdfDocument-Cgkkk8F8.mjs → pdfDocument-EcHxUnR6.mjs} +347 -22
- package/dist/{src-zeRl33xQ.mjs → src-CiUkSS81.mjs} +263 -23
- package/dist/{src-BdVnpRoy.cjs → src-PxZwqIKQ.cjs} +268 -22
- package/package.json +1 -1
- package/dist/index-BJtSRrMf.d.mts.map +0 -1
- package/dist/index-BqYQ9lsY.d.cts.map +0 -1
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { A as encodeUTCTime,
|
|
1
|
+
import { A as encodeUTCTime, Bn as restoreState, Br as lineTo, C as encodeInteger, E as encodeOctetString, F as parseDerTlv, Hr as rectangle, Ht as PageSizes, I as toBuffer, Ir as fill, Jn as applyFillColor, M as extractIssuerAndSerial, N as extractSubjectPublicKeyInfo, O as encodeSequence, P as getSubtle, Qr as moveText, S as encodeContextTag, T as encodeOID, Un as saveState, Ur as setDashPattern, V as findSignatures, Vr as moveTo, W as mergePdfs, Xr as beginText, Yn as applyStrokeColor, Yr as stroke, Zn as cmykToRgb, Zr as endText, b as detectKeyAlgorithm, ci as setWordSpacing, gn as PdfAnnotation, k as encodeSet, li as showText$1, n as StandardFonts, ni as setFont, qr as setLineWidth, r as createPdf, s as setPageLabels, st as sha256, t as PdfDocument, vn as buildAnnotationDict, vt as PdfParseError, wn as formatPdfDate, x as detectNamedCurve, y as decodeOidBytes, z as computeSignatureHash } from "./pdfDocument-EcHxUnR6.mjs";
|
|
2
2
|
import { c as PdfRef, i as PdfName, l as PdfStream, n as PdfBool, o as PdfNumber, r as PdfDict, t as PdfArray, u as PdfString } from "./pdfObjects-CB7TEdbW.mjs";
|
|
3
3
|
import { n as decodeStreamData, r as getStreamFilters } from "./streamDecode-DCpgTocN.mjs";
|
|
4
4
|
import { g as FieldFlags, v as numVal } from "./pdfForm-CfLnlsj-.mjs";
|
|
@@ -277,7 +277,7 @@ function compressStream(stream, level) {
|
|
|
277
277
|
* @returns The incremental save result.
|
|
278
278
|
*/
|
|
279
279
|
async function saveDocumentIncremental(originalBytes, doc, options) {
|
|
280
|
-
const { buildDocumentStructure } = await import("./pdfDocument-
|
|
280
|
+
const { buildDocumentStructure } = await import("./pdfDocument-EcHxUnR6.mjs").then((n) => n.Tn);
|
|
281
281
|
const registry = doc.getRegistry();
|
|
282
282
|
const structure = buildDocumentStructure(doc.getInternalPages().map((p) => p.finalize()), {
|
|
283
283
|
producer: doc.getProducer(),
|
|
@@ -4280,7 +4280,7 @@ function findChangedObjects(original, modified) {
|
|
|
4280
4280
|
continue;
|
|
4281
4281
|
}
|
|
4282
4282
|
if (computeObjectHash(origObj.content) !== computeObjectHash(modObj.content)) {
|
|
4283
|
-
if (!bytesEqual(origObj.content, modObj.content)) changedObjNums.push(objNum);
|
|
4283
|
+
if (!bytesEqual$1(origObj.content, modObj.content)) changedObjNums.push(objNum);
|
|
4284
4284
|
}
|
|
4285
4285
|
}
|
|
4286
4286
|
return changedObjNums.sort((a, b) => a - b);
|
|
@@ -4288,7 +4288,7 @@ function findChangedObjects(original, modified) {
|
|
|
4288
4288
|
/**
|
|
4289
4289
|
* Compare two Uint8Arrays for equality.
|
|
4290
4290
|
*/
|
|
4291
|
-
function bytesEqual(a, b) {
|
|
4291
|
+
function bytesEqual$1(a, b) {
|
|
4292
4292
|
if (a.length !== b.length) return false;
|
|
4293
4293
|
for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
|
|
4294
4294
|
return true;
|
|
@@ -4326,7 +4326,7 @@ function optimizeIncrementalSave(originalPdf, changes) {
|
|
|
4326
4326
|
const changeHash = computeObjectHash(change.newContent);
|
|
4327
4327
|
const origObj = originalObjs.get(change.objectNumber);
|
|
4328
4328
|
if (origObj) {
|
|
4329
|
-
if (computeObjectHash(origObj.content) === changeHash && bytesEqual(origObj.content, change.newContent)) continue;
|
|
4329
|
+
if (computeObjectHash(origObj.content) === changeHash && bytesEqual$1(origObj.content, change.newContent)) continue;
|
|
4330
4330
|
}
|
|
4331
4331
|
const dedupeKey = `${change.objectNumber}:${change.generationNumber}:${changeHash}`;
|
|
4332
4332
|
if (seenHashes.has(dedupeKey)) continue;
|
|
@@ -24457,7 +24457,7 @@ function extractCrlUrls(cert) {
|
|
|
24457
24457
|
/**
|
|
24458
24458
|
* Extract the DER-encoded subject Name from a certificate.
