@embedpdf/engine-core 3.0.0-next.13 → 3.0.0-next.15

package/dist/builders-Bqm8yTpi.cjs

@@ -1,3564 +0,0 @@
-const require_fold = require("./fold-2V29cxCV.cjs");
-const require_PageInsertBlankInput = require("./PageInsertBlankInput-CqXBmFhN.cjs");
-const require_resolver = require("./resolver-CYVNV4hn.cjs");
-//#region src/dto/PdfAction.ts
-/**
-* The one Table-240 decode, shared by the reader, the schema's producers,
-* and tests — so bit semantics cannot fork.
-*/
-const decodeSubmitFormFlags = (raw) => {
-	const bit = (n) => (raw & 1 << n - 1) !== 0;
-	const format = bit(9) ? "pdf" : bit(6) ? "xfdf" : bit(3) ? "html" : "fdf";
-	return {
-		raw,
-		exclude: bit(1),
-		includeNoValueFields: bit(2),
-		format,
-		method: bit(4) && (format === "html" || format === "pdf") ? "get" : "post",
-		submitCoordinates: bit(5),
-		includeAppendSaves: bit(7),
-		includeAnnotations: bit(8),
-		canonicalFormat: bit(10),
-		exclNonUserAnnots: bit(11),
-		exclFKey: bit(12),
-		embedForm: bit(14)
-	};
-};
-//#endregion
-//#region src/dto/PageRender.ts
-function createPageImageHandle(result, blobSource) {
-	return {
-		...result,
-		async objectUrl(signal) {
-			if (typeof Blob === "undefined" || typeof URL === "undefined" || !URL.createObjectURL) throw new require_fold.EngineError(require_PageInsertBlankInput.EngineErrorCode.RuntimeUnavailable, "Object URLs are not available in this environment");
-			const blob = await blobSource.blob(signal);
-			const url = URL.createObjectURL(blob);
-			return {
-				url,
-				revoke: () => URL.revokeObjectURL(url)
-			};
-		}
-	};
-}
-//#endregion
-//#region src/dto/PdfSaveMode.ts
-const DEFAULT_PDF_SAVE_MODE = "incremental";
-//#endregion
-//#region src/dto/RichText.ts
-/** The plain-text projection of a rich document: paragraphs joined by `\r`,
-*  runs concatenated — what the engine writes to `/Contents`. */
-function richTextPlainText(doc) {
-	return doc.paragraphs.map((p) => p.runs.map((r) => r.text).join("")).join("\r");
-}
-/** Plain text as rich paragraphs: one per line break, one run each, no
-*  overrides (the engine's own `/Contents` fallback shape). */
-function richTextParagraphsFromPlainText(text) {
-	return text.split(/\r\n|\r|\n/).map((line) => ({ runs: [{ text: line }] }));
-}
-//#endregion
-//#region src/identity/PageObjectNumber.ts
-/**
-* Type guard for the rare malformed-PDF case where a page is a direct
-* object. The engine treats `0` as malformed and throws `EngineError(NotFound)`
-* before any page-level operation.
-*/
-function isValidPageObjectNumber(value) {
-	return typeof value === "number" && Number.isInteger(value) && value > 0;
-}
-//#endregion
-//#region src/identity/AnnotationStableId.ts
-/**
-* URL-safe encoding of a stable id, used by the cloud HTTP surface as the
-* `:annotKey` route parameter. Decoded by the server back into an
-* `AnnotationStableId` via `decodeStableIdKey`.
-*
-* Format:
-*   `{ kind: 'objectNumber', value: 42 }` -> `'obj:42'`
-*   `{ kind: 'nm', value: 'foo bar' }`    -> `'nm:foo bar'`
-*
-* The caller is responsible for `encodeURIComponent`-ing the result before
-* splicing it into a URL path; `wirePaths.layerAnnotationByKey` already does
-* that. /NM values are opaque strings and may contain anything; the
-* `nm:` prefix lets the decoder distinguish them from numeric ids
-* unambiguously.
-*/
-function encodeStableIdKey(id) {
-	if (id.kind === "objectNumber") {
-		if (!Number.isInteger(id.value) || id.value <= 0) throw new RangeError(`encodeStableIdKey: objectNumber must be a positive integer, got ${id.value}`);
-		return `obj:${id.value}`;
-	}
-	return `nm:${id.value}`;
-}
-/**
-* Inverse of `encodeStableIdKey`. Returns `null` for malformed input so
-* the server can answer 400 InvalidArg with a useful message instead of
-* throwing.
-*
-* The input is the already-`decodeURIComponent`-ed segment from the route
-* path. Empty `/NM` values are rejected: `nm:` with no suffix is not a
-* valid identity.
-*/
-function decodeStableIdKey(key) {
-	if (key.startsWith("obj:")) {
-		const rest = key.slice(4);
-		const n = Number.parseInt(rest, 10);
-		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
-		return {
-			kind: "objectNumber",
-			value: n
-		};
-	}
-	if (key.startsWith("nm:")) {
-		const value = key.slice(3);
-		if (value.length === 0) return null;
-		return {
-			kind: "nm",
-			value
-		};
-	}
-	return null;
-}
-//#endregion
-//#region src/revision/RevisionToken.ts
-function revisionTokensEqual(a, b) {
-	return a.docSessionId === b.docSessionId && a.pageObjectNumber === b.pageObjectNumber && a.generation === b.generation;
-}
-//#endregion
-//#region src/revision/WeakAnnotationState.ts
-const UNKNOWN_WEAK_ANNOTATION_STATE = { kind: "unknown" };
-function knownWeakAnnotationState(hasAnyWeakAnnotations) {
-	return {
-		kind: "known",
-		hasAnyWeakAnnotations
-	};
-}
-//#endregion
-//#region src/annotation/primitives.ts
-const NO_ANNOTATION_FLAGS = {
-	invisible: false,
-	hidden: false,
-	print: false,
-	noZoom: false,
-	noRotate: false,
-	noView: false,
-	readOnly: false,
-	locked: false,
-	toggleNoView: false,
-	lockedContents: false
-};
-//#endregion
-//#region src/resource/BinarySource.ts
-function isBlob(value) {
-	return typeof Blob !== "undefined" && value instanceof Blob;
-}
-/**
-* Copy a Uint8Array view into a fresh, exactly-sized ArrayBuffer the call
-* owns. Always copies — even when the view spans its whole buffer — because
-* the result may be transferred to a worker (detaching it), and the view is
-* the caller's. Returning `view.buffer` here would let one transfer zero
-* the caller's bytes (a stamp library's Uint8Array became single-use).
-* Callers wanting a zero-copy hand-off need an explicit "give" form, as
-* `pages.insert` has for bare ArrayBuffers; `BinarySource` has none.
-*/
-function toOwnedArrayBuffer(view) {
-	const copy = new ArrayBuffer(view.byteLength);
-	new Uint8Array(copy).set(view);
-	return copy;
-}
-/**
-* Resolve any accepted `BinarySource` form into a `WireResource`.
-* Async because Blob bytes can only be read asynchronously.
-*/
-async function resolveBinarySource(source) {
-	if (source instanceof Uint8Array) return { bytes: toOwnedArrayBuffer(source) };
-	if (isBlob(source)) {
-		const blobName = blobFileName(source);
-		return {
-			bytes: await source.arrayBuffer(),
-			mimeType: source.type || void 0,
-			...blobName !== void 0 ? { name: blobName } : {}
-		};
-	}
-	const { data, mimeType, name } = source;
-	const inner = data instanceof Uint8Array ? {
-		bytes: toOwnedArrayBuffer(data),
-		mimeType: void 0,
-		name: void 0
-	} : {
-		bytes: await data.arrayBuffer(),
-		mimeType: data.type || void 0,
-		name: blobFileName(data)
-	};
-	const resolvedName = name ?? inner.name;
-	return {
-		bytes: inner.bytes,
-		...mimeType ?? inner.mimeType ? { mimeType: mimeType ?? inner.mimeType } : {},
-		...resolvedName !== void 0 ? { name: resolvedName } : {}
-	};
-}
-/** A browser `File` is a Blob with a `name` — pick it up so attachment
-*  drafts can pass a `File` directly without repeating the file name. */
-function blobFileName(blob) {
-	const name = blob.name;
-	return typeof name === "string" && name.length > 0 ? name : void 0;
-}
-//#endregion
-//#region src/resource/binaryMetadata.ts
-/**
-* Detect format (and intrinsic dimensions for rasters) of a binary buffer.
-*
-* @returns metadata, or `null` for unsupported/corrupt data
-*/
-function sniffBinaryMetadata(buffer) {
-	if (buffer.byteLength < 4) return null;
-	const bytes = new Uint8Array(buffer);
-	if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) return parsePng(buffer);
-	if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return parseJpeg(buffer);
-	if (bytes[0] === 37 && bytes[1] === 80 && bytes[2] === 68 && bytes[3] === 70) return { mimeType: "application/pdf" };
-	return null;
-}
-function parsePng(buffer) {
-	if (buffer.byteLength < 24) return null;
-	const view = new DataView(buffer);
-	const width = view.getUint32(16);
-	const height = view.getUint32(20);
-	if (width === 0 || height === 0) return null;
-	return {
-		mimeType: "image/png",
-		width,
-		height
-	};
-}
-function parseJpeg(buffer) {
-	const bytes = new Uint8Array(buffer);
-	let offset = 2;
-	while (offset + 4 < bytes.byteLength) {
-		if (bytes[offset] !== 255) return null;
-		const marker = bytes[offset + 1];
-		if (marker >= 192 && marker <= 195) {
-			if (offset + 9 > bytes.byteLength) return null;
-			const view = new DataView(buffer, offset + 5);
-			const height = view.getUint16(0);
-			const width = view.getUint16(2);
-			if (width === 0 || height === 0) return null;
-			return {
-				mimeType: "image/jpeg",
-				width,
-				height
-			};
-		}
-		if (marker === 216 || marker === 217) offset += 2;
-		else if (marker === 255) offset += 1;
-		else {
-			const segLen = bytes[offset + 2] << 8 | bytes[offset + 3];
-			offset += 2 + segLen;
-		}
-	}
-	return null;
-}
-//#endregion
-//#region src/annotation/kinds/file-attachment/normalize.ts
-/**
-* Resolve an attachment `file` into its wire halves: metadata into the
-* JSON body, bytes into the resource map. Unlike stamps there is NO
-* format allowlist — attaching arbitrary files is the point — so the
-* declared mime type wins (attachment formats cannot be reliably sniffed;
-* the writer falls back to `application/octet-stream` when absent).
-*
-* Shared by the file-attachment annotation draft (below) and the
-* document-level `attachments.create` mutation — one vocabulary, one
-* normalizer for both homes a file can enter a PDF through.
-*/
-async function normalizeAttachmentFileSource(file, key) {
-	const resolved = await resolveBinarySource(file.data);
-	const name = file.name ?? resolved.name;
-	if (!name) throw new require_fold.EngineError(require_PageInsertBlankInput.EngineErrorCode.InvalidArg, "attachment file requires a name — pass { data, name } or a File whose name is set");
-	const mimeType = file.mimeType ?? resolved.mimeType;
-	return {
-		wireFile: {
-			resource: key,
-			name,
-			...mimeType !== void 0 ? { mimeType } : {},
-			...file.description !== void 0 ? { description: file.description } : {}
-		},
-		resource: {
-			bytes: resolved.bytes,
-			...mimeType !== void 0 ? { mimeType } : {},
-			name
-		}
-	};
-}
-async function normalizeFileAttachmentDraft(draft, allocateKey) {
-	const { file, ...rest } = draft;
-	const key = allocateKey();
-	const { wireFile, resource } = await normalizeAttachmentFileSource(file, key);
-	return {
-		wire: {
-			...rest,
-			file: wireFile
-		},
-		resources: { [key]: resource }
-	};
-}
-//#endregion
-//#region src/annotation/kinds/stamp/normalize.ts
-/**
-* Resolve + validate a stamp `source`. Sniffing happens here — before any
-* transport — so callers get a fast `InvalidArg` instead of a worker/HTTP
-* round-trip. The sniffed mime type overwrites whatever was declared.
-*/
-async function resolveStampSource(source) {
-	const resolved = await resolveBinarySource(source);
-	const meta = sniffBinaryMetadata(resolved.bytes);
-	if (!meta) throw new require_fold.EngineError(require_PageInsertBlankInput.EngineErrorCode.InvalidArg, "stamp source must be PNG, JPEG, or single-page PDF bytes (format is detected from the data, not the declared mime type)");
-	return {
-		...resolved,
-		mimeType: meta.mimeType
-	};
-}
-async function normalizeStampDraft(draft, allocateKey) {
-	const { source, ...rest } = draft;
-	const resolved = await resolveStampSource(source);
-	const key = allocateKey();
-	return {
-		wire: {
-			...rest,
-			source: { resource: key }
-		},
-		resources: { [key]: resolved }
-	};
-}
-async function normalizeStampPatch(patch, allocateKey) {
-	if (patch.source === void 0) {
-		const { source: _source, ...rest } = patch;
-		return {
-			wire: rest,
-			resources: {}
-		};
-	}
-	const { source, ...rest } = patch;
-	const resolved = await resolveStampSource(source);
-	const key = allocateKey();
-	return {
-		wire: {
-			...rest,
-			source: { resource: key }
-		},
-		resources: { [key]: resolved }
-	};
-}
-//#endregion
-//#region src/annotation/normalize.ts
-function createResourceKeyAllocator() {
-	let next = 0;
-	return () => `r${next++}`;
-}
-async function normalizeAnnotationDraft(draft) {
-	switch (draft.subtype) {
-		case "stamp": return normalizeStampDraft(draft, createResourceKeyAllocator());
-		case "file-attachment": return normalizeFileAttachmentDraft(draft, createResourceKeyAllocator());
-		default: return {
-			wire: draft,
-			resources: {}
-		};
-	}
-}
-async function normalizeAnnotationPatch(patch) {
-	switch (patch.subtype) {
-		case "stamp": return normalizeStampPatch(patch, createResourceKeyAllocator());
-		default: return {
-			wire: patch,
-			resources: {}
-		};
-	}
-}
-//#endregion
-//#region src/annotation/relationships.ts
-/**
-* Classify one annotation by its relationship edge alone. Mirrors the
-* spec's "practical parser rule": no `/IRT` is top-level; `/RT /Group` is
-* a grouped subordinate; anything else with an `/IRT` is a reply (the
-* engine has already normalized a missing `/RT` to `'reply'`).
-*/
-function classifyRelation(a) {
-	if (!a.inReplyTo) return "top-level";
-	return a.replyType === "group" ? "grouped-subordinate" : "reply";
-}
-/**
-* Stable string key for an {@link AnnotationRef}, used to match a child's
-* `inReplyTo` against a candidate parent's `ref`. Both sides are produced
-* by the engine with the same identity precedence (objectNumber, then nm,
-* then index), so equal keys mean "same annotation".
-*/
-function refKey(ref) {
-	switch (ref.kind) {
-		case "objectNumber": return `obj:${ref.pageObjectNumber}:${ref.annotObjectNumber}`;
-		case "nm": return `nm:${ref.pageObjectNumber}:${ref.nm}`;
-		case "index": return `idx:${ref.pageObjectNumber}:${ref.index}`;
-	}
-}
-/**
-* Compose a flat annotation list (one page, or a whole document via
-* `listRawAll()` flattened) into {@link AnnotationThread}s in primary
-* order.
-*
-* Rules (ISO 32000 §12.5.6.2 + the spec's UI rule):
-*   - Annotations with no `/IRT` become thread primaries, in input order.
-*   - A `/RT /Group` child is attached to its primary's `groupedParts`.
-*   - A `/RT /R` (or default) child is attached to its primary's `replies`.
-*   - A child whose parent is not in the input set is treated as an
-*     orphan primary (defensive — e.g. a partial/filtered page slice).
-*
-* Limitations (v1, matches the legacy stack): threading is one level deep
-* — a reply-to-a-reply is keyed to its direct parent, so it only appears
-* nested if that direct parent is itself a primary. Callers that want a
-* sidebar of "most annotations, not widgets/popups" should pre-filter the
-* input; this helper is intentionally unopinionated about eligibility.
-*/
-function buildThreads(annotations) {
-	const byKey = /* @__PURE__ */ new Map();
-	for (const a of annotations) {
-		byKey.set(refKey(a.ref), a);
-		if (a.nm && a.nm.length > 0) byKey.set(`nm:${a.ref.pageObjectNumber}:${a.nm}`, a);
-	}
-	const threads = [];
-	const threadByPrimaryKey = /* @__PURE__ */ new Map();
-	const primaryThread = (primary) => {
-		const key = refKey(primary.ref);
-		let thread = threadByPrimaryKey.get(key);
-		if (!thread) {
-			thread = {
-				primary,
-				groupedParts: [],
-				replies: []
-			};
-			threadByPrimaryKey.set(key, thread);
-			threads.push(thread);
-		}
-		return thread;
-	};
-	for (const a of annotations) if (!a.inReplyTo) primaryThread(a);
-	for (const a of annotations) {
-		if (!a.inReplyTo) continue;
-		const parent = byKey.get(refKey(a.inReplyTo));
-		if (!parent || parent.inReplyTo) {
-			primaryThread(a);
-			continue;
-		}
-		const thread = primaryThread(parent);
-		if (a.replyType === "group") thread.groupedParts.push(a);
-		else thread.replies.push(a);
-	}
-	return threads;
-}
-//#endregion
-//#region src/annotation/comments.ts
-/** Subtypes that never participate in comment threads. `unsupported`
-*  covers `/Popup` dictionaries (raw code 16) and unreadable foreign
-*  blobs — neither makes a meaningful comment card. */
-const EXCLUDED_SUBTYPES = /* @__PURE__ */ new Set([
-	"widget",
-	"link",
-	"unsupported"
-]);
-const REVIEW_STATES = /* @__PURE__ */ new Set([
-	"accepted",
-	"rejected",
-	"cancelled",
-	"completed",
-	"none"
-]);
-const MARKED_STATES = /* @__PURE__ */ new Set(["marked", "unmarked"]);
-const nonEmpty = (v) => typeof v === "string" && v !== "";
-/**
-* An ISO 32000 §12.5.6.3 state annotation: a text annotation carrying a
-* non-empty `/State` or `/StateModel`. Classification never relies on
-* flags — producers disagree on how state annotations are flagged.
