@embedpdf/engine-core 3.0.0-next.13 → 3.0.0-next.15

package/dist/builders-CNj0POeY.js

@@ -0,0 +1,161 @@
+//#region src/auth/scope/builders.ts
+/**
+* Typed capability constants for customer-side JWT minting.
+*
+* The shape mirrors the dotted capability name so it reads naturally:
+*   caps.doc.text.copy()                  // "doc.text.copy"
+*   caps.doc.download()                   // "doc.download"
+*   caps.doc.download.flattened()         // "doc.download.flattened"
+*   caps.doc.print.high()                 // "doc.print.high"
+*
+* Each leaf is a function returning the literal string (as `const`) so
+* TypeScript catches typos at the call site. Wrappers like `download`
+* and `print` are `Object.assign`'d to be callable and carry child
+* properties for the refinement capabilities.
+*/
+const caps = { doc: {
+	open: () => "doc.open",
+	render: () => "doc.render",
+	text: {
+		select: () => "doc.text.select",
+		copy: () => "doc.text.copy",
+		search: () => "doc.text.search"
+	},
+	content: { copy: () => "doc.content.copy" },
+	download: Object.assign(() => "doc.download", { flattened: () => "doc.download.flattened" }),
+	print: Object.assign(() => "doc.print", { high: () => "doc.print.high" }),
+	pages: {
+		modify: () => "doc.pages.modify",
+		assemble: () => "doc.pages.assemble"
+	},
+	forms: {
+		read: () => "doc.forms.read",
+		fill: () => "doc.forms.fill",
+		modify: () => "doc.forms.modify",
+		import: () => "doc.forms.import",
+		script: () => "doc.forms.script",
+		submit: () => "doc.forms.submit"
+	},
+	annotate: {
+		read: () => "doc.annotate.read",
+		modify: () => "doc.annotate.modify",
+		import: () => "doc.annotate.import"
+	},
+	metadata: { modify: () => "doc.metadata.modify" },
+	attachments: { modify: () => "doc.attachments.modify" },
+	redact: () => "doc.redact",
+	sign: Object.assign(() => "doc.sign", { certify: () => "doc.sign.certify" })
+} };
+/**
+* Builder factory for collab scope filters. Each entity:action pair
+* gets a sub-object with the four filter constructors.
+*
+*   collab.annotations.create.self()           → "annotations:create:self"
+*   collab.annotations.create.group("legal")   → "annotations:create:group=legal"
+*   collab.annotations.update.group("4")       → "annotations:update:group=4"
+*   collab.annotations.delete.createdBy("u-7") → "annotations:delete:createdBy=u-7"
+*   collab.annotations.setGroup.group("legal") → "annotations:set-group:group=legal"
+*   collab.annotations.all.all()               → "annotations:*:all"  (action wildcard)
+*   collab.fields.fill.group("buyer")          → "fields:fill:group=buyer"
+*   collab.fields.sign.group("buyer")          → "fields:sign:group=buyer"
+*   collab.fields.all.group("seller")          → "fields:*:group=seller"
+*
+* On create, the filter is evaluated against the caller's own identity
+* (no impersonation), so `:self` and `:all` trivially pass; `:group=X`
+* is the meaningful filter — it constrains creation to callers whose
+* default group is X.
+*/
+const collab = {
+	annotations: {
+		create: makeFilterBuilder("annotations", "create"),
+		update: makeFilterBuilder("annotations", "update"),
+		delete: makeFilterBuilder("annotations", "delete"),
+		setGroup: makeGroupFilterBuilder("annotations", "set-group"),
+		/** Action wildcard — matches create, update, delete, and set-group with the given filter. */
+		all: makeFilterBuilder("annotations", "*")
+	},
+	/** Form fields, by group: a field records no creator, so only `:all` and `:group=X`. */
+	fields: {
+		fill: makeGroupFilterBuilder("fields", "fill"),
+		sign: makeGroupFilterBuilder("fields", "sign"),
+		setGroup: makeGroupFilterBuilder("fields", "set-group"),
+		/** Action wildcard — matches fill, sign, and set-group with the given filter. */
+		all: makeGroupFilterBuilder("fields", "*")
+	}
+};
+function makeFilterBuilder(entity, action) {
+	return {
+		all: () => `${entity}:${action}:all`,
+		self: () => `${entity}:${action}:self`,
+		createdBy: (userId) => `${entity}:${action}:createdBy=${userId}`,
+		group: (groupId) => `${entity}:${action}:group=${groupId}`
+	};
+}
+function makeGroupFilterBuilder(entity, action) {
+	return {
+		all: () => `${entity}:${action}:all`,
+		group: (groupId) => `${entity}:${action}:group=${groupId}`
+	};
+}
+/**
+* Builder for the `pdf.permissions` virtual scope. Returns the literal
+* string; provided as a helper for parity with caps/collab in JWT
+* construction code.
+*/
+const pdfPermissions = () => "pdf.permissions";
+/**
+* Materialise `pdf.permissions` into the concrete capability list it
+* would expand to under the given PDF bit configuration.
+*
+* Useful when the customer wants to start from PDF defaults and then
+* subtract specific capabilities — easier to build the JWT scope array
+* by filtering an explicit list than by composing virtual + denials.