|
|
24459
24459
|
*/
|
|
24460
|
-
function extractSubjectDer$
|
|
24460
|
+
function extractSubjectDer$2(certDer) {
|
|
24461
24461
|
const tbsCert = parseDerTlv(certDer, 0).children[0];
|
|
24462
24462
|
let idx = 0;
|
|
24463
24463
|
if (tbsCert.children[0].tag === 160) idx = 1;
|
|
@@ -24468,7 +24468,7 @@ function extractSubjectDer$1(certDer) {
|
|
|
24468
24468
|
/**
|
|
24469
24469
|
* Extract the DER-encoded issuer Name from a certificate.
|
|
24470
24470
|
*/
|
|
24471
|
-
function extractIssuerDer$
|
|
24471
|
+
function extractIssuerDer$2(certDer) {
|
|
24472
24472
|
const tbsCert = parseDerTlv(certDer, 0).children[0];
|
|
24473
24473
|
let idx = 0;
|
|
24474
24474
|
if (tbsCert.children[0].tag === 160) idx = 1;
|
|
@@ -24590,7 +24590,7 @@ var TrustStore = class {
|
|
|
24590
24590
|
*/
|
|
24591
24591
|
async isTrusted(cert) {
|
|
24592
24592
|
await this._ready;
|
|
24593
|
-
const key = await computeSubjectKey(extractSubjectDer$
|
|
24593
|
+
const key = await computeSubjectKey(extractSubjectDer$2(cert));
|
|
24594
24594
|
const entries = this._certs.get(key);
|
|
24595
24595
|
if (!entries) return false;
|
|
24596
24596
|
return entries.some((e) => compareBytes$1(e.der, cert));
|
|
@@ -24607,7 +24607,7 @@ var TrustStore = class {
|
|
|
24607
24607
|
*/
|
|
24608
24608
|
async findIssuer(cert) {
|
|
24609
24609
|
await this._ready;
|
|
24610
|
-
const key = await computeSubjectKey(extractIssuerDer$
|
|
24610
|
+
const key = await computeSubjectKey(extractIssuerDer$2(cert));
|
|
24611
24611
|
const entries = this._certs.get(key);
|
|
24612
24612
|
if (!entries || entries.length === 0) return null;
|
|
24613
24613
|
return entries[0].der;
|
|
@@ -24641,7 +24641,7 @@ var TrustStore = class {
|
|
|
24641
24641
|
* Add a single certificate to the store.
|
|
24642
24642
|
*/
|
|
24643
24643
|
async _addOne(cert) {
|
|
24644
|
-
const key = await computeSubjectKey(extractSubjectDer$
|
|
24644
|
+
const key = await computeSubjectKey(extractSubjectDer$2(cert));
|
|
24645
24645
|
const entry = {
|
|
24646
24646
|
der: cert,
|
|
24647
24647
|
serialBytes: extractSerialBytes(cert),
|
|
@@ -26729,7 +26729,7 @@ function parseAsn1Time(node) {
|
|
|
26729
26729
|
/**
|
|
26730
26730
|
* Extract the subject raw DER bytes from a certificate.
|
|
26731
26731
|
*/
|
|
26732
|
-
function extractSubjectDer(certDer) {
|
|
26732
|
+
function extractSubjectDer$1(certDer) {
|
|
26733
26733
|
const tbsCert = parseDerTlv(certDer, 0).children[0];
|
|
26734
26734
|
let idx = 0;
|
|
26735
26735
|
if (tbsCert.children[0].tag === 160) idx = 1;
|
|
@@ -26740,7 +26740,7 @@ function extractSubjectDer(certDer) {
|
|
|
26740
26740
|
/**
|
|
26741
26741
|
* Extract the issuer raw DER bytes from a certificate.
|
|
26742
26742
|
*/
|
|
26743
|
-
function extractIssuerDer(certDer) {
|
|
26743
|
+
function extractIssuerDer$1(certDer) {
|
|
26744
26744
|
const tbsCert = parseDerTlv(certDer, 0).children[0];
|
|
26745
26745
|
let idx = 0;
|
|
26746
26746
|
if (tbsCert.children[0].tag === 160) idx = 1;
|
|
@@ -26794,8 +26794,8 @@ function isCA(certDer) {
|
|
|
26794
26794
|
* Check if a certificate is self-signed (subject === issuer).