-*/
-function isStateAnnotation(a) {
-	return a.subtype === "text" && (nonEmpty(a.state) || nonEmpty(a.stateModel));
-}
-function buildCommentThreads(annotations, opts = {}) {
-	const eligible = annotations.filter((a) => !EXCLUDED_SUBTYPES.has(a.subtype));
-	const byKey = /* @__PURE__ */ new Map();
-	for (const a of eligible) {
-		const key = refKey(a.ref);
-		if (!byKey.has(key)) byKey.set(key, a);
-		if (a.nm) {
-			const aliasKey = refKey({
-				kind: "nm",
-				pageObjectNumber: a.pageObjectNumber,
-				nm: a.nm
-			});
-			if (!byKey.has(aliasKey)) byKey.set(aliasKey, a);
-		}
-	}
-	const children = /* @__PURE__ */ new Map();
-	for (const a of eligible) {
-		if (!a.inReplyTo) continue;
-		const parent = byKey.get(refKey(a.inReplyTo));
-		if (!parent) continue;
-		const parentKey = refKey(parent.ref);
-		const list = children.get(parentKey);
-		if (list) list.push(a);
-		else children.set(parentKey, [a]);
-	}
-	const visited = /* @__PURE__ */ new Set();
-	const threads = [];
-	const walk = (root) => {
-		const replies = [];
-		const groupedParts = [];
-		const states = [];
-		visited.add(refKey(root.ref));
-		const stack = [...children.get(refKey(root.ref)) ?? []];
-		while (stack.length > 0) {
-			const a = stack.pop();
-			const key = refKey(a.ref);
-			if (visited.has(key)) continue;
-			visited.add(key);
-			if (isStateAnnotation(a)) states.push(a);
-			else if (classifyRelation(a) === "grouped-subordinate") groupedParts.push(a);
-			else replies.push(a);
-			stack.push(...children.get(key) ?? []);
-		}
-		replies.sort(chronological);
-		states.sort(chronological);
-		threads.push({
-			root,
-			pageObjectNumber: root.pageObjectNumber,
-			replies,
-			groupedParts,
-			review: computeReview(states, opts)
-		});
-	};
-	for (const a of eligible) if (!a.inReplyTo && !isStateAnnotation(a)) walk(a);
-	for (const a of eligible) {
-		if (visited.has(refKey(a.ref))) continue;
-		if (isStateAnnotation(a)) continue;
-		walk(a);
-	}
-	return threads;
-}
-/** `created ?? modified` ascending; undated last; z-order tiebreak. */
-function chronological(a, b) {
-	const at = a.created ?? a.modified;
-	const bt = b.created ?? b.modified;
-	if (at !== null && bt !== null && at !== bt) return at < bt ? -1 : 1;
-	if (at !== null && bt === null) return -1;
-	if (at === null && bt !== null) return 1;
-	return a.index - b.index;
-}
-function computeReview(states, opts) {
-	const byReviewer = {};
-	const markedLatest = {};
-	let lastChange = null;
-	for (const a of states) {
-		const status = toReviewStatus(a);
-		if (!status) continue;
-		if (status.stateModel === "marked") {
-			if (status.by !== null && isNewer(status, markedLatest[status.by])) markedLatest[status.by] = status;
-			continue;
-		}
-		if (status.by !== null && isNewer(status, byReviewer[status.by])) byReviewer[status.by] = status;
-		if (isNewer(status, lastChange)) lastChange = status;
-	}
-	const markedBy = Object.keys(markedLatest).filter((key) => markedLatest[key].state === "marked").sort();
-	const review = {
-		byReviewer,
-		lastChange,
-		markedBy,
-		statusRefs: states.map((a) => a.ref)
-	};
-	if (opts.currentUserId !== void 0) review.mine = byReviewer[opts.currentUserId] ?? null;
-	return review;
-}
-/**
-* Derive a `ReviewStatus` from one state annotation, or null when nothing
-* classifiable can be derived. ISO defaulting happens HERE, not in the
-* engine reader: a known model with an absent state means `none` /
-* `unmarked`; an absent model infers from a known state; a custom model
-* with no state has no derivable status.
-*/
-function toReviewStatus(a) {
-	if (a.subtype !== "text") return null;
-	const rawState = nonEmpty(a.state) ? a.state : null;
-	let stateModel = nonEmpty(a.stateModel) ? a.stateModel : null;
-	if (stateModel === null && rawState !== null) if (REVIEW_STATES.has(rawState)) stateModel = "review";
-	else if (MARKED_STATES.has(rawState)) stateModel = "marked";
-	else return null;
-	let state = rawState;
-	if (state === null) if (stateModel === "review") state = "none";
-	else if (stateModel === "marked") state = "unmarked";
-	else return null;
-	if (stateModel === null) return null;
-	return {
-		state,
-		stateModel,
-		by: a.userId ?? (nonEmpty(a.author) ? a.author : null),
-		at: a.modified ?? a.created ?? null,
-		ref: a.ref
-	};
-}
-/** `a` newer than (or supersedes) `b`. `at` decides; dated beats undated.
-*  States arrive pre-sorted by `chronological` (date, then z-order), so on
-*  equal or missing dates the later entry wins via `>=` / `true`. */
-function isNewer(a, b) {
-	if (!b) return true;
-	if (a.at !== null && b.at !== null) return a.at >= b.at;
-	if (a.at !== null) return true;
-	if (b.at !== null) return false;
-	return true;
-}
-//#endregion
-//#region src/mutation/AnnotationMutationImpactPolicy.ts
-function changesAnnotationList(_kind) {
-	return true;
-}
-function shiftsExistingAnnotationIndices(kind) {
-	return kind === "delete" || kind === "move";
-}
-function invalidatesWeakIndexRefs(kind, weakStateBefore) {
-	if (!shiftsExistingAnnotationIndices(kind)) return false;
-	if (weakStateBefore.kind !== "known") throw new Error(`invalidatesWeakIndexRefs requires a known WeakAnnotationState for ${kind}; got 'unknown'. Caller must scan the page before computing mutation impact.`);
-	return weakStateBefore.hasAnyWeakAnnotations;
-}
-//#endregion
-//#region src/annotation/appearance.ts
-/**
-* Coordinate tolerance in PDF user-space points. PDF numbers round-trip
-* through f32 (~7 significant digits) and client-side space conversions, so
-* exact float equality would misclassify no-op writes; 1e-3 pt is far below
-* anything visible while far above accumulated f32 drift at page magnitudes.
-*/
-const EPSILON = .001;
-/**
-* Keys that never affect `/AP` on any kind: the discriminator, behavioral
-* flags, reply relationships, grouping, and the conversation-plane
-* entries (`/Subj` subject line, `/State` + `/StateModel` review status —
-* dictionary-only per ISO 32000 §12.5.6.3, never painted).
-*/
-const INERT_KEYS = /* @__PURE__ */ new Set([
-	"subtype",
-	"flags",
-	"inReplyTo",
-	"replyType",
-	"groupId",
-	"subject",
-	"state",
-	"stateModel"
-]);
-/**
-* Kinds whose `/AP` paints `/Contents`. Everywhere else `contents` is popup
-* note text — editing a comment must never re-bake (or destroy) the shape's
-* appearance.
-*/
-const CONTENTS_PAINTED = /* @__PURE__ */ new Set(["free-text", "redact"]);
-/**
-* The vertex family's `/EMBD_Metadata/Rotation` is an advisory scalar (the
-* vertices are already rotated); it never drives the AP generator, so patches
-* touching it are appearance-inert for these kinds.
-*/
-const ADVISORY_ROTATION = /* @__PURE__ */ new Set([
-	"line",
-	"polyline",
-	"polygon",
-	"ink"
-]);
-/**
-* The box kinds carry the `/EMBD_Metadata` transform pair (`rotation` +
-* `unrotatedRect`), tri-state on writes: omitted fields are PRESERVED, `null`
-* (or `0` for rotation) clears. Translation verification therefore compares
-* the after-state — `patch.rotation ?? current.rotation` — not the patch keys.
-*/
-const BOX_TRANSFORM = /* @__PURE__ */ new Set([
-	"square",
-	"circle",
-	"free-text",
-	"stamp"
-]);
-/**
-* Per-kind absolute-geometry fields (PDF user space) that a rigid translation
-* shifts together. A kind absent from this table never takes the translation
-* route. `rect` is required in every entry: a translation always moves `/Rect`.
-*/
-const TRANSLATABLE_GEOMETRY = {
-	square: ["rect", "unrotatedRect"],
-	circle: ["rect", "unrotatedRect"],
-	"free-text": [
-		"rect",
-		"unrotatedRect",
-		"calloutLine"
-	],
-	line: ["rect", "linePoints"],
-	polygon: ["rect", "vertices"],
-	polyline: ["rect", "vertices"],
-	ink: ["rect", "inkList"],
-	highlight: ["rect", "quadPoints"],
-	underline: ["rect", "quadPoints"],
-	squiggly: ["rect", "quadPoints"],
-	strikeout: ["rect", "quadPoints"],
-	redact: ["rect", "quadPoints"],
-	caret: ["rect"],
-	text: ["rect"],
-	stamp: ["rect", "unrotatedRect"],
-	"file-attachment": ["rect"],
-	link: ["rect"]
-};
-const numEq = (a, b) => Math.abs(a - b) <= EPSILON;
-/** Degrees normalized to [0,360); absent reads as 0 (no rotation). */
-const normDeg = (v) => {
-	return typeof v === "number" ? (v % 360 + 360) % 360 : 0;
-};
-/**
-* Semantic equality between a patch value and the current DTO value.
-* Numbers compare within {@link EPSILON}; `null` and `undefined` both mean
-* "entry absent" (the tri-state clear of an absent entry is a no-op); arrays
-* and objects compare structurally.
-*/
-function semanticEqual(a, b) {
-	if (a == null || b == null) return a == null && b == null;
-	if (typeof a === "number" && typeof b === "number") return numEq(a, b);
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => semanticEqual(v, b[i]));
-	}
-	if (typeof a === "object" && typeof b === "object") {
-		const keys = /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)]);
-		for (const k of keys) if (!semanticEqual(a[k], b[k])) return false;
-		return true;
-	}
-	return a === b;
-}
-/**
-* Is `next` exactly `cur` shifted by `(dx, dy)`? Walks the value structurally:
-* numeric leaves under x-axis keys (`left`/`right`/`x`) must shift by `dx`,
-* y-axis keys (`bottom`/`top`/`y`) by `dy`, and any other numeric leaf must be
-* unchanged. Arrays walk elementwise (same length required).
-*/
-function shiftedBy(cur, next, dx, dy) {
-	if (cur == null || next == null) return cur == null && next == null;
-	if (Array.isArray(cur) || Array.isArray(next)) {
-		if (!Array.isArray(cur) || !Array.isArray(next) || cur.length !== next.length) return false;
-		return cur.every((v, i) => shiftedBy(v, next[i], dx, dy));
-	}
-	if (typeof cur === "object" && typeof next === "object") {
-		const keys = /* @__PURE__ */ new Set([...Object.keys(cur), ...Object.keys(next)]);
-		for (const k of keys) {
-			const c = cur[k];
-			const n = next[k];
-			if (typeof c === "number" && typeof n === "number") {
-				if (!numEq(c + (k === "left" || k === "right" || k === "x" ? dx : k === "bottom" || k === "top" || k === "y" ? dy : 0), n)) return false;
-			} else if (!shiftedBy(c, n, dx, dy)) return false;
-		}
-		return true;
-	}
-	return cur === next;
-}
-/**
-* Verify the touched geometry is one rigid translation of the current state.
-* Requires `patch.rect` (a translation always moves `/Rect`) with width and
-* height preserved; every other geometry field present on the annotation must
-* ride along shifted by the same delta — a rect move that leaves `vertices`
-* behind is NOT a translation (the dictionary would desync from the pixels).
-* For box kinds the `/EMBD_Metadata` transform group is checked as an
-* after-state: writes are tri-state (omitted preserves, null/0 clears), so an
-* omitted rotation keeps the current one — but a preserved-yet-unshifted
-* `unrotatedRect` still fails the congruence check via the field loop.
-*/
-function isRigidTranslation(cur, pat, subtype, geometryKeys) {
-	const curRect = cur.rect;
-	const patRect = pat.rect;
-	if (!curRect || !patRect) return false;
-	const dx = patRect.left - curRect.left;
-	const dy = patRect.bottom - curRect.bottom;
-	if (!numEq(patRect.right - patRect.left, curRect.right - curRect.left)) return false;
-	if (!numEq(patRect.top - patRect.bottom, curRect.top - curRect.bottom)) return false;
-	if (BOX_TRANSFORM.has(subtype)) {
-		const rotAfter = pat.rotation === void 0 ? cur.rotation : pat.rotation;
-		if (!numEq(normDeg(cur.rotation), normDeg(rotAfter))) return false;
-	}
-	for (const key of geometryKeys) {
-		if (key === "rect") continue;
-		const c = cur[key];
-		const p = pat[key];
-		if (c == null && p == null) continue;
-		if (c == null || p == null) return false;
-		if (!shiftedBy(c, p, dx, dy)) return false;
-	}
-	return true;
-}
-/**
-* Classify an update patch against the annotation's current DTO.
-*
-* 1. Value-diff: drop keys whose value semantically equals the current one,
-*    plus the always-inert metadata keys (and per-kind inert keys: `contents`
-*    where it isn't painted, advisory `rotation` on the vertex family).
-*    Nothing left → `'inert'`.
-* 2. If every remaining key is translatable geometry for this kind AND the
-*    values are one rigid translation → `'translation'`.
-* 3. Anything else — style, text, unknown keys, unknown kinds → `'regenerate'`.
-*/
-function appearanceImpactOf(current, patch) {
-	if (patch.subtype !== current.subtype) return "regenerate";
-	const cur = current;
-	const pat = patch;
-	const subtype = patch.subtype;
-	const touched = [];
-	for (const [key, value] of Object.entries(pat)) {
-		if (value === void 0 || INERT_KEYS.has(key)) continue;
-		if (key === "contents" && !CONTENTS_PAINTED.has(subtype)) continue;
-		if (key === "rotation" && ADVISORY_ROTATION.has(subtype)) continue;
-		if (!semanticEqual(value, cur[key])) touched.push(key);
-	}
-	if (touched.length === 0) return "inert";
-	const geometryKeys = TRANSLATABLE_GEOMETRY[subtype];
-	if (!geometryKeys) return "regenerate";
-	if (!touched.every((k) => geometryKeys.includes(k))) return "regenerate";
-	return isRigidTranslation(cur, pat, subtype, geometryKeys) ? "translation" : "regenerate";
-}
-//#endregion
-//#region src/identity/FormFieldRef.ts
-/**
-* URL-safe encoding of a `FormFieldRef`, used by the cloud HTTP surface as
-* the `:fieldKey` route parameter. Decoded by the server back into a
-* `FormFieldRef` via `decodeFieldRefKey`. Mirrors the annotation plane's
-* `encodeStableIdKey` (`obj:42` / `nm:…`) so the two member-key syntaxes
-* read the same on the wire:
-*
-*   `{ kind: 'objectNumber', fieldObjectNumber: 12 }` -> `'obj:12'`
-*   `{ kind: 'fqn', name: 'billing.name' }`           -> `'fqn:billing.name'`
-*
-* The caller is responsible for `encodeURIComponent`-ing the result before
-* splicing it into a URL path; the `wirePaths.layerFormField*` builders
-* already do that. FQNs are opaque strings and may contain anything; the
-* `fqn:` prefix keeps them unambiguous from numeric ids.
-*/
-function encodeFieldRefKey(ref) {
-	if (ref.kind === "objectNumber") {
-		if (!Number.isInteger(ref.fieldObjectNumber) || ref.fieldObjectNumber <= 0) throw new RangeError(`encodeFieldRefKey: fieldObjectNumber must be a positive integer, got ${ref.fieldObjectNumber}`);
-		return `obj:${ref.fieldObjectNumber}`;
-	}
-	return `fqn:${ref.name}`;
-}
-/**
-* Inverse of `encodeFieldRefKey`. Returns `null` for malformed input so the
-* server can answer 400 InvalidArg with a useful message instead of
-* throwing. The input is the already-`decodeURIComponent`-ed segment from
-* the route path. Empty FQNs are rejected: `fqn:` with no suffix is not a
-* valid identity.