+*
+*   const defaults = materializePdfPermissions(pdfBits);
+*   const scope = [
+*     ...defaults.filter(s => s !== 'doc.text.copy'),
+*     'doc.download',
+*   ];
+*
+* This is the one reading of the bits: the scope resolver and the
+* permission advisory both use it. It follows what Acrobat allows on a
+* file with these bits, which is broader than ISO 32000 in two places:
+* bit 4 ("changing the document") also allows filling in and signing, and
+* bit 5 ("copying text and graphics") governs taking the text out, not
+* finding or selecting it: Acrobat finds and selects text in a file that
+* forbids copying. A search's snippets reproduce the text, so they need
+* `doc.text.copy`.
+*/
+function materializePdfPermissions(b) {
+	const out = /* @__PURE__ */ new Set();
+	out.add("doc.open");
+	out.add("doc.render");
+	out.add("doc.annotate.read");
+	out.add("doc.forms.read");
+	out.add("doc.text.search");
+	out.add("doc.text.select");
+	if (b.bit5) {
+		out.add("doc.text.copy");
+		out.add("doc.content.copy");
+	}
+	if (b.bit3) out.add("doc.print");
+	if (b.bit12 && b.bit3) out.add("doc.print.high");
+	if (b.bit4) {
+		out.add("doc.pages.modify");
+		out.add("doc.redact");
+		out.add("doc.metadata.modify");
+		out.add("doc.attachments.modify");
+	}
+	if (b.bit4 || b.bit11) out.add("doc.pages.assemble");
+	if (b.bit6) out.add("doc.annotate.modify");
+	if (b.bit4 || b.bit6 || b.bit9) {
+		out.add("doc.forms.fill");
+		out.add("doc.sign");
+	}
+	if (b.bit6 && b.bit4) out.add("doc.forms.modify");
+	return [...out];
+}
+//#endregion
+export { pdfPermissions as i, collab as n, materializePdfPermissions as r, caps as t };
+
+//# sourceMappingURL=builders-CNj0POeY.js.map

package/dist/builders-CNj0POeY.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders-CNj0POeY.js","names":[],"sources":["../src/auth/scope/builders.ts"],"sourcesContent":["import type { DocCapability, PdfBits } from './types';\n\n/**\n * Typed capability constants for customer-side JWT minting.\n *\n * The shape mirrors the dotted capability name so it reads naturally:\n *   caps.doc.text.copy()                  // \"doc.text.copy\"\n *   caps.doc.download()                   // \"doc.download\"\n *   caps.doc.download.flattened()         // \"doc.download.flattened\"\n *   caps.doc.print.high()                 // \"doc.print.high\"\n *\n * Each leaf is a function returning the literal string (as `const`) so\n * TypeScript catches typos at the call site. Wrappers like `download`\n * and `print` are `Object.assign`'d to be callable and carry child\n * properties for the refinement capabilities.\n */\nexport const caps = {\n  doc: {\n    open: () => 'doc.open' as const,\n    render: () => 'doc.render' as const,\n    text: {\n      select: () => 'doc.text.select' as const,\n      copy: () => 'doc.text.copy' as const,\n      search: () => 'doc.text.search' as const,\n    },\n    content: {\n      copy: () => 'doc.content.copy' as const,\n    },\n    download: Object.assign(() => 'doc.download' as const, {\n      flattened: () => 'doc.download.flattened' as const,\n    }),\n    print: Object.assign(() => 'doc.print' as const, {\n      high: () => 'doc.print.high' as const,\n    }),\n    pages: {\n      modify: () => 'doc.pages.modify' as const,\n      assemble: () => 'doc.pages.assemble' as const,\n    },\n    forms: {\n      read: () => 'doc.forms.read' as const,\n      fill: () => 'doc.forms.fill' as const,\n      modify: () => 'doc.forms.modify' as const,\n      import: () => 'doc.forms.import' as const,\n      script: () => 'doc.forms.script' as const,\n      submit: () => 'doc.forms.submit' as const,\n    },\n    annotate: {\n      read: () => 'doc.annotate.read' as const,\n      modify: () => 'doc.annotate.modify' as const,\n      import: () => 'doc.annotate.import' as const,\n    },\n    metadata: {\n      modify: () => 'doc.metadata.modify' as const,\n    },\n    attachments: {\n      modify: () => 'doc.attachments.modify' as const,\n    },\n    redact: () => 'doc.redact' as const,\n    sign: Object.assign(() => 'doc.sign' as const, {\n      certify: () => 'doc.sign.certify' as const,\n    }),\n  },\n} as const;\n\n/**\n * Builder factory for collab scope filters. Each entity:action pair\n * gets a sub-object with the four filter constructors.