pdf-oxide-wasm 0.3.37 → 0.3.39

package/README.md

@@ -167,7 +167,7 @@ const pngBytes = doc.extractImageBytes(0);
 
 ```javascript
 doc.setTitle("Quarterly Report");
-doc.setAuthor("Finance Team");
+doc.setAuthor("Example Author");
 doc.setPageRotation(0, 90);
 doc.cropMargins(36, 36, 36, 36);
 doc.eraseRegion(0, 50, 50, 200, 100);

package/bundler/package.json

@@ -0,0 +1 @@
+{"type":"module","sideEffects":false}

package/{pdf_oxide.d.ts → bundler/pdf_oxide.d.ts}

@@ -1,6 +1,26 @@
 /* tslint:disable */
 /* eslint-disable */
 
+/**
+ * Horizontal-alignment enum shared by `textInRect`, buffered `table`, and
+ * `streamingTable`. Maps 1:1 onto [`crate::writer::TextAlign`] /
+ * [`crate::writer::CellAlign`]. Exported to JS as `Align` via `js_name`.
+ */
+export enum Align {
+    /**
+     * Align to the left edge.
+     */
+    Left = 0,
+    /**
+     * Center horizontally.
+     */
+    Center = 1,
+    /**
+     * Align to the right edge.
+     */
+    Right = 2,
+}
+
 /**
  * Style configuration for header/footer text.
  */
@@ -26,25 +46,42 @@ export class ArtifactStyle {
 }
 
 /**
- * Chroma subsampling format
+ * WASM handle to a streaming-table building session. Created by
+ * `FluentPageBuilder.streamingTable()`; rows are pushed via `pushRow`,
+ * and the session is sealed with `finish()`.
+ *
+ * Single-use: `finish()` twice throws, and `pushRow` after `finish()`
+ * throws. The rows are buffered and replayed against the real Rust
+ * `StreamingTable` at `WasmFluentPageBuilder.done()` commit time —
+ * preserving the FluentPageBuilder borrow-lifetime invariant that can't
+ * cross the wasm-bindgen boundary.
  */
-export enum ChromaSampling {
+export class StreamingTable {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
     /**
-     * Both vertically and horizontally subsampled.
+     * Number of columns configured on this streaming table.
      */
-    Cs420 = 0,
+    columnCount(): number;
     /**
-     * Horizontally subsampled.
+     * Seal the streaming table — the buffered rows are flushed onto the
+     * parent page's op queue, to be replayed against the real Rust
+     * `StreamingTable` at `done()` commit time. Calling `finish()` twice
+     * throws.
      */
-    Cs422 = 1,
+    finish(): void;
     /**
-     * Not subsampled.
+     * Push one row as an array of cell strings (all rowspan=1). Returns an
+     * error if the table has already been finished or if the row's cell count
+     * does not match the column count.
      */
-    Cs444 = 2,
+    pushRow(cells: string[]): void;
     /**
-     * Monochrome.
+     * Push one row with per-cell rowspan values. `cells` is a JS array of
+     * `[text, rowspan]` two-element arrays. `rowspan == 1` is a normal cell.
      */
-    Cs400 = 3,
+    pushRowSpan(cells: any): void;
 }
 
 /**
@@ -79,6 +116,376 @@ export class WasmArtifact {
     withStyle(style: ArtifactStyle): WasmArtifact;
 }
 
+/**
+ * X.509 certificate parsed from a raw DER blob. Mirrors the C#,
+ * Node, Python, and Go `Certificate` surfaces — `subject` / `issuer`
+ * / `serial` / `validity` / `isValid` getters only.
+ */
+export class WasmCertificate {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Load a certificate from a DER-encoded X.509 blob. Throws if
+     * the DER doesn't parse.
+     */
+    static load(data: Uint8Array): WasmCertificate;
+    /**
+     * Load a signer certificate + private key from PEM strings.
+     * `certPem` must begin `-----BEGIN CERTIFICATE-----`.
+     * `keyPem` must begin `-----BEGIN PRIVATE KEY-----` or `-----BEGIN RSA PRIVATE KEY-----`.
+     */
+    static loadPem(cert_pem: string, key_pem: string): WasmCertificate;
+    /**
+     * Load a signer certificate + private key from a PKCS#12 (.p12/.pfx) blob.
+     * `password` is the passphrase protecting the key bag.
+     */
+    static loadPkcs12(data: Uint8Array, password: string): WasmCertificate;
+    /**
+     * Whether the certificate is currently within its validity
+     * window. Does NOT verify chain, trust-root, or revocation.
