@signpdf

WHAT IS IT?

@signpdf is a family of npm packages that digitally sign PDFs from Node.js. The flow has two halves: first you insert a signature placeholder into the document, meaning a Sig object and a Widget attached to a form declared in the PDF Root, then @signpdf/signpdf replaces the reserved zeros in the Contents descriptor with the real signature. The project is upfront about its goal: show that flow in readable code, because piecing it together from the spec takes hours.

WHY IS IT INTERESTING?

• Split into small packages: @signpdf/signpdf orchestrates, a signer supplies the crypto, a helper adds the placeholder. You install only the combination your case needs.
• One helper per way of getting a PDF: placeholder-pdfkit for PDFKit 0.11 and up, placeholder-pdfkit010 for PDFKit 0.10, placeholder-pdf-lib for PDF-LIB, and placeholder-plain for a .pdf file already on disk.
• Detached signing: @signpdf/signer-p12 signs a buffer with a P12 bundle through node-forge. In detached mode the signature length depends on the certificate rather than on document size, so you size the placeholder once.
• PAdES: the ETSI.CAdES.detached subfilter is declared with the subFilter option on the placeholder helpers, in place of the default Adobe value.
• The limits are written down: placeholder-plain works through string operations, so it is fragile, has no stream support and stops at PDF 1.3. The README says so, while noting it is the most used helper of the set.
• Types and examples: the packages publish TypeScript declarations, and the repo carries one runnable example per combination, in JS and in TS.

USE CASES

• Sign invoices or contracts on the fly as PDFKit or PDF-LIB generates them.
• Apply a company certificate to PDFs arriving from mixed sources, inside a backend job.
• Produce PAdES-compliant signatures for European regulatory use.
• Handle documents that already carry a placeholder from another tool, with @signpdf/signpdf and a signer alone.
• Read a short implementation of the PDF signature format before writing your own.

The README states its own scope: only the basic PDF signing scenarios are covered. The cryptography itself goes through node-forge, declared as a peer dependency of the P12 signer.