@rightkit/document-core 0.1.1 → 0.2.0

package/dist/state/tauriBridge.d.ts

@@ -1,5 +1,4 @@
 import { type FileFingerprint, type LoadedDocument } from "../documents/types.js";
-import type { LicenseClient } from "@rightkit/license";
 import { isTauri } from "@rightkit/platform-ui";
 import { type Shell } from "@rightkit/tauri-shell";
 /** True when running inside the Tauri webview (vs. plain `vite dev` in a browser). */
@@ -12,7 +11,6 @@ export declare function getShell(): Shell;
  * reports a copy that did not happen (an absent browser clipboard used to read as success).
  */
 export declare function writeClipboardText(text: string): Promise<void>;
-export declare function isBrowserQaMode(): boolean;
 declare function invoke<T>(cmd: string, args?: Record<string, unknown>): Promise<T>;
 declare function listen<T>(event: string, callback: (event: {
     payload: T;
@@ -26,12 +24,6 @@ export declare const nativeIpc: {
     invoke: typeof invoke;
     listen: typeof listen;
 };
-/**
- * Browser-QA licence client (`@rightkit/license/testing`, in-memory, no network). Returns null
- * outside browser QA, so the caller uses the native client. The `testing` export resolves only
- * under the `development` condition and the call site folds to `false` in a release build.
- */
-export declare function browserQaLicenseClient(): Promise<LicenseClient | null>;
 /** Classified shape every bridge caller can rely on. `code` matches the Rust `HostError`
  *  variant in snake_case (e.g. "broker_denied", "file_not_found"), or "unknown" when the rejection
  *  didn't carry the envelope shape at all (a raw JS Error, a plain string, or something else). */
@@ -79,7 +71,7 @@ export declare function readRelativeScript(docPath: string, rel: string, rootPat
  *  rejection (escapes the granted root, not an openable type). The grant is brokered in Rust. */
 export declare function grantRelativeFile(docPath: string, rel: string, rootPath?: string, siteToken?: string): Promise<string | null>;
 /** Infer and grant this HTML tab's site root (nearest enclosing project directory), returning the
- *  opaque token that backs `viewright-site://` subresource URLs plus the granted directory for
+ *  opaque token that backs `<host id>-site://` subresource URLs plus the granted directory for
  *  display. Returns null outside Tauri, so browser/dev/test builds fall back to inlining. */
 export declare function grantSiteRoot(docPath: string): Promise<{
     token: string;
@@ -111,6 +103,7 @@ export declare function revokePath(path: string): Promise<void>;
 /** Write text, preserving the file's `encoding` (default UTF-8). Returns actual encoding plus the
  *  committed source SHA-256; in-place callers send the prior SHA for stale-source protection. */
 export declare function writeDocument(path: string, content: string, encoding?: string, expectedSourceSha256?: string): Promise<WriteDocumentResult>;
+export declare function byteArrayToBase64(bytes: Uint8Array): string;
 export declare function writeDocumentBytes(path: string, data: ArrayBuffer): Promise<void>;
 /** Copy an already-authorized document to a user-selected write target without decoding or
  * reserializing its bytes. The desktop command owns both broker checks and the filesystem copy so
@@ -119,57 +112,6 @@ export declare function copyDocument(sourcePath: string, targetPath: string): Pr
 /** Open a web/mail link in the system browser (never navigate the app webview away). */
 export declare function openExternal(url: string): Promise<void>;
 export declare function editImageExternal(path: string): Promise<void>;
-import type { ComposePdfPreview, CommitPdfSave, InspectPdfPage, ListPdfFonts, PreparePdfSave } from "../documents/pdf/pdfEditModel.js";
-import type { OcrLine } from "../documents/pdf/pdfOcr.js";
-/** OCR one rasterized PDF page. The PNG is the raw request body, not JSON metadata. */
-export declare const ocrPage: (png: ArrayBuffer | Uint8Array) => Promise<OcrLine[]>;
-/** Probe whether native OCR can be offered. This deliberately returns false outside Tauri instead
- *  of using requireTauriForPdfEdit: callers use it to decide whether to offer recognition at all.