\n *\n *   collab.annotations.create.self()           → \"annotations:create:self\"\n *   collab.annotations.create.group(\"legal\")   → \"annotations:create:group=legal\"\n *   collab.annotations.update.group(\"4\")       → \"annotations:update:group=4\"\n *   collab.annotations.delete.createdBy(\"u-7\") → \"annotations:delete:createdBy=u-7\"\n *   collab.annotations.setGroup.group(\"legal\") → \"annotations:set-group:group=legal\"\n *   collab.annotations.all.all()               → \"annotations:*:all\"  (action wildcard)\n *   collab.fields.fill.group(\"buyer\")          → \"fields:fill:group=buyer\"\n *   collab.fields.sign.group(\"buyer\")          → \"fields:sign:group=buyer\"\n *   collab.fields.all.group(\"seller\")          → \"fields:*:group=seller\"\n *\n * On create, the filter is evaluated against the caller's own identity\n * (no impersonation), so `:self` and `:all` trivially pass; `:group=X`\n * is the meaningful filter — it constrains creation to callers whose\n * default group is X.\n */\nexport const collab = {\n  annotations: {\n    create: makeFilterBuilder('annotations', 'create'),\n    update: makeFilterBuilder('annotations', 'update'),\n    delete: makeFilterBuilder('annotations', 'delete'),\n    setGroup: makeGroupFilterBuilder('annotations', 'set-group'),\n    /** Action wildcard — matches create, update, delete, and set-group with the given filter. */\n    all: makeFilterBuilder('annotations', '*'),\n  },\n  /** Form fields, by group: a field records no creator, so only `:all` and `:group=X`. */\n  fields: {\n    fill: makeGroupFilterBuilder('fields', 'fill'),\n    sign: makeGroupFilterBuilder('fields', 'sign'),\n    setGroup: makeGroupFilterBuilder('fields', 'set-group'),\n    /** Action wildcard — matches fill, sign, and set-group with the given filter. */\n    all: makeGroupFilterBuilder('fields', '*'),\n  },\n} as const;\n\ninterface FilterBuilder {\n  all(): string;\n  self(): string;\n  createdBy(userId: string): string;\n  group(groupId: string): string;\n}\n\nfunction makeFilterBuilder(entity: string, action: string): FilterBuilder {\n  return {\n    all: () => `${entity}:${action}:all`,\n    self: () => `${entity}:${action}:self`,\n    createdBy: (userId: string) => `${entity}:${action}:createdBy=${userId}`,\n    group: (groupId: string) => `${entity}:${action}:group=${groupId}`,\n  };\n}\n\n/**\n * The scopes that take only `:all` and `:group=X`: `set-group`, an\n * assignment authority rather than a per-record filter (assign-to-any vs\n * assign-to-X), and every field scope, since a field records no creator.\n * The builder exposes exactly those two — a typo at JWT mint time is caught\n * by the compiler instead of producing a JWT that fails at verify.\n */\ninterface GroupFilterBuilder {\n  all(): string;\n  group(groupId: string): string;\n}\n\nfunction makeGroupFilterBuilder(entity: string, action: string): GroupFilterBuilder {\n  return {\n    all: () => `${entity}:${action}:all`,\n    group: (groupId: string) => `${entity}:${action}:group=${groupId}`,\n  };\n}\n\n/**\n * Builder for the `pdf.permissions` virtual scope. Returns the literal\n * string; provided as a helper for parity with caps/collab in JWT\n * construction code.\n */\nexport const pdfPermissions = (): 'pdf.permissions' => 'pdf.permissions';\n\n/**\n * Materialise `pdf.permissions` into the concrete capability list it\n * would expand to under the given PDF bit configuration.\n *\n * Useful when the customer wants to start from PDF defaults and then\n * subtract specific capabilities — easier to build the JWT scope array\n * by filtering an explicit list than by composing virtual + denials.\n *\n *   const defaults = materializePdfPermissions(pdfBits);\n *   const scope = [\n *     ...defaults.filter(s => s !