@hraness/kb 0.17.1

package/src/pdf/persist.ts

@@ -0,0 +1,314 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+
+import { redactSensitiveText } from "../clip/persist.js";
+import type {
+  PdfCaptureManifest,
+  PdfImageCandidate,
+} from "./model.js";
+import {
+  PDF_CAPTURE_ANNOTATIONS_FILENAME,
+  PDF_CAPTURE_MANIFEST_FILENAME,
+  PDF_CAPTURE_MANIFEST_SCHEMA_VERSION,
+  PDF_CAPTURE_SOURCE_FILENAME,
+} from "./model.js";
+
+function isConfinedChild(root: string, path: string): boolean {
+  const child = relative(root, path);
+  return child !== "" && !isAbsolute(child) && child !== ".." && !child.startsWith(`..${sep}`);
+}
+
+function assertConfinedChild(root: string, path: string, label: string): void {
+  if (!isConfinedChild(root, path)) throw new Error(`${label} escapes the PDF capture root`);
+}
+
+function safeSlug(slug: string): string {
+  if (
+    slug.length === 0
+    || slug.length > 240
+    || [...slug].length > 80
+    || slug !== slug.normalize("NFKC")
+    || !/^[\p{Letter}\p{Number}](?:[\p{Letter}\p{Number}._-]*[\p{Letter}\p{Number}])?$/u.test(slug)
+  ) throw new Error("unsafe PDF capture slug");
+  return slug;
+}
+
+function outputRoot(path: string): string {
+  const absolute = resolve(path);
+  mkdirSync(absolute, { recursive: true, mode: 0o755 });
+  const stats = lstatSync(absolute);
+  if (!stats.isDirectory() && !stats.isSymbolicLink()) {
+    throw new Error("PDF capture output root is not a directory");
+  }
+  const canonical = realpathSync(absolute);
+  if (!lstatSync(canonical).isDirectory()) throw new Error("PDF capture output root is not a directory");
+  if (dirname(canonical) === canonical || canonical === realpathSync(homedir())) {
+    throw new Error("refusing dangerous PDF capture output root");
+  }
+  return canonical;
+}
+
+function extensionForMimeType(mimeType: string): string {
+  switch (mimeType) {
+    case "image/png": return "png";
+    case "image/jpeg": return "jpg";
+    case "image/gif": return "gif";
+    case "image/webp": return "webp";
+    case "image/avif": return "avif";
+    default: throw new Error(`unsupported PDF image MIME type: ${mimeType}`);
+  }
+}
+
+/** Derive a stable, content-addressed path for a retained PDF image. */
+export function pdfImageAssetPath(image: Pick<PdfImageCandidate, "sha256" | "mimeType">): string {
+  if (!/^[0-9a-f]{64}$/u.test(image.sha256)) throw new Error("invalid PDF image sha256");
+  return `assets/${image.sha256}.${extensionForMimeType(image.mimeType)}`;
+}
+
+function hashFile(path: string): string {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+function assertSourceIdentity(path: string, expectedBytes: number, expectedSha256: string, label: string): void {
+  const stats = statSync(path);
+  if (!stats.isFile() || stats.size !== expectedBytes || hashFile(path) !== expectedSha256) {
+    throw new Error(`${label} changed after PDF inspection`);
+  }
+}
+
+function ownedPdfTarget(targetDirectory: string, slug: string): { readonly device: number; readonly inode: number } {
+  const directory = lstatSync(targetDirectory);
+  if (!directory.isDirectory() || directory.isSymbolicLink()) {
+    throw new Error("PDF --force only replaces a regular PDF capture directory");
+  }
+  const manifestPath = join(targetDirectory, PDF_CAPTURE_MANIFEST_FILENAME);
+  const markdownPath = join(targetDirectory, `${safeSlug(slug)}.md`);
+  const sourcePath = join(targetDirectory, PDF_CAPTURE_SOURCE_FILENAME);
+  for (const path of [manifestPath, markdownPath, sourcePath]) {
+    const stats = lstatSync(path);
+    if (!stats.isFile() || stats.isSymbolicLink()) {
