modern-pdf-lib 0.33.0 → 0.35.0

package/dist/{pdfDocument-Cgkkk8F8.mjs → pdfDocument-Q0wrwKEZ.mjs}

@@ -21926,7 +21926,200 @@ function findSignatures(pdfBytes) {
 	return results;
 }
 //#endregion
+//#region src/signature/cadesAttributes.ts
+/**
+* @module signature/cadesAttributes
+*
+* CAdES-BES / PAdES-B-B baseline signed attributes.
+*
+* Implements the ESS `signing-certificate-v2` attribute that binds a
+* signature to the exact signer certificate that produced it, defeating
+* certificate-substitution attacks.  This is the mandatory signed
+* attribute for the CAdES-BES and PAdES-B-B (a.k.a. PAdES Baseline)
+* conformance levels.
+*
+* Structure (RFC 5035 §3, "ESS Update: Adding CertID Algorithm Agility"):
+* ```
+* id-aa-signingCertificateV2 OBJECT IDENTIFIER ::= { iso(1)
+*     member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
+*     smime(16) id-aa(2) 47 }                       -- 1.2.840.113549.1.9.16.2.47
+*
+* Attribute ::= SEQUENCE {
+*   attrType   OBJECT IDENTIFIER,                   -- id-aa-signingCertificateV2
+*   attrValues SET OF SigningCertificateV2 }
+*
+* SigningCertificateV2 ::= SEQUENCE {
+*   certs    SEQUENCE OF ESSCertIDv2,
+*   policies SEQUENCE OF PolicyInformation OPTIONAL }  -- omitted here
+*
+* ESSCertIDv2 ::= SEQUENCE {
+*   hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256},
+*   certHash      Hash,                              -- OCTET STRING
+*   issuerSerial  IssuerSerial OPTIONAL }            -- omitted here
+*
+* Hash ::= OCTET STRING
+* ```
+*
+* Because `hashAlgorithm` carries `DEFAULT {algorithm id-sha256}`, DER
+* (X.690 §11.5) requires the field to be **omitted** when the hash is
+* SHA-256, and **present** for any other algorithm (e.g. SHA-384,
+* SHA-512).  `certHash` is the digest of the WHOLE DER certificate.
+*
+* References:
+* - RFC 5035 (Enhanced Security Services (ESS) Update — signing-certificate-v2)
+* - ETSI EN 319 122-1 (CAdES baseline) — requires id-aa-signingCertificateV2
+* - ETSI EN 319 142-1 (PAdES baseline) — PAdES-B-B uses the same attribute
+*
+* Every OID and ASN.1 element here was verified against RFC 5035.
+*
+* @packageDocumentation
+*/
+/** id-aa-signingCertificateV2 — RFC 5035 §3. */
+const ID_AA_SIGNING_CERTIFICATE_V2 = "1.2.840.113549.1.9.16.2.47";
+/** Hash algorithm OIDs (NIST CSOR; same values used throughout pkcs7.ts). */
+const SHA256_OID = "2.16.840.1.101.3.4.2.1";
+const SHA384_OID = "2.16.840.1.101.3.4.2.2";
+const SHA512_OID = "2.16.840.1.101.3.4.2.3";
+/** DER literal for an explicit NULL value (tag 0x05, length 0). */
+const DER_NULL = new Uint8Array([5, 0]);
+/**
+* Encode an AlgorithmIdentifier SEQUENCE for a SHA-2 hash with NULL
+* parameters: `SEQUENCE { OID, NULL }`.
+*
+* RFC 5035's ESSCertIDv2 uses the same AlgorithmIdentifier as the rest
+* of the CMS structure; SHA-2 digest algorithms carry NULL parameters
+* (RFC 5754 permits either NULL or absent — we emit NULL to match the
+* digestAlgorithm encoding already used by pkcs7.ts).
+*/
+function encodeHashAlgorithmIdentifier(hashOid) {
+	return encodeSequence([encodeOID(hashOid), DER_NULL]);
+}
+/** Map a Web Crypto hash name to its OID. */
+function hashNameToOid(hash) {
+	switch (hash) {
+		case "SHA-256": return SHA256_OID;
+		case "SHA-384": return SHA384_OID;
+		case "SHA-512": return SHA512_OID;
+		default: throw new Error(`Unsupported hash algorithm: ${String(hash)}`);
+	}
+}
+/**
+* Build the ESS `signing-certificate-v2` signed attribute (RFC 5035).
+*
+* The returned bytes are a complete DER-encoded `Attribute` SEQUENCE
+* suitable for insertion into the CMS `SignedAttributes` SET.
