modern-pdf-lib 0.14.0 → 0.14.1

package/dist/index.cjs

@@ -6307,15 +6307,76 @@ function padPassword(password) {
 	return result;
 }
 /**
-* Truncate a UTF-8 password to 127 bytes for R=5/R=6 (SASLprep would
-* be ideal but we approximate with simple truncation as most PDF
-* libraries do).
+* Prepare a password for R=5/R=6 (AES-256) using SASLprep (RFC 4013).
+*
+* ISO 32000-2 SS7.6.3.1 requires SASLprep normalization for passwords
+* used with encryption revision 5 and 6.  The steps are:
+*
+* 1. Map: Convert non-ASCII space characters to U+0020, remove
+*    "commonly mapped to nothing" characters (RFC 3454 B.1).
+* 2. Normalize: Apply Unicode NFKC normalization.
+* 3. Prohibit: Reject characters from RFC 3454 prohibited tables.
+* 4. Bidi: Check bidirectional string rules.
+*
+* The result is truncated to 127 UTF-8 bytes per the PDF spec.
 */
 function preparePasswordV5(password) {
-	const encoded = new TextEncoder().encode(password);
+	const prepared = saslprep(password);
+	const encoded = new TextEncoder().encode(prepared);
 	return encoded.length > 127 ? encoded.subarray(0, 127) : encoded;
 }
 /**
+* Simplified SASLprep (RFC 4013) profile of stringprep (RFC 3454).
+*
+* Covers the mapping, normalization, and prohibited-character steps
+* needed for PDF password preparation.  Bidi checking is omitted
+* since PDF passwords are typically LTR and the spec allows
+* implementations to skip it.
+*
+* @internal
+*/
+function saslprep(input) {
+	let mapped = "";
+	for (const ch of input) {
+		const cp = ch.codePointAt(0);
+		if (isMappedToNothing(cp)) continue;
+		if (isNonAsciiSpace(cp)) {
+			mapped += " ";
+			continue;
+		}
+		mapped += ch;
+	}
+	const normalized = mapped.normalize("NFKC");
+	for (const ch of normalized) {
+		const cp = ch.codePointAt(0);
+		if (isProhibited(cp)) throw new Error(`Password contains prohibited character U+${cp.toString(16).toUpperCase().padStart(4, "0")} (SASLprep)`);
+	}
+	return normalized;
+}
+/** RFC 3454 Table B.1 — Commonly mapped to nothing. */
+function isMappedToNothing(cp) {
+	return cp === 173 || cp === 6150 || cp === 8203 || cp === 8288 || cp === 65279 || cp === 847 || cp === 6155 || cp === 6156 || cp === 6157 || cp === 8204 || cp === 8205 || cp >= 65024 && cp <= 65039;
+}
+/** RFC 3454 Table C.1.2 — Non-ASCII space characters. */
+function isNonAsciiSpace(cp) {
+	return cp === 160 || cp === 5760 || cp === 8192 || cp === 8193 || cp === 8194 || cp === 8195 || cp === 8196 || cp === 8197 || cp === 8198 || cp === 8199 || cp === 8200 || cp === 8201 || cp === 8202 || cp === 8239 || cp === 8287 || cp === 12288;
+}
+/**
+* RFC 3454 prohibited tables (C.2.1, C.2.2, C.3, C.4, C.5, C.6, C.7, C.8, C.9).
+* Simplified to the ranges most likely to appear in passwords.
+*/
+function isProhibited(cp) {
+	if (cp <= 31 || cp === 127) return true;
+	if (cp >= 128 && cp <= 159 || cp === 1757 || cp === 1807 || cp === 6158 || cp >= 8204 && cp <= 8205 || cp >= 8232 && cp <= 8233 || cp >= 8288 && cp <= 8291 || cp >= 8298 && cp <= 8303 || cp === 65279 || cp >= 65529 && cp <= 65532 || cp >= 119155 && cp <= 119162) return true;
+	if (cp >= 57344 && cp <= 63743 || cp >= 983040 && cp <= 1048573 || cp >= 1048576 && cp <= 1114109) return true;
+	if (cp >= 64976 && cp <= 65007 || (cp & 65535) === 65534 || (cp & 65535) === 65535) return true;
+	if (cp >= 55296 && cp <= 57343) return true;
+	if (cp === 65529 || cp === 65530 || cp === 65531 || cp === 65532) return true;
+	if (cp === 832 || cp === 833 || cp === 8206 || cp === 8207 || cp >= 8234 && cp <= 8238 || cp >= 8298 && cp <= 8303) return true;
+	if (cp === 917505 || cp >= 917536 && cp <= 917631) return true;
+	return false;
+}
+/**
 * Concatenate multiple Uint8Arrays into one.
 */
 function concat$1(...arrays) {
@@ -6594,11 +6655,33 @@ async function computeEncryptionKeyR6(password, dict, isOwner) {
 	}
 }
 /**
+* LRU cache for file encryption keys.
+*
+* Keyed on a hash derived from password + encryption dict parameters,
+* so re-opening the same PDF with the same password skips the expensive
+* key derivation (especially for R=6 which runs 64+ rounds of AES+SHA).
+*/
+const fileKeyCache = /* @__PURE__ */ new Map();
+const FILE_KEY_CACHE_MAX = 32;
+/**
+* Build a cache key string from the inputs that uniquely identify
+* a key derivation result.
+*/
+function buildCacheKey(password, dict, fileId) {
+	const oHex = Array.from(dict.ownerKey.subarray(0, 16), (b) => b.toString(16).padStart(2, "0")).join("");
+	const uHex = Array.from(dict.userKey.subarray(0, 16), (b) => b.toString(16).padStart(2, "0")).join("");
+	const fHex = Array.from(fileId.subarray(0, 16), (b) => b.toString(16).padStart(2, "0")).join("");
+	return `${dict.revision}:${dict.permissions}:${password}:${oHex}:${uHex}:${fHex}`;
+}
+/**
 * Compute the file encryption key from a password and encryption dict.
