@stll/anonymize-pdf 0.0.1-placeholder.0 → 2.4.0

package/ATTRIBUTION.md

@@ -0,0 +1,28 @@
+# Attribution
+
+PDF structures are parsed by `lopdf`, distributed under the MIT License.
+
+- Copyright (c) 2016 Junfeng Liu
+- https://github.com/J-F-Liu/lopdf
+
+## lopdf MIT License
+
+Copyright (c) 2016 Junfeng Liu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/LICENSE

@@ -0,0 +1,17 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+Copyright 2026 stella
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,110 @@
+# `@stll/anonymize-pdf`
+
+Bounded PDF inspection and destructive raster anonymization contracts.
+
+Inspection results inventory
+structures that can retain sensitive data, including forms, annotations,
+attachments, metadata, JavaScript, XFA, optional content, signatures, and image
+objects. A black rectangle drawn over a PDF page is not redaction because the
+original text or image can remain underneath it.
+
+Incremental revisions and non-whitespace bytes after the final `%%EOF` marker
+are reported as retained document bytes and prevent full coverage. The current
+object graph is inspected; superseded revision contents are not claimed as
+parsed or safe.
+
+```ts
+import { readFile } from "node:fs/promises";
+import { inspectPdf } from "@stll/anonymize-pdf";
+
+const inspection = inspectPdf(await readFile("contract.pdf"));
+console.log(inspection.risks);
+console.log(inspection.coverage);
+```
+
+Without page observations from a renderer/OCR adapter, coverage is explicitly
+`partial` with `page-content-not-observed`. The optional observation contract
+uses UTF-16 text offsets and PDF points. Page dimensions must match the
+effective CropBox/MediaBox intersection after page rotation and UserUnit scaling
+(within 0.25 points for renderer rounding). A `complete` text layer must map
+every observed UTF-16 code unit to glyph geometry. It is the seam for a later
+PDFium-backed renderer and destructive raster workflow; callers must not
+describe inspection alone as anonymization.
+
+Glyph bounds use a normalized displayed-page coordinate space in PDF points:
+the effective visible page's bottom-left is `(0, 0)`, and CropBox translation,
+page rotation, and UserUnit scaling have already been applied.
+
+Coverage is only `full` when every page was rendered, its text layer was
+completely observed, and OCR completely covered the rendered page pixels. That
+includes vector outlines, not only PDF image objects.
+
+lopdf enforces the decompression ceiling per object or cross-reference stream
+during parsing. The inspector additionally bounds aggregate loaded string,
+name, dictionary-key, and stream payload after parsing. That aggregate check is
+not a guarantee that the parser allocated no intermediate memory before the
+check; callers must also enforce the input-byte limit and process isolation
+appropriate for untrusted files.
+
+## Destructive raster anonymization
+
+`anonymizePdfRaster` accepts pages produced by an explicit renderer/OCR
+provider and creates a brand-new image-only PDF. It requires a prepared stella
+pipeline, runs native detection over each page's observed text, merges an
+optional digest-bound `ExternalDetectionBatch`, and fails if any selected
+non-whitespace UTF-16 span is not completely mapped to observed glyph geometry.
+Provider metadata must identify one explicit OCR language pack; mixed or
+implicit language selection is not part of the contract.
+It requires one opaque, row-packed RGB8 buffer for every source page, SHA-256
+binds the source and each page, requires complete rendering and OCR assertions,
+destructively fills the mapped pixels, and verifies both the newly written PDF
+graph and its decompressed image pixels. Encrypted inputs are rejected.
+
+The output never reuses source PDF objects, streams, text layers, metadata,
+forms, annotations, attachments, actions, signatures, optional content, or
+incremental revisions. A solid rectangle in this output is destructive: the
+original pixels are absent rather than hidden underneath it. The tradeoff is
+intentional loss of searchability, accessibility, links, forms, signatures,
+and other interactive behavior.
+
+The package does not bundle renderer/OCR binaries or silently select a language.
+Its optional Node adapter invokes locally installed Poppler `pdftoppm` and
+Tesseract directly (without a shell), sequentially, in a private temporary
+directory with bounded output and timeouts. It renders and removes one page at a
+time so document-wide limits are enforced without first materializing every
+page raster. Callers select exactly one installed Tesseract language pack.
+
+```ts
+import {
+  anonymizePdfRaster,
+  renderPdfWithPopplerTesseract,
+} from "@stll/anonymize-pdf";
+
+const observed = await renderPdfWithPopplerTesseract({
+  document,
+  ocrLanguage: "eng",
+});
+const result = anonymizePdfRaster({
+  document,
+  pipeline,
+  provider: observed.provider,
+  pages: observed.pages,
+});
+```
+
+A provider's `complete` OCR assertion means every rendered page was submitted
+to that OCR engine; it is not a claim that OCR or PII detection has perfect
+recall. OCR word boxes are conservatively redacted as whole regions when a
+selected span overlaps them. The returned certificate always says
+`piiCleanGuaranteed: false`:
+verification proves a fresh image-only structure and the requested destructive
+pixel rewrite, not perfect OCR or detector recall. Browser rendering is not
+part of this surface. Raster anonymization is a Node and Python
+document-profile capability; PDF inspection remains available through the
+byte-oriented core runtimes. The Poppler/Tesseract adapter is separately named
+as the Node-only `document.pdf.observe-raster-local` capability.
+
+`rewritePdfRasterFromDetections` is the advanced rewrite-only seam for trusted
+adapters that already ran detection. Detection spans must be strictly ordered
+and non-overlapping. Its name and certificate deliberately do not imply
+detection or PII cleanliness.

package/dist/index.d.mts

@@ -0,0 +1,231 @@
+import { ExternalDetectionBatch, PreparedNativePipeline } from "@stll/anonymize";
+//#region src/types.d.ts
+type PdfRect = {
+  left: number;
+  bottom: number;
+  right: number;
+  top: number;
+};
+type PdfGlyphObservation = {
+  start: number;
+  end: number;
+  /** Bounds in normalized displayed-page PDF points, origin bottom-left. */
+  bounds: PdfRect;
+  source: "embedded-text" | "ocr";
+};
+type PdfPageObservation = {
+  pageIndex: number;
+  /** Effective visible width after page boxes, rotation, and UserUnit scaling. */
+  widthPoints: number;
+  /** Effective visible height after page boxes, rotation, and UserUnit scaling. */
+  heightPoints: number;
+  text: string;
+  glyphs: readonly PdfGlyphObservation[];
+  rendered: boolean;
+  textLayer: "absent" | "partial" | "complete";
+  ocr: "not-run" | "partial" | "complete";
+  imageCount: number;
+};
+type PdfRiskInventory = {
+  acroFormFieldCount: number;
+  annotationCount: number;
+  documentInfoEntryCount: number;
+  embeddedFileCount: number;
+  externalActionCount: number;
+  formXObjectCount: number;
+  imageObjectCount: number;
+  incrementalRevisionCount: number;
+  javascriptActionCount: number;
+  metadataStreamCount: number;
+  optionalContentGroupCount: number;
+  signatureCount: number;
+  trailingNonWhitespaceByteCount: number;
+  unsupportedActionCount: number;
+  xfaEntryCount: number;
+};
+type PdfInspectionGap = "encrypted-document" | "page-content-not-observed" | "page-not-rendered" | "partial-text-layer" | "retained-document-bytes" | "unobserved-visual-content";
+type PdfPageInspection = {
+  pageIndex: number;
+  /** Effective visible width after page boxes, rotation, and UserUnit scaling. */
+  widthPoints: number;
+  /** Effective visible height after page boxes, rotation, and UserUnit scaling. */
+  heightPoints: number;
+  annotationCount: number;
+  observation: PdfPageObservation | null;
+};
+type PdfInspection = {
+  contractVersion: 1;
+  pdfVersion: string;
+  byteLength: number;
+  objectCount: number;
+  pageCount: number;
+  encrypted: boolean;
+  pages: readonly PdfPageInspection[];
+  risks: PdfRiskInventory;
+  coverage: {
+    status: "full" | "partial";
+    gaps: readonly PdfInspectionGap[];
+  };
+};
+type PdfRasterProvider = {
+  providerId: string;
+  rendererName: string;
+  rendererVersion: string;
+  ocrName: string;
+  ocrVersion: string;
+  /** One explicit provider language pack; never an implicit mixed-language set. */
+  ocrLanguage: string;
+};
+type PdfRasterPage = {
+  observation: PdfPageObservation;
+  widthPixels: number;
+  heightPixels: number;
+  /** Lowercase SHA-256 of this page's exact opaque, row-packed RGB8 bytes. */
+  pixelSha256: string;
+  /** Strictly ordered, non-overlapping UTF-16 spans. */
+  detections: readonly PdfRasterDetection[];
+};
+type PdfRasterDetection = {
+  start: number;
+  end: number;
+};
+type PdfRasterRewrite = {
+  contractVersion: 1;
+  /** Lowercase SHA-256 of the exact source PDF bytes supplied to the call. */
+  sourceSha256: string;
+  provider: PdfRasterProvider;
+  fillRgb: readonly [number, number, number];
+  pages: readonly PdfRasterPage[];
+};
+type PdfRasterRewriteCertificate = {
+  contractVersion: 1;
+  pageCount: number;
+  sourceSha256: string;
+  outputSha256: string;
+  provider: PdfRasterProvider;
+  detectionCount: number;
+  mappedRegionCount: number;
+  structurePixelRewriteVerified: true;
+  providerAssertedCoverage: "complete-rendering-and-ocr-observation";
+  piiCleanGuaranteed: false;
+  limitation: string;
+};
+type PdfRasterRewriteResult = {
+  document: Uint8Array;
+  certificate: PdfRasterRewriteCertificate;
+};
+declare const PDF_INSPECTION_ERROR_CODES: {
+  readonly documentLimitExceeded: "document-limit-exceeded";
+  readonly invalidDocument: "invalid-document";
+  readonly invalidObservation: "invalid-observation";
+  readonly observationLimitExceeded: "observation-limit-exceeded";
+  readonly providerFailed: "provider-failed";
+};
+type PdfInspectionErrorCode = (typeof PDF_INSPECTION_ERROR_CODES)[keyof typeof PDF_INSPECTION_ERROR_CODES];
+declare const PDF_RASTER_ERROR_CODES: {
+  readonly detectionFailed: "detection-failed";
+  readonly invalidContract: "invalid-contract";
+  readonly limitExceeded: "limit-exceeded";
+  readonly sourceRejected: "source-rejected";
+  readonly verificationFailed: "verification-failed";
+};
+type PdfRasterErrorCode = (typeof PDF_RASTER_ERROR_CODES)[keyof typeof PDF_RASTER_ERROR_CODES];
+//#endregion
+//#region src/local-provider.d.ts
+declare const PDF_LOCAL_PROVIDER_ERROR_CODES: {
+  readonly cleanupFailed: "cleanup-failed";
+  readonly executableFailed: "executable-failed";
+  readonly invalidOptions: "invalid-options";
+  readonly invalidOutput: "invalid-output";
+  readonly limitExceeded: "limit-exceeded";
+  readonly sourceRejected: "source-rejected";
+};
+type PdfLocalProviderErrorCode = (typeof PDF_LOCAL_PROVIDER_ERROR_CODES)[keyof typeof PDF_LOCAL_PROVIDER_ERROR_CODES];
+declare class PdfLocalProviderError extends Error {
+  readonly code: PdfLocalProviderErrorCode;
+  constructor(code: PdfLocalProviderErrorCode, message: string);
+}
+type RenderPdfWithPopplerTesseractOptions = {
+  document: Uint8Array;
+  /** One explicit installed Tesseract traineddata name, for example `eng`. */
+  ocrLanguage: string;
+  dpi?: number | undefined;
+  pdftoppmPath?: string | undefined;
+  tesseractPath?: string | undefined;
+  timeoutMs?: number | undefined;
+};
+type LocalPdfRasterPage = {
+  observation: PdfPageObservation;
+  widthPixels: number;
+  heightPixels: number;
+  pixels: Uint8Array;
+};
+type LocalPdfRasterObservation = {
+  provider: PdfRasterProvider;
+  pages: readonly LocalPdfRasterPage[];
+};
+declare const renderPdfWithPopplerTesseract: (options: RenderPdfWithPopplerTesseractOptions) => Promise<LocalPdfRasterObservation>;
+//#endregion
+//#region src/index.d.ts
+declare const PDF_INSPECTION_CONTRACT_VERSION: 1;
+declare const PDF_RASTER_CONTRACT_VERSION: 1;
+declare const PDF_RASTER_MAX_PAGE_BYTES: number;
+declare const PDF_RASTER_MAX_TOTAL_BYTES: number;
+declare const PDF_RASTER_MAX_OUTPUT_BYTES: number;
+declare const PDF_RASTER_REQUEST_JSON_MAX_BYTES: number;
+declare const PDF_DOCUMENT_MAX_BYTES: number;
+declare const PDF_STREAM_DECOMPRESSED_MAX_BYTES: number;
+declare const PDF_LOADED_PAYLOAD_MAX_BYTES: number;
+declare const PDF_MAX_OBJECTS = 200000;
+declare const PDF_MAX_OBJECT_NODES = 1000000;
+declare const PDF_MAX_OBJECT_DEPTH = 128;
+declare const PDF_MAX_PAGES = 10000;
+declare const PDF_MAX_GLYPHS = 5000000;
+declare const PDF_MAX_PAGE_TEXT_UTF8_BYTES: number;
+declare const PDF_MAX_OBSERVED_TEXT_UTF8_BYTES: number;
+declare const PDF_OBSERVATIONS_JSON_MAX_BYTES: number;
+/** Renderer dimensions may differ by this many points due to numeric rounding. */
+declare const PDF_PAGE_DIMENSION_TOLERANCE_POINTS = 0.25;
+declare class PdfInspectionError extends Error {
+  readonly code: PdfInspectionErrorCode;
+  constructor(code: PdfInspectionErrorCode, message: string);
+}
+declare class PdfRasterError extends Error {
+  readonly code: PdfRasterErrorCode;
+  constructor(code: PdfRasterErrorCode, message: string);
+}
+type InspectPdfOptions = {
+  pageObservations?: readonly PdfPageObservation[];
+};
+declare const inspectPdf: (document: Uint8Array, options?: InspectPdfOptions) => PdfInspection;
+type RewritePdfRasterFromDetectionsOptions = {
+  document: Uint8Array;
+  request: PdfRasterRewrite;
+  /** One opaque, row-packed RGB8 buffer per request page, in page order. */
+  pagePixels: readonly Uint8Array[];
+};
+/**
+ * Advanced rewrite-only surface. It verifies structure and destructive pixels but
+ * does not run detection or certify that the result is PII-free.
