pdf-lite 1.5.0 → 1.6.1

package/dist/signing/document-security-store.js

@@ -30,23 +30,20 @@ export class PdfDocumentSecurityStoreDictionary extends PdfDictionary {
  * @example
  * ```typescript
  * const dss = new PdfDocumentSecurityStoreObject(document)
- * await dss.addCert(certificateBytes)
- * await dss.addCrl(crlBytes)
- * await dss.addOcsp(ocspBytes)
+ * dss.addCert(certificateBytes)
+ * dss.addCrl(crlBytes)
+ * dss.addOcsp(ocspBytes)
  * ```
  */
 export class PdfDocumentSecurityStoreObject extends PdfIndirectObject {
-    /** Reference to the parent document. */
-    document;
     /**
      * Creates a new DSS object.
      *
      * @param document - The parent PDF document.
      * @param content - Optional pre-existing DSS dictionary.
      */
-    constructor(document, content) {
+    constructor(content) {
         super(content ?? new PdfDocumentSecurityStoreDictionary());
-        this.document = document;
     }
     /**
      * Adds an OCSP response to the DSS, avoiding duplicates.
@@ -54,25 +51,21 @@ export class PdfDocumentSecurityStoreObject extends PdfIndirectObject {
      * @param ocsp - The DER-encoded OCSP response.
      * @returns The created or existing OCSP object.
      */
-    async addOcsp(ocsp) {
+    addOcsp(ocsp) {
         const newOcsp = new PdfStream(ocsp);
         let ocspArray = this.content.get('OCSPs');
-        const currentOcsps = (await Promise.all((ocspArray?.items ?? []).map(async (ref) => {
-            const obj = await this.document.readObject(ref);
-            return obj;
-        })));
+        const currentOcsps = (ocspArray?.items ?? []).map((ref) => ref.resolve());
         for (const existingOcsp of currentOcsps) {
             if (existingOcsp.content.equals(newOcsp)) {
-                return existingOcsp;
+                return existingOcsp.becomes(PdfOcspObject);
             }
         }
         const ocspObject = new PdfOcspObject(newOcsp);
-        this.document.add(ocspObject);
         if (!ocspArray) {
             ocspArray = new PdfArray([]);
             this.content.set('OCSPs', ocspArray);
         }
-        ocspArray.items.push(ocspObject.reference);
+        ocspArray.push(ocspObject.reference);
         return ocspObject;
     }
     /**
@@ -81,24 +74,20 @@ export class PdfDocumentSecurityStoreObject extends PdfIndirectObject {
      * @param crl - The DER-encoded CRL.
      * @returns The created or existing CRL object.
      */
-    async addCrl(crl) {
+    addCrl(crl) {
         let crlArray = this.content.get('CRLs');
-        const currentCrls = (await Promise.all((crlArray?.items ?? []).map(async (ref) => {
-            const obj = await this.document.readObject(ref);
-            return obj;
-        })));
+        const currentCrls = (crlArray?.items ?? []).map((ref) => ref.resolve());
         for (const existingCrl of currentCrls) {
             if (existingCrl.content.equals(new PdfStream(crl))) {
-                return existingCrl;
+                return existingCrl.becomes(PdfCrlObject);
             }
         }
         const crlObject = new PdfCrlObject(new PdfStream(crl));
-        this.document.add(crlObject);
         if (!crlArray) {
             crlArray = new PdfArray([]);
             this.content.set('CRLs', crlArray);
         }
-        crlArray.items.push(crlObject.reference);
+        crlArray.push(crlObject.reference);
         return crlObject;
     }
     /**
@@ -107,24 +96,20 @@ export class PdfDocumentSecurityStoreObject extends PdfIndirectObject {
      * @param cert - The DER-encoded certificate.
      * @returns The created or existing certificate object.
      */
-    async addCert(cert) {
+    addCert(cert) {
         let certArray = this.content.get('Certs');
-        const currentCerts = (await Promise.all((certArray?.items ?? []).map(async (ref) => {
-            const obj = await this.document.readObject(ref);
-            return obj;
-        })));
+        const currentCerts = (certArray?.items ?? []).map((ref) => ref.resolve());
         for (const existingCert of currentCerts) {
             if (existingCert.content.equals(new PdfStream(cert))) {
-                return existingCert;
+                return existingCert.becomes(PdfCertObject);
             }
         }
         const certObject = new PdfCertObject(new PdfStream(cert));
-        this.document.add(certObject);
         if (!certArray) {
             certArray = new PdfArray([]);
             this.content.set('Certs', certArray);
         }
-        certArray.items.push(certObject.reference);
+        certArray.push(certObject.reference);
         return certObject;
     }
     /**
@@ -132,12 +117,12 @@ export class PdfDocumentSecurityStoreObject extends PdfIndirectObject {
      *
      * @param revocationInfo - The revocation information to add.
      */
-    async addRevocationInfo(revocationInfo) {
+    addRevocationInfo(revocationInfo) {
         for (const ocsp of revocationInfo.ocsps ?? []) {
-            await this.addOcsp(ocsp);
+            this.addOcsp(ocsp);
         }
         for (const crl of revocationInfo.crls ?? []) {
-            await this.addCrl(crl);
+            this.addCrl(crl);
         }
     }
     /**