-*/
-function decodeFieldRefKey(key) {
-	if (key.startsWith("obj:")) {
-		const rest = key.slice(4);
-		const n = Number.parseInt(rest, 10);
-		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
-		return {
-			kind: "objectNumber",
-			fieldObjectNumber: n
-		};
-	}
-	if (key.startsWith("fqn:")) {
-		const name = key.slice(4);
-		if (name.length === 0) return null;
-		return {
-			kind: "fqn",
-			name
-		};
-	}
-	return null;
-}
-//#endregion
-//#region src/signature/analysis/pdf-value.ts
-/**
-* Parse the fork's canonical shallow serialisation:
-*   dict     <</Key value/Key2 value>>        (keys sorted, `#xx`-escaped)
-*   array    [item item]
-*   ref      n 0 R
-*   stream   stream(length,sha256hex)<<dict>>
-*   name     /Name (with #xx escapes)
-*   string   (literal with backslash escapes) or <hex>
-*   number   -12.5   bool  true|false   null
-*/
-function parsePdfValue(text) {
-	const parser = new Parser(text);
-	const value = parser.value();
-	parser.skipSpaces();
-	if (!parser.atEnd()) throw new Error(`trailing input at ${parser.pos}: ${text.slice(parser.pos, parser.pos + 20)}`);
-	return value;
-}
-var Parser = class {
-	constructor(text) {
-		this.text = text;
-		require_fold._defineProperty(this, "pos", 0);
-	}
-	atEnd() {
-		return this.pos >= this.text.length;
-	}
-	skipSpaces() {
-		while (this.pos < this.text.length && this.text[this.pos] === " ") this.pos++;
-	}
-	value() {
-		this.skipSpaces();
-		const t = this.text;
-		if (t.startsWith("<<", this.pos)) return this.dict();
-		if (t.startsWith("stream(", this.pos)) return this.stream();
-		if (t[this.pos] === "[") return this.array();
-		if (t[this.pos] === "/") return {
-			t: "name",
-			v: this.name()
-		};
-		if (t[this.pos] === "(") return {
-			t: "string",
-			v: this.literalString()
-		};
-		if (t[this.pos] === "<") return {
-			t: "string",
-			v: this.hexString()
-		};
-		if (t.startsWith("true", this.pos)) {
-			this.pos += 4;
-			return {
-				t: "bool",
-				v: true
-			};
-		}
-		if (t.startsWith("false", this.pos)) {
-			this.pos += 5;
-			return {
-				t: "bool",
-				v: false
-			};
-		}
-		if (t.startsWith("null", this.pos)) {
-			this.pos += 4;
-			return { t: "null" };
-		}
-		const ref = /^(\d+) 0 R(?![0-9A-Za-z])/.exec(t.slice(this.pos));
-		if (ref) {
-			this.pos += ref[0].length;
-			return {
-				t: "ref",
-				num: Number(ref[1])
-			};
-		}
-		const num = /^[+-]?(?:\d+\.?\d*|\.\d+)/.exec(t.slice(this.pos));
-		if (num) {
-			this.pos += num[0].length;
-			return {
-				t: "number",
-				v: Number(num[0])
-			};
-		}
-		throw new Error(`unexpected input at ${this.pos}: ${t.slice(this.pos, this.pos + 20)}`);
-	}
-	dict() {
-		return {
-			t: "dict",
-			entries: this.dictEntries()
-		};
-	}
-	dictEntries() {
-		this.expect("<<");
-		const entries = {};
-		for (;;) {
-			this.skipSpaces();
-			if (this.text.startsWith(">>", this.pos)) {
-				this.pos += 2;
-				return entries;
-			}
-			if (this.text[this.pos] !== "/") throw new Error(`expected a key at ${this.pos}`);
-			const key = this.name();
-			this.skipSpaces();
-			entries[key] = this.value();
-		}
-	}
-	stream() {
-		const m = /^stream\((\d+),([0-9a-fA-F]*)\)/.exec(this.text.slice(this.pos));
-		if (!m) throw new Error(`malformed stream signature at ${this.pos}`);
-		this.pos += m[0].length;
-		const dict = this.dictEntries();
-		return {
-			t: "stream",
-			length: Number(m[1]),
-			sha256: m[2].toLowerCase(),
-			dict
-		};
-	}
-	array() {
-		this.expect("[");
-		const items = [];
-		for (;;) {
-			this.skipSpaces();
-			if (this.text[this.pos] === "]") {
-				this.pos++;
-				return {
-					t: "array",
-					items
-				};
-			}
-			items.push(this.value());
-		}
-	}
-	name() {
-		this.expect("/");
-		let out = "";
-		while (this.pos < this.text.length) {
-			const ch = this.text[this.pos];
-			if (ch === " " || ch === "/" || ch === "[" || ch === "]" || ch === "<" || ch === ">" || ch === "(" || ch === ")") break;
-			if (ch === "#" && /^[0-9A-Fa-f]{2}/.test(this.text.slice(this.pos + 1, this.pos + 3))) {
-				out += String.fromCharCode(parseInt(this.text.slice(this.pos + 1, this.pos + 3), 16));
-				this.pos += 3;
-				continue;
-			}
-			out += ch;
-			this.pos++;
-		}
-		return out;
-	}
-	literalString() {
-		this.expect("(");
-		let depth = 1;
-		let out = "";
-		while (this.pos < this.text.length) {
-			const ch = this.text[this.pos++];
-			if (ch === "\\") {
-				const next = this.text[this.pos++];
-				switch (next) {
-					case "n":
-						out += "\n";
-						break;
-					case "r":
-						out += "\r";
-						break;
-					case "t":
-						out += "	";
-						break;
-					case "b":
-						out += "\b";
-						break;
-					case "f":
-						out += "\f";
-						break;
-					case "\n": break;
-					case "\r":
-						if (this.text[this.pos] === "\n") this.pos++;
-						break;
-					default: {
-						const oct = /^[0-7]{1,3}/.exec(this.text.slice(this.pos - 1));
-						if (oct) {
-							out += String.fromCharCode(parseInt(oct[0], 8));
-							this.pos += oct[0].length - 1;
-						} else out += next;
-					}
-				}
-				continue;
-			}
-			if (ch === "(") depth++;
-			if (ch === ")") {
-				depth--;
-				if (depth === 0) return out;
-			}
-			out += ch;
-		}
-		throw new Error("unterminated string");
-	}
-	hexString() {
-		this.expect("<");
-		const end = this.text.indexOf(">", this.pos);
-		if (end < 0) throw new Error("unterminated hex string");
-		const hex = this.text.slice(this.pos, end).replace(/\s+/g, "");
-		this.pos = end + 1;
-		let out = "";
-		for (let i = 0; i < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.slice(i, i + 2).padEnd(2, "0"), 16));
-		return out;
-	}
-	expect(token) {
-		if (!this.text.startsWith(token, this.pos)) throw new Error(`expected ${token} at ${this.pos}`);
-		this.pos += token.length;
-	}
-};
-/** Structural equality of two parsed values. */
-function pdfValueEquals(a, b) {
-	return stableStringify(a) === stableStringify(b);
-}
-function stableStringify(value) {
-	if (value === null) return "null";
-	switch (value.t) {
-		case "dict": return `<<${Object.keys(value.entries).sort().map((k) => `/${k} ${stableStringify(value.entries[k])}`).join("")}>>`;
-		case "stream": return `stream(${value.length},${value.sha256})${stableStringify({
-			t: "dict",
-			entries: value.dict
-		})}`;
-		case "array": return `[${value.items.map(stableStringify).join(" ")}]`;
-		case "ref": return `${value.num} 0 R`;
-		case "name": return `/${encodeName(value.v)}`;
-		case "string": return `(${value.v.replace(/[\\()]/g, (ch) => `\\${ch}`)})`;
-		case "number": return String(value.v);
-		case "bool": return value.v ? "true" : "false";
-		case "null": return "null";
-	}
-}
-function dictEntries(value) {
-	if (!value) return null;
-	if (value.t === "dict") return value.entries;
-	if (value.t === "stream") return value.dict;
-	return null;
-}
-/** Keys whose value differs (added, removed, or changed) between two dictionaries. */
-function changedKeys(a, b) {
-	const ea = dictEntries(a) ?? {};
-	const eb = dictEntries(b) ?? {};
-	const out = /* @__PURE__ */ new Set();
-	for (const key of /* @__PURE__ */ new Set([...Object.keys(ea), ...Object.keys(eb)])) if (!pdfValueEquals(ea[key] ?? null, eb[key] ?? null)) out.add(key);
-	return out;
-}
-function refsOf(value) {
-	if (!value) return [];
-	if (value.t === "ref") return [value.num];
-	if (value.t === "array") return value.items.flatMap(refsOf);
-	return [];
-}
-/** `#xx`-escape a name the way the PDF writer does: delimiters, whitespace, `#`, and non-printables. */
-function encodeName(name) {
-	let out = "";
-	for (const ch of name) {
-		const code = ch.charCodeAt(0);
-		if (code < 33 || code > 126 || "#/[]<>(){}%".includes(ch)) out += `#${code.toString(16).toUpperCase().padStart(2, "0")}`;
-		else out += ch;
-	}
-	return out;
-}
-//#endregion
-//#region src/signature/analysis/verdict.ts
-const RANK = {
-	unchanged: 0,
-	permitted: 1,
-	indeterminate: 2,
-	forbidden: 3
-};
-/** The worst of several verdicts (a certification replay's steps). */
-function worstVerdict(steps) {
-	let worst = "unchanged";
-	for (const s of steps) if (RANK[s.verdict] > RANK[worst]) worst = s.verdict;
-	return worst;
-}
-/**
-* One aggregation rule everywhere: a proven violation decides, whatever
-* else could not be established; missing evidence never becomes a pass.
-*/
-function conclude(findings, hasEffectiveChanges) {
-	if (findings.some((f) => f.verdict === "forbidden")) return "forbidden";
-	if (findings.some((f) => f.verdict === "incomplete")) return "indeterminate";
-	return hasEffectiveChanges ? "permitted" : "unchanged";
-}
-/** The finding that explains a verdict: the violation, else the gap, else the most notable allowance. */
-function primaryFinding(findings) {
-	return findings.find((f) => f.verdict === "forbidden") ?? findings.find((f) => f.verdict === "incomplete") ?? findings.find((f) => f.verdict === "permitted");
-}
-function assessmentOf(step) {
-	const primary = primaryFinding(step.findings);
-	return {
-		verdict: step.verdict,
-		complete: !step.findings.some((f) => f.verdict === "incomplete"),
-		...primary ? { primary } : {},
-		findings: step.findings
-	};
-}
-/**
-* A certification window: the net verdict and every replayed step, under
-* the same rule. A step's violation is a violation of the certification
-* even when the final state no longer shows it (corpus v3/83).
-*/
-function combine(net, steps) {
-	const findings = [...net.findings];
-	for (const s of steps) {
-		if (s === net) continue;
-		for (const f of s.findings) {
-			if (f.verdict === "permitted") continue;
-			findings.push({
-				...f,
-				detail: `revision ${s.newer}: ${f.detail ?? f.rule}`
-			});
-		}
-	}
-	const verdict = conclude(findings, net.verdict !== "unchanged" || steps.some((s) => s.verdict !== "unchanged"));
-	const primary = primaryFinding(findings);
-	return {
-		verdict,
-		complete: !findings.some((f) => f.verdict === "incomplete"),
-		...primary ? { primary } : {},
-		findings
-	};
-}
-//#endregion
-//#region src/signature/analysis/evaluate.ts
-const SIDES = ["old", "new"];
-const TRAILER_KEYS = /* @__PURE__ */ new Set([
-	"Size",
-	"Prev",
-	"XRefStm",
-	"Info",
-	"ID",
-	"Root",
-	"Type",
-	"W",
-	"Index",
-	"Filter",
-	"DecodeParms",
-	"Length",
-	"Encrypt"
-]);
-const CATALOG_KEYS = /* @__PURE__ */ new Set([
-	"Metadata",
-	"Extensions",
-	"Version",
-	"DSS",
-	"AcroForm",
-	"Perms"
-]);
-const ACROFORM_KEYS = /* @__PURE__ */ new Set([
-	"DR",
-	"DA",
-	"Q",
-	"SigFlags",
-	"NeedAppearances",
-	"Fields"
-]);
-/**
-* What a form field may change after a signature, by the level in force.
-* Every key here has a corpus case behind it (`signature-compat`); a key
-* not listed is forbidden until one does.
-*
-*   annotate (an approval signature: "Form Fill-in, Signing and Commenting
-*   are allowed"): everything but the field's identity and its place in
-*   the tree. v1/08 /V+/AP, 09 /Ff, 10 /Rect, 11 /F, 18 /TU, 21 /DA; 13 /T
-*   forbidden. /AA (v1/12) and /A are accepted by Acrobat and deliberately
-*   NOT listed: an action on a signed form is executable content.
-*
-*   fill (a P=2 certification): value and appearance. v1/26 /V+/AP, v3/64
-*   /Ff (ReadOnly added), 65 /DA, 68 /AP stream; v3/66 /TU, 67 /F, v2/50
-*   /Rect forbidden.
-*/
-const FIELD_KEYS_BY_LEVEL = {
-	annotate: /* @__PURE__ */ new Set([
-		"V",
-		"AS",
-		"AP",
-		"I",
-		"DA",
-		"Ff",
-		"RV",
-		"MK",
-		"Q",
-		"TU",
-		"F",
-		"Rect",
-		"BS",
-		"Opt",
-		"DV",
-		"MaxLen"
-	]),
-	fill: /* @__PURE__ */ new Set([
-		"V",
-		"AS",
-		"AP",
-		"I",
-		"RV",
-		"DA",
-		"Ff"
-	])
-};
-/** A separate widget dictionary: the presentation subset of the same tables. */
-const WIDGET_KEYS_BY_LEVEL = {
-	annotate: /* @__PURE__ */ new Set([
-		"AS",
-		"AP",
-		"DA",
-		"MK",
-		"Q",
-		"TU",
-		"F",
-		"Rect",
-		"BS"
-	]),
-	fill: /* @__PURE__ */ new Set([
-		"AS",
-		"AP",
-		"DA"
-	])
-};
-/**
-* Signing an EXISTING field: its value, appearance and ReadOnly at any
-* level; after an approval signature also its tooltip and a /Lock installed
-* with the signature (v1/18, 19: both valid; under P=2 the combination is
-* rejected, v3/69, so neither is allowed at `fill`).
-*/
-const SIGNED_FIELD_KEYS_BY_LEVEL = {
-	annotate: /* @__PURE__ */ new Set([
-		"V",
-		"AP",
-		"AS",
-		"Ff",
-		"TU",
-		"Lock"
-	]),
-	fill: /* @__PURE__ */ new Set([
-		"V",
-		"AP",
-		"AS",
-		"Ff"
-	])
-};
-const SIGNED_WIDGET_KEYS = /* @__PURE__ */ new Set(["AP", "AS"]);
-const FF_READ_ONLY = 1;
-function fieldKeysFor(level) {
-	return level === "annotate" ? FIELD_KEYS_BY_LEVEL.annotate : FIELD_KEYS_BY_LEVEL.fill;
-}
-function widgetKeysFor(level) {
-	return level === "annotate" ? WIDGET_KEYS_BY_LEVEL.annotate : WIDGET_KEYS_BY_LEVEL.fill;
-}
-function signedFieldKeysFor(level) {
-	return level === "annotate" ? SIGNED_FIELD_KEYS_BY_LEVEL.annotate : SIGNED_FIELD_KEYS_BY_LEVEL.fill;
-}
-/**
-* Rules whose permitted findings do not make a revision a CHANGE of the
-* document: an object written again with the sealed value, an object nobody
-* references, a cross-reference container, the trailer's own bookkeeping.
-* A window with nothing else is `unchanged` (Acrobat: "not modified").
-*/
-const NON_EFFECTIVE_RULES = /* @__PURE__ */ new Set([
-	"identical-rewrite",
-	"orphan",
-	"xref-container",
-	"trailer"
-]);
-/** The level a step runs at, and the locks it enforces: what the OLDER revision's signatures established. */
-function restrictionsOf(before) {
-	const protection = require_resolver.deriveProtection(before.signatures);
-	return {
-		level: protection.judged ?? "annotate",
-		locks: protection.fieldLocks
-	};
-}
-/**
-* Judge one pairwise step. Every reference to a changed object, in the
-* older AND the newer revision, must be claimed by a rule that inspected
-* that use; an unclaimed reference is `unexplained` and forbidden. A
-* truncated value is `incomplete`, never permitted. Pure: JSON in, JSON
-* out, the same code in the browser worker, on the server and in tests.
-*/
-function evaluateStep(input) {
-	const changes = withEvidenceCheck(input.changes);
-	const { level, locks } = input.restrictions ?? restrictionsOf(input.before);
-	const levelInForce = input.levelOverride ?? level;
-	const ctx = new StepContext({
-		...input,
-		changes
-	}, levelInForce, locks);
-	ruleRevisionHealth(ctx);
-	ruleXrefContainer(ctx);
-	ruleIdenticalRewrite(ctx);
-	ruleFieldLock(ctx);
-	ruleTrailer(ctx);
-	ruleInfo(ctx);
-	ruleMetadata(ctx);
-	ruleCatalog(ctx);
-	ruleAcroForm(ctx);
-	ruleDss(ctx);
-	ruleSignatureFieldAdded(ctx);
-	ruleSignatureAdded(ctx);
-	ruleFormFill(ctx);
-	ruleAnnotation(ctx);
-	ruleUnexplained(ctx);
-	const verdict = conclude(ctx.findings, ctx.findings.some((f) => f.verdict === "permitted" && !NON_EFFECTIVE_RULES.has(f.rule)));
-	return {
-		older: input.older,
-		newer: input.newer,
-		levelInForce,
-		locks,
-		verdict,
-		findings: ctx.findings,
-		changes
-	};
-}
-/**
-* The evaluator never trusts its transport to be honest about gaps: a side
-* that exists must carry a value, and an object whose value is missing is
-* judged as truncated, whatever the flag says. Cross-reference containers
-* are exempt (their members are judged on their own).