|
|
26795
26795
|
*/
|
|
26796
26796
|
function isSelfSigned(certDer) {
|
|
26797
|
-
const subjectDer = extractSubjectDer(certDer);
|
|
26798
|
-
const issuerDer = extractIssuerDer(certDer);
|
|
26797
|
+
const subjectDer = extractSubjectDer$1(certDer);
|
|
26798
|
+
const issuerDer = extractIssuerDer$1(certDer);
|
|
26799
26799
|
if (subjectDer.length !== issuerDer.length) return false;
|
|
26800
26800
|
for (let i = 0; i < subjectDer.length; i++) if (subjectDer[i] !== issuerDer[i]) return false;
|
|
26801
26801
|
return true;
|
|
@@ -26993,9 +26993,9 @@ function buildCertificateChain(leaf, intermediates) {
|
|
|
26993
26993
|
chain,
|
|
26994
26994
|
complete: true
|
|
26995
26995
|
};
|
|
26996
|
-
const currentIssuerDer = extractIssuerDer(current);
|
|
26996
|
+
const currentIssuerDer = extractIssuerDer$1(current);
|
|
26997
26997
|
let foundIdx = -1;
|
|
26998
|
-
for (let i = 0; i < available.length; i++) if (namesEqual(currentIssuerDer, extractSubjectDer(available[i]))) {
|
|
26998
|
+
for (let i = 0; i < available.length; i++) if (namesEqual(currentIssuerDer, extractSubjectDer$1(available[i]))) {
|
|
26999
26999
|
foundIdx = i;
|
|
27000
27000
|
break;
|
|
27001
27001
|
}
|
|
@@ -27083,8 +27083,8 @@ async function validateCertificateChain(chain, options) {
|
|
|
27083
27083
|
if (!signatureValid) certErrors.push("Root certificate self-signature verification failed");
|
|
27084
27084
|
} else {
|
|
27085
27085
|
let foundTrusted = false;
|
|
27086
|
-
const certIssuerDer = extractIssuerDer(certDer);
|
|
27087
|
-
for (const trusted of trustedCerts) if (namesEqual(certIssuerDer, extractSubjectDer(trusted))) {
|
|
27086
|
+
const certIssuerDer = extractIssuerDer$1(certDer);
|
|
27087
|
+
for (const trusted of trustedCerts) if (namesEqual(certIssuerDer, extractSubjectDer$1(trusted))) {
|
|
27088
27088
|
signatureValid = await verifyCertSignature(certDer, trusted);
|
|
27089
27089
|
foundTrusted = true;
|
|
27090
27090
|
break;
|
|
@@ -27841,6 +27841,246 @@ function extractNodeBytesFromParent(fullBuffer, parent, child) {
|
|
|
27841
27841
|
return fullBuffer.subarray(start, start + child.totalLength);
|
|
27842
27842
|
}
|
|
27843
27843
|
//#endregion
|
|
27844
|
+
//#region src/signature/certPathBuilder.ts
|
|
27845
|
+
/**
|
|
27846
|
+
* @module signature/certPathBuilder
|
|
27847
|
+
*
|
|
27848
|
+
* Certification-path (trust-chain) construction per RFC 5280 §6.1.
|
|
27849
|
+
*
|
|
27850
|
+
* Given a leaf certificate, a pool of intermediate CA certificates, and a
|
|
27851
|
+
* set of trust anchors, {@link buildCertPath} assembles the ordered chain
|
|
27852
|
+
*
|
|
27853
|
+
* ```
|
|
27854
|
+
* leaf -> intermediate -> ... -> (issuer that is a trust anchor)
|
|
27855
|
+
* ```
|
|
27856
|
+
*
|
|
27857
|
+
* by matching, at each step, the *current* certificate's **issuer** Name to
|
|
27858
|
+
* a candidate certificate's **subject** Name (RFC 5280 §4.1.2.4 / §4.1.2.6).
|
|
27859
|
+
* When both certificates additionally carry the relevant key-identifier
|
|
27860
|
+
* extensions, the candidate's **Subject Key Identifier** (SKI, OID
|
|
27861
|
+
* `2.5.29.14`, RFC 5280 §4.2.1.2) must equal the current certificate's
|
|
27862
|
+
* **Authority Key Identifier** (AKI `keyIdentifier`, OID `2.5.29.35`,
|
|
27863
|
+
* RFC 5280 §4.2.1.1) for the link to be accepted. If only one side carries
|
|
27864
|
+
* the identifier, name matching alone is used (RFC 5280 §6.1.4 treats key
|
|
27865
|
+
* identifiers as a hint, not a hard requirement).
|
|
27866
|
+
*
|
|
27867
|
+
* Building stops when:
|
|
27868
|
+
* - the current certificate (or a matched issuer) is a member of `anchors`
|
|
27869
|
+
* → `complete: true`, `anchor` set, and `path` excludes the anchor; or
|
|
27870
|
+
* - no issuer can be found among `intermediates`/`anchors`
|
|
27871
|
+
* → `complete: false` (partial path returned).
|
|
27872
|
+
*
|
|
27873
|
+
* Loop protection: a certificate already present in the constructed path is
|
|
27874
|
+
* never revisited (RFC 5280 §6.1 prohibits a certificate appearing more than
|
|
27875
|
+
* once in a certification path).
|
|
27876
|
+
*
|
|
27877
|
+
* Name matching uses byte-for-byte equality of the DER-encoded `Name`. This
|
|
27878
|
+
* is the exact-match comparison permitted by RFC 5280 §7.1 when both names
|
|
27879
|
+
* are produced by conforming encoders (as is the case for fixtures generated
|
|
27880
|
+
* here and for the overwhelming majority of real-world CAs).
