@embedpdf/engine-core 3.0.0-next.13 → 3.0.0-next.15

package/dist/authority-B3BklsB4.js

@@ -0,0 +1,2239 @@
+import { g as writesScripts } from "./value-Dhc8eYcx.js";
+import { gt as normalizePdfRect, nt as kindFactsOf, wt as pdfRectTurnedBounds, xt as pdfRectIntersection } from "./resolveAnnotationDraft-CUpf0SMh.js";
+import { h as EngineError, m as annotationKey, u as encodePageKey, v as _defineProperty, y as EngineErrorCode } from "./format-Dgg428Kb.js";
+import { Et as pdfRectOf, J as pageDestinationOf, K as mapPageActions, M as pageAnnotationOf, Q as applyResolvedPatch, W as mapFieldActions, Y as pdfDestinationOf, c as foldText, ht as resolveBinarySource, q as mapTriggerActions, xt as pageBoxOf } from "./calibrate-7T3fnP8-.js";
+import { C as lockCovers, E as protectedCapabilities, S as levelFromPermission, T as minLevel, _ as deriveProtection, a as checkFieldAction, i as checkCollab, j as PermissionDenied, n as checkAnyFieldAction, o as checkSetGroup, r as checkCapability, s as collabTargetOf, v as describeProtection, x as levelAllows } from "./resolver-CzxmD9Ck.js";
+import { S as AbortablePromise, d as matchLiteral, s as matchRegex, u as foldOptionsFor } from "./viewport-BJW13EGZ.js";
+//#region src/geometry/pageBoxes.ts
+/** The media box of a page that has none, which the file needs: US Letter. */
+const DEFAULT_MEDIA_BOX = {
+	left: 0,
+	bottom: 0,
+	right: 612,
+	top: 792
+};
+/** A box that shares nothing with the media box: no size, at the origin. */
+const EMPTY_BOX = {
+	left: 0,
+	right: 0,
+	bottom: 0,
+	top: 0
+};
+/**
+* The page's five boxes as ISO 32000-1 §14.11.2 defines them: the crop box
+* defaults to the media box and the other three to the crop box, and each is
+* reduced to the part it shares with the media box. The crop box is then the
+* visible page, what the page shows.
+*
+* For broken files, which the standard doesn't cover, we do what Acrobat
+* does: a page without a media box is US Letter, and a box that shares
+* nothing with the media box is empty, so a crop box off the page leaves a
+* page with no size.
+*/
+function pageBoxesOf(written) {
+	const media = written.media ?? DEFAULT_MEDIA_BOX;
+	const within = (box) => pdfRectIntersection(box, media) ?? EMPTY_BOX;
+	const crop = within(written.crop ?? media);
+	return {
+		media,
+		crop,
+		bleed: within(written.bleed ?? crop),
+		trim: within(written.trim ?? crop),
+		art: within(written.art ?? crop)
+	};
+}
+/**
+* A page's turn from its `/Rotate`, degrees clockwise. ISO 32000-1 Table 30
+* allows multiples of 90; a negative one or one past 360 is the same turn.
+* For a value that isn't a multiple of 90, which the file shouldn't hold, we
+* do what Acrobat does: no turn.
+*/
+function pageRotationOf(written) {
+	if (!Number.isInteger(written) || written % 90 !== 0) return 0;
+	return (written % 360 + 360) % 360;
+}
+//#endregion
+//#region src/dto/PageRender.ts
+/**
+* What a page picture draws: the options as passed, and for each one left
+* out, what the caller may read. A left-out option never asks for more than
+* the caller may see; `true` for something they may not read is refused
+* (`PermissionDenied`, naming the option).
+*/
+function resolvePageLayers(options, may) {
+	const { includeAnnotations, includeFormFields } = options ?? {};
+	if (includeAnnotations === true && !may.annotations) throw new PermissionDenied("doc.annotate.read", "includeAnnotations");
+	if (includeFormFields === true && !may.formFields) throw new PermissionDenied("doc.forms.read", "includeFormFields");
+	return {
+		includeAnnotations: includeAnnotations ?? may.annotations,
+		includeFormFields: includeFormFields ?? (includeAnnotations === false ? false : may.formFields)
+	};
+}
+/** `InvalidArg` unless `quality` is absent or between 0 and 1. */
+function checkImageQuality(quality) {
+	if (quality === void 0 || quality >= 0 && quality <= 1) return;
+	throw new EngineError(EngineErrorCode.InvalidArg, "quality must be between 0 and 1", { details: { field: "quality" } });
+}
+function createPageImageHandle(result, blobSource) {
+	return {
+		...result,
+		...imageSourceOf(blobSource)
+	};
+}
+/**
+* An image whose encoded bytes this device holds (a picture it made, such as
+* a stamp's preview), to paint like one an engine rendered.
+*/
+function imageSourceOfBytes(bytes, contentType) {
+	return imageSourceOf({ blob: async () => new Blob([bytes.slice()], { type: contentType }) });
+}
+/** The image `blobSource` gives, as a blob and as an object URL. */
+function imageSourceOf(blobSource) {
+	return {
+		blob() {
+			return AbortablePromise.run(async (signal) => {
+				if (typeof Blob === "undefined") throw new EngineError(EngineErrorCode.RuntimeUnavailable, "Blob is not available in this environment");
+				const blob = await blobSource.blob(signal);
+				if (signal.aborted) throw signal.reason;
+				return blob;
+			});
+		},
+		objectUrl() {
+			return AbortablePromise.run(async (signal) => {
+				if (typeof Blob === "undefined" || typeof URL === "undefined" || !URL.createObjectURL) throw new EngineError(EngineErrorCode.RuntimeUnavailable, "Object URLs are not available in this environment");
+				const blob = await blobSource.blob(signal);
+				const url = URL.createObjectURL(blob);
+				if (signal.aborted) {
+					URL.revokeObjectURL(url);
+					throw signal.reason;
+				}
+				return {
+					url,
+					revoke: () => URL.revokeObjectURL(url)
+				};
+			});
+		}
+	};
+}
+//#endregion
+//#region src/dto/PdfSaveMode.ts
+const DEFAULT_PDF_SAVE_MODE = "incremental";
+//#endregion
+//#region src/identity/uuid.ts
+/**
+* Generate an RFC 4122 v4 UUID using the Web Crypto API surface available in
+* every realm this code runs in: Node 19+, Web Workers, browsers on https,
+* http, intranet and file: pages, and edge runtimes.
+*
+* Why this implementation:
+*   - `crypto.randomUUID()` is limited to secure contexts in some browsers;
+*     `getRandomValues()` has no such restriction.
+*   - `import { randomUUID } from 'crypto'` makes Vite externalize the
+*     `crypto` module for browser builds and fail at runtime.
+*
+* Output is the canonical hex form: `xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx`,
+* where `y` is one of `8/9/a/b` (variant nibble = 10xx).
+*/
+function generateUuid() {
+	const bytes = globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	bytes[6] = bytes[6] & 15 | 64;
+	bytes[8] = bytes[8] & 63 | 128;
+	return formatUuid(bytes);
+}
+/**
+* Generate an RFC 9562 v7 UUID: the Unix time in milliseconds in the first
+* 48 bits, then random bits. Names made later sort later, which is what an
+* annotation's `/NM` gets when the data names none.
+*/
+function generateUuidV7(now = Date.now()) {
+	const bytes = globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	let time = Math.max(0, Math.floor(now));
+	for (let i = 5; i >= 0; i--) {
+		bytes[i] = time % 256;
+		time = Math.floor(time / 256);
+	}
+	bytes[6] = bytes[6] & 15 | 112;
+	bytes[8] = bytes[8] & 63 | 128;
+	return formatUuid(bytes);
+}
+function formatUuid(bytes) {
+	const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+//#endregion
+//#region src/annotation/family.ts
+/** The family an annotation of `subtype` belongs to. */
+function familyOfSubtype(subtype) {
+	return subtype === "widget" ? "widgets" : "annotations";
+}
+//#endregion
+//#region src/dto/normalizeAttachmentFileSource.ts
+/**
+* Resolve an attachment `file` into its wire halves: metadata into the
+* JSON body, bytes into the resource map. Unlike stamps there is no
+* format allowlist — attaching arbitrary files is the point — so the
+* declared mime type wins, then the Blob's; attachment formats cannot be
+* reliably sniffed, so without either the file has no type.
+* Used by the document-level `attachments.create`.
+*/
+async function normalizeAttachmentFileSource(file, key) {
+	const resolved = await resolveBinarySource(file.data instanceof ArrayBuffer ? new Uint8Array(file.data) : file.data);
+	const name = file.name ?? resolved.name;
+	if (!name) throw new EngineError(EngineErrorCode.InvalidArg, "attachment file requires a name — pass { data, name } or a File whose name is set");
+	const mimeType = file.mimeType ?? resolved.mimeType;
+	return {
+		wireFile: {
+			resources: { file: key },
+			name,
+			...mimeType !== void 0 ? { mimeType } : {},
+			...file.description !== void 0 ? { description: file.description } : {}
+		},
+		resource: {
+			bytes: resolved.bytes,
+			...mimeType !== void 0 ? { mimeType } : {},
+			name
+		}
+	};
+}
+//#endregion
+//#region src/transfer/annotationImport.ts
+/**
+* The facts an import committed: one `annotations.created` per annotation, in
+* bundle order, each with the envelope of its own page and its own id. The
+* cache pins move once, with the last.
+*/
+function annotationImportFacts(result) {
+	const last = result.annotations.length - 1;
+	return result.annotations.map((annotation, index) => {
+		const { page } = annotation.ref;
+		return {
+			page,
+			annotation,
+			meta: {
+				affectedPages: result.meta.affectedPages.filter((affected) => affected.objectNumber === page.objectNumber),
+				cacheDelta: index === last ? result.meta.cacheDelta : null,
+				opId: result.meta.opId,
+				undoable: result.meta.undoable,
+				changed: [annotation.ref]
+			}
+		};
+	});
+}
+//#endregion
+//#region src/transfer/exportSelection.ts
+/**
+* The annotations an export takes, in document order: page order, then each
+* page's annotation order. Besides the selection:
+*
+* - a reply brings its parent, and the parent's, up to the root;
+* - an annotation brings its popup, and a popup brings its parent;
+* - with `include: 'threads'`, the default, every reply below a selected
+*   annotation.
+*
+* A reply is on its parent's page (ISO 32000-2 §12.5.6.2, `/IRT`) and a popup
+* on its parent's, so none of this reaches another page. `readPage` returns a
+* page's annotations in `/Annots` order and is called once for each page
+* the selection is on. `pages` is the document's pages in order. A selected
+* page or annotation the document doesn't have is refused with `NotFound`.
+*/
+function closeExportSelection(selection, pages, readPage) {
+	const inDocument = new Set(pages.map(encodePageKey));
+	const read = /* @__PURE__ */ new Map();
+	const byKey = /* @__PURE__ */ new Map();
+	const readOnce = (page) => {
+		const pageKey = encodePageKey(page);
+		if (read.has(pageKey) || !inDocument.has(pageKey)) return;
+		const annotations = readPage(page);
+		read.set(pageKey, annotations);
+		for (const annotation of annotations) byKey.set(annotationKey(annotation.ref), annotation);
+	};
+	const find = (ref) => {
+		readOnce(ref.page);
+		return byKey.get(annotationKey(ref));
+	};
+	for (const page of selection.pages ?? []) if (!inDocument.has(encodePageKey(page))) throw new EngineError(EngineErrorCode.NotFound, `export: the document has no page ${encodePageKey(page)}`);
+	const everything = !selection.refs && !selection.pages;
+	const threads = (selection.include ?? "threads") === "threads";
+	for (const page of everything ? pages : selection.pages ?? []) readOnce(page);
+	const taken = /* @__PURE__ */ new Set();
+	const pending = [];
+	const take = (annotation) => {
+		if (!annotation) return;
+		const key = annotationKey(annotation.ref);
+		if (taken.has(key)) return;
+		taken.add(key);
+		pending.push(annotation);
+	};
+	if (everything) for (const annotations of read.values()) annotations.forEach(take);
+	else {
+		for (const page of selection.pages ?? []) read.get(encodePageKey(page))?.forEach(take);
+		for (const ref of selection.refs ?? []) {
+			const annotation = find(ref);
+			if (!annotation) throw new EngineError(EngineErrorCode.NotFound, `export: the document has no annotation ${annotationKey(ref)}`);
+			take(annotation);
+		}
+	}
+	if (threads) {
+		for (const annotation of [...pending]) if (annotation.subtype === "popup" && annotation.parent) take(find(annotation.parent));
+		const replies = /* @__PURE__ */ new Map();
+		for (const annotations of read.values()) for (const annotation of annotations) {
+			const parent = annotation.reply ? find(annotation.reply.to) : void 0;
+			if (!parent) continue;
+			const key = annotationKey(parent.ref);
+			replies.set(key, [...replies.get(key) ?? [], annotation]);
+		}
+		for (let i = 0; i < pending.length; i++) replies.get(annotationKey(pending[i].ref))?.forEach(take);
+	}
+	for (let i = 0; i < pending.length; i++) {
+		const annotation = pending[i];
+		if (annotation.reply) take(find(annotation.reply.to));
+		if (annotation.popup) take(find(annotation.popup));
+		if (annotation.subtype === "popup" && annotation.parent) take(find(annotation.parent));
+	}
+	const ordered = [];
+	for (const page of pages) for (const annotation of read.get(encodePageKey(page)) ?? []) if (taken.has(annotationKey(annotation.ref))) ordered.push(annotation);
+	return ordered;
+}
+//#endregion
+//#region src/annotation/AnnotationList.ts
+/** Lists of different pages as one, in their order. */
+function concatAnnotationLists(lists) {
+	return {
+		annotations: lists.flatMap((list) => list.annotations),
+		pages: lists.flatMap((list) => list.pages)
+	};
+}
+//#endregion
+//#region src/mutation/AnnotationMutationResults.ts
+/**
+* What a delete removed, as its `annotations.deleted` event names it for
+* listeners that didn't make the call: the refs in `meta.changed`, the
+* annotation first.
