@embedpdf/engine-core 3.0.0-next.14 → 3.0.0-next.16

package/dist/{resolver-CYVNV4hn.cjs → resolver-BWSWSF6R.cjs}

@@ -1,8 +1,115 @@
+const require_format = require("./format-Bp3QFSH1.cjs");
+const require_builders = require("./builders-DgTAj_tP.cjs");
+//#region src/auth/scope/errors.ts
+/**
+* Thrown by {@link parseScope} / {@link validateScopeArray} when a scope
+* string does not match any known grammar (capability, collab, virtual,
+* or wildcard). An `EngineError` with code `InvalidArg`.
+*
+* Carries the offending scope verbatim so route/JWT-layer error
+* handlers can echo it to the customer.
+*/
+var InvalidScope = class extends require_format.EngineError {
+	constructor(scope, reason) {
+		super(require_format.EngineErrorCode.InvalidArg, `invalid scope "${scope}": ${reason}`, { details: {
+			scope,
+			reason
+		} });
+		this.scope = scope;
+		require_format._defineProperty(this, "name", "InvalidScope");
+	}
+};
+/**
+* Thrown by route guards and engine-local enforcement when a capability
+* or collab action is denied for the current request/handle. An
+* `EngineError` with code `Forbidden`, on both engines.
+*
+* `required` (also `details.required`) names what the caller needed (e.g.
+* "doc.render" or "annotations:update"). When any of several would have
+* done, `anyOf` (also `details.anyOf`) lists them and `required` is the
+* first. `context` is an optional label such as "engine-local" or a route.
+*/
+var PermissionDenied = class extends require_format.EngineError {
+	constructor(required, context, anyOf, refs) {
+		super(require_format.EngineErrorCode.Forbidden, `permission denied${context ? ` (${context})` : ""}: ${anyOf ? `one of ${anyOf.join(", ")}` : required}${refs ? ` for ${refs.length} annotation${refs.length === 1 ? "" : "s"}` : ""}`, { details: {
+			required,
+			...context === void 0 ? {} : { context },
+			...anyOf === void 0 ? {} : { anyOf: [...anyOf] },
+			...refs === void 0 ? {} : { refs: [...refs] }
+		} });
+		this.required = required;
+		this.context = context;
+		this.anyOf = anyOf;
+		this.refs = refs;
+		require_format._defineProperty(this, "name", "PermissionDenied");
+	}
+};
+/**
+* Thrown at engine-local open time when the supplied scope includes
+* collab filters (`:self`, `:group=...`) but the identity claims needed
+* to resolve them are missing. Fails loudly at open so the configuration
+* mistake is visible immediately instead of producing silent denies at
+* every annotation mutation. An `EngineError` with code `InvalidArg`.
+*/
+var MissingIdentity = class extends require_format.EngineError {
+	constructor(scope) {
+		super(require_format.EngineErrorCode.InvalidArg, `scope "${scope}" requires an identity (userId and/or groups)`, { details: { scope } });
+		this.scope = scope;
+		require_format._defineProperty(this, "name", "MissingIdentity");
+	}
+};
+//#endregion
+//#region src/identity/AnnotationRef.ts
+/**
+* URL-safe encoding of a ref without its page, used by the cloud HTTP
+* surface as the `:annotKey` route parameter beside `:pageKey`
+* (`encodePageKey`). Decoded by `decodeAnnotKey`.
+*
+*   `{ kind: 'objectNumber', objectNumber: 42 }` -> `'obj:42'`
+*   `{ kind: 'baseIndex', baseIndex: 2 }`        -> `'base:2'`
+*/
+function encodeAnnotKey(ref) {
+	if (ref.kind === "objectNumber") {
+		if (!Number.isInteger(ref.objectNumber) || ref.objectNumber <= 0) throw new RangeError(`encodeAnnotKey: objectNumber must be a positive integer, got ${ref.objectNumber}`);
+		return `obj:${ref.objectNumber}`;
+	}
+	if (!Number.isInteger(ref.baseIndex) || ref.baseIndex < 0) throw new RangeError(`encodeAnnotKey: baseIndex must be a non-negative integer, got ${ref.baseIndex}`);
+	return `base:${ref.baseIndex}`;
+}
+/**
+* Inverse of `encodeAnnotKey`, on the page the route names. Returns `null`
+* for malformed input so the server can answer 400 InvalidArg with a useful
+* message instead of throwing. The input is the already-`decodeURIComponent`-ed
+* segment from the route path.