-*/
-function withEvidenceCheck(changes) {
-	return changes.map((c) => {
-		if (c.value.truncated || c.kind === "xref" || c.kind === "objstm") return c;
-		const missingOld = c.present.old && (c.value.old === null || c.read?.old === "failed");
-		const missingNew = c.present.new && (c.value.new === null || c.read?.new === "failed");
-		return missingOld || missingNew ? {
-			...c,
-			value: {
-				...c.value,
-				truncated: true
-			}
-		} : c;
-	});
-}
-/**
-* The transport's verdict on each revision as a whole. A sealed revision
-* Acrobat cannot judge later changes to (sparse cross-reference table, a
-* reachable bare-reference object) makes every step over it indeterminate:
-* our verdict would otherwise disagree with the validator recipients use,
-* and for a reason that has nothing to do with the change. An incomplete
-* reachability walk on either side leaves every use unproven.
-*/
-function ruleRevisionHealth(ctx) {
-	const health = ctx.input.health;
-	if (!health) return;
-	const base = health.old;
-	if (base.sparseXref || base.bareReferences > 0) {
-		const why = [base.sparseXref ? "its cross-reference table has no entry for some object numbers below /Size" : null, base.bareReferences > 0 ? `${base.bareReferences} reachable indirect object(s) consist of a bare reference` : null].filter((x) => x !== null).join("; ");
-		ctx.findings.push({
-			rule: "base-unverifiable",
-			verdict: "incomplete",
-			objectNumber: 0,
-			detail: `the signed revision cannot be verified against later changes by Acrobat (${why}); no verdict is given rather than one Acrobat would contradict`
-		});
-	}
-	for (const side of SIDES) if (!health[side].referrersComplete) ctx.findings.push({
-		rule: "unexplained",
-		verdict: "incomplete",
-		objectNumber: 0,
-		detail: `the ${side === "old" ? "older" : "newer"} revision's reachability walk hit its budget; not every use of a changed object is known`
-	});
-}
-/**
-* Same effective value on both sides: same canonical serialisation (keys
-* sorted, whitespace normalised - Acrobat compares dictionaries by value,
-* corpus v3/61-62), same stream data (by bytes, v2/45), and both sides
-* actually read. A failed read serialises as "null" and would match another
-* failed read - evidence of nothing.
-*/
-function sameEffectiveValue(c) {
-	return c.change === "modified" && !c.value.truncated && c.read?.old !== "failed" && c.read?.new !== "failed" && c.raw.old !== null && c.raw.new !== null && c.raw.old === c.raw.new && !c.streamDataChanged;
-}
-function indexRoles(s) {
-	const fieldByObj = /* @__PURE__ */ new Map();
-	const widgetToField = /* @__PURE__ */ new Map();
-	const sigFields = /* @__PURE__ */ new Set();
-	for (const f of s.fields) {
-		fieldByObj.set(f.objectNumber, f);
-		if (f.family === "signature") sigFields.add(f.objectNumber);
-		for (const w of f.widgets) widgetToField.set(w, f.objectNumber);
-	}
-	const signedFields = /* @__PURE__ */ new Set();
-	for (const sig of s.signatures) if (sig.signed && sig.field.kind === "objectNumber") signedFields.add(sig.field.fieldObjectNumber);
-	return {
-		fieldByObj,
-		widgetToField,
-		pages: new Set(s.pages),
-		signedFields,
-		sigFields
-	};
-}
-function edgeKey(e) {
-	return `${e.parent}:${e.label}`;
-}
-var StepContext = class {
-	constructor(input, level, locks) {
-		this.input = input;
-		this.level = level;
-		this.locks = locks;
-		require_fold._defineProperty(this, "findings", []);
-		require_fold._defineProperty(this, "byNum", /* @__PURE__ */ new Map());
-		require_fold._defineProperty(this, "before", void 0);
-		require_fold._defineProperty(this, "after", void 0);
-		require_fold._defineProperty(this, "claims", /* @__PURE__ */ new Map());
-		require_fold._defineProperty(this, "locked", /* @__PURE__ */ new Set());
-		for (const c of input.changes) this.byNum.set(c.objectNumber, c);
-		this.before = indexRoles(input.before);
-		this.after = indexRoles(input.after);
-	}
-	get changes() {
-		return this.input.changes;
-	}
-	allows(needed) {
-		return require_resolver.levelAllows(this.level, needed);
-	}
-	claimEdge(c, side, edge, rule, allow = true) {
-		if (this.locked.has(c.objectNumber)) return;
-		const key = `${c.objectNumber}:${side}:${edgeKey(edge)}`;
-		if (!this.claims.has(key)) this.claims.set(key, {
-			rule,
-			allow
-		});
-	}
-	claimAll(c, rule, allow = true) {
-		for (const side of SIDES) for (const e of c.usage[side]) this.claimEdge(c, side, e, rule, allow);
-	}
-	/**
-	* Claim the references that are the same in both revisions; a reference
-	* gained or lost stays unexplained. `allow: false` explains a condemned
-	* object's edges (one cause in the report, not a cascade) without letting
-	* anything hang off it.
-	*/
-	claimStable(c, rule, allow = true) {
-		const oldKeys = new Set(c.usage.old.map(edgeKey));
-		const newKeys = new Set(c.usage.new.map(edgeKey));
-		for (const e of c.usage.old) if (newKeys.has(edgeKey(e))) this.claimEdge(c, "old", e, rule, allow);
-		for (const e of c.usage.new) if (oldKeys.has(edgeKey(e))) this.claimEdge(c, "new", e, rule, allow);
-	}
-	isClaimed(c, side, edge) {
-		return this.claims.has(`${c.objectNumber}:${side}:${edgeKey(edge)}`);
-	}
-	/** The use was inspected by a rule that allowed it. */
-	isAllowed(c, side, edge) {
-		return this.claims.get(`${c.objectNumber}:${side}:${edgeKey(edge)}`)?.allow === true;
-	}
-	permitted(c, rule, detail) {
-		if (this.locked.has(c.objectNumber)) return;
-		this.findings.push({
-			rule,
-			verdict: "permitted",
-			objectNumber: c.objectNumber,
-			detail
-		});
-	}
-	/**
-	* A violation is only proven on evidence: a rule condemning an object
-	* whose value could not be read or inspected is reporting what it could
-	* not see, and that is `incomplete`, never `forbidden`.
-	*/
-	forbidden(c, rule, detail, edge) {
-		this.findings.push({
-			rule,
-			verdict: c.value.truncated ? "incomplete" : "forbidden",
-			objectNumber: c.objectNumber,
-			edge: edge ? edgeKey(edge) : void 0,
-			detail: c.value.truncated ? `${detail} (judged on missing evidence: not proven)` : detail
-		});
-	}
-	/**
-	* Claim every reference under a set of parents (an appearance subtree,
-	* the DSS): objects whose references come from `parents` through labels
-	* `accept`, then everything referenced from those objects, and so on.
-	* Runs per side, because a replaced appearance stream exists on one
-	* side only.
-	*/
-	claimSubtree(side, roots, accept, rule) {
-		const joined = /* @__PURE__ */ new Set();
-		let grew = true;
-		while (grew) {
-			grew = false;
-			for (const c of this.changes) {
-				if (roots.has(c.objectNumber) || joined.has(c.objectNumber)) continue;
-				if (this.locked.has(c.objectNumber)) continue;
-				const edges = c.usage[side];
-				if (edges.length === 0) continue;
-				const inside = edges.filter((e) => roots.has(e.parent) && accept(e.label) || joined.has(e.parent));
-				if (inside.length === 0) continue;
-				for (const e of inside) this.claimEdge(c, side, e, rule);
-				if (edges.every((e) => inside.includes(e) || this.isAllowed(c, side, e))) {
-					joined.add(c.objectNumber);
-					grew = true;
-				}
-			}
-		}
-	}
-	isIdentical(c) {
-		return sameEffectiveValue(c);
-	}
-	/** Signatures signed in the newer revision but not the older: this step's signing events. */
-	newlySigned() {
-		const out = [];
-		for (const sig of this.input.after.signatures) {
-			if (!sig.signed || sig.field.kind !== "objectNumber") continue;
-			if (this.before.signedFields.has(sig.field.fieldObjectNumber)) continue;
-			out.push({
-				fieldObjectNumber: sig.field.fieldObjectNumber,
-				sig
-			});
-		}
-		return out;
-	}
-};
-function ruleXrefContainer(ctx) {
-	for (const c of ctx.changes) if (c.kind === "xref" || c.kind === "objstm") {
-		ctx.claimAll(c, "xref-container");
-		ctx.permitted(c, "xref-container", "cross-reference container; members are judged on their own");
-	}
-}
-/**
-* An object written again with the value the sealed revision holds is not
-* a modification: Acrobat compares objects by value and reports such a
-* revision as "not modified" for every role tried - document information,
-* a custom catalog entry, a page, the signed signature's own widget, a text
-* field, an annotation, the encryption dictionary, reserialised with keys
-* reordered, under a certification, under a field lock (corpus v1/02-07,
-* 23, v2/47, v3/54-62, 70, 71, 77). Under P=1 nothing is established and
-* the rewrite stays forbidden. Claimed here so the object-kind rules skip
-* it; the verdict treats it as no effective change.
-*/
-function ruleIdenticalRewrite(ctx) {
-	for (const c of ctx.changes) {
-		if (!ctx.isIdentical(c)) continue;
-		if (ctx.allows("fill")) {
-			ctx.claimAll(c, "identical-rewrite");
-			ctx.permitted(c, "identical-rewrite", "written again with the sealed value");
-		} else {
-			ctx.claimAll(c, "identical-rewrite", false);
-			ctx.forbidden(c, "identical-rewrite", `written again with the sealed value under level '${ctx.level}' (not established for this level)`);
-		}
-	}
-}
-function ruleTrailer(ctx) {
-	const c = ctx.byNum.get(0);
-	if (!c) return;
-	const changed = changedKeys(c.value.old, c.value.new);
-	const bad = [...changed].filter((k) => !TRAILER_KEYS.has(k));
-	const oldRoot = dictEntries(c.value.old)?.Root;
-	const newRoot = dictEntries(c.value.new)?.Root;
-	if (bad.length > 0) {
-		ctx.forbidden(c, "trailer", `trailer keys changed: ${bad.join(", ")}`);
-		return;
-	}
-	if (changed.has("Root") && !pdfValueEquals(oldRoot ?? null, newRoot ?? null)) {
-		ctx.forbidden(c, "trailer", "the trailer points at a different catalog");
-		return;
-	}
-	if (changed.has("Encrypt") && !pdfValueEquals(dictEntries(c.value.old)?.Encrypt ?? null, dictEntries(c.value.new)?.Encrypt ?? null)) {
-		ctx.forbidden(c, "trailer", "the trailer points at a different encryption dictionary");
-		return;
-	}
-	ctx.claimAll(c, "trailer");
-	ctx.permitted(c, "trailer");
-}
-function onlyEdges(c, test) {
-	const all = [...c.usage.old, ...c.usage.new];
-	return all.length > 0 && all.every(test);
-}
-function ruleInfo(ctx) {
-	for (const c of ctx.changes) {
-		if (ctx.isIdentical(c)) continue;
-		if (c.objectNumber !== 0 && onlyEdges(c, (e) => e.parent === 0 && e.label === "Info")) {
-			ctx.claimAll(c, "info");
-			ctx.permitted(c, "info", "document information dictionary");
-		}
-	}
-}
-function ruleMetadata(ctx) {
-	const roots = /* @__PURE__ */ new Set([ctx.input.before.root, ctx.input.after.root]);
-	for (const c of ctx.changes) {
-		if (ctx.isIdentical(c)) continue;
-		if (onlyEdges(c, (e) => roots.has(e.parent) && e.label === "Metadata")) {
-			ctx.claimAll(c, "metadata");
-			ctx.permitted(c, "metadata", "XMP metadata stream");
-		}
-	}
-}
-function ruleCatalog(ctx) {
-	const root = ctx.input.after.root;
-	const c = ctx.byNum.get(root);
-	if (!c || ctx.isIdentical(c)) return;
-	const changed = changedKeys(c.value.old, c.value.new);
-	const bad = [...changed].filter((k) => !CATALOG_KEYS.has(k));
-	if (bad.length > 0) {
-		ctx.forbidden(c, "catalog-housekeeping", `catalog keys changed: ${bad.join(", ")}`);
-		return;
-	}
-	if (changed.has("AcroForm") && !ctx.input.after.acroForm && !ctx.input.before.acroForm) {
-		const problem = acroFormProblem(ctx, dictEntries(c.value.old)?.AcroForm ?? null, dictEntries(c.value.new)?.AcroForm ?? null);
-		if (problem) {
-			ctx.forbidden(c, "acroform-housekeeping", problem);
-			return;
-		}
-		for (const side of SIDES) ctx.claimSubtree(side, /* @__PURE__ */ new Set([root]), (label) => label.startsWith("AcroForm/DR/"), "acroform-housekeeping");
-	}
-	if (changed.has("Perms")) {
-		const after = require_resolver.deriveProtection(ctx.input.after.signatures);
-		const before = require_resolver.deriveProtection(ctx.input.before.signatures);
-		if (!after.certification || before.judged !== null) {
-			ctx.forbidden(c, "catalog-housekeeping", "/Perms may only appear with the certification signature, in the first signed revision");
-			return;
-		}
-	}
-	ctx.claimAll(c, "catalog-housekeeping");
-	ctx.permitted(c, "catalog-housekeeping");
-}
-function ruleAcroForm(ctx) {
-	const acro = ctx.input.after.acroForm || ctx.input.before.acroForm;
-	if (!acro) return;
-	const c = ctx.byNum.get(acro);
-	if (!c || ctx.isIdentical(c)) return;
-	const problem = acroFormProblem(ctx, c.value.old, c.value.new);
-	if (problem) {
-		ctx.forbidden(c, "acroform-housekeeping", problem);
-		return;
-	}
-	ctx.claimAll(c, "acroform-housekeeping");
-	ctx.permitted(c, "acroform-housekeeping");
-	for (const side of SIDES) ctx.claimSubtree(side, /* @__PURE__ */ new Set([acro]), (label) => label.startsWith("DR/"), "acroform-housekeeping");
-}
-/** What is wrong with an AcroForm dictionary change, or null when it is housekeeping. */
-function acroFormProblem(ctx, oldValue, newValue) {
-	const changed = changedKeys(oldValue, newValue);
-	const bad = [...changed].filter((k) => !ACROFORM_KEYS.has(k));
-	if (bad.length > 0) return `AcroForm keys changed: ${bad.join(", ")}`;
-	if (changed.has("Fields")) {
-		const oldRefs = refsOf(dictEntries(oldValue)?.Fields);
-		const newRefs = refsOf(dictEntries(newValue)?.Fields);
-		if (oldRefs.length > newRefs.length || oldRefs.some((n, i) => newRefs[i] !== n)) return "/AcroForm /Fields is not append-only";
-		const newSigFields = newSignatureFields(ctx);
-		const strangers = newRefs.slice(oldRefs.length).filter((n) => !newSigFields.has(n));
-		if (strangers.length > 0) return `/AcroForm /Fields gained non-signature fields: ${strangers.join(", ")}`;
-	}
-	return null;
-}
-/** The refs appended to an array-valued key when the old array is a prefix of the new one; null otherwise. */
-function appendedRefs(c, key) {
-	const oldItems = dictEntries(c.value.old)?.[key];
-	const newItems = dictEntries(c.value.new)?.[key];
-	const oldRefs = refsOf(oldItems);
-	const newRefs = refsOf(newItems);
-	if (oldItems && oldItems.t !== "array") return null;
-	if (!newItems || newItems.t !== "array") return null;
-	if (oldRefs.length > newRefs.length) return null;
-	for (let i = 0; i < oldRefs.length; i++) if (oldRefs[i] !== newRefs[i]) return null;
-	return newRefs.slice(oldRefs.length);
-}
-function newSignatureFields(ctx) {
-	const out = /* @__PURE__ */ new Set();
-	for (const n of ctx.after.sigFields) if (!ctx.before.fieldByObj.has(n)) out.add(n);
-	return out;
-}
-function ruleDss(ctx) {
-	const roots = /* @__PURE__ */ new Set([ctx.input.before.root, ctx.input.after.root]);
-	for (const side of SIDES) ctx.claimSubtree(side, roots, (label) => label === "DSS" || label.startsWith("DSS/"), "dss");
-	for (const c of ctx.changes) if (c.usage.new.some((e) => roots.has(e.parent) && e.label === "DSS") && !ctx.findings.some((f) => f.objectNumber === c.objectNumber)) ctx.permitted(c, "dss", "document security store");
-}
-function ruleSignatureFieldAdded(ctx) {
-	const added = newSignatureFields(ctx);
-	if (added.size === 0) return;
-	const rule = "signature-field-added";