- *  Non-throwing contract: a backend/IPC failure resolves false. */
-export declare const ocrAvailable: () => Promise<boolean>;
-export declare const ocrBackendMissing: () => Promise<boolean>;
-/** §5.2 `inspect_pdf_page`. Walks one page's content stream and returns its authoritative source
- *  graph (islands, locators, digests). `path` must already be a broker-granted read target. */
-export declare const inspectPdfPage: InspectPdfPage;
-/** §7.2 `list_pdf_fonts`. Returns the bundled + system font catalog available for embedding. */
-export declare const listPdfFonts: ListPdfFonts;
-/** §9.4 `compose_pdf_preview`. Memory-only recomposition of staged source commands against fresh
- *  disk bytes, for committed-unsaved-edit preview re-render — no token, no retained candidate, no
- *  writes. Candidate bytes use JSON; affected pages derive from request commands. */
-export declare const composePdfPreview: ComposePdfPreview;
-/** §10.1 `prepare_pdf_save`. The frozen frontend `PreparePdfSave` type (`pdfEditModel.ts`) expects
- *  one call returning `PreparedPdfSave` (metadata + `candidateBytes` together), but the actual Rust
- *  implementation returns candidate bytes as a numeric JSON array because WKWebView cannot
- *  reliably consume this staged candidate through Tauri's raw-response or large-base64 paths.
- *
- *  Judgment call: this bridge function internally calls both backend commands in sequence and
- *  combines their results into the single `PreparedPdfSave` shape B7's `pdfSave.ts` was written
- *  against, so the frozen frontend type/signature is satisfied without B7 needing to know about the
- *  two-call split. `expectedText` field names (`page`/`text`) come from the backend's
- *  `ExpectedTextCheck { page, text }`; mapped here to `pdfEditModel.ts`'s `PdfExpectedTextCheck`
- *  shape (`page`/`islandId`/`expectedText`) — no `islandId` exists in the backend response, so it is
- *  populated as an empty string (the backend recheck matches by page + text substring only, not by
- *  island id; see `pdf_save.rs`'s `structurally_verify_candidate`). */
-export declare const preparePdfSave: PreparePdfSave;
-/** §10.3 `commit_pdf_save`. Consumes the single-use save token and atomically writes the staged
- *  candidate to `targetPath` (or back to the original source path for a same-path Save). The
- *  backend's `PdfCommitResult` (`pdf_save.rs`) carries only `{ targetPath, documentSha256 }` — it
- *  has no `revision`/`affectedPages` fields, unlike the richer shape `pdfEditModel.ts` sketches as
- *  "inferred" (that file's own comment flags this exact field set as not given anywhere in the
- *  contract text). Rather than fabricate an `affectedPages`/`revision` this command never returns,
- *  this bridge function follows the caller-refresh pattern already used elsewhere in this file
- *  (e.g. `readDocument`'s post-write re-read): the caller (`pdfSave.ts`) is expected to re-run
- *  `inspectPdfPage` per page after a successful commit to obtain a fresh revision, rather than this
- *  bridge inventing data. `committedPath`/`committedSha256` map 1:1 from the backend's
- *  `targetPath`/`documentSha256`; `affectedPages` is returned empty and `revision` as an
- *  empty-pages placeholder so the return type still satisfies `PdfCommitResult` structurally. */
-export declare const commitPdfSave: CommitPdfSave;
-/** Browser-QA-only: current bytes of the in-memory QA PDF "disk" at `path`, or `null` outside QA
- *  mode / for an untouched path. PdfViewer.tsx's post-commit reload uses this instead of
- *  re-fetching its `url` prop — a real Tauri stream token is a revocable token that re-resolves to
- *  the same (now-committed) file on every fetch, but browser QA's `url` is a static `data:` URL
- *  captured once at document-open time, which can never reflect a later commit on its own. */
-export declare function qaReloadPdfBytes(path: string): Promise<Uint8Array | null>;
 export declare function setInspectableHtmlPreview(token: string | null): void;
 /** Clear the DevTools owner, but only if `token` still owns it (a newer frame may have replaced it). */
 export declare function releaseInspectableHtmlPreview(token: string): void;
@@ -177,7 +119,7 @@ export declare function releaseInspectableHtmlPreview(token: string): void;
  *  content window that has no IPC, and the shell opens that window's inspector (decision D2). The
  *  main webview is never inspectable. No-op without an active HTML preview or outside Tauri. */
 export declare function openDevtools(): Promise<void>;
-/** No-op: the macOS inspect-accelerator scope command was removed with the shell port (viewright#375). */
+/** No-op: the macOS inspect-accelerator scope command was removed with the shell port (host shell port). */
 export declare function setDevtoolsShortcutScope(_enabled: boolean): Promise<void>;
 export declare function revealInFileExplorer(path: string): Promise<void>;
 /** What the clipboard held when "Open from clipboard" / paste ran. Files win, then a bitmap (written

package/dist/state/tauriBridge.js

@@ -1,14 +1,7 @@
 import { baseName, formatFromPath, normalizeViewMode, } from "../documents/types.js";
 import { isTauri } from "@rightkit/platform-ui";
 import { createShell } from "@rightkit/tauri-shell";
-// Browser-QA fixture modules load on demand. Every call site sits behind `BROWSER_QA_BUILD` (a
-// build-time constant), so production builds fold the guard to `false`, drop these dynamic imports,
-// and never emit the fixture chunks. Keep static imports of these modules out of this file.