+*/
+function decodeAnnotKey(page, key) {
+	const number = (prefix, min) => {
+		if (!key.startsWith(prefix)) return null;
+		const rest = key.slice(prefix.length);
+		const n = Number.parseInt(rest, 10);
+		return Number.isInteger(n) && n >= min && String(n) === rest ? n : null;
+	};
+	const objectNumber = number("obj:", 1);
+	if (objectNumber !== null) return {
+		kind: "objectNumber",
+		page,
+		objectNumber
+	};
+	const baseIndex = number("base:", 0);
+	if (baseIndex !== null) return {
+		kind: "baseIndex",
+		page,
+		baseIndex
+	};
+	return null;
+}
+//#endregion
 //#region src/signature/protection.ts
 /**
 * Bumped whenever the derivation below (or a judgement rule) changes meaning.
 * Rides every protection and every analysis, and keys the cloud's immutable
-* analysis URLs. v4 (the `signature-compat` corpus, 91 Acrobat observations):
+* analysis URLs. The current policy is calibrated on the 91 Acrobat
+* observations in `packages/engine/main/test/fixtures/signature-compat`:
 * each signature is judged on the net state of the document against the
 * revision it sealed; an object written again with the sealed value is not
 * a modification; an approval signature permits commenting; field
@@ -15,8 +122,8 @@ const SIGNATURE_POLICY_VERSION = 4;
 * changes only for certification signatures; Acrobat reads an approval
 * signature as "Form Fill-in, Signing and Commenting are allowed" (its own
 * permission text under every such signature) and keeps it valid through a
-* Square annotation added, deleted or recoloured afterwards (corpus
-* `signature-compat` v3 cases 88, 90, 91: "Annotations Created/Deleted/
+* Square annotation added, deleted or recoloured afterwards (fixtures
+* `signature-compat/v3/88`, `/90` and `/91`: "Annotations Created/Deleted/
 * Modified", signature valid). pyHanko judges stricter (fill only); Acrobat
 * is the validator recipients use, so the baseline is `annotate`.
 */
@@ -64,7 +171,7 @@ function lockCovers(spec, fieldName) {
 *              did allow annotations.
 *   fieldLocks = every signed signature's FieldMDP and the /Lock of every
 *              signed field. Unsigned fields' /Lock entries describe a
-*              FUTURE signature and lock nothing yet.
+*              future signature and lock nothing yet.
 */
 function deriveProtection(signatures) {
 	let signed = false;
@@ -109,15 +216,38 @@ function fieldLockFor(protection, fieldName) {
 	return null;
 }
 /**
+* Every capability a protection can remove: the most it ever takes away.
+* A check of any other capability never needs the document's protection.
+*/
+const PROTECTABLE_CAPABILITIES = [
+	"doc.download.flattened",
+	"doc.pages.modify",
+	"doc.pages.assemble",
+	"doc.redact",
+	"doc.attachments.modify",
+	"doc.outline.modify",
+	"doc.forms.modify",
+	"doc.forms.script",
+	"doc.annotate.modify",
+	"doc.annotate.import",
+	"doc.forms.fill",
+	"doc.forms.import"
+];
+const PROTECTABLE = new Set(PROTECTABLE_CAPABILITIES);
+/** Whether a protection can ever remove `capability`. */
+function isProtectableCapability(capability) {
+	return PROTECTABLE.has(capability);
+}
+/**
 * The capabilities a protection removes from every caller, admin scope
 * included — document-derived authority, exactly like encryption bits.
