@doccloak/core 0.12.1 → 0.13.0

package/dist/pdf/oracle.js

@@ -0,0 +1,384 @@
+/**
+ * @doccloak/core/pdf - pdf.js oracle (T212).
+ *
+ * pdf.js is the INDEPENDENT second extractor. It never edits anything; it is
+ * used (1) before a page is touched, to confirm that our own decoder read the
+ * same text pdf.js reads, (2) after writing, to verify that no redacted value
+ * is extractable from the output, and (3) to render pages for the rasterize
+ * fallback (see raster.ts).
+ *
+ * Runtime configuration:
+ * - The legacy build (`pdfjs-dist/legacy/build/pdf.mjs`) is imported lazily in
+ *   every environment: it carries the Node factories (fs-backed asset fetch,
+ *   `@napi-rs/canvas` canvas factory) as well as the browser ones and is the
+ *   build the package's typings describe. It is loaded on first use so hosts
+ *   that never open a PDF never pay for it.
+ * - Node: no worker; pdf.js runs its "fake worker" on the calling thread.
+ *   `cMapUrl` / `standardFontDataUrl` are file-system paths (or file: URLs).
+ * - Browsers: the host serves the worker file and passes its URL through
+ *   `PdfAssetPaths.pdfjsWorkerUrl`; it is applied to
+ *   `GlobalWorkerOptions.workerSrc` once. Without it pdf.js throws
+ *   'No "GlobalWorkerOptions.workerSrc" specified.' in a browser.
+ * - Fonts are never taken from the system (`useSystemFonts: false`). pdf.js 6
+ *   no longer has an eval-based PostScript compiler (`isEvalSupported` is gone).
+ * - `disableFontFace` is true wherever there is no `document` (Node, Web
+ *   Workers): glyphs are then drawn as paths, which also makes rendering
+ *   deterministic across hosts.
+ */
+import { UnsupportedDocumentError } from "../dom/errors.js";
+/** Deadline for one pdf.js page operation (text, render). */
+export const ORACLE_DEADLINE_MS = 60000;
+let pdfjsPromise;
+function loadPdfJs() {
+    pdfjsPromise ?? (pdfjsPromise = import('pdfjs-dist/legacy/build/pdf.mjs'));
+    return pdfjsPromise;
+}
+function errorName(err) {
+    return typeof err === 'object' && err !== null ? String(err.name ?? '') : '';
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * pdf.js takes the canvas factory as a class at getDocument() time, while we
+ * receive it per render() call. This bridge is handed to pdf.js and forwards
+ * to whichever factory the current render uses.
+ */
+class FactorySlot {
+    bridgeClass() {
+        const slot = this;
+        return class OracleCanvasFactory {
+            constructor(_options) { }
+            create(width, height) {
+                if (width <= 0 || height <= 0)
+                    throw new Error('Invalid canvas size');
+                const factory = slot.current ?? defaultCanvasFactory();
+                const handle = factory.create(Math.ceil(width), Math.ceil(height));
+                return { canvas: handle.canvas, context: handle.context };
+            }
+            reset(pair, width, height) {
+                if (!pair.canvas)
+                    throw new Error('Canvas is not specified');
+                if (width <= 0 || height <= 0)
+                    throw new Error('Invalid canvas size');
+                pair.canvas.width = Math.ceil(width);
+                pair.canvas.height = Math.ceil(height);
+            }
+            destroy(pair) {
+                if (!pair.canvas)
+                    throw new Error('Canvas is not specified');
+                pair.canvas.width = 0;
+                pair.canvas.height = 0;
+                pair.canvas = null;
+                pair.context = null;
+            }
+        };
+    }
+}
+/**
+ * Browser default: OffscreenCanvas when available (works in Web Workers and
+ * on the main thread), else an HTMLCanvasElement. Node has neither: inject a
+ * factory (tests use a recording double; hosts can wrap `@napi-rs/canvas`).
