@embedpdf/engine-core 3.0.0-next.14 → 3.0.0-next.16

package/dist/{resolver-inAVzsWt.js → resolver-BBggAxQc.js}

@@ -1,8 +1,115 @@
+import { h as EngineError, v as _defineProperty, y as EngineErrorCode } from "./format-Dgg428Kb.js";
+import { r as materializePdfPermissions } from "./builders-DV62HA3I.js";
+//#region src/auth/scope/errors.ts
+/**
+* Thrown by {@link parseScope} / {@link validateScopeArray} when a scope
+* string does not match any known grammar (capability, collab, virtual,
+* or wildcard). An `EngineError` with code `InvalidArg`.
+*
+* Carries the offending scope verbatim so route/JWT-layer error
+* handlers can echo it to the customer.
+*/
+var InvalidScope = class extends EngineError {
+	constructor(scope, reason) {
+		super(EngineErrorCode.InvalidArg, `invalid scope "${scope}": ${reason}`, { details: {
+			scope,
+			reason
+		} });
+		this.scope = scope;
+		_defineProperty(this, "name", "InvalidScope");
+	}
+};
+/**
+* Thrown by route guards and engine-local enforcement when a capability
+* or collab action is denied for the current request/handle. An
+* `EngineError` with code `Forbidden`, on both engines.
+*
+* `required` (also `details.required`) names what the caller needed (e.g.
+* "doc.render" or "annotations:update"). When any of several would have
+* done, `anyOf` (also `details.anyOf`) lists them and `required` is the
+* first. `context` is an optional label such as "engine-local" or a route.
+*/
+var PermissionDenied = class extends EngineError {
+	constructor(required, context, anyOf, refs) {
+		super(EngineErrorCode.Forbidden, `permission denied${context ? ` (${context})` : ""}: ${anyOf ? `one of ${anyOf.join(", ")}` : required}${refs ? ` for ${refs.length} annotation${refs.length === 1 ? "" : "s"}` : ""}`, { details: {
+			required,
+			...context === void 0 ? {} : { context },
+			...anyOf === void 0 ? {} : { anyOf: [...anyOf] },
+			...refs === void 0 ? {} : { refs: [...refs] }
+		} });
+		this.required = required;
+		this.context = context;
+		this.anyOf = anyOf;
+		this.refs = refs;
+		_defineProperty(this, "name", "PermissionDenied");
+	}
+};
+/**
+* Thrown at engine-local open time when the supplied scope includes
+* collab filters (`:self`, `:group=...`) but the identity claims needed
+* to resolve them are missing. Fails loudly at open so the configuration
+* mistake is visible immediately instead of producing silent denies at
+* every annotation mutation. An `EngineError` with code `InvalidArg`.
+*/
+var MissingIdentity = class extends EngineError {
+	constructor(scope) {
+		super(EngineErrorCode.InvalidArg, `scope "${scope}" requires an identity (userId and/or groups)`, { details: { scope } });
+		this.scope = scope;
+		_defineProperty(this, "name", "MissingIdentity");
+	}
+};
+//#endregion
+//#region src/identity/AnnotationRef.ts
+/**
+* URL-safe encoding of a ref without its page, used by the cloud HTTP
+* surface as the `:annotKey` route parameter beside `:pageKey`
+* (`encodePageKey`). Decoded by `decodeAnnotKey`.
+*
+*   `{ kind: 'objectNumber', objectNumber: 42 }` -> `'obj:42'`
+*   `{ kind: 'baseIndex', baseIndex: 2 }`        -> `'base:2'`
+*/
+function encodeAnnotKey(ref) {
+	if (ref.kind === "objectNumber") {
+		if (!Number.isInteger(ref.objectNumber) || ref.objectNumber <= 0) throw new RangeError(`encodeAnnotKey: objectNumber must be a positive integer, got ${ref.objectNumber}`);
+		return `obj:${ref.objectNumber}`;
+	}
+	if (!Number.isInteger(ref.baseIndex) || ref.baseIndex < 0) throw new RangeError(`encodeAnnotKey: baseIndex must be a non-negative integer, got ${ref.baseIndex}`);
+	return `base:${ref.baseIndex}`;
+}
+/**
+* Inverse of `encodeAnnotKey`, on the page the route names. Returns `null`
+* for malformed input so the server can answer 400 InvalidArg with a useful
+* message instead of throwing. The input is the already-`decodeURIComponent`-ed
+* segment from the route path.
