@embedpdf/engine-core 3.0.0-next.0

package/dist/builders-C548U47M.js

@@ -0,0 +1,1367 @@
+import { o as EngineErrorCode } from "./subtype-BvAzLCGC.js";
+import { i as EngineError, n as foldText, r as toOriginalRange } from "./fold-CB4fAOOy.js";
+//#region src/geometry/convert.ts
+/**
+* Normalize a `PdfRect` to the y-up invariant (`left <= right`, `bottom <= top`),
+* regardless of how the PDF ordered the corners (a `/Rect` array or `FS_RECTF`
+* may carry them in any order). THE enforcement point for the "PdfRect is always
+* normalized" rule: every producer that reads a raw box from PDFium passes it
+* through here, so the invariant holds once, centrally — downstream `width =
+* right - left` is never negative.
+*/
+function normalizePdfRect(r) {
+	return {
+		left: Math.min(r.left, r.right),
+		right: Math.max(r.left, r.right),
+		bottom: Math.min(r.top, r.bottom),
+		top: Math.max(r.top, r.bottom)
+	};
+}
+function pdfRectWidth(r) {
+	return r.right - r.left;
+}
+function pdfRectHeight(r) {
+	return r.top - r.bottom;
+}
+function pdfRectSize(r) {
+	return {
+		width: r.right - r.left,
+		height: r.top - r.bottom
+	};
+}
+/** Convert edges -> origin+size, staying y-up (origin at bottom-left). */
+function pdfRectToOriginSize(r) {
+	return {
+		x: r.left,
+		y: r.bottom,
+		width: r.right - r.left,
+		height: r.top - r.bottom
+	};
+}
+/** Convert y-up origin+size back to edges. */
+function pdfRectFromOriginSize(o) {
+	return {
+		left: o.x,
+		bottom: o.y,
+		right: o.x + o.width,
+		top: o.y + o.height
+	};
+}
+/**
+* Enclosing axis-aligned box of a quad, in PDF user space. Orientation
+* agnostic (correct for rotated/skewed quads) — this is what highlight
+* rendering and hit-testing want.
+*/
+function pdfQuadBounds(q) {
+	const xs = [
+		q.p1.x,
+		q.p2.x,
+		q.p3.x,
+		q.p4.x
+	];
+	const ys = [
+		q.p1.y,
+		q.p2.y,
+		q.p3.y,
+		q.p4.y
+	];
+	return {
+		left: Math.min(...xs),
+		right: Math.max(...xs),
+		bottom: Math.min(...ys),
+		top: Math.max(...ys)
+	};
+}
+/**
+* Axis-aligned named-corner interpretation of a quad.
+*
+* VALID ONLY for upright (non-rotated, non-skewed) quads: it is derived from
+* the enclosing bounds, so for rotated/skewed quads it returns the bounding
+* box corners, not the true geometric corners. For arbitrary quads use the
+* positional `p1..p4` or `pdfQuadBounds` directly.
+*/
+function pdfQuadCorners(q) {
+	const b = pdfQuadBounds(q);
+	return {
+		topLeft: {
+			x: b.left,
+			y: b.top
+		},
+		topRight: {
+			x: b.right,
+			y: b.top
+		},
+		bottomLeft: {
+			x: b.left,
+			y: b.bottom
+		},
+		bottomRight: {
+			x: b.right,
+			y: b.bottom
+		}
+	};
+}
+/**
+* Build a quad from named corners, in PDFium `FS_QUADPOINTSF` slot order
+* (`p1 = topLeft`, `p2 = topRight`, `p3 = bottomLeft`, `p4 = bottomRight`).
+* The inverse of `pdfQuadCorners` for upright quads.
+*/
+function pdfQuadFromCorners(c) {
+	return {
+		p1: c.topLeft,
+		p2: c.topRight,
+		p3: c.bottomLeft,
+		p4: c.bottomRight
+	};
+}
+//#endregion
+//#region src/dto/PageRender.ts
+function createPageImageHandle(result, blobSource) {
+	return {
+		...result,
+		async objectUrl(signal) {
+			if (typeof Blob === "undefined" || typeof URL === "undefined" || !URL.createObjectURL) throw new EngineError(EngineErrorCode.RuntimeUnavailable, "Object URLs are not available in this environment");
+			const blob = await blobSource.blob(signal);
+			const url = URL.createObjectURL(blob);
+			return {
+				url,
+				revoke: () => URL.revokeObjectURL(url)
+			};
+		}
+	};
+}
+//#endregion
+//#region src/dto/PdfSaveMode.ts
+const DEFAULT_PDF_SAVE_MODE = "incremental";
+//#endregion
+//#region src/identity/PageObjectNumber.ts
+/**
+* Type guard for the rare malformed-PDF case where a page is a direct
+* object. The engine treats `0` as malformed and throws `EngineError(NotFound)`
+* before any page-level operation.
+*/
+function isValidPageObjectNumber(value) {
+	return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+//#endregion
+//#region src/identity/AnnotationStableId.ts
+/**
+* URL-safe encoding of a stable id, used by the cloud HTTP surface as the
+* `:annotKey` route parameter. Decoded by the server back into an
+* `AnnotationStableId` via `decodeStableIdKey`.
+*
+* Format:
+*   `{ kind: 'objectNumber', value: 42 }` -> `'obj:42'`
+*   `{ kind: 'nm', value: 'foo bar' }`    -> `'nm:foo bar'`
+*
+* The caller is responsible for `encodeURIComponent`-ing the result before
+* splicing it into a URL path; `wirePaths.layerAnnotationByKey` already does
+* that. /NM values are opaque strings and may contain anything; the
+* `nm:` prefix lets the decoder distinguish them from numeric ids
+* unambiguously.
+*/
+function encodeStableIdKey(id) {
+	if (id.kind === "objectNumber") {
+		if (!Number.isInteger(id.value) || id.value <= 0) throw new RangeError(`encodeStableIdKey: objectNumber must be a positive integer, got ${id.value}`);
+		return `obj:${id.value}`;
+	}
+	return `nm:${id.value}`;
+}
+/**
+* Inverse of `encodeStableIdKey`. Returns `null` for malformed input so
+* the server can answer 400 InvalidArg with a useful message instead of
+* throwing.
+*
+* The input is the already-`decodeURIComponent`-ed segment from the route
+* path. Empty `/NM` values are rejected: `nm:` with no suffix is not a
+* valid identity.