+ */
+export function defaultCanvasFactory() {
+    const g = globalThis;
+    if (typeof g.OffscreenCanvas === 'function') {
+        const Offscreen = g.OffscreenCanvas;
+        return {
+            create(width, height) {
+                const canvas = new Offscreen(width, height);
+                const context = canvas.getContext('2d', { willReadFrequently: true });
+                if (!context)
+                    throw new Error('OffscreenCanvas 2D context unavailable');
+                return {
+                    canvas,
+                    context,
+                    async toPng() {
+                        const blob = await canvas.convertToBlob({ type: 'image/png' });
+                        return new Uint8Array(await blob.arrayBuffer());
+                    },
+                    getImageData() {
+                        return context.getImageData(0, 0, canvas.width, canvas.height).data;
+                    },
+                };
+            },
+        };
+    }
+    if (g.document && typeof g.document.createElement === 'function') {
+        const document = g.document;
+        return {
+            create(width, height) {
+                const canvas = document.createElement('canvas');
+                canvas.width = width;
+                canvas.height = height;
+                const context = canvas.getContext('2d', { willReadFrequently: true });
+                if (!context)
+                    throw new Error('Canvas 2D context unavailable');
+                return {
+                    canvas,
+                    context,
+                    toPng() {
+                        return new Promise((resolve, reject) => {
+                            canvas.toBlob((blob) => {
+                                if (!blob) {
+                                    reject(new Error('canvas.toBlob returned null'));
+                                    return;
+                                }
+                                blob.arrayBuffer().then((buf) => resolve(new Uint8Array(buf)), reject);
+                            }, 'image/png');
+                        });
+                    },
+                    getImageData() {
+                        return context.getImageData(0, 0, canvas.width, canvas.height).data;
+                    },
+                };
+            },
+        };
+    }
+    throw new Error('No canvas implementation available in this runtime: pass a canvasFactory');
+}
+/**
+ * Open `bytes` with pdf.js. The buffer is copied because pdf.js transfers
+ * (and thereby neuters) the ArrayBuffer it is given. Password-protected files
+ * without the right password raise UnsupportedDocumentError('encrypted');
+ * files pdf.js cannot parse at all raise 'invalid-package'.
+ */
+export async function openWithOracle(bytes, assets, password) {
+    const pdfjs = await loadPdfJs();
+    if (assets?.pdfjsWorkerUrl && pdfjs.GlobalWorkerOptions.workerSrc !== assets.pdfjsWorkerUrl) {
+        pdfjs.GlobalWorkerOptions.workerSrc = assets.pdfjsWorkerUrl;
+    }
+    const slot = new FactorySlot();
+    const data = new Uint8Array(bytes.byteLength);
+    data.set(bytes);
+    const task = pdfjs.getDocument({
+        data,
+        password,
+        cMapUrl: assets?.cMapUrl,
+        cMapPacked: true,
+        standardFontDataUrl: assets?.standardFontDataUrl,
+        wasmUrl: assets?.wasmUrl,
+        useSystemFonts: false,
+        // Never register the document's fonts with the browser's FontFace API: text extraction does
+        // not need it and every registration is a worker round trip per font (a 100-font file took
+        // ten times longer in a browser than in Node); the raster renders glyph outlines itself.
+        disableFontFace: true,
+        stopAtErrors: false,
+        verbosity: 0,
+        useWorkerFetch: false,
+        CanvasFactory: slot.bridgeClass(),
+    });
+    let doc;
+    try {
+        doc = await task.promise;
+    }
+    catch (err) {
+        await task.destroy().catch(() => undefined);
+        const name = errorName(err);
+        if (name === 'PasswordException') {
+            throw new UnsupportedDocumentError('encrypted', 'PDF is encrypted; a valid user password is required', [errorMessage(err)]);
+        }
+        if (name === 'InvalidPDFException') {
+            throw new UnsupportedDocumentError('invalid-package', 'pdf.js cannot parse this PDF', [errorMessage(err)]);
+        }
+        // Anything else pdf.js raises while opening (unsupported encryption, broken xref, a worker
+        // error) is a document we cannot handle, never an internal failure.