-const loadQaFixtures = () => import("./browserQa.js");
-const loadQaText = () => import("./browserQaText.js");
-const loadQaDocx = () => import("./browserQaDocx.js");
-const loadQaPdf = () => import("./browserQaPdf.js");
-const loadQaLicense = () => import("./browserQaLicense.js");
+import { hostHeader, hostScheme } from "../host.js";
 /** True when running inside the Tauri webview (vs. plain `vite dev` in a browser). */
 const inTauri = isTauri;
 let shell = null;
@@ -17,13 +10,6 @@ export function getShell() {
     shell ??= createShell();
     return shell;
 }
-/**
- * Build-time switch for the browser-QA fixtures: `true` in `vite dev` and in the
- * `VITE_RIGHTKIT_BROWSER_QA=1` build, a literal `false` in production builds. Every QA branch in
- * this module is guarded with it, so the minifier drops those branches and nothing references the
- * `browserQa*` fixture modules in a production bundle.
- */
-const BROWSER_QA_BUILD = import.meta.env?.DEV || import.meta.env?.VITE_RIGHTKIT_BROWSER_QA === "1";
 /**
  * Write text to the system clipboard: through the shell's native clipboard in the app, through the
  * browser clipboard in browser QA. It rejects when no clipboard is available, so a caller never
@@ -39,15 +25,6 @@ export async function writeClipboardText(text) {
     }
     await navigator.clipboard.writeText(text);
 }
-export function isBrowserQaMode() {
-    const qaBuild = import.meta.env?.VITE_RIGHTKIT_BROWSER_QA === "1";
-    if (!import.meta.env?.DEV && !qaBuild)
-        return false;
-    if (typeof window === "undefined" || inTauri())
-        return false;
-    const params = new URLSearchParams(window.location.search);
-    return params.has("qa") || qaBuild;
-}
 async function invoke(cmd, args) {
     const { invoke } = await import("@tauri-apps/api/core");
     return invoke(cmd, args);
@@ -62,16 +39,6 @@ async function listen(event, callback) {
  * update Bearer; the webview only sends commands and receives validated display views.
  */
 export const nativeIpc = { invoke, listen };
-/**
- * Browser-QA licence client (`@rightkit/license/testing`, in-memory, no network). Returns null
- * outside browser QA, so the caller uses the native client. The `testing` export resolves only
- * under the `development` condition and the call site folds to `false` in a release build.
