@broberg/lens-daemon 0.0.0-stage → 0.1.5

package/src/password-in-url.ts

@@ -0,0 +1,106 @@
+// F074.99 part 2 — a password in the final URL means the page was never hydrated.
+//
+// fd-sundhed drove /reset-password and got 12 of 12 GREEN steps while the
+// screenshot showed both fields EMPTY. `fill` had done its job perfectly: the
+// value went into the DOM and was read back. There was simply no application
+// listening — Next 16 blocks cross-origin dev resources, so served as
+// 127.0.0.1 (rather than localhost) the client bundle never arrives. The form
+// then did a NATIVE GET:
+//
+//   final_url = …/reset-password?password=Abcdefg1%21&confirmPassword=Abcdefg1%21
+//
+// A hydrated page would have submitted via JS. So the values ending up in the
+// query string is proof, after the fact, that nothing was running — and we
+// already return final_url, so it costs no probe, no assert and no browser work.
+//
+// ────────────────────────────────────────────────────────────────────────────
+// THE RULE IS fd-sundhed's, AND IT REPLACED MINE. I proposed matching query KEYS
+// against the names of the fields the run filled, having already rejected the
+// cruder "there is a query string". They measured mine wrong in their own app:
+// `q` is a search parameter in FIFTEEN places, and a GET search form typically
+// has <input name="q">, so a manuscript that fills a search box and presses
+// search lands on ?q=… with an EXACT name match — on a fully hydrated page doing
+// precisely its job. A GET search form is the commonest case in the world of "a
+// submit became a navigation carrying the field's name", and it is CORRECT.
+// Name-matching does not escape the false positive; it walks into it.
+//
+// SO: only a PASSWORD value. A password in a query string is never legitimate —
+// it lands in server logs, in browser history and in the Referer header. Both
+// readings therefore deserve the warning:
+//
+//   not hydrated → we caught exactly this bug
+//   hydrated     → the app leaks passwords in URLs, which is WORSE than the
+//                  thing we were looking for
+//
+// There is no third reading in which it is noise. That property is why it will
+// still be believed in six months, and it is worth more than the coverage the
+// broad rule would have bought.
+//
+// THE BROAD VERSION IS DEFERRED, NOT REJECTED: it needs a discriminator between
+// "GET because the form meant to" and "GET because nobody caught it". Neither we
+// nor fd-sundhed have one, and they said so rather than proposing something
+// unmeasured.
+
+/** A value this run typed into an input whose type is `password`.
+ *
+ *  The value is held only to compare against the URL and never leaves this
+ *  process: the finding names the ANCHOR and the PARAMETER, never the secret. */
+export interface FilledPassword {
+  /** How the step addressed the field — a testid or selector, for the report. */
+  anchor: string;
+  value: string;
+}
+
+export interface PasswordInUrlFinding {
+  /** The query parameter the password turned up in. */
+  param: string;
+  /** The field it was typed into. */
+  anchor: string;
+  /** Ready to print. Deliberately carries no value. */
+  message: string;
+}
+
+export function passwordInUrlMessage(param: string, anchor: string): string {
+  return (
+    `A PASSWORD typed into ${anchor} came back in the final URL as "?${param}=…". ` +
+    'Two readings, and both are worth acting on: the page was never hydrated, so the form ' +
+    'fell back to a native GET and nothing you clicked was handled by the app (every step ' +
+    'can still be green) — or the page WAS hydrated and this app puts passwords in URLs, ' +
+    'where they reach server logs, browser history and the Referer header. ' +
+    'Check whether the app is served on the same hostname the client bundle is allowed to load from.'
+  );
+}
+
+/**
+ * Did a password this run typed end up in the final URL's query string?
+ *
+ * Returns the FIRST match — one finding is enough to act on, and listing every
+ * field would put the same secret's shape in the report several times.
+ *
+ * A malformed or absent url yields null rather than throwing: this runs while
+ * assembling a result that is already complete, and a crash here would destroy
+ * a report to deliver a warning.