+*/
+function deletedAnnotationsOf(result) {
+	return result.meta.changed;
+}
+//#endregion
+//#region src/annotation/resolve/patchBetween.ts
+/** Exact deep equality: the same value, or arrays and objects whose members are. */
+function sameValue(left, right) {
+	if (Object.is(left, right)) return true;
+	if (typeof left !== "object" || typeof right !== "object" || left === null || right === null) return false;
+	if (Array.isArray(left) !== Array.isArray(right)) return false;
+	const leftRecord = left;
+	const rightRecord = right;
+	const names = Object.keys(leftRecord).filter((name) => leftRecord[name] !== void 0);
+	const others = Object.keys(rightRecord).filter((name) => rightRecord[name] !== void 0);
+	return names.length === others.length && names.every((name) => sameValue(leftRecord[name], rightRecord[name]));
+}
+/**
+* What `after` changed from `before`, as `update` takes it: each data field
+* whose value differs, whole. Fields the engine works out, stamps or keeps as
+* found (a drawn kind's `rect`, the dates and authors, the refs it keeps) are
+* left out. Values are compared exactly, so a value rebuilt with the same
+* content is no change. Works in either space: it only compares values by
+* field name.
+*/
+function annotationPatchBetween(before, after) {
+	const patch = {};
+	if (before === after) return patch;
+	const owners = kindFactsOf(after.subtype)?.owners ?? {};
+	const was = before;
+	const now = after;
+	for (const [name, owner] of Object.entries(owners)) {
+		if (owner !== "data" || sameValue(was[name], now[name])) continue;
+		patch[name] = now[name] === void 0 ? null : now[name];
+	}
+	return patch;
+}
+/**
+* `current` with `patch`'s data fields set, each as a read spells it: the
+* patch as given. No field follows from another here; `applyAnnotationPatch`
+* adds what the engine's rules make follow. Works in either space.
+*/
+function mergeAnnotationPatch(current, patch) {
+	return applyResolvedPatch(current, patch);
+}
+//#endregion
+//#region src/pageSpace/pages.ts
+/**
+* A page's five boxes in page space: measured from the top-left of the crop
+* box, the visible page, which is therefore `{ x: 0, y: 0, width, height }`.
+*/
+function pageSpaceBoxesOf(boxes) {
+	const visible = boxes.crop;
+	return {
+		media: pageBoxOf(boxes.media, visible),
+		crop: pageBoxOf(boxes.crop, visible),
+		bleed: pageBoxOf(boxes.bleed, visible),
+		trim: pageBoxOf(boxes.trim, visible),
+		art: pageBoxOf(boxes.art, visible)
+	};
+}
+/**
+* A page's layout in page space. Its actions may go to other pages, so each
+* destination is measured with `boxOf`, the box of the page it goes to.
+*/
+function pageLayoutOf(layout, boxOf) {
+	const { actions, ...rest } = layout;
+	return {
+		...rest,
+		boxes: pageSpaceBoxesOf(layout.boxes),
+		...actions ? { actions: mapPageActions(actions, (destination) => pageDestinationOf(destination, boxOf)) } : {}
+	};
+}
+/** Every page's visible box, by page, from the pages' layouts. */
+function visibleBoxesOf(pages) {
+	const boxes = new Map(pages.map((page) => [page.ref.objectNumber, page.boxes.crop]));
+	return (page) => {
+		const box = boxes.get(page.objectNumber);
+		if (!box) throw new EngineError(EngineErrorCode.InvalidArg, `No page ${page.objectNumber} in this document`);
+		return box;
+	};
+}
+/** The document's pages in page space. */
+function pageListOf(snapshot) {
+	const boxOf = visibleBoxesOf(snapshot.pages);
+	return {
+		...snapshot,
+		pages: snapshot.pages.map((page) => pageLayoutOf(page, boxOf))
+	};
+}
+//#endregion
+//#region src/pageSpace/rendering.ts
+/** A page-space render target in the file's coordinates. `visible` is the page's visible box. */
+function pdfRenderTargetOf(target, visible) {
+	return target.kind === "rect" ? {
+		...target,
+		rect: pdfRectOf(target.rect, visible)
+	} : target;
+}
+/**
+* Where each rendered appearance goes, in page space: raster or encoded, each
+* placed by its `rect`. `visible` is the page's visible box.
+*/
+function pageAppearancesOf(appearances, visible) {
+	return appearances.map((appearance) => ({
+		...appearance,
+		rect: pageBoxOf(appearance.rect, visible)
+	}));
+}
+//#endregion
+//#region src/pageSpace/forms.ts
+/** A page-space widget placement in the file's coordinates, measured on its page. */
+function pdfWidgetPlacementOf(placement, boxOf) {
+	const { actions, ...rest } = placement;
+	const visible = boxOf(placement.page);
+	return {
+		...rest,
+		...placement.rect ? { rect: pdfRectOf(placement.rect, visible) } : {},
+		...placement.box ? { box: pdfRectOf(placement.box, visible) } : {},
+		...actions ? { actions: mapTriggerActions(actions, (destination) => pdfDestinationOf(destination, boxOf)) } : {}
+	};
+}
+/** A field draft in the file's coordinates: each widget measured on its own page. */
+function pdfFormFieldDraftOf(draft, boxOf) {
+	if (!draft.widgets) return draft;
+	return {
+		...draft,
+		widgets: draft.widgets.map((widget) => pdfWidgetPlacementOf(widget, boxOf))
+	};
+}
+/** A field's actions in page space, each destination measured on its page. */
+function pageFieldActionsOf(actions, boxOf) {
+	return mapFieldActions(actions, (destination) => pageDestinationOf(destination, boxOf));
+}
+/** A form field in page space: each destination of its actions on the page it goes to. */
+function pageFormFieldOf(field, boxOf) {
+	if (!field.actions) return field;
+	return {
+		...field,
+		actions: pageFieldActionsOf(field.actions, boxOf)
+	};
+}
+/** A widget row in page space, measured on its page. */
+function pageWidgetOf(widget, boxOf) {
+	return pageAnnotationOf(widget, boxOf(widget.page), boxOf);
+}
+/** A form in page space: its fields, and each widget row on its page. */
+function pageFormSnapshotOf(snapshot, boxOf) {
+	return {
+		...snapshot,
+		fields: snapshot.fields.map((field) => pageFormFieldOf(field, boxOf)),
+		widgets: snapshot.widgets.map((widget) => pageWidgetOf(widget, boxOf))
+	};
+}
+//#endregion
+//#region src/forms/draft.ts
+/**
+* Whether creating a field from `draft` takes `doc.forms.script`: a script
+* among its actions, or a widget action that holds JavaScript, a submit or a
+* link.
+*/
+function draftWritesScripts(draft) {
+	return writesScripts(draft.actions) || (draft.widgets ?? []).some((placement) => writesScripts(placement.actions));
+}
+//#endregion
+//#region src/forms/placement.ts
+/**
+* A placement as the file holds it: `/Rect`, where the widget stands, and
+* its turn. A `box` given is turned into the rect it stands in, as a box
+* kind's create turns it; without one, `rect` is that place.
+*
+* Refused with `InvalidArg`: a placement with neither, and a turn that
+* isn't a quarter turn (a widget's contents turn only so, `/MK /R`).
