@signiphi/pdf-signer 0.2.0-beta.30 → 0.2.0-beta.31

package/dist/components/SubmissionForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SubmissionForm.d.ts","sourceRoot":"","sources":["../../src/components/SubmissionForm.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAwC,MAAM,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AA6B3K,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,qDAAqD;IACrD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,cAAc,EAAE,CAAC;IACpC,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qEAAqE;IACrE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,6FAA6F;IAC7F,qBAAqB,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAClD,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;QAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAChG,gHAAgH;IAChH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,WAAW,EAAE,gBAAgB,EAAE,CAAC;QAChC,QAAQ,EAAE,UAAU,CAAC;KACtB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IAE7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAGrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,cAAc,CAAC,EAC7B,MAAM,EACN,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAAE,yBAAyB;AAC7C,aAAa,EACb,mBAAmB,EACnB,aAAoB,EACpB,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,QAAgB,EAChB,SAAc,EACd,aAAoB,EACpB,gBAAgB,EAChB,kBAA0B,EAC1B,qBAA6B,EAC7B,qBAA6B,EAC7B,iBAAyB,EACzB,cAAmB,EACnB,oBAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,gBAAwB,EACxB,eAAe,EACf,0BAA0B,EAC1B,wBAA8C,EAC9C,IAAI,EACJ,UAAU,EAAE,cAAc,EAC1B,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,EAAE,mBAAmB,2CAg0GrB"}
+{"version":3,"file":"SubmissionForm.d.ts","sourceRoot":"","sources":["../../src/components/SubmissionForm.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAwC,MAAM,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AA6B3K,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,qDAAqD;IACrD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,cAAc,EAAE,CAAC;IACpC,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qEAAqE;IACrE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,6FAA6F;IAC7F,qBAAqB,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAClD,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;QAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAChG,gHAAgH;IAChH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,WAAW,EAAE,gBAAgB,EAAE,CAAC;QAChC,QAAQ,EAAE,UAAU,CAAC;KACtB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IAE7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAGrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,cAAc,CAAC,EAC7B,MAAM,EACN,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAAE,yBAAyB;AAC7C,aAAa,EACb,mBAAmB,EACnB,aAAoB,EACpB,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,QAAgB,EAChB,SAAc,EACd,aAAoB,EACpB,gBAAgB,EAChB,kBAA0B,EAC1B,qBAA6B,EAC7B,qBAA6B,EAC7B,iBAAyB,EACzB,cAAmB,EACnB,oBAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,gBAAwB,EACxB,eAAe,EACf,0BAA0B,EAC1B,wBAA8C,EAC9C,IAAI,EACJ,UAAU,EAAE,cAAc,EAC1B,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,EAAE,mBAAmB,2CA+zGrB"}

package/dist/components/index.js

@@ -2827,12 +2827,43 @@ function assertSigningSourceIsClean(params) {
   }
 }
 var REVIEW_MARKUP_SUBTYPES = /* @__PURE__ */ new Set(["Highlight", "FreeText", "Ink", "Stamp", "Text"]);
-async function hasBakedReviewMarkup(pdfBytes, ignoreIds) {
-  const { PDFDocument, PDFName: PDFName3, PDFArray, PDFDict, PDFRef } = await loadPdfLib();
+var REVIEW_MARKER_KEY = "SigniphiReview";
+var RECT_MATCH_EPSILON = 1;
+function rectsMatch(a, b) {
+  const norm = (r) => [
+    Math.min(r[0], r[2]),
+    Math.min(r[1], r[3]),
+    Math.max(r[0], r[2]),
+    Math.max(r[1], r[3])
+  ];
