@embedpdf/engine-core 3.0.0-next.13 → 3.0.0-next.15

package/dist/builders-Dqo2X-dt.js

@@ -1,3121 +0,0 @@
-import { i as EngineError, n as foldText, r as toOriginalRange, s as _defineProperty, u as isRotatedGeometryRun } from "./fold-CdEJTBTn.js";
-import { f as EngineErrorCode } from "./PageInsertBlankInput-cHq9-i-z.js";
-import { _ as levelAllows, h as deriveProtection, v as levelFromPermission, x as minLevel, y as lockCovers } from "./resolver-inAVzsWt.js";
-//#region src/dto/PdfAction.ts
-/**
-* The one Table-240 decode, shared by the reader, the schema's producers,
-* and tests — so bit semantics cannot fork.
-*/
-const decodeSubmitFormFlags = (raw) => {
-	const bit = (n) => (raw & 1 << n - 1) !== 0;
-	const format = bit(9) ? "pdf" : bit(6) ? "xfdf" : bit(3) ? "html" : "fdf";
-	return {
-		raw,
-		exclude: bit(1),
-		includeNoValueFields: bit(2),
-		format,
-		method: bit(4) && (format === "html" || format === "pdf") ? "get" : "post",
-		submitCoordinates: bit(5),
-		includeAppendSaves: bit(7),
-		includeAnnotations: bit(8),
-		canonicalFormat: bit(10),
-		exclNonUserAnnots: bit(11),
-		exclFKey: bit(12),
-		embedForm: bit(14)
-	};
-};
-//#endregion
-//#region src/dto/PageRender.ts
-function createPageImageHandle(result, blobSource) {
-	return {
-		...result,
-		async objectUrl(signal) {
-			if (typeof Blob === "undefined" || typeof URL === "undefined" || !URL.createObjectURL) throw new EngineError(EngineErrorCode.RuntimeUnavailable, "Object URLs are not available in this environment");
-			const blob = await blobSource.blob(signal);
-			const url = URL.createObjectURL(blob);
-			return {
-				url,
-				revoke: () => URL.revokeObjectURL(url)
-			};
-		}
-	};
-}
-//#endregion
-//#region src/dto/PdfSaveMode.ts
-const DEFAULT_PDF_SAVE_MODE = "incremental";
-//#endregion
-//#region src/dto/RichText.ts
-/** The plain-text projection of a rich document: paragraphs joined by `\r`,
-*  runs concatenated — what the engine writes to `/Contents`. */
-function richTextPlainText(doc) {
-	return doc.paragraphs.map((p) => p.runs.map((r) => r.text).join("")).join("\r");
-}
-/** Plain text as rich paragraphs: one per line break, one run each, no
-*  overrides (the engine's own `/Contents` fallback shape). */
-function richTextParagraphsFromPlainText(text) {
-	return text.split(/\r\n|\r|\n/).map((line) => ({ runs: [{ text: line }] }));
-}
-//#endregion
-//#region src/identity/PageObjectNumber.ts
-/**
-* Type guard for the rare malformed-PDF case where a page is a direct
-* object. The engine treats `0` as malformed and throws `EngineError(NotFound)`
-* before any page-level operation.
-*/
-function isValidPageObjectNumber(value) {
-	return typeof value === "number" && Number.isInteger(value) && value > 0;
-}
-//#endregion
-//#region src/identity/AnnotationStableId.ts
-/**
-* URL-safe encoding of a stable id, used by the cloud HTTP surface as the
-* `:annotKey` route parameter. Decoded by the server back into an
-* `AnnotationStableId` via `decodeStableIdKey`.
-*
-* Format:
-*   `{ kind: 'objectNumber', value: 42 }` -> `'obj:42'`
-*   `{ kind: 'nm', value: 'foo bar' }`    -> `'nm:foo bar'`
-*
-* The caller is responsible for `encodeURIComponent`-ing the result before
-* splicing it into a URL path; `wirePaths.layerAnnotationByKey` already does
-* that. /NM values are opaque strings and may contain anything; the
-* `nm:` prefix lets the decoder distinguish them from numeric ids
-* unambiguously.
-*/
-function encodeStableIdKey(id) {
-	if (id.kind === "objectNumber") {
-		if (!Number.isInteger(id.value) || id.value <= 0) throw new RangeError(`encodeStableIdKey: objectNumber must be a positive integer, got ${id.value}`);
-		return `obj:${id.value}`;
-	}
-	return `nm:${id.value}`;
-}
-/**
-* Inverse of `encodeStableIdKey`. Returns `null` for malformed input so
-* the server can answer 400 InvalidArg with a useful message instead of
-* throwing.
-*
-* The input is the already-`decodeURIComponent`-ed segment from the route
-* path. Empty `/NM` values are rejected: `nm:` with no suffix is not a
-* valid identity.
-*/
-function decodeStableIdKey(key) {
-	if (key.startsWith("obj:")) {
-		const rest = key.slice(4);
-		const n = Number.parseInt(rest, 10);
-		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
-		return {
-			kind: "objectNumber",
-			value: n
-		};
-	}
-	if (key.startsWith("nm:")) {
-		const value = key.slice(3);
-		if (value.length === 0) return null;
-		return {
-			kind: "nm",
-			value
-		};
-	}
-	return null;
-}
-//#endregion
-//#region src/revision/RevisionToken.ts
-function revisionTokensEqual(a, b) {
-	return a.docSessionId === b.docSessionId && a.pageObjectNumber === b.pageObjectNumber && a.generation === b.generation;
-}
-//#endregion
-//#region src/revision/WeakAnnotationState.ts
-const UNKNOWN_WEAK_ANNOTATION_STATE = { kind: "unknown" };
-function knownWeakAnnotationState(hasAnyWeakAnnotations) {
-	return {
-		kind: "known",
-		hasAnyWeakAnnotations
-	};
-}
-//#endregion
-//#region src/annotation/primitives.ts
-const NO_ANNOTATION_FLAGS = {
-	invisible: false,
-	hidden: false,
-	print: false,
-	noZoom: false,
-	noRotate: false,
-	noView: false,
-	readOnly: false,
-	locked: false,
-	toggleNoView: false,
-	lockedContents: false
-};
-//#endregion
-//#region src/resource/BinarySource.ts
-function isBlob(value) {
-	return typeof Blob !== "undefined" && value instanceof Blob;
-}
-/**
-* Copy a Uint8Array view into a fresh, exactly-sized ArrayBuffer the call
-* owns. Always copies — even when the view spans its whole buffer — because
-* the result may be transferred to a worker (detaching it), and the view is
-* the caller's. Returning `view.buffer` here would let one transfer zero
-* the caller's bytes (a stamp library's Uint8Array became single-use).
-* Callers wanting a zero-copy hand-off need an explicit "give" form, as
-* `pages.insert` has for bare ArrayBuffers; `BinarySource` has none.
-*/
-function toOwnedArrayBuffer(view) {
-	const copy = new ArrayBuffer(view.byteLength);
-	new Uint8Array(copy).set(view);
-	return copy;
-}
-/**
-* Resolve any accepted `BinarySource` form into a `WireResource`.
-* Async because Blob bytes can only be read asynchronously.
-*/
-async function resolveBinarySource(source) {
-	if (source instanceof Uint8Array) return { bytes: toOwnedArrayBuffer(source) };
-	if (isBlob(source)) {
-		const blobName = blobFileName(source);
-		return {
-			bytes: await source.arrayBuffer(),
-			mimeType: source.type || void 0,
-			...blobName !== void 0 ? { name: blobName } : {}
-		};
-	}
-	const { data, mimeType, name } = source;
-	const inner = data instanceof Uint8Array ? {
-		bytes: toOwnedArrayBuffer(data),
-		mimeType: void 0,
-		name: void 0
-	} : {
-		bytes: await data.arrayBuffer(),
-		mimeType: data.type || void 0,
-		name: blobFileName(data)
-	};
-	const resolvedName = name ?? inner.name;
-	return {
-		bytes: inner.bytes,
-		...mimeType ?? inner.mimeType ? { mimeType: mimeType ?? inner.mimeType } : {},
-		...resolvedName !== void 0 ? { name: resolvedName } : {}
-	};
-}
-/** A browser `File` is a Blob with a `name` — pick it up so attachment
-*  drafts can pass a `File` directly without repeating the file name. */
-function blobFileName(blob) {
-	const name = blob.name;
-	return typeof name === "string" && name.length > 0 ? name : void 0;
-}
-//#endregion
-//#region src/resource/binaryMetadata.ts
-/**
-* Detect format (and intrinsic dimensions for rasters) of a binary buffer.
-*
-* @returns metadata, or `null` for unsupported/corrupt data
-*/
-function sniffBinaryMetadata(buffer) {
-	if (buffer.byteLength < 4) return null;
-	const bytes = new Uint8Array(buffer);
-	if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) return parsePng(buffer);
-	if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return parseJpeg(buffer);
-	if (bytes[0] === 37 && bytes[1] === 80 && bytes[2] === 68 && bytes[3] === 70) return { mimeType: "application/pdf" };
-	return null;
-}
-function parsePng(buffer) {
-	if (buffer.byteLength < 24) return null;
-	const view = new DataView(buffer);
-	const width = view.getUint32(16);
-	const height = view.getUint32(20);
-	if (width === 0 || height === 0) return null;
-	return {
-		mimeType: "image/png",
-		width,
-		height
-	};
-}
-function parseJpeg(buffer) {
-	const bytes = new Uint8Array(buffer);
-	let offset = 2;
-	while (offset + 4 < bytes.byteLength) {
-		if (bytes[offset] !== 255) return null;
-		const marker = bytes[offset + 1];
-		if (marker >= 192 && marker <= 195) {
-			if (offset + 9 > bytes.byteLength) return null;
-			const view = new DataView(buffer, offset + 5);
-			const height = view.getUint16(0);
-			const width = view.getUint16(2);
-			if (width === 0 || height === 0) return null;
-			return {
-				mimeType: "image/jpeg",
-				width,
-				height
-			};
-		}
-		if (marker === 216 || marker === 217) offset += 2;
-		else if (marker === 255) offset += 1;
-		else {
-			const segLen = bytes[offset + 2] << 8 | bytes[offset + 3];
-			offset += 2 + segLen;
-		}
-	}
-	return null;
-}
-//#endregion
-//#region src/annotation/kinds/file-attachment/normalize.ts
-/**
-* Resolve an attachment `file` into its wire halves: metadata into the
-* JSON body, bytes into the resource map. Unlike stamps there is NO
-* format allowlist — attaching arbitrary files is the point — so the
-* declared mime type wins (attachment formats cannot be reliably sniffed;
-* the writer falls back to `application/octet-stream` when absent).
-*
-* Shared by the file-attachment annotation draft (below) and the
-* document-level `attachments.create` mutation — one vocabulary, one
-* normalizer for both homes a file can enter a PDF through.
-*/
-async function normalizeAttachmentFileSource(file, key) {
-	const resolved = await resolveBinarySource(file.data);
-	const name = file.name ?? resolved.name;
-	if (!name) throw new EngineError(EngineErrorCode.InvalidArg, "attachment file requires a name — pass { data, name } or a File whose name is set");
-	const mimeType = file.mimeType ?? resolved.mimeType;
-	return {
-		wireFile: {
-			resource: key,
-			name,
-			...mimeType !== void 0 ? { mimeType } : {},
-			...file.description !== void 0 ? { description: file.description } : {}
-		},
-		resource: {
-			bytes: resolved.bytes,
-			...mimeType !== void 0 ? { mimeType } : {},
-			name
-		}
-	};
-}
-async function normalizeFileAttachmentDraft(draft, allocateKey) {
-	const { file, ...rest } = draft;
-	const key = allocateKey();
-	const { wireFile, resource } = await normalizeAttachmentFileSource(file, key);
-	return {
-		wire: {
-			...rest,
-			file: wireFile
-		},
-		resources: { [key]: resource }
-	};
-}
-//#endregion
-//#region src/annotation/kinds/stamp/normalize.ts
-/**
-* Resolve + validate a stamp `source`. Sniffing happens here — before any
-* transport — so callers get a fast `InvalidArg` instead of a worker/HTTP
-* round-trip. The sniffed mime type overwrites whatever was declared.
-*/
-async function resolveStampSource(source) {
-	const resolved = await resolveBinarySource(source);
-	const meta = sniffBinaryMetadata(resolved.bytes);
-	if (!meta) throw new EngineError(EngineErrorCode.InvalidArg, "stamp source must be PNG, JPEG, or single-page PDF bytes (format is detected from the data, not the declared mime type)");
-	return {
-		...resolved,
-		mimeType: meta.mimeType
-	};
-}
-async function normalizeStampDraft(draft, allocateKey) {
-	const { source, ...rest } = draft;
-	const resolved = await resolveStampSource(source);
-	const key = allocateKey();
-	return {
-		wire: {
-			...rest,
-			source: { resource: key }
-		},
-		resources: { [key]: resolved }
-	};
-}
-async function normalizeStampPatch(patch, allocateKey) {
-	if (patch.source === void 0) {
-		const { source: _source, ...rest } = patch;
-		return {
-			wire: rest,
-			resources: {}
-		};
-	}
-	const { source, ...rest } = patch;
-	const resolved = await resolveStampSource(source);
-	const key = allocateKey();
-	return {
-		wire: {
-			...rest,
-			source: { resource: key }
-		},
-		resources: { [key]: resolved }
-	};
-}
-//#endregion
-//#region src/annotation/normalize.ts
-function createResourceKeyAllocator() {
-	let next = 0;
-	return () => `r${next++}`;
-}
-async function normalizeAnnotationDraft(draft) {
-	switch (draft.subtype) {
-		case "stamp": return normalizeStampDraft(draft, createResourceKeyAllocator());
-		case "file-attachment": return normalizeFileAttachmentDraft(draft, createResourceKeyAllocator());
-		default: return {
-			wire: draft,
-			resources: {}
-		};
-	}
-}
-async function normalizeAnnotationPatch(patch) {
-	switch (patch.subtype) {
-		case "stamp": return normalizeStampPatch(patch, createResourceKeyAllocator());
-		default: return {
-			wire: patch,
-			resources: {}
-		};
-	}
-}
-//#endregion
-//#region src/annotation/relationships.ts
-/**
-* Classify one annotation by its relationship edge alone. Mirrors the
-* spec's "practical parser rule": no `/IRT` is top-level; `/RT /Group` is
-* a grouped subordinate; anything else with an `/IRT` is a reply (the
-* engine has already normalized a missing `/RT` to `'reply'`).
-*/
-function classifyRelation(a) {
-	if (!a.inReplyTo) return "top-level";
-	return a.replyType === "group" ? "grouped-subordinate" : "reply";
-}
-/**
-* Stable string key for an {@link AnnotationRef}, used to match a child's
-* `inReplyTo` against a candidate parent's `ref`. Both sides are produced
-* by the engine with the same identity precedence (objectNumber, then nm,
-* then index), so equal keys mean "same annotation".
-*/
-function refKey(ref) {
-	switch (ref.kind) {
-		case "objectNumber": return `obj:${ref.pageObjectNumber}:${ref.annotObjectNumber}`;
-		case "nm": return `nm:${ref.pageObjectNumber}:${ref.nm}`;
-		case "index": return `idx:${ref.pageObjectNumber}:${ref.index}`;
-	}
-}
-/**
-* Compose a flat annotation list (one page, or a whole document via
-* `listRawAll()` flattened) into {@link AnnotationThread}s in primary
-* order.
-*
-* Rules (ISO 32000 §12.5.6.2 + the spec's UI rule):
-*   - Annotations with no `/IRT` become thread primaries, in input order.
-*   - A `/RT /Group` child is attached to its primary's `groupedParts`.
-*   - A `/RT /R` (or default) child is attached to its primary's `replies`.
-*   - A child whose parent is not in the input set is treated as an
-*     orphan primary (defensive — e.g. a partial/filtered page slice).
-*
-* Limitations (v1, matches the legacy stack): threading is one level deep
-* — a reply-to-a-reply is keyed to its direct parent, so it only appears
-* nested if that direct parent is itself a primary. Callers that want a
-* sidebar of "most annotations, not widgets/popups" should pre-filter the
-* input; this helper is intentionally unopinionated about eligibility.