|
|
27881
|
+
*
|
|
27882
|
+
* References:
|
|
27883
|
+
* - RFC 5280 §4.1.2.4 (issuer), §4.1.2.6 (subject)
|
|
27884
|
+
* - RFC 5280 §4.2.1.1 (Authority Key Identifier, OID 2.5.29.35)
|
|
27885
|
+
* - RFC 5280 §4.2.1.2 (Subject Key Identifier, OID 2.5.29.14)
|
|
27886
|
+
* - RFC 5280 §6.1 (Certification Path Validation — path construction)
|
|
27887
|
+
*
|
|
27888
|
+
* @packageDocumentation
|
|
27889
|
+
*/
|
|
27890
|
+
/** Subject Key Identifier — RFC 5280 §4.2.1.2. */
|
|
27891
|
+
const OID_SUBJECT_KEY_IDENTIFIER = "2.5.29.14";
|
|
27892
|
+
/** Authority Key Identifier — RFC 5280 §4.2.1.1. */
|
|
27893
|
+
const OID_AUTHORITY_KEY_IDENTIFIER = "2.5.29.35";
|
|
27894
|
+
/**
|
|
27895
|
+
* Reconstruct the absolute byte range of a child node within the original
|
|
27896
|
+
* certificate buffer, returning the full TLV (header + value) as a subarray
|
|
27897
|
+
* that shares the cert's underlying ArrayBuffer.
|
|
27898
|
+
*
|
|
27899
|
+
* `parentNode.data` is a subarray of `certDer`; `child.offset` is the child's
|
|
27900
|
+
* offset within that parent value; `child.totalLength` covers header + value.
|
|
27901
|
+
*/
|
|
27902
|
+
function sliceChild(certDer, parentNode, child) {
|
|
27903
|
+
const start = child.offset + (parentNode.data.byteOffset - certDer.byteOffset);
|
|
27904
|
+
return certDer.subarray(start, start + child.totalLength);
|
|
27905
|
+
}
|
|
27906
|
+
/**
|
|
27907
|
+
* Resolve the TBSCertificate node and the index offset that accounts for the
|
|
27908
|
+
* optional `version [0] EXPLICIT` field.
|
|
27909
|
+
*
|
|
27910
|
+
* TBSCertificate ::= SEQUENCE {
|
|
27911
|
+
* version [0] EXPLICIT INTEGER DEFAULT v1, -- tag 0xA0 when present
|
|
27912
|
+
* serialNumber INTEGER,
|
|
27913
|
+
* signature AlgorithmIdentifier,
|
|
27914
|
+
* issuer Name,
|
|
27915
|
+
* validity Validity,
|
|
27916
|
+
* subject Name,
|
|
27917
|
+
* subjectPublicKeyInfo SubjectPublicKeyInfo,
|
|
27918
|
+
* ... extensions [3] EXPLICIT ...
|
|
27919
|
+
* }
|
|
27920
|
+
*/
|
|
27921
|
+
function tbsContext(certDer) {
|
|
27922
|
+
const tbs = parseDerTlv(certDer, 0).children[0];
|
|
27923
|
+
if (!tbs) throw new Error("Malformed certificate: missing TBSCertificate");
|
|
27924
|
+
const first = tbs.children[0];
|
|
27925
|
+
return {
|
|
27926
|
+
tbs,
|
|
27927
|
+
idx: first && first.tag === 160 ? 1 : 0
|
|
27928
|
+
};
|
|
27929
|
+
}
|
|
27930
|
+
/** Extract the raw DER bytes of the issuer Name (RFC 5280 §4.1.2.4). */
|
|
27931
|
+
function extractIssuerDer(certDer) {
|
|
27932
|
+
const { tbs, idx } = tbsContext(certDer);
|
|
27933
|
+
const issuerNode = tbs.children[idx + 2];
|
|
27934
|
+
if (!issuerNode) throw new Error("Malformed certificate: missing issuer");
|
|
27935
|
+
return sliceChild(certDer, tbs, issuerNode);
|
|
27936
|
+
}
|
|
27937
|
+
/** Extract the raw DER bytes of the subject Name (RFC 5280 §4.1.2.6). */
|
|
27938
|
+
function extractSubjectDer(certDer) {
|
|
27939
|
+
const { tbs, idx } = tbsContext(certDer);
|
|
27940
|
+
const subjectNode = tbs.children[idx + 4];
|
|
27941
|
+
if (!subjectNode) throw new Error("Malformed certificate: missing subject");
|
|
27942
|
+
return sliceChild(certDer, tbs, subjectNode);
|
|
27943
|
+
}
|
|
27944
|
+
/**
|
|
27945
|
+
* Extract the list of Extension nodes (each a SEQUENCE) from a certificate,
|
|
27946
|
+
* or an empty array when no extensions are present.
|
|
27947
|
+
*
|
|
27948
|
+
* extensions [3] EXPLICIT SEQUENCE OF Extension
|
|
27949
|
+
* Extension ::= SEQUENCE { extnID OID, critical BOOLEAN DEFAULT FALSE, extnValue OCTET STRING }
|
|
27950
|
+
*/
|
|
27951
|
+
function extractExtensionNodes(certDer) {
|
|
27952
|
+
try {
|
|
27953
|
+
const { tbs } = tbsContext(certDer);
|
|
27954
|
+
for (const child of tbs.children) if (child.tag === 163 && child.children.length > 0) return child.children[0].children;
|
|
27955
|
+
} catch {}
|
|
27956
|
+
return [];
|
|
27957
|
+
}
|
|
27958
|
+
/**
|
|
27959
|
+
* Locate the `extnValue` OCTET STRING contents for a given extension OID.