package/dist/signing/signer.d.ts

@@ -1,8 +1,9 @@
-import { PdfDocument } from '../pdf/pdf-document.js';
+import { PdfDocumentSecurityStoreObject } from './document-security-store.js';
 import { PdfSignatureObject } from './signatures/index.js';
 import { PdfSignatureVerificationResult, CertificateValidationOptions, PdfSignatureSubType } from './types.js';
+import { PdfDocument } from '../pdf/pdf-document.js';
 /**
- * Result of verifying all signatures in a document.
+ * Result of verifying all signatures in a this.document.
  */
 export type PdfDocumentVerificationResult = {
     /** Whether all signatures in the document are valid. */
@@ -11,7 +12,7 @@ export type PdfDocumentVerificationResult = {
     signatures: {
         /** The signature subfilter type. */
         type: PdfSignatureSubType;
-        /** Index of the signature in the document. */
+        /** Index of the signature in the this.document. */
         index: number;
         /** The signature object. */
         signature: PdfSignatureObject;
@@ -30,16 +31,22 @@ export type PdfDocumentVerificationResult = {
  * ```
  */
 export declare class PdfSigner {
+    /** The PDF document to be signed. */
+    document: PdfDocument;
     /** Whether to use the Document Security Store for revocation information. */
     useDocumentSecurityStore: boolean;
+    constructor(options: {
+        useDocumentSecurityStore?: boolean;
+        document: PdfDocument;
+    });
     /**
-     * Signs all signature objects in the document.
+     * Signs all signature objects in the this.document.
      * Computes byte ranges, generates signatures, and optionally adds revocation info to DSS.
      *
      * @param document - The PDF document to sign.
-     * @returns The signed document.
+     * @returns The signed this.document.
      */
-    sign(document: PdfDocument): Promise<PdfDocument>;
+    sign(): Promise<void>;
     /**
      * Instantiates the appropriate signature object based on SubFilter type.
      *
@@ -48,7 +55,7 @@ export declare class PdfSigner {
      */
     private instantiateSignatureObject;
     /**
-     * Verifies all signatures in the document.
+     * Verifies all signatures in the this.document.
      * First serializes the document to bytes and reloads it to ensure signatures
      * are properly deserialized into the correct classes before verification.
      * Then searches for signature objects, computes their byte ranges, and verifies each one.
@@ -72,7 +79,15 @@ export declare class PdfSigner {
      * }
      * ```
      */
-    verify(document: PdfDocument, options?: {
+    verify(options?: {
         certificateValidation?: CertificateValidationOptions | boolean;
     }): Promise<PdfDocumentVerificationResult>;
+    /**
+     * Sets the Document Security Store (DSS) for the this.document.
+     * Used for long-term validation of digital signatures.
+     *
+     * @param dss - The Document Security Store object to set
+     * @throws Error if the document has no root dictionary
+     */
+    setDocumentSecurityStore(dss: PdfDocumentSecurityStoreObject): void;
 }

package/dist/signing/signer.js

@@ -1,6 +1,3 @@
-import { PdfCommentToken } from '../core/tokens/comment-token.js';
-import { PdfHexadecimalToken } from '../core/tokens/hexadecimal-token.js';
-import { PdfNameToken } from '../core/tokens/name-token.js';
 import { concatUint8Arrays } from '../utils/concatUint8Arrays.js';
 import { PdfDocumentSecurityStoreObject } from './document-security-store.js';
 import { PdfSignatureObject, PdfAdbePkcs7DetachedSignatureObject, PdfAdbePkcs7Sha1SignatureObject, PdfAdbePkcsX509RsaSha1SignatureObject, PdfEtsiCadesDetachedSignatureObject, PdfEtsiRfc3161SignatureObject, PdfSignatureDictionary, } from './signatures/index.js';
@@ -8,6 +5,9 @@ import { PdfNumber } from '../core/objects/pdf-number.js';
 import { PdfIndirectObject } from '../core/objects/pdf-indirect-object.js';
 import { PdfDictionary } from '../core/objects/pdf-dictionary.js';
 import { PdfArray } from '../core/objects/pdf-array.js';
+import { PdfNameToken } from '../core/tokens/name-token.js';
+import { PdfCommentToken } from '../core/tokens/comment-token.js';
+import { PdfHexadecimalToken } from '../core/tokens/hexadecimal-token.js';
 /**
  * Handles digital signing operations for PDF documents.
  * Processes signature objects and optionally stores revocation information in the DSS.
@@ -19,25 +19,39 @@ import { PdfArray } from '../core/objects/pdf-array.js';
  * ```
  */
 export class PdfSigner {
+    /** The PDF document to be signed. */
+    document;
     /** Whether to use the Document Security Store for revocation information. */
     useDocumentSecurityStore = true;
+    constructor(options) {
+        this.document = options.document;
+        if (options?.useDocumentSecurityStore !== undefined) {
+            this.useDocumentSecurityStore = options.useDocumentSecurityStore;