+ */
+declare const rewritePdfRasterFromDetections: ({ document, request, pagePixels }: RewritePdfRasterFromDetectionsOptions) => PdfRasterRewriteResult;
+type PdfRasterObservedPageInput = {
+  observation: PdfPageObservation;
+  widthPixels: number;
+  heightPixels: number;
+  pixels: Uint8Array;
+  /** Optional digest-bound provider batch merged through stella caller semantics. */
+  externalDetectionBatch?: ExternalDetectionBatch | string | undefined;
+};
+type AnonymizePdfRasterOptions = {
+  document: Uint8Array;
+  pipeline: Pick<PreparedNativePipeline, "redactText" | "redactTextWithCallerDetections">;
+  provider: PdfRasterProvider;
+  pages: readonly PdfRasterObservedPageInput[];
+  fillRgb?: readonly [number, number, number] | undefined;
+};
+/** Run stella detection, merge optional external detections, then rewrite pixels. */
+declare const anonymizePdfRaster: ({ document, pipeline, provider, pages, fillRgb }: AnonymizePdfRasterOptions) => PdfRasterRewriteResult;
+//#endregion
+export { AnonymizePdfRasterOptions, InspectPdfOptions, type LocalPdfRasterObservation, type LocalPdfRasterPage, PDF_DOCUMENT_MAX_BYTES, PDF_INSPECTION_CONTRACT_VERSION, PDF_INSPECTION_ERROR_CODES, PDF_LOADED_PAYLOAD_MAX_BYTES, PDF_LOCAL_PROVIDER_ERROR_CODES, PDF_MAX_GLYPHS, PDF_MAX_OBJECTS, PDF_MAX_OBJECT_DEPTH, PDF_MAX_OBJECT_NODES, PDF_MAX_OBSERVED_TEXT_UTF8_BYTES, PDF_MAX_PAGES, PDF_MAX_PAGE_TEXT_UTF8_BYTES, PDF_OBSERVATIONS_JSON_MAX_BYTES, PDF_PAGE_DIMENSION_TOLERANCE_POINTS, PDF_RASTER_CONTRACT_VERSION, PDF_RASTER_ERROR_CODES, PDF_RASTER_MAX_OUTPUT_BYTES, PDF_RASTER_MAX_PAGE_BYTES, PDF_RASTER_MAX_TOTAL_BYTES, PDF_RASTER_REQUEST_JSON_MAX_BYTES, PDF_STREAM_DECOMPRESSED_MAX_BYTES, type PdfGlyphObservation, type PdfInspection, PdfInspectionError, type PdfInspectionErrorCode, type PdfInspectionGap, PdfLocalProviderError, type PdfLocalProviderErrorCode, type PdfPageInspection, type PdfPageObservation, type PdfRasterDetection, PdfRasterError, type PdfRasterErrorCode, PdfRasterObservedPageInput, type PdfRasterPage, type PdfRasterProvider, type PdfRasterRewrite, type PdfRasterRewriteCertificate, type PdfRasterRewriteResult, type PdfRect, type PdfRiskInventory, type RenderPdfWithPopplerTesseractOptions, RewritePdfRasterFromDetectionsOptions, anonymizePdfRaster, inspectPdf, renderPdfWithPopplerTesseract, rewritePdfRasterFromDetections };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -0,0 +1,478 @@
+import { createHash } from "node:crypto";
+import { convert_external_detection_batch, loadNativeAnonymizeBinding } from "@stll/anonymize";
+import { execFile } from "node:child_process";
+import { lstat, mkdtemp, readFile, rm, unlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, sep } from "node:path";
+//#region src/types.ts
+const PDF_INSPECTION_ERROR_CODES = {
+	documentLimitExceeded: "document-limit-exceeded",
+	invalidDocument: "invalid-document",
+	invalidObservation: "invalid-observation",
+	observationLimitExceeded: "observation-limit-exceeded",
+	providerFailed: "provider-failed"
+};
+const PDF_RASTER_ERROR_CODES = {
+	detectionFailed: "detection-failed",
+	invalidContract: "invalid-contract",
+	limitExceeded: "limit-exceeded",
+	sourceRejected: "source-rejected",
+	verificationFailed: "verification-failed"
+};
+//#endregion
+//#region src/local-provider.ts
+const LOCAL_PROVIDER_ID = "poppler-tesseract-local";
+const PROCESS_OUTPUT_MAX_BYTES = 64 * 1024 * 1024;
+const PDF_DOCUMENT_MAX_BYTES$1 = 64 * 1024 * 1024;
+const PDF_RASTER_MAX_PAGE_BYTES$1 = 128 * 1024 * 1024;
+const PDF_RASTER_MAX_TOTAL_BYTES$1 = 512 * 1024 * 1024;
+const PDF_MAX_PAGES$1 = 1e4;
+const PDF_MAX_GLYPHS$1 = 5e6;
+const PDF_MAX_OBSERVED_TEXT_UTF8_BYTES$1 = 64 * 1024 * 1024;
+const DEFAULT_DPI = 300;
+const DEFAULT_TIMEOUT_MS = 12e4;
+const MIN_DPI = 72;
+const MAX_DPI = 600;
+const MIN_TIMEOUT_MS = 100;
+const MAX_TIMEOUT_MS = 3e5;
+const LANGUAGE_PACK_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/u;
+const TEMP_PREFIX = "stella-anonymize-pdf-";
+const PDF_LOCAL_PROVIDER_ERROR_CODES = {
+	cleanupFailed: "cleanup-failed",
+	executableFailed: "executable-failed",
+	invalidOptions: "invalid-options",
+	invalidOutput: "invalid-output",
+	limitExceeded: "limit-exceeded",
+	sourceRejected: "source-rejected"
+};
+var PdfLocalProviderError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "PdfLocalProviderError";
+		this.code = code;
+	}
+};
+const providerError = (code, message) => new PdfLocalProviderError(code, `${code}: ${message}`);
+const validateOptions = (options) => {
+	const dpi = options.dpi ?? DEFAULT_DPI;
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const pdftoppmPath = options.pdftoppmPath ?? "pdftoppm";
+	const tesseractPath = options.tesseractPath ?? "tesseract";
+	if (!Number.isInteger(dpi) || dpi < MIN_DPI || dpi > MAX_DPI || !Number.isInteger(timeoutMs) || timeoutMs < MIN_TIMEOUT_MS || timeoutMs > MAX_TIMEOUT_MS || !LANGUAGE_PACK_PATTERN.test(options.ocrLanguage) || !pdftoppmPath || pdftoppmPath.includes("\0") || !tesseractPath || tesseractPath.includes("\0")) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOptions, "local PDF provider options are invalid");
+	return {
+		dpi,
+		ocrLanguage: options.ocrLanguage,
+		pdftoppmPath,
+		tesseractPath,
+		timeoutMs
+	};
+};
+const runExecutable = (executable, args, timeoutMs, stage) => new Promise((resolve, reject) => {
+	execFile(executable, args, {
+		encoding: "buffer",
+		maxBuffer: PROCESS_OUTPUT_MAX_BYTES,
+		timeout: timeoutMs,
+		windowsHide: true
+	}, (error, stdout, stderr) => {
+		if (error !== null) {
+			reject(providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.executableFailed, `local PDF ${stage} failed`));
+			return;
+		}
+		resolve({
+			stdout: Buffer.from(stdout),
+			stderr: Buffer.from(stderr)
+		});
+	});
+});
+const decodeUtf8 = (value, context) => {
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(value);
+	} catch {
+		throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, `local PDF ${context} is not valid UTF-8`);
+	}
+};
+const versionFrom = (value, prefix, context) => {
+	const line = decodeUtf8(value, context).split(/\r?\n/u, 1)[0]?.trim();
+	const version = line?.startsWith(prefix) ? line.slice(prefix.length).trim() : "";
+	if (!version || version.length > 256 || /\p{Cc}/u.test(version)) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, `local PDF ${context} is invalid`);
+	return version;
+};
+const inspectPageGeometry = (document) => {
+	if (document.byteLength > PDF_DOCUMENT_MAX_BYTES$1) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "PDF source exceeds its byte limit");
+	const inspect = loadNativeAnonymizeBinding().inspectPdfJson;
+	if (inspect === void 0) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.sourceRejected, "native PDF inspection is unavailable");
+	try {
+		const inspection = JSON.parse(inspect(document));
+		if (inspection.encrypted === true || !Number.isSafeInteger(inspection.pageCount) || inspection.pageCount < 1 || inspection.pageCount > PDF_MAX_PAGES$1 || !Array.isArray(inspection.pages) || inspection.pages.length !== inspection.pageCount) throw new Error("source rejected");
+		return inspection.pages.map((page, pageIndex) => {
+			if (typeof page !== "object" || page === null) throw new Error("source rejected");
+			const { heightPoints, pageIndex: inspectedPageIndex, widthPoints } = page;
+			if (inspectedPageIndex !== pageIndex || typeof widthPoints !== "number" || !Number.isFinite(widthPoints) || widthPoints <= 0 || typeof heightPoints !== "number" || !Number.isFinite(heightPoints) || heightPoints <= 0) throw new Error("source rejected");
+			return {
+				heightPoints,
+				widthPoints
+			};
+		});
+	} catch {
+		throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.sourceRejected, "PDF source is unsupported by the local raster provider");
+	}
+};
+const assertProjectedRasterLimits = (pages, dpi) => {
+	let totalBytes = 0;
+	for (const { heightPoints, widthPoints } of pages) {
+		const widthPixels = Math.ceil(widthPoints * dpi / 72);
+		const heightPixels = Math.ceil(heightPoints * dpi / 72);
+		const pageBytes = widthPixels * heightPixels * 3;
+		totalBytes += pageBytes;
+		if (!Number.isSafeInteger(widthPixels) || !Number.isSafeInteger(heightPixels) || widthPixels <= 0 || heightPixels <= 0 || !Number.isSafeInteger(pageBytes) || pageBytes > PDF_RASTER_MAX_PAGE_BYTES$1 || !Number.isSafeInteger(totalBytes) || totalBytes > PDF_RASTER_MAX_TOTAL_BYTES$1) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "PDF page geometry exceeds the selected DPI raster limits");
+	}
+};
+const isWhitespace = (byte) => byte === 9 || byte === 10 || byte === 11 || byte === 12 || byte === 13 || byte === 32;
+const ppmToken = (bytes, start) => {
+	let offset = start;
+	while (offset < bytes.length) {
+		if (isWhitespace(bytes[offset] ?? -1)) {
+			offset += 1;
+			continue;
+		}
+		if (bytes[offset] === 35) {
+			while (offset < bytes.length && bytes[offset] !== 10) offset += 1;
+			continue;
+		}
+		break;
+	}
+	const tokenStart = offset;
+	while (offset < bytes.length && !isWhitespace(bytes[offset] ?? -1) && bytes[offset] !== 35) offset += 1;
+	if (tokenStart === offset) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Poppler emitted an invalid PPM header");
+	const token = Buffer.from(bytes.subarray(tokenStart, offset)).toString("ascii");
+	if (!/^[\x21-\x7e]+$/u.test(token)) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Poppler emitted an invalid PPM header");
+	return [token, offset];
+};
+const parsePositiveInteger = (value) => {
+	if (!/^[1-9][0-9]*$/u.test(value)) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Poppler emitted invalid PPM dimensions");
+	const parsed = Number(value);
+	if (!Number.isSafeInteger(parsed)) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "Poppler PPM dimensions exceed their limit");
+	return parsed;
+};
+const parsePpm = (bytes) => {
+	const [magic, afterMagic] = ppmToken(bytes, 0);
+	const [widthValue, afterWidth] = ppmToken(bytes, afterMagic);
+	const [heightValue, afterHeight] = ppmToken(bytes, afterWidth);
+	const [maximumValue, afterMaximum] = ppmToken(bytes, afterHeight);
+	if (magic !== "P6" || maximumValue !== "255") throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Poppler must emit binary RGB8 PPM pages");
+	const width = parsePositiveInteger(widthValue);
+	const height = parsePositiveInteger(heightValue);
+	const expected = width * height * 3;
+	if (!Number.isSafeInteger(expected) || expected > PDF_RASTER_MAX_PAGE_BYTES$1) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "Poppler page pixels exceed their byte limit");