+        const message = errorMessage(err);
+        if (/encrypt|password/i.test(message))
+            throw new UnsupportedDocumentError('encrypted', 'PDF uses an encryption pdf.js cannot open', [message]);
+        throw new UnsupportedDocumentError('invalid-package', `pdf.js cannot open this PDF: ${message}`, [message]);
+    }
+    /**
+     * pdf.js can be made to work forever by a hostile content stream (a hundred thousand nested
+     * `q`, an exponential chain of form XObjects): every page operation gets a deadline, after which
+     * the worker is torn down and the caller sees an error (a page issue, or a refusal).
+     */
+    const deadline = (what, work) => {
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                void task.destroy().catch(() => undefined);
+                reject(new Error(`pdf.js did not finish ${what} within ${ORACLE_DEADLINE_MS / 1000} s`));
+            }, ORACLE_DEADLINE_MS);
+        });
+        return Promise.race([work, timeout]).finally(() => { if (timer !== undefined)
+            clearTimeout(timer); });
+    };
+    const getPage = async (index) => {
+        if (!Number.isInteger(index) || index < 0 || index >= doc.numPages) {
+            throw new RangeError(`page index ${index} out of range (0..${doc.numPages - 1})`);
+        }
+        return doc.getPage(index + 1);
+    };
+    return {
+        pageCount: doc.numPages,
+        async pageText(index) {
+            const page = await deadline(`loading page ${index + 1}`, getPage(index));
+            const content = await deadline(`reading page ${index + 1}`, page.getTextContent({ includeMarkedContent: false, disableNormalization: true }));
+            let out = '';
+            for (const item of content.items) {
+                if (!('str' in item))
+                    continue;
+                out += item.str;
+                if (item.hasEOL)
+                    out += '\n';
+            }
+            return out;
+        },
+        async pageItems(index) {
+            const page = await deadline(`loading page ${index + 1}`, getPage(index));
+            const content = await deadline(`reading page ${index + 1}`, page.getTextContent({ includeMarkedContent: false, disableNormalization: true }));
+            const out = [];
+            for (const item of content.items) {
+                if (!('str' in item))
+                    continue;
+                out.push({ str: item.str, transform: item.transform, width: item.width, height: item.height, hasEOL: item.hasEOL, fontName: item.fontName, dir: item.dir });
+            }
+            return out;
+        },
+        async pageSize(index) {
+            const page = await getPage(index);
+            const [x0, y0, x1, y1] = page.view;
+            return { width: Math.abs(x1 - x0), height: Math.abs(y1 - y0), rotate: page.rotate };
+        },
+        async render(index, scale, canvasFactory) {
+            if (!(scale > 0) || !Number.isFinite(scale))
+                throw new RangeError(`invalid render scale ${scale}`);
+            const page = await deadline(`loading page ${index + 1}`, getPage(index));
+            const viewport = page.getViewport({ scale });
+            const widthPx = Math.ceil(viewport.width);
+            const heightPx = Math.ceil(viewport.height);
+            const factory = canvasFactory ?? defaultCanvasFactory();
+            slot.current = factory;
+            try {
+                const handle = factory.create(widthPx, heightPx);
+                const renderTask = page.render({
+                    canvas: (handle.canvas ?? null),
+                    canvasContext: handle.context,
+                    viewport,
+                    intent: 'print',
+                    annotationMode: pdfjs.AnnotationMode.DISABLE,
+                    background: 'rgb(255,255,255)',
+                });
+                await deadline(`rendering page ${index + 1}`, renderTask.promise);
+                return {
+                    widthPx,
+                    heightPx,
+                    widthPt: viewport.width / scale,
+                    heightPt: viewport.height / scale,
+                    transform: Array.from(viewport.transform),
+                    canvas: handle,
+                };
+            }
+            finally {
+                slot.current = undefined;
+            }
+        },
+        async close() {
+            await task.destroy();
+        },
+    };
+}
+/** Text of every page, in page order (see {@link OracleDocument.pageText}). */
+export async function oracleText(doc) {
+    const pages = [];
+    for (let i = 0; i < doc.pageCount; i++)
+        pages.push(await doc.pageText(i));
+    return pages;
+}
+const LIGATURES = {
+    'ff': 'ff',
+    'fi': 'fi',
+    'fl': 'fl',
+    'ffi': 'ffi',
+    'ffl': 'ffl',
+    'ſt': 'st',
+    'st': 'st',
+};
+/**
+ * Whitespace (JS `\s` is Unicode White_Space minus U+0085), the soft hyphen,
+ * zero-width characters and bidi controls, all of which one extractor may emit
+ * and another drop.