+        }
+    }
     /**
-     * Signs all signature objects in the document.
+     * Signs all signature objects in the this.document.
      * Computes byte ranges, generates signatures, and optionally adds revocation info to DSS.
      *
      * @param document - The PDF document to sign.
-     * @returns The signed document.
+     * @returns The signed this.document.
      */
-    async sign(document) {
+    async sign() {
         const signatures = [
-            ...document.objects.filter((x) => x instanceof PdfSignatureObject),
+            ...this.document.objects.filter((x) => x instanceof PdfSignatureObject),
         ];
+        // Move all signature objects to the end of the document in a new revision to ensure their byte positions are after all other content.
+        signatures.forEach((sig) => {
+            this.document.deleteObject(sig);
+            this.document.startNewRevision();
+            this.document.add(sig);
+        });
         const dss = this.useDocumentSecurityStore
-            ? (document.objects.find((x) => x instanceof PdfDocumentSecurityStoreObject) ?? new PdfDocumentSecurityStoreObject(document))
+            ? (this.document.objects.find((x) => x instanceof PdfDocumentSecurityStoreObject) ?? new PdfDocumentSecurityStoreObject())
             : undefined;
         for (let i = 0; i < signatures.length; i++) {
             const signature = signatures[i];
-            const tokens = document.tokensWithObjects();
+            const tokens = this.document.tokensWithObjects();
             const signableTokens = [];
             let contentsOffset = 0;
             let contentsLength = 0;
@@ -77,7 +91,7 @@ export class PdfSigner {
                 byteCount - (contentsOffset + contentsLength),
             ];
             signature.setByteRange(byteRange);
-            const allBytes = document.toBytes();
+            const allBytes = this.document.toBytes();
             const toSign = concatUint8Arrays(allBytes.slice(byteRange[0], byteRange[1]), allBytes.slice(byteRange[2], byteRange[3] + byteRange[2]));
             const { signedBytes, revocationInfo } = await signature.sign({
                 bytes: toSign,
@@ -85,13 +99,12 @@ export class PdfSigner {
             });
             signature.setSignedBytes(signedBytes);
             if (dss && revocationInfo) {
-                await dss.addRevocationInfo(revocationInfo);
+                dss.addRevocationInfo(revocationInfo);
             }
         }
         if (dss && !dss.isEmpty()) {
-            await document.setDocumentSecurityStore(dss);
+            this.setDocumentSecurityStore(dss);
         }
-        return document;
     }
     /**
      * Instantiates the appropriate signature object based on SubFilter type.
@@ -161,7 +174,7 @@ export class PdfSigner {
         return signatureObj;
     }
     /**
-     * Verifies all signatures in the document.
+     * Verifies all signatures in the this.document.
      * First serializes the document to bytes and reloads it to ensure signatures
      * are properly deserialized into the correct classes before verification.
      * Then searches for signature objects, computes their byte ranges, and verifies each one.
@@ -185,11 +198,11 @@ export class PdfSigner {
      * }
      * ```
      */
-    async verify(document, options) {
-        const documentBytes = document.toBytes();
+    async verify(options) {
+        const documentBytes = this.document.toBytes();
         const results = [];
         let allValid = true;
-        const documentObjects = document.objects;
+        const documentObjects = this.document.objects;
         for (let i = 0; i < documentObjects.length; i++) {
             const obj = documentObjects[i];
             if (!(obj instanceof PdfIndirectObject)) {
@@ -284,4 +297,25 @@ export class PdfSigner {
             signatures: results,
         };
     }
+    /**
+     * Sets the Document Security Store (DSS) for the this.document.
+     * Used for long-term validation of digital signatures.
+     *
+     * @param dss - The Document Security Store object to set
+     * @throws Error if the document has no root dictionary
+     */
+    setDocumentSecurityStore(dss) {
+        const root = this.document.root;
+        if (!root?.content) {
+            throw new Error('Cannot set DSS - document has no root dictionary');
+        }
+        // Add DSS in a new incremental revision so it doesn't change
+        // byte positions in earlier revisions (which have signed ByteRanges).
+        this.document.startNewRevision();
+        // Clone the root catalog into the new revision with the DSS reference
+        const updatedRoot = root.clone();
+        updatedRoot.content.set('DSS', dss.reference);
+        this.document.add(updatedRoot);
+        this.document.add(dss);
+    }
 }