+  const na = norm(a);
+  const nb = norm(b);
+  return na.every((v, i) => Math.abs(v - nb[i]) <= RECT_MATCH_EPSILON);
+}
+function sourceNativeMarkDescriptors(threads) {
+  const out = [];
+  for (const t of threads) {
+    const a = t.annotation;
+    if (!a.sourceAnnotationId) continue;
+    const rect = a.position?.rect;
+    if (!rect || rect.length < 4) continue;
+    out.push({
+      subtype: ANNOTATION_SUBTYPE_MAP[a.type] || "Text",
+      pageIndex: (a.position.pageNumber ?? 1) - 1,
+      rect: rect.slice(0, 4)
+    });
+  }
+  return out;
+}
+async function hasBakedReviewMarkup(pdfBytes, allowedSourceMarks) {
+  const { PDFDocument, PDFName: PDFName3, PDFArray, PDFDict, PDFRef, PDFNumber } = await loadPdfLib();
   const pdfDoc = await PDFDocument.load(pdfBytes);
   const markup = [];
   const byTag = /* @__PURE__ */ new Map();
-  for (const page of pdfDoc.getPages()) {
+  const pages = pdfDoc.getPages();
+  for (let pageIndex = 0; pageIndex < pages.length; pageIndex++) {
+    const page = pages[pageIndex];
+    if (!page) continue;
     const annots = page.node.lookupMaybe(PDFName3.of("Annots"), PDFArray);
     if (!annots) continue;
     for (let i = 0; i < annots.size(); i++) {
@@ -2844,47 +2875,64 @@ async function hasBakedReviewMarkup(pdfBytes, ignoreIds) {
         continue;
       }
       const irt = dict.get(PDFName3.of("IRT"));
+      const rt = dict.get(PDFName3.of("RT"));
+      const rectArr = dict.lookup(PDFName3.of("Rect"));
+      let rect = null;
+      if (rectArr instanceof PDFArray && rectArr.size() >= 4) {
+        const values = [];
+        for (let j = 0; j < 4; j++) {
+          const n = rectArr.lookup(j);
+          if (n instanceof PDFNumber) values.push(n.asNumber());
+        }
+        if (values.length === 4) rect = values;
+      }
+      const subtypeText = subtype.decodeText();
       const record = {
-        id: entry instanceof PDFRef ? pdfJsRefId(entry) : null,
+        subtype: subtypeText,
+        pageIndex,
+        rect,
         irtTag: irt instanceof PDFRef ? irt.toString() : null,
-        tag: entry instanceof PDFRef ? entry.toString() : null
+        tag: entry instanceof PDFRef ? entry.toString() : null,
+        marker: dict.get(PDFName3.of(REVIEW_MARKER_KEY)) !== void 0,
+        replyShaped: subtypeText === "Text" || rt instanceof PDFName3 && rt.decodeText() === "Group"
       };
       markup.push(record);
       if (record.tag) byTag.set(record.tag, record);
     }
   }
   if (markup.length === 0) return false;
-  if (!ignoreIds?.size) return true;
-  const rootId = (m) => {
-    let current = m;
-    for (let hops = 0; current.irtTag && hops < 64; hops++) {
-      const parent = byTag.get(current.irtTag);
-      if (!parent) break;
-      current = parent;
-    }
-    return current.id;
+  if (!allowedSourceMarks?.length) return true;
+  const matchesDescriptor = (m) => m.rect !== null && allowedSourceMarks.some(
+    (d) => d.subtype === m.subtype && d.pageIndex === m.pageIndex && rectsMatch(d.rect, m.rect)
+  );
+  const isExempt = (m, hops = 0) => {
+    if (m.marker) return false;
+    if (matchesDescriptor(m)) return true;
+    if (!m.replyShaped || !m.irtTag || hops >= 64) return false;
+    const parent = byTag.get(m.irtTag);
+    return parent !== void 0 && parent !== m && isExempt(parent, hops + 1);
   };
-  for (const m of markup) {
-    const id = rootId(m);
-    if (!id || !ignoreIds.has(id)) return true;
-  }
-  return false;
+  return markup.some((m) => !isExempt(m));
 }
 function pdfJsRefId(ref) {
   return `${ref.objectNumber}R${ref.generationNumber === 0 ? "" : ref.generationNumber}`;
 }
 async function removeMarkupAnnotations(pdfBytes, options) {
