v1.4.0 — PAdES B-T/B-LT/B-LTA, compare, metadata & manifest pipelines

pdfnative-cli v1.4.0

Released 2026-08-26

Built on pdfnative 1.7.0. This release completes the PAdES ladder promised on the
roadmap — trusted timestamps at signing time (B-T), long-term validation data
(B-LT) and document timestamps (B-LTA) — and grows the CLI from 17 to
21 commands with ltv, doc-timestamp, metadata and compare, plus
multi-signature support, declarative batch --manifest pipelines, print production,
PDF/A strict diagnostics, charts v2 and JSON-usable image blocks. The command surface
is 100% backward-compatible; network I/O remains strictly opt-in and SSRF-guarded.

Highlights

• The full PAdES ladder, composable:

  pdfnative sign --timestamp https://tsa.example/tsr --profile pades ...   # B-T
  pdfnative ltv add --online -i signed.pdf -o lt.pdf                       # B-LT
  pdfnative doc-timestamp --url https://tsa.example/tsr -i lt.pdf -o lta.pdf  # B-LTA
  pdfnative ltv add --online -i lta.pdf -o final.pdf   # LTV for the doc-timestamp

• Air-gapped LTV — ltv collect --online emits a replayable JSON file
  (schema subject ltv-data); ltv embed applies it fully offline.
• compare a.pdf b.pdf — text + structure diffing with CI-friendly exit codes
  (identical → 0, different → 1 / E_CHECK_FAILED).
• metadata — incremental /Info + XMP updates that keep existing signatures valid.
• batch --manifest tasks.json — declarative render → sign → encrypt pipelines with
  @id output references; an untrusted manifest can never trigger network I/O without
  --allow-network.
• Multiple signatures — sign --allow-multiple --field-name Approval2, inventoried by
  inspect --signatures and validated per field by verify.
• Print production — bleed/trim/art boxes, vector printer marks, /UserUnit, RGB ICC
  output intents, duplex/copies viewer preferences; boxes now survive
  merge/split/extract.
• Charts v2 — 9 chart kinds, secondary axis, log/time axes, data labels.
• render --strict — PDF/A diagnostics escalate to a hard error before any output byte.
• PDF/A claims are now proven, not asserted — every PDF/A-claiming output is validated
  against the veraPDF reference validator in CI (blocking), including negative canaries
  the validator must reject. Locally: npm run validate:pdfa (skips with exit 0 when
  veraPDF is absent — a skip, not a pass). Conformance recipe:
  --tagged pdfa<level> --font latin --lang latin.

What's new

New commands

• ltv collect|embed|add — PAdES B-LT /DSS + /VRI via pdfnative 1.7.0
  collectValidationInfo / embedValidationInfo / addValidationInfo. --online is
  mandatory for any fetching (OCSP preferred, CRL fallback — --prefer), --extra-cert
  completes chains out-of-band, and embed never touches the network.
• doc-timestamp — appends a /DocTimeStamp revision (/SubFilter /ETSI.RFC3161,
  ISO 32000-2 §12.8.5) covering every byte; earlier revisions stay byte-identical. Repeat
  to renew LTA protection.
• metadata — --title/--author/--subject/--keywords/--mod-date/--from-json,
  incremental save (signatures preserved), XMP kept in sync.
• compare — --mode text|structure|both, --format json (schema subject
  compare), --tolerance, --ignore-whitespace, --pages, per-file passwords. Visual
  diffing is explicitly out of scope (no rasteriser upstream).

sign

• --timestamp <tsa-url> is now functional (previously a reserved flag that errored with
  E_UNSUPPORTED, as its message announced) with --timestamp-digest and
  --timestamp-nonce; failures are E_NETWORK/E_PARSE with no silent fallback to
  an untimestamped signature.
• --allow-multiple, --field-name, --profile pkcs7|pades,
  --digest sha256|sha384|sha512, --signature-rect, --signature-page,
  --placeholder-bytes.