+*/
+function placedWidgetOf(placement) {
+	const { box, rect, rotation, ...rest } = placement;
+	if (rotation !== void 0 && ![
+		0,
+		90,
+		180,
+		270
+	].includes(rotation)) throw new EngineError(EngineErrorCode.InvalidArg, `a widget turns by a quarter turn (0, 90, 180 or 270), not ${rotation}`, { details: { field: "rotation" } });
+	const place = box ? pdfRectTurnedBounds(normalizePdfRect(box), rotation ?? 0) : rect;
+	if (!place) throw new EngineError(EngineErrorCode.InvalidArg, "a widget's placement needs its `rect` or its `box`", { details: { field: "rect" } });
+	return {
+		...rest,
+		rect: place,
+		...rotation !== void 0 ? { rotation } : {}
+	};
+}
+//#endregion
+//#region src/signature/analysis/pdf-value.ts
+/**
+* Parse the fork's canonical shallow serialisation:
+*   dict     <</Key value/Key2 value>>        (keys sorted, `#xx`-escaped)
+*   array    [item item]
+*   ref      n 0 R
+*   stream   stream(length,sha256hex)<<dict>>
+*   name     /Name (with #xx escapes)
+*   string   (literal with backslash escapes) or <hex>
+*   number   -12.5   bool  true|false   null
+*/
+function parsePdfValue(text) {
+	const parser = new Parser(text);
+	const value = parser.value();
+	parser.skipSpaces();
+	if (!parser.atEnd()) throw new Error(`trailing input at ${parser.pos}: ${text.slice(parser.pos, parser.pos + 20)}`);
+	return value;
+}
+var Parser = class {
+	constructor(text) {
+		this.text = text;
+		_defineProperty(this, "pos", 0);
+	}
+	atEnd() {
+		return this.pos >= this.text.length;
+	}
+	skipSpaces() {
+		while (this.pos < this.text.length && this.text[this.pos] === " ") this.pos++;
+	}
+	value() {
+		this.skipSpaces();
+		const t = this.text;
+		if (t.startsWith("<<", this.pos)) return this.dict();
+		if (t.startsWith("stream(", this.pos)) return this.stream();
+		if (t[this.pos] === "[") return this.array();
+		if (t[this.pos] === "/") return {
+			t: "name",
+			v: this.name()
+		};
+		if (t[this.pos] === "(") return {
+			t: "string",
+			v: this.literalString()
+		};
+		if (t[this.pos] === "<") return {
+			t: "string",
+			v: this.hexString()
+		};
+		if (t.startsWith("true", this.pos)) {
+			this.pos += 4;
+			return {
+				t: "bool",
+				v: true
+			};
+		}
+		if (t.startsWith("false", this.pos)) {
+			this.pos += 5;
+			return {
+				t: "bool",
+				v: false
+			};
+		}
+		if (t.startsWith("null", this.pos)) {
+			this.pos += 4;
+			return { t: "null" };
+		}
+		const ref = /^(\d+) 0 R(?![0-9A-Za-z])/.exec(t.slice(this.pos));
+		if (ref) {
+			this.pos += ref[0].length;
+			return {
+				t: "ref",
+				num: Number(ref[1])
+			};
+		}
+		const num = /^[+-]?(?:\d+\.?\d*|\.\d+)/.exec(t.slice(this.pos));
+		if (num) {
+			this.pos += num[0].length;
+			return {
+				t: "number",
+				v: Number(num[0])
+			};
+		}
+		throw new Error(`unexpected input at ${this.pos}: ${t.slice(this.pos, this.pos + 20)}`);
+	}
+	dict() {
+		return {
+			t: "dict",
+			entries: this.dictEntries()
+		};
+	}
+	dictEntries() {
+		this.expect("<<");
+		const entries = {};
+		for (;;) {
+			this.skipSpaces();
+			if (this.text.startsWith(">>", this.pos)) {
+				this.pos += 2;
+				return entries;
+			}
+			if (this.text[this.pos] !== "/") throw new Error(`expected a key at ${this.pos}`);
+			const key = this.name();
+			this.skipSpaces();
+			entries[key] = this.value();
+		}
+	}
+	stream() {
+		const m = /^stream\((\d+),([0-9a-fA-F]*)\)/.exec(this.text.slice(this.pos));
+		if (!m) throw new Error(`malformed stream signature at ${this.pos}`);
+		this.pos += m[0].length;
+		const dict = this.dictEntries();
+		return {
+			t: "stream",
+			length: Number(m[1]),
+			sha256: m[2].toLowerCase(),
+			dict
+		};
+	}
+	array() {
+		this.expect("[");
+		const items = [];
+		for (;;) {
+			this.skipSpaces();
+			if (this.text[this.pos] === "]") {
+				this.pos++;
+				return {
+					t: "array",
+					items
+				};
+			}
+			items.push(this.value());
+		}
+	}
+	name() {
+		this.expect("/");
+		let out = "";
+		while (this.pos < this.text.length) {
+			const ch = this.text[this.pos];
+			if (ch === " " || ch === "/" || ch === "[" || ch === "]" || ch === "<" || ch === ">" || ch === "(" || ch === ")") break;
+			if (ch === "#" && /^[0-9A-Fa-f]{2}/.test(this.text.slice(this.pos + 1, this.pos + 3))) {
+				out += String.fromCharCode(parseInt(this.text.slice(this.pos + 1, this.pos + 3), 16));
+				this.pos += 3;
+				continue;
+			}
+			out += ch;
+			this.pos++;
+		}
+		return out;
+	}
+	literalString() {
+		this.expect("(");
+		let depth = 1;
+		let out = "";
+		while (this.pos < this.text.length) {
+			const ch = this.text[this.pos++];
+			if (ch === "\\") {
+				const next = this.text[this.pos++];
+				switch (next) {
+					case "n":
+						out += "\n";
+						break;
+					case "r":
+						out += "\r";
+						break;
+					case "t":
+						out += "	";
+						break;
+					case "b":
+						out += "\b";
+						break;
+					case "f":
+						out += "\f";
+						break;
+					case "\n": break;
+					case "\r":
+						if (this.text[this.pos] === "\n") this.pos++;
+						break;
+					default: {
+						const oct = /^[0-7]{1,3}/.exec(this.text.slice(this.pos - 1));
+						if (oct) {
+							out += String.fromCharCode(parseInt(oct[0], 8));
+							this.pos += oct[0].length - 1;
+						} else out += next;
+					}
+				}
+				continue;
+			}
+			if (ch === "(") depth++;
+			if (ch === ")") {
+				depth--;
+				if (depth === 0) return out;
+			}
+			out += ch;
+		}
+		throw new Error("unterminated string");
+	}
+	hexString() {
+		this.expect("<");
+		const end = this.text.indexOf(">", this.pos);
+		if (end < 0) throw new Error("unterminated hex string");
+		const hex = this.text.slice(this.pos, end).replace(/\s+/g, "");
+		this.pos = end + 1;
+		let out = "";
+		for (let i = 0; i < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.slice(i, i + 2).padEnd(2, "0"), 16));
+		return out;
+	}
+	expect(token) {
+		if (!this.text.startsWith(token, this.pos)) throw new Error(`expected ${token} at ${this.pos}`);
+		this.pos += token.length;
+	}
+};
+/** Structural equality of two parsed values. */
+function pdfValueEquals(a, b) {
+	return stableStringify(a) === stableStringify(b);
+}
+function stableStringify(value) {
+	if (value === null) return "null";
+	switch (value.t) {
+		case "dict": return `<<${Object.keys(value.entries).sort().map((k) => `/${k} ${stableStringify(value.entries[k])}`).join("")}>>`;
+		case "stream": return `stream(${value.length},${value.sha256})${stableStringify({
+			t: "dict",
+			entries: value.dict
+		})}`;
+		case "array": return `[${value.items.map(stableStringify).join(" ")}]`;
+		case "ref": return `${value.num} 0 R`;
+		case "name": return `/${encodeName(value.v)}`;
+		case "string": return `(${value.v.replace(/[\\()]/g, (ch) => `\\${ch}`)})`;
+		case "number": return String(value.v);
+		case "bool": return value.v ? "true" : "false";
+		case "null": return "null";
+	}
+}
+function dictEntries(value) {
+	if (!value) return null;
+	if (value.t === "dict") return value.entries;
+	if (value.t === "stream") return value.dict;
+	return null;
+}
+/** Keys whose value differs (added, removed, or changed) between two dictionaries. */
+function changedKeys(a, b) {
+	const ea = dictEntries(a) ?? {};
+	const eb = dictEntries(b) ?? {};
+	const out = /* @__PURE__ */ new Set();
+	for (const key of /* @__PURE__ */ new Set([...Object.keys(ea), ...Object.keys(eb)])) if (!pdfValueEquals(ea[key] ?? null, eb[key] ?? null)) out.add(key);
+	return out;
+}
+function refsOf(value) {
+	if (!value) return [];
+	if (value.t === "ref") return [value.num];
+	if (value.t === "array") return value.items.flatMap(refsOf);
+	return [];
+}
+/** `#xx`-escape a name the way the PDF writer does: delimiters, whitespace, `#`, and non-printables. */
+function encodeName(name) {
+	let out = "";
+	for (const ch of name) {
+		const code = ch.charCodeAt(0);
+		if (code < 33 || code > 126 || "#/[]<>(){}%".includes(ch)) out += `#${code.toString(16).toUpperCase().padStart(2, "0")}`;
+		else out += ch;
+	}
+	return out;
+}
+//#endregion
+//#region src/signature/analysis/verdict.ts
+const RANK = {
+	unchanged: 0,
+	permitted: 1,
+	indeterminate: 2,
+	forbidden: 3
+};
+/** The worst of several verdicts (a certification replay's steps). */
+function worstVerdict(steps) {
+	let worst = "unchanged";
+	for (const s of steps) if (RANK[s.verdict] > RANK[worst]) worst = s.verdict;
+	return worst;
+}
+/**
+* One aggregation rule everywhere: a proven violation decides, whatever
+* else could not be established; missing evidence never becomes a pass.
+*/
+function conclude(findings, hasEffectiveChanges) {
+	if (findings.some((f) => f.verdict === "forbidden")) return "forbidden";
+	if (findings.some((f) => f.verdict === "incomplete")) return "indeterminate";
+	return hasEffectiveChanges ? "permitted" : "unchanged";
+}
+/** The finding that explains a verdict: the violation, else the gap, else the most notable allowance. */
+function primaryFinding(findings) {
+	return findings.find((f) => f.verdict === "forbidden") ?? findings.find((f) => f.verdict === "incomplete") ?? findings.find((f) => f.verdict === "permitted");
+}
+function assessmentOf(step) {
+	const primary = primaryFinding(step.findings);
+	return {
+		verdict: step.verdict,
+		complete: !step.findings.some((f) => f.verdict === "incomplete"),
+		...primary ? { primary } : {},
+		findings: step.findings
+	};
+}
+/**
+* A certification window: the net verdict and every replayed step, under
+* the same rule. A step's violation is a violation of the certification
+* even when the final state no longer shows it (corpus v3/83).
+*/
+function combine(net, steps) {
+	const findings = [...net.findings];
+	for (const s of steps) {
+		if (s === net) continue;
+		for (const f of s.findings) {
+			if (f.verdict === "permitted") continue;
+			findings.push({
+				...f,
+				detail: `revision ${s.newer}: ${f.detail ?? f.rule}`
+			});
+		}
+	}
+	const verdict = conclude(findings, net.verdict !== "unchanged" || steps.some((s) => s.verdict !== "unchanged"));
+	const primary = primaryFinding(findings);
+	return {
+		verdict,
+		complete: !findings.some((f) => f.verdict === "incomplete"),
+		...primary ? { primary } : {},
+		findings
+	};
+}
+//#endregion
+//#region src/signature/analysis/evaluate.ts
+const SIDES = ["old", "new"];
+const TRAILER_KEYS = /* @__PURE__ */ new Set([
+	"Size",
+	"Prev",
+	"XRefStm",
+	"Info",
+	"ID",
+	"Root",
+	"Type",
+	"W",
+	"Index",
+	"Filter",
+	"DecodeParms",
+	"Length",
+	"Encrypt"
+]);
+const CATALOG_KEYS = /* @__PURE__ */ new Set([
+	"Metadata",
+	"Extensions",
+	"Version",
+	"DSS",
+	"AcroForm",
+	"Perms"
+]);
+const ACROFORM_KEYS = /* @__PURE__ */ new Set([
+	"DR",
+	"DA",
+	"Q",
+	"SigFlags",
+	"NeedAppearances",
+	"Fields"
+]);
+/**
+* What a form field may change after a signature, by the level in force.
+* Every key here has a corpus case behind it (`signature-compat`); a key
+* not listed is forbidden until one does.
+*
+*   annotate (an approval signature: "Form Fill-in, Signing and Commenting
+*   are allowed"): everything but the field's identity and its place in
+*   the tree. v1/08 /V+/AP, 09 /Ff, 10 /Rect, 11 /F, 18 /TU, 21 /DA; 13 /T
+*   forbidden. /AA (v1/12) and /A are accepted by Acrobat and deliberately
+*   not listed: an action on a signed form is executable content.
+*
+*   fill (a P=2 certification): value and appearance. v1/26 /V+/AP, v3/64
+*   /Ff (ReadOnly added), 65 /DA, 68 /AP stream; v3/66 /TU, 67 /F, v2/50
+*   /Rect forbidden.
+*/
+const FIELD_KEYS_BY_LEVEL = {
+	annotate: /* @__PURE__ */ new Set([
+		"V",
+		"AS",
+		"AP",
+		"I",
+		"DA",
+		"Ff",
+		"RV",
+		"MK",
+		"Q",
+		"TU",
+		"F",
+		"Rect",
+		"BS",
+		"Opt",
+		"DV",
+		"MaxLen"
+	]),
+	fill: /* @__PURE__ */ new Set([
+		"V",
+		"AS",
+		"AP",
+		"I",
+		"RV",
+		"DA",
+		"Ff"
+	])
+};
+/** A separate widget dictionary: the presentation subset of the same tables. */
+const WIDGET_KEYS_BY_LEVEL = {
+	annotate: /* @__PURE__ */ new Set([
+		"AS",
+		"AP",
+		"DA",
+		"MK",
+		"Q",
+		"TU",
+		"F",
+		"Rect",
+		"BS"
+	]),
+	fill: /* @__PURE__ */ new Set([
+		"AS",
+		"AP",
+		"DA"
+	])
+};
+/**
+* Signing an existing field: its value, appearance and ReadOnly at any
+* level; after an approval signature also its tooltip and a /Lock installed
+* with the signature (v1/18, 19: both valid; under P=2 the combination is
+* rejected, v3/69, so neither is allowed at `fill`).
+*/
+const SIGNED_FIELD_KEYS_BY_LEVEL = {
+	annotate: /* @__PURE__ */ new Set([
+		"V",
+		"AP",
+		"AS",
+		"Ff",
+		"TU",
+		"Lock"
+	]),
+	fill: /* @__PURE__ */ new Set([
+		"V",
+		"AP",
+		"AS",
+		"Ff"
+	])
+};
+const SIGNED_WIDGET_KEYS = /* @__PURE__ */ new Set(["AP", "AS"]);
+const FF_READ_ONLY = 1;
+function fieldKeysFor(level) {
+	return level === "annotate" ? FIELD_KEYS_BY_LEVEL.annotate : FIELD_KEYS_BY_LEVEL.fill;
+}
+function widgetKeysFor(level) {
+	return level === "annotate" ? WIDGET_KEYS_BY_LEVEL.annotate : WIDGET_KEYS_BY_LEVEL.fill;
+}
+function signedFieldKeysFor(level) {
+	return level === "annotate" ? SIGNED_FIELD_KEYS_BY_LEVEL.annotate : SIGNED_FIELD_KEYS_BY_LEVEL.fill;
+}
+/**
+* Rules whose permitted findings do not make a revision a change of the
+* document: an object written again with the sealed value, an object nobody
+* references, a cross-reference container, the trailer's own bookkeeping.
+* A window with nothing else is `unchanged` (Acrobat: "not modified").