|
|
27960
|
+
* Returns the raw bytes inside the OCTET STRING (the DER of the extension's
|
|
27961
|
+
* value), or `undefined` if the extension is absent.
|
|
27962
|
+
*/
|
|
27963
|
+
function findExtensionValue(certDer, oid) {
|
|
27964
|
+
for (const ext of extractExtensionNodes(certDer)) {
|
|
27965
|
+
const oidNode = ext.children[0];
|
|
27966
|
+
if (!oidNode) continue;
|
|
27967
|
+
if (decodeOidBytes(oidNode.data) !== oid) continue;
|
|
27968
|
+
const valueNode = ext.children[ext.children.length - 1];
|
|
27969
|
+
if (!valueNode) return void 0;
|
|
27970
|
+
return valueNode.data;
|
|
27971
|
+
}
|
|
27972
|
+
}
|
|
27973
|
+
/**
|
|
27974
|
+
* Extract the Subject Key Identifier (key bytes) — RFC 5280 §4.2.1.2.
|
|
27975
|
+
*
|
|
27976
|
+
* SubjectKeyIdentifier ::= KeyIdentifier
|
|
27977
|
+
* KeyIdentifier ::= OCTET STRING
|
|
27978
|
+
*
|
|
27979
|
+
* extnValue (an OCTET STRING) wraps the KeyIdentifier OCTET STRING, so we
|
|
27980
|
+
* parse one inner OCTET STRING to obtain the raw identifier bytes.
|
|
27981
|
+
*/
|
|
27982
|
+
function extractSki(certDer) {
|
|
27983
|
+
const extnValue = findExtensionValue(certDer, OID_SUBJECT_KEY_IDENTIFIER);
|
|
27984
|
+
if (!extnValue) return void 0;
|
|
27985
|
+
try {
|
|
27986
|
+
const inner = parseDerTlv(extnValue, 0);
|
|
27987
|
+
if (inner.tag !== 4) return void 0;
|
|
27988
|
+
return inner.data;
|
|
27989
|
+
} catch {
|
|
27990
|
+
return;
|
|
27991
|
+
}
|
|
27992
|
+
}
|
|
27993
|
+
/**
|
|
27994
|
+
* Extract the Authority Key Identifier `keyIdentifier` — RFC 5280 §4.2.1.1.
|
|
27995
|
+
*
|
|
27996
|
+
* AuthorityKeyIdentifier ::= SEQUENCE {
|
|
27997
|
+
* keyIdentifier [0] KeyIdentifier OPTIONAL, -- IMPLICIT OCTET STRING, tag 0x80
|
|
27998
|
+
* authorityCertIssuer [1] GeneralNames OPTIONAL,
|
|
27999
|
+
* authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
|
|
28000
|
+
*
|
|
28001
|
+
* extnValue (an OCTET STRING) wraps the SEQUENCE. We return the bytes of the
|
|
28002
|
+
* `[0]` IMPLICIT field (context tag 0x80), or `undefined` if absent.
|
|
28003
|
+
*/
|
|
28004
|
+
function extractAkiKeyId(certDer) {
|
|
28005
|
+
const extnValue = findExtensionValue(certDer, OID_AUTHORITY_KEY_IDENTIFIER);
|
|
28006
|
+
if (!extnValue) return void 0;
|
|
28007
|
+
try {
|
|
28008
|
+
const seq = parseDerTlv(extnValue, 0);
|
|
28009
|
+
if (seq.tag !== 48) return void 0;
|
|
28010
|
+
for (const field of seq.children) if (field.tag === 128) return field.data;
|
|
28011
|
+
} catch {
|
|
28012
|
+
return;
|
|
28013
|
+
}
|
|
28014
|
+
}
|
|
28015
|
+
/** Byte-for-byte equality of two arrays. */
|
|
28016
|
+
function bytesEqual(a, b) {
|
|
28017
|
+
if (a.length !== b.length) return false;
|
|
28018
|
+
for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
|
|
28019
|
+
return true;
|
|
28020
|
+
}
|
|
28021
|
+
/**
|
|
28022
|
+
* Determine whether `candidate` could be the issuer of `cert`:
|
|
28023
|
+
* the candidate's subject DN must equal the cert's issuer DN, and — only when
|
|
28024
|
+
* BOTH key identifiers are present — the candidate's SKI must equal the cert's
|
|
28025
|
+
* AKI keyIdentifier (RFC 5280 §6.1.4 / §4.2.1.1).
|
|
28026
|
+
*/
|
|
28027
|
+
function isIssuerOf(cert, candidate) {
|
|
28028
|
+
if (!bytesEqual(extractIssuerDer(cert), extractSubjectDer(candidate))) return false;
|
|
28029
|
+
const aki = extractAkiKeyId(cert);
|
|
28030
|
+
const ski = extractSki(candidate);
|
|
28031
|
+
if (aki && ski) return bytesEqual(aki, ski);
|
|
28032
|
+
return true;
|
|
28033
|
+
}
|
|
28034
|
+
/**
|
|
28035
|
+
* Build an ordered certification path from a leaf certificate to a trust
|
|
28036
|
+
* anchor per RFC 5280 §6.1.