+     */
+    readonly isValid: boolean;
+    /**
+     * Issuer distinguished name.
+     */
+    readonly issuer: string;
+    /**
+     * Serial number as a hex string (no `0x` prefix).
+     */
+    readonly serial: string;
+    /**
+     * Subject distinguished name.
+     */
+    readonly subject: string;
+    /**
+     * Validity window as `[notBefore, notAfter]` Unix epoch seconds.
+     * JavaScript: `new Date(notBefore * 1000)` for a Date.
+     */
+    readonly validity: BigInt64Array;
+}
+
+/**
+ * WASM wrapper for [`crate::writer::DocumentBuilder`]. Fluent API for
+ * programmatic multi-page PDF construction with embedded fonts and
+ * annotations.
+ *
+ * The terminal methods (`build`, `toBytesEncrypted`) **consume** the
+ * builder; subsequent calls throw `Error: DocumentBuilder already
+ * consumed`.
+ */
+export class WasmDocumentBuilder {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Start a new A4 page. Returns a `FluentPageBuilder` that must be
+     * committed with `.done()` before calling another page method or a
+     * terminal (`build`, etc.).
+     */
+    a4Page(): WasmFluentPageBuilder;
+    /**
+     * Set document author.
+     */
+    author(author: string): void;
+    /**
+     * Build the PDF and return it as a `Uint8Array`. **Consumes** the
+     * builder.
+     */
+    build(): Uint8Array;
+    /**
+     * Commit a completed `FluentPageBuilder` back to this builder.
+     * Takes the place of the Rust `page.done()` re-parenting.
+     *
+     * JS users typically don't call this directly — the ergonomic
+     * pattern is `builder.a4Page();` for each page, then
+     * `builder.commitPage(page)` once ops are queued. For more fluent
+     * code, see the `FluentPageBuilder.done(builder)` helper which
+     * delegates to this method.
+     */
+    commitPage(page: WasmFluentPageBuilder): void;
+    /**
+     * Set the creator application name recorded in the PDF.
+     */
+    creator(creator: string): void;
+    /**
+     * Set document keywords (comma-separated per PDF convention).
+     */
+    keywords(keywords: string): void;
+    /**
+     * Set the document's natural language tag (e.g. `"en-US"`).
+     *
+     * Emitted as `/Lang` in the catalog when `taggedPdfUa1()` is set.
+     */
+    language(lang: string): void;
+    /**
+     * Start a new US Letter page.
+     */
+    letterPage(): WasmFluentPageBuilder;
+    /**
+     * Create a new empty document builder. Equivalent to the Rust
+     * [`crate::writer::DocumentBuilder::new`] — every other method
+     * chains off the instance returned here.
+     */
+    constructor();
+    /**
+     * Run a JavaScript script when the document is opened (`/OpenAction`).
+     */
+    onOpen(script: string): void;
+    /**
+     * Start a new page with custom dimensions in PDF points
+     * (72 pt = 1 inch).
+     */
+    page(width: number, height: number): WasmFluentPageBuilder;
+    /**
+     * Register a TTF / OTF font the pages can reference by name.
+     * **Consumes** `font` — reusing the `WasmEmbeddedFont` throws.
+     */
+    registerEmbeddedFont(name: string, font: WasmEmbeddedFont): void;
+    /**
+     * Add a role-map entry: custom structure type → standard PDF structure type.
+     *
+     * Emitted in `/RoleMap` inside the StructTreeRoot when `taggedPdfUa1()`
+     * is set. Multiple calls accumulate entries.
+     */
+    roleMap(custom: string, standard: string): void;
+    /**
+     * Set document subject.
+     */
+    subject(subject: string): void;
+    /**
+     * Enable PDF/UA-1 tagged PDF mode.
+     *
+     * When enabled, `build()` emits `/MarkInfo`, `/StructTreeRoot`, `/Lang`,
+     * and `/ViewerPreferences` in the catalog. Opt-in — no effect unless called.
+     */
+    taggedPdfUa1(): void;
+    /**
+     * Set document title.
+     */
+    title(title: string): void;
+    /**
+     * Build the PDF with AES-256 encryption and return it as a
+     * `Uint8Array`. Granted permissions default to all. **Consumes**
+     * the builder.
+     */
+    toBytesEncrypted(user_password: string, owner_password: string): Uint8Array;
+}
+
+/**
+ * Embedded TTF/OTF font usable by `WasmDocumentBuilder`. Single-use: once
+ * passed to `registerEmbeddedFont`, the underlying Rust `EmbeddedFont` is
+ * moved into the builder and this handle becomes empty.