- */
-export async function browserQaLicenseClient() {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return (await loadQaLicense()).qaLicenseClient();
-    return null;
-}
 /** Classify an IPC rejection from `invoke()` into `{code, message}`. Tauri serializes a command's
  *  `Err(HostError)` using the envelope's own `#[serde(tag = "code", content = "message")]`
  *  representation, so a migrated command's rejection value IS already `{code, message}` — this
@@ -97,9 +64,6 @@ export function parseHostError(e) {
     return { code: "unknown", message: String(e) };
 }
 export async function openFileDialog() {
-    if (BROWSER_QA_BUILD && isBrowserQaMode()) {
-        return (await loadQaFixtures()).qaDialogPath();
-    }
     if (!inTauri()) {
         console.warn("openFileDialog: not in Tauri — open a real document via `pnpm tauri dev`.");
         return null;
@@ -108,27 +72,6 @@ export async function openFileDialog() {
 }
 export async function readDocument(path) {
     const format = formatFromPath(path);
-    if (BROWSER_QA_BUILD && isBrowserQaMode()) {
-        const qaDocx = await loadQaDocx();
-        const qaText = await loadQaText();
-        const savedDocx = qaDocx.readQaDocxDocument({
-            path,
-            displayName: baseName(path),
-            format,
-            content: "",
-        });
-        if (savedDocx)
-            return savedDocx;
-        const doc = await (await loadQaFixtures()).qaDocumentForPath(path);
-        if (doc) {
-            if (format === "pdf") {
-                const assetUrl = await (await loadQaPdf()).qaCurrentPdfAssetUrl(path);
-                return { ...doc, assetUrl: assetUrl ?? doc.assetUrl };
-            }
-            return qaText.readQaTextDocument(doc);
-        }
-        return qaText.readQaTextDocument({ path, displayName: baseName(path), format, content: "" });
-    }
     if (!inTauri()) {
         return { path, displayName: baseName(path), format, content: "" };
     }
@@ -140,7 +83,7 @@ export async function readDocument(path) {
         const { convertFileSrc } = await import("@tauri-apps/api/core");
         if (!raw.stream_token)
             throw new Error("binary stream token missing");
-        assetUrl = `${convertFileSrc(raw.stream_token, "viewright-stream")}?t=${Date.now()}`;
+        assetUrl = `${convertFileSrc(raw.stream_token, hostScheme("stream"))}?t=${Date.now()}`;
     }
     let viewMeta;
     if (raw.view_meta) {
@@ -191,10 +134,6 @@ export async function getPersistenceStatus() {
     return { degraded: status.degraded === true, quarantinedTo: status.quarantined_to ?? null };
 }
 export async function getInitialOpenPaths() {
-    if (BROWSER_QA_BUILD && isBrowserQaMode()) {
-        const path = (await loadQaFixtures()).qaInitialOpenPath();
-        return path ? [path] : [];
-    }
     if (!inTauri())
         return [];
     // The shell's open-paths gate: it grants and drains what argv / a second launch / macOS
@@ -245,7 +184,7 @@ export async function grantRelativeFile(docPath, rel, rootPath, siteToken) {
     }
 }
 /** Infer and grant this HTML tab's site root (nearest enclosing project directory), returning the
- *  opaque token that backs `viewright-site://` subresource URLs plus the granted directory for
+ *  opaque token that backs `<host id>-site://` subresource URLs plus the granted directory for
  *  display. Returns null outside Tauri, so browser/dev/test builds fall back to inlining. */
 export async function grantSiteRoot(docPath) {
     if (!inTauri())
@@ -325,8 +264,6 @@ export async function revokePath(path) {
 /** Write text, preserving the file's `encoding` (default UTF-8). Returns actual encoding plus the
  *  committed source SHA-256; in-place callers send the prior SHA for stale-source protection. */
 export async function writeDocument(path, content, encoding, expectedSourceSha256) {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return (await loadQaText()).writeQaTextDocument(path, content, encoding, expectedSourceSha256);
     if (!inTauri())
         throw new Error("Saving requires the desktop app.");
     const result = await invoke("write_document", {
@@ -344,10 +281,7 @@ export async function writeDocument(path, content, encoding, expectedSourceSha25
 // changing writeDocumentBytes's contract (out of scope here) — and a 32k-arg spread/apply call is
 // exactly the call-stack-pressure risk the loop below was already written to avoid. Not a clear
 // improvement, so kept unchanged per the audit's own guidance.