+*
+* Encoding rules applied (verified against RFC 5035):
+* - `hashAlgorithm` is OMITTED when `hashAlgorithm === 'SHA-256'` (the
+*   `DEFAULT {algorithm id-sha256}`), and INCLUDED for SHA-384/SHA-512.
+* - `certHash` is `subtle.digest(hashAlgorithm, <whole DER cert>)`.
+* - `issuerSerial` and `policies` are OPTIONAL and omitted.
+*
+* @param certDer        The DER-encoded X.509 signer certificate.
+* @param hashAlgorithm  The digest used for `certHash`.
+* @returns              DER-encoded `Attribute` SEQUENCE.
+*/
+async function buildSigningCertificateV2Attribute(certDer, hashAlgorithm) {
+	const digestBuffer = await getSubtle().digest(hashAlgorithm, toBuffer(certDer));
+	const certHash = new Uint8Array(digestBuffer);
+	const essCertIdParts = [];
+	if (hashAlgorithm !== "SHA-256") essCertIdParts.push(encodeHashAlgorithmIdentifier(hashNameToOid(hashAlgorithm)));
+	essCertIdParts.push(encodeOctetString(certHash));
+	const signingCertificateV2 = encodeSequence([encodeSequence([encodeSequence(essCertIdParts)])]);
+	return encodeSequence([encodeOID(ID_AA_SIGNING_CERTIFICATE_V2), encodeSet([signingCertificateV2])]);
+}
+/**
+* Best-effort DER scan for the `signing-certificate-v2` attribute inside
+* an encoded `SignedAttributes` SET (or any SET/SEQUENCE OF Attribute).
+*
+* When found, the embedded `certHash` OCTET STRING is returned so callers
+* can compare it against the signer certificate's digest.
+*
+* This walks: SET -> Attribute SEQUENCE { OID, SET { SigningCertificateV2
+* SEQUENCE { certs SEQUENCE OF { ESSCertIDv2 SEQUENCE { [algId], certHash } } } } }.
+*
+* @param signedAttrsDer  DER bytes of a SET (or constructed container) of Attributes.
+* @returns               `{ present, certHash? }`.
+*/
+function extractSigningCertificateV2(signedAttrsDer) {
+	try {
+		const container = parseDerTlv(signedAttrsDer, 0);
+		for (const attr of container.children) {
+			if (attr.tag !== 48 || attr.children.length < 2) continue;
+			const oidNode = attr.children[0];
+			if (oidNode.tag !== 6) continue;
+			if (decodeOidBytes(oidNode.data) !== ID_AA_SIGNING_CERTIFICATE_V2) continue;
+			const signingCertV2 = attr.children[1].children[0];
+			if (!signingCertV2) return {
+				present: true,
+				certHash: void 0
+			};
+			const certsSeqOf = signingCertV2.children[0];
+			if (!certsSeqOf) return {
+				present: true,
+				certHash: void 0
+			};
+			const essCertId = certsSeqOf.children[0];
+			if (!essCertId) return {
+				present: true,
+				certHash: void 0
+			};
+			for (const child of essCertId.children) if (child.tag === 4) return {
+				present: true,
+				certHash: child.data
+			};
+			return {
+				present: true,
+				certHash: void 0
+			};
+		}
+	} catch {}
+	return {
+		present: false,
+		certHash: void 0
+	};
+}
+//#endregion
 //#region src/signature/pkcs7.ts
+/**
+* @module signature/pkcs7
+*
+* PKCS#7 / CMS SignedData structure builder for PDF digital signatures.
+*
+* Builds a minimal but valid PKCS#7 SignedData structure using pure
+* TypeScript ASN.1 DER encoding.  Uses the Web Crypto API for
+* RSASSA-PKCS1-v1_5 or ECDSA signing.