+ */
+const DROP_RE = /[\s\u0085­᠎​-‏‪-‮⁠-⁤⁦-⁩]/gu;
+/**
+ * Bring two extractors' output onto common ground: NFC, typographic
+ * ligatures spelled out, and every whitespace / soft-hyphen / zero-width
+ * character removed. Case and punctuation are kept.
+ */
+export function normalizeForCompare(text) {
+    return foldGlyphText(text.normalize('NFC')).replace(DROP_RE, '');
+}
+/**
+ * Kangxi radicals, CJK radicals supplement and CJK compatibility ideographs: some ToUnicode
+ * maps (Chrome with Hiragino) spell ordinary ideographs with these look-alikes; NFKC turns them
+ * into the unified ideograph a detector and a user type.
+ */
+const COMPAT_CJK_RE = /[\u2E80-\u2EF3\u2F00-\u2FD5\uF900-\uFAFF]/u;
+/**
+ * The text of a glyph as a detector should see it: typographic ligatures spelled out
+ * (fi -> fi) and CJK compatibility forms unified. Applied when glyphs are decoded, so plainText,
+ * the oracle comparison and the layer-zero search all agree.
+ */
+export function foldGlyphText(text) {
+    let out = text.replace(/[ff-st]/g, (m) => LIGATURES[m] ?? m);
+    if (COMPAT_CJK_RE.test(out))
+        out = [...out].map((ch) => (COMPAT_CJK_RE.test(ch) ? ch.normalize('NFKC') : ch)).join('');
+    return out;
+}
+/**
+ * The same folding as {@link normalizeForCompare} plus a length-preserving
+ * lower-casing, with an offset map back into the input, so a search in the
+ * folded text can be turned into a replacement range of the original. Used
+ * by the writer's layer zero so that it covers exactly what the verifier
+ * would flag (a value wrapped over a line end, spaced differently, or
+ * written with a typographic ligature).
+ */
+export function foldForSearch(text) {
+    let folded = '';
+    const offsets = [];
+    const dropRe = new RegExp(DROP_RE.source, 'u');
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (dropRe.test(c))
+            continue;
+        // Hyphens are dropped on both sides, so a value broken at a line end ("Kowal-" / "ski") and a
+        // value written with or without hyphens ("600-100-200") are found either way.
+        if (c === '-' || c === '\u2010' || c === '\u2011')
+            continue;
+        const expanded = foldGlyphText(c);
+        for (const ch of expanded) {
+            const lower = ch.toLowerCase();
+            folded += lower.length === 1 ? lower : ch;
+            offsets.push(i);
+        }
+    }
+    return { folded, offsets };
+}
+const WORD_CHAR_RE = /[\p{L}\p{N}]/u;
+/** The search fold of a text, reusable across many values (folding a long text once). */
+export function searchIndex(text) {
+    const { folded, offsets } = foldForSearch(text);
+    return { text, folded, offsets };
+}
+export function findOccurrences(source, value) {
+    const out = [];
+    const needle = foldForSearch(value).folded;
+    if (needle.length < 2)
+        return out;
+    const index = typeof source === 'string' ? searchIndex(source) : source;
+    const { text, folded, offsets } = index;
+    const boundStart = WORD_CHAR_RE.test(value.trim().charAt(0));
+    const boundEnd = WORD_CHAR_RE.test(value.trim().slice(-1));
+    for (let i = folded.indexOf(needle); i >= 0; i = folded.indexOf(needle, i + 1)) {
+        const start = offsets[i];
+        const end = offsets[i + needle.length - 1] + 1;
+        if (boundStart && start > 0 && WORD_CHAR_RE.test(text.charAt(start - 1)))
+            continue;
+        if (boundEnd && end < text.length && WORD_CHAR_RE.test(text.charAt(end)))
+            continue;
+        out.push([start, end]);
+        i += needle.length - 1;
+    }
+    return out;
+}

package/dist/pdf/raster.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @doccloak/core/pdf - page rasterization fallback (T212).