== 'doc.text.copy'),\n *     'doc.download',\n *   ];\n *\n * This is the one reading of the bits: the scope resolver and the\n * permission advisory both use it. It follows what Acrobat allows on a\n * file with these bits, which is broader than ISO 32000 in two places:\n * bit 4 (\"changing the document\") also allows filling in and signing, and\n * bit 5 (\"copying text and graphics\") governs taking the text out, not\n * finding or selecting it: Acrobat finds and selects text in a file that\n * forbids copying. A search's snippets reproduce the text, so they need\n * `doc.text.copy`.\n */\nexport function materializePdfPermissions(b: PdfBits): DocCapability[] {\n  const out = new Set<DocCapability>();\n\n  // Always — pdf.permissions means \"give me a working session\"\n  out.add('doc.open');\n  out.add('doc.render');\n  // Reading existing annotations and form values is unconditional —\n  // PDF bit 6 governs writes, not visibility.\n  out.add('doc.annotate.read');\n  out.add('doc.forms.read');\n  // Finding and selecting text are too: bit 5 governs taking it out.\n  out.add('doc.text.search');\n  out.add('doc.text.select');\n\n  if (b.bit5) {\n    out.add('doc.text.copy');\n    out.add('doc.content.copy');\n  }\n  if (b.bit3) out.add('doc.print');\n  if (b.bit12 && b.bit3) out.add('doc.print.high');\n  if (b.bit4) {\n    out.add('doc.pages.modify');\n    out.add('doc.redact');\n    out.add('doc.metadata.modify');\n    out.add('doc.attachments.modify');\n  }\n  // Bit 11 assembles pages even when bit 4 is clear; bit 4 includes it.\n  if (b.bit4 || b.bit11) out.add('doc.pages.assemble');\n  if (b.bit6) out.add('doc.annotate.modify');\n  // Signing a signature field is filling it in. Acrobat (and PDFium's form\n  // filler) let any of the three bits fill in.\n  if (b.bit4 || b.bit6 || b.bit9) {\n    out.add('doc.forms.fill');\n    out.add('doc.sign');\n  }\n  // Changing existing fields takes both: Acrobat keeps them in fill mode\n  // under bit 4 alone, and offers no form tools under bit 6 or 9 alone.\n  if (b.bit6 && b.bit4) out.add('doc.forms.modify');\n\n  return [...out];\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAa,OAAO,EAClB,KAAK;CACH,YAAY;CACZ,cAAc;CACd,MAAM;EACJ,cAAc;EACd,YAAY;EACZ,cAAc;CAChB;CACA,SAAS,EACP,YAAY,mBACd;CACA,UAAU,OAAO,aAAa,gBAAyB,EACrD,iBAAiB,yBACnB,CAAC;CACD,OAAO,OAAO,aAAa,aAAsB,EAC/C,YAAY,iBACd,CAAC;CACD,OAAO;EACL,cAAc;EACd,gBAAgB;CAClB;CACA,OAAO;EACL,YAAY;EACZ,YAAY;EACZ,cAAc;EACd,cAAc;EACd,cAAc;EACd,cAAc;CAChB;CACA,UAAU;EACR,YAAY;EACZ,cAAc;EACd,cAAc;CAChB;CACA,UAAU,EACR,cAAc,sBAChB;CACA,aAAa,EACX,cAAc,yBAChB;CACA,cAAc;CACd,MAAM,OAAO,aAAa,YAAqB,EAC7C,eAAe,mBACjB,CAAC;AACH,EACF;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,SAAS;CACpB,aAAa;EACX,QAAQ,kBAAkB,eAAe,QAAQ;EACjD,QAAQ,kBAAkB,eAAe,QAAQ;EACjD,QAAQ,kBAAkB,eAAe,QAAQ;EACjD,UAAU,uBAAuB,eAAe,WAAW;;EAE3D,KAAK,kBAAkB,eAAe,GAAG;CAC3C;;CAEA,QAAQ;EACN,MAAM,uBAAuB,UAAU,MAAM;EAC7C,MAAM,uBAAuB,UAAU,MAAM;EAC7C,UAAU,uBAAuB,UAAU,WAAW;;EAEtD,KAAK,uBAAuB,UAAU,GAAG;CAC3C;AACF;AASA,SAAS,kBAAkB,QAAgB,QAA+B;CACxE,OAAO;EACL,WAAW,GAAG,OAAO,GAAG,OAAO;EAC/B,YAAY,GAAG,OAAO,GAAG,OAAO;EAChC,YAAY,WAAmB,GAAG,OAAO,GAAG,OAAO,aAAa;EAChE,QAAQ,YAAoB,GAAG,OAAO,GAAG,OAAO,SAAS;CAC3D;AACF;AAcA,SAAS,uBAAuB,QAAgB,QAAoC;CAClF,OAAO;EACL,WAAW,GAAG,OAAO,GAAG,OAAO;EAC/B,QAAQ,YAAoB,GAAG,OAAO,GAAG,OAAO,SAAS;CAC3D;AACF;;;;;;AAOA,MAAa,uBAA0C;;;;;;;;;;;;;;;;;;;;;;;;AAyBvD,SAAgB,0BAA0B,GAA6B;CACrE,MAAM,sBAAM,IAAI,IAAmB;CAGnC,IAAI,IAAI,UAAU;CAClB,IAAI,IAAI,YAAY;CAGpB,IAAI,IAAI,mBAAmB;CAC3B,IAAI,IAAI,gBAAgB;CAExB,IAAI,IAAI,iBAAiB;CACzB,IAAI,IAAI,iBAAiB;CAEzB,IAAI,EAAE,MAAM;EACV,IAAI,IAAI,eAAe;EACvB,IAAI,IAAI,kBAAkB;CAC5B;CACA,IAAI,EAAE,MAAM,IAAI,IAAI,WAAW;CAC/B,IAAI,EAAE,SAAS,EAAE,MAAM,IAAI,IAAI,gBAAgB;CAC/C,IAAI,EAAE,MAAM;EACV,IAAI,IAAI,kBAAkB;EAC1B,IAAI,IAAI,YAAY;EACpB,IAAI,IAAI,qBAAqB;EAC7B,IAAI,IAAI,wBAAwB;CAClC;CAEA,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI,oBAAoB;CACnD,IAAI,EAAE,MAAM,IAAI,IAAI,qBAAqB;CAGzC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM;EAC9B,IAAI,IAAI,gBAAgB;EACxB,IAAI,IAAI,UAAU;CACpB;CAGA,IAAI,EAAE,QAAQ,EAAE,MAAM,IAAI,IAAI,kBAAkB;CAEhD,OAAO,CAAC,GAAG,GAAG;AAChB"}

package/dist/builders-Cgdp_YCn.cjs

@@ -0,0 +1,184 @@
+//#region src/auth/scope/builders.ts
+/**
+* Typed capability constants for customer-side JWT minting.