 *
-* Only what was DECLARED is refused: a refusal is a promise a signer made,
+* Only what was declared is refused: a refusal is a promise a signer made,
 * never a guess about a validator. A certification (or a lock with /P)
 * declares what may follow, and everything outside that — page edits,
-* redaction, field authoring, attachments, and below P=3 annotations, below
+* redaction, field authoring, attachments, the outline, and below P=3 annotations, below
 * P=2 form fill — is refused. A plain approval signature declares nothing:
-* the same edits stay possible and are then JUDGED, the verdict saying the
+* the same edits stay possible and are then judged, the verdict saying the
 * signature no longer holds, exactly as Acrobat does. The one exception is a
 * rewrite: it does not invalidate signatures, it erases them, so any signed
 * document refuses it. Per-field locks are enforced by the form mutator.
@@ -131,63 +261,29 @@ function protectedCapabilities(protection) {
 	out.add("doc.pages.assemble");
 	out.add("doc.redact");
 	out.add("doc.attachments.modify");
+	out.add("doc.outline.modify");
 	out.add("doc.forms.modify");
-	if (!levelAllows(protection.enforced, "annotate")) out.add("doc.annotate.modify");
-	if (!levelAllows(protection.enforced, "fill")) out.add("doc.forms.fill");
-	return out;
-}
-//#endregion
-//#region src/auth/scope/errors.ts
-/**
-* Thrown by {@link parseScope} / {@link validateScopeArray} when a scope
-* string does not match any known grammar (capability, collab, virtual,
-* or wildcard).
-*
-* Carries the offending scope verbatim so route/JWT-layer error
-* handlers can echo it to the customer.
-*/
-var InvalidScope = class extends Error {
-	constructor(scope, reason) {
-		super(`invalid scope "${scope}": ${reason}`);
-		this.scope = scope;
-		this.name = "InvalidScope";
+	out.add("doc.forms.script");
+	if (!levelAllows(protection.enforced, "annotate")) {
+		out.add("doc.annotate.modify");
+		out.add("doc.annotate.import");
 	}
-};
-/**
-* Thrown by route guards and engine-local enforcement when a capability
-* or collab action is denied for the current request/handle.
-*
-* `required` names what the caller needed (e.g., "doc.render" or
-* "annotations:update"). `context` is an optional label such as "local"
-* or "/v1/docs/.../pages/2/render".
-*/
-var PermissionDenied = class extends Error {
-	constructor(required, context) {
-		super(`permission denied${context ? ` (${context})` : ""}: ${required}`);
-		this.required = required;
-		this.context = context;
-		this.name = "PermissionDenied";
-	}
-};
-/**
-* Thrown at engine-local open time when the supplied scope includes
-* collab filters (`:self`, `:group=...`) but the identity claims needed
-* to resolve them are missing. Fails loudly at open so the configuration
-* mistake is visible immediately instead of producing silent denies at
-* every annotation mutation.
-*/
-var MissingIdentity = class extends Error {
-	constructor(scope) {
-		super(`scope "${scope}" requires identity claims (user_id and/or groups)`);
-		this.name = "MissingIdentity";
+	if (!levelAllows(protection.enforced, "fill")) {
+		out.add("doc.forms.fill");
+		out.add("doc.forms.import");
 	}
-};
+	return out;
+}
+/** Why `protection` refuses `capability`: the message of a `ProtectedDocument` refusal. */
+function describeProtection(capability, protection) {
+	return `the document is signed: ${protection.certification ? `certification signature ${protection.certification.signatureIndex} (permission ${protection.certification.permission})` : `an existing signature (declared level '${protection.enforced ?? "none declared"}')`} forbids '${capability}'`;
+}
 //#endregion
 //#region src/auth/scope/parser.ts
 /**
 * Closed set of recognized capability strings. Membership is the
 * authoritative source of truth — adding a new capability requires
-* extending the `DocCapability` union AND adding it here. The parser
+* extending the `DocCapability` union and adding it here. The parser
 * rejects anything outside this set.