+*
+* Structure overview:
+* ```
+* ContentInfo {
+*   contentType: signedData (1.2.840.113549.1.7.2)
+*   content: SignedData {
+*     version: 1
+*     digestAlgorithms: { SHA-256 }
+*     encapContentInfo: { data (1.2.840.113549.1.7.1) }
+*     certificates: [0] IMPLICIT { certificate }
+*     signerInfos: {
+*       SignerInfo {
+*         version: 1
+*         issuerAndSerialNumber
+*         digestAlgorithm: SHA-256
+*         signedAttrs: { contentType, signingTime, messageDigest }
+*         signatureAlgorithm
+*         signature
+*       }
+*     }
+*   }
+* }
+* ```
+*
+* References:
+* - RFC 5652 (Cryptographic Message Syntax)
+* - RFC 3161 (Internet X.509 PKI Time-Stamp Protocol)
+* - PKCS#7 / CMS SignedData
+*
+* @packageDocumentation
+*/
 /** OID constants for ASN.1 structures. */
 const OID = {
 	signedData: "1.2.840.113549.1.7.2",
@@ -21938,6 +22131,8 @@ const OID = {
 	sha256WithRSA: "1.2.840.113549.1.1.11",
 	sha384WithRSA: "1.2.840.113549.1.1.12",
 	sha512WithRSA: "1.2.840.113549.1.1.13",
+	rsaPss: "1.2.840.113549.1.1.10",
+	mgf1: "1.2.840.113549.1.1.8",
 	ecPublicKey: "1.2.840.10045.2.1",
 	ecdsaWithSHA256: "1.2.840.10045.4.3.2",
 	ecdsaWithSHA384: "1.2.840.10045.4.3.3",
@@ -22188,6 +22383,52 @@ function encodeSignatureAlgorithm(keyAlgo, hashAlgo) {
 	throw new Error(`Unsupported key algorithm: ${keyAlgo}`);
 }
 /**
+* Encode the AlgorithmIdentifier for an RSASSA-PSS signature (RFC 4055 §3.1).
+*
+* ```
+* AlgorithmIdentifier ::= SEQUENCE {
+*   algorithm  id-RSASSA-PSS,                       -- 1.2.840.113549.1.1.10
+*   parameters RSASSA-PSS-params }
+*
+* RSASSA-PSS-params ::= SEQUENCE {
+*   hashAlgorithm    [0] HashAlgorithm    DEFAULT sha1Identifier,
+*   maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1Identifier,
+*   saltLength       [2] INTEGER          DEFAULT 20,
+*   trailerField     [3] INTEGER          DEFAULT 1 }
+* ```
+*
+* The `[0]`/`[1]`/`[2]` tags are EXPLICIT (the fields are tagged in the
+* ASN.1 module without `IMPLICIT`, and the CMS modules import EXPLICIT
+* tagging by default), so each wraps the full underlying TLV.  Per
+* RFC 4055, when the hash is SHA-256 the hashAlgorithm AlgorithmIdentifier
+* is `{ id-sha256, NULL }` and the maskGenAlgorithm is
+* `{ id-mgf1, { id-sha256, NULL } }`.  `trailerField` is the default (1)
+* and is omitted (RFC 4055 mandates generators omit it).
+*
+* Salt length equals the hash output length: 32 (SHA-256), 48 (SHA-384),
+* 64 (SHA-512).
+*/
+function encodeRsaPssSignatureAlgorithm(hashAlgo) {
+	const hashOid = HASH_OID_MAP[hashAlgo];
+	if (!hashOid) throw new Error(`Unsupported hash for RSA-PSS: ${hashAlgo}`);
+	const saltLength = PSS_SALT_LENGTH[hashAlgo];
+	if (saltLength === void 0) throw new Error(`Unsupported hash for RSA-PSS: ${hashAlgo}`);
+	const hashAlgId = encodeSequence([encodeOID(hashOid), encodeTlv(TAG.NULL, /* @__PURE__ */ new Uint8Array(0))]);
+	const mgfAlgId = encodeSequence([encodeOID(OID.mgf1), hashAlgId]);
+	const params = encodeSequence([
+		encodeContextTag(0, hashAlgId),
+		encodeContextTag(1, mgfAlgId),
+		encodeContextTag(2, encodeIntegerValue(saltLength))
+	]);
+	return encodeSequence([encodeOID(OID.rsaPss), params]);
+}
+/** PSS salt length (= hash output length in bytes) per hash algorithm. */
+const PSS_SALT_LENGTH = {
+	"SHA-256": 32,
+	"SHA-384": 48,
+	"SHA-512": 64
+};
+/**
 * Parse a single DER TLV from a byte array at the given offset.
 */
 function parseDerTlv(data, offset) {
@@ -22351,11 +22592,11 @@ function getSubtle() {
 /**
 * Import a PKCS#8 private key for signing.
 */
-async function importPrivateKey(pkcs8Der, keyAlgorithm, hashAlgorithm, namedCurve) {
+async function importPrivateKey(pkcs8Der, keyAlgorithm, hashAlgorithm, namedCurve, rsaScheme = "pkcs1v15") {
 	const subtle = getSubtle();
 	let algorithm;
 	if (keyAlgorithm === "RSA") algorithm = {
-		name: "RSASSA-PKCS1-v1_5",
+		name: rsaScheme === "pss" ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
 		hash: hashAlgorithm
 	};
 	else algorithm = {
@@ -22367,10 +22608,17 @@ async function importPrivateKey(pkcs8Der, keyAlgorithm, hashAlgorithm, namedCurv
 /**
 * Sign data using the imported private key.