+*/
+const NON_EFFECTIVE_RULES = /* @__PURE__ */ new Set([
+	"identical-rewrite",
+	"orphan",
+	"xref-container",
+	"trailer"
+]);
+/** The level a step runs at, and the locks it enforces: what the older revision's signatures established. */
+function restrictionsOf(before) {
+	const protection = deriveProtection(before.signatures);
+	return {
+		level: protection.judged ?? "annotate",
+		locks: protection.fieldLocks
+	};
+}
+/**
+* Judge one pairwise step. Every reference to a changed object, in the
+* older and the newer revision, must be claimed by a rule that inspected
+* that use; an unclaimed reference is `unexplained` and forbidden. A
+* truncated value is `incomplete`, never permitted. Pure: JSON in, JSON
+* out, the same code in the browser worker, on the server and in tests.
+*/
+function evaluateStep(input) {
+	const changes = withEvidenceCheck(input.changes);
+	const { level, locks } = input.restrictions ?? restrictionsOf(input.before);
+	const levelInForce = input.levelOverride ?? level;
+	const ctx = new StepContext({
+		...input,
+		changes
+	}, levelInForce, locks);
+	ruleRevisionHealth(ctx);
+	ruleXrefContainer(ctx);
+	ruleIdenticalRewrite(ctx);
+	ruleFieldLock(ctx);
+	ruleTrailer(ctx);
+	ruleInfo(ctx);
+	ruleMetadata(ctx);
+	ruleCatalog(ctx);
+	ruleAcroForm(ctx);
+	ruleDss(ctx);
+	ruleSignatureFieldAdded(ctx);
+	ruleSignatureAdded(ctx);
+	ruleFormFill(ctx);
+	ruleAnnotation(ctx);
+	ruleUnexplained(ctx);
+	const verdict = conclude(ctx.findings, ctx.findings.some((f) => f.verdict === "permitted" && !NON_EFFECTIVE_RULES.has(f.rule)));
+	return {
+		older: input.older,
+		newer: input.newer,
+		levelInForce,
+		locks,
+		verdict,
+		findings: ctx.findings,
+		changes
+	};
+}
+/**
+* The evaluator never trusts its transport to be honest about gaps: a side
+* that exists must carry a value, and an object whose value is missing is
+* judged as truncated, whatever the flag says. Cross-reference containers
+* are exempt (their members are judged on their own).
+*/
+function withEvidenceCheck(changes) {
+	return changes.map((c) => {
+		if (c.value.truncated || c.kind === "xref" || c.kind === "objstm") return c;
+		const missingOld = c.present.old && (c.value.old === null || c.read?.old === "failed");
+		const missingNew = c.present.new && (c.value.new === null || c.read?.new === "failed");
+		return missingOld || missingNew ? {
+			...c,
+			value: {
+				...c.value,
+				truncated: true
+			}
+		} : c;
+	});
+}
+/**
+* The transport's verdict on each revision as a whole. A sealed revision
+* Acrobat cannot judge later changes to (sparse cross-reference table, a
+* reachable bare-reference object) makes every step over it indeterminate:
+* our verdict would otherwise disagree with the validator recipients use,
+* and for a reason that has nothing to do with the change. An incomplete
+* reachability walk on either side leaves every use unproven.
+*/
+function ruleRevisionHealth(ctx) {
+	const health = ctx.input.health;
+	if (!health) return;
+	const base = health.old;
+	if (base.sparseXref || base.bareReferences > 0) {
+		const why = [base.sparseXref ? "its cross-reference table has no entry for some object numbers below /Size" : null, base.bareReferences > 0 ? `${base.bareReferences} reachable indirect object(s) consist of a bare reference` : null].filter((x) => x !== null).join("; ");
+		ctx.findings.push({
+			rule: "base-unverifiable",
+			verdict: "incomplete",
+			objectNumber: 0,
+			detail: `the signed revision cannot be verified against later changes by Acrobat (${why}); no verdict is given rather than one Acrobat would contradict`
+		});
+	}
+	for (const side of SIDES) if (!health[side].referrersComplete) ctx.findings.push({
+		rule: "unexplained",
+		verdict: "incomplete",
+		objectNumber: 0,
+		detail: `the ${side === "old" ? "older" : "newer"} revision's reachability walk hit its budget; not every use of a changed object is known`
+	});
+}
+/**
+* Same effective value on both sides: same canonical serialisation (keys
+* sorted, whitespace normalised - Acrobat compares dictionaries by value,
+* corpus v3/61-62), same stream data (by bytes, v2/45), and both sides
+* actually read. A failed read serialises as "null" and would match another
+* failed read - evidence of nothing.
+*/
+function sameEffectiveValue(c) {
+	return c.change === "modified" && !c.value.truncated && c.read?.old !== "failed" && c.read?.new !== "failed" && c.raw.old !== null && c.raw.new !== null && c.raw.old === c.raw.new && !c.streamDataChanged;
+}
+function indexRoles(s) {
+	const fieldByObj = /* @__PURE__ */ new Map();
+	const widgetToField = /* @__PURE__ */ new Map();
+	const sigFields = /* @__PURE__ */ new Set();
+	for (const f of s.fields) {
+		fieldByObj.set(f.objectNumber, f);
+		if (f.family === "signature") sigFields.add(f.objectNumber);
+		for (const w of f.widgets) widgetToField.set(w, f.objectNumber);
+	}
+	const signedFields = /* @__PURE__ */ new Set();
+	for (const sig of s.signatures) if (sig.signed && sig.field.kind === "objectNumber") signedFields.add(sig.field.objectNumber);
+	return {
+		fieldByObj,
+		widgetToField,
+		pages: new Set(s.pages),
+		signedFields,
+		sigFields
+	};
+}
+function edgeKey(e) {
+	return `${e.parent}:${e.label}`;
+}
+var StepContext = class {
+	constructor(input, level, locks) {
+		this.input = input;
+		this.level = level;
+		this.locks = locks;
+		_defineProperty(this, "findings", []);
+		_defineProperty(this, "byNum", /* @__PURE__ */ new Map());
+		_defineProperty(this, "before", void 0);
+		_defineProperty(this, "after", void 0);
+		_defineProperty(this, "claims", /* @__PURE__ */ new Map());
+		_defineProperty(this, "locked", /* @__PURE__ */ new Set());
+		for (const c of input.changes) this.byNum.set(c.objectNumber, c);
+		this.before = indexRoles(input.before);
+		this.after = indexRoles(input.after);
+	}
+	get changes() {
+		return this.input.changes;
+	}
+	allows(needed) {
+		return levelAllows(this.level, needed);
+	}
+	claimEdge(c, side, edge, rule, allow = true) {
+		if (this.locked.has(c.objectNumber)) return;
+		const key = `${c.objectNumber}:${side}:${edgeKey(edge)}`;
+		if (!this.claims.has(key)) this.claims.set(key, {
+			rule,
+			allow
+		});
+	}
+	claimAll(c, rule, allow = true) {
+		for (const side of SIDES) for (const e of c.usage[side]) this.claimEdge(c, side, e, rule, allow);
+	}
+	/**
+	* Claim the references that are the same in both revisions; a reference
+	* gained or lost stays unexplained. `allow: false` explains a condemned
+	* object's edges (one cause in the report, not a cascade) without letting
+	* anything hang off it.
+	*/
+	claimStable(c, rule, allow = true) {
+		const oldKeys = new Set(c.usage.old.map(edgeKey));
+		const newKeys = new Set(c.usage.new.map(edgeKey));
+		for (const e of c.usage.old) if (newKeys.has(edgeKey(e))) this.claimEdge(c, "old", e, rule, allow);
+		for (const e of c.usage.new) if (oldKeys.has(edgeKey(e))) this.claimEdge(c, "new", e, rule, allow);
+	}
+	isClaimed(c, side, edge) {
+		return this.claims.has(`${c.objectNumber}:${side}:${edgeKey(edge)}`);
+	}
+	/** The use was inspected by a rule that allowed it. */
+	isAllowed(c, side, edge) {
+		return this.claims.get(`${c.objectNumber}:${side}:${edgeKey(edge)}`)?.allow === true;
+	}
+	permitted(c, rule, detail) {
+		if (this.locked.has(c.objectNumber)) return;
+		this.findings.push({
+			rule,
+			verdict: "permitted",
+			objectNumber: c.objectNumber,
+			detail
+		});
+	}
+	/**
+	* A violation is only proven on evidence: a rule condemning an object
+	* whose value could not be read or inspected is reporting what it could
+	* not see, and that is `incomplete`, never `forbidden`.
+	*/
+	forbidden(c, rule, detail, edge) {
+		this.findings.push({
+			rule,
+			verdict: c.value.truncated ? "incomplete" : "forbidden",
+			objectNumber: c.objectNumber,
+			edge: edge ? edgeKey(edge) : void 0,
+			detail: c.value.truncated ? `${detail} (judged on missing evidence: not proven)` : detail
+		});
+	}
+	/**
+	* Claim every reference under a set of parents (an appearance subtree,
+	* the DSS): objects whose references come from `parents` through labels
+	* `accept`, then everything referenced from those objects, and so on.
+	* Runs per side, because a replaced appearance stream exists on one
+	* side only.
+	*/
+	claimSubtree(side, roots, accept, rule) {
+		const joined = /* @__PURE__ */ new Set();
+		let grew = true;
+		while (grew) {
+			grew = false;
+			for (const c of this.changes) {
+				if (roots.has(c.objectNumber) || joined.has(c.objectNumber)) continue;
+				if (this.locked.has(c.objectNumber)) continue;
+				const edges = c.usage[side];
+				if (edges.length === 0) continue;
+				const inside = edges.filter((e) => roots.has(e.parent) && accept(e.label) || joined.has(e.parent));
+				if (inside.length === 0) continue;
+				for (const e of inside) this.claimEdge(c, side, e, rule);
+				if (edges.every((e) => inside.includes(e) || this.isAllowed(c, side, e))) {
+					joined.add(c.objectNumber);
+					grew = true;
+				}
+			}
+		}
+	}
+	isIdentical(c) {
+		return sameEffectiveValue(c);
+	}
+	/** Signatures signed in the newer revision but not the older: this step's signing events. */
+	newlySigned() {
+		const out = [];
+		for (const sig of this.input.after.signatures) {
+			if (!sig.signed || sig.field.kind !== "objectNumber") continue;
+			if (this.before.signedFields.has(sig.field.objectNumber)) continue;
+			out.push({
+				fieldObjectNumber: sig.field.objectNumber,
+				sig
+			});
+		}
+		return out;
+	}
+};
+function ruleXrefContainer(ctx) {
+	for (const c of ctx.changes) if (c.kind === "xref" || c.kind === "objstm") {
+		ctx.claimAll(c, "xref-container");
+		ctx.permitted(c, "xref-container", "cross-reference container; members are judged on their own");
+	}
+}
+/**
+* An object written again with the value the sealed revision holds is not
+* a modification: Acrobat compares objects by value and reports such a
+* revision as "not modified" for every role tried - document information,
+* a custom catalog entry, a page, the signed signature's own widget, a text
+* field, an annotation, the encryption dictionary, reserialised with keys
+* reordered, under a certification, under a field lock (corpus v1/02-07,
+* 23, v2/47, v3/54-62, 70, 71, 77). Under P=1 nothing is established and
+* the rewrite stays forbidden. Claimed here so the object-kind rules skip
+* it; the verdict treats it as no effective change.