 *
 * Removed legacy names (e.g., `doc.read`, `doc.edit-pages`, `doc.save`)
@@ -210,11 +306,15 @@ const KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
 	"doc.forms.read",
 	"doc.forms.fill",
 	"doc.forms.modify",
+	"doc.forms.import",
+	"doc.forms.script",
 	"doc.forms.submit",
 	"doc.annotate.read",
 	"doc.annotate.modify",
+	"doc.annotate.import",
 	"doc.metadata.modify",
 	"doc.attachments.modify",
+	"doc.outline.modify",
 	"doc.redact",
 	"doc.sign",
 	"doc.sign.certify"
@@ -257,6 +357,7 @@ function parseCollab(raw) {
 	const entity = raw.slice(0, idx1);
 	const action = raw.slice(idx1 + 1, idx2);
 	const filterStr = raw.slice(idx2 + 1);
+	if (entity === "fields") return parseFieldScope(raw, action, filterStr);
 	if (entity !== "annotations") throw new InvalidScope(raw, `unknown collab entity: ${entity}`);
 	if (action !== "create" && action !== "update" && action !== "delete" && action !== "set-group" && action !== "*") throw new InvalidScope(raw, `unknown collab action: ${action}`);
 	const filter = parseFilter(filterStr, raw);
@@ -268,6 +369,22 @@ function parseCollab(raw) {
 		filter
 	};
 }
+/**
+* `fields:<fill|sign|set-group|*>:<all|group=NAME>`. A field's group is who
+* fills it, and a field records no creator, so `self` and `createdBy=` are
+* refused.
+*/
+function parseFieldScope(raw, action, filterStr) {
+	if (action !== "fill" && action !== "sign" && action !== "set-group" && action !== "*") throw new InvalidScope(raw, `unknown fields action: ${action}`);
+	const filter = parseFilter(filterStr, raw);
+	if (filter.kind !== "all" && filter.kind !== "group") throw new InvalidScope(raw, `fields only support :all or :group=<id> filters (got :${filter.kind})`);
+	return {
+		kind: "collab",
+		entity: "fields",
+		action,
+		filter
+	};
+}
 function parseFilter(s, raw) {
 	if (s === "all") return { kind: "all" };
 	if (s === "self") return { kind: "self" };
@@ -300,6 +417,13 @@ function parseCapability(raw) {
 }
 //#endregion
 //#region src/auth/scope/resolver.ts
+/** The collab target of a record read with nullable owner fields (an annotation). */
+function collabTargetOf(owner) {
+	return {
+		...owner.userId ? { userId: owner.userId } : {},
+		...owner.groupId ? { groupId: owner.groupId } : {}
+	};
+}
 /**
 * True iff the given capability is granted by the scope array plus the
 * PDF bits visible via `pdf.permissions` expansion.
@@ -314,9 +438,9 @@ function checkCapability(capability, rawScope, pdfBits, protection = null) {
 	return expandedCapabilities(parsed, pdfBits, protection).has(capability);
 }
 /**
-* True iff the scope grants AT LEAST ONE of `capabilities`. Convenience
-* for routes like `/text` (`doc.text.copy` OR `doc.text.search`) and
-* `/geometry` (`doc.text.select` OR `doc.text.search`).
+* True iff the scope grants at least one of `capabilities`. Convenience
+* for routes like `/text` (`doc.text.copy` or `doc.text.search`) and
+* `/geometry` (`doc.text.select` or `doc.text.search`).
 */
 function checkAnyCapability(capabilities, rawScope, pdfBits, protection = null) {
 	return capabilities.some((c) => checkCapability(c, rawScope, pdfBits, protection));
@@ -326,7 +450,7 @@ function checkAnyCapability(capabilities, rawScope, pdfBits, protection = null)
 *
 * Narrowing model. For each action independently:
 *   1. wildcard `*` → allow (global escape hatch)
-*   2. if any collab scope applies to this action → NARROW: only those
+*   2. if any collab scope applies to this action → narrow: only those
 *      collab filters decide. If none match the target, deny — even if
 *      `doc.annotate.modify` is also present. This is what makes
 *      `[modify, update:self]` correctly mean "edit own only" rather
@@ -337,7 +461,7 @@ function checkAnyCapability(capabilities, rawScope, pdfBits, protection = null)
 *   4. otherwise → deny.