-*/
-function buildThreads(annotations) {
-	const byKey = /* @__PURE__ */ new Map();
-	for (const a of annotations) {
-		byKey.set(refKey(a.ref), a);
-		if (a.nm && a.nm.length > 0) byKey.set(`nm:${a.ref.pageObjectNumber}:${a.nm}`, a);
-	}
-	const threads = [];
-	const threadByPrimaryKey = /* @__PURE__ */ new Map();
-	const primaryThread = (primary) => {
-		const key = refKey(primary.ref);
-		let thread = threadByPrimaryKey.get(key);
-		if (!thread) {
-			thread = {
-				primary,
-				groupedParts: [],
-				replies: []
-			};
-			threadByPrimaryKey.set(key, thread);
-			threads.push(thread);
-		}
-		return thread;
-	};
-	for (const a of annotations) if (!a.inReplyTo) primaryThread(a);
-	for (const a of annotations) {
-		if (!a.inReplyTo) continue;
-		const parent = byKey.get(refKey(a.inReplyTo));
-		if (!parent || parent.inReplyTo) {
-			primaryThread(a);
-			continue;
-		}
-		const thread = primaryThread(parent);
-		if (a.replyType === "group") thread.groupedParts.push(a);
-		else thread.replies.push(a);
-	}
-	return threads;
-}
-//#endregion
-//#region src/annotation/comments.ts
-/** Subtypes that never participate in comment threads. `unsupported`
-*  covers `/Popup` dictionaries (raw code 16) and unreadable foreign
-*  blobs — neither makes a meaningful comment card. */
-const EXCLUDED_SUBTYPES = /* @__PURE__ */ new Set([
-	"widget",
-	"link",
-	"unsupported"
-]);
-const REVIEW_STATES = /* @__PURE__ */ new Set([
-	"accepted",
-	"rejected",
-	"cancelled",
-	"completed",
-	"none"
-]);
-const MARKED_STATES = /* @__PURE__ */ new Set(["marked", "unmarked"]);
-const nonEmpty = (v) => typeof v === "string" && v !== "";
-/**
-* An ISO 32000 §12.5.6.3 state annotation: a text annotation carrying a
-* non-empty `/State` or `/StateModel`. Classification never relies on
-* flags — producers disagree on how state annotations are flagged.
-*/
-function isStateAnnotation(a) {
-	return a.subtype === "text" && (nonEmpty(a.state) || nonEmpty(a.stateModel));
-}
-function buildCommentThreads(annotations, opts = {}) {
-	const eligible = annotations.filter((a) => !EXCLUDED_SUBTYPES.has(a.subtype));
-	const byKey = /* @__PURE__ */ new Map();
-	for (const a of eligible) {
-		const key = refKey(a.ref);
-		if (!byKey.has(key)) byKey.set(key, a);
-		if (a.nm) {
-			const aliasKey = refKey({
-				kind: "nm",
-				pageObjectNumber: a.pageObjectNumber,
-				nm: a.nm
-			});
-			if (!byKey.has(aliasKey)) byKey.set(aliasKey, a);
-		}
-	}
-	const children = /* @__PURE__ */ new Map();
-	for (const a of eligible) {
-		if (!a.inReplyTo) continue;
-		const parent = byKey.get(refKey(a.inReplyTo));
-		if (!parent) continue;
-		const parentKey = refKey(parent.ref);
-		const list = children.get(parentKey);
-		if (list) list.push(a);
-		else children.set(parentKey, [a]);
-	}
-	const visited = /* @__PURE__ */ new Set();
-	const threads = [];
-	const walk = (root) => {
-		const replies = [];
-		const groupedParts = [];
-		const states = [];
-		visited.add(refKey(root.ref));
-		const stack = [...children.get(refKey(root.ref)) ?? []];
-		while (stack.length > 0) {
-			const a = stack.pop();
-			const key = refKey(a.ref);
-			if (visited.has(key)) continue;
-			visited.add(key);
-			if (isStateAnnotation(a)) states.push(a);
-			else if (classifyRelation(a) === "grouped-subordinate") groupedParts.push(a);
-			else replies.push(a);
-			stack.push(...children.get(key) ?? []);
-		}
-		replies.sort(chronological);
-		states.sort(chronological);
-		threads.push({
-			root,
-			pageObjectNumber: root.pageObjectNumber,
-			replies,
-			groupedParts,
-			review: computeReview(states, opts)
-		});
-	};
-	for (const a of eligible) if (!a.inReplyTo && !isStateAnnotation(a)) walk(a);
-	for (const a of eligible) {
-		if (visited.has(refKey(a.ref))) continue;
-		if (isStateAnnotation(a)) continue;
-		walk(a);
-	}
-	return threads;
-}
-/** `created ?? modified` ascending; undated last; z-order tiebreak. */
-function chronological(a, b) {
-	const at = a.created ?? a.modified;
-	const bt = b.created ?? b.modified;
-	if (at !== null && bt !== null && at !== bt) return at < bt ? -1 : 1;
-	if (at !== null && bt === null) return -1;
-	if (at === null && bt !== null) return 1;
-	return a.index - b.index;
-}
-function computeReview(states, opts) {
-	const byReviewer = {};
-	const markedLatest = {};
-	let lastChange = null;
-	for (const a of states) {
-		const status = toReviewStatus(a);
-		if (!status) continue;
-		if (status.stateModel === "marked") {
-			if (status.by !== null && isNewer(status, markedLatest[status.by])) markedLatest[status.by] = status;
-			continue;
-		}
-		if (status.by !== null && isNewer(status, byReviewer[status.by])) byReviewer[status.by] = status;
-		if (isNewer(status, lastChange)) lastChange = status;
-	}
-	const markedBy = Object.keys(markedLatest).filter((key) => markedLatest[key].state === "marked").sort();
-	const review = {
-		byReviewer,
-		lastChange,
-		markedBy,
-		statusRefs: states.map((a) => a.ref)
-	};
-	if (opts.currentUserId !== void 0) review.mine = byReviewer[opts.currentUserId] ?? null;
-	return review;
-}
-/**
-* Derive a `ReviewStatus` from one state annotation, or null when nothing
-* classifiable can be derived. ISO defaulting happens HERE, not in the
-* engine reader: a known model with an absent state means `none` /
-* `unmarked`; an absent model infers from a known state; a custom model
-* with no state has no derivable status.
-*/
-function toReviewStatus(a) {
-	if (a.subtype !== "text") return null;
-	const rawState = nonEmpty(a.state) ? a.state : null;
-	let stateModel = nonEmpty(a.stateModel) ? a.stateModel : null;
-	if (stateModel === null && rawState !== null) if (REVIEW_STATES.has(rawState)) stateModel = "review";
-	else if (MARKED_STATES.has(rawState)) stateModel = "marked";
-	else return null;
-	let state = rawState;
-	if (state === null) if (stateModel === "review") state = "none";
-	else if (stateModel === "marked") state = "unmarked";
-	else return null;
-	if (stateModel === null) return null;
-	return {
-		state,
-		stateModel,
-		by: a.userId ?? (nonEmpty(a.author) ? a.author : null),
-		at: a.modified ?? a.created ?? null,
-		ref: a.ref
-	};
-}
-/** `a` newer than (or supersedes) `b`. `at` decides; dated beats undated.
-*  States arrive pre-sorted by `chronological` (date, then z-order), so on
-*  equal or missing dates the later entry wins via `>=` / `true`. */
-function isNewer(a, b) {
-	if (!b) return true;
-	if (a.at !== null && b.at !== null) return a.at >= b.at;
-	if (a.at !== null) return true;
-	if (b.at !== null) return false;
-	return true;
-}
-//#endregion
-//#region src/mutation/AnnotationMutationImpactPolicy.ts
-function changesAnnotationList(_kind) {
-	return true;
-}
-function shiftsExistingAnnotationIndices(kind) {
-	return kind === "delete" || kind === "move";
-}
-function invalidatesWeakIndexRefs(kind, weakStateBefore) {
-	if (!shiftsExistingAnnotationIndices(kind)) return false;
-	if (weakStateBefore.kind !== "known") throw new Error(`invalidatesWeakIndexRefs requires a known WeakAnnotationState for ${kind}; got 'unknown'. Caller must scan the page before computing mutation impact.`);
-	return weakStateBefore.hasAnyWeakAnnotations;
-}
-//#endregion
-//#region src/annotation/appearance.ts
-/**
-* Coordinate tolerance in PDF user-space points. PDF numbers round-trip
-* through f32 (~7 significant digits) and client-side space conversions, so
-* exact float equality would misclassify no-op writes; 1e-3 pt is far below
-* anything visible while far above accumulated f32 drift at page magnitudes.
-*/
-const EPSILON = .001;
-/**
-* Keys that never affect `/AP` on any kind: the discriminator, behavioral
-* flags, reply relationships, grouping, and the conversation-plane
-* entries (`/Subj` subject line, `/State` + `/StateModel` review status —
-* dictionary-only per ISO 32000 §12.5.6.3, never painted).
-*/
-const INERT_KEYS = /* @__PURE__ */ new Set([
-	"subtype",
-	"flags",
-	"inReplyTo",
-	"replyType",
-	"groupId",
-	"subject",
-	"state",
-	"stateModel"
-]);
-/**
-* Kinds whose `/AP` paints `/Contents`. Everywhere else `contents` is popup
-* note text — editing a comment must never re-bake (or destroy) the shape's
-* appearance.
-*/
-const CONTENTS_PAINTED = /* @__PURE__ */ new Set(["free-text", "redact"]);
-/**
-* The vertex family's `/EMBD_Metadata/Rotation` is an advisory scalar (the
-* vertices are already rotated); it never drives the AP generator, so patches
-* touching it are appearance-inert for these kinds.
-*/
-const ADVISORY_ROTATION = /* @__PURE__ */ new Set([
-	"line",
-	"polyline",
-	"polygon",
-	"ink"
-]);
-/**
-* The box kinds carry the `/EMBD_Metadata` transform pair (`rotation` +
-* `unrotatedRect`), tri-state on writes: omitted fields are PRESERVED, `null`
-* (or `0` for rotation) clears. Translation verification therefore compares
-* the after-state — `patch.rotation ?? current.rotation` — not the patch keys.
-*/
-const BOX_TRANSFORM = /* @__PURE__ */ new Set([
-	"square",
-	"circle",
-	"free-text",
-	"stamp"
-]);
-/**
-* Per-kind absolute-geometry fields (PDF user space) that a rigid translation
-* shifts together. A kind absent from this table never takes the translation
-* route. `rect` is required in every entry: a translation always moves `/Rect`.
-*/
-const TRANSLATABLE_GEOMETRY = {
-	square: ["rect", "unrotatedRect"],
-	circle: ["rect", "unrotatedRect"],
-	"free-text": [
-		"rect",
-		"unrotatedRect",
-		"calloutLine"
-	],
-	line: ["rect", "linePoints"],
-	polygon: ["rect", "vertices"],
-	polyline: ["rect", "vertices"],
-	ink: ["rect", "inkList"],
-	highlight: ["rect", "quadPoints"],
-	underline: ["rect", "quadPoints"],
-	squiggly: ["rect", "quadPoints"],
-	strikeout: ["rect", "quadPoints"],
-	redact: ["rect", "quadPoints"],
-	caret: ["rect"],
-	text: ["rect"],
-	stamp: ["rect", "unrotatedRect"],
-	"file-attachment": ["rect"],
-	link: ["rect"]
-};
-const numEq = (a, b) => Math.abs(a - b) <= EPSILON;
-/** Degrees normalized to [0,360); absent reads as 0 (no rotation). */
-const normDeg = (v) => {
-	return typeof v === "number" ? (v % 360 + 360) % 360 : 0;
-};
-/**
-* Semantic equality between a patch value and the current DTO value.
-* Numbers compare within {@link EPSILON}; `null` and `undefined` both mean
-* "entry absent" (the tri-state clear of an absent entry is a no-op); arrays
-* and objects compare structurally.
-*/
-function semanticEqual(a, b) {
-	if (a == null || b == null) return a == null && b == null;
-	if (typeof a === "number" && typeof b === "number") return numEq(a, b);
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => semanticEqual(v, b[i]));
-	}
-	if (typeof a === "object" && typeof b === "object") {
-		const keys = /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)]);
-		for (const k of keys) if (!semanticEqual(a[k], b[k])) return false;
-		return true;
-	}
-	return a === b;
-}
-/**
-* Is `next` exactly `cur` shifted by `(dx, dy)`? Walks the value structurally:
-* numeric leaves under x-axis keys (`left`/`right`/`x`) must shift by `dx`,
-* y-axis keys (`bottom`/`top`/`y`) by `dy`, and any other numeric leaf must be
-* unchanged. Arrays walk elementwise (same length required).
-*/
-function shiftedBy(cur, next, dx, dy) {
-	if (cur == null || next == null) return cur == null && next == null;
-	if (Array.isArray(cur) || Array.isArray(next)) {
-		if (!Array.isArray(cur) || !Array.isArray(next) || cur.length !== next.length) return false;
-		return cur.every((v, i) => shiftedBy(v, next[i], dx, dy));
-	}
-	if (typeof cur === "object" && typeof next === "object") {
-		const keys = /* @__PURE__ */ new Set([...Object.keys(cur), ...Object.keys(next)]);
-		for (const k of keys) {
-			const c = cur[k];
-			const n = next[k];
-			if (typeof c === "number" && typeof n === "number") {
-				if (!numEq(c + (k === "left" || k === "right" || k === "x" ? dx : k === "bottom" || k === "top" || k === "y" ? dy : 0), n)) return false;
-			} else if (!shiftedBy(c, n, dx, dy)) return false;
-		}
-		return true;
-	}
-	return cur === next;
-}
-/**
-* Verify the touched geometry is one rigid translation of the current state.
-* Requires `patch.rect` (a translation always moves `/Rect`) with width and
-* height preserved; every other geometry field present on the annotation must
-* ride along shifted by the same delta — a rect move that leaves `vertices`
-* behind is NOT a translation (the dictionary would desync from the pixels).
-* For box kinds the `/EMBD_Metadata` transform group is checked as an
-* after-state: writes are tri-state (omitted preserves, null/0 clears), so an
-* omitted rotation keeps the current one — but a preserved-yet-unshifted
-* `unrotatedRect` still fails the congruence check via the field loop.
-*/
-function isRigidTranslation(cur, pat, subtype, geometryKeys) {
-	const curRect = cur.rect;
-	const patRect = pat.rect;
-	if (!curRect || !patRect) return false;
-	const dx = patRect.left - curRect.left;
-	const dy = patRect.bottom - curRect.bottom;
-	if (!numEq(patRect.right - patRect.left, curRect.right - curRect.left)) return false;
-	if (!numEq(patRect.top - patRect.bottom, curRect.top - curRect.bottom)) return false;
-	if (BOX_TRANSFORM.has(subtype)) {
-		const rotAfter = pat.rotation === void 0 ? cur.rotation : pat.rotation;
-		if (!numEq(normDeg(cur.rotation), normDeg(rotAfter))) return false;
-	}
-	for (const key of geometryKeys) {
-		if (key === "rect") continue;
-		const c = cur[key];
-		const p = pat[key];
-		if (c == null && p == null) continue;
-		if (c == null || p == null) return false;
-		if (!shiftedBy(c, p, dx, dy)) return false;
-	}
-	return true;
-}
-/**
-* Classify an update patch against the annotation's current DTO.
-*
-* 1. Value-diff: drop keys whose value semantically equals the current one,
-*    plus the always-inert metadata keys (and per-kind inert keys: `contents`
-*    where it isn't painted, advisory `rotation` on the vertex family).
-*    Nothing left → `'inert'`.
-* 2. If every remaining key is translatable geometry for this kind AND the
-*    values are one rigid translation → `'translation'`.
-* 3. Anything else — style, text, unknown keys, unknown kinds → `'regenerate'`.
