@embedpdf/engine-core 3.0.0-next.0

package/dist/builders-BvikWRuO.cjs

@@ -0,0 +1,1684 @@
+const require_subtype = require("./subtype-qejjVr6h.cjs");
+const require_fold = require("./fold-IaMph3CO.cjs");
+//#region src/geometry/convert.ts
+/**
+* Normalize a `PdfRect` to the y-up invariant (`left <= right`, `bottom <= top`),
+* regardless of how the PDF ordered the corners (a `/Rect` array or `FS_RECTF`
+* may carry them in any order). THE enforcement point for the "PdfRect is always
+* normalized" rule: every producer that reads a raw box from PDFium passes it
+* through here, so the invariant holds once, centrally — downstream `width =
+* right - left` is never negative.
+*/
+function normalizePdfRect(r) {
+	return {
+		left: Math.min(r.left, r.right),
+		right: Math.max(r.left, r.right),
+		bottom: Math.min(r.top, r.bottom),
+		top: Math.max(r.top, r.bottom)
+	};
+}
+function pdfRectWidth(r) {
+	return r.right - r.left;
+}
+function pdfRectHeight(r) {
+	return r.top - r.bottom;
+}
+function pdfRectSize(r) {
+	return {
+		width: r.right - r.left,
+		height: r.top - r.bottom
+	};
+}
+/** Convert edges -> origin+size, staying y-up (origin at bottom-left). */
+function pdfRectToOriginSize(r) {
+	return {
+		x: r.left,
+		y: r.bottom,
+		width: r.right - r.left,
+		height: r.top - r.bottom
+	};
+}
+/** Convert y-up origin+size back to edges. */
+function pdfRectFromOriginSize(o) {
+	return {
+		left: o.x,
+		bottom: o.y,
+		right: o.x + o.width,
+		top: o.y + o.height
+	};
+}
+/**
+* Enclosing axis-aligned box of a quad, in PDF user space. Orientation
+* agnostic (correct for rotated/skewed quads) — this is what highlight
+* rendering and hit-testing want.
+*/
+function pdfQuadBounds(q) {
+	const xs = [
+		q.p1.x,
+		q.p2.x,
+		q.p3.x,
+		q.p4.x
+	];
+	const ys = [
+		q.p1.y,
+		q.p2.y,
+		q.p3.y,
+		q.p4.y
+	];
+	return {
+		left: Math.min(...xs),
+		right: Math.max(...xs),
+		bottom: Math.min(...ys),
+		top: Math.max(...ys)
+	};
+}
+/**
+* Axis-aligned named-corner interpretation of a quad.
+*
+* VALID ONLY for upright (non-rotated, non-skewed) quads: it is derived from
+* the enclosing bounds, so for rotated/skewed quads it returns the bounding
+* box corners, not the true geometric corners. For arbitrary quads use the
+* positional `p1..p4` or `pdfQuadBounds` directly.
+*/
+function pdfQuadCorners(q) {
+	const b = pdfQuadBounds(q);
+	return {
+		topLeft: {
+			x: b.left,
+			y: b.top
+		},
+		topRight: {
+			x: b.right,
+			y: b.top
+		},
+		bottomLeft: {
+			x: b.left,
+			y: b.bottom
+		},
+		bottomRight: {
+			x: b.right,
+			y: b.bottom
+		}
+	};
+}
+/**
+* Build a quad from named corners, in PDFium `FS_QUADPOINTSF` slot order
+* (`p1 = topLeft`, `p2 = topRight`, `p3 = bottomLeft`, `p4 = bottomRight`).
+* The inverse of `pdfQuadCorners` for upright quads.
+*/
+function pdfQuadFromCorners(c) {
+	return {
+		p1: c.topLeft,
+		p2: c.topRight,
+		p3: c.bottomLeft,
+		p4: c.bottomRight
+	};
+}
+//#endregion
+//#region src/dto/PageRender.ts
+function createPageImageHandle(result, blobSource) {
+	return {
+		...result,
+		async objectUrl(signal) {
+			if (typeof Blob === "undefined" || typeof URL === "undefined" || !URL.createObjectURL) throw new require_fold.EngineError(require_subtype.EngineErrorCode.RuntimeUnavailable, "Object URLs are not available in this environment");
+			const blob = await blobSource.blob(signal);
+			const url = URL.createObjectURL(blob);
+			return {
+				url,
+				revoke: () => URL.revokeObjectURL(url)
+			};
+		}
+	};
+}
+//#endregion
+//#region src/dto/PdfSaveMode.ts
+const DEFAULT_PDF_SAVE_MODE = "incremental";
+//#endregion
+//#region src/identity/PageObjectNumber.ts
+/**
+* Type guard for the rare malformed-PDF case where a page is a direct
+* object. The engine treats `0` as malformed and throws `EngineError(NotFound)`
+* before any page-level operation.
+*/
+function isValidPageObjectNumber(value) {
+	return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+//#endregion
+//#region src/identity/AnnotationStableId.ts
+/**
+* URL-safe encoding of a stable id, used by the cloud HTTP surface as the
+* `:annotKey` route parameter. Decoded by the server back into an
+* `AnnotationStableId` via `decodeStableIdKey`.
+*
+* Format:
+*   `{ kind: 'objectNumber', value: 42 }` -> `'obj:42'`
+*   `{ kind: 'nm', value: 'foo bar' }`    -> `'nm:foo bar'`
+*
+* The caller is responsible for `encodeURIComponent`-ing the result before
+* splicing it into a URL path; `wirePaths.layerAnnotationByKey` already does
+* that. /NM values are opaque strings and may contain anything; the
+* `nm:` prefix lets the decoder distinguish them from numeric ids
+* unambiguously.
+*/
+function encodeStableIdKey(id) {
+	if (id.kind === "objectNumber") {
+		if (!Number.isInteger(id.value) || id.value <= 0) throw new RangeError(`encodeStableIdKey: objectNumber must be a positive integer, got ${id.value}`);
+		return `obj:${id.value}`;
+	}
+	return `nm:${id.value}`;
+}
+/**
+* Inverse of `encodeStableIdKey`. Returns `null` for malformed input so
+* the server can answer 400 InvalidArg with a useful message instead of
+* throwing.
+*
+* The input is the already-`decodeURIComponent`-ed segment from the route
+* path. Empty `/NM` values are rejected: `nm:` with no suffix is not a
+* valid identity.
+*/
+function decodeStableIdKey(key) {
+	if (key.startsWith("obj:")) {
+		const rest = key.slice(4);
+		const n = Number.parseInt(rest, 10);
+		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
+		return {
+			kind: "objectNumber",
+			value: n
+		};
+	}
+	if (key.startsWith("nm:")) {
+		const value = key.slice(3);
+		if (value.length === 0) return null;
+		return {
+			kind: "nm",
+			value
+		};
+	}
+	return null;
+}
+//#endregion
+//#region src/revision/RevisionToken.ts
+function revisionTokensEqual(a, b) {
+	return a.docSessionId === b.docSessionId && a.pageObjectNumber === b.pageObjectNumber && a.generation === b.generation;
+}
+//#endregion
+//#region src/revision/WeakAnnotationState.ts
+const UNKNOWN_WEAK_ANNOTATION_STATE = { kind: "unknown" };
+function knownWeakAnnotationState(hasAnyWeakAnnotations) {
+	return {
+		kind: "known",
+		hasAnyWeakAnnotations
+	};
+}
+//#endregion
+//#region src/annotation/primitives.ts
+const NO_ANNOTATION_FLAGS = {
+	invisible: false,
+	hidden: false,
+	print: false,
+	noZoom: false,
+	noRotate: false,
+	noView: false,
+	readOnly: false,
+	locked: false,
+	toggleNoView: false,
+	lockedContents: false
+};
+//#endregion
+//#region src/resource/BinarySource.ts
+function isBlob(value) {
+	return typeof Blob !== "undefined" && value instanceof Blob;
+}
+/**
+* Detach a Uint8Array view into a standalone ArrayBuffer without copying
+* when the view already spans its whole buffer.
