@rightkit/document-core 0.1.1 → 0.2.0

package/dist/documents/pdf/pdfOcr.js

@@ -1,88 +0,0 @@
-import * as pdfjs from "pdfjs-dist";
-import { readPdfPageText } from "./usePdfSearch.js";
-// These names are present in older pdf.js operator lists; current pdf.js folds JPEG painting into
-// paintImageXObject, so keep the compatibility check without adding undefined to the operator set.
-const paintJpegXObject = pdfjs.OPS
-    .paintJpegXObject;
-const IMAGE_OPERATOR_CODES = new Set([
-    pdfjs.OPS.paintImageXObject,
-    ...(paintJpegXObject === undefined ? [] : [paintJpegXObject]),
-    pdfjs.OPS.paintInlineImageXObject,
-    pdfjs.OPS.paintImageMaskXObject,
-]);
-/** These prefixes are a cross-language contract with src-tauri/crates/ocr/src/lib.rs; they must not drift. */
-export const WINDOWS_OCR_UNAVAILABLE_PREFIX = "windows-ocr-unavailable:";
-export const MACOS_VISION_UNAVAILABLE_PREFIX = "macos-vision-unavailable:";
-export const OCR_UNSUPPORTED_PLATFORM_PREFIX = "ocr-unsupported-platform:";
-/**
- * Fast eligibility check used while browsing. It reads only the streamed text layer, so opening
- * a document or changing pages never asks pdf.js to decode every page's operator list.
- */
-export async function isTextlessPage(page) {
-    const text = await readPdfPageText(page);
-    return text.trim() === "";
-}
-/**
- * Scanned-page recognition is offered only when there is no usable text and the page paints an
- * image: streamed text is authoritative because WKWebView's pdf.js worker can leave a parallel
- * getTextContent() request empty even while the visible streamed text layer has content, and the
- * image check prevents genuinely blank pages from being sent to OCR.
- */
-export async function isProbablyScannedPage(page) {
-    if (!(await isTextlessPage(page)))
-        return false;
-    const operatorList = await page.getOperatorList();
-    return operatorList.fnArray.some((operator) => IMAGE_OPERATOR_CODES.has(operator));
-}
-/**
- * Rasterizes one PDF page at 300 DPI by default. 300 DPI is the standard floor for reliable text
- * recognition on scanned documents; pdf.js's default page space is 72 DPI, so the scale converts
- * directly from points to the requested pixel density.
- */
-export async function renderPageToPng(page, dpi = 300, rotation) {
-    // `rotation` is the ABSOLUTE total rotation (page rotation + the viewer's), because pdf.js
-    // treats getViewport's rotation as absolute rather than additive. It is threaded in here rather
-    // than by wrapping the page: a derived or proxied page object breaks page.render(), which writes
-    // private class fields on `this` and throws "Cannot write private member #pendingCleanup to an
-    // object whose class did not declare it".
-    const viewport = page.getViewport(rotation === undefined ? { scale: dpi / 72 } : { scale: dpi / 72, rotation });
-    const canvas = document.createElement("canvas");
-    canvas.width = Math.ceil(viewport.width);
-    canvas.height = Math.ceil(viewport.height);
-    try {
-        const context = canvas.getContext("2d");
-        if (!context)
-            throw new Error("Cannot rasterize PDF page: canvas 2D context unavailable.");
-        // OCR needs a flat page raster, never interactive annotations. Print intent avoids pdf.js's
-        // display-only requestAnimationFrame scheduler, which WKWebView pauses for minimized windows.
-        // Disabling annotations also gives OCR a distinct pdf.js intent-state key from thumbnail renders,
-        // which use print intent with annotations enabled on the same cached PDFPageProxy.
