pdf-oxide-wasm 0.3.49 → 0.3.50

package/bundler/pdf_oxide.d.ts

@@ -45,6 +45,93 @@ export class ArtifactStyle {
     constructor();
 }
 
+/**
+ * A parsed Document Security Store (`/DSS`, ISO 32000-2 §12.8.4.3).
+ * Count + index accessors mirror `WasmCertificate`'s flat shape
+ * (wasm-bindgen cannot return `Uint8Array[]` directly).
+ */
+export class Dss {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * The `i`-th DER certificate, or `undefined` if out of range.
+     */
+    getCert(i: number): Uint8Array | undefined;
+    /**
+     * The `i`-th DER CRL, or `undefined` if out of range.
+     */
+    getCrl(i: number): Uint8Array | undefined;
+    /**
+     * The `i`-th DER OCSP response, or `undefined` if out of range.
+     */
+    getOcsp(i: number): Uint8Array | undefined;
+    /**
+     * Number of DER X.509 certificates in the DSS.
+     */
+    readonly certCount: number;
+    /**
+     * Number of DER CRLs in the DSS.
+     */
+    readonly crlCount: number;
+    /**
+     * Number of DER OCSP responses in the DSS.
+     */
+    readonly ocspCount: number;
+    /**
+     * Per-signature VRI keys (uppercase-hex SHA-1 of `/Contents`).
+     */
+    readonly vri: string[];
+}
+
+/**
+ * PAdES baseline level. Frozen integer mapping (BB=0, BT=1, BLt=2,
+ * BLta=3) shared with the C ABI and every binding — never renumber.
+ */
+export enum PadesLevel {
+    /**
+     * B-B: signed attrs incl. the ESS signing-certificate-v2.
+     */
+    BB = 0,
+    /**
+     * B-T: B-B + an RFC 3161 signature-time-stamp unsigned attr.
+     */
+    BT = 1,
+    /**
+     * B-LT: B-T + a Document Security Store (DSS/VRI).
+     */
+    BLt = 2,
+    /**
+     * B-LTA: B-LT + a document-scoped `/DocTimeStamp`.
+     */
+    BLta = 3,
+}
+
+/**
+ * Offline B-LT validation material (DER certs / CRLs / OCSP
+ * responses). Build with `new()` then `addCert`/`addCrl`/`addOcsp`.
+ */
+export class RevocationMaterial {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Add a DER X.509 certificate.
+     */
+    addCert(der: Uint8Array): void;
+    /**
+     * Add a DER CRL.
+     */
+    addCrl(der: Uint8Array): void;
+    /**
+     * Add a DER OCSP response.
+     */
+    addOcsp(der: Uint8Array): void;
+    /**
+     * Create an empty revocation-material set.
+     */
+    constructor();
+}
+
 /**
  * WASM handle to a streaming-table building session. Created by
  * `FluentPageBuilder.streamingTable()`; rows are pushed via `pushRow`,
@@ -703,6 +790,11 @@ export class WasmPdf {
 export class WasmPdfDocument {
     free(): void;
     [Symbol.dispose](): void;
+    /**
+     * Queue an explicit destructive redaction rectangle on a page
+     * (page user space; `fill` is an optional DeviceRGB `[r,g,b]`).
+     */
+    addRedaction(page: number, x0: number, y0: number, x1: number, y1: number, fill?: Float32Array | null): void;
     /**
      * Apply all redactions in the document.
      */
@@ -711,6 +803,11 @@ export class WasmPdfDocument {
      * Apply redactions on a page (removes redacted content permanently).
      */
     applyPageRedactions(page_index: number): void;
+    /**
+     * Destructively apply all queued redactions (true content removal,
+     * ISO 32000-1:2008 §12.5.6.23). Returns a `RedactionReport` object.
+     */
+    applyRedactionsDestructive(scrub_metadata?: boolean | null): any;
     /**
      * Authenticate with a password to decrypt an encrypted PDF.
      *
@@ -737,6 +834,11 @@ export class WasmPdfDocument {
      * Delete a page by index (0-based).
      */
     deletePage(index: number): void;
+    /**
+     * The document's Document Security Store (`/DSS`) as a `Dss`, or
+     * `undefined` if absent. Mirrors Rust `signatures::read_dss`.
+     */
+    dss(): Dss | undefined;
     /**
      * Deprecated: Use eraseFooter instead.
      */
@@ -1051,6 +1153,10 @@ export class WasmPdfDocument {
      * Get the rotation of a page in degrees (0, 90, 180, 270).
      */
     pageRotation(page_index: number): number;
+    /**
+     * Number of redaction regions queued for `page`.
+     */
+    redactionCount(page: number): number;
     /**
      * Identify and remove both headers and footers.
      *
@@ -1104,6 +1210,12 @@ export class WasmPdfDocument {
      * Rotate a page by the given degrees (adds to current rotation).
      */
     rotatePage(page_index: number, degrees: number): void;
+    /**
+     * Standalone document sanitization (#231 T10): strip `/Info`,
+     * catalog XMP `/Metadata`, document JavaScript and embedded files
+     * without geometric redaction. Returns a `RedactionReport` object.
+     */
+    sanitizeDocument(scrub_metadata?: boolean | null, remove_javascript?: boolean | null, remove_embedded_files?: boolean | null): any;
     /**
      * Save all edits and return the resulting PDF as bytes.
      *
@@ -1374,6 +1486,12 @@ export class WasmSignature {
      * `/Location` entry from the signature dictionary, if present.
      */
     readonly location: string | undefined;
+    /**
+     * PAdES baseline level from this signature's CMS attributes alone
+     * (`BB` vs `BT`). `BLt` additionally needs the document `/DSS` —
+     * read it via `WasmPdfDocument.dss()` and re-classify there.
+     */
+    readonly padesLevel: PadesLevel;
     /**
      * `/Reason` entry from the signature dictionary, if present.
      */
@@ -1437,6 +1555,23 @@ export class WasmTimestamp {
     readonly tsaName: string;
 }
 