+*/
+function toStandaloneArrayBuffer(view) {
+	if (view.byteOffset === 0 && view.buffer instanceof ArrayBuffer && view.byteLength === view.buffer.byteLength) return view.buffer;
+	return view.slice().buffer;
+}
+/**
+* Resolve any accepted `BinarySource` form into a `WireResource`.
+* Async because Blob bytes can only be read asynchronously.
+*/
+async function resolveBinarySource(source) {
+	if (source instanceof Uint8Array) return { bytes: toStandaloneArrayBuffer(source) };
+	if (isBlob(source)) {
+		const blobName = blobFileName(source);
+		return {
+			bytes: await source.arrayBuffer(),
+			mimeType: source.type || void 0,
+			...blobName !== void 0 ? { name: blobName } : {}
+		};
+	}
+	const { data, mimeType, name } = source;
+	const inner = data instanceof Uint8Array ? {
+		bytes: toStandaloneArrayBuffer(data),
+		mimeType: void 0,
+		name: void 0
+	} : {
+		bytes: await data.arrayBuffer(),
+		mimeType: data.type || void 0,
+		name: blobFileName(data)
+	};
+	const resolvedName = name ?? inner.name;
+	return {
+		bytes: inner.bytes,
+		...mimeType ?? inner.mimeType ? { mimeType: mimeType ?? inner.mimeType } : {},
+		...resolvedName !== void 0 ? { name: resolvedName } : {}
+	};
+}
+/** A browser `File` is a Blob with a `name` — pick it up so attachment
+*  drafts can pass a `File` directly without repeating the file name. */
+function blobFileName(blob) {
+	const name = blob.name;
+	return typeof name === "string" && name.length > 0 ? name : void 0;
+}
+//#endregion
+//#region src/resource/binaryMetadata.ts
+/**
+* Detect format (and intrinsic dimensions for rasters) of a binary buffer.
+*
+* @returns metadata, or `null` for unsupported/corrupt data
+*/
+function sniffBinaryMetadata(buffer) {
+	if (buffer.byteLength < 4) return null;
+	const bytes = new Uint8Array(buffer);
+	if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) return parsePng(buffer);
+	if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return parseJpeg(buffer);
+	if (bytes[0] === 37 && bytes[1] === 80 && bytes[2] === 68 && bytes[3] === 70) return { mimeType: "application/pdf" };
+	return null;
+}
+function parsePng(buffer) {
+	if (buffer.byteLength < 24) return null;
+	const view = new DataView(buffer);
+	const width = view.getUint32(16);
+	const height = view.getUint32(20);
+	if (width === 0 || height === 0) return null;
+	return {
+		mimeType: "image/png",
+		width,
+		height
+	};
+}
+function parseJpeg(buffer) {
+	const bytes = new Uint8Array(buffer);
+	let offset = 2;
+	while (offset + 4 < bytes.byteLength) {
+		if (bytes[offset] !== 255) return null;
+		const marker = bytes[offset + 1];
+		if (marker >= 192 && marker <= 195) {
+			if (offset + 9 > bytes.byteLength) return null;
+			const view = new DataView(buffer, offset + 5);
+			const height = view.getUint16(0);
+			const width = view.getUint16(2);
+			if (width === 0 || height === 0) return null;
+			return {
+				mimeType: "image/jpeg",
+				width,
+				height
+			};
+		}
+		if (marker === 216 || marker === 217) offset += 2;
+		else if (marker === 255) offset += 1;
+		else {
+			const segLen = bytes[offset + 2] << 8 | bytes[offset + 3];
+			offset += 2 + segLen;
+		}
+	}
+	return null;
+}
+//#endregion
+//#region src/annotation/kinds/file-attachment/normalize.ts
+/**
+* Resolve an attachment `file` into its wire halves: metadata into the
+* JSON body, bytes into the resource map. Unlike stamps there is NO
+* format allowlist — attaching arbitrary files is the point — so the
+* declared mime type wins (attachment formats cannot be reliably sniffed;
+* the writer falls back to `application/octet-stream` when absent).
+*
+* Shared by the file-attachment annotation draft (below) and the
+* document-level `attachments.create` mutation — one vocabulary, one
+* normalizer for both homes a file can enter a PDF through.
+*/
+async function normalizeAttachmentFileSource(file, key) {
+	const resolved = await resolveBinarySource(file.data);
+	const name = file.name ?? resolved.name;
+	if (!name) throw new require_fold.EngineError(require_subtype.EngineErrorCode.InvalidArg, "attachment file requires a name — pass { data, name } or a File whose name is set");
+	const mimeType = file.mimeType ?? resolved.mimeType;
+	return {
+		wireFile: {
+			resource: key,
+			name,
+			...mimeType !== void 0 ? { mimeType } : {},
+			...file.description !== void 0 ? { description: file.description } : {}
+		},
+		resource: {
+			bytes: resolved.bytes,
+			...mimeType !== void 0 ? { mimeType } : {},
+			name
+		}
+	};
+}
+async function normalizeFileAttachmentDraft(draft, allocateKey) {
+	const { file, ...rest } = draft;
+	const key = allocateKey();
+	const { wireFile, resource } = await normalizeAttachmentFileSource(file, key);
+	return {
+		wire: {
+			...rest,
+			file: wireFile
+		},
+		resources: { [key]: resource }
+	};
+}
+//#endregion
+//#region src/annotation/kinds/stamp/normalize.ts
+/**
+* Resolve + validate a stamp `source`. Sniffing happens here — before any
+* transport — so callers get a fast `InvalidArg` instead of a worker/HTTP
+* round-trip. The sniffed mime type overwrites whatever was declared.
+*/
+async function resolveStampSource(source) {
+	const resolved = await resolveBinarySource(source);
+	const meta = sniffBinaryMetadata(resolved.bytes);
+	if (!meta) throw new require_fold.EngineError(require_subtype.EngineErrorCode.InvalidArg, "stamp source must be PNG, JPEG, or single-page PDF bytes (format is detected from the data, not the declared mime type)");
+	return {
+		...resolved,
+		mimeType: meta.mimeType
+	};
+}
+async function normalizeStampDraft(draft, allocateKey) {
+	const { source, ...rest } = draft;
+	const resolved = await resolveStampSource(source);
+	const key = allocateKey();
+	return {
+		wire: {
+			...rest,
+			source: { resource: key }
+		},
+		resources: { [key]: resolved }
+	};
+}
+async function normalizeStampPatch(patch, allocateKey) {
+	if (patch.source === void 0) {
+		const { source: _source, ...rest } = patch;
+		return {
+			wire: rest,
+			resources: {}
+		};
+	}
+	const { source, ...rest } = patch;
+	const resolved = await resolveStampSource(source);
+	const key = allocateKey();
+	return {
+		wire: {
+			...rest,
+			source: { resource: key }
+		},
+		resources: { [key]: resolved }
+	};
+}
+//#endregion
+//#region src/annotation/normalize.ts
+function createResourceKeyAllocator() {
+	let next = 0;
+	return () => `r${next++}`;
+}
+async function normalizeAnnotationDraft(draft) {
+	switch (draft.subtype) {
+		case "stamp": return normalizeStampDraft(draft, createResourceKeyAllocator());
+		case "file-attachment": return normalizeFileAttachmentDraft(draft, createResourceKeyAllocator());
+		default: return {
+			wire: draft,
+			resources: {}
+		};
+	}
+}
+async function normalizeAnnotationPatch(patch) {
+	switch (patch.subtype) {
+		case "stamp": return normalizeStampPatch(patch, createResourceKeyAllocator());
+		default: return {
+			wire: patch,
+			resources: {}
+		};
+	}
+}
+//#endregion
+//#region src/annotation/relationships.ts
+/**
+* Classify one annotation by its relationship edge alone. Mirrors the
+* spec's "practical parser rule": no `/IRT` is top-level; `/RT /Group` is
+* a grouped subordinate; anything else with an `/IRT` is a reply (the
+* engine has already normalized a missing `/RT` to `'reply'`).