+ */
+export function passwordInUrl(
+  finalUrl: string | null | undefined,
+  filled: readonly FilledPassword[],
+): PasswordInUrlFinding | null {
+  if (!finalUrl || filled.length === 0) return null;
+  let params: URLSearchParams;
+  try {
+    params = new URL(finalUrl).searchParams;
+  } catch {
+    return null;
+  }
+  for (const [param, got] of params.entries()) {
+    for (const f of filled) {
+      // Exact match only. A password is compared whole: a substring test would
+      // fire on a one-character password appearing inside an unrelated id, and
+      // an empty one would match everything — so empties are skipped outright.
+      if (f.value.length > 0 && got === f.value) {
+        return { param, anchor: f.anchor, message: passwordInUrlMessage(param, f.anchor) };
+      }
+    }
+  }
+  return null;
+}

package/src/pdf-text.ts

@@ -0,0 +1,514 @@
+// F074.63 — the measuring instrument for "is this PDF editable, or a picture?"
+//
+// This exists because the obvious assertion is worthless here. "It returned a
+// PDF" is EXACTLY the green fd-sundhed's broken artifact already passes: their
+// stitched bitmap is a perfectly valid PDF. So is its MIME type, its %PDF-
+// header and its file size. Every cheap check passes on the very artifact this
+// feature exists to replace. What separates the two is what Illustrator showed
+// them when they opened it: ONE <Linked File>, ZERO text objects.
+//
+// THE FIRST VERSION OF THIS FILE WAS WRONG IN BOTH DIRECTIONS, and only
+// measuring it against a real Chromium PDF found that out:
+//
+//   · it looked for `(literal) Tj`. Chromium writes `<hex> Tj` with subset
+//     fonts, so the real text runs matched NOTHING — a textless verdict on a
+//     perfectly good vector PDF, which is the false negative that would have
+//     made this whole feature look broken.
+//   · it sliced streams on the first `endstream` it found. Binary font data
+//     contains that word, so streams were cut short and the leftover bytes
+//     matched the operator regexes by accident: it reported 3 text runs on a
+//     document, and would have reported some on a bitmap too.
+//
+// Both were invisible until the numbers were compared with `pdftotext` on the
+// same file. So this version does the real work: /Length-delimited streams, the
+// font's own /ToUnicode CMap, and actual STRINGS out the other end — which is
+// what the acceptance criterion asks for, and what a proxy count could never be.
+//
+// DEPENDENCY-FREE ON PURPOSE. poppler is on the machine this was written on and
+// gives a stronger extraction — but the CI runner has no poppler, and a gate
+// that only passes where a system package happens to exist is a gate that goes
+// red for a reason unrelated to the code. node's own zlib is everywhere.
+// poppler stays the manual cross-check for one-off proof on a real document.
+import { inflateSync } from 'node:zlib';
+
+export interface PdfContentStats {
+  /** Text-showing operators (Tj / TJ / ' / ") actually decoded. > 0 means real
+   *  text objects — the thing a designer can edit. */
+  textRuns: number;
+  /** Embedded font resources. Text runs with no font would be suspicious. */
+  fonts: number;
+  /** Image XObjects. A "picture of a document" is images >= 1 with textRuns 0. */
+  images: number;
+  /** Streams we could not decode. Reported rather than swallowed: a count of 0
+   *  text runs means something different when 40 streams were unreadable. */
+  undecodableStreams: number;
+  /** F074.65 — text-showing operators whose character codes we DROPPED, because
+   *  the font they select resolves to no usable /ToUnicode CMap.
+   *
+   *  Deliberately NOT folded into undecodableStreams. That field counts inflate
+   *  failures, and merging the two is exactly how the previous version reported
+   *  `0` while silently losing an entire line of the page: the stream inflated
+   *  perfectly, so nothing was wrong by its measure, and a whole headline
+   *  vanished. Two different unknowns reported as one number is indistinguishable
+   *  from confidence. */
+  undecodedRuns: number;
+  /** F074.65 — font programs the document draws text with, EXCLUDING the CID
+   *  descendants a composite font points at (those are the same typeface counted
+   *  twice, and pdffonts does not list them either). */
+  fontPrograms: PdfFontProgram[];
+  /** The extracted text itself, runs joined by a space. This is the field an
+   *  assertion should use — a COUNT can be right for the wrong reason, a string
+   *  the page actually rendered cannot. */
+  text: string;
+}
+
+/** F074.65 — one font the PDF draws with, and whether it is a real font program
+ *  or a set of drawings.