-	if (!ctx.allows("fill")) {
-		for (const n of added) {
-			const c = ctx.byNum.get(n);
-			if (c) ctx.forbidden(c, rule, `a signature field was added under level '${ctx.level}'`);
-		}
-		return;
-	}
-	const newWidgets = /* @__PURE__ */ new Set();
-	for (const n of added) {
-		const field = ctx.after.fieldByObj.get(n);
-		const c = ctx.byNum.get(n);
-		if (c) {
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, `new signature field "${field.name}"`);
-		}
-		for (const w of field.widgets) {
-			newWidgets.add(w);
-			if (w === n) continue;
-			const wc = ctx.byNum.get(w);
-			if (wc) {
-				ctx.claimAll(wc, rule);
-				ctx.permitted(wc, rule, `widget of new signature field "${field.name}"`);
-			}
-		}
-	}
-	for (const p of ctx.after.pages) {
-		const c = ctx.byNum.get(p);
-		if (!c || ctx.isIdentical(c)) continue;
-		const changed = changedKeys(c.value.old, c.value.new);
-		if (changed.size !== 1 || !changed.has("Annots")) continue;
-		const appended = appendedRefs(c, "Annots");
-		if (appended && appended.every((n) => newWidgets.has(n))) {
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, "page /Annots gained the new signature widget");
-		}
-	}
-	for (const c of ctx.changes) {
-		if (c.kind !== "dictionary" || ctx.isIdentical(c)) continue;
-		const changed = changedKeys(c.value.old, c.value.new);
-		if (changed.size !== 1 || !changed.has("Kids")) continue;
-		const appended = appendedRefs(c, "Kids");
-		if (appended && appended.length > 0 && appended.every((n) => added.has(n) || newWidgets.has(n))) {
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, "field /Kids gained the new signature field");
-		}
-	}
-}
-function ruleSignatureAdded(ctx) {
-	const rule = "signature-added";
-	const events = ctx.newlySigned();
-	if (events.length === 0) return;
-	const addedThisStep = newSignatureFields(ctx);
-	const beforeProtection = require_resolver.deriveProtection(ctx.input.before.signatures);
-	const afterProtection = require_resolver.deriveProtection(ctx.input.after.signatures);
-	const parents = /* @__PURE__ */ new Set();
-	const values = /* @__PURE__ */ new Set();
-	for (const { fieldObjectNumber, sig } of events) {
-		const needed = sig.kind === "timestamp" ? "lta" : "fill";
-		if (!ctx.allows(needed)) {
-			const c = ctx.byNum.get(fieldObjectNumber);
-			if (c) ctx.forbidden(c, rule, `a ${sig.kind} was added under level '${ctx.level}'`);
-			continue;
-		}
-		if (sig.catalogCertification && beforeProtection.judged !== null) {
-			const c = ctx.byNum.get(fieldObjectNumber);
-			if (c) ctx.forbidden(c, rule, "a certification signature after another signature");
-			continue;
-		}
-		const field = ctx.after.fieldByObj.get(fieldObjectNumber);
-		parents.add(fieldObjectNumber);
-		for (const w of field?.widgets ?? []) parents.add(w);
-		const fieldIsNew = addedThisStep.has(fieldObjectNumber);
-		const allowedFieldKeys = beforeProtection.judged === null ? /* @__PURE__ */ new Set([...signedFieldKeysFor(ctx.level), "Lock"]) : signedFieldKeysFor(ctx.level);
-		const fc = ctx.byNum.get(fieldObjectNumber);
-		if (fc && fieldIsNew) ctx.permitted(fc, rule, `new field "${sig.fieldName}" signed`);
-		else if (fc && !ctx.isIdentical(fc)) {
-			const changed = changedKeys(fc.value.old, fc.value.new);
-			const bad = [...changed].filter((k) => !allowedFieldKeys.has(k));
-			if (bad.length > 0) {
-				ctx.forbidden(fc, rule, `signature field keys changed: ${bad.join(", ")}`);
-				ctx.claimStable(fc, rule, false);
-			} else if (changed.has("Ff") && !readOnlyOnlyChange(fc, ctx.before.fieldByObj.get(fieldObjectNumber)?.flags)) {
-				ctx.forbidden(fc, rule, "signature field flags changed beyond ReadOnly");
-				ctx.claimStable(fc, rule, false);
-			} else {
-				ctx.claimStable(fc, rule);
-				ctx.permitted(fc, rule, `field "${sig.fieldName}" signed`);
-			}
-		}
-		for (const w of field?.widgets ?? []) {
-			if (w === fieldObjectNumber || fieldIsNew) continue;
-			const wc = ctx.byNum.get(w);
-			if (!wc || ctx.isIdentical(wc)) continue;
-			const bad = [...changedKeys(wc.value.old, wc.value.new)].filter((k) => !SIGNED_WIDGET_KEYS.has(k));
-			if (bad.length > 0) {
-				ctx.forbidden(wc, rule, `signature widget keys changed: ${bad.join(", ")}`);
-				ctx.claimStable(wc, rule, false);
-				continue;
-			}
-			ctx.claimStable(wc, rule);
-			ctx.permitted(wc, rule, "signature widget appearance");
-		}
-		for (const c of ctx.changes) {
-			if (c.change !== "added") continue;
-			const asValue = c.usage.new.filter((e) => e.parent === fieldObjectNumber && e.label === "V");
-			const asLock = c.usage.new.filter((e) => e.parent === fieldObjectNumber && e.label === "Lock");
-			const type = dictEntries(c.value.new)?.Type;
-			if (asValue.length > 0) {
-				if (!(type?.t === "name" && (type.v === "Sig" || type.v === "DocTimeStamp")) && type !== void 0) continue;
-				for (const e of c.usage.new) if (e.parent === fieldObjectNumber && e.label === "V" || e.label === "DocMDP") ctx.claimEdge(c, "new", e, rule);
-				ctx.permitted(c, rule, "signature value");
-				values.add(c.objectNumber);
-			} else if (asLock.length > 0) {
-				if (!(type === void 0 || type.t === "name" && type.v === "SigFieldLock")) continue;
-				for (const e of asLock) ctx.claimEdge(c, "new", e, rule);
-				ctx.permitted(c, rule, "field lock installed with the signature");
-			}
-		}
-	}
-	if (afterProtection.certification && beforeProtection.judged === null) {
-		const root = ctx.input.after.root;
-		for (const c of ctx.changes) if (c.change === "added" && onlyEdges(c, (e) => e.parent === root && e.label === "Perms")) {
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, "certification permissions");
-		}
-	}
-	for (const side of SIDES) ctx.claimSubtree(side, parents, (label) => label === "AP" || label.startsWith("AP/"), rule);
-	if (values.size > 0) ctx.claimSubtree("new", values, () => true, rule);
-}
-/**
-* Did `/Ff` change by gaining ReadOnly and nothing else? `/Ff` is
-* inheritable, and a lock writes `effective | ReadOnly` into the terminal
-* dictionary, so a terminal that carried no `/Ff` of its own is judged
-* against the effective flags the older revision's form model reported.
-*/
-function readOnlyOnlyChange(c, effectiveBefore) {
-	const oldFf = dictEntries(c.value.old)?.Ff;
-	const newFf = dictEntries(c.value.new)?.Ff;
-	const before = oldFf?.t === "number" ? oldFf.v : effectiveBefore ?? 0;
-	const after = newFf?.t === "number" ? newFf.v : 0;
-	return (before | FF_READ_ONLY) === after;
-}
-function ruleFormFill(ctx) {
-	const rule = "form-fill";
-	const fieldKeys = fieldKeysFor(ctx.level);
-	const widgetKeys = widgetKeysFor(ctx.level);
-	const parents = /* @__PURE__ */ new Set();
-	const fields = new Map([...ctx.before.fieldByObj, ...ctx.after.fieldByObj]);
-	for (const [num, field] of fields) {
-		if (field.family === "signature") continue;
-		const fc = ctx.byNum.get(num);
-		const widgetChanges = field.widgets.filter((w) => w !== num).map((w) => ctx.byNum.get(w)).filter(Boolean);
-		const owners = /* @__PURE__ */ new Set([num, ...field.widgets]);
-		const isAp = (label) => label === "AP" || label.startsWith("AP/");
-		const appearanceOnly = !fc && widgetChanges.length === 0 ? ctx.changes.filter((c) => SIDES.some((side) => c.usage[side].some((e) => owners.has(e.parent) && isAp(e.label))) && SIDES.every((side) => c.usage[side].every((e) => !isAp(e.label) || owners.has(e.parent)))) : [];
-		if (!fc && widgetChanges.length === 0 && appearanceOnly.length === 0) continue;
-		if (!ctx.allows("fill")) {
-			for (const c of [
-				fc,
-				...widgetChanges,
-				...appearanceOnly
-			]) if (c && !ctx.isIdentical(c)) ctx.forbidden(c, rule, `form fill under level '${ctx.level}'`);
-			continue;
-		}
-		if (appearanceOnly.length > 0) {
-			for (const c of appearanceOnly) ctx.permitted(c, rule, `appearance of field "${field.name}" regenerated`);
-			parents.add(num);
-			for (const w of field.widgets) parents.add(w);
-			continue;
-		}
-		let ok = true;
-		if (fc && !ctx.isIdentical(fc)) {
-			const changed = changedKeys(fc.value.old, fc.value.new);
-			const bad = [...changed].filter((k) => !fieldKeys.has(k));
-			if (bad.length > 0) {
-				ctx.forbidden(fc, rule, `field "${field.name}" keys changed: ${bad.join(", ")}`);
-				ctx.claimStable(fc, rule, false);
-				ok = false;
-			} else if (changed.has("Ff") && !readOnlyOnlyChange(fc, ctx.before.fieldByObj.get(num)?.flags)) {
-				ctx.forbidden(fc, rule, `field "${field.name}" flags changed beyond adding ReadOnly`);
-				ctx.claimStable(fc, rule, false);
-				ok = false;
-			} else {
-				ctx.claimStable(fc, rule);
-				const properties = [...changed].filter((k) => k !== "V" && k !== "AP" && k !== "AS" && k !== "I" && k !== "RV");
-				ctx.permitted(fc, rule, properties.length > 0 ? `field "${field.name}" ${changed.has("V") || changed.has("AS") ? "filled, " : ""}properties changed: ${properties.join(", ")}` : `field "${field.name}" filled`);
-			}
-		}
-		for (const wc of widgetChanges) {
-			if (ctx.isIdentical(wc)) continue;
-			const bad = [...changedKeys(wc.value.old, wc.value.new)].filter((k) => !widgetKeys.has(k));
-			if (bad.length > 0) {
-				ctx.forbidden(wc, rule, `widget of "${field.name}" keys changed: ${bad.join(", ")}`);
-				ctx.claimStable(wc, rule, false);
-				ok = false;
-				continue;
-			}
-			ctx.claimStable(wc, rule);
-			ctx.permitted(wc, rule, `widget of "${field.name}" appearance`);
-		}
-		if (ok) {
-			parents.add(num);
-			for (const w of field.widgets) parents.add(w);
-		}
-	}
-	for (const side of SIDES) ctx.claimSubtree(side, parents, (label) => label === "AP" || label.startsWith("AP/"), rule);
-}
-function ruleAnnotation(ctx) {
-	const rule = "annotation";
-	const pages = /* @__PURE__ */ new Set([...ctx.before.pages, ...ctx.after.pages]);
-	const widgets = /* @__PURE__ */ new Set([...ctx.before.widgetToField.keys(), ...ctx.after.widgetToField.keys()]);
-	const isWidget = (c) => {
-		if (widgets.has(c.objectNumber)) return true;
-		const sub = dictEntries(c.value.new ?? c.value.old)?.Subtype;
-		return sub?.t === "name" && sub.v === "Widget";
-	};
-	const annots = [];
-	for (const c of ctx.changes) {
-		if (c.kind !== "dictionary" || ctx.isIdentical(c)) continue;
-		if ([...c.usage.old, ...c.usage.new].some((e) => pages.has(e.parent) && e.label.startsWith("Annots/")) && !isWidget(c)) annots.push(c);
-	}
-	if (annots.length === 0) {}
-	if (!ctx.allows("annotate")) {
-		for (const c of annots) ctx.forbidden(c, rule, `annotation change under level '${ctx.level}'`);
-		return;
-	}
-	const parents = /* @__PURE__ */ new Set();
-	for (const c of annots) {
-		ctx.claimAll(c, rule);
-		ctx.permitted(c, rule, `${c.change} annotation`);
-		parents.add(c.objectNumber);
-	}
-	for (const p of pages) {
-		const c = ctx.byNum.get(p);
-		if (!c || ctx.isIdentical(c)) continue;
-		const changed = changedKeys(c.value.old, c.value.new);
-		if (changed.size === 1 && changed.has("Annots")) {
-			const removed = refsOf(dictEntries(c.value.old)?.Annots).filter((n) => !refsOf(dictEntries(c.value.new)?.Annots).includes(n));
-			const added = refsOf(dictEntries(c.value.new)?.Annots).filter((n) => !refsOf(dictEntries(c.value.old)?.Annots).includes(n));
-			if ([...removed, ...added].some((n) => widgets.has(n) && !ctx.findings.some((f) => f.objectNumber === n && f.verdict === "permitted"))) {
-				ctx.forbidden(c, rule, "page /Annots added or removed a form widget");
-				continue;
-			}
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, "page /Annots changed");
-		}
-	}
-	for (const side of SIDES) ctx.claimSubtree(side, parents, (label) => label === "AP" || label.startsWith("AP/") || label === "Popup" || label === "IRT", rule);
-}
-function ruleFieldLock(ctx) {
-	if (ctx.locks.length === 0) return;
-	const lockedFields = ctx.input.before.fields.filter((f) => ctx.locks.some((l) => require_resolver.lockCovers(l.spec, f.name)));
-	const lockedObjects = /* @__PURE__ */ new Set();
-	for (const f of lockedFields) {
-		lockedObjects.add(f.objectNumber);
-		for (const w of f.widgets) lockedObjects.add(w);
-	}
-	const frontier = new Set(lockedObjects);
-	let grew = true;
-	while (grew) {
-		grew = false;
-		for (const c of ctx.changes) {
-			if (frontier.has(c.objectNumber)) continue;
-			if (c.usage.old.length > 0 && c.usage.old.every((e) => frontier.has(e.parent))) {
-				frontier.add(c.objectNumber);
-				grew = true;
-			}
-		}
-	}
-	for (const c of ctx.changes) {
-		if (!frontier.has(c.objectNumber) || ctx.isIdentical(c)) continue;
-		const field = lockedFields.find((f) => f.objectNumber === c.objectNumber || f.widgets.includes(c.objectNumber));
-		if (field && field.objectNumber === c.objectNumber) {
-			const changed = changedKeys(c.value.old, c.value.new);
-			if (changed.size === 1 && changed.has("Ff") && readOnlyOnlyChange(c, ctx.before.fieldByObj.get(c.objectNumber)?.flags)) {
-				ctx.claimStable(c, "field-lock");
-				ctx.permitted(c, "field-lock", `ReadOnly set on locked field "${field.name}"`);
-				continue;
-			}
-		}
-		ctx.locked.add(c.objectNumber);
-		ctx.forbidden(c, "field-lock", field ? `field "${field.name}" is locked by the signature` : "part of a locked field changed");
-	}
-}
-function ruleUnexplained(ctx) {
-	for (const c of ctx.changes) {
-		if (c.value.truncated) {
-			ctx.findings.push({
-				rule: "unexplained",
-				verdict: "incomplete",
-				objectNumber: c.objectNumber,
-				detail: "value too large to inspect"
-			});
-			continue;
-		}
-		if (c.usageIncomplete) {
-			ctx.findings.push({
-				rule: "unexplained",
-				verdict: "incomplete",
-				objectNumber: c.objectNumber,
-				detail: "references could not be resolved within budget (depth, fan-out or total reads)"
-			});
-			continue;
-		}
-		if (ctx.locked.has(c.objectNumber)) continue;
-		for (const side of SIDES) for (const e of c.usage[side]) if (!ctx.isClaimed(c, side, e)) ctx.forbidden(c, "unexplained", `${side === "old" ? "was" : "is"} referenced from object ${e.parent} at ${e.label} and no rule explains it`, e);
-		if (c.usage.old.length === 0 && c.usage.new.length === 0 && !ctx.findings.some((f) => f.objectNumber === c.objectNumber)) ctx.permitted(c, "orphan", "referenced from nowhere reachable");
-	}
-}
-//#endregion
-//#region src/signature/analysis/restrictions.ts
-/**
-* The restrictions a window is judged under, read from the SEALED
-* revision's structure (what that revision declared, not what the final
-* file says).
-*
-*   - `judged` given (a signature-anchored analysis): its own FieldMDP and
-*     /Lock bind the window; other signatures' locks do not (corpus v3/85:
-*     a second signature is valid with a fill of a field the first locked).
-*     Every certification's level, own or earlier, applies (inherited:
-*     conservative until observed otherwise), as does a /Lock's /P.
-*   - no `judged` (a revision-anchored analysis): every signed signature's
-*     locks and levels, as before.