-        await page.render({
-            canvas,
-            canvasContext: context,
-            viewport,
-            intent: "print",
-            annotationMode: pdfjs.AnnotationMode.DISABLE,
-        }).promise;
-        return await new Promise((resolve, reject) => {
-            canvas.toBlob((blob) => {
-                if (blob)
-                    resolve(blob);
-                else
-                    reject(new Error("Cannot rasterize PDF page: PNG encoding unavailable."));
-            }, "image/png");
-        });
-    }
-    finally {
-        // Drop backing storage promptly: OCR can process long documents, so retaining one 300 DPI
-        // canvas per in-flight page is enough to create a large avoidable native allocation.
-        canvas.width = 0;
-        canvas.height = 0;
-    }
-}
-export { ocrPage, ocrAvailable, ocrBackendMissing } from "../../state/tauriBridge.js";
-export function isBackendUnavailable(message) {
-    return (message.startsWith(WINDOWS_OCR_UNAVAILABLE_PREFIX) ||
-        message.startsWith(MACOS_VISION_UNAVAILABLE_PREFIX) ||
-        message.startsWith(OCR_UNSUPPORTED_PLATFORM_PREFIX));
-}

package/dist/documents/pdf/pdfOcrEdit.d.ts

@@ -1,32 +0,0 @@
-import type { PageViewport } from "pdfjs-dist";
-import type { PdfColor, PdfPoint, PdfRect, PdfTextAppearance } from "./pdfEditModel.js";
-import type { OcrLine } from "./pdfOcr.js";
-export interface PdfOcrHit {
-    index: number;
-    line: OcrLine;
-}
-export interface PdfOcrCorrectionGeometry {
-    lineId: string;
-    rect: PdfRect;
-    anchor: PdfPoint;
-    appearance: PdfTextAppearance;
-}
-export declare function findOcrLineAt(lines: readonly OcrLine[], normalizedX: number, normalizedY: number): PdfOcrHit | null;
-export declare function ocrLineId(page: number, index: number, line: OcrLine): string;
-export declare function ocrLineCorrectionGeometry(page: number, index: number, line: OcrLine, viewport: PageViewport): PdfOcrCorrectionGeometry;
-/** Finds one dominant local color while tolerating dark glyph pixels over a uniform scan. */
-export declare function detectNearUniformBackground(data: Uint8ClampedArray): PdfColor | null;
-/**
- * Dominant background color under a CSS-pixel rect of a page slot, read from that slot's render
- * canvas (which is rasterized at devicePixelRatio, so CSS px are scaled by canvas/slot width).
- * Used to mask the original glyphs under the inline source-text editor; `null` when the area is
- * not near-uniform (e.g. text over an image), in which case the caller falls back to white.
- */
-export declare function sampleCanvasRectBackground(canvas: HTMLCanvasElement, rectCss: PdfRect, slotWidthCss: number): PdfColor | null;
-export declare function sampleOcrBackground(canvas: HTMLCanvasElement, line: OcrLine): PdfColor | null;
-export declare function applyOcrCorrections(source: ReadonlyMap<number, OcrLine[]>, corrections: readonly {
-    kind: string;
-    page?: number;
-    lineId?: string;
-    text?: string;
-}[]): Map<number, OcrLine[]>;

package/dist/documents/pdf/pdfOcrEdit.js

@@ -1,138 +0,0 @@
-export function findOcrLineAt(lines, normalizedX, normalizedY) {
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index];
-        if (normalizedX >= line.rect.x &&
-            normalizedX <= line.rect.x + line.rect.width &&
