Administracion-Abierta / AutoFirme

# AutoFirma Web
Client-side-rendered SPA: sign and verify documents with X.509 certificates, entirely in the
browser. No backend, no key material leaving the client.
The reference implementation is AutoFirma
(`ctt-gob-es/clienteafirma`, the Spanish government's signing client, GPL-2+/EUPL-1.1): this
project re-thinks its signing core (`afirma-core`, the `AOSigner` family) as a browser-native
TypeScript app. See docs/architecture.md for the map of the Java signing
core this rewrite follows, and AGENTS.md for the repo rules.
The app lives at the repo root; from the root:
 [code] 
## Chrome extension
The complete webapp is also available as a responsive Manifest V3 extension, with
a certificate chooser for supported website AutoFirma requests. Build with
`pnpm build:extension` and load `dist/extension` in Chrome Developer mode.
See extension installation, features and security boundaries.
## Stack
- SvelteKit 3 (static adapter) + Svelte 5 runes + Vite + TypeScript
- Tailwind CSS v4 (`@tailwindcss/vite`)
- shadcn-svelte components (bits-ui) on the same tokens; dark mode is the `.dark` class on ` `,
 driven by the system preference from an inline script in `src/app.html` (#27)
- pnpm, Node 22 for builds
- Vitest + `@testing-library/svelte` + jsdom for the smoke test
| Path | Contents |
|---|---|
| `src/routes/` | Pages — `/` is the sign flow |
| `src/lib/App.svelte` | Sign workflow shell (2/3 drop + file list, 1/3 sticky actions on ≥1024px; stacked below) and verify workflow |
| `src/lib/components/` | `FileDrop`, `FileCard`, `CertPicker`, `BatchQueue`, `VerifyReport` |
| `src/lib/components/ui/` | shadcn-svelte primitives (button, card, table, badge, input, dropdown-menu, dialog, tooltip) + their snapshot test (#27) |
| `src/lib/utils.ts` | `cn()` class merger used by the primitives |
| `components.json` | shadcn-svelte CLI config (`#lib` aliases, neutral base, `src/app.css`) |
| `src/lib/asn1.ts` | DER reader and writer (PKCS#12 / X.509 / CMS) |
| `src/lib/pkcs12.ts` | PKCS#12 container: PBES2 decryption, certificate bags |
| `src/lib/x509.ts` | Certificate summary (subject, issuer, validity, public key) |
| `src/lib/keystore.ts` | PIN + container → non-extractable `CryptoKey` + certificate list |
| `src/lib/cms.ts` | CAdES-BES detached `SignedData` (WebCrypto digest + hand-built DER) |
| `src/lib/sign.ts` | Format list and sign-flow types (the seam for #6–#11) |
| `src/lib/c14n.ts` | Canonical XML: C14N 1.0 + Exclusive C14N |
| `src/lib/xades.ts` | XAdES-EPES enveloped signature over an XML document |
| `src/lib/pades.ts` | PAdES B-B signing: CMS `SignedData` over a real PDF incremental update |
| `src/lib/pades-visible.ts` | Visible signature block: corner/page placement, image embedding, block text |
| `src/lib/der.ts` | Minimal DER writer/reader for the PAdES CMS structures |
| `src/lib/batch.ts` | Batch queue state machine, manifest and ZIP assembly (engine-agnostic) |
| `src/lib/zip.ts` | ZIP writer (STORE entries, CRC-32) — no dependency, ver