-*/
-function restrictionsFor(before, judged) {
-	const anchors = [];
-	const locks = [];
-	let enforced = null;
-	let signed = false;
-	for (const sig of before.signatures) {
-		if (!sig.signed || sig.revisionIndex === null) continue;
-		signed = true;
-		const own = judged !== null && sig.index === judged.index;
-		if (sig.catalogCertification && sig.docMdp !== null) {
-			anchors.push({
-				signatureIndex: sig.index,
-				revisionIndex: sig.revisionIndex,
-				source: "docmdp",
-				own,
-				permission: sig.docMdp
-			});
-			enforced = require_resolver.minLevel(enforced ?? "annotate", require_resolver.levelFromPermission(sig.docMdp));
-		}
-		if (sig.lock?.permission !== void 0) enforced = require_resolver.minLevel(enforced ?? "annotate", require_resolver.levelFromPermission(sig.lock.permission));
-		if (judged !== null && !own) continue;
-		if (sig.fieldMdp) {
-			anchors.push({
-				signatureIndex: sig.index,
-				revisionIndex: sig.revisionIndex,
-				source: "fieldmdp",
-				own,
-				fields: sig.fieldMdp
-			});
-			locks.push({
-				signatureIndex: sig.index,
-				source: "fieldmdp",
-				spec: sig.fieldMdp
-			});
-		}
-		if (sig.lock) {
-			anchors.push({
-				signatureIndex: sig.index,
-				revisionIndex: sig.revisionIndex,
-				source: "lock",
-				own,
-				fields: sig.lock
-			});
-			locks.push({
-				signatureIndex: sig.index,
-				source: "lock",
-				spec: sig.lock
-			});
-		}
-	}
-	return {
-		anchors,
-		level: signed ? enforced ?? "annotate" : "annotate",
-		locks
-	};
-}
-//#endregion
-//#region src/signature/analysis/resolve.ts
-const DEFAULT_EDGE_RESOLVER_BUDGET = {
-	maxDepth: 16,
-	maxEdgesPerObject: 256,
-	maxReads: 2e4
-};
-const USAGE_INCOMPLETE = "incomplete";
-/**
-* Resolves the raw inbound edges of an object (from the fork's referrer
-* index, which covers every reachable object of a revision) into edges
-* from *anchors*: the changed objects and the structural objects of the
-* revision (trailer, catalog, AcroForm, page tree root, pages, fields,
-* widgets). An edge from an unchanged, non-structural parent is replaced by
-* that parent's own anchored edges with the labels joined, so an
-* appearance stream under an unchanged indirect `/AP` dictionary reads
-* `widget:AP/N` rather than `apDict:N`.
-*
-* A graph traversal, not a path enumeration: results are memoised per
-* object, so a lattice of shared unchanged objects costs its size, not the
-* number of paths through it. Cycle edges contribute no anchors and are
-* skipped; a result computed while skipping one is not memoised.
-*/
-var EdgeResolver = class {
-	constructor(read, anchors, budget = DEFAULT_EDGE_RESOLVER_BUDGET) {
-		this.read = read;
-		this.anchors = anchors;
-		this.budget = budget;
-		require_fold._defineProperty(this, "memo", /* @__PURE__ */ new Map());
-		require_fold._defineProperty(this, "reads", 0);
-		require_fold._defineProperty(this, "exhausted", false);
-	}
-	/** Anchored edges of `objectNumber`, or `incomplete` when a budget was exceeded. */
-	resolve(objectNumber) {
-		if (this.exhausted) return USAGE_INCOMPLETE;
-		const result = this.resolveInner(objectNumber, /* @__PURE__ */ new Set());
-		return result === null ? USAGE_INCOMPLETE : result.edges;
-	}
-	resolveInner(n, active) {
-		const hit = this.memo.get(n);
-		if (hit) return hit;
-		if (active.size >= this.budget.maxDepth) return null;
-		if (this.reads >= this.budget.maxReads) {
-			this.exhausted = true;
-			return null;
-		}
-		this.reads += 1;
-		const raw = this.read(n);
-		active.add(n);
-		const edges = [];
-		let cyclic = false;
-		try {
-			for (const e of raw) {
-				if (this.anchors.has(e.parent)) edges.push(e);
-				else if (active.has(e.parent)) {
-					cyclic = true;
-					continue;
-				} else {
-					const up = this.resolveInner(e.parent, active);
-					if (up === null) return null;
-					cyclic || (cyclic = up.cyclic);
-					for (const u of up.edges) edges.push({
-						parent: u.parent,
-						label: `${u.label}/${e.label}`,
-						via: [...u.via ?? [], e.parent]
-					});
-				}
-				if (edges.length > this.budget.maxEdgesPerObject) return null;
-			}
-		} finally {
-			active.delete(n);
-		}
-		const resolution = {
-			edges,
-			cyclic
-		};
-		if (!cyclic) this.memo.set(n, resolution);
-		return resolution;
-	}
-};
-//#endregion
-//#region src/search/literal.ts
-/**
-* The fold flavor a literal query needs. Haystack and needle MUST be
-* folded with the same options; corpus caches key their pre-folded text
-* on this (the default `{}` fold is the persistable one — non-default
-* queries fold the original page text at query time).
-*/
-function foldOptionsFor(query) {
-	return {
-		keepCase: !!query.matchCase,
-		keepMarks: !!query.matchDiacritics
-	};
-}
-const WORD_UNIT = /[\p{L}\p{N}_]/u;
-const MARK = /\p{M}/u;
-/** Whether the code point ENDING at `index` (exclusive) is a word char. */
-function wordBefore(text, index) {
-	if (index <= 0) return false;
-	const unit = text.charCodeAt(index - 1);
-	const start = unit >= 56320 && unit <= 57343 && index >= 2 ? index - 2 : index - 1;
-	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(start)));
-}
-/** Whether the code point starting at `index` is a word char. */
-function wordAt(text, index) {
-	if (index >= text.length) return false;
-	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(index)));
-}
-/**
-* All non-overlapping literal matches, in original code-unit space.
-* `haystack` must have been folded with `foldOptionsFor(query)`.
-*/
-function matchLiteral(haystack, query) {
-	const needle = require_fold.foldText(query.text, foldOptionsFor(query)).folded;
-	if (needle.trim().length === 0) return [];
-	const out = [];
-	let from = 0;
-	while (from <= haystack.folded.length - needle.length) {
-		const at = haystack.folded.indexOf(needle, from);
-		if (at < 0) break;
-		if (query.wholeWord && (wordBefore(haystack.folded, at) || wordAt(haystack.folded, at + needle.length))) {
-			from = at + 1;
-			continue;
-		}
-		if (query.matchDiacritics && at + needle.length < haystack.folded.length) {
-			const after = haystack.folded.codePointAt(at + needle.length);
-			if (MARK.test(String.fromCodePoint(after))) {
-				from = at + 1;
-				continue;
-			}
-		}
-		out.push(require_fold.toOriginalRange(haystack, at, needle.length));
-		from = at + needle.length;
-	}
-	return out;
-}
-//#endregion
-//#region src/search/regex.ts
-/**
-* The portable search-regex dialect: JavaScript `u`-mode syntax MINUS the
-* features RE2 refuses (backreferences, lookaround). The local engine
-* executes patterns with JS `RegExp`; the server executes the SAME
-* pattern with RE2, whose linear-time guarantee is the ReDoS defense.
-* Restricting both sides to the common subset keeps one query string
-* valid — and equally powerful — everywhere.
-*/
-const SEARCH_REGEX_MAX_LENGTH = 512;
-/**
-* Validate a pattern against the dialect. Cheap and dependency-free —
-* viewers call it on keystroke for early feedback; engines re-validate
-* and reject bad patterns with `InvalidArg`.
-*/
-function validateSearchRegex(pattern) {
-	if (pattern.length === 0) return {
-		ok: false,
-		issue: "empty",
-		message: "Pattern is empty."
-	};
-	if (pattern.length > 512) return {
-		ok: false,
-		issue: "too-long",
-		message: `Pattern exceeds 512 characters.`
-	};
-	let inClass = false;
-	for (let i = 0; i < pattern.length; i++) {
-		const ch = pattern[i];
-		if (ch === "\\") {
-			const next = pattern[i + 1] ?? "";
-			if (!inClass && next >= "1" && next <= "9") return {
-				ok: false,
-				issue: "backreference",
-				message: `Backreference \\${next} is not supported.`
-			};
-			if (!inClass && next === "k" && pattern[i + 2] === "<") return {
-				ok: false,
-				issue: "backreference",
-				message: "Named backreferences (\\k<…>) are not supported."
-			};
-			i++;
-			continue;
-		}
-		if (inClass) {
-			if (ch === "]") inClass = false;
-			continue;
-		}
-		if (ch === "[") {
-			inClass = true;
-			continue;
-		}
-		if (ch === "(" && pattern[i + 1] === "?") {
-			const tag = pattern[i + 2] ?? "";
-			if (tag === "=" || tag === "!") return {
-				ok: false,
-				issue: "lookaround",
-				message: "Lookahead ((?=…), (?!…)) is not supported."
-			};
-			if (tag === "<" && (pattern[i + 3] === "=" || pattern[i + 3] === "!")) return {
-				ok: false,
-				issue: "lookaround",
-				message: "Lookbehind ((?<=…), (?<!…)) is not supported."
-			};
-		}
-	}
-	try {
-		new RegExp(pattern, "mu");
-	} catch (error) {
-		return {
-			ok: false,
-			issue: "syntax",
-			message: error.message
-		};
-	}
-	return { ok: true };
-}
-function validateSearchQuery(query) {
-	if (!query.regex) return { ok: true };
-	if (query.matchDiacritics) return {
-		ok: false,
-		issue: "diacritics-with-regex",
-		message: "Diacritic-sensitive matching is not available for regex patterns (regex runs on the raw text plane)."
-	};
-	return validateSearchRegex(query.text);
-}
-/**
-* All matches of a dialect-valid pattern over the RAW page text (regex
-* does not run against folded text — case handling is the `i` flag, and
-* diacritic folding never applies). `wholeWord` is a boundary POST-FILTER
-* using the same Unicode word test as the literal path — never `\b`,
-* whose ASCII word set would give the toggle different semantics in regex
-* mode ("caf" whole-word matching inside "café"). Filtering after the
-* match also survives the move to RE2 server-side. Zero-length matches
-* are skipped: search UI cannot highlight nothing, and skipping them is
-* also the infinite-loop guard for patterns like `a*`.
-*/
-function matchRegex(text, query) {
-	const valid = validateSearchQuery({
-		...query,
-		regex: true
-	});
-	if (!valid.ok) throw new Error(`Invalid search query (${valid.issue}): ${valid.message}`);
-	const re = new RegExp(query.text, query.matchCase ? "gmu" : "gimu");
-	const out = [];
-	let m;
-	while ((m = re.exec(text)) !== null) {
-		if (m[0].length === 0) {
-			const unit = text.charCodeAt(re.lastIndex);
-			re.lastIndex += unit >= 55296 && unit <= 56319 ? 2 : 1;
-			continue;
-		}
-		if (query.wholeWord && (wordBefore(text, m.index) || wordAt(text, m.index + m[0].length))) continue;
-		out.push({
-			start: m.index,
-			length: m[0].length
-		});
-	}
-	return out;
-}
-//#endregion
-//#region src/search/matcher.ts
-/**
-* The whole match stage in one pure call: page text in, original-space
-* match ranges out. Engines with a pre-folded corpus for the default fold
-* skip this and call `matchLiteral` on the cached `FoldedText` directly;
-* everything else (non-default fold options, regex, tests) comes through
-* here.
-*/
-function matchPageText(text, query) {
-	if (query.regex) return matchRegex(text, query);
-	return matchLiteral(require_fold.foldText(text, foldOptionsFor(query)), query);
-}
-//#endregion
-//#region src/search/snippet.ts
-/** Default context on each side of a match, in code units. */
-const SEARCH_SNIPPET_CONTEXT = 48;
-const WHITESPACE = /\s/;
-const WHITESPACE_ALL = /\s/g;
-const isLowSurrogate = (text, index) => {
-	const unit = text.charCodeAt(index);
-	return unit >= 56320 && unit <= 57343;
-};
-/**
-* The `'full'`-mode excerpt around one match: up to `context` code units
-* of page text on each side, trimmed to a whitespace boundary when one
-* exists inside the window (so snippets start and end on whole words),
-* never splitting a surrogate pair, whitespace flattened 1:1.
-*/
-function buildSnippet(text, range, context = 48) {
-	const matchEnd = range.start + range.length;
-	let start = Math.max(0, range.start - context);
-	if (start > 0) {
-		for (let i = start; i < range.start; i++) if (WHITESPACE.test(text[i])) {
-			start = i + 1;
-			break;
-		}
-		if (isLowSurrogate(text, start)) start++;
-	}
-	let end = Math.min(text.length, matchEnd + context);
-	if (end < text.length) {
-		for (let i = end - 1; i >= matchEnd; i--) if (WHITESPACE.test(text[i])) {
-			end = i;
-			break;
-		}
-		if (isLowSurrogate(text, end)) end--;
-	}
-	return {
-		text: text.slice(start, end).replace(WHITESPACE_ALL, " "),
-		matchStart: range.start - start,
-		matchLength: range.length
-	};
-}
-//#endregion
-//#region src/text/layout.ts
-const FLAG_EMPTY = 2;
-const isBoundary = (flags) => (flags & 3) !== 0;
-const isEmpty = (flags) => (flags & FLAG_EMPTY) !== 0;
-const CHAR_DISTANCE_FACTOR = 2.5;
-const FONT_SIZE_RATIO_THRESHOLD = 1.5;
-const VERTICAL_OVERLAP_THRESHOLD = .8;
-const LINE_OVERLAP_THRESHOLD = .5;
-/** Baseline directions within ~0.5° share a frame. */
-const FRAME_DOT_TOLERANCE = Math.cos(.0087);
-const EDGE_EPSILON = 1e-6;
-const IDENTITY_FRAME = {
-	baseline: {
-		x: 1,
-		y: 0
-	},
-	ascent: {
-		x: 0,
-		y: 1
-	}
-};
-const toFrame = (f, p) => ({
-	x: p.x * f.baseline.x + p.y * f.baseline.y,
-	y: p.x * f.ascent.x + p.y * f.ascent.y
-});
-const fromFrame = (f, p) => ({
-	x: f.baseline.x * p.x + f.ascent.x * p.y,
-	y: f.baseline.y * p.x + f.ascent.y * p.y
-});
-const ZERO_RECT = {
-	left: 0,
-	bottom: 0,
-	right: 0,
-	top: 0
-};
-/** Frame-local AABB of a page-space cell (exact under the frame's rotation;
-*  shear residue is the documented in-frame envelope). */
-function frameBoxOfQuad(f, q) {
-	const pts = [
-		q.p1,
-		q.p2,
-		q.p3,
-		q.p4
-	].map((p) => toFrame(f, p));
-	const xs = pts.map((p) => p.x);
-	const ys = pts.map((p) => p.y);
-	return {
-		left: Math.min(...xs),
-		bottom: Math.min(...ys),
-		right: Math.max(...xs),
-		top: Math.max(...ys)
-	};
-}
-/** Find-or-create the frame for a rotated run, keyed by the baseline
-*  direction + ascent handedness of its first classifiable glyph's edges. */
-function frameForRun(frames, run) {
-	const seed = run.glyphs.find((g) => !isEmpty(g.flags));
-	if (!seed) return 0;
-	const q = seed.looseQuad;
-	const bx = q.p2.x - q.p1.x;
-	const by = q.p2.y - q.p1.y;
-	const len = Math.hypot(bx, by);
-	if (len <= EDGE_EPSILON) return 0;
-	const baseline = {
-		x: bx / len,
-		y: by / len
-	};
-	const ax = q.p1.x - q.p3.x;
-	const ay = q.p1.y - q.p3.y;
-	const sign = baseline.x * ay - baseline.y * ax >= 0 ? 1 : -1;
-	const ascent = {
-		x: -baseline.y * sign,
-		y: baseline.x * sign
-	};
-	for (let i = 0; i < frames.length; i++) {
-		const f = frames[i];
-		const dot = f.baseline.x * baseline.x + f.baseline.y * baseline.y;
-		const sameHandedness = f.ascent.x * ascent.x + f.ascent.y * ascent.y > 0;
-		if (dot >= FRAME_DOT_TOLERANCE && sameHandedness) return i;
-	}
-	frames.push({
-		baseline,
-		ascent
-	});
-	return frames.length - 1;
-}
-/**
-* Flatten a page's geometry snapshot into the canonical layout. Upright runs
-* copy their wire boxes verbatim (frame 0 — byte-identical to the
-* pre-orientation behavior, wire run rects included); rotated runs project
-* their glyph cells into their cluster's frame.
-*/
-function buildPageTextLayout(snapshot) {
-	const glyphs = [];
-	const runs = [];
-	const frames = [IDENTITY_FRAME];
-	for (const run of snapshot.runs) {
-		if (!require_fold.isRotatedGeometryRun(run)) {
-			for (const g of run.glyphs) glyphs.push({
-				loose: g.looseBox,
-				tight: g.tightBox,
-				flags: g.flags
-			});
-			runs.push({
-				charStart: run.charStart,
-				count: run.glyphs.length,
-				rect: run.rect,
-				fontSize: run.fontSize,
-				frame: 0
-			});
-			continue;
-		}
-		const frame = frameForRun(frames, run);
-		const f = frames[frame];
-		let runBox = null;
-		for (const g of run.glyphs) {
-			if (isEmpty(g.flags)) {
-				glyphs.push({
-					loose: ZERO_RECT,
-					flags: g.flags
-				});
-				continue;
-			}
-			const loose = frameBoxOfQuad(f, g.looseQuad);
-			const tight = g.tightQuad ? frameBoxOfQuad(f, g.tightQuad) : void 0;
-			glyphs.push({
-				loose,
-				tight,
-				flags: g.flags
-			});
-			runBox = runBox ? {
-				left: Math.min(runBox.left, loose.left),
-				bottom: Math.min(runBox.bottom, loose.bottom),
-				right: Math.max(runBox.right, loose.right),
-				top: Math.max(runBox.top, loose.top)
-			} : loose;
-		}
-		runs.push({
-			charStart: run.charStart,
-			count: run.glyphs.length,
-			rect: runBox ?? ZERO_RECT,
-			fontSize: run.fontSize,
-			frame
-		});
-	}
-	return {
-		glyphs,
-		runs,
-		frames
-	};
-}
-const inRect = (r, p) => p.x >= r.left && p.x <= r.right && p.y >= r.bottom && p.y <= r.top;
-function avgGlyphHeight(layout) {
-	let total = 0;
-	let count = 0;
-	for (const g of layout.glyphs) {
-		if (isEmpty(g.flags)) continue;
-		total += g.loose.top - g.loose.bottom;
-		count++;
-	}
-	return count === 0 ? 0 : total / count;
-}
-/** The point expressed in every frame (index-aligned with `layout.frames`).