+ *
+ *  A Type 3 font is not a font in the sense a designer means: it is a dictionary
+ *  of little content streams, one per glyph. It prints perfectly and it opens in
+ *  Illustrator as PATHS — you can nudge the shapes and you can never re-type the
+ *  word. Chromium falls back to it whenever it cannot subset the source face,
+ *  which on macOS means every VARIABLE font, i.e. `system-ui` and `-apple-system`
+ *  — and therefore Tailwind's default `--font-sans` stack. */
+export interface PdfFontProgram {
+  /** /BaseFont, e.g. `AAAAAA+Georgia` or `DAAAAA+.SFNS-Regular`. */
+  name: string;
+  /** /Subtype: `Type0`, `TrueType`, `Type1`, `Type3`, … */
+  subtype: string;
+  /** True for Type 3 — glyphs stored as drawings, not as an editable face. */
+  outlines: boolean;
+}
+
+interface PdfStream {
+  /** The object number, when the stream belongs to a numbered object. */
+  obj: number | null;
+  /** Inflated (or raw, when not Flate) payload as latin1. */
+  body: string;
+  /** The object's dictionary text, for finding /ToUnicode and friends. */
+  dict: string;
+  decoded: boolean;
+}
+
+/** Every stream in the file, delimited by its own /Length.
+ *
+ *  Length-delimited, NOT `indexOf('endstream')`: an embedded TrueType font
+ *  contains those bytes, and cutting there yields a truncated stream whose
+ *  leftover binary matches operator regexes by accident. That is how the first
+ *  version of this file counted text runs in a document that had none. */
+function streams(bytes: Buffer): { list: PdfStream[]; undecodable: number } {
+  const hay = bytes.toString('latin1');
+  const list: PdfStream[] = [];
+  let undecodable = 0;
+
+  const objRe = /(\d+)\s+0\s+obj\b/g;
+  const objAt: Array<{ num: number; at: number }> = [];
+  let om: RegExpExecArray | null;
+  while ((om = objRe.exec(hay)) !== null) objAt.push({ num: Number(om[1]), at: om.index });
+
+  // The lookbehind is load-bearing: `endstream` ENDS in "stream", so a bare
+  // /stream\r?\n/ matches the close of every stream as if it opened a new one.
+  // Measured before the fix — a 5-stream PDF reported 5 phantom undecodable
+  // streams, which made the "how much could I not read?" field report noise as
+  // if it were coverage.
+  const streamRe = /(?<![A-Za-z])stream\r?\n/g;
+  let sm: RegExpExecArray | null;
+  while ((sm = streamRe.exec(hay)) !== null) {
+    const start = sm.index + sm[0].length;
+    // The dictionary is whatever sits between the enclosing `N 0 obj` and here.
+    let obj: number | null = null;
+    let dictFrom = Math.max(0, sm.index - 600);
+    for (let i = objAt.length - 1; i >= 0; i -= 1) {
+      if (objAt[i]!.at < sm.index) {
+        obj = objAt[i]!.num;
+        dictFrom = objAt[i]!.at;
+        break;
+      }
+    }
+    const dict = hay.slice(dictFrom, sm.index);
+    const len = Number(dict.match(/\/Length\s+(\d+)/)?.[1] ?? NaN);
+    // No /Length is a stream we cannot delimit safely. Count it as undecodable
+    // rather than guessing an end — a guess here fabricates content.