 *
 * For create: `target` should be built by the caller from JWT identity
-* (`{ userId: caller.user_id, groupId: caller.group_id }`). `:self` and
+* (`{ userId: caller.userId, groupId: caller.groupId }`). `:self` and
 * `:all` then trivially pass; `:group=X` is the meaningful filter (only
 * matches when the caller's default group is X).
 *
@@ -362,17 +486,22 @@ function checkCollab(action, target, rawScope, identity, pdfBits) {
 *   - any annotation collab scope implies `doc.annotate.read`, because
 *     mutation routes need to see the target row to evaluate the
 *     collab filter against its current owner.
+*   - any field collab scope implies `doc.forms.read`: filling in or
+*     signing a field means seeing the form. Groups limit writes, never
+*     reads.
 *
-* Does NOT short-circuit on wildcard — callers do that themselves
+* Does not short-circuit on wildcard — callers do that themselves
 * before calling this. Returning the expanded set is useful for the
 * `/access` response's `effectiveScope` and for advisory UI surfacing.
 */
 function expandedCapabilities(parsed, pdfBits, protection = null) {
 	const out = /* @__PURE__ */ new Set();
 	let hasAnnotationCollab = false;
+	let hasFieldCollab = false;
 	for (const s of parsed) if (s.kind === "capability") out.add(s.name);
 	else if (s.kind === "virtual" && s.name === "pdf.permissions") addPdfPermissions(out, pdfBits);
 	else if (s.kind === "collab" && s.entity === "annotations") hasAnnotationCollab = true;
+	else if (s.kind === "collab" && s.entity === "fields") hasFieldCollab = true;
 	if (out.has("doc.annotate.modify")) out.add("doc.annotate.read");
 	if (out.has("doc.forms.modify")) {
 		out.add("doc.forms.fill");
@@ -380,6 +509,7 @@ function expandedCapabilities(parsed, pdfBits, protection = null) {
 	}
 	if (out.has("doc.forms.fill")) out.add("doc.forms.read");
 	if (hasAnnotationCollab) out.add("doc.annotate.read");
+	if (hasFieldCollab) out.add("doc.forms.read");
 	for (const removed of protectedCapabilities(protection)) out.delete(removed);
 	return out;
 }
@@ -392,117 +522,140 @@ function expandRawScope(rawScope, pdfBits, protection = null) {
 	return expandedCapabilities(rawScope.map(parseScope), pdfBits, protection);
 }
 /**
-* Test a single collab filter against a target record + the caller's
-* identity. Pure function — no side effects, no implicit rules.
+* Authority to put a record of `entity` in a specific group: an annotation,
+* or a form field.
 *
-*   all              → always matches
-*   self             → matches if identity.user_id === target.userId
-*   createdBy=<X>    → matches if target.userId === X
-*   group=<X>        → matches if target.groupId === X
-*                      AND identity.groups includes X
-*
-* The group-membership check on `group=X` prevents a token from
-* matching annotations in a group it doesn't belong to, even if the
-* target row carries that groupId.
-*/
-/**
-* Authority to assign a specific groupId to an annotation.
-*
-* Set-group is decoupled from `doc.annotate.modify`. The reasoning:
-* capabilities like `modify` describe row access — what kind of write
-* you can do to which existing rows — and map to PDF permission bits.
-* Set-group is a cloud-only *assignment authority*: which destination
-* group can you put an annotation into? There is no PDF-bit
-* counterpart, so it doesn't inherit from `modify`.
+* Set-group is decoupled from the write capabilities (`doc.annotate.modify`,
+* `doc.forms.modify`). The reasoning: those describe row access — what kind
+* of write you can do to which existing rows — and map to PDF permission
+* bits. Set-group is a cloud-only *assignment authority*: which destination
+* group can you put a record into? There is no PDF-bit counterpart, so it
+* doesn't inherit from them.