+*/
+function classifyRelation(a) {
+	if (!a.inReplyTo) return "top-level";
+	return a.replyType === "group" ? "grouped-subordinate" : "reply";
+}
+/**
+* Stable string key for an {@link AnnotationRef}, used to match a child's
+* `inReplyTo` against a candidate parent's `ref`. Both sides are produced
+* by the engine with the same identity precedence (objectNumber, then nm,
+* then index), so equal keys mean "same annotation".
+*/
+function refKey(ref) {
+	switch (ref.kind) {
+		case "objectNumber": return `obj:${ref.pageObjectNumber}:${ref.annotObjectNumber}`;
+		case "nm": return `nm:${ref.pageObjectNumber}:${ref.nm}`;
+		case "index": return `idx:${ref.pageObjectNumber}:${ref.index}`;
+	}
+}
+/**
+* Compose a flat annotation list (one page, or a whole document via
+* `listRawAll()` flattened) into {@link AnnotationThread}s in primary
+* order.
+*
+* Rules (ISO 32000 §12.5.6.2 + the spec's UI rule):
+*   - Annotations with no `/IRT` become thread primaries, in input order.
+*   - A `/RT /Group` child is attached to its primary's `groupedParts`.
+*   - A `/RT /R` (or default) child is attached to its primary's `replies`.
+*   - A child whose parent is not in the input set is treated as an
+*     orphan primary (defensive — e.g. a partial/filtered page slice).
+*
+* Limitations (v1, matches the legacy stack): threading is one level deep
+* — a reply-to-a-reply is keyed to its direct parent, so it only appears
+* nested if that direct parent is itself a primary. Callers that want a
+* sidebar of "most annotations, not widgets/popups" should pre-filter the
+* input; this helper is intentionally unopinionated about eligibility.
+*/
+function buildThreads(annotations) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const a of annotations) {
+		byKey.set(refKey(a.ref), a);
+		if (a.nm && a.nm.length > 0) byKey.set(`nm:${a.ref.pageObjectNumber}:${a.nm}`, a);
+	}
+	const threads = [];
+	const threadByPrimaryKey = /* @__PURE__ */ new Map();
+	const primaryThread = (primary) => {
+		const key = refKey(primary.ref);
+		let thread = threadByPrimaryKey.get(key);
+		if (!thread) {
+			thread = {
+				primary,
+				groupedParts: [],
+				replies: []
+			};
+			threadByPrimaryKey.set(key, thread);
+			threads.push(thread);
+		}
+		return thread;
+	};
+	for (const a of annotations) if (!a.inReplyTo) primaryThread(a);
+	for (const a of annotations) {
+		if (!a.inReplyTo) continue;
+		const parent = byKey.get(refKey(a.inReplyTo));
+		if (!parent || parent.inReplyTo) {
+			primaryThread(a);
+			continue;
+		}
+		const thread = primaryThread(parent);
+		if (a.replyType === "group") thread.groupedParts.push(a);
+		else thread.replies.push(a);
+	}
+	return threads;
+}
+//#endregion
+//#region src/mutation/AnnotationMutationImpactPolicy.ts
+function changesAnnotationList(_kind) {
+	return true;
+}
+function shiftsExistingAnnotationIndices(kind) {
+	return kind === "delete" || kind === "move";
+}
+function invalidatesWeakIndexRefs(kind, weakStateBefore) {
+	if (!shiftsExistingAnnotationIndices(kind)) return false;
+	if (weakStateBefore.kind !== "known") throw new Error(`invalidatesWeakIndexRefs requires a known WeakAnnotationState for ${kind}; got 'unknown'. Caller must scan the page before computing mutation impact.`);
+	return weakStateBefore.hasAnyWeakAnnotations;
+}
+//#endregion
+//#region src/annotation/appearance.ts
+/**
+* Coordinate tolerance in PDF user-space points. PDF numbers round-trip
+* through f32 (~7 significant digits) and client-side space conversions, so
+* exact float equality would misclassify no-op writes; 1e-3 pt is far below
+* anything visible while far above accumulated f32 drift at page magnitudes.
+*/
+const EPSILON = .001;
+/**
+* Keys that never affect `/AP` on any kind: the discriminator, behavioral
+* flags, reply relationships, and grouping.
+*/
+const INERT_KEYS = /* @__PURE__ */ new Set([
+	"subtype",
+	"flags",
+	"inReplyTo",
+	"replyType",
+	"groupId"
+]);
+/**
+* Kinds whose `/AP` paints `/Contents`. Everywhere else `contents` is popup
+* note text — editing a comment must never re-bake (or destroy) the shape's
+* appearance.
+*/
+const CONTENTS_PAINTED = /* @__PURE__ */ new Set(["free-text", "redact"]);
+/**
+* The vertex family's `/EMBD_Metadata/Rotation` is an advisory scalar (the
+* vertices are already rotated); it never drives the AP generator, so patches
+* touching it are appearance-inert for these kinds.
+*/
+const ADVISORY_ROTATION = /* @__PURE__ */ new Set([
+	"line",
+	"polyline",
+	"polygon",
+	"ink"
+]);
+/**
+* The box kinds carry the `/EMBD_Metadata` transform pair (`rotation` +
+* `unrotatedRect`), tri-state on writes: omitted fields are PRESERVED, `null`
+* (or `0` for rotation) clears. Translation verification therefore compares
+* the after-state — `patch.rotation ?? current.rotation` — not the patch keys.
+*/
+const BOX_TRANSFORM = /* @__PURE__ */ new Set([
+	"square",
+	"circle",
+	"free-text",
+	"stamp"
+]);
+/**
+* Per-kind absolute-geometry fields (PDF user space) that a rigid translation
+* shifts together. A kind absent from this table never takes the translation
+* route. `rect` is required in every entry: a translation always moves `/Rect`.
+*/
+const TRANSLATABLE_GEOMETRY = {
+	square: ["rect", "unrotatedRect"],
+	circle: ["rect", "unrotatedRect"],
+	"free-text": [
+		"rect",
+		"unrotatedRect",
+		"calloutLine"
+	],
+	line: ["rect", "linePoints"],
+	polygon: ["rect", "vertices"],
+	polyline: ["rect", "vertices"],
+	ink: ["rect", "inkList"],
+	highlight: ["rect", "quadPoints"],
+	underline: ["rect", "quadPoints"],
+	squiggly: ["rect", "quadPoints"],
+	strikeout: ["rect", "quadPoints"],
+	redact: ["rect", "quadPoints"],
+	caret: ["rect"],
+	text: ["rect"],
+	stamp: ["rect", "unrotatedRect"],
+	"file-attachment": ["rect"],
+	link: ["rect"]
+};
+const numEq = (a, b) => Math.abs(a - b) <= EPSILON;
+/** Degrees normalized to [0,360); absent reads as 0 (no rotation). */
+const normDeg = (v) => {
+	return typeof v === "number" ? (v % 360 + 360) % 360 : 0;
+};
+/**
+* Semantic equality between a patch value and the current DTO value.
+* Numbers compare within {@link EPSILON}; `null` and `undefined` both mean
+* "entry absent" (the tri-state clear of an absent entry is a no-op); arrays
+* and objects compare structurally.