+      throw new Error("PDF --force refused a target without its owned files");
+    }
+  }
+  if (lstatSync(manifestPath).size > 16 * 1024 * 1024) {
+    throw new Error("PDF --force refused an oversized capture manifest");
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(manifestPath, "utf8")) as unknown;
+  } catch {
+    throw new Error("PDF --force refused an invalid capture manifest");
+  }
+  if (
+    typeof parsed !== "object"
+    || parsed === null
+    || Array.isArray(parsed)
+    || !("schemaVersion" in parsed)
+    || parsed.schemaVersion !== PDF_CAPTURE_MANIFEST_SCHEMA_VERSION
+    || !("kind" in parsed)
+    || parsed.kind !== "pdf"
+  ) throw new Error("PDF --force refused an incompatible capture manifest");
+  return { device: directory.dev, inode: directory.ino };
+}
+
+function assertStagingTreeSafe(root: string, directory = root): void {
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    assertConfinedChild(root, path, "staged PDF artifact");
+    const stats = lstatSync(path);
+    if (stats.isSymbolicLink()) throw new Error("staged PDF artifacts must not be symbolic links");
+    if (stats.isDirectory()) assertStagingTreeSafe(root, path);
+    else if (!stats.isFile()) throw new Error("staged PDF artifacts must be regular files");
+  }
+}
+
+function unusedBackupPath(root: string): string {
+  for (;;) {
+    const candidate = join(root, `.pdf-capture-backup-${randomUUID()}`);
+    assertConfinedChild(root, candidate, "PDF capture backup");
+    if (!existsSync(candidate)) return candidate;
+  }
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+export type PersistPdfCaptureInput = {
+  readonly outputBase: string;
+  readonly slug: string;
+  readonly force: boolean;
+  readonly sourcePath: string;
+  readonly markdown: string;
+  readonly manifest: PdfCaptureManifest;
+  readonly images: readonly PdfImageCandidate[];
+  readonly annotationsJson?: string;
+  readonly afterBackup?: () => void;
+  readonly afterInstall?: () => void;
+};
+
+/** Stage and atomically install a complete PDF source bundle. */
+export function persistPdfCapture(input: PersistPdfCaptureInput): string {
+  const slug = safeSlug(input.slug);
+  const root = outputRoot(input.outputBase);
+  const targetDirectory = join(root, slug);
+  assertConfinedChild(root, targetDirectory, "PDF capture target");
+  const targetExists = existsSync(targetDirectory);
+  if (targetExists && !input.force) {
+    throw new Error(`PDF capture already exists: ${targetDirectory}; pass --force to replace it`);
+  }
+  const expectedIdentity = targetExists ? ownedPdfTarget(targetDirectory, slug) : null;
+  const stagingDirectory = mkdtempSync(join(root, ".pdf-capture-staging-"));
+  chmodSync(stagingDirectory, 0o700);
+  assertConfinedChild(root, stagingDirectory, "PDF capture staging directory");
+
+  try {
+    assertSourceIdentity(
+      input.sourcePath,
+      input.manifest.source.bytes,
+      input.manifest.source.sha256,
+      "PDF source",
+    );
+    const sourceDestination = join(stagingDirectory, PDF_CAPTURE_SOURCE_FILENAME);
+    copyFileSync(input.sourcePath, sourceDestination);
+    chmodSync(sourceDestination, 0o644);
+    const assetsDirectory = join(stagingDirectory, "assets");
+    mkdirSync(assetsDirectory, { recursive: true, mode: 0o755 });
+
+    const imagesByPath = new Map<string, PdfImageCandidate>();
+    for (const image of input.images) {
+      const assetPath = pdfImageAssetPath(image);
+      const existing = imagesByPath.get(assetPath);
+      if (existing !== undefined) {