+*
+* The shape mirrors the dotted capability name so it reads naturally:
+*   caps.doc.text.copy()                  // "doc.text.copy"
+*   caps.doc.download()                   // "doc.download"
+*   caps.doc.download.flattened()         // "doc.download.flattened"
+*   caps.doc.print.high()                 // "doc.print.high"
+*
+* Each leaf is a function returning the literal string (as `const`) so
+* TypeScript catches typos at the call site. Wrappers like `download`
+* and `print` are `Object.assign`'d to be callable and carry child
+* properties for the refinement capabilities.
+*/
+const caps = { doc: {
+	open: () => "doc.open",
+	render: () => "doc.render",
+	text: {
+		select: () => "doc.text.select",
+		copy: () => "doc.text.copy",
+		search: () => "doc.text.search"
+	},
+	content: { copy: () => "doc.content.copy" },
+	download: Object.assign(() => "doc.download", { flattened: () => "doc.download.flattened" }),
+	print: Object.assign(() => "doc.print", { high: () => "doc.print.high" }),
+	pages: {
+		modify: () => "doc.pages.modify",
+		assemble: () => "doc.pages.assemble"
+	},
+	forms: {
+		read: () => "doc.forms.read",
+		fill: () => "doc.forms.fill",
+		modify: () => "doc.forms.modify",
+		import: () => "doc.forms.import",
+		script: () => "doc.forms.script",
+		submit: () => "doc.forms.submit"
+	},
+	annotate: {
+		read: () => "doc.annotate.read",
+		modify: () => "doc.annotate.modify",
+		import: () => "doc.annotate.import"
+	},
+	metadata: { modify: () => "doc.metadata.modify" },
+	attachments: { modify: () => "doc.attachments.modify" },
+	redact: () => "doc.redact",
+	sign: Object.assign(() => "doc.sign", { certify: () => "doc.sign.certify" })
+} };
+/**
+* Builder factory for collab scope filters. Each entity:action pair
+* gets a sub-object with the four filter constructors.
+*
+*   collab.annotations.create.self()           → "annotations:create:self"
+*   collab.annotations.create.group("legal")   → "annotations:create:group=legal"
+*   collab.annotations.update.group("4")       → "annotations:update:group=4"
+*   collab.annotations.delete.createdBy("u-7") → "annotations:delete:createdBy=u-7"
+*   collab.annotations.setGroup.group("legal") → "annotations:set-group:group=legal"
+*   collab.annotations.all.all()               → "annotations:*:all"  (action wildcard)
+*   collab.fields.fill.group("buyer")          → "fields:fill:group=buyer"
+*   collab.fields.sign.group("buyer")          → "fields:sign:group=buyer"
+*   collab.fields.all.group("seller")          → "fields:*:group=seller"
+*
+* On create, the filter is evaluated against the caller's own identity
+* (no impersonation), so `:self` and `:all` trivially pass; `:group=X`
+* is the meaningful filter — it constrains creation to callers whose
+* default group is X.
+*/
+const collab = {
+	annotations: {
+		create: makeFilterBuilder("annotations", "create"),
+		update: makeFilterBuilder("annotations", "update"),
+		delete: makeFilterBuilder("annotations", "delete"),
+		setGroup: makeGroupFilterBuilder("annotations", "set-group"),
+		/** Action wildcard — matches create, update, delete, and set-group with the given filter. */
+		all: makeFilterBuilder("annotations", "*")
+	},
+	/** Form fields, by group: a field records no creator, so only `:all` and `:group=X`. */
+	fields: {
+		fill: makeGroupFilterBuilder("fields", "fill"),
+		sign: makeGroupFilterBuilder("fields", "sign"),
+		setGroup: makeGroupFilterBuilder("fields", "set-group"),
+		/** Action wildcard — matches fill, sign, and set-group with the given filter. */
+		all: makeGroupFilterBuilder("fields", "*")
+	}
+};
+function makeFilterBuilder(entity, action) {
+	return {
+		all: () => `${entity}:${action}:all`,
+		self: () => `${entity}:${action}:self`,
+		createdBy: (userId) => `${entity}:${action}:createdBy=${userId}`,
+		group: (groupId) => `${entity}:${action}:group=${groupId}`
+	};
+}
+function makeGroupFilterBuilder(entity, action) {
+	return {
+		all: () => `${entity}:${action}:all`,
+		group: (groupId) => `${entity}:${action}:group=${groupId}`
+	};
+}
+/**
+* Builder for the `pdf.permissions` virtual scope. Returns the literal
+* string; provided as a helper for parity with caps/collab in JWT
+* construction code.
+*/
+const pdfPermissions = () => "pdf.permissions";
+/**
+* Materialise `pdf.permissions` into the concrete capability list it
+* would expand to under the given PDF bit configuration.
+*
+* Useful when the customer wants to start from PDF defaults and then
+* subtract specific capabilities — easier to build the JWT scope array
+* by filtering an explicit list than by composing virtual + denials.