+	let pixelOffset = afterMaximum;
+	if (!isWhitespace(bytes[pixelOffset] ?? -1)) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Poppler emitted an invalid PPM pixel separator");
+	const separator = bytes[pixelOffset];
+	pixelOffset += 1;
+	if (separator === 13 && bytes[pixelOffset] === 10) pixelOffset += 1;
+	if (bytes.length - pixelOffset !== expected) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Poppler emitted a truncated or trailing PPM page");
+	return {
+		width,
+		height,
+		pixels: bytes.subarray(pixelOffset)
+	};
+};
+const boundedRenderedPage = async (path) => {
+	const metadata = await lstat(path);
+	if (!metadata.isFile() || metadata.isSymbolicLink()) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Poppler page output must be a regular file");
+	if (metadata.size > 135266304) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "Poppler page output exceeds its byte limit");
+	return parsePpm(await readFile(path));
+};
+const integerTsvField = (value) => {
+	if (value === void 0 || !/^(?:0|[1-9][0-9]*)$/u.test(value)) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Tesseract emitted invalid TSV geometry");
+	const parsed = Number(value);
+	if (!Number.isSafeInteger(parsed)) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "Tesseract TSV geometry exceeds its limit");
+	return parsed;
+};
+const parseTesseractTsv = (bytes, page, pageGeometry, pageIndex) => {
+	const lines = decodeUtf8(bytes, "Tesseract TSV").split(/\r?\n/u);
+	if ((lines.shift()?.split("	"))?.slice(0, 12).join("	") !== "level	page_num	block_num	par_num	line_num	word_num	left	top	width	height	conf	text") throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Tesseract emitted an unsupported TSV header");
+	const { heightPoints, widthPoints } = pageGeometry;
+	const glyphs = [];
+	let text = "";
+	let previousLine = "";
+	for (const line of lines) {
+		if (!line) continue;
+		const fields = line.split("	");
+		if (fields[0] !== "5") continue;
+		const word = fields.slice(11).join("	").trim();
+		if (!word) continue;
+		if (/\p{Cc}/u.test(word)) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Tesseract emitted control characters in OCR text");
+		const lineKey = `${fields[2] ?? ""}/${fields[3] ?? ""}/${fields[4] ?? ""}`;
+		if (text) text += lineKey === previousLine ? " " : "\n";
+		previousLine = lineKey;
+		const start = text.length;
+		text += word;
+		const end = text.length;
+		const left = integerTsvField(fields[6]);
+		const top = integerTsvField(fields[7]);
+		const width = integerTsvField(fields[8]);
+		const height = integerTsvField(fields[9]);
+		const right = left + width;
+		const bottom = top + height;
+		if (width === 0 || height === 0 || !Number.isSafeInteger(right) || !Number.isSafeInteger(bottom) || right > page.width || bottom > page.height) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput, "Tesseract emitted out-of-page OCR geometry");
+		glyphs.push({
+			start,
+			end,
+			bounds: {
+				left: left * widthPoints / page.width,
+				bottom: heightPoints - bottom * heightPoints / page.height,
+				right: right * widthPoints / page.width,
+				top: heightPoints - top * heightPoints / page.height
+			},
+			source: "ocr"
+		});
+		if (glyphs.length > PDF_MAX_GLYPHS$1) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "Tesseract OCR glyph count exceeds its limit");
+		if (Buffer.byteLength(text, "utf8") > PDF_MAX_OBSERVED_TEXT_UTF8_BYTES$1) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "Tesseract OCR text exceeds its byte limit");
+	}
+	return {
+		pageIndex,
+		widthPoints,
+		heightPoints,
+		text,
+		glyphs,
+		rendered: true,
+		textLayer: "absent",
+		ocr: "complete",
+		imageCount: 0
+	};
+};
+const safeCleanup = async (directory) => {
+	const expectedPrefix = `${tmpdir()}${sep}${TEMP_PREFIX}`;
+	if (!directory.startsWith(expectedPrefix)) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed, "local PDF temporary directory could not be verified");
+	try {
+		const metadata = await lstat(directory);
+		if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed, "local PDF temporary directory could not be verified");
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		if (error instanceof PdfLocalProviderError) throw error;
+		throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed, "local PDF temporary directory could not be inspected");
+	}
+	try {
+		await rm(directory, {
+			force: true,
+			recursive: true
+		});
+	} catch {
+		throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed, "local PDF temporary files could not be removed");
+	}
+};
+const renderPdfWithPopplerTesseract = async (options) => {
+	const resolved = validateOptions(options);
+	const pageGeometry = inspectPageGeometry(options.document);
+	assertProjectedRasterLimits(pageGeometry, resolved.dpi);
+	const pageCount = pageGeometry.length;
+	const popplerVersionResult = await runExecutable(resolved.pdftoppmPath, ["-v"], resolved.timeoutMs, "version probe");
+	const tesseractVersionResult = await runExecutable(resolved.tesseractPath, ["--version"], resolved.timeoutMs, "version probe");
+	const rendererVersion = versionFrom(popplerVersionResult.stderr.length > 0 ? popplerVersionResult.stderr : popplerVersionResult.stdout, "pdftoppm version ", "Poppler version");
+	const ocrVersion = versionFrom(tesseractVersionResult.stdout.length > 0 ? tesseractVersionResult.stdout : tesseractVersionResult.stderr, "tesseract ", "Tesseract version");
+	const directory = await mkdtemp(join(tmpdir(), TEMP_PREFIX));
+	try {
+		const sourcePath = join(directory, "source.pdf");
+		const outputPrefix = join(directory, "page");
+		await writeFile(sourcePath, options.document, {
+			flag: "wx",
+			mode: 384
+		});
+		const pages = [];
+		let totalPixels = 0;
+		let totalGlyphs = 0;
+		let totalObservedTextUtf8Bytes = 0;
+		for (let pageNumber = 1; pageNumber <= pageCount; pageNumber += 1) {
+			const inspectedGeometry = pageGeometry.at(pageNumber - 1);
+			if (inspectedGeometry === void 0) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.sourceRejected, "PDF page geometry became unavailable");
+			const pageOutputPrefix = `${outputPrefix}-${pageNumber}`;
+			const pagePath = `${pageOutputPrefix}.ppm`;
+			await runExecutable(resolved.pdftoppmPath, [
+				"-cropbox",
+				"-f",
+				String(pageNumber),
+				"-l",
+				String(pageNumber),
+				"-singlefile",
+				"-r",
+				String(resolved.dpi),
+				sourcePath,
+				pageOutputPrefix
+			], resolved.timeoutMs, "renderer");
+			try {
+				const page = await boundedRenderedPage(pagePath);
+				totalPixels += page.pixels.byteLength;
+				if (!Number.isSafeInteger(totalPixels) || totalPixels > PDF_RASTER_MAX_TOTAL_BYTES$1) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "Poppler page pixels exceed their aggregate limit");
+				const ocr = await runExecutable(resolved.tesseractPath, [
+					pagePath,
+					"stdout",
+					"-l",
+					resolved.ocrLanguage,
+					"tsv"
+				], resolved.timeoutMs, "OCR");
+				const observation = parseTesseractTsv(ocr.stdout, page, inspectedGeometry, pageNumber - 1);
+				totalGlyphs += observation.glyphs.length;
+				totalObservedTextUtf8Bytes += Buffer.byteLength(observation.text, "utf8");
+				if (!Number.isSafeInteger(totalGlyphs) || totalGlyphs > PDF_MAX_GLYPHS$1 || !Number.isSafeInteger(totalObservedTextUtf8Bytes) || totalObservedTextUtf8Bytes > PDF_MAX_OBSERVED_TEXT_UTF8_BYTES$1) throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded, "Tesseract OCR document output exceeds its aggregate limit");
+				pages.push({
+					observation,
+					widthPixels: page.width,
+					heightPixels: page.height,
+					pixels: page.pixels
+				});
+			} finally {
+				await unlink(pagePath).catch((error) => {
+					if (error.code === "ENOENT") return;
+					throw providerError(PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed, "local PDF page raster could not be removed");
+				});
+			}
+		}
+		return {
+			provider: {
+				providerId: LOCAL_PROVIDER_ID,
+				rendererName: "Poppler pdftoppm",
+				rendererVersion,
+				ocrName: "Tesseract OCR",
+				ocrVersion,
+				ocrLanguage: resolved.ocrLanguage
+			},
+			pages
+		};
+	} finally {
+		await safeCleanup(directory);
+	}
+};
+//#endregion
+//#region src/index.ts
+const PDF_INSPECTION_CONTRACT_VERSION = 1;
+const PDF_RASTER_CONTRACT_VERSION = 1;
+const PDF_RASTER_MAX_PAGE_BYTES = 128 * 1024 * 1024;
+const PDF_RASTER_MAX_TOTAL_BYTES = 512 * 1024 * 1024;
+const PDF_RASTER_MAX_OUTPUT_BYTES = 512 * 1024 * 1024;
+const PDF_RASTER_REQUEST_JSON_MAX_BYTES = 64 * 1024 * 1024;
+const PDF_DOCUMENT_MAX_BYTES = 64 * 1024 * 1024;
+const PDF_STREAM_DECOMPRESSED_MAX_BYTES = 32 * 1024 * 1024;
+const PDF_LOADED_PAYLOAD_MAX_BYTES = 128 * 1024 * 1024;
+const PDF_MAX_OBJECTS = 2e5;
+const PDF_MAX_OBJECT_NODES = 1e6;
+const PDF_MAX_OBJECT_DEPTH = 128;
+const PDF_MAX_PAGES = 1e4;
+const PDF_MAX_GLYPHS = 5e6;
+const PDF_MAX_PAGE_TEXT_UTF8_BYTES = 16 * 1024 * 1024;
+const PDF_MAX_OBSERVED_TEXT_UTF8_BYTES = 64 * 1024 * 1024;
+const PDF_OBSERVATIONS_JSON_MAX_BYTES = 64 * 1024 * 1024;
+/** Renderer dimensions may differ by this many points due to numeric rounding. */
+const PDF_PAGE_DIMENSION_TOLERANCE_POINTS = .25;
+var PdfInspectionError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "PdfInspectionError";
+		this.code = code;
+	}
+};
+var PdfRasterError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "PdfRasterError";
+		this.code = code;
+	}
+};
+const errorCode = (message) => {
+	return Object.values(PDF_INSPECTION_ERROR_CODES).find((candidate) => message.startsWith(`${candidate}:`)) ?? PDF_INSPECTION_ERROR_CODES.invalidDocument;
+};
+const rasterErrorCode = (message) => {
+	return Object.values(PDF_RASTER_ERROR_CODES).find((candidate) => message.startsWith(`${candidate}:`)) ?? PDF_RASTER_ERROR_CODES.verificationFailed;
+};
+const inspectPdf = (document, options = {}) => {
+	const inspect = loadNativeAnonymizeBinding().inspectPdfJson;
+	if (inspect === void 0) throw new PdfInspectionError(PDF_INSPECTION_ERROR_CODES.invalidDocument, "Native anonymize binding does not expose PDF inspection");
+	try {
+		const observations = options.pageObservations;
+		return JSON.parse(inspect(document, observations === void 0 ? void 0 : JSON.stringify(observations)));
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "PDF inspection failed";
+		throw new PdfInspectionError(errorCode(message), message);
+	}
+};
+/**
+* Advanced rewrite-only surface. It verifies structure and destructive pixels but
+* does not run detection or certify that the result is PII-free.