-function arrayBufferToBase64(ab) {
-    return byteArrayToBase64(new Uint8Array(ab));
-}
-function byteArrayToBase64(bytes) {
+export function byteArrayToBase64(bytes) {
     let bin = "";
     const chunk = 0x8000;
     for (let i = 0; i < bytes.length; i += chunk) {
@@ -362,18 +296,13 @@ function byteArrayToBase64(bytes) {
     return btoa(bin);
 }
 export async function writeDocumentBytes(path, data) {
-    if (BROWSER_QA_BUILD && isBrowserQaMode()) {
-        if (formatFromPath(path) === "docx")
-            await (await loadQaDocx()).writeQaDocxDocument(path, data, arrayBufferToBase64(data));
-        return;
-    }
     if (!inTauri())
         throw new Error("Saving requires the desktop app.");
     // Raw request body (like ocr_page): the DOCX bytes cross IPC as-is, with no JS base64 encode on
     // the main thread. The target path rides in a hex header so any filesystem path is header-safe.
     const { invoke: tauriInvoke } = await import("@tauri-apps/api/core");
     await tauriInvoke("write_document_base64", new Uint8Array(data), {
-        headers: { "x-viewright-path-hex": pathToHex(path) },
+        headers: { [hostHeader("path-hex")]: pathToHex(path) },
     });
 }
 function pathToHex(path) {
@@ -386,8 +315,6 @@ function pathToHex(path) {
  * reserializing its bytes. The desktop command owns both broker checks and the filesystem copy so
  * PDF Save As preserves signatures, encryption, widgets, and any bytes pdf.js cannot round-trip. */
 export async function copyDocument(sourcePath, targetPath) {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return;
     if (!inTauri())
         throw new Error("Saving requires the desktop app.");
     await invoke("copy_document", { sourcePath, targetPath });
@@ -412,191 +339,6 @@ export async function editImageExternal(path) {
         return;
     await invoke("edit_image_external", { path });
 }
-import { hostAppName } from "../appName.js";
-if (BROWSER_QA_BUILD && isBrowserQaMode())
-    void loadQaPdf().then((qaPdf) => qaPdf.registerViewrightQaGlobal());
-/** Normalizes an `invoke()` raw-body result (an `ArrayBuffer`, or occasionally already a
- *  `Uint8Array`/plain byte array depending on Tauri's IPC transport) into a `Uint8Array`. */
-function toUint8Array(body) {
-    if (body instanceof Uint8Array)
-        return body;
-    if (body instanceof ArrayBuffer)
-        return new Uint8Array(body);
-    if (Array.isArray(body))
-        return new Uint8Array(body);
-    throw new Error("Expected a raw byte response from the PDF bridge.");
-}
-/** Every other bridge function in this file short-circuits outside a real Tauri webview
- *  (`readDocument`, `fileFingerprint`, `getInitialOpenPaths`, …) rather than letting `invoke()`'s
- *  dynamic `@tauri-apps/api/core` import reach into `window.__TAURI_INTERNALS__`, which is
- *  `undefined` there and throws a raw, unclassified "Cannot read properties of undefined (reading
- *  'invoke')" instead of a `ClassifiedError` a caller's existing catch/`errorMessage` handling can
- *  show meaningfully. These six PDF-editor commands have no browser-QA fixture to fall back to
- *  (unlike `readDocument`'s `qaDocumentForPath`) — a real Rust backend is unavoidable for source
- *  inspection/composition/save — so the correct graceful behavior is a clean, classified rejection
- *  rather than either a raw crash or a fabricated result. */
-function requireTauriForPdfEdit(command) {
-    if (!inTauri()) {
-        throw { code: "unsupported_outside_tauri", message: `${command} requires the native app` };
-    }
-}
-/** OCR one rasterized PDF page. The PNG is the raw request body, not JSON metadata. */
-export const ocrPage = async (png) => {
-    // Browser QA has no Rust OCR backend, so the IPC-boundary fixture keeps the scanned-page UI
-    // exercisable without moving a mock into the document components.
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return (await loadQaFixtures()).qaOcrLines();
-    requireTauriForPdfEdit("ocr_page");
-    const { invoke: tauriInvoke } = await import("@tauri-apps/api/core");
-    return tauriInvoke("ocr_page", png);
-};
-// Cached OCR-capability probe. OCR capability cannot change mid-session, so N concurrent
-// PdfViewer mounts share ONE `ocr_available` invoke instead of one IPC each. A failed probe is
-// NOT cached (reset below) — the next caller retries instead of pinning a transient IPC error.