+ *
+ * A page whose text cannot be edited safely is rendered to pixels by pdf.js
+ * and the redacted rectangles are painted black IN THE PIXELS, on the same
+ * canvas, after the render: the PNG never contains what was under a box.
+ * The caller (writer) replaces the page contents with this image and
+ * reports the page in `rasterizedPages`.
+ */
+import type { CanvasFactory, OracleDocument } from './oracle.js';
+import type { Rect } from './types.js';
+export interface RasterizedPage {
+    png: Uint8Array;
+    widthPx: number;
+    heightPx: number;
+    /** Displayed page size in points (CropBox with /Rotate applied), the size of a replacement page that shows the PNG unrotated. */
+    widthPt: number;
+    heightPt: number;
+}
+export interface RasterizeOptions {
+    dpi: number;
+    canvasFactory?: CanvasFactory;
+}
+/** Integer pixel box, top-left origin. */
+export interface PixelBox {
+    x: number;
+    y: number;
+    w: number;
+    h: number;
+}
+/**
+ * Map a user-space rectangle to canvas pixels through the pdf.js viewport
+ * transform [a b c d e f] (x' = a*x + c*y + e, y' = b*x + d*y + f). The four
+ * corners are transformed (rotation may swap axes) and their bounding box is
+ * returned, expanded outwards to whole pixels. No padding is applied here.
+ */
+export declare function userRectToPixels(viewportTransform: number[], rect: Rect): PixelBox;
+/** Pad a pixel box by `pad` on every side and clamp it to the canvas. Empty when the box lies outside. */
+export declare function padAndClamp(box: PixelBox, pad: number, widthPx: number, heightPx: number): PixelBox;
+/**
+ * Render page `index` at `options.dpi` (pdf.js applies /Rotate as a viewer
+ * would), paint every `boxes` rectangle black on the rendered pixels, and
+ * encode the canvas as PNG.
+ */
+export declare function rasterizePage(doc: OracleDocument, index: number, boxes: Rect[], options: RasterizeOptions): Promise<RasterizedPage>;

package/dist/pdf/raster.js

@@ -0,0 +1,89 @@
+/**
+ * @doccloak/core/pdf - page rasterization fallback (T212).
+ *
+ * A page whose text cannot be edited safely is rendered to pixels by pdf.js
+ * and the redacted rectangles are painted black IN THE PIXELS, on the same
+ * canvas, after the render: the PNG never contains what was under a box.
+ * The caller (writer) replaces the page contents with this image and
+ * reports the page in `rasterizedPages`.
+ */
+/**
+ * Map a user-space rectangle to canvas pixels through the pdf.js viewport
+ * transform [a b c d e f] (x' = a*x + c*y + e, y' = b*x + d*y + f). The four
+ * corners are transformed (rotation may swap axes) and their bounding box is
+ * returned, expanded outwards to whole pixels. No padding is applied here.
+ */
+export function userRectToPixels(viewportTransform, rect) {
+    const [a, b, c, d, e, f] = viewportTransform;
+    const xs = [rect.x0, rect.x1, rect.x0, rect.x1];
+    const ys = [rect.y0, rect.y0, rect.y1, rect.y1];
+    let minX = Infinity;
+    let minY = Infinity;
+    let maxX = -Infinity;
+    let maxY = -Infinity;
+    for (let i = 0; i < 4; i++) {
+        const px = a * xs[i] + c * ys[i] + e;
+        const py = b * xs[i] + d * ys[i] + f;
+        if (px < minX)
+            minX = px;
+        if (px > maxX)
+            maxX = px;
+        if (py < minY)
+            minY = py;
+        if (py > maxY)
+            maxY = py;
+    }
+    // Round to whole pixels outwards; tolerate float noise (1224.0000001 stays 1224).