+*/
+function decodeStableIdKey(key) {
+	if (key.startsWith("obj:")) {
+		const rest = key.slice(4);
+		const n = Number.parseInt(rest, 10);
+		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
+		return {
+			kind: "objectNumber",
+			value: n
+		};
+	}
+	if (key.startsWith("nm:")) {
+		const value = key.slice(3);
+		if (value.length === 0) return null;
+		return {
+			kind: "nm",
+			value
+		};
+	}
+	return null;
+}
+//#endregion
+//#region src/revision/RevisionToken.ts
+function revisionTokensEqual(a, b) {
+	return a.docSessionId === b.docSessionId && a.pageObjectNumber === b.pageObjectNumber && a.generation === b.generation;
+}
+//#endregion
+//#region src/revision/WeakAnnotationState.ts
+const UNKNOWN_WEAK_ANNOTATION_STATE = { kind: "unknown" };
+function knownWeakAnnotationState(hasAnyWeakAnnotations) {
+	return {
+		kind: "known",
+		hasAnyWeakAnnotations
+	};
+}
+//#endregion
+//#region src/annotation/primitives.ts
+const NO_ANNOTATION_FLAGS = {
+	invisible: false,
+	hidden: false,
+	print: false,
+	noZoom: false,
+	noRotate: false,
+	noView: false,
+	readOnly: false,
+	locked: false,
+	toggleNoView: false,
+	lockedContents: false
+};
+//#endregion
+//#region src/resource/BinarySource.ts
+function isBlob(value) {
+	return typeof Blob !== "undefined" && value instanceof Blob;
+}
+/**
+* Detach a Uint8Array view into a standalone ArrayBuffer without copying
+* when the view already spans its whole buffer.
+*/
+function toStandaloneArrayBuffer(view) {
+	if (view.byteOffset === 0 && view.buffer instanceof ArrayBuffer && view.byteLength === view.buffer.byteLength) return view.buffer;
+	return view.slice().buffer;
+}
+/**
+* Resolve any accepted `BinarySource` form into a `WireResource`.
+* Async because Blob bytes can only be read asynchronously.
+*/
+async function resolveBinarySource(source) {
+	if (source instanceof Uint8Array) return { bytes: toStandaloneArrayBuffer(source) };
+	if (isBlob(source)) {
+		const blobName = blobFileName(source);
+		return {
+			bytes: await source.arrayBuffer(),
+			mimeType: source.type || void 0,
+			...blobName !== void 0 ? { name: blobName } : {}
+		};
+	}
+	const { data, mimeType, name } = source;
+	const inner = data instanceof Uint8Array ? {
+		bytes: toStandaloneArrayBuffer(data),
+		mimeType: void 0,
+		name: void 0
+	} : {
+		bytes: await data.arrayBuffer(),
+		mimeType: data.type || void 0,
+		name: blobFileName(data)
+	};
+	const resolvedName = name ?? inner.name;
+	return {
+		bytes: inner.bytes,
+		...mimeType ?? inner.mimeType ? { mimeType: mimeType ?? inner.mimeType } : {},
+		...resolvedName !== void 0 ? { name: resolvedName } : {}
+	};
+}
+/** A browser `File` is a Blob with a `name` — pick it up so attachment
+*  drafts can pass a `File` directly without repeating the file name. */
+function blobFileName(blob) {
+	const name = blob.name;
+	return typeof name === "string" && name.length > 0 ? name : void 0;
+}
+//#endregion
+//#region src/resource/binaryMetadata.ts
+/**
+* Detect format (and intrinsic dimensions for rasters) of a binary buffer.
+*
+* @returns metadata, or `null` for unsupported/corrupt data
+*/
+function sniffBinaryMetadata(buffer) {
+	if (buffer.byteLength < 4) return null;
+	const bytes = new Uint8Array(buffer);
+	if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) return parsePng(buffer);
+	if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return parseJpeg(buffer);
+	if (bytes[0] === 37 && bytes[1] === 80 && bytes[2] === 68 && bytes[3] === 70) return { mimeType: "application/pdf" };
+	return null;
+}
+function parsePng(buffer) {
+	if (buffer.byteLength < 24) return null;
+	const view = new DataView(buffer);
+	const width = view.getUint32(16);
+	const height = view.getUint32(20);
+	if (width === 0 || height === 0) return null;
+	return {
+		mimeType: "image/png",
+		width,
+		height
+	};
+}
+function parseJpeg(buffer) {
+	const bytes = new Uint8Array(buffer);
+	let offset = 2;
+	while (offset + 4 < bytes.byteLength) {
+		if (bytes[offset] !== 255) return null;
+		const marker = bytes[offset + 1];
+		if (marker >= 192 && marker <= 195) {
+			if (offset + 9 > bytes.byteLength) return null;
+			const view = new DataView(buffer, offset + 5);
+			const height = view.getUint16(0);
+			const width = view.getUint16(2);
+			if (width === 0 || height === 0) return null;
+			return {
+				mimeType: "image/jpeg",
+				width,
+				height
+			};
+		}
+		if (marker === 216 || marker === 217) offset += 2;
+		else if (marker === 255) offset += 1;
+		else {
+			const segLen = bytes[offset + 2] << 8 | bytes[offset + 3];
+			offset += 2 + segLen;
+		}
+	}
+	return null;
+}
+//#endregion
+//#region src/annotation/kinds/file-attachment/normalize.ts
+/**
+* Resolve an attachment `file` into its wire halves: metadata into the
+* JSON body, bytes into the resource map. Unlike stamps there is NO
+* format allowlist — attaching arbitrary files is the point — so the
+* declared mime type wins (attachment formats cannot be reliably sniffed;
+* the writer falls back to `application/octet-stream` when absent).
+*
+* Shared by the file-attachment annotation draft (below) and the
+* document-level `attachments.create` mutation — one vocabulary, one
+* normalizer for both homes a file can enter a PDF through.
+*/
+async function normalizeAttachmentFileSource(file, key) {
+	const resolved = await resolveBinarySource(file.data);
+	const name = file.name ?? resolved.name;
+	if (!name) throw new EngineError(EngineErrorCode.InvalidArg, "attachment file requires a name — pass { data, name } or a File whose name is set");
+	const mimeType = file.mimeType ?? resolved.mimeType;
+	return {
+		wireFile: {
+			resource: key,
+			name,
+			...mimeType !== void 0 ? { mimeType } : {},
+			...file.description !== void 0 ? { description: file.description } : {}
+		},
+		resource: {
+			bytes: resolved.bytes,
+			...mimeType !== void 0 ? { mimeType } : {},
+			name
+		}
+	};
+}
+async function normalizeFileAttachmentDraft(draft, allocateKey) {
+	const { file, ...rest } = draft;
+	const key = allocateKey();
+	const { wireFile, resource } = await normalizeAttachmentFileSource(file, key);
+	return {
+		wire: {
+			...rest,
+			file: wireFile
+		},
+		resources: { [key]: resource }
+	};
+}
+//#endregion
+//#region src/annotation/kinds/stamp/normalize.ts
+/**
+* Resolve + validate a stamp `source`. Sniffing happens here — before any
+* transport — so callers get a fast `InvalidArg` instead of a worker/HTTP
+* round-trip. The sniffed mime type overwrites whatever was declared.