+        if (existing.bytes !== image.bytes || existing.sha256 !== image.sha256) {
+          throw new Error("conflicting PDF image assets have the same destination");
+        }
+        continue;
+      }
+      imagesByPath.set(assetPath, image);
+    }
+    for (const [assetPath, image] of [...imagesByPath.entries()].sort(([left], [right]) =>
+      left.localeCompare(right))) {
+      assertSourceIdentity(image.sourcePath, image.bytes, image.sha256, "PDF image");
+      const destination = join(stagingDirectory, assetPath);
+      assertConfinedChild(stagingDirectory, destination, "PDF image destination");
+      copyFileSync(image.sourcePath, destination);
+      chmodSync(destination, 0o644);
+    }
+
+    writeFileSync(
+      join(stagingDirectory, `${slug}.md`),
+      `${redactSensitiveText(input.markdown).trimEnd()}\n`,
+      { encoding: "utf8", flag: "wx", mode: 0o644 },
+    );
+    if (input.manifest.annotations === null) {
+      if (input.annotationsJson !== undefined) {
+        throw new Error("PDF annotations were supplied without manifest provenance");
+      }
+    } else {
+      const annotationsJson = input.annotationsJson;
+      if (annotationsJson === undefined) {
+        throw new Error("PDF annotation provenance is missing its retained input");
+      }
+      if (
+        Buffer.byteLength(annotationsJson) !== input.manifest.annotations.bytes
+        || createHash("sha256").update(annotationsJson).digest("hex")
+          !== input.manifest.annotations.sha256
+      ) {
+        throw new Error("PDF annotation input does not match its manifest provenance");
+      }
+      let annotations: unknown;
+      try {
+        annotations = JSON.parse(annotationsJson) as unknown;
+      } catch {
+        throw new Error("PDF annotation input is not valid JSON");
+      }
+      if (
+        !Array.isArray(annotations)
+        || annotations.length !== input.manifest.annotations.count
+      ) {
+        throw new Error("PDF annotation input count does not match its manifest provenance");
+      }
+      writeFileSync(
+        join(stagingDirectory, PDF_CAPTURE_ANNOTATIONS_FILENAME),
+        annotationsJson,
+        { encoding: "utf8", flag: "wx", mode: 0o644 },
+      );
+    }
+    writeFileSync(
+      join(stagingDirectory, PDF_CAPTURE_MANIFEST_FILENAME),
+      `${JSON.stringify(input.manifest, null, 2)}\n`,
+      { encoding: "utf8", flag: "wx", mode: 0o644 },
+    );
+    assertStagingTreeSafe(stagingDirectory);
+
+    if (existsSync(targetDirectory) !== (expectedIdentity !== null)) {
+      throw new Error("PDF capture target changed during the transaction");
+    }
+    if (expectedIdentity !== null) {
+      const current = ownedPdfTarget(targetDirectory, slug);
+      if (current.device !== expectedIdentity.device || current.inode !== expectedIdentity.inode) {
+        throw new Error("PDF capture target changed during the transaction");
+      }
+    }
+
+    const backupDirectory = expectedIdentity === null ? null : unusedBackupPath(root);
+    let installed = false;
+    let backedUp = false;
+    try {
+      if (backupDirectory !== null) {
+        renameSync(targetDirectory, backupDirectory);
+        backedUp = true;
+        input.afterBackup?.();
+      }
+      renameSync(stagingDirectory, targetDirectory);
+      installed = true;
+      input.afterInstall?.();
+      if (backupDirectory !== null) rmSync(backupDirectory, { recursive: true, force: true });
+      return targetDirectory;
+    } catch (error) {
+      let rollbackError: unknown;
+      try {
+        if (installed && existsSync(targetDirectory)) {