+*/
+function semanticEqual(a, b) {
+	if (a == null || b == null) return a == null && b == null;
+	if (typeof a === "number" && typeof b === "number") return numEq(a, b);
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => semanticEqual(v, b[i]));
+	}
+	if (typeof a === "object" && typeof b === "object") {
+		const keys = /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)]);
+		for (const k of keys) if (!semanticEqual(a[k], b[k])) return false;
+		return true;
+	}
+	return a === b;
+}
+/**
+* Is `next` exactly `cur` shifted by `(dx, dy)`? Walks the value structurally:
+* numeric leaves under x-axis keys (`left`/`right`/`x`) must shift by `dx`,
+* y-axis keys (`bottom`/`top`/`y`) by `dy`, and any other numeric leaf must be
+* unchanged. Arrays walk elementwise (same length required).
+*/
+function shiftedBy(cur, next, dx, dy) {
+	if (cur == null || next == null) return cur == null && next == null;
+	if (Array.isArray(cur) || Array.isArray(next)) {
+		if (!Array.isArray(cur) || !Array.isArray(next) || cur.length !== next.length) return false;
+		return cur.every((v, i) => shiftedBy(v, next[i], dx, dy));
+	}
+	if (typeof cur === "object" && typeof next === "object") {
+		const keys = /* @__PURE__ */ new Set([...Object.keys(cur), ...Object.keys(next)]);
+		for (const k of keys) {
+			const c = cur[k];
+			const n = next[k];
+			if (typeof c === "number" && typeof n === "number") {
+				if (!numEq(c + (k === "left" || k === "right" || k === "x" ? dx : k === "bottom" || k === "top" || k === "y" ? dy : 0), n)) return false;
+			} else if (!shiftedBy(c, n, dx, dy)) return false;
+		}
+		return true;
+	}
+	return cur === next;
+}
+/**
+* Verify the touched geometry is one rigid translation of the current state.
+* Requires `patch.rect` (a translation always moves `/Rect`) with width and
+* height preserved; every other geometry field present on the annotation must
+* ride along shifted by the same delta — a rect move that leaves `vertices`
+* behind is NOT a translation (the dictionary would desync from the pixels).
+* For box kinds the `/EMBD_Metadata` transform group is checked as an
+* after-state: writes are tri-state (omitted preserves, null/0 clears), so an
+* omitted rotation keeps the current one — but a preserved-yet-unshifted
+* `unrotatedRect` still fails the congruence check via the field loop.
+*/
+function isRigidTranslation(cur, pat, subtype, geometryKeys) {
+	const curRect = cur.rect;
+	const patRect = pat.rect;
+	if (!curRect || !patRect) return false;
+	const dx = patRect.left - curRect.left;
+	const dy = patRect.bottom - curRect.bottom;
+	if (!numEq(patRect.right - patRect.left, curRect.right - curRect.left)) return false;
+	if (!numEq(patRect.top - patRect.bottom, curRect.top - curRect.bottom)) return false;
+	if (BOX_TRANSFORM.has(subtype)) {
+		const rotAfter = pat.rotation === void 0 ? cur.rotation : pat.rotation;
+		if (!numEq(normDeg(cur.rotation), normDeg(rotAfter))) return false;
+	}
+	for (const key of geometryKeys) {
+		if (key === "rect") continue;
+		const c = cur[key];
+		const p = pat[key];
+		if (c == null && p == null) continue;
+		if (c == null || p == null) return false;
+		if (!shiftedBy(c, p, dx, dy)) return false;
+	}
+	return true;
+}
+/**
+* Classify an update patch against the annotation's current DTO.
+*
+* 1. Value-diff: drop keys whose value semantically equals the current one,
+*    plus the always-inert metadata keys (and per-kind inert keys: `contents`
+*    where it isn't painted, advisory `rotation` on the vertex family).
+*    Nothing left → `'inert'`.
+* 2. If every remaining key is translatable geometry for this kind AND the
+*    values are one rigid translation → `'translation'`.
+* 3. Anything else — style, text, unknown keys, unknown kinds → `'regenerate'`.
+*/
+function appearanceImpactOf(current, patch) {
+	if (patch.subtype !== current.subtype) return "regenerate";
+	const cur = current;
+	const pat = patch;
+	const subtype = patch.subtype;
+	const touched = [];
+	for (const [key, value] of Object.entries(pat)) {
+		if (value === void 0 || INERT_KEYS.has(key)) continue;
+		if (key === "contents" && !CONTENTS_PAINTED.has(subtype)) continue;
+		if (key === "rotation" && ADVISORY_ROTATION.has(subtype)) continue;
+		if (!semanticEqual(value, cur[key])) touched.push(key);
+	}
+	if (touched.length === 0) return "inert";
+	const geometryKeys = TRANSLATABLE_GEOMETRY[subtype];
+	if (!geometryKeys) return "regenerate";
+	if (!touched.every((k) => geometryKeys.includes(k))) return "regenerate";
+	return isRigidTranslation(cur, pat, subtype, geometryKeys) ? "translation" : "regenerate";
+}
+//#endregion
+//#region src/identity/FormFieldRef.ts
+/**
+* URL-safe encoding of a `FormFieldRef`, used by the cloud HTTP surface as
+* the `:fieldKey` route parameter. Decoded by the server back into a
+* `FormFieldRef` via `decodeFieldRefKey`. Mirrors the annotation plane's
+* `encodeStableIdKey` (`obj:42` / `nm:…`) so the two member-key syntaxes
+* read the same on the wire:
+*
+*   `{ kind: 'objectNumber', fieldObjectNumber: 12 }` -> `'obj:12'`
+*   `{ kind: 'fqn', name: 'billing.name' }`           -> `'fqn:billing.name'`
+*
+* The caller is responsible for `encodeURIComponent`-ing the result before
+* splicing it into a URL path; the `wirePaths.layerFormField*` builders
+* already do that. FQNs are opaque strings and may contain anything; the
+* `fqn:` prefix keeps them unambiguous from numeric ids.
+*/
+function encodeFieldRefKey(ref) {
+	if (ref.kind === "objectNumber") {
+		if (!Number.isInteger(ref.fieldObjectNumber) || ref.fieldObjectNumber <= 0) throw new RangeError(`encodeFieldRefKey: fieldObjectNumber must be a positive integer, got ${ref.fieldObjectNumber}`);
+		return `obj:${ref.fieldObjectNumber}`;
+	}
+	return `fqn:${ref.name}`;
+}
+/**
+* Inverse of `encodeFieldRefKey`. Returns `null` for malformed input so the
+* server can answer 400 InvalidArg with a useful message instead of
+* throwing. The input is the already-`decodeURIComponent`-ed segment from
+* the route path. Empty FQNs are rejected: `fqn:` with no suffix is not a
+* valid identity.
+*/
+function decodeFieldRefKey(key) {
+	if (key.startsWith("obj:")) {
+		const rest = key.slice(4);
+		const n = Number.parseInt(rest, 10);
+		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
+		return {
+			kind: "objectNumber",
+			fieldObjectNumber: n
+		};
+	}
+	if (key.startsWith("fqn:")) {
+		const name = key.slice(4);
+		if (name.length === 0) return null;
+		return {
+			kind: "fqn",
+			name
+		};
+	}
+	return null;
+}
+//#endregion
+//#region src/search/literal.ts
+/**
+* The fold flavor a literal query needs. Haystack and needle MUST be
+* folded with the same options; corpus caches key their pre-folded text
+* on this (the default `{}` fold is the persistable one — non-default
+* queries fold the original page text at query time).
+*/
+function foldOptionsFor(query) {
+	return {
+		keepCase: !!query.matchCase,
+		keepMarks: !!query.matchDiacritics
+	};
+}
+const WORD_UNIT = /[\p{L}\p{N}_]/u;
+const MARK = /\p{M}/u;
+/** Whether the code point ENDING at `index` (exclusive) is a word char. */
+function wordBefore(text, index) {
+	if (index <= 0) return false;
+	const unit = text.charCodeAt(index - 1);
+	const start = unit >= 56320 && unit <= 57343 && index >= 2 ? index - 2 : index - 1;
+	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(start)));
+}
+/** Whether the code point starting at `index` is a word char. */
+function wordAt(text, index) {
+	if (index >= text.length) return false;
+	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(index)));
+}
+/**
+* All non-overlapping literal matches, in original code-unit space.
