modern-pdf-lib 0.33.0 → 0.35.0

package/dist/{pdfDocument-Bh4ebDqE.cjs → pdfDocument-D5qz7duP.cjs}

@@ -21926,7 +21926,200 @@ function findSignatures(pdfBytes) {
 	return results;
 }
 //#endregion
+//#region src/signature/cadesAttributes.ts
+/**
+* @module signature/cadesAttributes
+*
+* CAdES-BES / PAdES-B-B baseline signed attributes.
+*
+* Implements the ESS `signing-certificate-v2` attribute that binds a
+* signature to the exact signer certificate that produced it, defeating
+* certificate-substitution attacks.  This is the mandatory signed
+* attribute for the CAdES-BES and PAdES-B-B (a.k.a. PAdES Baseline)
+* conformance levels.
+*
+* Structure (RFC 5035 §3, "ESS Update: Adding CertID Algorithm Agility"):
+* ```
+* id-aa-signingCertificateV2 OBJECT IDENTIFIER ::= { iso(1)
+*     member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
+*     smime(16) id-aa(2) 47 }                       -- 1.2.840.113549.1.9.16.2.47
+*
+* Attribute ::= SEQUENCE {
+*   attrType   OBJECT IDENTIFIER,                   -- id-aa-signingCertificateV2
+*   attrValues SET OF SigningCertificateV2 }
+*
+* SigningCertificateV2 ::= SEQUENCE {
+*   certs    SEQUENCE OF ESSCertIDv2,
+*   policies SEQUENCE OF PolicyInformation OPTIONAL }  -- omitted here
+*
+* ESSCertIDv2 ::= SEQUENCE {
+*   hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256},
+*   certHash      Hash,                              -- OCTET STRING
+*   issuerSerial  IssuerSerial OPTIONAL }            -- omitted here
+*
+* Hash ::= OCTET STRING
+* ```
+*
+* Because `hashAlgorithm` carries `DEFAULT {algorithm id-sha256}`, DER
+* (X.690 §11.5) requires the field to be **omitted** when the hash is
+* SHA-256, and **present** for any other algorithm (e.g. SHA-384,
+* SHA-512).  `certHash` is the digest of the WHOLE DER certificate.
+*
+* References:
+* - RFC 5035 (Enhanced Security Services (ESS) Update — signing-certificate-v2)
+* - ETSI EN 319 122-1 (CAdES baseline) — requires id-aa-signingCertificateV2
+* - ETSI EN 319 142-1 (PAdES baseline) — PAdES-B-B uses the same attribute
+*
+* Every OID and ASN.1 element here was verified against RFC 5035.
+*
+* @packageDocumentation
+*/
+/** id-aa-signingCertificateV2 — RFC 5035 §3. */
+const ID_AA_SIGNING_CERTIFICATE_V2 = "1.2.840.113549.1.9.16.2.47";
+/** Hash algorithm OIDs (NIST CSOR; same values used throughout pkcs7.ts). */
+const SHA256_OID = "2.16.840.1.101.3.4.2.1";
+const SHA384_OID = "2.16.840.1.101.3.4.2.2";
+const SHA512_OID = "2.16.840.1.101.3.4.2.3";
+/** DER literal for an explicit NULL value (tag 0x05, length 0). */
+const DER_NULL = new Uint8Array([5, 0]);
+/**
+* Encode an AlgorithmIdentifier SEQUENCE for a SHA-2 hash with NULL
+* parameters: `SEQUENCE { OID, NULL }`.
+*
+* RFC 5035's ESSCertIDv2 uses the same AlgorithmIdentifier as the rest
+* of the CMS structure; SHA-2 digest algorithms carry NULL parameters
+* (RFC 5754 permits either NULL or absent — we emit NULL to match the
+* digestAlgorithm encoding already used by pkcs7.ts).
+*/
+function encodeHashAlgorithmIdentifier(hashOid) {
+	return encodeSequence([encodeOID(hashOid), DER_NULL]);
+}
+/** Map a Web Crypto hash name to its OID. */
+function hashNameToOid(hash) {
+	switch (hash) {
+		case "SHA-256": return SHA256_OID;
+		case "SHA-384": return SHA384_OID;
+		case "SHA-512": return SHA512_OID;
+		default: throw new Error(`Unsupported hash algorithm: ${String(hash)}`);
+	}
+}
+/**
+* Build the ESS `signing-certificate-v2` signed attribute (RFC 5035).