+*/
+async function resolveStampSource(source) {
+	const resolved = await resolveBinarySource(source);
+	const meta = sniffBinaryMetadata(resolved.bytes);
+	if (!meta) throw new EngineError(EngineErrorCode.InvalidArg, "stamp source must be PNG, JPEG, or single-page PDF bytes (format is detected from the data, not the declared mime type)");
+	return {
+		...resolved,
+		mimeType: meta.mimeType
+	};
+}
+async function normalizeStampDraft(draft, allocateKey) {
+	const { source, ...rest } = draft;
+	const resolved = await resolveStampSource(source);
+	const key = allocateKey();
+	return {
+		wire: {
+			...rest,
+			source: { resource: key }
+		},
+		resources: { [key]: resolved }
+	};
+}
+async function normalizeStampPatch(patch, allocateKey) {
+	if (patch.source === void 0) {
+		const { source: _source, ...rest } = patch;
+		return {
+			wire: rest,
+			resources: {}
+		};
+	}
+	const { source, ...rest } = patch;
+	const resolved = await resolveStampSource(source);
+	const key = allocateKey();
+	return {
+		wire: {
+			...rest,
+			source: { resource: key }
+		},
+		resources: { [key]: resolved }
+	};
+}
+//#endregion
+//#region src/annotation/normalize.ts
+function createResourceKeyAllocator() {
+	let next = 0;
+	return () => `r${next++}`;
+}
+async function normalizeAnnotationDraft(draft) {
+	switch (draft.subtype) {
+		case "stamp": return normalizeStampDraft(draft, createResourceKeyAllocator());
+		case "file-attachment": return normalizeFileAttachmentDraft(draft, createResourceKeyAllocator());
+		default: return {
+			wire: draft,
+			resources: {}
+		};
+	}
+}
+async function normalizeAnnotationPatch(patch) {
+	switch (patch.subtype) {
+		case "stamp": return normalizeStampPatch(patch, createResourceKeyAllocator());
+		default: return {
+			wire: patch,
+			resources: {}
+		};
+	}
+}
+//#endregion
+//#region src/annotation/relationships.ts
+/**
+* Classify one annotation by its relationship edge alone. Mirrors the
+* spec's "practical parser rule": no `/IRT` is top-level; `/RT /Group` is
+* a grouped subordinate; anything else with an `/IRT` is a reply (the
+* engine has already normalized a missing `/RT` to `'reply'`).
+*/
+function classifyRelation(a) {
+	if (!a.inReplyTo) return "top-level";
+	return a.replyType === "group" ? "grouped-subordinate" : "reply";
+}
+/**
+* Stable string key for an {@link AnnotationRef}, used to match a child's
+* `inReplyTo` against a candidate parent's `ref`. Both sides are produced
+* by the engine with the same identity precedence (objectNumber, then nm,
+* then index), so equal keys mean "same annotation".
+*/
+function refKey(ref) {
+	switch (ref.kind) {
+		case "objectNumber": return `obj:${ref.pageObjectNumber}:${ref.annotObjectNumber}`;
+		case "nm": return `nm:${ref.pageObjectNumber}:${ref.nm}`;
+		case "index": return `idx:${ref.pageObjectNumber}:${ref.index}`;
+	}
+}
+/**
+* Compose a flat annotation list (one page, or a whole document via
+* `listRawAll()` flattened) into {@link AnnotationThread}s in primary
+* order.
+*
+* Rules (ISO 32000 §12.5.6.2 + the spec's UI rule):
+*   - Annotations with no `/IRT` become thread primaries, in input order.
+*   - A `/RT /Group` child is attached to its primary's `groupedParts`.
+*   - A `/RT /R` (or default) child is attached to its primary's `replies`.
+*   - A child whose parent is not in the input set is treated as an
+*     orphan primary (defensive — e.g. a partial/filtered page slice).
+*
+* Limitations (v1, matches the legacy stack): threading is one level deep
+* — a reply-to-a-reply is keyed to its direct parent, so it only appears
+* nested if that direct parent is itself a primary. Callers that want a
+* sidebar of "most annotations, not widgets/popups" should pre-filter the
+* input; this helper is intentionally unopinionated about eligibility.
+*/
+function buildThreads(annotations) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const a of annotations) {
+		byKey.set(refKey(a.ref), a);
+		if (a.nm && a.nm.length > 0) byKey.set(`nm:${a.ref.pageObjectNumber}:${a.nm}`, a);
+	}
+	const threads = [];
+	const threadByPrimaryKey = /* @__PURE__ */ new Map();
+	const primaryThread = (primary) => {
+		const key = refKey(primary.ref);
+		let thread = threadByPrimaryKey.get(key);
+		if (!thread) {
+			thread = {
+				primary,
+				groupedParts: [],
+				replies: []
+			};
+			threadByPrimaryKey.set(key, thread);
+			threads.push(thread);
+		}
+		return thread;
+	};
+	for (const a of annotations) if (!a.inReplyTo) primaryThread(a);
+	for (const a of annotations) {
+		if (!a.inReplyTo) continue;
+		const parent = byKey.get(refKey(a.inReplyTo));
+		if (!parent || parent.inReplyTo) {
+			primaryThread(a);
+			continue;
+		}
+		const thread = primaryThread(parent);
+		if (a.replyType === "group") thread.groupedParts.push(a);
+		else thread.replies.push(a);
+	}
+	return threads;
+}
+//#endregion
+//#region src/mutation/AnnotationMutationImpactPolicy.ts
+function changesAnnotationList(_kind) {
+	return true;
+}
+function shiftsExistingAnnotationIndices(kind) {
+	return kind === "delete" || kind === "move";
+}
+function invalidatesWeakIndexRefs(kind, weakStateBefore) {
+	if (!shiftsExistingAnnotationIndices(kind)) return false;
+	if (weakStateBefore.kind !== "known") throw new Error(`invalidatesWeakIndexRefs requires a known WeakAnnotationState for ${kind}; got 'unknown'. Caller must scan the page before computing mutation impact.`);
+	return weakStateBefore.hasAnyWeakAnnotations;
+}
+//#endregion
+//#region src/annotation/appearance.ts
+/**
+* Coordinate tolerance in PDF user-space points. PDF numbers round-trip
+* through f32 (~7 significant digits) and client-side space conversions, so
+* exact float equality would misclassify no-op writes; 1e-3 pt is far below
+* anything visible while far above accumulated f32 drift at page magnitudes.
+*/
+const EPSILON = .001;
+/**
+* Keys that never affect `/AP` on any kind: the discriminator, behavioral
+* flags, reply relationships, and grouping.
+*/
+const INERT_KEYS = /* @__PURE__ */ new Set([
+	"subtype",
+	"flags",
+	"inReplyTo",
+	"replyType",
+	"groupId"
+]);
+/**
+* Kinds whose `/AP` paints `/Contents`. Everywhere else `contents` is popup
+* note text — editing a comment must never re-bake (or destroy) the shape's
+* appearance.
+*/
+const CONTENTS_PAINTED = /* @__PURE__ */ new Set(["free-text", "redact"]);
+/**
+* The vertex family's `/EMBD_Metadata/Rotation` is an advisory scalar (the
+* vertices are already rotated); it never drives the AP generator, so patches
+* touching it are appearance-inert for these kinds.