-  const { PDFDocument, PDFName: PDFName3, PDFArray, PDFDict, PDFRef } = await loadPdfLib();
+  const { PDFDocument, PDFName: PDFName3, PDFArray, PDFDict, PDFRef, PDFNumber } = await loadPdfLib();
   const pdfDoc = await PDFDocument.load(pdfBytes);
   const keepIds = options?.keepIds ?? /* @__PURE__ */ new Set();
+  const keepDescriptors = options?.keepDescriptors ?? [];
   const subtypeName = PDFName3.of("Subtype");
   const irtName = PDFName3.of("IRT");
+  const rtName = PDFName3.of("RT");
   const popupName = PDFName3.of("Popup");
   const parentName = PDFName3.of("Parent");
   const annotsName = PDFName3.of("Annots");
   const markupByTag = /* @__PURE__ */ new Map();
   const pages = pdfDoc.getPages();
-  for (const page of pages) {
+  for (let pageIndex = 0; pageIndex < pages.length; pageIndex++) {
+    const page = pages[pageIndex];
+    if (!page) continue;
     const annots = page.node.lookupMaybe(annotsName, PDFArray);
     if (!annots) continue;
     for (let i = 0; i < annots.size(); i++) {
@@ -2894,9 +2942,59 @@ async function removeMarkupAnnotations(pdfBytes, options) {
       if (!(dict instanceof PDFDict)) continue;
       const subtype = dict.get(subtypeName);
       if (subtype instanceof PDFName3 && REVIEW_MARKUP_SUBTYPES.has(subtype.decodeText())) {
-        markupByTag.set(entry.toString(), { ref: entry, dict });
+        const rectArr = dict.lookup(PDFName3.of("Rect"));
+        let rect = null;
+        if (rectArr instanceof PDFArray && rectArr.size() >= 4) {
+          const values = [];
+          for (let j = 0; j < 4; j++) {
+            const n = rectArr.lookup(j);
+            if (n instanceof PDFNumber) values.push(n.asNumber());
+          }
+          if (values.length === 4) rect = values;
+        }
+        markupByTag.set(entry.toString(), {
+          ref: entry,
+          dict,
+          subtype: subtype.decodeText(),
+          pageIndex,
+          rect
+        });
+      }
+    }
+  }
+  const isChainChild = (entry) => {
+    const irt = entry.dict.get(irtName);
+    return irt instanceof PDFRef && markupByTag.has(irt.toString());
+  };
+  const matchingDescriptorIndices = (entry) => {
+    if (!entry.rect) return [];
+    const indices = [];
+    for (let i = 0; i < keepDescriptors.length; i++) {
+      const d = keepDescriptors[i];
+      if (d.subtype === entry.subtype && d.pageIndex === entry.pageIndex && rectsMatch(d.rect, entry.rect)) {
+        indices.push(i);
       }
     }
+    return indices;
+  };
+  const rootKeep = /* @__PURE__ */ new Set();
+  const descriptorClaimed = /* @__PURE__ */ new Set();
+  const keptDescriptors = [];
+  for (const [tag, entry] of markupByTag) {
+    if (isChainChild(entry)) continue;
+    if (keepIds.has(pdfJsRefId(entry.ref))) {
+      rootKeep.add(tag);
+      for (const i of matchingDescriptorIndices(entry)) descriptorClaimed.add(i);
+    }
+  }
+  for (const [tag, entry] of markupByTag) {
+    if (isChainChild(entry) || rootKeep.has(tag)) continue;
+    const index = matchingDescriptorIndices(entry).find((i) => !descriptorClaimed.has(i));
+    if (index !== void 0) {
+      descriptorClaimed.add(index);
+      rootKeep.add(tag);
+      keptDescriptors.push({ index, id: pdfJsRefId(entry.ref) });
+    }
   }
   const keepDecision = /* @__PURE__ */ new Map();
   const isKept = (tag) => {
@@ -2906,7 +3004,10 @@ async function removeMarkupAnnotations(pdfBytes, options) {
     const entry = markupByTag.get(tag);
     if (!entry) return false;
     const irt = entry.dict.get(irtName);
-    const decision = irt instanceof PDFRef && markupByTag.has(irt.toString()) ? isKept(irt.toString()) : keepIds.has(pdfJsRefId(entry.ref));
+    const subtype = entry.dict.get(subtypeName);