+    if (!Number.isFinite(len) || len <= 0) {
+      undecodable += 1;
+      continue;
+    }
+    const raw = bytes.subarray(start, start + len);
+    if (/\/FlateDecode/.test(dict)) {
+      try {
+        list.push({ obj, dict, body: inflateSync(raw).toString('latin1'), decoded: true });
+      } catch {
+        undecodable += 1;
+        list.push({ obj, dict, body: '', decoded: false });
+      }
+    } else {
+      list.push({ obj, dict, body: raw.toString('latin1'), decoded: true });
+    }
+  }
+  return { list, undecodable };
+}
+
+/** code → unicode, plus how many bytes one code occupies. */
+interface CMap {
+  map: Map<number, string>;
+  codeBytes: 1 | 2;
+}
+
+/** Parse a /ToUnicode CMap: the bfchar pairs and bfrange runs. */
+function parseCMap(body: string): CMap {
+  const map = new Map<number, string>();
+  const hexToStr = (h: string): string => {
+    const clean = h.replace(/\s+/g, '');
+    let out = '';
+    for (let i = 0; i + 3 < clean.length + 1; i += 4) {
+      const cp = parseInt(clean.slice(i, i + 4), 16);
+      if (Number.isFinite(cp)) out += String.fromCharCode(cp);
+    }
+    return out;
+  };
+
+  for (const block of body.match(/beginbfchar([\s\S]*?)endbfchar/g) ?? []) {
+    for (const m of block.matchAll(/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>/g)) {
+      map.set(parseInt(m[1]!, 16), hexToStr(m[2]!));
+    }
+  }
+  for (const block of body.match(/beginbfrange([\s\S]*?)endbfrange/g) ?? []) {
+    for (const m of block.matchAll(/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>/g)) {
+      const lo = parseInt(m[1]!, 16);
+      const hi = parseInt(m[2]!, 16);
+      const base = parseInt(m[3]!, 16);
+      // A runaway range would allocate unboundedly on a malformed file.
+      if (!(hi >= lo) || hi - lo > 65535) continue;
+      for (let c = lo; c <= hi; c += 1) map.set(c, String.fromCharCode(base + (c - lo)));
+    }
+  }
+  const cs = body.match(/begincodespacerange\s*<([0-9A-Fa-f]+)>/);
+  const codeBytes: 1 | 2 = cs && cs[1]!.length >= 4 ? 2 : 1;
+  return { map, codeBytes };
+}
+
+/** Resource-name (`F4`) → the CMap of the font it points at.
+ *
+ *  Resolved per font rather than merged across all of them: two subset fonts
+ *  routinely use the SAME code for different glyphs, so one merged table would
+ *  decode half the page into the wrong letters and still look like text. */
+function fontCMaps(bytes: Buffer, all: PdfStream[]): Map<string, CMap> {
+  const hay = bytes.toString('latin1');
+  const byObj = new Map<number, PdfStream>();
+  for (const s of all) if (s.obj != null && s.decoded) byObj.set(s.obj, s);
+
+  const out = new Map<string, CMap>();
+  for (const fd of hay.matchAll(/\/Font\s*<<([\s\S]*?)>>/g)) {
+    for (const ref of fd[1]!.matchAll(/\/([A-Za-z0-9]+)\s+(\d+)\s+0\s+R/g)) {
+      const name = ref[1]!;
+      const fontObj = Number(ref[2]);
+      // BOUNDED BY THE OBJECT'S OWN `endobj`, NOT BY A MAGIC NUMBER.
+      //
+      // F074.65: this used to be `[\s\S]{0,600}?`. A Type 3 font dictionary is
+      // far larger than 600 characters because it carries /CharProcs — a named
+      // content stream for EVERY glyph — so /ToUnicode fell outside the window,
+      // the font resolved to no CMap, and every character code it selected was
+      // dropped. Measured on the committed fixture: the line "system-ui er
+      // variabel" vanished completely while undecodableStreams reported 0,
+      // because the stream inflated perfectly and only the mapping was missing.
+      const objBody = hay.match(new RegExp(`(?:^|[^0-9])${fontObj}\\s+0\\s+obj([\\s\\S]*?)endobj`));
+      const toUni = objBody?.[1]?.match(/\/ToUnicode\s+(\d+)\s+0\s+R/)?.[1];
+      if (!toUni) continue;
+      const cmapStream = byObj.get(Number(toUni));
+      if (cmapStream) out.set(name, parseCMap(cmapStream.body));
+    }
+  }
+  return out;
+}
+
+/** Decode one text-showing operand into characters.