+*/
+const ADVISORY_ROTATION = /* @__PURE__ */ new Set([
+	"line",
+	"polyline",
+	"polygon",
+	"ink"
+]);
+/**
+* The box kinds carry the `/EMBD_Metadata` transform pair (`rotation` +
+* `unrotatedRect`), tri-state on writes: omitted fields are PRESERVED, `null`
+* (or `0` for rotation) clears. Translation verification therefore compares
+* the after-state — `patch.rotation ?? current.rotation` — not the patch keys.
+*/
+const BOX_TRANSFORM = /* @__PURE__ */ new Set([
+	"square",
+	"circle",
+	"free-text",
+	"stamp"
+]);
+/**
+* Per-kind absolute-geometry fields (PDF user space) that a rigid translation
+* shifts together. A kind absent from this table never takes the translation
+* route. `rect` is required in every entry: a translation always moves `/Rect`.
+*/
+const TRANSLATABLE_GEOMETRY = {
+	square: ["rect", "unrotatedRect"],
+	circle: ["rect", "unrotatedRect"],
+	"free-text": [
+		"rect",
+		"unrotatedRect",
+		"calloutLine"
+	],
+	line: ["rect", "linePoints"],
+	polygon: ["rect", "vertices"],
+	polyline: ["rect", "vertices"],
+	ink: ["rect", "inkList"],
+	highlight: ["rect", "quadPoints"],
+	underline: ["rect", "quadPoints"],
+	squiggly: ["rect", "quadPoints"],
+	strikeout: ["rect", "quadPoints"],
+	redact: ["rect", "quadPoints"],
+	caret: ["rect"],
+	text: ["rect"],
+	stamp: ["rect", "unrotatedRect"],
+	"file-attachment": ["rect"],
+	link: ["rect"]
+};
+const numEq = (a, b) => Math.abs(a - b) <= EPSILON;
+/** Degrees normalized to [0,360); absent reads as 0 (no rotation). */
+const normDeg = (v) => {
+	return typeof v === "number" ? (v % 360 + 360) % 360 : 0;
+};
+/**
+* Semantic equality between a patch value and the current DTO value.
+* Numbers compare within {@link EPSILON}; `null` and `undefined` both mean
+* "entry absent" (the tri-state clear of an absent entry is a no-op); arrays
+* and objects compare structurally.
+*/
+function semanticEqual(a, b) {
+	if (a == null || b == null) return a == null && b == null;
+	if (typeof a === "number" && typeof b === "number") return numEq(a, b);
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => semanticEqual(v, b[i]));
+	}
+	if (typeof a === "object" && typeof b === "object") {
+		const keys = /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)]);
+		for (const k of keys) if (!semanticEqual(a[k], b[k])) return false;
+		return true;
+	}
+	return a === b;
+}
+/**
+* Is `next` exactly `cur` shifted by `(dx, dy)`? Walks the value structurally:
+* numeric leaves under x-axis keys (`left`/`right`/`x`) must shift by `dx`,
+* y-axis keys (`bottom`/`top`/`y`) by `dy`, and any other numeric leaf must be
+* unchanged. Arrays walk elementwise (same length required).
+*/
+function shiftedBy(cur, next, dx, dy) {
+	if (cur == null || next == null) return cur == null && next == null;
+	if (Array.isArray(cur) || Array.isArray(next)) {
+		if (!Array.isArray(cur) || !Array.isArray(next) || cur.length !== next.length) return false;
+		return cur.every((v, i) => shiftedBy(v, next[i], dx, dy));
+	}
+	if (typeof cur === "object" && typeof next === "object") {
+		const keys = /* @__PURE__ */ new Set([...Object.keys(cur), ...Object.keys(next)]);
+		for (const k of keys) {
+			const c = cur[k];
+			const n = next[k];
+			if (typeof c === "number" && typeof n === "number") {
+				if (!numEq(c + (k === "left" || k === "right" || k === "x" ? dx : k === "bottom" || k === "top" || k === "y" ? dy : 0), n)) return false;
+			} else if (!shiftedBy(c, n, dx, dy)) return false;
+		}
+		return true;
+	}
+	return cur === next;
+}
+/**
+* Verify the touched geometry is one rigid translation of the current state.
+* Requires `patch.rect` (a translation always moves `/Rect`) with width and
+* height preserved; every other geometry field present on the annotation must
+* ride along shifted by the same delta — a rect move that leaves `vertices`
+* behind is NOT a translation (the dictionary would desync from the pixels).
+* For box kinds the `/EMBD_Metadata` transform group is checked as an
+* after-state: writes are tri-state (omitted preserves, null/0 clears), so an
+* omitted rotation keeps the current one — but a preserved-yet-unshifted
+* `unrotatedRect` still fails the congruence check via the field loop.
+*/
+function isRigidTranslation(cur, pat, subtype, geometryKeys) {
+	const curRect = cur.rect;
+	const patRect = pat.rect;
+	if (!curRect || !patRect) return false;
+	const dx = patRect.left - curRect.left;
+	const dy = patRect.bottom - curRect.bottom;
+	if (!numEq(patRect.right - patRect.left, curRect.right - curRect.left)) return false;
+	if (!numEq(patRect.top - patRect.bottom, curRect.top - curRect.bottom)) return false;
+	if (BOX_TRANSFORM.has(subtype)) {
+		const rotAfter = pat.rotation === void 0 ? cur.rotation : pat.rotation;
+		if (!numEq(normDeg(cur.rotation), normDeg(rotAfter))) return false;
+	}
+	for (const key of geometryKeys) {
+		if (key === "rect") continue;
+		const c = cur[key];
+		const p = pat[key];
+		if (c == null && p == null) continue;
+		if (c == null || p == null) return false;
+		if (!shiftedBy(c, p, dx, dy)) return false;
+	}
+	return true;
+}
+/**
+* Classify an update patch against the annotation's current DTO.
+*
+* 1. Value-diff: drop keys whose value semantically equals the current one,
+*    plus the always-inert metadata keys (and per-kind inert keys: `contents`
+*    where it isn't painted, advisory `rotation` on the vertex family).
+*    Nothing left → `'inert'`.
+* 2. If every remaining key is translatable geometry for this kind AND the
+*    values are one rigid translation → `'translation'`.
+* 3. Anything else — style, text, unknown keys, unknown kinds → `'regenerate'`.