+*/
+const rewritePdfRasterFromDetections = ({ document, request, pagePixels }) => {
+	const rewrite = loadNativeAnonymizeBinding().rewritePdfRasterFromDetectionsJson;
+	if (rewrite === void 0) throw new PdfRasterError(PDF_RASTER_ERROR_CODES.verificationFailed, "Native anonymize binding does not expose PDF raster rewriting");
+	try {
+		const result = rewrite(document, JSON.stringify(request), pagePixels);
+		return {
+			document: result.document,
+			certificate: JSON.parse(result.certificateJson)
+		};
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "PDF raster rewrite failed";
+		throw new PdfRasterError(rasterErrorCode(message), message);
+	}
+};
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+/** Run stella detection, merge optional external detections, then rewrite pixels. */
+const anonymizePdfRaster = ({ document, pipeline, provider, pages, fillRgb = [
+	0,
+	0,
+	0
+] }) => {
+	if (document.byteLength > 67108864) throw new PdfRasterError(PDF_RASTER_ERROR_CODES.limitExceeded, "limit-exceeded: PDF source exceeds its byte limit");
+	if (pages.length > 1e4) throw new PdfRasterError(PDF_RASTER_ERROR_CODES.limitExceeded, "limit-exceeded: PDF raster page count exceeds its limit");
+	let totalPixelBytes = 0;
+	let totalObservedTextBytes = 0;
+	const textEncoder = new TextEncoder();
+	for (const page of pages) {
+		if (typeof page.observation?.text !== "string") throw new PdfRasterError(PDF_RASTER_ERROR_CODES.invalidContract, "invalid-contract: PDF raster observed text is invalid");
+		const observedTextBytes = textEncoder.encode(page.observation.text).byteLength;
+		if (observedTextBytes > 16777216) throw new PdfRasterError(PDF_RASTER_ERROR_CODES.limitExceeded, "limit-exceeded: PDF raster page text exceeds its byte limit");
+		totalObservedTextBytes += observedTextBytes;
+		if (totalObservedTextBytes > 67108864) throw new PdfRasterError(PDF_RASTER_ERROR_CODES.limitExceeded, "limit-exceeded: PDF raster observed text exceeds its aggregate byte limit");
+		const { heightPixels, widthPixels } = page;
+		if (!Number.isSafeInteger(widthPixels) || !Number.isSafeInteger(heightPixels) || widthPixels <= 0 || heightPixels <= 0) throw new PdfRasterError(PDF_RASTER_ERROR_CODES.invalidContract, "invalid-contract: PDF raster pixel dimensions are invalid");
+		const expected = widthPixels * heightPixels * 3;
+		if (!Number.isSafeInteger(expected) || expected > 134217728 || page.pixels.byteLength !== expected) throw new PdfRasterError(PDF_RASTER_ERROR_CODES.limitExceeded, "limit-exceeded: PDF raster page pixels exceed limits or have an invalid RGB8 length");
+		totalPixelBytes += expected;
+		if (!Number.isSafeInteger(totalPixelBytes) || totalPixelBytes > 536870912) throw new PdfRasterError(PDF_RASTER_ERROR_CODES.limitExceeded, "limit-exceeded: PDF raster pixels exceed their aggregate limit");
+	}
+	const binding = loadNativeAnonymizeBinding();
+	let requestPages;
+	try {
+		requestPages = pages.map((page) => {
+			const external = page.externalDetectionBatch === void 0 ? void 0 : convert_external_detection_batch(new TextEncoder().encode(page.observation.text), page.externalDetectionBatch, { binding });
+			const result = external === void 0 ? pipeline.redactText(page.observation.text) : pipeline.redactTextWithCallerDetections(page.observation.text, { detections: external });
+			return {
+				observation: page.observation,
+				widthPixels: page.widthPixels,
+				heightPixels: page.heightPixels,
+				pixelSha256: sha256(page.pixels),
+				detections: result.resolvedEntities.map(({ start, end }) => ({
+					start,
+					end
+				}))
+			};
+		});
+	} catch {
+		throw new PdfRasterError(PDF_RASTER_ERROR_CODES.detectionFailed, "detection-failed: PDF raster detection failed");
+	}
+	return rewritePdfRasterFromDetections({
+		document,
+		request: {
+			contractVersion: 1,
+			sourceSha256: sha256(document),
+			provider,
+			fillRgb,
+			pages: requestPages
+		},
+		pagePixels: pages.map(({ pixels }) => pixels)
+	});
+};
+//#endregion
+export { PDF_DOCUMENT_MAX_BYTES, PDF_INSPECTION_CONTRACT_VERSION, PDF_INSPECTION_ERROR_CODES, PDF_LOADED_PAYLOAD_MAX_BYTES, PDF_LOCAL_PROVIDER_ERROR_CODES, PDF_MAX_GLYPHS, PDF_MAX_OBJECTS, PDF_MAX_OBJECT_DEPTH, PDF_MAX_OBJECT_NODES, PDF_MAX_OBSERVED_TEXT_UTF8_BYTES, PDF_MAX_PAGES, PDF_MAX_PAGE_TEXT_UTF8_BYTES, PDF_OBSERVATIONS_JSON_MAX_BYTES, PDF_PAGE_DIMENSION_TOLERANCE_POINTS, PDF_RASTER_CONTRACT_VERSION, PDF_RASTER_ERROR_CODES, PDF_RASTER_MAX_OUTPUT_BYTES, PDF_RASTER_MAX_PAGE_BYTES, PDF_RASTER_MAX_TOTAL_BYTES, PDF_RASTER_REQUEST_JSON_MAX_BYTES, PDF_STREAM_DECOMPRESSED_MAX_BYTES, PdfInspectionError, PdfLocalProviderError, PdfRasterError, anonymizePdfRaster, inspectPdf, renderPdfWithPopplerTesseract, rewritePdfRasterFromDetections };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["PDF_DOCUMENT_MAX_BYTES","PDF_RASTER_MAX_PAGE_BYTES","PDF_RASTER_MAX_TOTAL_BYTES","PDF_MAX_PAGES","PDF_MAX_GLYPHS","PDF_MAX_OBSERVED_TEXT_UTF8_BYTES","candidate"],"sources":["../src/types.ts","../src/local-provider.ts","../src/index.ts"],"sourcesContent":["export type PdfRect = {\n  left: number;\n  bottom: number;\n  right: number;\n  top: number;\n};\n\nexport type PdfGlyphObservation = {\n  start: number;\n  end: number;\n  /** Bounds in normalized displayed-page PDF points, origin bottom-left. */\n  bounds: PdfRect;\n  source: \"embedded-text\" | \"ocr\";\n};\n\nexport type PdfPageObservation = {\n  pageIndex: number;\n  /** Effective visible width after page boxes, rotation, and UserUnit scaling. */\n  widthPoints: number;\n  /** Effective visible height after page boxes, rotation, and UserUnit scaling. */\n  heightPoints: number;\n  text: string;\n  glyphs: readonly PdfGlyphObservation[];\n  rendered: boolean;\n  textLayer: \"absent\" | \"partial\" | \"complete\";\n  ocr: \"not-run\" | \"partial\" | \"complete\";\n  imageCount: number;\n};\n\nexport type PdfRiskInventory = {\n  acroFormFieldCount: number;\n  annotationCount: number;\n  documentInfoEntryCount: number;\n  embeddedFileCount: number;\n  externalActionCount: number;\n  formXObjectCount: number;\n  imageObjectCount: number;\n  incrementalRevisionCount: number;\n  javascriptActionCount: number;\n  metadataStreamCount: number;\n  optionalContentGroupCount: number;\n  signatureCount: number;\n  trailingNonWhitespaceByteCount: number;\n  unsupportedActionCount: number;\n  xfaEntryCount: number;\n};\n\nexport type PdfInspectionGap =\n  | \"encrypted-document\"\n  | \"page-content-not-observed\"\n  | \"page-not-rendered\"\n  | \"partial-text-layer\"\n  | \"retained-document-bytes\"\n  | \"unobserved-visual-content\";\n\nexport type PdfPageInspection = {\n  pageIndex: number;\n  /** Effective visible width after page boxes, rotation, and UserUnit scaling. */\n  widthPoints: number;\n  /** Effective visible height after page boxes, rotation, and UserUnit scaling. */\n  heightPoints: number;\n  annotationCount: number;\n  observation: PdfPageObservation | null;\n};\n\nexport type PdfInspection = {\n  contractVersion: 1;\n  pdfVersion: string;\n  byteLength: number;\n  objectCount: number;\n  pageCount: number;\n  encrypted: boolean;\n  pages: readonly PdfPageInspection[];\n  risks: PdfRiskInventory;\n  coverage: {\n    status: \"full\" | \"partial\";\n    gaps: readonly PdfInspectionGap[];\n  };\n};\n\nexport type PdfRasterProvider = {\n  providerId: string;\n  rendererName: string;\n  rendererVersion: string;\n  ocrName: string;\n  ocrVersion: string;\n  /** One explicit provider language pack; never an implicit mixed-language set. */\n  ocrLanguage: string;\n};\n\nexport type PdfRasterPage = {\n  observation: PdfPageObservation;\n  widthPixels: number;\n  heightPixels: number;\n  /** Lowercase SHA-256 of this page's exact opaque, row-packed RGB8 bytes. */\n  pixelSha256: string;\n  /** Strictly ordered, non-overlapping UTF-16 spans. */\n  detections: readonly PdfRasterDetection[];\n};\n\nexport type PdfRasterDetection = { start: number; end: number };\n\nexport type PdfRasterRewrite = {\n  contractVersion: 1;\n  /** Lowercase SHA-256 of the exact source PDF bytes supplied to the call. */\n  sourceSha256: string;\n  provider: PdfRasterProvider;\n  fillRgb: readonly [number, number, number];\n  pages: readonly PdfRasterPage[];\n};\n\nexport type PdfRasterRewriteCertificate = {\n  contractVersion: 1;\n  pageCount: number;\n  sourceSha256: string;\n  outputSha256: string;\n  provider: PdfRasterProvider;\n  detectionCount: number;\n  mappedRegionCount: number;\n  structurePixelRewriteVerified: true;\n  providerAssertedCoverage: \"complete-rendering-and-ocr-observation\";\n  piiCleanGuaranteed: false;\n  limitation: string;\n};\n\nexport type PdfRasterRewriteResult = {\n  document: Uint8Array;\n  certificate: PdfRasterRewriteCertificate;\n};\n\nexport const PDF_INSPECTION_ERROR_CODES = {\n  documentLimitExceeded: \"document-limit-exceeded\",\n  invalidDocument: \"invalid-document\",\n  invalidObservation: \"invalid-observation\",\n  observationLimitExceeded: \"observation-limit-exceeded\",\n  providerFailed: \"provider-failed\",\n} as const;\n\nexport type PdfInspectionErrorCode =\n  (typeof PDF_INSPECTION_ERROR_CODES)[keyof typeof PDF_INSPECTION_ERROR_CODES];\n\nexport const PDF_RASTER_ERROR_CODES = {\n  detectionFailed: \"detection-failed\",\n  invalidContract: \"invalid-contract\",\n  limitExceeded: \"limit-exceeded\",\n  sourceRejected: \"source-rejected\",\n  verificationFailed: \"verification-failed\",\n} as const;\n\nexport type PdfRasterErrorCode =\n  (typeof PDF_RASTER_ERROR_CODES)[keyof typeof PDF_RASTER_ERROR_CODES];\n","import { execFile } from \"node:child_process\";\nimport {\n  lstat,\n  mkdtemp,\n  readFile,\n  rm,\n  unlink,\n  writeFile,\n} from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join, sep } from \"node:path\";\n\nimport { loadNativeAnonymizeBinding } from \"@stll/anonymize\";\n\nimport type {\n  PdfGlyphObservation,\n  PdfPageObservation,\n  PdfRasterProvider,\n} from \"./types\";\n\nconst LOCAL_PROVIDER_ID = \"poppler-tesseract-local\";\nconst PROCESS_OUTPUT_MAX_BYTES = 64 * 1024 * 1024;\nconst PDF_DOCUMENT_MAX_BYTES = 64 * 1024 * 1024;\nconst PDF_RASTER_MAX_PAGE_BYTES = 128 * 1024 * 1024;\nconst PDF_RASTER_MAX_TOTAL_BYTES = 512 * 1024 * 1024;\nconst PDF_MAX_PAGES = 10_000;\nconst PDF_MAX_GLYPHS = 5_000_000;\nconst PDF_MAX_OBSERVED_TEXT_UTF8_BYTES = 64 * 1024 * 1024;\nconst DEFAULT_DPI = 300;\nconst DEFAULT_TIMEOUT_MS = 120_000;\nconst MIN_DPI = 72;\nconst MAX_DPI = 600;\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 300_000;\nconst LANGUAGE_PACK_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/u;\nconst TEMP_PREFIX = \"stella-anonymize-pdf-\";\n\nexport const PDF_LOCAL_PROVIDER_ERROR_CODES = {\n  cleanupFailed: \"cleanup-failed\",\n  executableFailed: \"executable-failed\",\n  invalidOptions: \"invalid-options\",\n  invalidOutput: \"invalid-output\",\n  limitExceeded: \"limit-exceeded\",\n  sourceRejected: \"source-rejected\",\n} as