-*  Frame 0 returns the point itself — no float round-trip on the fast path. */
-function pointPerFrame(layout, p) {
-	return layout.frames.map((f, i) => i === 0 ? p : toFrame(f, p));
-}
-/**
-* The glyph (char) index at a page-space point, or null when nothing is near
-* (so callers can show the pointer cursor off-text). PDFium `GetIndexAtPos`:
-* exact tight-box containment first, then a tolerance pass (closest by
-* Manhattan distance within `toleranceFactor × average glyph height`). Each
-* run tests the point in ITS OWN frame, so rotated text hit-tests exactly.
-*/
-function textGlyphAt(layout, point, toleranceFactor = 1.5) {
-	const pts = pointPerFrame(layout, point);
-	for (const run of layout.runs) {
-		const q = pts[run.frame];
-		if (!inRect(run.rect, q)) continue;
-		for (let i = 0; i < run.count; i++) {
-			const g = layout.glyphs[run.charStart + i];
-			if (inRect(g.tight ?? g.loose, q)) return run.charStart + i;
-		}
-	}
-	if (toleranceFactor <= 0) return null;
-	const half = avgGlyphHeight(layout) * toleranceFactor / 2;
-	let best = -1;
-	let bestDist = Infinity;
-	for (const run of layout.runs) {
-		const q = pts[run.frame];
-		const r = run.rect;
-		if (q.x < r.left - half || q.x > r.right + half || q.y < r.bottom - half || q.y > r.top + half) continue;
-		for (let i = 0; i < run.count; i++) {
-			const g = layout.glyphs[run.charStart + i];
-			if (isEmpty(g.flags)) continue;
-			const b = g.tight ?? g.loose;
-			if (q.x < b.left - half || q.x > b.right + half || q.y < b.bottom - half || q.y > b.top + half) continue;
-			const dx = Math.min(Math.abs(q.x - b.left), Math.abs(q.x - b.right));
-			const dy = Math.min(Math.abs(q.y - b.bottom), Math.abs(q.y - b.top));
-			if (dx + dy < bestDist) {
-				bestDist = dx + dy;
-				best = run.charStart + i;
-			}
-		}
-	}
-	return best >= 0 ? best : null;
-}
-/** Double-click: the word around `glyph` (walk to space/empty glyphs both ways). */
-function expandTextRangeToWord(layout, glyph) {
-	const n = layout.glyphs.length;
-	if (glyph < 0 || glyph >= n) return [glyph, glyph];
-	let from = glyph;
-	while (from > 0 && !isBoundary(layout.glyphs[from - 1].flags)) from--;
-	let to = glyph;
-	while (to < n - 1 && !isBoundary(layout.glyphs[to + 1].flags)) to++;
-	return [from, to];
-}
-/** Triple-click: the full visual line — SAME-FRAME runs whose vertical extent
-*  overlaps the anchor run's. A differently-oriented run is a line boundary. */
-function expandTextRangeToLine(layout, glyph) {
-	const ri = layout.runs.findIndex((r) => glyph >= r.charStart && glyph < r.charStart + r.count);
-	if (ri < 0) return [glyph, glyph];
-	const anchor = layout.runs[ri];
-	const bottom = anchor.rect.bottom;
-	const top = anchor.rect.top;
-	let from = anchor.charStart;
-	let to = anchor.charStart + anchor.count - 1;
-	for (let r = ri - 1; r >= 0; r--) {
-		const run = layout.runs[r];
-		if (isZero(run.rect)) continue;
-		if (run.frame !== anchor.frame) break;
-		if (!overlapV(run.rect.bottom, run.rect.top, bottom, top)) break;
-		from = run.charStart;
-	}
-	for (let r = ri + 1; r < layout.runs.length; r++) {
-		const run = layout.runs[r];
-		if (isZero(run.rect)) continue;
-		if (run.frame !== anchor.frame) break;
-		if (!overlapV(run.rect.bottom, run.rect.top, bottom, top)) break;
-		to = run.charStart + run.count - 1;
-	}
-	return [from, to];
-}
-/**
-* A single glyph's oriented cell in page space, or null for degenerate
-* glyphs — the anchor for caret placement at a selection boundary.
-*/
-function textGlyphQuad(layout, glyph) {
-	const g = layout.glyphs[glyph];
-	if (!g || isEmpty(g.flags)) return null;
-	const b = g.loose;
-	if (b.right <= b.left || b.top <= b.bottom) return null;
-	const run = layout.runs.find((r) => glyph >= r.charStart && glyph < r.charStart + r.count);
-	const f = layout.frames[run?.frame ?? 0];
-	return quadOfFrameRect(f, run?.frame ?? 0, b);
-}
-/**
-* Merged visual-line segments for the half-open char range
-* `[charStart, charStart + charCount)` — THE canonical segmentation. Chars
-* outside the layout are ignored.
-*/
-function textSegmentsForRange(layout, charStart, charCount) {
-	if (charCount <= 0 || layout.glyphs.length === 0) return [];
-	const lo = Math.max(0, charStart);
-	const hi = Math.min(layout.glyphs.length - 1, charStart + charCount - 1);
-	if (hi < lo) return [];
-	const subRuns = [];
-	for (const run of layout.runs) {
-		const runEnd = run.charStart + run.count - 1;
-		if (runEnd < lo || run.charStart > hi) continue;
-		const s = Math.max(lo, run.charStart);
-		const e = Math.min(hi, runEnd);
-		let left = Infinity;
-		let right = -Infinity;
-		let bottom = Infinity;
-		let top = -Infinity;
-		let charCountAcc = 0;
-		let widthSum = 0;
-		let prevRight = -Infinity;
-		let firstX = 0;
-		let lastX = 0;
-		const flush = () => {
-			if (charCountAcc > 0 && left !== Infinity) subRuns.push({
-				rect: {
-					left,
-					bottom,
-					right,
-					top
-				},
-				charCount: charCountAcc,
-				fontSize: run.fontSize,
-				frame: run.frame,
-				firstX,
-				lastX
-			});
-			left = Infinity;
-			right = -Infinity;
-			bottom = Infinity;
-			top = -Infinity;
-			charCountAcc = 0;
-			widthSum = 0;
-			prevRight = -Infinity;
-		};
-		for (let ci = s; ci <= e; ci++) {
-			const g = layout.glyphs[ci];
-			if (isEmpty(g.flags)) continue;
-			const b = g.loose;
-			if (charCountAcc > 0 && prevRight > -Infinity) {
-				const avg = widthSum / charCountAcc;
-				if (avg > 0 && Math.abs(b.left - prevRight) > CHAR_DISTANCE_FACTOR * avg) flush();
-			}
-			const centerX = (b.left + b.right) / 2;
-			if (charCountAcc === 0) firstX = centerX;
-			lastX = centerX;
-			left = Math.min(left, b.left);
-			right = Math.max(right, b.right);
-			bottom = Math.min(bottom, b.bottom);
-			top = Math.max(top, b.top);
-			charCountAcc++;
-			widthSum += b.right - b.left;
-			prevRight = b.right;
-		}
-		flush();
-	}
-	return mergeAdjacentSubRuns(subRuns).map((m) => materializeSegment(layout, m));
-}
-function mergeAdjacentSubRuns(runs) {
-	const out = [];
-	let prev = null;
-	let cur = null;
-	for (const run of runs) {
-		if (prev && cur && prev.frame === run.frame && shouldMerge(prev, run)) cur = {
-			rect: {
-				left: Math.min(cur.rect.left, run.rect.left),
-				bottom: Math.min(cur.rect.bottom, run.rect.bottom),
-				right: Math.max(cur.rect.right, run.rect.right),
-				top: Math.max(cur.rect.top, run.rect.top)
-			},
-			frame: cur.frame,
-			firstX: cur.firstX,
-			lastX: run.lastX
-		};
-		else {
-			if (cur) out.push(cur);
-			cur = {
-				rect: run.rect,
-				frame: run.frame,
-				firstX: run.firstX,
-				lastX: run.lastX
-			};
-		}
-		prev = run;
-	}
-	if (cur && cur.rect.right > cur.rect.left && cur.rect.top > cur.rect.bottom) out.push(cur);
-	return out;
-}
-/** Segment quad for a frame-local rect (frame 0: the rect's own corners,
-*  no float round-trip). Slot order US, UE, LS, LE; frame is y-up, so the
-*  upper corners sit at the frame TOP. */
-function quadOfFrameRect(f, frameIndex, r) {
-	if (frameIndex === 0) return {
-		p1: {
-			x: r.left,
-			y: r.top
-		},
-		p2: {
-			x: r.right,
-			y: r.top
-		},
-		p3: {
-			x: r.left,
-			y: r.bottom
-		},
-		p4: {
-			x: r.right,
-			y: r.bottom
-		}
-	};
-	return {
-		p1: fromFrame(f, {
-			x: r.left,
-			y: r.top
-		}),
-		p2: fromFrame(f, {
-			x: r.right,
-			y: r.top
-		}),
-		p3: fromFrame(f, {
-			x: r.left,
-			y: r.bottom
-		}),
-		p4: fromFrame(f, {
-			x: r.right,
-			y: r.bottom
-		})
-	};
-}
-function materializeSegment(layout, m) {
-	const frame = layout.frames[m.frame];
-	const quad = quadOfFrameRect(frame, m.frame, m.rect);
-	return {
-		quad,
-		rect: m.frame === 0 ? m.rect : {
-			left: Math.min(quad.p1.x, quad.p2.x, quad.p3.x, quad.p4.x),
-			bottom: Math.min(quad.p1.y, quad.p2.y, quad.p3.y, quad.p4.y),
-			right: Math.max(quad.p1.x, quad.p2.x, quad.p3.x, quad.p4.x),
-			top: Math.max(quad.p1.y, quad.p2.y, quad.p3.y, quad.p4.y)
-		},
-		advance: m.lastX >= m.firstX ? 1 : -1
-	};
-}
-function shouldMerge(a, b) {
-	if (a.fontSize != null && b.fontSize != null && a.fontSize > 0 && b.fontSize > 0) {
-		if (Math.max(a.fontSize, b.fontSize) / Math.min(a.fontSize, b.fontSize) > FONT_SIZE_RATIO_THRESHOLD) return false;
-	}
-	if (verticalOverlap(a.rect, b.rect) < VERTICAL_OVERLAP_THRESHOLD) return false;
-	const aw = (a.rect.right - a.rect.left) / a.charCount;
-	const bw = (b.rect.right - b.rect.left) / b.charCount;
-	const aL = a.rect.left - aw;
-	const aR = a.rect.right + aw;
-	const bL = b.rect.left - bw;
-	return aL < b.rect.right + bw && aR > bL;
-}
-function verticalOverlap(a, b) {
-	const ah = a.top - a.bottom;
-	const bh = b.top - b.bottom;
-	if (ah <= 0 || bh <= 0) return 0;
-	const u = Math.max(a.top, b.top) - Math.min(a.bottom, b.bottom);
-	if (u === ah || u === bh) return 1;
-	return Math.max(0, Math.min(a.top, b.top) - Math.max(a.bottom, b.bottom)) / u;
-}
-const isZero = (r) => r.right === r.left && r.top === r.bottom;
-function overlapV(bottom1, top1, bottom2, top2) {
-	const u = Math.max(top1, top2) - Math.min(bottom1, bottom2);
-	if (u === 0) return false;
-	return Math.max(0, Math.min(top1, top2) - Math.max(bottom1, bottom2)) / u >= LINE_OVERLAP_THRESHOLD;
-}
-//#endregion
-//#region src/search/rects.ts
-/**
-* Match-range → canonical visual-line segments. Thin wrappers over the ONE
-* text layout (`src/text/layout.ts`) — search owns matching and cursors,
-* never segmentation, so a match highlights exactly like a selection of the
-* same characters. No frame or merge logic lives here.
-*/
-/** Canonical segments for `[charStart, charStart + charCount)`. */
-function searchSegmentsForRange(snapshot, charStart, charCount) {
-	return textSegmentsForRange(buildPageTextLayout(snapshot), charStart, charCount);
-}
-/** The segments' AABBs — for consumers that genuinely want boxes. */
-function searchRectsForRange(snapshot, charStart, charCount) {
-	return searchSegmentsForRange(snapshot, charStart, charCount).map((s) => s.rect);
-}
-//#endregion
-//#region src/search/epoch.ts
-/**
-* The search CONTENT EPOCH: a deterministic fingerprint of everything a
-* search result depends on — page order/structure (`layoutVersion`) and
-* each page's text content (`contentVersion`), nothing else. Annotation
-* and metadata churn deliberately do NOT move it, so cached search
-* responses in a collaborative document survive comment storms.
-*
-* Both sides compute it from the manifest they already hold: the client
-* to mint versioned search URLs, the server to validate them (mismatch →
-* NotFound, the standard stale-versioned-read signal). FNV-1a 64-bit —
-* dependency-free and stable; not cryptographic, and doesn't need to be:
-* an adversary can only vary his OWN authorized query results.
-*/
-function searchContentEpoch(manifest) {
-	let input = `${manifest.layoutVersion}`;
-	for (const page of manifest.pages) input += `|${page.state.pageObjectNumber}:${page.cache.contentVersion}`;
-	return fnv1a64(input);
-}
-const FNV_OFFSET = 14695981039346656037n;
-const FNV_PRIME = 1099511628211n;
-const MASK_64 = 18446744073709551615n;
-function fnv1a64(input) {
-	let hash = FNV_OFFSET;
-	for (let i = 0; i < input.length; i++) {
-		hash ^= BigInt(input.charCodeAt(i));
-		hash = hash * FNV_PRIME & MASK_64;
-	}
-	return hash.toString(16).padStart(16, "0");
-}
-/**
-* Canonicalize a query for CACHE KEYING: default-fold literal queries are
-* pre-folded ("Café", "café" and "CAFE" are the same search, so they
-* should be the same cache entry). Semantics are unchanged — the fold is
-* idempotent and exactly what the matcher applies to the needle anyway.
-* Case- or diacritic-sensitive literals and regex patterns pass through
-* untouched (their raw form IS the query).
-*/
-function canonicalSearchQuery(query) {
-	if (query.regex || query.matchCase || query.matchDiacritics) return query;
-	const canonical = { text: require_fold.foldText(query.text).folded };
-	if (query.wholeWord) canonical.wholeWord = true;
-	return canonical;
-}
-//#endregion
-//#region src/auth/scope/pdf-bits.ts
-/**
-* ISO 32000 user-access permission bit positions, expressed as integer
-* masks. Bit numbers in the spec are 1-indexed, so bit 3 = `1 << 2`.
-*
-* Bits 1, 2, 7, 8, and 13+ are reserved and not surfaced here.
-*/
-const PDF_BITS = {
-	/** Bit 3 — print the document. */
-	PRINT: 4,
-	/** Bit 4 — modify content streams. */
-	MODIFY: 8,
-	/** Bit 5 — copy/extract text and graphics. */
-	COPY: 16,
-	/** Bit 6 — annotate + fill forms (+ modify form fields with bit 4). */
-	ANNOTATE_FILL: 32,
-	/** Bit 9 — fill existing forms (even if bit 6 is clear). */
-	FILL_FORMS: 256,
-	/** Bit 10 — accessibility extraction (deprecated in PDF 2.0). */
-	ACCESSIBILITY: 512,
-	/** Bit 11 — assemble document (insert/rotate/delete pages, outline). */
-	ASSEMBLE: 1024,
-	/** Bit 12 — high-quality print (refines bit 3). */
-	PRINT_HIGH: 2048
-};
-/**
-* Decode a raw PDFium permission integer into a typed boolean view.
-*
-* `null` input (the documents row column is nullable until probed)
-* yields all-false bits — i.e., a maximally restrictive interpretation.
-* That keeps `pdf.permissions` expansion safe on unprobed documents.
-*/
-function decodePdfBits(raw) {
-	if (raw === null) return {
-		bit3: false,
-		bit4: false,
-		bit5: false,
-		bit6: false,
-		bit9: false,
-		bit10: false,
-		bit11: false,
-		bit12: false
-	};
-	return {
-		bit3: (raw & PDF_BITS.PRINT) !== 0,
-		bit4: (raw & PDF_BITS.MODIFY) !== 0,
-		bit5: (raw & PDF_BITS.COPY) !== 0,
-		bit6: (raw & PDF_BITS.ANNOTATE_FILL) !== 0,
-		bit9: (raw & PDF_BITS.FILL_FORMS) !== 0,
-		bit10: (raw & PDF_BITS.ACCESSIBILITY) !== 0,
-		bit11: (raw & PDF_BITS.ASSEMBLE) !== 0,
-		bit12: (raw & PDF_BITS.PRINT_HIGH) !== 0
-	};
-}
-//#endregion
-//#region src/auth/scope/builders.ts
-/**
-* Typed capability constants for customer-side JWT minting.