+*/
+function decodeAnnotKey(page, key) {
+	const number = (prefix, min) => {
+		if (!key.startsWith(prefix)) return null;
+		const rest = key.slice(prefix.length);
+		const n = Number.parseInt(rest, 10);
+		return Number.isInteger(n) && n >= min && String(n) === rest ? n : null;
+	};
+	const objectNumber = number("obj:", 1);
+	if (objectNumber !== null) return {
+		kind: "objectNumber",
+		page,
+		objectNumber
+	};
+	const baseIndex = number("base:", 0);
+	if (baseIndex !== null) return {
+		kind: "baseIndex",
+		page,
+		baseIndex
+	};
+	return null;
+}
+//#endregion
 //#region src/signature/protection.ts
 /**
 * Bumped whenever the derivation below (or a judgement rule) changes meaning.
 * Rides every protection and every analysis, and keys the cloud's immutable
-* analysis URLs. v4 (the `signature-compat` corpus, 91 Acrobat observations):
+* analysis URLs. The current policy is calibrated on the 91 Acrobat
+* observations in `packages/engine/main/test/fixtures/signature-compat`:
 * each signature is judged on the net state of the document against the
 * revision it sealed; an object written again with the sealed value is not
 * a modification; an approval signature permits commenting; field
@@ -15,8 +122,8 @@ const SIGNATURE_POLICY_VERSION = 4;
 * changes only for certification signatures; Acrobat reads an approval
 * signature as "Form Fill-in, Signing and Commenting are allowed" (its own
 * permission text under every such signature) and keeps it valid through a
-* Square annotation added, deleted or recoloured afterwards (corpus
-* `signature-compat` v3 cases 88, 90, 91: "Annotations Created/Deleted/
+* Square annotation added, deleted or recoloured afterwards (fixtures
+* `signature-compat/v3/88`, `/90` and `/91`: "Annotations Created/Deleted/
 * Modified", signature valid). pyHanko judges stricter (fill only); Acrobat
 * is the validator recipients use, so the baseline is `annotate`.
 */
@@ -64,7 +171,7 @@ function lockCovers(spec, fieldName) {
 *              did allow annotations.
 *   fieldLocks = every signed signature's FieldMDP and the /Lock of every
 *              signed field. Unsigned fields' /Lock entries describe a
-*              FUTURE signature and lock nothing yet.
+*              future signature and lock nothing yet.
 */
 function deriveProtection(signatures) {
 	let signed = false;
@@ -109,15 +216,38 @@ function fieldLockFor(protection, fieldName) {
 	return null;
 }
 /**
+* Every capability a protection can remove: the most it ever takes away.
+* A check of any other capability never needs the document's protection.
+*/
+const PROTECTABLE_CAPABILITIES = [
+	"doc.download.flattened",
+	"doc.pages.modify",
+	"doc.pages.assemble",
+	"doc.redact",
+	"doc.attachments.modify",
+	"doc.outline.modify",
+	"doc.forms.modify",
+	"doc.forms.script",
+	"doc.annotate.modify",
+	"doc.annotate.import",
+	"doc.forms.fill",
+	"doc.forms.import"
+];
+const PROTECTABLE = new Set(PROTECTABLE_CAPABILITIES);
+/** Whether a protection can ever remove `capability`. */
+function isProtectableCapability(capability) {
+	return PROTECTABLE.has(capability);
+}
+/**
 * The capabilities a protection removes from every caller, admin scope
 * included — document-derived authority, exactly like encryption bits.
 *
-* Only what was DECLARED is refused: a refusal is a promise a signer made,
+* Only what was declared is refused: a refusal is a promise a signer made,
 * never a guess about a validator. A certification (or a lock with /P)
 * declares what may follow, and everything outside that — page edits,
-* redaction, field authoring, attachments, and below P=3 annotations, below
+* redaction, field authoring, attachments, the outline, and below P=3 annotations, below
 * P=2 form fill — is refused. A plain approval signature declares nothing:
-* the same edits stay possible and are then JUDGED, the verdict saying the
+* the same edits stay possible and are then judged, the verdict saying the
 * signature no longer holds, exactly as Acrobat does. The one exception is a
 * rewrite: it does not invalidate signatures, it erases them, so any signed
 * document refuses it. Per-field locks are enforced by the form mutator.