+*/
+function ruleIdenticalRewrite(ctx) {
+	for (const c of ctx.changes) {
+		if (!ctx.isIdentical(c)) continue;
+		if (ctx.allows("fill")) {
+			ctx.claimAll(c, "identical-rewrite");
+			ctx.permitted(c, "identical-rewrite", "written again with the sealed value");
+		} else {
+			ctx.claimAll(c, "identical-rewrite", false);
+			ctx.forbidden(c, "identical-rewrite", `written again with the sealed value under level '${ctx.level}' (not established for this level)`);
+		}
+	}
+}
+function ruleTrailer(ctx) {
+	const c = ctx.byNum.get(0);
+	if (!c) return;
+	const changed = changedKeys(c.value.old, c.value.new);
+	const bad = [...changed].filter((k) => !TRAILER_KEYS.has(k));
+	const oldRoot = dictEntries(c.value.old)?.Root;
+	const newRoot = dictEntries(c.value.new)?.Root;
+	if (bad.length > 0) {
+		ctx.forbidden(c, "trailer", `trailer keys changed: ${bad.join(", ")}`);
+		return;
+	}
+	if (changed.has("Root") && !pdfValueEquals(oldRoot ?? null, newRoot ?? null)) {
+		ctx.forbidden(c, "trailer", "the trailer points at a different catalog");
+		return;
+	}
+	if (changed.has("Encrypt") && !pdfValueEquals(dictEntries(c.value.old)?.Encrypt ?? null, dictEntries(c.value.new)?.Encrypt ?? null)) {
+		ctx.forbidden(c, "trailer", "the trailer points at a different encryption dictionary");
+		return;
+	}
+	ctx.claimAll(c, "trailer");
+	ctx.permitted(c, "trailer");
+}
+function onlyEdges(c, test) {
+	const all = [...c.usage.old, ...c.usage.new];
+	return all.length > 0 && all.every(test);
+}
+function ruleInfo(ctx) {
+	for (const c of ctx.changes) {
+		if (ctx.isIdentical(c)) continue;
+		if (c.objectNumber !== 0 && onlyEdges(c, (e) => e.parent === 0 && e.label === "Info")) {
+			ctx.claimAll(c, "info");
+			ctx.permitted(c, "info", "document information dictionary");
+		}
+	}
+}
+function ruleMetadata(ctx) {
+	const roots = /* @__PURE__ */ new Set([ctx.input.before.root, ctx.input.after.root]);
+	for (const c of ctx.changes) {
+		if (ctx.isIdentical(c)) continue;
+		if (onlyEdges(c, (e) => roots.has(e.parent) && e.label === "Metadata")) {
+			ctx.claimAll(c, "metadata");
+			ctx.permitted(c, "metadata", "XMP metadata stream");
+		}
+	}
+}
+function ruleCatalog(ctx) {
+	const root = ctx.input.after.root;
+	const c = ctx.byNum.get(root);
+	if (!c || ctx.isIdentical(c)) return;
+	const changed = changedKeys(c.value.old, c.value.new);
+	const bad = [...changed].filter((k) => !CATALOG_KEYS.has(k));
+	if (bad.length > 0) {
+		ctx.forbidden(c, "catalog-housekeeping", `catalog keys changed: ${bad.join(", ")}`);
+		return;
+	}
+	if (changed.has("AcroForm") && !ctx.input.after.acroForm && !ctx.input.before.acroForm) {
+		const problem = acroFormProblem(ctx, dictEntries(c.value.old)?.AcroForm ?? null, dictEntries(c.value.new)?.AcroForm ?? null);
+		if (problem) {
+			ctx.forbidden(c, "acroform-housekeeping", problem);
+			return;
+		}
+		for (const side of SIDES) ctx.claimSubtree(side, /* @__PURE__ */ new Set([root]), (label) => label.startsWith("AcroForm/DR/"), "acroform-housekeeping");
+	}
+	if (changed.has("Perms")) {
+		const after = deriveProtection(ctx.input.after.signatures);
+		const before = deriveProtection(ctx.input.before.signatures);
+		if (!after.certification || before.judged !== null) {
+			ctx.forbidden(c, "catalog-housekeeping", "/Perms may only appear with the certification signature, in the first signed revision");
+			return;
+		}
+	}
+	ctx.claimAll(c, "catalog-housekeeping");
+	ctx.permitted(c, "catalog-housekeeping");
+}
+function ruleAcroForm(ctx) {
+	const acro = ctx.input.after.acroForm || ctx.input.before.acroForm;
+	if (!acro) return;
+	const c = ctx.byNum.get(acro);
+	if (!c || ctx.isIdentical(c)) return;
+	const problem = acroFormProblem(ctx, c.value.old, c.value.new);
+	if (problem) {
+		ctx.forbidden(c, "acroform-housekeeping", problem);
+		return;
+	}
+	ctx.claimAll(c, "acroform-housekeeping");
+	ctx.permitted(c, "acroform-housekeeping");
+	for (const side of SIDES) ctx.claimSubtree(side, /* @__PURE__ */ new Set([acro]), (label) => label.startsWith("DR/"), "acroform-housekeeping");
+}
+/** What is wrong with an AcroForm dictionary change, or null when it is housekeeping. */
+function acroFormProblem(ctx, oldValue, newValue) {
+	const changed = changedKeys(oldValue, newValue);
+	const bad = [...changed].filter((k) => !ACROFORM_KEYS.has(k));
+	if (bad.length > 0) return `AcroForm keys changed: ${bad.join(", ")}`;
+	if (changed.has("Fields")) {
+		const oldRefs = refsOf(dictEntries(oldValue)?.Fields);
+		const newRefs = refsOf(dictEntries(newValue)?.Fields);
+		if (oldRefs.length > newRefs.length || oldRefs.some((n, i) => newRefs[i] !== n)) return "/AcroForm /Fields is not append-only";
+		const newSigFields = newSignatureFields(ctx);
+		const strangers = newRefs.slice(oldRefs.length).filter((n) => !newSigFields.has(n));
+		if (strangers.length > 0) return `/AcroForm /Fields gained non-signature fields: ${strangers.join(", ")}`;
+	}
+	return null;
+}
+/** The refs appended to an array-valued key when the old array is a prefix of the new one; null otherwise. */
+function appendedRefs(c, key) {
+	const oldItems = dictEntries(c.value.old)?.[key];
+	const newItems = dictEntries(c.value.new)?.[key];
+	const oldRefs = refsOf(oldItems);
+	const newRefs = refsOf(newItems);
+	if (oldItems && oldItems.t !== "array") return null;
+	if (!newItems || newItems.t !== "array") return null;
+	if (oldRefs.length > newRefs.length) return null;
+	for (let i = 0; i < oldRefs.length; i++) if (oldRefs[i] !== newRefs[i]) return null;
+	return newRefs.slice(oldRefs.length);
+}
+function newSignatureFields(ctx) {
+	const out = /* @__PURE__ */ new Set();
+	for (const n of ctx.after.sigFields) if (!ctx.before.fieldByObj.has(n)) out.add(n);
+	return out;
+}
+function ruleDss(ctx) {
+	const roots = /* @__PURE__ */ new Set([ctx.input.before.root, ctx.input.after.root]);
+	for (const side of SIDES) ctx.claimSubtree(side, roots, (label) => label === "DSS" || label.startsWith("DSS/"), "dss");
+	for (const c of ctx.changes) if (c.usage.new.some((e) => roots.has(e.parent) && e.label === "DSS") && !ctx.findings.some((f) => f.objectNumber === c.objectNumber)) ctx.permitted(c, "dss", "document security store");
+}
+function ruleSignatureFieldAdded(ctx) {
+	const added = newSignatureFields(ctx);
+	if (added.size === 0) return;
+	const rule = "signature-field-added";
+	if (!ctx.allows("fill")) {
+		for (const n of added) {
+			const c = ctx.byNum.get(n);
+			if (c) ctx.forbidden(c, rule, `a signature field was added under level '${ctx.level}'`);
+		}
+		return;
+	}
+	const newWidgets = /* @__PURE__ */ new Set();
+	for (const n of added) {
+		const field = ctx.after.fieldByObj.get(n);
+		const c = ctx.byNum.get(n);
+		if (c) {
+			ctx.claimAll(c, rule);
+			ctx.permitted(c, rule, `new signature field "${field.name}"`);
+		}
+		for (const w of field.widgets) {
+			newWidgets.add(w);
+			if (w === n) continue;
+			const wc = ctx.byNum.get(w);
+			if (wc) {
+				ctx.claimAll(wc, rule);
+				ctx.permitted(wc, rule, `widget of new signature field "${field.name}"`);
+			}
+		}
+	}
+	for (const p of ctx.after.pages) {
+		const c = ctx.byNum.get(p);
+		if (!c || ctx.isIdentical(c)) continue;
+		const changed = changedKeys(c.value.old, c.value.new);
+		if (changed.size !== 1 || !changed.has("Annots")) continue;
+		const appended = appendedRefs(c, "Annots");
+		if (appended && appended.every((n) => newWidgets.has(n))) {
+			ctx.claimAll(c, rule);
+			ctx.permitted(c, rule, "page /Annots gained the new signature widget");
+		}
+	}
+	for (const c of ctx.changes) {
+		if (c.kind !== "dictionary" || ctx.isIdentical(c)) continue;
+		const changed = changedKeys(c.value.old, c.value.new);
+		if (changed.size !== 1 || !changed.has("Kids")) continue;
+		const appended = appendedRefs(c, "Kids");
+		if (appended && appended.length > 0 && appended.every((n) => added.has(n) || newWidgets.has(n))) {
+			ctx.claimAll(c, rule);
+			ctx.permitted(c, rule, "field /Kids gained the new signature field");
+		}
+	}
+}
+function ruleSignatureAdded(ctx) {
+	const rule = "signature-added";
+	const events = ctx.newlySigned();
+	if (events.length === 0) return;
+	const addedThisStep = newSignatureFields(ctx);
+	const beforeProtection = deriveProtection(ctx.input.before.signatures);
+	const afterProtection = deriveProtection(ctx.input.after.signatures);
+	const parents = /* @__PURE__ */ new Set();
+	const values = /* @__PURE__ */ new Set();
+	for (const { fieldObjectNumber, sig } of events) {
+		const needed = sig.kind === "timestamp" ? "lta" : "fill";
+		if (!ctx.allows(needed)) {
+			const c = ctx.byNum.get(fieldObjectNumber);
+			if (c) ctx.forbidden(c, rule, `a ${sig.kind} was added under level '${ctx.level}'`);
+			continue;
+		}
+		if (sig.catalogCertification && beforeProtection.judged !== null) {
+			const c = ctx.byNum.get(fieldObjectNumber);
+			if (c) ctx.forbidden(c, rule, "a certification signature after another signature");
+			continue;
+		}
+		const field = ctx.after.fieldByObj.get(fieldObjectNumber);
+		parents.add(fieldObjectNumber);
+		for (const w of field?.widgets ?? []) parents.add(w);
+		const fieldIsNew = addedThisStep.has(fieldObjectNumber);
+		const allowedFieldKeys = beforeProtection.judged === null ? /* @__PURE__ */ new Set([...signedFieldKeysFor(ctx.level), "Lock"]) : signedFieldKeysFor(ctx.level);
+		const fc = ctx.byNum.get(fieldObjectNumber);
+		if (fc && fieldIsNew) ctx.permitted(fc, rule, `new field "${sig.fieldName}" signed`);
+		else if (fc && !ctx.isIdentical(fc)) {
+			const changed = changedKeys(fc.value.old, fc.value.new);
+			const bad = [...changed].filter((k) => !allowedFieldKeys.has(k));
+			if (bad.length > 0) {
+				ctx.forbidden(fc, rule, `signature field keys changed: ${bad.join(", ")}`);
+				ctx.claimStable(fc, rule, false);
+			} else if (changed.has("Ff") && !readOnlyOnlyChange(fc, ctx.before.fieldByObj.get(fieldObjectNumber)?.flags)) {
+				ctx.forbidden(fc, rule, "signature field flags changed beyond ReadOnly");
+				ctx.claimStable(fc, rule, false);
+			} else {
+				ctx.claimStable(fc, rule);
+				ctx.permitted(fc, rule, `field "${sig.fieldName}" signed`);
+			}
+		}
+		for (const w of field?.widgets ?? []) {
+			if (w === fieldObjectNumber || fieldIsNew) continue;
+			const wc = ctx.byNum.get(w);
+			if (!wc || ctx.isIdentical(wc)) continue;
+			const bad = [...changedKeys(wc.value.old, wc.value.new)].filter((k) => !SIGNED_WIDGET_KEYS.has(k));
+			if (bad.length > 0) {
+				ctx.forbidden(wc, rule, `signature widget keys changed: ${bad.join(", ")}`);
+				ctx.claimStable(wc, rule, false);
+				continue;
+			}
+			ctx.claimStable(wc, rule);
+			ctx.permitted(wc, rule, "signature widget appearance");
+		}
+		for (const c of ctx.changes) {
+			if (c.change !== "added") continue;
+			const asValue = c.usage.new.filter((e) => e.parent === fieldObjectNumber && e.label === "V");
+			const asLock = c.usage.new.filter((e) => e.parent === fieldObjectNumber && e.label === "Lock");
+			const type = dictEntries(c.value.new)?.Type;
+			if (asValue.length > 0) {
+				if (!(type?.t === "name" && (type.v === "Sig" || type.v === "DocTimeStamp")) && type !== void 0) continue;
+				for (const e of c.usage.new) if (e.parent === fieldObjectNumber && e.label === "V" || e.label === "DocMDP") ctx.claimEdge(c, "new", e, rule);
+				ctx.permitted(c, rule, "signature value");
+				values.add(c.objectNumber);
+			} else if (asLock.length > 0) {
+				if (!(type === void 0 || type.t === "name" && type.v === "SigFieldLock")) continue;
+				for (const e of asLock) ctx.claimEdge(c, "new", e, rule);
+				ctx.permitted(c, rule, "field lock installed with the signature");
+			}
+		}
+	}
+	if (afterProtection.certification && beforeProtection.judged === null) {
+		const root = ctx.input.after.root;
+		for (const c of ctx.changes) if (c.change === "added" && onlyEdges(c, (e) => e.parent === root && e.label === "Perms")) {
+			ctx.claimAll(c, rule);
+			ctx.permitted(c, rule, "certification permissions");
+		}
+	}
+	for (const side of SIDES) ctx.claimSubtree(side, parents, (label) => label === "AP" || label.startsWith("AP/"), rule);
+	if (values.size > 0) ctx.claimSubtree("new", values, () => true, rule);
+}
+/**
+* Did `/Ff` change by gaining ReadOnly and nothing else? `/Ff` is
+* inheritable, and a lock writes `effective | ReadOnly` into the terminal
+* dictionary, so a terminal that carried no `/Ff` of its own is judged
+* against the effective flags the older revision's form model reported.