+*/
+function appearanceImpactOf(current, patch) {
+	if (patch.subtype !== current.subtype) return "regenerate";
+	const cur = current;
+	const pat = patch;
+	const subtype = patch.subtype;
+	const touched = [];
+	for (const [key, value] of Object.entries(pat)) {
+		if (value === void 0 || INERT_KEYS.has(key)) continue;
+		if (key === "contents" && !CONTENTS_PAINTED.has(subtype)) continue;
+		if (key === "rotation" && ADVISORY_ROTATION.has(subtype)) continue;
+		if (!semanticEqual(value, cur[key])) touched.push(key);
+	}
+	if (touched.length === 0) return "inert";
+	const geometryKeys = TRANSLATABLE_GEOMETRY[subtype];
+	if (!geometryKeys) return "regenerate";
+	if (!touched.every((k) => geometryKeys.includes(k))) return "regenerate";
+	return isRigidTranslation(cur, pat, subtype, geometryKeys) ? "translation" : "regenerate";
+}
+//#endregion
+//#region src/identity/FormFieldRef.ts
+/**
+* URL-safe encoding of a `FormFieldRef`, used by the cloud HTTP surface as
+* the `:fieldKey` route parameter. Decoded by the server back into a
+* `FormFieldRef` via `decodeFieldRefKey`. Mirrors the annotation plane's
+* `encodeStableIdKey` (`obj:42` / `nm:…`) so the two member-key syntaxes
+* read the same on the wire:
+*
+*   `{ kind: 'objectNumber', fieldObjectNumber: 12 }` -> `'obj:12'`
+*   `{ kind: 'fqn', name: 'billing.name' }`           -> `'fqn:billing.name'`
+*
+* The caller is responsible for `encodeURIComponent`-ing the result before
+* splicing it into a URL path; the `wirePaths.layerFormField*` builders
+* already do that. FQNs are opaque strings and may contain anything; the
+* `fqn:` prefix keeps them unambiguous from numeric ids.
+*/
+function encodeFieldRefKey(ref) {
+	if (ref.kind === "objectNumber") {
+		if (!Number.isInteger(ref.fieldObjectNumber) || ref.fieldObjectNumber <= 0) throw new RangeError(`encodeFieldRefKey: fieldObjectNumber must be a positive integer, got ${ref.fieldObjectNumber}`);
+		return `obj:${ref.fieldObjectNumber}`;
+	}
+	return `fqn:${ref.name}`;
+}
+/**
+* Inverse of `encodeFieldRefKey`. Returns `null` for malformed input so the
+* server can answer 400 InvalidArg with a useful message instead of
+* throwing. The input is the already-`decodeURIComponent`-ed segment from
+* the route path. Empty FQNs are rejected: `fqn:` with no suffix is not a
+* valid identity.
+*/
+function decodeFieldRefKey(key) {
+	if (key.startsWith("obj:")) {
+		const rest = key.slice(4);
+		const n = Number.parseInt(rest, 10);
+		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
+		return {
+			kind: "objectNumber",
+			fieldObjectNumber: n
+		};
+	}
+	if (key.startsWith("fqn:")) {
+		const name = key.slice(4);
+		if (name.length === 0) return null;
+		return {
+			kind: "fqn",
+			name
+		};
+	}
+	return null;
+}
+//#endregion
+//#region src/search/literal.ts
+/**
+* The fold flavor a literal query needs. Haystack and needle MUST be
+* folded with the same options; corpus caches key their pre-folded text
+* on this (the default `{}` fold is the persistable one — non-default
+* queries fold the original page text at query time).
+*/
+function foldOptionsFor(query) {
+	return {
+		keepCase: !!query.matchCase,
+		keepMarks: !!query.matchDiacritics
+	};
+}
+const WORD_UNIT = /[\p{L}\p{N}_]/u;
+const MARK = /\p{M}/u;
+/** Whether the code point ENDING at `index` (exclusive) is a word char. */
+function wordBefore(text, index) {
+	if (index <= 0) return false;
+	const unit = text.charCodeAt(index - 1);
+	const start = unit >= 56320 && unit <= 57343 && index >= 2 ? index - 2 : index - 1;
+	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(start)));
+}
+/** Whether the code point starting at `index` is a word char. */
+function wordAt(text, index) {
+	if (index >= text.length) return false;
+	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(index)));
+}
+/**
+* All non-overlapping literal matches, in original code-unit space.
+* `haystack` must have been folded with `foldOptionsFor(query)`.
+*/
+function matchLiteral(haystack, query) {
+	const needle = foldText(query.text, foldOptionsFor(query)).folded;
+	if (needle.trim().length === 0) return [];
+	const out = [];
+	let from = 0;
+	while (from <= haystack.folded.length - needle.length) {
+		const at = haystack.folded.indexOf(needle, from);
+		if (at < 0) break;
+		if (query.wholeWord && (wordBefore(haystack.folded, at) || wordAt(haystack.folded, at + needle.length))) {
+			from = at + 1;
+			continue;
+		}
+		if (query.matchDiacritics && at + needle.length < haystack.folded.length) {
+			const after = haystack.folded.codePointAt(at + needle.length);
+			if (MARK.test(String.fromCodePoint(after))) {
+				from = at + 1;
+				continue;
+			}
+		}
+		out.push(toOriginalRange(haystack, at, needle.length));
+		from = at + needle.length;
+	}
+	return out;
+}
+//#endregion
+//#region src/search/regex.ts
+/**
+* The portable search-regex dialect: JavaScript `u`-mode syntax MINUS the
+* features RE2 refuses (backreferences, lookaround). The local engine
+* executes patterns with JS `RegExp`; the server executes the SAME
+* pattern with RE2, whose linear-time guarantee is the ReDoS defense.
+* Restricting both sides to the common subset keeps one query string
+* valid — and equally powerful — everywhere.
+*/
+const SEARCH_REGEX_MAX_LENGTH = 512;
+/**
+* Validate a pattern against the dialect. Cheap and dependency-free —
+* viewers call it on keystroke for early feedback; engines re-validate
+* and reject bad patterns with `InvalidArg`.
+*/
+function validateSearchRegex(pattern) {
+	if (pattern.length === 0) return {
+		ok: false,
+		issue: "empty",
+		message: "Pattern is empty."
+	};
+	if (pattern.length > 512) return {
+		ok: false,
+		issue: "too-long",
+		message: `Pattern exceeds 512 characters.`
+	};
+	let inClass = false;
+	for (let i = 0; i < pattern.length; i++) {
+		const ch = pattern[i];
+		if (ch === "\\") {
+			const next = pattern[i + 1] ?? "";
+			if (!inClass && next >= "1" && next <= "9") return {
+				ok: false,
+				issue: "backreference",
+				message: `Backreference \\${next} is not supported.`
+			};
+			if (!inClass && next === "k" && pattern[i + 2] === "<") return {
+				ok: false,
+				issue: "backreference",
+				message: "Named backreferences (\\k<…>) are not supported."
+			};
+			i++;
+			continue;
+		}
+		if (inClass) {
+			if (ch === "]") inClass = false;
+			continue;
+		}
+		if (ch === "[") {
+			inClass = true;
+			continue;
+		}
+		if (ch === "(" && pattern[i + 1] === "?") {
+			const tag = pattern[i + 2] ?? "";
+			if (tag === "=" || tag === "!") return {
+				ok: false,
+				issue: "lookaround",
+				message: "Lookahead ((?=…), (?!…)) is not supported."