+    const rt = entry.dict.get(rtName);
+    const replyShaped = subtype instanceof PDFName3 && subtype.decodeText() === "Text" || rt instanceof PDFName3 && rt.decodeText() === "Group";
+    const decision = irt instanceof PDFRef && markupByTag.has(irt.toString()) ? replyShaped && isKept(irt.toString()) : rootKeep.has(tag);
     keepDecision.set(tag, decision);
     return decision;
   };
@@ -2923,32 +3024,140 @@ async function removeMarkupAnnotations(pdfBytes, options) {
       if (popup instanceof PDFRef) removedTags.add(popup.toString());
     }
   }
+  let removedInline = 0;
   for (const page of pages) {
     const annots = page.node.lookupMaybe(annotsName, PDFArray);
     if (!annots) continue;
     for (let i = annots.size() - 1; i >= 0; i--) {
       const entry = annots.get(i);
-      if (!(entry instanceof PDFRef)) continue;
-      let remove = removedTags.has(entry.toString());
-      if (!remove) {
-        const dict = page.node.context.lookup(entry);
-        if (dict instanceof PDFDict) {
-          const subtype = dict.get(subtypeName);
-          const parent = dict.get(parentName);
-          remove = subtype instanceof PDFName3 && subtype.decodeText() === "Popup" && parent instanceof PDFRef && removedTags.has(parent.toString());
-        }
+      let remove = false;
+      if (entry instanceof PDFRef) {
+        remove = removedTags.has(entry.toString());
+        if (!remove) {
+          const dict = page.node.context.lookup(entry);
+          if (dict instanceof PDFDict) {
+            const subtype = dict.get(subtypeName);
+            const parent = dict.get(parentName);
+            remove = subtype instanceof PDFName3 && subtype.decodeText() === "Popup" && parent instanceof PDFRef && removedTags.has(parent.toString());
+          }
+        }
+      } else if (entry instanceof PDFDict) {
+        const subtype = entry.get(subtypeName);
+        const parent = entry.get(parentName);
+        remove = subtype instanceof PDFName3 && REVIEW_MARKUP_SUBTYPES.has(subtype.decodeText()) || subtype instanceof PDFName3 && subtype.decodeText() === "Popup" && parent instanceof PDFRef && removedTags.has(parent.toString());
+        if (remove) removedInline++;
       }
       if (remove) annots.remove(i);
     }
   }
-  if (removedTags.size === 0) {
-    return { pdfBytes, removedIds, keptIds };
+  if (removedTags.size === 0 && removedInline === 0) {
+    return { pdfBytes, removedIds, keptIds, keptDescriptors };
   }
   const saved = await pdfDoc.save();
-  return { pdfBytes: saved, removedIds, keptIds };
+  return { pdfBytes: saved, removedIds, keptIds, keptDescriptors };
+}
+async function appendRepliesToExistingAnnotations(pdfBytes, threadsWithKeptRoots) {
+  if (!threadsWithKeptRoots.some(({ thread }) => thread.replies.length > 0)) {
+    return pdfBytes;
+  }
+  const { PDFDocument, PDFName: PDFName3, PDFArray, PDFDict, PDFRef, PDFNumber, PDFString: PDFString2, PDFHexString: PDFHexString2 } = await loadPdfLib();
+  const pdfDoc = await PDFDocument.load(pdfBytes);
+  const context = pdfDoc.context;
+  const subtypeName = PDFName3.of("Subtype");
+  const irtName = PDFName3.of("IRT");
+  const annotsName = PDFName3.of("Annots");
+  const entriesByTag = /* @__PURE__ */ new Map();
+  const tagById = /* @__PURE__ */ new Map();
+  for (const page of pdfDoc.getPages()) {
+    const annots = page.node.lookupMaybe(annotsName, PDFArray);
+    if (!annots) continue;
+    for (let i = 0; i < annots.size(); i++) {
+      const entry = annots.get(i);
+      if (!(entry instanceof PDFRef)) continue;
+      const dict = page.node.context.lookup(entry);
+      if (!(dict instanceof PDFDict)) continue;