+ */
+export class WasmEmbeddedFont {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Load an embedded font from raw TTF/OTF bytes. Pass `name` to
+     * override the PostScript name baked into the font file.
+     */
+    static fromBytes(data: Uint8Array, name?: string | null): WasmEmbeddedFont;
+    /**
+     * The font's PostScript name (or the override). Empty once consumed.
+     */
+    readonly name: string;
+}
+
+/**
+ * Per-page fluent builder. Buffers operations until `done(builder)` is
+ * called, which commits them to the parent `WasmDocumentBuilder`. Each
+ * instance is single-use — `done()` twice throws.
+ */
+export class WasmFluentPageBuilder {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    at(x: number, y: number): void;
+    /**
+     * Place a 1-D barcode image at `(x, y, w, h)` on the page.
+     * `barcodeType`: 0=Code128 1=Code39 2=EAN13 3=EAN8 4=UPCA 5=ITF
+     * 6=Code93 7=Codabar.
+     */
+    barcode1d(barcode_type: number, data: string, x: number, y: number, w: number, h: number): void;
+    /**
+     * Place a QR-code image at `(x, y, size, size)` on the page.
+     */
+    barcodeQr(data: string, x: number, y: number, size: number): void;
+    checkbox(name: string, x: number, y: number, w: number, h: number, checked: boolean): void;
+    /**
+     * Lay out `text` as balanced multi-column flow (`columnCount` columns,
+     * `gapPt` points between columns). Paragraphs in `text` are separated by `"\n\n"`.
+     */
+    columns(column_count: number, gap_pt: number, text: string): void;
+    /**
+     * Add a dropdown combo-box.
+     */
+    comboBox(name: string, x: number, y: number, w: number, h: number, options: string[], selected?: string | null): void;
+    /**
+     * Convenience: commit this page's buffered ops to `builder`. Same
+     * as `builder.commitPage(this)` but lets JS users keep the
+     * chain-like flow:
+     *
+     * ```javascript
+     * const page = builder.a4Page();
+     * page.at(72, 720); page.text("Hi");
+     * page.done(builder);
+     * ```
+     */
+    done(builder: WasmDocumentBuilder): void;
+    fieldCalculate(script: string): void;
+    fieldFormat(script: string): void;
+    fieldKeystroke(script: string): void;
+    fieldValidate(script: string): void;
+    /**
+     * Draw a filled rectangle. RGB channels in 0.0-1.0.
+     */
+    filledRect(x: number, y: number, w: number, h: number, r: number, g: number, b: number): void;
+    font(name: string, size: number): void;
+    /**
+     * Add a footnote: inline `refMark` at the cursor and `noteText` body
+     * near the page bottom with a separator artifact line.
+     */
+    footnote(ref_mark: string, note_text: string): void;
+    freeText(x: number, y: number, w: number, h: number, text: string): void;
+    heading(level: number, text: string): void;
+    highlight(r: number, g: number, b: number): void;
+    horizontalRule(): void;
+    /**
+     * Embed a decorative image (JPEG/PNG/WebP bytes) as an /Artifact (no alt text).
+     */
+    imageArtifact(bytes: Uint8Array, x: number, y: number, w: number, h: number): void;
+    /**
+     * Embed an image (JPEG/PNG/WebP bytes) with an accessibility alt text.
+     */
+    imageWithAlt(bytes: Uint8Array, x: number, y: number, w: number, h: number, alt_text: string): void;
+    /**
+     * Emit `text` inline (advances cursorX only, not cursorY).
+     */
+    inline(text: string): void;
+    /**
+     * Inline bold run.
+     */
+    inlineBold(text: string): void;
+    /**
+     * Inline colored run (RGB 0.0–1.0).
+     */
+    inlineColor(r: number, g: number, b: number, text: string): void;
+    /**
+     * Inline italic run.
+     */
+    inlineItalic(text: string): void;
+    /**
+     * Draw a line from (x1, y1) to (x2, y2) with 1pt black stroke.
+     */
+    line(x1: number, y1: number, x2: number, y2: number): void;
+    linkJavascript(script: string): void;
+    linkNamed(destination: string): void;
+    linkPage(page: number): void;
+    linkUrl(url: string): void;
+    /**
+     * Measure the rendered width of `text` in the builder's current font
+     * and size, in PDF points. Pure query — does not mutate state.