 */
-async function signData(key, data, keyAlgorithm, hashAlgorithm) {
+async function signData(key, data, keyAlgorithm, hashAlgorithm, rsaScheme = "pkcs1v15") {
 	const subtle = getSubtle();
 	let algorithm;
-	if (keyAlgorithm === "RSA") algorithm = { name: "RSASSA-PKCS1-v1_5" };
+	if (keyAlgorithm === "RSA") if (rsaScheme === "pss") {
+		const saltLength = PSS_SALT_LENGTH[hashAlgorithm];
+		if (saltLength === void 0) throw new Error(`Unsupported hash for RSA-PSS: ${hashAlgorithm}`);
+		algorithm = {
+			name: "RSA-PSS",
+			saltLength
+		};
+	} else algorithm = { name: "RSASSA-PKCS1-v1_5" };
 	else algorithm = {
 		name: "ECDSA",
 		hash: hashAlgorithm
@@ -22394,11 +22642,12 @@ async function buildPkcs7Signature(dataHash, options) {
 	const hashAlgorithm = signerInfoOpts.hashAlgorithm;
 	const keyAlgo = detectKeyAlgorithm(signerInfoOpts.certificate);
 	const namedCurve = keyAlgo === "EC" ? detectNamedCurve(signerInfoOpts.certificate) : void 0;
+	const rsaScheme = keyAlgo === "RSA" && signerInfoOpts.signatureScheme === "pss" ? "pss" : "pkcs1v15";
 	const { issuerDer, serialDer } = extractIssuerAndSerial(signerInfoOpts.certificate);
-	const privateKey = await importPrivateKey(signerInfoOpts.privateKey, keyAlgo, hashAlgorithm, namedCurve);
-	const signedAttrs = buildSignedAttributes(dataHash, hashAlgorithm, options.signingDate ?? /* @__PURE__ */ new Date());
-	const signatureValue = await signData(privateKey, encodeSet(signedAttrs), keyAlgo, hashAlgorithm);
-	const signerInfoValue = buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgo, signedAttrs, keyAlgo === "EC" ? convertEcdsaToDer(signatureValue) : signatureValue);
+	const privateKey = await importPrivateKey(signerInfoOpts.privateKey, keyAlgo, hashAlgorithm, namedCurve, rsaScheme);
+	const signedAttrs = await buildSignedAttributes(dataHash, hashAlgorithm, options.signingDate ?? /* @__PURE__ */ new Date(), options.cades === true ? signerInfoOpts.certificate : void 0);
+	const signatureValue = await signData(privateKey, encodeSet(signedAttrs), keyAlgo, hashAlgorithm, rsaScheme);
+	const signerInfoValue = buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgo, signedAttrs, keyAlgo === "EC" ? convertEcdsaToDer(signatureValue) : signatureValue, rsaScheme);
 	const signedData = buildSignedData(hashAlgorithm, signerInfoOpts.certificate, signerInfoValue);
 	return encodeSequence([encodeOID(OID.signedData), encodeContextTag(0, signedData)]);
 }
@@ -22409,24 +22658,61 @@ async function buildPkcs7Signature(dataHash, options) {
 * 1. contentType (data)
 * 2. signingTime
 * 3. messageDigest (the hash of the PDF content)
-*/
-function buildSignedAttributes(dataHash, _hashAlgorithm, signingTime) {
-	return [
-		encodeSequence([encodeOID(OID.contentType), encodeSet([encodeOID(OID.data)])]),
-		encodeSequence([encodeOID(OID.signingTime), encodeSet([encodeUTCTime(signingTime)])]),
-		encodeSequence([encodeOID(OID.messageDigest), encodeSet([encodeOctetString(dataHash)])])
+*
+* When `cadesCertDer` is provided, the ESS `signing-certificate-v2`
+* attribute (RFC 5035) is added and the whole SET OF is re-sorted into
+* DER order (X.690 §11.6) so the resulting SignedAttributes encoding is
+* valid.  When omitted, the original three attributes are returned in
+* their original order so the output stays byte-identical to prior
+* versions.