-*/
-function appearanceImpactOf(current, patch) {
-	if (patch.subtype !== current.subtype) return "regenerate";
-	const cur = current;
-	const pat = patch;
-	const subtype = patch.subtype;
-	const touched = [];
-	for (const [key, value] of Object.entries(pat)) {
-		if (value === void 0 || INERT_KEYS.has(key)) continue;
-		if (key === "contents" && !CONTENTS_PAINTED.has(subtype)) continue;
-		if (key === "rotation" && ADVISORY_ROTATION.has(subtype)) continue;
-		if (!semanticEqual(value, cur[key])) touched.push(key);
-	}
-	if (touched.length === 0) return "inert";
-	const geometryKeys = TRANSLATABLE_GEOMETRY[subtype];
-	if (!geometryKeys) return "regenerate";
-	if (!touched.every((k) => geometryKeys.includes(k))) return "regenerate";
-	return isRigidTranslation(cur, pat, subtype, geometryKeys) ? "translation" : "regenerate";
-}
-//#endregion
-//#region src/identity/FormFieldRef.ts
-/**
-* URL-safe encoding of a `FormFieldRef`, used by the cloud HTTP surface as
-* the `:fieldKey` route parameter. Decoded by the server back into a
-* `FormFieldRef` via `decodeFieldRefKey`. Mirrors the annotation plane's
-* `encodeStableIdKey` (`obj:42` / `nm:…`) so the two member-key syntaxes
-* read the same on the wire:
-*
-*   `{ kind: 'objectNumber', fieldObjectNumber: 12 }` -> `'obj:12'`
-*   `{ kind: 'fqn', name: 'billing.name' }`           -> `'fqn:billing.name'`
-*
-* The caller is responsible for `encodeURIComponent`-ing the result before
-* splicing it into a URL path; the `wirePaths.layerFormField*` builders
-* already do that. FQNs are opaque strings and may contain anything; the
-* `fqn:` prefix keeps them unambiguous from numeric ids.
-*/
-function encodeFieldRefKey(ref) {
-	if (ref.kind === "objectNumber") {
-		if (!Number.isInteger(ref.fieldObjectNumber) || ref.fieldObjectNumber <= 0) throw new RangeError(`encodeFieldRefKey: fieldObjectNumber must be a positive integer, got ${ref.fieldObjectNumber}`);
-		return `obj:${ref.fieldObjectNumber}`;
-	}
-	return `fqn:${ref.name}`;
-}
-/**
-* Inverse of `encodeFieldRefKey`. Returns `null` for malformed input so the
-* server can answer 400 InvalidArg with a useful message instead of
-* throwing. The input is the already-`decodeURIComponent`-ed segment from
-* the route path. Empty FQNs are rejected: `fqn:` with no suffix is not a
-* valid identity.
-*/
-function decodeFieldRefKey(key) {
-	if (key.startsWith("obj:")) {
-		const rest = key.slice(4);
-		const n = Number.parseInt(rest, 10);
-		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
-		return {
-			kind: "objectNumber",
-			fieldObjectNumber: n
-		};
-	}
-	if (key.startsWith("fqn:")) {
-		const name = key.slice(4);
-		if (name.length === 0) return null;
-		return {
-			kind: "fqn",
-			name
-		};
-	}
-	return null;
-}
-//#endregion
-//#region src/signature/analysis/pdf-value.ts
-/**
-* Parse the fork's canonical shallow serialisation:
-*   dict     <</Key value/Key2 value>>        (keys sorted, `#xx`-escaped)
-*   array    [item item]
-*   ref      n 0 R
-*   stream   stream(length,sha256hex)<<dict>>
-*   name     /Name (with #xx escapes)
-*   string   (literal with backslash escapes) or <hex>
-*   number   -12.5   bool  true|false   null
-*/
-function parsePdfValue(text) {
-	const parser = new Parser(text);
-	const value = parser.value();
-	parser.skipSpaces();
-	if (!parser.atEnd()) throw new Error(`trailing input at ${parser.pos}: ${text.slice(parser.pos, parser.pos + 20)}`);
-	return value;
-}
-var Parser = class {
-	constructor(text) {
-		this.text = text;
-		_defineProperty(this, "pos", 0);
-	}
-	atEnd() {
-		return this.pos >= this.text.length;
-	}
-	skipSpaces() {
-		while (this.pos < this.text.length && this.text[this.pos] === " ") this.pos++;
-	}
-	value() {
-		this.skipSpaces();
-		const t = this.text;
-		if (t.startsWith("<<", this.pos)) return this.dict();
-		if (t.startsWith("stream(", this.pos)) return this.stream();
-		if (t[this.pos] === "[") return this.array();
-		if (t[this.pos] === "/") return {
-			t: "name",
-			v: this.name()
-		};
-		if (t[this.pos] === "(") return {
-			t: "string",
-			v: this.literalString()
-		};
-		if (t[this.pos] === "<") return {
-			t: "string",
-			v: this.hexString()
-		};
-		if (t.startsWith("true", this.pos)) {
-			this.pos += 4;
-			return {
-				t: "bool",
-				v: true
-			};
-		}
-		if (t.startsWith("false", this.pos)) {
-			this.pos += 5;
-			return {
-				t: "bool",
-				v: false
-			};
-		}
-		if (t.startsWith("null", this.pos)) {
-			this.pos += 4;
-			return { t: "null" };
-		}
-		const ref = /^(\d+) 0 R(?![0-9A-Za-z])/.exec(t.slice(this.pos));
-		if (ref) {
-			this.pos += ref[0].length;
-			return {
-				t: "ref",
-				num: Number(ref[1])
-			};
-		}
-		const num = /^[+-]?(?:\d+\.?\d*|\.\d+)/.exec(t.slice(this.pos));
-		if (num) {
-			this.pos += num[0].length;
-			return {
-				t: "number",
-				v: Number(num[0])
-			};
-		}
-		throw new Error(`unexpected input at ${this.pos}: ${t.slice(this.pos, this.pos + 20)}`);
-	}
-	dict() {
-		return {
-			t: "dict",
-			entries: this.dictEntries()
-		};
-	}
-	dictEntries() {
-		this.expect("<<");
-		const entries = {};
-		for (;;) {
-			this.skipSpaces();
-			if (this.text.startsWith(">>", this.pos)) {
-				this.pos += 2;
-				return entries;
-			}
-			if (this.text[this.pos] !== "/") throw new Error(`expected a key at ${this.pos}`);
-			const key = this.name();
-			this.skipSpaces();
-			entries[key] = this.value();
-		}
-	}
-	stream() {
-		const m = /^stream\((\d+),([0-9a-fA-F]*)\)/.exec(this.text.slice(this.pos));
-		if (!m) throw new Error(`malformed stream signature at ${this.pos}`);
-		this.pos += m[0].length;
-		const dict = this.dictEntries();
-		return {
-			t: "stream",
-			length: Number(m[1]),
-			sha256: m[2].toLowerCase(),
-			dict
-		};
-	}
-	array() {
-		this.expect("[");
-		const items = [];
-		for (;;) {
-			this.skipSpaces();
-			if (this.text[this.pos] === "]") {
-				this.pos++;
-				return {
-					t: "array",
-					items
-				};
-			}
-			items.push(this.value());
-		}
-	}
-	name() {
-		this.expect("/");
-		let out = "";
-		while (this.pos < this.text.length) {
-			const ch = this.text[this.pos];
-			if (ch === " " || ch === "/" || ch === "[" || ch === "]" || ch === "<" || ch === ">" || ch === "(" || ch === ")") break;
-			if (ch === "#" && /^[0-9A-Fa-f]{2}/.test(this.text.slice(this.pos + 1, this.pos + 3))) {
-				out += String.fromCharCode(parseInt(this.text.slice(this.pos + 1, this.pos + 3), 16));
-				this.pos += 3;
-				continue;
-			}
-			out += ch;
-			this.pos++;
-		}
-		return out;
-	}
-	literalString() {
-		this.expect("(");
-		let depth = 1;
-		let out = "";
-		while (this.pos < this.text.length) {
-			const ch = this.text[this.pos++];
-			if (ch === "\\") {
-				const next = this.text[this.pos++];
-				switch (next) {
-					case "n":
-						out += "\n";
-						break;
-					case "r":
-						out += "\r";
-						break;
-					case "t":
-						out += "	";
-						break;
-					case "b":
-						out += "\b";
-						break;
-					case "f":
-						out += "\f";
-						break;
-					case "\n": break;
-					case "\r":
-						if (this.text[this.pos] === "\n") this.pos++;
-						break;
-					default: {
-						const oct = /^[0-7]{1,3}/.exec(this.text.slice(this.pos - 1));
-						if (oct) {
-							out += String.fromCharCode(parseInt(oct[0], 8));
-							this.pos += oct[0].length - 1;
-						} else out += next;
-					}
-				}
-				continue;
-			}
-			if (ch === "(") depth++;
-			if (ch === ")") {
-				depth--;
-				if (depth === 0) return out;
-			}
-			out += ch;
-		}
-		throw new Error("unterminated string");
-	}
-	hexString() {
-		this.expect("<");
-		const end = this.text.indexOf(">", this.pos);
-		if (end < 0) throw new Error("unterminated hex string");
-		const hex = this.text.slice(this.pos, end).replace(/\s+/g, "");
-		this.pos = end + 1;
-		let out = "";
-		for (let i = 0; i < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.slice(i, i + 2).padEnd(2, "0"), 16));
-		return out;
-	}
-	expect(token) {
-		if (!this.text.startsWith(token, this.pos)) throw new Error(`expected ${token} at ${this.pos}`);
-		this.pos += token.length;
-	}
-};
-/** Structural equality of two parsed values. */
-function pdfValueEquals(a, b) {
-	return stableStringify(a) === stableStringify(b);
-}
-function stableStringify(value) {
-	if (value === null) return "null";
-	switch (value.t) {
-		case "dict": return `<<${Object.keys(value.entries).sort().map((k) => `/${k} ${stableStringify(value.entries[k])}`).join("")}>>`;
-		case "stream": return `stream(${value.length},${value.sha256})${stableStringify({
-			t: "dict",
-			entries: value.dict
-		})}`;
-		case "array": return `[${value.items.map(stableStringify).join(" ")}]`;
-		case "ref": return `${value.num} 0 R`;
-		case "name": return `/${encodeName(value.v)}`;
-		case "string": return `(${value.v.replace(/[\\()]/g, (ch) => `\\${ch}`)})`;
-		case "number": return String(value.v);
-		case "bool": return value.v ? "true" : "false";
-		case "null": return "null";
-	}
-}
-function dictEntries(value) {
-	if (!value) return null;
-	if (value.t === "dict") return value.entries;
-	if (value.t === "stream") return value.dict;
-	return null;
-}
-/** Keys whose value differs (added, removed, or changed) between two dictionaries. */
-function changedKeys(a, b) {
-	const ea = dictEntries(a) ?? {};
-	const eb = dictEntries(b) ?? {};
-	const out = /* @__PURE__ */ new Set();
-	for (const key of /* @__PURE__ */ new Set([...Object.keys(ea), ...Object.keys(eb)])) if (!pdfValueEquals(ea[key] ?? null, eb[key] ?? null)) out.add(key);
-	return out;
-}
-function refsOf(value) {
-	if (!value) return [];
-	if (value.t === "ref") return [value.num];
-	if (value.t === "array") return value.items.flatMap(refsOf);
-	return [];
-}
-/** `#xx`-escape a name the way the PDF writer does: delimiters, whitespace, `#`, and non-printables. */
-function encodeName(name) {
-	let out = "";
-	for (const ch of name) {
-		const code = ch.charCodeAt(0);
-		if (code < 33 || code > 126 || "#/[]<>(){}%".includes(ch)) out += `#${code.toString(16).toUpperCase().padStart(2, "0")}`;
-		else out += ch;
-	}
-	return out;
-}
-//#endregion
-//#region src/signature/analysis/verdict.ts
-const RANK = {
-	unchanged: 0,
-	permitted: 1,
-	indeterminate: 2,
-	forbidden: 3
-};
-/** The worst of several verdicts (a certification replay's steps). */
-function worstVerdict(steps) {
-	let worst = "unchanged";
-	for (const s of steps) if (RANK[s.verdict] > RANK[worst]) worst = s.verdict;
-	return worst;
-}
-/**
-* One aggregation rule everywhere: a proven violation decides, whatever
-* else could not be established; missing evidence never becomes a pass.
-*/
-function conclude(findings, hasEffectiveChanges) {
-	if (findings.some((f) => f.verdict === "forbidden")) return "forbidden";
-	if (findings.some((f) => f.verdict === "incomplete")) return "indeterminate";
-	return hasEffectiveChanges ? "permitted" : "unchanged";
-}
-/** The finding that explains a verdict: the violation, else the gap, else the most notable allowance. */
-function primaryFinding(findings) {
-	return findings.find((f) => f.verdict === "forbidden") ?? findings.find((f) => f.verdict === "incomplete") ?? findings.find((f) => f.verdict === "permitted");
-}
-function assessmentOf(step) {
-	const primary = primaryFinding(step.findings);
-	return {
-		verdict: step.verdict,
-		complete: !step.findings.some((f) => f.verdict === "incomplete"),
-		...primary ? { primary } : {},
-		findings: step.findings
-	};
-}
-/**
-* A certification window: the net verdict and every replayed step, under
-* the same rule. A step's violation is a violation of the certification
-* even when the final state no longer shows it (corpus v3/83).
-*/
-function combine(net, steps) {
-	const findings = [...net.findings];
-	for (const s of steps) {
-		if (s === net) continue;
-		for (const f of s.findings) {
-			if (f.verdict === "permitted") continue;
-			findings.push({
-				...f,
-				detail: `revision ${s.newer}: ${f.detail ?? f.rule}`
-			});
-		}
-	}
-	const verdict = conclude(findings, net.verdict !== "unchanged" || steps.some((s) => s.verdict !== "unchanged"));
-	const primary = primaryFinding(findings);
-	return {
-		verdict,
-		complete: !findings.some((f) => f.verdict === "incomplete"),
-		...primary ? { primary } : {},
-		findings
-	};
-}
-//#endregion
-//#region src/signature/analysis/evaluate.ts
-const SIDES = ["old", "new"];
-const TRAILER_KEYS = /* @__PURE__ */ new Set([
-	"Size",
-	"Prev",
-	"XRefStm",
-	"Info",
-	"ID",
-	"Root",
-	"Type",
-	"W",
-	"Index",
-	"Filter",
-	"DecodeParms",
-	"Length",
-	"Encrypt"
-]);
-const CATALOG_KEYS = /* @__PURE__ */ new Set([
-	"Metadata",
-	"Extensions",
-	"Version",
-	"DSS",
-	"AcroForm",
-	"Perms"
-]);
-const ACROFORM_KEYS = /* @__PURE__ */ new Set([
-	"DR",
-	"DA",
-	"Q",
-	"SigFlags",
-	"NeedAppearances",
-	"Fields"
-]);
-/**
-* What a form field may change after a signature, by the level in force.
-* Every key here has a corpus case behind it (`signature-compat`); a key
-* not listed is forbidden until one does.
-*
-*   annotate (an approval signature: "Form Fill-in, Signing and Commenting
-*   are allowed"): everything but the field's identity and its place in
-*   the tree. v1/08 /V+/AP, 09 /Ff, 10 /Rect, 11 /F, 18 /TU, 21 /DA; 13 /T
-*   forbidden. /AA (v1/12) and /A are accepted by Acrobat and deliberately
-*   NOT listed: an action on a signed form is executable content.
-*
-*   fill (a P=2 certification): value and appearance. v1/26 /V+/AP, v3/64
-*   /Ff (ReadOnly added), 65 /DA, 68 /AP stream; v3/66 /TU, 67 /F, v2/50
-*   /Rect forbidden.
-*/
-const FIELD_KEYS_BY_LEVEL = {
-	annotate: /* @__PURE__ */ new Set([
-		"V",
-		"AS",
-		"AP",
-		"I",
-		"DA",
-		"Ff",
-		"RV",
-		"MK",
-		"Q",
-		"TU",
-		"F",
-		"Rect",
-		"BS",
-		"Opt",
-		"DV",
-		"MaxLen"
-	]),
-	fill: /* @__PURE__ */ new Set([
-		"V",
-		"AS",
-		"AP",
-		"I",
-		"RV",
-		"DA",
-		"Ff"
-	])
-};
-/** A separate widget dictionary: the presentation subset of the same tables. */
-const WIDGET_KEYS_BY_LEVEL = {
-	annotate: /* @__PURE__ */ new Set([
-		"AS",
-		"AP",
-		"DA",
-		"MK",
-		"Q",
-		"TU",
-		"F",
-		"Rect",
-		"BS"
-	]),
-	fill: /* @__PURE__ */ new Set([
-		"AS",
-		"AP",
-		"DA"
-	])
-};
-/**
-* Signing an EXISTING field: its value, appearance and ReadOnly at any
-* level; after an approval signature also its tooltip and a /Lock installed
-* with the signature (v1/18, 19: both valid; under P=2 the combination is
-* rejected, v3/69, so neither is allowed at `fill`).