+     *
+     * Thin JS view over [`crate::writer::FluentPageBuilder::measure`]. The
+     * WASM class tracks the current font/size independently of the
+     * buffered ops so this query is served without a live builder.
+     */
+    measure(text: string): number;
+    /**
+     * Finish the current page and start a new one with the same page
+     * size. Cursor resets to the top-left margin (72, height-72). The
+     * builder's font carries over.
+     */
+    newPageSameSize(): void;
+    /**
+     * Advance cursorY by one line-height and reset cursorX to 72 pt.
+     */
+    newline(): void;
+    onClose(script: string): void;
+    onOpen(script: string): void;
+    paragraph(text: string): void;
+    /**
+     * Add a clickable push button with a visible caption.
+     */
+    pushButton(name: string, x: number, y: number, w: number, h: number, caption: string): void;
+    /**
+     * Add a radio-button group. `values`, `xs`, `ys`, `ws`, `hs` are
+     * parallel arrays of length N describing each option's export
+     * value and rectangle. `selected` picks the initial value.
+     */
+    radioGroup(name: string, values: string[], xs: Float32Array, ys: Float32Array, ws: Float32Array, hs: Float32Array, selected?: string | null): void;
+    /**
+     * Draw a stroked rectangle outline (1pt black).
+     */
+    rect(x: number, y: number, w: number, h: number): void;
+    /**
+     * Points remaining on the current page below the cursor (down to the
+     * 72 pt bottom margin). Mirrors
+     * [`crate::writer::FluentPageBuilder::remaining_space`] using the WASM
+     * class's independently-tracked cursor — accurate after `at`, `text`,
+     * `space`, `newPageSameSize`, `textInRect` and the table helpers.
+     */
+    remainingSpace(): number;
+    /**
+     * Add an unsigned signature placeholder field at the given bounds.
+     */
+    signatureField(name: string, x: number, y: number, w: number, h: number): void;
+    space(points: number): void;
+    squiggly(r: number, g: number, b: number): void;
+    stamp(name: string): void;
+    stickyNote(text: string): void;
+    stickyNoteAt(x: number, y: number, text: string): void;
+    /**
+     * Open a streaming table. Returns a `StreamingTable` handle the caller
+     * pushes rows into; call `finish()` when done. The streamed rows are
+     * buffered per-table and replayed against the real Rust
+     * `StreamingTable` at `done()` commit time — avoiding the
+     * FluentPageBuilder-lifetime problem that otherwise can't cross the
+     * wasm-bindgen boundary.
+     */
+    streamingTable(spec: any): StreamingTable;
+    strikeout(r: number, g: number, b: number): void;
+    /**
+     * Draw a straight line with explicit stroke width and RGB colour.
+     */
+    strokeLine(x1: number, y1: number, x2: number, y2: number, width: number, r: number, g: number, b: number): void;
+    /**
+     * Draw a stroked rectangle with explicit stroke width and RGB colour.
+     */
+    strokeRect(x: number, y: number, w: number, h: number, width: number, r: number, g: number, b: number): void;
+    /**
+     * Render a buffered table from a JS object:
+     *
+     * ```javascript
+     * page.table({
+     *   columns: [
+     *     { header: "SKU", width: 100, align: Align.Left },
+     *     { header: "Qty", width: 60,  align: Align.Right },
+     *   ],
+     *   rows: [["A-1","12"], ["B-2","3"]],
+     *   hasHeader: true,
+     * });
+     * ```
+     *
+     * Uses `serde-wasm-bindgen` for deserialisation. Replays against the
+     * Rust `Table` builder at `done()` commit time.
+     */
+    table(spec: any): void;
+    text(text: string): void;
+    textField(name: string, x: number, y: number, w: number, h: number, default_value?: string | null): void;
+    /**
+     * Place wrapped text inside a rectangle with horizontal alignment.
+     * `align` is the `Align` enum (0 = Left, 1 = Center, 2 = Right) — also
+     * accepts a raw integer for JS callers that pre-date the enum import.
+     */
+    textInRect(x: number, y: number, w: number, h: number, text: string, align: number): void;
+    underline(r: number, g: number, b: number): void;
+    watermark(text: string): void;
+    watermarkConfidential(): void;
+    watermarkDraft(): void;
+}
+
 /**
  * A footer definition.