+*/
+async function buildSignedAttributes(dataHash, _hashAlgorithm, signingTime, cadesCertDer) {
+	const contentTypeAttr = encodeSequence([encodeOID(OID.contentType), encodeSet([encodeOID(OID.data)])]);
+	const signingTimeAttr = encodeSequence([encodeOID(OID.signingTime), encodeSet([encodeUTCTime(signingTime)])]);
+	const messageDigestAttr = encodeSequence([encodeOID(OID.messageDigest), encodeSet([encodeOctetString(dataHash)])]);
+	if (cadesCertDer === void 0) return [
+		contentTypeAttr,
+		signingTimeAttr,
+		messageDigestAttr
 	];
+	return sortDerSetMembers([
+		contentTypeAttr,
+		signingTimeAttr,
+		messageDigestAttr,
+		await buildSigningCertificateV2Attribute(cadesCertDer, _hashAlgorithm)
+	]);
+}
+/**
+* Sort the members of a SET OF into DER canonical order (X.690 §11.6):
+* by ascending lexicographic comparison of their complete DER encodings,
+* padding the shorter encoding with conceptual trailing zero octets.
+*/
+function sortDerSetMembers(members) {
+	return [...members].sort(compareDerEncodings);
+}
+/**
+* Compare two DER encodings as unsigned octet strings, treating a
+* shorter array as if padded with trailing zero octets (X.690 §11.6).
+*/
+function compareDerEncodings(a, b) {
+	const len = Math.max(a.length, b.length);
+	for (let i = 0; i < len; i++) {
+		const av = a[i] ?? 0;
+		const bv = b[i] ?? 0;
+		if (av !== bv) return av - bv;
+	}
+	return 0;
 }
 /**
 * Build a SignerInfo SEQUENCE.
 */
-function buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgorithm, signedAttrs, signatureValue) {
+function buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgorithm, signedAttrs, signatureValue, rsaScheme = "pkcs1v15") {
 	return encodeSequence([
 		encodeIntegerValue(1),
 		encodeSequence([issuerDer, serialDer]),
 		encodeDigestAlgorithm(hashAlgorithm),
 		encodeContextTag(0, concat(...signedAttrs)),
-		encodeSignatureAlgorithm(keyAlgorithm, hashAlgorithm),
+		keyAlgorithm === "RSA" && rsaScheme === "pss" ? encodeRsaPssSignatureAlgorithm(hashAlgorithm) : encodeSignatureAlgorithm(keyAlgorithm, hashAlgorithm),
 		encodeOctetString(signatureValue)
 	]);
 }
@@ -22725,6 +23011,9 @@ function parsePkcs7Structure(pkcs7Bytes) {
 			signedAttrsRaw = encodeSet(signedAttrs);
 			idx++;
 		}
+		let signatureAlgorithmOid = "";
+		const sigAlgoNode = signerInfo.children[idx];
+		if (sigAlgoNode && sigAlgoNode.children.length > 0) signatureAlgorithmOid = decodeOidBytes(sigAlgoNode.children[0].data);
 		idx++;
 		const signatureNode = signerInfo.children[idx];
 		const signatureValue = signatureNode ? signatureNode.data : /* @__PURE__ */ new Uint8Array(0);
@@ -22733,7 +23022,8 @@ function parsePkcs7Structure(pkcs7Bytes) {
 			signedAttrs,
 			signedAttrsRaw,
 			signatureValue,
-			digestAlgorithm
+			digestAlgorithm,
+			signatureAlgorithmOid
 		};
 	} catch {
 		return null;
@@ -22881,6 +23171,23 @@ async function verifySignatures(pdfBytes) {
 		} catch {
 			certificateValid = false;
 		}
+		let cadesSigningCertPresent;
+		let cadesSigningCertHashValid;
+		try {
+			const ess = extractSigningCertificateV2(parsed.signedAttrsRaw);
+			cadesSigningCertPresent = ess.present;
+			if (ess.present && ess.certHash) {
+				const algo = {
+					32: "SHA-256",
+					48: "SHA-384",
+					64: "SHA-512"
+				}[ess.certHash.length];
+				if (algo) {
+					const digest = new Uint8Array(await getSubtle().digest(algo, toBuffer(parsed.certificate)));
+					cadesSigningCertHashValid = digest.length === ess.certHash.length && digest.every((b, i) => b === ess.certHash[i]);
+				}
+			}
+		} catch {}
 		results.push({
 			fieldName: fieldInfo.fieldName,
 			signedBy,
@@ -22888,7 +23195,9 @@ async function verifySignatures(pdfBytes) {
 			integrityValid,
 			certificateValid,
 			signingDate,
-			reason: fieldInfo.reason