 *
 * Tries the password as both user and owner password. Returns the key
 * on the first successful match, or throws if neither works.
 *
+* Results are cached so that re-opening the same PDF with the same
+* password skips the expensive key derivation.
+*
 * @param password  The password to try.
 * @param dict      Encryption dictionary values.
 * @param fileId    The first element of the /ID array (unused for R>=5).
@@ -6606,23 +6689,35 @@ async function computeEncryptionKeyR6(password, dict, isOwner) {
 * @throws          If the password is incorrect.
 */
 async function computeFileEncryptionKey(password, dict, fileId) {
+	const ck = buildCacheKey(password, dict, fileId);
+	const cached = fileKeyCache.get(ck);
+	if (cached) return cached.slice();
+	let result;
 	if (dict.revision >= 6) {
 		const userKey = await computeEncryptionKeyR6(password, dict, false);
-		if (userKey) return userKey;
-		const ownerKey = await computeEncryptionKeyR6(password, dict, true);
-		if (ownerKey) return ownerKey;
-		throw new Error("Incorrect password for R=6 encryption");
-	}
-	if (dict.revision === 5) {
+		if (userKey) result = userKey;
+		else {
+			const ownerKey = await computeEncryptionKeyR6(password, dict, true);
+			if (ownerKey) result = ownerKey;
+			else throw new Error("Incorrect password for R=6 encryption");
+		}
+	} else if (dict.revision === 5) {
 		const userKey = await computeEncryptionKeyR5(password, dict, false);
-		if (userKey) return userKey;
-		const ownerKey = await computeEncryptionKeyR5(password, dict, true);
-		if (ownerKey) return ownerKey;
-		throw new Error("Incorrect password for R=5 encryption");
-	}
-	if (await verifyUserPassword(password, dict, fileId)) return computeEncryptionKeyR2R4(password, dict, fileId);
-	if (await verifyOwnerPassword(password, dict, fileId)) return computeEncryptionKeyR2R4Bytes(recoverUserKeyFromOwner(password, dict), dict, fileId);
-	throw new Error("Incorrect password");
+		if (userKey) result = userKey;
+		else {
+			const ownerKey = await computeEncryptionKeyR5(password, dict, true);
+			if (ownerKey) result = ownerKey;
+			else throw new Error("Incorrect password for R=5 encryption");
+		}
+	} else if (await verifyUserPassword(password, dict, fileId)) result = computeEncryptionKeyR2R4(password, dict, fileId);
+	else if (await verifyOwnerPassword(password, dict, fileId)) result = computeEncryptionKeyR2R4Bytes(recoverUserKeyFromOwner(password, dict), dict, fileId);
+	else throw new Error("Incorrect password");
+	if (fileKeyCache.size >= FILE_KEY_CACHE_MAX) {
+		const firstKey = fileKeyCache.keys().next().value;
+		if (firstKey !== void 0) fileKeyCache.delete(firstKey);
+	}
+	fileKeyCache.set(ck, result.slice());
+	return result;
 }
 /**
 * Compute encryption key from raw password bytes (already padded/recovered).
@@ -6885,6 +6980,15 @@ var PdfEncryptionHandler = class PdfEncryptionHandler {
 	perms;
 	/** The file ID (first element of /ID array). */
 	fileId;
+	/**
+	* Cache for per-object derived keys (V=1-4 only).
+	* Key: `(objNum << 16) | genNum` — unique integer per object.
+	* Value: the derived encryption key.
+	*
+	* Avoids recomputing MD5(fileKey + objNum + genNum [+ sAlT]) for
+	* every string and stream in the same object.
+	*/
+	objectKeyCache = /* @__PURE__ */ new Map();
 	constructor(params) {
 		this.fileKey = params.fileKey;
 		this.version = params.version;
@@ -7037,6 +7141,9 @@ var PdfEncryptionHandler = class PdfEncryptionHandler {
 	*/
 	deriveObjectKey(objNum, genNum) {
 		if (this.version === 5) return this.fileKey;
+		const cacheKey = objNum << 16 | genNum;
+		const cached = this.objectKeyCache.get(cacheKey);
+		if (cached) return cached;
 		const extra = this.useAes ? 4 : 0;
 		const input = new Uint8Array(this.fileKey.length + 5 + extra);
 		input.set(this.fileKey, 0);
@@ -7054,7 +7161,9 @@ var PdfEncryptionHandler = class PdfEncryptionHandler {
 		}
 		const hash = md5(input);
 		const keyLen = Math.min(this.keyLengthBits / 8 + 5, 16);
-		return hash.subarray(0, keyLen);
+		const key = hash.subarray(0, keyLen);
+		this.objectKeyCache.set(cacheKey, key);
+		return key;
 	}
 	/**
 	* Encrypt raw data for a specific object.
@@ -10216,23 +10325,73 @@ function findStringForward(data, needle, startOffset) {
 	return -1;
 }
 /**
-* Prepare a PDF for signing by appending a signature dictionary
-* via incremental update.
+* Build a PDF content stream for a visible signature appearance.
 *
-* This function:
-* 1. Appends a new signature field and value to the PDF
-* 2. Inserts an empty `/Contents` placeholder of the specified size
-* 3. Computes the `/ByteRange` that excludes the `/Contents` value
+* Renders a bordered rectangle with optional background color and
+* text lines rendered in Helvetica.
 *
-* The resulting PDF bytes can be hashed (excluding the placeholder gap)
-* and the hash can be signed.
-*
-* @param pdfBytes           The original PDF file bytes.
-* @param signatureFieldName The name for the signature field.
-* @param placeholderSize    Size in bytes for the signature. Default 8192.
-* @returns                  The prepared PDF and ByteRange info.