+*
+* The returned bytes are a complete DER-encoded `Attribute` SEQUENCE
+* suitable for insertion into the CMS `SignedAttributes` SET.
+*
+* Encoding rules applied (verified against RFC 5035):
+* - `hashAlgorithm` is OMITTED when `hashAlgorithm === 'SHA-256'` (the
+*   `DEFAULT {algorithm id-sha256}`), and INCLUDED for SHA-384/SHA-512.
+* - `certHash` is `subtle.digest(hashAlgorithm, <whole DER cert>)`.
+* - `issuerSerial` and `policies` are OPTIONAL and omitted.
+*
+* @param certDer        The DER-encoded X.509 signer certificate.
+* @param hashAlgorithm  The digest used for `certHash`.
+* @returns              DER-encoded `Attribute` SEQUENCE.
+*/
+async function buildSigningCertificateV2Attribute(certDer, hashAlgorithm) {
+	const digestBuffer = await getSubtle().digest(hashAlgorithm, toBuffer(certDer));
+	const certHash = new Uint8Array(digestBuffer);
+	const essCertIdParts = [];
+	if (hashAlgorithm !== "SHA-256") essCertIdParts.push(encodeHashAlgorithmIdentifier(hashNameToOid(hashAlgorithm)));
+	essCertIdParts.push(encodeOctetString(certHash));
+	const signingCertificateV2 = encodeSequence([encodeSequence([encodeSequence(essCertIdParts)])]);
+	return encodeSequence([encodeOID(ID_AA_SIGNING_CERTIFICATE_V2), encodeSet([signingCertificateV2])]);
+}
+/**
+* Best-effort DER scan for the `signing-certificate-v2` attribute inside
+* an encoded `SignedAttributes` SET (or any SET/SEQUENCE OF Attribute).
+*
+* When found, the embedded `certHash` OCTET STRING is returned so callers
+* can compare it against the signer certificate's digest.
+*
+* This walks: SET -> Attribute SEQUENCE { OID, SET { SigningCertificateV2
+* SEQUENCE { certs SEQUENCE OF { ESSCertIDv2 SEQUENCE { [algId], certHash } } } } }.
+*
+* @param signedAttrsDer  DER bytes of a SET (or constructed container) of Attributes.
+* @returns               `{ present, certHash? }`.
+*/
+function extractSigningCertificateV2(signedAttrsDer) {
+	try {
+		const container = parseDerTlv(signedAttrsDer, 0);
+		for (const attr of container.children) {
+			if (attr.tag !== 48 || attr.children.length < 2) continue;
+			const oidNode = attr.children[0];
+			if (oidNode.tag !== 6) continue;
+			if (decodeOidBytes(oidNode.data) !== ID_AA_SIGNING_CERTIFICATE_V2) continue;
+			const signingCertV2 = attr.children[1].children[0];
+			if (!signingCertV2) return {
+				present: true,
+				certHash: void 0
+			};
+			const certsSeqOf = signingCertV2.children[0];
+			if (!certsSeqOf) return {
+				present: true,
+				certHash: void 0
+			};
+			const essCertId = certsSeqOf.children[0];
+			if (!essCertId) return {
+				present: true,
+				certHash: void 0
+			};
+			for (const child of essCertId.children) if (child.tag === 4) return {
+				present: true,
+				certHash: child.data
+			};
+			return {
+				present: true,
+				certHash: void 0
+			};
+		}
+	} catch {}
+	return {
+		present: false,
+		certHash: void 0
+	};
+}
+//#endregion
 //#region src/signature/pkcs7.ts
+/**
+* @module signature/pkcs7
+*
+* PKCS#7 / CMS SignedData structure builder for PDF digital signatures.
+*
+* Builds a minimal but valid PKCS#7 SignedData structure using pure
+* TypeScript ASN.1 DER encoding.  Uses the Web Crypto API for
+* RSASSA-PKCS1-v1_5 or ECDSA signing.