+			};
+			if (tag === "<" && (pattern[i + 3] === "=" || pattern[i + 3] === "!")) return {
+				ok: false,
+				issue: "lookaround",
+				message: "Lookbehind ((?<=…), (?<!…)) is not supported."
+			};
+		}
+	}
+	try {
+		new RegExp(pattern, "mu");
+	} catch (error) {
+		return {
+			ok: false,
+			issue: "syntax",
+			message: error.message
+		};
+	}
+	return { ok: true };
+}
+function validateSearchQuery(query) {
+	if (!query.regex) return { ok: true };
+	if (query.matchDiacritics) return {
+		ok: false,
+		issue: "diacritics-with-regex",
+		message: "Diacritic-sensitive matching is not available for regex patterns (regex runs on the raw text plane)."
+	};
+	return validateSearchRegex(query.text);
+}
+/**
+* All matches of a dialect-valid pattern over the RAW page text (regex
+* does not run against folded text — case handling is the `i` flag, and
+* diacritic folding never applies). `wholeWord` is a boundary POST-FILTER
+* using the same Unicode word test as the literal path — never `\b`,
+* whose ASCII word set would give the toggle different semantics in regex
+* mode ("caf" whole-word matching inside "café"). Filtering after the
+* match also survives the move to RE2 server-side. Zero-length matches
+* are skipped: search UI cannot highlight nothing, and skipping them is
+* also the infinite-loop guard for patterns like `a*`.
+*/
+function matchRegex(text, query) {
+	const valid = validateSearchQuery({
+		...query,
+		regex: true
+	});
+	if (!valid.ok) throw new Error(`Invalid search query (${valid.issue}): ${valid.message}`);
+	const re = new RegExp(query.text, query.matchCase ? "gmu" : "gimu");
+	const out = [];
+	let m;
+	while ((m = re.exec(text)) !== null) {
+		if (m[0].length === 0) {
+			const unit = text.charCodeAt(re.lastIndex);
+			re.lastIndex += unit >= 55296 && unit <= 56319 ? 2 : 1;
+			continue;
+		}
+		if (query.wholeWord && (wordBefore(text, m.index) || wordAt(text, m.index + m[0].length))) continue;
+		out.push({
+			start: m.index,
+			length: m[0].length
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/search/matcher.ts
+/**
+* The whole match stage in one pure call: page text in, original-space
+* match ranges out. Engines with a pre-folded corpus for the default fold
+* skip this and call `matchLiteral` on the cached `FoldedText` directly;
+* everything else (non-default fold options, regex, tests) comes through
+* here.
+*/
+function matchPageText(text, query) {
+	if (query.regex) return matchRegex(text, query);
+	return matchLiteral(foldText(text, foldOptionsFor(query)), query);
+}
+//#endregion
+//#region src/search/snippet.ts
+/** Default context on each side of a match, in code units. */
+const SEARCH_SNIPPET_CONTEXT = 48;
+const WHITESPACE = /\s/;
+const WHITESPACE_ALL = /\s/g;
+const isLowSurrogate = (text, index) => {
+	const unit = text.charCodeAt(index);
+	return unit >= 56320 && unit <= 57343;
+};
+/**
+* The `'full'`-mode excerpt around one match: up to `context` code units
+* of page text on each side, trimmed to a whitespace boundary when one
+* exists inside the window (so snippets start and end on whole words),
+* never splitting a surrogate pair, whitespace flattened 1:1.
+*/
+function buildSnippet(text, range, context = 48) {
+	const matchEnd = range.start + range.length;
+	let start = Math.max(0, range.start - context);
+	if (start > 0) {
+		for (let i = start; i < range.start; i++) if (WHITESPACE.test(text[i])) {
+			start = i + 1;
+			break;
+		}
+		if (isLowSurrogate(text, start)) start++;
+	}
+	let end = Math.min(text.length, matchEnd + context);
+	if (end < text.length) {
+		for (let i = end - 1; i >= matchEnd; i--) if (WHITESPACE.test(text[i])) {
+			end = i;
+			break;
+		}
+		if (isLowSurrogate(text, end)) end--;
+	}
+	return {
+		text: text.slice(start, end).replace(WHITESPACE_ALL, " "),
+		matchStart: range.start - start,
+		matchLength: range.length
+	};
+}
+//#endregion
+//#region src/search/rects.ts
+/**
+* Match-range → merged line rects, in PDF user space (y-up).
+*
+* This is the same line-merge text selection uses (adapted from Chromium's
+* pdf/pdfium/pdfium_range.cc `MergeAdjacentRects`, BSD-licensed, Copyright
+* 2010 The Chromium Authors), operating directly on the engine's
+* `PageGeometrySnapshot`: glyph loose boxes → sub-runs (split on big
+* intra-run gaps) → one rect per visual line. Search highlights therefore
+* look exactly like selections — never a rect per glyph (the v2 bug).
+*
+* It lives in engine-core because BOTH sides need it: the server computes
+* rects here for `'rects'`-mode responses (geometry never leaves the trust
+* boundary), and the local engine computes them in the worker.
+*/
+const FLAG_EMPTY = 2;
+const CHAR_DISTANCE_FACTOR = 2.5;
+const FONT_SIZE_RATIO_THRESHOLD = 1.5;
+const VERTICAL_OVERLAP_THRESHOLD = .8;
+/**
+* Merged line rects for the text-page char range
+* `[charStart, charStart + charCount)`. Ranges index the same space as
+* `PageGeometryRun.charStart`; chars outside the snapshot are ignored.