+* @internal
+*/
+function buildSignatureAppearanceStream(options) {
+	const [, , w, h] = options.rect;
+	const fontSize = options.fontSize ?? 10;
+	const borderWidth = options.borderWidth ?? 1;
+	const borderColor = options.borderColor ?? [
+		0,
+		0,
+		0
+	];
+	const bgColor = options.backgroundColor;
+	const lines = options.textLines;
+	const ops = [];
+	ops.push("q");
+	if (bgColor) {
+		ops.push(`${n$5(bgColor[0])} ${n$5(bgColor[1])} ${n$5(bgColor[2])} rg`);
+		ops.push(`0 0 ${n$5(w)} ${n$5(h)} re`);
+		ops.push("f");
+	}
+	if (borderWidth > 0) {
+		ops.push(`${n$5(borderColor[0])} ${n$5(borderColor[1])} ${n$5(borderColor[2])} RG`);
+		ops.push(`${n$5(borderWidth)} w`);
+		const bw2 = borderWidth / 2;
+		ops.push(`${n$5(bw2)} ${n$5(bw2)} ${n$5(w - borderWidth)} ${n$5(h - borderWidth)} re`);
+		ops.push("S");
+	}
+	if (lines.length > 0) {
+		const margin = borderWidth + 4;
+		const lineHeight = fontSize * 1.2;
+		ops.push("BT");
+		ops.push(`/F1 ${n$5(fontSize)} Tf`);
+		ops.push("0 0 0 rg");
+		const startY = h - margin - fontSize;
+		for (let i = 0; i < lines.length; i++) {
+			const y = startY - i * lineHeight;
+			if (y < margin) break;
+			ops.push(`${n$5(margin)} ${n$5(y)} Td`);
+			ops.push(`(${escapePdfString(lines[i])}) Tj`);
+			ops.push(`${n$5(-margin)} ${n$5(-y)} Td`);
+		}
+		ops.push("ET");
+	}
+	ops.push("Q");
+	return ops.join("\n");
+}
+/**
+* Escape a string for use inside a PDF literal string `(...)`.
+* @internal
+*/
+function escapePdfString(str) {
+	return str.replace(/\\/g, "\\\\").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
+}
+/**
+* Format a number for PDF operators (max 6 decimal places, no trailing zeros).
+* @internal
 */
-function prepareForSigning(pdfBytes, signatureFieldName, placeholderSize = 8192) {
+function n$5(value) {
+	if (Number.isInteger(value)) return value.toString();
+	return value.toFixed(6).replace(/\.?0+$/, "");
+}
+function prepareForSigning(pdfBytes, signatureFieldName, placeholderSize = 8192, appearance) {
 	const pdfStr = decoder$4.decode(pdfBytes);
 	const startxrefIdx = pdfStr.lastIndexOf("startxref");
 	if (startxrefIdx === -1) throw new Error("Cannot find startxref in PDF — file may be corrupted");
@@ -10249,9 +10408,21 @@ function prepareForSigning(pdfBytes, signatureFieldName, placeholderSize = 8192)
 	const infoMatch = pdfStr.match(/\/Info\s+(\d+)\s+(\d+)\s+R/);
 	const sigValueObjNum = originalSize;
 	const sigFieldObjNum = originalSize + 1;
-	const newSize = originalSize + 2;
+	let apStreamObjNum = -1;
+	let newSize = originalSize + 2;
+	if (appearance) {
+		apStreamObjNum = newSize;
+		newSize++;
+	}
 	const sigDictStr = buildSignatureDictString(placeholderSize, signatureFieldName);
-	const sigFieldDict = `<< /Type /Annot /Subtype /Widget /FT /Sig /T (${signatureFieldName}) /V ${sigValueObjNum} 0 R /F 132 /Rect [0 0 0 0] >>`;
+	let rectStr = "0 0 0 0";
+	if (appearance) {
+		const [x, y, w, h] = appearance.rect;
+		rectStr = `${x} ${y} ${x + w} ${y + h}`;
+	}
+	let sigFieldDict = `<< /Type /Annot /Subtype /Widget /FT /Sig /T (${signatureFieldName}) /V ${sigValueObjNum} 0 R /F 132 /Rect [${rectStr}]`;
+	if (appearance && apStreamObjNum >= 0) sigFieldDict += ` /AP << /N ${apStreamObjNum} 0 R >>`;
+	sigFieldDict += " >>";
 	let appendix = "\n";
 	const objOffsets = /* @__PURE__ */ new Map();
 	const sigValueStart = pdfBytes.length + encoder$3.encode(appendix).length;
@@ -10264,11 +10435,28 @@ function prepareForSigning(pdfBytes, signatureFieldName, placeholderSize = 8192)
 	appendix += `${sigFieldObjNum} 0 obj\n`;
 	appendix += sigFieldDict;
 	appendix += `\nendobj\n`;
+	let apStreamStart = -1;
+	if (appearance && apStreamObjNum >= 0) {
+		apStreamStart = pdfBytes.length + encoder$3.encode(appendix).length;
+		objOffsets.set(apStreamObjNum, apStreamStart);
+		const apContent = buildSignatureAppearanceStream(appearance);
+		const [, , w, h] = appearance.rect;
+		appendix += `${apStreamObjNum} 0 obj\n`;
+		appendix += `<< /Type /XObject /Subtype /Form /BBox [0 0 ${w} ${h}]`;
+		appendix += ` /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> >>`;
+		appendix += ` /Length ${apContent.length} >>\n`;
+		appendix += `stream\n`;
+		appendix += apContent;
+		appendix += `\nendstream\n`;
+		appendix += `endobj\n`;
+	}
 	const xrefOffset = pdfBytes.length + encoder$3.encode(appendix).length;
+	const objCount = appearance ? 3 : 2;
 	appendix += "xref\n";
-	appendix += `${sigValueObjNum} 2\n`;
+	appendix += `${sigValueObjNum} ${objCount}\n`;
 	appendix += `${sigValueStart.toString().padStart(10, "0")} 00000 n \n`;
 	appendix += `${sigFieldStart.toString().padStart(10, "0")} 00000 n \n`;
+	if (appearance && apStreamStart >= 0) appendix += `${apStreamStart.toString().padStart(10, "0")} 00000 n \n`;
 	appendix += "trailer\n";
 	appendix += "<<\n";
 	appendix += `/Size ${newSize}\n`;
@@ -11058,7 +11246,32 @@ function parsePkcs7ForCert(pkcs7Bytes) {
 */
 async function signPdf(pdfBytes, fieldName, options) {
 	const hashAlgorithm = options.hashAlgorithm ?? "SHA-256";