+			reason: fieldInfo.reason,
+			cadesSigningCertPresent,
+			cadesSigningCertHashValid
 		});
 	}
 	return results;
@@ -22911,17 +23220,33 @@ async function verifySignature(pdfBytes, byteRange, signatureBytes, certificateB
 		if (!parsed) return false;
 		const subtle = getSubtle();
 		const keyAlgo = detectKeyAlgorithm(certificateBytes);
+		const isPss = parsed.signatureAlgorithmOid === "1.2.840.113549.1.1.10";
+		const PSS_SALT_LENGTH = {
+			"SHA-256": 32,
+			"SHA-384": 48,
+			"SHA-512": 64
+		};
 		const spki = extractSubjectPublicKeyInfo(certificateBytes);
 		let importAlgo;
 		let verifyAlgo;
 		let sigBytes = parsed.signatureValue;
-		if (keyAlgo === "RSA") {
+		if (keyAlgo === "RSA") if (isPss) {
+			importAlgo = {
+				name: "RSA-PSS",
+				hash: parsed.digestAlgorithm
+			};
+			verifyAlgo = {
+				name: "RSA-PSS",
+				saltLength: PSS_SALT_LENGTH[parsed.digestAlgorithm] ?? 32
+			};
+		} else {
 			importAlgo = {
 				name: "RSASSA-PKCS1-v1_5",
 				hash: parsed.digestAlgorithm
 			};
 			verifyAlgo = { name: "RSASSA-PKCS1-v1_5" };
-		} else {
+		}
+		else {
 			const namedCurve = detectNamedCurve(certificateBytes);
 			importAlgo = {
 				name: "ECDSA",
@@ -25659,6 +25984,6 @@ function createPdf() {
 	return new PdfDocument();
 }
 //#endregion
-export { PdfOutlineTree as $, deviceNColor as $n, setCharacterSpacing as $r, getRedactionMarks as $t, encodeUTCTime as A, endArtifact as An, curveToFinal as Ar, pngEmbed_exports as At, prepareForSigning as B, rotationMatrix as Bn, rectangle as Br, PageSizes as Bt, encodeInteger as C, pdfCatalog_exports as Cn, clip as Cr, parseTiffIfd as Ct, encodePrintableString as D, beginMarkedContentSequence as Dn, closeFillEvenOddAndStroke as Dr, detectImageFormat as Dt, encodeOctetString as E, beginMarkedContent as En, closeFillAndStroke as Er, isWebPLossless as Et, parseDerTlv as F, degreesToRadians as Fn, fillAndStroke as Fr, extractMetrics as Ft, isAccessible as G, translate as Gn, setLineWidth as Gr, encodeQrCode as Gt, mergePdfs as H, scale as Hn, setFlatness as Hr, wrapText as Ht, toBuffer as I, radians as In, fillEvenOdd as Ir, PdfStreamWriter as It, PdfStructureTree as J, cmyk as Jn, beginText as Jr, buildPatternObjects as Jt, summarizeIssues as K, applyFillColor as Kn, setMiterLimit as Kr, qrCodeToOperators as Kt, computeSignatureHash as L, radiansToDegrees as Ln, fillEvenOddAndStroke as Lr, PdfWriter as Lt, extractIssuerAndSerial as M, wrapInMarkedContent as Mn, ellipsePath as Mr, isTrueType as Mt, extractSubjectPublicKeyInfo as N, concatMatrix as Nn, endPath as Nr, EmbeddedFont as Nt, encodeSequence as O, beginMarkedContentWithProperties as On, closePath as Or, getImageFormatName as Ot, getSubtle as P, degrees as Pn, fill as Pr, fontSubset_exports as Pt, PdfOutlineItem as Q, componentsToColor as Qn, nextLine as Qr, applyRedactions as Qt, embedSignature as R, restoreState as Rn, lineTo as Rr, serializePdf as Rt, encodeContextTag as S, formatPdfDate$1 as Sn, circlePath as Sr, isTiff as St, encodeOID as T, beginArtifactWithType as Tn, closeAndStroke as Tr, isWebP as Tt, splitPdf as U, setGraphicsState as Un, setLineCap as Ur, renderMultiPageTable as Ut, copyPages as V, saveState as Vn, setDashPattern as Vr, PdfPage as Vt, checkAccessibility as W, skew as Wn, setLineJoin as Wr, renderTable as Wt, buildViewerPreferencesDict as X, colorToComponents as Xn, moveText as Xr, radialGradient as Xt, PdfViewerPreferences as Y, cmykToRgb as Yn, endText as Yr, linearGradient as Yt, parseViewerPreferences as Z, colorToHex as Zn, moveTextSetLeading as Zr, tilingPattern as Zt, signPdf as _, createAnnotation as _n, spotColor as _r, formatHexContext as _t, getPageLabels as a, setTextRise as ai, drawSvgOnPage as an, setColorSpace as ar, sha256 as