+          rmSync(targetDirectory, { recursive: true, force: true });
+        }
+        if (backedUp && backupDirectory !== null && existsSync(backupDirectory)) {
+          if (existsSync(targetDirectory)) throw new Error("target was recreated before rollback");
+          renameSync(backupDirectory, targetDirectory);
+        }
+      } catch (caught) {
+        rollbackError = caught;
+      }
+      if (rollbackError !== undefined) {
+        throw new Error(
+          `PDF capture commit failed (${errorMessage(error)}) and rollback failed (${errorMessage(rollbackError)})`,
+          { cause: error },
+        );
+      }
+      throw error;
+    }
+  } catch (error) {
+    if (existsSync(stagingDirectory)) rmSync(stagingDirectory, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+export function pdfMarkdownFilename(slug: string): string {
+  return `${safeSlug(slug)}.md`;
+}

package/src/pdf/source.ts

@@ -0,0 +1,135 @@
+import {
+  chmodSync,
+  mkdtempSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+
+import {
+  safeFetch,
+  type SafeFetchOptions,
+  type SafeFetchResult,
+} from "../clip/network.js";
+import { sanitizeArtifactUrl } from "../clip/persist.js";
+import { pdfCaptureDefaults } from "./extract.js";
+import type { PdfRemoteSource } from "./model.js";
+
+export type PreparedPdfSource = {
+  readonly inputPath: string;
+  readonly remoteSource?: PdfRemoteSource;
+  readonly dispose: () => void;
+};
+
+export type PdfSourceDependencies = {
+  readonly fetch?: (url: URL, options: SafeFetchOptions) => Promise<SafeFetchResult>;
+  readonly makeTemporaryDirectory?: () => string;
+  readonly writeFile?: typeof writeFileSync;
+  readonly removeDirectory?: (path: string) => void;
+};
+
+const remoteUserAgent = "hraness-kb/0.7 PDF capture";
+
+function parseRemoteUrl(input: string): URL | null {
+  if (!/^https?:\/\//iu.test(input)) return null;
+  let url: URL;
+  try {
+    url = new URL(input);
+  } catch {
+    throw new Error("PDF URL is invalid");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("PDF URL must use HTTP or HTTPS");
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new Error("PDF URL must not contain embedded credentials");
+  }
+  return url;
+}
+
+function remoteFilename(url: URL): string {
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(basename(url.pathname));
+  } catch {
+    decoded = "source.pdf";
+  }
+  const normalized = decoded
+    .normalize("NFKC")
+    .replace(/[^\p{Letter}\p{Number}._-]+/gu, "-")
+    .replace(/^[.-]+|[.-]+$/gu, "")
+    .slice(0, 180);
+  const stem = normalized === "" ? "source" : normalized.replace(/\.pdf$/iu, "");
+  return `${stem}.pdf`;
+}
+
+function assertPdfSignature(bytes: Uint8Array): void {
+  if (
+    bytes.byteLength < 5
+    || new TextDecoder().decode(bytes.subarray(0, 5)) !== "%PDF-"
+  ) {
+    throw new Error("remote PDF input does not have a valid PDF signature");
+  }
+}
+
+/** Resolve a local path directly or download one bounded public PDF into a disposable private directory. */
+export async function preparePdfSource(
+  input: string,
+  options: {
+    readonly timeoutMs?: number;
+    readonly maxPdfBytes?: number;
+  } = {},
+  dependencies: PdfSourceDependencies = {},
+): Promise<PreparedPdfSource> {
+  const requestedUrl = parseRemoteUrl(input);
+  if (requestedUrl === null) {
+    return {
+      inputPath: input,
+      dispose: () => {},
+    };
+  }
+
+  const result = await (dependencies.fetch ?? safeFetch)(requestedUrl, {
+    timeoutMs: options.timeoutMs ?? pdfCaptureDefaults.timeoutMs,
+    maxBytes: options.maxPdfBytes ?? pdfCaptureDefaults.maxPdfBytes,