-	const { preparedPdf, byteRange } = prepareForSigning(pdfBytes, fieldName, 8192);
+	let prepareAppearance;
+	if (options.appearance) {
+		const ap = options.appearance;
+		let textLines = ap.text;
+		if (!textLines) {
+			textLines = [];
+			try {
+				const { subjectCN } = extractIssuerAndSerial(options.certificate);
+				if (subjectCN) textLines.push(`Signed by: ${subjectCN}`);
+			} catch {
+				textLines.push("Digitally Signed");
+			}
+			if (options.reason) textLines.push(`Reason: ${options.reason}`);
+			if (options.location) textLines.push(`Location: ${options.location}`);
+			textLines.push(`Date: ${(/* @__PURE__ */ new Date()).toISOString().substring(0, 10)}`);
+		}
+		prepareAppearance = {
+			rect: ap.rect,
+			textLines,
+			fontSize: ap.fontSize,
+			backgroundColor: ap.backgroundColor,
+			borderColor: ap.borderColor,
+			borderWidth: ap.borderWidth
+		};
+	}
+	const { preparedPdf, byteRange } = prepareForSigning(pdfBytes, fieldName, 8192, prepareAppearance);
 	return embedSignature(preparedPdf, await buildPkcs7Signature(await computeSignatureHash(preparedPdf, byteRange.byteRange, hashAlgorithm), {
 		signerInfo: {
 			certificate: options.certificate,
@@ -18870,6 +19083,30 @@ var PdfDocument = class PdfDocument {
 		return imageRef;
 	}
 	/**
+	* Embed an image, auto-detecting the format from file headers.
+	*
+	* Inspects the first bytes to determine whether the data is PNG or JPEG,
+	* then delegates to {@link embedPng} or {@link embedJpeg} accordingly.
+	*
+	* @param imageData  Raw image file bytes (PNG or JPEG).
+	* @returns          An {@link ImageRef} to pass to `page.drawImage()`.
+	* @throws           If the image format cannot be detected.
+	*
+	* @example
+	* ```ts
+	* const bytes = new Uint8Array(await readFile('photo.jpg'));
+	* const image = await pdf.embedImage(bytes);
+	* page.drawImage(image, { x: 50, y: 400, width: 200, height: 150 });
+	* ```
+	*/
+	async embedImage(imageData) {
+		const data = imageData instanceof ArrayBuffer ? new Uint8Array(imageData) : imageData;
+		if (data.length < 4) throw new Error("Image data too short to detect format");
+		if (data[0] === 137 && data[1] === 80 && data[2] === 78 && data[3] === 71) return this.embedPng(data);
+		if (data[0] === 255 && data[1] === 216 && data[2] === 255) return this.embedJpeg(data);
+		throw new Error(`Unsupported image format. Expected PNG (89 50 4E 47) or JPEG (FF D8 FF), got ${Array.from(data.subarray(0, 4)).map((b) => b.toString(16).padStart(2, "0")).join(" ")}.`);
+	}
+	/**
 	* Embed pages from another PDF as Form XObjects.
 	*
 	* Each embedded page is turned into a self-contained Form XObject that
@@ -21770,6 +22007,261 @@ var PdfRedactAnnotation = class PdfRedactAnnotation extends require_pdfPage.PdfA
 	}
 };
 
+//#endregion
+//#region src/annotation/types/popupAnnotation.ts
+/**
+* @module annotation/types/popupAnnotation
+*
+* Popup annotation — a floating window that displays the text of its
+* parent annotation (typically a text/sticky note annotation).
+*
+* Popup annotations have no appearance of their own; the PDF viewer
+* renders them as a resizable window near the parent annotation.
+*
+* Reference: PDF 1.7 spec, Section 12.5.6.14 (Popup Annotations).
+*/
+/**
+* A popup annotation (subtype /Popup).
+*
+* Displays a floating window containing the text of its parent
+* annotation. The parent annotation references this popup via its
+* `/Popup` entry, and this popup references its parent via `/Parent`.
+*/
+var PdfPopupAnnotation = class PdfPopupAnnotation extends require_pdfPage.PdfAnnotation {
+	constructor(dict) {
+		super("Popup", dict);
+	}
+	/**
+	* Create a new popup annotation.
+	*
+	* @param options.open  Whether the popup is initially open. Default: false.
+	* @param options.parent  Reference to the parent annotation (set after registration).
+	*/
+	static create(options) {
+		const annot = new PdfPopupAnnotation(require_pdfPage.buildAnnotationDict("Popup", options));
+		if (options.open !== void 0) annot.setOpen(options.open);
+		return annot;
+	}
+	/**
+	* Create a PdfPopupAnnotation from an existing dictionary.
+	*/
+	static fromDict(dict, _resolver) {
+		return new PdfPopupAnnotation(dict);
+	}
+	/** Whether the popup is initially open. */
+	isOpen() {
+		const obj = this.dict.get("/Open");
+		if (obj && obj.kind === "bool") return obj.value;
+		return false;
+	}
+	/** Set the initial open state. */
+	setOpen(open) {
+		this.dict.set("/Open", require_pdfCatalog.PdfBool.of(open));
+	}
+	/**
+	* Set the parent annotation reference.
+	* The parent is the annotation whose text this popup displays.
+	*/
+	setParent(parentRef) {
+		this.dict.set("/Parent", parentRef);
+	}
+	/** Get the parent annotation reference, if set. */
+	getParent() {
+		const obj = this.dict.get("/Parent");
+		if (obj && obj.kind === "ref") return obj;
+	}
+};
+
+//#endregion
+//#region src/annotation/types/caretAnnotation.ts
+/**
+* @module annotation/types/caretAnnotation
+*
+* Caret annotation — marks a text insertion point in the document.