+    const EPS = 1e-6;
+    const x = Math.floor(minX + EPS);
+    const y = Math.floor(minY + EPS);
+    const x1 = Math.ceil(maxX - EPS);
+    const y1 = Math.ceil(maxY - EPS);
+    return { x, y, w: Math.max(0, x1 - x), h: Math.max(0, y1 - y) };
+}
+/** Pad a pixel box by `pad` on every side and clamp it to the canvas. Empty when the box lies outside. */
+export function padAndClamp(box, pad, widthPx, heightPx) {
+    const x0 = Math.max(0, box.x - pad);
+    const y0 = Math.max(0, box.y - pad);
+    const x1 = Math.min(widthPx, box.x + box.w + pad);
+    const y1 = Math.min(heightPx, box.y + box.h + pad);
+    if (x1 <= x0 || y1 <= y0)
+        return { x: 0, y: 0, w: 0, h: 0 };
+    return { x: x0, y: y0, w: x1 - x0, h: y1 - y0 };
+}
+/** Pixels of padding around every box (covers anti-aliased glyph edges). */
+const BOX_PAD_PX = 1;
+/**
+ * Render page `index` at `options.dpi` (pdf.js applies /Rotate as a viewer
+ * would), paint every `boxes` rectangle black on the rendered pixels, and
+ * encode the canvas as PNG.
+ */
+export async function rasterizePage(doc, index, boxes, options) {
+    if (!(options.dpi > 0) || !Number.isFinite(options.dpi))
+        throw new RangeError(`invalid dpi ${options.dpi}`);
+    const scale = options.dpi / 72;
+    const page = await doc.render(index, scale, options.canvasFactory);
+    const ctx = page.canvas.context;
+    // pdf.js leaves its own transform / composite state on the context: draw
+    // in plain device pixels with an opaque black brush.
+    ctx.save();
+    ctx.setTransform(1, 0, 0, 1, 0, 0);
+    ctx.globalAlpha = 1;
+    ctx.globalCompositeOperation = 'source-over';
+    ctx.fillStyle = '#000000';
+    for (const box of boxes) {
+        const px = padAndClamp(userRectToPixels(page.transform, box), BOX_PAD_PX, page.widthPx, page.heightPx);
+        if (px.w === 0 || px.h === 0)
+            continue;
+        ctx.fillRect(px.x, px.y, px.w, px.h);
+    }
+    ctx.restore();
+    const png = await page.canvas.toPng();
+    return {
+        png,
+        widthPx: page.widthPx,
+        heightPx: page.heightPx,
+        widthPt: page.widthPt,
+        heightPt: page.heightPt,
+    };
+}

package/dist/pdf/read.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @doccloak/core/pdf - readPdf (T213/T215).
+ *
+ * Parses a PDF, extracts its text with glyph geometry, cross-checks every
+ * page against pdf.js and returns the extraction hosts run detection on.
+ * The extraction keeps the input bytes; the writer re-extracts from them so
+ * a stale extraction can never be applied to different bytes.
+ */
+import type { GlyphRun, PdfAssetPaths, PdfPageInfo, PdfReadOptions, RemovedPart } from './types.js';
+import type { UnredactablePart } from '../dom/errors.js';
+export interface PdfExtraction {
+    /** Flat text detection runs on. */
+    plainText: string;
+    pageCount: number;
+    pages: PdfPageInfo[];
+    /** Glyph runs in flat-text order (internal geometry, exposed for hosts that draw previews). */
+    runs: GlyphRun[];
+    /** Parts that cannot be redacted (scanned pages, undecodable text); gate the export like docx. */
+    unredactable: UnredactablePart[];
+    /** Parts the writer will drop from the output. */
+    removed: RemovedPart[];
+    warnings: string[];
+    /** True when no readable text was found. */
+    empty: boolean;
+    /** 0-based pages whose text came from pdf.js because our decoder disagreed (edits rasterize them). */
+    rasterOnlyPages: number[];
+    /** Input bytes (the writer's source of truth). */
+    bytes: Uint8Array;
+    assets?: PdfAssetPaths;
+    password?: string;
+}
+export type PdfInput = Blob | ArrayBuffer | Uint8Array;
+export declare function toPdfBytes(input: PdfInput): Promise<Uint8Array>;
+export declare function readPdf(input: PdfInput, options?: PdfReadOptions): Promise<PdfExtraction>;
+/** True for names ending in .pdf (case-insensitive). */
+export declare function isPdfFile(filename: string): boolean;

package/dist/pdf/read.js

@@ -0,0 +1,65 @@
+/**
+ * @doccloak/core/pdf - readPdf (T213/T215).