+    allowPrivateNetwork: false,
+    userAgent: remoteUserAgent,
+    accept: "application/pdf,application/octet-stream;q=0.9,*/*;q=0.1",
+    retries: 2,
+    maxRedirects: 5,
+  });
+  assertPdfSignature(result.bytes);
+
+  const makeTemporaryDirectory = dependencies.makeTemporaryDirectory
+    ?? (() => mkdtempSync(join(tmpdir(), "hraness-kb-pdf-source-")));
+  const removeDirectory = dependencies.removeDirectory
+    ?? ((path: string) => rmSync(path, { recursive: true, force: true }));
+  const directory = makeTemporaryDirectory();
+  let disposed = false;
+  const dispose = (): void => {
+    if (disposed) return;
+    disposed = true;
+    removeDirectory(directory);
+  };
+  try {
+    chmodSync(directory, 0o700);
+    const inputPath = join(directory, remoteFilename(result.finalUrl));
+    (dependencies.writeFile ?? writeFileSync)(inputPath, result.bytes, {
+      encoding: null,
+      flag: "wx",
+      mode: 0o600,
+    });
+    return {
+      inputPath,
+      remoteSource: {
+        requestedUrl: sanitizeArtifactUrl(requestedUrl.href),
+        finalUrl: sanitizeArtifactUrl(result.finalUrl.href),
+      },
+      dispose,
+    };
+  } catch (error) {
+    dispose();
+    throw error;
+  }
+}

package/src/pdf/tools.ts

@@ -0,0 +1,146 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import { BoundedByteBuffer } from "../clip/bounded-byte-buffer.js";
+import type {
+  PdfCaptureDependencies,
+  PdfToolCommand,
+  PdfToolCommandResult,
+  PdfToolPaths,
+  PdfToolRunner,
+} from "./model.js";
+
+const commonExecutableDirectories = [
+  "/opt/homebrew/bin",
+  "/usr/local/bin",
+  "/usr/bin",
+] as const;
+
+async function readBoundedStream(stream: NodeJS.ReadableStream, maxBytes: number): Promise<string> {
+  const bytes = new BoundedByteBuffer(maxBytes);
+  const iterable: AsyncIterable<unknown> = stream;
+  for await (const value of iterable) {
+    let chunk: Uint8Array;
+    if (typeof value === "string") chunk = new TextEncoder().encode(value);
+    else if (value instanceof Uint8Array) chunk = value;
+    else throw new Error("PDF tool returned an unsupported output chunk");
+    if (!bytes.append(chunk)) throw new Error(`PDF tool output exceeded ${maxBytes} bytes`);
+  }
+  return new TextDecoder().decode(bytes.toUint8Array());
+}
+
+/** Run a local PDF tool without a shell and with bounded output and wall time. */
+export const runPdfToolCommand: PdfToolRunner = async (
+  specification: PdfToolCommand,
+): Promise<PdfToolCommandResult> => {
+  const executable = specification.command[0];
+  if (executable === undefined) throw new Error("PDF tool command is empty");
+  const useProcessGroup = process.platform !== "win32";
+  const child = spawn(executable, specification.command.slice(1), {
+    cwd: specification.cwd,
+    detached: useProcessGroup,
+    env: {
+      ...process.env,
+      LC_ALL: "C",
+      LANG: "C",
+      ...specification.environment,
+    },
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true,
+  });
+  const exited = new Promise<number>((resolveExit, rejectExit) => {
+    child.once("error", rejectExit);
+    child.once("close", (code) => resolveExit(code ?? 1));
+  });
+  const signalProcessTree = (signal: NodeJS.Signals): void => {
+    if (useProcessGroup && child.pid !== undefined) {
+      try {
+        process.kill(-child.pid, signal);
+        return;
+      } catch {
+        // The process may have exited before the group signal.
+      }
+    }
+    try {
+      child.kill(signal);
+    } catch {
+      // Killing an already exited direct child is harmless.