+      const subtype = dict.get(subtypeName);
+      if (subtype instanceof PDFName3 && REVIEW_MARKUP_SUBTYPES.has(subtype.decodeText())) {
+        entriesByTag.set(entry.toString(), { ref: entry, dict, annotsArray: annots });
+        tagById.set(pdfJsRefId(entry), entry.toString());
+      }
+    }
+  }
+  const decodeText = (value) => {
+    if (value instanceof PDFHexString2 || value instanceof PDFString2) return value.decodeText();
+    return null;
+  };
+  const rootTagOf = (tag) => {
+    let current = tag;
+    const seen = /* @__PURE__ */ new Set();
+    while (!seen.has(current)) {
+      seen.add(current);
+      const irt = entriesByTag.get(current)?.dict.get(irtName);
+      if (!(irt instanceof PDFRef) || !entriesByTag.has(irt.toString())) break;
+      current = irt.toString();
+    }
+    return current;
+  };
+  const dedupKey = (author, contents) => `${author ?? "Document"}
+${contents ?? ""}`;
+  const existingByRootTag = /* @__PURE__ */ new Map();
+  for (const [tag, entry] of entriesByTag) {
+    if (!(entry.dict.get(irtName) instanceof PDFRef)) continue;
+    const rootTag = rootTagOf(tag);
+    if (rootTag === tag) continue;
+    let keys = existingByRootTag.get(rootTag);
+    if (!keys) existingByRootTag.set(rootTag, keys = /* @__PURE__ */ new Set());
+    keys.add(
+      dedupKey(decodeText(entry.dict.get(PDFName3.of("T"))), decodeText(entry.dict.get(PDFName3.of("Contents"))))
+    );
+  }
+  let appended = 0;
+  for (const { thread, rootId } of threadsWithKeptRoots) {
+    const rootTag = tagById.get(rootId);
+    const root = rootTag ? entriesByTag.get(rootTag) : void 0;
+    if (!root || !rootTag) {
+      logger.debug(
+        `appendRepliesToExistingAnnotations: no markup dict with id ${rootId} in these bytes; skipping ${thread.replies.length} reply(ies).`
+      );
+      continue;
+    }
+    const rectArr = root.dict.get(PDFName3.of("Rect"));
+    const rect = [0, 0, 0, 0];
+    if (rectArr instanceof PDFArray && rectArr.size() >= 4) {
+      for (let j = 0; j < 4; j++) {
+        const n = rectArr.lookup(j);
+        if (n instanceof PDFNumber) rect[j] = n.asNumber();
+      }
+    }
+    let keys = existingByRootTag.get(rootTag);
+    if (!keys) existingByRootTag.set(rootTag, keys = /* @__PURE__ */ new Set());
+    for (const reply of thread.replies) {
+      const key = dedupKey(reply.author.name || reply.author.email || "Unknown", reply.content);
+      if (keys.has(key)) continue;
+      keys.add(key);
+      addReplyAnnotation(
+        context,
+        root.annotsArray,
+        root.ref,
+        reply,
+        PDFName3,
+        PDFArray,
+        PDFString2,
+        PDFNumber,
+        PDFHexString2,
+        rect[0],
+        rect[1],
+        rect[2],
+        rect[3]
+      );
+      appended++;
+    }
+  }
+  if (appended === 0) return pdfBytes;
+  return pdfDoc.save();
 }
-async function assertSigningBytesFreeOfReviewMarkup(pdfBytes, allowedSourceIds) {
-  if (await hasBakedReviewMarkup(pdfBytes, allowedSourceIds)) {
+async function assertSigningBytesFreeOfReviewMarkup(pdfBytes, allowedSourceMarks) {
+  if (await hasBakedReviewMarkup(pdfBytes, allowedSourceMarks)) {
     throw new ReviewAnnotationSigningError(
       "SubmissionForm: the PDF selected as the signing source still carries baked review annotations (markup annotation dicts are present in its pages). Signing it would embed those review marks in the signed copy. Pass `pdfUrlForSigning` pointing at the clean original/prepared PDF (distinct from the baked review PDF) so the deliverable is filled from un-annotated source. This check is content-based, so it holds even when the annotation tree was not hydrated in the viewer."