+*/
+function searchRectsForRange(snapshot, charStart, charCount) {
+	if (charCount <= 0) return [];
+	const lo = charStart;
+	const hi = charStart + charCount - 1;
+	const subRuns = [];
+	for (const run of snapshot.runs) {
+		const runEnd = run.charStart + run.glyphs.length - 1;
+		if (runEnd < lo || run.charStart > hi) continue;
+		const s = Math.max(lo, run.charStart);
+		const e = Math.min(hi, runEnd);
+		let left = Infinity;
+		let right = -Infinity;
+		let bottom = Infinity;
+		let top = -Infinity;
+		let count = 0;
+		let widthSum = 0;
+		let prevRight = -Infinity;
+		const flush = () => {
+			if (count > 0 && right > left && top > bottom) subRuns.push({
+				rect: {
+					left,
+					bottom,
+					right,
+					top
+				},
+				charCount: count,
+				fontSize: run.fontSize
+			});
+			left = Infinity;
+			right = -Infinity;
+			bottom = Infinity;
+			top = -Infinity;
+			count = 0;
+			widthSum = 0;
+			prevRight = -Infinity;
+		};
+		for (let ci = s; ci <= e; ci++) {
+			const g = run.glyphs[ci - run.charStart];
+			if ((g.flags & FLAG_EMPTY) !== 0) continue;
+			const b = g.looseBox;
+			if (count > 0 && prevRight > -Infinity) {
+				const avg = widthSum / count;
+				if (avg > 0 && Math.abs(b.left - prevRight) > CHAR_DISTANCE_FACTOR * avg) flush();
+			}
+			left = Math.min(left, b.left);
+			right = Math.max(right, b.right);
+			bottom = Math.min(bottom, b.bottom);
+			top = Math.max(top, b.top);
+			count++;
+			widthSum += b.right - b.left;
+			prevRight = b.right;
+		}
+		flush();
+	}
+	return mergeAdjacentRects(subRuns);
+}
+function mergeAdjacentRects(runs) {
+	const out = [];
+	let prev = null;
+	let cur = null;
+	for (const run of runs) {
+		if (prev && cur && shouldMerge(prev, run)) cur = union(cur, run.rect);
+		else {
+			if (cur) out.push(cur);
+			cur = run.rect;
+		}
+		prev = run;
+	}
+	if (cur) out.push(cur);
+	return out;
+}
+function shouldMerge(a, b) {
+	if (a.fontSize != null && b.fontSize != null && a.fontSize > 0 && b.fontSize > 0) {
+		if (Math.max(a.fontSize, b.fontSize) / Math.min(a.fontSize, b.fontSize) > FONT_SIZE_RATIO_THRESHOLD) return false;
+	}
+	if (verticalOverlap(a.rect, b.rect) < VERTICAL_OVERLAP_THRESHOLD) return false;
+	const aw = (a.rect.right - a.rect.left) / a.charCount;
+	const bw = (b.rect.right - b.rect.left) / b.charCount;
+	const aL = a.rect.left - aw;
+	const aR = a.rect.right + aw;
+	const bL = b.rect.left - bw;
+	return aL < b.rect.right + bw && aR > bL;
+}
+function union(a, b) {
+	return {
+		left: Math.min(a.left, b.left),
+		bottom: Math.min(a.bottom, b.bottom),
+		right: Math.max(a.right, b.right),
+		top: Math.max(a.top, b.top)
+	};
+}
+function verticalOverlap(a, b) {
+	const ah = a.top - a.bottom;
+	const bh = b.top - b.bottom;
+	if (ah <= 0 || bh <= 0) return 0;
+	const u = Math.max(a.top, b.top) - Math.min(a.bottom, b.bottom);
+	if (u === ah || u === bh) return 1;
+	return Math.max(0, Math.min(a.top, b.top) - Math.max(a.bottom, b.bottom)) / u;
+}
+//#endregion
+//#region src/search/epoch.ts
+/**
+* The search CONTENT EPOCH: a deterministic fingerprint of everything a
+* search result depends on — page order/structure (`layoutVersion`) and
+* each page's text content (`contentVersion`), nothing else. Annotation
+* and metadata churn deliberately do NOT move it, so cached search
+* responses in a collaborative document survive comment storms.
+*
+* Both sides compute it from the manifest they already hold: the client
+* to mint versioned search URLs, the server to validate them (mismatch →
+* NotFound, the standard stale-versioned-read signal). FNV-1a 64-bit —
+* dependency-free and stable; not cryptographic, and doesn't need to be:
+* an adversary can only vary his OWN authorized query results.
+*/
+function searchContentEpoch(manifest) {
+	let input = `${manifest.layoutVersion}`;
+	for (const page of manifest.pages) input += `|${page.state.pageObjectNumber}:${page.cache.contentVersion}`;
+	return fnv1a64(input);
+}
+const FNV_OFFSET = 14695981039346656037n;
+const FNV_PRIME = 1099511628211n;
+const MASK_64 = 18446744073709551615n;
+function fnv1a64(input) {
+	let hash = FNV_OFFSET;
+	for (let i = 0; i < input.length; i++) {
+		hash ^= BigInt(input.charCodeAt(i));
+		hash = hash * FNV_PRIME & MASK_64;
+	}
+	return hash.toString(16).padStart(16, "0");
+}
+/**
+* Canonicalize a query for CACHE KEYING: default-fold literal queries are
+* pre-folded ("Café", "café" and "CAFE" are the same search, so they
+* should be the same cache entry). Semantics are unchanged — the fold is
+* idempotent and exactly what the matcher applies to the needle anyway.
+* Case- or diacritic-sensitive literals and regex patterns pass through
+* untouched (their raw form IS the query).
+*/
+function canonicalSearchQuery(query) {
+	if (query.regex || query.matchCase || query.matchDiacritics) return query;
+	const canonical = { text: foldText(query.text).folded };
+	if (query.wholeWord) canonical.wholeWord = true;
+	return canonical;
+}
+//#endregion
+//#region src/auth/scope/pdf-bits.ts
+/**
+* ISO 32000 user-access permission bit positions, expressed as integer
+* masks. Bit numbers in the spec are 1-indexed, so bit 3 = `1 << 2`.
+*
+* Bits 1, 2, 7, 8, and 13+ are reserved and not surfaced here.
+*/
+const PDF_BITS = {
+	/** Bit 3 — print the document. */
+	PRINT: 4,
+	/** Bit 4 — modify content streams. */
+	MODIFY: 8,
+	/** Bit 5 — copy/extract text and graphics. */
+	COPY: 16,
+	/** Bit 6 — annotate + fill forms (+ modify form fields with bit 4). */
+	ANNOTATE_FILL: 32,
+	/** Bit 9 — fill existing forms (even if bit 6 is clear). */
+	FILL_FORMS: 256,
+	/** Bit 10 — accessibility extraction (deprecated in PDF 2.0). */
+	ACCESSIBILITY: 512,
+	/** Bit 11 — assemble document (insert/rotate/delete pages, outline). */
+	ASSEMBLE: 1024,
+	/** Bit 12 — high-quality print (refines bit 3). */
+	PRINT_HIGH: 2048
+};
+/**
+* Decode a raw PDFium permission integer into a typed boolean view.
+*
+* `null` input (the documents row column is nullable until probed)
+* yields all-false bits — i.e., a maximally restrictive interpretation.
+* That keeps `pdf.permissions` expansion safe on unprobed documents.
+*/
+function decodePdfBits(raw) {
+	if (raw === null) return {
+		bit3: false,
+		bit4: false,
+		bit5: false,
+		bit6: false,
+		bit9: false,
+		bit10: false,
+		bit11: false,
+		bit12: false
+	};
+	return {
+		bit3: (raw & PDF_BITS.PRINT) !== 0,
+		bit4: (raw & PDF_BITS.MODIFY) !== 0,
+		bit5: (raw & PDF_BITS.COPY) !== 0,
+		bit6: (raw & PDF_BITS.ANNOTATE_FILL) !== 0,
+		bit9: (raw & PDF_BITS.FILL_FORMS) !== 0,
+		bit10: (raw & PDF_BITS.ACCESSIBILITY) !== 0,
+		bit11: (raw & PDF_BITS.ASSEMBLE) !== 0,
+		bit12: (raw & PDF_BITS.PRINT_HIGH) !== 0
+	};
+}
+//#endregion
+//#region src/auth/scope/builders.ts
+/**
+* Typed capability constants for customer-side JWT minting.