+    }
+  };
+
+  const state: { failure: Error | null } = { failure: null };
+  let forceKillTimer: ReturnType<typeof setTimeout> | null = null;
+  const requestStop = (error: Error): void => {
+    state.failure ??= error;
+    if (forceKillTimer !== null) return;
+    signalProcessTree("SIGTERM");
+    forceKillTimer = setTimeout(() => signalProcessTree("SIGKILL"), 1_000);
+  };
+  const timer = setTimeout(() => {
+    requestStop(new Error(`PDF tool timed out after ${specification.timeoutMs}ms`));
+  }, specification.timeoutMs);
+
+  try {
+    const [stdout, stderr, exitCode] = await Promise.all([
+      readBoundedStream(child.stdout, specification.maxOutputBytes).catch((error: unknown) => {
+        const normalized = error instanceof Error ? error : new Error(String(error));
+        requestStop(normalized);
+        throw normalized;
+      }),
+      readBoundedStream(child.stderr, specification.maxOutputBytes).catch((error: unknown) => {
+        const normalized = error instanceof Error ? error : new Error(String(error));
+        requestStop(normalized);
+        throw normalized;
+      }),
+      exited,
+    ]);
+    if (state.failure !== null) throw state.failure;
+    return { stdout, stderr, exitCode };
+  } catch (error) {
+    requestStop(error instanceof Error ? error : new Error(String(error)));
+    await exited.catch(() => 1);
+    throw error;
+  } finally {
+    clearTimeout(timer);
+    if (forceKillTimer !== null) clearTimeout(forceKillTimer);
+  }
+};
+
+function discoverExecutable(
+  name: string,
+  dependencies: Pick<PdfCaptureDependencies, "which" | "exists">,
+): string | null {
+  const exists = dependencies.exists ?? existsSync;
+  const fromPath = (dependencies.which ?? ((value: string) => Bun.which(value)))(name);
+  if (fromPath !== null && exists(fromPath)) return fromPath;
+  const homeCandidates = name === "tesseract"
+    ? [join(homedir(), ".local", "bin", name)]
+    : [];
+  for (const path of [
+    ...homeCandidates,
+    ...commonExecutableDirectories.map((directory) => join(directory, name)),
+  ]) {
+    if (exists(path)) return path;
+  }
+  return null;
+}
+
+/** Resolve required Poppler tools and the optional local OCR executable. */
+export function resolvePdfTools(dependencies: PdfCaptureDependencies = {}): PdfToolPaths {
+  const pdfinfo = dependencies.tools?.pdfinfo
+    ?? discoverExecutable("pdfinfo", dependencies);
+  const pdftohtml = dependencies.tools?.pdftohtml
+    ?? discoverExecutable("pdftohtml", dependencies);
+  const tesseract = dependencies.tools?.tesseract === undefined
+    ? discoverExecutable("tesseract", dependencies)
+    : dependencies.tools.tesseract;
+  if (pdfinfo === null) {
+    throw new Error("pdfinfo is required for PDF ingestion; install the Poppler command-line tools");
+  }
+  if (pdftohtml === null) {
+    throw new Error("pdftohtml is required for PDF ingestion; install the Poppler command-line tools");
+  }
+  return { pdfinfo, pdftohtml, tesseract };
+}

package/src/pdf.ts

@@ -0,0 +1,92 @@
+import {
+  parsePdfArguments as parsePdfArgumentsImplementation,
+  pdfUsage as installedPdfUsage,
+} from "./pdf/args.js";
+import {
+  main as runPdfCommandImplementation,
+  pdfCaptureSummary as pdfCaptureSummaryImplementation,
+} from "./pdf/cli.js";
+import { runPdfCapture as runPdfCaptureImplementation } from "./pdf/capture.js";
+import {
+  inspectPdf as inspectPdfImplementation,
+  pdfCaptureDefaults as installedPdfCaptureDefaults,