-*/
-const SIGNED_FIELD_KEYS_BY_LEVEL = {
-	annotate: /* @__PURE__ */ new Set([
-		"V",
-		"AP",
-		"AS",
-		"Ff",
-		"TU",
-		"Lock"
-	]),
-	fill: /* @__PURE__ */ new Set([
-		"V",
-		"AP",
-		"AS",
-		"Ff"
-	])
-};
-const SIGNED_WIDGET_KEYS = /* @__PURE__ */ new Set(["AP", "AS"]);
-const FF_READ_ONLY = 1;
-function fieldKeysFor(level) {
-	return level === "annotate" ? FIELD_KEYS_BY_LEVEL.annotate : FIELD_KEYS_BY_LEVEL.fill;
-}
-function widgetKeysFor(level) {
-	return level === "annotate" ? WIDGET_KEYS_BY_LEVEL.annotate : WIDGET_KEYS_BY_LEVEL.fill;
-}
-function signedFieldKeysFor(level) {
-	return level === "annotate" ? SIGNED_FIELD_KEYS_BY_LEVEL.annotate : SIGNED_FIELD_KEYS_BY_LEVEL.fill;
-}
-/**
-* Rules whose permitted findings do not make a revision a CHANGE of the
-* document: an object written again with the sealed value, an object nobody
-* references, a cross-reference container, the trailer's own bookkeeping.
-* A window with nothing else is `unchanged` (Acrobat: "not modified").
-*/
-const NON_EFFECTIVE_RULES = /* @__PURE__ */ new Set([
-	"identical-rewrite",
-	"orphan",
-	"xref-container",
-	"trailer"
-]);
-/** The level a step runs at, and the locks it enforces: what the OLDER revision's signatures established. */
-function restrictionsOf(before) {
-	const protection = deriveProtection(before.signatures);
-	return {
-		level: protection.judged ?? "annotate",
-		locks: protection.fieldLocks
-	};
-}
-/**
-* Judge one pairwise step. Every reference to a changed object, in the
-* older AND the newer revision, must be claimed by a rule that inspected
-* that use; an unclaimed reference is `unexplained` and forbidden. A
-* truncated value is `incomplete`, never permitted. Pure: JSON in, JSON
-* out, the same code in the browser worker, on the server and in tests.
-*/
-function evaluateStep(input) {
-	const changes = withEvidenceCheck(input.changes);
-	const { level, locks } = input.restrictions ?? restrictionsOf(input.before);
-	const levelInForce = input.levelOverride ?? level;
-	const ctx = new StepContext({
-		...input,
-		changes
-	}, levelInForce, locks);
-	ruleRevisionHealth(ctx);
-	ruleXrefContainer(ctx);
-	ruleIdenticalRewrite(ctx);
-	ruleFieldLock(ctx);
-	ruleTrailer(ctx);
-	ruleInfo(ctx);
-	ruleMetadata(ctx);
-	ruleCatalog(ctx);
-	ruleAcroForm(ctx);
-	ruleDss(ctx);
-	ruleSignatureFieldAdded(ctx);
-	ruleSignatureAdded(ctx);
-	ruleFormFill(ctx);
-	ruleAnnotation(ctx);
-	ruleUnexplained(ctx);
-	const verdict = conclude(ctx.findings, ctx.findings.some((f) => f.verdict === "permitted" && !NON_EFFECTIVE_RULES.has(f.rule)));
-	return {
-		older: input.older,
-		newer: input.newer,
-		levelInForce,
-		locks,
-		verdict,
-		findings: ctx.findings,
-		changes
-	};
-}
-/**
-* The evaluator never trusts its transport to be honest about gaps: a side
-* that exists must carry a value, and an object whose value is missing is
-* judged as truncated, whatever the flag says. Cross-reference containers
-* are exempt (their members are judged on their own).
-*/
-function withEvidenceCheck(changes) {
-	return changes.map((c) => {
-		if (c.value.truncated || c.kind === "xref" || c.kind === "objstm") return c;
-		const missingOld = c.present.old && (c.value.old === null || c.read?.old === "failed");
-		const missingNew = c.present.new && (c.value.new === null || c.read?.new === "failed");
-		return missingOld || missingNew ? {
-			...c,
-			value: {
-				...c.value,
-				truncated: true
-			}
-		} : c;
-	});
-}
-/**
-* The transport's verdict on each revision as a whole. A sealed revision
-* Acrobat cannot judge later changes to (sparse cross-reference table, a
-* reachable bare-reference object) makes every step over it indeterminate:
-* our verdict would otherwise disagree with the validator recipients use,
-* and for a reason that has nothing to do with the change. An incomplete
-* reachability walk on either side leaves every use unproven.
-*/
-function ruleRevisionHealth(ctx) {
-	const health = ctx.input.health;
-	if (!health) return;
-	const base = health.old;
-	if (base.sparseXref || base.bareReferences > 0) {
-		const why = [base.sparseXref ? "its cross-reference table has no entry for some object numbers below /Size" : null, base.bareReferences > 0 ? `${base.bareReferences} reachable indirect object(s) consist of a bare reference` : null].filter((x) => x !== null).join("; ");
-		ctx.findings.push({
-			rule: "base-unverifiable",
-			verdict: "incomplete",
-			objectNumber: 0,
-			detail: `the signed revision cannot be verified against later changes by Acrobat (${why}); no verdict is given rather than one Acrobat would contradict`
-		});
-	}
-	for (const side of SIDES) if (!health[side].referrersComplete) ctx.findings.push({
-		rule: "unexplained",
-		verdict: "incomplete",
-		objectNumber: 0,
-		detail: `the ${side === "old" ? "older" : "newer"} revision's reachability walk hit its budget; not every use of a changed object is known`
-	});
-}
-/**
-* Same effective value on both sides: same canonical serialisation (keys
-* sorted, whitespace normalised - Acrobat compares dictionaries by value,
-* corpus v3/61-62), same stream data (by bytes, v2/45), and both sides
-* actually read. A failed read serialises as "null" and would match another
-* failed read - evidence of nothing.
-*/
-function sameEffectiveValue(c) {
-	return c.change === "modified" && !c.value.truncated && c.read?.old !== "failed" && c.read?.new !== "failed" && c.raw.old !== null && c.raw.new !== null && c.raw.old === c.raw.new && !c.streamDataChanged;
-}
-function indexRoles(s) {
-	const fieldByObj = /* @__PURE__ */ new Map();
-	const widgetToField = /* @__PURE__ */ new Map();
-	const sigFields = /* @__PURE__ */ new Set();
-	for (const f of s.fields) {
-		fieldByObj.set(f.objectNumber, f);
-		if (f.family === "signature") sigFields.add(f.objectNumber);
-		for (const w of f.widgets) widgetToField.set(w, f.objectNumber);
-	}
-	const signedFields = /* @__PURE__ */ new Set();
-	for (const sig of s.signatures) if (sig.signed && sig.field.kind === "objectNumber") signedFields.add(sig.field.fieldObjectNumber);
-	return {
-		fieldByObj,
-		widgetToField,
-		pages: new Set(s.pages),
-		signedFields,
-		sigFields
-	};
-}
-function edgeKey(e) {
-	return `${e.parent}:${e.label}`;
-}
-var StepContext = class {
-	constructor(input, level, locks) {
-		this.input = input;
-		this.level = level;
-		this.locks = locks;
-		_defineProperty(this, "findings", []);
-		_defineProperty(this, "byNum", /* @__PURE__ */ new Map());
-		_defineProperty(this, "before", void 0);
-		_defineProperty(this, "after", void 0);
-		_defineProperty(this, "claims", /* @__PURE__ */ new Map());
-		_defineProperty(this, "locked", /* @__PURE__ */ new Set());
-		for (const c of input.changes) this.byNum.set(c.objectNumber, c);
-		this.before = indexRoles(input.before);
-		this.after = indexRoles(input.after);
-	}
-	get changes() {
-		return this.input.changes;
-	}
-	allows(needed) {
-		return levelAllows(this.level, needed);
-	}
-	claimEdge(c, side, edge, rule, allow = true) {
-		if (this.locked.has(c.objectNumber)) return;
-		const key = `${c.objectNumber}:${side}:${edgeKey(edge)}`;
-		if (!this.claims.has(key)) this.claims.set(key, {
-			rule,
-			allow
-		});
-	}
-	claimAll(c, rule, allow = true) {
-		for (const side of SIDES) for (const e of c.usage[side]) this.claimEdge(c, side, e, rule, allow);
-	}
-	/**
-	* Claim the references that are the same in both revisions; a reference
-	* gained or lost stays unexplained. `allow: false` explains a condemned
-	* object's edges (one cause in the report, not a cascade) without letting
-	* anything hang off it.
-	*/
-	claimStable(c, rule, allow = true) {
-		const oldKeys = new Set(c.usage.old.map(edgeKey));
-		const newKeys = new Set(c.usage.new.map(edgeKey));
-		for (const e of c.usage.old) if (newKeys.has(edgeKey(e))) this.claimEdge(c, "old", e, rule, allow);
-		for (const e of c.usage.new) if (oldKeys.has(edgeKey(e))) this.claimEdge(c, "new", e, rule, allow);
-	}
-	isClaimed(c, side, edge) {
-		return this.claims.has(`${c.objectNumber}:${side}:${edgeKey(edge)}`);
-	}
-	/** The use was inspected by a rule that allowed it. */
-	isAllowed(c, side, edge) {
-		return this.claims.get(`${c.objectNumber}:${side}:${edgeKey(edge)}`)?.allow === true;
-	}
-	permitted(c, rule, detail) {
-		if (this.locked.has(c.objectNumber)) return;
-		this.findings.push({
-			rule,
-			verdict: "permitted",
-			objectNumber: c.objectNumber,
-			detail
-		});
-	}
-	/**
-	* A violation is only proven on evidence: a rule condemning an object
-	* whose value could not be read or inspected is reporting what it could
-	* not see, and that is `incomplete`, never `forbidden`.
-	*/
-	forbidden(c, rule, detail, edge) {
-		this.findings.push({
-			rule,
-			verdict: c.value.truncated ? "incomplete" : "forbidden",
-			objectNumber: c.objectNumber,
-			edge: edge ? edgeKey(edge) : void 0,
-			detail: c.value.truncated ? `${detail} (judged on missing evidence: not proven)` : detail
-		});
-	}
-	/**
-	* Claim every reference under a set of parents (an appearance subtree,
-	* the DSS): objects whose references come from `parents` through labels
-	* `accept`, then everything referenced from those objects, and so on.
-	* Runs per side, because a replaced appearance stream exists on one
-	* side only.
-	*/
-	claimSubtree(side, roots, accept, rule) {
-		const joined = /* @__PURE__ */ new Set();
-		let grew = true;
-		while (grew) {
-			grew = false;
-			for (const c of this.changes) {
-				if (roots.has(c.objectNumber) || joined.has(c.objectNumber)) continue;
-				if (this.locked.has(c.objectNumber)) continue;
-				const edges = c.usage[side];
-				if (edges.length === 0) continue;
-				const inside = edges.filter((e) => roots.has(e.parent) && accept(e.label) || joined.has(e.parent));
-				if (inside.length === 0) continue;
-				for (const e of inside) this.claimEdge(c, side, e, rule);
-				if (edges.every((e) => inside.includes(e) || this.isAllowed(c, side, e))) {
-					joined.add(c.objectNumber);
-					grew = true;
-				}
-			}
-		}
-	}
-	isIdentical(c) {
-		return sameEffectiveValue(c);
-	}
-	/** Signatures signed in the newer revision but not the older: this step's signing events. */
-	newlySigned() {
-		const out = [];
-		for (const sig of this.input.after.signatures) {
-			if (!sig.signed || sig.field.kind !== "objectNumber") continue;
-			if (this.before.signedFields.has(sig.field.fieldObjectNumber)) continue;
-			out.push({
-				fieldObjectNumber: sig.field.fieldObjectNumber,
-				sig
-			});
-		}
-		return out;
-	}
-};
-function ruleXrefContainer(ctx) {
-	for (const c of ctx.changes) if (c.kind === "xref" || c.kind === "objstm") {
-		ctx.claimAll(c, "xref-container");
-		ctx.permitted(c, "xref-container", "cross-reference container; members are judged on their own");
-	}
-}
-/**
-* An object written again with the value the sealed revision holds is not
-* a modification: Acrobat compares objects by value and reports such a
-* revision as "not modified" for every role tried - document information,
-* a custom catalog entry, a page, the signed signature's own widget, a text
-* field, an annotation, the encryption dictionary, reserialised with keys
-* reordered, under a certification, under a field lock (corpus v1/02-07,
-* 23, v2/47, v3/54-62, 70, 71, 77). Under P=1 nothing is established and
-* the rewrite stays forbidden. Claimed here so the object-kind rules skip
-* it; the verdict treats it as no effective change.