|
|
28037
|
+
*
|
|
28038
|
+
* @param leafCertDer DER-encoded end-entity (leaf) certificate.
|
|
28039
|
+
* @param intermediates DER-encoded intermediate CA certificates (any order).
|
|
28040
|
+
* @param anchors DER-encoded trust anchors (root or directly-trusted CAs).
|
|
28041
|
+
* @returns {@link CertPathResult} — `path` is leaf-first and
|
|
28042
|
+
* excludes the anchor; `anchor` is reported separately
|
|
28043
|
+
* when the path is `complete`.
|
|
28044
|
+
*
|
|
28045
|
+
* @example
|
|
28046
|
+
* ```ts
|
|
28047
|
+
* const { path, complete, anchor } = buildCertPath(leaf, [intermediate], [root]);
|
|
28048
|
+
* // path = [leaf, intermediate], complete = true, anchor = root
|
|
28049
|
+
* ```
|
|
28050
|
+
*/
|
|
28051
|
+
function buildCertPath(leafCertDer, intermediates, anchors) {
|
|
28052
|
+
const leafAnchor = anchors.find((a) => bytesEqual(a, leafCertDer));
|
|
28053
|
+
if (leafAnchor) return {
|
|
28054
|
+
path: [leafCertDer],
|
|
28055
|
+
complete: true,
|
|
28056
|
+
anchor: leafAnchor
|
|
28057
|
+
};
|
|
28058
|
+
const path = [leafCertDer];
|
|
28059
|
+
let current = leafCertDer;
|
|
28060
|
+
const maxDepth = intermediates.length + anchors.length + 2;
|
|
28061
|
+
for (let depth = 0; depth < maxDepth; depth++) {
|
|
28062
|
+
const anchor = anchors.find((a) => isIssuerOf(current, a));
|
|
28063
|
+
if (anchor) return {
|
|
28064
|
+
path,
|
|
28065
|
+
complete: true,
|
|
28066
|
+
anchor
|
|
28067
|
+
};
|
|
28068
|
+
const next = intermediates.find((c) => isIssuerOf(current, c) && !path.some((p) => bytesEqual(p, c)));
|
|
28069
|
+
if (!next) return {
|
|
28070
|
+
path,
|
|
28071
|
+
complete: false,
|
|
28072
|
+
anchor: void 0
|
|
28073
|
+
};
|
|
28074
|
+
path.push(next);
|
|
28075
|
+
current = next;
|
|
28076
|
+
}
|
|
28077
|
+
return {
|
|
28078
|
+
path,
|
|
28079
|
+
complete: false,
|
|
28080
|
+
anchor: void 0
|
|
28081
|
+
};
|
|
28082
|
+
}
|
|
28083
|
+
//#endregion
|
|
27844
28084
|
//#region src/render/matrix.ts
|
|
27845
28085
|
/** The identity transform. */
|
|
27846
28086
|
function identity() {
|
|
@@ -31649,15 +31889,15 @@ async function initWasm(options) {
|
|
|
31649
31889
|
if (wasmInitialized) return;
|
|
31650
31890
|
const inits = [];
|
|
31651
31891
|
if (options.deflate || options.deflateWasm) inits.push((async () => {
|
|
31652
|
-
const { initDeflateWasm } = await import("./pdfDocument-
|
|
31892
|
+
const { initDeflateWasm } = await import("./pdfDocument-EcHxUnR6.mjs").then((n) => n.Vt);
|
|
31653
31893
|
await initDeflateWasm(options.deflateWasm);
|
|
31654
31894
|
})());
|
|
31655
31895
|
if (options.png || options.pngWasm) inits.push((async () => {
|
|
31656
|
-
const { initPngWasm } = await import("./pdfDocument-
|
|
31896
|
+
const { initPngWasm } = await import("./pdfDocument-EcHxUnR6.mjs").then((n) => n.Mt);
|
|
31657
31897
|
await initPngWasm(options.pngWasm);
|
|
31658
31898
|
})());
|
|
31659
31899
|
if (options.fonts || options.fontWasm) inits.push((async () => {
|
|
31660
|
-
const { initSubsetWasm } = await import("./pdfDocument-
|
|
31900
|
+
const { initSubsetWasm } = await import("./pdfDocument-EcHxUnR6.mjs").then((n) => n.It);
|
|
31661
31901
|
await initSubsetWasm(options.fontWasm);
|
|
31662
31902
|
})());
|
|
31663
31903
|
if (options.jpeg || options.jpegWasm) inits.push((async () => {
|
|
@@ -31668,6 +31908,6 @@ async function initWasm(options) {
|
|
|
31668
31908
|
wasmInitialized = true;
|
|
31669
31909
|
}
|
|
31670
31910
|
//#endregion
|
|
31671
|
-
export {
|
|
31911
|
+