@@ -131,63 +261,29 @@ function protectedCapabilities(protection) {
 	out.add("doc.pages.assemble");
 	out.add("doc.redact");
 	out.add("doc.attachments.modify");
+	out.add("doc.outline.modify");
 	out.add("doc.forms.modify");
-	if (!levelAllows(protection.enforced, "annotate")) out.add("doc.annotate.modify");
-	if (!levelAllows(protection.enforced, "fill")) out.add("doc.forms.fill");
-	return out;
-}
-//#endregion
-//#region src/auth/scope/errors.ts
-/**
-* Thrown by {@link parseScope} / {@link validateScopeArray} when a scope
-* string does not match any known grammar (capability, collab, virtual,
-* or wildcard).
-*
-* Carries the offending scope verbatim so route/JWT-layer error
-* handlers can echo it to the customer.
-*/
-var InvalidScope = class extends Error {
-	constructor(scope, reason) {
-		super(`invalid scope "${scope}": ${reason}`);
-		this.scope = scope;
-		this.name = "InvalidScope";
+	out.add("doc.forms.script");
+	if (!levelAllows(protection.enforced, "annotate")) {
+		out.add("doc.annotate.modify");
+		out.add("doc.annotate.import");
 	}
-};
-/**
-* Thrown by route guards and engine-local enforcement when a capability
-* or collab action is denied for the current request/handle.
-*
-* `required` names what the caller needed (e.g., "doc.render" or
-* "annotations:update"). `context` is an optional label such as "local"
-* or "/v1/docs/.../pages/2/render".
-*/
-var PermissionDenied = class extends Error {
-	constructor(required, context) {
-		super(`permission denied${context ? ` (${context})` : ""}: ${required}`);
-		this.required = required;
-		this.context = context;
-		this.name = "PermissionDenied";
-	}
-};
-/**
-* Thrown at engine-local open time when the supplied scope includes
-* collab filters (`:self`, `:group=...`) but the identity claims needed
-* to resolve them are missing. Fails loudly at open so the configuration
-* mistake is visible immediately instead of producing silent denies at
-* every annotation mutation.
-*/
-var MissingIdentity = class extends Error {
-	constructor(scope) {
-		super(`scope "${scope}" requires identity claims (user_id and/or groups)`);
-		this.name = "MissingIdentity";
+	if (!levelAllows(protection.enforced, "fill")) {
+		out.add("doc.forms.fill");
+		out.add("doc.forms.import");
 	}
-};
+	return out;
+}
+/** Why `protection` refuses `capability`: the message of a `ProtectedDocument` refusal. */
+function describeProtection(capability, protection) {
+	return `the document is signed: ${protection.certification ? `certification signature ${protection.certification.signatureIndex} (permission ${protection.certification.permission})` : `an existing signature (declared level '${protection.enforced ?? "none declared"}')`} forbids '${capability}'`;
+}
 //#endregion
 //#region src/auth/scope/parser.ts
 /**
 * Closed set of recognized capability strings. Membership is the
 * authoritative source of truth — adding a new capability requires
-* extending the `DocCapability` union AND adding it here. The parser
+* extending the `DocCapability` union and adding it here. The parser
 * rejects anything outside this set.
 *
 * Removed legacy names (e.g., `doc.read`, `doc.edit-pages`, `doc.save`)
@@ -210,11 +306,15 @@ const KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
 	"doc.forms.read",
 	"doc.forms.fill",
 	"doc.forms.modify",
+	"doc.forms.import",
+	"doc.forms.script",
 	"doc.forms.submit",
 	"doc.annotate.read",
 	"doc.annotate.modify",
+	"doc.annotate.import",
 	"doc.metadata.modify",
 	"doc.attachments.modify",
+	"doc.outline.modify",
 	"doc.redact",
 	"doc.sign",
 	"doc.sign.certify"
@@ -257,6 +357,7 @@ function parseCollab(raw) {
 	const entity = raw.slice(0, idx1);
 	const action = raw.slice(idx1 + 1, idx2);
 	const filterStr = raw.slice(idx2 + 1);
+	if (entity === "fields") return parseFieldScope(raw, action, filterStr);
 	if (entity !== "annotations") throw new InvalidScope(raw, `unknown collab entity: ${entity}`);
 	if (action !== "create" && action !== "update" && action !== "delete" && action !== "set-group" && action !== "*") throw new InvalidScope(raw, `unknown collab action: ${action}`);
 	const filter = parseFilter(filterStr, raw);
@@ -268,6 +369,22 @@ function parseCollab(raw) {
 		filter
 	};
 }
+/**
+* `fields:<fill|sign|set-group|*>:<all|group=NAME>`. A field's group is who
+* fills it, and a field records no creator, so `self` and `createdBy=` are
+* refused.