-            normalizedY >= line.rect.y &&
-            normalizedY <= line.rect.y + line.rect.height) {
-            return { index, line };
-        }
-    }
-    return null;
-}
-function hashText(input) {
-    let hash = 0x811c9dc5;
-    for (let index = 0; index < input.length; index += 1) {
-        hash ^= input.charCodeAt(index);
-        hash = Math.imul(hash, 0x01000193);
-    }
-    return (hash >>> 0).toString(16).padStart(8, "0");
-}
-export function ocrLineId(page, index, line) {
-    return `${page}:${index}:${hashText(JSON.stringify([line.text, line.rect]))}`;
-}
-export function ocrLineCorrectionGeometry(page, index, line, viewport) {
-    const left = line.rect.x * viewport.width;
-    const top = line.rect.y * viewport.height;
-    const right = (line.rect.x + line.rect.width) * viewport.width;
-    const bottom = (line.rect.y + line.rect.height) * viewport.height;
-    const corners = [
-        viewport.convertToPdfPoint(left, top),
-        viewport.convertToPdfPoint(right, top),
-        viewport.convertToPdfPoint(left, bottom),
-        viewport.convertToPdfPoint(right, bottom),
-    ];
-    const xs = corners.map(([x]) => x);
-    const ys = corners.map(([, y]) => y);
-    const rect = {
-        x: Math.min(...xs),
-        y: Math.min(...ys),
-        width: Math.max(...xs) - Math.min(...xs),
-        height: Math.max(...ys) - Math.min(...ys),
-    };
-    const sizePt = Math.max(6, Math.min(72, rect.height * 0.72));
-    return {
-        lineId: ocrLineId(page, index, line),
-        rect,
-        anchor: { x: rect.x, y: rect.y + rect.height * 0.18 },
-        appearance: {
-            fontId: "source-serif-4",
-            family: "Source Serif 4",
-            sizePt,
-            color: { r: 0, g: 0, b: 0, alpha: 1 },
-        },
-    };
-}
-/** Finds one dominant local color while tolerating dark glyph pixels over a uniform scan. */
-export function detectNearUniformBackground(data) {
-    const buckets = new Map();
-    let opaque = 0;
-    for (let index = 0; index + 3 < data.length; index += 4) {
-        if (data[index + 3] < 128)
-            continue;
-        opaque += 1;
-        const key = `${data[index] >> 4}:${data[index + 1] >> 4}:${data[index + 2] >> 4}`;
-        const bucket = buckets.get(key) ?? { count: 0, r: 0, g: 0, b: 0 };
-        bucket.count += 1;
-        bucket.r += data[index];
-        bucket.g += data[index + 1];
-        bucket.b += data[index + 2];
-        buckets.set(key, bucket);
-    }
-    if (opaque === 0)
-        return null;
-    const dominant = [...buckets.values()].sort((a, b) => b.count - a.count)[0];
-    if (!dominant || dominant.count / opaque < 0.6)
-        return null;
-    return {
-        r: dominant.r / dominant.count / 255,
-        g: dominant.g / dominant.count / 255,
-        b: dominant.b / dominant.count / 255,
-        alpha: 1,
-    };
-}
-/**
- * Dominant background color under a CSS-pixel rect of a page slot, read from that slot's render
- * canvas (which is rasterized at devicePixelRatio, so CSS px are scaled by canvas/slot width).
- * Used to mask the original glyphs under the inline source-text editor; `null` when the area is
- * not near-uniform (e.g. text over an image), in which case the caller falls back to white.