at, detectKeyAlgorithm as b, buildInfoDict as bn, drawImageXObject as br, decodeTiffPage as bt, embedPageAsFormXObject as c, showTextArray as ci, interpolateLinearRgb as cn, setFillColorGray as cr, decodePermissions as ct, attachFile as d, showTextWithSpacing as di, parseSvgPath as dn, setStrokeColor as dr, aesEncryptCBC as dt, setFont as ei, markForRedaction as en, deviceNResourceName as er, loadPdf as et, buildEmbeddedFilesNameTree as f, parseSvgTransform as fn, setStrokeColorCmyk as fr, rc4 as ft, getSignatures as g, buildAnnotationDict as gn, setStrokingColor as gr, PdfParseError as gt, verifySignatures as h, annotationFromDict as hn, setStrokeColorSpace as hr, base64Encode as ht, PdfPluginManager as i, setTextRenderingMode as ii, endLayerContent as in, rgbToCmyk as ir, verifyUserPassword as it, encodeUtf8String as j, endMarkedContent as jn, curveToInitial as jr, isOpenTypeCFF as jt, encodeSet as k, createMarkedContentScope as kn, curveTo as kr, getSupportedFormats as kt, addWatermark as l, showTextHex as li, parseSvg as ln, setFillColorRgb as lr, encodePermissions as lt, verifySignature as m, PdfAnnotation as mn, setStrokeColorRgb as mr, base64Decode as mt, StandardFonts as n, setLeading as ni, PdfLayerManager as nn, hexToColor as nr, computeFileEncryptionKey as nt, removePageLabels as o, setWordSpacing as oi, svgToPdfOperators as on, setFillColor as or, sha384 as ot, getAttachments as p, AnnotationFlags as pn, setStrokeColorGray as pr, md5 as pt, PdfStructureElement as q, applyStrokeColor as qn, stroke as qr, buildGradientObjects as qt, createPdf as r, setTextMatrix as ri, beginLayerContent as rn, rgb as rr, verifyOwnerPassword as rt, setPageLabels as s, showText as si, applySpreadMethod as sn, setFillColorCmyk as sr, sha512 as st, PdfDocument as t, setFontSize as ti, PdfLayer as tn, grayscale as tr, PdfEncryptionHandler as tt, addWatermarkToPage as u, showTextNextLine as ui, parseSvgColor as un, setFillingColor as ur, aesDecryptCBC as ut, buildPkcs7Signature as v, buildCatalog as vn, spotResourceName as vr, decodeTiff as vt, encodeLength as w, beginArtifact as wn, clipEvenOdd as wr, decodeWebP as wt, detectNamedCurve as x, buildPageTree as xn, drawXObject as xr, getTiffPageCount as xt, decodeOidBytes as y, buildDocumentStructure as yn, drawImageWithMatrix as yr, decodeTiffAll as yt, findSignatures as z, rotate as zn, moveTo as zr, libdeflateWasm_exports as zt };
+export { parseViewerPreferences as $, cmyk as $n, beginText as $r, buildPatternObjects as $t, encodeUTCTime as A, beginArtifactWithType as An, closeAndStroke as Ar, isWebP as At, embedSignature as B, degreesToRadians as Bn, fillAndStroke as Br, extractMetrics as Bt, encodeInteger as C, buildCatalog as Cn, spotResourceName as Cr, decodeTiff as Ct, encodePrintableString as D, formatPdfDate$1 as Dn, circlePath as Dr, isTiff as Dt, encodeOctetString as E, buildPageTree as En, drawXObject as Er, getTiffPageCount as Et, parseDerTlv as F, endArtifact as Fn, curveToFinal as Fr, pngEmbed_exports as Ft, splitPdf as G, rotationMatrix as Gn, rectangle as Gr, PageSizes as Gt, prepareForSigning as H, radiansToDegrees as Hn, fillEvenOddAndStroke as Hr, PdfWriter as Ht, toBuffer as I, endMarkedContent as In, curveToInitial as Ir, isOpenTypeCFF as It, summarizeIssues as J, setGraphicsState as Jn, setLineCap as Jr, renderMultiPageTable as Jt, checkAccessibility as K, saveState as Kn, setDashPattern as Kr, PdfPage as Kt, buildSigningCertificateV2Attribute as L, wrapInMarkedContent as Ln, ellipsePath as Lr, isTrueType as Lt, extractIssuerAndSerial as M, beginMarkedContentSequence as Mn, closeFillEvenOddAndStroke as Mr, detectImageFormat as Mt, extractSubjectPublicKeyInfo as N, beginMarkedContentWithProperties as Nn, closePath as Nr, getImageFormatName