 *
 * Resolution order:
 *   1. newGroupId === callerDefaultGroupId → true (no real reassignment
-*      is happening; the annotation gets the caller's default group)
+*      is happening; the record gets the caller's default group)
 *   2. wildcard `*` → true (global escape hatch)
-*   3. `annotations:set-group:all` → true
-*   4. `annotations:set-group:group=<newGroupId>` → true
-*   5. `annotations:*:all` or `annotations:*:group=<newGroupId>` → true
+*   3. `<entity>:set-group:all` → true
+*   4. `<entity>:set-group:group=<newGroupId>` → true
+*   5. `<entity>:*:all` or `<entity>:*:group=<newGroupId>` → true
 *      (action wildcard includes set-group)
 *   6. otherwise → false
 *
-* Note: independent from membership. A user with
-* `set-group:group=legal` can assign annotations to the legal group
-* even if they're not a member — that's the whole point.
+* A user with `set-group:group=legal` can put records in the legal group
+* whatever their own group is — that's the whole point.
 */
-function checkSetGroup(newGroupId, callerDefaultGroupId, rawScope, _pdfBits) {
+function checkSetGroup(entity, newGroupId, callerDefaultGroupId, rawScope) {
 	if (newGroupId === callerDefaultGroupId) return true;
 	const parsed = rawScope.map(parseScope);
 	if (parsed.some((s) => s.kind === "wildcard")) return true;
 	for (const s of parsed) {
 		if (s.kind !== "collab") continue;
-		if (s.entity !== "annotations") continue;
+		if (s.entity !== entity) continue;
 		if (s.action !== "set-group" && s.action !== "*") continue;
 		if (s.filter.kind === "all") return true;
 		if (s.filter.kind === "group" && s.filter.groupId === newGroupId) return true;
 	}
 	return false;
 }
+/**
+* True iff the scope lets the caller `action` (fill in, or sign) a form
+* field in `groupId` (`null` for a field in no group).
+*
+* Narrowing, per action, as for annotations:
+*   1. wildcard `*` → allow;
+*   2. if any `fields:<action>` scope exists (or `fields:*`) → only those
+*      decide: the field must match one of their filters, even when the
+*      broad capability is also present. A field in no group then matches
+*      only `:all`;
+*   3. otherwise the broad capability decides, for every field:
+*      `doc.forms.fill` to fill, `doc.sign` to sign.
+*
+* Nothing here narrows form design (`doc.forms.modify`).
+*/
+function checkFieldAction(action, groupId, rawScope, pdfBits, protection = null) {
+	const broad = action === "fill" ? "doc.forms.fill" : "doc.sign";
+	if (protectedCapabilities(protection).has(broad)) return false;
+	const parsed = rawScope.map(parseScope);
+	if (parsed.some((s) => s.kind === "wildcard")) return true;
+	const applicable = parsed.filter((s) => s.kind === "collab" && s.entity === "fields" && (s.action === action || s.action === "*"));
+	if (applicable.length > 0) return applicable.some((s) => s.filter.kind === "all" || groupId !== null && s.filter.groupId === groupId);
+	return expandedCapabilities(parsed, pdfBits, protection).has(broad);
+}
+/**
+* {@link checkFieldAction} and {@link checkSetGroup} as lists: for each
+* action, every field or the groups the scope names, so a designer can
+* offer exactly the groups a field may go in, and a filler see whose fields
+* are theirs. The same rules, read the other way round.