     );
@@ -3107,6 +3316,7 @@ async function embedAnnotationsInPdf(pdfBytes, annotations, options) {
     const annotDict = context.obj({});
     annotDict.set(PDFName3.of("Type"), PDFName3.of("Annot"));
     annotDict.set(PDFName3.of("Subtype"), PDFName3.of(subtype));
+    annotDict.set(PDFName3.of(REVIEW_MARKER_KEY), PDFName3.of("v1"));
     const [x1, y1, x2, y2] = serializedRect;
     const rectArray = PDFArray.withContext(context);
     rectArray.push(PDFNumber.of(x1));
@@ -3260,6 +3470,7 @@ function addReplyAnnotation(context, annotsArray, parentRef, reply, PDFName3, PD
   const replyDict = context.obj({});
   replyDict.set(PDFName3.of("Type"), PDFName3.of("Annot"));
   replyDict.set(PDFName3.of("Subtype"), PDFName3.of("Text"));
+  replyDict.set(PDFName3.of(REVIEW_MARKER_KEY), PDFName3.of("v1"));
   const rectArray = PDFArray.withContext(context);
   rectArray.push(PDFNumber.of(x1));
   rectArray.push(PDFNumber.of(y1));
@@ -3300,20 +3511,42 @@ async function deriveReviewPdf(preparedPdfBytes, annotationTree, options) {
     for (const t of annotationTree) {
       if (isUnchangedSourceThread(t)) wantKeep.set(t.annotation.sourceAnnotationId, t);
     }
-    const { pdfBytes: cleaned, keptIds, removedIds } = await removeMarkupAnnotations(
-      preparedPdfBytes,
-      { keepIds: new Set(wantKeep.keys()) }
-    );
+    const descriptorOwners = [];
+    const descriptors = [];
+    for (const thread of wantKeep.values()) {
+      const [descriptor] = sourceNativeMarkDescriptors([thread]);
+      if (descriptor) {
+        descriptors.push(descriptor);
+        descriptorOwners.push(thread);
+      }
+    }
+    const { pdfBytes: cleaned, keptIds, removedIds, keptDescriptors } = await removeMarkupAnnotations(preparedPdfBytes, {
+      keepIds: new Set(wantKeep.keys()),
+      keepDescriptors: descriptors
+    });
     if (removedIds.length > 0 || keptIds.length > 0) {
       logger.debug(
         `deriveReviewPdf(sanitizeSource): kept ${keptIds.length} source mark(s), removed ${removedIds.length} from the source bytes before embedding.`
       );
     }
     const found = new Set(keptIds);
+    const contentMatched = /* @__PURE__ */ new Map();
+    for (const { index, id } of keptDescriptors) {
+      const owner = descriptorOwners[index];
+      if (owner) contentMatched.set(owner, id);
+    }
     const toEmbed = annotationTree.filter(
-      (t) => !(t.annotation.sourceAnnotationId && found.has(t.annotation.sourceAnnotationId))
+      (t) => !(t.annotation.sourceAnnotationId && found.has(t.annotation.sourceAnnotationId)) && !contentMatched.has(t)
     );
-    return embedAnnotationsInPdf(cleaned, toEmbed, embedOptions);
+    const keptRootThreads = [];
+    for (const [sourceId, thread] of wantKeep) {
+      const rootId = found.has(sourceId) ? sourceId : contentMatched.get(thread);
+      if (rootId && thread.replies.length > 0) {
+        keptRootThreads.push({ thread, rootId });
+      }
+    }
+    const withReplies = keptRootThreads.length ? await appendRepliesToExistingAnnotations(cleaned, keptRootThreads) : cleaned;
+    return embedAnnotationsInPdf(withReplies, toEmbed, embedOptions);
   }
   if (!allowMarkupInSource && await hasBakedReviewMarkup(preparedPdfBytes)) {
     throw new ReviewAnnotationSigningError(
@@ -5608,13 +5841,13 @@ function usePdfViewer(multiSignerContext) {
     [extractedFields]
   );
   const fillPdf = React9.useCallback(
-    async (fieldValues, signatures, currentSignerEmail, metadata, auditTrail, pdfBytesOverride, guardReviewMarkup = false, allowedSourceMarkupIds) => {
+    async (fieldValues, signatures, currentSignerEmail, metadata, auditTrail, pdfBytesOverride, guardReviewMarkup = false, allowedSourceMarks) => {
       const sourceBytes = pdfBytesOverride ?? originalPdfBytes;
       if (!sourceBytes) {
         throw new PdfProcessingError("No PDF loaded");
       }
       if (guardReviewMarkup) {
-        await assertSigningBytesFreeOfReviewMarkup(sourceBytes, allowedSourceMarkupIds);
+        await assertSigningBytesFreeOfReviewMarkup(sourceBytes, allowedSourceMarks);
       }
       try {
         const valuesValidation = validateFieldValues(fieldValues);
@@ -6536,6 +6769,31 @@ var AnnotationBridge = class {
       logger.error("AnnotationBridge: Failed to navigate to page:", e);
     }
   }
+  /**
+   * Origin check for inbound viewer messages (defence-in-depth alongside the
+   * event.source check). The viewer iframe is always embedded same-origin
+   * (`public/pdfjs/web/...` served by the host app), so the legitimate sender
+   * origin is our own — but derive the expectation from the iframe's actual
+   * `src` so a host that serves the viewer from another origin keeps working.