export { buildCertPath as $, PdfPolygonAnnotation as $a, getProfile as $i, metadataPlugin as $n, readCode39 as $r, gtsPdfVtVersion as $t, buildSoftMaskNone as A, MdpPermission as Aa, webpToJpeg as Ai, reconstructParagraphs as An, RichTextFieldReadError as Ar, checkCertificateStatus as At, redactRegions as B, buildTimestampRequest as Ba, optimizeImage as Bi, toSarif as Bn, ellipsisText as Br, AFDate_FormatEx as Bt, tagTableHeaderCell as C, addCounterSignature as Ca, encodeCode128Values as Ci, buildType5Halftone as Cn, ChangeTracker as Co, InvalidColorError as Cr, decodeTileRegion as Ct, buildImageSoftMask as D, buildFieldLockDict as Da, embedTiffDirect as Di, markdownToPdf as Dn, NoSuchFieldError as Dr, downloadCrl as Dt, buildColorKeyMask as E, addFieldLock as Ea, canDirectEmbed as Ei, evaluateFunction as En, MissingOnValueCheckError as Er, TrustStore as Et, attachAssociatedFiles as F, appendIncrementalUpdate as Fa, extractJpegMetadata as Fi, buildLab as Fn, formatDate$1 as Fr, setFieldValue as Ft, extractImages as G, PdfCaretAnnotation as Ga, generatePdfAXmpBytes as Gi, buildPieceInfo as Gn, applyPreset as Gr, decodeWoff as Gt, compareImages as H, requestTimestamp as Ha, applyRedaction as Hi, PDF2_NAMESPACE as Hn, shrinkFontSize as Hr, parseAcrobatDate as Ht, registerEmbeddedFile as I, findExistingSignatures as Ia, injectJpegMetadata as Ii, labToRgb as In, replaceTemplateVariables as Ir, addVisibilityAction as It, renderPageToCanvas as J, PdfInkAnnotation as Ja, buildAfArray as Ji, buildDPartRoot as Jn, minimalPreset as Jr, readWoffHeader as Jt, generateThumbnail as K, PdfPopupAnnotation as Ka, countOccurrences as Ki, buildRequirement as Kn, applyTablePreset as Kr, isWoff as Kt, RenderCache as L, parseExistingTrailer as La, analyzeJpegMarkers as Li, DEFAULT_SARIF_TOOL_NAME as Ln, toAlpha as Lr, setFieldVisibility as Lt, buildUnencryptedWrapper as M, getCertificationLevel as Ma, convertTiffCmykToRgb as Mi, buildDocTimeStampDict as Mn, UnexpectedFieldTypeError as Mr, createSandbox as Mt, attachOutputIntents as N, setCertificationLevel as Na, embedTiffCmyk as Ni, buildCalGray as Nn, applyHeaderFooter as Nr, getFieldValue as Nt, buildStencilMask as O, getFieldLocks as Oa, encodePngFromPixels as Oi, buildCollection as On, PluginError as Or, extractCrlUrls as Ot, buildPageOutputIntent as P, validateSignatureChain as Pa, isCmykTiff as Pi, buildCalRGB as Pn, applyHeaderFooterToPage as Pr, resolveFieldReference as Pt, interpretPage as Q, PdfPolyLineAnnotation as Qa, validateXmpMetadata as Qi, accessibilityPlugin as Qn, readCode128 as Qr, buildVtDpm as Qt, computeTileGrid as R, saveIncrementalWithSignaturePreservation as Ra, downscaleImage as Ri, SARIF_SCHEMA_URI as Rn, toRoman as Rr, validateFieldValue as Rt, tagTableDataCell as S, hasLtvData as Sa, encodeCode128 as Si, buildType1Halftone as Sn, buildSeparationColorSpace as So, ForeignPageError as Sr, decodeTile as St, buildBlackPointCompensationExtGState as T, diffSignedContent as Ta, PdfWorker as Ti, nameHalftone as Tn, saveIncremental as To, InvalidPageSizeError as Tr, verifySignatureDetailed as Tt, comparePages as U, searchTextItems as Ua, enforcePdfAFull as Ui, buildNamespace as Un, truncateText as Ur, AFNumber_Format as Ut, applyOcr as V, parseTimestampResponse as Va, recompressImage as Vi, MATHML_NAMESPACE as Vn, estimateTextWidth as Vr, formatDate as Vt, extractFonts as W, PdfFileAttachmentAnnotation as Wa, generatePdfAXmp as Wi, buildNamespacesArray as Wn, wrapText$2 as Wr, formatNumber$1 as Wt, renderPageToImage as X, PdfCircleAnnotation as Xa, extractXmpMetadata as Xi, tableToCsv as Xn, stripedPreset as Xr, createWorkerPool as Xt, rasterize as Y, PdfStampAnnotation as Ya, createAssociatedFile as Yi, extractTables as Yn, professionalPreset as Yr, signDeferred as Yt, interpretContentStream as Z, PdfLineAnnotation as Za, parseXmpMetadata as Zi, tableToJson as Zn, readBarcode as Zr, buildPdfVtDParts as Zt, tagLink as _, computeObjectHash as _a, itfToOperators as _i, buildPdfX6OutputIntent as _n, buildXmpMetadata as _o, EncryptedPdfError as _r, normalizeComponentDepth as _t, assembleFacturX as a, getToUnicodeCmap as aa, pdf417ToOperators as ai, generateOrderX as an, PdfFreeTextAnnotation as ao, batchFlatten as ar, validateKeyUsage as at, tagParagraph as b, buildDssDictionary as ba, encodeCode39 as bi, buildSampledTransferFunction as bn, PDFOperator as bo, FieldExistsAsNonTerminalError as br, upscale8To16 as bt, buildWtpdfIdentificationXmp as c, generateSrgbIccProfile as ca, calculateUpcCheckDigit as ci, pdfA4Rules as cn, generateHighlightAppearance as co, addBookmark