-*/
-function ruleIdenticalRewrite(ctx) {
-	for (const c of ctx.changes) {
-		if (!ctx.isIdentical(c)) continue;
-		if (ctx.allows("fill")) {
-			ctx.claimAll(c, "identical-rewrite");
-			ctx.permitted(c, "identical-rewrite", "written again with the sealed value");
-		} else {
-			ctx.claimAll(c, "identical-rewrite", false);
-			ctx.forbidden(c, "identical-rewrite", `written again with the sealed value under level '${ctx.level}' (not established for this level)`);
-		}
-	}
-}
-function ruleTrailer(ctx) {
-	const c = ctx.byNum.get(0);
-	if (!c) return;
-	const changed = changedKeys(c.value.old, c.value.new);
-	const bad = [...changed].filter((k) => !TRAILER_KEYS.has(k));
-	const oldRoot = dictEntries(c.value.old)?.Root;
-	const newRoot = dictEntries(c.value.new)?.Root;
-	if (bad.length > 0) {
-		ctx.forbidden(c, "trailer", `trailer keys changed: ${bad.join(", ")}`);
-		return;
-	}
-	if (changed.has("Root") && !pdfValueEquals(oldRoot ?? null, newRoot ?? null)) {
-		ctx.forbidden(c, "trailer", "the trailer points at a different catalog");
-		return;
-	}
-	if (changed.has("Encrypt") && !pdfValueEquals(dictEntries(c.value.old)?.Encrypt ?? null, dictEntries(c.value.new)?.Encrypt ?? null)) {
-		ctx.forbidden(c, "trailer", "the trailer points at a different encryption dictionary");
-		return;
-	}
-	ctx.claimAll(c, "trailer");
-	ctx.permitted(c, "trailer");
-}
-function onlyEdges(c, test) {
-	const all = [...c.usage.old, ...c.usage.new];
-	return all.length > 0 && all.every(test);
-}
-function ruleInfo(ctx) {
-	for (const c of ctx.changes) {
-		if (ctx.isIdentical(c)) continue;
-		if (c.objectNumber !== 0 && onlyEdges(c, (e) => e.parent === 0 && e.label === "Info")) {
-			ctx.claimAll(c, "info");
-			ctx.permitted(c, "info", "document information dictionary");
-		}
-	}
-}
-function ruleMetadata(ctx) {
-	const roots = /* @__PURE__ */ new Set([ctx.input.before.root, ctx.input.after.root]);
-	for (const c of ctx.changes) {
-		if (ctx.isIdentical(c)) continue;
-		if (onlyEdges(c, (e) => roots.has(e.parent) && e.label === "Metadata")) {
-			ctx.claimAll(c, "metadata");
-			ctx.permitted(c, "metadata", "XMP metadata stream");
-		}
-	}
-}
-function ruleCatalog(ctx) {
-	const root = ctx.input.after.root;
-	const c = ctx.byNum.get(root);
-	if (!c || ctx.isIdentical(c)) return;
-	const changed = changedKeys(c.value.old, c.value.new);
-	const bad = [...changed].filter((k) => !CATALOG_KEYS.has(k));
-	if (bad.length > 0) {
-		ctx.forbidden(c, "catalog-housekeeping", `catalog keys changed: ${bad.join(", ")}`);
-		return;
-	}
-	if (changed.has("AcroForm") && !ctx.input.after.acroForm && !ctx.input.before.acroForm) {
-		const problem = acroFormProblem(ctx, dictEntries(c.value.old)?.AcroForm ?? null, dictEntries(c.value.new)?.AcroForm ?? null);
-		if (problem) {
-			ctx.forbidden(c, "acroform-housekeeping", problem);
-			return;
-		}
-		for (const side of SIDES) ctx.claimSubtree(side, /* @__PURE__ */ new Set([root]), (label) => label.startsWith("AcroForm/DR/"), "acroform-housekeeping");
-	}
-	if (changed.has("Perms")) {
-		const after = deriveProtection(ctx.input.after.signatures);
-		const before = deriveProtection(ctx.input.before.signatures);
-		if (!after.certification || before.judged !== null) {
-			ctx.forbidden(c, "catalog-housekeeping", "/Perms may only appear with the certification signature, in the first signed revision");
-			return;
-		}
-	}
-	ctx.claimAll(c, "catalog-housekeeping");
-	ctx.permitted(c, "catalog-housekeeping");
-}
-function ruleAcroForm(ctx) {
-	const acro = ctx.input.after.acroForm || ctx.input.before.acroForm;
-	if (!acro) return;
-	const c = ctx.byNum.get(acro);
-	if (!c || ctx.isIdentical(c)) return;
-	const problem = acroFormProblem(ctx, c.value.old, c.value.new);
-	if (problem) {
-		ctx.forbidden(c, "acroform-housekeeping", problem);
-		return;
-	}
-	ctx.claimAll(c, "acroform-housekeeping");
-	ctx.permitted(c, "acroform-housekeeping");
-	for (const side of SIDES) ctx.claimSubtree(side, /* @__PURE__ */ new Set([acro]), (label) => label.startsWith("DR/"), "acroform-housekeeping");
-}
-/** What is wrong with an AcroForm dictionary change, or null when it is housekeeping. */
-function acroFormProblem(ctx, oldValue, newValue) {
-	const changed = changedKeys(oldValue, newValue);
-	const bad = [...changed].filter((k) => !ACROFORM_KEYS.has(k));
-	if (bad.length > 0) return `AcroForm keys changed: ${bad.join(", ")}`;
-	if (changed.has("Fields")) {
-		const oldRefs = refsOf(dictEntries(oldValue)?.Fields);
-		const newRefs = refsOf(dictEntries(newValue)?.Fields);
-		if (oldRefs.length > newRefs.length || oldRefs.some((n, i) => newRefs[i] !== n)) return "/AcroForm /Fields is not append-only";
-		const newSigFields = newSignatureFields(ctx);
-		const strangers = newRefs.slice(oldRefs.length).filter((n) => !newSigFields.has(n));
-		if (strangers.length > 0) return `/AcroForm /Fields gained non-signature fields: ${strangers.join(", ")}`;
-	}
-	return null;
-}
-/** The refs appended to an array-valued key when the old array is a prefix of the new one; null otherwise. */
-function appendedRefs(c, key) {
-	const oldItems = dictEntries(c.value.old)?.[key];
-	const newItems = dictEntries(c.value.new)?.[key];
-	const oldRefs = refsOf(oldItems);
-	const newRefs = refsOf(newItems);
-	if (oldItems && oldItems.t !== "array") return null;
-	if (!newItems || newItems.t !== "array") return null;
-	if (oldRefs.length > newRefs.length) return null;
-	for (let i = 0; i < oldRefs.length; i++) if (oldRefs[i] !== newRefs[i]) return null;
-	return newRefs.slice(oldRefs.length);
-}
-function newSignatureFields(ctx) {
-	const out = /* @__PURE__ */ new Set();
-	for (const n of ctx.after.sigFields) if (!ctx.before.fieldByObj.has(n)) out.add(n);
-	return out;
-}
-function ruleDss(ctx) {
-	const roots = /* @__PURE__ */ new Set([ctx.input.before.root, ctx.input.after.root]);
-	for (const side of SIDES) ctx.claimSubtree(side, roots, (label) => label === "DSS" || label.startsWith("DSS/"), "dss");
-	for (const c of ctx.changes) if (c.usage.new.some((e) => roots.has(e.parent) && e.label === "DSS") && !ctx.findings.some((f) => f.objectNumber === c.objectNumber)) ctx.permitted(c, "dss", "document security store");
-}
-function ruleSignatureFieldAdded(ctx) {
-	const added = newSignatureFields(ctx);
-	if (added.size === 0) return;
-	const rule = "signature-field-added";
-	if (!ctx.allows("fill")) {
-		for (const n of added) {
-			const c = ctx.byNum.get(n);
-			if (c) ctx.forbidden(c, rule, `a signature field was added under level '${ctx.level}'`);
-		}
-		return;
-	}
-	const newWidgets = /* @__PURE__ */ new Set();
-	for (const n of added) {
-		const field = ctx.after.fieldByObj.get(n);
-		const c = ctx.byNum.get(n);
-		if (c) {
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, `new signature field "${field.name}"`);
-		}
-		for (const w of field.widgets) {
-			newWidgets.add(w);
-			if (w === n) continue;
-			const wc = ctx.byNum.get(w);
-			if (wc) {
-				ctx.claimAll(wc, rule);
-				ctx.permitted(wc, rule, `widget of new signature field "${field.name}"`);
-			}
-		}
-	}
-	for (const p of ctx.after.pages) {
-		const c = ctx.byNum.get(p);
-		if (!c || ctx.isIdentical(c)) continue;
-		const changed = changedKeys(c.value.old, c.value.new);
-		if (changed.size !== 1 || !changed.has("Annots")) continue;
-		const appended = appendedRefs(c, "Annots");
-		if (appended && appended.every((n) => newWidgets.has(n))) {
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, "page /Annots gained the new signature widget");
-		}
-	}
-	for (const c of ctx.changes) {
-		if (c.kind !== "dictionary" || ctx.isIdentical(c)) continue;
-		const changed = changedKeys(c.value.old, c.value.new);
-		if (changed.size !== 1 || !changed.has("Kids")) continue;
-		const appended = appendedRefs(c, "Kids");
-		if (appended && appended.length > 0 && appended.every((n) => added.has(n) || newWidgets.has(n))) {
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, "field /Kids gained the new signature field");
-		}
-	}
-}
-function ruleSignatureAdded(ctx) {
-	const rule = "signature-added";
-	const events = ctx.newlySigned();
-	if (events.length === 0) return;
-	const addedThisStep = newSignatureFields(ctx);
-	const beforeProtection = deriveProtection(ctx.input.before.signatures);
-	const afterProtection = deriveProtection(ctx.input.after.signatures);
-	const parents = /* @__PURE__ */ new Set();
-	const values = /* @__PURE__ */ new Set();
-	for (const { fieldObjectNumber, sig } of events) {
-		const needed = sig.kind === "timestamp" ? "lta" : "fill";
-		if (!ctx.allows(needed)) {
-			const c = ctx.byNum.get(fieldObjectNumber);
-			if (c) ctx.forbidden(c, rule, `a ${sig.kind} was added under level '${ctx.level}'`);
-			continue;
-		}
-		if (sig.catalogCertification && beforeProtection.judged !== null) {
-			const c = ctx.byNum.get(fieldObjectNumber);
-			if (c) ctx.forbidden(c, rule, "a certification signature after another signature");
-			continue;
-		}
-		const field = ctx.after.fieldByObj.get(fieldObjectNumber);
-		parents.add(fieldObjectNumber);
-		for (const w of field?.widgets ?? []) parents.add(w);
-		const fieldIsNew = addedThisStep.has(fieldObjectNumber);
-		const allowedFieldKeys = beforeProtection.judged === null ? /* @__PURE__ */ new Set([...signedFieldKeysFor(ctx.level), "Lock"]) : signedFieldKeysFor(ctx.level);
-		const fc = ctx.byNum.get(fieldObjectNumber);
-		if (fc && fieldIsNew) ctx.permitted(fc, rule, `new field "${sig.fieldName}" signed`);
-		else if (fc && !ctx.isIdentical(fc)) {
-			const changed = changedKeys(fc.value.old, fc.value.new);
-			const bad = [...changed].filter((k) => !allowedFieldKeys.has(k));
-			if (bad.length > 0) {
-				ctx.forbidden(fc, rule, `signature field keys changed: ${bad.join(", ")}`);
-				ctx.claimStable(fc, rule, false);
-			} else if (changed.has("Ff") && !readOnlyOnlyChange(fc, ctx.before.fieldByObj.get(fieldObjectNumber)?.flags)) {
-				ctx.forbidden(fc, rule, "signature field flags changed beyond ReadOnly");
-				ctx.claimStable(fc, rule, false);
-			} else {
-				ctx.claimStable(fc, rule);
-				ctx.permitted(fc, rule, `field "${sig.fieldName}" signed`);
-			}
-		}
-		for (const w of field?.widgets ?? []) {
-			if (w === fieldObjectNumber || fieldIsNew) continue;
-			const wc = ctx.byNum.get(w);
-			if (!wc || ctx.isIdentical(wc)) continue;
-			const bad = [...changedKeys(wc.value.old, wc.value.new)].filter((k) => !SIGNED_WIDGET_KEYS.has(k));
-			if (bad.length > 0) {
-				ctx.forbidden(wc, rule, `signature widget keys changed: ${bad.join(", ")}`);
-				ctx.claimStable(wc, rule, false);
-				continue;
-			}
-			ctx.claimStable(wc, rule);
-			ctx.permitted(wc, rule, "signature widget appearance");
-		}
-		for (const c of ctx.changes) {
-			if (c.change !== "added") continue;
-			const asValue = c.usage.new.filter((e) => e.parent === fieldObjectNumber && e.label === "V");
-			const asLock = c.usage.new.filter((e) => e.parent === fieldObjectNumber && e.label === "Lock");
-			const type = dictEntries(c.value.new)?.Type;
-			if (asValue.length > 0) {
-				if (!(type?.t === "name" && (type.v === "Sig" || type.v === "DocTimeStamp")) && type !== void 0) continue;
-				for (const e of c.usage.new) if (e.parent === fieldObjectNumber && e.label === "V" || e.label === "DocMDP") ctx.claimEdge(c, "new", e, rule);
-				ctx.permitted(c, rule, "signature value");
-				values.add(c.objectNumber);
-			} else if (asLock.length > 0) {
-				if (!(type === void 0 || type.t === "name" && type.v === "SigFieldLock")) continue;
-				for (const e of asLock) ctx.claimEdge(c, "new", e, rule);
-				ctx.permitted(c, rule, "field lock installed with the signature");
-			}
-		}
-	}
-	if (afterProtection.certification && beforeProtection.judged === null) {
-		const root = ctx.input.after.root;
-		for (const c of ctx.changes) if (c.change === "added" && onlyEdges(c, (e) => e.parent === root && e.label === "Perms")) {
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, "certification permissions");
-		}
-	}
-	for (const side of SIDES) ctx.claimSubtree(side, parents, (label) => label === "AP" || label.startsWith("AP/"), rule);
-	if (values.size > 0) ctx.claimSubtree("new", values, () => true, rule);
-}
-/**
-* Did `/Ff` change by gaining ReadOnly and nothing else? `/Ff` is
-* inheritable, and a lock writes `effective | ReadOnly` into the terminal
-* dictionary, so a terminal that carried no `/Ff` of its own is judged
-* against the effective flags the older revision's form model reported.