+   * blob: URLs inherit their creator's origin, which `new URL(...).origin`
+   * resolves correctly.
+   *
+   * Residual gap: when the iframe's src resolves to an opaque origin
+   * (`'null'`, e.g. a sandboxed data: URL) origins are indistinguishable and
+   * we fall back to the event.source check alone rather than dropping all
+   * messages.
+   */
+  isExpectedOrigin(origin) {
+    const src = this.iframeRef.current?.src;
+    if (!src) return origin === window.location.origin;
+    try {
+      const srcOrigin = new URL(src, window.location.href).origin;
+      if (srcOrigin === "null") return true;
+      return origin === srcOrigin || origin === window.location.origin;
+    } catch {
+      return origin === window.location.origin;
+    }
+  }
   /**
    * Start listening for annotation events from the iframe
    */
@@ -6544,6 +6802,7 @@ var AnnotationBridge = class {
     this.messageHandler = (event) => {
       const expectedSource = this.iframeRef.current?.contentWindow;
       if (!expectedSource || event.source !== expectedSource) return;
+      if (!this.isExpectedOrigin(event.origin)) return;
       if (!event.data || typeof event.data.type !== "string") return;
       if (!event.data.type.startsWith("signiphi:annotation:")) return;
       const { type, payload } = event.data;
@@ -6561,7 +6820,7 @@ var AnnotationBridge = class {
           this.callbacks.onAnnotationsInjected?.(payload?.count ?? 0);
           break;
         case "signiphi:annotation:clicked":
-          if (payload?.editorId) {
+          if (typeof payload?.editorId === "string" && payload.editorId) {
             this.callbacks.onAnnotationClicked?.(payload.editorId);
           }
           break;
@@ -7109,11 +7368,12 @@ function useAnnotationChat({
     if (annotationsRef.current.length > 0) return;
     const bridge = bridgeRef.current;
     if (!bridge) return;
-    sourceIngestDone.current = true;
     let cancelled = false;
     void (async () => {
       const source = await bridge.getSourceMarkupAnnotations();
-      if (cancelled || source.length === 0) return;
+      if (cancelled) return;
+      sourceIngestDone.current = true;
+      if (source.length === 0) return;
       const threads = sourceMarkupToThreads(source);
       if (threads.length === 0) return;
       logger.debug(
@@ -14501,9 +14761,7 @@ function SubmissionForm({
         pdfUrl,
         pdfUrlForSigning
       });
-      const sourceNativeIds = new Set(
-        annotationChat.annotations.map((t) => t.annotation.sourceAnnotationId).filter((id) => !!id)
-      );
+      const sourceNativeMarks = sourceNativeMarkDescriptors(annotationChat.annotations);
       let pdfBytesOverride = null;
       const signingUrl = pdfUrlForSigning?.trim();
       if (signingUrl && signingUrl !== pdfUrl) {
@@ -14523,7 +14781,7 @@ function SubmissionForm({
         auditTrail,
         pdfBytesOverride,
         enableAnnotationChat,
-        sourceNativeIds
+        sourceNativeMarks
       );
       const finalPdfBytes = filledPdfBytes;
       const annotationThreads = enableAnnotationChat ? annotationChat.getAnnotationsForPdfSave() : void 0;