as cr, findHyphenationPoints as ct, autoTagPage as d, enforcePdfA as da, calculateEanCheckDigit as di, didYouMean as dn, generateSquareAppearance as do, removeBookmark as dr, layoutTextFlow as dt, getSupportedLevels as ea, readEan13 as ei, h as en, PdfSquareAnnotation as eo, timestampPlugin as er, extractEmbeddedRevocationData as et, buildPdfUa2Xmp as f, validatePdfA as fa, ean13ToOperators as fi, levenshtein as fn, generateSquigglyAppearance as fo, flattenField as fr, buildPdfXOutputIntent as ft, tagHeading as g, linearizePdf as ga, encodeItf as gi, buildGtsPdfxVersion as gn, PdfTextAnnotation as go, CombedTextLayoutError as gr, getComponentDepths as gt, tagFigure as h, isLinearized as ha, encodeEan8 as hi, buildBoxDict as hn, PdfLinkAnnotation as ho, BatchProcessingError as hr, downscale16To8 as ht, validateEn16931 as i, generateZapfDingbatsToUnicodeCmap as ia, encodePdf417 as ii, splitByScript as in, PdfUnderlineAnnotation as io, validatePdfUa as ir, validateExtendedKeyUsage as it, buildEncryptedPayload as j, buildDocMdpReference as ja, webpToPng as ji, DEFAULT_DOC_TIMESTAMP_CONTENTS_SIZE as jn, StreamingParseError as jr, extractOcspUrl as jt, buildSoftMaskGroupExtGState as k, detectModifications as ka, recompressWebP as ki, reconstructLines as kn, RemovePageFromEmptyDocumentError as kr, isCertificateRevoked as kt, convertPdfAConformanceXmp as l, detectTransparency as la, encodeUpcA as li, buildFunctionShading as ln, generateInkAppearance as lo, getBookmarks as lr, layoutColumns as lt, LIST_NUMBERING_KEY as m, getLinearizationInfo as ma, encodeEan13 as mi, generateCiiXml as mn, generateUnderlineAppearance as mo, flattenForm as mr, validatePdfX as mt, detectFacturXProfile as n, generateSymbolToUnicodeCmap as na, calculateBarcodeDimensions as ni, createRangeFetcher as nn, PdfSquigglyAnnotation as no, PdfDocumentBuilder as nr, EKU_OIDS as nt, buildFacturXXmp as o, buildOutputIntent as oa, dataMatrixToOperators as oi, generateXRechnungCii as on, generateCircleAppearance as oo, batchMerge as or, buildCertificateChain as ot, validatePdfUa2 as p, delinearizePdf as pa, ean8ToOperators as pi, renderCodeFrame as pn, generateStrikeOutAppearance as po, flattenFields as pr, enforcePdfX as pt, renderDisplayListToCanvas as q, PdfRedactAnnotation as qa, stripProhibitedFeatures as qi, buildRequirements as qn, borderedPreset as qr, isWoff2 as qt, parseCiiXml as r, generateWinAnsiToUnicodeCmap as ra, renderStyledBarcode as ri, resolveFallback as rn, PdfStrikeOutAnnotation as ro, enforcePdfUa as rr, validateCertificatePolicy as rt, buildPdfRIdentificationXmp as s, SRGB_ICC_PROFILE as sa, encodeDataMatrix as si, buildPdfA4Xmp as sn, generateFreeTextAppearance as so, processBatch as sr, validateCertificateChain as st, initWasm as t, isValidLevel as ta, readEan8 as ti, renderToPdf as tn, PdfHighlightAnnotation as to, StreamingPdfParser as tr, verifyOfflineRevocation as tt, preflightPdfA as u, flattenTransparency as ua, upcAToOperators as ui, sampleShadingColor as un, generateLineAppearance as uo, removeAllBookmarks as ur, layoutParagraph as ut, tagList as v, findChangedObjects as va, code39ToOperators as vi, validateBoxGeometry as vn, createXmpStream as vo, ExceededMaxLengthError as vr, offsetSignedToUnsigned as vt, tagTableRow as w, getCounterSignatures as wa, valuesToModules as wi, identityTransferFunction as wn, saveDocumentIncremental as wo, InvalidFieldNamePartError as wr, parseTileInfo as wt, tagTable as x, embedLtvData as xa, code128ToOperators as xi, buildThresholdHalftone as xn, buildDeviceNColorSpace as xo, FontNotEmbeddedError as xr, assembleTiles as xt, tagListItem as y, optimizeIncrementalSave as ya, computeCode39CheckDigit as yi, STANDARD_SPOT_FUNCTIONS as yn, parseXmpMetadata$1 as yo, FieldAlreadyExistsError as yr, summarizeBitDepth as yt, renderPageTile as z, validateByteRangeIntegrity as za, estimateJpegQuality as zi, toJsonReport as zn, applyOverflow as zr, AFSpecial_Format as zt };
|
|
31672
31912
|
|
|
31673
|
-
//# sourceMappingURL=src-
|
|
31913
|
+
//# sourceMappingURL=src-CiUkSS81.mjs.map
|