-let ocrAvailableProbe = null;
-/** Probe whether native OCR can be offered. This deliberately returns false outside Tauri instead
- *  of using requireTauriForPdfEdit: callers use it to decide whether to offer recognition at all.
- *  Non-throwing contract: a backend/IPC failure resolves false. */
-export const ocrAvailable = () => {
-    // Browser QA has no Rust OCR backend, so the IPC-boundary fixture keeps the scanned-page UI
-    // exercisable without moving a mock into the document components.
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return Promise.resolve(true);
-    if (!inTauri())
-        return Promise.resolve(false);
-    ocrAvailableProbe ??= invoke("ocr_available").catch(() => {
-        ocrAvailableProbe = null;
-        return false;
-    });
-    return ocrAvailableProbe;
-};
-/** True only when the backend answered that this machine has no OCR. A timeout, an IPC failure or
- *  running outside Tauri is not an answer: OCR stays offered and the run itself reports the
- *  failure. Only a real answer is cached for the session. */
-let ocrBackendAnswer = null;
-export const ocrBackendMissing = () => {
-    if (!inTauri())
-        return Promise.resolve(false);
-    ocrBackendAnswer ??= invoke("ocr_available").then((available) => available === false, () => {
-        ocrBackendAnswer = null;
-        return false;
-    });
-    return ocrBackendAnswer;
-};
-/** §5.2 `inspect_pdf_page`. Walks one page's content stream and returns its authoritative source
- *  graph (islands, locators, digests). `path` must already be a broker-granted read target. */
-export const inspectPdfPage = async (path, page) => {
-    // Browser QA has no Rust content-stream walker, so the IPC-boundary fixture keeps Edit-text mode
-    // reachable/non-crashing (islands always empty — source-text editing stays native-only).
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return (await loadQaPdf()).qaInspectPdfPage(path, page);
-    requireTauriForPdfEdit("inspect_pdf_page");
-    return invoke("inspect_pdf_page", { path, page });
-};
-/** §7.2 `list_pdf_fonts`. Returns the bundled + system font catalog available for embedding. */
-export const listPdfFonts = async () => {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return (await loadQaPdf()).qaListPdfFonts();
-    requireTauriForPdfEdit("list_pdf_fonts");
-    return invoke("list_pdf_fonts");
-};
-/** §9.4 `compose_pdf_preview`. Memory-only recomposition of staged source commands against fresh
- *  disk bytes, for committed-unsaved-edit preview re-render — no token, no retained candidate, no
- *  writes. Candidate bytes use JSON; affected pages derive from request commands. */
-export const composePdfPreview = async (request) => {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return (await loadQaPdf()).qaComposePdfPreview(request);
-    requireTauriForPdfEdit("compose_pdf_preview");
-    const body = await invoke("compose_pdf_preview", {
-        request: {
-            sourcePath: request.sourcePath,
-            expectedSourceSha256: request.expectedSourceSha256,
-            sourceCommands: request.sourceCommands,
-        },
-    });
-    const pages = new Set();
-    for (const command of request.sourceCommands) {
-        pages.add(command.kind === "replaceSourceText" ? command.locator.page : command.page);
-    }
-    return {
-        candidateBytes: toUint8Array(body),
-        affectedPages: Array.from(pages).sort((a, b) => a - b),
-    };
-};
-/** §10.1 `prepare_pdf_save`. The frozen frontend `PreparePdfSave` type (`pdfEditModel.ts`) expects
- *  one call returning `PreparedPdfSave` (metadata + `candidateBytes` together), but the actual Rust
- *  implementation returns candidate bytes as a numeric JSON array because WKWebView cannot
- *  reliably consume this staged candidate through Tauri's raw-response or large-base64 paths.
