Home  ›  Playgrounds  ›  CLI command builder

pdfnative-cli command builder

Pick a command, fill the form, copy the resulting npx pdfnative-cli invocation. Covers the full CLI surface: render (with --outline / --font math / --inspect-layout), sign (RSA + ECDSA-SHA256, native constant-time crypto, --pure-crypto opt-out), inspect (with --annotations), verify, and the v1.2.0 page-tree / governance commands merge, split, extract, annotate, and govern. The builder runs entirely in your browser — nothing is uploaded.

Path to JSON input. Omit to read from stdin.
Output path. Omit to write to stdout.
Selects the renderer variant.
Single value or top,right,bottom,left in points.
FlateDecode all content streams.
AsyncGenerator streaming output.
Load any subset of PdfLayoutOptions. CLI flags override the layout file.
Comma-separated language codes. Non-Latin requires a registerFontLoader() wrapper.
Iteration helpers
Re-render on input/layout/template change. Requires --input + --output.
JSON file with { "key": "value" } pairs substituted into the document.
Bundled font codes. For other scripts use --lang.
Bookmarks, math & layout v1.2
Add a /Outlines bookmark tree. auto derives it from headings.
Emit a LayoutInspection JSON report instead of a PDF.
Overlay layout-debug guides on a normal PDF.
Watermark
Headers / footers
Placeholders: {page}, {pages}, {date}, {title}. {pages} is rejected with --stream.
Encryption (mutually exclusive with --tagged pdfa*)
Required if any --encrypt-* flag is set. Prefer the env var.
PDF/A-3 attachments
Format: path[:mime[:relationship[:description]]]. Repeatable.
Or set $PDFNATIVE_SIGN_KEY.
Or set $PDFNATIVE_SIGN_CERT.
Repeatable. Or set $PDFNATIVE_SIGN_CHAIN.
Force the portable pure-JS CMS path. Default is native constant-time node:crypto.
Adds trailerKeys, catalogKeys, objectCount, xmpMetadata.
Per-page geometry, annotations, form fields.
List markup + link annotations per page. Page labels reported automatically.
--check (CI assertions, ANDed)
Exit code 0 on all-pass, 1 on any failure. Composable with --format.
Exit 1 on any failure or zero signatures.
Trust-anchor PEMs. Repeatable.

Scope (v1.1.0): full CMS/PKCS#7 verification (RSA + ECDSA-SHA256), byte-range integrity (SHA-256), certificate chain, trust evaluation against --trust roots, RFC 3161 timestamp validation (PAdES-T), and OCSP/CRL revocation checking via --revocation / --revocation-policy. See the CLI guide.

Source PDFs, concatenated in order. Repeatable.
Output ceiling in bytes (default 256 MiB).

Encrypted sources are rejected; signatures and /AcroForm are dropped (page edits invalidate /ByteRange); URI /Link annotations are preserved. Every path is validated against traversal.

Required. Parts written as <prefix>-<n>.pdf.
Comma-separated 1-based inclusive ranges. Omit for one output per page.
1-based page list/ranges. Order is preserved and repeats are allowed.
JSON array (or { "annotations": [...] }): each entry a markup annotation plus a 1-based page.

Written with an incremental save, so existing signatures stay valid. Types: text, highlight, underline, strikeout, squiggly, square, circle, line, freetext. Overlay, not redaction.

rules prints the agent/human protocol; policy the machine-readable JSON; verify-issue gates a draft.
Path to the local issue draft to gate. Exit 1 / E_POLICY on a violation.
Machine-readable output (best with policy).

Agents act as draftsmen: a human must always review and submit. verify-issue is a pure, fully offline validator — no GitHub or network access.

Generated command 

npx pdfnative-cli render

Paste this in any shell. Secrets are never sent — the entire builder runs client-side.

What this playground does not do

It does not execute the CLI in your browser — signing real PDFs requires real private keys, and we will not pretend to. For an in-browser demo of render output, see the homepage live demo. To exercise the full CLI on your machine: npx pdfnative-cli <your built command>.

Resources