+*/
+function readOnlyOnlyChange(c, effectiveBefore) {
+	const oldFf = dictEntries(c.value.old)?.Ff;
+	const newFf = dictEntries(c.value.new)?.Ff;
+	const before = oldFf?.t === "number" ? oldFf.v : effectiveBefore ?? 0;
+	const after = newFf?.t === "number" ? newFf.v : 0;
+	return (before | FF_READ_ONLY) === after;
+}
+function ruleFormFill(ctx) {
+	const rule = "form-fill";
+	const fieldKeys = fieldKeysFor(ctx.level);
+	const widgetKeys = widgetKeysFor(ctx.level);
+	const parents = /* @__PURE__ */ new Set();
+	const fields = new Map([...ctx.before.fieldByObj, ...ctx.after.fieldByObj]);
+	for (const [num, field] of fields) {
+		if (field.family === "signature") continue;
+		const fc = ctx.byNum.get(num);
+		const widgetChanges = field.widgets.filter((w) => w !== num).map((w) => ctx.byNum.get(w)).filter(Boolean);
+		const owners = /* @__PURE__ */ new Set([num, ...field.widgets]);
+		const isAp = (label) => label === "AP" || label.startsWith("AP/");
+		const appearanceOnly = !fc && widgetChanges.length === 0 ? ctx.changes.filter((c) => SIDES.some((side) => c.usage[side].some((e) => owners.has(e.parent) && isAp(e.label))) && SIDES.every((side) => c.usage[side].every((e) => !isAp(e.label) || owners.has(e.parent)))) : [];
+		if (!fc && widgetChanges.length === 0 && appearanceOnly.length === 0) continue;
+		if (!ctx.allows("fill")) {
+			for (const c of [
+				fc,
+				...widgetChanges,
+				...appearanceOnly
+			]) if (c && !ctx.isIdentical(c)) ctx.forbidden(c, rule, `form fill under level '${ctx.level}'`);
+			continue;
+		}
+		if (appearanceOnly.length > 0) {
+			for (const c of appearanceOnly) ctx.permitted(c, rule, `appearance of field "${field.name}" regenerated`);
+			parents.add(num);
+			for (const w of field.widgets) parents.add(w);
+			continue;
+		}
+		let ok = true;
+		if (fc && !ctx.isIdentical(fc)) {
+			const changed = changedKeys(fc.value.old, fc.value.new);
+			const bad = [...changed].filter((k) => !fieldKeys.has(k));
+			if (bad.length > 0) {
+				ctx.forbidden(fc, rule, `field "${field.name}" keys changed: ${bad.join(", ")}`);
+				ctx.claimStable(fc, rule, false);
+				ok = false;
+			} else if (changed.has("Ff") && !readOnlyOnlyChange(fc, ctx.before.fieldByObj.get(num)?.flags)) {
+				ctx.forbidden(fc, rule, `field "${field.name}" flags changed beyond adding ReadOnly`);
+				ctx.claimStable(fc, rule, false);
+				ok = false;
+			} else {
+				ctx.claimStable(fc, rule);
+				const properties = [...changed].filter((k) => k !== "V" && k !== "AP" && k !== "AS" && k !== "I" && k !== "RV");
+				ctx.permitted(fc, rule, properties.length > 0 ? `field "${field.name}" ${changed.has("V") || changed.has("AS") ? "filled, " : ""}properties changed: ${properties.join(", ")}` : `field "${field.name}" filled`);
+			}
+		}
+		for (const wc of widgetChanges) {
+			if (ctx.isIdentical(wc)) continue;
+			const bad = [...changedKeys(wc.value.old, wc.value.new)].filter((k) => !widgetKeys.has(k));
+			if (bad.length > 0) {
+				ctx.forbidden(wc, rule, `widget of "${field.name}" keys changed: ${bad.join(", ")}`);
+				ctx.claimStable(wc, rule, false);
+				ok = false;
+				continue;
+			}
+			ctx.claimStable(wc, rule);
+			ctx.permitted(wc, rule, `widget of "${field.name}" appearance`);
+		}
+		if (ok) {
+			parents.add(num);
+			for (const w of field.widgets) parents.add(w);
+		}
+	}
+	for (const side of SIDES) ctx.claimSubtree(side, parents, (label) => label === "AP" || label.startsWith("AP/"), rule);
+}
+function ruleAnnotation(ctx) {
+	const rule = "annotation";
+	const pages = /* @__PURE__ */ new Set([...ctx.before.pages, ...ctx.after.pages]);
+	const widgets = /* @__PURE__ */ new Set([...ctx.before.widgetToField.keys(), ...ctx.after.widgetToField.keys()]);
+	const isWidget = (c) => {
+		if (widgets.has(c.objectNumber)) return true;
+		const sub = dictEntries(c.value.new ?? c.value.old)?.Subtype;
+		return sub?.t === "name" && sub.v === "Widget";
+	};
+	const annots = [];
+	for (const c of ctx.changes) {
+		if (c.kind !== "dictionary" || ctx.isIdentical(c)) continue;
+		if ([...c.usage.old, ...c.usage.new].some((e) => pages.has(e.parent) && e.label.startsWith("Annots/")) && !isWidget(c)) annots.push(c);
+	}
+	if (annots.length === 0) {}
+	if (!ctx.allows("annotate")) {
+		for (const c of annots) ctx.forbidden(c, rule, `annotation change under level '${ctx.level}'`);
+		return;
+	}
+	const parents = /* @__PURE__ */ new Set();
+	for (const c of annots) {
+		ctx.claimAll(c, rule);
+		ctx.permitted(c, rule, `${c.change} annotation`);
+		parents.add(c.objectNumber);
+	}
+	for (const p of pages) {
+		const c = ctx.byNum.get(p);
+		if (!c || ctx.isIdentical(c)) continue;
+		const changed = changedKeys(c.value.old, c.value.new);
+		if (changed.size === 1 && changed.has("Annots")) {
+			const removed = refsOf(dictEntries(c.value.old)?.Annots).filter((n) => !refsOf(dictEntries(c.value.new)?.Annots).includes(n));
+			const added = refsOf(dictEntries(c.value.new)?.Annots).filter((n) => !refsOf(dictEntries(c.value.old)?.Annots).includes(n));
+			if ([...removed, ...added].some((n) => widgets.has(n) && !ctx.findings.some((f) => f.objectNumber === n && f.verdict === "permitted"))) {
+				ctx.forbidden(c, rule, "page /Annots added or removed a form widget");
+				continue;
+			}
+			ctx.claimAll(c, rule);
+			ctx.permitted(c, rule, "page /Annots changed");
+		}
+	}
+	for (const side of SIDES) ctx.claimSubtree(side, parents, (label) => label === "AP" || label.startsWith("AP/") || label === "Popup" || label === "IRT", rule);
+}
+function ruleFieldLock(ctx) {
+	if (ctx.locks.length === 0) return;
+	const lockedFields = ctx.input.before.fields.filter((f) => ctx.locks.some((l) => lockCovers(l.spec, f.name)));
+	const lockedObjects = /* @__PURE__ */ new Set();
+	for (const f of lockedFields) {
+		lockedObjects.add(f.objectNumber);
+		for (const w of f.widgets) lockedObjects.add(w);
+	}
+	const frontier = new Set(lockedObjects);
+	let grew = true;
+	while (grew) {
+		grew = false;
+		for (const c of ctx.changes) {
+			if (frontier.has(c.objectNumber)) continue;
+			if (c.usage.old.length > 0 && c.usage.old.every((e) => frontier.has(e.parent))) {
+				frontier.add(c.objectNumber);
+				grew = true;
+			}
+		}
+	}
+	for (const c of ctx.changes) {
+		if (!frontier.has(c.objectNumber) || ctx.isIdentical(c)) continue;
+		const field = lockedFields.find((f) => f.objectNumber === c.objectNumber || f.widgets.includes(c.objectNumber));
+		if (field && field.objectNumber === c.objectNumber) {
+			const changed = changedKeys(c.value.old, c.value.new);
+			if (changed.size === 1 && changed.has("Ff") && readOnlyOnlyChange(c, ctx.before.fieldByObj.get(c.objectNumber)?.flags)) {
+				ctx.claimStable(c, "field-lock");
+				ctx.permitted(c, "field-lock", `ReadOnly set on locked field "${field.name}"`);
+				continue;
+			}
+		}
+		ctx.locked.add(c.objectNumber);
+		ctx.forbidden(c, "field-lock", field ? `field "${field.name}" is locked by the signature` : "part of a locked field changed");
+	}
+}
+function ruleUnexplained(ctx) {
+	for (const c of ctx.changes) {
+		if (c.value.truncated) {
+			ctx.findings.push({
+				rule: "unexplained",
+				verdict: "incomplete",
+				objectNumber: c.objectNumber,
+				detail: "value too large to inspect"
+			});
+			continue;
+		}
+		if (c.usageIncomplete) {
+			ctx.findings.push({
+				rule: "unexplained",
+				verdict: "incomplete",
+				objectNumber: c.objectNumber,
+				detail: "references could not be resolved within budget (depth, fan-out or total reads)"
+			});
+			continue;
+		}
+		if (ctx.locked.has(c.objectNumber)) continue;
+		for (const side of SIDES) for (const e of c.usage[side]) if (!ctx.isClaimed(c, side, e)) ctx.forbidden(c, "unexplained", `${side === "old" ? "was" : "is"} referenced from object ${e.parent} at ${e.label} and no rule explains it`, e);
+		if (c.usage.old.length === 0 && c.usage.new.length === 0 && !ctx.findings.some((f) => f.objectNumber === c.objectNumber)) ctx.permitted(c, "orphan", "referenced from nowhere reachable");
+	}
+}
+//#endregion
+//#region src/signature/analysis/restrictions.ts
+/**
+* The restrictions a window is judged under, read from the sealed
+* revision's structure (what that revision declared, not what the final
+* file says).
+*
+*   - `judged` given (a signature-anchored analysis): its own FieldMDP and
+*     /Lock bind the window; other signatures' locks do not (corpus v3/85:
+*     a second signature is valid with a fill of a field the first locked).
+*     Every certification's level, own or earlier, applies (inherited:
+*     conservative until observed otherwise), as does a /Lock's /P.
+*   - no `judged` (a revision-anchored analysis): every signed signature's
+*     locks and levels apply.