+ *
+ *  Returns what was read AND how many character codes were DROPPED. The count is
+ *  the point: an unmapped code is deliberately not guessed (inventing a character
+ *  would let a containment assertion pass on text the page never drew), but
+ *  dropping it silently is how a whole line disappears while the report says
+ *  everything was readable. */
+function decodeOperand(
+  operand: string,
+  isHex: boolean,
+  cmap: CMap | undefined,
+): { text: string; dropped: number } {
+  if (!isHex) {
+    // A literal string in a simple-encoded font is already readable.
+    return {
+      text: operand.replace(/\\([nrtbf()\\])/g, (_, c: string) =>
+        ({ n: '\n', r: '\r', t: '\t', b: '\b', f: '\f' })[c] ?? c,
+      ),
+      dropped: 0,
+    };
+  }
+  const clean = operand.replace(/\s+/g, '');
+  const step = (cmap?.codeBytes ?? 2) * 2;
+  let out = '';
+  let dropped = 0;
+  for (let i = 0; i + step <= clean.length; i += step) {
+    const code = parseInt(clean.slice(i, i + step), 16);
+    if (!Number.isFinite(code)) continue;
+    // An unmapped code is dropped rather than guessed: inventing a character
+    // here would let a containment assertion pass on text the page never drew.
+    const ch = cmap?.map.get(code);
+    if (ch != null) out += ch;
+    else dropped += 1;
+  }
+  return { text: out, dropped };
+}
+
+/** Pull the readable text out of one content stream, tracking the current font. */
+function textFromStream(
+  body: string,
+  cmaps: Map<string, CMap>,
+): { text: string; runs: number; undecodedRuns: number } {
+  let current: CMap | undefined;
+  let text = '';
+  let runs = 0;
+  let undecodedRuns = 0;
+  // Font selections and text-showing operators, in document order.
+  const re =
+    /\/([A-Za-z0-9]+)\s+[\d.]+\s+Tf|<([0-9A-Fa-f\s]*)>\s*(Tj|'|")|\(((?:\\.|[^)\\])*)\)\s*(Tj|'|")|\[((?:[^\]\\]|\\.)*)\]\s*TJ/g;
+  for (const m of body.matchAll(re)) {
+    if (m[1] != null) {
+      current = cmaps.get(m[1]);
+      continue;
+    }
+    let piece = '';
+    let dropped = 0;
+    const take = (r: { text: string; dropped: number }) => {
+      piece += r.text;
+      dropped += r.dropped;
+    };
+    if (m[2] != null) take(decodeOperand(m[2], true, current));
+    else if (m[4] != null) take(decodeOperand(m[4], false, current));
+    else if (m[6] != null) {
+      // A TJ array interleaves strings with kerning numbers; only the strings
+      // are content. The numbers are DELIBERATELY ignored.
+      //
+      // The first version turned a large negative kern into a space, on the
+      // theory that it is a word gap the page draws but never stores. Measured
+      // against fd-sundhed's real poster, that was wrong and destructive: CSS
+      // letter-spacing is emitted as exactly those kerns, so every headline came
+      // out as "f d s u n d h e d . d k" and a containment assertion on correct
+      // output FAILED. Chromium writes real space glyphs (the CMap maps them to
+      // U+0020), so the gaps do not need reconstructing — and a heuristic that
+      // invents characters can only ever make extracted text say something the
+      // page did not.
+      for (const part of m[6].matchAll(/<([0-9A-Fa-f\s]*)>|\(((?:\\.|[^)\\])*)\)/g)) {
+        if (part[1] != null) take(decodeOperand(part[1], true, current));
+        else if (part[2] != null) take(decodeOperand(part[2], false, current));
+      }
+    }
+    // F074.65 — COUNTED BEFORE THE EMPTY-PIECE SKIP, and that order is the whole
+    // fix. A run whose every code was dropped produces an empty piece, so the
+    // old `continue` returned it to the caller as if it had never existed: the
+    // page's line was gone AND nothing said so.