+/**
+ * A CycloneDX 1.6 Cryptographic Bill of Materials (JSON string) of the
+ * algorithms exercised so far this process (#230 Phase F).
+ */
+export function cryptoCbom(): string;
+
+/**
+ * The cryptographic algorithm tokens exercised so far this process
+ * (governance report), as a JSON string array.
+ */
+export function cryptoInventory(): any;
+
+/**
+ * The active crypto policy as its canonical grammar string.
+ */
+export function cryptoPolicy(): string;
+
 /**
  * Disable all pdf_oxide log output — convenience wrapper for
  * `setLogLevel("off")`.
@@ -1457,6 +1592,29 @@ export function generateBarcodeSvg(barcode_type: number, data: string): string;
  */
 export function generateQrSvg(data: string, error_correction: number, size: number): string;
 
+/**
+ * Whether `pdf_data` carries a document-scoped RFC 3161
+ * `/DocTimeStamp` archival timestamp (PAdES-B-LTA). This is the
+ * document-level reader signal; a `WasmSignature`'s `padesLevel`
+ * getter is signature-scoped and tops out at B-LT by design.
+ */
+export function hasDocumentTimestamp(pdf_data: Uint8Array): boolean;
+
+/**
+ * Plan a bookmark split without producing PDFs. Returns a JSON array
+ * of segment objects (`index, startPage…` shape from
+ * `BookmarkSegment`). `level`: 0 = all depths, 1 = top-level.
+ */
+export function planSplitByBookmarks(src_bytes: Uint8Array, title_prefix: string | null | undefined, ignore_case: boolean, level: number, include_front_matter: boolean): any;
+
+/**
+ * Install the process-wide runtime crypto policy from its grammar
+ * string (`"compat"|"strict"|"fips-strict"[;…]`). Fail-closed:
+ * throws on an unparseable spec (policy NOT installed) or if a
+ * policy is already set. Default (never set) is `compat`.
+ */
+export function setCryptoPolicy(spec: string): void;
+
 /**
  * Set the maximum log level for pdf_oxide messages.
  *
@@ -1483,3 +1641,22 @@ export function setLogLevel(level: string): void;
  * `Certificate.loadPkcs12`).
  */
 export function signPdfBytes(pdf_data: Uint8Array, cert: WasmCertificate, reason?: string | null, location?: string | null): Uint8Array;
+
+/**
+ * Sign raw PDF bytes at a PAdES baseline level and return the signed
+ * PDF as a `Uint8Array`.
+ *
+ * `level` `BLTA` is reserved (→ error). For `BT`/`BLt` pass a
+ * pre-fetched RFC 3161 `timestampToken` (DER): WASM intentionally
+ * omits the online TSA client (same `ureq`-incompat carve-out as
+ * v0.3.38) — without a token the core fail-closes with `Unsupported`.
+ * `revocation` supplies the B-LT DSS material.
+ */
+export function signPdfBytesPades(pdf_data: Uint8Array, cert: WasmCertificate, level: PadesLevel, timestamp_token?: Uint8Array | null, revocation?: RevocationMaterial | null, reason?: string | null, location?: string | null): Uint8Array;
+
+/**
+ * Split at bookmark boundaries. Returns a JSON array of
+ * `[segment, bytes]` pairs (bytes as a number array; source
+ * unmodified).
+ */
+export function splitByBookmarks(src_bytes: Uint8Array, title_prefix: string | null | undefined, ignore_case: boolean, level: number, include_front_matter: boolean): any;

package/bundler/pdf_oxide.js

@@ -5,5 +5,5 @@ import { __wbg_set_wasm } from "./pdf_oxide_bg.js";
 __wbg_set_wasm(wasm);
 
 export {
-    Align, ArtifactStyle, StreamingTable, WasmArtifact, WasmCertificate, WasmDocumentBuilder, WasmEmbeddedFont, WasmFluentPageBuilder, WasmFooter, WasmHeader, WasmOcrConfig, WasmOcrEngine, WasmPageTemplate, WasmPdf, WasmPdfDocument, WasmPdfPageRegion, WasmSignature, WasmTimestamp, disableLogging, generateBarcodeSvg, generateQrSvg, setLogLevel, signPdfBytes
+    Align, ArtifactStyle, Dss, PadesLevel, RevocationMaterial, StreamingTable, WasmArtifact, WasmCertificate, WasmDocumentBuilder, WasmEmbeddedFont, WasmFluentPageBuilder, WasmFooter, WasmHeader, WasmOcrConfig, WasmOcrEngine, WasmPageTemplate, WasmPdf, WasmPdfDocument, WasmPdfPageRegion, WasmSignature, WasmTimestamp, cryptoCbom, cryptoInventory, cryptoPolicy, disableLogging, generateBarcodeSvg, generateQrSvg, hasDocumentTimestamp, planSplitByBookmarks, setCryptoPolicy, setLogLevel, signPdfBytes, signPdfBytesPades, splitByBookmarks
 } from "./pdf_oxide_bg.js";