- */
-export function sampleCanvasRectBackground(canvas, rectCss, slotWidthCss) {
-    if (slotWidthCss <= 0 || canvas.width <= 0)
-        return null;
-    const context = canvas.getContext("2d", { willReadFrequently: true });
-    if (!context)
-        return null;
-    const ratio = canvas.width / slotWidthCss;
-    const x = Math.max(0, Math.floor(rectCss.x * ratio));
-    const y = Math.max(0, Math.floor(rectCss.y * ratio));
-    const width = Math.max(1, Math.min(canvas.width - x, Math.ceil(rectCss.width * ratio)));
-    const height = Math.max(1, Math.min(canvas.height - y, Math.ceil(rectCss.height * ratio)));
-    try {
-        return detectNearUniformBackground(context.getImageData(x, y, width, height).data);
-    }
-    catch {
-        return null;
-    }
-}
-export function sampleOcrBackground(canvas, line) {
-    const context = canvas.getContext("2d", { willReadFrequently: true });
-    if (!context)
-        return null;
-    const x = Math.max(0, Math.floor(line.rect.x * canvas.width));
-    const y = Math.max(0, Math.floor(line.rect.y * canvas.height));
-    const width = Math.max(1, Math.min(canvas.width - x, Math.ceil(line.rect.width * canvas.width)));
-    const height = Math.max(1, Math.min(canvas.height - y, Math.ceil(line.rect.height * canvas.height)));
-    try {
-        return detectNearUniformBackground(context.getImageData(x, y, width, height).data);
-    }
-    catch {
-        return null;
-    }
-}
-export function applyOcrCorrections(source, corrections) {
-    const latest = new Map();
-    for (const command of corrections) {
-        if (command.kind === "correctOcrText" && command.lineId && command.text !== undefined) {
-            latest.set(command.lineId, command.text);
-        }
-    }
-    const result = new Map();
-    for (const [page, lines] of source) {
-        result.set(page, lines.map((line, index) => {
-            const text = latest.get(ocrLineId(page, index, line));
-            return text === undefined ? line : { ...line, text };
-        }));
-    }
-    return result;
-}

package/dist/documents/pdf/pdfPrinting.d.ts

@@ -1,28 +0,0 @@
-import type { PDFDocumentProxy } from "pdfjs-dist";
-/** Rasterize PDF bytes into the print host as flat images, then trigger native print.
- *
- *  Two deliberate choices, both learned the hard way on macOS:
- *
- *  1. A SEPARATE pdf.js document is loaded from these bytes, never the on-screen viewer's live
- *     `PDFDocumentProxy`. pdf.js caches page proxies per document, so printing off the viewer's copy
- *     issues a second `render()` against a `PDFPageProxy` the viewer may already be rendering — a
- *     documented failure class whose symptom is a render promise that never settles, i.e. print that
- *     silently does nothing. An isolated document shares no page state.
- *  2. Each page is rasterized to a canvas and then flattened to a `data:` image. The canvas itself is
- *     NOT appended: WKWebView's print pass re-renders the page into a print context and canvas
- *     backing stores do not reliably survive it (the same reason the image viewer had to print a flat
- *     `<img src="data:...">` instead of its live stage). Images do survive.
- *
- *  Every await is bounded, so a hang surfaces as a rejected promise the caller can toast rather than
- *  as silence. */
-export declare function printPdfBytes(bytes: ArrayBuffer | Uint8Array): Promise<boolean>;
-/** Print the PDF a viewer pane already has open, WITHOUT re-fetching it. `getData()` hands back the
- *  bytes pdf.js already holds in memory, so this never re-opens the revocable viewright-stream:// URL
- *  that the on-screen viewer is still streaming from. */
-export declare function printPdfDocument(doc: PDFDocumentProxy): Promise<boolean>;
-/** Fallback PDF print path for when no viewer pane is registered: fetch the bytes from the stream URL
- *  and rasterize them. Prefer printPdfDocument whenever a pane is mounted — it skips the fetch. NOT a
- *  plain `<iframe src=blobURL>`: WKWebView does not reliably render a PDF blob inline via a bare
- *  iframe navigation, so `iframe.onload` never fires and print() never runs — the original silent
- *  no-op on macOS that this replaced. */
-export declare function printPdf(assetUrl: string): Promise<boolean>;

package/dist/documents/pdf/pdfPrinting.js

@@ -1,110 +0,0 @@
-import * as pdfjs from "pdfjs-dist";
-import { pdfDocumentInit } from "@rightkit/pdf-ui";
-import { mountPrintImage, printHost } from "../../app/printPipelineShared.js";
-import { withTimeout } from "./pdfShared.js";
-// pdf.js's getDocument() spins up a Web Worker to parse the PDF off the main thread, and if that
-// worker never starts (silently, e.g. resolving `?url` through a fresh dynamic import chunk rather
-// than the already-loaded static module), `getDocument().promise` just hangs forever — no error, no
-// rejection, nothing to catch. That hang was indistinguishable from a printer dialog never opening.