+*
+* Structure overview:
+* ```
+* ContentInfo {
+*   contentType: signedData (1.2.840.113549.1.7.2)
+*   content: SignedData {
+*     version: 1
+*     digestAlgorithms: { SHA-256 }
+*     encapContentInfo: { data (1.2.840.113549.1.7.1) }
+*     certificates: [0] IMPLICIT { certificate }
+*     signerInfos: {
+*       SignerInfo {
+*         version: 1
+*         issuerAndSerialNumber
+*         digestAlgorithm: SHA-256
+*         signedAttrs: { contentType, signingTime, messageDigest }
+*         signatureAlgorithm
+*         signature
+*       }
+*     }
+*   }
+* }
+* ```
+*
+* References:
+* - RFC 5652 (Cryptographic Message Syntax)
+* - RFC 3161 (Internet X.509 PKI Time-Stamp Protocol)
+* - PKCS#7 / CMS SignedData
+*
+* @packageDocumentation
+*/
 /** OID constants for ASN.1 structures. */
 const OID = {
 	signedData: "1.2.840.113549.1.7.2",
@@ -21938,6 +22131,8 @@ const OID = {
 	sha256WithRSA: "1.2.840.113549.1.1.11",
 	sha384WithRSA: "1.2.840.113549.1.1.12",
 	sha512WithRSA: "1.2.840.113549.1.1.13",
+	rsaPss: "1.2.840.113549.1.1.10",
+	mgf1: "1.2.840.113549.1.1.8",
 	ecPublicKey: "1.2.840.10045.2.1",
 	ecdsaWithSHA256: "1.2.840.10045.4.3.2",
 	ecdsaWithSHA384: "1.2.840.10045.4.3.3",
@@ -22188,6 +22383,52 @@ function encodeSignatureAlgorithm(keyAlgo, hashAlgo) {
 	throw new Error(`Unsupported key algorithm: ${keyAlgo}`);
 }
 /**
+* Encode the AlgorithmIdentifier for an RSASSA-PSS signature (RFC 4055 §3.1).
+*
+* ```
+* AlgorithmIdentifier ::= SEQUENCE {
+*   algorithm  id-RSASSA-PSS,                       -- 1.2.840.113549.1.1.10
+*   parameters RSASSA-PSS-params }
+*
+* RSASSA-PSS-params ::= SEQUENCE {
+*   hashAlgorithm    [0] HashAlgorithm    DEFAULT sha1Identifier,
+*   maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1Identifier,
+*   saltLength       [2] INTEGER          DEFAULT 20,
+*   trailerField     [3] INTEGER          DEFAULT 1 }
+* ```
+*
+* The `[0]`/`[1]`/`[2]` tags are EXPLICIT (the fields are tagged in the
+* ASN.1 module without `IMPLICIT`, and the CMS modules import EXPLICIT
+* tagging by default), so each wraps the full underlying TLV.  Per
+* RFC 4055, when the hash is SHA-256 the hashAlgorithm AlgorithmIdentifier
+* is `{ id-sha256, NULL }` and the maskGenAlgorithm is
+* `{ id-mgf1, { id-sha256, NULL } }`.  `trailerField` is the default (1)
+* and is omitted (RFC 4055 mandates generators omit it).
+*
+* Salt length equals the hash output length: 32 (SHA-256), 48 (SHA-384),
+* 64 (SHA-512).
+*/
+function encodeRsaPssSignatureAlgorithm(hashAlgo) {
+	const hashOid = HASH_OID_MAP[hashAlgo];
+	if (!hashOid) throw new Error(`Unsupported hash for RSA-PSS: ${hashAlgo}`);
+	const saltLength = PSS_SALT_LENGTH[hashAlgo];
+	if (saltLength === void 0) throw new Error(`Unsupported hash for RSA-PSS: ${hashAlgo}`);
+	const hashAlgId = encodeSequence([encodeOID(hashOid), encodeTlv(TAG.NULL, /* @__PURE__ */ new Uint8Array(0))]);
+	const mgfAlgId = encodeSequence([encodeOID(OID.mgf1), hashAlgId]);
+	const params = encodeSequence([
+		encodeContextTag(0, hashAlgId),
+		encodeContextTag(1, mgfAlgId),
+		encodeContextTag(2, encodeIntegerValue(saltLength))
+	]);
+	return encodeSequence([encodeOID(OID.rsaPss), params]);
+}
+/** PSS salt length (= hash output length in bytes) per hash algorithm. */
+const PSS_SALT_LENGTH = {
+	"SHA-256": 32,
+	"SHA-384": 48,
+	"SHA-512": 64
+};
+/**
 * Parse a single DER TLV from a byte array at the given offset.
 */
 function parseDerTlv(data, offset) {
@@ -22351,11 +22592,11 @@ function getSubtle() {
 /**
 * Import a PKCS#8 private key for signing.