+*
+*   const defaults = materializePdfPermissions(pdfBits);
+*   const scope = [
+*     ...defaults.filter(s => s !== 'doc.text.copy'),
+*     'doc.download',
+*   ];
+*
+* This is the one reading of the bits: the scope resolver and the
+* permission advisory both use it. It follows what Acrobat allows on a
+* file with these bits, which is broader than ISO 32000 in two places:
+* bit 4 ("changing the document") also allows filling in and signing, and
+* bit 5 ("copying text and graphics") governs taking the text out, not
+* finding or selecting it: Acrobat finds and selects text in a file that
+* forbids copying. A search's snippets reproduce the text, so they need
+* `doc.text.copy`.
+*/
+function materializePdfPermissions(b) {
+	const out = /* @__PURE__ */ new Set();
+	out.add("doc.open");
+	out.add("doc.render");
+	out.add("doc.annotate.read");
+	out.add("doc.forms.read");
+	out.add("doc.text.search");
+	out.add("doc.text.select");
+	if (b.bit5) {
+		out.add("doc.text.copy");
+		out.add("doc.content.copy");
+	}
+	if (b.bit3) out.add("doc.print");
+	if (b.bit12 && b.bit3) out.add("doc.print.high");
+	if (b.bit4) {
+		out.add("doc.pages.modify");
+		out.add("doc.redact");
+		out.add("doc.metadata.modify");
+		out.add("doc.attachments.modify");
+	}
+	if (b.bit4 || b.bit11) out.add("doc.pages.assemble");
+	if (b.bit6) out.add("doc.annotate.modify");
+	if (b.bit4 || b.bit6 || b.bit9) {
+		out.add("doc.forms.fill");
+		out.add("doc.sign");
+	}
+	if (b.bit6 && b.bit4) out.add("doc.forms.modify");
+	return [...out];
+}
+//#endregion
+Object.defineProperty(exports, "caps", {
+	enumerable: true,
+	get: function() {
+		return caps;
+	}
+});
+Object.defineProperty(exports, "collab", {
+	enumerable: true,
+	get: function() {
+		return collab;
+	}
+});
+Object.defineProperty(exports, "materializePdfPermissions", {
+	enumerable: true,
+	get: function() {
+		return materializePdfPermissions;
+	}
+});
+Object.defineProperty(exports, "pdfPermissions", {
+	enumerable: true,
+	get: function() {
+		return pdfPermissions;
+	}
+});
+
+//# sourceMappingURL=builders-Cgdp_YCn.cjs.map

package/dist/builders-Cgdp_YCn.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders-Cgdp_YCn.cjs","names":[],"sources":["../src/auth/scope/builders.ts"],"sourcesContent":["import type { DocCapability, PdfBits } from './types';\n\n/**\n * Typed capability constants for customer-side JWT minting.\n *\n * The shape mirrors the dotted capability name so it reads naturally:\n *   caps.doc.text.copy()                  // \"doc.text.copy\"\n *   caps.doc.download()                   // \"doc.download\"\n *   caps.doc.download.flattened()         // \"doc.download.flattened\"\n *   caps.doc.print.high()                 // \"doc.print.high\"\n *\n * Each leaf is a function returning the literal string (as `const`) so\n * TypeScript catches typos at the call site. Wrappers like `download`\n * and `print` are `Object.assign`'d to be callable and carry child\n * properties for the refinement capabilities.\n */\nexport const caps = {\n  doc: {\n    open: () => 'doc.open' as const,\n    render: () => 'doc.render' as const,\n    text: {\n      select: () => 'doc.text.select' as const,\n      copy: () => 'doc.text.copy' as const,\n      search: () => 'doc.text.search' as const,\n    },\n    content: {\n      copy: () => 'doc.content.copy' as const,\n    },\n    download: Object.assign(() => 'doc.download' as const, {\n      flattened: () => 'doc.download.flattened' as const,\n    }),\n    print: Object.assign(() => 'doc.print' as const, {\n      high: () => 'doc.print.high' as const,\n    }),\n    pages: {\n      modify: () => 'doc.pages.modify' as const,\n      assemble: () => 'doc.pages.assemble' as const,\n    },\n    forms: {\n      read: () => 'doc.forms.read' as const,\n      fill: () => 'doc.forms.fill' as const,\n      modify: () => 'doc.forms.modify' as const,\n      import: () => 'doc.forms.import' as const,\n      script: () => 'doc.forms.script' as const,\n      submit: () => 'doc.forms.submit' as const,\n    },\n    annotate: {\n      read: () => 'doc.annotate.read' as const,\n      modify: () => 'doc.annotate.modify' as const,\n      import: () => 'doc.annotate.import' as const,\n    },\n    metadata: {\n      modify: () => 'doc.metadata.modify' as const,\n    },\n    attachments: {\n      modify: () => 'doc.attachments.modify' as const,\n    },\n    redact: () => 'doc.redact' as const,\n    sign: Object.assign(() => 'doc.sign' as const, {\n      certify: () => 'doc.sign.certify' as const,\n    }),\n  },\n} as const;\n\n/**\n * Builder factory for collab scope filters. Each entity:action pair\n * gets a sub-object with the four filter constructors.