+*
+* A caret annotation indicates where text should be inserted. It is
+* typically used in document review workflows to suggest additions.
+* The annotation renders as a caret (^) symbol at the specified
+* location.
+*
+* Reference: PDF 1.7 spec, Section 12.5.6.11 (Caret Annotations).
+*/
+/**
+* A caret annotation (subtype /Caret).
+*
+* Marks an insertion point in the text. Used in review workflows
+* to indicate where new content should be added.
+*/
+var PdfCaretAnnotation = class PdfCaretAnnotation extends require_pdfPage.PdfAnnotation {
+	constructor(dict) {
+		super("Caret", dict);
+	}
+	/**
+	* Create a new caret annotation.
+	*
+	* @param options.symbol  The caret symbol. Default: 'None'.
+	* @param options.caretRect  The inner rectangle (RD) that describes
+	*   the difference between the annotation rect and the actual caret
+	*   position. Format: [left, bottom, right, top] insets.
+	*/
+	static create(options) {
+		const annot = new PdfCaretAnnotation(require_pdfPage.buildAnnotationDict("Caret", options));
+		if (options.symbol !== void 0) annot.setSymbol(options.symbol);
+		if (options.caretRect !== void 0) annot.setCaretRect(options.caretRect);
+		return annot;
+	}
+	/**
+	* Create a PdfCaretAnnotation from an existing dictionary.
+	*/
+	static fromDict(dict, _resolver) {
+		return new PdfCaretAnnotation(dict);
+	}
+	/** Get the caret symbol. Defaults to 'None'. */
+	getSymbol() {
+		const obj = this.dict.get("/Sy");
+		if (obj && obj.kind === "name") {
+			if ((obj.value.startsWith("/") ? obj.value.slice(1) : obj.value) === "P") return "P";
+		}
+		return "None";
+	}
+	/** Set the caret symbol. */
+	setSymbol(symbol) {
+		this.dict.set("/Sy", require_pdfCatalog.PdfName.of(symbol));
+	}
+	/**
+	* Get the inner rectangle differences (RD entry).
+	* Returns [left, bottom, right, top] insets from the annotation rect.
+	*/
+	getCaretRect() {
+		const obj = this.dict.get("/RD");
+		if (obj && obj.kind === "array" && obj.items.length === 4) return obj.items.map((item) => {
+			if (item.kind === "number") return item.value;
+			return 0;
+		});
+	}
+	/** Set the inner rectangle differences (RD entry). */
+	setCaretRect(rd) {
+		this.dict.set("/RD", require_pdfCatalog.PdfArray.of(rd.map(require_pdfCatalog.PdfNumber.of)));
+	}
+};
+
+//#endregion
+//#region src/annotation/types/fileAttachmentAnnotation.ts
+/**
+* @module annotation/types/fileAttachmentAnnotation
+*
+* File attachment annotation — embeds a file as an inline annotation
+* on a page, displayed as a clickable icon.
+*
+* Unlike document-level attachments (via `attachFile()`), file attachment
+* annotations are positioned on a specific page and rendered as an icon
+* that users can click to open or save the embedded file.
+*
+* Reference: PDF 1.7 spec, Section 12.5.6.15 (File Attachment Annotations).
+*/
+/**
+* A file attachment annotation (subtype /FileAttachment).
+*
+* Embeds a file directly in the annotation, rendered as a clickable
+* icon on the page. When the user clicks the icon, the PDF viewer
+* allows them to open or save the embedded file.
+*/
+var PdfFileAttachmentAnnotation = class PdfFileAttachmentAnnotation extends require_pdfPage.PdfAnnotation {
+	/** The raw file data to embed. */
+	fileData;
+	/** The filename to display. */
+	fileName;
+	/** Optional MIME type. */
+	mimeType;
+	/** Optional file description. */
+	fileDescription;
+	constructor(dict) {
+		super("FileAttachment", dict);
+	}
+	/**
+	* Create a new file attachment annotation.
+	*
+	* @param options.file       The file data to embed.
+	* @param options.fileName   The filename (e.g., 'invoice.xml').
+	* @param options.mimeType   Optional MIME type (e.g., 'application/xml').
+	* @param options.description Optional description of the file.
+	* @param options.icon       Icon to display. Default: 'GraphPushPin'.
+	*/
+	static create(options) {
+		const annot = new PdfFileAttachmentAnnotation(require_pdfPage.buildAnnotationDict("FileAttachment", options));
+		annot.fileData = options.file;
+		annot.fileName = options.fileName;
+		annot.mimeType = options.mimeType;
+		annot.fileDescription = options.description;
+		if (options.icon !== void 0) annot.setIcon(options.icon);
+		return annot;
+	}
+	/**
+	* Create a PdfFileAttachmentAnnotation from an existing dictionary.
+	*/
+	static fromDict(dict, _resolver) {
+		return new PdfFileAttachmentAnnotation(dict);
+	}
+	/** Get the icon name. Defaults to 'GraphPushPin'. */
+	getIcon() {
+		const obj = this.dict.get("/Name");
+		if (obj && obj.kind === "name") {
+			const val = obj.value.startsWith("/") ? obj.value.slice(1) : obj.value;
+			if ([
+				"GraphPushPin",
+				"PaperclipTag",
+				"Paperclip",
+				"Tag"
+			].includes(val)) return val;
+		}
+		return "GraphPushPin";
+	}
+	/** Set the icon name. */
+	setIcon(icon) {
+		this.dict.set("/Name", require_pdfCatalog.PdfName.of(icon));
+	}
+	/** Get the filename, if set. */
+	getFileName() {
+		const fs = this.dict.get("/FS");
+		if (fs && fs.kind === "dict") {
+			const uf = fs.get("/UF");
+			if (uf && uf.kind === "string") return uf.value;
+			const f = fs.get("/F");
+			if (f && f.kind === "string") return f.value;
+		}
+		return this.fileName;
+	}
+	/**
+	* Build the file specification dictionary and register the embedded
+	* file stream. Call this before serializing the annotation.