-// The worker URL must therefore be resolved exactly ONCE, by the host app at startup, through
-// @rightkit/pdf-ui's configurePdfJs({ workerSrc }) (a Vite host: `import workerUrl from
-// "pdfjs-dist/build/pdf.worker.min.mjs?url"`): a published package cannot resolve a bundler URL. A hard
-// timeout below converts any hang into a visible failure instead of silence.
-/** Rasterize PDF bytes into the print host as flat images, then trigger native print.
- *
- *  Two deliberate choices, both learned the hard way on macOS:
- *
- *  1. A SEPARATE pdf.js document is loaded from these bytes, never the on-screen viewer's live
- *     `PDFDocumentProxy`. pdf.js caches page proxies per document, so printing off the viewer's copy
- *     issues a second `render()` against a `PDFPageProxy` the viewer may already be rendering — a
- *     documented failure class whose symptom is a render promise that never settles, i.e. print that
- *     silently does nothing. An isolated document shares no page state.
- *  2. Each page is rasterized to a canvas and then flattened to a `data:` image. The canvas itself is
- *     NOT appended: WKWebView's print pass re-renders the page into a print context and canvas
- *     backing stores do not reliably survive it (the same reason the image viewer had to print a flat
- *     `<img src="data:...">` instead of its live stage). Images do survive.
- *
- *  Every await is bounded, so a hang surfaces as a rejected promise the caller can toast rather than
- *  as silence. */
-export async function printPdfBytes(bytes) {
-    const data = bytes instanceof Uint8Array ? bytes.slice() : new Uint8Array(bytes.slice(0));
-    const loadingTask = pdfjs.getDocument(pdfDocumentInit(data));
-    try {
-        const doc = await withTimeout(loadingTask.promise, 20_000, "pdf.js getDocument timed out");
-        let mountedPages = 0;
-        return await printHost(async (host) => {
-            for (let i = 1; i <= doc.numPages; i++) {
-                const page = await withTimeout(doc.getPage(i), 20_000, `pdf.js getPage(${i}) timed out`);
-                try {
-                    const viewport = page.getViewport({ scale: 2 });
-                    const canvas = document.createElement("canvas");
-                    canvas.width = viewport.width;
-                    canvas.height = viewport.height;
-                    try {
-                        const ctx = canvas.getContext("2d");
-                        if (!ctx)
-                            throw new Error(`PDF print page ${i} has no 2D canvas context`);
-                        const renderTask = page.render({ canvas, canvasContext: ctx, viewport });
-                        try {
-                            await withTimeout(renderTask.promise, 30_000, `pdf.js render(page ${i}) timed out`);
-                        }
-                        catch (error) {
-                            // A timeout only races the promise; cancel the underlying render before cleanup and
-                            // backing-store release so a late worker completion cannot paint a detached canvas.
-                            renderTask.cancel?.();
-                            throw error;
-                        }
-                        if (mountedPages === 0) {
-                            const pageSize = document.createElement("style");
-                            // PDF.js viewport units at scale 1 are PDF points. Matching @page to those dimensions
-                            // makes each raster image exactly one printer sheet; width-only fitting spilled an A4
-                            // PDF onto Letter's next sheet, which looked like alternating blank pages.
-                            pageSize.textContent = `@page { size: ${viewport.width / 2}pt ${viewport.height / 2}pt; margin: 0; }`;
-                            host.appendChild(pageSize);
-                        }
-                        // Prepare one page at a time. The host must retain every decoded image for native print,
-                        // but no second all-pages `pageImages` array or canvas backing stores are retained while
-                        // later pages render. Data URLs remain the portable representation required by the
-                        // Windows preview webview and by WKWebView's raster print path.
-                        const src = canvas.toDataURL("image/png");
-                        await mountPrintImage(host, src, "box-sizing:border-box;display:block;width:99.5%;height:auto;margin:0 auto;break-inside:avoid;page-break-inside:avoid;");
-                        mountedPages += 1;
-                    }
-                    finally {
-                        // Explicitly release temporary raster backing store before preparing next page.