+    if (dropped > 0) undecodedRuns += 1;
+    if (piece.length === 0) continue;
+    runs += 1;
+    // Concatenated with NOTHING inserted between runs.
+    //
+    // Measured on fd-sundhed's real poster, which is what settled it. Joining
+    // runs with a space looked right on a plain page and destroyed every
+    // letter-spaced headline: Chromium emits one run per glyph for CSS
+    // letter-spacing, so "fdsundhed.dk" came back as "f d s u n d h e d . d k"
+    // and a containment check on CORRECT output failed. Concatenating instead
+    // loses a space at a line break ("Skaden skal" + "ikke stå" → "skalikke"),
+    // which is why pdfTextContains() compares whitespace-insensitively. The
+    // trade is deliberate: a missing space is a false NEGATIVE the caller can
+    // work around, an invented one puts characters in the text that the page
+    // never drew.
+    text += piece;
+  }
+  return { text, runs, undecodedRuns };
+}
+
+/** F074.65 — which font PROGRAMS the document draws with.
+ *
+ *  Answers the only question a graphic designer is actually asking: can I re-type
+ *  this word? `/Subtype /Type3` says no — the glyphs are drawings. It is read
+ *  straight out of the dictionary, so there is no heuristic and nothing to
+ *  calibrate.
+ *
+ *  CID DESCENDANTS ARE EXCLUDED. A composite font is a `/Type0` that points at a
+ *  `/CIDFontType2` descendant: the same typeface described twice, which is why
+ *  the raw `/Type /Font` count says 10 on a document `pdffonts` lists 7 rows for.
+ *  Counting the descendant would inflate the "real fonts" number with duplicates
+ *  and make a Type-3-heavy document look better than it is. */
+export function fontPrograms(bytes: Buffer): PdfFontProgram[] {
+  const hay = bytes.toString('latin1');
+  const out: PdfFontProgram[] = [];
+  for (const m of hay.matchAll(/\d+\s+0\s+obj([\s\S]*?)endobj/g)) {
+    const body = m[1]!;
+    if (!/\/Type\s*\/Font\b/.test(body)) continue;
+    const subtype = body.match(/\/Subtype\s*\/([A-Za-z0-9]+)/)?.[1];
+    if (!subtype) continue;
+    // The descendant half of a composite font — the same face, counted twice.
+    if (subtype.startsWith('CIDFontType')) continue;
+    out.push({
+      name: fontName(hay, body),
+      subtype,
+      outlines: subtype === 'Type3',
+    });
+  }
+  return out;
+}
+
+/** The font's human name, following /FontDescriptor when the dictionary has no
+ *  /BaseFont of its own.
+ *
+ *  A TYPE 3 FONT HAS NO /BaseFont — measured on the committed fixture, where the
+ *  dictionary carries FontMatrix, Widths, CharProcs and a /FontDescriptor
+ *  reference, and nothing else identifying. The name a designer needs
+ *  (`DAAAAA+.SFNS-Regular`) is one hop away in that descriptor's /FontName, which
+ *  is also where `pdffonts` reads it from. Without the hop the report says
+ *  "(unnamed)" for exactly the fonts it exists to name, which is the whole
+ *  remedy gone. */
+function fontName(hay: string, body: string): string {
+  const direct = body.match(/\/BaseFont\s*\/([^\s/>\]]+)/)?.[1];
+  if (direct) return direct;
+  const descRef = body.match(/\/FontDescriptor\s+(\d+)\s+0\s+R/)?.[1];
+  if (descRef) {
+    const desc = hay.match(new RegExp(`(?:^|[^0-9])${descRef}\\s+0\\s+obj([\\s\\S]*?)endobj`))?.[1];
+    const named = desc?.match(/\/FontName\s*\/([^\s/>\]]+)/)?.[1];
+    if (named) return named;
+  }
+  // Reported as unnamed rather than given a plausible label: a made-up family
+  // name in the remedy sends someone looking for a font they do not have.