package/dist/utils/index.d.ts

@@ -13,7 +13,6 @@ export * from './hexBytesToString.js';
 export * from './hexToBytes.js';
 export * from './needsUnicodeEncoding.js';
 export * from './padBytes.js';
-export * from './predictors.js';
 export * from './replaceInBuffer.js';
 export * from './stringToBytes.js';
 export * from './stringToHexBytes.js';

package/dist/utils/index.js

@@ -13,7 +13,6 @@ export * from './hexBytesToString.js';
 export * from './hexToBytes.js';
 export * from './needsUnicodeEncoding.js';
 export * from './padBytes.js';
-export * from './predictors.js';
 export * from './replaceInBuffer.js';
 export * from './stringToBytes.js';
 export * from './stringToHexBytes.js';

package/dist/utils/needsCentralWhitespace.d.ts

@@ -0,0 +1,10 @@
+import { PdfObject } from '../core/objects/pdf-object.js';
+/**
+ * Returns true if the given PDF object's serialized form starts with a
+ * non-delimiter character, meaning it requires whitespace separation from
+ * a preceding token to avoid ambiguous parsing.
+ *
+ * Self-delimiting types (PdfString, PdfHexadecimal, PdfArray, PdfDictionary)
+ * start with `(`, `<`, `[`, or `<<` and do not need a leading space.
+ */
+export declare function needsCentralWhitespace(obj1?: PdfObject, obj2?: PdfObject): boolean;