+} from "./pdf/extract.js";
+import {
+  decodePopplerText as decodePopplerTextImplementation,
+  layoutBlocks as layoutBlocksImplementation,
+  parsePdfImageInterpretations as parsePdfImageInterpretationsImplementation,
+  parsePdfInfo as parsePdfInfoImplementation,
+  parsePopplerXml as parsePopplerXmlImplementation,
+  type PdfLayoutBlock,
+} from "./pdf/layout.js";
+import { buildPdfMarkdown as buildPdfMarkdownImplementation } from "./pdf/markdown.js";
+import {
+  PDF_CAPTURE_ANNOTATIONS_FILENAME as installedAnnotationsFilename,
+  PDF_CAPTURE_MANIFEST_FILENAME as installedManifestFilename,
+  PDF_CAPTURE_MANIFEST_SCHEMA_VERSION as installedManifestSchemaVersion,
+  PDF_CAPTURE_SOURCE_FILENAME as installedSourceFilename,
+} from "./pdf/model.js";
+import {
+  ocrPdfImage as ocrPdfImageImplementation,
+  parseTesseractTsv as parseTesseractTsvImplementation,
+} from "./pdf/ocr.js";
+import {
+  pdfImageAssetPath as pdfImageAssetPathImplementation,
+  pdfMarkdownFilename as pdfMarkdownFilenameImplementation,
+  persistPdfCapture as persistPdfCaptureImplementation,
+} from "./pdf/persist.js";
+import {
+  resolvePdfTools as resolvePdfToolsImplementation,
+  runPdfToolCommand as runPdfToolCommandImplementation,
+} from "./pdf/tools.js";
+
+// Explicit value assignments avoid a Bun bundler bug that can drop bindings
+// used only by a re-exporting entrypoint.
+export const PDF_CAPTURE_MANIFEST_FILENAME = installedManifestFilename;
+export const PDF_CAPTURE_MANIFEST_SCHEMA_VERSION = installedManifestSchemaVersion;
+export const PDF_CAPTURE_SOURCE_FILENAME = installedSourceFilename;
+export const PDF_CAPTURE_ANNOTATIONS_FILENAME = installedAnnotationsFilename;
+export const buildPdfMarkdown = buildPdfMarkdownImplementation;
+export const decodePopplerText = decodePopplerTextImplementation;
+export const inspectPdf = inspectPdfImplementation;
+export const layoutBlocks = layoutBlocksImplementation;
+export const ocrPdfImage = ocrPdfImageImplementation;
+export const parsePdfArguments = parsePdfArgumentsImplementation;
+export const parsePdfImageInterpretations = parsePdfImageInterpretationsImplementation;
+export const parsePdfInfo = parsePdfInfoImplementation;
+export const parsePopplerXml = parsePopplerXmlImplementation;
+export const parseTesseractTsv = parseTesseractTsvImplementation;
+export const pdfCaptureDefaults = installedPdfCaptureDefaults;
+export const pdfCaptureSummary = pdfCaptureSummaryImplementation;
+export const pdfImageAssetPath = pdfImageAssetPathImplementation;
+export const pdfMarkdownFilename = pdfMarkdownFilenameImplementation;
+export const pdfUsage = installedPdfUsage;
+export const persistPdfCapture = persistPdfCaptureImplementation;
+export const resolvePdfTools = resolvePdfToolsImplementation;
+export const runPdfCapture = runPdfCaptureImplementation;
+export const runPdfCommand = runPdfCommandImplementation;
+export const runPdfToolCommand = runPdfToolCommandImplementation;
+
+export type { PdfLayoutBlock };
+export type {
+  PdfBounds,
+  PdfCaptureDependencies,
+  PdfCaptureManifest,
+  PdfCaptureOptions,
+  PdfCaptureOutcome,
+  PdfCaptureStatus,
+  PdfDocumentMetadata,
+  PdfImageCandidate,
+  PdfImageInterpretation,
+  PdfImageSemanticMetadata,
+  PdfInspection,
+  PdfManifestAsset,
+  PdfManifestImage,
+  PdfOcrResult,
+  PdfPageLayout,
+  PdfTextFragment,
+  PdfToolCommand,
+  PdfToolCommandResult,
+  PdfToolPaths,
+  PdfToolRunner,
+} from "./pdf/model.js";