+  return '(unnamed)';
+}
+
+/** Count and READ what the PDF actually contains. */
+export function pdfContentStats(bytes: Buffer): PdfContentStats {
+  const { list, undecodable } = streams(bytes);
+  const cmaps = fontCMaps(bytes, list);
+
+  let textRuns = 0;
+  let undecodedRuns = 0;
+  const parts: string[] = [];
+  for (const s of list) {
+    if (!s.decoded) continue;
+    // A content stream is one that selects a font and shows text. Font programs
+    // and CMaps live in streams too and must not be scanned as content.
+    if (!/\bTf\b/.test(s.body)) continue;
+    const r = textFromStream(s.body, cmaps);
+    textRuns += r.runs;
+    undecodedRuns += r.undecodedRuns;
+    if (r.text) parts.push(r.text);
+  }
+
+  const hay = bytes.toString('latin1');
+  return {
+    textRuns,
+    fonts: (hay.match(/\/Type\s*\/Font\b/g) ?? []).length,
+    images: (hay.match(/\/Subtype\s*\/Image\b/g) ?? []).length,
+    undecodableStreams: undecodable,
+    undecodedRuns,
+    fontPrograms: fontPrograms(bytes),
+    text: parts.join(' '),
+  };
+}
+
+/** The verdict fd-sundhed's designer cares about: can they edit the text?
+ *
+ *  Deliberately NOT `textRuns > 0` alone. A bitmap page can carry a stray text
+ *  operator (a watermark, a page number stamped over the image) and would then
+ *  pass a naive check while remaining exactly as un-editable as before.
+ *
+ *  F074.65 ADDS THE FOURTH CONDITION, and it is the one that was wrong in
+ *  production: NO Type 3 font. A page set in a variable font (macOS `system-ui`,
+ *  and therefore Tailwind's default `--font-sans`) satisfied all three original
+ *  conditions — real text runs, real fonts, real extractable characters — and
+ *  opened in Illustrator as paths the designer could not re-type. Every cheap
+ *  check passed on exactly the artifact the tool exists to replace, one level
+ *  further in than the bitmap it was written to catch.
+ *
+ *  IT GOES FALSE RATHER THAN TRUE-WITH-A-WARNING. sanne proposed the warning and
+ *  it is a reasonable position; this disagrees on one point. A boolean whose name
+ *  answers the designer's question has to answer it — a `true` sitting beside a
+ *  caveat is read as `true`, and the caveat is the half that gets skimmed. */
+export function isVectorText(stats: PdfContentStats): boolean {
+  if (stats.fontPrograms.some((f) => f.outlines)) return false;
+  // WE SAW FONT OBJECTS AND COULD CLASSIFY NONE OF THEM.
+  //
+  // Found reviewing this card's own diff, and it is the same false-green one
+  // level further along: fontPrograms reads /Subtype out of top-level `N 0 obj`
+  // dictionaries, so a producer that puts fonts in a compressed object stream
+  // (or writes a /Subtype this does not parse) yields an EMPTY list — and an
+  // empty list has no Type 3 in it, so the outline check above passes and the
+  // verdict falls through to true. A document we could not read would be
+  // reported as safe to hand a designer.
+  //
+  // Today's only caller feeds this the bytes our own Chromium just produced, so
+  // it does not happen in practice. That is a reason it is cheap to guard, not a
+  // reason to skip it: the guard costs one line, and the assumption it rests on
+  // is invisible at the call site the day someone measures an uploaded PDF.
+  if (stats.fonts > 0 && stats.fontPrograms.length === 0) return false;
+  return stats.textRuns > 0 && stats.fonts > 0 && stats.text.trim().length > 0;
+}
+
+/** The font families drawn as outlines, deduplicated — the ACTIONABLE half.
+ *
+ *  "This PDF has outlines" tells the mockup author nothing they can do.
+ *  "`.SFNS-Regular` is drawn as outlines" tells them which font to replace with a
+ *  static instance, which is the whole remedy. */
+export function outlineFontNames(stats: PdfContentStats): string[] {
+  return [...new Set(stats.fontPrograms.filter((f) => f.outlines).map((f) => f.name))].sort();
+}
+
+/** Does the extracted text contain `phrase`, ignoring whitespace on both sides?