const;\n\nexport type PdfLocalProviderErrorCode =\n  (typeof PDF_LOCAL_PROVIDER_ERROR_CODES)[keyof typeof PDF_LOCAL_PROVIDER_ERROR_CODES];\n\nexport class PdfLocalProviderError extends Error {\n  readonly code: PdfLocalProviderErrorCode;\n\n  constructor(code: PdfLocalProviderErrorCode, message: string) {\n    super(message);\n    this.name = \"PdfLocalProviderError\";\n    this.code = code;\n  }\n}\n\nexport type RenderPdfWithPopplerTesseractOptions = {\n  document: Uint8Array;\n  /** One explicit installed Tesseract traineddata name, for example `eng`. */\n  ocrLanguage: string;\n  dpi?: number | undefined;\n  pdftoppmPath?: string | undefined;\n  tesseractPath?: string | undefined;\n  timeoutMs?: number | undefined;\n};\n\nexport type LocalPdfRasterPage = {\n  observation: PdfPageObservation;\n  widthPixels: number;\n  heightPixels: number;\n  pixels: Uint8Array;\n};\n\nexport type LocalPdfRasterObservation = {\n  provider: PdfRasterProvider;\n  pages: readonly LocalPdfRasterPage[];\n};\n\ntype ResolvedLocalProviderOptions = {\n  dpi: number;\n  ocrLanguage: string;\n  pdftoppmPath: string;\n  tesseractPath: string;\n  timeoutMs: number;\n};\n\ntype ProcessResult = { stdout: Buffer; stderr: Buffer };\n\nconst providerError = (\n  code: PdfLocalProviderErrorCode,\n  message: string,\n): PdfLocalProviderError =>\n  new PdfLocalProviderError(code, `${code}: ${message}`);\n\nconst validateOptions = (\n  options: RenderPdfWithPopplerTesseractOptions,\n): ResolvedLocalProviderOptions => {\n  const dpi = options.dpi ?? DEFAULT_DPI;\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const pdftoppmPath = options.pdftoppmPath ?? \"pdftoppm\";\n  const tesseractPath = options.tesseractPath ?? \"tesseract\";\n  if (\n    !Number.isInteger(dpi) ||\n    dpi < MIN_DPI ||\n    dpi > MAX_DPI ||\n    !Number.isInteger(timeoutMs) ||\n    timeoutMs < MIN_TIMEOUT_MS ||\n    timeoutMs > MAX_TIMEOUT_MS ||\n    !LANGUAGE_PACK_PATTERN.test(options.ocrLanguage) ||\n    !pdftoppmPath ||\n    pdftoppmPath.includes(\"\\0\") ||\n    !tesseractPath ||\n    tesseractPath.includes(\"\\0\")\n  ) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOptions,\n      \"local PDF provider options are invalid\",\n    );\n  }\n  return {\n    dpi,\n    ocrLanguage: options.ocrLanguage,\n    pdftoppmPath,\n    tesseractPath,\n    timeoutMs,\n  };\n};\n\nconst runExecutable = (\n  executable: string,\n  args: readonly string[],\n  timeoutMs: number,\n  stage: \"OCR\" | \"renderer\" | \"version probe\",\n): Promise<ProcessResult> =>\n  new Promise((resolve, reject) => {\n    execFile(\n      executable,\n      args,\n      {\n        encoding: \"buffer\",\n        maxBuffer: PROCESS_OUTPUT_MAX_BYTES,\n        timeout: timeoutMs,\n        windowsHide: true,\n      },\n      (error, stdout, stderr) => {\n        if (error !== null) {\n          reject(\n            providerError(\n              PDF_LOCAL_PROVIDER_ERROR_CODES.executableFailed,\n              `local PDF ${stage} failed`,\n            ),\n          );\n          return;\n        }\n        resolve({ stdout: Buffer.from(stdout), stderr: Buffer.from(stderr) });\n      },\n    );\n  });\n\nconst decodeUtf8 = (value: Uint8Array, context: string): string => {\n  try {\n    return new TextDecoder(\"utf-8\", { fatal: true }).decode(value);\n  } catch {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      `local PDF ${context} is not valid UTF-8`,\n    );\n  }\n};\n\nconst versionFrom = (\n  value: Uint8Array,\n  prefix: string,\n  context: string,\n): string => {\n  const line = decodeUtf8(value, context).split(/\\r?\\n/u, 1)[0]?.trim();\n  const version = line?.startsWith(prefix)\n    ? line.slice(prefix.length).trim()\n    : \"\";\n  if (!version || version.length > 256 || /\\p{Cc}/u.test(version)) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      `local PDF ${context} is invalid`,\n    );\n  }\n  return version;\n};\n\ntype InspectedPageGeometry = {\n  heightPoints: number;\n  widthPoints: number;\n};\n\nconst inspectPageGeometry = (\n  document: Uint8Array,\n): readonly InspectedPageGeometry[] => {\n  if (document.byteLength > PDF_DOCUMENT_MAX_BYTES) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n      \"PDF source exceeds its byte limit\",\n    );\n  }\n  const inspect = loadNativeAnonymizeBinding().inspectPdfJson;\n  if (inspect === undefined) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.sourceRejected,\n      \"native PDF inspection is unavailable\",\n    );\n  }\n  try {\n    const inspection = JSON.parse(inspect(document)) as {\n      encrypted?: unknown;\n      pageCount?: unknown;\n      pages?: unknown;\n    };\n    if (\n      inspection.encrypted === true ||\n      !Number.isSafeInteger(inspection.pageCount) ||\n      (inspection.pageCount as number) < 1 ||\n      (inspection.pageCount as number) > PDF_MAX_PAGES ||\n      !Array.isArray(inspection.pages) ||\n      inspection.pages.length !== inspection.pageCount\n    ) {\n      throw new Error(\"source rejected\");\n    }\n    return inspection.pages.map((page, pageIndex) => {\n      if (typeof page !== \"object\" || page === null) {\n        throw new Error(\"source rejected\");\n      }\n      const candidate = page as Record<string, unknown>;\n      const {\n        heightPoints,\n        pageIndex: inspectedPageIndex,\n        widthPoints,\n      } = candidate;\n      if (\n        inspectedPageIndex !== pageIndex ||\n        typeof widthPoints !== \"number\" ||\n        !Number.isFinite(widthPoints) ||\n        widthPoints <= 0 ||\n        typeof heightPoints !== \"number\" ||\n        !Number.isFinite(heightPoints) ||\n        heightPoints <= 0\n      ) {\n        throw new Error(\"source rejected\");\n      }\n      return { heightPoints, widthPoints };\n    });\n  } catch {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.sourceRejected,\n      \"PDF source is unsupported by the local raster provider\",\n    );\n  }\n};\n\nconst assertProjectedRasterLimits = (\n  pages: readonly InspectedPageGeometry[],\n  dpi: number,\n): void => {\n  let totalBytes = 0;\n  for (const { heightPoints, widthPoints } of pages) {\n    const widthPixels = Math.ceil((widthPoints * dpi) / 72);\n    const heightPixels = Math.ceil((heightPoints * dpi) / 72);\n    const pageBytes = widthPixels * heightPixels * 3;\n    totalBytes += pageBytes;\n    if (\n      !Number.isSafeInteger(widthPixels) ||\n      !Number.isSafeInteger(heightPixels) ||\n      widthPixels <= 0 ||\n      heightPixels <= 0 ||\n      !Number.isSafeInteger(pageBytes) ||\n      pageBytes > PDF_RASTER_MAX_PAGE_BYTES ||\n      !Number.isSafeInteger(totalBytes) ||\n      totalBytes > PDF_RASTER_MAX_TOTAL_BYTES\n    ) {\n      throw providerError(\n        PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n        \"PDF page geometry exceeds the selected DPI raster limits\",\n      );\n    }\n  }\n};\n\ntype PpmPage = {\n  width: number;\n  height: number;\n  pixels: Uint8Array;\n};\n\nconst isWhitespace = (byte: number): boolean =>\n  byte === 0x09 ||\n  byte === 0x0a ||\n  byte === 0x0b ||\n  byte === 0x0c ||\n  byte === 0x0d ||\n  byte === 0x20;\n\nconst ppmToken = (bytes: Uint8Array, start: number): [string, number] => {\n  let offset = start;\n  while (offset < bytes.length) {\n    if (isWhitespace(bytes[offset] ?? -1)) {\n      offset += 1;\n      continue;\n    }\n    if (bytes[offset] === 0x23) {\n      while (offset < bytes.length && bytes[offset] !== 0x0a) offset += 1;\n      continue;\n    }\n    break;\n  }\n  const tokenStart = offset;\n  while (\n    offset < bytes.length &&\n    !isWhitespace(bytes[offset] ?? -1) &&\n    bytes[offset] !== 0x23\n  ) {\n    offset += 1;\n  }\n  if (tokenStart === offset) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      \"Poppler emitted an invalid PPM header\",\n    );\n  }\n  const token = Buffer.from(bytes.subarray(tokenStart, offset)).toString(\n    \"ascii\",\n  );\n  if (!/^[\\x21-\\x7e]+$/u.test(token)) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      \"Poppler emitted an invalid PPM header\",\n    );\n  }\n  return [token, offset];\n};\n\nconst parsePositiveInteger = (value: string): number => {\n  if (!/^[1-9][0-9]*$/u.test(value)) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      \"Poppler emitted invalid PPM dimensions\",\n    );\n  }\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed)) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n      \"Poppler PPM dimensions exceed their limit\",\n    );\n  }\n  return parsed;\n};\n\nconst parsePpm = (bytes: Uint8Array): PpmPage => {\n  const [magic, afterMagic] = ppmToken(bytes, 0);\n  const [widthValue, afterWidth] = ppmToken(bytes, afterMagic);\n  const [heightValue, afterHeight] = ppmToken(bytes, afterWidth);\n  const [maximumValue, afterMaximum] = ppmToken(bytes, afterHeight);\n  if (magic !== \"P6\" || maximumValue !== \"255\") {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      \"Poppler must emit binary RGB8 PPM pages\",\n    );\n  }\n  const width = parsePositiveInteger(widthValue);\n  const height = parsePositiveInteger(heightValue);\n  const expected = width * height * 3;\n  if (!Number.isSafeInteger(expected) || expected > PDF_RASTER_MAX_PAGE_BYTES) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n      \"Poppler page pixels exceed their byte limit\",\n    );\n  }\n  let pixelOffset = afterMaximum;\n  if (!isWhitespace(bytes[pixelOffset] ?? -1)) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      \"Poppler emitted an invalid PPM pixel separator\",\n    );\n  }\n  const separator = bytes[pixelOffset];\n  pixelOffset += 1;\n  if (separator === 0x0d && bytes[pixelOffset] === 0x0a) pixelOffset += 1;\n  if (bytes.length - pixelOffset !== expected) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      \"Poppler emitted a truncated or trailing PPM page\",\n    );\n  }\n  return { width, height, pixels: bytes.subarray(pixelOffset) };\n};\n\nconst boundedRenderedPage = async (path: string): Promise<PpmPage> => {\n  const metadata = await lstat(path);\n  if (!metadata.isFile() || metadata.isSymbolicLink()) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      \"Poppler page output must be a regular file\",\n    );\n  }\n  if (metadata.size > PDF_RASTER_MAX_PAGE_BYTES + 1024 * 1024) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n      \"Poppler page output exceeds its byte limit\",\n    );\n  }\n  return parsePpm(await readFile(path));\n};\n\nconst integerTsvField = (value: string | undefined): number => {\n  if (value === undefined || !/^(?:0|[1-9][0-9]*)$/u.test(value)) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      \"Tesseract emitted invalid TSV geometry\",\n    );\n  }\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed)) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n      \"Tesseract TSV geometry exceeds its limit\",\n    );\n  }\n  return parsed;\n};\n\nconst parseTesseractTsv = (\n  bytes: Uint8Array,\n  page: PpmPage,\n  pageGeometry: InspectedPageGeometry,\n  pageIndex: number,\n): PdfPageObservation => {\n  const lines = decodeUtf8(bytes, \"Tesseract TSV\").split(/\\r?