-*/
-function readOnlyOnlyChange(c, effectiveBefore) {
-	const oldFf = dictEntries(c.value.old)?.Ff;
-	const newFf = dictEntries(c.value.new)?.Ff;
-	const before = oldFf?.t === "number" ? oldFf.v : effectiveBefore ?? 0;
-	const after = newFf?.t === "number" ? newFf.v : 0;
-	return (before | FF_READ_ONLY) === after;
-}
-function ruleFormFill(ctx) {
-	const rule = "form-fill";
-	const fieldKeys = fieldKeysFor(ctx.level);
-	const widgetKeys = widgetKeysFor(ctx.level);
-	const parents = /* @__PURE__ */ new Set();
-	const fields = new Map([...ctx.before.fieldByObj, ...ctx.after.fieldByObj]);
-	for (const [num, field] of fields) {
-		if (field.family === "signature") continue;
-		const fc = ctx.byNum.get(num);
-		const widgetChanges = field.widgets.filter((w) => w !== num).map((w) => ctx.byNum.get(w)).filter(Boolean);
-		const owners = /* @__PURE__ */ new Set([num, ...field.widgets]);
-		const isAp = (label) => label === "AP" || label.startsWith("AP/");
-		const appearanceOnly = !fc && widgetChanges.length === 0 ? ctx.changes.filter((c) => SIDES.some((side) => c.usage[side].some((e) => owners.has(e.parent) && isAp(e.label))) && SIDES.every((side) => c.usage[side].every((e) => !isAp(e.label) || owners.has(e.parent)))) : [];
-		if (!fc && widgetChanges.length === 0 && appearanceOnly.length === 0) continue;
-		if (!ctx.allows("fill")) {
-			for (const c of [
-				fc,
-				...widgetChanges,
-				...appearanceOnly
-			]) if (c && !ctx.isIdentical(c)) ctx.forbidden(c, rule, `form fill under level '${ctx.level}'`);
-			continue;
-		}
-		if (appearanceOnly.length > 0) {
-			for (const c of appearanceOnly) ctx.permitted(c, rule, `appearance of field "${field.name}" regenerated`);
-			parents.add(num);
-			for (const w of field.widgets) parents.add(w);
-			continue;
-		}
-		let ok = true;
-		if (fc && !ctx.isIdentical(fc)) {
-			const changed = changedKeys(fc.value.old, fc.value.new);
-			const bad = [...changed].filter((k) => !fieldKeys.has(k));
-			if (bad.length > 0) {
-				ctx.forbidden(fc, rule, `field "${field.name}" keys changed: ${bad.join(", ")}`);
-				ctx.claimStable(fc, rule, false);
-				ok = false;
-			} else if (changed.has("Ff") && !readOnlyOnlyChange(fc, ctx.before.fieldByObj.get(num)?.flags)) {
-				ctx.forbidden(fc, rule, `field "${field.name}" flags changed beyond adding ReadOnly`);
-				ctx.claimStable(fc, rule, false);
-				ok = false;
-			} else {
-				ctx.claimStable(fc, rule);
-				const properties = [...changed].filter((k) => k !== "V" && k !== "AP" && k !== "AS" && k !== "I" && k !== "RV");
-				ctx.permitted(fc, rule, properties.length > 0 ? `field "${field.name}" ${changed.has("V") || changed.has("AS") ? "filled, " : ""}properties changed: ${properties.join(", ")}` : `field "${field.name}" filled`);
-			}
-		}
-		for (const wc of widgetChanges) {
-			if (ctx.isIdentical(wc)) continue;
-			const bad = [...changedKeys(wc.value.old, wc.value.new)].filter((k) => !widgetKeys.has(k));
-			if (bad.length > 0) {
-				ctx.forbidden(wc, rule, `widget of "${field.name}" keys changed: ${bad.join(", ")}`);
-				ctx.claimStable(wc, rule, false);
-				ok = false;
-				continue;
-			}
-			ctx.claimStable(wc, rule);
-			ctx.permitted(wc, rule, `widget of "${field.name}" appearance`);
-		}
-		if (ok) {
-			parents.add(num);
-			for (const w of field.widgets) parents.add(w);
-		}
-	}
-	for (const side of SIDES) ctx.claimSubtree(side, parents, (label) => label === "AP" || label.startsWith("AP/"), rule);
-}
-function ruleAnnotation(ctx) {
-	const rule = "annotation";
-	const pages = /* @__PURE__ */ new Set([...ctx.before.pages, ...ctx.after.pages]);
-	const widgets = /* @__PURE__ */ new Set([...ctx.before.widgetToField.keys(), ...ctx.after.widgetToField.keys()]);
-	const isWidget = (c) => {
-		if (widgets.has(c.objectNumber)) return true;
-		const sub = dictEntries(c.value.new ?? c.value.old)?.Subtype;
-		return sub?.t === "name" && sub.v === "Widget";
-	};
-	const annots = [];
-	for (const c of ctx.changes) {
-		if (c.kind !== "dictionary" || ctx.isIdentical(c)) continue;
-		if ([...c.usage.old, ...c.usage.new].some((e) => pages.has(e.parent) && e.label.startsWith("Annots/")) && !isWidget(c)) annots.push(c);
-	}
-	if (annots.length === 0) {}
-	if (!ctx.allows("annotate")) {
-		for (const c of annots) ctx.forbidden(c, rule, `annotation change under level '${ctx.level}'`);
-		return;
-	}
-	const parents = /* @__PURE__ */ new Set();
-	for (const c of annots) {
-		ctx.claimAll(c, rule);
-		ctx.permitted(c, rule, `${c.change} annotation`);
-		parents.add(c.objectNumber);
-	}
-	for (const p of pages) {
-		const c = ctx.byNum.get(p);
-		if (!c || ctx.isIdentical(c)) continue;
-		const changed = changedKeys(c.value.old, c.value.new);
-		if (changed.size === 1 && changed.has("Annots")) {
-			const removed = refsOf(dictEntries(c.value.old)?.Annots).filter((n) => !refsOf(dictEntries(c.value.new)?.Annots).includes(n));
-			const added = refsOf(dictEntries(c.value.new)?.Annots).filter((n) => !refsOf(dictEntries(c.value.old)?.Annots).includes(n));
-			if ([...removed, ...added].some((n) => widgets.has(n) && !ctx.findings.some((f) => f.objectNumber === n && f.verdict === "permitted"))) {
-				ctx.forbidden(c, rule, "page /Annots added or removed a form widget");
-				continue;
-			}
-			ctx.claimAll(c, rule);
-			ctx.permitted(c, rule, "page /Annots changed");
-		}
-	}
-	for (const side of SIDES) ctx.claimSubtree(side, parents, (label) => label === "AP" || label.startsWith("AP/") || label === "Popup" || label === "IRT", rule);
-}
-function ruleFieldLock(ctx) {
-	if (ctx.locks.length === 0) return;
-	const lockedFields = ctx.input.before.fields.filter((f) => ctx.locks.some((l) => lockCovers(l.spec, f.name)));
-	const lockedObjects = /* @__PURE__ */ new Set();
-	for (const f of lockedFields) {
-		lockedObjects.add(f.objectNumber);
-		for (const w of f.widgets) lockedObjects.add(w);
-	}
-	const frontier = new Set(lockedObjects);
-	let grew = true;
-	while (grew) {
-		grew = false;
-		for (const c of ctx.changes) {
-			if (frontier.has(c.objectNumber)) continue;
-			if (c.usage.old.length > 0 && c.usage.old.every((e) => frontier.has(e.parent))) {
-				frontier.add(c.objectNumber);
-				grew = true;
-			}
-		}
-	}
-	for (const c of ctx.changes) {
-		if (!frontier.has(c.objectNumber) || ctx.isIdentical(c)) continue;
-		const field = lockedFields.find((f) => f.objectNumber === c.objectNumber || f.widgets.includes(c.objectNumber));
-		if (field && field.objectNumber === c.objectNumber) {
-			const changed = changedKeys(c.value.old, c.value.new);
-			if (changed.size === 1 && changed.has("Ff") && readOnlyOnlyChange(c, ctx.before.fieldByObj.get(c.objectNumber)?.flags)) {
-				ctx.claimStable(c, "field-lock");
-				ctx.permitted(c, "field-lock", `ReadOnly set on locked field "${field.name}"`);
-				continue;
-			}
-		}
-		ctx.locked.add(c.objectNumber);
-		ctx.forbidden(c, "field-lock", field ? `field "${field.name}" is locked by the signature` : "part of a locked field changed");
-	}
-}
-function ruleUnexplained(ctx) {
-	for (const c of ctx.changes) {
-		if (c.value.truncated) {
-			ctx.findings.push({
-				rule: "unexplained",
-				verdict: "incomplete",
-				objectNumber: c.objectNumber,
-				detail: "value too large to inspect"
-			});
-			continue;
-		}
-		if (c.usageIncomplete) {
-			ctx.findings.push({
-				rule: "unexplained",
-				verdict: "incomplete",
-				objectNumber: c.objectNumber,
-				detail: "references could not be resolved within budget (depth, fan-out or total reads)"
-			});
-			continue;
-		}
-		if (ctx.locked.has(c.objectNumber)) continue;
-		for (const side of SIDES) for (const e of c.usage[side]) if (!ctx.isClaimed(c, side, e)) ctx.forbidden(c, "unexplained", `${side === "old" ? "was" : "is"} referenced from object ${e.parent} at ${e.label} and no rule explains it`, e);
-		if (c.usage.old.length === 0 && c.usage.new.length === 0 && !ctx.findings.some((f) => f.objectNumber === c.objectNumber)) ctx.permitted(c, "orphan", "referenced from nowhere reachable");
-	}
-}
-//#endregion
-//#region src/signature/analysis/restrictions.ts
-/**
-* The restrictions a window is judged under, read from the SEALED
-* revision's structure (what that revision declared, not what the final
-* file says).
-*
-*   - `judged` given (a signature-anchored analysis): its own FieldMDP and
-*     /Lock bind the window; other signatures' locks do not (corpus v3/85:
-*     a second signature is valid with a fill of a field the first locked).
-*     Every certification's level, own or earlier, applies (inherited:
-*     conservative until observed otherwise), as does a /Lock's /P.
-*   - no `judged` (a revision-anchored analysis): every signed signature's
-*     locks and levels, as before.
-*/
-function restrictionsFor(before, judged) {
-	const anchors = [];
-	const locks = [];
-	let enforced = null;
-	let signed = false;
-	for (const sig of before.signatures) {
-		if (!sig.signed || sig.revisionIndex === null) continue;
-		signed = true;
-		const own = judged !== null && sig.index === judged.index;
-		if (sig.catalogCertification && sig.docMdp !== null) {
-			anchors.push({
-				signatureIndex: sig.index,
-				revisionIndex: sig.revisionIndex,
-				source: "docmdp",
-				own,
-				permission: sig.docMdp
-			});
-			enforced = minLevel(enforced ?? "annotate", levelFromPermission(sig.docMdp));
-		}
-		if (sig.lock?.permission !== void 0) enforced = minLevel(enforced ?? "annotate", levelFromPermission(sig.lock.permission));
-		if (judged !== null && !own) continue;
-		if (sig.fieldMdp) {
-			anchors.push({
-				signatureIndex: sig.index,
-				revisionIndex: sig.revisionIndex,
-				source: "fieldmdp",
-				own,
-				fields: sig.fieldMdp
-			});
-			locks.push({
-				signatureIndex: sig.index,
-				source: "fieldmdp",
-				spec: sig.fieldMdp
-			});
-		}
-		if (sig.lock) {
-			anchors.push({
-				signatureIndex: sig.index,
-				revisionIndex: sig.revisionIndex,
-				source: "lock",
-				own,
-				fields: sig.lock
-			});
-			locks.push({
-				signatureIndex: sig.index,
-				source: "lock",
-				spec: sig.lock
-			});
-		}
-	}
-	return {
-		anchors,
-		level: signed ? enforced ?? "annotate" : "annotate",
-		locks
-	};
-}
-//#endregion
-//#region src/signature/analysis/resolve.ts
-const DEFAULT_EDGE_RESOLVER_BUDGET = {
-	maxDepth: 16,
-	maxEdgesPerObject: 256,
-	maxReads: 2e4
-};
-const USAGE_INCOMPLETE = "incomplete";
-/**
-* Resolves the raw inbound edges of an object (from the fork's referrer
-* index, which covers every reachable object of a revision) into edges
-* from *anchors*: the changed objects and the structural objects of the
-* revision (trailer, catalog, AcroForm, page tree root, pages, fields,
-* widgets). An edge from an unchanged, non-structural parent is replaced by
-* that parent's own anchored edges with the labels joined, so an
-* appearance stream under an unchanged indirect `/AP` dictionary reads
-* `widget:AP/N` rather than `apDict:N`.
-*
-* A graph traversal, not a path enumeration: results are memoised per
-* object, so a lattice of shared unchanged objects costs its size, not the
-* number of paths through it. Cycle edges contribute no anchors and are
-* skipped; a result computed while skipping one is not memoised.
-*/
-var EdgeResolver = class {
-	constructor(read, anchors, budget = DEFAULT_EDGE_RESOLVER_BUDGET) {
-		this.read = read;
-		this.anchors = anchors;
-		this.budget = budget;
-		_defineProperty(this, "memo", /* @__PURE__ */ new Map());
-		_defineProperty(this, "reads", 0);
-		_defineProperty(this, "exhausted", false);
-	}
-	/** Anchored edges of `objectNumber`, or `incomplete` when a budget was exceeded. */
-	resolve(objectNumber) {
-		if (this.exhausted) return USAGE_INCOMPLETE;
-		const result = this.resolveInner(objectNumber, /* @__PURE__ */ new Set());
-		return result === null ? USAGE_INCOMPLETE : result.edges;
-	}
-	resolveInner(n, active) {
-		const hit = this.memo.get(n);
-		if (hit) return hit;
-		if (active.size >= this.budget.maxDepth) return null;
-		if (this.reads >= this.budget.maxReads) {
-			this.exhausted = true;
-			return null;
-		}
-		this.reads += 1;
-		const raw = this.read(n);
-		active.add(n);
-		const edges = [];
-		let cyclic = false;
-		try {
-			for (const e of raw) {
-				if (this.anchors.has(e.parent)) edges.push(e);
-				else if (active.has(e.parent)) {
-					cyclic = true;
-					continue;
-				} else {
-					const up = this.resolveInner(e.parent, active);
-					if (up === null) return null;
-					cyclic || (cyclic = up.cyclic);
-					for (const u of up.edges) edges.push({
-						parent: u.parent,
-						label: `${u.label}/${e.label}`,
-						via: [...u.via ?? [], e.parent]
-					});
-				}
-				if (edges.length > this.budget.maxEdgesPerObject) return null;
-			}
-		} finally {
-			active.delete(n);
-		}
-		const resolution = {
-			edges,
-			cyclic
-		};
-		if (!cyclic) this.memo.set(n, resolution);
-		return resolution;
-	}
-};
-//#endregion
-//#region src/search/literal.ts
-/**
-* The fold flavor a literal query needs. Haystack and needle MUST be
-* folded with the same options; corpus caches key their pre-folded text
-* on this (the default `{}` fold is the persistable one — non-default
-* queries fold the original page text at query time).
-*/
-function foldOptionsFor(query) {
-	return {
-		keepCase: !!query.matchCase,
-		keepMarks: !!query.matchDiacritics
-	};
-}
-const WORD_UNIT = /[\p{L}\p{N}_]/u;
-const MARK = /\p{M}/u;
-/** Whether the code point ENDING at `index` (exclusive) is a word char. */
-function wordBefore(text, index) {
-	if (index <= 0) return false;
-	const unit = text.charCodeAt(index - 1);
-	const start = unit >= 56320 && unit <= 57343 && index >= 2 ? index - 2 : index - 1;
-	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(start)));
-}
-/** Whether the code point starting at `index` is a word char. */
-function wordAt(text, index) {
-	if (index >= text.length) return false;
-	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(index)));
-}
-/**
-* All non-overlapping literal matches, in original code-unit space.
-* `haystack` must have been folded with `foldOptionsFor(query)`.
-*/
-function matchLiteral(haystack, query) {
-	const needle = foldText(query.text, foldOptionsFor(query)).folded;
-	if (needle.trim().length === 0) return [];
-	const out = [];
-	let from = 0;
-	while (from <= haystack.folded.length - needle.length) {
-		const at = haystack.folded.indexOf(needle, from);
-		if (at < 0) break;
-		if (query.wholeWord && (wordBefore(haystack.folded, at) || wordAt(haystack.folded, at + needle.length))) {
-			from = at + 1;
-			continue;
-		}
-		if (query.matchDiacritics && at + needle.length < haystack.folded.length) {
-			const after = haystack.folded.codePointAt(at + needle.length);
-			if (MARK.test(String.fromCodePoint(after))) {
-				from = at + 1;
-				continue;
-			}
-		}
-		out.push(toOriginalRange(haystack, at, needle.length));
-		from = at + needle.length;
-	}
-	return out;
-}
-//#endregion
-//#region src/search/regex.ts
-/**
-* The portable search-regex dialect: JavaScript `u`-mode syntax MINUS the
-* features RE2 refuses (backreferences, lookaround). The local engine
-* executes patterns with JS `RegExp`; the server executes the SAME
-* pattern with RE2, whose linear-time guarantee is the ReDoS defense.
-* Restricting both sides to the common subset keeps one query string
-* valid — and equally powerful — everywhere.
-*/
-const SEARCH_REGEX_MAX_LENGTH = 512;
-/**
-* Validate a pattern against the dialect. Cheap and dependency-free —
-* viewers call it on keystroke for early feedback; engines re-validate
-* and reject bad patterns with `InvalidArg`.
-*/
-function validateSearchRegex(pattern) {
-	if (pattern.length === 0) return {
-		ok: false,
-		issue: "empty",
-		message: "Pattern is empty."
-	};
-	if (pattern.length > 512) return {
-		ok: false,
-		issue: "too-long",
-		message: `Pattern exceeds 512 characters.`
-	};
-	let inClass = false;
-	for (let i = 0; i < pattern.length; i++) {
-		const ch = pattern[i];
-		if (ch === "\\") {
-			const next = pattern[i + 1] ?? "";
-			if (!inClass && next >= "1" && next <= "9") return {
-				ok: false,
-				issue: "backreference",
-				message: `Backreference \\${next} is not supported.`
-			};
-			if (!inClass && next === "k" && pattern[i + 2] === "<") return {
-				ok: false,
-				issue: "backreference",
-				message: "Named backreferences (\\k<…>) are not supported."
-			};
-			i++;
-			continue;
-		}
-		if (inClass) {
-			if (ch === "]") inClass = false;
-			continue;
-		}
-		if (ch === "[") {
-			inClass = true;
-			continue;
-		}
-		if (ch === "(" && pattern[i + 1] === "?") {
-			const tag = pattern[i + 2] ?? "";
-			if (tag === "=" || tag === "!") return {
-				ok: false,
-				issue: "lookaround",
-				message: "Lookahead ((?=…), (?!…)) is not supported."
-			};
-			if (tag === "<" && (pattern[i + 3] === "=" || pattern[i + 3] === "!")) return {
-				ok: false,
-				issue: "lookaround",
-				message: "Lookbehind ((?<=…), (?<!…)) is not supported."
-			};
-		}
-	}
-	try {
-		new RegExp(pattern, "mu");
-	} catch (error) {
-		return {
-			ok: false,
-			issue: "syntax",
-			message: error.message
-		};
-	}
-	return { ok: true };
-}
-function validateSearchQuery(query) {
-	if (!query.regex) return { ok: true };
-	if (query.matchDiacritics) return {
-		ok: false,
-		issue: "diacritics-with-regex",
-		message: "Diacritic-sensitive matching is not available for regex patterns (regex runs on the raw text plane)."
-	};
-	return validateSearchRegex(query.text);
-}
-/**
-* All matches of a dialect-valid pattern over the RAW page text (regex
-* does not run against folded text — case handling is the `i` flag, and
-* diacritic folding never applies). `wholeWord` is a boundary POST-FILTER
-* using the same Unicode word test as the literal path — never `\b`,
-* whose ASCII word set would give the toggle different semantics in regex
-* mode ("caf" whole-word matching inside "café"). Filtering after the
-* match also survives the move to RE2 server-side. Zero-length matches
-* are skipped: search UI cannot highlight nothing, and skipping them is
-* also the infinite-loop guard for patterns like `a*`.