+	*
+	* @param registry  The document's object registry.
+	* @returns  The annotation dict with `/FS` referencing the file.
+	*/
+	buildFileSpec(registry) {
+		if (!this.fileData || !this.fileName) return this.dict;
+		const efStreamDict = new require_pdfCatalog.PdfDict();
+		efStreamDict.set("/Type", require_pdfCatalog.PdfName.of("EmbeddedFile"));
+		if (this.mimeType) efStreamDict.set("/Subtype", require_pdfCatalog.PdfName.of(this.mimeType.replace("/", "#2F")));
+		const params = new require_pdfCatalog.PdfDict();
+		params.set("/Size", require_pdfCatalog.PdfNumber.of(this.fileData.length));
+		efStreamDict.set("/Params", params);
+		const efStream = new require_pdfCatalog.PdfStream(efStreamDict, this.fileData);
+		const efRef = registry.register(efStream);
+		const efDict = new require_pdfCatalog.PdfDict();
+		efDict.set("/F", efRef);
+		const fsDict = new require_pdfCatalog.PdfDict();
+		fsDict.set("/Type", require_pdfCatalog.PdfName.of("Filespec"));
+		fsDict.set("/F", require_pdfCatalog.PdfString.literal(this.fileName));
+		fsDict.set("/UF", require_pdfCatalog.PdfString.literal(this.fileName));
+		fsDict.set("/EF", efDict);
+		if (this.fileDescription) fsDict.set("/Desc", require_pdfCatalog.PdfString.literal(this.fileDescription));
+		const fsRef = registry.register(fsDict);
+		this.dict.set("/FS", fsRef);
+		return this.dict;
+	}
+};
+
 //#endregion
 //#region src/parser/textExtractor.ts
 /**
@@ -23853,6 +24345,339 @@ function addTrailerId(data) {
 	return concatBytes(...parts);
 }
 
+//#endregion
+//#region src/assets/image/imageOptimize.ts
+/**
+* Downscale an image to fit within the specified dimensions.
+*
+* If the image is already smaller than the target dimensions, it is
+* returned unchanged.
+*
+* @param image   - The raw image pixel data.
+* @param options - Downscaling options (target dimensions, algorithm).
+* @returns The downscaled image, or the original if no scaling needed.
+*
+* @example
+* ```ts
+* const result = downscaleImage(rawImage, {
+*   maxWidth: 1024,
+*   maxHeight: 768,
+*   algorithm: 'bilinear',
+* });
+* ```
+*/
+function downscaleImage(image, options = {}) {
+	const target = computeTargetDimensions(image.width, image.height, options);
+	if (target.width >= image.width && target.height >= image.height) return image;
+	switch (options.algorithm ?? "bilinear") {
+		case "nearest": return resampleNearest(image, target.width, target.height);
+		case "bilinear": return resampleBilinear(image, target.width, target.height);
+		case "lanczos": return resampleLanczos(image, target.width, target.height);
+		default: return resampleBilinear(image, target.width, target.height);
+	}
+}
+/**
+* Recompress raw image pixel data using the specified format.
+*
+* @param image   - The raw image pixel data.
+* @param options - Recompression options (format, quality).
+* @returns The compressed image data.
+*
+* @example
+* ```ts
+* const result = await recompressImage(rawImage, {
+*   format: 'deflate',
+*   compressionLevel: 9,
+* });
+* ```
+*/
+async function recompressImage(image, options = {}) {
+	switch (options.format ?? "deflate") {
+		case "deflate": return recompressDeflate(image, options.compressionLevel ?? 6);
+		case "jpeg": return recompressJpeg(image, options.quality ?? 85);
+		default: return {
+			data: image.pixels,
+			width: image.width,
+			height: image.height,
+			channels: image.channels,
+			format: "raw",
+			wasOptimized: false
+		};
+	}
+}
+/**
+* Run the full image optimization pipeline: downscale then recompress.
+*
+* @param image   - The raw image pixel data.
+* @param options - Combined optimization options.
+* @returns The optimized result.
+*/
+async function optimizeImage(image, options = {}) {
+	if (options.skipBelowBytes && image.pixels.length < options.skipBelowBytes) return {
+		data: image.pixels,
+		width: image.width,
+		height: image.height,
+		channels: image.channels,
+		format: "raw",
+		wasOptimized: false
+	};
+	return recompressImage(downscaleImage(image, options), options);
+}
+/**
+* Compute target dimensions from options, preserving aspect ratio.
+* @internal
+*/
+function computeTargetDimensions(srcWidth, srcHeight, options) {
+	let targetWidth = srcWidth;
+	let targetHeight = srcHeight;
+	if (options.targetDpi && options.printWidth && options.printHeight) {
+		const printWidthInches = options.printWidth / 72;
+		const printHeightInches = options.printHeight / 72;
+		const dpiWidth = Math.round(printWidthInches * options.targetDpi);
+		const dpiHeight = Math.round(printHeightInches * options.targetDpi);
+		targetWidth = Math.min(targetWidth, dpiWidth);
+		targetHeight = Math.min(targetHeight, dpiHeight);
+	}
+	if (options.maxWidth && targetWidth > options.maxWidth) {
+		const scale = options.maxWidth / targetWidth;
+		targetWidth = options.maxWidth;
+		targetHeight = Math.round(targetHeight * scale);
+	}
+	if (options.maxHeight && targetHeight > options.maxHeight) {
+		const scale = options.maxHeight / targetHeight;
+		targetHeight = options.maxHeight;
+		targetWidth = Math.round(targetWidth * scale);
+	}
+	targetWidth = Math.max(1, targetWidth);
+	targetHeight = Math.max(1, targetHeight);
+	return {
+		width: targetWidth,
+		height: targetHeight
+	};
+}
+/**
+* Nearest-neighbor resampling.