\\n/u);\n  const header = lines.shift()?.split(\"\\t\");\n  if (\n    header?.slice(0, 12).join(\"\\t\") !==\n    \"level\\tpage_num\\tblock_num\\tpar_num\\tline_num\\tword_num\\tleft\\ttop\\twidth\\theight\\tconf\\ttext\"\n  ) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n      \"Tesseract emitted an unsupported TSV header\",\n    );\n  }\n  const { heightPoints, widthPoints } = pageGeometry;\n  const glyphs: PdfGlyphObservation[] = [];\n  let text = \"\";\n  let previousLine = \"\";\n  for (const line of lines) {\n    if (!line) continue;\n    const fields = line.split(\"\\t\");\n    if (fields[0] !== \"5\") continue;\n    const word = fields.slice(11).join(\"\\t\").trim();\n    if (!word) continue;\n    if (/\\p{Cc}/u.test(word)) {\n      throw providerError(\n        PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n        \"Tesseract emitted control characters in OCR text\",\n      );\n    }\n    const lineKey = `${fields[2] ?? \"\"}/${fields[3] ?? \"\"}/${fields[4] ?? \"\"}`;\n    if (text) text += lineKey === previousLine ? \" \" : \"\\n\";\n    previousLine = lineKey;\n    const start = text.length;\n    text += word;\n    const end = text.length;\n    const left = integerTsvField(fields[6]);\n    const top = integerTsvField(fields[7]);\n    const width = integerTsvField(fields[8]);\n    const height = integerTsvField(fields[9]);\n    const right = left + width;\n    const bottom = top + height;\n    if (\n      width === 0 ||\n      height === 0 ||\n      !Number.isSafeInteger(right) ||\n      !Number.isSafeInteger(bottom) ||\n      right > page.width ||\n      bottom > page.height\n    ) {\n      throw providerError(\n        PDF_LOCAL_PROVIDER_ERROR_CODES.invalidOutput,\n        \"Tesseract emitted out-of-page OCR geometry\",\n      );\n    }\n    glyphs.push({\n      start,\n      end,\n      bounds: {\n        left: (left * widthPoints) / page.width,\n        bottom: heightPoints - (bottom * heightPoints) / page.height,\n        right: (right * widthPoints) / page.width,\n        top: heightPoints - (top * heightPoints) / page.height,\n      },\n      source: \"ocr\",\n    });\n    if (glyphs.length > PDF_MAX_GLYPHS) {\n      throw providerError(\n        PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n        \"Tesseract OCR glyph count exceeds its limit\",\n      );\n    }\n    if (Buffer.byteLength(text, \"utf8\") > PDF_MAX_OBSERVED_TEXT_UTF8_BYTES) {\n      throw providerError(\n        PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n        \"Tesseract OCR text exceeds its byte limit\",\n      );\n    }\n  }\n  return {\n    pageIndex,\n    widthPoints,\n    heightPoints,\n    text,\n    glyphs,\n    rendered: true,\n    textLayer: \"absent\",\n    ocr: \"complete\",\n    imageCount: 0,\n  };\n};\n\nconst safeCleanup = async (directory: string): Promise<void> => {\n  const expectedPrefix = `${tmpdir()}${sep}${TEMP_PREFIX}`;\n  if (!directory.startsWith(expectedPrefix)) {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed,\n      \"local PDF temporary directory could not be verified\",\n    );\n  }\n  try {\n    const metadata = await lstat(directory);\n    if (!metadata.isDirectory() || metadata.isSymbolicLink()) {\n      throw providerError(\n        PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed,\n        \"local PDF temporary directory could not be verified\",\n      );\n    }\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return;\n    if (error instanceof PdfLocalProviderError) throw error;\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed,\n      \"local PDF temporary directory could not be inspected\",\n    );\n  }\n  try {\n    await rm(directory, { force: true, recursive: true });\n  } catch {\n    throw providerError(\n      PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed,\n      \"local PDF temporary files could not be removed\",\n    );\n  }\n};\n\nexport const renderPdfWithPopplerTesseract = async (\n  options: RenderPdfWithPopplerTesseractOptions,\n): Promise<LocalPdfRasterObservation> => {\n  const resolved = validateOptions(options);\n  const pageGeometry = inspectPageGeometry(options.document);\n  assertProjectedRasterLimits(pageGeometry, resolved.dpi);\n  const pageCount = pageGeometry.length;\n  const popplerVersionResult = await runExecutable(\n    resolved.pdftoppmPath,\n    [\"-v\"],\n    resolved.timeoutMs,\n    \"version probe\",\n  );\n  const tesseractVersionResult = await runExecutable(\n    resolved.tesseractPath,\n    [\"--version\"],\n    resolved.timeoutMs,\n    \"version probe\",\n  );\n  const rendererVersion = versionFrom(\n    popplerVersionResult.stderr.length > 0\n      ? popplerVersionResult.stderr\n      : popplerVersionResult.stdout,\n    \"pdftoppm version \",\n    \"Poppler version\",\n  );\n  const ocrVersion = versionFrom(\n    tesseractVersionResult.stdout.length > 0\n      ? tesseractVersionResult.stdout\n      : tesseractVersionResult.stderr,\n    \"tesseract \",\n    \"Tesseract version\",\n  );\n  const directory = await mkdtemp(join(tmpdir(), TEMP_PREFIX));\n  try {\n    const sourcePath = join(directory, \"source.pdf\");\n    const outputPrefix = join(directory, \"page\");\n    await writeFile(sourcePath, options.document, { flag: \"wx\", mode: 0o600 });\n    const pages: LocalPdfRasterPage[] = [];\n    let totalPixels = 0;\n    let totalGlyphs = 0;\n    let totalObservedTextUtf8Bytes = 0;\n    for (let pageNumber = 1; pageNumber <= pageCount; pageNumber += 1) {\n      const inspectedGeometry = pageGeometry.at(pageNumber - 1);\n      if (inspectedGeometry === undefined) {\n        throw providerError(\n          PDF_LOCAL_PROVIDER_ERROR_CODES.sourceRejected,\n          \"PDF page geometry became unavailable\",\n        );\n      }\n      const pageOutputPrefix = `${outputPrefix}-${pageNumber}`;\n      const pagePath = `${pageOutputPrefix}.ppm`;\n      await runExecutable(\n        resolved.pdftoppmPath,\n        [\n          \"-cropbox\",\n          \"-f\",\n          String(pageNumber),\n          \"-l\",\n          String(pageNumber),\n          \"-singlefile\",\n          \"-r\",\n          String(resolved.dpi),\n          sourcePath,\n          pageOutputPrefix,\n        ],\n        resolved.timeoutMs,\n        \"renderer\",\n      );\n      try {\n        const page = await boundedRenderedPage(pagePath);\n        totalPixels += page.pixels.byteLength;\n        if (\n          !Number.isSafeInteger(totalPixels) ||\n          totalPixels > PDF_RASTER_MAX_TOTAL_BYTES\n        ) {\n          throw providerError(\n            PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n            \"Poppler page pixels exceed their aggregate limit\",\n          );\n        }\n        const ocr = await runExecutable(\n          resolved.tesseractPath,\n          [pagePath, \"stdout\", \"-l\", resolved.ocrLanguage, \"tsv\"],\n          resolved.timeoutMs,\n          \"OCR\",\n        );\n        const observation = parseTesseractTsv(\n          ocr.stdout,\n          page,\n          inspectedGeometry,\n          pageNumber - 1,\n        );\n        totalGlyphs += observation.glyphs.length;\n        totalObservedTextUtf8Bytes += Buffer.byteLength(\n          observation.text,\n          \"utf8\",\n        );\n        if (\n          !Number.isSafeInteger(totalGlyphs) ||\n          totalGlyphs > PDF_MAX_GLYPHS ||\n          !Number.isSafeInteger(totalObservedTextUtf8Bytes) ||\n          totalObservedTextUtf8Bytes > PDF_MAX_OBSERVED_TEXT_UTF8_BYTES\n        ) {\n          throw providerError(\n            PDF_LOCAL_PROVIDER_ERROR_CODES.limitExceeded,\n            \"Tesseract OCR document output exceeds its aggregate limit\",\n          );\n        }\n        pages.push({\n          observation,\n          widthPixels: page.width,\n          heightPixels: page.height,\n          pixels: page.pixels,\n        });\n      } finally {\n        await unlink(pagePath).catch((error: NodeJS.ErrnoException) => {\n          if (error.code === \"ENOENT\") return;\n          throw providerError(\n            PDF_LOCAL_PROVIDER_ERROR_CODES.cleanupFailed,\n            \"local PDF page raster could not be removed\",\n          );\n        });\n      }\n    }\n    return {\n      provider: {\n        providerId: LOCAL_PROVIDER_ID,\n        rendererName: \"Poppler pdftoppm\",\n        rendererVersion,\n        ocrName: \"Tesseract OCR\",\n        ocrVersion,\n        ocrLanguage: resolved.ocrLanguage,\n      },\n      pages,\n    };\n  } finally {\n    await safeCleanup(directory);\n  }\n};\n","import { createHash } from \"node:crypto\";\n\nimport {\n  convert_external_detection_batch,\n  loadNativeAnonymizeBinding,\n  type ExternalDetectionBatch,\n  type PreparedNativePipeline,\n} from \"@stll/anonymize\";\n\nimport {\n  PDF_INSPECTION_ERROR_CODES,\n  PDF_RASTER_ERROR_CODES,\n  type PdfInspection,\n  type PdfInspectionErrorCode,\n  type PdfPageObservation,\n  type PdfRasterProvider,\n  type PdfRasterErrorCode,\n  type PdfRasterRewrite,\n  type PdfRasterRewriteResult,\n} from \"./types\";\n\nexport const PDF_INSPECTION_CONTRACT_VERSION = 1 as const;\nexport const PDF_RASTER_CONTRACT_VERSION = 1 as const;\nexport const PDF_RASTER_MAX_PAGE_BYTES = 128 * 1024 * 1024;\nexport const PDF_RASTER_MAX_TOTAL_BYTES = 512 * 1024 * 1024;\nexport const PDF_RASTER_MAX_OUTPUT_BYTES = 512 * 1024 * 1024;\nexport const PDF_RASTER_REQUEST_JSON_MAX_BYTES = 64 * 1024 * 1024;\nexport const PDF_DOCUMENT_MAX_BYTES = 64 * 1024 * 1024;\nexport const PDF_STREAM_DECOMPRESSED_MAX_BYTES = 32 * 1024 * 1024;\nexport const PDF_LOADED_PAYLOAD_MAX_BYTES = 128 * 1024 * 1024;\nexport const PDF_MAX_OBJECTS = 200_000;\nexport const PDF_MAX_OBJECT_NODES = 1_000_000;\nexport const PDF_MAX_OBJECT_DEPTH = 128;\nexport const PDF_MAX_PAGES = 10_000;\nexport const PDF_MAX_GLYPHS = 5_000_000;\nexport const PDF_MAX_PAGE_TEXT_UTF8_BYTES = 16 * 1024 * 1024;\nexport const PDF_MAX_OBSERVED_TEXT_UTF8_BYTES = 64 * 1024 * 1024;\nexport const PDF_OBSERVATIONS_JSON_MAX_BYTES = 64 * 1024 * 1024;\n/** Renderer dimensions may differ by this many points due to numeric rounding. */\nexport const PDF_PAGE_DIMENSION_TOLERANCE_POINTS = 0.25;\n\nexport class PdfInspectionError extends Error {\n  readonly code: PdfInspectionErrorCode;\n\n  constructor(code: PdfInspectionErrorCode, message: string) {\n    super(message);\n    this.name = \"PdfInspectionError\";\n    this.code = code;\n  }\n}\n\nexport class PdfRasterError extends Error {\n  readonly code: PdfRasterErrorCode;\n\n  constructor(code: PdfRasterErrorCode, message: string) {\n    super(message);\n    this.name = \"PdfRasterError\";\n    this.code = code;\n  }\n}\n\nconst errorCode = (message: string): PdfInspectionErrorCode => {\n  const code = Object.values(PDF_INSPECTION_ERROR_CODES).find((candidate) =>\n    message.startsWith(`${candidate}:`),\n  );\n  return code ?? PDF_INSPECTION_ERROR_CODES.invalidDocument;\n};\n\nconst rasterErrorCode = (message: string): PdfRasterErrorCode => {\n  const code = Object.values(PDF_RASTER_ERROR_CODES).find((candidate) =>\n    message.startsWith(`${candidate}:`),\n  );\n  return code ?? PDF_RASTER_ERROR_CODES.verificationFailed;\n};\n\nexport type InspectPdfOptions = {\n  pageObservations?: readonly PdfPageObservation[];\n};\n\nexport const inspectPdf = (\n  document: Uint8Array,\n  options: InspectPdfOptions = {},\n): PdfInspection => {\n  const inspect = loadNativeAnonymizeBinding().inspectPdfJson;\n  if (inspect === undefined) {\n    throw new PdfInspectionError(\n      PDF_INSPECTION_ERROR_CODES.invalidDocument,\n      \"Native anonymize binding does not expose PDF inspection\",\n    );\n  }\n  try {\n    const observations = options.pageObservations;\n    return JSON.parse(\n      inspect(\n        document,\n        observations === undefined ? undefined : JSON.stringify(observations),\n      ),\n    ) as PdfInspection;\n  } catch (error) {\n    const message =\n      error instanceof Error ? error.message : \"PDF inspection failed\";\n    throw new PdfInspectionError(errorCode(message), message);\n  }\n};\n\nexport type RewritePdfRasterFromDetectionsOptions = {\n  document: Uint8Array;\n  request: PdfRasterRewrite;\n  /** One opaque, row-packed RGB8 buffer per request page, in page order. */\n  pagePixels: readonly Uint8Array[];\n};\n\n/**\n * Advanced rewrite-only surface. It verifies structure and destructive pixels but\n * does not run detection or certify that the result is PII-free.\n */\nexport const rewritePdfRasterFromDetections = ({\n  document,\n  request,\n  pagePixels,\n}: RewritePdfRasterFromDetectionsOptions): PdfRasterRewriteResult => {\n  const rewrite =\n    loadNativeAnonymizeBinding().rewritePdfRasterFromDetectionsJson;\n  if (rewrite === undefined) {\n    throw new PdfRasterError(\n      PDF_RASTER_ERROR_CODES.verificationFailed,\n      \"Native anonymize binding does not expose PDF raster rewriting\",\n    );\n  }\n  try {\n    const result = rewrite(document, JSON.stringify(request), pagePixels);\n    return {\n      document: result.document,\n      certificate: JSON.parse(result.certificateJson),\n    } as PdfRasterRewriteResult;\n  } catch (error) {\n    const message =\n      error instanceof Error ? error.message : \"PDF raster rewrite failed\";\n    throw new PdfRasterError(rasterErrorCode(message), message);\n  }\n};\n\nexport type PdfRasterObservedPageInput = {\n  observation: PdfPageObservation;\n  widthPixels: number;\n  heightPixels: number;\n  pixels: Uint8Array;\n  /** Optional digest-bound provider batch merged through stella caller semantics. */\n  externalDetectionBatch?: ExternalDetectionBatch | string | undefined;\n};\n\nexport type AnonymizePdfRasterOptions = {\n  document: Uint8Array;\n  pipeline: Pick<\n    PreparedNativePipeline,\n    \"redactText\" | \"redactTextWithCallerDetections\"\n  >;\n  provider: PdfRasterProvider;\n  pages: readonly PdfRasterObservedPageInput[];\n  fillRgb?: readonly [number, number, number] | undefined;\n};\n\nconst sha256 = (value: Uint8Array): string =>\n  createHash(\"sha256\").update(value).digest(\"hex\");\n\n/** Run stella detection, merge optional external detections, then rewrite pixels. */\nexport const anonymizePdfRaster = ({\n  document,\n  pipeline,\n  provider,\n  pages,\n  fillRgb = [0, 0, 0],\n}: AnonymizePdfRasterOptions): PdfRasterRewriteResult => {\n  if (document.byteLength > PDF_DOCUMENT_MAX_BYTES) {\n    throw new PdfRasterError(\n      PDF_RASTER_ERROR_CODES.limitExceeded,\n      \"limit-exceeded: PDF source exceeds its byte limit\",\n    );\n  }\n  if (pages.length > PDF_MAX_PAGES) {\n    throw new PdfRasterError(\n      PDF_RASTER_ERROR_CODES.limitExceeded,\n      \"limit-exceeded: PDF raster page count exceeds its limit\",\n    );\n  }\n  let totalPixelBytes = 0;\n  let totalObservedTextBytes = 0;\n  const textEncoder = new TextEncoder();\n  for (const page of pages) {\n    if (typeof page.observation?.text !== \"string\") {\n      throw new PdfRasterError(\n        PDF_RASTER_ERROR_CODES.invalidContract,\n        \"invalid-contract: PDF raster observed text is invalid\",\n      );\n    }\n    const observedTextBytes = textEncoder.encode(\n      page.observation.text,\n    ).byteLength;\n    if (observedTextBytes > PDF_MAX_PAGE_TEXT_UTF8_BYTES) {\n      throw new PdfRasterError(\n        PDF_RASTER_ERROR_CODES.limitExceeded,\n        \"limit-exceeded: PDF raster page text exceeds its byte limit\",\n      );\n    }\n    totalObservedTextBytes += observedTextBytes;\n    if (totalObservedTextBytes > PDF_MAX_OBSERVED_TEXT_UTF8_BYTES) {\n      throw new PdfRasterError(\n        PDF_RASTER_ERROR_CODES.limitExceeded,\n        \"limit-exceeded: PDF raster observed text exceeds its aggregate byte limit\",\n      );\n    }\n    const { heightPixels, widthPixels } = page;\n    if (\n      !Number.isSafeInteger(widthPixels) ||\n      !Number.isSafeInteger(heightPixels) ||\n      widthPixels <= 0 ||\n      heightPixels <= 0\n    ) {\n      throw new PdfRasterError(\n        PDF_RASTER_ERROR_CODES.invalidContract,\n        \"invalid-contract: PDF raster pixel dimensions are invalid\",\n      );\n    }\n    const expected = widthPixels * heightPixels * 3;\n    if (\n      !Number.isSafeInteger(expected) ||\n      expected > PDF_RASTER_MAX_PAGE_BYTES ||\n      page.pixels.byteLength !== expected\n    ) {\n      throw new PdfRasterError(\n        PDF_RASTER_ERROR_CODES.limitExceeded,\n        \"limit-exceeded: PDF raster page pixels exceed limits or have an invalid RGB8 length\",\n      );\n    }\n    totalPixelBytes += expected;\n    if (\n      !Number.isSafeInteger(totalPixelBytes) ||\n      totalPixelBytes > PDF_RASTER_MAX_TOTAL_BYTES\n    ) {\n      throw new PdfRasterError(\n        PDF_RASTER_ERROR_CODES.limitExceeded,\n        \"limit-exceeded: PDF raster pixels exceed their aggregate limit\",\n      );\n    }\n  }\n  const binding = loadNativeAnonymizeBinding();\n  let requestPages: PdfRasterRewrite[\"pages\"];\n  try {\n    requestPages = pages.map((page) => {\n      const external =\n        page.externalDetectionBatch === undefined\n          ? undefined\n          : convert_external_detection_batch(\n              new TextEncoder().encode(page.observation.text),\n              page.externalDetectionBatch,\n              { binding },\n            );\n      const result =\n        external === undefined\n          ? pipeline.redactText(page.observation.text)\n          : pipeline.redactTextWithCallerDetections(page.observation.text, {\n              detections: external,\n            });\n      return {\n        observation: page.observation,\n        widthPixels: page.widthPixels,\n        heightPixels: page.heightPixels,\n        pixelSha256: sha256(page.pixels),\n        detections: result.resolvedEntities.map(({ start, end }) => ({\n          start,\n          end,\n        })),\n      };\n    });\n  } catch {\n    throw new PdfRasterError(\n      PDF_RASTER_ERROR_CODES.detectionFailed,\n      \"detection-failed: PDF raster detection failed\",\n    );\n  }\n  return rewritePdfRasterFromDetections({\n    document,\n    request: {\n      contractVersion: PDF_RASTER_CONTRACT_VERSION,\n      sourceSha256: sha256(document),\n      provider,\n      fillRgb,\n      pages: requestPages,\n    },\n    pagePixels: pages.map(({ pixels }) => pixels),\n  });\n};\n\nexport { PDF_INSPECTION_ERROR_CODES } from \"./types\";\nexport { PDF_RASTER_ERROR_CODES } from \"./types\";\nexport {\n  PDF_LOCAL_PROVIDER_ERROR_CODES,\n  PdfLocalProviderError,\n  renderPdfWithPopplerTesseract,\n} from \"./local-provider\";\nexport type {\n  LocalPdfRasterObservation,\n  LocalPdfRasterPage,\n  PdfLocalProviderErrorCode,\n  RenderPdfWithPopplerTesseractOptions,\n} from \"./local-provider\";\nexport type {\n  PdfGlyphObservation,\n  PdfInspection,\n  PdfInspectionErrorCode,\n  PdfInspectionGap,\n  PdfPageInspection,\n  PdfPageObservation,\n  PdfRect,\n  PdfRiskInventory,\n  PdfRasterDetection,\n  PdfRasterErrorCode,\n  PdfRasterPage,\n  PdfRasterProvider,\n  PdfRasterRewrite,\n  PdfRasterRewriteCertificate,\n  PdfRasterRewriteResult,\n} from \"./types\";\n"],"mappings":";;;;;;;AAkIA,MAAa,6BAA6B;CACxC,uBAAuB;CACvB,iBAAiB;CACjB,oBAAoB;CACpB,0BAA0B;CAC1B,gBAAgB;AAClB;AAKA,MAAa,yBAAyB;CACpC,iBAAiB;CACjB,iBAAiB;CACjB,eAAe;CACf,gBAAgB;CAChB,oBAAoB;AACtB;;;AC/HA,MAAM,oBAAoB;AAC1B,MAAM,2BAA2B,KAAK,OAAO;AAC7C,MAAMA,2BAAyB,KAAK,OAAO;AAC3C,MAAMC,8BAA4B,MAAM,OAAO;AAC/C,MAAMC,+BAA6B,MAAM,OAAO;AAChD,MAAMC,kBAAgB;AACtB,MAAMC,mBAAiB;AACvB,MAAMC,qCAAmC,KAAK,OAAO;AACrD,MAAM,cAAc;AACpB,MAAM,qBAAqB;AAC3B,MAAM,UAAU;AAChB,MAAM,UAAU;AAChB,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,wBAAwB;AAC9B,MAAM,cAAc;AAEpB,MAAa,iCAAiC;CAC5C,eAAe;CACf,kBAAkB;CAClB,gBAAgB;CAChB,eAAe;CACf,eAAe;CACf,gBAAgB;AAClB;AAKA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CAEA,YAAY,MAAiC,SAAiB;EAC5D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;AAkCA,MAAM,iBACJ,MACA,YAEA,IAAI,sBAAsB,MAAM,GAAG,KAAK,IAAI,SAAS;AAEvD,MAAM,mBACJ,YACiC;CACjC,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,eAAe,QAAQ,gBAAgB;CAC7C,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,IACE,CAAC,OAAO,UAAU,GAAG,KACrB,MAAM,WACN,MAAM,WACN,CAAC,OAAO,UAAU,SAAS,KAC3B,YAAY,kBACZ,YAAY,kBACZ,CAAC,sBAAsB,KAAK,QAAQ,WAAW,KAC/C,CAAC,gBACD,aAAa,SAAS,IAAI,KAC1B,CAAC,iBACD,cAAc,SAAS,IAAI,GAE3B,MAAM,cACJ,+BAA+B,gBAC/B,wCACF;CAEF,OAAO;EACL;EACA,aAAa,QAAQ;EACrB;EACA;EACA;CACF;AACF;AAEA,MAAM,iBACJ,YACA,MACA,WACA,UAEA,IAAI,SAAS,SAAS,WAAW;CAC/B,SACE,YACA,MACA;EACE,UAAU;EACV,WAAW;EACX,SAAS;EACT,aAAa;CACf,IACC,OAAO,QAAQ,WAAW;EACzB,IAAI,UAAU,MAAM;GAClB,OACE,cACE,+BAA+B,kBAC/B,aAAa,MAAM,QACrB,CACF;GACA;EACF;EACA,QAAQ;GAAE,QAAQ,OAAO,KAAK,MAAM;GAAG,QAAQ,OAAO,KAAK,MAAM;EAAE,CAAC;CACtE,CACF;AACF,CAAC;AAEH,MAAM,cAAc,OAAmB,YAA4B;CACjE,IAAI;EACF,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK;CAC/D,QAAQ;EACN,MAAM,cACJ,+BAA+B,eAC/B,aAAa,QAAQ,oBACvB;CACF;AACF;AAEA,MAAM,eACJ,OACA,QACA,YACW;CACX,MAAM,OAAO,WAAW,OAAO,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK;CACpE,MAAM,UAAU,MAAM,WAAW,MAAM,IACnC,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,KAAK,IAC/B;CACJ,IAAI,CAAC,WAAW,QAAQ,SAAS,OAAO,UAAU,KAAK,OAAO,GAC5D,MAAM,cACJ,+BAA+B,eAC/B,aAAa,QAAQ,YACvB;CAEF,OAAO;AACT;AAOA,MAAM,uBACJ,aACqC;CACrC,IAAI,SAAS,aAAaL,0BACxB,MAAM,cACJ,+BAA+B,eAC/B,mCACF;CAEF,MAAM,UAAU,2BAA2B,CAAC,CAAC;CAC7C,IAAI,YAAY,KAAA,GACd,MAAM,cACJ,+BAA+B,gBAC/B,sCACF;CAEF,IAAI;EACF,MAAM,aAAa,KAAK,MAAM,QAAQ,QAAQ,CAAC;EAK/C,IACE,WAAW,cAAc,QACzB,CAAC,OAAO,cAAc,WAAW,SAAS,KACzC,WAAW,YAAuB,KAClC,WAAW,YAAuBG,mBACnC,CAAC,MAAM,QAAQ,WAAW,KAAK,KAC/B,WAAW,MAAM,WAAW,WAAW,WAEvC,MAAM,IAAI,MAAM,iBAAiB;EAEnC,OAAO,WAAW,MAAM,KAAK,MAAM,cAAc;GAC/C,IAAI,OAAO,SAAS,YAAY,SAAS,MACvC,MAAM,IAAI,MAAM,iBAAiB;GAGnC,MAAM,EACJ,cACA,WAAW,oBACX,gBACEG;GACJ,IACE,uBAAuB,aACvB,OAAO,gBAAgB,YACvB,CAAC,OAAO,SAAS,WAAW,KAC5B,eAAe,KACf,OAAO,iBAAiB,YACxB,CAAC,OAAO,SAAS,YAAY,KAC7B,gBAAgB,GAEhB,MAAM,IAAI,MAAM,iBAAiB;GAEnC,OAAO;IAAE;IAAc;GAAY;EACrC,CAAC;CACH,QAAQ;EACN,MAAM,cACJ,+BAA+B,gBAC/B,wDACF;CACF;AACF;AAEA,MAAM,+BACJ,OACA,QACS;CACT,IAAI,aAAa;CACjB,KAAK,MAAM,EAAE,cAAc,iBAAiB,OAAO;EACjD,MAAM,cAAc,KAAK,KAAM,cAAc,MAAO,EAAE;EACtD,MAAM,eAAe,KAAK,KAAM,eAAe,MAAO,EAAE;EACxD,MAAM,YAAY,cAAc,eAAe;EAC/C,cAAc;EACd,IACE,CAAC,OAAO,cAAc,WAAW,KACjC,CAAC,OAAO,cAAc,YAAY,KAClC,eAAe,KACf,gBAAgB,KAChB,CAAC,OAAO,cAAc,SAAS,KAC/B,YAAYL,+BACZ,CAAC,OAAO,cAAc,UAAU,KAChC,aAAaC,8BAEb,MAAM,cACJ,+BAA+B,eAC/B,0DACF;CAEJ;AACF;AAQA,MAAM,gBAAgB,SACpB,SAAS,KACT,SAAS,MACT,SAAS,MACT,SAAS,MACT,SAAS,MACT,SAAS;AAEX,MAAM,YAAY,OAAmB,UAAoC;CACvE,IAAI,SAAS;CACb,OAAO,SAAS,MAAM,QAAQ;EAC5B,IAAI,aAAa,MAAM,WAAW,EAAE,GAAG;GACrC,UAAU;GACV;EACF;EACA,IAAI,MAAM,YAAY,IAAM;GAC1B,OAAO,SAAS,MAAM,UAAU,MAAM,YAAY,IAAM,UAAU;GAClE;EACF;EACA;CACF;CACA,MAAM,aAAa;CACnB,OACE,SAAS,MAAM,UACf,CAAC,aAAa,MAAM,WAAW,EAAE,KACjC,MAAM,YAAY,IAElB,UAAU;CAEZ,IAAI,eAAe,QACjB,MAAM,cACJ,+BAA+B,eAC/B,uCACF;CAEF,MAAM,QAAQ,OAAO,KAAK,MAAM,SAAS,YAAY,MAAM,CAAC,CAAC,CAAC,SAC5D,OACF;CACA,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAC/B,MAAM,cACJ,+BAA+B,eAC/B,uCACF;CAEF,OAAO,CAAC,OAAO,MAAM;AACvB;AAEA,MAAM,wBAAwB,UAA0B;CACtD,IAAI,CAAC,iBAAiB,KAAK,KAAK,GAC9B,MAAM,cACJ,+BAA+B,eAC/B,wCACF;CAEF,MAAM,SAAS,OAAO,KAAK;CAC3B,IAAI,CAAC,OAAO,cAAc,MAAM,GAC9B,MAAM,cACJ,+BAA+B,eAC/B,2CACF;CAEF,OAAO;AACT;AAEA,MAAM,YAAY,UAA+B;CAC/C,MAAM,CAAC,OAAO,cAAc,SAAS,OAAO,CAAC;CAC7C,MAAM,CAAC,YAAY,cAAc,SAAS,OAAO,UAAU;CAC3D,MAAM,CAAC,aAAa,eAAe,SAAS,OAAO,UAAU;CAC7D,MAAM,CAAC,cAAc,gBAAgB,SAAS,OAAO,WAAW;CAChE,IAAI,UAAU,QAAQ,iBAAiB,OACrC,MAAM,cACJ,+BAA+B,eAC/B,yCACF;CAEF,MAAM,QAAQ,qBAAqB,UAAU;CAC7C,MAAM,SAAS,qBAAqB,WAAW;CAC/C,MAAM,WAAW,QAAQ,SAAS;CAClC,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAWD,6BAChD,MAAM,cACJ,+BAA+B,eAC/B,6CACF;CAEF,IAAI,cAAc;CAClB,IAAI,CAAC,aAAa,MAAM,gBAAgB,EAAE,GACxC,MAAM,cACJ,+BAA+B,eAC/B,gDACF;CAEF,MAAM,YAAY,MAAM;CACxB,eAAe;CACf,IAAI,cAAc,MAAQ,MAAM,iBAAiB,IAAM,eAAe;CACtE,IAAI,MAAM,SAAS,gBAAgB,UACjC,MAAM,cACJ,+BAA+B,eAC/B,kDACF;CAEF,OAAO;EAAE;EAAO;EAAQ,QAAQ,MAAM,SAAS,WAAW;CAAE;AAC9D;AAEA,MAAM,sBAAsB,OAAO,SAAmC;CACpE,MAAM,WAAW,MAAM,MAAM,IAAI;CACjC,IAAI,CAAC,SAAS,OAAO,KAAK,SAAS,eAAe,GAChD,MAAM,cACJ,+BAA+B,eAC/B,4CACF;CAEF,IAAI,SAAS,OAAO,WAClB,MAAM,cACJ,+BAA+B,eAC/B,4CACF;CAEF,OAAO,SAAS,MAAM,SAAS,IAAI,CAAC;AACtC;AAEA,MAAM,mBAAmB,UAAsC;CAC7D,IAAI,UAAU,KAAA,KAAa,CAAC,uBAAuB,KAAK,KAAK,GAC3D,MAAM,cACJ,+BAA+B,eAC/B,wCACF;CAEF,MAAM,SAAS,OAAO,KAAK;CAC3B,IAAI,CAAC,OAAO,cAAc,MAAM,GAC9B,MAAM,cACJ,+BAA+B,eAC/B,0CACF;CAEF,OAAO;AACT;AAEA,MAAM,qBACJ,OACA,MACA,cACA,cACuB;CACvB,MAAM,QAAQ,WAAW,OAAO,eAAe,CAAC,CAAC,MAAM,QAAQ;CAE/D,KADe,MAAM,MAAM,CAAC,EAAE,MAAM,GAAI,EAAA,EAE9B,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,GAAI,MAC9B,sFAEA,MAAM,cACJ,+BAA+B,eAC/B,6CACF;CAEF,MAAM,EAAE,cAAc,gBAAgB;CACtC,MAAM,SAAgC,CAAC;CACvC,IAAI,OAAO;CACX,IAAI,eAAe;CACnB,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,CAAC,MAAM;EACX,MAAM,SAAS,KAAK,MAAM,GAAI;EAC9B,IAAI,OAAO,OAAO,KAAK;EACvB,MAAM,OAAO,OAAO,MAAM,EAAE,CAAC,CAAC,KAAK,GAAI,CAAC,CAAC,KAAK;EAC9C,IAAI,CAAC,MAAM;EACX,IAAI,UAAU,KAAK,IAAI,GACrB,MAAM,cACJ,+BAA+B,eAC/B,kDACF;EAEF,MAAM,UAAU,GAAG,OAAO,MAAM,GAAG,GAAG,OAAO,MAAM,GAAG,GAAG,OAAO,MAAM;EACtE,IAAI,MAAM,QAAQ,YAAY,eAAe,MAAM;EACnD,eAAe;EACf,MAAM,QAAQ,KAAK;EACnB,QAAQ;EACR,MAAM,MAAM,KAAK;EACjB,MAAM,OAAO,gBAAgB,OAAO,EAAE;EACtC,MAAM,MAAM,gBAAgB,OAAO,EAAE;EACrC,MAAM,QAAQ,gBAAgB,OAAO,EAAE;EACvC,MAAM,SAAS,gBAAgB,OAAO,EAAE;EACxC,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,MAAM;EACrB,IACE,UAAU,KACV,WAAW,KACX,CAAC,OAAO,cAAc,KAAK,KAC3B,CAAC,OAAO,cAAc,MAAM,KAC5B,QAAQ,KAAK,SACb,SAAS,KAAK,QAEd,MAAM,cACJ,+BAA+B,eAC/B,4CACF;EAEF,OAAO,KAAK;GACV;GACA;GACA,QAAQ;IACN,MAAO,OAAO,cAAe,KAAK;IAClC,QAAQ,eAAgB,SAAS,eAAgB,KAAK;IACtD,OAAQ,QAAQ,cAAe,KAAK;IACpC,KAAK,eAAgB,MAAM,eAAgB,KAAK;GAClD;GACA,QAAQ;EACV,CAAC;EACD,IAAI,OAAO,SAASG,kBAClB,MAAM,cACJ,+BAA+B,eAC/B,6CACF;EAEF,IAAI,OAAO,WAAW,MAAM,MAAM,IAAIC,oCACpC,MAAM,cACJ,+BAA+B,eAC/B,2CACF;CAEJ;CACA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA,UAAU;EACV,WAAW;EACX,KAAK;EACL,YAAY;CACd;AACF;AAEA,MAAM,cAAc,OAAO,cAAqC;CAC9D,MAAM,iBAAiB,GAAG,OAAO,IAAI,MAAM;CAC3C,IAAI,CAAC,UAAU,WAAW,cAAc,GACtC,MAAM,cACJ,+BAA+B,eAC/B,qDACF;CAEF,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,SAAS;EACtC,IAAI,CAAC,SAAS,YAAY,KAAK,SAAS,eAAe,GACrD,MAAM,cACJ,+BAA+B,eAC/B,qDACF;CAEJ,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU;EACxD,IAAI,iBAAiB,uBAAuB,MAAM;EAClD,MAAM,cACJ,+BAA+B,eAC/B,sDACF;CACF;CACA,IAAI;EACF,MAAM,GAAG,WAAW;GAAE,OAAO;GAAM,WAAW;EAAK,CAAC;CACtD,QAAQ;EACN,MAAM,cACJ,+BAA+B,eAC/B,gDACF;CACF;AACF;AAEA,MAAa,gCAAgC,OAC3C,YACuC;CACvC,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,eAAe,oBAAoB,QAAQ,QAAQ;CACzD,4BAA4B,cAAc,SAAS,GAAG;CACtD,MAAM,YAAY,aAAa;CAC/B,MAAM,uBAAuB,MAAM,cACjC,SAAS,cACT,CAAC,IAAI,GACL,SAAS,WACT,eACF;CACA,MAAM,yBAAyB,MAAM,cACnC,SAAS,eACT,CAAC,WAAW,GACZ,SAAS,WACT,eACF;CACA,MAAM,kBAAkB,YACtB,qBAAqB,OAAO,SAAS,IACjC,qBAAqB,SACrB,qBAAqB,QACzB,qBACA,iBACF;CACA,MAAM,aAAa,YACjB,uBAAuB,OAAO,SAAS,IACnC,uBAAuB,SACvB,uBAAuB,QAC3B,cACA,mBACF;CACA,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,WAAW,CAAC;CAC3D,IAAI;EACF,MAAM,aAAa,KAAK,WAAW,YAAY;EAC/C,MAAM,eAAe,KAAK,WAAW,MAAM;EAC3C,MAAM,UAAU,YAAY,QAAQ,UAAU;GAAE,MAAM;GAAM,MAAM;EAAM,CAAC;EACzE,MAAM,QAA8B,CAAC;EACrC,IAAI,cAAc;EAClB,IAAI,cAAc;EAClB,IAAI,6BAA6B;EACjC,KAAK,IAAI,aAAa,GAAG,cAAc,WAAW,cAAc,GAAG;GACjE,MAAM,oBAAoB,aAAa,GAAG,aAAa,CAAC;GACxD,IAAI,sBAAsB,KAAA,GACxB,MAAM,cACJ,+BAA+B,gBAC/B,sCACF;GAEF,MAAM,mBAAmB,GAAG,aAAa,GAAG;GAC5C,MAAM,WAAW,GAAG,iBAAiB;GACrC,MAAM,cACJ,SAAS,cACT;IACE;IACA;IACA,OAAO,UAAU;IACjB;IACA,OAAO,UAAU;IACjB;IACA;IACA,OAAO,SAAS,GAAG;IACnB;IACA;GACF,GACA,SAAS,WACT,UACF;GACA,IAAI;IACF,MAAM,OAAO,MAAM,oBAAoB,QAAQ;IAC/C,eAAe,KAAK,OAAO;IAC3B,IACE,CAAC,OAAO,cAAc,WAAW,KACjC,cAAcH,8BAEd,MAAM,cACJ,+BAA+B,eAC/B,kDACF;IAEF,MAAM,MAAM,MAAM,cAChB,SAAS,eACT;KAAC;KAAU;KAAU;KAAM,SAAS;KAAa;IAAK,GACtD,SAAS,WACT,KACF;IACA,MAAM,cAAc,kBAClB,IAAI,QACJ,MACA,mBACA,aAAa,CACf;IACA,eAAe,YAAY,OAAO;IAClC,8BAA8B,OAAO,WACnC,YAAY,MACZ,MACF;IACA,IACE,CAAC,OAAO,cAAc,WAAW,KACjC,cAAcE,oBACd,CAAC,OAAO,cAAc,0BAA0B,KAChD,6BAA6BC,oCAE7B,MAAM,cACJ,+BAA+B,eAC/B,2DACF;IAEF,MAAM,KAAK;KACT;KACA,aAAa,KAAK;KAClB,cAAc,KAAK;KACnB,QAAQ,KAAK;IACf,CAAC;GACH,UAAU;IACR,MAAM,OAAO,QAAQ,CAAC,CAAC,OAAO,UAAiC;KAC7D,IAAI,MAAM,SAAS,UAAU;KAC7B,MAAM,cACJ,+BAA+B,eAC/B,4CACF;IACF,CAAC;GACH;EACF;EACA,OAAO;GACL,UAAU;IACR,YAAY;IACZ,cAAc;IACd;IACA,SAAS;IACT;IACA,aAAa,SAAS;GACxB;GACA;EACF;CACF,UAAU;EACR,MAAM,YAAY,SAAS;CAC7B;AACF;;;ACrqBA,MAAa,kCAAkC;AAC/C,MAAa,8BAA8B;AAC3C,MAAa,4BAA4B,MAAM,OAAO;AACtD,MAAa,6BAA6B,MAAM,OAAO;AACvD,MAAa,8BAA8B,MAAM,OAAO;AACxD,MAAa,oCAAoC,KAAK,OAAO;AAC7D,MAAa,yBAAyB,KAAK,OAAO;AAClD,MAAa,oCAAoC,KAAK,OAAO;AAC7D,MAAa,+BAA+B,MAAM,OAAO;AACzD,MAAa,kBAAkB;AAC/B,MAAa,uBAAuB;AACpC,MAAa,uBAAuB;AACpC,MAAa,gBAAgB;AAC7B,MAAa,iBAAiB;AAC9B,MAAa,+BAA+B,KAAK,OAAO;AACxD,MAAa,mCAAmC,KAAK,OAAO;AAC5D,MAAa,kCAAkC,KAAK,OAAO;;AAE3D,MAAa,sCAAsC;AAEnD,IAAa,qBAAb,cAAwC,MAAM;CAC5C;CAEA,YAAY,MAA8B,SAAiB;EACzD,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,MAAM;CACxC;CAEA,YAAY,MAA0B,SAAiB;EACrD,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;AAEA,MAAM,aAAa,YAA4C;CAI7D,OAHa,OAAO,OAAO,0BAA0B,CAAC,CAAC,MAAM,cAC3D,QAAQ,WAAW,GAAG,UAAU,EAAE,CAE1B,KAAK,2BAA2B;AAC5C;AAEA,MAAM,mBAAmB,YAAwC;CAI/D,OAHa,OAAO,OAAO,sBAAsB,CAAC,CAAC,MAAM,cACvD,QAAQ,WAAW,GAAG,UAAU,EAAE,CAE1B,KAAK,uBAAuB;AACxC;AAMA,MAAa,cACX,UACA,UAA6B,CAAC,MACZ;CAClB,MAAM,UAAU,2BAA2B,CAAC,CAAC;CAC7C,IAAI,YAAY,KAAA,GACd,MAAM,IAAI,mBACR,2BAA2B,iBAC3B,yDACF;CAEF,IAAI;EACF,MAAM,eAAe,QAAQ;EAC7B,OAAO,KAAK,MACV,QACE,UACA,iBAAiB,KAAA,IAAY,KAAA,IAAY,KAAK,UAAU,YAAY,CACtE,CACF;CACF,SAAS,OAAO;EACd,MAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;EAC3C,MAAM,IAAI,mBAAmB,UAAU,OAAO,GAAG,OAAO;CAC1D;AACF;;;;;AAaA,MAAa,kCAAkC,EAC7C,UACA,SACA,iBACmE;CACnE,MAAM,UACJ,2BAA2B,CAAC,CAAC;CAC/B,IAAI,YAAY,KAAA,GACd,MAAM,IAAI,eACR,uBAAuB,oBACvB,+DACF;CAEF,IAAI;EACF,MAAM,SAAS,QAAQ,UAAU,KAAK,UAAU,OAAO,GAAG,UAAU;EACpE,OAAO;GACL,UAAU,OAAO;GACjB,aAAa,KAAK,MAAM,OAAO,eAAe;EAChD;CACF,SAAS,OAAO;EACd,MAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;EAC3C,MAAM,IAAI,eAAe,gBAAgB,OAAO,GAAG,OAAO;CAC5D;AACF;AAsBA,MAAM,UAAU,UACd,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;;AAGjD,MAAa,sBAAsB,EACjC,UACA,UACA,UACA,OACA,UAAU;CAAC;CAAG;CAAG;AAAC,QACqC;CACvD,IAAI,SAAS,aAAA,UACX,MAAM,IAAI,eACR,uBAAuB,eACvB,mDACF;CAEF,IAAI,MAAM,SAAA,KACR,MAAM,IAAI,eACR,uBAAuB,eACvB,yDACF;CAEF,IAAI,kBAAkB;CACtB,IAAI,yBAAyB;CAC7B,MAAM,cAAc,IAAI,YAAY;CACpC,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,OAAO,KAAK,aAAa,SAAS,UACpC,MAAM,IAAI,eACR,uBAAuB,iBACvB,uDACF;EAEF,MAAM,oBAAoB,YAAY,OACpC,KAAK,YAAY,IACnB,CAAC,CAAC;EACF,IAAI,oBAAA,UACF,MAAM,IAAI,eACR,uBAAuB,eACvB,6DACF;EAEF,0BAA0B;EAC1B,IAAI,yBAAA,UACF,MAAM,IAAI,eACR,uBAAuB,eACvB,2EACF;EAEF,MAAM,EAAE,cAAc,gBAAgB;EACtC,IACE,CAAC,OAAO,cAAc,WAAW,KACjC,CAAC,OAAO,cAAc,YAAY,KAClC,eAAe,KACf,gBAAgB,GAEhB,MAAM,IAAI,eACR,uBAAuB,iBACvB,2DACF;EAEF,MAAM,WAAW,cAAc,eAAe;EAC9C,IACE,CAAC,OAAO,cAAc,QAAQ,KAC9B,WAAA,aACA,KAAK,OAAO,eAAe,UAE3B,MAAM,IAAI,eACR,uBAAuB,eACvB,qFACF;EAEF,mBAAmB;EACnB,IACE,CAAC,OAAO,cAAc,eAAe,KACrC,kBAAA,WAEA,MAAM,IAAI,eACR,uBAAuB,eACvB,gEACF;CAEJ;CACA,MAAM,UAAU,2BAA2B;CAC3C,IAAI;CACJ,IAAI;EACF,eAAe,MAAM,KAAK,SAAS;GACjC,MAAM,WACJ,KAAK,2BAA2B,KAAA,IAC5B,KAAA,IACA,iCACE,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,YAAY,IAAI,GAC9C,KAAK,wBACL,EAAE,QAAQ,CACZ;GACN,MAAM,SACJ,aAAa,KAAA,IACT,SAAS,WAAW,KAAK,YAAY,IAAI,IACzC,SAAS,+BAA+B,KAAK,YAAY,MAAM,EAC7D,YAAY,SACd,CAAC;GACP,OAAO;IACL,aAAa,KAAK;IAClB,aAAa,KAAK;IAClB,cAAc,KAAK;IACnB,aAAa,OAAO,KAAK,MAAM;IAC/B,YAAY,OAAO,iBAAiB,KAAK,EAAE,OAAO,WAAW;KAC3D;KACA;IACF,EAAE;GACJ;EACF,CAAC;CACH,QAAQ;EACN,MAAM,IAAI,eACR,uBAAuB,iBACvB,+CACF;CACF;CACA,OAAO,+BAA+B;EACpC;EACA,SAAS;GACP,iBAAA;GACA,cAAc,OAAO,QAAQ;GAC7B;GACA;GACA,OAAO;EACT;EACA,YAAY,MAAM,KAAK,EAAE,aAAa,MAAM;CAC9C,CAAC;AACH"}

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "@stll/anonymize-pdf",
-  "version": "0.0.1-placeholder.0",
-  "description": "Placeholder to bootstrap npm trusted publishing. The real package will be published from the anonymize repository via OIDC.",
-  "license": "MIT"
+  "version": "2.4.0",
+  "description": "Fail-closed PDF coverage and risk inspection contracts for stella anonymization",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs",
+      "default": "./dist/index.mjs"
+    }
+  },
+  "files": [
+    "ATTRIBUTION.md",
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/stella/anonymize.git"
+  },
+  "license": "Apache-2.0",
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "bun ../../scripts/tsc-native.ts --noEmit -p tsconfig.json && bun ../../scripts/tsc-native.ts --noEmit -p tsconfig.test.json",
+    "test": "bun test",
+    "format": "oxfmt ."
+  },
+  "dependencies": {
+    "@stll/anonymize": "2.4.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "bun-types": "^1.3.14",
+    "tsdown": "^0.22.7",
+    "typescript": "^6.0.3"
+  }
 }