-                        canvas.width = 0;
-                        canvas.height = 0;
-                    }
-                }
-                finally {
-                    page.cleanup();
-                }
-            }
-            return mountedPages > 0;
-        });
-    }
-    finally {
-        try {
-            await withTimeout(loadingTask.destroy(), 5_000, "pdf.js print cleanup timed out");
-        }
-        catch {
-            // Cleanup failure must not become an unhandled rejection or replace the print error.
-        }
-    }
-}
-/** Print the PDF a viewer pane already has open, WITHOUT re-fetching it. `getData()` hands back the
- *  bytes pdf.js already holds in memory, so this never re-opens the revocable viewright-stream:// URL
- *  that the on-screen viewer is still streaming from. */
-export async function printPdfDocument(doc) {
-    const bytes = await withTimeout(doc.getData(), 15_000, "pdf.js getData timed out");
-    return printPdfBytes(bytes);
-}
-/** Fallback PDF print path for when no viewer pane is registered: fetch the bytes from the stream URL
- *  and rasterize them. Prefer printPdfDocument whenever a pane is mounted — it skips the fetch. NOT a
- *  plain `<iframe src=blobURL>`: WKWebView does not reliably render a PDF blob inline via a bare
- *  iframe navigation, so `iframe.onload` never fires and print() never runs — the original silent
- *  no-op on macOS that this replaced. */
-export async function printPdf(assetUrl) {
-    const bytes = await withTimeout(fetch(assetUrl).then((r) => r.arrayBuffer()), 15_000, "pdf byte fetch timed out");
-    return printPdfBytes(bytes);
-}

package/dist/documents/pdf/pdfSave.d.ts

@@ -1,87 +0,0 @@
-/**
- * PDF save orchestration (`docs/PDF-EDITOR-NOW.md` §9.4, §10).
- *
- * Two independent flows live here, both built against the *injected-bridge* function types frozen
- * in `pdfEditModel.ts` (§10.3's "Frozen cross-lane seams" — the real `tauriBridge.ts` Tauri-backed
- * implementations land later at Dispatch D2, so every backend call here is a parameter, never an
- * import):
- *
- *  1. `recomposePdfPreview` (§9.4) — calls an injected `ComposePdfPreview`-shaped function to get
- *     memory-only candidate bytes for the current source-command history, so the on-page display of
- *     committed-but-unsaved edits always renders from the same composer Save itself will use.
- *
- *  2. `createPdfSavePlan` (§10.1/§10.2/§10.3) — the two-phase Save protocol: prepare (Rust composes
- *     + structurally validates a candidate and returns it plus a short-lived token), isolated
- *     pdf.js render-verify (catch corruption client-side before committing), then commit (Rust
- *     atomically replaces bytes). Returns a `PdfSavePlan` (§10.3's exact shape) rather than bare
- *     bytes, so the generic document saver only updates recents/fingerprints/checkpoints after a
- *     real commit succeeds.
- *
- * `verifyPdfCandidate` (§10.2) loads candidate bytes into a FRESH, isolated pdf.js document — never
- * the active on-screen `PDFDocumentProxy` — and renders affected pages to an offscreen canvas before
- * extracting text for the expected-text checks. This mirrors `pdfPrinting.ts`'s isolated-document
- * pattern (pdf.js caches page proxies per document; reusing the live viewer's document risks a
- * second concurrent `render()` against a `PDFPageProxy` it may already be rendering — a hang, not an
- * error). Every await is time-bounded so a stuck pdf.js worker surfaces as a rejected promise
- * (`VerificationFailed`) instead of silence.