\n *\n *   collab.annotations.create.self()           → \"annotations:create:self\"\n *   collab.annotations.create.group(\"legal\")   → \"annotations:create:group=legal\"\n *   collab.annotations.update.group(\"4\")       → \"annotations:update:group=4\"\n *   collab.annotations.delete.createdBy(\"u-7\") → \"annotations:delete:createdBy=u-7\"\n *   collab.annotations.setGroup.group(\"legal\") → \"annotations:set-group:group=legal\"\n *   collab.annotations.all.all()               → \"annotations:*:all\"  (action wildcard)\n *   collab.fields.fill.group(\"buyer\")          → \"fields:fill:group=buyer\"\n *   collab.fields.sign.group(\"buyer\")          → \"fields:sign:group=buyer\"\n *   collab.fields.all.group(\"seller\")          → \"fields:*:group=seller\"\n *\n * On create, the filter is evaluated against the caller's own identity\n * (no impersonation), so `:self` and `:all` trivially pass; `:group=X`\n * is the meaningful filter — it constrains creation to callers whose\n * default group is X.\n */\nexport const collab = {\n  annotations: {\n    create: makeFilterBuilder('annotations', 'create'),\n    update: makeFilterBuilder('annotations', 'update'),\n    delete: makeFilterBuilder('annotations', 'delete'),\n    setGroup: makeGroupFilterBuilder('annotations', 'set-group'),\n    /** Action wildcard — matches create, update, delete, and set-group with the given filter. */\n    all: makeFilterBuilder('annotations', '*'),\n  },\n  /** Form fields, by group: a field records no creator, so only `:all` and `:group=X`. */\n  fields: {\n    fill: makeGroupFilterBuilder('fields', 'fill'),\n    sign: makeGroupFilterBuilder('fields', 'sign'),\n    setGroup: makeGroupFilterBuilder('fields', 'set-group'),\n    /** Action wildcard — matches fill, sign, and set-group with the given filter. */\n    all: makeGroupFilterBuilder('fields', '*'),\n  },\n} as const;\n\ninterface FilterBuilder {\n  all(): string;\n  self(): string;\n  createdBy(userId: string): string;\n  group(groupId: string): string;\n}\n\nfunction makeFilterBuilder(entity: string, action: string): FilterBuilder {\n  return {\n    all: () => `${entity}:${action}:all`,\n    self: () => `${entity}:${action}:self`,\n    createdBy: (userId: string) => `${entity}:${action}:createdBy=${userId}`,\n    group: (groupId: string) => `${entity}:${action}:group=${groupId}`,\n  };\n}\n\n/**\n * The scopes that take only `:all` and `:group=X`: `set-group`, an\n * assignment authority rather than a per-record filter (assign-to-any vs\n * assign-to-X), and every field scope, since a field records no creator.\n * The builder exposes exactly those two — a typo at JWT mint time is caught\n * by the compiler instead of producing a JWT that fails at verify.\n */\ninterface GroupFilterBuilder {\n  all(): string;\n  group(groupId: string): string;\n}\n\nfunction makeGroupFilterBuilder(entity: string, action: string): GroupFilterBuilder {\n  return {\n    all: () => `${entity}:${action}:all`,\n    group: (groupId: string) => `${entity}:${action}:group=${groupId}`,\n  };\n}\n\n/**\n * Builder for the `pdf.permissions` virtual scope. Returns the literal\n * string; provided as a helper for parity with caps/collab in JWT\n * construction code.\n */\nexport const pdfPermissions = (): 'pdf.permissions' => 'pdf.permissions';\n\n/**\n * Materialise `pdf.permissions` into the concrete capability list it\n * would expand to under the given PDF bit configuration.\n *\n * Useful when the customer wants to start from PDF defaults and then\n * subtract specific capabilities — easier to build the JWT scope array\n * by filtering an explicit list than by composing virtual + denials.