+*/
+function restrictionsFor(before, judged) {
+	const anchors = [];
+	const locks = [];
+	let enforced = null;
+	let signed = false;
+	for (const sig of before.signatures) {
+		if (!sig.signed || sig.revisionIndex === null) continue;
+		signed = true;
+		const own = judged !== null && sig.index === judged.index;
+		if (sig.catalogCertification && sig.docMdp !== null) {
+			anchors.push({
+				signatureIndex: sig.index,
+				revisionIndex: sig.revisionIndex,
+				source: "docmdp",
+				own,
+				permission: sig.docMdp
+			});
+			enforced = minLevel(enforced ?? "annotate", levelFromPermission(sig.docMdp));
+		}
+		if (sig.lock?.permission !== void 0) enforced = minLevel(enforced ?? "annotate", levelFromPermission(sig.lock.permission));
+		if (judged !== null && !own) continue;
+		if (sig.fieldMdp) {
+			anchors.push({
+				signatureIndex: sig.index,
+				revisionIndex: sig.revisionIndex,
+				source: "fieldmdp",
+				own,
+				fields: sig.fieldMdp
+			});
+			locks.push({
+				signatureIndex: sig.index,
+				source: "fieldmdp",
+				spec: sig.fieldMdp
+			});
+		}
+		if (sig.lock) {
+			anchors.push({
+				signatureIndex: sig.index,
+				revisionIndex: sig.revisionIndex,
+				source: "lock",
+				own,
+				fields: sig.lock
+			});
+			locks.push({
+				signatureIndex: sig.index,
+				source: "lock",
+				spec: sig.lock
+			});
+		}
+	}
+	return {
+		anchors,
+		level: signed ? enforced ?? "annotate" : "annotate",
+		locks
+	};
+}
+//#endregion
+//#region src/signature/analysis/resolve.ts
+const DEFAULT_EDGE_RESOLVER_BUDGET = {
+	maxDepth: 16,
+	maxEdgesPerObject: 256,
+	maxReads: 2e4
+};
+const USAGE_INCOMPLETE = "incomplete";
+/**
+* Resolves the raw inbound edges of an object (from the fork's referrer
+* index, which covers every reachable object of a revision) into edges
+* from *anchors*: the changed objects and the structural objects of the
+* revision (trailer, catalog, AcroForm, page tree root, pages, fields,
+* widgets). An edge from an unchanged, non-structural parent is replaced by
+* that parent's own anchored edges with the labels joined, so an
+* appearance stream under an unchanged indirect `/AP` dictionary reads
+* `widget:AP/N` rather than `apDict:N`.
+*
+* A graph traversal, not a path enumeration: results are memoised per
+* object, so a lattice of shared unchanged objects costs its size, not the
+* number of paths through it. Cycle edges contribute no anchors and are
+* skipped; a result computed while skipping one is not memoised.
+*/
+var EdgeResolver = class {
+	constructor(read, anchors, budget = DEFAULT_EDGE_RESOLVER_BUDGET) {
+		this.read = read;
+		this.anchors = anchors;
+		this.budget = budget;
+		_defineProperty(this, "memo", /* @__PURE__ */ new Map());
+		_defineProperty(this, "reads", 0);
+		_defineProperty(this, "exhausted", false);
+	}
+	/** Anchored edges of `objectNumber`, or `incomplete` when a budget was exceeded. */
+	resolve(objectNumber) {
+		if (this.exhausted) return USAGE_INCOMPLETE;
+		const result = this.resolveInner(objectNumber, /* @__PURE__ */ new Set());
+		return result === null ? USAGE_INCOMPLETE : result.edges;
+	}
+	resolveInner(n, active) {
+		const hit = this.memo.get(n);
+		if (hit) return hit;
+		if (active.size >= this.budget.maxDepth) return null;
+		if (this.reads >= this.budget.maxReads) {
+			this.exhausted = true;
+			return null;
+		}
+		this.reads += 1;
+		const raw = this.read(n);
+		active.add(n);
+		const edges = [];
+		let cyclic = false;
+		try {
+			for (const e of raw) {
+				if (this.anchors.has(e.parent)) edges.push(e);
+				else if (active.has(e.parent)) {
+					cyclic = true;
+					continue;
+				} else {
+					const up = this.resolveInner(e.parent, active);
+					if (up === null) return null;
+					cyclic || (cyclic = up.cyclic);
+					for (const u of up.edges) edges.push({
+						parent: u.parent,
+						label: `${u.label}/${e.label}`,
+						via: [...u.via ?? [], e.parent]
+					});
+				}
+				if (edges.length > this.budget.maxEdgesPerObject) return null;
+			}
+		} finally {
+			active.delete(n);
+		}
+		const resolution = {
+			edges,
+			cyclic
+		};
+		if (!cyclic) this.memo.set(n, resolution);
+		return resolution;
+	}
+};
+//#endregion
+//#region src/search/types.ts
+/** The query part of a request (or of any object that carries one): its text and flags, set flags only. */
+function searchQueryOf(query) {
+	return {
+		text: query.text,
+		...query.regex ? { regex: true } : {},
+		...query.matchCase ? { matchCase: true } : {},
+		...query.wholeWord ? { wholeWord: true } : {},
+		...query.matchDiacritics ? { matchDiacritics: true } : {},
+		...query.ignoreWhitespace ? { ignoreWhitespace: true } : {}
+	};
+}
+//#endregion
+//#region src/search/matcher.ts
+/**
+* The whole match stage in one pure call: page text in, original-space
+* match ranges out. Engines with a pre-folded corpus for the default fold
+* skip this and call `matchLiteral` on the cached `FoldedText` directly;
+* everything else (non-default fold options, regex, tests) comes through
+* here.
+*/
+function matchPageText(text, query) {
+	if (query.regex) return matchRegex(text, query);
+	return matchLiteral(foldText(text, foldOptionsFor(query)), query);
+}
+//#endregion
+//#region src/search/snippet.ts
+/** Default context on each side of a match, in code units. */
+const SEARCH_SNIPPET_CONTEXT = 48;
+const WHITESPACE = /\s/;
+const WHITESPACE_ALL = /\s/g;
+const isLowSurrogate = (text, index) => {
+	const unit = text.charCodeAt(index);
+	return unit >= 56320 && unit <= 57343;
+};
+/**
+* The excerpt around one match (`snippets: true`): up to `context` code
+* units of page text on each side, trimmed to a whitespace boundary when one
+* exists inside the window (so snippets start and end on whole words),
+* never splitting a surrogate pair, whitespace flattened to spaces.
+*/
+function buildSnippet(text, range, context = 48) {
+	const matchEnd = range.start + range.count;
+	let start = Math.max(0, range.start - context);
+	if (start > 0) {
+		for (let i = start; i < range.start; i++) if (WHITESPACE.test(text[i])) {
+			start = i + 1;
+			break;
+		}
+		if (isLowSurrogate(text, start)) start++;
+	}
+	let end = Math.min(text.length, matchEnd + context);
+	if (end < text.length) {
+		for (let i = end - 1; i >= matchEnd; i--) if (WHITESPACE.test(text[i])) {
+			end = i;
+			break;
+		}
+		if (isLowSurrogate(text, end)) end--;
+	}
+	const flat = (from, to) => text.slice(from, to).replace(WHITESPACE_ALL, " ");
+	return {
+		before: flat(start, range.start),
+		match: flat(range.start, matchEnd),
+		after: flat(matchEnd, end)
+	};
+}
+//#endregion
+//#region src/search/epoch.ts
+/**
+* The search content epoch: a deterministic fingerprint of everything a
+* search result depends on — page order/structure (`layoutVersion`) and
+* each page's text content (`contentVersion`), nothing else. Annotation
+* and metadata churn deliberately do not move it, so cached search
+* responses in a collaborative document survive comment storms.
+*
+* Both sides compute it from the manifest they already hold: the client
+* to mint versioned search URLs, the server to validate them (mismatch →
+* NotFound, the standard stale-versioned-read signal). FNV-1a 64-bit —
+* dependency-free and stable; not cryptographic, and doesn't need to be:
+* an adversary can only vary his own authorized query results.
+*/
+function searchContentEpoch(manifest) {
+	let input = `${manifest.layoutVersion}`;
+	for (const page of manifest.pages) input += `|${page.page.objectNumber}:${page.cache.contentVersion}`;
+	return fnv1a64(input);
+}
+const FNV_OFFSET = 14695981039346656037n;
+const FNV_PRIME = 1099511628211n;
+const MASK_64 = 18446744073709551615n;
+function fnv1a64(input) {
+	let hash = FNV_OFFSET;
+	for (let i = 0; i < input.length; i++) {
+		hash ^= BigInt(input.charCodeAt(i));
+		hash = hash * FNV_PRIME & MASK_64;
+	}
+	return hash.toString(16).padStart(16, "0");
+}
+/**
+* Canonicalize a query for cache keying: default-fold literal queries are
+* pre-folded ("Café", "café" and "CAFE" are the same search, so they
+* should be the same cache entry). Semantics are unchanged — the fold is
+* idempotent and exactly what the matcher applies to the needle anyway.
+* Case- or diacritic-sensitive literals and regex patterns pass through
+* untouched (their raw form is the query).
+*/
+function canonicalSearchQuery(request) {
+	const query = searchQueryOf(request);
+	if (query.regex || query.matchCase || query.matchDiacritics || query.ignoreWhitespace) return query;
+	const canonical = { text: foldText(query.text).folded };
+	if (query.wholeWord) canonical.wholeWord = true;
+	return canonical;
+}
+//#endregion
+//#region src/mutation/WriteOptions.ts
+/** What an `opId` may be: what an HTTP header carries (`Idempotency-Key`). */
+const OP_ID = /^[\x21-\x7e]{1,255}$/;
+/**
+* The `opId` a write runs under: the caller's, or a fresh one. The caller's
+* must be 1 to 255 visible ASCII characters, on every engine; anything else
+* is refused with `InvalidArg`.
+*/
+function opIdOf(options) {
+	const opId = options?.opId;
+	if (opId === void 0) return generateUuid();
+	if (!OP_ID.test(opId)) throw new EngineError(EngineErrorCode.InvalidArg, "opId must be 1 to 255 visible ASCII characters", { details: { field: "opId" } });
+	return opId;
+}
+//#endregion
+//#region src/mutation/changeOutcome.ts
+/**
+* The refusals a change keeps under its `opId`, like a success: the document
+* or the caller refused it, so asking again gets the same answer, even once
+* the document has changed so that it would apply. Anything else (an abort, a
+* lost race with another writer, an engine failure) applied nothing, is not
+* kept, and may run again.
+*/
+const KEPT_REFUSALS = /* @__PURE__ */ new Set([
+	EngineErrorCode.InvalidArg,
+	EngineErrorCode.NotFound,
+	EngineErrorCode.Forbidden,
+	EngineErrorCode.ProtectedDocument,
+	EngineErrorCode.MalformedPdf,
+	EngineErrorCode.PayloadTooLarge,
+	EngineErrorCode.ObjectNumberUnavailable,
+	EngineErrorCode.LayerFull,
+	EngineErrorCode.ChangeConflict,
+	EngineErrorCode.UndoUnavailable
+]);
+/** Whether a change refused with `code` keeps that answer (see `KEPT_REFUSALS`). */
+function isKeptRefusal(code) {
+	return KEPT_REFUSALS.has(code);
+}
+/**
+* What a retry under the same `opId` must send: the change's fingerprint. The
+* same ops with the same bytes give the same fingerprint whatever the order
+* of their keys; bytes count by their content.
+*/
+function changeFingerprint(change) {
+	const text = canonicalJson(change);
+	return `${text.length.toString(36)}-${hashText(text)}`;
+}
+/** `value` as JSON with every object's keys sorted, and bytes as their length and hash. */
+function canonicalJson(value) {
+	if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {
+		const bytes = value instanceof ArrayBuffer ? new Uint8Array(value) : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+		return JSON.stringify({ $bytes: `${bytes.byteLength.toString(36)}-${hashBytes(bytes)}` });
+	}
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+/** A 53-bit hash (cyrb53) of a string's UTF-16 units, in base 36. */
+function hashText(text) {
+	let h1 = 3735928559;
+	let h2 = 1103547991;
+	for (let i = 0; i < text.length; i++) {
+		const unit = text.charCodeAt(i);
+		h1 = Math.imul(h1 ^ unit, 2654435761);
+		h2 = Math.imul(h2 ^ unit, 1597334677);
+	}
+	return finish(h1, h2);
+}
+/** The same hash over bytes. */
+function hashBytes(bytes) {
+	let h1 = 3735928559;
+	let h2 = 1103547991;
+	for (const byte of bytes) {
+		h1 = Math.imul(h1 ^ byte, 2654435761);
+		h2 = Math.imul(h2 ^ byte, 1597334677);
+	}
+	return finish(h1, h2);
+}
+function finish(h1, h2) {
+	h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507);
+	h1 ^= Math.imul(h2 ^ h2 >>> 13, 3266489909);
+	h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507);
+	h2 ^= Math.imul(h1 ^ h1 >>> 13, 3266489909);
+	return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(36);
+}
+//#endregion
+//#region src/auth/scope/pdf-bits.ts
+/**
+* ISO 32000 user-access permission bit positions, expressed as integer
+* masks. Bit numbers in the spec are 1-indexed, so bit 3 = `1 << 2`.