+*/
+function parseFieldScope(raw, action, filterStr) {
+	if (action !== "fill" && action !== "sign" && action !== "set-group" && action !== "*") throw new InvalidScope(raw, `unknown fields action: ${action}`);
+	const filter = parseFilter(filterStr, raw);
+	if (filter.kind !== "all" && filter.kind !== "group") throw new InvalidScope(raw, `fields only support :all or :group=<id> filters (got :${filter.kind})`);
+	return {
+		kind: "collab",
+		entity: "fields",
+		action,
+		filter
+	};
+}
 function parseFilter(s, raw) {
 	if (s === "all") return { kind: "all" };
 	if (s === "self") return { kind: "self" };
@@ -300,6 +417,13 @@ function parseCapability(raw) {
 }
 //#endregion
 //#region src/auth/scope/resolver.ts
+/** The collab target of a record read with nullable owner fields (an annotation). */
+function collabTargetOf(owner) {
+	return {
+		...owner.userId ? { userId: owner.userId } : {},
+		...owner.groupId ? { groupId: owner.groupId } : {}
+	};
+}
 /**
 * True iff the given capability is granted by the scope array plus the
 * PDF bits visible via `pdf.permissions` expansion.
@@ -314,9 +438,9 @@ function checkCapability(capability, rawScope, pdfBits, protection = null) {
 	return expandedCapabilities(parsed, pdfBits, protection).has(capability);
 }
 /**
-* True iff the scope grants AT LEAST ONE of `capabilities`. Convenience
-* for routes like `/text` (`doc.text.copy` OR `doc.text.search`) and
-* `/geometry` (`doc.text.select` OR `doc.text.search`).
+* True iff the scope grants at least one of `capabilities`. Convenience
+* for routes like `/text` (`doc.text.copy` or `doc.text.search`) and
+* `/geometry` (`doc.text.select` or `doc.text.search`).
 */
 function checkAnyCapability(capabilities, rawScope, pdfBits, protection = null) {
 	return capabilities.some((c) => checkCapability(c, rawScope, pdfBits, protection));
@@ -326,7 +450,7 @@ function checkAnyCapability(capabilities, rawScope, pdfBits, protection = null)
 *
 * Narrowing model. For each action independently:
 *   1. wildcard `*` → allow (global escape hatch)
-*   2. if any collab scope applies to this action → NARROW: only those
+*   2. if any collab scope applies to this action → narrow: only those
 *      collab filters decide. If none match the target, deny — even if
 *      `doc.annotate.modify` is also present. This is what makes
 *      `[modify, update:self]` correctly mean "edit own only" rather
@@ -337,7 +461,7 @@ function checkAnyCapability(capabilities, rawScope, pdfBits, protection = null)
 *   4. otherwise → deny.
 *
 * For create: `target` should be built by the caller from JWT identity
-* (`{ userId: caller.user_id, groupId: caller.group_id }`). `:self` and
+* (`{ userId: caller.userId, groupId: caller.groupId }`). `:self` and
 * `:all` then trivially pass; `:group=X` is the meaningful filter (only
 * matches when the caller's default group is X).
 *
@@ -362,17 +486,22 @@ function checkCollab(action, target, rawScope, identity, pdfBits) {
 *   - any annotation collab scope implies `doc.annotate.read`, because
 *     mutation routes need to see the target row to evaluate the
 *     collab filter against its current owner.
+*   - any field collab scope implies `doc.forms.read`: filling in or
+*     signing a field means seeing the form. Groups limit writes, never
+*     reads.
 *
-* Does NOT short-circuit on wildcard — callers do that themselves
+* Does not short-circuit on wildcard — callers do that themselves
 * before calling this. Returning the expanded set is useful for the
 * `/access` response's `effectiveScope` and for advisory UI surfacing.