  */
@@ -203,6 +610,21 @@ export class WasmPdf {
      * @param author - Optional document author
      */
     static fromHtml(content: string, title?: string | null, author?: string | null): WasmPdf;
+    /**
+     * Render `html` with `css` applied, embedding `font_bytes` for the
+     * body text. The font must cover every codepoint used by `html` or
+     * unknown glyphs fall back to `.notdef`. See
+     * [`Self::from_html_css_with_fonts`] for a multi-font cascade.
+     */
+    static fromHtmlCss(html: string, css: string, font_bytes: Uint8Array): WasmPdf;
+    /**
+     * Render `html` + `css` with a multi-font cascade. `families` and
+     * `fonts` are parallel arrays: `families[i]` names the CSS
+     * `font-family` that resolves to `fonts[i]` bytes. The first entry
+     * is the default used whenever a CSS `font-family` doesn't match a
+     * registered family.
+     */
+    static fromHtmlCssWithFonts(html: string, css: string, families: string[], fonts: Uint8Array[]): WasmPdf;
     /**
      * Create a PDF from image bytes (PNG, JPEG, etc.).
      *
@@ -477,6 +899,15 @@ export class WasmPdfDocument {
      * Flatten annotations on a page into the page content.
      */
     flattenPageAnnotations(page_index: number): void;
+    /**
+     * Return warnings collected during the last form-flattening save.
+     *
+     * Each entry names a widget field that had no `/AP` appearance stream;
+     * flattening such a field produces a blank rectangle.
+     *
+     * @returns Array of warning strings
+     */
+    flattenWarnings(): string[];
     /**
      * Get annotations from a page.
      *
@@ -530,6 +961,13 @@ export class WasmPdfDocument {
      * @returns Number of pages merged
      */
     mergeFrom(data: Uint8Array): number;
+    /**
+     * Move a page within the document. Zero-based; `from_index` and
+     * `to_index` refer to positions **before** the move, matching the
+     * Python (`PyPdfDocument.move_page`) / Go (`DocumentEditor.MovePage`) /
+     * C# contracts.
+     */
+    movePage(from_index: number, to_index: number): void;
     /**
      * Load a PDF document from raw bytes.
      *
@@ -626,6 +1064,16 @@ export class WasmPdfDocument {
      * @returns Uint8Array containing the modified PDF
      */
     saveToBytes(): Uint8Array;
+    /**
+     * Save with options (compress, garbage_collect, linearize) and return bytes.
+     *
+     * @param {Object} [options] - Optional save options.
+     * @param {boolean} [options.compress=true] - Compress raw streams with FlateDecode.
+     * @param {boolean} [options.garbageCollect=true] - Remove unreachable objects.
+     * @param {boolean} [options.linearize=false] - Linearize (reserved, no-op).
+     * @returns Uint8Array containing the modified PDF
+     */
+    saveWithOptions(compress?: boolean | null, garbage_collect?: boolean | null, linearize?: boolean | null): Uint8Array;
     /**
      * Search for text across all pages.
      *
@@ -681,6 +1129,17 @@ export class WasmPdfDocument {
      * Set the document title.
      */
     setTitle(title: string): void;
+    /**
+     * Count existing PDF signatures. Returns 0 when the document has
+     * no AcroForm or no signed signature fields.
+     */
+    signatureCount(): number;
+    /**
+     * Enumerate existing PDF signatures. Each entry is a
+     * `WasmSignature` (inspection-only) mirroring the C# and Python
+     * Signature surfaces.
+     */
+    signatures(): WasmSignature[];
     /**
      * Convert a single page to HTML.
      *
@@ -793,6 +1252,119 @@ export class WasmPdfPageRegion {
     extractWords(): any;
 }
 
+/**
+ * A single existing PDF signature surfaced by
+ * `WasmPdfDocument.signatures()`. `verify()` runs the RSA-PKCS#1 v1.5
+ * signer-attributes check; `verifyDetached()` adds the
+ * `messageDigest` content-hash check. RSA-PSS / ECDSA signers still
+ * throw an `UnsupportedFeature`-mapped JS error.
+ */
+export class WasmSignature {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Run the RFC 5652 §5.4 signer-attributes crypto check. Today
+     * this covers RSA-PKCS#1 v1.5 over SHA-1/256/384/512 — the
+     * padding used by essentially every PDF signature.
+     *
+     * A `true` return proves the signer held the private key matching
+     * the embedded certificate and that the signed-attribute bundle
+     * is authentic. It does **not** verify the `messageDigest`
+     * attribute against the document's byte-range content hash —
+     * call `verifyDetached()` for that end-to-end check.
+     *
+     * Throws for RSA-PSS, ECDSA, unknown digest OIDs, or signatures
+     * without signed_attrs.