 */
-async function importPrivateKey(pkcs8Der, keyAlgorithm, hashAlgorithm, namedCurve) {
+async function importPrivateKey(pkcs8Der, keyAlgorithm, hashAlgorithm, namedCurve, rsaScheme = "pkcs1v15") {
 	const subtle = getSubtle();
 	let algorithm;
 	if (keyAlgorithm === "RSA") algorithm = {
-		name: "RSASSA-PKCS1-v1_5",
+		name: rsaScheme === "pss" ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
 		hash: hashAlgorithm
 	};
 	else algorithm = {
@@ -22367,10 +22608,17 @@ async function importPrivateKey(pkcs8Der, keyAlgorithm, hashAlgorithm, namedCurv
 /**
 * Sign data using the imported private key.
 */
-async function signData(key, data, keyAlgorithm, hashAlgorithm) {
+async function signData(key, data, keyAlgorithm, hashAlgorithm, rsaScheme = "pkcs1v15") {
 	const subtle = getSubtle();
 	let algorithm;
-	if (keyAlgorithm === "RSA") algorithm = { name: "RSASSA-PKCS1-v1_5" };
+	if (keyAlgorithm === "RSA") if (rsaScheme === "pss") {
+		const saltLength = PSS_SALT_LENGTH[hashAlgorithm];
+		if (saltLength === void 0) throw new Error(`Unsupported hash for RSA-PSS: ${hashAlgorithm}`);
+		algorithm = {
+			name: "RSA-PSS",
+			saltLength
+		};
+	} else algorithm = { name: "RSASSA-PKCS1-v1_5" };
 	else algorithm = {
 		name: "ECDSA",
 		hash: hashAlgorithm
@@ -22394,11 +22642,12 @@ async function buildPkcs7Signature(dataHash, options) {
 	const hashAlgorithm = signerInfoOpts.hashAlgorithm;
 	const keyAlgo = detectKeyAlgorithm(signerInfoOpts.certificate);
 	const namedCurve = keyAlgo === "EC" ? detectNamedCurve(signerInfoOpts.certificate) : void 0;
+	const rsaScheme = keyAlgo === "RSA" && signerInfoOpts.signatureScheme === "pss" ? "pss" : "pkcs1v15";
 	const { issuerDer, serialDer } = extractIssuerAndSerial(signerInfoOpts.certificate);
-	const privateKey = await importPrivateKey(signerInfoOpts.privateKey, keyAlgo, hashAlgorithm, namedCurve);
-	const signedAttrs = buildSignedAttributes(dataHash, hashAlgorithm, options.signingDate ?? /* @__PURE__ */ new Date());
-	const signatureValue = await signData(privateKey, encodeSet(signedAttrs), keyAlgo, hashAlgorithm);
-	const signerInfoValue = buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgo, signedAttrs, keyAlgo === "EC" ? convertEcdsaToDer(signatureValue) : signatureValue);
+	const privateKey = await importPrivateKey(signerInfoOpts.privateKey, keyAlgo, hashAlgorithm, namedCurve, rsaScheme);
+	const signedAttrs = await buildSignedAttributes(dataHash, hashAlgorithm, options.signingDate ?? /* @__PURE__ */ new Date(), options.cades === true ? signerInfoOpts.certificate : void 0);
+	const signatureValue = await signData(privateKey, encodeSet(signedAttrs), keyAlgo, hashAlgorithm, rsaScheme);
+	const signerInfoValue = buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgo, signedAttrs, keyAlgo === "EC" ? convertEcdsaToDer(signatureValue) : signatureValue, rsaScheme);
 	const signedData = buildSignedData(hashAlgorithm, signerInfoOpts.certificate, signerInfoValue);
 	return encodeSequence([encodeOID(OID.signedData), encodeContextTag(0, signedData)]);
 }
@@ -22409,24 +22658,61 @@ async function buildPkcs7Signature(dataHash, options) {
 * 1. contentType (data)
 * 2. signingTime
 * 3. messageDigest (the hash of the PDF content)
-*/
-function buildSignedAttributes(dataHash, _hashAlgorithm, signingTime) {
-	return [
-		encodeSequence([encodeOID(OID.contentType), encodeSet([encodeOID(OID.data)])]),
-		encodeSequence([encodeOID(OID.signingTime), encodeSet([encodeUTCTime(signingTime)])]),
-		encodeSequence([encodeOID(OID.messageDigest), encodeSet([encodeOctetString(dataHash)])])
+*
+* When `cadesCertDer` is provided, the ESS `signing-certificate-v2`
+* attribute (RFC 5035) is added and the whole SET OF is re-sorted into
+* DER order (X.690 §11.6) so the resulting SignedAttributes encoding is
+* valid.  When omitted, the original three attributes are returned in
+* their original order so the output stays byte-identical to prior
+* versions.