package/dist/utils/needsCentralWhitespace.js

@@ -0,0 +1,34 @@
+import { PdfBoolean } from '../core/objects/pdf-boolean.js';
+import { PdfNull } from '../core/objects/pdf-null.js';
+import { PdfNumber } from '../core/objects/pdf-number.js';
+import { PdfObjectReference } from '../core/objects/pdf-object-reference.js';
+/**
+ * Returns true if the given PDF object's serialized form starts with a
+ * non-delimiter character, meaning it requires whitespace separation from
+ * a preceding token to avoid ambiguous parsing.
+ *
+ * Self-delimiting types (PdfString, PdfHexadecimal, PdfArray, PdfDictionary)
+ * start with `(`, `<`, `[`, or `<<` and do not need a leading space.
+ */
+export function needsCentralWhitespace(obj1, obj2) {
+    if (!obj1 || !obj2) {
+        return false;
+    }
+    if (obj1.postTokens === undefined && obj2.preTokens === undefined) {
+        // Undefined means tokens will be generated
+        return false;
+    }
+    if (obj1.isTrailingDelimited) {
+        // Self-delimiting types (string, hex, array, dict) end with a delimiter
+        // character and never require trailing whitespace before the next token
+        return false;
+    }
+    const tokens = [...(obj1.postTokens ?? []), ...(obj2?.preTokens ?? [])];
+    if (tokens.length > 0) {
+        return false;
+    }
+    return (obj2 instanceof PdfObjectReference ||
+        obj2 instanceof PdfNumber ||
+        obj2 instanceof PdfNull ||
+        obj2 instanceof PdfBoolean);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pdf-lite",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "main": "dist/index.js",
   "type": "module",
   "exports": {
@@ -54,8 +54,8 @@
   ],
   "dependencies": {
     "pako": "2.1.0",
-    "pki-lite": "^1.0.13",
-    "pki-lite-crypto-extended": "^1.0.13"
+    "pki-lite": "^1.0.14",
+    "pki-lite-crypto-extended": "^1.0.14"
   },
   "scripts": {
     "test:acceptance": "vitest run test/acceptance",

package/dist/acroform/acroform.d.ts

@@ -1,9 +0,0 @@
-/**
- * Backward-compatible re-export shim.
- * All classes have been moved to dedicated modules.
- */
-export { PdfFormField as PdfAcroFormField } from './fields/pdf-form-field.js';
-export { PdfAcroForm } from './pdf-acro-form.js';
-export type { PdfDefaultResourcesDictionary } from './pdf-acro-form.js';
-export { PdfFieldType } from './fields/types.js';
-export type { PdfAppearanceStreamDictionary } from '../annotations/index.js';

package/dist/acroform/acroform.js

@@ -1,7 +0,0 @@
-/**
- * Backward-compatible re-export shim.
- * All classes have been moved to dedicated modules.
- */
-export { PdfFormField as PdfAcroFormField } from './fields/pdf-form-field.js';
-export { PdfAcroForm } from './pdf-acro-form.js';
-export { PdfFieldType } from './fields/types.js';

package/dist/acroform/manager.d.ts

@@ -1,37 +0,0 @@
-import { PdfDocument } from '../pdf/pdf-document.js';
-import { PdfAcroForm } from './acroform.js';
-import { PdfXfaForm } from './xfa/pdf-xfa-form.js';
-/**
- * Manages AcroForm fields in PDF documents.
- * Provides methods to read and write form field values.
- */
-export declare class PdfAcroFormManager {
-    private document;
-    private _acroform;
-    constructor(document: PdfDocument);
-    /**
-     * Gets the XFA form wrapper, loading it lazily on first access.
-     * @returns The PdfXfaForm or null if no XFA forms exist
-     */
-    getXfa(): Promise<PdfXfaForm | null>;
-    /**
-     * Checks if the document contains AcroForm fields.
-     * @returns True if the document has AcroForm fields, false otherwise
-     */
-    exists(): Promise<boolean>;
-    /**
-     * Gets the AcroForm object from the document catalog.
-     * @returns The AcroForm object or null if not found
-     */
-    read(): Promise<PdfAcroForm | null>;
-    /**
-     * Explicitly sets the XFA form instance, bypassing the lazy load on next write.
-     */
-    setXfa(xfa: PdfXfaForm): Promise<void>;
-    /**
-     * Writes the provided AcroForm to the associated PDF document.
-     * @param acroForm The AcroForm instance to serialize into the document.
-     * @throws Error If writing the AcroForm to the document fails.
-     */
-    write(acroForm?: PdfAcroForm): Promise<void>;
-}