+* `haystack` must have been folded with `foldOptionsFor(query)`.
+*/
+function matchLiteral(haystack, query) {
+	const needle = require_fold.foldText(query.text, foldOptionsFor(query)).folded;
+	if (needle.trim().length === 0) return [];
+	const out = [];
+	let from = 0;
+	while (from <= haystack.folded.length - needle.length) {
+		const at = haystack.folded.indexOf(needle, from);
+		if (at < 0) break;
+		if (query.wholeWord && (wordBefore(haystack.folded, at) || wordAt(haystack.folded, at + needle.length))) {
+			from = at + 1;
+			continue;
+		}
+		if (query.matchDiacritics && at + needle.length < haystack.folded.length) {
+			const after = haystack.folded.codePointAt(at + needle.length);
+			if (MARK.test(String.fromCodePoint(after))) {
+				from = at + 1;
+				continue;
+			}
+		}
+		out.push(require_fold.toOriginalRange(haystack, at, needle.length));
+		from = at + needle.length;
+	}
+	return out;
+}
+//#endregion
+//#region src/search/regex.ts
+/**
+* The portable search-regex dialect: JavaScript `u`-mode syntax MINUS the
+* features RE2 refuses (backreferences, lookaround). The local engine
+* executes patterns with JS `RegExp`; the server executes the SAME
+* pattern with RE2, whose linear-time guarantee is the ReDoS defense.
+* Restricting both sides to the common subset keeps one query string
+* valid — and equally powerful — everywhere.
+*/
+const SEARCH_REGEX_MAX_LENGTH = 512;
+/**
+* Validate a pattern against the dialect. Cheap and dependency-free —
+* viewers call it on keystroke for early feedback; engines re-validate
+* and reject bad patterns with `InvalidArg`.
+*/
+function validateSearchRegex(pattern) {
+	if (pattern.length === 0) return {
+		ok: false,
+		issue: "empty",
+		message: "Pattern is empty."
+	};
+	if (pattern.length > 512) return {
+		ok: false,
+		issue: "too-long",
+		message: `Pattern exceeds 512 characters.`
+	};
+	let inClass = false;
+	for (let i = 0; i < pattern.length; i++) {
+		const ch = pattern[i];
+		if (ch === "\\") {
+			const next = pattern[i + 1] ?? "";
+			if (!inClass && next >= "1" && next <= "9") return {
+				ok: false,
+				issue: "backreference",
+				message: `Backreference \\${next} is not supported.`
+			};
+			if (!inClass && next === "k" && pattern[i + 2] === "<") return {
+				ok: false,
+				issue: "backreference",
+				message: "Named backreferences (\\k<…>) are not supported."
+			};
+			i++;
+			continue;
+		}
+		if (inClass) {
+			if (ch === "]") inClass = false;
+			continue;
+		}
+		if (ch === "[") {
+			inClass = true;
+			continue;
+		}
+		if (ch === "(" && pattern[i + 1] === "?") {
+			const tag = pattern[i + 2] ?? "";
+			if (tag === "=" || tag === "!") return {
+				ok: false,
+				issue: "lookaround",
+				message: "Lookahead ((?=…), (?!…)) is not supported."
+			};
+			if (tag === "<" && (pattern[i + 3] === "=" || pattern[i + 3] === "!")) return {
+				ok: false,
+				issue: "lookaround",
+				message: "Lookbehind ((?<=…), (?<!…)) is not supported."
+			};
+		}
+	}
+	try {
+		new RegExp(pattern, "mu");
+	} catch (error) {
+		return {
+			ok: false,
+			issue: "syntax",
+			message: error.message
+		};
+	}
+	return { ok: true };
+}
+function validateSearchQuery(query) {
+	if (!query.regex) return { ok: true };
+	if (query.matchDiacritics) return {
+		ok: false,
+		issue: "diacritics-with-regex",
+		message: "Diacritic-sensitive matching is not available for regex patterns (regex runs on the raw text plane)."
+	};
+	return validateSearchRegex(query.text);
+}
+/**
+* All matches of a dialect-valid pattern over the RAW page text (regex
+* does not run against folded text — case handling is the `i` flag, and
+* diacritic folding never applies). `wholeWord` is a boundary POST-FILTER
+* using the same Unicode word test as the literal path — never `\b`,
+* whose ASCII word set would give the toggle different semantics in regex
+* mode ("caf" whole-word matching inside "café"). Filtering after the
+* match also survives the move to RE2 server-side. Zero-length matches
+* are skipped: search UI cannot highlight nothing, and skipping them is
+* also the infinite-loop guard for patterns like `a*`.
+*/
+function matchRegex(text, query) {
+	const valid = validateSearchQuery({
+		...query,
+		regex: true
+	});
+	if (!valid.ok) throw new Error(`Invalid search query (${valid.issue}): ${valid.message}`);
+	const re = new RegExp(query.text, query.matchCase ? "gmu" : "gimu");
+	const out = [];
+	let m;
+	while ((m = re.exec(text)) !== null) {
+		if (m[0].length === 0) {
+			const unit = text.charCodeAt(re.lastIndex);
+			re.lastIndex += unit >= 55296 && unit <= 56319 ? 2 : 1;
+			continue;
+		}
+		if (query.wholeWord && (wordBefore(text, m.index) || wordAt(text, m.index + m[0].length))) continue;
+		out.push({
+			start: m.index,
+			length: m[0].length
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/search/matcher.ts
+/**
+* The whole match stage in one pure call: page text in, original-space
+* match ranges out. Engines with a pre-folded corpus for the default fold
+* skip this and call `matchLiteral` on the cached `FoldedText` directly;
+* everything else (non-default fold options, regex, tests) comes through
+* here.
+*/
+function matchPageText(text, query) {
+	if (query.regex) return matchRegex(text, query);
+	return matchLiteral(require_fold.foldText(text, foldOptionsFor(query)), query);
+}
+//#endregion
+//#region src/search/snippet.ts
+/** Default context on each side of a match, in code units. */
+const SEARCH_SNIPPET_CONTEXT = 48;
+const WHITESPACE = /\s/;
+const WHITESPACE_ALL = /\s/g;
+const isLowSurrogate = (text, index) => {
+	const unit = text.charCodeAt(index);
+	return unit >= 56320 && unit <= 57343;
+};
+/**
+* The `'full'`-mode excerpt around one match: up to `context` code units
+* of page text on each side, trimmed to a whitespace boundary when one
+* exists inside the window (so snippets start and end on whole words),
+* never splitting a surrogate pair, whitespace flattened 1:1.
+*/
+function buildSnippet(text, range, context = 48) {
+	const matchEnd = range.start + range.length;
+	let start = Math.max(0, range.start - context);
+	if (start > 0) {
+		for (let i = start; i < range.start; i++) if (WHITESPACE.test(text[i])) {
+			start = i + 1;
+			break;
+		}
+		if (isLowSurrogate(text, start)) start++;
+	}
+	let end = Math.min(text.length, matchEnd + context);
+	if (end < text.length) {
+		for (let i = end - 1; i >= matchEnd; i--) if (WHITESPACE.test(text[i])) {
+			end = i;
+			break;
+		}
+		if (isLowSurrogate(text, end)) end--;
+	}
+	return {
+		text: text.slice(start, end).replace(WHITESPACE_ALL, " "),
+		matchStart: range.start - start,
+		matchLength: range.length
+	};
+}
+//#endregion
+//#region src/search/rects.ts
+/**
+* Match-range → merged line rects, in PDF user space (y-up).