-*
-* The shape mirrors the dotted capability name so it reads naturally:
-*   caps.doc.text.copy()                  // "doc.text.copy"
-*   caps.doc.download()                   // "doc.download"
-*   caps.doc.download.flattened()         // "doc.download.flattened"
-*   caps.doc.print.high()                 // "doc.print.high"
-*
-* Each leaf is a function returning the literal string (as `const`) so
-* TypeScript catches typos at the call site. Wrappers like `download`
-* and `print` are `Object.assign`'d to be callable AND carry child
-* properties for the refinement capabilities.
-*/
-const caps = { doc: {
-	open: () => "doc.open",
-	render: () => "doc.render",
-	text: {
-		select: () => "doc.text.select",
-		copy: () => "doc.text.copy",
-		search: () => "doc.text.search"
-	},
-	content: { copy: () => "doc.content.copy" },
-	download: Object.assign(() => "doc.download", { flattened: () => "doc.download.flattened" }),
-	print: Object.assign(() => "doc.print", { high: () => "doc.print.high" }),
-	pages: {
-		modify: () => "doc.pages.modify",
-		assemble: () => "doc.pages.assemble"
-	},
-	forms: {
-		read: () => "doc.forms.read",
-		fill: () => "doc.forms.fill",
-		modify: () => "doc.forms.modify"
-	},
-	annotate: {
-		read: () => "doc.annotate.read",
-		modify: () => "doc.annotate.modify"
-	},
-	metadata: { modify: () => "doc.metadata.modify" },
-	attachments: { modify: () => "doc.attachments.modify" },
-	redact: () => "doc.redact"
-} };
-/**
-* Builder factory for collab scope filters. Each entity:action pair
-* gets a sub-object with the four filter constructors.
-*
-*   collab.annotations.create.self()           → "annotations:create:self"
-*   collab.annotations.create.group("legal")   → "annotations:create:group=legal"
-*   collab.annotations.update.group("4")       → "annotations:update:group=4"
-*   collab.annotations.delete.createdBy("u-7") → "annotations:delete:createdBy=u-7"
-*   collab.annotations.setGroup.group("legal") → "annotations:set-group:group=legal"
-*   collab.annotations.all.all()               → "annotations:*:all"  (action wildcard)
-*
-* On create, the filter is evaluated against the caller's own identity
-* (no impersonation), so `:self` and `:all` trivially pass; `:group=X`
-* is the meaningful filter — it constrains creation to callers whose
-* default group is X.
-*/
-const collab = { annotations: {
-	create: makeFilterBuilder("annotations", "create"),
-	update: makeFilterBuilder("annotations", "update"),
-	delete: makeFilterBuilder("annotations", "delete"),
-	setGroup: makeSetGroupBuilder(),
-	/** Action wildcard — matches create, update, delete, AND set-group with the given filter. */
-	all: makeFilterBuilder("annotations", "*")
-} };
-function makeFilterBuilder(entity, action) {
-	return {
-		all: () => `${entity}:${action}:all`,
-		self: () => `${entity}:${action}:self`,
-		createdBy: (userId) => `${entity}:${action}:createdBy=${userId}`,
-		group: (groupId) => `${entity}:${action}:group=${groupId}`
-	};
-}
-function makeSetGroupBuilder() {
-	return {
-		all: () => "annotations:set-group:all",
-		group: (groupId) => `annotations:set-group:group=${groupId}`
-	};
-}
-/**
-* Builder for the `pdf.permissions` virtual scope. Returns the literal
-* string; provided as a helper for parity with caps/collab in JWT
-* construction code.
-*/
-const pdfPermissions = () => "pdf.permissions";
-/**
-* Materialise `pdf.permissions` into the concrete capability list it
-* would expand to under the given PDF bit configuration.
-*
-* Useful when the customer wants to start from PDF defaults and then
-* subtract specific capabilities — easier to build the JWT scope array
-* by filtering an explicit list than by composing virtual + denials.
-*
-*   const defaults = materializePdfPermissions(pdfBits);
-*   const scope = [
-*     ...defaults.filter(s => s !== 'doc.text.copy'),
-*     'doc.download',
-*   ];
-*
-* IMPORTANT: this MUST stay in sync with `addPdfPermissions` inside
-* resolver.ts. A test pins them together.
-*/
-function materializePdfPermissions(b) {
-	const out = /* @__PURE__ */ new Set();
-	out.add("doc.open");
-	out.add("doc.render");
-	out.add("doc.annotate.read");
-	out.add("doc.forms.read");
-	if (b.bit5) {
-		out.add("doc.text.select");
-		out.add("doc.text.copy");
-		out.add("doc.text.search");
-		out.add("doc.content.copy");
-	}
-	if (b.bit3) out.add("doc.print");
-	if (b.bit12 && b.bit3) out.add("doc.print.high");
-	if (b.bit4) {
-		out.add("doc.pages.modify");
-		out.add("doc.redact");
-		out.add("doc.metadata.modify");
-		out.add("doc.attachments.modify");
-	}
-	if (b.bit11) out.add("doc.pages.assemble");
-	if (b.bit6) out.add("doc.annotate.modify");
-	if (b.bit6 || b.bit9) {
-		out.add("doc.forms.fill");
-		out.add("doc.sign");
-	}
-	if (b.bit6 && b.bit4) out.add("doc.forms.modify");
-	return [...out];
-}
-//#endregion
-Object.defineProperty(exports, "DEFAULT_EDGE_RESOLVER_BUDGET", {
-	enumerable: true,
-	get: function() {
-		return DEFAULT_EDGE_RESOLVER_BUDGET;
-	}
-});
-Object.defineProperty(exports, "DEFAULT_PDF_SAVE_MODE", {
-	enumerable: true,
-	get: function() {
-		return DEFAULT_PDF_SAVE_MODE;
-	}
-});
-Object.defineProperty(exports, "EdgeResolver", {
-	enumerable: true,
-	get: function() {
-		return EdgeResolver;
-	}
-});
-Object.defineProperty(exports, "NO_ANNOTATION_FLAGS", {
-	enumerable: true,
-	get: function() {
-		return NO_ANNOTATION_FLAGS;
-	}
-});
-Object.defineProperty(exports, "PDF_BITS", {
-	enumerable: true,
-	get: function() {
-		return PDF_BITS;
-	}
-});
-Object.defineProperty(exports, "SEARCH_REGEX_MAX_LENGTH", {
-	enumerable: true,
-	get: function() {
-		return SEARCH_REGEX_MAX_LENGTH;
-	}
-});
-Object.defineProperty(exports, "SEARCH_SNIPPET_CONTEXT", {
-	enumerable: true,
-	get: function() {
-		return SEARCH_SNIPPET_CONTEXT;
-	}
-});
-Object.defineProperty(exports, "UNKNOWN_WEAK_ANNOTATION_STATE", {
-	enumerable: true,
-	get: function() {
-		return UNKNOWN_WEAK_ANNOTATION_STATE;
-	}
-});
-Object.defineProperty(exports, "USAGE_INCOMPLETE", {
-	enumerable: true,
-	get: function() {
-		return USAGE_INCOMPLETE;
-	}
-});
-Object.defineProperty(exports, "appearanceImpactOf", {
-	enumerable: true,
-	get: function() {
-		return appearanceImpactOf;
-	}
-});
-Object.defineProperty(exports, "assessmentOf", {
-	enumerable: true,
-	get: function() {
-		return assessmentOf;
-	}
-});
-Object.defineProperty(exports, "buildCommentThreads", {
-	enumerable: true,
-	get: function() {
-		return buildCommentThreads;
-	}
-});
-Object.defineProperty(exports, "buildPageTextLayout", {
-	enumerable: true,
-	get: function() {
-		return buildPageTextLayout;
-	}
-});
-Object.defineProperty(exports, "buildSnippet", {
-	enumerable: true,
-	get: function() {
-		return buildSnippet;
-	}
-});
-Object.defineProperty(exports, "buildThreads", {
-	enumerable: true,
-	get: function() {
-		return buildThreads;
-	}
-});
-Object.defineProperty(exports, "canonicalSearchQuery", {
-	enumerable: true,
-	get: function() {
-		return canonicalSearchQuery;
-	}
-});
-Object.defineProperty(exports, "caps", {
-	enumerable: true,
-	get: function() {
-		return caps;
-	}
-});
-Object.defineProperty(exports, "changedKeys", {
-	enumerable: true,
-	get: function() {
-		return changedKeys;
-	}
-});
-Object.defineProperty(exports, "changesAnnotationList", {
-	enumerable: true,
-	get: function() {
-		return changesAnnotationList;
-	}
-});
-Object.defineProperty(exports, "classifyRelation", {
-	enumerable: true,
-	get: function() {
-		return classifyRelation;
-	}
-});
-Object.defineProperty(exports, "collab", {
-	enumerable: true,
-	get: function() {
-		return collab;
-	}
-});
-Object.defineProperty(exports, "combine", {
-	enumerable: true,
-	get: function() {
-		return combine;
-	}
-});
-Object.defineProperty(exports, "conclude", {
-	enumerable: true,
-	get: function() {
-		return conclude;
-	}
-});
-Object.defineProperty(exports, "createPageImageHandle", {
-	enumerable: true,
-	get: function() {
-		return createPageImageHandle;
-	}
-});
-Object.defineProperty(exports, "decodeFieldRefKey", {
-	enumerable: true,
-	get: function() {
-		return decodeFieldRefKey;
-	}
-});
-Object.defineProperty(exports, "decodePdfBits", {
-	enumerable: true,
-	get: function() {
-		return decodePdfBits;
-	}
-});
-Object.defineProperty(exports, "decodeStableIdKey", {
-	enumerable: true,
-	get: function() {
-		return decodeStableIdKey;
-	}
-});
-Object.defineProperty(exports, "decodeSubmitFormFlags", {
-	enumerable: true,
-	get: function() {
-		return decodeSubmitFormFlags;
-	}
-});
-Object.defineProperty(exports, "dictEntries", {
-	enumerable: true,
-	get: function() {
-		return dictEntries;
-	}
-});
-Object.defineProperty(exports, "encodeFieldRefKey", {
-	enumerable: true,
-	get: function() {
-		return encodeFieldRefKey;
-	}
-});
-Object.defineProperty(exports, "encodeStableIdKey", {
-	enumerable: true,
-	get: function() {
-		return encodeStableIdKey;
-	}
-});
-Object.defineProperty(exports, "evaluateStep", {
-	enumerable: true,
-	get: function() {
-		return evaluateStep;
-	}
-});
-Object.defineProperty(exports, "expandTextRangeToLine", {
-	enumerable: true,
-	get: function() {
-		return expandTextRangeToLine;
-	}
-});
-Object.defineProperty(exports, "expandTextRangeToWord", {
-	enumerable: true,
-	get: function() {
-		return expandTextRangeToWord;
-	}
-});
-Object.defineProperty(exports, "foldOptionsFor", {
-	enumerable: true,
-	get: function() {
-		return foldOptionsFor;
-	}
-});
-Object.defineProperty(exports, "invalidatesWeakIndexRefs", {
-	enumerable: true,
-	get: function() {
-		return invalidatesWeakIndexRefs;
-	}
-});
-Object.defineProperty(exports, "isStateAnnotation", {
-	enumerable: true,
-	get: function() {
-		return isStateAnnotation;
-	}
-});
-Object.defineProperty(exports, "isValidPageObjectNumber", {
-	enumerable: true,
-	get: function() {
-		return isValidPageObjectNumber;
-	}
-});
-Object.defineProperty(exports, "knownWeakAnnotationState", {
-	enumerable: true,
-	get: function() {
-		return knownWeakAnnotationState;
-	}
-});
-Object.defineProperty(exports, "matchLiteral", {
-	enumerable: true,
-	get: function() {
-		return matchLiteral;
-	}
-});
-Object.defineProperty(exports, "matchPageText", {
-	enumerable: true,
-	get: function() {
-		return matchPageText;
-	}
-});
-Object.defineProperty(exports, "matchRegex", {
-	enumerable: true,
-	get: function() {
-		return matchRegex;
-	}
-});
-Object.defineProperty(exports, "materializePdfPermissions", {
-	enumerable: true,
-	get: function() {
-		return materializePdfPermissions;
-	}
-});
-Object.defineProperty(exports, "normalizeAnnotationDraft", {
-	enumerable: true,
-	get: function() {
-		return normalizeAnnotationDraft;
-	}
-});
-Object.defineProperty(exports, "normalizeAnnotationPatch", {
-	enumerable: true,
-	get: function() {
-		return normalizeAnnotationPatch;
-	}
-});
-Object.defineProperty(exports, "normalizeAttachmentFileSource", {
-	enumerable: true,
-	get: function() {
-		return normalizeAttachmentFileSource;
-	}
-});
-Object.defineProperty(exports, "parsePdfValue", {
-	enumerable: true,
-	get: function() {
-		return parsePdfValue;
-	}
-});
-Object.defineProperty(exports, "pdfPermissions", {
-	enumerable: true,
-	get: function() {
-		return pdfPermissions;
-	}
-});
-Object.defineProperty(exports, "pdfValueEquals", {
-	enumerable: true,
-	get: function() {
-		return pdfValueEquals;
-	}
-});
-Object.defineProperty(exports, "primaryFinding", {
-	enumerable: true,
-	get: function() {
-		return primaryFinding;
-	}
-});
-Object.defineProperty(exports, "refKey", {
-	enumerable: true,
-	get: function() {
-		return refKey;
-	}
-});
-Object.defineProperty(exports, "refsOf", {
-	enumerable: true,
-	get: function() {
-		return refsOf;
-	}
-});
-Object.defineProperty(exports, "resolveBinarySource", {
-	enumerable: true,
-	get: function() {
-		return resolveBinarySource;
-	}
-});
-Object.defineProperty(exports, "restrictionsFor", {
-	enumerable: true,
-	get: function() {
-		return restrictionsFor;
-	}
-});
-Object.defineProperty(exports, "restrictionsOf", {
-	enumerable: true,
-	get: function() {
-		return restrictionsOf;
-	}
-});
-Object.defineProperty(exports, "revisionTokensEqual", {
-	enumerable: true,
-	get: function() {
-		return revisionTokensEqual;
-	}
-});
-Object.defineProperty(exports, "richTextParagraphsFromPlainText", {
-	enumerable: true,
-	get: function() {
-		return richTextParagraphsFromPlainText;
-	}
-});
-Object.defineProperty(exports, "richTextPlainText", {
-	enumerable: true,
-	get: function() {
-		return richTextPlainText;
-	}
-});
-Object.defineProperty(exports, "sameEffectiveValue", {
-	enumerable: true,
-	get: function() {
-		return sameEffectiveValue;
-	}
-});
-Object.defineProperty(exports, "searchContentEpoch", {
-	enumerable: true,
-	get: function() {
-		return searchContentEpoch;
-	}
-});
-Object.defineProperty(exports, "searchRectsForRange", {
-	enumerable: true,
-	get: function() {
-		return searchRectsForRange;
-	}
-});
-Object.defineProperty(exports, "searchSegmentsForRange", {
-	enumerable: true,
-	get: function() {
-		return searchSegmentsForRange;
-	}
-});
-Object.defineProperty(exports, "semanticEqual", {
-	enumerable: true,
-	get: function() {
-		return semanticEqual;
-	}
-});
-Object.defineProperty(exports, "shiftsExistingAnnotationIndices", {
-	enumerable: true,
-	get: function() {
-		return shiftsExistingAnnotationIndices;
-	}
-});
-Object.defineProperty(exports, "sniffBinaryMetadata", {
-	enumerable: true,
-	get: function() {
-		return sniffBinaryMetadata;
-	}
-});
-Object.defineProperty(exports, "stableStringify", {
-	enumerable: true,
-	get: function() {
-		return stableStringify;
-	}
-});
-Object.defineProperty(exports, "textGlyphAt", {
-	enumerable: true,
-	get: function() {
-		return textGlyphAt;
-	}
-});
-Object.defineProperty(exports, "textGlyphQuad", {
-	enumerable: true,
-	get: function() {
-		return textGlyphQuad;
-	}
-});
-Object.defineProperty(exports, "textSegmentsForRange", {
-	enumerable: true,
-	get: function() {
-		return textSegmentsForRange;
-	}
-});
-Object.defineProperty(exports, "validateSearchQuery", {
-	enumerable: true,
-	get: function() {
-		return validateSearchQuery;
-	}
-});
-Object.defineProperty(exports, "validateSearchRegex", {
-	enumerable: true,
-	get: function() {
-		return validateSearchRegex;
-	}
-});
-Object.defineProperty(exports, "wordAt", {
-	enumerable: true,
-	get: function() {
-		return wordAt;
-	}
-});
-Object.defineProperty(exports, "wordBefore", {
-	enumerable: true,
-	get: function() {
-		return wordBefore;
-	}
-});
-Object.defineProperty(exports, "worstVerdict", {
-	enumerable: true,
-	get: function() {
-		return worstVerdict;
-	}
-});
-
-//# sourceMappingURL=builders-Bqm8yTpi.cjs.map