package/dist/acroform/manager.js

@@ -1,57 +0,0 @@
-import { PdfAcroForm } from './acroform.js';
-/**
- * Manages AcroForm fields in PDF documents.
- * Provides methods to read and write form field values.
- */
-export class PdfAcroFormManager {
-    document;
-    _acroform = null;
-    constructor(document) {
-        this.document = document;
-    }
-    /**
-     * Gets the XFA form wrapper, loading it lazily on first access.
-     * @returns The PdfXfaForm or null if no XFA forms exist
-     */
-    async getXfa() {
-        return (await (await this.read())?.getXfa()) || null;
-    }
-    /**
-     * Checks if the document contains AcroForm fields.
-     * @returns True if the document has AcroForm fields, false otherwise
-     */
-    async exists() {
-        try {
-            const acroForm = await this.read();
-            return acroForm !== null;
-        }
-        catch {
-            return false;
-        }
-    }
-    /**
-     * Gets the AcroForm object from the document catalog.
-     * @returns The AcroForm object or null if not found
-     */
-    async read() {
-        if (this._acroform)
-            return this._acroform;
-        this._acroform = await PdfAcroForm.fromDocument(this.document);
-        return this._acroform;
-    }
-    /**
-     * Explicitly sets the XFA form instance, bypassing the lazy load on next write.
-     */
-    async setXfa(xfa) {
-        ;
-        (await this.read())?.setXfa(xfa);
-    }
-    /**
-     * Writes the provided AcroForm to the associated PDF document.
-     * @param acroForm The AcroForm instance to serialize into the document.
-     * @throws Error If writing the AcroForm to the document fails.
-     */
-    async write(acroForm) {
-        await (acroForm ?? (await this.read()))?.write(this.document);
-    }
-}

package/dist/acroform/pdf-font-encoding-cache.d.ts

@@ -1,27 +0,0 @@
-import { PdfDocument } from '../pdf/pdf-document.js';
-import { PdfDictionary } from '../core/objects/pdf-dictionary.js';
-import { PdfObjectReference } from '../core/objects/pdf-object-reference.js';
-import type { PdfDefaultResourcesDictionary } from './acroform.js';
-/**
- * Resolves and caches font encoding maps from the form's default resources.
- */
-export declare class PdfFontEncodingCache {
-    readonly fontEncodingMaps: Map<string, Map<number, string>>;
-    readonly fontTypes: Map<string, string>;
-    /** Object references for all resolved fonts, keyed by resource name. */
-    readonly fontRefs: Map<string, PdfObjectReference>;
-    private document?;
-    private defaultResources;
-    constructor(document: PdfDocument | undefined, defaultResources: PdfDefaultResourcesDictionary | null);
-    getFontEncodingMap(fontName: string): Promise<Map<number, string> | null>;
-    cacheAllFontEncodings(fields: Array<{
-        content: PdfDictionary;
-    }>): Promise<void>;
-    /**
-     * Walks the page-tree (page → parent → … → Pages root), looking for the
-     * font in each node's /Resources/Font dict. Stops as soon as it finds the
-     * font. PDF resource inheritance means any ancestor can supply the font.
-     */
-    private resolveFontFromPage;
-    isFontUnicode(fontName: string): boolean;
-}