+*
+* The shape mirrors the dotted capability name so it reads naturally:
+*   caps.doc.text.copy()                  // "doc.text.copy"
+*   caps.doc.download()                   // "doc.download"
+*   caps.doc.download.flattened()         // "doc.download.flattened"
+*   caps.doc.print.high()                 // "doc.print.high"
+*
+* Each leaf is a function returning the literal string (as `const`) so
+* TypeScript catches typos at the call site. Wrappers like `download`
+* and `print` are `Object.assign`'d to be callable AND carry child
+* properties for the refinement capabilities.
+*/
+const caps = { doc: {
+	open: () => "doc.open",
+	render: () => "doc.render",
+	text: {
+		select: () => "doc.text.select",
+		copy: () => "doc.text.copy",
+		search: () => "doc.text.search"
+	},
+	content: { copy: () => "doc.content.copy" },
+	download: Object.assign(() => "doc.download", { flattened: () => "doc.download.flattened" }),
+	print: Object.assign(() => "doc.print", { high: () => "doc.print.high" }),
+	pages: {
+		modify: () => "doc.pages.modify",
+		assemble: () => "doc.pages.assemble"
+	},
+	forms: {
+		read: () => "doc.forms.read",
+		fill: () => "doc.forms.fill",
+		modify: () => "doc.forms.modify"
+	},
+	annotate: {
+		read: () => "doc.annotate.read",
+		modify: () => "doc.annotate.modify"
+	},
+	metadata: { modify: () => "doc.metadata.modify" },
+	attachments: { modify: () => "doc.attachments.modify" },
+	redact: () => "doc.redact"
+} };
+/**
+* Builder factory for collab scope filters. Each entity:action pair
+* gets a sub-object with the four filter constructors.
+*
+*   collab.annotations.create.self()           → "annotations:create:self"
+*   collab.annotations.create.group("legal")   → "annotations:create:group=legal"
+*   collab.annotations.update.group("4")       → "annotations:update:group=4"
+*   collab.annotations.delete.createdBy("u-7") → "annotations:delete:createdBy=u-7"
+*   collab.annotations.setGroup.group("legal") → "annotations:set-group:group=legal"
+*   collab.annotations.all.all()               → "annotations:*:all"  (action wildcard)
+*
+* On create, the filter is evaluated against the caller's own identity
+* (no impersonation), so `:self` and `:all` trivially pass; `:group=X`
+* is the meaningful filter — it constrains creation to callers whose
+* default group is X.
+*/
+const collab = { annotations: {
+	create: makeFilterBuilder("annotations", "create"),
+	update: makeFilterBuilder("annotations", "update"),
+	delete: makeFilterBuilder("annotations", "delete"),
+	setGroup: makeSetGroupBuilder(),
+	/** Action wildcard — matches create, update, delete, AND set-group with the given filter. */
+	all: makeFilterBuilder("annotations", "*")
+} };
+function makeFilterBuilder(entity, action) {
+	return {
+		all: () => `${entity}:${action}:all`,
+		self: () => `${entity}:${action}:self`,
+		createdBy: (userId) => `${entity}:${action}:createdBy=${userId}`,
+		group: (groupId) => `${entity}:${action}:group=${groupId}`
+	};
+}
+function makeSetGroupBuilder() {
+	return {
+		all: () => "annotations:set-group:all",
+		group: (groupId) => `annotations:set-group:group=${groupId}`
+	};
+}
+/**
+* Builder for the `pdf.permissions` virtual scope. Returns the literal
+* string; provided as a helper for parity with caps/collab in JWT
+* construction code.
+*/
+const pdfPermissions = () => "pdf.permissions";
+/**
+* Materialise `pdf.permissions` into the concrete capability list it
+* would expand to under the given PDF bit configuration.
+*
+* Useful when the customer wants to start from PDF defaults and then
+* subtract specific capabilities — easier to build the JWT scope array
+* by filtering an explicit list than by composing virtual + denials.
+*
+*   const defaults = materializePdfPermissions(pdfBits);
+*   const scope = [
+*     ...defaults.filter(s => s !== 'doc.text.copy'),
+*     'doc.download',
+*   ];
+*
+* IMPORTANT: this MUST stay in sync with `addPdfPermissions` inside
+* resolver.ts. A test pins them together.
+*/
+function materializePdfPermissions(b) {
+	const out = /* @__PURE__ */ new Set();
+	out.add("doc.open");
+	out.add("doc.render");
+	out.add("doc.annotate.read");
+	out.add("doc.forms.read");
+	if (b.bit5) {
+		out.add("doc.text.select");
+		out.add("doc.text.copy");
+		out.add("doc.text.search");
+		out.add("doc.content.copy");
+	}
+	if (b.bit3) out.add("doc.print");
+	if (b.bit12 && b.bit3) out.add("doc.print.high");
+	if (b.bit4) {
+		out.add("doc.pages.modify");
+		out.add("doc.redact");
+		out.add("doc.metadata.modify");
+		out.add("doc.attachments.modify");
+	}
+	if (b.bit11) out.add("doc.pages.assemble");
+	if (b.bit6) out.add("doc.annotate.modify");
+	if (b.bit6 || b.bit9) out.add("doc.forms.fill");
+	if (b.bit6 && b.bit4) out.add("doc.forms.modify");
+	return [...out];
+}
+//#endregion
+export { pdfRectWidth as $, refKey as A, decodeStableIdKey as B, appearanceImpactOf as C, shiftsExistingAnnotationIndices as D, invalidatesWeakIndexRefs as E, resolveBinarySource as F, normalizePdfRect as G, isValidPageObjectNumber as H, NO_ANNOTATION_FLAGS as I, pdfQuadFromCorners as J, pdfQuadBounds as K, UNKNOWN_WEAK_ANNOTATION_STATE as L, normalizeAnnotationPatch as M, normalizeAttachmentFileSource as N, buildThreads as O, sniffBinaryMetadata as P, pdfRectToOriginSize as Q, knownWeakAnnotationState as R, encodeFieldRefKey as S, changesAnnotationList as T, DEFAULT_PDF_SAVE_MODE as U, encodeStableIdKey as V, createPageImageHandle as W, pdfRectHeight as X, pdfRectFromOriginSize as Y, pdfRectSize as Z, foldOptionsFor as _, PDF_BITS as a, wordBefore as b, searchContentEpoch as c, buildSnippet as d, matchPageText as f, validateSearchRegex as g, validateSearchQuery as h, pdfPermissions as i, normalizeAnnotationDraft as j, classifyRelation as k, searchRectsForRange as l, matchRegex as m, collab as n, decodePdfBits as o, SEARCH_REGEX_MAX_LENGTH as p, pdfQuadCorners as q, materializePdfPermissions as r, canonicalSearchQuery as s, caps as t, SEARCH_SNIPPET_CONTEXT as u, matchLiteral as v, semanticEqual as w, decodeFieldRefKey as x, wordAt as y, revisionTokensEqual as z };
+
+//# sourceMappingURL=builders-C548U47M.js.map