\n *\n *   const defaults = materializePdfPermissions(pdfBits);\n *   const scope = [\n *     ...defaults.filter(s => s !== 'doc.text.copy'),\n *     'doc.download',\n *   ];\n *\n * This is the one reading of the bits: the scope resolver and the\n * permission advisory both use it. It follows what Acrobat allows on a\n * file with these bits, which is broader than ISO 32000 in two places:\n * bit 4 (\"changing the document\") also allows filling in and signing, and\n * bit 5 (\"copying text and graphics\") governs taking the text out, not\n * finding or selecting it: Acrobat finds and selects text in a file that\n * forbids copying. A search's snippets reproduce the text, so they need\n * `doc.text.copy`.\n */\nexport function materializePdfPermissions(b: PdfBits): DocCapability[] {\n  const out = new Set<DocCapability>();\n\n  // Always — pdf.permissions means \"give me a working session\"\n  out.add('doc.open');\n  out.add('doc.render');\n  // Reading existing annotations and form values is unconditional —\n  // PDF bit 6 governs writes, not visibility.\n  out.add('doc.annotate.read');\n  out.add('doc.forms.read');\n  // Finding and selecting text are too: bit 5 governs taking it out.\n  out.add('doc.text.search');\n  out.add('doc.text.select');\n\n  if (b.bit5) {\n    out.add('doc.text.copy');\n    out.add('doc.content.copy');\n  }\n  if (b.bit3) out.add('doc.print');\n  if (b.bit12 && b.bit3) out.add('doc.print.high');\n  if (b.bit4) {\n    out.add('doc.pages.modify');\n    out.add('doc.redact');\n    out.add('doc.metadata.modify');\n    out.add('doc.attachments.modify');\n  }\n  // Bit 11 assembles pages even when bit 4 is clear; bit 4 includes it.\n  if (b.bit4 || b.bit11) out.add('doc.pages.assemble');\n  if (b.bit6) out.add('doc.annotate.modify');\n  // Signing a signature field is filling it in. Acrobat (and PDFium's form\n  // filler) let any of the three bits fill in.\n  if (b.bit4 || b.bit6 || b.bit9) {\n    out.add('doc.forms.fill');\n    out.add('doc.sign');\n  }\n  // Changing existing fields takes both: Acrobat keeps them in fill mode\n  // under bit 4 alone, and offers no form tools under bit 6 or 9 alone.\n  if (b.bit6 && b.bit4) out.add('doc.forms.modify');\n\n  return [...out];\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAa,OAAO,EAClB,KAAK;CACH,YAAY;CACZ,cAAc;CACd,MAAM;EACJ,cAAc;EACd,YAAY;EACZ,cAAc;CAChB;CACA,SAAS,EACP,YAAY,mBACd;CACA,UAAU,OAAO,aAAa,gBAAyB,EACrD,iBAAiB,yBACnB,CAAC;CACD,OAAO,OAAO,aAAa,aAAsB,EAC/C,YAAY,iBACd,CAAC;CACD,OAAO;EACL,cAAc;EACd,gBAAgB;CAClB;CACA,OAAO;EACL,YAAY;EACZ,YAAY;EACZ,cAAc;EACd,cAAc;EACd,cAAc;EACd,cAAc;CAChB;CACA,UAAU;EACR,YAAY;EACZ,cAAc;EACd,cAAc;CAChB;CACA,UAAU,EACR,cAAc,sBAChB;CACA,aAAa,EACX,cAAc,yBAChB;CACA,cAAc;CACd,MAAM,OAAO,aAAa,YAAqB,EAC7C,eAAe,mBACjB,CAAC;AACH,EACF;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,SAAS;CACpB,aAAa;EACX,QAAQ,kBAAkB,eAAe,QAAQ;EACjD,QAAQ,kBAAkB,eAAe,QAAQ;EACjD,QAAQ,kBAAkB,eAAe,QAAQ;EACjD,UAAU,uBAAuB,eAAe,WAAW;;EAE3D,KAAK,kBAAkB,eAAe,GAAG;CAC3C;;CAEA,QAAQ;EACN,MAAM,uBAAuB,UAAU,MAAM;EAC7C,MAAM,uBAAuB,UAAU,MAAM;EAC7C,UAAU,uBAAuB,UAAU,WAAW;;EAEtD,KAAK,uBAAuB,UAAU,GAAG;CAC3C;AACF;AASA,SAAS,kBAAkB,QAAgB,QAA+B;CACxE,OAAO;EACL,WAAW,GAAG,OAAO,GAAG,OAAO;EAC/B,YAAY,GAAG,OAAO,GAAG,OAAO;EAChC,YAAY,WAAmB,GAAG,OAAO,GAAG,OAAO,aAAa;EAChE,QAAQ,YAAoB,GAAG,OAAO,GAAG,OAAO,SAAS;CAC3D;AACF;AAcA,SAAS,uBAAuB,QAAgB,QAAoC;CAClF,OAAO;EACL,WAAW,GAAG,OAAO,GAAG,OAAO;EAC/B,QAAQ,YAAoB,GAAG,OAAO,GAAG,OAAO,SAAS;CAC3D;AACF;;;;;;AAOA,MAAa,uBAA0C;;;;;;;;;;;;;;;;;;;;;;;;AAyBvD,SAAgB,0BAA0B,GAA6B;CACrE,MAAM,sBAAM,IAAI,IAAmB;CAGnC,IAAI,IAAI,UAAU;CAClB,IAAI,IAAI,YAAY;CAGpB,IAAI,IAAI,mBAAmB;CAC3B,IAAI,IAAI,gBAAgB;CAExB,IAAI,IAAI,iBAAiB;CACzB,IAAI,IAAI,iBAAiB;CAEzB,IAAI,EAAE,MAAM;EACV,IAAI,IAAI,eAAe;EACvB,IAAI,IAAI,kBAAkB;CAC5B;CACA,IAAI,EAAE,MAAM,IAAI,IAAI,WAAW;CAC/B,IAAI,EAAE,SAAS,EAAE,MAAM,IAAI,IAAI,gBAAgB;CAC/C,IAAI,EAAE,MAAM;EACV,IAAI,IAAI,kBAAkB;EAC1B,IAAI,IAAI,YAAY;EACpB,IAAI,IAAI,qBAAqB;EAC7B,IAAI,IAAI,wBAAwB;CAClC;CAEA,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI,oBAAoB;CACnD,IAAI,EAAE,MAAM,IAAI,IAAI,qBAAqB;CAGzC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM;EAC9B,IAAI,IAAI,gBAAgB;EACxB,IAAI,IAAI,UAAU;CACpB;CAGA,IAAI,EAAE,QAAQ,EAAE,MAAM,IAAI,IAAI,kBAAkB;CAEhD,OAAO,CAAC,GAAG,GAAG;AAChB"}