 */
 function expandedCapabilities(parsed, pdfBits, protection = null) {
 	const out = /* @__PURE__ */ new Set();
 	let hasAnnotationCollab = false;
+	let hasFieldCollab = false;
 	for (const s of parsed) if (s.kind === "capability") out.add(s.name);
 	else if (s.kind === "virtual" && s.name === "pdf.permissions") addPdfPermissions(out, pdfBits);
 	else if (s.kind === "collab" && s.entity === "annotations") hasAnnotationCollab = true;
+	else if (s.kind === "collab" && s.entity === "fields") hasFieldCollab = true;
 	if (out.has("doc.annotate.modify")) out.add("doc.annotate.read");
 	if (out.has("doc.forms.modify")) {
 		out.add("doc.forms.fill");
@@ -380,6 +509,7 @@ function expandedCapabilities(parsed, pdfBits, protection = null) {
 	}
 	if (out.has("doc.forms.fill")) out.add("doc.forms.read");
 	if (hasAnnotationCollab) out.add("doc.annotate.read");
+	if (hasFieldCollab) out.add("doc.forms.read");
 	for (const removed of protectedCapabilities(protection)) out.delete(removed);
 	return out;
 }
@@ -392,119 +522,142 @@ function expandRawScope(rawScope, pdfBits, protection = null) {
 	return expandedCapabilities(rawScope.map(parseScope), pdfBits, protection);
 }
 /**
-* Test a single collab filter against a target record + the caller's
-* identity. Pure function — no side effects, no implicit rules.
+* Authority to put a record of `entity` in a specific group: an annotation,
+* or a form field.
 *
-*   all              → always matches
-*   self             → matches if identity.user_id === target.userId
-*   createdBy=<X>    → matches if target.userId === X
-*   group=<X>        → matches if target.groupId === X
-*                      AND identity.groups includes X
-*
-* The group-membership check on `group=X` prevents a token from
-* matching annotations in a group it doesn't belong to, even if the
-* target row carries that groupId.
-*/
-/**
-* Authority to assign a specific groupId to an annotation.
-*
-* Set-group is decoupled from `doc.annotate.modify`. The reasoning:
-* capabilities like `modify` describe row access — what kind of write
-* you can do to which existing rows — and map to PDF permission bits.
-* Set-group is a cloud-only *assignment authority*: which destination
-* group can you put an annotation into? There is no PDF-bit
-* counterpart, so it doesn't inherit from `modify`.
+* Set-group is decoupled from the write capabilities (`doc.annotate.modify`,
+* `doc.forms.modify`). The reasoning: those describe row access — what kind
+* of write you can do to which existing rows — and map to PDF permission
+* bits. Set-group is a cloud-only *assignment authority*: which destination
+* group can you put a record into? There is no PDF-bit counterpart, so it
+* doesn't inherit from them.
 *
 * Resolution order:
 *   1. newGroupId === callerDefaultGroupId → true (no real reassignment
-*      is happening; the annotation gets the caller's default group)
+*      is happening; the record gets the caller's default group)
 *   2. wildcard `*` → true (global escape hatch)
-*   3. `annotations:set-group:all` → true
-*   4. `annotations:set-group:group=<newGroupId>` → true
-*   5. `annotations:*:all` or `annotations:*:group=<newGroupId>` → true
+*   3. `<entity>:set-group:all` → true
+*   4. `<entity>:set-group:group=<newGroupId>` → true
+*   5. `<entity>:*:all` or `<entity>:*:group=<newGroupId>` → true
 *      (action wildcard includes set-group)
 *   6. otherwise → false
 *
-* Note: independent from membership. A user with
-* `set-group:group=legal` can assign annotations to the legal group
-* even if they're not a member — that's the whole point.
+* A user with `set-group:group=legal` can put records in the legal group
+* whatever their own group is — that's the whole point.
 */
-function checkSetGroup(newGroupId, callerDefaultGroupId, rawScope, _pdfBits) {
+function checkSetGroup(entity, newGroupId, callerDefaultGroupId, rawScope) {
 	if (newGroupId === callerDefaultGroupId) return true;
 	const parsed = rawScope.map(parseScope);
 	if (parsed.some((s) => s.kind === "wildcard")) return true;
 	for (const s of parsed) {
 		if (s.kind !== "collab") continue;
-		if (s.entity !== "annotations") continue;
+		if (s.entity !== entity) continue;
 		if (s.action !== "set-group" && s.action !== "*") continue;
 		if (s.filter.kind === "all") return true;
 		if (s.filter.kind === "group" && s.filter.groupId === newGroupId) return true;
 	}
 	return false;
 }
+/**
+* True iff the scope lets the caller `action` (fill in, or sign) a form
+* field in `groupId` (`null` for a field in no group).