- *
- *  Judgment call: this bridge function internally calls both backend commands in sequence and
- *  combines their results into the single `PreparedPdfSave` shape B7's `pdfSave.ts` was written
- *  against, so the frozen frontend type/signature is satisfied without B7 needing to know about the
- *  two-call split. `expectedText` field names (`page`/`text`) come from the backend's
- *  `ExpectedTextCheck { page, text }`; mapped here to `pdfEditModel.ts`'s `PdfExpectedTextCheck`
- *  shape (`page`/`islandId`/`expectedText`) — no `islandId` exists in the backend response, so it is
- *  populated as an empty string (the backend recheck matches by page + text substring only, not by
- *  island id; see `pdf_save.rs`'s `structurally_verify_candidate`). */
-export const preparePdfSave = async (request) => {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return (await loadQaPdf()).qaPreparePdfSave(request);
-    requireTauriForPdfEdit("prepare_pdf_save");
-    const meta = await invoke("prepare_pdf_save", {
-        request: {
-            sourcePath: request.sourcePath,
-            expectedSourceSha256: request.expectedSourceSha256,
-            annotationPdfBase64: byteArrayToBase64(request.annotationPdfBytes),
-            sourceCommands: request.sourceCommands,
-        },
-    });
-    return {
-        token: meta.token,
-        candidateSha256: meta.candidateSha256,
-        candidateBytes: Uint8Array.from(meta.candidateBytes),
-        affectedPages: meta.affectedPages,
-        expectedText: meta.expectedText.map((check) => ({
-            page: check.page,
-            islandId: "",
-            expectedText: check.text,
-        })),
-    };
-};
-/** §10.3 `commit_pdf_save`. Consumes the single-use save token and atomically writes the staged
- *  candidate to `targetPath` (or back to the original source path for a same-path Save). The
- *  backend's `PdfCommitResult` (`pdf_save.rs`) carries only `{ targetPath, documentSha256 }` — it
- *  has no `revision`/`affectedPages` fields, unlike the richer shape `pdfEditModel.ts` sketches as
- *  "inferred" (that file's own comment flags this exact field set as not given anywhere in the
- *  contract text). Rather than fabricate an `affectedPages`/`revision` this command never returns,
- *  this bridge function follows the caller-refresh pattern already used elsewhere in this file
- *  (e.g. `readDocument`'s post-write re-read): the caller (`pdfSave.ts`) is expected to re-run
- *  `inspectPdfPage` per page after a successful commit to obtain a fresh revision, rather than this
- *  bridge inventing data. `committedPath`/`committedSha256` map 1:1 from the backend's
- *  `targetPath`/`documentSha256`; `affectedPages` is returned empty and `revision` as an
- *  empty-pages placeholder so the return type still satisfies `PdfCommitResult` structurally. */
-export const commitPdfSave = async (token, targetPath) => {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return (await loadQaPdf()).qaCommitPdfSave(token, targetPath);
-    requireTauriForPdfEdit("commit_pdf_save");
-    const result = await invoke("commit_pdf_save", {
-        token,
-        targetPath: targetPath ?? null,
-    });
-    return {
-        committedPath: result.targetPath,
-        committedSha256: result.documentSha256,
-        affectedPages: [],
-        revision: { documentSha256: result.documentSha256, pageCount: 0, pages: [] },
-    };
-};
-/** Browser-QA-only: current bytes of the in-memory QA PDF "disk" at `path`, or `null` outside QA
- *  mode / for an untouched path. PdfViewer.tsx's post-commit reload uses this instead of
- *  re-fetching its `url` prop — a real Tauri stream token is a revocable token that re-resolves to
- *  the same (now-committed) file on every fetch, but browser QA's `url` is a static `data:` URL
- *  captured once at document-open time, which can never reflect a later commit on its own. */
-export async function qaReloadPdfBytes(path) {
-    if (!BROWSER_QA_BUILD || !isBrowserQaMode())
-        return null;
-    return (await loadQaPdf()).qaCurrentPdfBytes(path);
-}
 /** Token of the interactive HTML preview that currently owns DevTools (the active tab's frame), or
  *  null. Set by the HTML preview frame; DevTools opens exactly that registered document. */
 let inspectableHtmlToken = null;
@@ -613,14 +355,14 @@ export function releaseInspectableHtmlPreview(token) {
  *  main webview is never inspectable. No-op without an active HTML preview or outside Tauri. */
 export async function openDevtools() {
     const token = inspectableHtmlToken;