+*/
+async function buildSignedAttributes(dataHash, _hashAlgorithm, signingTime, cadesCertDer) {
+	const contentTypeAttr = encodeSequence([encodeOID(OID.contentType), encodeSet([encodeOID(OID.data)])]);
+	const signingTimeAttr = encodeSequence([encodeOID(OID.signingTime), encodeSet([encodeUTCTime(signingTime)])]);
+	const messageDigestAttr = encodeSequence([encodeOID(OID.messageDigest), encodeSet([encodeOctetString(dataHash)])]);
+	if (cadesCertDer === void 0) return [
+		contentTypeAttr,
+		signingTimeAttr,
+		messageDigestAttr
 	];
+	return sortDerSetMembers([
+		contentTypeAttr,
+		signingTimeAttr,
+		messageDigestAttr,
+		await buildSigningCertificateV2Attribute(cadesCertDer, _hashAlgorithm)
+	]);
+}
+/**
+* Sort the members of a SET OF into DER canonical order (X.690 §11.6):
+* by ascending lexicographic comparison of their complete DER encodings,
+* padding the shorter encoding with conceptual trailing zero octets.
+*/
+function sortDerSetMembers(members) {
+	return [...members].sort(compareDerEncodings);
+}
+/**
+* Compare two DER encodings as unsigned octet strings, treating a
+* shorter array as if padded with trailing zero octets (X.690 §11.6).
+*/
+function compareDerEncodings(a, b) {
+	const len = Math.max(a.length, b.length);
+	for (let i = 0; i < len; i++) {
+		const av = a[i] ?? 0;
+		const bv = b[i] ?? 0;
+		if (av !== bv) return av - bv;
+	}
+	return 0;
 }
 /**
 * Build a SignerInfo SEQUENCE.
 */
-function buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgorithm, signedAttrs, signatureValue) {
+function buildSignerInfo(issuerDer, serialDer, hashAlgorithm, keyAlgorithm, signedAttrs, signatureValue, rsaScheme = "pkcs1v15") {
 	return encodeSequence([
 		encodeIntegerValue(1),
 		encodeSequence([issuerDer, serialDer]),
 		encodeDigestAlgorithm(hashAlgorithm),
 		encodeContextTag(0, concat(...signedAttrs)),
-		encodeSignatureAlgorithm(keyAlgorithm, hashAlgorithm),
+		keyAlgorithm === "RSA" && rsaScheme === "pss" ? encodeRsaPssSignatureAlgorithm(hashAlgorithm) : encodeSignatureAlgorithm(keyAlgorithm, hashAlgorithm),
 		encodeOctetString(signatureValue)
 	]);
 }
@@ -22725,6 +23011,9 @@ function parsePkcs7Structure(pkcs7Bytes) {
 			signedAttrsRaw = encodeSet(signedAttrs);
 			idx++;
 		}
+		let signatureAlgorithmOid = "";
+		const sigAlgoNode = signerInfo.children[idx];
+		if (sigAlgoNode && sigAlgoNode.children.length > 0) signatureAlgorithmOid = decodeOidBytes(sigAlgoNode.children[0].data);
 		idx++;
 		const signatureNode = signerInfo.children[idx];
 		const signatureValue = signatureNode ? signatureNode.data : /* @__PURE__ */ new Uint8Array(0);
@@ -22733,7 +23022,8 @@ function parsePkcs7Structure(pkcs7Bytes) {
 			signedAttrs,
 			signedAttrsRaw,
 			signatureValue,
-			digestAlgorithm
+			digestAlgorithm,
+			signatureAlgorithmOid
 		};
 	} catch {
 		return null;
@@ -22881,6 +23171,23 @@ async function verifySignatures(pdfBytes) {
 		} catch {
 			certificateValid = false;
 		}
+		let cadesSigningCertPresent;
+		let cadesSigningCertHashValid;
+		try {
+			const ess = extractSigningCertificateV2(parsed.signedAttrsRaw);
+			cadesSigningCertPresent = ess.present;
+			if (ess.present && ess.certHash) {
+				const algo = {
+					32: "SHA-256",
+					48: "SHA-384",
+					64: "SHA-512"
+				}[ess.certHash.length];
+				if (algo) {