+*
+* Narrowing, per action, as for annotations:
+*   1. wildcard `*` → allow;
+*   2. if any `fields:<action>` scope exists (or `fields:*`) → only those
+*      decide: the field must match one of their filters, even when the
+*      broad capability is also present. A field in no group then matches
+*      only `:all`;
+*   3. otherwise the broad capability decides, for every field:
+*      `doc.forms.fill` to fill, `doc.sign` to sign.
+*
+* Nothing here narrows form design (`doc.forms.modify`).
+*/
+function checkFieldAction(action, groupId, rawScope, pdfBits, protection = null) {
+	const broad = action === "fill" ? "doc.forms.fill" : "doc.sign";
+	if (protectedCapabilities(protection).has(broad)) return false;
+	const parsed = rawScope.map(parseScope);
+	if (parsed.some((s) => s.kind === "wildcard")) return true;
+	const applicable = parsed.filter((s) => s.kind === "collab" && s.entity === "fields" && (s.action === action || s.action === "*"));
+	if (applicable.length > 0) return applicable.some((s) => s.filter.kind === "all" || groupId !== null && s.filter.groupId === groupId);
+	return expandedCapabilities(parsed, pdfBits, protection).has(broad);
+}
+/**
+* {@link checkFieldAction} and {@link checkSetGroup} as lists: for each
+* action, every field or the groups the scope names, so a designer can
+* offer exactly the groups a field may go in, and a filler see whose fields
+* are theirs. The same rules, read the other way round.
+*/
+function fieldRightsOf(rawScope, pdfBits, protection, callerDefaultGroupId) {
+	const parsed = rawScope.map(parseScope);
+	const wildcard = parsed.some((s) => s.kind === "wildcard");
+	const fieldScopes = (action) => parsed.filter((s) => s.kind === "collab" && s.entity === "fields" && (s.action === action || s.action === "*"));
+	const fromScopes = (scopes, extra = []) => {
+		if (scopes.some((s) => s.filter.kind === "all")) return { all: true };
+		const groups = scopes.flatMap((s) => s.filter.kind === "group" ? [s.filter.groupId] : []);
+		return {
+			all: false,
+			groups: [.../* @__PURE__ */ new Set([...groups, ...extra])]
+		};
+	};
+	const NONE = {
+		all: false,
+		groups: []
+	};
+	const writing = (action) => {
+		const broad = action === "fill" ? "doc.forms.fill" : "doc.sign";
+		if (protectedCapabilities(protection).has(broad)) return NONE;
+		if (wildcard) return { all: true };
+		const scopes = fieldScopes(action);
+		if (scopes.length > 0) return fromScopes(scopes);
+		return expandedCapabilities(parsed, pdfBits, protection).has(broad) ? { all: true } : NONE;
+	};
+	const own = callerDefaultGroupId !== void 0 ? [callerDefaultGroupId] : [];
+	return {
+		fill: writing("fill"),
+		sign: writing("sign"),
+		setGroup: wildcard ? { all: true } : fromScopes(fieldScopes("set-group"), own)
+	};
+}
+/**
+* Whether the scope lets the caller `action` some form field: the broad
+* capability, or any `fields:<action>` scope. What a form verb checks
+* before its fields are known; each field is checked in the write.
+*/
+function checkAnyFieldAction(action, rawScope, pdfBits, protection = null) {
+	const broad = action === "fill" ? "doc.forms.fill" : "doc.sign";
+	if (protectedCapabilities(protection).has(broad)) return false;
+	const parsed = rawScope.map(parseScope);
+	if (parsed.some((s) => s.kind === "wildcard")) return true;
+	if (parsed.some((s) => s.kind === "collab" && s.entity === "fields" && (s.action === action || s.action === "*"))) return true;
+	return expandedCapabilities(parsed, pdfBits, protection).has(broad);
+}
+/**
+* Test a single collab filter against a target record. Every filter but
+* `self` compares one fact on the record with the value the scope names:
+*
+*   all              → always matches
+*   self             → matches if identity.userId === target.userId
+*   createdBy=<X>    → matches if target.userId === X
+*   group=<X>        → matches if target.groupId === X
+*/
 function filterMatches(filter, target, id) {
 	switch (filter.kind) {
 		case "all": return true;
-		case "self": return !!id.user_id && target.userId === id.user_id;
+		case "self": return !!id.userId && target.userId === id.userId;
 		case "createdBy": return target.userId === filter.userId;
-		case "group": return target.groupId === filter.groupId && (id.groups?.includes(filter.groupId) ?? false);
+		case "group": return target.groupId === filter.groupId;
 	}
 }
 /**
 * Translate `pdf.permissions` (virtual scope) into the concrete
-* capabilities it represents under the current PDF bit configuration.