+* @internal
+*/
+function resampleNearest(src, dstWidth, dstHeight) {
+	const channels = src.channels;
+	const dst = new Uint8Array(dstWidth * dstHeight * channels);
+	const xRatio = src.width / dstWidth;
+	const yRatio = src.height / dstHeight;
+	for (let y = 0; y < dstHeight; y++) {
+		const srcY = Math.min(Math.floor(y * yRatio), src.height - 1);
+		for (let x = 0; x < dstWidth; x++) {
+			const srcX = Math.min(Math.floor(x * xRatio), src.width - 1);
+			const srcIdx = (srcY * src.width + srcX) * channels;
+			const dstIdx = (y * dstWidth + x) * channels;
+			for (let c = 0; c < channels; c++) dst[dstIdx + c] = src.pixels[srcIdx + c];
+		}
+	}
+	return {
+		pixels: dst,
+		width: dstWidth,
+		height: dstHeight,
+		channels,
+		bitsPerChannel: src.bitsPerChannel
+	};
+}
+/**
+* Bilinear interpolation resampling.
+* @internal
+*/
+function resampleBilinear(src, dstWidth, dstHeight) {
+	const channels = src.channels;
+	const dst = new Uint8Array(dstWidth * dstHeight * channels);
+	const xRatio = (src.width - 1) / Math.max(1, dstWidth - 1);
+	const yRatio = (src.height - 1) / Math.max(1, dstHeight - 1);
+	for (let y = 0; y < dstHeight; y++) {
+		const srcYf = y * yRatio;
+		const srcY0 = Math.floor(srcYf);
+		const srcY1 = Math.min(srcY0 + 1, src.height - 1);
+		const yFrac = srcYf - srcY0;
+		for (let x = 0; x < dstWidth; x++) {
+			const srcXf = x * xRatio;
+			const srcX0 = Math.floor(srcXf);
+			const srcX1 = Math.min(srcX0 + 1, src.width - 1);
+			const xFrac = srcXf - srcX0;
+			const dstIdx = (y * dstWidth + x) * channels;
+			for (let c = 0; c < channels; c++) {
+				const topLeft = src.pixels[(srcY0 * src.width + srcX0) * channels + c];
+				const topRight = src.pixels[(srcY0 * src.width + srcX1) * channels + c];
+				const bottomLeft = src.pixels[(srcY1 * src.width + srcX0) * channels + c];
+				const bottomRight = src.pixels[(srcY1 * src.width + srcX1) * channels + c];
+				const top = topLeft + (topRight - topLeft) * xFrac;
+				const value = top + (bottomLeft + (bottomRight - bottomLeft) * xFrac - top) * yFrac;
+				dst[dstIdx + c] = Math.round(Math.max(0, Math.min(255, value)));
+			}
+		}
+	}
+	return {
+		pixels: dst,
+		width: dstWidth,
+		height: dstHeight,
+		channels,
+		bitsPerChannel: src.bitsPerChannel
+	};
+}
+/**
+* Lanczos kernel function.
+*
+* Computes the Lanczos windowed sinc value for a given distance `x`
+* and window size `a`. For Lanczos-3, `a = 3`.
+*
+* @param x - Distance from the center sample.
+* @param a - Window radius (3 for Lanczos-3).
+* @returns   The kernel weight.
+* @internal
+*/
+function lanczos(x, a = 3) {
+	if (x === 0) return 1;
+	if (Math.abs(x) >= a) return 0;
+	const pix = Math.PI * x;
+	return Math.sin(pix) / pix * (Math.sin(pix / a) / (pix / a));
+}
+/**
+* Lanczos-3 resampling.
+*
+* Uses a 6-tap (a=3) windowed sinc filter in both dimensions for
+* high-quality downscaling. This is the best quality option but
+* also the slowest.
+*
+* @internal
+*/
+function resampleLanczos(src, dstWidth, dstHeight) {
+	const channels = src.channels;
+	const a = 3;
+	const dst = new Uint8Array(dstWidth * dstHeight * channels);
+	const xRatio = src.width / dstWidth;
+	const yRatio = src.height / dstHeight;
+	for (let y = 0; y < dstHeight; y++) {
+		const srcYf = (y + .5) * yRatio - .5;
+		for (let x = 0; x < dstWidth; x++) {
+			const srcXf = (x + .5) * xRatio - .5;
+			const dstIdx = (y * dstWidth + x) * channels;
+			const sum = new Float64Array(channels);
+			let weightSum = 0;
+			const yStart = Math.floor(srcYf) - a + 1;
+			const yEnd = Math.floor(srcYf) + a;
+			const xStart = Math.floor(srcXf) - a + 1;
+			const xEnd = Math.floor(srcXf) + a;
+			for (let sy = yStart; sy <= yEnd; sy++) {
+				const wy = lanczos(srcYf - sy, a);
+				if (wy === 0) continue;
+				const clampedY = Math.max(0, Math.min(src.height - 1, sy));
+				for (let sx = xStart; sx <= xEnd; sx++) {
+					const wx = lanczos(srcXf - sx, a);
+					if (wx === 0) continue;
+					const w = wx * wy;
+					const clampedX = Math.max(0, Math.min(src.width - 1, sx));
+					const srcIdx = (clampedY * src.width + clampedX) * channels;
+					for (let c = 0; c < channels; c++) sum[c] = (sum[c] ?? 0) + src.pixels[srcIdx + c] * w;
+					weightSum += w;
+				}
+			}
+			if (weightSum > 0) for (let c = 0; c < channels; c++) dst[dstIdx + c] = Math.round(Math.max(0, Math.min(255, sum[c] / weightSum)));
+		}
+	}
+	return {
+		pixels: dst,
+		width: dstWidth,
+		height: dstHeight,
+		channels,
+		bitsPerChannel: src.bitsPerChannel
+	};
+}
+/**
+* Recompress image data using deflate (for PDF FlateDecode).