+*
+* Bits 1, 2, 7, 8, and 13+ are reserved and not surfaced here.
+*/
+const PDF_BITS = {
+	/** Bit 3 — print the document. */
+	PRINT: 4,
+	/** Bit 4 — modify content streams. */
+	MODIFY: 8,
+	/** Bit 5 — copy/extract text and graphics. */
+	COPY: 16,
+	/** Bit 6 — annotate + fill forms (+ modify form fields with bit 4). */
+	ANNOTATE_FILL: 32,
+	/** Bit 9 — fill existing forms (even if bit 6 is clear). */
+	FILL_FORMS: 256,
+	/** Bit 10 — accessibility extraction (deprecated in PDF 2.0). */
+	ACCESSIBILITY: 512,
+	/** Bit 11 — assemble document (insert/rotate/delete pages, outline). */
+	ASSEMBLE: 1024,
+	/** Bit 12 — high-quality print (refines bit 3). */
+	PRINT_HIGH: 2048
+};
+/**
+* Decode a raw PDFium permission integer into a typed boolean view.
+*
+* `null` input (the documents row column is nullable until probed)
+* yields all-false bits — i.e., a maximally restrictive interpretation.
+* That keeps `pdf.permissions` expansion safe on unprobed documents.
+*/
+function decodePdfBits(raw) {
+	if (raw === null) return {
+		bit3: false,
+		bit4: false,
+		bit5: false,
+		bit6: false,
+		bit9: false,
+		bit10: false,
+		bit11: false,
+		bit12: false
+	};
+	return {
+		bit3: (raw & PDF_BITS.PRINT) !== 0,
+		bit4: (raw & PDF_BITS.MODIFY) !== 0,
+		bit5: (raw & PDF_BITS.COPY) !== 0,
+		bit6: (raw & PDF_BITS.ANNOTATE_FILL) !== 0,
+		bit9: (raw & PDF_BITS.FILL_FORMS) !== 0,
+		bit10: (raw & PDF_BITS.ACCESSIBILITY) !== 0,
+		bit11: (raw & PDF_BITS.ASSEMBLE) !== 0,
+		bit12: (raw & PDF_BITS.PRINT_HIGH) !== 0
+	};
+}
+//#endregion
+//#region src/auth/scope/authority.ts
+/**
+* Check that the caller may use `capability`: `ProtectedDocument` when a
+* signature in the document took it away, `PermissionDenied` when the
+* grants never gave it.
+*/
+function authorizeCapability(authority, capability) {
+	authorizeUnprotected(authority, capability);
+	const { grants, protection } = authority;
+	if (grants && !checkCapability(capability, grants.scope, grants.pdfBits, protection)) throw new PermissionDenied(capability, "target");
+}
+/** Whether the caller may use `capability`: what {@link authorizeCapability} checks, as a yes or no. */
+function allowsCapability(authority, capability) {
+	const { grants, protection } = authority;
+	if (protection && protectedCapabilities(protection).has(capability)) return false;
+	return !grants || checkCapability(capability, grants.scope, grants.pdfBits, protection);
+}
+/**
+* Check only that no signature in the document took `capability` away
+* (`ProtectedDocument`). Annotation creates, updates and deletes take this
+* for `doc.annotate.modify`; their grants are checked per annotation.
+*/
+function authorizeUnprotected(authority, capability) {
+	const { protection } = authority;
+	if (protection && protectedCapabilities(protection).has(capability)) throw new EngineError(EngineErrorCode.ProtectedDocument, describeProtection(capability, protection));
+}
+/**
+* The capability writing an annotation of `subtype` takes. A widget belongs
+* to a form field, so creating, changing, moving or deleting one is
+* designing the form: `doc.forms.modify`. The annotation scopes
+* (`annotations:*`) never apply to it, and it has no group of its own.
+*/
+function annotationWriteCapability(subtype) {
+	return subtype === "widget" ? "doc.forms.modify" : "doc.annotate.modify";
+}
+/** The capabilities writing all of `annotations` takes, each once. */
+function annotationWriteCapabilities(annotations) {
+	return [...new Set(annotations.map((annotation) => annotationWriteCapability(annotation.subtype)))];
+}
+/**
+* Check a widget write (see {@link annotationWriteCapability}): form design,
+* and no group to set. Returns the actor the write stamps: the editor.
+*/
+function authorizeWidgetWrite(authority, groupId) {
+	const { identity, grants } = authority;
+	if (grants && !checkCapability("doc.forms.modify", grants.scope, grants.pdfBits)) throw new PermissionDenied("doc.forms.modify", "target");
+	if (typeof groupId === "string") throw new EngineError(EngineErrorCode.InvalidArg, "a widget has no group of its own: a form field's group is the field's");
+	const actor = {
+		...identity.userId !== void 0 ? { userId: identity.userId } : {},
+		...identity.displayName !== void 0 ? { displayName: identity.displayName } : {}
+	};
+	return actor.userId || actor.displayName ? actor : void 0;
+}
+/**
+* Check a create of a `subtype` annotation in `groupId` (the identity's own
+* group without one) and return the actor the write stamps: the creator, in
+* that group. A group other than the identity's takes the authority a
+* reassignment takes. A widget takes form design instead, in no group.
+*/
+function authorizeAnnotationCreate(authority, subtype, groupId) {
+	if (subtype === "widget") return authorizeWidgetWrite(authority, groupId);
+	const { identity, grants } = authority;
+	const group = groupId ?? identity.groupId;
+	if (grants) {
+		if (group !== void 0 && !checkSetGroup("annotations", group, identity.groupId, grants.scope)) throw new PermissionDenied(`annotations:set-group:group=${group}`, "target");
+		if (!checkCollab("create", collabTargetOf({
+			userId: identity.userId,
+			groupId: group
+		}), grants.scope, identity, grants.pdfBits)) throw new PermissionDenied("annotations:create", "target");
+	}
+	const actor = {
+		...identity.userId !== void 0 ? { userId: identity.userId } : {},
+		...group !== void 0 ? { groupId: group } : {},
+		...identity.displayName !== void 0 ? { displayName: identity.displayName } : {}
+	};
+	return actor.userId || actor.groupId || actor.displayName ? actor : void 0;
+}
+/**
+* Check an update of the annotation `owner` describes and return the actor
+* the write stamps: the editor, and the group only when the patch reassigns
+* it. An existing group can be reassigned, never removed. A widget takes form
+* design instead, and its patch sets no group.
+*/
+function authorizeAnnotationUpdate(authority, owner, patchGroupId) {
+	if (owner.subtype === "widget") return authorizeWidgetWrite(authority, patchGroupId);
+	const { identity, grants } = authority;
+	const target = collabTargetOf(owner);
+	if (grants && !checkCollab("update", target, grants.scope, identity, grants.pdfBits)) throw new PermissionDenied("annotations:update", "target");
+	if (patchGroupId === null && target.groupId !== void 0) throw new EngineError(EngineErrorCode.InvalidArg, "an annotation's group can't be removed");
+	const reassigning = typeof patchGroupId === "string" && patchGroupId !== target.groupId;
+	if (reassigning && grants && !checkSetGroup("annotations", patchGroupId, identity.groupId, grants.scope)) throw new PermissionDenied(`annotations:set-group:group=${patchGroupId}`, "target");
+	const actor = {
+		...identity.userId !== void 0 ? { userId: identity.userId } : {},
+		...identity.displayName !== void 0 ? { displayName: identity.displayName } : {},
+		...reassigning ? { groupId: patchGroupId } : {}
+	};
+	return actor.userId || actor.groupId || actor.displayName ? actor : void 0;
+}
+/**
+* Check a delete of every annotation it removes (an annotation goes with its
+* thread and popups): all or nothing, `PermissionDenied` naming each one
+* refused. A widget takes form design, never the annotation scopes.
+*/
+function authorizeAnnotationDelete(authority, members) {
+	const { identity, grants } = authority;
+	if (!grants) return;
+	const mayDesign = checkCapability("doc.forms.modify", grants.scope, grants.pdfBits);
+	const refused = members.filter((member) => member.subtype === "widget" ? !mayDesign : !checkCollab("delete", collabTargetOf(member), grants.scope, identity, grants.pdfBits));
+	if (refused.length > 0) throw new PermissionDenied("annotations:delete", "target", void 0, refused.map((member) => member.ref));
+}
+/**
+* Check that the caller may `action` (fill in, or sign) the field in
+* `groupId`: `ProtectedDocument` when a signature in the document took the
+* capability away, `PermissionDenied` naming the scope it would take when
+* the grants don't reach the field's group.
+*/
+function authorizeFieldWrite(authority, groupId, action) {
+	authorizeUnprotected(authority, fieldCapability(action));
+	if (!allowsFieldWrite(authority, groupId, action)) throw new PermissionDenied(groupId === null ? fieldCapability(action) : `fields:${action}:group=${groupId}`, "target");
+}
+/** Whether the caller may `action` the field in `groupId`: what {@link authorizeFieldWrite} checks. */
+function allowsFieldWrite(authority, groupId, action) {
+	const { grants, protection } = authority;
+	if (protection && protectedCapabilities(protection).has(fieldCapability(action))) return false;
+	return !grants || checkFieldAction(action, groupId, grants.scope, grants.pdfBits, protection);
+}
+/**
+* Whether the caller may `action` some field: what a form verb checks
+* before it knows which fields it writes. Each field is then checked in
+* the write with {@link authorizeFieldWrite}.
+*/
+function allowsSomeFieldWrite(authority, action) {
+	const { grants, protection } = authority;
+	if (protection && protectedCapabilities(protection).has(fieldCapability(action))) return false;
+	return !grants || checkAnyFieldAction(action, grants.scope, grants.pdfBits, protection);
+}
+/**
+* Check that the caller may put a form field in `groupId`: their own
+* default group always, another with `fields:set-group` for it.
+*/
+function authorizeFieldGroup(authority, groupId) {
+	const { identity, grants } = authority;
+	if (grants && !checkSetGroup("fields", groupId, identity.groupId, grants.scope)) throw new PermissionDenied(`fields:set-group:group=${groupId}`, "target");
+}
+/** The broad capability a field action takes without a `fields:` scope. */
+function fieldCapability(action) {
+	return action === "fill" ? "doc.forms.fill" : "doc.sign";
+}
+//#endregion
+export { pageListOf as $, sameEffectiveValue as A, refsOf as B, searchQueryOf as C, restrictionsFor as D, USAGE_INCOMPLETE as E, worstVerdict as F, pageFormFieldOf as G, placedWidgetOf as H, changedKeys as I, pdfFormFieldDraftOf as J, pageFormSnapshotOf as K, dictEntries as L, combine as M, conclude as N, evaluateStep as O, primaryFinding as P, pageLayoutOf as Q, parsePdfValue as R, matchPageText as S, EdgeResolver as T, draftWritesScripts as U, stableStringify as V, pageFieldActionsOf as W, pageAppearancesOf as X, pdfWidgetPlacementOf as Y, pdfRenderTargetOf as Z, opIdOf as _, DEFAULT_MEDIA_BOX as _t, annotationWriteCapability as a, concatAnnotationLists as at, SEARCH_SNIPPET_CONTEXT as b, authorizeAnnotationUpdate as c, normalizeAttachmentFileSource as ct, authorizeFieldWrite as d, generateUuidV7 as dt, pageSpaceBoxesOf as et, authorizeUnprotected as f, DEFAULT_PDF_SAVE_MODE as ft, isKeptRefusal as g, resolvePageLayers as gt, changeFingerprint as h, imageSourceOfBytes as ht, annotationWriteCapabilities as i, deletedAnnotationsOf as it, assessmentOf as j, restrictionsOf as k, authorizeCapability as l, familyOfSubtype as lt, decodePdfBits as m, createPageImageHandle as mt, allowsFieldWrite as n, annotationPatchBetween as nt, authorizeAnnotationCreate as o, closeExportSelection as ot, PDF_BITS as p, checkImageQuality as pt, pageWidgetOf as q, allowsSomeFieldWrite as r, mergeAnnotationPatch as rt, authorizeAnnotationDelete as s, annotationImportFacts as st, allowsCapability as t, visibleBoxesOf as tt, authorizeFieldGroup as u, generateUuid as ut, canonicalSearchQuery as v, pageBoxesOf as vt, DEFAULT_EDGE_RESOLVER_BUDGET as w, buildSnippet as x, searchContentEpoch as y, pageRotationOf as yt, pdfValueEquals as z };
+
+//# sourceMappingURL=authority-B3BklsB4.js.map