verify

• Verifies RSA SHA-384/512 CMS signatures (rsa-sha384 / rsa-sha512).
• Validates /DocTimeStamp revisions as RFC 3161 tokens; reports fieldName and
  isDocTimestamp per signature (additive fields).

inspect / annotate

• inspect --signatures (structural inventory, never the signature bytes),
  print-production page boxes + /UserUnit, metadata.trapped,
  --check "signatures>=N".
• annotate --password for encrypted PDFs.

render

• --strict, stderr warning: diagnostics + diagnostics[] in the --json envelope.
• Image blocks from JSON: src (path) or dataBase64 (inline).
• layout.print (bleed/boxes/marks/userUnit), layout.outputIntent (RGB ICC),
  layout.viewerPreferences (duplex, pickTrayByPDFSize, printPageRange, numCopies),
  params.metadata (incl. trapped), charts v2, --chunk-size.

Agent surface

• New stable error code E_NETWORK; schema subjects 15 → 19 (ltv-data,
  compare, batch-manifest, metadata); extended render/inspect/verify/
  batch/status schemas; global --max-inflate-size (anti zip-bomb, default
  100 MiB); capability manifest, completions (bash/zsh/fish/powershell) and
  llms.txt cover all 21 commands.

Compatibility

• 100% backward-compatible command surface — no flag, default, exit code, error code
  or envelope changed; every addition is opt-in or additive.
• Support policy: Node.js ≥ 22 (was ≥ 20; Node 20 reached EOL on 2026-04-30 and
  pdfnative 1.7.0 declares engines.node >= 22). CI now tests Node 22 + 24.
• Inherited pdfnative 1.7.0 byte-level improvements: form-bearing documents gain fully
  searchable text, RTL shaping fixes, and merge/split/extract preserve
  Bleed/Trim/Art boxes + /UserUnit. Outputs remain spec-valid but are not byte-identical
  to 1.3.0 for those documents.

Security

• All new network paths (TSA, OCSP, CRL) are opt-in only (--timestamp, --url,
  --online, batch --allow-network) and go through the existing SSRF guard: http/https
  only, private/loopback/metadata addresses blocked, DNS pinning, 10 s timeout, 5 MiB
  response cap, no redirects. Response bodies are never echoed into CLI output.
• Global --max-inflate-size caps decompression while parsing untrusted PDFs.
• Dev-dependency overrides refreshed (js-yaml ^4.3.1, nanoid ^3.3.18); npm audit
  clean.

Fixed

• inspect signature/form-field counters were always 0 — parsed PDF name objects were
  compared against raw strings and never matched; both counters now use the parser's
  nameValue.

Notes

• The whole PAdES ladder is tested offline against an in-process mock PKI issuing genuine
  RFC 3161 tokens, OCSP responses and CRLs — zero network, zero binary fixtures.
• Samples for every new capability ship as .sh + .ps1 pairs, offline by default;
  timestamp/LTV samples run their network step only when PDFNATIVE_TSA_URL is set.
• Still tracked upstream (see ROADMAP): optimize (linearisation), visual compare
  (rasteriser), arbitrary object modify.

Install

npm install -g pdfnative-cli@1.4.0

Upgrade

No action required from 1.x — all existing invocations behave identically on Node ≥ 22.

Verification

• 600 vitest tests green on Node 22/24; coverage above the enforced thresholds.
• PDF/A validation corpus (12 files) validated with veraPDF 1.30.2 locally: 10 PASS +
  2 XFAIL (negative canaries correctly rejected), exit 0. The same gate runs blocking
  in CI (verapdf.yml, SHA-256-verified pinned installer) and pre-publish
  (publish.yml).
• npm audit clean; built binary smoke-tested (node dist/cli.cjs …) for every command.
• SBOM (CycloneDX) and npm provenance attached by the release workflow. Consumers
  can verify the published package's provenance and registry signatures with
  npm audit signatures after installing.