+* @internal
+*/
+async function recompressDeflate(image, level) {
+	if (typeof CompressionStream !== "undefined") {
+		const cs = new CompressionStream("deflate");
+		const writer = cs.writable.getWriter();
+		const reader = cs.readable.getReader();
+		const chunks = [];
+		writer.write(new Uint8Array(image.pixels)).catch(() => {});
+		writer.close().catch(() => {});
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			chunks.push(value);
+		}
+		const totalLength = chunks.reduce((sum, c) => sum + c.length, 0);
+		const result = new Uint8Array(totalLength);
+		let pos = 0;
+		for (const chunk of chunks) {
+			result.set(chunk, pos);
+			pos += chunk.length;
+		}
+		return {
+			data: result,
+			width: image.width,
+			height: image.height,
+			channels: image.channels,
+			format: "deflate",
+			wasOptimized: true
+		};
+	}
+	try {
+		const { deflateSync } = await import("fflate");
+		return {
+			data: deflateSync(image.pixels, { level }),
+			width: image.width,
+			height: image.height,
+			channels: image.channels,
+			format: "deflate",
+			wasOptimized: true
+		};
+	} catch {
+		return {
+			data: image.pixels,
+			width: image.width,
+			height: image.height,
+			channels: image.channels,
+			format: "raw",
+			wasOptimized: false
+		};
+	}
+}
+/**
+* Recompress image data as JPEG.
+* @internal
+*/
+/**
+* Recompress image data as JPEG.
+*
+* JPEG encoding in pure JS is complex (DCT, Huffman coding, quantization).
+* A full implementation requires either:
+*
+* 1. **WASM-based encoder** (preferred) -- compile libjpeg-turbo or mozjpeg
+*    to WASM, feed raw pixels, get JPEG bytes back.
+* 2. **Canvas API** (browser-only fallback) -- use `OffscreenCanvas` with
+*    `convertToBlob({ type: 'image/jpeg', quality })`.
+* 3. **Pure JS encoder** (last resort) -- very slow but works everywhere.
+*
+* Until a WASM encoder module is bundled, this function returns the input
+* data unchanged. The caller receives `format: 'raw'` and
+* `wasOptimized: false` to indicate that JPEG encoding was not applied.
+*
+* @param image   - The raw image pixel data.
+* @param quality - JPEG quality 1-100 (reserved for future use).
+* @returns         The input data as-is, marked as un-optimized.
+* @internal
+*/
+async function recompressJpeg(image, quality) {
+	return {
+		data: image.pixels,
+		width: image.width,
+		height: image.height,
+		channels: image.channels,
+		format: "raw",
+		wasOptimized: false
+	};
+}
+
 //#endregion
 //#region src/errors.ts
 /**
@@ -24060,6 +24885,7 @@ exports.PdfAnnotation = require_pdfPage.PdfAnnotation;
 exports.PdfArray = require_pdfCatalog.PdfArray;
 exports.PdfBool = require_pdfCatalog.PdfBool;
 exports.PdfButtonField = PdfButtonField;
+exports.PdfCaretAnnotation = PdfCaretAnnotation;
 exports.PdfCheckboxField = PdfCheckboxField;
 exports.PdfCircleAnnotation = PdfCircleAnnotation;
 exports.PdfDict = require_pdfCatalog.PdfDict;
@@ -24067,6 +24893,7 @@ exports.PdfDocument = PdfDocument;
 exports.PdfDropdownField = PdfDropdownField;
 exports.PdfEncryptionHandler = PdfEncryptionHandler;
 exports.PdfField = PdfField;
+exports.PdfFileAttachmentAnnotation = PdfFileAttachmentAnnotation;
 exports.PdfForm = PdfForm;
 exports.PdfFreeTextAnnotation = PdfFreeTextAnnotation;
 exports.PdfHighlightAnnotation = PdfHighlightAnnotation;
@@ -24086,6 +24913,7 @@ exports.PdfPage = require_pdfPage.PdfPage;
 exports.PdfParseError = PdfParseError;
 exports.PdfPolyLineAnnotation = PdfPolyLineAnnotation;
 exports.PdfPolygonAnnotation = PdfPolygonAnnotation;
+exports.PdfPopupAnnotation = PdfPopupAnnotation;
 exports.PdfRadioGroup = PdfRadioGroup;
 exports.PdfRedactAnnotation = PdfRedactAnnotation;
 exports.PdfRef = require_pdfCatalog.PdfRef;
@@ -24172,6 +25000,7 @@ exports.decodePermissions = decodePermissions;
 exports.decodeStream = decodeStream;
 exports.degrees = require_pdfPage.degrees;
 exports.degreesToRadians = require_pdfPage.degreesToRadians;
+exports.downscaleImage = downscaleImage;
 exports.drawImageWithMatrix = require_pdfPage.drawImageWithMatrix;
 exports.drawImageXObject = require_pdfPage.drawImageXObject;
 exports.drawObject = require_pdfPage.drawXObject;
@@ -24249,6 +25078,7 @@ exports.moveTextOp = require_pdfPage.moveText;
 exports.moveTextSetLeading = require_pdfPage.moveTextSetLeading;
 exports.moveToOp = require_pdfPage.moveTo;
 exports.nextLineOp = require_pdfPage.nextLine;
+exports.optimizeImage = optimizeImage;
 exports.parseContentStream = parseContentStream;
 exports.parseSvg = require_pdfPage.parseSvg;
 exports.parseSvgColor = require_pdfPage.parseSvgColor;
@@ -24264,6 +25094,7 @@ exports.radialGradient = require_pdfPage.radialGradient;
 exports.radians = require_pdfPage.radians;
 exports.radiansToDegrees = require_pdfPage.radiansToDegrees;
 exports.rc4 = rc4;
+exports.recompressImage = recompressImage;
 exports.rectangleOp = require_pdfPage.rectangle;
 exports.removePage = removePage;
 exports.removePages = removePages;