-*/
-function matchRegex(text, query) {
-	const valid = validateSearchQuery({
-		...query,
-		regex: true
-	});
-	if (!valid.ok) throw new Error(`Invalid search query (${valid.issue}): ${valid.message}`);
-	const re = new RegExp(query.text, query.matchCase ? "gmu" : "gimu");
-	const out = [];
-	let m;
-	while ((m = re.exec(text)) !== null) {
-		if (m[0].length === 0) {
-			const unit = text.charCodeAt(re.lastIndex);
-			re.lastIndex += unit >= 55296 && unit <= 56319 ? 2 : 1;
-			continue;
-		}
-		if (query.wholeWord && (wordBefore(text, m.index) || wordAt(text, m.index + m[0].length))) continue;
-		out.push({
-			start: m.index,
-			length: m[0].length
-		});
-	}
-	return out;
-}
-//#endregion
-//#region src/search/matcher.ts
-/**
-* The whole match stage in one pure call: page text in, original-space
-* match ranges out. Engines with a pre-folded corpus for the default fold
-* skip this and call `matchLiteral` on the cached `FoldedText` directly;
-* everything else (non-default fold options, regex, tests) comes through
-* here.
-*/
-function matchPageText(text, query) {
-	if (query.regex) return matchRegex(text, query);
-	return matchLiteral(foldText(text, foldOptionsFor(query)), query);
-}
-//#endregion
-//#region src/search/snippet.ts
-/** Default context on each side of a match, in code units. */
-const SEARCH_SNIPPET_CONTEXT = 48;
-const WHITESPACE = /\s/;
-const WHITESPACE_ALL = /\s/g;
-const isLowSurrogate = (text, index) => {
-	const unit = text.charCodeAt(index);
-	return unit >= 56320 && unit <= 57343;
-};
-/**
-* The `'full'`-mode excerpt around one match: up to `context` code units
-* of page text on each side, trimmed to a whitespace boundary when one
-* exists inside the window (so snippets start and end on whole words),
-* never splitting a surrogate pair, whitespace flattened 1:1.
-*/
-function buildSnippet(text, range, context = 48) {
-	const matchEnd = range.start + range.length;
-	let start = Math.max(0, range.start - context);
-	if (start > 0) {
-		for (let i = start; i < range.start; i++) if (WHITESPACE.test(text[i])) {
-			start = i + 1;
-			break;
-		}
-		if (isLowSurrogate(text, start)) start++;
-	}
-	let end = Math.min(text.length, matchEnd + context);
-	if (end < text.length) {
-		for (let i = end - 1; i >= matchEnd; i--) if (WHITESPACE.test(text[i])) {
-			end = i;
-			break;
-		}
-		if (isLowSurrogate(text, end)) end--;
-	}
-	return {
-		text: text.slice(start, end).replace(WHITESPACE_ALL, " "),
-		matchStart: range.start - start,
-		matchLength: range.length
-	};
-}
-//#endregion
-//#region src/text/layout.ts
-const FLAG_EMPTY = 2;
-const isBoundary = (flags) => (flags & 3) !== 0;
-const isEmpty = (flags) => (flags & FLAG_EMPTY) !== 0;
-const CHAR_DISTANCE_FACTOR = 2.5;
-const FONT_SIZE_RATIO_THRESHOLD = 1.5;
-const VERTICAL_OVERLAP_THRESHOLD = .8;
-const LINE_OVERLAP_THRESHOLD = .5;
-/** Baseline directions within ~0.5° share a frame. */
-const FRAME_DOT_TOLERANCE = Math.cos(.0087);
-const EDGE_EPSILON = 1e-6;
-const IDENTITY_FRAME = {
-	baseline: {
-		x: 1,
-		y: 0
-	},
-	ascent: {
-		x: 0,
-		y: 1
-	}
-};
-const toFrame = (f, p) => ({
-	x: p.x * f.baseline.x + p.y * f.baseline.y,
-	y: p.x * f.ascent.x + p.y * f.ascent.y
-});
-const fromFrame = (f, p) => ({
-	x: f.baseline.x * p.x + f.ascent.x * p.y,
-	y: f.baseline.y * p.x + f.ascent.y * p.y
-});
-const ZERO_RECT = {
-	left: 0,
-	bottom: 0,
-	right: 0,
-	top: 0
-};
-/** Frame-local AABB of a page-space cell (exact under the frame's rotation;
-*  shear residue is the documented in-frame envelope). */
-function frameBoxOfQuad(f, q) {
-	const pts = [
-		q.p1,
-		q.p2,
-		q.p3,
-		q.p4
-	].map((p) => toFrame(f, p));
-	const xs = pts.map((p) => p.x);
-	const ys = pts.map((p) => p.y);
-	return {
-		left: Math.min(...xs),
-		bottom: Math.min(...ys),
-		right: Math.max(...xs),
-		top: Math.max(...ys)
-	};
-}
-/** Find-or-create the frame for a rotated run, keyed by the baseline
-*  direction + ascent handedness of its first classifiable glyph's edges. */
-function frameForRun(frames, run) {
-	const seed = run.glyphs.find((g) => !isEmpty(g.flags));
-	if (!seed) return 0;
-	const q = seed.looseQuad;
-	const bx = q.p2.x - q.p1.x;
-	const by = q.p2.y - q.p1.y;
-	const len = Math.hypot(bx, by);
-	if (len <= EDGE_EPSILON) return 0;
-	const baseline = {
-		x: bx / len,
-		y: by / len
-	};
-	const ax = q.p1.x - q.p3.x;
-	const ay = q.p1.y - q.p3.y;
-	const sign = baseline.x * ay - baseline.y * ax >= 0 ? 1 : -1;
-	const ascent = {
-		x: -baseline.y * sign,
-		y: baseline.x * sign
-	};
-	for (let i = 0; i < frames.length; i++) {
-		const f = frames[i];
-		const dot = f.baseline.x * baseline.x + f.baseline.y * baseline.y;
-		const sameHandedness = f.ascent.x * ascent.x + f.ascent.y * ascent.y > 0;
-		if (dot >= FRAME_DOT_TOLERANCE && sameHandedness) return i;
-	}
-	frames.push({
-		baseline,
-		ascent
-	});
-	return frames.length - 1;
-}
-/**
-* Flatten a page's geometry snapshot into the canonical layout. Upright runs
-* copy their wire boxes verbatim (frame 0 — byte-identical to the
-* pre-orientation behavior, wire run rects included); rotated runs project
-* their glyph cells into their cluster's frame.
-*/
-function buildPageTextLayout(snapshot) {
-	const glyphs = [];
-	const runs = [];
-	const frames = [IDENTITY_FRAME];
-	for (const run of snapshot.runs) {
-		if (!isRotatedGeometryRun(run)) {
-			for (const g of run.glyphs) glyphs.push({
-				loose: g.looseBox,
-				tight: g.tightBox,
-				flags: g.flags
-			});
-			runs.push({
-				charStart: run.charStart,
-				count: run.glyphs.length,
-				rect: run.rect,
-				fontSize: run.fontSize,
-				frame: 0
-			});
-			continue;
-		}
-		const frame = frameForRun(frames, run);
-		const f = frames[frame];
-		let runBox = null;
-		for (const g of run.glyphs) {
-			if (isEmpty(g.flags)) {
-				glyphs.push({
-					loose: ZERO_RECT,
-					flags: g.flags
-				});
-				continue;
-			}
-			const loose = frameBoxOfQuad(f, g.looseQuad);
-			const tight = g.tightQuad ? frameBoxOfQuad(f, g.tightQuad) : void 0;
-			glyphs.push({
-				loose,
-				tight,
-				flags: g.flags
-			});
-			runBox = runBox ? {
-				left: Math.min(runBox.left, loose.left),
-				bottom: Math.min(runBox.bottom, loose.bottom),
-				right: Math.max(runBox.right, loose.right),
-				top: Math.max(runBox.top, loose.top)
-			} : loose;
-		}
-		runs.push({
-			charStart: run.charStart,
-			count: run.glyphs.length,
-			rect: runBox ?? ZERO_RECT,
-			fontSize: run.fontSize,
-			frame
-		});
-	}
-	return {
-		glyphs,
-		runs,
-		frames
-	};
-}
-const inRect = (r, p) => p.x >= r.left && p.x <= r.right && p.y >= r.bottom && p.y <= r.top;
-function avgGlyphHeight(layout) {
-	let total = 0;
-	let count = 0;
-	for (const g of layout.glyphs) {
-		if (isEmpty(g.flags)) continue;
-		total += g.loose.top - g.loose.bottom;
-		count++;
-	}
-	return count === 0 ? 0 : total / count;
-}
-/** The point expressed in every frame (index-aligned with `layout.frames`).
-*  Frame 0 returns the point itself — no float round-trip on the fast path. */
-function pointPerFrame(layout, p) {
-	return layout.frames.map((f, i) => i === 0 ? p : toFrame(f, p));
-}
-/**
-* The glyph (char) index at a page-space point, or null when nothing is near
-* (so callers can show the pointer cursor off-text). PDFium `GetIndexAtPos`:
-* exact tight-box containment first, then a tolerance pass (closest by
-* Manhattan distance within `toleranceFactor × average glyph height`). Each
-* run tests the point in ITS OWN frame, so rotated text hit-tests exactly.
-*/
-function textGlyphAt(layout, point, toleranceFactor = 1.5) {
-	const pts = pointPerFrame(layout, point);
-	for (const run of layout.runs) {
-		const q = pts[run.frame];
-		if (!inRect(run.rect, q)) continue;
-		for (let i = 0; i < run.count; i++) {
-			const g = layout.glyphs[run.charStart + i];
-			if (inRect(g.tight ?? g.loose, q)) return run.charStart + i;
-		}
-	}
-	if (toleranceFactor <= 0) return null;
-	const half = avgGlyphHeight(layout) * toleranceFactor / 2;
-	let best = -1;
-	let bestDist = Infinity;
-	for (const run of layout.runs) {
-		const q = pts[run.frame];
-		const r = run.rect;
-		if (q.x < r.left - half || q.x > r.right + half || q.y < r.bottom - half || q.y > r.top + half) continue;
-		for (let i = 0; i < run.count; i++) {
-			const g = layout.glyphs[run.charStart + i];
-			if (isEmpty(g.flags)) continue;
-			const b = g.tight ?? g.loose;
-			if (q.x < b.left - half || q.x > b.right + half || q.y < b.bottom - half || q.y > b.top + half) continue;
-			const dx = Math.min(Math.abs(q.x - b.left), Math.abs(q.x - b.right));
-			const dy = Math.min(Math.abs(q.y - b.bottom), Math.abs(q.y - b.top));
-			if (dx + dy < bestDist) {
-				bestDist = dx + dy;
-				best = run.charStart + i;
-			}
-		}
-	}
-	return best >= 0 ? best : null;
-}
-/** Double-click: the word around `glyph` (walk to space/empty glyphs both ways). */
-function expandTextRangeToWord(layout, glyph) {
-	const n = layout.glyphs.length;
-	if (glyph < 0 || glyph >= n) return [glyph, glyph];
-	let from = glyph;
-	while (from > 0 && !isBoundary(layout.glyphs[from - 1].flags)) from--;
-	let to = glyph;
-	while (to < n - 1 && !isBoundary(layout.glyphs[to + 1].flags)) to++;
-	return [from, to];
-}
-/** Triple-click: the full visual line — SAME-FRAME runs whose vertical extent
-*  overlaps the anchor run's. A differently-oriented run is a line boundary. */
-function expandTextRangeToLine(layout, glyph) {
-	const ri = layout.runs.findIndex((r) => glyph >= r.charStart && glyph < r.charStart + r.count);
-	if (ri < 0) return [glyph, glyph];
-	const anchor = layout.runs[ri];
-	const bottom = anchor.rect.bottom;
-	const top = anchor.rect.top;
-	let from = anchor.charStart;
-	let to = anchor.charStart + anchor.count - 1;
-	for (let r = ri - 1; r >= 0; r--) {
-		const run = layout.runs[r];
-		if (isZero(run.rect)) continue;
-		if (run.frame !== anchor.frame) break;
-		if (!overlapV(run.rect.bottom, run.rect.top, bottom, top)) break;
-		from = run.charStart;
-	}
-	for (let r = ri + 1; r < layout.runs.length; r++) {
-		const run = layout.runs[r];
-		if (isZero(run.rect)) continue;
-		if (run.frame !== anchor.frame) break;
-		if (!overlapV(run.rect.bottom, run.rect.top, bottom, top)) break;
-		to = run.charStart + run.count - 1;
-	}
-	return [from, to];
-}
-/**
-* A single glyph's oriented cell in page space, or null for degenerate
-* glyphs — the anchor for caret placement at a selection boundary.
-*/
-function textGlyphQuad(layout, glyph) {
-	const g = layout.glyphs[glyph];
-	if (!g || isEmpty(g.flags)) return null;
-	const b = g.loose;
-	if (b.right <= b.left || b.top <= b.bottom) return null;
-	const run = layout.runs.find((r) => glyph >= r.charStart && glyph < r.charStart + r.count);
-	const f = layout.frames[run?.frame ?? 0];
-	return quadOfFrameRect(f, run?.frame ?? 0, b);
-}
-/**
-* Merged visual-line segments for the half-open char range
-* `[charStart, charStart + charCount)` — THE canonical segmentation. Chars
-* outside the layout are ignored.