+*/
+function fieldRightsOf(rawScope, pdfBits, protection, callerDefaultGroupId) {
+	const parsed = rawScope.map(parseScope);
+	const wildcard = parsed.some((s) => s.kind === "wildcard");
+	const fieldScopes = (action) => parsed.filter((s) => s.kind === "collab" && s.entity === "fields" && (s.action === action || s.action === "*"));
+	const fromScopes = (scopes, extra = []) => {
+		if (scopes.some((s) => s.filter.kind === "all")) return { all: true };
+		const groups = scopes.flatMap((s) => s.filter.kind === "group" ? [s.filter.groupId] : []);
+		return {
+			all: false,
+			groups: [.../* @__PURE__ */ new Set([...groups, ...extra])]
+		};
+	};
+	const NONE = {
+		all: false,
+		groups: []
+	};
+	const writing = (action) => {
+		const broad = action === "fill" ? "doc.forms.fill" : "doc.sign";
+		if (protectedCapabilities(protection).has(broad)) return NONE;
+		if (wildcard) return { all: true };
+		const scopes = fieldScopes(action);
+		if (scopes.length > 0) return fromScopes(scopes);
+		return expandedCapabilities(parsed, pdfBits, protection).has(broad) ? { all: true } : NONE;
+	};
+	const own = callerDefaultGroupId !== void 0 ? [callerDefaultGroupId] : [];
+	return {
+		fill: writing("fill"),
+		sign: writing("sign"),
+		setGroup: wildcard ? { all: true } : fromScopes(fieldScopes("set-group"), own)
+	};
+}
+/**
+* Whether the scope lets the caller `action` some form field: the broad
+* capability, or any `fields:<action>` scope. What a form verb checks
+* before its fields are known; each field is checked in the write.
+*/
+function checkAnyFieldAction(action, rawScope, pdfBits, protection = null) {
+	const broad = action === "fill" ? "doc.forms.fill" : "doc.sign";
+	if (protectedCapabilities(protection).has(broad)) return false;
+	const parsed = rawScope.map(parseScope);
+	if (parsed.some((s) => s.kind === "wildcard")) return true;
+	if (parsed.some((s) => s.kind === "collab" && s.entity === "fields" && (s.action === action || s.action === "*"))) return true;
+	return expandedCapabilities(parsed, pdfBits, protection).has(broad);
+}
+/**
+* Test a single collab filter against a target record. Every filter but
+* `self` compares one fact on the record with the value the scope names:
+*
+*   all              → always matches
+*   self             → matches if identity.userId === target.userId
+*   createdBy=<X>    → matches if target.userId === X
+*   group=<X>        → matches if target.groupId === X
+*/
 function filterMatches(filter, target, id) {
 	switch (filter.kind) {
 		case "all": return true;
-		case "self": return !!id.user_id && target.userId === id.user_id;
+		case "self": return !!id.userId && target.userId === id.userId;
 		case "createdBy": return target.userId === filter.userId;
-		case "group": return target.groupId === filter.groupId && (id.groups?.includes(filter.groupId) ?? false);
+		case "group": return target.groupId === filter.groupId;
 	}
 }
 /**
 * Translate `pdf.permissions` (virtual scope) into the concrete
-* capabilities it represents under the current PDF bit configuration.
-*
-* Always adds `doc.open` and `doc.render` — these are cloud-only
-* capabilities with no PDF bit, but `pdf.permissions` is meant to be
-* the "give the user a working session" shorthand. Without them, a
-* token with just `['pdf.permissions']` would be useless.
-*
-* Reads are unconditional: ISO 32000 / Acrobat let any reader see
-* existing annotations and form values regardless of permission bits.
-* Bit 6 governs *writing*, not visibility.
-*
-* Bit-derived expansions follow ISO 32000:
-*   bit 5   → doc.text.{select, copy, search}, doc.content.copy
-*   bit 3   → doc.print
-*   bit 12  → doc.print.high (requires bit 3 also set)
-*   bit 4   → doc.pages.modify, doc.redact, doc.metadata.modify, doc.attachments.modify
-*   bit 11  → doc.pages.assemble
-*   bit 6   → doc.annotate.modify
-*   bit 6/9 → doc.forms.fill
-*   bit 6+4 → doc.forms.modify
-*
-* Note: this same expansion lives in builders.ts as
-* `materializePdfPermissions` for SDK-side use. The two MUST stay in
-* sync; a test in resolver.test.ts pins them together.
+* capabilities it represents under the current PDF bit configuration:
+* {@link materializePdfPermissions}, the one reading of the bits.
