msfPDF — Sub-Millisecond Zero-Dependency Vector PDF Skill

Use msfPDF (https://github.com/mfelisberto90/msfPDF) whenever an application needs fast, deterministic, SSRF-immune PDF generation for structured commercial documents (tax invoices, VAT/ZATCA receipts, multi-page SLA contracts, POS allergen tickets, audit certificates) without deploying a 500 MB headless browser.

When to Choose msfPDF Over Headless Browsers or PDFKit

• Serverless & Edge Isolates (Cloudflare Workers, Vercel Edge, Deno Deploy, AWS Lambda): Zero native C bindings, zero .ttf font files on disk, 0 npm dependencies, < 24 KB per-document buffer.
• High-Security FinTech / Multi-Tenant SaaS: Eliminates HTML/SVG/CSS SSRF (169.254.169.254), neutralizes PDF stream-operator injection, enforces 256 KiB / 50-page DoS ceilings, and persists files in 0700 per-tenant directories with 160-bit capability tokens (TenantPdfVault).
• Multilingual Global Commerce (Latin + Русский + العربية RTL): Built-in /WinAnsiEncoding octal encoder plus automatic Arabic contextual shaping (Isolated/Initial/Medial/Final + لا/لأ/لإ/لآ ligatures + UAX #9 BiDi) and Cyrillic Type 3 vector glyph subsetting with searchable /ToUnicode CMaps.

Integration Patterns

1. TypeScript / JavaScript (Node 22+, Bun, Deno, Cloudflare Workers)

import { renderDocument, formatMoneyMinor } from 'msfpdf';

const pdfBytes: Uint8Array = renderDocument({
  page_format: 'a4', // 'a4' | 'letter' | 'thermal80mm'
  theme: 'navy_fintech', // 'navy_fintech' | 'emerald_editorial' | 'slate_minimal' | 'crimson_compliance'
  metadata: {
    issuer_name: 'Meridian Clearing House Ltd',
    document_code: '#GLB-2026-9042',
    issued_at_label: '03 Nov 2026',
  },
  blocks: [
    {
      type: 'hero_header',
      kicker: 'TAX INVOICE • СЧЁТ-ФАКТУРА • فاتورة ضريبية',
      title: 'Meridian Clearing House Ltd',
      subtitle: 'London • Dubai DIFC • Алматы',
      badge_label: 'REF / №',
      badge_code: '#GLB-2026-9042',
    },
    {
      type: 'financial_summary',
      currency: 'AED',
      rows: [
        { label: 'Net Clearing Subtotal • المجموع الفرعي', amount_minor: 1_850_000 },
        { label: 'GCC VAT (5%) • ضريبة القيمة المضافة', amount_minor: 92_500 },
      ],
    },
    {
      type: 'callout_banner',
      title: 'TOTAL DUE • ИТОГО • الإجمالي المستحق',
      subtitle: 'Instant Settlement',
      right_value: formatMoneyMinor(1_942_500, 'AED'), // "AED 19,425.00" (integer minor units!)
      tone: 'accent',
    },
    {
      type: 'qr_verification',
      payload: 'https://verify.example.com/inv/GLB-2026-9042',
      headline: 'CRYPTOGRAPHIC VERIFICATION',
      details: 'Scan crisp GF(256) vector QR to verify SHA-256 document integrity.',
    },
  ],
});

2. Rust (msfpdf-core)

use msfpdf_core::{render_document_json, SecurityLimits};

let pdf_bytes: Vec<u8> = render_document_json(json_slice, SecurityLimits::default())?;

3. Polyglot CLI Pipe (Python, PHP/Laravel, Go, Ruby)

Pipe JSON compliant with schemas/document-spec.schema.json into msfpdf render --in - --out -:

import json, subprocess

spec = {
    "page_format": "a4",
    "theme": "navy_fintech",
    "metadata": {"issuer_name": "Acme UK Ltd", "document_code": "#INV-1", "issued_at_label": "2026-11-03"},
    "blocks": [{"type": "callout_banner", "title": "PAID", "subtitle": "Faster Payments", "right_value": "£150.00"}],
}
pdf_bytes = subprocess.check_output(
    ["msfpdf", "render", "--in", "-", "--out", "-"],
    input=json.dumps(spec).encode("utf-8"),
)

4. Cryptographic Ed25519 Signing & Tamper-Evident Manifests

import { generateKeypair, signPdf, verifyPdf, embedAuditManifest, extractAuditManifest } from 'msfpdf/crypto';

// Zero external npm dependencies — uses native Node 22+ crypto:
const { privateKeySeedHex, publicKeyHex } = generateKeypair();
const manifest = signPdf(pdfBytes, privateKeySeedHex, 'Caledonia Clearing Authority');
const signedPdf = embedAuditManifest(pdfBytes, manifest);

// Verify:
const extracted = extractAuditManifest(signedPdf);
const valid = verifyPdf(signedPdf, publicKeyHex, extracted.signatureHex); // true

Or via CLI:

msfpdf keygen --out keys.json
msfpdf sign --in invoice.pdf --key <priv_seed_hex> --identity "Audit Partner" --embed --out invoice-signed.pdf
msfpdf verify --in invoice-signed.pdf --pubkey <pub_hex>

Critical Rules When Generating DocumentSpec Payloads

1. Never pass floats for money: amount_minor in financial_summary and formatMoneyMinor(minorUnits, currency) require exact integers (1999 for £19.99, 1942500 for AED 19,425.00). Passing 19.99 throws MsfPdfError('INVALID_SPEC').
2. Write Arabic in normal logical UTF-8 order: Do not pre-reverse Arabic strings or manually substitute U+FE80 presentation forms — msfPDF automatically performs contextual shaping, Lam-Alef ligature substitution, and UAX #9 BiDi visual reordering while keeping embedded numbers (2026, 19,425.00) Left-to-Right.
3. Validate against JSON Schema: Use schemas/document-spec.schema.json for LLM Structured Outputs.
4. Cryptographic Integrity: Use audit_manifest block or msfpdf sign --embed to append an Ed25519 signature in trailing comments without invalidating standard PDF viewers or xref offsets.