- */
-import type { CommitPdfSave, ComposePdfPreview, ComposedPdfPreview, PdfEditCommand, PdfExpectedTextCheck, PdfSavePlan, PreparePdfSave } from "./pdfEditModel.js";
-/** Deps for `recomposePdfPreview` — just the injected bridge call, kept as an object so call sites
- *  read as named fields rather than positional args (matches this module's other `*Deps` shapes). */
-export interface RecomposePdfPreviewDeps {
-    composePdfPreview: ComposePdfPreview;
-}
-/** Recompose the memory-only preview candidate for the given source-command history (§9.4). No
- *  token, no retained candidate, no write — callers re-render affected pages from the returned
- *  bytes inside their existing page slots. Thin by design: the composer decides validity; this
- *  function only shapes the request and forwards the injected call. */
-export declare function recomposePdfPreview(deps: RecomposePdfPreviewDeps, sourcePath: string, expectedSourceSha256: string, sourceCommands: readonly PdfEditCommand[]): Promise<ComposedPdfPreview>;
-/** Thrown by `verifyPdfCandidate` on any renderability/content failure. Callers map this to
- *  `PdfEditError` code `"verification_failed"` (§11) rather than letting a raw pdf.js error surface,
- *  since §11 requires logs to carry "code/page/strategy but no document text" — this type carries a
- *  `page` when the failure is page-scoped and never embeds extracted document text in its message. */
-export declare class PdfCandidateVerificationError extends Error {
-    readonly page: number | null;
-    constructor(message: string, page?: number | null);
-}
-export interface VerifyPdfCandidateArgs {
-    bytes: Uint8Array;
-    pages: readonly number[];
-    expectedText: readonly PdfExpectedTextCheck[];
-}
-/** Render every page in `pages` from a FRESH, isolated pdf.js document built from `bytes` (never the
- *  active on-screen document — see module doc), waiting for each render to fully settle, then check
- *  that every `expectedText` entry's text is present somewhere in that page's extracted text.
- *  Resolves on success; rejects with `PdfCandidateVerificationError` on any load/render/text-check
- *  failure. Always disposes the isolated document via `doc.destroy()`, success or failure, so a
- *  failed verification never leaks a pdf.js worker/document. */
-export declare function verifyPdfCandidate({ bytes, pages, expectedText, }: VerifyPdfCandidateArgs): Promise<void>;
-export interface PdfSaveDeps {
-    preparePdfSave: PreparePdfSave;
-    commitPdfSave: CommitPdfSave;
-    /** Injectable so tests can substitute a fake without mocking pdf.js. Defaults to the real
-     *  `verifyPdfCandidate` above. */
-    verifyCandidate?: (args: VerifyPdfCandidateArgs) => Promise<void>;
-}
-export interface PdfSaveInput {
-    sourcePath: string;
-    expectedSourceSha256: string;
-    annotationPdfBytes: Uint8Array;
-    sourceCommands: readonly PdfEditCommand[];
-}
-/**
- * Runs §10.1 prepare against the injected `preparePdfSave`, then §10.2 isolated pdf.js
- * render-verify against the returned candidate. Returns a `PdfSavePlan` (§10.3's exact shape) only
- * once both steps succeed — `commit` is the only thing that talks to `commitPdfSave`, and it does so
- * lazily so a caller that decides not to commit (e.g. user cancels a Save As target picker between
- * prepare and commit) never invalidates the token by calling it.
- *
- * Token lifecycle (§10.3): the token this returns is single-use, expires after five minutes, and is
- * invalidated by any source revision in between — this module does not retry or re-prepare on a
- * stale-token rejection from `commit_pdf_save`; it surfaces the typed `PdfEditError` (expected code
- * `"write_conflict"` or `"stale_source"` per §11) to the caller, which owns the "start over" UX.
- * `didCommit` intentionally does nothing beyond what `commitPdfSave` already returned — §10.3 gives
- * the generic document saver, not this module, ownership of when recents/fingerprints/checkpoints
- * update, so this hook exists only as the seam that saver calls after using `result`.
- */
-export declare function prepareAndVerifyPdfSave(deps: PdfSaveDeps, input: PdfSaveInput): Promise<PdfSavePlan>;