-*
-* Always adds `doc.open` and `doc.render` — these are cloud-only
-* capabilities with no PDF bit, but `pdf.permissions` is meant to be
-* the "give the user a working session" shorthand. Without them, a
-* token with just `['pdf.permissions']` would be useless.
-*
-* Reads are unconditional: ISO 32000 / Acrobat let any reader see
-* existing annotations and form values regardless of permission bits.
-* Bit 6 governs *writing*, not visibility.
-*
-* Bit-derived expansions follow ISO 32000:
-*   bit 5   → doc.text.{select, copy, search}, doc.content.copy
-*   bit 3   → doc.print
-*   bit 12  → doc.print.high (requires bit 3 also set)
-*   bit 4   → doc.pages.modify, doc.redact, doc.metadata.modify, doc.attachments.modify
-*   bit 11  → doc.pages.assemble
-*   bit 6   → doc.annotate.modify
-*   bit 6/9 → doc.forms.fill
-*   bit 6+4 → doc.forms.modify
-*
-* Note: this same expansion lives in builders.ts as
-* `materializePdfPermissions` for SDK-side use. The two MUST stay in
-* sync; a test in resolver.test.ts pins them together.
+* capabilities it represents under the current PDF bit configuration:
+* {@link materializePdfPermissions}, the one reading of the bits.
 */
 function addPdfPermissions(out, b) {
-	out.add("doc.open");
-	out.add("doc.render");
-	out.add("doc.annotate.read");
-	out.add("doc.forms.read");
-	if (b.bit5) {
-		out.add("doc.text.select");
-		out.add("doc.text.copy");
-		out.add("doc.text.search");
-		out.add("doc.content.copy");
-	}
-	if (b.bit3) out.add("doc.print");
-	if (b.bit12 && b.bit3) out.add("doc.print.high");
-	if (b.bit4) {
-		out.add("doc.pages.modify");
-		out.add("doc.redact");
-		out.add("doc.metadata.modify");
-		out.add("doc.attachments.modify");
-	}
-	if (b.bit11) out.add("doc.pages.assemble");
-	if (b.bit6) out.add("doc.annotate.modify");
-	if (b.bit6 || b.bit9) {
-		out.add("doc.forms.fill");
-		out.add("doc.sign");
-	}
-	if (b.bit6 && b.bit4) out.add("doc.forms.modify");
+	for (const capability of materializePdfPermissions(b)) out.add(capability);
 }
 //#endregion
-export { protectedCapabilities as S, levelAllows as _, expandRawScope as a, lockNameCovers as b, parseScope as c, MissingIdentity as d, PermissionDenied as f, fieldLockFor as g, deriveProtection as h, checkSetGroup as i, validateScopeArray as l, SIGNATURE_POLICY_VERSION as m, checkCapability as n, expandedCapabilities as o, APPROVAL_BASELINE as p, checkCollab as r, filterMatches as s, checkAnyCapability as t, InvalidScope as u, levelFromPermission as v, minLevel as x, lockCovers as y };
+export { MissingIdentity as A, lockCovers as C, decodeAnnotKey as D, protectedCapabilities as E, encodeAnnotKey as O, levelFromPermission as S, minLevel as T, deriveProtection as _, checkFieldAction as a, isProtectableCapability as b, expandRawScope as c, filterMatches as d, parseScope as f, SIGNATURE_POLICY_VERSION as g, PROTECTABLE_CAPABILITIES as h, checkCollab as i, PermissionDenied as j, InvalidScope as k, expandedCapabilities as l, APPROVAL_BASELINE as m, checkAnyFieldAction as n, checkSetGroup as o, validateScopeArray as p, checkCapability as r, collabTargetOf as s, checkAnyCapability as t, fieldRightsOf as u, describeProtection as v, lockNameCovers as w, levelAllows as x, fieldLockFor as y };
 
-//# sourceMappingURL=resolver-inAVzsWt.js.map
+//# sourceMappingURL=resolver-BBggAxQc.js.map