+ *
+ * Parses a PDF, extracts its text with glyph geometry, cross-checks every
+ * page against pdf.js and returns the extraction hosts run detection on.
+ * The extraction keeps the input bytes; the writer re-extracts from them so
+ * a stale extraction can never be applied to different bytes.
+ */
+import { DEFAULT_MAX_BYTES, extractPdf } from "./extract.js";
+import { UnsupportedDocumentError } from "../dom/errors.js";
+import { openWithOracle } from "./oracle.js";
+export async function toPdfBytes(input) {
+    if (input instanceof Uint8Array)
+        return input;
+    if (input instanceof ArrayBuffer)
+        return new Uint8Array(input);
+    if (typeof input.arrayBuffer === 'function')
+        return new Uint8Array(await input.arrayBuffer());
+    // Older Blob implementations (jsdom): go through FileReader.
+    return new Promise((resolve, reject) => {
+        const reader = new FileReader();
+        reader.onerror = () => reject(reader.error ?? new Error('could not read the file'));
+        reader.onload = () => resolve(new Uint8Array(reader.result));
+        reader.readAsArrayBuffer(input);
+    });
+}
+export async function readPdf(input, options = {}) {
+    const bytes = await toPdfBytes(input);
+    // Size cap before anything parses the file (pdf.js would otherwise read all of it first).
+    const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+    if (bytes.length > maxBytes) {
+        throw new UnsupportedDocumentError('too-large', `PDF is ${bytes.length} bytes; the limit is ${maxBytes}`, [String(bytes.length)]);
+    }
+    const oracle = await openWithOracle(bytes, options.assets, options.password);
+    try {
+        const res = await extractPdf(bytes, {
+            maxBytes: options.maxBytes,
+            maxPages: options.maxPages,
+            maxGlyphs: options.maxGlyphs,
+            password: options.password,
+            oracle,
+        });
+        return {
+            plainText: res.plainText,
+            pageCount: res.pages.length,
+            pages: res.pages,
+            runs: res.runs,
+            unredactable: res.unredactable,
+            removed: res.removed,
+            warnings: res.warnings,
+            empty: res.empty,
+            rasterOnlyPages: res.model.pages.filter((p) => p.oracleText).map((p) => p.index),
+            bytes,
+            assets: options.assets,
+            password: options.password,
+        };
+    }
+    finally {
+        await oracle.close();
+    }
+}
+/** True for names ending in .pdf (case-insensitive). */
+export function isPdfFile(filename) {
+    return /\.pdf$/i.test(filename.trim());
+}

package/dist/pdf/serializer.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @doccloak/core/pdf - content stream serializer (T206).
+ *
+ * Writes operators back to bytes. Operators that still carry their source
+ * range are copied verbatim from the original stream (so nothing we did not
+ * touch changes by even a byte); synthesized or edited operators are emitted
+ * from their operands. New strings are always written as hex strings, which
+ * is binary-safe for every font encoding.
+ */
+import type { ContentOp, Operand } from './lexer.js';
+export declare function formatNumber(value: number): string;
+export declare function hexOf(bytes: Uint8Array): string;
+export declare function serializeOperand(operand: Operand): string;
+/** Serialize one operator from its operands (ignores the source range). */
+export declare function serializeOp(op: ContentOp): string;
+/**
+ * Serialize a whole operator list. `source` is the original stream: an op
+ * whose [start, end) range is present is copied from it byte-for-byte.
+ */
+export declare function serializeOps(ops: readonly ContentOp[], source?: Uint8Array): Uint8Array;
+export declare function latin1Bytes(text: string): Uint8Array;