+ *
+ *  This is the matcher an assertion should use, and the reason is measured, not
+ *  stylistic: run boundaries in a PDF do not line up with word boundaries on the
+ *  page. A line break between "Skaden skal" and "ikke stå i kø" stores no space
+ *  at all, so a literal `includes()` misses a headline that is plainly there —
+ *  a false negative on a correct export, which is the direction that makes a
+ *  working feature look broken.
+ *
+ *  What it gives up: a phrase could match across two unrelated elements that
+ *  happen to abut. That is a far narrower risk than the one it removes, and it
+ *  fails toward "found" only for text that genuinely IS in the document. */
+export function pdfTextContains(source: PdfContentStats | string, phrase: string): boolean {
+  return matchPhrase(source, phrase) !== 'absent';
+}
+
+/** HOW a phrase matched — the distinction `pdfTextContains` flattens.
+ *
+ *  'case-insensitive' means the page drew the words with DIFFERENT CAPITALISATION
+ *  from what the caller wrote. That is a fact worth keeping, not a detail to
+ *  swallow: it is almost always `text-transform` in the stylesheet, and the
+ *  caller should be able to see that the page says something other than their
+ *  source does. */
+export type PhraseMatch = 'exact' | 'case-insensitive' | 'absent';
+
+/** F074.67 — case, like whitespace, is a PAINT-TIME difference.
+ *
+ *  Measured on fd-sundhed's real A3 poster: the source says "Til alle ansatte i
+ *  Aalborg Kommune", `text-transform: uppercase` applies when the page is drawn,
+ *  and the PDF stores "TIL ALLE ANSATTE I AALBORGKOMMUNE". A case-sensitive
+ *  matcher answers a confident FALSE for a headline that is unmistakably there —
+ *  and the caller goes looking for a layout bug that does not exist.
+ *
+ *  THE PRECEDENT IS ALREADY HERE, which is what makes this consistent rather than
+ *  a convenience: this matcher has been whitespace-insensitive since F074.63, for
+ *  exactly the same reason (run boundaries do not line up with word boundaries —
+ *  "Skaden skal" + "ikke stå i kø" is stored with no space at all). Case is the
+ *  same category of difference the caller cannot predict from their own HTML.
+ *
+ *  WHAT IS DELIBERATELY NOT WIDENED: punctuation, accents, and word-internal
+ *  substrings. Those would let an assertion pass on text the page never drew,
+ *  which is a worse failure than the false negative being fixed here. */
+export function matchPhrase(source: PdfContentStats | string, phrase: string): PhraseMatch {
+  const strip = (v: string) => v.replace(/\s+/g, '');
+  const hay = typeof source === 'string' ? source : source.text;
+  const needle = strip(phrase);
+  if (needle.length === 0) return 'absent';
+  const haystack = strip(hay);
+  if (haystack.includes(needle)) return 'exact';
+  // toLowerCase, not localeCompare: this compares two strings from the SAME
+  // document pipeline, and Danish æ/ø/å round-trip through it unchanged.
+  if (haystack.toLowerCase().includes(needle.toLowerCase())) return 'case-insensitive';
+  return 'absent';
+}

package/src/pixelmatch.d.ts

@@ -0,0 +1,21 @@
+// pixelmatch@6 ships no type declarations (ESM, default export only).
+// Minimal ambient declaration for the single signature Lens uses.
+declare module 'pixelmatch' {
+  interface PixelmatchOptions {
+    threshold?: number;
+    includeAA?: boolean;
+    alpha?: number;
+    aaColor?: [number, number, number];
+    diffColor?: [number, number, number];
+    diffColorAlt?: [number, number, number];
+    diffMask?: boolean;
+  }
+  export default function pixelmatch(
+    img1: Uint8Array,
+    img2: Uint8Array,
+    output: Uint8Array | null,
+    width: number,
+    height: number,
+    options?: PixelmatchOptions,
+  ): number;
+}