+*
+* This is the same line-merge text selection uses (adapted from Chromium's
+* pdf/pdfium/pdfium_range.cc `MergeAdjacentRects`, BSD-licensed, Copyright
+* 2010 The Chromium Authors), operating directly on the engine's
+* `PageGeometrySnapshot`: glyph loose boxes → sub-runs (split on big
+* intra-run gaps) → one rect per visual line. Search highlights therefore
+* look exactly like selections — never a rect per glyph (the v2 bug).
+*
+* It lives in engine-core because BOTH sides need it: the server computes
+* rects here for `'rects'`-mode responses (geometry never leaves the trust
+* boundary), and the local engine computes them in the worker.
+*/
+const FLAG_EMPTY = 2;
+const CHAR_DISTANCE_FACTOR = 2.5;
+const FONT_SIZE_RATIO_THRESHOLD = 1.5;
+const VERTICAL_OVERLAP_THRESHOLD = .8;
+/**
+* Merged line rects for the text-page char range
+* `[charStart, charStart + charCount)`. Ranges index the same space as
+* `PageGeometryRun.charStart`; chars outside the snapshot are ignored.
+*/
+function searchRectsForRange(snapshot, charStart, charCount) {
+	if (charCount <= 0) return [];
+	const lo = charStart;
+	const hi = charStart + charCount - 1;
+	const subRuns = [];
+	for (const run of snapshot.runs) {
+		const runEnd = run.charStart + run.glyphs.length - 1;
+		if (runEnd < lo || run.charStart > hi) continue;
+		const s = Math.max(lo, run.charStart);
+		const e = Math.min(hi, runEnd);
+		let left = Infinity;
+		let right = -Infinity;
+		let bottom = Infinity;
+		let top = -Infinity;
+		let count = 0;
+		let widthSum = 0;
+		let prevRight = -Infinity;
+		const flush = () => {
+			if (count > 0 && right > left && top > bottom) subRuns.push({
+				rect: {
+					left,
+					bottom,
+					right,
+					top
+				},
+				charCount: count,
+				fontSize: run.fontSize
+			});
+			left = Infinity;
+			right = -Infinity;
+			bottom = Infinity;
+			top = -Infinity;
+			count = 0;
+			widthSum = 0;
+			prevRight = -Infinity;
+		};
+		for (let ci = s; ci <= e; ci++) {
+			const g = run.glyphs[ci - run.charStart];
+			if ((g.flags & FLAG_EMPTY) !== 0) continue;
+			const b = g.looseBox;
+			if (count > 0 && prevRight > -Infinity) {
+				const avg = widthSum / count;
+				if (avg > 0 && Math.abs(b.left - prevRight) > CHAR_DISTANCE_FACTOR * avg) flush();
+			}
+			left = Math.min(left, b.left);
+			right = Math.max(right, b.right);
+			bottom = Math.min(bottom, b.bottom);
+			top = Math.max(top, b.top);
+			count++;
+			widthSum += b.right - b.left;
+			prevRight = b.right;
+		}
+		flush();
+	}
+	return mergeAdjacentRects(subRuns);
+}
+function mergeAdjacentRects(runs) {
+	const out = [];
+	let prev = null;
+	let cur = null;
+	for (const run of runs) {
+		if (prev && cur && shouldMerge(prev, run)) cur = union(cur, run.rect);
+		else {
+			if (cur) out.push(cur);
+			cur = run.rect;
+		}
+		prev = run;
+	}
+	if (cur) out.push(cur);
+	return out;
+}
+function shouldMerge(a, b) {
+	if (a.fontSize != null && b.fontSize != null && a.fontSize > 0 && b.fontSize > 0) {
+		if (Math.max(a.fontSize, b.fontSize) / Math.min(a.fontSize, b.fontSize) > FONT_SIZE_RATIO_THRESHOLD) return false;
+	}
+	if (verticalOverlap(a.rect, b.rect) < VERTICAL_OVERLAP_THRESHOLD) return false;
+	const aw = (a.rect.right - a.rect.left) / a.charCount;
+	const bw = (b.rect.right - b.rect.left) / b.charCount;
+	const aL = a.rect.left - aw;
+	const aR = a.rect.right + aw;
+	const bL = b.rect.left - bw;
+	return aL < b.rect.right + bw && aR > bL;
+}
+function union(a, b) {
+	return {
+		left: Math.min(a.left, b.left),
+		bottom: Math.min(a.bottom, b.bottom),
+		right: Math.max(a.right, b.right),
+		top: Math.max(a.top, b.top)
+	};
+}
+function verticalOverlap(a, b) {
+	const ah = a.top - a.bottom;
+	const bh = b.top - b.bottom;
+	if (ah <= 0 || bh <= 0) return 0;
+	const u = Math.max(a.top, b.top) - Math.min(a.bottom, b.bottom);
+	if (u === ah || u === bh) return 1;
+	return Math.max(0, Math.min(a.top, b.top) - Math.max(a.bottom, b.bottom)) / u;
+}
+//#endregion
+//#region src/search/epoch.ts
+/**
+* The search CONTENT EPOCH: a deterministic fingerprint of everything a
+* search result depends on — page order/structure (`layoutVersion`) and
+* each page's text content (`contentVersion`), nothing else. Annotation
+* and metadata churn deliberately do NOT move it, so cached search
+* responses in a collaborative document survive comment storms.
+*
+* Both sides compute it from the manifest they already hold: the client
+* to mint versioned search URLs, the server to validate them (mismatch →
+* NotFound, the standard stale-versioned-read signal). FNV-1a 64-bit —
+* dependency-free and stable; not cryptographic, and doesn't need to be:
+* an adversary can only vary his OWN authorized query results.
+*/
+function searchContentEpoch(manifest) {
+	let input = `${manifest.layoutVersion}`;
+	for (const page of manifest.pages) input += `|${page.state.pageObjectNumber}:${page.cache.contentVersion}`;
+	return fnv1a64(input);
+}
+const FNV_OFFSET = 14695981039346656037n;
+const FNV_PRIME = 1099511628211n;
+const MASK_64 = 18446744073709551615n;
+function fnv1a64(input) {
+	let hash = FNV_OFFSET;
+	for (let i = 0; i < input.length; i++) {
+		hash ^= BigInt(input.charCodeAt(i));
+		hash = hash * FNV_PRIME & MASK_64;
+	}
+	return hash.toString(16).padStart(16, "0");
+}
+/**
+* Canonicalize a query for CACHE KEYING: default-fold literal queries are
+* pre-folded ("Café", "café" and "CAFE" are the same search, so they
+* should be the same cache entry). Semantics are unchanged — the fold is
+* idempotent and exactly what the matcher applies to the needle anyway.
+* Case- or diacritic-sensitive literals and regex patterns pass through
+* untouched (their raw form IS the query).
+*/
+function canonicalSearchQuery(query) {
+	if (query.regex || query.matchCase || query.matchDiacritics) return query;
+	const canonical = { text: require_fold.foldText(query.text).folded };
+	if (query.wholeWord) canonical.wholeWord = true;
+	return canonical;
+}
+//#endregion
+//#region src/auth/scope/pdf-bits.ts
+/**
+* ISO 32000 user-access permission bit positions, expressed as integer
+* masks. Bit numbers in the spec are 1-indexed, so bit 3 = `1 << 2`.
+*
+* Bits 1, 2, 7, 8, and 13+ are reserved and not surfaced here.
+*/
+const PDF_BITS = {
+	/** Bit 3 — print the document. */
+	PRINT: 4,
+	/** Bit 4 — modify content streams. */
+	MODIFY: 8,
+	/** Bit 5 — copy/extract text and graphics. */
+	COPY: 16,
+	/** Bit 6 — annotate + fill forms (+ modify form fields with bit 4). */
+	ANNOTATE_FILL: 32,
+	/** Bit 9 — fill existing forms (even if bit 6 is clear). */
+	FILL_FORMS: 256,
+	/** Bit 10 — accessibility extraction (deprecated in PDF 2.0). */
+	ACCESSIBILITY: 512,
+	/** Bit 11 — assemble document (insert/rotate/delete pages, outline). */
+	ASSEMBLE: 1024,
+	/** Bit 12 — high-quality print (refines bit 3). */
+	PRINT_HIGH: 2048
+};
+/**
+* Decode a raw PDFium permission integer into a typed boolean view.