+     */
+    verify(): boolean;
+    /**
+     * End-to-end detached-signature verification. Runs both the
+     * signer-attributes RSA-PKCS#1 v1.5 crypto check AND the RFC 5652
+     * §11.2 `messageDigest` check against the segment of `pdfData`
+     * this signature covers (extracted via `/ByteRange`).
+     *
+     * `pdfData` must be the full PDF file. A `true` result proves
+     * both the signer is authentic and that the document's byte-range
+     * content has not been altered since signing. `false` means one
+     * of the two checks failed (wrong key or tampered content).
+     *
+     * Throws for RSA-PSS, ECDSA, unknown digest OIDs, or CMS blobs
+     * missing `signed_attrs` / `messageDigest`.
+     */
+    verifyDetached(pdf_data: Uint8Array): boolean;
+    /**
+     * `/ContactInfo` entry from the signature dictionary, if present.
+     */
+    readonly contactInfo: string | undefined;
+    /**
+     * True iff `/ByteRange` is a 4-element array covering the whole
+     * document (i.e. the signature protects every byte of the file).
+     */
+    readonly coversWholeDocument: boolean;
+    /**
+     * `/Location` entry from the signature dictionary, if present.
+     */
+    readonly location: string | undefined;
+    /**
+     * `/Reason` entry from the signature dictionary, if present.
+     */
+    readonly reason: string | undefined;
+    /**
+     * `/Name` entry from the signature dictionary, if present.
+     */
+    readonly signerName: string | undefined;
+    /**
+     * Unix epoch (seconds). `None` if the `/M` entry is missing or
+     * unparseable.
+     */
+    readonly signingTime: bigint | undefined;
+}
+
+/**
+ * RFC 3161 timestamp parsed from a DER TimeStampToken or bare
+ * TSTInfo. Mirrors the C#, Go, and Python `Timestamp` surfaces.
+ */
+export class WasmTimestamp {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Parse a DER blob that may be either a full TimeStampToken or
+     * the bare TSTInfo SEQUENCE.
+     */
+    static parse(data: Uint8Array): WasmTimestamp;
+    /**
+     * Cryptographic verify — not yet implemented.
+     */
+    verify(): boolean;
+    /**
+     * Hash algorithm enum value (1=SHA1, 2=SHA256, 3=SHA384,
+     * 4=SHA512, 0=unknown).
+     */
+    readonly hashAlgorithm: number;
+    /**
+     * Raw message-imprint hash bytes.
+     */
+    readonly messageImprint: Uint8Array;
+    /**
+     * TSA policy OID in dotted-decimal form.
+     */
+    readonly policyOid: string;
+    /**
+     * Serial number as a hex string (no `0x` prefix).
+     */
+    readonly serial: string;
+    /**
+     * Generation time as Unix epoch seconds.
+     */
+    readonly time: bigint;
+    /**
+     * TSA name from the token (may be empty).
+     */
+    readonly tsaName: string;
+}
+
 /**
  * Disable all pdf_oxide log output — convenience wrapper for
  * `setLogLevel("off")`.
@@ -817,3 +1389,11 @@ export function disableLogging(): void;
  * ```
  */
 export function setLogLevel(level: string): void;
+
+/**
+ * Sign raw PDF bytes and return the signed PDF as a `Uint8Array`.
+ *
+ * `cert` must carry a private key (loaded via `Certificate.loadPem` or
+ * `Certificate.loadPkcs12`).
+ */
+export function signPdfBytes(pdf_data: Uint8Array, cert: WasmCertificate, reason?: string | null, location?: string | null): Uint8Array;

package/bundler/pdf_oxide.js

@@ -0,0 +1,9 @@
+/* @ts-self-types="./pdf_oxide.d.ts" */
+import * as wasm from "./pdf_oxide_bg.wasm";
+import { __wbg_set_wasm } from "./pdf_oxide_bg.js";
+
+__wbg_set_wasm(wasm);
+
+export {
+    Align, ArtifactStyle, StreamingTable, WasmArtifact, WasmCertificate, WasmDocumentBuilder, WasmEmbeddedFont, WasmFluentPageBuilder, WasmFooter, WasmHeader, WasmOcrConfig, WasmOcrEngine, WasmPageTemplate, WasmPdf, WasmPdfDocument, WasmPdfPageRegion, WasmSignature, WasmTimestamp, disableLogging, setLogLevel, signPdfBytes
+} from "./pdf_oxide_bg.js";