as Nt, encodeSequence as O, pdfCatalog_exports as On, clip as Or, parseTiffIfd as Ot, getSubtle as P, createMarkedContentScope as Pn, curveTo as Pr, getSupportedFormats as Pt, buildViewerPreferencesDict as Q, applyStrokeColor as Qn, stroke as Qr, buildGradientObjects as Qt, extractSigningCertificateV2 as R, concatMatrix as Rn, endPath as Rr, EmbeddedFont as Rt, encodeContextTag as S, createAnnotation as Sn, spotColor as Sr, formatHexContext as St, encodeOID as T, buildInfoDict as Tn, drawImageXObject as Tr, decodeTiffPage as Tt, copyPages as U, restoreState as Un, lineTo as Ur, serializePdf as Ut, findSignatures as V, radians as Vn, fillEvenOdd as Vr, PdfStreamWriter as Vt, mergePdfs as W, rotate as Wn, moveTo as Wr, libdeflateWasm_exports as Wt, PdfStructureTree as X, translate as Xn, setLineWidth as Xr, encodeQrCode as Xt, PdfStructureElement as Y, skew as Yn, setLineJoin as Yr, renderTable as Yt, PdfViewerPreferences as Z, applyFillColor as Zn, setMiterLimit as Zr, qrCodeToOperators as Zt, signPdf as _, parseSvgTransform as _n, setStrokeColorCmyk as _r, base64Encode as _t, getPageLabels as a, setFont as ai, markForRedaction as an, deviceNResourceName as ar, verifyOwnerPassword as at, detectKeyAlgorithm as b, annotationFromDict as bn, setStrokeColorSpace as br, PdfLexer as bt, embedPageAsFormXObject as c, setTextMatrix as ci, beginLayerContent as cn, rgb as cr, sha384 as ct, attachFile as d, setWordSpacing as di, svgToPdfOperators as dn, setFillColor as dr, encodePermissions as dt, endText as ei, linearGradient as en, cmykToRgb as er, PdfOutlineItem as et, buildEmbeddedFilesNameTree as f, showText as fi, applySpreadMethod as fn, setFillColorCmyk as fr, aesDecryptCBC as ft, getSignatures as g, showTextWithSpacing as gi, parseSvgPath as gn, setStrokeColor as gr, base64Decode as gt, verifySignatures as h, showTextNextLine as hi, parseSvgColor as hn, setFillingColor as hr, md5 as ht, PdfPluginManager as i, setCharacterSpacing as ii, getRedactionMarks as in, deviceNColor as ir, computeFileEncryptionKey as it, encodeUtf8String as j, beginMarkedContent as jn, closeFillAndStroke as jr, isWebPLossless as jt, encodeSet as k, beginArtifact as kn, clipEvenOdd as kr, decodeWebP as kt, addWatermark as l, setTextRenderingMode as li, endLayerContent as ln, rgbToCmyk as lr, sha512 as lt, verifySignature as m, showTextHex as mi, parseSvg as mn, setFillColorRgb as mr, rc4 as mt, StandardFonts as n, moveTextSetLeading as ni, tilingPattern as nn, colorToHex as nr, loadPdf as nt, removePageLabels as o, setFontSize as oi, PdfLayer as on, grayscale as or, verifyUserPassword as ot, getAttachments as p, showTextArray as pi, interpolateLinearRgb as pn, setFillColorGray as pr, aesEncryptCBC as pt, isAccessible as q, scale as qn, setFlatness as qr, wrapText as qt, createPdf as r, nextLine as ri, applyRedactions as rn, componentsToColor as rr, PdfEncryptionHandler as rt, setPageLabels as s, setLeading as si, PdfLayerManager as sn, hexToColor as sr, sha256 as st, PdfDocument as t, moveText as ti, radialGradient as tn, colorToComponents as tr, PdfOutlineTree as tt, addWatermarkToPage as u, setTextRise as ui, drawSvgOnPage as un, setColorSpace as ur, decodePermissions as ut, buildPkcs7Signature as v, AnnotationFlags as vn, setStrokeColorGray as vr, XrefParser as vt, encodeLength as w, buildDocumentStructure as wn, drawImageWithMatrix as wr, decodeTiffAll as wt, detectNamedCurve as x, buildAnnotationDict as xn, setStrokingColor as xr, PdfParseError as xt, decodeOidBytes as y, PdfAnnotation as yn, setStrokeColorRgb as yr, PdfObjectParser as yt, computeSignatureHash as z, degrees as zn, fill as zr, fontSubset_exports as zt };
 
-//# sourceMappingURL=pdfDocument-Cgkkk8F8.mjs.map
+//# sourceMappingURL=pdfDocument-Q0wrwKEZ.mjs.map