+*
+* `null` input (the documents row column is nullable until probed)
+* yields all-false bits — i.e., a maximally restrictive interpretation.
+* That keeps `pdf.permissions` expansion safe on unprobed documents.
+*/
+function decodePdfBits(raw) {
+	if (raw === null) return {
+		bit3: false,
+		bit4: false,
+		bit5: false,
+		bit6: false,
+		bit9: false,
+		bit10: false,
+		bit11: false,
+		bit12: false
+	};
+	return {
+		bit3: (raw & PDF_BITS.PRINT) !== 0,
+		bit4: (raw & PDF_BITS.MODIFY) !== 0,
+		bit5: (raw & PDF_BITS.COPY) !== 0,
+		bit6: (raw & PDF_BITS.ANNOTATE_FILL) !== 0,
+		bit9: (raw & PDF_BITS.FILL_FORMS) !== 0,
+		bit10: (raw & PDF_BITS.ACCESSIBILITY) !== 0,
+		bit11: (raw & PDF_BITS.ASSEMBLE) !== 0,
+		bit12: (raw & PDF_BITS.PRINT_HIGH) !== 0
+	};
+}
+//#endregion
+//#region src/auth/scope/builders.ts
+/**
+* Typed capability constants for customer-side JWT minting.
+*
+* The shape mirrors the dotted capability name so it reads naturally:
+*   caps.doc.text.copy()                  // "doc.text.copy"
+*   caps.doc.download()                   // "doc.download"
+*   caps.doc.download.flattened()         // "doc.download.flattened"
+*   caps.doc.print.high()                 // "doc.print.high"
+*
+* Each leaf is a function returning the literal string (as `const`) so
+* TypeScript catches typos at the call site. Wrappers like `download`
+* and `print` are `Object.assign`'d to be callable AND carry child
+* properties for the refinement capabilities.
+*/
+const caps = { doc: {
+	open: () => "doc.open",
+	render: () => "doc.render",
+	text: {
+		select: () => "doc.text.select",
+		copy: () => "doc.text.copy",
+		search: () => "doc.text.search"
+	},
+	content: { copy: () => "doc.content.copy" },
+	download: Object.assign(() => "doc.download", { flattened: () => "doc.download.flattened" }),
+	print: Object.assign(() => "doc.print", { high: () => "doc.print.high" }),
+	pages: {
+		modify: () => "doc.pages.modify",
+		assemble: () => "doc.pages.assemble"
+	},
+	forms: {
+		read: () => "doc.forms.read",
+		fill: () => "doc.forms.fill",
+		modify: () => "doc.forms.modify"
+	},
+	annotate: {
+		read: () => "doc.annotate.read",
+		modify: () => "doc.annotate.modify"
+	},
+	metadata: { modify: () => "doc.metadata.modify" },
+	attachments: { modify: () => "doc.attachments.modify" },
+	redact: () => "doc.redact"
+} };
+/**
+* Builder factory for collab scope filters. Each entity:action pair
+* gets a sub-object with the four filter constructors.
+*
+*   collab.annotations.create.self()           → "annotations:create:self"
+*   collab.annotations.create.group("legal")   → "annotations:create:group=legal"
+*   collab.annotations.update.group("4")       → "annotations:update:group=4"
+*   collab.annotations.delete.createdBy("u-7") → "annotations:delete:createdBy=u-7"
+*   collab.annotations.setGroup.group("legal") → "annotations:set-group:group=legal"
+*   collab.annotations.all.all()               → "annotations:*:all"  (action wildcard)
+*
+* On create, the filter is evaluated against the caller's own identity
+* (no impersonation), so `:self` and `:all` trivially pass; `:group=X`
+* is the meaningful filter — it constrains creation to callers whose
+* default group is X.
+*/
+const collab = { annotations: {
+	create: makeFilterBuilder("annotations", "create"),
+	update: makeFilterBuilder("annotations", "update"),
+	delete: makeFilterBuilder("annotations", "delete"),
+	setGroup: makeSetGroupBuilder(),
+	/** Action wildcard — matches create, update, delete, AND set-group with the given filter. */
+	all: makeFilterBuilder("annotations", "*")
+} };
+function makeFilterBuilder(entity, action) {
+	return {
+		all: () => `${entity}:${action}:all`,
+		self: () => `${entity}:${action}:self`,
+		createdBy: (userId) => `${entity}:${action}:createdBy=${userId}`,
+		group: (groupId) => `${entity}:${action}:group=${groupId}`
+	};
+}
+function makeSetGroupBuilder() {
+	return {
+		all: () => "annotations:set-group:all",
+		group: (groupId) => `annotations:set-group:group=${groupId}`
+	};
+}
+/**
+* Builder for the `pdf.permissions` virtual scope. Returns the literal
+* string; provided as a helper for parity with caps/collab in JWT
+* construction code.
+*/
+const pdfPermissions = () => "pdf.permissions";
+/**
+* Materialise `pdf.permissions` into the concrete capability list it
+* would expand to under the given PDF bit configuration.
+*
+* Useful when the customer wants to start from PDF defaults and then
+* subtract specific capabilities — easier to build the JWT scope array
+* by filtering an explicit list than by composing virtual + denials.
+*
+*   const defaults = materializePdfPermissions(pdfBits);
+*   const scope = [
+*     ...defaults.filter(s => s !== 'doc.text.copy'),
+*     'doc.download',
+*   ];
+*
+* IMPORTANT: this MUST stay in sync with `addPdfPermissions` inside
+* resolver.ts. A test pins them together.