+					const digest = new Uint8Array(await getSubtle().digest(algo, toBuffer(parsed.certificate)));
+					cadesSigningCertHashValid = digest.length === ess.certHash.length && digest.every((b, i) => b === ess.certHash[i]);
+				}
+			}
+		} catch {}
 		results.push({
 			fieldName: fieldInfo.fieldName,
 			signedBy,
@@ -22888,7 +23195,9 @@ async function verifySignatures(pdfBytes) {
 			integrityValid,
 			certificateValid,
 			signingDate,
-			reason: fieldInfo.reason
+			reason: fieldInfo.reason,
+			cadesSigningCertPresent,
+			cadesSigningCertHashValid
 		});
 	}
 	return results;
@@ -22911,17 +23220,33 @@ async function verifySignature(pdfBytes, byteRange, signatureBytes, certificateB
 		if (!parsed) return false;
 		const subtle = getSubtle();
 		const keyAlgo = detectKeyAlgorithm(certificateBytes);
+		const isPss = parsed.signatureAlgorithmOid === "1.2.840.113549.1.1.10";
+		const PSS_SALT_LENGTH = {
+			"SHA-256": 32,
+			"SHA-384": 48,
+			"SHA-512": 64
+		};
 		const spki = extractSubjectPublicKeyInfo(certificateBytes);
 		let importAlgo;
 		let verifyAlgo;
 		let sigBytes = parsed.signatureValue;
-		if (keyAlgo === "RSA") {
+		if (keyAlgo === "RSA") if (isPss) {
+			importAlgo = {
+				name: "RSA-PSS",
+				hash: parsed.digestAlgorithm
+			};
+			verifyAlgo = {
+				name: "RSA-PSS",
+				saltLength: PSS_SALT_LENGTH[parsed.digestAlgorithm] ?? 32
+			};
+		} else {
 			importAlgo = {
 				name: "RSASSA-PKCS1-v1_5",
 				hash: parsed.digestAlgorithm
 			};
 			verifyAlgo = { name: "RSASSA-PKCS1-v1_5" };
-		} else {
+		}
+		else {
 			const namedCurve = detectNamedCurve(certificateBytes);
 			importAlgo = {
 				name: "ECDSA",
@@ -25707,6 +26032,18 @@ Object.defineProperty(exports, "PdfLayerManager", {
 		return PdfLayerManager;
 	}
 });
+Object.defineProperty(exports, "PdfLexer", {
+	enumerable: true,
+	get: function() {
+		return PdfLexer;
+	}
+});
+Object.defineProperty(exports, "PdfObjectParser", {
+	enumerable: true,
+	get: function() {
+		return PdfObjectParser;
+	}
+});
 Object.defineProperty(exports, "PdfOutlineItem", {
 	enumerable: true,
 	get: function() {
@@ -25773,6 +26110,12 @@ Object.defineProperty(exports, "StandardFonts", {
 		return StandardFonts;
 	}
 });
+Object.defineProperty(exports, "XrefParser", {
+	enumerable: true,
+	get: function() {
+		return XrefParser;
+	}
+});
 Object.defineProperty(exports, "addWatermark", {
 	enumerable: true,
 	get: function() {
@@ -25941,6 +26284,12 @@ Object.defineProperty(exports, "buildPkcs7Signature", {
 		return buildPkcs7Signature;
 	}
 });
+Object.defineProperty(exports, "buildSigningCertificateV2Attribute", {
+	enumerable: true,
+	get: function() {
+		return buildSigningCertificateV2Attribute;
+	}
+});
 Object.defineProperty(exports, "buildViewerPreferencesDict", {
 	enumerable: true,
 	get: function() {
@@ -26319,6 +26668,12 @@ Object.defineProperty(exports, "extractMetrics", {
 		return extractMetrics;
 	}
 });
+Object.defineProperty(exports, "extractSigningCertificateV2", {
+	enumerable: true,
+	get: function() {
+		return extractSigningCertificateV2;
+	}
+});
 Object.defineProperty(exports, "extractSubjectPublicKeyInfo", {
 	enumerable: true,
 	get: function() {
@@ -27022,4 +27377,4 @@ Object.defineProperty(exports, "wrapText", {
 	}
 });
 
-//# sourceMappingURL=pdfDocument-Bh4ebDqE.cjs.map
+//# sourceMappingURL=pdfDocument-D5qz7duP.cjs.map