-*/
-function textSegmentsForRange(layout, charStart, charCount) {
-	if (charCount <= 0 || layout.glyphs.length === 0) return [];
-	const lo = Math.max(0, charStart);
-	const hi = Math.min(layout.glyphs.length - 1, charStart + charCount - 1);
-	if (hi < lo) return [];
-	const subRuns = [];
-	for (const run of layout.runs) {
-		const runEnd = run.charStart + run.count - 1;
-		if (runEnd < lo || run.charStart > hi) continue;
-		const s = Math.max(lo, run.charStart);
-		const e = Math.min(hi, runEnd);
-		let left = Infinity;
-		let right = -Infinity;
-		let bottom = Infinity;
-		let top = -Infinity;
-		let charCountAcc = 0;
-		let widthSum = 0;
-		let prevRight = -Infinity;
-		let firstX = 0;
-		let lastX = 0;
-		const flush = () => {
-			if (charCountAcc > 0 && left !== Infinity) subRuns.push({
-				rect: {
-					left,
-					bottom,
-					right,
-					top
-				},
-				charCount: charCountAcc,
-				fontSize: run.fontSize,
-				frame: run.frame,
-				firstX,
-				lastX
-			});
-			left = Infinity;
-			right = -Infinity;
-			bottom = Infinity;
-			top = -Infinity;
-			charCountAcc = 0;
-			widthSum = 0;
-			prevRight = -Infinity;
-		};
-		for (let ci = s; ci <= e; ci++) {
-			const g = layout.glyphs[ci];
-			if (isEmpty(g.flags)) continue;
-			const b = g.loose;
-			if (charCountAcc > 0 && prevRight > -Infinity) {
-				const avg = widthSum / charCountAcc;
-				if (avg > 0 && Math.abs(b.left - prevRight) > CHAR_DISTANCE_FACTOR * avg) flush();
-			}
-			const centerX = (b.left + b.right) / 2;
-			if (charCountAcc === 0) firstX = centerX;
-			lastX = centerX;
-			left = Math.min(left, b.left);
-			right = Math.max(right, b.right);
-			bottom = Math.min(bottom, b.bottom);
-			top = Math.max(top, b.top);
-			charCountAcc++;
-			widthSum += b.right - b.left;
-			prevRight = b.right;
-		}
-		flush();
-	}
-	return mergeAdjacentSubRuns(subRuns).map((m) => materializeSegment(layout, m));
-}
-function mergeAdjacentSubRuns(runs) {
-	const out = [];
-	let prev = null;
-	let cur = null;
-	for (const run of runs) {
-		if (prev && cur && prev.frame === run.frame && shouldMerge(prev, run)) cur = {
-			rect: {
-				left: Math.min(cur.rect.left, run.rect.left),
-				bottom: Math.min(cur.rect.bottom, run.rect.bottom),
-				right: Math.max(cur.rect.right, run.rect.right),
-				top: Math.max(cur.rect.top, run.rect.top)
-			},
-			frame: cur.frame,
-			firstX: cur.firstX,
-			lastX: run.lastX
-		};
-		else {
-			if (cur) out.push(cur);
-			cur = {
-				rect: run.rect,
-				frame: run.frame,
-				firstX: run.firstX,
-				lastX: run.lastX
-			};
-		}
-		prev = run;
-	}
-	if (cur && cur.rect.right > cur.rect.left && cur.rect.top > cur.rect.bottom) out.push(cur);
-	return out;
-}
-/** Segment quad for a frame-local rect (frame 0: the rect's own corners,
-*  no float round-trip). Slot order US, UE, LS, LE; frame is y-up, so the
-*  upper corners sit at the frame TOP. */
-function quadOfFrameRect(f, frameIndex, r) {
-	if (frameIndex === 0) return {
-		p1: {
-			x: r.left,
-			y: r.top
-		},
-		p2: {
-			x: r.right,
-			y: r.top
-		},
-		p3: {
-			x: r.left,
-			y: r.bottom
-		},
-		p4: {
-			x: r.right,
-			y: r.bottom
-		}
-	};
-	return {
-		p1: fromFrame(f, {
-			x: r.left,
-			y: r.top
-		}),
-		p2: fromFrame(f, {
-			x: r.right,
-			y: r.top
-		}),
-		p3: fromFrame(f, {
-			x: r.left,
-			y: r.bottom
-		}),
-		p4: fromFrame(f, {
-			x: r.right,
-			y: r.bottom
-		})
-	};
-}
-function materializeSegment(layout, m) {
-	const frame = layout.frames[m.frame];
-	const quad = quadOfFrameRect(frame, m.frame, m.rect);
-	return {
-		quad,
-		rect: m.frame === 0 ? m.rect : {
-			left: Math.min(quad.p1.x, quad.p2.x, quad.p3.x, quad.p4.x),
-			bottom: Math.min(quad.p1.y, quad.p2.y, quad.p3.y, quad.p4.y),
-			right: Math.max(quad.p1.x, quad.p2.x, quad.p3.x, quad.p4.x),
-			top: Math.max(quad.p1.y, quad.p2.y, quad.p3.y, quad.p4.y)
-		},
-		advance: m.lastX >= m.firstX ? 1 : -1
-	};
-}
-function shouldMerge(a, b) {
-	if (a.fontSize != null && b.fontSize != null && a.fontSize > 0 && b.fontSize > 0) {
-		if (Math.max(a.fontSize, b.fontSize) / Math.min(a.fontSize, b.fontSize) > FONT_SIZE_RATIO_THRESHOLD) return false;
-	}
-	if (verticalOverlap(a.rect, b.rect) < VERTICAL_OVERLAP_THRESHOLD) return false;
-	const aw = (a.rect.right - a.rect.left) / a.charCount;
-	const bw = (b.rect.right - b.rect.left) / b.charCount;
-	const aL = a.rect.left - aw;
-	const aR = a.rect.right + aw;
-	const bL = b.rect.left - bw;
-	return aL < b.rect.right + bw && aR > bL;
-}
-function verticalOverlap(a, b) {
-	const ah = a.top - a.bottom;
-	const bh = b.top - b.bottom;
-	if (ah <= 0 || bh <= 0) return 0;
-	const u = Math.max(a.top, b.top) - Math.min(a.bottom, b.bottom);
-	if (u === ah || u === bh) return 1;
-	return Math.max(0, Math.min(a.top, b.top) - Math.max(a.bottom, b.bottom)) / u;
-}
-const isZero = (r) => r.right === r.left && r.top === r.bottom;
-function overlapV(bottom1, top1, bottom2, top2) {
-	const u = Math.max(top1, top2) - Math.min(bottom1, bottom2);
-	if (u === 0) return false;
-	return Math.max(0, Math.min(top1, top2) - Math.max(bottom1, bottom2)) / u >= LINE_OVERLAP_THRESHOLD;
-}
-//#endregion
-//#region src/search/rects.ts
-/**
-* Match-range → canonical visual-line segments. Thin wrappers over the ONE
-* text layout (`src/text/layout.ts`) — search owns matching and cursors,
-* never segmentation, so a match highlights exactly like a selection of the
-* same characters. No frame or merge logic lives here.
-*/
-/** Canonical segments for `[charStart, charStart + charCount)`. */
-function searchSegmentsForRange(snapshot, charStart, charCount) {
-	return textSegmentsForRange(buildPageTextLayout(snapshot), charStart, charCount);
-}
-/** The segments' AABBs — for consumers that genuinely want boxes. */
-function searchRectsForRange(snapshot, charStart, charCount) {
-	return searchSegmentsForRange(snapshot, charStart, charCount).map((s) => s.rect);
-}
-//#endregion
-//#region src/search/epoch.ts
-/**
-* The search CONTENT EPOCH: a deterministic fingerprint of everything a
-* search result depends on — page order/structure (`layoutVersion`) and
-* each page's text content (`contentVersion`), nothing else. Annotation
-* and metadata churn deliberately do NOT move it, so cached search
-* responses in a collaborative document survive comment storms.
-*
-* Both sides compute it from the manifest they already hold: the client
-* to mint versioned search URLs, the server to validate them (mismatch →
-* NotFound, the standard stale-versioned-read signal). FNV-1a 64-bit —
-* dependency-free and stable; not cryptographic, and doesn't need to be:
-* an adversary can only vary his OWN authorized query results.
-*/
-function searchContentEpoch(manifest) {
-	let input = `${manifest.layoutVersion}`;
-	for (const page of manifest.pages) input += `|${page.state.pageObjectNumber}:${page.cache.contentVersion}`;
-	return fnv1a64(input);
-}
-const FNV_OFFSET = 14695981039346656037n;
-const FNV_PRIME = 1099511628211n;
-const MASK_64 = 18446744073709551615n;
-function fnv1a64(input) {
-	let hash = FNV_OFFSET;
-	for (let i = 0; i < input.length; i++) {
-		hash ^= BigInt(input.charCodeAt(i));
-		hash = hash * FNV_PRIME & MASK_64;
-	}
-	return hash.toString(16).padStart(16, "0");
-}
-/**
-* Canonicalize a query for CACHE KEYING: default-fold literal queries are
-* pre-folded ("Café", "café" and "CAFE" are the same search, so they
-* should be the same cache entry). Semantics are unchanged — the fold is
-* idempotent and exactly what the matcher applies to the needle anyway.
-* Case- or diacritic-sensitive literals and regex patterns pass through
-* untouched (their raw form IS the query).
-*/
-function canonicalSearchQuery(query) {
-	if (query.regex || query.matchCase || query.matchDiacritics) return query;
-	const canonical = { text: foldText(query.text).folded };
-	if (query.wholeWord) canonical.wholeWord = true;
-	return canonical;
-}
-//#endregion
-//#region src/auth/scope/pdf-bits.ts
-/**
-* ISO 32000 user-access permission bit positions, expressed as integer
-* masks. Bit numbers in the spec are 1-indexed, so bit 3 = `1 << 2`.
-*
-* Bits 1, 2, 7, 8, and 13+ are reserved and not surfaced here.
-*/
-const PDF_BITS = {
-	/** Bit 3 — print the document. */
-	PRINT: 4,
-	/** Bit 4 — modify content streams. */
-	MODIFY: 8,
-	/** Bit 5 — copy/extract text and graphics. */
-	COPY: 16,
-	/** Bit 6 — annotate + fill forms (+ modify form fields with bit 4). */
-	ANNOTATE_FILL: 32,
-	/** Bit 9 — fill existing forms (even if bit 6 is clear). */
-	FILL_FORMS: 256,
-	/** Bit 10 — accessibility extraction (deprecated in PDF 2.0). */
-	ACCESSIBILITY: 512,
-	/** Bit 11 — assemble document (insert/rotate/delete pages, outline). */
-	ASSEMBLE: 1024,
-	/** Bit 12 — high-quality print (refines bit 3). */
-	PRINT_HIGH: 2048
-};
-/**
-* Decode a raw PDFium permission integer into a typed boolean view.
-*
-* `null` input (the documents row column is nullable until probed)
-* yields all-false bits — i.e., a maximally restrictive interpretation.
-* That keeps `pdf.permissions` expansion safe on unprobed documents.
-*/
-function decodePdfBits(raw) {
-	if (raw === null) return {
-		bit3: false,
-		bit4: false,
-		bit5: false,
-		bit6: false,
-		bit9: false,
-		bit10: false,
-		bit11: false,
-		bit12: false
-	};
-	return {
-		bit3: (raw & PDF_BITS.PRINT) !== 0,
-		bit4: (raw & PDF_BITS.MODIFY) !== 0,
-		bit5: (raw & PDF_BITS.COPY) !== 0,
-		bit6: (raw & PDF_BITS.ANNOTATE_FILL) !== 0,
-		bit9: (raw & PDF_BITS.FILL_FORMS) !== 0,
-		bit10: (raw & PDF_BITS.ACCESSIBILITY) !== 0,
-		bit11: (raw & PDF_BITS.ASSEMBLE) !== 0,
-		bit12: (raw & PDF_BITS.PRINT_HIGH) !== 0
-	};
-}
-//#endregion
-//#region src/auth/scope/builders.ts
-/**
-* Typed capability constants for customer-side JWT minting.
-*
-* The shape mirrors the dotted capability name so it reads naturally:
-*   caps.doc.text.copy()                  // "doc.text.copy"
-*   caps.doc.download()                   // "doc.download"
-*   caps.doc.download.flattened()         // "doc.download.flattened"
-*   caps.doc.print.high()                 // "doc.print.high"
-*
-* Each leaf is a function returning the literal string (as `const`) so
-* TypeScript catches typos at the call site. Wrappers like `download`
-* and `print` are `Object.assign`'d to be callable AND carry child
-* properties for the refinement capabilities.
-*/
-const caps = { doc: {
-	open: () => "doc.open",
-	render: () => "doc.render",
-	text: {
-		select: () => "doc.text.select",
-		copy: () => "doc.text.copy",
-		search: () => "doc.text.search"
-	},
-	content: { copy: () => "doc.content.copy" },
-	download: Object.assign(() => "doc.download", { flattened: () => "doc.download.flattened" }),
-	print: Object.assign(() => "doc.print", { high: () => "doc.print.high" }),
-	pages: {
-		modify: () => "doc.pages.modify",
-		assemble: () => "doc.pages.assemble"
-	},
-	forms: {
-		read: () => "doc.forms.read",
-		fill: () => "doc.forms.fill",
-		modify: () => "doc.forms.modify"
-	},
-	annotate: {
-		read: () => "doc.annotate.read",
-		modify: () => "doc.annotate.modify"
-	},
-	metadata: { modify: () => "doc.metadata.modify" },
-	attachments: { modify: () => "doc.attachments.modify" },
-	redact: () => "doc.redact"
-} };
-/**
-* Builder factory for collab scope filters. Each entity:action pair
-* gets a sub-object with the four filter constructors.
-*
-*   collab.annotations.create.self()           → "annotations:create:self"
-*   collab.annotations.create.group("legal")   → "annotations:create:group=legal"
-*   collab.annotations.update.group("4")       → "annotations:update:group=4"
-*   collab.annotations.delete.createdBy("u-7") → "annotations:delete:createdBy=u-7"
-*   collab.annotations.setGroup.group("legal") → "annotations:set-group:group=legal"
-*   collab.annotations.all.all()               → "annotations:*:all"  (action wildcard)
-*
-* On create, the filter is evaluated against the caller's own identity
-* (no impersonation), so `:self` and `:all` trivially pass; `:group=X`
-* is the meaningful filter — it constrains creation to callers whose
-* default group is X.
-*/
-const collab = { annotations: {
-	create: makeFilterBuilder("annotations", "create"),
-	update: makeFilterBuilder("annotations", "update"),
-	delete: makeFilterBuilder("annotations", "delete"),
-	setGroup: makeSetGroupBuilder(),
-	/** Action wildcard — matches create, update, delete, AND set-group with the given filter. */
-	all: makeFilterBuilder("annotations", "*")
-} };
-function makeFilterBuilder(entity, action) {
-	return {
-		all: () => `${entity}:${action}:all`,
-		self: () => `${entity}:${action}:self`,
-		createdBy: (userId) => `${entity}:${action}:createdBy=${userId}`,
-		group: (groupId) => `${entity}:${action}:group=${groupId}`
-	};
-}
-function makeSetGroupBuilder() {
-	return {
-		all: () => "annotations:set-group:all",
-		group: (groupId) => `annotations:set-group:group=${groupId}`
-	};
-}
-/**
-* Builder for the `pdf.permissions` virtual scope. Returns the literal
-* string; provided as a helper for parity with caps/collab in JWT
-* construction code.
-*/
-const pdfPermissions = () => "pdf.permissions";
-/**
-* Materialise `pdf.permissions` into the concrete capability list it
-* would expand to under the given PDF bit configuration.
-*
-* Useful when the customer wants to start from PDF defaults and then
-* subtract specific capabilities — easier to build the JWT scope array
-* by filtering an explicit list than by composing virtual + denials.
-*
-*   const defaults = materializePdfPermissions(pdfBits);
-*   const scope = [
-*     ...defaults.filter(s => s !== 'doc.text.copy'),
-*     'doc.download',
-*   ];
-*
-* IMPORTANT: this MUST stay in sync with `addPdfPermissions` inside
-* resolver.ts. A test pins them together.
-*/
-function materializePdfPermissions(b) {
-	const out = /* @__PURE__ */ new Set();
-	out.add("doc.open");
-	out.add("doc.render");
-	out.add("doc.annotate.read");
-	out.add("doc.forms.read");
-	if (b.bit5) {
-		out.add("doc.text.select");
-		out.add("doc.text.copy");
-		out.add("doc.text.search");
-		out.add("doc.content.copy");
-	}
-	if (b.bit3) out.add("doc.print");
-	if (b.bit12 && b.bit3) out.add("doc.print.high");
-	if (b.bit4) {
-		out.add("doc.pages.modify");
-		out.add("doc.redact");
-		out.add("doc.metadata.modify");
-		out.add("doc.attachments.modify");
-	}
-	if (b.bit11) out.add("doc.pages.assemble");
-	if (b.bit6) out.add("doc.annotate.modify");
-	if (b.bit6 || b.bit9) {
-		out.add("doc.forms.fill");
-		out.add("doc.sign");
-	}
-	if (b.bit6 && b.bit4) out.add("doc.forms.modify");
-	return [...out];
-}
-//#endregion
-export { buildCommentThreads as $, USAGE_INCOMPLETE as A, changedKeys as B, validateSearchRegex as C, wordBefore as D, wordAt as E, assessmentOf as F, stableStringify as G, parsePdfValue as H, combine as I, appearanceImpactOf as J, decodeFieldRefKey as K, conclude as L, evaluateStep as M, restrictionsOf as N, DEFAULT_EDGE_RESOLVER_BUDGET as O, sameEffectiveValue as P, shiftsExistingAnnotationIndices as Q, primaryFinding as R, validateSearchQuery as S, matchLiteral as T, pdfValueEquals as U, dictEntries as V, refsOf as W, changesAnnotationList as X, semanticEqual as Y, invalidatesWeakIndexRefs as Z, SEARCH_SNIPPET_CONTEXT as _, richTextPlainText as _t, PDF_BITS as a, normalizeAnnotationPatch as at, SEARCH_REGEX_MAX_LENGTH as b, decodeSubmitFormFlags as bt, searchContentEpoch as c, resolveBinarySource as ct, buildPageTextLayout as d, knownWeakAnnotationState as dt, isStateAnnotation as et, expandTextRangeToLine as f, revisionTokensEqual as ft, textSegmentsForRange as g, richTextParagraphsFromPlainText as gt, textGlyphQuad as h, isValidPageObjectNumber as ht, pdfPermissions as i, normalizeAnnotationDraft as it, restrictionsFor as j, EdgeResolver as k, searchRectsForRange as l, NO_ANNOTATION_FLAGS as lt, textGlyphAt as m, encodeStableIdKey as mt, collab as n, classifyRelation as nt, decodePdfBits as o, normalizeAttachmentFileSource as ot, expandTextRangeToWord as p, decodeStableIdKey as pt, encodeFieldRefKey as q, materializePdfPermissions as r, refKey as rt, canonicalSearchQuery as s, sniffBinaryMetadata as st, caps as t, buildThreads as tt, searchSegmentsForRange as u, UNKNOWN_WEAK_ANNOTATION_STATE as ut, buildSnippet as v, DEFAULT_PDF_SAVE_MODE as vt, foldOptionsFor as w, matchRegex as x, matchPageText as y, createPageImageHandle as yt, worstVerdict as z };
-
-//# sourceMappingURL=builders-Dqo2X-dt.js.map