+*/
+function materializePdfPermissions(b) {
+	const out = /* @__PURE__ */ new Set();
+	out.add("doc.open");
+	out.add("doc.render");
+	out.add("doc.annotate.read");
+	out.add("doc.forms.read");
+	if (b.bit5) {
+		out.add("doc.text.select");
+		out.add("doc.text.copy");
+		out.add("doc.text.search");
+		out.add("doc.content.copy");
+	}
+	if (b.bit3) out.add("doc.print");
+	if (b.bit12 && b.bit3) out.add("doc.print.high");
+	if (b.bit4) {
+		out.add("doc.pages.modify");
+		out.add("doc.redact");
+		out.add("doc.metadata.modify");
+		out.add("doc.attachments.modify");
+	}
+	if (b.bit11) out.add("doc.pages.assemble");
+	if (b.bit6) out.add("doc.annotate.modify");
+	if (b.bit6 || b.bit9) out.add("doc.forms.fill");
+	if (b.bit6 && b.bit4) out.add("doc.forms.modify");
+	return [...out];
+}
+//#endregion
+Object.defineProperty(exports, "DEFAULT_PDF_SAVE_MODE", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_PDF_SAVE_MODE;
+	}
+});
+Object.defineProperty(exports, "NO_ANNOTATION_FLAGS", {
+	enumerable: true,
+	get: function() {
+		return NO_ANNOTATION_FLAGS;
+	}
+});
+Object.defineProperty(exports, "PDF_BITS", {
+	enumerable: true,
+	get: function() {
+		return PDF_BITS;
+	}
+});
+Object.defineProperty(exports, "SEARCH_REGEX_MAX_LENGTH", {
+	enumerable: true,
+	get: function() {
+		return SEARCH_REGEX_MAX_LENGTH;
+	}
+});
+Object.defineProperty(exports, "SEARCH_SNIPPET_CONTEXT", {
+	enumerable: true,
+	get: function() {
+		return SEARCH_SNIPPET_CONTEXT;
+	}
+});
+Object.defineProperty(exports, "UNKNOWN_WEAK_ANNOTATION_STATE", {
+	enumerable: true,
+	get: function() {
+		return UNKNOWN_WEAK_ANNOTATION_STATE;
+	}
+});
+Object.defineProperty(exports, "appearanceImpactOf", {
+	enumerable: true,
+	get: function() {
+		return appearanceImpactOf;
+	}
+});
+Object.defineProperty(exports, "buildSnippet", {
+	enumerable: true,
+	get: function() {
+		return buildSnippet;
+	}
+});
+Object.defineProperty(exports, "buildThreads", {
+	enumerable: true,
+	get: function() {
+		return buildThreads;
+	}
+});
+Object.defineProperty(exports, "canonicalSearchQuery", {
+	enumerable: true,
+	get: function() {
+		return canonicalSearchQuery;
+	}
+});
+Object.defineProperty(exports, "caps", {
+	enumerable: true,
+	get: function() {
+		return caps;
+	}
+});
+Object.defineProperty(exports, "changesAnnotationList", {
+	enumerable: true,
+	get: function() {
+		return changesAnnotationList;
+	}
+});
+Object.defineProperty(exports, "classifyRelation", {
+	enumerable: true,
+	get: function() {
+		return classifyRelation;
+	}
+});
+Object.defineProperty(exports, "collab", {
+	enumerable: true,
+	get: function() {
+		return collab;
+	}
+});
+Object.defineProperty(exports, "createPageImageHandle", {
+	enumerable: true,
+	get: function() {
+		return createPageImageHandle;
+	}
+});
+Object.defineProperty(exports, "decodeFieldRefKey", {
+	enumerable: true,
+	get: function() {
+		return decodeFieldRefKey;
+	}
+});
+Object.defineProperty(exports, "decodePdfBits", {
+	enumerable: true,
+	get: function() {
+		return decodePdfBits;
+	}
+});
+Object.defineProperty(exports, "decodeStableIdKey", {
+	enumerable: true,
+	get: function() {
+		return decodeStableIdKey;
+	}
+});
+Object.defineProperty(exports, "encodeFieldRefKey", {
+	enumerable: true,
+	get: function() {
+		return encodeFieldRefKey;
+	}
+});
+Object.defineProperty(exports, "encodeStableIdKey", {
+	enumerable: true,
+	get: function() {
+		return encodeStableIdKey;
+	}
+});
+Object.defineProperty(exports, "foldOptionsFor", {
+	enumerable: true,
+	get: function() {
+		return foldOptionsFor;
+	}
+});
+Object.defineProperty(exports, "invalidatesWeakIndexRefs", {
+	enumerable: true,
+	get: function() {
+		return invalidatesWeakIndexRefs;
+	}
+});
+Object.defineProperty(exports, "isValidPageObjectNumber", {
+	enumerable: true,
+	get: function() {
+		return isValidPageObjectNumber;
+	}
+});
+Object.defineProperty(exports, "knownWeakAnnotationState", {
+	enumerable: true,
+	get: function() {
+		return knownWeakAnnotationState;
+	}
+});
+Object.defineProperty(exports, "matchLiteral", {
+	enumerable: true,
+	get: function() {
+		return matchLiteral;
+	}
+});
+Object.defineProperty(exports, "matchPageText", {
+	enumerable: true,
+	get: function() {
+		return matchPageText;
+	}
+});
+Object.defineProperty(exports, "matchRegex", {
+	enumerable: true,
+	get: function() {
+		return matchRegex;
+	}
+});
+Object.defineProperty(exports, "materializePdfPermissions", {
+	enumerable: true,
+	get: function() {
+		return materializePdfPermissions;
+	}
+});
+Object.defineProperty(exports, "normalizeAnnotationDraft", {
+	enumerable: true,
+	get: function() {
+		return normalizeAnnotationDraft;
+	}
+});
+Object.defineProperty(exports, "normalizeAnnotationPatch", {
+	enumerable: true,
+	get: function() {
+		return normalizeAnnotationPatch;
+	}
+});
+Object.defineProperty(exports, "normalizeAttachmentFileSource", {
+	enumerable: true,
+	get: function() {
+		return normalizeAttachmentFileSource;
+	}
+});
+Object.defineProperty(exports, "normalizePdfRect", {
+	enumerable: true,
+	get: function() {
+		return normalizePdfRect;
+	}
+});
+Object.defineProperty(exports, "pdfPermissions", {
+	enumerable: true,
+	get: function() {
+		return pdfPermissions;
+	}
+});
+Object.defineProperty(exports, "pdfQuadBounds", {
+	enumerable: true,
+	get: function() {
+		return pdfQuadBounds;
+	}
+});
+Object.defineProperty(exports, "pdfQuadCorners", {
+	enumerable: true,
+	get: function() {
+		return pdfQuadCorners;
+	}
+});
+Object.defineProperty(exports, "pdfQuadFromCorners", {
+	enumerable: true,
+	get: function() {
+		return pdfQuadFromCorners;
+	}
+});
+Object.defineProperty(exports, "pdfRectFromOriginSize", {
+	enumerable: true,
+	get: function() {
+		return pdfRectFromOriginSize;
+	}
+});
+Object.defineProperty(exports, "pdfRectHeight", {
+	enumerable: true,
+	get: function() {
+		return pdfRectHeight;
+	}
+});
+Object.defineProperty(exports, "pdfRectSize", {
+	enumerable: true,
+	get: function() {
+		return pdfRectSize;
+	}
+});
+Object.defineProperty(exports, "pdfRectToOriginSize", {
+	enumerable: true,
+	get: function() {
+		return pdfRectToOriginSize;
+	}
+});
+Object.defineProperty(exports, "pdfRectWidth", {
+	enumerable: true,
+	get: function() {
+		return pdfRectWidth;
+	}
+});
+Object.defineProperty(exports, "refKey", {
+	enumerable: true,
+	get: function() {
+		return refKey;
+	}
+});
+Object.defineProperty(exports, "resolveBinarySource", {
+	enumerable: true,
+	get: function() {
+		return resolveBinarySource;
+	}
+});
+Object.defineProperty(exports, "revisionTokensEqual", {
+	enumerable: true,
+	get: function() {
+		return revisionTokensEqual;
+	}
+});
+Object.defineProperty(exports, "searchContentEpoch", {
+	enumerable: true,
+	get: function() {
+		return searchContentEpoch;
+	}
+});
+Object.defineProperty(exports, "searchRectsForRange", {
+	enumerable: true,
+	get: function() {
+		return searchRectsForRange;
+	}
+});
+Object.defineProperty(exports, "semanticEqual", {
+	enumerable: true,
+	get: function() {
+		return semanticEqual;
+	}
+});
+Object.defineProperty(exports, "shiftsExistingAnnotationIndices", {
+	enumerable: true,
+	get: function() {
+		return shiftsExistingAnnotationIndices;
+	}
+});
+Object.defineProperty(exports, "sniffBinaryMetadata", {
+	enumerable: true,
+	get: function() {
+		return sniffBinaryMetadata;
+	}
+});
+Object.defineProperty(exports, "validateSearchQuery", {
+	enumerable: true,
+	get: function() {
+		return validateSearchQuery;
+	}
+});
+Object.defineProperty(exports, "validateSearchRegex", {
+	enumerable: true,
+	get: function() {
+		return validateSearchRegex;
+	}
+});
+Object.defineProperty(exports, "wordAt", {
+	enumerable: true,
+	get: function() {
+		return wordAt;
+	}
+});
+Object.defineProperty(exports, "wordBefore", {
+	enumerable: true,
+	get: function() {
+		return wordBefore;
+	}
+});
+
+//# sourceMappingURL=builders-BvikWRuO.cjs.map