-    if (!token || (BROWSER_QA_BUILD && isBrowserQaMode()) || !inTauri())
+    if (!token || !inTauri())
         return;
     await invoke("open_html_devtools", { token });
 }
-/** No-op: the macOS inspect-accelerator scope command was removed with the shell port (viewright#375). */
+/** No-op: the macOS inspect-accelerator scope command was removed with the shell port (host shell port). */
 export async function setDevtoolsShortcutScope(_enabled) { }
 export async function revealInFileExplorer(path) {
-    if ((BROWSER_QA_BUILD && isBrowserQaMode()) || !inTauri())
+    if (!inTauri())
         return;
     await invoke("reveal_in_file_explorer", { path });
 }
@@ -651,24 +393,10 @@ export async function printCurrentWebview() {
     }
 }
 export async function listSystemFonts() {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return ["Inter", "Source Serif 4", "JetBrains Mono", "Geist", "Newsreader"];
     if (!inTauri())
         return [];
     return invoke("list_system_fonts");
 }
-const QA_FILE_ASSOCIATION_FORMATS = ["md", "mdx", "txt", "pdf", "html", "docx", "image"];
-let qaPreferredAssociationFormats = new Set(["md", "mdx"]);
-function qaFileAssociationStatus() {
-    return {
-        formats: QA_FILE_ASSOCIATION_FORMATS.map((formatId) => ({
-            formatId,
-            extensions: [],
-            handlers: [],
-            allSet: qaPreferredAssociationFormats.has(formatId),
-        })),
-    };
-}
 function toFormatStatus(group) {
     return {
         formatId: group.id,
@@ -682,17 +410,10 @@ function toFormatStatus(group) {
     };
 }
 export async function fileAssociationStatus() {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return qaFileAssociationStatus();
     const status = await getShell().associations.status();
     return { formats: status.groups.map(toFormatStatus) };
 }
 export async function setFileAssociationDefaults(formatIds) {
-    if (BROWSER_QA_BUILD && isBrowserQaMode()) {
-        qaPreferredAssociationFormats = new Set(formatIds);
-        const status = qaFileAssociationStatus();
-        return { formats: status.formats, allSet: formatIds.length > 0 };
-    }
     // macOS: one NSWorkspace request per content type (system consent sheet), one shared 60 s
     // deadline (the shell default; the host clamps a given value to 1 to 120 s).
     const result = await getShell().associations.set(formatIds);
@@ -701,8 +422,6 @@ export async function setFileAssociationDefaults(formatIds) {
 /** Windows owns protected default-app choices. This opens Windows Default apps; the shell never
  * writes UserChoice registry hashes or claims a default changed. */
 export async function openFileAssociationSettings(_formatIds) {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return;
     await getShell().associations.openDefaultApps();
 }
 export async function saveSession(tabs) {
@@ -818,15 +537,11 @@ export function installExternalLinkGuard() {
     });
 }
 export async function saveFileDialog(defaultName, format) {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return `D:\\${hostAppName()} QA\\${defaultName ?? `untitled.${format ?? "txt"}`}`;
     if (!inTauri())
         return null;
     return invoke("save_file_dialog", { defaultName, format });
 }
 export async function grantKnownFileToken(token) {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return token;
     if (!inTauri())
         return null;
     return invoke("grant_known_file_token", { token });
@@ -840,15 +555,11 @@ export async function grantKnownFileToken(token) {
 //   - regrantSavedTarget: re-grant a path the host app itself just wrote (save-as, duplicate, DOCX
 //     save-as) — refused unless the exact path was written in the last few writes.
 export async function openLinkedDocument(target, from) {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return target;
     if (!inTauri())
         return null;
     return invoke("open_linked_document", { target, from: from ?? null });
 }
 export async function regrantSavedTarget(path) {
-    if (BROWSER_QA_BUILD && isBrowserQaMode())
-        return path;
     if (!inTauri())
         return null;
     return invoke("regrant_saved_target", { path });

package/dist/styles.css

@@ -1,2 +1,2 @@
-/* Every stylesheet this package's components use. Hosts import "<package>/styles.css" once (Node cannot import CSS from JS). */
-@import "pdfjs-dist/web/pdf_viewer.css";
+/* The editor base ships no stylesheet of its own. The PDF viewer styles (pdf.js `pdf_viewer.css`) moved
+   with the PDF editor to @rightkit/document-workspace in 0.2.0; this file stays so `<package>/styles.css` keeps resolving. */