 */
 function addPdfPermissions(out, b) {
-	out.add("doc.open");
-	out.add("doc.render");
-	out.add("doc.annotate.read");
-	out.add("doc.forms.read");
-	if (b.bit5) {
-		out.add("doc.text.select");
-		out.add("doc.text.copy");
-		out.add("doc.text.search");
-		out.add("doc.content.copy");
-	}
-	if (b.bit3) out.add("doc.print");
-	if (b.bit12 && b.bit3) out.add("doc.print.high");
-	if (b.bit4) {
-		out.add("doc.pages.modify");
-		out.add("doc.redact");
-		out.add("doc.metadata.modify");
-		out.add("doc.attachments.modify");
-	}
-	if (b.bit11) out.add("doc.pages.assemble");
-	if (b.bit6) out.add("doc.annotate.modify");
-	if (b.bit6 || b.bit9) {
-		out.add("doc.forms.fill");
-		out.add("doc.sign");
-	}
-	if (b.bit6 && b.bit4) out.add("doc.forms.modify");
+	for (const capability of require_builders.materializePdfPermissions(b)) out.add(capability);
 }
 //#endregion
 Object.defineProperty(exports, "APPROVAL_BASELINE", {
@@ -523,6 +676,12 @@ Object.defineProperty(exports, "MissingIdentity", {
 		return MissingIdentity;
 	}
 });
+Object.defineProperty(exports, "PROTECTABLE_CAPABILITIES", {
+	enumerable: true,
+	get: function() {
+		return PROTECTABLE_CAPABILITIES;
+	}
+});
 Object.defineProperty(exports, "PermissionDenied", {
 	enumerable: true,
 	get: function() {
@@ -541,6 +700,12 @@ Object.defineProperty(exports, "checkAnyCapability", {
 		return checkAnyCapability;
 	}
 });
+Object.defineProperty(exports, "checkAnyFieldAction", {
+	enumerable: true,
+	get: function() {
+		return checkAnyFieldAction;
+	}
+});
 Object.defineProperty(exports, "checkCapability", {
 	enumerable: true,
 	get: function() {
@@ -553,18 +718,48 @@ Object.defineProperty(exports, "checkCollab", {
 		return checkCollab;
 	}
 });
+Object.defineProperty(exports, "checkFieldAction", {
+	enumerable: true,
+	get: function() {
+		return checkFieldAction;
+	}
+});
 Object.defineProperty(exports, "checkSetGroup", {
 	enumerable: true,
 	get: function() {
 		return checkSetGroup;
 	}
 });
+Object.defineProperty(exports, "collabTargetOf", {
+	enumerable: true,
+	get: function() {
+		return collabTargetOf;
+	}
+});
+Object.defineProperty(exports, "decodeAnnotKey", {
+	enumerable: true,
+	get: function() {
+		return decodeAnnotKey;
+	}
+});
 Object.defineProperty(exports, "deriveProtection", {
 	enumerable: true,
 	get: function() {
 		return deriveProtection;
 	}
 });
+Object.defineProperty(exports, "describeProtection", {
+	enumerable: true,
+	get: function() {
+		return describeProtection;
+	}
+});
+Object.defineProperty(exports, "encodeAnnotKey", {
+	enumerable: true,
+	get: function() {
+		return encodeAnnotKey;
+	}
+});
 Object.defineProperty(exports, "expandRawScope", {
 	enumerable: true,
 	get: function() {
@@ -583,12 +778,24 @@ Object.defineProperty(exports, "fieldLockFor", {
 		return fieldLockFor;
 	}
 });
+Object.defineProperty(exports, "fieldRightsOf", {
+	enumerable: true,
+	get: function() {
+		return fieldRightsOf;
+	}
+});
 Object.defineProperty(exports, "filterMatches", {
 	enumerable: true,
 	get: function() {
 		return filterMatches;
 	}
 });
+Object.defineProperty(exports, "isProtectableCapability", {
+	enumerable: true,
+	get: function() {
+		return isProtectableCapability;
+	}
+});
 Object.defineProperty(exports, "levelAllows", {
 	enumerable: true,
 	get: function() {
@@ -638,4 +845,4 @@ Object.defineProperty(exports, "validateScopeArray", {
 	}
 });
 
-//# sourceMappingURL=resolver-CYVNV4hn.cjs.map
+//# sourceMappingURL=resolver-BWSWSF6R.cjs.map